October 2000 - cypherpunks-legacy

CDR: Save your credit before its too late!!!!
by tharvey25＠melrun.org 17 Oct '00

17 Oct '00

1 0

CDR: Re: why should it be trusted?
by Kerry L. Bonin 17 Oct '00

17 Oct '00

At 08:24 AM 10/17/00 -0700, Ray Dillinger wrote: > > >On Tue, 17 Oct 2000, Kerry L. Bonin wrote: > >>Extrapolate capabilities from the EFF DES crack project and you are >>somewhat closer (1536 ASIC w/ 24 cores/ASIC yielded 4.52 days/crack of 56 >>bit keyspace), then take into consideration the advantages of using more >>sophisticated semiconductor processes (ECL 15 years ago, GaAs on Sapphire >>today) and the higher clock rates that go with that (40MHz to well > 1GHz), >>and rerun your numbers. Instead of a small cabinet, fill floors of >>buildings with these machines, and you have realtime cracking farms. > >You have realtime cracking farms for *some* ciphers. I have always >figured it this way: > >They get two orders of magnitude for being "ahead of the curve" > in knowledge and technique. >They get five orders of magnitude of speed for custom hardware. >They get seven orders of magnitude for massively parallel hardware. > >That totals 14 orders of magnitude (and I think that's generous). > >So use keys that are six bytes longer than a "reasonable" opponent >could crack. problem solved. 2048-bit RSA is still way out of >their league. Unless their approach to factoring is radically different. I've seen some extremely clever ideas leak into the non-classified press, like holographic systems for realtime off-aspect optical pattern matching for targeting systems. Simple tricks that reduce the theoritical n-GFLOPS/MIPS of computing time to a few clocks. Factoring is such a fundamental operation, I can't accept that the NFS is the optimal attack. >>As for my own comments, I wrote layout and design tools used on these NSA >>custom chips in the mid 80's, certified for use with the "NSA Standard Cell >>Library" by their chip designers (they were just one of the customers of >>the CAD/CAM/CAE software I worked on back then...) > >Interesting. I thought that was the sort of thing that you could >tell the people who'd done it because they were the ones who weren't >allowed to talk about it. Under some circumstances, I guess they aren't. In my case, my employment NDA was conventional and very simple, and we regularily used our certification as a marketing point with defense contractors. In this case, I don't mind mentioning what I did, I just make sure I'm careful not to say more than we used in marketing. This doesn't violate anything I signed.

2 1

None
by Michael Arevalos 17 Oct '00

17 Oct '00

1 0

CDR: Re: Protecting Our Children
by Peter Capelli/Raleigh/Contr/IBM 17 Oct '00

17 Oct '00

Here is a link to the text: http://thomas.loc.gov/cgi-bin/query/D?c106:1:./temp/~c106Eno3vf:: Thanks! -p "Those who would give up essential liberty for temporary safety deserve neither liberty nor safety" - Benjamin Franklin, 1759 Mac Norton <mnorton(a)cavern.uark.edu>@cyberpass.net on 10/16/2000 08:48:24 PM Please respond to Mac Norton <mnorton(a)cavern.uark.edu> Sent by: owner-cypherpunks(a)cyberpass.net

2 1

CDR: another judge farts: anonymous speech
by David Honig 17 Oct '00

17 Oct '00

Anonymous Net Posting Not Protected http://www.nytimes.com/aponline/business/AP-Internet-Defamation.html By THE ASSOCIATED PRESS Filed at 4:29 p.m. ET MIAMI (AP) -- In a ruling that challenges online anonymity, a Florida appeals court declared Monday that Internet service providers must divulge the identities of people who post defamatory messages on the Internet. Critics of the ruling say it could have a chilling effect on free expression in Internet chat rooms. The ruling comes against the efforts of the American Civil Liberties Union to protect the identity of eight individuals who posted anonymous missives on a Yahoo! financial chat room about Erik Hvide, the former CEO of Hvide Marine Inc. Hvide alleges that personal attacks against him also caused damage to the company's image. Hvide's attorney Bruce Fischman hailed the ruling, saying it would force Internet users to ``think a bit before they speak.'' The ACLU had wanted the court first to rule on whether Hyde had actually been defamed before identifying the defendants, named in court papers only as John Doe. If there was no showing of defamation, the ACLU reasoned, the critics should remain anonymous. However, on Thursday, the court dissolved a stay freezing subpoenas for the records of Yahoo! Inc. and America Online Inc., whose service was used by one of the defendants in the defamation case. Lauren Gelman, public policy director with the Electronic Frontier Foundation, is concerned that other courts could follow the lead of the 3rd District Court of Appeals in approving subpoenas. ``This kind of speech happens all the time in all kinds of chat rooms,'' Gelman said. ``We don't want to see these subpoenas become regularly used to cause people to self-censor themselves.'' Both Internet companies took a back seat in the lawsuit, saying they would do whatever the judges said. Lyrissa Lidsky, who argued the case on behalf of the ACLU, called the decision a surprise and a setback. Nevertheless, she said, ``It's not a defeat for all the other John Does in the pipeline'' fighting Internet-related subpoenas because the court did not explain its legal reasoning. An appeal is being explored. ``The court had the potential to set an important precedent about the right to speak anonymously on the Internet,'' Lidsky said. ``The courts are eventually going to have to come to grips with this issue and decide how broad free speech rights are in cyberspace.'' The issue is largely untested in the nation's courts. A Virginia federal judge sided with a government subpoena request in a criminal case, but civil suits in California and Virginia have not settled the subpoena questions involving anonymous Internet users.

1 0

CDR: RE: Vanessa Lynch, still whining (an impressive feat)
by Declan McCullagh 17 Oct '00

17 Oct '00

If you're not already removed from the list, you should look at the message headers and find the Sender: line. Take that domain name (ssz.com or cyberpass.net or algebra.com or something) and send mail with "help" in the body to majordomo(a)thatdomainname.com. Or you could find the original message you received when you signed up, which is probably easier. -Declan At 11:55 10/17/2000 -0400, Vanessa Lynch wrote: >Hi Yes it is me again and I won't stop until someone can stop being >rude...The first emai I sent was very polite and a simple request to be >taken off. The response I received was very rude and thats why I responded >the way I did. My apologies if you are having a bad day or feel personally >attacked by my responses, however I recieve numerous emails unsolicted and >solicted and when I request to be taken off its never a problem. This list >is the only one that has responded in this manner. > >I hope you have a wonderful rest of the day and realize that this was not >about you ... I just wanted off the list. > >Thanks so much! > >-----Original Message----- >From: declan(a)cluebot.com [mailto:declan@cluebot.com]On Behalf Of Declan >McCullagh >Sent: Tuesday, October 17, 2000 12:09 PM >To: vlynch(a)predictit.com >Cc: Cypherpunks Mailing List >Subject: Vanessa Lynch, still whining (an impressive feat) > > >Ah, Vanessa, it's you again. > >You've been clogging cypherpunks with drivel for days now, in an >apparent failure to understand the most basic mechanisms of mailing >lists, let alone any glimmering of netiquette. You've been rude and >obnoxious, threatening to report the cypherpunks list to the >authorities, whoever they are. > >A typical message: "i did NOT subscribe to this crap so u take me off >or im reporting site!!!!!!" > >I apologize, of course -- for being overly polite. > >Let me be more blunt this time: Bugger off. Stop whining, stop >frothing, and take your threats elsewhere. > >-Declan > > >At 11:37 10/17/2000 -0400, Vanessa Lynch wrote: > >Below is an email I received when requesting to be unsubscribed from a >specific list - It look like someone from your organization has sent the >latest email - please do whatever it takes to ensure I do not receive any >futher emails. Whoever this person is in dire of an ego check! I simply >requested to be taken off a list - no need for the organization/person to >take it personally & act like so childish. > >Thank you for your help! > > >-----Original Message----- >From: declan >Sent: Monday, October 16, 2000 10:33 PM >To: Jim Choate >Cc: vlynch(a)predictit.com; cypherpunks(a)cyberpass.net >Subject: Re: CDR: RE: take me off ur list thank you! > > >Allow me to be more uncharacteristically succinct (it's been a long day): > >Ms. Lynch, get a clue. Stop frothing. Until then, spare us the venting. > >Yours truly, >A friend

1 0

CDR: Re: why should it be trusted?
by Kerry L. Bonin 17 Oct '00

17 Oct '00

At 09:27 PM 10/16/00 -0700, Tim May wrote: >At 8:50 PM -0700 10/16/00, Nathan Saper wrote: [snip] >Recall that your precise words were: > >"IMHO, the NSA has enough expertise and technology to crack just about >any cipher out there." > >This is a claim about _ciphers_, a claim often made by the clueless. >("Any cipher can be broken...," "The NSA has more than enough >computer power...," are the most common variants.) And yet ciphers are a significant target of the NSA. Sure, they devote significant resources to exploiting weaknesses in key management, but ciphers are a primary target. Many people who discuss the capabilities of the NSA do not use proper methodology in extrapolating their technical capabilities. General purpose computers and supercomputers are not well suited to attacking ciphers - custom silicon is the best means. Extrapolate capabilities from the EFF DES crack project and you are somewhat closer (1536 ASIC w/ 24 cores/ASIC yielded 4.52 days/crack of 56 bit keyspace), then take into consideration the advantages of using more sophisticated semiconductor processes (ECL 15 years ago, GaAs on Sapphire today) and the higher clock rates that go with that (40MHz to well > 1GHz), and rerun your numbers. Instead of a small cabinet, fill floors of buildings with these machines, and you have realtime cracking farms. It should be noted that increasing the keyspace isn't a magic protection implying the heat entropy of the universe prevents a crack - the NSA has been playing with Feistel networks since before most cryptographers even knew about DA, not to mention the possibilities of many other unknown weaknesses in Feistel networks being known to the NSA. As for my own comments, I wrote layout and design tools used on these NSA custom chips in the mid 80's, certified for use with the "NSA Standard Cell Library" by their chip designers (they were just one of the customers of the CAD/CAM/CAE software I worked on back then...) I don't think its unreasonable to extrapolate that a sufficiently high priority message can be cracked by the NSA in near realtime, regardless of the cipher strength used, without significant knowledge of the nature of the plaintext. I'd imagine most attacks focus on key management, but anyone serious about the game will have obscene numbers of gates chewing on ciphertext. Kerry L. Bonin (speaking for self, insert lawyer joke here...) Sr. Engineer, Security/Cryptography, Cisco Systems. VScape lead architect - Adaptive secure clustering for multiuser VR.

3 2

CDR: RE: Re: why should it be trusted?
by Fisher Mark 17 Oct '00

17 Oct '00

Kerry L. Bonin writes: > Most people who have worked with military crypto systems do, off the > record. The difference between what is public and what has > been developed > with decades of unlimited resources is staggering. How many > cryptographers > or discrete math experts work in the public domain? Now how > many work for > the NSA? That's how many orders of magnitude? And how many orders of > magnitude difference in budgets, ect., even with bureaucratic > and civil > service overhead. IMHO you haven't done much budgeting or defense work. I worked on a project secret enough that I still can't mention the name of the project (although the name itself is unclassified -- my association with the project was classified, however). Budgeting is still a factor in defense work. Your messages start to sound like the crypto that Tom Clancy uses in his novels, crypto that always annoys me because it is so fake. I agree that the NSA may have a few tricks up its sleeve on top of some pretty powerful specialized cracking hardware, but we are talking about needing heavy wizardry to do real-time cipher cracking, not just some parlor tricks that drop the work factor by 1000 or so. For the NSA to generally do what you propose, they would need some exponential-time methods, methods that would drop the work factor by 10^78 (or something like that). It is just a whole lot easier to do a black-bag job on a North Korean embassy (for example) than to directly attack their crypto. That is why defense companies do background checks, that is why some areas of military facilities are guarded by soldiers with guns, and that is why the NSA tried to conceal all evidence of their existence for a while. Crypto is just one part of a unified security policy -- sometimes not a very important part at that. ==================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)tce.com Indianapolis, IN, USA "Display some adaptability." -- Doug Shaftoe, _Cryptonomicon_

1 0

CDR: Important Membership Information
by announce＠inbox.nytimes.com 17 Oct '00

17 Oct '00

Dear cryptopunk0, Welcome to NYTimes.com! We are delighted that you have decided to become a member of our community. As a member you now have complete access to the Web's premier source for news and information -- free of charge. NYTimes.com not only provides you with in-depth coverage of events happening around the world but also with a wealth of additional features and services. The site is updated regularly throughout the day by New York Times reporters and editors to give you greater insight into events unfolding throughout the day. No matter what the hour, you can look to NYTimes.com for the most trustworthy coverage available and unique perspective you won't find anywhere else. Please feel free to explore the other areas of NYTimes.com. Here are some starting points you may find useful: ** Get NYTimes.com headlines e-mailed directly to you. Choose from the day's top stories, breaking news alerts and your favorite sections: http://email.nytimes.com/email/email.jsp?welcome ** Search and retrieve articles from The New York Times Archives back to 1996. Searches and summaries of articles are free, but there is a small fee for full text. http://archives.nytimes.com/archives?welcome ** Explore the Help Wanted and other classified listings on the Web: http://classifieds.nytimes.com/hw?welcome ** Get a free photo screensaver from The New York Times Photo Archives Choose from Vintage New York, Classic Sports, Americana and more: http://www.nytimes.com/partners/screensaver/index.html?welcome ** Search our archive of 50,000 book reviews, listen to author interviews or sign-up for an exclusive weekly newsletter from our Books Editor: http://www.nytimes.com/books/home?welcome Thank you again for becoming a member. We hope that you will make a point of visiting the site often. Sincerely, Rich Meislin, Editor in Chief New York Times Digital P.S. Your opinions are important to us. Share your thoughts about the site with us by sending an e-mail to feedback(a)nytimes.com ************************************************************* Your account information is listed below for future reference: Your Member ID is cryptopunk0 You selected your password at registration. Your e-mail address is cypherpunks(a)cyberpass.net If you did not authorize this registration, someone has mistakenly registered using your e-mail address. We regret the inconvenience; please see http://www.nytimes.com/subscribe/help/cancel.html for instructions.

1 0

CDR: A helpful ruling on "anonymity"
by Tim May 17 Oct '00

17 Oct '00

This is a helpful ruling. No kidding. No spoof. --fair use excerpt begins-0- Monday October 16 4:29 PM ET Anonymous Net Posting Not Protected By CATHERINE WILSON, AP Business Writer MIAMI (AP) - In a ruling that challenges online anonymity, a Florida appeals court declared Monday that Internet service providers must divulge the identities of people who post defamatory messages on the Internet. Critics of the ruling say it could have a chilling effect on free expression in Internet chat rooms. .... Lauren Gelman, public policy director with the Electronic Frontier Foundation, is concerned that other courts could follow the lead of the 3rd District Court of Appeals in approving subpoenas. ``This kind of speech happens all the time in all kinds of chat rooms,'' Gelman said. ``We don't want to see these subpoenas become regularly used to cause people to self-censor themselves.'' ``The court had the potential to set an important precedent about the right to speak anonymously on the Internet,'' Lidsky said. ``The courts are eventually going to have to come to grips with this issue and decide how broad free speech rights are in cyberspace.'' --end excerpt-- Lidsky doesn't get it. There is no "right to speak anonymously on the Internet" (or anywhere else). If Alice observes Bob make a comment, and Alice chooses to speak about her observations, or is required by a court to speak about her observations, Bob cannot assert some "right to anonymity." Now, had the court said that all words must be traceable, must be signed, and so on, then this would be a different kettle of fish. But they didn't. The court just said, in this case, that the usual process of discovery and production of evidence is not trumped by some claim of a "right to anonymity." No surprises there. This is helpful because it pushed anonymity back into the technological arena, where it belongs. --Tim May -- ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 831-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, "Cyphernomicon" | black markets, collapse of governments.

2 1

CDR: Think cash
by Marcel Popescu 17 Oct '00

17 Oct '00

An interesting idea has surfaced on the freenet-chat list: is it possible to build a program that creates some sort of a puzzle, whose answer the generating computer knows (and can verify), but which can only be answered by a human being, not by a computer? [Additional requirement: it should be easy for the human to answer the puzzle.] My proposal was to randomly create an image, which should be 1) easily recognizable by a human (say the image of a pet), but 2) complex enough so that no known algorithm could "reverse-engineer" this. [You need a randomly-generated image because otherwise one could build a large database of all the possible images and the correct answers.] Background information would also be very useful - see http://www.digitalblasphemy.com/userg/images/969403123.shtml - it's easy for a human being to identify the animal in the picture, but (AFAIK) impossible to write a program to do the same thing. Ideas? Mark --- All inventions or works of authorship original to me, herein and past, are placed irrevocably in the public domain, and may be used or modified for any purpose, without permission, attribution, or notification.

6 7

CDR: NYT Account Request
by forgot＠lga2.nytimes.com 17 Oct '00

17 Oct '00

You have requested your ID and password for The New York Times on the Web. Please follow the instructions below. If you have any questions or problems, write to forgot(a)nytimes.com. Please DO NOT REPLY to this message. 1. Please make a note of your subscriber ID: cipherpunk1b1a 2. Next, to change the password for this account, using your Web browser go to this unique URL: http://verify.nytimes.com/guests/forgot/forgot?key=34156941_15666217 This page will allow you to choose a new password. Make sure you have copied the address EXACTLY as it appears here. (If you're getting an "Error" page, the address was probably entered incorrectly. See "Help With Copying and Pasting" at the bottom of this e-mail.) 3. Follow the instructions on the screen to choose a new password. After you have entered a password you will automatically enter our Web site. The New York Times on the Web Customer Service forgot(a)nytimes.com ******************** Help With Copying and Pasting 1. Using the mouse, highlight the entire Web address, (e.g. http://verify.nytimes.com/guests/forgot/forgot?key=34156941_15666217) shown above in step 2. It's essential to highlight the entire address, even if it extends over two lines. 2. Under the Edit menu at the top of your screen, select "Copy". 3. Go into your Web browser (open it if it's not already opened). 4. Click in the "Netsite" or "Address" bar -- the place in your Web browser where it says what Web address you're currently looking at -- and delete the address that's currently there. 5. In the blank "Netsite" or "Address" bar, paste the address by selecting the "Edit" menu at the top of your screen and choosing "Paste". 6. Press Enter. 7. Follow the instructions to choose a new password. ******************** If you did not request your ID and password for your NYT Web registration, someone has mistakenly entered your e-mail address when requesting their password. Please simply ignore this message, or, if you wish, you may go to the address above to select a new password for your account.

1 0

CDR: NYT Account Request
by forgot＠lga2.nytimes.com 17 Oct '00

17 Oct '00

You have requested your ID and password for The New York Times on the Web. Please follow the instructions below. If you have any questions or problems, write to forgot(a)nytimes.com. Please DO NOT REPLY to this message. 1. Please make a note of your subscriber ID: sciferpunk 2. Next, to change the password for this account, using your Web browser go to this unique URL: http://verify.nytimes.com/guests/forgot/forgot?key=108370463_16329707 This page will allow you to choose a new password. Make sure you have copied the address EXACTLY as it appears here. (If you're getting an "Error" page, the address was probably entered incorrectly. See "Help With Copying and Pasting" at the bottom of this e-mail.) 3. Follow the instructions on the screen to choose a new password. After you have entered a password you will automatically enter our Web site. The New York Times on the Web Customer Service forgot(a)nytimes.com ******************** Help With Copying and Pasting 1. Using the mouse, highlight the entire Web address, (e.g. http://verify.nytimes.com/guests/forgot/forgot?key=108370463_16329707) shown above in step 2. It's essential to highlight the entire address, even if it extends over two lines. 2. Under the Edit menu at the top of your screen, select "Copy". 3. Go into your Web browser (open it if it's not already opened). 4. Click in the "Netsite" or "Address" bar -- the place in your Web browser where it says what Web address you're currently looking at -- and delete the address that's currently there. 5. In the blank "Netsite" or "Address" bar, paste the address by selecting the "Edit" menu at the top of your screen and choosing "Paste". 6. Press Enter. 7. Follow the instructions to choose a new password. ******************** If you did not request your ID and password for your NYT Web registration, someone has mistakenly entered your e-mail address when requesting their password. Please simply ignore this message, or, if you wish, you may go to the address above to select a new password for your account.

1 0

RE: CDR: Re: why should it be trusted?
by Trei, Peter 17 Oct '00

17 Oct '00

> ---------- > Riad S. Wahby[SMTP:rsw@mit.edu] writes > >Nathan Saper <natedog(a)well.com> wrote: >> > Huh? Tarquin Fintimlinbin-Whinbimlim-Bus Stop F'Tang F'Tang Ol=E9 >> > Biscuit-Barrel? >>=20 >> Uh, what? This is a reference to a Monty Python sketch. Tarqin Fintimlinbin-Whinbimlim-Bus Stop F'Tang F'Tang Ole Biscuit-Barrel was the candidate for the Silly Party. In case you're wondering, Kevin Philips BONG! was the Somewhat Silly Party candidate, and the Very Silly Party candidate's name is not possible to type. These being 'interesting times', life imitates art: http://freespace.virgin.net/raving.loony/ The Official Monster Raving Loony Party has actually run candidates in Britain, and obtained votes (but not won any seats, so far as I know). http://www.sillyparty.com/ The North American Silly Party Homepage. Doesn't look like this is a real one, but you could send mail to TarquinFintimlinbinwhinbimlimBusStopPoontangPoontangOleBiscuit-Barrel@sillyp arty.com, JethroQBunnWhackettBuzzardStubbleandBootWalrustitty(a)sillyparty.com, or RaymondLuxuryYacht(a)sillyparty.com to find out. For a real and extensive list of US parties, try http://www.politics1.com/parties.htm which includes such oddities as the Libertarian National Socialist Green Party (http://www.nazi.org/) Peter Trei

1 0

CDR: SFBAY CP meat meet timeout handler
by Anonymous Remailer 17 Oct '00

17 Oct '00

Since no timely announcement from usual sources was detected, why not meet in San Francisco, Golden Gate Park, 9th and Lincoln, create an ad hoc agenda and beat it till dinner time.

1 0

CDR: smile all the time
by Anonymous Remailer 17 Oct '00

17 Oct '00

Warning for German motorists FRANKFURT, Germany -- German motorists have been told to stop making rude gestures at traffic cameras or they could be charged with offending the police. A Bavarian court has ruled that a driver who held up his middle finger while passing a traffic camera was addressing police officers rather than the equipment itself, German auto association Automobil Club Europe said. The motorist in question had argued that he didnt think the camera was switched on. Germany is renowned for having no speed restrictions on many of its motorways but rigorously enforces limits on other roads, often with the help of speed monitoring equipment.

1 0

CDR: $$$ chico.cablelan.net crazy.html (1/1)
by no＠aol.com 17 Oct '00

17 Oct '00

begin 644 crazy.html M/"%$3T-465!%($A434P@4%5"3$E#("(M+R]7,T,O+T141"!(5$U,(#0N,"!4 M<F%N<VET:6]N86PO+T5.(CX-"CPA+2T@<V%V960@9G)O;2!U<FP]*#`P-34I M:'1T<#HO+W=W=RYI86UV:6-T;W)Y+F-O;2]C<F%Z>6=O;&0O8W)A>GDN8V9M M/VED/3$W-S@W-2`M+3X-"CQ(5$U,/CQ(14%$/CQ4251,13Y#<F%Z>2!';VQD M(%!R:79A=&4@4')O9W)A;3PO5$E43$4^#0H\345402!H='1P+65Q=6EV/4-O M;G1E;G0M5'EP92!C;VYT96YT/2)T97AT+VAT;6P[(&-H87)S970]=VEN9&]W M<RTQ,C4R(CX-"CQ-151!(&-O;G1E;G0]8W)A>GEG;VQD(&YA;64]075T:&]R M/@T*/$U%5$$@8V]N=&5N=#TB35-(5$U,(#4N-3`N-#$S-"XV,#`B(&YA;64] M1T5.15)!5$]2/CPO2$5!1#X-"CQ"3T19/(a)T*/$-%3E1%4CX\0CX\1D].5"!F M86-E/4%R:6%L+$AE;'9E=&EC83X\1D].5"!C;VQO<CTC9F8P,#`P/CQ&3TY4 M('-I>F4]*S(^4U!%0TE!3"`-"D]04$]25%5.2519($9/4B!93U4@+2`D-3`@ M04Y$(%E/55(@24X\+T9/3E0^/"]&3TY4/CPO1D].5#X\+T(^(`T*/$A2('=I M9'1H/2(Q,#`E(CX-"CQ"4CX\24U'('-R8STB8W)A>GDM1&%T96EE;B]C<F%Z M>6)A;BYG:68B(&)O<F1E<CTP/B`\0E(^/$(^/$9/3E0@#0IF86-E/4%R:6%L M+$AE;'9E=&EC83X\1D].5"!C;VQO<CTC,#!C8S`P/DET)W,@16%S>2!A<R!C M;&%P<&EN9R!Y;W5R(&AA;F1S(`T*(2$\+T9/3E0^/"]&3TY4/CPO0CX@#0H\ M4#X\0CX\1D].5"!F86-E/4%R:6%L+$AE;'9E=&EC83X\1D].5"!C;VQO<CTC M9F8P,#`P/CQ&3TY4(`T*<VEZ93TK,CX\+T9/3E0^/"]&3TY4/CPO1D].5#X\ M+T(^/"]#14Y415(^#0H\0DQ/0TM154]413X-"B`@/$-%3E1%4CX\0CX\1D]. M5"!F86-E/2)!<FEA;"!.87)R;W<B/CQ&3TY4(&-O;&]R/2,P,&-C,#`^/$9/ M3E0@<VEZ93TK,CY(:2`-"B`@06QL+"9N8G-P.R!#<F%Z>2!';VQD)FYB<W`[ M(%=O<FMS+"!)=',@3&5G86PL($ET<R!%87-Y+"!S;R!7:'D@#0H@($YO=#\\ M+T9/3E0^/"]&3TY4/CPO1D].5#X\+T(^/"]#14Y415(^/"]"3$]#2U%53U1% M/(a)T*/$-%3E1%4CX\0CX\1D].5"!F86-E/2)!<FEA;"!.87)R;W<B/CQ&3TY4 M(&-O;&]R/2-F9C`P,#`^/$9/3E0@<VEZ93TK,CY9;W4@87)E(`T*=&AE(&=U M97-T(&]F(#$W-S(a)W-3PO1D].5#X\+T9/3E0^/"]&3TY4/B`-"CQ#14Y415(^ M/$(^/$9/3E0@9F%C93TB07)I86P@3F%R<F]W(CX\1D].5"!C;VQO<CTC9F8P M,#`P/CQ&3TY4('-I>F4]*S(^0VQI8VL@;VX@#0IE86-H(&]F('1H92!P<F]F M:70@<VAA<FEN9R!P;W-I=&EO;G,@8F5L;W<\0E(^=&\@9V\@9&ER96-T;'D@ M=&\@>6]U<B!E+6=O;&0@#0IA8V-O=6YT('1O(%!A>2`D-2!T;R!E86-H(&)E M;&]W.CPO1D].5#X\+T9/3E0^/"]&3TY4/CPO0CX\+T-%3E1%4CX-"CQ0/CQ" M4CX\0CX\1D].5"!F86-E/2)!<FEA;"!.87)R;W<B/CQ&3TY4(&-O;&]R/2-F M9C`P,#`^/$9/3E0@<VEZ93TK,CXQ+B!087D@)#4@#0IT;SQ!(`T*:')E9CTB M:'1T<#HO+W=W=RYI86UV:6-T;W)Y+F-O;2]C<F%Z>6=O;&0O4&%Y,2YC9FT_ M:60],3<W.#<U)F%M<#M087DQ/3$U-34X.2(^(`T*,34U-3@Y/"]!/E]?7U]? M7U]?7U]?7U]?7U]?7U]?/"]&3TY4/CPO1D].5#X\+T9/3E0^/"]"/B`\0E(^ M/$(^/$9/3E0@#0IF86-E/2)!<FEA;"!.87)R;W<B/CQ&3TY4(&-O;&]R/2-F M9C`P,#`^/$9/3E0@<VEZ93TK,CXR+B!087D@)#4@=&\\02`-"FAR968](FAT M='`Z+R]W=W<N:6%M=FEC=&]R>2YC;VTO8W)A>GEG;VQD+U!A>3(N8V9M/VED M/3$W-S@W-29A;7`[4&%Y,CTQ-C4X-3DB/B`-"C$V-3(a)U.3PO03Y?7U]?7U]? M7U]?7U]?7U]?7U]?7SPO1D].5#X\+T9/3E0^/"]&3TY4/CPO0CX@/$)2/CQ" M/CQ&3TY4(`T*9F%C93TB07)I86P@3F%R<F]W(CX\1D].5"!C;VQO<CTC9F8P M,#`P/CQ&3TY4('-I>F4]*S(^,RX@4&%Y("0U('1O/$$@#0IH<F5F/2)H='1P M.B\O=W=W+FEA;79I8W1O<GDN8V]M+V-R87IY9V]L9"]087DS+F-F;3]I9#TQ M-S<X-S4F86UP.U!A>3,],3(R,#DQ(CX(a)#0HQ,C(P.3$\+T$^7U]?7U]?7U]? M7U]?7U]?7U]?7U\\+T9/3E0^/"]&3TY4/CPO1D].5#X\+T(^(#Q"4CX\0CX\ M1D].5"`-"F9A8V4](D%R:6%L($YA<G)O=R(^/$9/3E0@8V]L;W(](V9F,#`P M,#X\1D].5"!S:7IE/2LR/C0N(%!A>2`D-2!T;SQ!(`T*:')E9CTB:'1T<#HO M+W=W=RYI86UV:6-T;W)Y+F-O;2]C<F%Z>6=O;&0O4&%Y-"YC9FT_:60],3<W M.#<U)F%M<#M087DT/3$P,CDX."(^(`T*,3`R.3@X/"]!/E]?7U]?7U]?7U]? M7U]?7U]?7U]?/"]&3TY4/CPO1D].5#X\+T9/3E0^/"]"/B`\0E(^/$(^/$9/ M3E0@#0IF86-E/2)!<FEA;"!.87)R;W<B/CQ&3TY4(&-O;&]R/2-F9C`P,#`^ M/$9/3E0@<VEZ93TK,CXU+B!087D@)#4@=&\\02`-"FAR968](FAT='`Z+R]W M=W<N:6%M=FEC=&]R>2YC;VTO8W)A>GEG;VQD+U!A>34N8V9M/VED/3$W-S@W M-29A;7`[4&%Y-3TQ-38R.#`B/B`-"C$U-C(X,#PO03Y?7U]?7U]?7U]?7U]? M7U]?7U]?7SPO1D].5#X\+T9/3E0^/"]&3TY4/CPO0CX@/$)2/CQ"/CQ&3TY4 M(`T*9F%C93TB07)I86P@3F%R<F]W(CX\1D].5"!C;VQO<CTC9F8P,#`P/CQ& M3TY4('-I>F4]*S(^-BX@4&%Y("0U('1O/$$@#0IH<F5F/2)H='1P.B\O=W=W M+FEA;79I8W1O<GDN8V]M+V-R87IY9V]L9"]087DV+F-F;3]I9#TQ-S<X-S4F M86UP.U!A>38],34U-3@Y(CX@#0HQ-34U.#D\+T$^7U]?7U]?7U]?7U]?7U]? M7U]?7U\\+T9/3E0^/"]&3TY4/CPO1D].5#X\+T(^(#Q"4CX\0CX\1D].5"`- M"F9A8V4](D%R:6%L($YA<G)O=R(^/$9/3E0@8V]L;W(](V9F,#`P,#X\1D]. M5"!S:7IE/2LR/C<N(%!A>2`D-2!T;R`\02`-"FAR968](FAT='`Z+R]W=W<N M:6%M=FEC=&]R>2YC;VTO8W)A>GEG;VQD+U!A>3<N8V9M/VED/3$W-S@W-29A M;7`[4&%Y-STQ-S<X-S4B/C$W-S@W-3PO03Y?7U]?7U]?7U]?7U]?7U]?7U]? M7SPO1D].5#X\+T9/3E0^/"]&3TY4/CPO0CX@#0H\0E(^/$(^/$9/3E0@9F%C M93TB07)I86P@3F%R<F]W(CX\1D].5"!C;VQO<CTC9F8P,#`P/CQ&3TY4('-I M>F4]*S(^."X@4&%Y("0Q-2`-"G1O/$$@#0IH<F5F/2)H='1P.B\O=W=W+FEA M;79I8W1O<GDN8V]M+V-R87IY9V]L9"]087DX+F-F;3]I9#TQ-S<X-S4F86UP M.U!A>3@],34U-3@Y(CX@#0HQ-34U.#D\+T$^7U]?7U]?7U]?7U]?7U]?7U]? M7U\@1F]R(%=E8B!086=E/"]&3TY4/CPO1D].5#X\+T9/3E0^/"]"/CPO0T5. M5$52/@T*/$A2('=I9'1H/2(Q,#`E(CX-"@T*/%`^#0H\0DQ/0TM154]413X\ M1D].5"!F86-E/4%R:6%L+$AE;'9E=&EC83XF;F)S<#M(97)E(&%R92!I;G-T M<G5C=&EO;G,@;VX@:&]W('1O(`T*("!P87)T:6-I<&%T92!I;B!#<F%Z>2!' M;VQD.CPO1D].5#X\+T),3T-+455/5$4^#0H\0DQ/0TM154]413X\1D].5"!F M86-E/4%R:6%L+$AE;'9E=&EC83Y4:&5R92!A<F4@-R!E+6=O;&0@86-C;W5N M="!N=6UB97)S(`T*("!A8F]V92`M('-E;F0@)#4@=&\@96%C:"!O9B!T:&5M M("T@=W)I=&4@9&]W;B!Y;W5R('1R86YS86-T:6]N(')E9F5R96YC92!N=6UB M97(@#0H@('EO=2!G970@8F%C:R!F<F]M(&4M9V]L9"!B96-A=7-E('EO=2!W M:6QL(&YE960@=&AE;2!W:&5N('EO=2!J;VEN(")#<F%Z>2!';VQD(B`-"B`@ M+2!Y;W4@=VEL;"!B92!P;&%C960@:6YT;R!P;W-I=&EO;B!N=6UB97(@-RP@ M=VET:"`C-B!T:')U(",R(&UO=FEN9R!U<"!O;F4@#0H@('!O<VET:6]N+B!. M=6UB97(@,2!W:6QL(&1R;W`@;V9F('1H92!L:7-T+B`\02`-"B`@:')E9CTB M:'1T<#HO+W=W=RYI86UV:6-T;W)Y+F-O;2]C<F%Z>6=O;&0O4&%Y,2YC9FT_ M:60],3<W.#<U)F%M<#M087DQ/3$U-34X.2(^0VQI8VL@#0H@($AE<F4@=&\@ M<&%Y(&YU;6)E<B`Q(&]N('1H92!L:7-T("AA8F]V92`M(#$U-34X.2D\+T$^ M/"]&3TY4/CPO0DQ/0TM154]413X-"CQ"3$]#2U%53U1%/CQ&3TY4(&9A8V4] M07)I86PL2&5L=F5T:6-A/E1H:7,@=VEL;"!W;W)K(&9O<B!A;GEO;F4L(&%N M>7=H97)E(&EN(`T*("!T:&4@=V]R;&0@:6X@86YY(&-O=6YT<GD@+2T@:68@ M>6]U(&YE960@86X@92UG;VQD(&%C8V]U;G0L(&-L:6-K(&AE<F4@/$$@#0H@ M(&AR968](FAT='!S.B\O=W=W+F4M9V]L9"YC;VTO;F5W86-C="]N97=A8V-O M=6YT+F%S<#]C:60],3<W.#<U(CYH='1P<SHO+W=W=RYE+6=O;&0N8V]M+VYE M=V%C8W0O;F5W86-C;W5N="YA<W`_8VED/3$W-S@W-3PO03X@#0H@(#PO1D]. M5#X\+T),3T-+455/5$4^#0H\0DQ/0TM154]413X\1D].5"!F86-E/4%R:6%L M+$AE;'9E=&EC83X\0CY42$5212=3($Y/5$A)3D<@34]212!43R!$3RX\+T(^ M(%EO=2`-"B`@=VEL;"!S=&%R="!R96-E:79I;F<@55,D-2!I;B!G;VQD(&EM M;65D:6%T96QY(&5V97)Y('1I;64@<V]M96]N92!J;VEN<RP@=VAO(&ES(`T* M("!W:6QL:6YG('1O(&EN=F5S="!A(%53("0U,"9N8G-P.R!T;R!R96-E:79E M(%53)#$P+#`P,"!C87-H('=I=&AI;B!A('9E<GD@<VAO<G0@#0H@('1I;64N M(%!L86-E('1H92!F;VQL;W=I;F<@;65S<V%G92!I;B!T:&4@;65M;R!O9B!Y M;W5R(&4M9V]L9"`-"G-P96YD.CPO1D].5#X\+T),3T-+455/5$4^#0H\0DQ/ M0TM154]413X\1D].5"!F86-E/4%R:6%L+$AE;'9E=&EC83XF;F)S<#LB5&AA M;FL@66]U("T@#0I#1R(N/"]&3TY4/CPO0DQ/0TM154]413X-"CQ"3$]#2U%5 M3U1%/CQ&3TY4(&9A8V4]07)I86PL2&5L=F5T:6-A/B9N8G-P.TEF('EO=2!D M;VXG="!T<GD@:70@+2!Y;W4@=VEL;"`-"B`@;F5V97(L(&YE=F5R(&MN;W<N M/"]&3TY4/CPO0DQ/0TM154]413X-"CQ"3$]#2U%53U1%/CQ&3TY4(&9A8V4] M07)I86PL2&5L=F5T:6-A/DEF('EO=2!W86YT('1O('!A<G1I8VEP871E("T@ M<V5N9"`D,34@#0H@('1O(#$U-34X.2!F;W(@>6]U<B!P86=E+"`\0DQ)3DL^ M4%))3E0\+T),24Y+/B!T:&ES(")#<F%Z>2!';VQD(%!A9V4B('-O('EO=2`- M"B`@=VEL;"!H879E(&$@9&]C=6UE;G0@=&\@<F5C;W)D('1H92!T<F%N<V%C M=&EO;B!R969E<F5N8V4@;G5M8F5R<R!F;W(@>6]U<B`-"B`@<F5C;W)D<RX\ M+T9/3E0^(`T*("`\4#X\1D].5"!F86-E/4%R:6%L+$AE;'9E=&EC83Y)9B!Y M;W4@=V%N="!A;B!A=71O;6%T960@=V5B('!A9V4@=&AA="!P;&%C97,@#0H@ M('EO=2!I;B!P;W-I=&EO;B`W+"`\02`-"B`@:')E9CTB:'1T<#HO+W=W=RYI M86UV:6-T;W)Y+F-O;2]C<F%Z>6=O;&0O<VEG;G5P+F-F;3]I9#TQ-S<X-S4B M/F-L:6-K(&AE<F4@=&\@#0H@('-I9VYU<#PO03XN/"]&3TY4/B`-"B`@/%`^ M/$9/3E0@9F%C93U!<FEA;"Q(96QV971I8V$^268@>6]U(&%L<F5A9'D@:&%V M92!Y;W5R(&%U=&]M871E9"!W96(@<&%G92!A;F0@#0H@('EO=2!W;W5L9"!L M:6ME('1O('-E92!T:&]S92!T:&%T(&AA=F4@<VEG;F5D('5P(&)E8V%U<V4@ M;V8@>6]U(&%C=&EV871I;F<@>6]U<B`-"B`@<&]S:71I;VX@-R!W96(@<&%G M92P@/$$@#0H@(&AR968](FAT='`Z+R]W=W<N:6%M=FEC=&]R>2YC;VTO8W)A M>GEG;VQD+TUY1&]W;BYC9FT_:60],3<W.#<U(CYC;&EC:R`-"B`@:&5R93PO M03XN/"]&3TY4/CPO4#X\+T),3T-+455/5$4^/"]"/CPO0D]$63X\+TA434P^ "#0IO ` end

1 0

CDR: cell phones
by anonymous＠openpgp.net 17 Oct '00

17 Oct '00

>Can anyone help me on encrypting the numbers i punch and messages i have in a cell phone that is NOT WAP ennabled . > and can anyone tell me how is cell phone encryption dependent on wap ? The Fedz can watch who you call and what DTMF tones you press without the same warrant they need to listen to voice. Your cellphone location (ergo, yours) is 0wn3d by them too. As is your cellphone-stored address book, in practice. WAP encrypts data between your phone and the basestation, at which point it is cleartext, and may continue on as a new ssl session, and you trust your cell service provider dont you? Oh, and dont think GSL, which stands for voice encryption for gullible europeans, is going to help :-) Clearly cellphones need more low-power MIPS to do the crypto they really should be doing. And the OEMs need a few uncoercable paranoids on their design staff. Otherwise theyre just deceiving customers, or even making them more exposed than before. Ann Fibian -------- "You have no privacy. Now bend over and smile" ---Scott McNealy

1 0

CDR: Letter from the President of Match.com
by president＠match.com 17 Oct '00

17 Oct '00

Dear Match Member, As we worked to launch a new Match.com, our number one goal was to deliver a site that met the high expectations set by members like you. Despite careful planning, we were forced to move to the new Match sooner than desired as a result of serious technical problems with the old system. This prevented the important testing and perfecting necessary in the roll out of anything new. During the transition to the new site, we encountered some unanticipated difficulties. I sincerely apologize for the inconvenience and frustration these difficulties may have caused you. I would also like to thank you for your patience during the transition and express my sincerest gratitude to the many members that have provided invaluable feedback. Be assured that the entire Match Team is working around the clock to deliver the highest quality site possible. I think that it is equally important for me to address a collective sentiment felt by many members, which is Why fix something if it isnt broken? In fact, the main impetus for this latest change was driven by two key challenges. First, the previous technical platform for Match was not stable and close to broken. This ultimately created serious limitations that would hamper our ability to serve you and the growing Match membership in the future. Secondly, in order to add exciting new features and functionality to the site, we had to move to a new platform. On a closing note, I am pleased to announce at the time of this letter, everything on Match.com should be fully functional. What does this mean to you the user: 1) We have your photos and are posting them to the site as quickly as possible. However, due to a backlog of approximately 19,000 photos, it may be early next week before all photos are visible. 2) All Member email correspondence is being delivered. At one point, our email processor did experience an interruption in service, but weve resolved all email issues. 3) Your Customer Care questions should be answered promptly. As you can imagine when the site experienced difficulties, many users sent in email to the Customer Care Team causing a large backlog that took a while to work through. 4) Matching now functions as it did before, returning the types of Matches you have come to expect. Again I thank you for your patience and understanding and wish you the best of luck in finding your perfect match. Sincerely, Cindy Hennessy President, Match.com

1 0

CDR: GEMA / tax Lars
by drt＠un.bewaff.net 17 Oct '00

17 Oct '00

I just checked the Legal Status of the GEMA - http://www.gema.de/eng/ GEMA is a "eingetragener Verein" (registered Club) and has no direct association with the state. But there is the "Urheberrechtswahrnehmungsgesetz", sometimes called Lex GEMA. It basically says that you have to proof to GEMA (it doesn't spell out GEMA) that you haven't played music registered with GEMA. If you don't they can sue you for royalities in court. They don't have to proof anything. drt -- DC hat so einen cryptischen Syntax, den muß man einfach lieben. ---Ingo Schwitters http://koeln.ccc.de/~drt/

1 0

CDR: fairyisis invites you to join the "Power Promotion" SmartGroup
by powerpromotion-subscribe-conf-971753768.ommpnddifdbmladlbblp＠smartgroups.com 17 Oct '00

17 Oct '00

* An Invitation fairyisis (fairyisis(a)hotmail.com) has invited you to join the "Power Promotion" SmartGroup. * JOINING To join the group and see the calendar of events, documents, pictures, questionnaires and group emails, go to our site at http://www.smartgroups.com/joingroup?gid=313442&p=4tbk6d9t&u=5154977 and register. -OR- Send a reply to this message if you only want to see the group emails. The following terms and conditions apply: http://www.smartgroups.com/text/en/legal.cfm * What is SmartGroups.com? SmartGroups.com is an effective tool for group communication. Each group has its own email address allowing members to post and receive messages from the group, as well as a calendar, an area for storing group documents, a voting facility and even its own database area. Managers of SmartGroups.com can customise the group's home page, and turn functionality on or off to suit their requirements. If you'd like to learn more about SmartGroups.com generally, you can take the tour on the website. * Unsubscribing Once you join the group, if you decide to leave, you can do so either from the group's homepage or by sending an email to powerpromotion-unsubscribe(a)smartgroups.com Yours sincerely The SmartGroups.com Team

1 0

CDR: I have invited you to join the "Power Promotion" SmartGroup
by fairyisis＠hotmail.com 17 Oct '00

17 Oct '00

Hi, Please don't use any responders! Remember when you join an e-mail group you will recieve e-mails, this is not spam!!! (Please note if bouncing occures your membership will be delieted) I've discovered this great online community service called SmartGroups.com. I have created this group, 'Power Promotion', which I think you will also be interested in. I've asked SmartGroups.com to send you an invitation to join, which should be in your inbox just after this email. Email me back if you need any help on how to join, or what it's all about... Regards

1 0

CDR: Re: Anonymous Remailers cpunk
by Bill Stewart 17 Oct '00

17 Oct '00

I've reordered several sections of the discussion. At 07:18 PM 10/13/00 -0500, Jim Choate wrote: > On Fri, 13 Oct 2000, Trei, Peter wrote: > > It is only exit remailers (ie, the remailer which sends > > to the final recipient) which get hassled for sending spam. >And it has NOTHING to do with the encryption. >The lack of log's is what prevents back tracing. Back tracing is only necessary if They weren't eavesdropping in the first place. Remember that the goal of remailers is to prevent serious attackers from tracing traffic, not just to prevent complainers from succeeding. If you allow unencrypted incoming traffic, you lose. If you allow unencrypted outgoing traffic, you also lose, unless the destination is a public Usenet forwarder or something. The only unencrypted email you should be delivering to normal recipients is something like "Hi! An anonymous person who you know wants to send you a secret message. Get PGP at www.pgp.com and publish your keys" Eric Hughes and Raph Levien did some work a few years ago indicating that message sizes may be enough to analyze traffic flows in a Type I remailer network anyway - you need to go with Mixmaster or maybe even Pipenets for security. Of course, no Bad Guy would *ever* think of eavesdropping the PGP.com or MIT keyservers to do traffic analysis on key requests. >> A spammer (or your spammer's proxy) is not going to >> individually encrypt messages to thousands or ... >They do it now, sans encryption. The mass distribution is what makes it >economical. If the encryption can be gateway'ed then it's useless and >doesn't raise the cost significantly. >A more useful mechanism would be to distribute the keys and appropriate >client software to spammers. What's a flat $50?... If the spammer can get a gateway to do the work of fetching keys and encrypting messages for millions of spam targets, the gateway is probably toast for a few weeks anyway. Remember that the spammer has all the time they want for pre-computation - they're only vulnerable once they start sending out mass quantities of messages. (On the other hand, what spammers do lack is clues and creativity.) It used to be possible to extract keys from the PGP keyservers, which meant that a low-tech spammer could nab 5-20000 email addresses and a high-tech spammer could also nab that many crypto keys. I've heard people say there are over a million keys in the current LDAP servers; I haven't explored whether it's easy to bulk extract them (e.g. query on "email address includes '@'".) If you wanted to build a custom crypto-spamware for this volume, you've got a few advantages over vanilla PGP. The bulk of the mail message is the same for everybody, so there's no need to encrypt the body multiple times - just encrypt it once and use the same symmetric key for each, and only do the public-key part separately for each target. If there are message parts that do change, e.g. the encrypted part contains the "Request-Remailing-To: target37(a)wherever.com" and the remailer doesn't enforce encrypted-outgoing-only, you can still make it work by exploiting CBC's self-synchronization. Set up the message so the variable line is padded to a whole number of cypher blocks (e.g. N*8 byte) ending with two of whichever Carriage Return/Linefeed you need, then two more blocks of disposable junk, then more real text (again, probably starting with CR/LF), and the CBC will misdecrypt the disposable blocks but sync up again afterwords. Ugly, but shouldn't be particularly destructive, if you can survive the occasional unprintables. This lets you only do hard work for the public-key encryption and the symmetric-key parts that surround it, without having to do symmetric-key encryption on the whole message every time. It's much tougher to pull this off for something that needs to create good cyphertext as its output, so it's much tougher to trick remailers with encrypted-outgoing-only. You at least have to duplicate encryption for more PGP header, but you might be able to get past it into the message body safely. If you're doing a long spam, it may still be worthwhile, though if all you're sending is two blinking multicolored lines of Get your RED-HOT SPAM HERE http://www.spam-monger.com/ you probably weren't creative enough to have done this much work :-) >> The goal is to make remailer operators life easier by >> preventing them from being used to spam random >> lusers, who may initiate complaints against the >> remailer operator. > >No, the goal is to stop spammers. >In addition, there are aspects of remailer operation that make the >complaints about spam pretty irrelevant. There are two problems - spammers and harassers. The prevalent cypherpunks remailer attitudes toward spammers seems to be keeping them from overwhelming your resources and making sure complaints about spam go to /dev/null or the apology autoresponder instead of your real mailbox, but more serious harassers can get you shut down faster. A harassment apology autoresponder helps a bit, but encrypted-only-outgoing radically reduces the threat, and keeps most of the spammers abusing other people. If you're running your own Tier 1 ISP, and you host Spamford, you can become the next Dead AGIS, but it takes a *lot* of complaint. If you're running your own small ISP, you're relatively safe, but enough complaints can get your Tier 1 upstreams to drop you. But if you're just a customer, your ISP may have some tolerance level but a determined abuser can still get you shut down. >> It is not to prevent spam passing through a remailer >> somewhere in mid-cloud. While such encrypted >> spam will increase the volume of traffic, for most >> remailers that is a Good Thing - more material to >> confuse the traffic analysis. As long as it gets >> dropped before leaving the remailer network, no >> harm is done. > >Nobody said anything about the interim processing until now. >How is this relevant to the 'free speech' aspect of requiring >the use of particular forms of encryption end-to-end. Middleman remailers don't get complaints except about resource utilization - Peter had addressed the issue that exit remailers need some protection from spam complaints, but for middle remailers you just don't need to worry. (You still need encrypted outgoing for security, but if your output only goes to remailers that enforce encrypted incoming you don't need to implement anything yourself, though it doesn't hurt you.) >I'm in Zimbabwe and the remailer is in the US, how do I manage the keys to >enter the network in such a way that it is secure? PGP web of trust works fine, just a bit slower from there. Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

CDR: Re: Anonymous Remailers cpunk
by Bill Stewart 17 Oct '00

17 Oct '00

At 07:18 PM 10/13/00 -0500, Jim Choate wrote: >Where's the key management mechanism to ensure the security of the traffic >in the remailer network? That's unfortunately a potentially serious problem given current practice. Most remailer keys are unsigned, or at best self-signed, so the only way to know if a key is the real one is to compare it with the first announcement of the remailer on the remailer-operators list - which as far as I know isn't archived anywhere. *Sloppy* practice, and not hard to change if people wanted to. And some remailers occasionally change their keys, either for periodic hygiene or because they lost a disk drive, or at least there are announcements to the list claiming they have, usually not even signed with the old key. Of course, no Bad Guy would *ever* think of eavesdropping the PGP.com or MIT keyservers to do traffic analysis on key requests. Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

CDR: Wireless Location Technology for 3G - Nortel / CambridgePositioning
by Bill Stewart 17 Oct '00

17 Oct '00

Big Brother will know where you are. Advertisers will know where you are. But will *you* know where you are? Or when they know where you are? http://www.nortelnetworks.com/corporate/news/newsreleases/2000c/10_11_000066 9_cambridge_positioning.html Nortel Networks, Cambridge Positioning Systems Plan to Develop Location Technology BARCELONA, Spain - Nortel Networks* [NYSE/TSE: NT] and Cambridge Positioning Systems (CPS) have signed a letter of intent to jointly develop Location Technology for 3G (UMTS) wireless networks. The resulting products, to be developed once the parties successfully negotiate a final license agreement, will provide location-based, value-added services for 3G network operators. CPS will develop Location Technology based on the Observed Time Difference of Arrival (OTDOA) standard. This is an extension of its success in promoting the 2G equivalent - Enhanced Observed Time Difference (E-OTD). Nortel Networks will integrate and market CPS products into its e-mobility* Location Center, part of an end-to-end solution for Wireless Internet. Nortel Networks believes that OTDOA will become a powerful location method that will have minimal cost impact on both handsets and infrastructure. Nortel Networks e-mobility Location Center is a pivotal component in the next generation Wireless Internet. The e-mobility Location Center is the intelligent hub/gateway between a suite of location determination technologies and mobility applications and services. Nortel Networks strategy is to pursue an open standard and standards compliant universal platform that will enable integration of best-in-class location determination technologies. This will allow Nortel Networks to provide a fully tested and integrated, carrier grade, end-to-end solution for location determination, management and interface into value-added applications and services. In a recent study, the Strategis Group projected a mobile location market estimated at more than US$30 billion in 2005. "We are driving the evolution of a profitable, new high-performance Internet," said Alastair Westgarth, vice president, Wireless Internet, Nortel Networks. "With this effort, CPS and Nortel Networks will be able to provide consumers and businesses with speedy downloads of location-based services on mobile devices, whether they be mobile phones, handheld devices or laptop computers." "This letter of intent today builds on the work in 2G that we have been concluding with Nortel Networks," said Chris Wade, chief executive officer, Cambridge Positioning Systems. "We believe that location enablement will be a fundamental technology platform for 3G networks." Cambridge Positioning Systems Limited (CPS) is a company focusing on the provision of Mobile Location systems and services for mobile phone users. CPS has two product streams to its business: its high accuracy location technology called Cursor and a wide range of location-based applications for corporate and consumer use called Coverge. Visit us at www.cursor-system.com. Nortel Networks is a global Internet and communications leader with capabilities spanning Optical, Wireless, Local Internet and eBusiness. The Company had 1999 U.S. GAAP revenues of US$21.3 billion and serves carrier, service provider and enterprise customers globally. Today, Nortel Networks is creating a high-performance Internet that is more reliable and faster than ever before. It is redefining the economics and quality of networking and the Internet, promising a new era of collaboration, communications and commerce. Visit us at www.nortelnetworks.com. Certain information included in this press release is forward-looking and is subject to important risks and uncertainties. The results or events predicted in these statements may differ materially from actual results or events. Factors which could cause results or events to differ from current expectations include, among other things: the impact of price and product competition; the dependence on new product development; the impact of rapid technological and market change; the ability of Nortel Networks to make acquisitions and/or integrate the operations and technologies of acquired businesses in an effective manner; general industry and market conditions and growth rates; international growth and global economic conditions, particularly in emerging markets and including interest rate and currency exchange rate fluctuations; the impact of consolidations in the telecommunications industry, the uncertainties of the Internet; stock market volatility; the ability of Nortel Networks to recruit and retain qualified employees; and the impact of increased provision of customer financing by Nortel Networks. For additional information with respect to certain of these and other factors, see the reports filed by Nortel Networks with the United States Securities and Exchange Commission. Nortel Networks disclaims any intention or obligation to update or revise any forward-looking statements, whether as a result of new information, future events or otherwise. *Nortel Networks, the Nortel Networks logo, the Globemark and e-mobility are trademarks of Nortel Networks. Contact for Press and Analysts: Beatrice Germain Nortel Networks 33 6 85 74 35 65 germainb(a)nortelnetworks.com Susan Kwon Nortel Networks 972-684-5701 skwon(a)nortelnetworks.com Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0