- cypherpunks-legacy - lists.cpunks.org

Re: "Utilization Review"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:22 AM 8/19/96, Black Unicorn wrote: >I listened with horror this evening to a radio program which >discussed the state of medical record privacy today. > >In one segment a doctor (psychologist) described an experience >she had after a session which was covered by the patient's >insurance plan. A friend of mine is a psychotherapist very concerned with such issues. There are many pressures on him to reveal information about patients, most of which are "unsurprising" in a world of what can only be called "socialized medicine." (I say "socialized" in that very few persons pay cash or their own money for medical care, psychiatric treatment, sports injury therapy, etc. Most are paying only a per-visit deductible, if even that, and the rest of the charges are picked up by their employers, their insurance plans through employers, the various social welfare institutions, etc.) Insurance companies want proof that the treatments are needed, or are working, and cannot merely take the word of a shrink, for example, that his services are needed. (I can think of some solutions, such as "second opinions" and "independent review panels," but, I can tell you, such things are not common with psychotherapy regimens.) >The doctor in question received a phone message with a 1-800 .... >about the patient's session in order to conduct a "utilization >review to determine medical necessity." Most alarmingly, the >representative could be heard typing on a computer during the >entire review. Let's hope the resulting entries did not show up on a Web page! (This has actually happened, accidentally. Only discovered when the search spiders found the data and others then found the records.) >The program went on to indicate that among the provisions in the >most recent health insurance reform bill there was a provision >for information sharing among insurance companies to facilitate >the transfer of insurance policies when the insured switches >jobs. Among the more alarming suggestions in the legislation is >the use of a "unique medical identifier." Many of you will see >this coming. One of the currently proposed "identifiers" is the >Social Security Number. First, Clinton's dormant Health Plan (her husband is not pushing it) would've _required_ such cross-linking of records. My friend the psychotherapist is a liberal, but was aghast at this and lobbied with his fellow mental health care professionals against this. He also got PGP as a result of this scare. Second, the "Social Security Number" worry is misplaced. They _already_ have enough identifiers to cross-link records til the cows come home. Thinking one is safe if the SSN is not used is "ostrich security." The real issue is having confidential medical or psychiatric or legal records out of the containment of a trusted holder. >Members of the list might also wish to consider that companies >which self insure their employees for health benefits are >entitled to all their medical records directly. Indeed, when I was at Intel an engineer was outraged almost to the point of quitting and filing a lawsuit when he learned that his "Human Relations" bimbo in a cubicle down the hall had the details of his vasectomy. I'm sure by now the news of his vasectomy is a hundred different file system in a dozen different institutions. An Alta Vista search should turn it up. --Tim May ObCrypto Relevance: One of the ways safes (the steel kind, not the alternative to vasectomies kind) got stronger was not through imploring and lecturing, as we in the crypto community do, but through _insurance_. Why? A way to discount future costs/risks to the present. A merchant who has never been robbed probably doesn't think about the security of his safe. But his insurer does. And he says to the merchant: "The charge is $2000 a year if you continue with your current safe, and $1000 a year if you get a Mosler Titan-2 safe. Your call." The same motivation is, I think, what will eventually get security and crypto more widely used. A hospital sued for multiple millions because its records got intercepted and placed on the Web will have its insurance company rethinking policies and rates, and setting procedures for protection of information. This will drive security in a way that lectures, rules, and even scare stories will not. Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Unix passwd-cracker online?
by couto＠oim.uem.mz 17 Dec '03

17 Dec '03

Hi Arnauld! Where can I get this file??? Is there a new version of Cracker Jack than 1.4? There is a whay of puting Cracker Jack to manage passwords bigger than 8 characters? Thanx in advance, cRaZy bYtE couto(a)oim.uem.mz On 17 Aug 96 at 22:53, Arnauld Dravet wrote: > Date sent: Sat, 17 Aug 1996 22:53:51 -0500 > From: Arnauld Dravet <scraver(a)mnet.fr> > To: cypherpunks(a)toad.com > Subject: Re: Unix passwd-cracker online? > there's a new cracker under dos called John the Cracker, and coded by > UCF96. It's optimized for Pentiumsand is better than cracker jack on a > lot of points : can work with or without wordlists, and u can modify all > what u want....approx 30% faster than cracker jack on a pentium (i run > it at usually 4000 cps on a P90/32Mb ram and a 25Mb wordlist (yeah it's > big)) > > scraver(a)mnet.fr >

1 0

No Subject
by winsock＠c2.org 17 Dec '03

17 Dec '03

DISCORDIAN SOCIETY SUPER SECRET CRYPTOGRAPHIC CYPHER CODE Of possible interest to all Discordians, this information is herewith release from the vaults of A.I.S.B., under the auspices of Episkopos Dr. Mordecai Malignatius, KNS. SAMPLE MESSAGE: ("HAIL ERIS") CONVERSATION: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 STEP 1. Write out the message (HAIL ERIS) and put all the vowels at the end (HLRSAIEI) STEP 2. Reverse order (IEIASRLH) STEP 3. Convert to numbers (9-5-9-1-19-18-12-8) STEP 4. Put into numerical order (1-5-8-9-9-12-18-19) STEP 5. Convert back to letters (AEHIILRS) This cryptographic cypher code is GUARANTEED TO BE 100% UNBREAKABLE.

3 2

Re:Why BlackNet *IS* a Data Haven
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Tim May writes: > Without splitting too many semantic hairs about the precise definition of > "data haven," let me examine some ways in which BlackNet behaves > identically to a conventional data haven. I would be willing to concede the point if you would take a few seconds to examine the issue of complete lack of persistence in BlackNet. Your descriptions of BlackNet as a data haven seem to be completely based upon the presumption that an anonymous contact service and contract exchange is the functional equivalent to a data haven. Here are a few reasons why I would disagree: As a publisher of "naughty bits" I do not have the ability to just toss data up and assume that it will be there when someone wants it. I am forced to continuously monitor the appropriate newsgroups to find messages from people asking me to post the blueprints to the orbital mind control lasers or kiddie porn. I cannot put my data onto "the Net" with an expectation that any arbitrary user will be able to get the bits one month later. To maintain persistence I need to constantly repost my data, making it easier for authorities to trace me through simple taffic analysis if nothing else. > The classical data haven is closely identified with "place." To many > people, they naturally assume "data haven" = a haven for data, a "harbor" > (same IE root as haven) = a physical place. > > But is "place" important? No one has really claimed place is important, in fact the ideal data haven has no physical existence whatsoever. This is a given. As a practical matter it is a lot easier if you start off in a "place" because there are fewer complications but this has never been a necessity. > A person in the U.S. seeking the Necronomicon posts a message to BlackNet > (or any similar forum, using the same methods) asking for a copy of it, or > offering to pay for it. (Whether the information is free or for a fee is > not central to the idea.) This request is, of course, untraceable. > > Anyone, anywhere in the world, with a copy of this banned material on his > or her private machines may see this request and respond, either giving the > material away, or negotiating a fee. (As I said before, the absence of a > robust digital cash system, bidirectionally untraceable, is a known > limitation of all such systems.) Now you reveal the objection I had to BlackNet being a data haven. What if only one person has a copy of this banned material? It may not be in this publishers interest to have the data available to anyone for posting in response to the query ("Information does not want to be free, it wants to be expensive and liberated...") and some data is not widespread enough or of interest to enough people to assume that multiple copies exist to those who read BlackNet postings. Therefore the only way for a publisher to maintain availability of their data is to constantly monitor the appropriate newsgroups and republish for each request, persistence is maintained only through eternal vigilence (much like liberty, only requiring a lot more effort :) > It's a data haven. No, it is an anonymous contact service. To claim this is a data haven is like claiming that the classified ads in a newspaper are the equivalent to a mall; you could probably find the same goods if you looked long enough, but there is a reason that manufacturers sell goods through stores rather than just posting classified ads across the country. When one does not have the time to check the classified ads, wants to goods from a reputable source, and wants the goods in a timely fashion they will go to a shopping center. jim

2 1

Hettinga Plays Horseman, Gets the Last Word...
by Robert Hettinga 17 Dec '03

17 Dec '03

It seems the former Office of Technology Assessment, now called the Institute for Technology Assessment (Go, Newt!), had a need for a horseman on their law-enforcement panel tomorrow. Anyone know where I can get a riding crop? :-). I'm scheduled, anyway. I'm in Cupertino at the moment (the Mac-Crypto conference was, er, insanely great; more on that later), and I haven't received the plane tickets yet (Bob Hettinga: You Buy, I Fly), though they're supposed to show up today. We'll see when I get home tonight. Oh. Any former Pac-Man addicts remember the name of the ghosts? I think there were four, right? Cheers, Bob Hettinga ----------------- The Institute For Technology Assessment ITA INSTITUTE FOR TECHNOLOGY ASSESSMENT WORKSHOP DIGITAL MONEY AND PUBLIC POLICY SEPTEMBER 10, 1996 US House of Representatives, Cannon Office Building, Room 121 A Workshop on Public Policy and New Technology: "Digital Money" is a rapidly evolving financial/communications technology. It is important that government, industry, and the public fully understand the unique characteristics and potential benefits and costs of this radically new technology, so that benefits may be fully realized and costs avoided through early, judicious attention to public policy issues and concerns. This workshop brings together the stakeholders and interested parties -including the public and their government representatives-to consider the issues that may be posed by this emerging technology. In this workshop, attention will be focused on three questions: What issues need to be resolved now if development of digital money is to proceed with minimal social costs and institutional risks? Where is there general agreement about needed actions, or about reasonable solutions to recognized problems? Where are there true uncertainties that must be monitored, solved empirically, or objectively researched? The workshop will consist of three sessions. Each will begin with invited presentations, followed by open discussion among presenters and participants. Moderator: Dr. Wayne Boucher of Strategic Futures International 10 a.m. Greetings and Introductions Keynote Address: The Honorable Michael Castle Chairman, Subcommittee on Domestic and International Monetary Policy House Committee on Banking and Financial Services 10:30 a.m. Session I : Digital Money Systems, Today and Tomorrow - Industry Perspectives Who are the players in developing digital money -and what new players will emerge? What are the potential benefits -and costs-for banks, credit card companies, telecom companies, software vendors, or others? What has been learned from early pilot systems? What are the relative advantages-and risks-of smart cards vs. network-based systems? What older payment systems lose ground to electronic money and smart cards? Is the playing field level with respect to regulation and legislation? Specific issues that may be raised include questions about state licensing, Bank Secrecy Act coverage and financial privacy, protocols for payments of different sizes, clearinghouses, and multiple mints. PRESENTERS: Roger Applewhite, Benton International, Inc., Torrance, California William Barr, Bellcore, Basking Ridge, N.J. Electronic Funds Transfer Association, Reston, Virginia Kawika Daguio, American Bankers Association, Washington, D.C. 12:30 p.m. Buffet lunch 1:15 p.m. Session II. Government's Role in the Development of Digital Money How may existing laws and regulations impede the development of digital money? Does the possibility of future regulations or restrictions threaten to drive development in sub-optimal directions? Do banks or other potential developers need firmer assurances about regulatory intentions? Does existing legislation and regulation adequately protect property and contract rights with regard to digital money? What might be the effect of European data protection initiatives, and what steps can the US government take to circumvent international friction over this issue? What are the major risks imposed by digital money, including risks of devaluation of US currency? Could private insurance buttress against network failure, electronic runs on money, or other sources of catastrophic risk? To what extent could a failure in digital money systems contaminate or threaten the traditional banking system, or the integrity of traditional money systems? Who will set standards with respect to risk management and capital adequacy of clearing systems? Should smart cards and small internet transactions be exempt from Regulation E and EFTA protections against consumer liability? Would -or should Representative Markey's On-line Privacy Bill cover digital money transactions? Would non-bank digital money mints be covered by the Right to Financial Privacy Act of 1978 and the Electronic Communications Act of 1986? Which party would bear the risk of loss in case of hard-disk crashes, counterfeiting, network failure, etc.? PRESENTERS: Melanie Fein, Arnold & Porter, Washington, D.C. L. Richard Fisher, Morrison & Foerster, Washington, D.C. Professor Sarah Jane Hughes, Indiana University Law School 2:45 p.m. Session III: Law Enforcement Issues Will anonymous instantaneous digital money create the possibility of new crimes, or new versions of old crimes -theft, money laundering, insider trading, etc.? How would the flow of invisible, non-traceable money affect law enforcement and the administration of justice? Do benefits of encryption outweigh the possible harm to law enforcement capabilities? Does digital money threaten the new focus of law enforcement on seizing the proceeds of criminal enterprises? Considering the lessor of the Digital Telephony Act, can early cooperation between digital money providers and law enforcement avoid the heavy costs of retrofitting systems to accommodate the needs of law enforcement? What is the appropriate role of government in assuring the security of digital money systems against breaches by insiders, or criminals, or terrorists? To what extent would digital money threaten the ability of the IRS to collect taxes or to prosecute tax dodgers? PRESENTERS: Roger Weiner, Deputy Director, FinCEN, U.S. Department of the Treasury Scott Charney, Chief, Computer Crimes Section, U.S. Department of Justice Robert Hettinga, Boston, MA 4:00 p.m. Adjournment Conference Organizers Steven Bonorris, Vary Coates (ITA) 202 686 0693 ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

U.S. as a Terrorist State
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:29 PM 9/9/96, Duncan Frissell wrote: >And I support a terrorist organization (the US Government) every year >whether I want to or not. The US was convicted of a major violation of >international law (akin to terrorism) in the International Court of Justice >back in the '80s for air sowing mines in Nicaragua's main harbor. This is a lie, a lie by the subversive left. As is well-known, the recent unpleasantness surrounding the Sandanista State was a police action in which Air America was protecting its agricultural subsidies to certain freedom-loving, non-leftist nations. Principally Bolivia, Columbia, and Peru. As noted foodstuff vendor, the Culinary Institute of America, was the prime importer of these agricultural products, the CIA was of course involved in this police action to protect the flow of their goods. The mining of a harbor of a state with which we are not at war, and which has a government elected by a democratic process, is justified if the Commander in Chief believes it is. When the U.S. funds freedom fighters in Iran and Iraq, this is different of course from when Libya funds terrorists. (It is different because our Commander in Chief tells us it is.) That the World Court would find the United States guilty of terrorist actions (and cases are pending involving the U.S.-funded bombing of Cuban planes, the use of bomblets in toys dropped in other police action cases, and the funding of the Brigate Rose by Gehlen operatives...) shows the World Court is becoming dangerously independent. I suggest the U.S. cut off funding until it learns to heel. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: ... subversive leftists
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:57 PM 9/9/96, William H. Geiger III wrote: >In <Pine.LNX.3.94.960909125148.16761A-100000(a)blau.pin.de>, on 09/09/96 at >12:53 PM, > Stephan Schmidt <schmidt(a)pin.de> said: > > >>I hope this one was ironic. > >>> The Democratic People's German Reich is fully justified in cutting off >>> contacts with subversive radical publications in Jew-dominated nations like >>> Holland. >>> >>> As Reichskommander Schmidt points out: "The citizen-units who access >> ^^^^^^^^^^^^^^^^^^^^^^^ >>But this one is tasteless and insulting even if it was >>meant ironic. > >If the boot fits....... > I don't know why Stephan waited so many days to make his comment. It was my noticing that I had "collided" with his name, Schmidt, when I made my facetious post that caused me to almost immediately issue a clarification that I was not thinking of him when I made my first post. To be clear, again, I was not basing my "Reichskommander Schmidt" line on Stephan Schmidt. That was just a coincidence. As to the "Reichskommander," in our country, and on the Net, such jokes are not illegal. I rather suspect they are in Germany, either the DDR or the Western side. As to "tasteless and insulting," a matter of personal perspective. I find it helpful to call a spade a spade, and others apparently do as well. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: China joins Singapore, Germany, ....
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:29 PM 9/9/96, Duncan Frissell wrote: >Course there hasn't really been much net censorship. Germany and China's >attempts have not been effective. The Feds lack a mechanism for "blocking >sites." There is no one in a position to give such an order. There is no >chance that such an order would be obeyed in any widespread way in any case. >Outlaw boards crackdowns didn't diminish the number of outlaw boards. Porno >boards crackdowns did not diminish the number of porno boards. Since it is >easier to create a site than it is to set up a board, legal maneuvers by the >Feds won't work. > >Making sites "illegal to connect to" is meaningless because most users won't >even know what is on the list and most of those who do will be encouraged to >connect to them rather than discouraged. While I agree with Duncan's sentiments (obviously) and even agree that censorship is impossible to completely implement, I think Duncan is oversimplifying and thus trivializing the dangers to Chinese, German, Singaporan, etc., subjects. Prison sentences in Germany for those who reveal forbidden information about "the Holocaust," prison terms (or worse) for dissidents in Burma, China, and, of course, various other nations and "democratic people's republics." Even here in the United States, connecting to an illegal site may mean imprisonment. (The charge: trafficking in child pornography, for example.) Rather than saying such laws are "meaningless," developing blinded, steganographic, etc. proxies may be a more useful strategy. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

SPL -- Suspicious Persons List
by tcmay＠got.net 17 Dec '03

17 Dec '03

Digitaltronics Corporation V.P of Human Relations: "Joe, thanks for coming in this morning. I'm sure you're busy, so I'll make this as short as possible. OK with you?" Joseph Shlubsky, Programmer: "Uh, sure." <nervously> Digitaltronics: "Joe, we have a problem. We understand that on your last two business trips you've been flagged for Special Processing at airport security. We checked, and it seems you're on the Suspicious Persons List. As you know, this causes problems for your fellow travellers (no pun intended, eh Joe <laughs>). And, Joe, it undermines the corporate image for one of our people to be on the SPL. I'm sure you see our problem?" JS: "Uh...." Digitaltronics: "Joe, we're not sure what you've been doing to get yourself put on the SPl, and we're forbidden by the Fairness in Employment Act from even asking you about your interests and affiliations, but we really can't have representatives of Digitaltronics being pulled aside for SPL processing, now can we?" JS: "But I told them I was only carrying a briefcase, and that they could search it all they wanted to, and--" Digitaltronics: "Joe, I'm sorry, but we're going to have to let you go. You know how these things are. Nothing can be done. Not our decision, when you think about it. The government has their ideas of who should be on the Suspicious Persons List, and there's just nothing we can do about it. We just can't have our corporate image linked to persons on the SPL. Now, Joe, you'll get a generous 6 weeks of severance pay, and Daphne will assist you with your outplacement processing. Of course, Joe, you will have to go through an inspection every morning until you're fully processed...there's that SPL matter, you know." <laughs> JS: "Uh..."

3 2

papers on anonymous protocols
by Wei Dai 17 Dec '03

17 Dec '03

I found a couple of papers on anonymous protocols that I haven't seen mentioned here before. I'll list them for people who might be interested: Cryptographic Defense Against Traffic Analysis by Rackoff and Simon. http://pct.microsoft.com/papers/ta.ps gives a proof of security for a mix-net like protocol. A. Pfitzmann, B. Pfitzmann, M. Waidner: ISDN-MIXes - Untraceable Communication with Very Small Bandwidth Overhead; Proc. Kommunikation in verteilten Systemen, Feb. 1991, Mannheim, Informatik-Fachberichte 267, Springer-Verlag, Heidelberg 1991, 451-463. describes a protocol for anonymous telephone calls. Wei Dai

2 1