- cypherpunks-legacy - lists.cpunks.org

Netscape stock on 12/7/95
by Adam philipp 17 Dec '03

17 Dec '03

2 1

Internet Stocks
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:14 PM 12/7/95, Adam philipp wrote: >16% tumble today... > > ...is the word getting out? > A few of you have corresponded with me about investments, Internet stocks, etc., so I reckon there's enough interest out there to share a few thoughts with you. Those who think this list has only to do with number theory or PGP are of course welcome to skip this message now and get back to reading Koblitz. I won't say anything negative or positive about Netscape per se, but here are some various developments: * A Smith Barney analyst today made essentially the same sort of comments that I (and maybe another or two) made several days ago, namely, that the market capitalizations are incredible ($7 B for Netscape at $170/share), that browsers are not a proprietary "franchise" (in that the standard is an open one), that a lot of competition is coming (Spyglass Mosaic, Oracle, Microsoft, etc.), and that many people hysterically bidding up the price of Internet stocks are barely aware of what this "Internet thing" is. He issued a "sell" recommendation on Netscape, an "underperform" recommendation on Netcom, Spyglass, UUNet, etc., and was generally bearish on the sector. (I saw him interviewed on CNBC, minutes before Marc Andreessen was interviewed.) * From a high on Tuesday of $170, Netscape was down to $130 at one point today. I haven't seen the closing price. * Analysts are also closely looking at the February '96 end of the "lockout" in some stock sales by Netscape employees. Basically, a lot of the shares that went to employees, etc., cannot be sold for 180 days after the IPO, which was in early August of this year. The effects of shares being put on the market is not clear, of course, and it is possible the effects will be minimal. Still, it might be prudent to take this account when considering strategies. * Microsoft also made announcements indicating a move closer to a standard Web browser strategy (as opposed to trying to sell the world on Microsoft Network). deal with Spyglass, and a licensing of JavaScript. (There've been too many deals connected with browers, Java, etc. for me to even begin to summarize here.) * Sentiment moves in waves, as per the Dutch tulip bulb scenario, and what was headed for the moon a few days ago is suddenly a turkey, to many. The whipsawing in Netscape, UUNET, Netcom, etc., is incredible: up 30 points in two days, then down 30 points in two days! By the way, some have sent me mail asking about how to sell these and other stocks short. One can sell them short directly (getting the money now and agreeing to deliver the shares at a later date), but this is risky, should these stocks rise. (And some of these shares are not readily available for short sales, due to the limited number of shares on the market and the difficulty of finding someone to lend the shares for a short sale.) One's risk is essentially unbounded (but practically there are some reasonable limits to how much the stock can rise, of course). Short sellers are always advised to remember this maxim: "He who sells what isn' his'n, must buy it back or go to prison." (It is said that some of the rise in Netscape stock price is due to "the shorts running for cover." That is, those who shorted the stock at, say, $80 are frantically trying to buy the stock to close out their positions. This can cause the relatively few shares to be bid further and further up. As I keep saying, be careful in believing this or not.) A safer strategy is to buy puts and calls, or to sell puts and calls. Buying "puts" (my mnemonic: the right to "put it" to another investor) involves, say, buying the right to sell a stock at some price in the future. Thus, one might buy a put on the Internet Index (http://www.amex.com) a collection of Internet-related stocks, to sell the IIX at $25 in April, '96 for a strike price of $255. If the IIX goes _up_, and as April approaches, that put will become worth less and less and may become worthless. If the IIX goes _down_, that put becomes more worthwhile (because one has the right to "put" it someone for $255 when the actual value of the IIX has dropped to, say, $200. (Roughly speaking, at expiration in April '96 this put will be worth $55, for a doubling of one's original investment; the pricing of options depends on a lot of things, including risk, time value of money, expectations, etc.) At this point there are no widely-available puts and calls on most of the recent high-fliers on the Internet. This is why the IIX looks to be a way to play this game. Interested investors should also look at LEAPs, which are essentially puts and calls with much longer expiration dates. A friend of mine bought $25K worth of Intel LEAPs (JAN96s) during the height of the Pentium debacle, when Intel was trading at $30, and in the next six months this $25K investment became worth over $300K. (Needless to say, your mileage may vary. Don't blame me if you lose your shirt. Bulls make money, bears make money, but pigs never make money, as another maxim goes.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

CPUSA = CypherPunks USA?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:39 PM 12/7/95, E. ALLEN SMITH wrote: > I suspect I know what organizations they're interested in (CPUSA et >al), but did they ask about any specific organizations? CPUSA? You mean "CypherPunks USA"? I agree that being on the Cypherpunks list is probably a serious threat to one's security clearance. After all, the things we talk about are destabilizing to governments, are conducive to creating open channels for releasing material anyone thinks is useful to be released, and even makes espionage trivial. (We seldom mention this, it being old hat, but the Aldrich Ames' of the world need no longer resort to archaic tradecraft such as leaving messages in Coke cans in the crooks of trees--digital dead drops are as close as your nearest PGP package and remailer. This is a revolution in espionage--not that I am advocating or condoning it, although it is often necessary and even moral.) Given that many of us take an explicitly trans-national approach, with little or no loyalty to local and national governments, and given that many of us advocate a Nietzschean kind of personal choice in deciding which laws to obey and which to ignore, our outlook is probably as dangerous to secret programs as membership in the Communist Party would be (especially these days, where membership in the CP would be seen as either a sign of slow thinking or quaintness). --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Still more on the Digicash protocol
by daw＠delhi.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just a clarification about my comments on privacy against eavesdroppers with Digicash. I admit I didn't express myself very well the first time. In article <199512071610.KAA16536(a)admin.starnet.net>, Mark Twain Ecash Support <support(a)marktwain.com> wrote: > > >Worse still, anonymity for the shop is worse with Digicash than with real > >cash. If I pay you real cash on a secluded street, you're fairly anonymous. > >If I pay you Digicash over the Internet, any passive eavesdropper could be > >recording your identy and the whole transaction. Blech. > > This is raising an issue that has nothing to do with Ecash. The complaint is > in fact about the lack of a gereral link encryption on the Internet. I agree > that this is needed, but providing it really isn't Ecash's job. I am eagerly > anticipating the general use of IPSEC. > Hrm, I think you misunderstood what I was trying to say. Assume the attacker is not doing any traffic analysis. The problem is that even then, the shop's identity (and product info, and payment amount, and bank ID, etc.) are still sent *in the clear* in the Digicash payment protocol. Thus all those items can be correlated to the payee's identity: a complete loss of privacy for the shop. There's no need to send that payment info in the clear -- why not encrypt? If it is encrypted, a passive eavesdropper can only learn the payer's & payee's identity if he uses traffic analysis, and even then he doesn't know the payment amount, product description, etc. For all he knows, the transaction could've been a $0.01 cent donation to Sameer for his anonymous remailer, or it could've been a $10,000 transfer to Sameer's machine in (virtual) Anguila-space for a few dozen Apache servers. (So this also has implications for payer anonymity & privacy, not just payee privacy. When payment info is sent in the clear, and the eavesdropper is doing traffic analysis (e.g. by sniffing the link out from a small business), the eavesdropper can correlate payer's identity with the payment amount, product description, and other buying habit information. When Digicash protocol messages are encrypted, this information isn't released, and can't be correlated with payer identity, even when traffic analysis is being done.) That's why I really wish Digicash were encrypting all its messages. And I'm very glad to hear that Digicash will support sending the entire protocol over a SSL-protected link. Great feature! I'll be looking forward to it. > >* continue specifying the protocol at a deeper level, like you promised > > (and throw in source for security-critical modules too, eh? :-) > > Writing all this down takes time. DigiCash may hire a tech writer soon. That > should improve communications between all parties. Excellent! Thanks for all you're doing to improve Digicash's anonymity, privacy, and security features, Lucky. I think it's really important to get this right in the pioneering work... - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMeEBCoZzwIn1bdtAQFzYAF/agJtA7eal+rEP0ki34FY/vyKc/EDqJ0p QR1T+zJZ0tn6i1hwluqlmvigJpWNst41 =/NJW -----END PGP SIGNATURE-----

1 0

Re: Micro$oft and Java
by Joel McNamara 17 Dec '03

17 Dec '03

I was at the Microsoft presentation. Crypto-relevant info: A patch will be published in the next few days to address the weak .PWL encryption. I got a rather lame excuse about how the encryption was first implemented in 1991, and how it was sufficient then. They will supposedly be changing the seed. I asked about what MS was doing in regard to future strong crypto. Got an interesting response in that that "the government was going to let them implement 768 bit keys." I later asked an MS person if these were RSA session keys or what. He said yes, but I really don't think he knew what he was talking about based on some of his other comments. Visual Basic Script will be MS's response to JavaScript. The interesting thing here is a plan to use digital signatures on controls and scripts as a means of authentication. The comment was made "you'd trust something signed by Lotus or some other big name, but you probably wouldn't be that trustful of a piece of shareware." Hmmm... MS will be releasing a "safe" runtime version of Visual Basic that will supposedly prevent nasty virii and trojan horses from being implemented on Web pages. IMHO, Perry's previous comments on the security of Java apply. Servers and some clients will support end-to-end encryption. No details... I didn't ask about GAK. Bill said there was a white paper explaining Microsoft's position on encryption. Maybe I'll test the search capabilities of the MS Web site later tonight. Overall, the presentation was interesting (but obviously lacking in technical details as the audience was mostly press). MS is going to throw a lot of resources at this in order to maintain its industry dominance. Thought for the day. Bill on the relevance of the briefing being held on Pearl Harbor day quoted Admiral Yamamoto after the 1941 attack, "we have awoken a sleeping giant." Draw your own conclusions on that one... Joel

3 2

Second mini-AIR report on PGP-Y
by Mark Aldrich 17 Dec '03

17 Dec '03

The following appeared in the latest issue of The mini-Annals of Improbable Research ("mini-AIR"), Issue Number 1996-03, March, 1996, ISSN 1076-500X (a superb sceince journal that comes with my highest recommendation, BTW): ----------------------------------------------------------- 1996-03-05 PGP-Y Ill Advised Reader Andrew Rock has been investigating our foolproof data security protocol, PGP-Y (Pretty Good Parasychology). He intuited this missive to us: "You were ill-advised to release the details of your PGP-Y -- "Pretty Good Parapsychology" protocol on an international mailing list such as mini_AIR. US law prohibits the export of such highly secure transmission technology, defining it as munitions. Your proposal must await government-approved key espcrow [sic] systems rumoured to be under consideration by the NSA. The approved systems will prohibit the possession or transmission of ideas beyond the imagination of government officers. Please do not carelessly put the publication of AIR at risk while I have nearly two years left on my subscription." Investigator Trevor Green and a large team at the University of Saskatchewan have also been laboring in the field. Green reports: "After an initial trial period of PGP-Y within our department, we have had some disappointing initial results. While the transmission rate is nothing short of paraphenomenal, the security mechanism is, alas, not wholly foolproof -- everything worked fine, until my friend Steve started imagining that he was intercepting the telepathically-transmitted data. We are sure that this technical loophole may be overcome but wish to alert your paranormal engineers to the oversight. Meanwhile, I am pleased to report that the credit-card fraud charges against Steve will be settled out of court." ------------------------------------------------------------------------- | Liberty is truly dead |Mark Aldrich | | when the slaves are willing |GRCI INFOSEC Engineering | | to forge their own chains. |maldrich(a)grci.com | | STOP THE CDA NOW! |MAldrich(a)dockmaster.ncsc.mil | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

1 0

Re: [FYI] FBI Training Eastern European Police
by Dave Del Torto 17 Dec '03

17 Dec '03

At 8:22 PM 12/6/95, anonymous-remailer(a)shell.portal.com wrote: [elided] >I'm certain that the FBI and other law-enforcement officials might >also learn by living in a city where the East truly meets the West. > >Budapest is a beautiful old city of bridges, not just literally but >figuratively. It's where anyone in the world can find comfort. [much elided] Hey "Alice," This is a very persipicatious set of observations about Budapest, a city I lived/worked in for a while (you sound like you know it rather well yourself). The level of technical CS knowledge in Bp is comparable to, or better than, many other cities (except maybe for Moscow and St. Petersburg) in the former Bloc. Your comments also provide good insights into why it's technically and geographically important to cypherpunks: it's the petri disk for many of our cpunk brethren over there. The fact that the FBI has chosen Bp as one of their entry-points into the region impacts our policy discussions here, particularly since our LE types are making contact with the former secret police in that region, and especially so given the stationing of US Troops in Kaposvar as we type (southern Hungary) for easy entry into Bosnia. Anyone who attended CFP 95 may also remember some of Esther Dyson's lunchtime comments about the Russian mafia (which has a strong presence in Bp) and the growth of crypto's use both by the gangsters and LE officers. Some of the most powerful crypto may be emanating from these regions and it would be wise for us to try and track TLA activities in that area. I won't drag this topic out any further, but if anyone comes across similar info about our various TLAs operations over there, I hope they'll at least share it with me, if not the list. dave PS: I hope Perry's paying attention. ;)

1 0

Java musings
by Adam Shostack 17 Dec '03

17 Dec '03

Some musings on policies, threats and liabilities of Java, Livescript and other downloadable applets. I. Policies. The recent Livescript problem was predictable. Building an execution environment to safely handle all the myriad of tricks that programmers will throw at it is not a simple or easy task. People will make mistakes in the design and execution of these environments. Right now, many people are chasing the idea of applets; its neat, sexy, and everyone wants in. But, for many users, and many environments, certain capabilities may be inappropriate. There has already been loud complaining in many forums about the lack of site configurable Certification authorities, lack of site control over Java features. A site needs to be able to decide who to trust, and who should be able to make these decisions, in a manner that a user can not easily override. The ease of configuration of trust parameters in Netscape is neat for personal use, but inappropriate for business. When Java gets its ability to check signatures, expect complaints about lack of site configuration of trust hierarchies. (Yes, as opposed to web of trust. As a bank, I want to be able to control what code can run with a very explicit hierarchy.) All applets are not created equal. All user requirements are not equal. Applets are not created equal. Some are created in house to do certain things, like watch the price of two stocks relative to one another. If an applet is created in house, signed off on by the InfoSec people, then there's no reason (assuming strong integrity checking) to deny it access to local disk, arbitrary network access, etc. However, for various reasons (notably compartmentalization, aka defense in depth), it is desirable to restrict disk (and possibly network) access to certain addresses. Something akin to chroot(), tagging of packets outside the applications control to make firewall filtering easy, filtering of available addresses to send to (only talk on local subnet). The ability to assign various levels of privilege to code that runs on a virtual machine will be essential. The ability to limit these privileges must be reserved in some way to those with site security responsibilities. The security people, in turn, will need the ability to delegate. This can perhaps be provided based on a least trusted basis. Code starts out in a small, tight environment, with no access to anything other than the (protected) processor, and a promote() function which does authorization checking before granting new levels of privileges in certain areas. Access to disk, access to local and remote network services, and the ability to pull the browser to a new URL are all privileges that should be orthogonally configurable, by site, by machine, or by applet. All user requirements are not equal. This should be obvious. Not all users need Java or Livescript. If a user is using Netscape to look at man pages, access to Java and livescript is not very important. Access to unsigned Java applets may or may not meet the site security policy. At home, I might happily look at them. In the office, I might have a very different approach. A bank teller might need access to applets developed by the bank for various things, but not need access to anything over the internet. He would need to be able to access the local lan servers. The need of users to get to different resources, and work under different levels of protection calls out for mandatory strong authentication in applets. In other words, a better design might be only execute applets with some (verified) signature attached to them. The language in which the applet was written is important. More important is the ability of users and management to set policies, and see those policies enforced by applications. I could then set my browser only to run Livescripts signed by someone I know (or an agency that vets them for bugs), and only run Java with minimal trust in the absence of signatures. II. Threats and liabilities A malicious applet, running amok on a machine, with the same disk & network access as a user, can send off to the world anything it thinks interesting. However, there are times when letting an applet at certain files, or giving it heavy network access, might be very useful. I'll take as an example Anderson Consulting's demo BargainFinder (http://bf.cstar.ac.com/bf/) BargainFinder is a way to search 9 music stores on the web for an album, with one form. 3 of the stores are blocking the searches. In addition, a cypherpunk might wonder if the searches and their origins are being logged. Thats not very useful for those of us who look forward to perfect marketplace information for consumer goods. Let me sketch BargainFinder2, as powered by Java. Instead of going to Anderson for the page, you download BF to your local machine. It does the searching, same as BF1 did, but with no blocking possible. You find your CD at the best price. Perhaps BF is rental-ware, perhaps its someone advertising their Java coding skills. But its clear that this applet needs to be able to access the network freely. Its also plain that it won't be written for 6 platforms. It might be written for Windows, but the Java market might be larger still, and thus more attractive. (Not to mention that the network interface is mostly taken care of. no Winsock version worries.) Other applets, say a Ecash wallet manager that interfaces with Quicken, needs access to your local disk, and needs to be able to respond to incoming network queries from shops. Granular control of the access that applets have thus seems to be needed. Making Java 'secure' is not enough, because people will 'turn off' all the security to make one applet work. It might also be interesting to consider automatically updating software, that can replace itself from time to time, after verifying that a signature is correct. Although, that does raise the value of stealing a key from some well known, trusted applet vendor. To summarize, 'security' in the vauge sense that Java promises, while useful, needs granularity to allow it to fulfill its potential. Comments are welcome. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: Is there a lawyer in the house?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:27 AM 12/8/95, sameer wrote: >> > You mean if you give me your key the police can get it from me without a >> > warrant? What if I don't want to give it up, and you don't? How would the >> > police get it without a warrant? >> >> Yes. Unless it could be shown there their was an expactation of privacy >> in the transfer, or that there was an understanding that you intended this >> to be a confidential matter. Or in the alternative, that the > > I do not understand. > >Alice has Alice gives Bob her key. Cop wants Alice's key. Cop tells >Bob "I want Alice's key, you need to give it to me. I don't have a >warrant." > >How is this different from >Bob has key. Cop want's Bob's key. Cop tells Bob "I want your key, >you need to give it to me. I don't have a warrant." > > > sheesh, what a fucked up legal system. ^^^^^^^^^ EXON WARNING! This message has just exposed the author, the toad.com system, and all those who pass it on to fines of not less than $10,000! But I share Sameer's confusion. If cops show up at my door, they must, it seems to me, present proper warrants before they can _enter_ my premises, or _search_ my premises. Something given to me, whether a letter, a key, a photo, etc., is essentially *my property* and may not simply be taken away from without due process. I hope Black Unicorn is incorrect in his point. --Tim Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: GAK solutions was: Is there a lawyer in the house?
by Carl Ellison 17 Dec '03

17 Dec '03

>>This is not far from the idea that CME proposed that the NSA/FBI/CIA >>publish public keys, and we'll hack a voluntary version of PGP that >>encrypts the session key with the LEA public key -- instant >>voluntary Key Escrow. > >I still think that's the only way the gov't will get GAK -- :) Actually, the real proposal (http://www.clark.net/pub/cme/html/no-ke.html) is to have them give me their public keys. I would sign and post them. The world's citizens would then add them to their public keyrings and, when they feel like volunteering GAK, would include these agencies as crypto-recipients -- on a per-message basis. No meetings -- no hassle -- nearly 0 cost -- and the gov't could have GAK tomorrow. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0