- cypherpunks-legacy - lists.cpunks.org

Re: PC disk wipe software
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Responding to msg by bdavis(a)dg.thepoint.net (Brian Davis) on Tue, 10 Oct 10:47 AM >FYI the Justice Department requires degaussing a hard >drive before it can be declared surplus ... ----- The Washington Post, Oct 9, 1995. E-Mail That Comes Back And Bites. Even Deleted Messages Can Be Recovered for Court [excerpts] Computer sleuth John Jessen dredges computer files for electronic embarrassments that their authors thought were long gone. "Deleted" e-mail messages can pile up like little time bombs until someone such as Jessen arrives, carrying a court order and a stack of blank memory cartridges. "Can you really delete e-mail? Sure," Jessen said. "Does it happen as a common practice? No." Jessen is the founder of Electronic Evidence Discovery Inc., a Seattle company that since 1987 has been going after computer evidence in civil lawsuits. The nation's 25 million to 40 million users of e-mail are growing more comfortable with the medium. And more attorneys are recognizing e-mail's potential as a source of unguarded information about the companies they're suing. "People are very candid talking around the coffee machine." attorney Michael Patrick of Palo Alto, Calif., said. "They seem to behave the same way on the computer system. "They think they're speaking confidentially, so they're off the cuff," he said. "They're very often insulting. What they don't realize is it's all being recorded, and often those recordings are stored for a very long time. When you send a message, you lose control over where it goes." Many workers think their e-mail is private. It's not. Federal law allows employers to monitor employees' e-mail, and even if they don't, e-mail is fair game in lawsuits. When someone sues a company, the rules of discovery demand that the company produce all relevant business records. "The fact that they live in a computer rather than a file cabinet doesn't make any difference to the court," said Joan Feldman at Computer Forensics, another Seattle firm that specializes in this work. Often files retrieved include e-mail thought to have been erased long ago. It survives because the diligent computer system manager makes backup tapes of everything on the system every night, then stores those tapes for years. And so the files persist and multiply, aided by technological advances that continually add more storage capacity, more automatic backups and more redundancies to safeguard data from accidental erasure. "The computer is like a file cabinet tbat can open its own drawer, put a file on the copy machine and then slip the copy into another cabinet," Jessen said. "Sometimes I think it's alive." Jessen and Feldman augment their high-tech detective work by advising companies how to become less vulnerable to computer snoops like themselves: They recommend regular purges of old data, and they offer tips for avoiding e-mail blunders in the first place. Rule No. 1: Don't put anything on e-mail that you wouldn't want a jury to see. -----

4 5

Re: credit card conventional wisdom
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here ... On Wed, 15 Nov 1995, Howard Melman wrote: > Vladimir Z. Nuri wrote: > > attempts to get secure credit card number transfer on the internet are > > not an end in themselves. they are the first steps toward an entirely > > new transaction system. those who see a single step and criticize it > > as feeble in the context of past systems are missing the point and > > apparently can't think past the present nanosecond of their lives. My grandfather used to say, that the first horse to break from the gate, isn't necessarily the first to cross the finish line. Often, he'll be pulling up the rear. > You'll have a hard convincing folks that they need something > better than what works perfectly well today. In my humble opinion, the present system can't really be characterized as "working perfectly well". Far from it. While not as familiar with the US system as the Canadian, I can give as a simple example, the bank clearing system for paper checks. In Canada, we can clear a check from one side of the country to the other overnight. We have 24 hour clearing. While this is far from "perfect", our existing paper systems allow for a degree of efficiency which I don't believe is engineered into the US clearing system. Perhaps someone can correct me, if I have erred but I think it takes far longer than 24 hours to clear a check drawn on any US bank, and deposited to any other bank's credit in the United States. It may work "functionally" ... but certainly far from "perfectly" nor "efficiently". > Here's another point that I didn't see in your list. Today it might be > just as safe to send your CC# over the internet as giving it to a clerk, > etc. This is mostly because the number of CC#'s sent over the net vs > the whole traffic is small. It is therefore not very cost effective to > try to steal credit card numbers over the net vs other means (searching > through dumpsters, taping a phone line near LL Bean, etc.). A very good point. But then, dumpster-diving attacks could be moderated by simply implementing carbonless forms. No carbon, reduces a lot of the risks. It's basic risk management. All of this becomes a part of the cost/benefit analysis, and is part of the function of security policy. It's very much like all the talk on another thread on this list about Java security. There is no point in even discussing Java security in Netscape, when Netscape PRESENTLY has existing security holes written into the very fabric of the existing installed codebase. Holes which Netscape and AT&T refuse to address, correct or even comment on. Sun's security approach misses the point. Putting dead-bolts on houses while leaving all of the windows open, just doesn't address the problem. It really misses the mark. > If CC# purchases became common over the net, it would become much more > valuable to try to steal them from the net and more people would. It > would then become much less secure, not for any technical reason but > because there will be more crooks exploiting the existing flaws. This is also unfortunately true. Information on how to "break" a system does propagate. As more people know how to exploit a system, or as more people learn how to utilize the "letter of the rules" (the "code") rather than the "spirit" (the "intent") the degree of exploitation grows. Ask any executive in the Gaming Industry about this. Black-Jack card-counting went through an evolution in exactly this fashion. Many casinos lost a veritable "fortune" to good card counters. They lost to organized "teams" of card counters. Counters who literally broke the bank. Systems always have exploitable features. And new systems will always present new opportunities for exploitation. A completely new set of risks which are additive to those already in place, even those which may not yet be in a state of active exploitation. A pertinent network example: credit card numbers. Credit card numbers are not just a set of random digits. Only particular patterns of numbers can be valid. This existing "security provision" -- check digits -- actually ends up opening a security hole when we look at transmitting credit card numbers via the Internet. The security feature on one side of the ledger makes it far easier to differentiate between what is a random set of numbers, and what is in fact a valid CC number. Simple pattern analysis allows to search for valid numbers. It makes the potential "crooks" job much easier and its already engineered into the system. The "credit card number" risk though is accidental, while the Netscape Navigator risk isn't accidental at all, it's willful. Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: credit card conventional wisdom
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here ... On Thu, 16 Nov 1995, Vladimir Z. Nuri wrote: > but one distinction I do realize has to be made in all this is the > difference between "fraud" and "breaking a system". the latter is > a far more potentially serious problem with cryptographic security than > the former. in fact cryptographic security attempts to deal with all > fraud by making "breaking the system" impossible, and succeeds to the > degree it accomplishes this. I think this is extremely important to consider. The functions which define relationships between large numbers of variables, (such as say the world economy) -- these functions are not "idiot proof". They can collapse. And, yes Virginia, the system can be "broken". To suggest that cryptography can address this issue is to misunderstand the problem, and is part of this whole mindset that "security" is cryptography. Our economies are, if anything, less resilient than they were in the not to distant past. They are far more vulnerable. The introduction of new business practices, such as the reduction in most firms inventories, and the ever greater reliance on "just in time" approaches has made us far less able to sustain any interruption. The headlong introduction of "new variables" and new vectors into an unstable system has never been "sound policy". I guess it's sort of like what happened when rabbits were introduced into Australia. An eco-catastrophe. Perhaps, we can all agree that existing systems are best "not destabilized". Then again, I'm not the one who gets his jollies by rocking the boat. I get mine elsewhere. I guess here then is the real question, what is the fallback plan when something does go catastrophically wrong?? What then, hand-wringing, and saying that it "exceeded our theoreticians predictive capabilities" just does not suffice. Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: Corrections about Bob Noyce and Intel
by John Young 17 Dec '03

17 Dec '03

Worth magazine of Dec/Jan has a lubricious article on "The Super Investors of Silicon Valley": " 'Rise of the Silicon Patriots,' by Donald Katz. If their egos and paychecks are oversized, so is their impact on the economy and culture. It's not for nothing that California's venture capitalists think they're at the center of the universe." It traces some of the mauling by rapacious VC tigers of unwary techno-bambis and gleefully vaunts winner-take-all when the chips are down (multiple puns there) -- commensurate with the flatulent flattering flummoxing of this "financial intelligence" oilslicker. For more FFF FinInt organ-grinding the monkeys, see "Downloading Warren Buffet's Brain."

2 1

No Privacy Right in Indonesia ?
by James M. Cobb 17 Dec '03

17 Dec '03

Cypherpunks assume privacy is a good thing and wish there were more of it. --Welcome to cypherpunks Friend, An 11 17 95 Reuter Information Service newsstory headlined Politics, not sex, is Indonesian Internet's concern reports that In Indonesia, the quiet Internet revolution has not gone un- noticed by the armed forces. Here are more excerpts from the newsstory: Armed forces spokesman Brigadier-General Surwarno Adi- wijoyo told Reuters the military had suggested to the com- munications ministry the need for some sort of "toll gate" to "black out" news which could damage culture or affect security. It has also suggested registering uses and users, he said. ...nobody doubts the military is watching. Activists in Indonesia who use the Internet say it is a power- ful tool for distributing information in a society where self- censorship abounds, newspapers are tightly controlled, jour- nalists are jailed and unlicensed magazines banned. Internet users doubt the Indonesian government can legis- late or control the Internet, short of pulling the plug on the nation's soon-to-be-privatised phone system. Please note that the expression "legislate or control" means control by either fraud or force, whichever the military finds most convenient. If the military does one day pull the plug, will that validate or invalidate the statement in the "Welcome to cypherpunks" document-- Cypherpunks know that a widely dispersed system can't be shut down. A tangential answer is supplied by Indonesian activists: Despite the technical and administrative hurdles with cen- soring an increasingly large volume and web of contacts, Internet users point out such a scheme [of censorship, not plug-pulling] would not stop the increasing distribution of material within the country. For there are private as well as commercial networks in the country. Commercial providers' estimates suggest there are around 10,000 registered local users, with popularity of the Internet growing among Indonesia's technological and edu- cated elite.... Please note the expression "registered local users," and re- call the military's suggested registering [of] uses and users Uses? Perhaps that means those nominally private networks. Cypherpunks hope that all people desiring privacy will learn how best to defend it. --Welcome to cypherpunks Cordially, Jim NOTE. NandO News, which posted the above newsstory, can be accessed at: http://www.nando.net The story's online filename is: info733_8.html It's datelined: JAKARTA (Nov 16, 1995 - 01:06 EST)

2 1

ELECTRICITY CAN MAKE YOU RICH
by partners＠partnersnow.com 17 Dec '03

17 Dec '03

All of us are constantly bombarded by people hawking "unbelievable", "once-in-a-lifetime", "get-rich-quick" business opportunities. I graduated from Yale, became Commissioner of Housing in New York City, started a real estate development company, and now own an 83-year-old diamond-cutting company. Quite bluntly, I won't waste my time even listening to the pitch. And yet right now, I am telling eveybody I know (and, obviously, hundreds of people I don't know) about an opportunity available in the deregulation of electricity that sounds just as outrageous as all the phony talk we've heard in the past. The difference is that this is real. And the urgency comes from the fact that it will never happen again. You might choose to read no further, but you will never be able to say that you weren't there when business history was being made. MAKE NO INVESTMENT AND START PART-TIME Know up front that your participation will not require start-up costs of more than about $300 nor that you leave your current full-time job. You should also know that deregulated electricity in the US, albeit a $215-billion industry, is only one component in a global master plan that will soon tap even larger markets in internet commerce, telecommunications, and energy distribution. In all these markets, our participation will be in partnership with the most respected names in the corporate world. The structure of this precedent-setting Company has already been formed and the names of our partners will be announced over the next few weeks. We intend to do for all services entering homes, offices, and factories what the supermarket did to individual food shops and what the mall did to Main Street stores. The powerful trend to consolidation will naturally successfully extend to essential modern services because the benefits will be the same: lower cost and greater convenience. This is nobody's pipe dream. This is history in the making, and you can become a very rich player by finally being in the right place at the right time and taking action. DEREGULATION CAN ONLY HAPPEN ONCE By the year 2002, the domestic electric utilities industry will be fundamentally deregulated. That means that the out-dated, costly, monopolistic utility providers, which we have always accepted like death and taxes, will be forced to compete in the open market with lower-cost, high-tech, entrepreneurial, service-oriented private companies. In many states, the process has already begun. California's $20-billion industry will be one of the first to deregulate completely in 1998, along with New Hampshire and Rhode Island. Massachusetts and Pennsylvania are right behind, with many other states scheduling to start in 1998, too. Consumers will have the right to choose the source of their power and you will have the opportunity to sell it. And it has all been done before. In the 1970's, the airline industry deregulated and the resulting competition destroyed established companies and made fortunes for others. In the 1980's, AT&T lost its monopoly and now barely holds on to 50% of the market. The significant difference in the deregulation of electricity in the 1990's is that you are right now being given a chance to participate even before it happens. Our Company has developed the multi-million-dollar infrastructure to support its goal of becoming to deregulated electricity what MCI became to deregulated telephone. And the distribution of our electricity will be made only through independent entrepreneurs empowered by the Company to profit every time a customer turns on a light. Even more eye-opening, these "electricity entrepreneurs" will profit to an even greater extent from their monthly commissions on their customers' use of all the other services the new Company will offer: internet commerce, telephony of all kinds, home security, cable TV, and many more. With three or more services "bundled" together, studies have shown that customers are lost at a rate of less than 10% a year. This is true residual income. Compensation accrues from four main sources: (1) up-front agency fees paid to the Distributor when customers subscribe to our services; (2) up-front training fees paid to the Sponsor when new Distributors join the Company; (3) residual commissions paid to the Distributor as a percentage of customers' monthly use of the Company's services; and (4) executive bonuses paid to Distributors on the total volume generated by his or her entire organization. CAPITALIZE ON A PROVEN ROCK-SOLID COMPANY As I said, we are not looking for investors. Our parent is a 13-year-old, $1.4 billion, high-tech company with a D&B 5A-1, no debt, US Olympic Committee licenses, and operations in 23 countries all over the world. It is one of nine companies in the history of the United States that grew from start-up to one billion dollars in sales in less than ten years (others include Microsoft, FEDEX, Nike, and Home Depot). Our Asian division went public on the New York Stock Exchange with Morgan Stanley and Merrill Lynch as our underwriters. Most important, the Company has established a brilliant, highly-leveraged plan for growth that has empowered over 400 associates, working on their own schedules, usually out of their own homes, to reach an income level that in 1996 averaged $561,000 a year. Significantly, that track record was achieved in industries a small fraction of the size of deregulated electricity and our other future markets. Please be aware that there will be many start-up companies hustling to be players in this historic opportunity. There will be efforts by the utility dinosaurs to hang on to their markets. Be sure that your potential in this industry isn't undermined by the failure of the insubstantial up-starts or the collapse of the prehistoric giants. LIFE IS NOT A DRESS REHEARSAL In my role as President of a diamond-cutting company, I know the frustrations of a capital-intensive, high-risk, low-margin, slow-growth industry. As an Administrator in the medical community, my wife sees the deterioration in doctors' earnings and the downsizing and closing of hospitals everywhere. While many of the old ways of making money are gone, new opportunities abound. Deregulated electricity is the next big opportunity, structured by a genius hyper-growth Company that is already allowing my wife and me to continue our professional work full-time, while enabling us to develop part-time a perpetual income with unlimited potential. The partners we are seeking for this opportunity should be independent, open-minded, self-motivated, highly-principled entrepreneurs. Such a profile might seem demanding, but the financial rewards can be gigantic. I was skeptical, too, at first. But the more I investigated, the more I realized that this is the rare, legitimate, dynamic opportunity that people, not long from now, will look back to and lament that they they missed. Electricity deregulation has never happened before and will never happen again. There is no doubt that fortunes will be made as a result of deregulation and the Company's global vision. The only question is who will be along for the ride. And it might not be for you. There are always reasons. But clearly, if you continue to do what you've always done, you'll continue to get what you've always gotten. And if you've already gotten all the time freedom and all the money you've always wanted, this opportunity is probably not for you. But if you haven't, how long are you going to wait? For more information, please call 1-800-326-9253 or email me back and leave your name and daytime and evening phone number and the best time to call. Serious inquiries only please. /////////////////////////////////////////////////////////////////////////////// We practice responsible emailing. If you wish to be removed from future mailings, please reply with remove in the subject. ////////////////////////////////////////////////////////////////////////////////

1 0

The Continued Attack on Cash (Was: "The Right of Anonymity"...) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 02 Feb 1998 00:51:11 -0600 > From: Black Unicorn <unicorn(a)schloss.li> > Subject: The Continued Attack on Cash (Was: "The Right of Anonymity"...) > Sound paranoid? Try this. I'd like everyone who reads this to try and go > 45 days without using plastic or writing a check. Just 45 days. If you > don't grow alarmist very quickly (like in the first week) I'd like to hear > your experience. I've been doing it for many years. Don't have a checking account, don't own a credit card. I do have a saving account with a local credit union and go in every 3-4 days and withdraw what I need for the next 3-4 days. Pay every bill in cash or money order. I'm not going into how I invest my excess capital. If my employer needs me to travel I do it on their plastic. The only irritating thing I find is that I can't walk into grocery stores any more and get money orders larger than $700 and many won't do it for more than $400. I have to pay my rent each month with a $400 and a $397 money order in order to meet the $797 amound due because I'm too lazy to drive the extra 6-8 blocks to the one who will do the $700 money orders. Other than that I don't have a problem at all. I'm going to go tomorrow and buy a new laptop at around $1500. I intend on paying with a wad of $100 bills. Bet you they don't look twice nor will they ask for ID. I've actualy never had a problem paying cash, never had anyone turn real money down... ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

4 3

Re: Ecash account
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 17 Nov 1995 don(a)cs.byu.edu wrote: > So who here is going to use their ecash account to set up a money > lau^H^H^Hexchange service? Oh boy. Not this argument again. The one that says that if someone makes "change" that its money laundering. *Sigh* I suppose it is, if that's the way you're going to look at it. On that basis, every time I go to the corner grocery, I'm "laundering" my money. So be it. And I suppose if I put aside a small "nestegg", that then I've got something to hide as well?? > Ob Cyphernoise: Would Dr Fred, Alice, and any other names LD has set up > for himself lately please keep the noise limited to email? Please? I too am tired of LD spoofing me. But I am not going to actively "deny" every one of his posts. It's just not worth it. Hopefully the people on this list can tell the difference between what I stand for, and what certain people would like to paint me as standing for. As I've said, and repeated, my only interests lie in E-cash, and in removing code from the Internet which opens up security holes. Software, like Netscape Navigator and Java. The rest ... or anything else that someone tries to paint me as "standing for" is simply juvenile antics. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: NSA, ITAR, NCSA and plug-in hooks.
by ahupp＠primenet.com 17 Dec '03

17 Dec '03

>From: Scott Brickner <sjb(a)universe.digex.net> >Date: Thu, 16 Nov 1995 15:13:27 -0600 >Subject: Re: NSA, ITAR, NCSA and plug-in hooks. >The problem is that the non-encryption program must use the same >interface as the encryption program. Text compression is often cited >as an example of a non-encryption program that can use the same hooks >as a compression program, but there's a key difference: the text >compressor *doesn't* need a key. > >The encryption tool would have an interface like > Boolean (*)( DataSource, DataSink, void*); > >A compressor written to the same interface would never need to touch >that third argument. Therefore, the second argument is "specifically >designed" to permit an encryption tool to be used. > >You'd need a program which not only *accepted* the additional parameter, >but also *needed* the second parameter. I confess I have some difficulty >thinking of one. > PKZIP allows encryption (other's ?). How about a hook to that? _____________________________________________________________ "We work in the dark We do what we can We give what we have Our doubt is our passion And our passion is our task The rest is the madness of art." --Henry James ___________________________________________________________

2 1

Re: protecting against impersonation (was: CANADIAN PRESS REPORTS)
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>anonymous writes: >> I still feel such a sense of violation with what LD did, such an >> utter sense of helplessness at the character assassination I've >> suffered at his hands, > >So use PGP, sign your messages. Simple solution. Absolutely! Anybody who uses anonymous remailers to post to public areas, and does not use digital signatures to prevent spoofing when it is obviously needed, is a fool or worse.

1 0