September 2001 - cypherpunks-legacy

DON'T BORROW MONEY! DON'T GET IN MORE DEBT!
by International Wealth Builders 02 Sep '01

02 Sep '01

Hello Friend, DON'T BORROW MONEY! SUPPOSE THERE WAS A WAY TO: Pay off a 30-year mortgage in much less time! Pay off your credit card debts! Pay rents and leases! Pay phone, utility, etc. bills! Pay off business loans! Pay off student loans! Pay judgments, child support, IRS liens! WELL....There is! NO OBLIGATION for free information on how The Debt Payment Club can help pay your debts, and...you don't pay them back - EVER! NO Refinancing - NO Monthly Payments NO Ruined Credit - NO Qualifying! CLUB MEMBERSHIP AVAILABLE WORLDWIDE! We have members in over 27 Countries and we are over 5 years old! So far The Debt Payment Club has paid... -over $4,000 of Mary W.'s debts from Cocoa, FL -over $1,500 of Mary S.'s debts in Butler, PA -over $31,000 of Mark D.'s debts in Bradenton, FL -over $40,000 for C.J. from B.C. Canada -over $120,000 for Grace B. from Banon,OR There's nothing like it: The Debt Payment Club! DPC Helps Pay off your debts ... all kinds, up to $100,000! Over 2.2 million in personal and business debts have been paid so far ... both nationally and internationally! As of 4/10/2001, we have paid $1,407,723.15 of The Debt Payment Club members' debts! and we are resolving over $5,000,000 in credit card and mortgage debt. Why don't you give us a call and let us help you? 1-818-763-1000 extension 10846 Thanks, Dana Brown DPC ID 10846

1 0

Stealth Computing Abuses TCP Checksums
by Bill Stewart 02 Sep '01

02 Sep '01

http://fyi.cnn.com/2001/TECH/internet/08/29/stealth.computing/index.html http://slashdot.org/article.pl?sid=01/08/29/199205&mode=thread A group of researchers at Notre Dame figured out how to use the TCP Checksum calculations to get other computers to do number-crunching for them. "Below, we present an implementation of a parasitic computer using the checksum function. In order for this to occur, one needs to design a special message that coerces a target server into performing the desired computation." The article has the amount of great mathematical depth you'd expect from CNN :-) But it does say that the paper will be published in "Nature" this week. It's a really cool hack, though not especially efficient for real work. Of course, the Slashdot discussion follows typical structure - there's an interesting technical suggestion (ICMP checksums may be usable and are probably more efficient than TCP), some trolls and flamers, the obligatory "Imagine a Beowulf Cluster of those!" comment, and some speculation about the potential legalities and other uses for it. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

6 6

Re: The Privacy/Untraceability Sweet Spot
by Nomen Nescio 02 Sep '01

02 Sep '01

On Monday, August 27, 2001, at 12:56 PM, Tim May wrote: > On Monday, August 27, 2001, at 12:40 PM, Nomen Nescio wrote: > > "Freedom fighters in communist-controlled regimes." How much money > > do they have? More importantly, how much are they willing and able to > > spend on anonymity/privacy/black-market technologies? These guys aren't > > rolling in dough. > > The IRA and the Real IRA have a lot of money, as the Brits have been > complaining about recently. Osama bin Laden is said to control more than > a billion dollars. And so on. I disagree with you assertion that "these > guys aren't rolling in dough." Members of the IRA are not freedom fighters in a communist-controlled country. bin Laden did fall under that definition when he was fighting to get the Russians out of Afghanistan but that was a long time ago. Now he's opposing American influence in Saudi Arabia. Some developers may nevertheless sympathize politically with such these groups and so could work on technology for them with a clear conscience. > > "Revolutionaries overthrowing bad governments." The main > > revolutionaries > > who will be willing to pay money are those who expect to get rich from > > their revolution. These are the ones who want to throw out the tyrants > > so they can set themselves up as new tyrants. It is people like this > > who would be the best customers of cypherpunk technology. You're not > > making the world a better place by giving them tools. > > You make the assumption that overthrowing, say, the PRC or USSR > governments, would result in a "worse or just as bad" regime. I > disagree. And the same tools are still available to deconstruct interim > replacement regimes. The point is that those who will pay large sums to acquire access to these technologies, even for the purpose of overthrowing an evil regime, are not doing it out of altruism. They're not good-guy libertarians who only want to set up a John Galt state. Realistically they're more likely to be interested in taking over the reins of power themselves. And it's pretty questionable to salve your conscience by saying that even if these guys use the tools to bad ends, someone else will then be able to use the same tools against them. The problem is, we're doing this for profit, right? We won't give the tools away once the first generation uses them to take over. We should sell them to the highest bidder. (Better to think of a service than a tool here. Most cypherpunk technologies require a distributed infrastructure that you can charge for.) The high bidders are once again going to be the bad guys who want to take over for selfish reasons. > > "Distribution of birth control information in Islamic countries." > > Again, > > selling to Planned Parenthood is not a business plan which will make > > anyone rich. > > Planned Parenthood is not envisaged as the user.... Pray tell, who exactly will pay large sums to be able to distribute birth control information in Islamic countries? > > The conclusion is that you need to add a third axis to Tim's graph: > > morality, in addition to value and cost. Many of the most lucrative > > potential uses of anonymity technologies are morally questionable. > > If you add this additional filter you are forced to focus on just a > > few application areas (with the additional complication that few people > > will agree on morality, and that morality and legality often have little > > overlap). > > The technology is agnostic to "morality." This is trivial; the same can be said for any technology. It is the users and implementors who are moral actors, and that is who we are considering. > Choate argues that at least 5 or 6 axes are needed. Ever the nitwit, he > fails to realize that the main debate doesn't even use the _two_ that I > have outlined. Yes, I know about phase spaces and multi-dimensional > diagrams. But given that the debate about privacy tools is mired at the > 1D level ("untracebility good, traceability bad...why don't the proles > see this?"), graphing the major users and suppliers on the 2D graph I > outlined is a step in the right direction. It goes a long way to > explaining why people will spend thousands to fly to the Caymans to set > up a bank account while others won't even bother using PGP. Fine, if the only point you want to make is that costs must be considered. But eventually we need to move beyond that simplistic analysis. At that point we do need to consider morality and other issues. > You want to add "morality" to the chart. Fine, except I don't see how it > gives different answers than my chart gave. The answers it gives depends on the questions you ask. If your questions are simple enough (untraceability good?) then your chart will answer them. If your questions are more interesting (what technologies can be practically implemented and make a positive difference in the world) then you need a better chart.

7 15

RE: Jim Bell sentenced to 10 years in prison
by jamesd＠echeque.com 02 Sep '01

02 Sep '01

-- On 1 Sep 2001, at 16:12, Faustine wrote: > All I'm saying is that if the feds are doing their job well, > they won't stick out at all. Fortunately it does not seem very common for government employees to do their jobs well. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG vuP3Scaq1rspcZvWRBMeyrfXAZy+ZdakxEmYzJIX 4AcwoF+RVx3EHZrq58+Pvvj6aJxojQXwE14EGbM4G

1 0

RE: Jim Bell sentenced to 10 years in prison
by jamesd＠echeque.com 02 Sep '01

02 Sep '01

-- On 1 Sep 2001, at 16:12, Faustine wrote: > All I'm saying is that if the feds are doing their job well, > they won't stick out at all. Smells like a witch hunt. Fortunately government employees seldom do their jobs well. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG VMG1ETupIefAXUXhriXMx/jYuZ/GAkBiR2bp0dam 4j11sKNzaPkhkV9Dcny7kqNAWJLgxx2fb75bC3eBw

1 0

stump go boom, and keeping kanooks at bay
by Subcommander Bob 02 Sep '01

02 Sep '01

At 11:17 AM 8/31/01 -0400, Duncan Frissell wrote: >Note that the unlicensed private use of explosives may be legal in America >depending on time and place. Need any stumps cleared? Last week, my local (SoCal) Home Depot had Grant's stump remover, which appeared to be homogenous small spheres and KNO3 was mentioned on the ingredients list :-) >How can we stop >that Canadian armoured column slicing through Buffalo and heading down the >Thruway towards NYC? Wait for a snowstorm.

3 2

Re: News: "U.S. May Help Chinese Evade Net Censorship"
by jamesd＠echeque.com 02 Sep '01

02 Sep '01

-- On 30 Aug 2001, at 14:52, Faustine wrote: > And as long as you have companies like ZeroKnowledge who are > willing/gullible/greedy/just plain fucking stupid enough to > sell their betas to the NSA, you never will. There is nothing wrong with selling betas to the NSA. I make my crypto source code available to the NSA, and to everyone else. Everyone should do this. Anyone that fails to do that is up to no good. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG 67dYNaWosvJqHSU041w2pF90I0cE+VHfMhQxInsf 4Is1TS6sNGfG1fhrdBPgbEbNEPYuv+XqX9gM0Ua0i

3 2

That's the 3th e-mail I send to you! 1_129
by 00001_002962＠mailcity.com 02 Sep '01

02 Sep '01

---------------------------------------------------------------- NASTY YOUNG GIRLS - WEB'S YOUNGEST WOMEN ---------------------------------------------------------------- Teens Super Model - Customizable pictures - Live & Interactive Videos Anal - Blowjob - Fucking - Young Teen - Clouse Up - Hardcore http://3368103282/young_g/ (Click in the link or copy and paste into your browser) ---------------------------------------------------------------- This email has been requested by a user on your network and has not been sent unsolicited. If the user does not recall requesting this email, then another user has maliciously requested it for them. If this is the case, please accept our apologies and email: nasty_young2001(a)yahoo.com IMMEDIATELY. Please include this entire email, plus any other info which may assist us in identifying the guilty party. ---------------------------------------------------------------- ---------------------------------------------------------------- ASTY YOUNG GIRLS - WEB'S YOUNGEST WOMEN ---------------------------------------------------------------

1 0

Re: Moral Crypto
by keyser-soze＠hushmail.com 02 Sep '01

02 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- At 03:40 AM 9/2/2001 +0200, Nomen Nescio wrote: Tim May wrote: > On Saturday, September 1, 2001, at 01:30 PM, Nomen Nescio wrote: > > Yes and no. The users aren't all that anonymous, or they wouldn't need > > anonymous technologies, would they? The remailer network sees where > > this message originates. If you use Zero Knowledge software, their > > network knows exactly who is using it at any time. If a digital cash > > bank came into existence, payments transferred into the digital system > > from outside would largely be from identified sources. > > What can I say? You clearly don't understand: > > -- how remailer _networks_ work (Hint: nested encryption...all the first > remailer sees when he opens a message is an encrypted message he can't > read and instructions on which remailer to send it to next, and so on. > Only if most/all remailers collaborate can the route be followed by > them.) >The fact that a given person is using the remailer network is not a secret. At least one remailer finds out every time he sends a message. The point is, the entry from the non-anonymous to the anonymous world is a vulnerability. If the number of remailers of small then this represents a vulnerability. If the number is large (and especially if the first remailer link is encrypted and is a generalized P2P client able to perform a great number of functions, including remailing) then risk is greatly reduced. > -- how Freedom works (Hint: They say that even they cannot know who is > using it, except in terms of network usage. Which with cover traffic, > forwarding of other traffic, dummy messages, etc., means the fact that > Alice was using the network during a period of time does not mean they > know which exit messages are hers.) >You are not stating their claims accurately. ZKS does indeed have information about who is using it at any given time, if they operate any of the servers. Or at least the server operators can tell. Each user sets up a route through a chain of servers, and any given server knows exactly who is using it as the initial connection into the network. Again, the entry from non-anonymous into anonymous networks is visible. The hierarchical architecture of ZKS' network is, in my opinion, a weakness. I greatly prefer a P2P approach, despite possible DoS shortcomings. In a P2P approach the first remailer may be hosted on your own machine. As Tim has noted as long as one or a few remailers are trusted (and one assumes you own PC is trusted) then the chain is sufficiently reliable. > -- blinding. (Hint: That Alice deposits money into a digital bank, and > is identified by the bank, does not mean the bank knows who received > digital money from Alice, because Alice unblinds the note before > spending it--or redeeming it.) >No, but the fact that Alice transfered a certain amount of funds into the anonymous bank is visible to at least some observers. Once again, the point is that as you enter the anonymous world your entry is visible. As in the remailer case, if the number of ecash merchants is small and they don't accept cash then this may be true. If the number of sales and redemption points is large and cash, or other anonymous bearer instruments, are accepted then the risk is greatly reduced. > > Nonsense. Most participants in this forum DO share common philosophical > > goals: the preservation and enhancement of individual freedom via > > technological means. This is our common heritage. People make moral > > judgements every single day on this list based on exactly this framework. > > And it is this moral view which tells us that bin Laden and his terrorist > > groups are not the market which we should target in order to advance > > these goals. > > How about McVeigh? How about The Real IRA? How about John Brown? How > about Patrick Henry/ How about Cuban exiles? (By the way, everyone > should know about the time an anti-Castro group blew up a Cuban > airliner. Terrorists, freedom fighters, or just a bunch who wants to be > in control?) >Not everyone will agree with every specific case. But given our common philosophical heritage, list members can come to agreement with regard to most examples. The test is simple, whether these individuals advance the causes we support. >As long as you're listing examples, what do you think about Osama bin Laden? Would you support efforts to market crypto technology to Islamic religious extremists? If it can't pass the terrorist or pedo test its not ready for prime time. Would you limit firearm ownership to pellet guns. Would you trust or wish to pay for a missile defense system which would only defend against amateur rockets? >The great thing about bin Laden as an example is that we can see exactly what the consequences will be when he succeeds. With McVeigh, nobody knows for sure. But chances are it would be much the same if the militias achieved their goals: installation of a religious state. Supporting these people means helping bring about another Afghanistan, maybe right here at home next time. And we can guess what happens when what we thought were our constitutional guarantees are slowly eroded "for our security and the safety of the Children." I have no interest in living in a "safe" society virtually devoid of my civil rights and woe onto those who enact leglislation or enforce laws taking it from you or I. -----BEGIN PGP SIGNATURE----- Version: Hush 2.0 wmAEARECACAFAjuRtHIZHGtleXNlci1zb3plQGh1c2htYWlsLmNvbQAKCRAg4ui5IoBV n0GtAKClCvpYr35qjFjsgWHASTip7P79bQCfbHSthkT76QyYLPZsm5PZHg/eZUo= =03a3 -----END PGP SIGNATURE-----

1 0

RE: The Privacy/Untraceability Sweet Spot
by Aimee Farr 02 Sep '01

02 Sep '01

Reese wrote: > >This is not legal advice. It's an obituary. :) > > Owning a vehicle that will exceed the speed limit is not a crime. > Driving a vehicle that will exceed the speed limit is not a crime. > Exceeding the speed limit is a crime and is a ticketable offense, > at the least. > > Mechanisms to maintain privacy and anonymity are no different, use of Damn it, Reese, I didn't say that. Can anybody here read between the lines? Helloooo? *echo-echo-echo* > those same mechanisms to commit crime is not a death knell for those > mechanisms just as manufacturers do not stop producing and selling > vehicles that are capable of exceeding the speed limit, even though > some people do speed and are ticketed or given warnings, at least. > > You are entirely too smug and happy, at the thought of these various > mechanisms useful for preserving privacy and anonymity going the way > of the dodo. That is not my attitude at all, Reese. I obviously like Tim's Blacknet. However, I don't like it being characterized as a subversive tool, and damn sure not in terms that might indicate a criminal conspiracy for shopping out secrets to Libya. > Tim may be correct, in his assessment on your deserving > what you receive. Oh, Noooooo!!!!! > >> think of people selling their expertise when some guild says they are > >> forbidden to. > > > >I talked about this before, as an OSINT channel for the U.S. Government. > > > >o BlackNet has legitimate intelligence applications. > > It also has legitimate applicability for Joe Sixpack and Suzy Winecooler, > who don't want a zillion ads and cookies clogging their bandwidth and > cache, who don't want targetted ads or their surfing habits tracked and > monitored, who certainly don't want their health insurance premiums to > go up after they do research on some rare, incurable disease they are > mildly curious about or after researching a more common ailment when a > friend happens to be diagnosed - to lean on those old standbys. No shit. > >o Anonymity can be a problem. You need authentication. You would like > >blinded biometrics. > > The maintenance of privacy can be a problem, from a marketers POV, other > things can be viewed as problems too, when the end consumer has proper > control of self-identifying information. If the money is good, that > level of authentication can be conducted in meatspace if it is truly > needed - most times, it is not. Again, I was speaking within the confines of a very limited application where authentication can be rather critical. > >o I would think the ROI would be where you can shoehorn into existing > >intelligence channels and groundwork. That's either a sovereign, an > >intermediary wrapped in the skirts of a sovereign, a defense contractor, > >or an untouchable intermediary. If not bona-fide intelligence, you're > >left with the criminal element, IRA and so forth. > > You leave many possible things out, you present a false summation of all > the possible uses of Blacknet and maintenance of anonymity. As I stated, I was examining it in the context of an _intelligence application_. I wonder if that's a good contract, but obviously not....why do I even bother? *sigh* > >Most move product and still have > >distribution channels. Yeah, the IRA would like digital cash, they are > >buying arms with offshore debit cards. > > This event by people acting criminally in another country (according to > the rules imposed by past-rulers of that other country, heh) should be > used to shape and mold US domestic policy and legislation for the care > and feeding of US citizen-units how, exactly? I was merely pointing out that people that crypto does not "beam" product. Solve the ship-submarine ditching problem if you want to help that scum. > >o It seems like _damn bad timing_ for a discussion in this context. > > Bad timing? Who is disadvantaged by the timing of this discussion? > Your handler said to slow the conversation down while they run some > numbers and gets some surveillance in place, or something? They've caught on to our "slow-the-conversation" tactic!! Oh, whatever shall we do now? *slap to side of face* "Run some numbers?" What? I flag posts in here that might qualify for Title I interceptions. This month is looking to be a record-breaker. Excuse me, my "handlers" are calling.....Sorry, I'm not allowed to talk about this. > >This should be couched in terms of a beneficial application, rather > >than something subversive. > > Principle is like that. You don't like what others have to say? You > should remove your own right to freedom of speech, before you attempt > to censor others. (Good luck, once you've effectively removed your own > right to free speech, on censoring anyone else). Damnit, I'm not censoring anybody. I believe in the First Amendment. It's such a good source of intelligence and so often leads to probable cause. *kidding* > As a lawyer, you know or should know that most (if not all) of the most > significant constitutional rights cases to be heard by the courts have > involved criminals and other undesirables and unlikelies who pushed the > edge of the envelope in their own defense. Just because I have a dislike > for Charles Manson, does not mean I support movements to suspend all the > rights affirmed under the First, Second, Fourth, Fifth and other of the > various Amendments we collectively refer to as the Bill of Rights, for > example. *applause* > >It's like the fall of Knights Templar in > >here. What happened to the pilgrims' safe passage? > > When it walks like a duck, quacks like a duck and looks like a duck, it > probably isn't a pilgrim. Real ducks neither quack nor waddle, Reese. I'm going to go outside now, and talk to snails. ~Aimee

5 5