- cypherpunks-legacy - lists.cpunks.org

Re: More FUD from First Virtual
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:52 PM 12/8/95 -0500, Jon Cooper wrote: > The US government can stop it. It is irrelevant what *should* stop >it, but it's extremely useful to note that the US government's political >climate of paranoia and FUD in general will certainly not allow truly >anonymous cash systems inside of our country in the forseeable future. But who's going to ask? If an anonymous payment system springs up outside the US, we can use it as a store of value if nothing else or for shopping overseas. Domestically, we can convert non-anonymous payment systems into semi-anonymous ones. What counts is difficulty of transaction and market demand not legal structure. Thus, about five minutes after the "temporary VISA card" travelers check substitutes are issued, I can start selling them for (discounted) cash to all comers. Likewise Ecash laundry servers letting anonymous people use non-anonymous Ecash. It remains to be seen how much customers value anonymity. There should be a niche market in any case. DCF "Every man his own ISP."

1 0

Re: Free calls to Govt (fwd)
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

I did and it did not work. At 04:22 PM 12/10/95 EDT, you wrote: > I've been told that number is out of date. Since I forgot to save it, >would someone who did check and find out? > Thanks, > -Allen > > -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

More elveator problem
by Jerry Whiting 17 Dec '03

17 Dec '03

More on The Elevator Problem: I'll confess that we're working on a new private key encryption product. Free and clear of existing claims on intellectual property, I'd like a protocol that answers the elevator problem: how can Alice and Bob agree on a private key via a compromised channel? I don't want them to meet under a street lamp and whisper in each other's ears _before_ trying to establish a secret on a crowded elevator. I'm willing to accept that the basic question is undoable without stepping on DH et al., I just don't want to give up until all parties are convinced it can't be done. As I stated in my original post, we're willing to consider less-than-perfect implimentations if we can quantify mathematically the risk involved. In some scenarios, Alice and Bob might not expect any Eve's in the crowded elevator or value the content at such a price that they're willing to live with less than 100%. As long as we can document the risk, the end user can make the decision as to whether the risk is worth it. Something that I neglected to mention before is that Alice and Bob do have a unique ID within this system, not that they necessarily know each others. If one assumes that they do, they then share a secret: the knowledge of each other's unique ID. Another segment of our attention is being spent daydreaming about the potential applications of a secondary channel in the cleartext portion of a crypto "package" or "bundle". The comment about secondary channels that I believe Tim made regarding the inmates and the warden is something we discuss in our spare time. Then again the wheels of justice doth turn and patents ain't forever... Jerry Whiting jwhiting(a)azalea.com

1 0

Netscape speaks with a forked tongue:
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

Netscape speaks with a forked tongue: Jim Clark, top guy and owner of netscape, has issued a statement in support of government access to keys: "To secure Net communications, the government will need to have access to private data exchanges using what is known as a key escrow security system " and he has issued a statement that Jeff (a netscape employee) has very generously interpreted as anti GAK. (Government access to keys) The only clear and authoritative statement issued by Netscape on GAK is Jim Clark's speech in support of GAK. Everything else is a cloud of unintelligible fog, or was issued by people with no authority and given a minimum of publicity. Jim Clark's supposedly anti GAK statement was incomprehensible to me. Perhaps he needs a punchier ghostwriter: I offer my services free of charge. :-) If Jim Clark wishes to persuade us that his heart is in the right place, he should put something like the following somewhere on the Netscape web pages: "Our customers do not want government access to their cryptographic keys. Mandatory government access to keys violates the rights of our customers. Therefore we will not foist government access to keys on those customers who have freedom to communicate securely. We will only build government access to keys into our products for those customers whose governments force them to provide such access. " If that really is Netscape's policy, then they should tell the world that that really is Netscape's policy, thus instantly relieving the fear, uncertainty, and doubt created by the unfortunate widespread misinterpretation of Jim Clark's original statements. The only clear and authoritative statement issued by Netscape on GAK is Jim Clark's speech in support of GAK. Everything else is a cloud of unintelligible fog, or was issued by people with no authority and given a minimum of publicity. --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from the arbitrary power of the omnipotent state. http://www.jim.com/jamesd/ James A. Donald jamesd(a)echeque.com

2 1

[FYI] Corp.Spooks Outed + W3 Proxy Filters
by Dave Del Torto 17 Dec '03

17 Dec '03

PRIVACY INTERNATIONAL's BIG BROTHER INCORPORATED. A Report on the Int'l Trade in Surveillance Technology and its Links to the Arms Industry. <http://www.privacy.org/pi/reports/big_bro/> "WebFilter" (formerly "NoShit") <http://emile.math.ucsb.edu:8000/~boldt/NoShit/index.html> <http://pubs.iworld.com/ww-online/Nov95/news/noshit.html>

1 0

Re: Still more on the Digicash protocol
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:26 PM 12/8/95 -0600, Mark Twain Bank Ecash Support wrote: >>There's no need to send that payment info in the clear -- why not encrypt? > >DigiCash agrees that it is desirable to encrypt the payment request. The >problem is how? You can't use the payor's public key, since the payor is >anonymous to the payee. There are other, high overhead, protocols that might >be used, but after taking MIM into account, securing the payment request >from within Ecash while retaining acceptable latency is much harder to >acomplish than one might think. Obviously if the payer is the one transmitting the message, she doesn't use her public key to encrypt; hers would be used for signature if appropriate. She should use the payee's public key, or some negotiated key like DH. It doesn't lose any privacy, because she already knows an address to send the money to, and the payee can create a public key for that address, or some other public key he makes available to payers. >The best solution at this time seems to be to use the already existing https >connection to transmit the payment request. The next version of Ecash will >offer this feature as an option to the user. I had assumed that the payment information wasn't encrypted because that's a separate problem from the basic digicash, and because if the payer wants to keep the transaction private, she probably also needs to encrypt the other side of the transaction - e.g. the request for n widget at $d/widget. https or other ssl connection, or an encrypted telnet, or encrypted email, or some other protected mechanism all would seem to be appropriate. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281 # Anybody notice that Microsoft's Wide Open Road ad has barbed-wire fences # on both sides of the road?

2 1

Re: Netscape speaks with a forked tongue:
by Tim Cook 17 Dec '03

17 Dec '03

> > Again, you seem fixated on making Clark's opinions equivelent to the > position of Netscape Communications Corp, this is not a reasonable > assumption. Given Clark's position, I believe it is a reasonable assumption. Unless of course you hold that the Corp. as a legal entity could have a seperate position. In that case then WHO speaks for the corporation? Some lower level PR person? I don't think so...<s>. Tim Cook, Mindsource(tm) Librarian. "The World is a Database - Mindsource is the Search Engine." ______________________________________________________________ M I N D S O U R C E (TM) I N F O R M A T I O N N E T W O R K Send a blank Email to:mindsource@memo.net for full information Visit our W3 Site http://www.ultimate.org/mindsource/main.html D E S T I N E D FOR G L O B A L D I S T R I B U T I O N! Concept:"The Greatest Untapped Resource is Human Resource(TM)" Mindsource is a Reg. Trademark Copyright(c)1995 by Mindsource

2 1

Re: Netscape announces position against GAK
by tcmay＠got.net 17 Dec '03

17 Dec '03

Credit where credit is due. I for one am satisfied--and even pleased--with the Netscape position on GAK. It remains to be seen how steadfast Netscape, as the major player in the Web browser business, remains in the face of (likely) pressure from the government. It seems to me that we have have been quick to criticize Netscape--which is good, the quickness part--and thus we should be equally quick to praise them. To be sure, various of us might've written the Netscape position statement slightly differently, but this does not change the basic point: that Netscape has come out against the Administration's position on GAK. For this they deserve our praise. --Tim May (slightly drunk at 3 a.m. PST after a Robben Ford concert: highly recommended if you like the blues) Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

E-Mail Privacy (CP boo)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Forwarding Cyberia-L mail by: hayam(a)actcom.co.il (Avraham Hayam) on Sat, 9 Dec 6:16 AM ------------------- Greetings, The only way for E-Mail Privacy on the internet is - ENCRYPTION. You don"t have to be an Internet Expert to understand that data which is not encrypted is open for every one. On Oct. 20 1995 Andy Jonson-Laird <andy(a)jli.com> sent a most interesting data to the list concerning that the user has absulutly no control ever how the data is routed. A Mail that he sent to an address which is at the distance of 11 miles actualy did 1200 miles. It may be " The end of days vision" that privacy will be maintained without encryption. With the ongoing danger from the Cypherpunks, we must use very strong Algorithms. A French "algorithms cracker" recommended not long ago that the commercial sector have to use not less than 128 bytes based algorithms. I will appreciate to receive list members opinion. Avraham Hayam IT Systems Security Consultants - ITSSC P.O.Box 11233 Jerusalem, 91112 ISRAEL Tel: + 972 - 2 - 761 803; Fax: + 972 - 2 - 769 263 E-Mail: hayam(a)actcom.co.il

1 0

Re: Win NT proprietary pw encryption (Was: Re: Windows .PW
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Sat, 9 Dec 1995 03:15:51 -0500 (EST) you wrote: >I don't quite agree with the last part. It might be educational to do a spot >of cryptanalysis in an attempt to determine the nature of the proprietary >algorithm used. It wouldn't be "cracking" the password protection, but I >think the general effort to "out" proprietary crypto algorithms is productive, >particularly in the case of major software packages. > > >Anyone feel like putting together some sample plaintext/ciphertext pairs ? > Well, the problem with coming up with plaintext/ciphertext is that I've never been able to find out exactly where the the SAM database is physically stored. Using Registry Editor, it's visible but not accessible as part of the Registry. Microsoft's APIs won't give you access to the stored ciphertext, so some serious hacking is required here, I'm just not sure where to begin. I think a hacked version of the Registry APIs that allow you to read the ciphertext would be a good place to start, but again, I'm not sure where to begin writing such a thing. The second problem is that we're not sure exactly what gets hashed and in what order. Is it username0x00password0x00domainname0x00SID or something similar? Tough to tell and MSoft wants to rely on the "tamper-proofness" of NT rather than on algorithmic security. If anyone has more information on these issues, I'd love to know what's really going on there. Dan *************************************************************** #define private public dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ***************************************************************

1 0