March 1993 - cypherpunks-legacy

FWEE! premature testing
by deltorto＠aol.com 23 Mar '93

23 Mar '93

Dewds, Just a thought on Tim May's anonymous baptism by Stealth-fire of the WB! project: Tim: though I appreciate your enthusiasm, could you *please* wait until there is something in place to actually _test_ before you test it? I know you really wanted to post that nifty F-117A thing you OCR'd _somewhere_ but that was not particularly helpful. It's not like I'm unaware of this issue. Remember, we're still in Phase One (design & data collection) now. Help with the design and data collection before you go off on your own and try to show where the holes are or have some fun with it. Later on, you can be very helpful if you want to play the Devil's Online Advocate. [Also, could you please spell my name correctly for the NSA's records? It's David Del Torto (not Deltorto). I promise not to spell your name "TiM aye" so they can come and get you too.] Someone suggested a set of WB guidelines should be posted. I began this process, and will continue next week after CFP. I ask your patience while I educate myself. CFP News: I had a *very* interesting/enlightening discussion with Nicholas Johnson, the former head of the FCC (under Johnson) last night about the WB! project - he loves the idea and is willing to help out "somehow." Also, Ralph Nader's organization is interested in what we're up to. Jim Settle (FBI Computer Crime Squad) is also surprisingly supportive of the idea. Also, believe it or not, a fellow from the CIA likes the idea and posits that, if done "correctly," the system can 'perhaps be somewhat protected' from posting by pranksters/attackers with bogus revelations - it might require someone to preview postings (I would like to DE-nominate myself and suggest that MAYBE a small review group be set up - let's discuss this, tell me what you think is a good idea). I believe that the implementation of a simple WB Key system can assist in this as well (refer to an earlier posting of mine). Of course, this would require widespread dissemination of encryption software for anyone needing that option. Dorothy Denning is there: does anyone have a question for her? A statement? I can post her email address after tonight if y'all like. More Later, Gotta Run... dave (Del Torto)

2 1

REMAIL: Anon.penet.fi no more
by jthomas＠coconut.mitre.org 23 Mar '93

23 Mar '93

You probably have seen this already, but it's certainly of relevance to cypherpunks: > Newsgroups: comp.org.eff.talk,news.admin.policy,alt.privacy,alt.sexual.abuse.reco very,alt.support,alt.transgendered,soc.motss > Path: linus.mitre.org!linus!agate!howland.reston.ans.net!usc!elroy.jpl.nasa .gov!decwrl!uunet!mcsun!fuug!penet!julf > From: julf(a)penet.fi (Ze Julf) > Subject: Anon.penet.fi no more > Organization: No! > Date: Tue, 23 Mar 1993 15:03:59 GMT > Message-ID: <1993Mar23.150359.16883(a)penet.fi> > Lines: 54 > > The anonymous service at anon.penet.fi has been closed down. Postings to > netnews and mail to arbitrary addresses has been blocked. To enable users > who know each other only by their anon ID's to arrange alternate > communication paths, mail to anonymous users will still be supported for > two weeks. After this period all database entries will be deleted. > > Due to the lawsuit-intensive climate in the US, many anonymous services have > been short-lived. By setting up anon.penet.fi in Finland, I hoped to create > a more stable service. Anon.penet.fi managed to stay in operation for almost > five months. The service was protected from most of the usual problems that > had forced other services to shut down. But there are always going to be > ways to stop something as controversial as an anon service. In this case, a > very well-known and extremely highly regarded net personality managed to > contact exactly the right people to create a situation where it is > politically impossible for me to continue running the service. > > But of course this political situation is mainly caused by the abuse of the > network that a very small minority of anon users engaged in. This small > group of immature and thoughtless individuals (mainly users from US > universities) caused much aggravation and negative feelings towards the > service. This is especially unfortunate considering these people really are > a minuscule minority of anon users. The latest statistics from the service > show 18203 registered users, 3500 messages per day on the average, and > postings to 576 newsgroups. Of these users, I have received complaints > involving postings from 57 anonymous users, and, of these, been forced to > block only 8 users who continued their abuse despite a warning from me. > > In retrospect I realize that I have been guilty to keeping a far too low > profile on the network, prefering to deal with the abuse cases privately > instead of making strong public statements. Unfortunately I realized this > only a couple of days before being forced to shut down the service, but the > results of a single posting to alt.binaries.pictures.erotica.d gave very > positive results. I take full blaim for my failure to realize the > psychological effects of a strongly stated, publicly visible display of > policy with regards to the abuse cases. For this I have to apologize to the > whole net community. > > On the other hand I am deeply concerned by the fact that the strongest > opposition to the service didn't come from users but from network > administrators. I don't think sysadmins have a god-given mandate to > dictate what's good for the users and what's not. A lot of users have > contacted me to thank me for the service, describing situations where > anonymity has been crucial, but I could never have imagined in my wildest > dreams. At the same time quite a few network administrators have made > comments like "I can't imagine any valid use for anonymity on the net" and > "The only use for anonymity is to harrass and terrorize the net". > > Nevertheless, I really want to apologize both to all the users on the > network who have suffered from the abusive misuse of the server, and to all > the users who have come to rely on the service. Again, I take full > responsibility for what has happened. > > Julf > Very sad, rather scary. Sorry to hear this, Julf. Joe

1 0

your note on sci.crypt
by Phil Karn 23 Mar '93

23 Mar '93

Dr. Denning: Although you are correct that many of the responses to your proposal contained personal attacks (in which people called you naive, etc), you seem to believe that this invalidates the fundamental underlying point they were making. This is not so. This fundamental point can be summarized as follows: The US government has repeatedly shown by its past conduct that it simply cannot be trusted to obey its own laws regarding spying on private citizens, particularly those who are organized in lawful, peaceful opposition to government policies. And history has shown that it can take many years for unlawful monitoring to become public, if indeed they ever do (consider the current story I just sent you about the Army spying on Dr. Martin Luther King). In other words, the government has frequently ignored its own laws, because it knows it can do so with impunity. No credible case can be made that the problem has been "fixed" since the now-publicized abuses of the 1960s and 1970s, i.e., that new safeguards have somehow rendered the government incapable of violating the privacy rights of its citizens. Privacy violations may or may not still be occurring; we have no way to know. But I suspect it depends far more on the people in power than on any post-Watergate "safeguards" against the abuse of that power. The private use of strong cryptography provides, for the very first time, a truly effective safeguard against this sort of government abuse. And that's why it must continue to be free and unregulated. I should credit you for doing us all a very important service by raising this issue. Nothing could have lit a bigger fire under those of us who strongly believe in a citizens' right to use cryptography than your proposals to ban or regulate it. There are many of us out here who share this belief *and* have the technical skills to turn it into practice. And I promise you that we will fight for this belief to the bitter end, if necessary. Phil Karn

1 0

another remailer goes on line
by Eric Hollander 23 Mar '93

23 Mar '93

Three remailers was not enough for me. I set up a fourth: 00x(a)uclink.berkeley.edu. It uses Hal's scripts, and will soon be running pgp (I already have pgp comiled for it). I'll post keys as soon as they are available. e

1 0

Re: Idea
by Arthur Abraham 22 Mar '93

22 Mar '93

>>> preceeding postings not copied to increase the brevity of this message \ I like that last one too, but who will bell the cat? -a2.

2 1

Re: Encrypted computing questions
by fnerd＠smds.com 22 Mar '93

22 Mar '93

Timothy Newsham <newsham(a)wiliki.eng.hawaii.edu> asks a lot of questions about my "crypto goal" of encrypted computing. Rather than answer his questions one at a time, I'll try to clarify what I meant. Also, below I ask about a related crypto goal of "trans-cryption." The idea is that you have a program and maybe some initial state information. The program accepts data in some encrypted form. It does the equivalent of decrypting it and processing it. EXCEPT... o It never turns any part of it into plaintext (unless the output is plaintext, in which case it only shows up after the computing is done). o It's impossible by analyzing the code or watching it run to figure out what it did, or which bits went where. o In particular, you can't figure out the decrypting key by analyzing the program or watching it run. o If there's state information left over, it has to be in some encrypted form. Working backward from these goals, I figure that the program is somehow combined with its private key when it is turned into a crypto-program. How do you convince users that this is what you've done, that your program is actually a crypto program that never reveals its private key or plaintext of its inputs--that it doesn't just decrypt and then process the plaintext--and that you've thrown away the private key used to make it? When it runs, it has to process all its data in encrypted form! What sort of encryption could this be? The data has to be shuffled all around continuously, and it would seem you'd have to have lots of "if" statements to make sure it behaved very differently with small input changes, so that no one could tell what any input bit affected. If the program were an interpreter for a general-purpose language, you could send it encrypted programs to run. A related idea is trans-cryption. Is it possible to do the equivalent of two RSA encryption steps (e.g., decrypt with one key, then encrypt with another), without storing information that would let you deduce either of the keys or the data between the two steps? -fnerd fnerd(a)smds.com (FutureNerd Steve Witham)

1 0

Re: HIDE: embedded msgs in grphics & snd
by George A. Gleason 22 Mar '93

22 Mar '93

"once data encryption becomes illegal, searching for LSBs will become standard procedure for datacops." Aha, but if we can establish artistic protection for cyphertext, that will be one more brick in the wall that keeps the censors out. The point is to prevent it becoming illegal in the first place. Now so far we have one great strategy: making crypto ubiquitous, so there is no way to get the horses back into the barn. I think we can benefit from additional strategies, such as expanding into all the various areas of constitutional protection that might be available. -gg

1 0

Double messages
by crunch＠netcom.com 22 Mar '93

22 Mar '93

I'm getting double messages from people. Is there something wrong with the mailing list? JD

1 0

Re: META: Support for prefixes
by Tony Kidson 22 Mar '93

22 Mar '93

In message <m0nTiSl-0001y6C(a)rmsdell.ftl.fl.us> you write: > > is problem: break the current list into topic areas. > > A similar situation occurred a while ago on the Extropians list. Many > people were complaining about excess volume, people were > unsubscribing, and there was talk of splitting the list into many > sublists. There are some problems with sublists. Many people would > subscribe to all the lists, or many of them. List management chores > ((un)subscriptions, bounces, address changes, etc) would increase. > Many messages would get "cross-posted" to several or all lists, and > thus would appear many times in everyone's mail box, thus even > increasing the number of messages to sift through. There are other > problems, which I will not mention now. > > I proposed a simple solution which is in use now, and has greatly > increased the quality of the list, makes it easy for everyone to only > read the messages they want, and does not require deployment of any > new software. The actual volume has not decreased, probably it even > increased. But the information flow is so much more manageable. > > The solution is the use of prefixes in Subject: lines. When you post, > prefix your Subject: line with a short "tag" such as "ANON:", > "DCNET:", "PGP:", "DCASH:", or others. For example, you would see > subjects like > > PGP: new version available > ANON: an new idea for anonymous replies > > etcetera. When reading your mail, just have your mailer sort the mail > by Subject: line (if your mailer can't do that, get a new mailer), and > all messages about PGP will come together, all messages about > anonymous remailers will be in one area, etc. Then it's easy to > delete them all without reading, to save them to a file for future > reference, or to read them if that is a topic you are interested in. > > The beauty of this system is it's anarchistic nature. There is no > need for people to maintain an official list of prefixes, or to vote > on new ones (as is done with newsgroups), or to ask someone to create > one (as would be necessary for mailing sublists). There's no need for > the group as a whole to agree on anything. Just start using them. > Try to find a logical prefix for each message that matches its subject > area. > > Most likely people posting on the same topic will choose same or similar > prefix. After some initial fluctuation, different prefixes for the same > topic will converge to one that will become customary for that topic. > > New prefixes will pop up every once in a while, and the ones not used > will fade from the group memory. This is a flexible, dynamic system. > > As a starting point I will make up a prefix for each of the sublists > you proposed (if you don't like my prefix, use a different one!): > > ANON: anon/pseudo_cpunks Anoymity/Pseudonymity > REMAIL: remailers_cpunks Remailer Technology > DCNET: dining_cpunks DC Nets > RANDOM: random-cpunks Random Generators > DCASH: digimoney_cpunks Digital Banking > PGP: pgp_cpunks PGP App/Current Info > FLAME:-) ziplips_cpunks Crypto-Censorship > WHISTLE: fweee_cpunks Whistleblowers (The "Keith Peterson Area"?) > MEET: physmtgs_cpunks Physical Meetings/Conferences > > Here are some more: META: discussions on the list about the list > itself, such as this post, or the post I am replying to which suggested > splitting the list. Complaints about high volume, messages saying something > does or does not belong on the list, etc, would use this prefix. > > ANNOUNCE: important messages that everyone may be interested in. > > FRIV: for jokes, parodies, other frivolous posts. > > If a post fits in more than one subject area, the main prefix should > be put first, for sorting purposes. The other prefix(es) would follow, > separated by slashes. For example "PGP/ANNOUNCE: new version available" > or "RANDOM/FRIV: why not just flip coins?". This is in no way mandatory, > it's just a convention that developed on Extropians, and it may be > advantageous to use it, to ease further processing. > > Some other ideas: > > You can use procmail, elm filter, slocal, or any other mail processing > tool to handle messages with different prefixes. > > For example if you are a very busy person, or are reading your mail > over a low-speed link, you may want to save all REMAIL/ANNOUNCE > messages in a "remailers" file, delete all FRIV, META, and FLAME > messages, and for each other prefix, save the message to an > appropriate folder for reading later. > > If you were not interested in discussion, but wanted to keep up > on what's going on, you would have the filter delete all the messages > from the mailin list that do not have an ANNOUNCE: prefix. > > Or, if you have enough time and/or are using a high-speed connection, > you may just sort all the messages by Subject: thereby lumping all the > messages on a subject together. Then you can decide which you are going > to read first, which ones you want to delete, etc. > > If this idea takes off, and most people will start using prefixes, further > evolution of the concept is possible. For example a group of extropians > are developing some software on the list host machine that will let people > customise their subscription, for example choosing not to receive messages > with a certain prefix, not to receive messages that don't have a prefix, > or choosing to receive only some selected prefixes, plus any new prefixes > that come to use. > > All this is sometime in the future. Right now, let's start by just > prefixing each subject line with an appropriate prefix. > > -- > Yanek Martinson > yanek(a)novavax.nova.edu > I fully support this call for prefixes by subject class. Tony +-----------------+-------------------------------+--------------------------+ | Tony Kidson | ** PGP 2.1 Key by request ** | Voice +44 81 466 5127 | | Morgan Towers, | The Cat has had to move now | E-Mail(in order) | | Morgan Road, | as I've had to take the top | tony(a)morgan.demon.co.uk | | Bromley, | off of the machine. | tny(a)cix.compulink.co.uk | | England BR1 3QE |Honda ST1100 -=<*>=- DoD# 0801 | 100024.301(a)compuserve.com| +-----------------+-------------------------------+--------------------------+

2 1

Re: HIDE: embedded msgs in grphics & snd
by George A. Gleason 22 Mar '93

22 Mar '93

Re. cyphertext and music: I've been professionally involved in the recording/production scene and could arrange something. There are plenty of damn good bands in the Bay Area who might volunteer for this kind of thing; I can think of a couple of candidates right away. Also a great local studio, Polymorph Productions, which would be amenable to this. All we need to get going is for someone to cover the actual cost of studio time, which is only $30/hour. Now the only hitch right now is my own schedule being really really busy, but I could get a free weekend, or hook up some local cypherpunx with the bands and the studio, and see where it goes. Basically I get the idea that if this worked, the record would get a lot of interest including from a wider audience than cypherpunx, and that translates into attention on the band as such, and that translates into paying back the original production investment with interest. So, anyone interested...? -gg(a)well.sf.ca.us.

4 3