November 1992 - cypherpunks-legacy

Re: How far is to far?
by fen＠genmagic.com 20 Nov '92

20 Nov '92

[mark(a)coombs.anu.edu.au writes:] >Maybe it's not in the spirit of this mailing group but what of the question >of purposeful abuse of the anon mailers/newsposters? Say for instance some >person posts either a sh*tload of garbage to every known group, flooding >the USENET or a more personal attack whereby they send out anonymously >information that was so fundamentally personal to someone they could >possibly react very badly.... I see two answers: one is public censure, which has appeared to work to a large extent in at least one newsgroup whose users make habitual use of an anonymous remailer (alt.sex.bondage) . Another is broadcatch, a favorite topic of mine, which is concerned with the filtering of information. (Note: where "broadcast" is a one-source-to-many subscriber system, "broadcatch" scans many sources for information relevant to one subscriber. The end result is less quantity and higher quality.) With broadcatch, you could turn off threads of conversation you were not interested in, block out flamers, and IGNORE ANONYMOUS EMAIL in general. Of course, pseudonyms may come to be trusted and thus not filtered out, though they, too, are cryptographically anonymous. (Another common mechanism of broadcatch filters is to allow through articles with mentions of the subscriber's name.) Also, in the long run, when networks are made up of smarter, cooperating machines, neighboring machines to a flamer that is generating mass ammounts of email will begin to choose not to listen as often at that address. In sum, I think that it is someone's right to say anything they want, as long as I don't have to listen. Fen ~~~ ~~~ Fen Labalme General Magic We Are Everywhere 40 Carl Street #4 2465 Latham Street ------------------- San Francisco CA 94117 Mountain View CA 94040 The US Constitution 415/731-1174 (home) 415/966-6273 (my desk) may not be perfect, <fen(a)netcom.com> 415/965-9424 (fax) but it's better than <fen(a)well.sf.ca.us> <fen(a)genmagic.com> what we've got now.

1 0

Re: PGP to SMTP mailer
by fen＠genmagic.com 20 Nov '92

20 Nov '92

[wcs(a)anchor.ho.att.com (Bill Stewart) writes:] >On the other hand, I'd be interested in seeing a PGP hook built into >Lotus Notes .... if Lotus were to license RSA support. I believe that Lotus has licensed RSA technology for notes. Fen ~~~ ~~~ Fen Labalme General Magic We Are Everywhere 40 Carl Street #4 2465 Latham Street ------------------- San Francisco CA 94117 Mountain View CA 94040 The US Constitution 415/731-1174 (home) 415/966-6273 (my desk) may not be perfect, <fen(a)netcom.com> 415/965-9424 (fax) but it's better than <fen(a)well.sf.ca.us> <fen(a)genmagic.com> what we've got now.

1 0

Re: Anymous Remailers and Newsposters
by fen＠genmagic.com 20 Nov '92

20 Nov '92

[VANGUARD(a)gribb.hsr.n0 writes:] >I have been aware of the need to make anonymous postings on the >newsnet. I have made most of the neseccery softwar to allow for such >a gateway, but it seems that the local system administartor is >strongly opposed to the idea of the protection given by beeing >anonymous. Such a gateway has an enourmous potential, and it is easy >to see why some wouldn't like the idea. I just thought I'd mention that there are several anonymous remailers currently in use by users of the alt.sex.bondage newsgroup. Unfortunately, I don't have the addresses handy, but they re-post the address and instructions for use every week or so... Fen ~~~ ~~~ Fen Labalme General Magic We Are Everywhere 40 Carl Street #4 2465 Latham Street ------------------- San Francisco CA 94117 Mountain View CA 94040 The US Constitution 415/731-1174 (home) 415/966-6273 (my desk) may not be perfect, <fen(a)netcom.com> 415/965-9424 (fax) but it's better than <fen(a)well.sf.ca.us> <fen(a)genmagic.com> what we've got now.

1 0

How far is to far?
by mark＠coombs.anu.edu.au 20 Nov '92

20 Nov '92

Maybe it's not in the spirit of this mailing group but what of the question of purposeful abuse of the anon mailers/newsposters? Say for instance some person posts either a sh*tload of garbage to every known group, flooding the USENET or a more personal attack whereby they send out anonymously information that was so fundamentally personal to someone they could possibly react very badly.... What if someone posted some top secret information and the various three letter acronyms all went out for someone's blood. As a few people have mentioned they would *like* the opportunity to use an anon system but the initial step of creating and running it isnt so appealing due to the fundamental dangers of it. Most people would respect such systems but you find one really rotten or immature loser that will use it for there own anti-social ends. Comments? Mark mark(a)coombs.anu.edu.au mark(a)gnu.ai.mit.edu markm(a)rmit.edu.au

2 1

Re: Anonymous Reply...
by VANGUARD＠gribb.hsr.no 19 Nov '92

19 Nov '92

Well after I made my last posting I realized there is a mush better way to avoid having identical reply adresses: Simply let pgp make a new encryption of the return adress. This works because pgp uses a different key for each message, and the key is the only information that is encrypted with th RSA algorithm. In other words if you encrypt a message once with a key and encrypt the same message again with the same key, the resulting ciphertext will be totally different, with exeption of the first bytes and the length of the text.

1 0

Anymous Remailers and Newsposters
by VANGUARD＠gribb.hsr.no 19 Nov '92

19 Nov '92

I have tried out the anonymous reply service at hal(a)alumni.caltech.com and I am very satisfied with the service, however I have a suggestion that will improve the security. The way it works now it is possible to link different messages that have the same originator, simply by comparing the return adress. Example I have a deal going with Bob and a different deal going with Alice, and it would be of my interest that Alice and Bob didnt know they where dealing with the same person. If a had given the the same Anonymous reply adress they could compare them and see that in fact they were dealing with the same person, thereby making it easier to trace me: Solutions: Use different remailers that have different public keys, or allow for a field of "random" i.e. different bytes so that if the return adress is identical the encoded block would be totally different. I have been aware of the need to make anonymous postings on the newsnet. I have made most of the neseccery softwar to allow for such a gateway, but it seems that the local system administartor is strongly opposed to the idea of the protection given by beeing anonymous. Such a gateway has an enourmous potential, and it is easy to see why some wouldn't like the idea. I have also been thinking about up such a gateway in my own name (i.e the anonymous postings would appear to come from me, with some sort of disclaimer) but I have so far been reluctant to take the risk of beeing identified with things that are none of my business. Any comments and suggestions would be appreciated.

1 0

IP Bouncer.. source included.
by mark＠coombs.anu.edu.au 19 Nov '92

19 Nov '92

Ok an IP bouncer is something that runs on a host that basically accepts connections on one port and redirects them to another specified host and port. The one below is for tcp connections but it could also be for udp with a little work. I actually have the code for a 'server' version of this that you connect to it, tell it which host you want and then it opens a connection to it. It's on another machine at the moment which is down. I had the sent to me via IRC a while ago and have used it off and on. Ive been meaning to fine tune it a bit as it's supposed to chew CPU a bit... -------cut here--------cut here--------cut here---------cut here------------- /* This file is telserv.c and is part of the Telnet Server package v. 1.0, written by "Hal-9000". Much of this package was developed by Richard Stephens and my thanks go to "Xanadude" for providing me with that section. To compile, type "cc -O -s telserv.c -o telserv". */ #include <stdio.h> #include <sys/types.h> #include <sys/socket.h> #include <fcntl.h> #include <errno.h> #include <netinet/in.h> #include <arpa/inet.h> #define SERV_TCP_PORT 12345 /* port I'll listen for connections on */ #define REM_HOST_ADDR "128.128.128.7" /* host I will bounce to */ #define REM_TCP_PORT 23 /* port I will bounce to */ main() { int sockfd, newsockfd, clilen, childpid; struct sockaddr_in cli_addr, serv_addr; sockfd = socket(AF_INET, SOCK_STREAM, 0); bzero((char *) &serv_addr, sizeof(serv_addr)); serv_addr.sin_family = AF_INET; serv_addr.sin_addr.s_addr = htonl(INADDR_ANY); serv_addr.sin_port = htons(SERV_TCP_PORT); bind(sockfd, (struct sockaddr *) &serv_addr, sizeof(serv_addr)); listen(sockfd, 5); while (1) { clilen = sizeof(cli_addr); newsockfd=accept(sockfd, (struct sockaddr *) &cli_addr, &clilen); fcntl(newsockfd,F_SETFL,O_NDELAY); childpid = fork(); if (childpid == 0) { /* child process */ close(sockfd); /* close original socket */ telcli(newsockfd); /* process the request */ exit(0); } close(newsockfd); /* parent process */ wait(0); } } telcli(clisockfd) { int servsockfd; struct sockaddr_in serv_addr; bzero((char *) &serv_addr, sizeof(serv_addr)); serv_addr.sin_family = AF_INET; serv_addr.sin_addr.s_addr = inet_addr(REM_HOST_ADDR); serv_addr.sin_port = htons(REM_TCP_PORT); servsockfd = socket(AF_INET, SOCK_STREAM, 0); connect(servsockfd, (struct sockaddr *) &serv_addr, sizeof(serv_addr)); fcntl(servsockfd,F_SETFL,O_NDELAY); communicate(servsockfd,clisockfd); close(servsockfd); exit(0); } communicate(servsockfd,clisockfd) { char rec[1]; int num; extern int errno; while (1) { num=read(servsockfd,rec,1); if ((num==-1) && (errno != EWOULDBLOCK)) return; if (num==0) return; if (num==1) write(clisockfd,rec,1); num=read(clisockfd,rec,1); if ((num==-1) && (errno != EWOULDBLOCK)) return; if (num==0) return; if (num==1) write(servsockfd,rec,1); } }

1 0

Finally back
by crunch＠netcom.com 19 Nov '92

19 Nov '92

Greetings, I'm finally back on-line for a few days here, and want to make the most of it. I'll be checking my Email frequently during the day tommorrow, and reading all back messages (All 120 of them), getting cought up on the latest... Before I forget, if anyone wants to send me an encrypted message, My key is as follows, so Pse add it to your pubkey list in case you want to send me an encrypted message. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.0 mQBNAisLBHoAAAECALXEdhLz3F9RmO6ypGFbR4/YqLgbHOrkDxVEgGMCMVQJh8zr /75cTwvXI7dyGorWqvkvhUw1jU7BvMSvyK9YOv8ABRG0IkpvaG4gVC4gRHJhcGVy IDxjcnVuY2hAbmV0Y29tLmNvbT4= =rTrk -----END PGP PUBLIC KEY BLOCK----- I haven't really started collecting pub keys yet, but I propose that we have a list stored somewhere on an ftp site. Or perhaps someone who has the keyrings. I'll have more things to Email later on, it has been a long night here, finally got to most Email. Had one fatal crash of the MacPGP program where it hung up the system when I tried to encrypt a message to someone. I have now tested out the PGP program fully, and now know how to use it. I can see plenty of omprovements I will want to make, but to do it right, we might have extensive changes to make. Still not done looking at code yet, but the modules I ve seen are pretty easy to inderstand. Later... John D>

1 0

Re: PGP to SMTP mailer
by wcs＠anchor.ho.att.com 19 Nov '92

19 Nov '92

Embedding SMTP support into a PGP mail reader is the wrong approach, though the DOS world seems to be going bananas over mail APIs. You gain a lot of flexibility by separating the Mail User Agent, which handles user interface, file storage, encryption and other decoding, etc. from the Mail Transfer Agent function, which lets you send/receive PGP messages over whatever mail systems you have available. That way you don't need to write one PGP program for SMTP, another for uucp, another for Fido, etc. On the other hand, I'd be interested in seeing a PGP hook built into Lotus Notes - does it have an open programming or file-transfer interface? It seems to be multimedia netnews for the mundanes, and getting some flavor of Public-Key encryption out there could help spread the technology, especially if Lotus were to license RSA support. Bill Stewart, somewhere in New Jersey.

1 0

PGP to SMTP mailer
by McGrath, James 19 Nov '92

19 Nov '92

Gudday, People were suggesting that someone write a mailer with PGP support, and because my site uses lots of PCs connected to an internet host, I was thinking of using an SMTP-client based system. That much I think I can do. However, I am also now trying to learn to program for Windows, and the idea of a windows based PGP is quite nice, and with an integrated mailer it would be great. Is anyone else working on either of these two things? What are the implications (security wise) of using something like windows where tasks aren't really that hidden from each other and that swaps to disk? I notice that PGP bothers to erase its stacks and work areas. It seems that this would be a lot less possible under windows. Comments? Jim McGrath

2 1