November 2000 - cypherpunks-legacy

CDR: RE: Re: Anonymous Remailers cpunk
by Trei, Peter 09 Jan '01

09 Jan '01

> ---------- > From: Jim Choate[SMTP:ravage@einstein.ssz.com] > Reply To: Jim Choate > Sent: Thursday, October 12, 2000 7:09 PM > To: cypherpunks(a)einstein.ssz.com > Subject: CDR: Re: Anonymous Remailers cpunk > > > On Tue, 3 Oct 2000, Steve Furlong wrote: > > > <<Proposal to limit spam sent through anon remailers by requiring that > > the traffic be encrypted>> > > > Perhaps we're talking at cross purposes. This subthread came along > > because some people have noticed that anonymous remailers are used for > > an awful lot of spam. Peter Trei proposed that remailers could pass > > along only encrypted mail. My understanding was that Alice, the > > message's author, would encrypt the message with Bob's public key; Bob > > is the end recipient: a person or a mailing list or whatever. Alice > > would send the message through Ramona, the anonymous remailer. Ramona is > > requiring that messages be encrypted as a means of filtering out spam. > > Ramona does not need to know Bob's public or private keys; Ramona cares > > only that the message is encrypted. > > So? I set up a email address that I offer to the spammers to sign up to > the anonymous remailers and then it proxies their email into the encrypted > network. I figure this baby'll stop'em for about six months. > Jim: A spammer (or your spammer's proxy) is not going to individually encrypt messages to thousands or millions of end-recipients, each with their own public key - the time factor makes this uneconomical, and the hassle factor of finding all the recipient public keys makes it impractical. Thus, only remailers which send out plaintext are useful to spammers as exit remailers. It is only exit remailers (ie, the remailer which sends to the final recipient) which get hassled for sending spam. The goal is to make remailer operators life easier by preventing them from being used to spam random lusers, who may initiate complaints against the remailer operator. It is not to prevent spam passing through a remailer somewhere in mid-cloud. While such encrypted spam will increase the volume of traffic, for most remailers that is a Good Thing - more material to confuse the traffic analysis. As long as it gets dropped before leaving the remailer network, no harm is done. Steve understands this, as does every one else but you. What's the problem? > For it to really stop spam it would need to be well distributed. So how do > you offset the increased sys admin issues this raises? > Any remailer operator can decide not to pass along plaintext. So long as the message sender is aware of this property, nothing more needs to be distributed. There are no increased sysadmin issues. > Then there is the old key management problem. > > James Choate > No, there is not, beyond the fact that the message originator must know the final recipient's public key. Jim, do you really understand how remailer chaining works? Peter Trei > Vizzini: HE DIDN'T FALL? INCONCEIVABLE! > Inigo Montoya: You keep using that word. I do not think it means what you > think it means. > - The Princess Bride > > >

7 9

hi
by root 15 Dec '00

15 Dec '00

hi

3 2

CDR: (sans sujet)
by Olivierreni＠aol.com 15 Dec '00

15 Dec '00

Hie, Do you know a site where i can know how to make bombs ? Ciao Olivier

3 2

CDR: Sunders point on copyright infringement & HTML
by Jim Choate 11 Dec '00

11 Dec '00

Sunder raises a good point about Netscape (and potentially other software as well) amd forwarding URL's with attached content. Why is the page attached? Because Netscape attaches the page and doesn't offer a way to send only the URL from right click -> send page. There isn't a switch to set default behaviour (and there should be). So, if you got a bitch about your copyright being infringed, take it to Netscape since they wrote the program without a mechanism that prevents users from committing copyright infringement. Of course this opens a perfect opportunity for LEA's to justify setting at least some basic programming guidelines that we'd all have to comply with... As to using HTML, this is 2000 (soon to be 2001). Get used to it. Hell, I might start embedding ANSI VT100 color codes and the occassional ^g. Animated ANSI would be pretty cool too. If I get the time I might even install TurBoard and MGE under an emulation and start including NAPLPS graphics while I'm at it. I don't have words to express the frustration I have with straight ASCII text and doing technical work at times (but that's another issue). ____________________________________________________________________ Before a larger group can see the virtue of an idea, a smaller group must first understand it. "Stranger Suns" George Zebrowski The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

13 21

CDR: Re: Jim Bell
by lcs Mixmaster Remailer 05 Dec '00

05 Dec '00

Ray Dillinger <bear(a)sonic.net> writes: > Bell handwaved on the point of obtaining digital cash for > paying the assassin with. Bob the broker can go to the > bank and obtain it in the usual way, of course - but then > has to transfer it to Alice the assassin, and there's a > sticky point involved. If he just "copies" the money to > Alice, she can double-spend with impunity and it's Bob's > identity that will be revealed. You're assuming an offline cash system with embedded identity. It is more likely that initial digital cash implementations will be online. By the time such systems come into widespread use (if ever) wireless connectivity will be ubiquitous. Offline cash really can't compete. Attempting to trace, identify, catch and punish double spenders will be overwhelmingly more expensive than simply checking directly that the cash hasn't been spent before. > Conversely, if she provides tokens for the bank to sign, > then Bob has a major problem getting them past the cut-and- > choose protocol at the bank. Even if she provides enough > tokens to completely populate the cut-and-choose protocol, > those tokens still have to have splits of valid identification > information for somebody in them - and giving them all to > Bob so that Bob could complete the protocol with the bank - > would imply that Bob is privy to that information. There are far more efficient offline systems than cut and choose. You need to get past the A's and into the B's and C's in your protocol list. Check more recent work from Brands and Chaum.

6 8

CDR: Arthur Anderson black-bagged, NIPC now spooking
by David Honig 03 Dec '00

03 Dec '00

"Arthur Andersen's office in Vilnius has reportedly fallen victim to electronic surveillance operations. Following the discovery of suspicious equiptment in the office, Andersen called on the Lithuanian authorities to open an investigation into what it views as a case of economic espionage. Another firm highly active in the region, J. Kabasinka & Partners, is said to have also been subjected to similar surveillance" Intelligence Newsletter 12 Oct 2000 p3 indigo-net.com [no affil.] Also a notes that FBI now training NIPC in Carnivore use. "Previously the FBI had sworn NIPC was not engaged in law enforcement surveillance." p 5 same issue. Will scan sources for John's library.

7 9

CDR: Carnivore Probe Mollifies Some
by anonymous＠openpgp.net 02 Dec '00

02 Dec '00

A report is to conclude that the FBI's e-mail surveillance system does not threaten civil liberties. Privacy advocates remain unconvinced. By Jennifer DiSabatino Privacy advocates said they remain leery about the FBI's Carnivore e-mail surveillance system following last night's release of a draft report on the technology by an independent review team, despite the report's conclusions that the controversial software essentially does what it was designed to do Ð track specific digital communications with the permission of a court order. But others, including the FBI, said the report prepared by the Chicago-based IIT Research Institute (IITRI) shows that Carnivore just needs to be fine-tuned and then closely monitored itself in order to prevent the system from being improperly used by law-enforcement officials. "I believe, at least at a basic level, that this established that Carnivore doesn't bite off more than it can chew," said Kenneth Segarnick, assistant general counsel at messaging services vendor United Messaging in West Chester, Pa. "Now we need to put a leash on it and make sure that it's only unleashed under a certain set of circumstances. Carnivore still can do quite a bit. They call it Carnivore for a reason." For example, Segarnick Ð who has testified before Congress on workplace e-mail security measures Ð suggested that regulations be put in place "so that the FBI does not have the automatic right to trap the 'to' and 'from' lines on e-mails" while using Carnivore to investigate suspected criminal activities. And he said legislation also needs to be enacted to make sure the software doesn't collect data on people who aren't being investigated. Carnivore is a software program that monitors packets of data passing through an Internet service provider's network. Officials at the FBI and the DOJ have said the surveillance system can only be legally deployed to monitor allegedly criminal activity under a court order, similar to the regulations that govern the use of telephone wiretaps. The report by IITRI, which was edited by officials at the U.S. Department of Justice before being released, said Carnivore isn't powerful enough to monitor "almost everyone with an e-mail account" at an ISP or to follow individual Internet users as they surf the Web. But the report added that the software "can record any traffic it monitors" if it has been incorrectly configured by investigators (see story). Privacy advocates seized on that point as a confirmation that Carnivore could be used to collect broad swaths of data on individuals. The Electronic Privacy Information Center (EPIC), a Washington-based privacy group that's seeking the release of all the FBI's Carnivore-related documents through a Freedom of Information Act request, yesterday issued a statement charging that the IITRI report "raises more questions than it answers." "If it's that easy for the FBI to accidentally collect too much data, imagine how simple it would be for agents to do so intentionally," said David Sobel, EPIC's general counsel. "This supports our belief that Carnivore raises extremely serious privacy concerns." But FBI spokesman Paul Bresson said those kinds of concerns are overstated. "We never denied that it had the capability to capture more [data than an investigation requires]," he said. "What we maintained was that it had the filtering devices to capture only the data pertaining to the court order." Bresson added that the FBI is now looking at improving the Carnivore software so it would only target the subject of an investigation without collecting information about other people whose e-mail messages are transmitted across an ISP's network as part of the same packet of data. But Jennifer Granick, an attorney and privacy advocate in San Francisco, said the FBI should have done that from the start. "If the device intends to adhere to the law, then design it that way," she said. Granick acknowledged that the likelihood of unintentional privacy violations is limited, but she said Carnivore gives individual employees within the FBI the ability to monitor anyone they want to track. That kind of rogue usage is the real threat, Granick said. Jennifer DiSabatino writes for the IDG News Service

8 9

Questions of size...
by Jim Choate 01 Dec '00

01 Dec '00

The list, by consensus of the operators, has a 1M file size limit. If you can't handle it don't ask others to discard inches... Oh, and to actually return to Sunders original point of copyright. Editing the copyrighted file actually shows intent. At least my excuse is the god damned software is intentionaly designed to force the behaviour. But I did find a way to remove the attachments with only 1 extra click. Though Netscape screams like a banshee when you do it (You pick up another extra click here as well which makes the exercise entirely too tedious - and I'm sure as hell not opening another(!) window - you've got your modem picadillo and I've got my software elegance standard - Want respect? Give it.). Clearly Netscape feels that the argument over unintentional (or 'forced' depending upon POV) copyright violations are less important than keeping attachments on 'send page' commands. It's always seemed to me that it would have made more sense to fetch the page reference when the mail was opened. But I didn't write the friggin beasty. If you don't like the behaviour then send a note to Netscape. I'm not going to do anything except keep transiently using the program and to keep participating in the list. If that means the occassional unintended attachment then so be it. Deal with it. If it really bothers you but you don't want to unsub then you can kill file (Mommy, can I go out and kill tonite?) or you can start your own node. File size limitations would be completely acceptable so long as you don't truncate the messages on the backbone that you forward to other core nodes. File size truncation would need to be limited to your direct subscribers only. You are of course always welcome to keep whinning. Empower the individual! The behaviour of the leading proponents of crypto-anarchy when faced with 'non-compliant' behaviour is clear evidence of why the philosophy doesn't work. Over and out. ____________________________________________________________________ Before a larger group can see the virtue of an idea, a smaller group must first understand it. "Stranger Suns" George Zebrowski The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

IBM Cries Crypto Wolf, Experts Say
by No User 01 Dec '00

01 Dec '00

Big Blue says it can make encryption twice as fast. But the company hyped a similar advancement years ago; experts say that idea didn't amount to much, and this one won't either. By Elinor Abreu IBM is announcing a new algorithm on Thursday that it says will double the speed at which online communications are encrypted. But several crypto experts say that IBM is fixing something that isn't broken and that Big Blue has a history of tooting its horn needlessly. IBM's new as-yet-unnamed security algorithm simultaneously encrypts and authenticates messages. It works with symmetric cryptography in which the same secret key, or mathematical code, is used to encrypt and decrypt, as opposed to public key cryptography, in which two different keys are used. The new algorithm has been submitted to the U.S. Patent Office and proposed to the National Institute of Standards. The improvement in speed won't be noticed when sending small items, such as an e-mail, but it will make a difference with things like a long Microsoft Word document, an entire Web page and bulk data, according to Charles Palmer, manager of IBM's Network Security and Cryptography division. The algorithm will be especially useful with parallel processors, spreading the work among multiple processors for even greater speed improvement, so that "pointing [a handheld device] at a Coke machine actually makes the transaction happen as soon as you touch the button," said Palmer. However, several crypto experts questioned the need for the technology and said it can't be taken seriously until it's been widely analyzed and tested. "There is no market demand for this algorithm," said Bruce Schneier, author of several cryptography and security books and chief technology officer of Counterpane Internet Security, a network monitoring outsourcer. "Sure, RSA (crypto) can be slow, but other aspects of network protocols are much slower. Rarely is the cryptography the bottleneck in any communications." Performance is already addressed by Moore's Law, which dictates that processing speed increases twofold every 18 months, Schneier pointed out. He also suggested that IBM's method is counterproductive P that most security protocols prefer separating encryption and authentication because they often have different key management and implementation requirements. "Combining the two makes engineering harder, not easier," he said. "I predict that if you go back in one year, zero applications will be using it." Tim Dierks, CTO of Certicom, concurred with Schneier and added that there are already other means, including hardware accelerators, to improve crypto performance. "I don't have reason to believe the market is hung up on this sort of solution. It's a question of whether there is market demand for it," he said. IBM's Palmer acknowledged that the new technology isn't going to have any drastic impact in the near term. "We can do it all right today, but this is just going to get worse as we get cable modems and DSL," he said. "[Schneier's] right; we may not have a blinding need for this right now." The criticism wouldn't be so harsh if IBM hadn't done this before. Two years ago, IBM announced what it called the "Cramer-Shoup cryptosystem" that it cited as "provably secure" and hyped as a replacement for SSL (Secure Sockets Layer), a protocol that is ubiquitous in e-commerce transactions. That IBM technology, which was designed to prevent against an obscure type of crypto attack, has not yet been deployed, noted Schneier. "IBM's got a track record of coming out with these major crypto announcements around early stage results" that haven't been evaluated and tested, said Dierks of Certicom. "They're seen as self promoting." An IBM algorithm dubbed the "Atjai-Dwork cryptosystem" was announced in 1997 and broken the following year, he said. Burt Kaliski, chief scientist and director of RSA's Labs, came to IBM's defense. The new IBM algorithm "is an interesting line of research; a nice application of theory to achieve some significant results," he said. "While we could debate whether there's a problem to be solved, it's a nice technology they've come up with. "Here, they seem to be on more solid ground in terms of the technology they're proposing," Kaliski added. "It still needs some more analysis by the crypto community."

4 3

RE: Arthur Anderson black-bagged, NIPC now spooking
by Carskadden, Rush 01 Dec '00

01 Dec '00

And you are bragging about this? Jeez. Have you MET the guy yet? So tell us, what was discussed, and where can we find it? -----Original Message----- X-Loop: openpgp.net From: Declan McCullagh [mailto:declan@well.com] Sent: Wednesday, November 29, 2000 9:50 PM To: Multiple recipients of list Subject: Re: Arthur Anderson black-bagged, NIPC now spooking On Wed, Nov 29, 2000 at 04:52:49PM -0500, Tim May wrote: > I don't know what "NIPC" means, but I thought at first you meant that > NIPC was in Lithuania. Perhaps not. FBI's National Infrastructure Protection Center. I'm on an ABA panel tomorrow with Michael Vatis, the head. Should be cybercast; I'll find details. -Declan

2 1