- cypherpunks-legacy - lists.cpunks.org

Re: PRIVACY: Private traces in public places
by tcmay＠got.net 17 Dec '03

17 Dec '03

(Sasha, good to have you on our list!) At 3:26 AM 1/10/96, Alexander 'Sasha' Chislenko wrote: > Sometimes, it comes as an unpleasant surprise to a person who >looks for web pages referencing his own name, and finds, among >other things, many of his explicit or controversial usenet or mailing >list messages, old resumes that may contradict the current one, >critical remarks of his high school girlfriend and former colleagues, etc. >Knowing that this information is easily accessible to his new girlfriend >and prospective employer may make him more than uncomfortable. Remember a couple of years ago on the Extropians list when I claimed to have compiled dossiers on people, from their admissions in posts about drug use, infidelities, and other such things? Several of them got quite irate. >All advice to such a person you may see on the Net mentions Net laws >that should have been passed and personal actions that should or >should not have been taken. Not all such advice, because my advice has been different from this. >How can people protect themselves from all this? > >Will people of the future all wear identical privacy suits, gloves and >helmets and burn >everything they have touched? > >Or they will just try not to do things they may later be ashamed of? >(How do you know what you may be ashamed of 30 years from now?) Or, the option I prefer: do what you gotta do, and screw those who claim you should be ashamed of yourself. Think of this as a screening process: anyone who is so offended or ashamed for you (what a concept: "I'm ashamed for you") probably is not someone you would want to deal with. Works for me. I'm not trivializing the issue of search engines and archiving systems turning up articles written, old posts, etc. Every couple of weeks, sometimes more often, someone sends me a copy of one of my postings and claims that someone else must be forging my name (recent posts on racial issues, for example--while I'm not a racist, I despise quotas, setasides, and preferential treatment for lazy people, of any race...this obviously makes some people "ashamed for me" :-}). These people, obsessed with political correctness, or having some notion that consistency must be enforced, are the populist form of Thought Police. Mostly I ignore these people pestering me to "explain" a post I made in a group, and, if they persist, I add them to my filter file. I prefer this liberated outlook to either of the two options you presented. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: E-cash and Interest
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:26 AM 1/10/96, Tim Philp wrote: >I had been doing some thinking about E-cash and some of the implications. >It seems to me that there is another element in the discussion that has >not gotten very much consideration. >When you have your money in the bank, you are earning interest on the >money (albeit not very much! <g>) and that money continues to earn What interest, if any, is a contractual arrangement a customer makes with a bank. Some banks pay no interest at all, some pay low rates, some pay more. A function of a lot of factors. Before saying that digital cash will not pay interest, one would have to know the type of digital cash and the ancillary contracts that may go with it. For example, the online clearing model could certainly still have interest-bearing accounts, in the underlying currency or commodity that represents the store of value to be paid out when the digital cash is redeemed. It might be cumbersome, but it would certainly be possible for an agent to buy what I'll call a "digital bond," worth one unit at time zero, 1.1 unit after one year, and so on. >interest until it is withdrawn. If you write a check to pay for >something, that ends your interest accumulation for that money. Actually, writing the check does not end your accumulation of interest. The payout of funds to the check casher is what ends the accumulation. Some parallels with online clearing digital cash. >With the E-cash systems that I have seen, you generate your own E-cash >and have it signed by a 'bank' At that moment, it becomes like cash in >your wallet and you loose interest that this money could be earning. >Has this issue been addressed, or am I missing something? Depends on the exact type. From your description, you're looking at the model in which one closes out a bank account (presumably interest-bearing), and says "Give it to me in unmarked bills" (loosely speaking). Well, if the digital cash is really just a call on funds still held (and perhaps used, hence they can give interest), then interest is still possible. If the bank has given out funds to some other bank, then they can no longer pay interest. (If this sounds confusing, it is because even in digital cash systems one must think about where the store of value really is, who has it, who must trade it for the numbers representing cash, etc. "There is no digital coin" means more than just that there is no unforgeable thing that is unforgeable the way a gold coin is; it also means that the numbers are not actual value, that the value exists in other places...it gets murky, though.) In any case, most initial uses of digital cash will more closely resemble currency exchanges (which it can be argued is a better model....), for which the customer usually pays a fee, or there are buy/sell rates that give the moneychangers in the temple their pound of flesh. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 3

Re: PRIVACY: Private traces in public places
by John Young 17 Dec '03

17 Dec '03

Responding to msg by nobody(a)REPLAY.COM (Anonymous) on Wed, 10 Jan 1:43 PM > Last summer the first case in Britain of a libel on the Internet was > settled out of court when Laurence Godfrey accepted undisclosed > damages from another nuclear physicist, Philip Hallam-Baker, over > remarks made in 1993 on Usenet, an electronic conference with 16 > million users. And Peter Lilley, the Social Security Secretary, sent a > stiff letter to the vice-chancellor of Leeds University after one of > its students used a faculty computer to make defamatory allegations > about him. ---------- The NYT reports that by 2000 there will be over 1 million lawyers in the US. These fine-minders, supported by the burgeoning private investigative and security fields, will surely mine electronic archives as thoroughly as they research paper -- and thanks to wondrous Altavistas maybe more thoroughly. And backed by these highly skilled lobbyists, laws will change to make remunerative rain of -- and by -- archiving and search technology as they have to capitalize on the technology of doing the same in the worlds of printing, telegraph, telephone and television. Promotion of these privacy-invasive services on the Net parallels the defensive measures explored on cypherpunks. Perhaps all c'punks should subscribe to cyberia-l and vice versa; they are hand in hand, or fist to fist, on this.

2 1

RE: Net Control is Thought Control
by Pete Loshin 17 Dec '03

17 Dec '03

Duncan Frissell wrote: >On CSPAN Friday morning a gentlemen who is, I take it, a lobbyist for TPC or >the Competitive Long Distance Coalition (TPCs) said that the Internet could >be regulated just like magazines, tv, or anything else. I have long doubted >statements like this particularly since they come from people without >apparent experience on the Net. > >[many other interesting comments deleted] Magazines and TV (and books, newspapers, movies etc.) are _NOT_ regulated, at least not as to content. These media are all pretty much self-regulated. The judgement of whether to print the f-word in a newspaper is made by the editors and/or the publishers--not the government. The same goes for how much flesh gets displayed on a television show, or in a movie, or on the cover of a magazine. It is true that the TV and movie industry have subjected themselves to self-censorship and "guidelines" to avoid having the government step in and do it for them, however. It may be that this individual was speaking in favor of having the Internet community police itself--which may mean he's in favor of an updated Hayes board of censors (the folks who felt that, during the 40's it was obscene to indicate that ANYONE, particularly married people, slept in the same bed together, with the result that bedroom scenes always had the couple sleeping in their own individual single beds). -Pete Loshin pete(a)loshin.com

1 0

fingerprinting
by D'jinnie 17 Dec '03

17 Dec '03

Immigration & Naturalization Department has been fingerprinting ppl for years. Does anyone have any ideas what agencies that information is shared with and what they need it for anyway? And what's with that new thumbprint thing in banks? I haven't had occasion to refuse it yet but I wonder if they'd open an account without it... --- Reality leaves a lot to the imagination. jinn(a)inetnebr.com

1 0

Re: Mixmaster On A $20 Floppy?
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 10, 1996 03:00:00, 'Bill Stewart <stewarts(a)ix.netcom.com>' wrote: >At 08:55 PM 1/5/96 -0500, tallpaul(a)pipeline.com (tallpaul) wrote: >>I've reports that the latest version of SyQuest's external parallel port >>EZ135 "floppy" drive is due on the shelves this month. > >Iomega's ZIP drives are similarly priced, hold 100 MB, and >come in parallel and SCSI flavors. > Quite right. In many ways the SyQuest and Iomega products are identical. However, I'm shooting for the SyQuest because of the advertised 12.5 msec access time. In any case, the tech is there and it is portable so we can expect to see a variety of similar products in the future. >>Question 1: Can you fit linux, pgp, mixmaster, etc. on the 135 Mb disk and >>have enough useful space left over for a useful amount of data? > >As various people have said, you can do it on a couple of floppies. >Is Mixmaster designed in a way that could easily accommodate having >Mixmasters pop in and out of existence, either well-known ones that travel, >or (with some enhancement) temporaries that pop up and squawk their >existence to some sort of web site or mailing list? What would it >take to add this capability? > I can't answer these questions which is why I started this thread to get answers from those who have the knowledge required to make meaningful answers. The major problem today stopping the proliferation of "temporary" sites seems to be the user interface. Ultimately, we would want something that was very easy to use and had incredibly simple user manuals (like the Army's Training Manuals for really dumb soldiers). You know, the ones that start: "This is a bullet. It has a pointy end and a flat end. The pointy end is the end you want to face the enemy. The flat end is the end you want to face you." >>Question 3: Anyone want to speculate on what data recovery is like when >>encrypted data and the horse it rode in (and out) on has all been >>physically destroyed at a replacement cost of only $US20? > >Old 5 1/4" floppies make a very secure satisfying sound when you >take the magnetic material out and drop it into a shredder :-) >The 20 MB Bernoulli Box floppies were also shreddable. > Yeah, and imagine the noise an anti-privacy technician makes when he/she/it is told to try to extract plaintext from the shredded results. >#-- ># Thanks; Bill ># Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 ># ># "The price of liberty is eternal vigilance" used to mean us watching ># the government, not the other way around.... > > -- -- tallpaul -- Any political analysis that fits on a bumper sticker is wrong.

1 0

Reports available via CTRS
by David J. Bianco 17 Dec '03

17 Dec '03

[Abstracts for, and (in most cases) links to these report titles can be found at the CTRS site, http://www.itribe.net/CTRS/ ] 1.Tuomas Aura, Modelling the Needham-Schroeder authentication protocol with high level Petri nets, Technical Report B14, Espoo, Finland, September 1995. 2.Arnold G. Reinhold, Diceware for Passphrase Generation and Other Cryptographic Applications, Cambridge, MA, July 28, 1995. 3.Arnold G. Reinhold, A Diceware Word List, Cambridge, MA, July 28, 1995. 4.Arnold G. Reinhold, Results of a Survey on PGP Pass Phrase Usage, Cambridge, MA, July 28, 1995. 5.Arnold G. Reinhold, "Common Sense and Cryptography" , Internet Secrets, John Levine and Carol Baroudi (Ed.), Foster City, CA, 1995, pp. 115-150. 6.Arnold G. Reinhold, On the Function of MHC-Antigen Specificity, Cambridge, MA, March 3, 1989. 7.VeriSign, Inc., FAQ: Answers About Today's Digital IDs, July 15, 1995. 8.Roos, Andrew, A Class of Weak Keys in the RC4 Stream Cipher (Preliminary Draft), Westville, South Africa, September 1995. 9.Terry Ritter, Substitution Cipher with Pseudo-Random Shuffling: The Dynamic Substitution Combiner., Cryptologia, vol. 14, no. 4, 1990, pp. 289-303. 10.Terry Ritter, Transposition Cipher with Pseudo-Random Shuffling: The Dynamic Transposition Combiner., Cryptologia, vol. 15, no. 1, 1991, pp. 1-17. 11.Terry Ritter, The Efficient Generation of Cryptographic Confusion Sequences., Cryptologia, vol. 15, no. 2, 1991, pp. 81-139. 12.Terry Ritter, Voice and Video Cryptography in a DSP Environment., Proceedings of the Second Annual Texas Instruments TMS320 Educators Conference, Houston, Texas, August 5-7, 1992. 13.Terry Ritter, Estimating Population from Repetitions in Accumulated Random Samples., Cryptologia, vol. 18, no. 2, 1994, pp. 155-190. 14.Camenisch, Jan; Piveteau, Jean-Marc; Stadler, Markus, An Efficient Fair Payment System, India, Mai 1996. 15.Camenisch, Jan; Piveteau, Jean-Marc; Stadler, Markus, An Efficient Electronic Payment System Protecting Privacy, Lecture Notes in Computer Science, vol. 875, pp. 207-215, Berlin, November 1994. 16.Camenisch, Jan; Piveteau, Jean-Marc; Stadler, Markus, Blind Signatures Based on the Discrete Logarithm Problem, Proceedings of EUROCRYPT 94,Lecture Notes in Computer Science, vol. 9505, pp. 428-432, Berlin, May 1994. 17.Stadler, Markus; Piveteau, Jean-Marc; Camenisch, Jan, Fair Blind Signatures , Proceedings of EUROCRYPT 95,Lecture Notes in Computer Science, vol. 921, pp. 209-219, Berlin, May 1995. 18.Kocher, Paul C., Cryptanalysis of Diffie-Hellman, RSA, DSS, and Other Systems Using Timing Attacks, Stanford, California, December 1995. 19.Schoenmakers, Berry, An Efficient Electronic Payment System Withstanding Parallel Attacks, CS-R9522, Amsterdam, Netherlands, March, 1995. =========================================================================== David J. Bianco | Web Wonders, Online Oddities, Cool Stuff iTribe, Inc. | Phone: (804) 446-9060 Fax: (804) 446-9061 Suite 1700, World Trade Center | email: <bianco(a)itribe.net> Norfolk, VA 23510 | URL : http://www.itribe.net/~bianco/

1 0

SSN collection prank
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I haven't seen this here. somewhat amusing. ------- Forwarded Message Date: Sun, 7 Jan 1996 19:49:14 -0500 (EST) From: Brad Dolan <bdolan(a)use.usit.net> To: snet-l(a)world.std.com Subject: (fwd) Private SSN Collection Project <cool!> (fwd) - - ---------- Forwarded message ---------- - - ---------- Forwarded message ---------- Date: Sun, 31 Dec 1995 00:01:48 -0800 From: Clint Danbury <danbury(a)shell.wco.com> Thank you for your response. Please send Full names and Social Security Numbers of anyone you know, including government officers and/or employees, to: Clint Danbury, Box 750037, Petaluma, CA 94975-0037 email: danbury(a)ssnShirt.com Questions And Answers On The Nationwide SSN Collection Project. - - -1- Why are you collecting SSNs ? Answer: For fun and amusement. - - -2- What do you plan to do with them ? Answer: Put them on sweatshirts and sell them through specialty clothing retailers. It has been suggested also that I post them on large billboards along the Mexican border, but I don't have enough capital to pull of such a stunt at this time. - - -3- How long do you intend to continue this ? Answer: Until it becomes illegal. The moment any legitimate government authority informs me of the specific laws which (A) Forbid the collection, recording, and distribution of SSNs by private parties, and (B) Provide legal recourse for the individual citizen against private parties which do so, I will stop. - - -4- What if the government finds out what you're doing ? Answer: First off, the government knows very well what I'm doing. I've been "reported" multiple times to the SSA and the Secret Service. Secondly, the government can find me quite easily (I'm in the phone book). Third, I will cooperate completely with any legitimate government authority. - - -5- Here's my ex-spouse's SSN; will you make him/her miserable for me ? Answer: Hell No ! If you want me to engage in illegal activity for you, then go somewhere else ! - - -6- Isn't what you are doing illegal ? Answer: Not according to the SSA. They have declared the private use of the SSN unrestricted. (More on this in a few questions) - - -7- If My name/SSN were in your database, would you tell me ? Answer: In order for me to confirm this, you must first tell me what your full name and SSN is, then I will tell you if you were already in there. If this sounds like two-faced hypocrisy, great! I got the idea from CBI-Equifax; that's their very own policy. If you don't tell them what your SSN is, they won't tell you what they've got on you. Therefore, I have decided to do the exact same thing. (If you don't believe it, then why don't you call them and ask for yourself?) - - -8- What if someone did the same thing to you ? How would YOU feel ? Answer: This already has happened to me. I told the SSA office about it, repeatedly, and they would take no action. (The story appears in the next answer.) - - -9- How did this all start ? Answer: In 1985, a co-worker learned that I object to the "Uni-Number" concept of identifying a single person across multiple databases. I was (and still am) specifically concerned about the use of the SSN for Non-Tax identification. The company placed our SSNs on our name tags, which, thankfully, we did not have to wear constantly, although we would occasionally have to display it for a guard during certain times. This co-worker went poking through my briefcase while I was out of my office, copied down my SSN, and then, for his own fun and amusement (I'm guessing at his motives, I don't know his true reasons) displayed it for me, and would not tell me where he got it. Seeing that this angered me, he then went to other co-workers, who joined him in making my SSN even more public. They then went to the personnel files, (which the company made no attempt to keep locked) and double-checked the number with my job application. After that, they memorized it, and, (again, I'm guessing here) for their own amusement, they would recite it in unison around the lunch table. (I know this sounds impossible, but it really did happen.) After that job ended (not very happily, surprise) I let myself cool off for a few months, and then moved to another city. During my time in that other city, I contacted the SSA office there, seeking another SSN. I made dozens of phone calls and wrote letter after letter, all to no avail. My letters got shorter and to-the-point, not long drawn out things. It took only 30 seconds to read them. This continued for several months. The result was always the same: words without action, and no replacement SSN. The company in that city went down the tube, and I had to move again. I wrote and called off-and-on over the next few years, and got the same treatment; empty words, stall-him-off, and they would make no statement one way or the other. In September of 1993 (perhaps an earlier date, I'm not sure) the SSA finally came out and gave their official written approval for unrestricted use of the SSN by private individuals and private organizations for any purpose, including fun and amusement. The pamphlet is entitled "Your Social Security Number", is SSA Publication 05-10002, and dated September/1993. You can get a copy by calling them at 1-800-772-1213. On page 9 of that pamphlet, they have finally removed all restrictions on the private use of the SSN and they've put it in writing... "Because there is no law concerning the use of a person's Social Security number by a private individual or organization, Social Security has no control over such use." So, if those are the rules they've made, fine. Those are the rules by which I'll act. The collection and distribution of other people's SSNs is (as you've just read) a legally unrestricted activity and that's exactly what I'm doing. - - -10- Where do you get the SSNs ? Answer: "...there is no law..." so, just like CBI, TRW, TU, et.al., I don't have to tell you where I got yours. Ask CBI where they got your SSN; they won't tell you, and neither will I. - - -11- How do you check for accuracy ? This question bothered me a lot at first, however, it has become astoundingly simple to check whether a number is accurate or not. So, just exactly how do I do this ? CBI doesn't have to tell, and neither do I. "...there is no law..." - - -12- How can I get a copy of your list ? Answer: Unfortunately, I have found the drones to outnumber the worker-bees by a factor of about 10-to-1. This is not the soup-kitchen, it's a group project. If you want SSNs from me, then I want SSNs from you. In the past, I offered a 1-for-1 exchange. I will no longer make that public offer. What is offered is this: If you will send me full names and SSNs of prominently elected officials, media-babes, et.al., then I will (to the extent my database allows) send you back full names and SSNs of other prominent politicians and media babes, 1-for-1 if I can. Of course, full names and SSNs of any individual or group are still welcome, they just don't qualify for the 1-for-1 offer. Copyright, 1995 by Clint Danbury (Better Living Thru Better Living) ************************************************************************** X SNAIL ME + GABRIELLI'S (Mendocino,CA, USA) 0 X YER ROSEHIPS + 0 X IF YOU LIKED THIS POST! + *Pinot Noir* & *ASCENZA* (WHITE-BLEND)-YUMMY!0 ************************************************************************** [Ask Fer "Mendocino,Ca. -- *Gabrielli Wine*" at yer local wine shop if'n ya want to tend yer rugosa] Let your voice be heard in the campaign to save the life of Mumia Abu Jamal ++++ more info: http://www.calyx.com/ ++++ - ------- End of Forwarded Message ------- End of Forwarded Message

1 0

More on Belgian 'key escrow law'
by lvhove＠vnet3.vub.ac.be 17 Dec '03

17 Dec '03

I looked up the law mentioned in the newspaper article and it goes like this (non french speaking cypherpunks, please see comments below <grin>): ---- "Loi du 21 décembre 1994 portant des dispositions sociales et diverses" - published in the 'Moniteur Belge' (= the official journal in which all laws are published), Vol. 164, Nr. 250, Friday 23 December 1994, p. 31878-31963. (p. 31960-31961): " Art. 202 Il est inséré dans la loi du 21 mars 1991 portant réforme de certaines entreprises publiques économiques, un article 70bis, rédigé comme suit: <<Art. 70bis - Le Roi fixe, par arrêté délibéré en Conseil des Ministres, les moyens techniques par lesquels Belgacom et les exploitants des services non réservés qu'Il désigne doivent permettre, le cas échéant éventuellement conjointement, le repérage, les écoutes, la prise de connaissance et l'enregistrement des télécommunications privées dans les conditions prévues par la loi du 30 juin 1994 relative à la protection de la vie privée contre les écoutes, la prise de connaissance et l'enregistrement de communications et de télécommunications privées.>>" (p. 31961): " Art. 203 L'article 95, alinéa 1er, de la même loi est complété comme suit: <<5° l'appareil terminal rends inefficaces les moyens permettant, dans les conditions prévues aux articles 88bis et 90ter à 90decies du Code d'instruction criminelle, le repérage, les écoutes, la prise de connaissance et l'enregistrement des télécommunications.>>" ---- Simplifying it all seems to boil down to this: The 1994 Law ammends a 1991 Law; that is, it adds a couple of articles/paragraphs. Art. 202 stipulates that Belgacom (= Belgium's leading telephone company) and other telecom companies have to cooperate with law enforcement when it wants to tap telephone lines - no, sorry, make that telecom lines (!). Note that tapping is only allowed under certain circumstances stipulated in the so-called Privacy Law (see also my previous posting to this list). Art. 203 is the most important as far as key escrow is concerned. It completes Art. 95 of the 1991 Law which stipulated 4 conditions in which telecom equipment may be seized. These initial conditions are rather harmless (equipment does no longer conform to the initial specifications, it hinders public broadcasts, presents health risks for the users,...). Art. 203 adds a 5th and stingy one: equipment that makes tapping impossible may be disconnected from the network and seized ... On the face of it - I'm not a lawyer, so don't pin me down on this - this means no crypto (or only with key escrow) ... Ciao, leo _________________________________________________________________________ Leo Van Hove Centre for Financial Economics Vrije Universiteit Brussel (Free University of Brussels) Pleinlaan 2 B-1050 Brussels Vox: +32 2 629.21.25 Fax: +32 2 629.22.82 e-mail: lvhove(a)vnet3.vub.ac.be VUB's Web site: http://www.vub.ac.be _________________________________________________________________________

1 0

Re: Book on Electronic Commerce
by Pete Loshin 17 Dec '03

17 Dec '03

For the sake of completeness, I'll mention my book, too: _Electronic Commerce: On-Line Ordering and Digital Money_ 1995, 282 pages, $35.95 (includes CD ROM) Charles River Media, Inc. 1 800 382-8505 ISBN # 1-886801-08-8 Excerpts (preface, Chapter 3, part of Chapter 6) are available at: http://www.loshin.com/ -Pete Loshin pete(a)loshin.com

1 0