- cypherpunks-legacy - lists.cpunks.org

Cash, cheaters, and anonymity
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

(As I said in another post, Netcom has a seriously broken mail system. Sorry for the delays.) I'll try to only respond to a few of Hal's good points, so as not to have too long a post here. His points are elided unless included. >Tim has made a lot of good points, and I'll only try to respond to a few: > >>NEGOTIATED PROTOCOLS TO REDUCE RISKS > >>However, just as most folks make arrangements with their bank/ATM machines >>(semantic meaning #2 of "ATM") to limit cash withdrawals to, say, $200 a >>day (it varies), so too can digital cash arrangements make similar >>contractual deals to limit losses. Some possible plans: > >>* Plan A: The protocol insists on retinal scan or other biometric >>authentication between the "smartcard" used as the cryptographic keying >>device and the putative owner. The "Thunderball" plan. (issues: preserving >>anonymity with biometric authentication, spoofing of the channel between >>card and physical apparatus, theft of smartcard, etc.) > >In Demolition Man, Wesley Snipes plucks the eyeball out of the victim to >hold it up to the retinal scanner and escape. Hacked-off thumbs may provide >similar workarounds for fingerprint protection. Maybe what we want is Yep. part of the reason I dubbed it the "Thunderball" plan: in that movie, almost 30 years ago, a stolen nuclear weapon is armed by spoofing the retinal scanner with a stolen eyeball (or maybe it was fake contact lenses...it's been awhile). Given the stolen nukes theme, it's amazing that the debate has shifted so little in 30 years. (ObCrypto links: Gus Simmons, who most of you should know about via his "Contemporary Cryptology" book and his work on subliminal messages, was the *main guy* on the "Permissive Action Links" (PALs) used to secure American nukes. I asked Whit Diffie, a close friend of him, if it was true that Simmons and others leaked security info to the Soviets to help them to secure their own nukes against unauthorized use...apparently they did, with the approval of the U.S. government.) ... >I think this is where the tamper-proof wallet idea comes from; it is the >closest anyone has come to providing truly conserved digital cash. With >such a system you can get the benefits of on-line clearing even in the off- >line environment, just as people will accept cash today without taking it >to the bank first. As I remember the observer protocol (Chaum's "Scientific American" article, August of 1992, as I recall), a trusted manufacturer is needed. Tamper-resistant modules, etc. This still allows spoofing. I know that off-line clearing, in which I get my money at some time after the transaction, is a whole lot less satisfying that receiving confirmation from my own agents/bankers that the money has already been transferred into my account. I agree that various protocols will exist, at various prices, with various benefits. .. >I think this is the key point. All of our speculation about the relative >advantages of the various forms of cash is largely irrelevant, as long as some >form of privacy-protecting payments comes into existance. Then the details >of the implementations will determine the relative costs and the market >advantages of each approach. The hard part will be getting that first cash >system in place. Which a free-market person such as Hal agrees with, of course. The market will ultimately evolve various protocols. Provided that regulations do not stop certain approaches, of course. ... >>([...] My use of the term "claim" >>here is of the "You present the right number, you get access" kind. Like >>the combination to a safe. The train locker idea makes this clearer, and >>gets around the confusion about "digimarks" of "e$" actually _being_ any >>kind of money it and of itself.) > >Dollar bills got their start this way. At one time they were just "claims" >on the real dollars in the bank vaults. Yet most people find it more con- >venient to think of them as money, even back when you could still turn them >in for gold. I think it's useful to think of ecash as being money as well, >although granted it is money with its own characteristics different in some >ways from banknotes, checks, or coins. The plethora of financial instruments, derivative, etc., will be echoed with digital money (indeed, some existing instruments already overlap with digital money, albeit not yet of the Chaumian flavor). For example, traveller's checks evolved to fill a niche for a form of money which could be "lost or stolen" and yet still be replaced. Don't leave home without it. Lots of niches exist, and many new ones will be created. >One thing I think is clear is that off-line cash will not be issued to >anonymous recipients. Imagine a magic quarter which would reappear in >your pocket after you put it into the coke machine. How many people would >be willing to resist using it? That's what you'll have with an off-line >coin issued to a pseudonym. We agree. Protocols I've seen make off-line cash problematic. "There is no digital coin." But on-line cash can be, and hence will be, issued to anonymous recipients. It's already done, with numbered Swiss bank accounts (at least in the past), and with the train lockers I mentioned. People put money in train lockers anonymously, then give the key to others, in exchange for goods and services (drugs, return of kidnap victims, etc.). > >>And as networks get much faster, expect even off-line cash to fade. Depends >>on costs, insurance rates, benefits, and of course on regulations. > >This is probably right, although ironically the infrastructure for off-line >cash might be simpler. On-line cash needs 24-hour availability, quick >(nearly instantaneous) response, a fully automated cash validation system. >We have this now, with the Visa cards, but it didn't appear overnight. And >I doubt that the Internet is a suitable communications medium for it (due >to reasons of availability, reliability, and security). Off-line cash could >be handled with longer turnaraounds in a machine which is not on the net, >using manual intervention so pass words and such are not stored on-line. >Of course the disadvantage is that the off-line cash requires identity >authorization during issuing. Yes, it requires an infrastructure. But for reasonable-sized transactions, the few cents for a current VISA transaction would be lost in the noise. Even if more computations are needed (as they will be, presumably), on-line transactions will be manageable for the larger transactions. Very small transactions (buying snacks and newspapers) can be handled off-line. This is already done, as when people buy "subway cards" that are semi-tamper-resistant (we all know they aren't, but most people don't try to diddle them). Ditto for phone cards, parking coupons, etc. (But why bother with off-line cash for most purposes? Physical cash is convenient for such things. However, markets will decide.) >Tim's ideas about escrow agents and a credential-less society are very >interesting as well and I'll try to make some comments on them later. > >Hal I look forward to hearing these comments. Understand that I wrote that essay basically off the top of my head, pulling together some ideas that I think have been pretty obvious for a while. We don't often discuss these sorts of ideas, preferring (I guess) to correct each other on points of trivia about the flight range of the A-10 Warthog (;-}). Life on the Internet. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Student expelled for writing hacking article, from Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 21 Jan 1998 10:49:17 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: politech(a)vorlon.mit.edu Subject: Student expelled for writing hacking article, from Netly News The "So You Want To Be A Hacker" article in question: http://cgi.pathfinder.com/netly/editorial/019821.html -Declan ****** http://cgi.pathfinder.com/netly/opinion/0,1042,1699,00.html The Netly News (http://netlynews.com/) January 21, 1998 Hacking 101 by Declan McCullagh (declan(a)well.com) The end of senior year for most high school students is a time for college decisions, vacation planning and beer-tinged teenage revelry. Not so for Justin Boucher. Today the Milwaukee, Wisconsin-area native will be expelled from Greenfield High School because of an article he wrote entitled "So You Want To Be A Hacker." Published under a pseudonym in an unofficial student newspaper, it described in colorful (and sometimes profane) language how enterprising snoops could break into the high school's computer network. The advice ranged from the glaringly obvious ("Some commonly used passwords at very stupid schools are...") to the Hacker Code of Ethics ("Never harm, alter or damage any computers"). The finer points of hacker morality and teenage toomfoolery, however, were lost on irate school officials, who expelled Boucher for one year. [...]

1 0

ITAR is back!
by David Miller 17 Dec '03

17 Dec '03

Those of you who thought that ITAR was dead had better check this out -- http://www.itar-tass.com/ Aparently, ITAR has found a new home... :-) Note that they are running Sun / Elvis+. --David Miller middle rival devil rim lad

1 0

Re: SC rules 1st doesn't cover lies [CNN] (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 21 Jan 1998 23:47:05 -0500 > From: Declan McCullagh <declan(a)well.com> > Subject: Re: SC rules 1st doesn't cover lies [CNN] > Reply-To: austin-cpunks(a)ssz.com > > Clarification on the Subject: line -- the court's ruling, at least as > described below, applies only to government employees. It is the > state-as-employer, not the state-as-sovereign, role the court is discussing. > > In other words, we're still free to lie, cheat, and steal[1]. > >> "A citizen may decline to answer the question, or answer it > >> honestly, but he cannot with impunity knowingly and willfully answer > >> with a falsehood," Rehnquist said. So you have to be an employee of the government to be a citizen? ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Candidate Blacknet Customer :-)
by Bill Stewart 17 Dec '03

17 Dec '03

http://www.newsmait.com has a section called the "Newspaper Intelligence Page", which has anonymized comments from newspaper reporters about what their (current or former) newspaper working environments are like. Aside from the usual issues that any site for griping about work offers, this site provides a lot of insight into the media business - how much freedom do writers have, what kinds of topics get squashed, what the biases of the editors and management are like. The folks who run the site have some obvious concerns about lawsuits. Looks like a good candidate for a Blacknet-style web site... Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

Hi !!!
by hoilu46＠concentric.net 17 Dec '03

17 Dec '03

Hi baby, I'm Christy. Cum join my girlfriends and I for some Live Erotic Chat!! We we're so naughty they banned us from the U.S.A!!!! We're so hot and horny we can't wait to get it on with you!! Call us at, 011-378-656-346. That's 011-378-656-346!! We'll be waiting ....... International rates apply. You be 18 or older to use this service.

1 0

Returned mail: User unknown
by Mail Delivery Subsystem 17 Dec '03

17 Dec '03

The original message was received at Fri, 23 Jan 1998 03:24:38 -0500 (EST) from ts26-15.homenet.ohio-state.edu [140.254.114.54] ----- The following addresses had permanent fatal errors ----- <eureka-unsubscribe(a)eureka.abc-web.com> ----- Transcript of session follows ----- ... while talking to eureka.abc-web.com.: >>> RCPT To:<eureka-unsubscribe(a)eureka.abc-web.com> <<< 553 sorry, your envelope sender is in my badmailfrom list (#5.7.1) 550 <eureka-unsubscribe(a)eureka.abc-web.com>... User unknown Reporting-MTA: dns; chemistry.mps.ohio-state.edu Received-From-MTA: DNS; ts26-15.homenet.ohio-state.edu Arrival-Date: Fri, 23 Jan 1998 03:24:38 -0500 (EST) Final-Recipient: RFC822; eureka-unsubscribe(a)eureka.abc-web.com Action: failed Status: 5.1.1 Remote-MTA: DNS; eureka.abc-web.com Diagnostic-Code: SMTP; 553 sorry, your envelope sender is in my badmailfrom list (#5.7.1) Last-Attempt-Date: Fri, 23 Jan 1998 03:24:40 -0500 (EST) To: eureka-unsubscribe(a)eureka.abc-web.com Subject: (no subject) From: cypherpunks(a)toad.com Date: Wed, 07 Jan 1998 00:04:05 -0800

1 0

Re: Misty???
by Anonymous 17 Dec '03

17 Dec '03

Adam Back wrote: > Tim May wrote: > | I wouldn't call Misty "snake oil." But it's also been thoroughly taken > | apart and shown to be weak. Importantly, it was submitted by Mitsubishi for > | peer review. > > Could you provide a pointer to the analysis paper? Adam, you should know better than to ask. Everyone knows you can't trust a bigot to do cryptography. Tim "Chop Chop" May's opinions about Misty are based not on the strength of the cipher, but on the ethnicity of the creator. On Thu, 11 Sep 1997 22:09:15, Tim May wrote: > At 9:30 PM -0700 9/11/97, Nobuki Nakatuji wrote: > >Does anybody know MITSUBISHI MISTY algorithm ? > >If you know it,Please send e-mail to me. > > > > You want me play Misty for you? You send me $2500, I play Misty. > > Like you do, I take much money, chop chop. > > (Now shut the fuck up and get the hell off our list with your demands for > money to explain your bullshit one time pad scheme.)

1 0

Communicator 5.0 to be GPL'ed
by Jrbl Pookah 17 Dec '03

17 Dec '03

Here's something I came across on one of my other lists. I looked at the URL, and it looked good. Anybody able to confirm/deny? And what kind of implications do y'all think this'll have for Netscape's security? (What if improved security code comes to Netscape from bodies /outside/ the US?) ---------- Forwarded message ---------- Date: Thu, 22 Jan 1998 10:33:21 -0800 (PST) From: <snip...snip> Subject: Communicator 5.0 to be GPL'ed Yes its true !! http://biz.yahoo.com/prnews/980122/ca_netscap_3.html woo hoo!! Dex- ----End Forwarded Message--- -- Joseph Blaylock Castle Computers, Inc. JOAT,MODF blaylock(a)castlec.com (513)469-0888 YMMV -- "Everything is perfect, but there is a lot of room for improvement." ---Shunryu Suzuki

1 0

Misty???
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Well on another mailing list I have been chastised for calling Misty "snake-oil". Has anyone actually examined this algorithm? Seems there is an IETF Draft on it (draft-ohta-misty1desc-00.txt). Any opinions on it?? My only exposure has be through the pidgon-english posts of Nobuki Nakatuji (if it looks like a duck, it smells like a duck, it quacks like a duck ....). - -- - --------------------------------------------------------------- William H. Geiger III http://users.invweb.net/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://users.invweb.net/~whgiii/pgpmr2.html - --------------------------------------------------------------- Tag-O-Matic: I use OS/2 2.0 and I don't care who knows! -----BEGIN PGP SIGNATURE----- Version: 2.6.3a-sha1 Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNMbWgY9Co1n+aLhhAQFjoQQAgRac4gm3MM1mbZUfb0jH21b7gQt1IRYR wWFilIA2am/6x+bmF3RKG64A9/iwp00rD45g2yybw91Gg3/87nEMjPBpo+DCchtb psYRKyDOTxOAr7GljOa2k4HJAfNDqjxQ56sI/4whk2PEADnpHilzln98tEJobZA7 oxZw9FeGlig= =M0fT -----END PGP SIGNATURE-----

6 10