- cypherpunks-legacy - lists.cpunks.org

Re: (Fwd) British Study Claims That Photo Credit Cards Don't Work
by David Loysen 17 Dec '03

17 Dec '03

At 12:58 AM 4/8/96 +0000, you wrote: >This comes from the FTC Privacy List, and is somewhat relevant.... >(The the "Crypto" in the title isn't, oddly...). > >Some thoughts... (er, questions): >1. What are the implications for log-on systems that rely on >recognition of faces (supposedly impossible for hackers to describe >and exploit)? Does anybody know how well these systems work? If I don't shave over the weekend will my computer know who I am Monday morning? Is my credit card going to have my face digitized and encoded onto the mag stipe for comparision with a video camera image at the time of sale? >2. Legal implications for witnesses? > I think many eyewitness accounts are already taken with a grain of salt, at least as far as picking a suspect. Certainly in court the lawyers say whatever makes their case look better. >------- Forwarded Message Follows ------- >Date: Sun, 7 Apr 1996 08:24:18 -0700 >From: taxhaven(a)ix.netcom.com (Adam Starchild ) >Subject: British Study Claims That Photo Credit Cards Don't Work >To: privacy(a)ftc.gov > > "Crypto-ID" Cards Not Effective > > Recent studies into the effectiveness of photo credit cards >have cast doubt over their ability to cut fraud. Dr. Richard >Kemp, of the Department of Psychology at Westminster University, >London, organized an experiment involving a London supermarket to >test the cards in "the real world." Most if not all credit card issuing banks use some form of fraud detection software. The next generation of these products will be analyzing transaction data from the card clearing banks in real time to stop fraudulent transactions before they are complete. Expect to see more "may I see your ID" questions as these systems flag transactions as possible fraud. I have had a credit card with my photo on it for several years, I can't ever remember a sales person who seemed at all interested in comparing the photo to me. > The supermarket was staffed by six people who were all >warned to be on the look out for fraudulent credit cards. Dr. >Kemp arranged for 44 of his students to pose as shoppers and test >the staffs' ability to spot photo-card misuse. Each student was >armed with four cards. One showed the student as they were, one >showed the student wearing make-up, one showed an individual who >vaguely resembled the student and the last card depicted someone >who looked nothing like the bearer. > People usually recognize photographs of individuals based on >a familiarity of the subject. A photograph captures only one >angle and expression out of thousands of different combinations. >People will recognize photographs of family, friends and well >known individuals easily. But how easy is it to accurately >compare a photograph with the face of a perfect stranger? At a >recent conference, Dr. Kemp said that matching a photo to a >stranger's face was "too difficult." He also said that in a non- >experimental situation, such as a supermarket, the incidence of >fraud detection would be even lower. > The results of Dr. Kemp's supermarket experiment proved very >interesting. In all, the majority of fraudulent cards were >accepted. Amazingly, 35 per cent of the cards bearing a >photograph of someone completely different from the student were >accepted. A massive 64 per cent of cards bearing a similar >individual were also accepted. Another factor which seems to >further prove Dr. Kemp's point is that 14 per cent of cards >bearing a true likeness of the student were rejected. > A few British banks are already offering customers the >opportunity to have their photograph etched onto their cards. >They claim a reduction in fraud has resulted from this. Dr. >Kemp's findings would seem to contradict this belief. Dr. Nicky >Towell, one of Dr. Kemp's researchers, said "There is a widely >held assumption that photo credit cards are a cheap and effective >way of stopping fraud. But this is not the case." > No one can tell how well photo credit cards will catch on. >But with the majority of people carrying at least one, if not >more cards of some sort, how long will it be before photos become >compulsory? The government knows that the introduction of ID >cards is a political hot potato, but how many people would notice >if they turned the cards we already have into crypto-ID cards? > > >Reprinted from The Mouse Monitor, The International Journal of >Bureau-Rat Control, a periodical published by Scope International >for its customers. Scope International is on the Worldwide Web >at http://www.britnet.co.uk/Scope/ > > >Posted by Adam Starchild > The Offshore Entrepreneur at http://www.au.com/offshore > > > >The privacy list is run automatically by the Majordomo list manager. >Send a "help" command to majordomo(a)ftc.gov for assistance. > >Rob. > >--- >Send a blank message with the subject "send pgp-key" >to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key. > > dwl(a)hnc.com David Loysen 619-546-8877 x245

3 2

Re: They're running scared.
by Michael C. Peponis 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Sun, 07 Apr 1996, jim bell wrote: [article snipped] >Articles such as this are interesting because they appear to be written >without any illusion that the interests of governments are anything other >than just that, interests of governments. They are NOT the interests >of the average citizen. Absolutly, and it seems that more and more thinking people are realizing this, as for the non-thinking ones, well we are better off without them, the only thing they contribute are problems Debate works to a point, but there comes a point and time where all that can be said, has been said, and we are past that point. Personally, I love national insecurity such as terrorist attacks and random bombings, wish there were more of them by more people. What they do is sow fear, instensify camps, and pit people against each other. Goverments are use to wars, where there are large, well-defined groups assult one another, they have huge problems dealing with small groups of people attack it or each other. That is what will eventually cause it to collapes, which is a good thing. For those who say that such an event would be catostrophic, that is a myth, I worked with someone from Berut a few years ago, when the goverment there collapesed. He said other than the perpetual mortor fire, and speratic bombings, life went on as usuall. People got up and went to work, people bought and sold, etc. From a microsopic scale, nothing had changed, it was only if you looked at the bigger picture that things were different, and quite frankly, those types of things do not effect us individually. I do not need an x trillion dollar economy to continue living at my standard of living, most of us on this list do not, the only people that benifit are the power brokers and the dumb, weak, and stupid. I have nothing against charity(that's what taxes amount to), but when charity reaches 50%+ of my income, and starts to erode my freedom, well now it's a problem. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: cp850 iQCVAwUBMWkWWUUffSIjnthhAQHEiQP/Sp5+UfCFGmvEO/9nRFBLXBm9haPiJC/y oVCoKQi/jeCkXy1HaPjrrObFkV0fvRsHxk5GvHXfX9sIkFi/i9mrGafpXFUuRfkP qua2wYp91Omh39QptHThGgEKl0sdKBzw+/9uHCqwUyViqoZZBO7Y7kUGffT9XL9m 13VTjMTyFz4= =e+UM -----END PGP SIGNATURE----- Regards, Michael Peponis PGP Key Available from MIT KeyServer

3 2

Bank transactions on Internet
by Jüri Kaljundi 17 Dec '03

17 Dec '03

Suddenly some banks here in Estonia have decided that they must start offering banking services over Internet already during the next months. What worries me is that some of them are talking about using 40-bit SSL as the main security mechanism. What about banks in US and Europe, how many of them are using Internet and WWW to offer their services already? Is it possible to use WWW forms to make real transactions or can you just view your transaction history and account status? In case the banks are using WWW forms and SSL, are the services limited to 128-bit clients? How is the client authentication handled? Does the client just get a plain username and password? I had a look at some banks like Security First National Bank and some others, and it seems that they use just SSL + username/password for they banking services. Does this really work, especially with 40-bit keys? SSL with client certificates would seem a little bit more secure once it is available, but still not secure enough for real banking on Internet. Just curious (and confused), Juri Kaljundi jk(a)digit.ee

6 9

Bulletin: Cypherpunks say no taxes owed by moneychangers!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:23 AM 4/8/96, jim bell wrote: >At 12:53 PM 4/7/96 PDT, Jim Gillogly wrote: >> >>jim bell <jimbell(a)pacifier.com> writes: >>>FWIW, I think that there is no capital-gains-type tax on currency >>>conversions. In other words, if I take dollars and buy yen today, and the >> >>I bounced this off a CPA, who said she would be very suprised if this is >>really the case: in general the IRS considers increases in wealth to be >>taxable, and unless there's a specific exclusion for currency transactions >>that she doesn't know about, she suspects this is not the case. As a >>conceptual counterexample she points out that you are responsible for any >>profit you make from selling your car for more than you pay for it (but, >>as you might expect, you don't get to take a loss if you sell it for less). > >That assumes that there is "profit" from exchanging currencies. On any >given transaction, there is never any "profit." The only thing that might >be called a profit is a difference in exchange rates, and that really isn't >an increase in wealth at any point. Ask that CPA to look it up. There are people and companies who make a nice business in currency exchange, ranging from the large companies one finds in international airline terminals and banks to the smaller, "Mom and Pop" moneychangers one finds in barrios and other such places. These moneychangers attempt to make a "profit" on each exchange (else they'd hardly stay in business). It will probably come as a surprise to them that, according to both a CPA and Jim Bell, no taxes are owed on their businesses, as "no wealth was created." Don't believe everything you read on this list, folks. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

International Net-Censorship Efforts Update
by Declan B. McCullagh 17 Dec '03

17 Dec '03

I've just doubled the number of international net-censorship efforts that I track on my web page: <http://www.cs.cmu.edu/~declan/zambia/>. Included are new updates reporting on Germany, France, Australia, Singapore, Canada, and China, among others. Please send me reports on countries I've missed! -Declan -------------------------------------------------------------------------- OTHER INTERNATIONAL NET-CENSOR EFFORTS By Declan McCullagh declan(a)well.com http://www.cs.cmu.edu/~declan/zambia/ France, China, Germany, Singapore, Jordan, the U.S., and many other countries are moving towards tighter control of the Internet. France and Germany want to see an international agreement of information controls emerge. Recently China required all of its estimated 40,000 Internet users to register at the local police station. This international crackdown marks a turning point in the development of the Net. Germany Germany cuts off access to holocaust revisionist web site (1/96) German Internet update, new laws planned (3/29/96) Los Angeles Times on German vs. U.S. netcensorship (3/13/96) German minister predicts collapse of governments (3/12/96) Germany's CompuServe net-censorship (12/31/95) France French government bans controversial book (1/96) French Jewish students sue ISPs for revisionist materials (3/14/96) French Jewish students sue ISPs for revisionist materials (3/15/96) France calls for "global Internet rules" (2/3/96) Europe Swiss statement on voice over Internet (3/16/96) Sweden proposes CDA-type law to control Internet (4/3/96) Italian net-censorship necessary, says Simon Wiesenthal Ctr (1/11/96) Turkey cracks down on Internet (2/18/96) Belgium bans non-escrowed encryption (1/10/96) Asia and Pacific Rim Singapore leader condemns Net (3/7/96) Indonesia attacks Net (3/11/96) Malaysia complains about uncensored Net, censors it (3/11/96) Singapore censors political, religious net.info (3/6/96) China China cracks down on Internet, "state security" cited (1/24/96) China's anti-cyberporn efforts (2/4/96) New York Times on China's net.crackdown (2/5/96) China's history of Net-regulation, cyberporn concerns (1/1/96) China requires Internet users to register with police (2/16/96) U.S. State Dept criticizes China's net.censorship (3/8/96) China applauds German net.censorship (1/11/96) Australia Australia considers net.legislation (2/13/96) New South Wales tries net-censorship (4/3/96) Australians upset by German Zundelcensorship (4/7/96) Canada Letter to Canadian minister (3/19/96) Canada needs to regulate Net, says Simon Wiesenthal Ctr (2/20/96) Middle East Persian Gulf States reluctant to move online (4/6/96) Jordan installs Internet screening facility (1/8/96) Saudi Arabian government says no unrestricted Net access (1/10/96) --------------------------------------------------------------------------

1 0

questions about bits and bytes
by Jack Mott 17 Dec '03

17 Dec '03

This may be a bit of a no brainer, but everything I have read sorta skips over this point. a bit is 1 or 0 8 bits make up a byte (0-255) If I have a 5 byte key, does that make it a 40 bit key? The only reason this doesn't make sense to me is it seems useless to use 5 byte keys, yet that is what companies export since the government limits keys to 40 bits. -- thecrow(a)iconn.net "It can't rain all the time" RSA ENCRYPTION IN 3 LINES OF PERL --------------------------------------------------------- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

1 0

Re: "Contempt" charges likely to increase
by jim bell 17 Dec '03

17 Dec '03

At 03:23 PM 4/8/96 -0800, david friedman wrote: >Have you read _The Hacker Crackdown_? I think it is pretty clear that part >of what was going on there involved law enforcement people deliberately >punishing BBS operators for behavior that was wicked but not >illegal--basically facilitating communications involved in committing >crimes (credit card number theft and the like). The punishment consisted of >seizing the computer and backups and holding it for a year or so as >"evidence"--without ever filing charges. > >Conceivably the owner could have taken legal action--but doing so would >give the law enforcement people an incentive to file charges, thus imposing >large costs on the owner even if he was innocent of any crime and could >eventually prove it. > >I suspect that a good deal of this goes on in most law enforcement systems, >in one form or another. Charging and convicting people is costly, even if >they are guilty--and there is often behavior that law enforcement people >want to prevent that is not even illegal. On the other hand, there are lots >of things police can do that impose sizable costs but do not require a >conviction, such as arresting you, holding you in a cell overnight, but >never actually trying you for anything. >David Friedman >School of Law >Santa Clara University This is yet another one of the many reasons I advocate a system, AP, that some people around here call "extremely radical." (By today's standards it _is_ "extremely radical," but only in the sense that many sheeple seem ready to continue to tolerate the status quo.) I assert that if there is a mechanism in existence over the medium to long term to allow officialdom to punish people without conviction for things that are not even crimes, then I see nothing wrong with setting up a different system to punish these _officials_, without conviction, for things that THEY would claim are not crimes. If those officials wish to avoid this punishment, they should resign or even better, use their powers to immediately eliminate that unfair and unjustified punishment for ordinary citizens. But I guess this solution is a bit too obvious for some, huh? B^) Maybe we should call it "Contempt of Citizenry." Jim Bell jimbell(a)pacifier.com

1 0

Re: Australia's New South Wales tries net-censorship
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 9:01 4/8/96, Mike Duvos wrote: >I'd be interested to know if the courts have ever had a case in >which a person has been declared to have been in "possession" of >illegal material merely by virtue of its momentary presence in >their cache, screen buffer, or usenet spool. If you want a real world analogy, there are cases where overeager USPS Inspectors who want to "get" someone have sent them porno as a Return Receipt Requested Item and then raided before the person had had a chance to open the package. That is possession under the Law.

2 1

Re: BATFC -- Bureau of Alcohol, Tobacco, Firearms and Cryptography
by Brian B. Riley 17 Dec '03

17 Dec '03

On 3/10/98 7:22 AM, John Young (jya(a)pipeline.com) passed this wisdom: >It worth noting that Microsoft and the Justice Department are >perfect twins of technology and law monopolies, using brute force >and contracts to get their way, both clothed in self-righteousness >and both led by charming weirdos, both totally obsessed with each >their own mad view of law and technology in the "public interest." John, would you really refer to Janet Reno as a 'charming weirdo'???? I can think of lost of names, epithets, and descriptions, but that surely would be far down my list.

1 0

Re: Disclosure of Public Knowledge to Foreigners
by cme＠acm.org 17 Dec '03

17 Dec '03

At 05:33 4/3/96, Timothy C. May wrote: >There is a reasonable chance the Supreme Court would see the overall >absurdity of a situation where the knowledge is freely available to 200 >million adult Americans, with no restrictions whatsover on publication, >discussion, etc., and yet uttering this knowledge in front of a foreigner >is a crime. > >I don't think this would pass Constitutional muster, as the lawyers like >to say. > >(The British at least have an Official Secrets Act. Much as I dislike that >Act, at least they are more consistent in the sense of classifying things >as being secret. How can the U.S. argue that knowledge available in any >large library or bookstore to anyone who wants it, citizen or not, may not >be "disclosed" to foreigners? If it's common knowledge, it's common >knowledge!) This assumes that the purpose of the ITAR restrictions is to keep a secret. To the extent that the gov't argues that, they have no case as you point out. However, the ITAR is there specifically to frustrate US businesses if they should want to sell or give away crypto overseas. The rules, despite their illogic, achieve that goal. I would like to believe that the Supremes would rule that the Gov't has no right to use what amounts to a secrecy provision just for harrassment -- but they might not. I had Mike Nelson say to my face, 1.5 years ago, that he knows good crypto is available to foreigners -- he just wants to make damn sure it doesn't come in shrink-wrapped packages from US companies. I can't judge the constitutionality of that position but it holds together logically. ["don't let American products hurt American interests" the battle cry runs] - Carl +--------------------------------------------------------------------------+ | Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | "Officer, officer, arrest that man! He's whistling a dirty song." | +---------------------------------------------- Jean Ellison (aka Mother) -+

2 1