- cypherpunks-legacy - lists.cpunks.org

Re: protecting against impersonation (was: CANADIAN PRESS REPORTS)
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>anonymous writes: >> I still feel such a sense of violation with what LD did, such an >> utter sense of helplessness at the character assassination I've >> suffered at his hands, > >So use PGP, sign your messages. Simple solution. Absolutely! Anybody who uses anonymous remailers to post to public areas, and does not use digital signatures to prevent spoofing when it is obviously needed, is a fool or worse.

1 0

WRITTEN CODE
by Daniel 'genius' Charpentier 17 Dec '03

17 Dec '03

In Raph Levien's Subject : Design proposal : crypto-capable generic interface he mentioned his desire to see more cryptographic program code and I didn't want to see this initiative die. I am a new commer to cryptography and I know I shouldn't be posting yet but that is what I thought cypherpunk postings was supposed to be in the first place ( program code, protocols, and algorithms ). Please don't flame me to badly for this message. I am doing everything I am supposed to before posting ( reading the FAQ's, the entire cypherpunk archive, and APPLIED CRYPTOGRAPHY by Bruce Schneier ) but I could not let this slip by. Let's talk more about the cryptographic algorithms, program code, and chips than politics. I hope this did not upset to many people

3 2

e$: What's a digital bearer bond?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Ps. I know I could probably look this up, but exactly what are bearer bonds? >I frequently hear them mentioned when market anonymity and money laundering >come up. It's the little questions which take the longest to answer... I wrote something here in cypherpunks this year called "The Book Entry / Certificate Distinction", which you might want to check out in the archives. Bearer bonds and bearer certificates (like cash) belong to the bearer. To be flip, possession is 100% of the law with a bearer bond. Bearer bonds can be stolen, but they aren't registered anywhere, which makes them useful for anonymity. All along the bottom of a bearer bond are little squares called coupons, which you cut out periodically and mail in to the issuer, and they'll send you back an interest check for that period's interest. Lots of financial phrases come from bearer bonds. When a bond trader talks about a bond's interest rate, she may use the word "coupon" interchageably, as in, "That bond has a 7% coupon.". Meaning, it pays 7% interest per year. Then there's the phrase "clipping coupons", meaning someone is retired or independently wealthy and living on their bond interest. Every month the interest on one bond or other would come due, the coupons clipped and sent in to the bond's issuer in return for an interest check. Most securities these days are registered to the owner somewhere, at a trustee, at the issuer, at a clearinghouse, or some combination of all. In fact, most securities these days don't exist in physical form at all and exist only on the books at clearinghouses and brokerages. This is why your stock broker squalls about "physical delivery" when you ask for a certificate. About a year ago, we talked about the Depository Trust Company, the clearing house for the New York Stock Exchange. They have entire issues there consisting of a single piece of paper in the clearinghouse vault which are traded entirely on a book entry basis, that is, only accounting entries are swapped when these securities change hands. There are several reasons for this. The putative reason is that as taxing authorities, like the Internal Revenue Service, have relied increasingly on various cash-flow taxes like the income tax for thier revenue, they have slowly regulated or legislated bearer bonds out of existence in favor of registered, and more to the point, book-entry securities. However, like everything else, law and regulation is really a creature of technology, and the technological reason that book-entry and consequently registered certificates are popular is because they're cheaper to handle locked down in a vault in a clearing house somewhere with the ownership changing hands by changing offsetting accounting entries at the buyer, seller, and clearinghouse. This is a direct consequence of financial systems organized on top of hierarchical communications networks, which was how all communication networks were organized before automated switching, and, more to the point, microprocessor switching made them more and more geodesic in structure. You might want to check the archives for more of my rants here on that subject. The thing about digital certificates, of which ecash is only the camel's nose in the tent, is that while electronic, they're actual bearer certificates. You get a lot of great non-sequiters when you talk about them. "Digital bearer certificates", when you can't actually touch them to "hold" them, Electronic "physical" delivery, and the like. So, with a digital bearer bond, you would have in effect a bundle of digital certificates. One would be for the principal and whould be good for the repayment of that principal on the date the bond was called or the redemption date, however the bond offering is written. The other certificates would represent coupons, one for each interest period for the life of the bond. These digital certificates, in combination increasingly geodesic networks enabled by exponentially falling microprocessor prices and strong cryptography, theoretically allow secure, point-to-point trading of any security of any amount with instantaneous clearing and cash settlement. The current hierarchical capital market model, with brokers, "wholesalers", and central exchanges has been collapsing for decades since the advent of electronic trading systems (glorified computer bulletin boards, really) like NASDAQ. With the coming of digital certificate technology on public networks, these markets will be "surfacted" into smaller and smaller concentrations of information and capital. I have no idea what markets will look like when we "return" to things like digital bearer bonds, but there's a prima facie example now on the web as we speak. This week Mark Grant just upgraded his Electronic Cash Market (ecm)-based cyberbuck (c$) webpage "trading post", so that it will take the new Mark Twain ecash. That means that it will be possible to trade old Digicash beta-certificate c$, which sold for 5 cents US per c$, and instataneously clear and settle them for Mark Twian ecash on-line. No checks have to be sent between trading parties to buy these certificates anymore, which should lower transaction costs significantly, not to mention the float on the money while the trade settled. It was curious that people were buying these things to begin with, as they had no value at all except their uniqueness, anonymous electronic transmissibility, and a promise from Digicash BV to issue only a millon of them. Yet now, with the market made infinitely more liquid with the introduction of real-time cash settlement, things will get, as Alice said, "curioser and curiouser". Digicash still has some large number of these things in the "treasury" unissued. I believe these original beta-test certificates have both payee and payor anonymity, especially if traded offline, which has been how they've been traded through the ecm. More fun with numbers. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

[NOISE] Review: GoldenEye
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just got back from the new Pierce-Brosnan-as-007 flick. It had a few typical "hacker" stereotypes, and a couple of interesting crypto relevant references. * Boris, the stereotypical hacker, was hacking through American banks. A screen had the words "Department of Justice" and the DoJ logo; underneath were the words "Clipper Chip" and a list of banks. * The archvillian's plan involved a massive money transfer and an EMP pulse; he very briefly explained the effects of what would happen if every computer in London were rendered non- functional. Possible crypto-anarchy bits. * Boris should learn the value of strong passphrases. His password for the massive mainframe which will be used in the archvillain's scheme is a five-letter dictionary word, which didn't change (and it was used on two different computers), and he revealed it indirectly (it was a word puzzle). * A few on-computer-screen references to "encryption". * Boris and the mastermind kept bantering about "breaking codes." * Boris' computer in Russia - in his apartment - has a domain ending in ".comp.math.edu"; when his screen lights up with the words "INCOMING EMAIL" he goes into a live chat (complete with graphics). Above-average action/adventure flick. The technical mistakes are forgiveable in the interest of dramatic license. Don't watch it for the techno/crypto bits, though. Watch it because lots of things blow up :) Dave----- David E. Smith, c/o Southeast Missouri State University 1210 Towers South, Cape Girardeau MO USA 63701-4745 +1(314)339-3814, "dsmith(a)midwest.net", PGP ID 0x92732139 http://www.midwest.net/scribers/dsmith/ - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMK1btCoZzwIn1bdtAQFmOgF/ZLYc3sT1L5sQS+wqmS5U6wsx9jL86job Ie6DU65FIuSZF6vFDBDNZFxZxs0HuaR6 =5PGz -----END PGP SIGNATURE-----

2 1

Design proposal: crypto-capable generic interface
by Raph Levien 17 Dec '03

17 Dec '03

Hi to cypherpunks who write code, The recent discussion of "plug-in" crypto is reminding me of some design work I did earlier this year. This post presents the motivation and some of the details of that design, slightly updated. First, a few words about what I consider to be good interface that can support plug-in crypto. It has to support both email and the Web; I feel that everything else follows. It should support completely transparent integration, by which I mean no extra clicking or commands or anything like that. Finally, it should be generic in that it will support a number of other plug-in applications besides cryptography. Two specific applications which interest me are file format conversions and external-body resolving. The design is based partly upon .mailcap, which is perhaps the best example of a generic interface we have today. However, while .mailcap is a nice interface for popping up windows to present semi-interesting multimedia types, it certainly cannot support transparent cryptography. I feel that its primary weakness is the inability to support MIME to MIME rewriting. However, .mailcap has some good ideas which are worth stealing. For the purposes of this proposal, I will assume that all objects are MIME encapsulated. I think that's a reasonable assumption, as it handily covers all cryptographic protocols that have any hope of surviving. I will propose my design at a very high level. Please forgive me for leaving out the juicy details. I propose that the new interface lives as a sort of daemon, rather than a static collection of command line script pieces. A reasonable way for applications to talk to the daemon would be Unix domain sockets, or whatever the equivalent is on Mac and Windows platforms. There should be a simple protocol for automatically starting up a daemon if there isn't one already running. The first part of the interface is the negotiation. The daemon tells the application what MIME types it can understand (this part is very similar to the .mailcap file, but doesn't include the corresponding command lines). In reply, the application tells the daemon what MIME types it can understand (this is like the Http-Accept: field in HTTP). Once the negotation has been established, the application can send the daemon MIME objects that the app does not understand but the daemon does (for example, an image/fractal). The daemon can return a MIME object that the app does understand (for example, an image/ppm). Alternatively, the daemon may request an authentication. This is useful when resolving external bodies that require authentication, including non-anonymous FTP, and standard authenticated HTTP. In this case, the daemon sends a message to the app requesting the authentication. It specifies whether it needs both username and password, or just password. In the latter case, it hands a username to the application. The application can then query the user for the authentication data. It hands this back to the daemon. In reply, the daemon indicates success or failure. In case of success, it hands the object back to the app. I'm quite pleased with this protocol as outlined. It's fairly simple, which means it might actually get implemented. It's also easy to see that it does exactly what you want for file format conversions, external body resolving, and decryption of encrypted messages. Encryption is a bit more tricky, but in essence you just hang a premail-alike off this kind of protocol. The hard part is specifying the key, but you just call it a "parameter" and put in hooks for the daemon to ask for whatever parameters it needs. This requires that keys have some nonforgeable names, which is unfortunately not a feature of PGP 2.6.2. S/MIME will do it just fine, if you buy into the Certifcation Authority (<wink> at Nick Szabo). One final aside: I've been fairly frustrated with this mailing list as a forum for talking about real design proposals and implementation issues. Ignorant posts by the likes of Dr. Fred and Alice d'Clueless tend to attract far more attention than real crypto work. I want a forum for, and just for, cypherpunks who write code. If I had just a smidgen more free time (as if), I'd be trying to start one myself. Anyone else? Raph

6 9

Oracle's "internet terminal"
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

The recent issue of _Computer Reseller News_ has a couple of items on the "internet terminal" being readied by Oracle. I'll quote a couple of crypto-relevant excerpts: 1. Interview with Larry Ellison (Oracle Corp's Chairman/CEO) Q. How far along are you in the development of the $500 Internet Network Terminal? A. We'll be delivering the prototype machines this year with full production in the third quarter next year. ... Q. Will you release Application Programing Interfaces for the Oracle browser and server? A. We will use industry-standard APIs that are accepted by everybody, not Microsoft-proposed APIs. ... Q. What differentiates the Oracle Web products from competitive offerings in terms of pricing and technology? A. There will be standard Web payment schemes. We'll use them, as will everybody else. We won't differentiate ourselves on basic payment schemes. The thing that will differentiate us is security protocols, the ability to use text processing, database processing, video processing, our video server technology and our powerful client. 2. Ellison's field of dreams - $500 PC (by Ken Yamada) ... Oracle's chairman and chief executive, Lawrence Ellison, previewing his latest futuristic vision at a trade show last month in Geneva, said Oracle is developing the computer and that it will be shown early next year. The desktop version of the new system, called a "network computer" and referred to as an "NC" rather than a PC, is expected to sell for about $500 and will use Internet servers to do the bulk of its computing. Basic hardware will include an inexpensive microprocessor, a small amount of memory, a monitor and a keyboard, but the device will lack storage and software. [I guess, they mean no permanent storage or software other than the browser in ROM. No remembered state, no viruses... -DV] ... The Redwood Shores, Calif., company is developing the computer's operating system and technical design, but the unit will be produces by hardware manufacturers, said Farzad Dibachi, an Oracle senior vice president. While Dibachi would not name specific manufacturers, he explained that Oracle's participation in the device's technical development was similar to the role it played in developing a digital television set-top box with Apple Computer, which produced the box's hardware. ... Oracle plans to sell software that turns World Wide Web sites essentially into central processing units for the new computers. ... "If computing is to go to the masses and we're doing electronic commerce," said Dibachi in a telephone interview from Geneva, "you have to have devices that are simpler." Oracle's Laursen said he expectes that eventually many different companies will manufacture the devices, which he described as an entire line of products encompassing two-way pagers, intelligent telephones, mobile computers, desktop systems and television set-top boxes. Each of these devices would rely on the Internet to do its core processing work. He said he expected Oracle to develop as many as 50 working prototypes by early next year. ... Oracle also plans to leverage its wireless communications software products and give some of the devices wireless capabilities. "We're still trying to figure out what processor to put in," Laursen said. Under consideration are chips from Mips Technologies and Motorola Inc. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: WRITTEN CODE
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:51 AM 11/18/95, Daniel 'genius' Charpentier wrote: >I didn't want to see this initiative die. I am a new commer to >cryptography and I know I shouldn't be posting yet but that is >what I thought cypherpunk postings was supposed to be in the first >place ( program code, protocols, and algorithms ). Please don't ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The list is about several things, some of which overlap the topics routinely discussed in sci.crypt and sci.crypt.research. Algorithms, code, etc. _does_ get discussed a lot, as you'll surely see as you peruse the archives. Volume-wise, it is a drop in the bucket. But this is not surprising, as primarily mathematical questions and answers tend to be brief. (You'll see this in the many one-line answwers to questions about cryptographic algorithms....) Also, technical questions tend to have precise answers, usually with answers in the various crypto texts and proceedings of the Crypto and EuroCrypt conferences. And technical questions which _don't_ have simple answers in the texts tend of course to be _research_ questions, and the dynamics mitigate against lively discussion until some progress is made. The social, political, and economic aspects are seldom discussed adequately elsewhere, and one thing the Cypherpunks group has really led in is the discussion of digital money, anonymous systems, pseudonyms, reputation, markets, and a host of other such topics. These topics can border on pure politics if people are not careful, but are generally close to the topics discussed at the first meeting over three years ago, before there was even a mailing list. >flame me to badly for this message. I am doing everything I am >supposed to before posting ( reading the FAQ's, the entire >cypherpunk archive, and APPLIED CRYPTOGRAPHY by Bruce Schneier ) >but I could not let this slip by. Let's talk more about the >cryptographic algorithms, program code, and chips than >politics. So, go ahead and talk. I mean this seriously, not sarcastically. No one will chastise you or anyone else for discussing technical cryptography. There are obviously folks interested in this. Experts, even. Published experts, even. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

ZD Net Update v.1 #2
by wwwziff＠internet.com 17 Dec '03

17 Dec '03

__________________________________ZD Net Update_______________________________ v. 1 #2 11-13-95 Welcome to ZD Net Update, the free E-mail newsletter created especially for registered users of Ziff-Davis Interactive's ZD Net/World Wide Web edition. ZD Net Update is a bi-weekly bulletin that alerts you to new and exciting developments on ZD Net. In this issue: > ZD NET COMDEX/FALL '95 COVERAGE KICKS OFF > ZIFF-DAVIS PREMIERES ZD INTERNET LIFE ON THE WORLD WIDE WEB > TRUE INTERACTIVE REALITY ARRIVES ON ZD NET > ANNOUNCING SNAP SOLUTIONS TO COMPLEX PROBLEMS > MEASURE THE HEALTH OF THE NET WITH THE INTERNET INDEX * * * * * * * * * * ZD NET COMDEX/FALL '95 COVERAGE KICKS OFF Comdex/Fall: It's been called the Greatest Show on Earth, and for good reason. All this week the ZD Net Special Report http://www.zdnet.com/~zdi/comdex/filters/main.html will provide continuous updates from the trade show, complete with daily news updates, expert commentary, and Live Chats. Follow PC Magazine's Technical Excellence Awards, cybercast as a virtual 3D world. Get the skinny from PC Week's Spencer F. Katt party. And learn all about the new products that have attendees buzzing. For all the sights and sounds of the show, ZD Net is the place to be. * * * * * * * * * * ZIFF-DAVIS PREMIERES ZD INTERNET LIFE ON THE WORLD WIDE WEB This month marks the debut of ZD Internet Life (http://www.zdnet.com/zdil/) the first interactive magazine designed from the ground up around a Web site. Combining a magazine, a Web site, and a CD ROM, ZD Internet Life is focused on using the Internet for fun, profit, and personal growth. The editorial staff is headed by Bill Machrone, ZD Internet Life's Editor-in-Chief, Ziff-Davis's Vice President of Technology, and one of computer journalism's most respected stars. It also includes Web doyenne Angela Gunn and Associate Editor Lisa Holzer. Together with expert reviewers, ZD Internet Life's staff picks "The Best" sites and provides a top-to-bottom listing of "The Rest" of the sites that address a given topic under the categories of fun, profit, and personal growth. Readers who visit the Web sites will be able to add their opinions to an online database of site reviews. The content of the Web site is a superset of what will appear in the magazine and on the CD ROM. In the words of the ZD Internet Life editors, "ZD Internet Life is a Web site with an accompanying magazine. In other words, what you see right here is a lot like what you'll see on your local newsstand three months from now. Make sense? Welcome to the future of publishing." * * * * * * * * * * TRUE INTERACTIVE REALITY ARRIVES ON ZD NET Blast off into the future with ZD3D (http://www.zdnet.com/~zdi/vrml) a new interactive virtual reality area on ZD Net. Designed to serve as the preeminent source for interactive virtual reality on the Internet, ZD3D provides users with a rich and evolving virtual reality site, direct access to other 3D Web sites, and a wealth of news, events, articles, and commentaries focusing on virtual reality. ZD3D's design is based on Virtual Reality Modeling Language (VRML), a technology standard created by Tony Parisi and Mark Pesce that makes 3D environments on the Internet accessible through a standard PC. Users will feel as if they're actually strolling around 3D Web sites at will, obtaining information in the form of graphical, three-dimensional metaphors. In building the area, ZDI obtained the support of both Pesce and Parisi, who will contribute exclusive VRML commentaries and updates to ZD3D. In addition, Parisi helped ZDI build the ZD3D site through Intervista Software, his VRML technology and consulting firm. When ZD Net users click on ZD3D, they're given several options, including hot news; Parisi and Pesce's commentaries; the WorldView VRML browser from Intervista Software and other VRML browsers; and Terminal Reality, ZD3D's interactive virtual reality experience. The WorldView browser can be downloaded for free, enabling users to access the Terminal Reality world and launch to the other 3D Web sites available there. Once in, users navigate through a virtual airport, complete with departure gates to other interactive 3D Web sites, a central newsstand, and advertisements on walls and vehicles. Users are transported to 3D sites via a wide range of vehicles, including rockets, jets, ships, buses, and trains. Over the next six to nine months, ZD3D will include 3D chat, animated objects, and 3D sound. Experience the brave new world of virtual reality on the Web. Experience ZD3D today! * * * * * * * * * * ANNOUNCING SNAP SOLUTIONS TO COMPLEX PROBLEMS Just don't have enough time to design your own home page? Relax, help is on the way. The ZD Net How To Design Your Own Home Page SnapSolution http://www.zdnet.com/~zdi/software/snapsol/snapmain.html provides all the knowledge you need to stake a claim on the World Wide Web and to put up your own site for the whole world to see. This informative, entertaining guide offers a step-by-step tutorial, using programs chosen from the thousands of files in ZD Net's shareware libraries as well as colorful screen shots illustrating the key points. SnapSolutions offer hands-on, step-by-step advice on how to make your life more productive using shareware. Appearing each month, SnapSolutions will focus on both computing and non-computing goals alike. The next two SnapSolutions will help you create our own screen saver and holiday greeting cards. SnapSolutions: shareware at its best. * * * * * * * * * * MEASURE THE HEALTH OF THE NET WITH THE INTERNET INDEX Got an extra couple of grand burning a hole in your pocket? Maybe it's time you invested in the Internet. Introducing the Inter@ctive Week Internet Index, or @Net Index, http://www.hydra.com/interactive_week.html a collection of 37 Internet-related companies that give investors a formal measure of the performance of the emerging Internet industry. The @Net Index, which trades under the symbol IIX, was developed by Inter@ctive Week and the American Stock Exchange to better measure the performance of businesses associated with the Internet. It does this by focusing on select Internet service providers, commercial online service companies, Internet tool companies, multimedia publishers, and networking companies. The @Net Index also includes providers of technology expected to shape the future of the Internet, such as videoconferencing and interactive television. The @Net Index is a bona fide investment vehicle; options contracts on it will trade every business day on the floor of the American Stock Exchange. Investors will trade options based on the direction the index takes, over time. Initial expiration months are November and December 1995; January, April, and July 1996. The @Net Index closed Oct. 17 at 215.04, up 52 percent since the beginning of 1995. The Standard & Poor's 500 was up 28 percent for the same period. For more information about investing in the Index, call (800) THE-AMEX or check out the AMEX's Web site at http://www.amex.com. The Inter@ctive Week Web site (http://www.zdnet.com/~intweek) provides trading updates. * * * * * * * * * * ZD Net Update is the official newsletter of ZD Net/World Wide Web Edition. It is compiled by Tom Schmidt (tom_schmidt(a)zd.com) Feel free to respond with any news, notes, comments, or suggestions. To unsubscribe to ZD Net Update, point your browser to: http://www.zdnet.com/cgi-bin/ziffmail.pl/update and select "Unsubscribe to ZD Net Update."

1 0

protecting against impersonation (was: CANADIAN PRESS REPORTS)
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

anonymous writes: > I still feel such a sense of violation with what LD did, such an > utter sense of helplessness at the character assassination I've > suffered at his hands, So use PGP, sign your messages. Simple solution. > that I feel that I must take some token action to "set the record > straight". Something which clears my name. This post wasn't signed off, but I presume you are "Alice d'nonymous", it would help lots if you could get yourself an account with a nym server, such as alpha(a)c2.org. That would have the advantages that your email address would be recognizable, and that people could reply to you if they wanted to. If having a working reply address bothers you, well at least sign your posts, if you're concerned about a persistant identity, the tools are available to do it. Complaining about things which have simple technological solutions won't get you much sympathy. Adam

2 1

Re: RealAudio website TEMPORARY PASSWORD
by Richard.Johnson＠Colorado.EDU 17 Dec '03

17 Dec '03

> > Username: cpunks >TEMPORARY Password: New.Norfolk > I assume that temp password will be changed to cypherpunks soon. Note that Username: cypherpu [8 char limit] Password: cypherpunks also works. Someone set it up a few months ago. Richard

1 0