- cypherpunks-legacy - lists.cpunks.org

Re: Electronic Banking
by richard_mezirka＠askinc.ask.com 26 Nov '92

26 Nov '92

IRS regulations related to 1099-b and 1099-misc make it LEGAL providing all parties and the BANK file with the IRS. Bank MUST file when over 100 transactions per year are recirded. Individuals must file each transaction. Add some rules for mandatrory electronic filing when movre than 500 (I think that's the limit) transactions are posted. ZAdd another hassle with mandatory 20% of value must be withheld and filed with IRS inlieu of taxes... (reference 1992 IRS publication on 1099 processing, pages 10-12... pub number available on request)(I left my copy at the office). As I told Tim, this smack s of Al Capone like harassment... "We''' make it WORSE if we catch you" BUT I have personal experience with IRS in 1980, 81, 82 as they attacked barter (I designed and developed software for an electronic settlement system for Trade Systems Corporation in San Jose; we did about 4 million/year unitl the IRS audits startedf and then all big players got tax attacked). for those without experience with our IRS, remember they do not live within our regulary judiciary (innocent until proven guilty) system with open courts... they seize first and have a closed hearing system underwhich you get to negotiate a settlement to get YOUR stuff back, maybe. (references available upon request). They use local marshalls with large guns and IRS judical orededers to tsake what everthey thiink they are due. Again, as I told Tim, we should continue our public discussion of the principles we hold dear and continue our efforts at preventing further erosion. We should also be very careful about stepping on the dragons' tails until we are privacy protected... principlesa nd theorey public, practice and tactics private. spreading the sanity, quietly Rich

1 0

Re: Electronic Banking
by tony＠morgan.demon.co.uk 26 Nov '92

26 Nov '92

In message <9211252219.AA00550(a)netcom.netcom.com> you write: > > Warning! Recently, a bunch of bowlers (women, no less) were busted for > illegal gambling because of their "pot" they were bowling for. After > much public outcry and laughter at the authorities, the charges were > either dropped or reduced. I mention this because casual bowlers evoke > sympathy, hackers and cypherpunks do not. Using the net, the 'banker' could easily be 'offshore' and not subject to US law in these matters. After all the internet reaches into Canada and obviously (from my point of view) to the UK. I think a more real problem with anonymous banking, is not one of 'trust' in the 'banker' but in his net access. What do you do when your banker, for whatever reason, becomes unreachable? Regards Tony ------------------+-------------------------------+--------------------------+ | Tony Kidson |`morgan' is an 8MB 486/33 Cat-| Voice +44 81 466 5127 | | Morgan Towers, |Warmer with a 670 MB Hard Disk.| E-Mail | | Morgan Road, |It resides at Morgan Towers in| tony(a)morgan.demon.co.uk | | Bromley, |Beautiful Down Town Bromley. | tny(a)cix.compulink.co.uk | | England BR1 3QE | -=<*>=- | 100024.301(a)compuserve.com| +=================+===============================+==========================+

2 1

Re: RS232 Crypto Dongle (idea for widely accessible crypto technology)
by George A. Gleason 26 Nov '92

26 Nov '92

Re Phil's items on the Crypto-Dongle. I'm in favor of a device having a keypad for PIN entry, with a fail --> destroy function. Making it small enough to be kept on one's person all the time, virtually guarantees other manufacturing compromises which would result in degraded reliability or increased potential for physical breakage. It should not be necessary to carry it on you; in any case, possession of one might raise eyebrows in some quarters. I believe that carrying out the entire crypto operation in the dongle is preferable to having it only do the secret key RSA processing; if for no other reason, compatibility problems that might result in creation of platform-specific dongles. Better to have one Universal Dongle that needs only a platform-specific user interface. The dongle (suggested brand name: Codepack) could also be sold as a sort of blank slate into which a user would load his preferred crypto software. Now we have a generic product which can be sold over the counter without prescription, as it were. -gg

1 0

Re: PGP on local machine (was Re: MacPGP)
by George A. Gleason 26 Nov '92

26 Nov '92

Eli discussed some ideas regarding online encryption... it suddenly occurred to me that if you were connected to the phone line while doing your crypto processing, it's entirely possible that some signal would leak through and if your phone line was being monitored, the nastie-wasties would get the whole thing including your private key. Uh-oh, very bad. Thus the need for some kind of hardware device which isolates the line and all that. Perhaps a specifically cryptographic modem as has been proposed by others here. And perhaps a tweak in the software which requires that the user set these options manually at some point, where a warning message would occur to say, "don't do on-line crypto unless you have (one of the protected modems)." -gg

1 0

Re: How far is to far?
by George A. Gleason 26 Nov '92

26 Nov '92

Miron Cuperman responds to my concerns about the IRS's claims on barter systems by saying, "How do you think the IRS is going to trace those banks and customers behind all the anon mixes?" I must really disagree here. If we start sneaking around in the shadows of legality, we will eventually bring down some nasty attention which will not help us. Privacy itself is a mainstream issue. Dumping all forms of taxes is not a mainstream issue, in fact the mainstream regards tax resisters as fringies of the worst order. This is not to debate the merits of the substantive issues involved, just to recognise the major PR problem which exists and say I believe we should stick to the main issue. I for one don't want the Feds to have an excuse to lock up the whole net or our little fragments of it. We can minimise taxation and stay completely within the law by operating as a volunteer not-for-profit network. And then if the Feds come down on us for using unregistered crypto keys, we have a new issue that the public haven't become jaded over, which can be made much of in the media. And I would also say that it's not good to give potential adversaries an excuse for saying we're doing crypto simply in order to hide illegal activities such as "tax cheating" or whatever; next it will be dope and kiddie porn and bank robbery via ISDN, eh...? -gg

1 0

Failed Fail Report
by Postmaster 26 Nov '92

26 Nov '92

The enclosed fail report failed to reach it's intended recipient because of the use of the unbracketed IP number. HOWEVER, surely there should be a -request address for cypherpunks to which should be in the Sender: field so that fail reports go back to the list maintainer and not the originator of the article. Tim Brooks Postmaster((a)uk.ac.cam.ucs, @uk.ac.cam.phx, @uk.ac.cam.cus, @uk.ac.cam.ppsw) Postmaster((a)ucs.cam.ac.uk, @phx.cam.ac.uk, @cus.cam.ac.uk, @ppsw.cam.ac.uk) University of Cambridge Computing Service Tel: 0223-334709, Int: +44 223 334709 New Museums Site Fax: 0223-334678, Int: +44 223 334678 Pembroke Street Telex: 81240 CAMSPL G CAMBRIDGE E-Mail(JNT): T.Brooks(a)UK.AC.Cam.UCS CB2 3QG United Kingdom "(Internet): T.Brooks(a)UCS.Cam.AC.UK X.400: /I=T/S=Brooks/OU=Computing-Service/O=Cambridge/PRMD=UK.AC/ADMD= /C=GB/ > Accepted: 17:57:03 25 Nov 92 > Submitted: 17:29:12 25 Nov 92 > IPMessageId: <"ppsw1.cam..157:25.10.92.17.28.53"@ppsw.cam.ac.uk> > From: MAIL-DAEMON <postmaster(a)uk.ac.cam.ppsw> > To: FAILREPTER(a)uk.ac.cam.phx > Subject: Delivery Report (failure) for fnerd(a)192.9.200.3 > Received: from ppsw.cam.ac.uk by ppsw1.cam.ac.uk id <05165-0(a)ppsw1.cam.ac.uk>; > Wed, 25 Nov 1992 17:29:12 +0000 > Message-Type: Delivery Report > Content-Identifier: Fail Report > > ------------------------------ Start of body part 1 > > This report relates to your message: Subject: Fail Report, > Message-ID: <A6A5DE7C97F29040(a)UK.AC.CAMBRIDGE.PHOENIX>, > To: fnerd(a)192.9.200.3 > of Wed, 25 Nov 1992 17:28:52 +0000 > > Your message was not delivered to fnerd(a)192.9.200.3 > for the following reason: > Unknown Address > Unknown domain '192.9.200.3' > > ***** The following information is directed towards the local administrator > ***** and is not intended for the end user > * > * DR generated by: mta ppsw1.cam.ac.uk > * in /PRMD=UK.AC/ADMD= /C=GB/ > * at Wed, 25 Nov 1992 17:28:53 +0000 > * > * Converted to RFC 822 at uk.ac.cam.ppsw1 > * at Wed, 25 Nov 1992 17:29:12 +0000 > * > * Delivery Report Contents: > * > * Subject-Submission-Identifier: [/PRMD=UK.AC/ADMD= /C=GB/;<A6A5DE7C97F29040(a)UK.AC.CAMBRIDG] > * Content-Identifier: Fail Report > * Subject-Intermediate-Trace-Information: /PRMD=UK.AC/ADMD= /C=GB/arrival Wed, 25 Nov 1992 17:28:52 +0000 action Relayed > * Subject-Intermediate-Trace-Information: /PRMD=UK.AC/ADMD= /C=GB/arrival Wed, 25 Nov 1992 17:28:40 +0000 action Relayed > * Content-Correlator: Subject: Fail Report, > * Message-ID: <A6A5DE7C97F29040(a)UK.AC.CAMBRIDGE.PHOENIX>, > * To: fnerd(a)192.9.200.3* Recipient-Info: fnerd(a)192.9.200.3, > * /RFC-822=fnerd(a)192.9.200.3/OU=PP Switch/O=Cambridge University/PRMD=UK.AC/ADMD= /C=GB/; > * FAILURE reason Unable-To-Transfer (1); > * diagnostic Unrecognised-ORName (0); > * last trace (ia5 text (2)) Wed, 25 Nov 1992 17:28:40 +0000; > * converted eits ia5 text (2); > * supplementary info "Unknown domain '192.9.200.3'"; > ****** End of administration information > > ------------------------------ Start of forwarded message 1 > > Received: from phx.cam.ac.uk by ppsw1.cam.ac.uk > with NIFTP (PP-6.0) Cambridge as ppsw.cam.ac.uk > id <05157-0(a)ppsw1.cam.ac.uk>; Wed, 25 Nov 1992 17:28:53 +0000 > Date: Wed, 25 Nov 92 17:28:40 GMT > To: fnerd(a)192.9.200.3 > From: Mail Server <FAILREPTER(a)uk.ac.cam.phx> > Subject: Fail Report > Message-ID: <A6A5DE7C97F29040(a)UK.AC.CAMBRIDGE.PHOENIX> > > Your message was not delivered to one or more of: > LI10000(a)uk.ac.cam.phx > > Recipient has too many outstanding messages in message store: 'LI10000(a)UK.AC.CAM.PHX' > No valid recipients in JNT header > > Failed message follows: > > Received: from relay2.UU.NET by ppsw1.cam.ac.uk > with SMTP (PP-6.0) International as ppsw.cam.ac.uk > id <05143-0(a)ppsw1.cam.ac.uk>; Wed, 25 Nov 1992 17:28:32 +0000 > Received: from toad.com by relay2.UU.NET > with SMTP (5.61/UUNET-internet-primary) id AA07054; > Wed, 25 Nov 92 12:20:09 -0500 > Received: from cygnus.com by toad.com id AA12348; Wed, 25 Nov 92 09:17:33 PST > Received: from relay2.UU.NET by cygnus.com (4.1/SMI-4.1) id AA26873; > Wed, 25 Nov 92 09:17:10 PST > Received: from uunet.uu.net (via LOCALHOST.UU.NET) by relay2.UU.NET > with SMTP (5.61/UUNET-internet-primary) id AA05539; > Wed, 25 Nov 92 12:15:15 -0500 > Received: from smds.UUCP by uunet.uu.net with UUCP/RMAIL (queueing-rmail) > id 121431.10955; Wed, 25 Nov 1992 12:14:31 EST > Received: from waldo by smds.com (4.1/SMI-4.1) id AB05506; > Wed, 25 Nov 92 11:29:04 EST > Message-Id: <9211251629.AB05506(a)smds.com> > Sender: fnerd(a)192.9.200.3 > Date: Wed, 25 Nov 1992 12:40:24 -0800 > To: cypherpunks(a)com.toad > From: fnerd(a)com.smds (FutureNerd Steve Witham) > Subject: Re: Random Numbers Boxes and Cypher Processers > > >Why do encryption in the modem instead of the host cpu? > > A point that hasn't been made painfully clear yet: "DSP--Digital > Signal Processor" chips are really just fast processors for repetitious > arithmetic--just what RSA needs. Maybe some experience in > programming them for that sort of purpose would be useful. > > - -fnerd > fnerd(a)smds.com (FutureNerd Steve Witham) > > > ------------------------------ End of forwarded message 1

1 0

Remailer at rebma
by rebma!rebma!wmo＠kksys.mn.org 26 Nov '92

26 Nov '92

I've got Hal's PGP mods to the remailer code installed on rebma. The remailer is remailer(a)rebma.mn.org, and the PGP key to use is: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.0 mQCNAisUI2QAAAEEAKgm07Hsje5KpmXYd5azk0R6AES+qK7LcofnVGojUs7GBghD WbwrmW8oOEOhRorlShRALKeYspV4xYIw4WDkJcJxuf1B254scz1urF/Eem3zPW9b yPAx7W/cGwvs6SouZvFcSDq4v1zApvGE9hP4szPzHeGmVr0NVNeaDK0guoCpAAUR tCBSZW1haWxlciAocmVtYWlsZXJAcmVibWEubW4ub3JnKQ== =/qHx -----END PGP PUBLIC KEY BLOCK----- See Hal's previous messages for how to use the remailer, or write me, and I'll dig his messages up. I liked Fen's idea about bartering remailers. I'm all for it. -Bill -- Bill O'Hanlon wmo(a)rebma.mn.org

1 0

No Subject
by fen＠genmagic.com 26 Nov '92

26 Nov '92

On the issue of digital cash and remailers tcmay writes: >Banks, escrow services, etc. will all have "reputations"... Note that a good reputation is good as gold. Now, when I get my remailer up and running, I'll run it for a while in "free mode" (while I get the bugs out) and then I'll put it into "reputation sharing mode" which works as follows: Every time I get a message to be re-mailed, I remember the sender's site name. Later, when I desire to mail something, I may choose to send it through that site. If operating in free mode, it passes through. If it is not a remailer or doesn't accept my message (via a bounce) I take it off my list of friendly mailers and and begin bouncing messages that it sends to me. This should, of course, all happen automagically. I realize that I am describing this somewhat poorly (it's late and I'm tired) but the basic concept is to get everuyone who wants to send mail through a re-mailer to become a remailer, or perhaps buy "friendship" with one through external means. This propogates remailers. The simplest form of barter is one for one. Fen

1 0

Sharp Wizard as a Crypto Dongle?
by tcmay＠netcom.com 26 Nov '92

26 Nov '92

All the interesting discussion of building RS-232 crypto dongles, notably the proposal of Yanek Martinson, remind me of the idea kicking around of simply programming a Sharp Wizard (or Casio B.O.S.S., etc.) to do the same function. (And eventually much of our critical encryption will likely be done on more powerful devices like the Apple Newton, General Magic gizmo, and Eo thingamajig.) These devices have several advantages: 1. Cheap. $150 or less. 2. No construction required. 3. Not likely to have trapdoors or other limits, at least not in the hardware, or in the units you buy today at your local electronics superstore. 4. RS-232 connections for PCs, Macs, etc. (used to be as an add-on, now often bundled with the units). 5. LCD display, keypad, etc. (some of the features Yanek was envisioning in later models of his dongle). 6. A fairly slow CPU, but one which is well-integrated with the other features (and which saves us the effort of designing and debugging). 7. Some have PCMCIA capabilities. 8. They can be used for other thingss when not being used as a dongle. 9. New versions of the software (e.g., PGP 3.21) can be added more easily, I suspect, than in a custom-built RS-232 dongle. 10. It is unlikely the NSA, FBI, or Patent Office could "ban" such devices, as they are already widely deployed. Only the specific programs that make them act as crypto dongles would be "bannable," and I doubt this could be enforced. By the way, the same arguments could be applied to using cellular telephones as the base for building/programming portable, personal crypto devices. (An exciting talk at Hackers on mods to Oki 900 cellphones was an eye-opener.) I don't think an easy interface to RS-232 ports exists, but I know some cellphones interface to computers (the Oki 900 above sure did). --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP Public Key: by arrangement.

2 1

using personal organizers or palmtops for crypto
by yanek＠novavax.nova.edu 26 Nov '92

26 Nov '92

> notably the proposal of Yanek Martinson, remind me of the idea kicking > around of simply programming a Sharp Wizard (or Casio B.O.S.S., etc.) > to do the same function. I have thought of that before. Actually, I was thinking of using a notebook computer with 2 serial ports as a prototype/proof of concept. > These devices have several advantages: True. But there are also disadvantages: They generally don't have two serial ports. This may not seem like much, but is actually a serius problem. Since they tend to have small screens, weak keyboards, and not the greatest comm software, you might not like using it as your window into the cyberspace. The advantage of a standalone device with two rs232 ports is that you can continue to use your existing terminal, pc or a mac, along with all its conveniences. > 1. Cheap. $150 or less. I hope to make my device in this price range or less. I can not be sure yet because I don't have a definite hardware design completed, but that is the range I am aiming for. I don't know, maybe I am unrealistic, but I think that in kit form it could be significantly under $100. > 2. No construction required. If this idea ever takes off in a big way (about a hundred orders or so) then I have an electronics company that could build them for me. > 3. Not likely to have trapdoors or other limits, at least not in the > hardware, or in the units you buy today at your local electronics While they may not have any intentional trapdoors, since you don't have the full design specs, you can never be sure of everything that is going on within the machine. For example, if in my device I have a section of memory that holds the private key, and I clear it (overwrite with nulls) then I can be reasonably sure that if someone was to get the device they would not be able to retrieve the private key from anywhere. In a machine such as a Wizard, you never know where the number may end up, for example in some area of memory used for the auto-resume feature or some kind of cache. If a device was not designed with security in mind it is likely to be insecure. > 6. A fairly slow CPU, Might severely limit the length of keys you can handle, therefore the level of your security. > 7. Some have PCMCIA capabilities. See my previous post on why PCMCIA is not a very good choice of technology for this purpose. > 9. New versions of the software (e.g., PGP 3.21) can be added more > easily, I suspect, than in a custom-built RS-232 dongle. I plan to build it as a generic processor with two RS-232 ports. All the crypto stuff would be handled in software. So to cope with new formats, etc. all you would need to do is reprogram the EPROM. This is completely unrelated to the topic at hand, but: > By the way, the same arguments could be applied to using cellular > telephones as the base for building/programming portable, personal > crypto devices. (An exciting talk at Hackers on mods to Oki 900 > cellphones was an eye-opener.) I don't think an easy interface to > RS-232 ports exists, but I know some cellphones interface to computers > (the Oki 900 above sure did). What interfaced to the computer was the control functions (dial, signaling, etc.) It sure was fun and useful, but not nearly enough to make a secure telephone. The actual speech (that which you are trying to encrypt) is never actually digitized.... -- Yanek Martinson mthvax.cs.miami.edu!safe0!yanek uunet!medexam!yanek this address preferred -->> yanek(a)novavax.nova.edu <<-- this address preferred Phone (305) 765-6300 daytime FAX: (305) 765-6708 1321 N 65 Way/Hollywood (305) 963-1931 evenings (305) 981-9812 Florida, 33024-5819

1 0