February 1993 - cypherpunks-legacy

Re: more ideas on anonymity
by George A. Gleason 26 Feb '93

26 Feb '93

John, I missed where I might have been advocating censorship... maybe it's so late at night that my logic filter is getting fuzzy... Of course one can't see the content of an encrypted anonymised message, but the case I'm concerned with here is where someone receives an encrypted threat message or some such, and wants it traced. In that case there ought to be some means. I'm speaking from recent experience, having received what the Berkeley PD considered a credible death threat on my answering machine last week... Okay, maybe your point hinges on the "advocating violent acts" item. Well this is a pretty tight issue: hard to differentiate between someone advocating insurrection, advocating race war, and advocating going out in your own neighborhood and killing (whoever). Either way it is advocacy of violence against someone. And I honestly don't have a simple answer to that one. The main point I was trying to go for is pretty unambiguous, that direct threats of violent actions are much more significant than for instance advocacy of committing some victimless crime or another... but that's a dull-obvious one compared to the advocating violence item. Somehow I believe we're going to need to consider the threats & violence questions sooner or later, if for no other reason than to have some solutions at hand when it happens and people start clamoring for restrictions on public access to crypto and anonymity. (jeez my writing is a mess at this hour!) -gg

2 1

subscribe
by Coyote Jack 26 Feb '93

26 Feb '93

subscribe cjack(a)mead.u.washington.edu

1 0

Re: more ideas on anonymity
by Hal 26 Feb '93

26 Feb '93

I want to add to John Gilmore's point about the practical difficulty of controlling anonymous postings and mailings if you are going to allow them at all. Johan is taking a very principled position by promising not to reveal true identities behind the pseudonyms. Instead, he offers to warn abusers, and if problems continue, to block their access to the service. Unfortunately, as more remailer sites develop, this tactic may become ineffective. It will be possible to chain remailers together in different ways, so that the effect is that you can post through Johan's system from many different addresses. With multiple remailers and chaining there is no way for the final remailer in the chain to know when two messages are coming from the same person. This will mean that it will not, in practice, be possible to block access for a given user. We discussed this earlier in the context of anonymous email. I had received a complaint from a young lady about receiving some offensive anonymous mail through my remailer. (This story was resolved surprisingly, BTW: it turned out that it was a joke message sent by a good friend of hers, someone who knew one of the Cypherpunks and who knew about the remailers. So she is no longer upset about the message at all. But I didn't know this at the time.) Realizing that it would not be practical to do source blocking, my suggestion was to implement destination blocking: no mail from my remailer would go to this person. Eric Messick expanded upon this idea recently so that only people who had actually requested anonymous mail would receive it. (A variation would be to first send a note to a person saying, "I have some anonymous mail for you; please reply within 48 hours if you'd like to receive it, otherwise it will be deleted.") Other variations upon this approach could help to keep anonymous remailers politically acceptable. But the idea doesn't generalize well to anonymous posting, except to do as Johan has done and forbid posting to certain newsgroups (sci.*, news.*, I'm not sure what else). This throws out the good postings along with the bad, though. I think the bottom line is that it will be difficult to provide anonymous/pseudonymous postings in a way which won't elicit the kinds of strong objections Johan has been facing. His controls are OK for now, but in the long run I think they won't work. What would happen if Johan just started ignoring the objectors? What if he stopped reading his mail for a while and left the service operating? Would his newsfeed eventually get cut off by Finnish authorities goaded into action by email complaints? Are there ANY sites in the world which would be immune to such pressures? I read that at the Hacker's Conference, the owner of Portal offered to run a remailer. Would he be able to stand up to these pressures? How about John Gilmore's machine? He made a powerful argument recently that he was not subject to various restrictions. Would it be possible to run a remailer there, perhaps based on Johan's code, which simply ignored complaints and allowed anonymous postings to all groups? Hal Finney

2 1

DES
by John.Nieder＠f33.n125.z1.FIDONET.ORG 26 Feb '93

26 Feb '93

* Reply to msg originally in Cypherpunks <INET> marc(a)Athena.MIT.EDU (Marc Horowitz) writes: BK> I also believe that nobody's security is perfect, and that if BK> something as big as DES was broken, even at the NSA, we would have BK> heard about it. If the world banking industry trusts DES for their BK> trillions of dollars a day, I'm willing to trust it for my little, BK> insignificant messages. I'm surprised that you haven't had 53 replies to this already, but in that you haven't I suppose I ought not let this go by unchallenged. In a _MicroTimes_ article by Jim Warren of the EFF, the unreliability of DES was discussed at length. In a nutshell, Marty Hellman of Stanford broke the "unbreakable" 54-bit DES _prior to its adoption as a standard_. He promoted the idea of a 64-bit DES instead, but was _opposed by the NSA_ for reasons we can all speculate upon at length. This opposition is the basis of the rumors (?) of DES being backdoored by the NSA. The upshot was that DES was adopted _after_ being demonstrably compromised. The postscript to this is that Hellman's proposed "unbreakable" 64-bit DES variant was later cracked as well. The post-postscript is an apocryphal story I personally got from an Israeli communications tech and minor spook. He claimed that DES was broken by the cryptanalytic arm of Israeli intelligence _in two hours_. It is relatively certain that a DES-encrypted cyphertext can be easily decrypted by well-equipped agencies. Whether decryption is now trivially accomplished by private parties is another question. JN ... "He isn't my president & these aren't my people." --- Blue Wave/Opus v2.12 [NR] -- John Nieder - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!33!John.Nieder INTERNET - John.Nieder(a)f33.n125.z1.FIDONET.ORG

2 1

Re: dispatches from the front lines of anonymity
by John.Nieder＠f33.n125.z1.FIDONET.ORG 26 Feb '93

26 Feb '93

* Reply to msg originally in Cypherpunks <INET> julf(a)penet.FI (Johan Helsingius) writes: BK> Penet.fi will be PGP:s as soon as I get PGP running reliably on the BK> Interactive UNIX system I use. This weekend, I hope... But if you all BK> keep coming up with other new features I have to add, I don't know how BK> long it's going to take. It must seem a thankless task sometimes, I'm sure. One thing I noticed about penet.fi's processing of messages is that it at least scrapes off the trailing addresses automatically tacked on at the end of every outgoing message leaving all Fido BBSs. A test message sent via the babani remailer arrived anonymously, but with all three lines of the address footer (see below) attached. Hardly anonymous... > Yes, and preferably at a site outside the US, just for good measure. > There is an obvious appeal to having servers outside the jurisdiction of > American law-enforcement busybodies. BK> Yeah, seems that (and the fact that I have 100% control not only of BK> the site but of the network as well) is what has kept anon.penet.fi up BK> this long... Yes, and don't think that we don't appreciate your efforts! JN ... Criticism is nothing but a mild form of envy. --- Blue Wave/Opus v2.12 [NR] -- John Nieder - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!33!John.Nieder INTERNET - John.Nieder(a)f33.n125.z1.FIDONET.ORG

1 0

archives
by corwin＠Cayman.COM 26 Feb '93

26 Feb '93

Is there an archive for this list? thanx, corwin

2 1

Was: Poor man's anon server ...
by Anonymous＠cs.Buffalo.EDU 26 Feb '93

26 Feb '93

There was a mention uptopic of ANI "demo" numbers. Anyone have one of them kicking about?

1 0

Moral dilemma.
by Johan Helsingius 26 Feb '93

26 Feb '93

This is a typical example of the dilemmas faced by an anon posting operator. Here is my reply to the complaint from an user in rec.music.gdead. Don't feel good about it, but... ------- Forwarded Message To: <DELETED> Subject: Re: abuse of internet access > To whom it may concern: > > I direct your attention to the following post made on the rec.music.gdead > newsgroup: > > Article 30001 (26 more) in rec.music.gdead: > From: an13488(a)anon.penet.fi > Subject: Tickets available > Organization: Anonymous contact service > X-Anonymously-To: rec.music.gdead > Date: Thu, 25 Feb 1993 20:48:01 GMT > Lines: 28 > > > We have the following tickets available: > > Rosemont: > 3/9 12 tickets > 3/10 6 tickets, 4 taper tickets > 3/11 10 tickets, 8 taper tickets > > Richfield: > 3/14 12 tickets > > Landover: > 3/16 12 tickets > 3/17 12 tickets, 6 taper tickets > > > 3/17 12 tickets, 6 taper tickets > 3/18 6 tickets, 2 taper tickets > > Tickets will be sold for best offer. Include your phone number with your > bid. Winning bidders will be contacted by phone to arrange payment > and delivery of tickets. We accept Visa and Mastercard. Bids are > taken up to 5 days before the show, although we may contact you earlier > if we feel your bid is suficient to warrant immediate sale. > - ------------------------------------------------------------------------- > To find out more about the anon service, send mail to help(a)anon.penet.fi. > Due to the double-blind system, any replies to this message will be anonymized, > and an anonymous id will be allocated automatically. You have been warned. > Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi. > *IMPORTANT server security update*, mail to update(a)anon.penet.fi for details. > > > This is ticket scalping, pure and simple (selling a ticket for higher than its > value. This is extremely illegal in the United States. This is also a posting > promoting a private enterprise for profit on the internet, extremely unethical. > > Furthermore, the people who are doing this are selling what are known a > s > "taper tickets". These tickets are only available through the Grateful Dead Ti > cket Service via mail order. The reason GDTS does this is to help deter scalpe > rs. I hereby request 2 courses of action from you: > > 1)You immediately suspend Internet access priveleges of the individual(s) > responsible for this posting. > > 2)You provide the individual's (or individuals') name(s) to the Grateful > Dead Ticket Service so they may take legal action against these criminals. > > I hope my letter is merely one of many that have reached you concerning this su > bject. I assure you, there are many people who will not tolerate this and > will do everything in their power to see that these people are caught and stopp > ed. Furthermore, if you are going to offer people anonymous Internet access, > be prepared to face the consequences when your clients break U.S. law. As far > as I am concerned, you are an accessory and should do everything in your power > to rectify this situation. > > I hope you take the time to respond and tell me what measures you have taken. I have sent the person a message informing him/her that the account will be blocked if the inappropriate postings continue. In an international world, where laws, customs and morals vary from one place and culture to another, and where a lot of people are trying to force their views onto others, the only way a service like anon.penet.fi can operate is by very simple and firm rules that are followed without exception. One rule is that I *never* reveal the true identity of an anon user, and another is that I *never* block access to the server without warning and without giving the person a chance to defend him/herself. I do understand your views, and I am very sympatetic to them, but I hope you also realize that inpartial service requires "blind" abiding to these rules. Julf ------- End of Forwarded Message

2 1

Re: Poor Man's Anonymous Remailer
by George A. Gleason 26 Feb '93

26 Feb '93

Re Thug & Phiber on the long-term chances that OSPS will forward the entire number to the destination.... The solution to this is Anonymous Diverters. You have pairs of telephone numbers set up. Callers come in on one side, and are connected to the other side behind a toll-restrictor that only allows calls beginning with 1-800+. The minimum configuration is two lines, one in and one out. With a PBX you can handle from three patches at one time all the way up to 10,000. I can provide hardware and associated programming to anyone who is interested in starting one of these services. When using an Anonymous Diverter, the destination 800-number only gets the ANI of the diverter's outgoing side. Now of course, Big Brother can simply watch the incoming side of the diverter if he wants to, but at least this keeps your originating number secret from the destination 800-number. Right now there are 900/976 numbers set up with this kind of service, but I don't see any evidence that they are designed for data applications; and the per-minute rates are typically way high. What is needed is a network of local service providers who can do the same job either free as a public service or at a reasonable cost. One way to provide service at reasonable cost is to have prepaid flat-rate cash accounts from regular subscribers and give each of them some kind of password (no ID there either; you pay cash and choose your password, it never ties in to your name or anything else). This is also something we can set up on our larger PBXs if you're interested. Come to think of it, we have a client whose PBX would be ideal for this, but we have to check with them. It would only be open on an after-hours basis of course, when they're not using the lines. And it won't cost them anything since those 800+ calls are free. Now also, if anyone in the Bay Area wants to set up one of these, the actual monthly cost is less than $50.00 for lines, plus line cards at the rate of about $600 per each eight trunks (four links through the system). Anyone interested...? We're going to be putting in a larger switch later this year which will also give us the ability to do those anonymous cash accounts such that you could have toll-call dialling privileges through the system on a prepaid basis. Anyone interested in *that*...? - gg(a)well.sf.ca.us

1 0

1000 points of light?
by fergp＠sytex.com 26 Feb '93

26 Feb '93

<dmandl(a)shearson.com> David Mandl writes - DM> Yup, there are dozens of reasons to want anonymity. This DM> should be completely obvious to anyone moving in cypherpunk DM> circles--or alt.sex circles, where, amazingly, some DM> well-respected sexosophists actually spoke out against anonymous DM> posting recently. No offense intended, but anyone who can't think DM> of situations where anonymity is essential should get out more. DM> Any first grader can list dozens of places where even mild DM> blasphemy will get you locked up for a long time. [Begin Zerowork DM> tangent] And even if you think the U.S. isn't one of them (which DM> it is), keep in mind that most workplaces are effectively stalinist DM> dictatorships, and bosses may not be thrilled about having their DM> employees discuss crypto anarchy, the overthrow of governments, or DM> S & M on the net. Point taken, however there will be those who will argue that, "S & M has no business being discussed on the net in the first place." Not exactly my sentiment, but you know the spiel. That type of "Stalinist dictatorship" mentality inherently exists in every nook and cranny of society, including the nets. My original post was not issued as a challenge, but merely a question to gauge some of the responses and justifications I hoped to receive. ;-) Cheers. Paul Ferguson | Network Integration Consultant | "All of life's answers are Alexandria, Virginia USA | on TV." fergp(a)sytex.com (Internet) | -- Homer Simpson sytex.com!fergp (UUNet) | 1:109/229 (FidoNet) | PGP public encryption key available upon request.

1 0