December 2003 - cypherpunks-legacy

Blacknet
by LaurianneA＠aol.com 17 Dec '03

17 Dec '03

Are you still up and running with Blacknet? I just need to know if you can use some info. Message me here.

1 0

Re: Using deterministic programs to select private RSA keys.
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 10:38 AM 10/17/95, Martin Diehl wrote: .... > I suggest that if you capture the time in microseconds between > keystrokes and insert the least significant 8 bits between the > corresponding characters (i. e. <letter1> <time2 - time1> <letter2> > <time3 - time2> <letter3> ... <letter nnn> <time until double CR - > time nnn>) and MD5 the set of values, the resulting "random" value > will be different for both people who type different input texts as > well as those people who type the same input text. .... Indeed, but the point of the proposal is a determinate and reproducible program behavior so as to gain confidence that the output is correct by comparing output of several programs. .... > As regards the observation that MD5 produces only a 128 bit result, > you could call MD5 after each nn values (at least 16) have been > entered. In that way a few lines of input and associated timing > values could easily generate a value of the same order of magnitude as > the number of 1K primes. .... Sounds good.

1 0

I want to learn!
by VINCENT810＠aol.com 17 Dec '03

17 Dec '03

Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs.

1 0

if-comp: Project to make Fact true (fwd)
by s1018954＠aix2.uottawa.ca 17 Dec '03

17 Dec '03

This is something I got off the Idea Futures computers list. (The Fact claim is that a 512 bit number will be factored by '97) I don't know if the following address has been posted here before. ---------- Forwarded message ---------- Date: Tue, 17 Oct 95 13:45:40 PDT From: Robin Hanson <hanson(a)hss.caltech.edu> To: if-comp(a)merak.com Subject: if-comp: Project to make Fact true A team at Bellcore seems to be planning to try and make the claim Fact true. See this web page, and the forward in particular: http://kayak.npac.syr.edu:2008/ They plan to use the web to allow lots of machines to easily participate. They will start with a 130-digit number and work their way up to the 155-digit number required to satisfy the claim. Will they succeed by the end of '97? A crypto expert friend of mine claims their chances are 90%. I have bet accordingly. Robin Hanson hanson(a)hss.caltech.edu http://www.hss.caltech.edu/~hanson/ 818-683-9153 2433 Oswego St., Pasadena, CA 91107 FAX: 818-405-9841 818-395-4289 Div. Hum. & Soc. Sci. 228-77 Caltech, Pasadena, CA 91125

1 1

Re: Security Spectra (Oops)
by P.J. Ponder 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: 17 Oct 1995 14:13:10 GMT From: Jeff Williams <williams(a)va.arca.com> To: cypherpunks(a)toad.com Subject: Re: Security Spectra P.J. Ponder writes: > In your recent post to the cypherpunks mailing list you proposed a > taxonomy of security weaknesses and vulnerabilities, adding that these Please watch your attribution. Vlad Nuri proposed this rating scheme. Oops. Sorry about that. ------------------------------------------------------------------------- On another matter, what's wrong with Mr. W of NetScape Communications subscribing to this list, maybe even posting once in a while if he feels like it, and in general just being a list subscriber like the rest of us? Remember, as Mr. PM says - 'It's not a group, it's a mailing list'. Mr. Weinstein's sig file says his posts are his own opinions, anyway. NetScape biggies have certainly posted on this list before and probably will again when they have something they want to send to the list, like a press release. Cut Jeff some slack. (apology to international readers, that's an Americanism for quit busting his chops.)

1 0

[ANNOUNCEMENT] eCash reality !!
by usura＠berserk.com 17 Dec '03

17 Dec '03

e-WAVE [issue 42], a dutch language electronic newsletter published by Riverland Publications, reports that DigiCash has reached agreement with a big US bank to make eCash real. DigiCash promised the 'scoop' to Newsweek, so in next monday's issue of Newsweek we will know wich bank that is. (They are also said to be talking with a Dutch or Belgian bank or financial institution). Since there has been cut a deal with the monetary powers I wonder if we get the whole anonymous ecash or a 'diluted spieces'. -AJ- For the many subscribers of the cypherpunks mailinglist that are able to read Dutch, here is the portion of e-WAVE that has the announcement. <g> ------BEGIN QUOTE------ Tijdens de toelichting op de toepasbaarheid van Digicash's encryptie-technologie op stemmen, komt het vermaarde e-cash ter sprake. Dinnissen heeft een primeur maar mag nog niks verklappen: 'Volgende week maandag zullen wij bekend maken met welke grote Amerikaanse bank Digicash in zee gaat om e-cash tot een legitiem en valide betaalmiddel te maken.' WAT!!! E-CASH LEGAAL?! Wow, gelijk de cyberbucks natellen. En met welke bank? 'Kan ik niet zeggen.' Ook nog Nederlandse of Belgische banken? 'Er zijn ook gesprekken dichter bij huis, ja.' Kan dat eigenlijk zomaar? 'Er zijn afspraken gemaakt met monetaire instanties. De scoop is beloofd aan het Amerikaanse tijdschrift *Newsweek* dat op die maandag uitkomt.' (Shit) Spoedig meer hierover. For more information mail: erwin(a)wave.riv.nl ------END QUOTE------ 88888b d888b 888b 88 8P 888888 88888b 888 888b 88 88 d888b 88 88 88 88 88 88`8b 88 88 88 88 88 88 88`8b 88 88 88 ` 88 88 88 88 88 88 88 88 88 88888P 88 88 88 88 88 88 88 88 88 88 88 88 88 `8b88 88 88 d8888888b 88 `8b88 88 88 , "" 88888P `888P 88 `888 88 88 88 `8b 88 `888 88 `888P 88

1 0

Re: [ANNOUNCEMENT] eCash reality !!
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <3R85cD1w165w(a)berserk.com>, usura(a)berserk.com (Alex de Joode) wrote: > e-WAVE [issue 42], a dutch language electronic newsletter > published by Riverland Publications, reports that DigiCash > has reached agreement with a big US bank to make eCash real. > > DigiCash promised the 'scoop' to Newsweek, so in next monday's > issue of Newsweek we will know wich bank that is. (They are also > said to be talking with a Dutch or Belgian bank or financial > institution). > > Since there has been cut a deal with the monetary powers I wonder > if we get the whole anonymous ecash or a 'diluted spieces'. It will have the same features as the Ecash used in the trial. Payer is anonymous, but the payee isn't. I hope that I'll be able to finish some perl scripts that add this badly needed, but for political reasons missing, feature by the end of the month. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMIRvWioZzwIn1bdtAQHT8wF+JUheIIJxAV4ER1+lPddZhr744rR9N0/f Ps0CIGNK9Ie16XVBMXx4J0OkKqCjP0PW =HFWw -----END PGP SIGNATURE-----

3 2

PINs
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

What if You had Two PINs ??? And One Works and One Sounds a Silent Alarm . Then If You are Forced to give your PIN ,You give Them your Second PIN and They get Caught !!!!!!

2 1

Re: transaction costs in anonymous markets
by sdavidm＠iconz.co.nz 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.SUN.3.91.951016011355.2241A-100000(a)eskimo.com> Wei Dai said: "Maintaining anonymity requires that communications be done through special untraceable protocols." I think it is important to keep in mind exactly what we mean by anonymity in these discussions - there seems to be a bewildering array of flavours. Take three situations where anonymity might be useful: 1. The State Authorities come and take you away for subscribing to a publication advocating the end of socialised medicine. 2. The State Authorities come and take your assets away to pay for socialised medicine. 3. The Private Hospital comes and takes your assets away to pay for your lifesaving operation. [Avoiding 1 is (in my opinion) an unmitigated good; avoiding 2 is obviously desirable; but avoiding 3 could well be counter-productive.] This points to two categories of anonymity: Meat anonymity - there is no way of knowing which human is responsible; and Asset anonymity - there is no way of linking a particular human, transaction or activity to any particular asset, or vice versa. The point being that sometimes one will be desirable without the other. Concentrating on meat (or combined?) anonymity, there are (at least) two sorts; Legal anonymity - where the split between asset and meat is the result of the interposition of some legal structure (eg. Trust, corporation etc), the ultimate owners/controllers of which are unknown; and Digital anonymity - where the identity of the actor is mathematically unknowable (at least, at the limit). Obviously, these sorts can be layered, with legal entities transacting as digitally anonymous parties, and the owners of those legal entities protected by digital anonymity. In addition, we can distinguish between digital anonymity that allows no link between separate transactions (anonymity proper[?]), and digital anonymity that does allow links to be drawn between separate transactions or activities (pseudonymity). Similarly, we can distinguish between the various anonymous properties of transactions: A. Private Transactions. Each party to the transaction knows the identity of the others, but no third party can know who is transacting with whom. B. Unilateral Anonymity. One party to the transaction is known, but the other is unknowable. An example might be subscribing for a digital security with ecash - the issuer is known, but the purchaser is anonymous. C. Bilateral Anonymity. The identities of both parties to the transaction are unknowable. This might be the case on a cypherpunk stock exchange... "The current state-of-art (i.e. RemailerNet) adds several hours of transmition time to each message to achieve effective untraceability. Contract negotiation, for example, becomes very difficult under these circumstances." My experience of contract negotiation is that a delay of hours would be immaterial. Don't forget that email, fax machines, and even the telephone are relatively recent phenomena (not to mention the photocopier and the word-processor). Most super-tight deadlines are self-inflicted. "If these costs remain high, but anonymous markets develop regardless, it will be interesting to see how these costs affect the structure of the markets. Will special protocols for contract negotiations develop to minimize the number of round-trip messages?" Doubtless. In areas where complex transactions really have to be entered into at short notice, a lot of the negotiation goes on in advance, often by trade associations. ISDA, for instance, is forever producing standard terms and appendices so that all manner of arcane derivative transactions can be more or less negotiated over the phone. Cheers, Dm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMISijFlo3j8JHzalAQENEAP/UJTSvhAR534mh1KUQZQC1JYxZeROUaDf 6Nd42yxCmLbbSa72dEAB69jdfDHBj2sj6Jf6jL+HAGTrfG6I/dNJuKu9MaaCw64z MKe0efTCmD2caehOv9lf5tI2uJ0vAql8UdCC5gj3NhkxKr/uEAvcbIlt/Z60mmEu 4P2hxCv1u/o= =U8gP -----END PGP SIGNATURE----- [Palmtop News Reader - Beta Version 3]

2 2

I want to learn!
by Leo_Martensen_at_~~HEID-DHS＠ccmail.odedodea.edu 17 Dec '03

17 Dec '03

>From: VINCENT810(a)aol.com >Message-Id: <951017234254_126621887(a)mail06.mail.aol.com> >To: Cypherpunks(a)toad.com >Subject: I want to learn! >Sender: owner-cypherpunks(a)toad.com >Precedence: bulk >Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs. Me Too, I'm catching on but some help would help ! Leo_Martensen_at_~~HEID-DHS(a)ccmail.odedodea.edu

1 0

unsubscribing
by Sheedy, E.C.C. 17 Dec '03

17 Dec '03

Apologies for the e-mail but could someone please tell me how one unsubcribes from this list as the recent changes have messed it up. _______________________________________________________ Kamer : B40 KPN Research Telefoon : +31-50-5822816 PO Box 15000 Fax : +31-50-3183110 9700 CD Groningen Email : e.c.c.sheedy(a)research.kpn.com The Netherlands ________________________________________________________________

1 0

Anonymity: A Modest Proposal
by Modemac 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Several weeks back, I posted a message stating the need (in my opinion) for a system of anonymity on the Internet that would be more secure than the anonymous remailers. Despite the valuable service provided by the remailers, I am troubled by their vulnerability. It seems likely that at some point in the near future, a remailer is going to be silenced, and possibly (though not inevitably) the contents of its database made public. This may possibly lead to criminal charges being filed against someone, based on alleged criminal acts in which the remailer plays a part. (I am not going to state what these "criminal acts" may be, because I don't know which ones will be involed. I don't know when this blow to the remailer system will come, or who it will happen to. I simply believe that, given the growing trend towards censorship and anti-privacy in government and business circles, the blow will come sooner or later.) The vulnerability of the remailer system, in my opinion, rests in the fact that a remailer is physically located in a certain place. This makes the remailer a target for attacks, as shown by the futile efforts (so far) of the so-called "church" of Scientology to silence the remailers at anon.penet.fi and xs4all.nl. (The original demand of Scientology in the Penet affair was for the entire contents of Julf's database to be revealed, but fortunately Julf was able to limit the exposure to a single user. When Scientology attempted to raid xs4all, their original seizure order was against the remailer itself - -- but fortunately (again) the remailer itself had been closed two months before. The representative of Scientology had to re-phrase the seizure order on the spot, declaring instead that the reason for the seizure was the existence of the infamous "Fishman Affivavit" on an xs4all Web page.) I believe a system of anonymity is needed that can withstand attacks of this sort. The current remailer system may be able to weather the oncoming storm, but it will suffer damage in the process. A system to reduce the effect of pro-censorship forces on sources of online anonymity is needed. But what shall this system be? Since the prime vulnerability of the remailers rests in their physical locations, we have the possibility of physically hiding their locations. This is impossible in the long run, and it hampers the ability to set up a remailer on a short-term basis. How hard is it to set up a node that is hidden from efforts to discover its location? If setting up a remailer requires you to go into hiding, many would-be privacy activists will be dissuaded from giving it a try. Rather, I wonder if it would be possible to devise a system that introduced a random element into the picture, one that lessens the possibility of blame being placed on any one individual, or any one site. The Netherlands responded to Scientology's attack on xs4all by spreading the Fishman Affivavit far and wide. At the time of this writing, this document now exists on more than eighty Web pages in Holland, and this makes it far more difficult for Scientology to stop the spread of information. (They are still trying, however. The latest word from Europe is that a member of Scientology's "Office of Special Affairs" has flown to Europe, and is now calling service providers and individual users. A lawyer for Scientology is there as well. See alt.religion.scientology for more details of this case.) Using Scientology as an example once again (this will be my last mention of it, I promise), note the failure of the "church" to shut down alt.religion.scientology. They have tried every possible means to prevent the newsgroup from spreading information to the world, and every attempt to stop this "leak" has failed. If it was possible to effectively eradicate a newsgroup, Scientology would certainly have done so by now. Alt.religion.scientology cannot be shut up because it is distributed to thousands of sites around the world, thus making it impossible to shut them all down. That's why I believe a newsgroup for anonymous messages would be able to withstand attacks by would-be censors. Previously, I had suggested the possibility of a "moderated" anonymous newsgroup that would forward all postings to the address of the "moderator," where they might then be randomly distributed to remailers before being posted to the anonymous newsgroup. However, that idea had several inherent weaknesses, including attacks on the "moderation" site and newgroup messages designed to compromise the newsgroup and send postings to other places. The way to prevent a newsgroup from being compromised in this manner, then, would use a different method -- one that is immune to control messages. In the course discussion with a group of cyberpunks on IRC a couple of days ago, another possible system for anonymity was devised. This system can reply on a unmoderated newsgroup as a source for messages. Instead of forwarding messages to an address in order to hide the ID of an anonymous poster, it was suggested that PGP be used to protect the messages themselves. The basic idea for this system goes like this: 1) A person writes a message and encrypts it with PGP. 2) That person then posts his message to the "anonymous messages" newsgroup. 3) A remailer scanning the newsgroup picks up the message, decrypts it, strips the headers and makes it anonymous, and sends it to its destination. Because the anonymous messages come to the remailer by scanning a newsgroup, tracking a remailer's incoming-mail logs would be useless. To offer further protection for the remailers, a random system could be devised to ensure that no one knows exactly which remailer scans a particular message at a particular time. I am not a programmer, and some of the technical details in this proposal go over my head. Hopefully you can clairfy some of the points presented here and see if this system is possible or not. The actual remailer code, involving scanning the newsgroup for PGP-encrypted messages and stripping headers, could be written with PERL scripts. This would keep it portable, and it would be easy for a person to tell if it has been tampered with. This code would be distributed widely. A series of remailers would be used to decrypt anonymous messages. A "token" (like the token ring of IBM fame) would be passed back and forth between all of the Cryptoclients in the remailer network, so that only one remailer would be "active" at any given time. This token would be passed back and forth at random, so no one would know exactly which remailer is being used to anonymize a message. The "token" is the key to this remailing system. This token would include necessary information such as the last message scanned, and to coordinate timing among the remailers. This will work to avoid duplication of messages. (Of course, the remailers should also hold messages for a random amount of time -- say, up to two hours -- in order to prevent someone from being traced, based on the time he posted his encrypted message to the newsgroup.) The decryption key for the anonymous messages would be created using a 2047-bit PGP key. To prevent this key from falling into the wrong hands, a "web of trust" could be used to pass pieces of the key among each other. If enough sites trust remailers trust a site, that site will receive enough pieces of the group key to be able to respond and "accept" the token. The public key for this PGP key would be sent to the keyservers. People would encrypt their messages using this key. The mental image I have is that of a virtual "anon demon," zipping back and forth among the network of remailer sites, stopping at each site to scan messages from the newsgroup and send them to their destinations. If a large network of remailers is connected in this fashion, it becomes impossible to prevent stop anonymous messages from reaching their destination simply by attacking one site, or even a series of sites. The "anon demon" would simply bypass the compromised sites and use other points in the network. Comments are welcome concerning the vulnerability of this system, its complexity, its ability to withstand attacks, and any other constructive criticism. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIToGR7ohFhEPknNAQHEtwP9EmdEVtNoEJC6MtokZs66ea27Nx874K+s ueOiX21QL01SGjn7AvHUxTDPSiNXdnqSlDRqsnc2nefNlkhc2bzZklovlnZ15XC/ ZUxRWtCBk0LFoPyxbc/kEOM2cjqJdZ4llxYRHed0RcH0ABvYcGv8ZTjxtKEwN9Sy IDxmiTlqHXU= =yLqV -----END PGP SIGNATURE-----

7 9

Re: Anonymity: A Modest Proposal
by Herb Sutter 17 Dec '03

17 Dec '03

At 04:58 10.18.1995 -0700, Modemac wrote: > 1) A person writes a message and encrypts it with PGP. Using a set public key? Which would mean the remailers all share the same pub/pri key pair (or pieces thereof)? You'll have to come up with a good way of maintaining this secret, since if you're not careful it could be compromised by something as simple as an attacker's trying to attach a new remailer to the remailer group or physically attack any existing remailer. > 2) That person then posts his message to the "anonymous messages" > newsgroup. > 3) A remailer scanning the newsgroup picks up the message, > decrypts it, strips the headers and makes it anonymous, and > sends it to its destination. Not only is the anonymity of the entire traffic load compromised if the single shared private key is compromised, but even if the secret is kept the newsgroup articles' headers being posted in the clear still opens this scheme to traffic analysis (even if you put it a short random remailer delay, as you say later on; computers are very good at sifting through large volumes of data to find this kind of pattern, especially if the remailer delay's upper bound is known (you proposed two hours)). >The actual remailer code, involving scanning the newsgroup for >PGP-encrypted messages and stripping headers, could be written with >PERL scripts. This would keep it portable, and it would be easy for >a person to tell if it has been tampered with. This code would be >distributed widely. ...and if someone installs their own remailer and adds it to the group, and therefore it must get the complete shared private key at some point (of necessity, else it couldn't decrypt the messages), and then the attacker can just look at the key and decrypt all traffic...? Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

1 0

Re: Microsoft: WFW & Win95 TCP/IP is insecure, and alleged serious computer crime
by llurch＠Networking.Stanford.EDU 17 Dec '03

17 Dec '03

Posted, emailed, and archived. I probably should have talked to a lawyer first. Oh well. Followup-To poster (that means email) or spawn new threads. The FAQ is at http://www-dccs.stanford.edu/NetConsult/Win95Net/faq.html. It's getting dated; please download the new.txt link, in UNIX mbox format. The quixote list archive server has been turned off for security reasons. -----BEGIN PGP SIGNED MESSAGE----- In article <461u88$luk(a)dingo.cc.uq.oz.au> in a few newsgroups, DavidS(a)gpo.pa.uq.edu.au (David Steadson) writes: >In article <45rims$9fc(a)Networking.Stanford.EDU>, llurch(a)Networking.Stanford.EDU >says... >> >>Note that Microsoft's "in order to have this problem, there must be a >>UNIX >>computer on your network" really means "if you're connected to the >>Internet, and you're not behind a firewall that disallows all SMB traf >>fic, >>you have this problem." Some other bits are misleading as well. > >Ummm, this is new?? I knew about this security hole in MS TCP/IP months ago, >via newsgroups. Lots of things are new, and very interesting, especially for Usenet readers, because the story involves forged cancels, apparently stolen passwords, and serious computer crime. I'm so glad you asked. Unsurprising Fact: Microsoft has finally acknowledged and documented the problem, and, without fanfare, released a patch for Windows for Workgroups that claims to fix it. Fact: several people at Microsoft have been lying about the problem. In early September, paulbal(a)microsoft.com assured a gathering of Stanford computing support staff that the problem had been fixed in build 490, so I looked no further into it. For a while. Fact: On September 27, I reposted a July article from the SAMBA email list archive about the bug you know all about. I asked for confirmation on whether it had been fixed in the release version of Win95, and whether a fix was available for WFW. Supposition: Early morning September 28, my kerberos password was apparently hacked, and my .forward file was disabled on several UNIX machines, preventing me from receiving some personal and work-related email. I did not notice this problem until October 6 because I seldom log on to the machines in question. Fact: On September 28, I received several replies to my post, several saying that Microsoft had assured them that it had been fixed at some specified (often specified different) build. I also received two replies that the problem had *not* been fixed, and volunteering to reproduce the problem for me. Fact: I posted the confirmation of the bug to win95netbugs(a)lists.stanford.edu. Fact: The Windows for Workgroups security bug fix patch on Microsoft's FTP server is dated late night September 28. Fact: On October 2, Paul_Krill(a)InfoWorld.Com phoned and emailed me inquiring about the problem. He had also been assured by Microsoft sources that the problem had been fixed. I forwarded several articles his way indicating that it had not been fixed. I again searched the Microsoft Knowledge Base for any mention of "SAMBA" or "SMBCLIENT" and found none. Fact: On October 4, received an email message from henrysa(a)microsoft.com inquiring about the problem and offering to investigate for me the current status of the problem. In reply, I sent him the three email messages that are included at the bottom of this post. I have not received any sort of reply from Henry. Fact/Supposition: October 2 (?), somebody made a directory on a Stanford FTP server world-readable and world-writeable, uploaded several megabytes of "warez," and advertised the site on hacker BBSes. Since many people had access to this directory, there were no suspicions about who was responsible. My kerberos password, which I now believe was stolen, would have been sufficient to cause this problem. Fact: Late night/early morning October 14-15, in a routine browse of the Microsoft Knowledge Base, I came across articles on the SMB security bugs, which we all know about now. I posted them, with commentary rather less lurid than what you have seen from me since, when I was perturbed. Fact: The article was canceled. On this day 10/18/95, under penalty of perjury, I swear that it was not canceled by me. My PGP signature should be legally binding. Fact: I also Cc'd the article to \win95netbugs and myself via email. The email made it. NewsWatcher works such that separate Message-IDs are created for news and email, and someone reading the news post has no way of knowing whether the article was also emailed. Supposition: the canceler did not know that NewsWatcher worked this way. Fact: In the morning, I noticed the article was missing, but that earlier and later articles by me were there. I figured something must have gone wrong, so I reposted it. Fact: From 12:10 to 5PM, I was with Kevin Morris at Sacred Heart school in Atherton, building a local PhoneNET network. Obviously, I had no Internet access. While I was there, my second post of the article was canceled. Fact: Around 7PM, I noticed the second cancel, and a followup thereto from a netcom account confirming that the article had been posted and propagated, got really pissed off, and posted it a third time. I also posted to news.admin.net-abuse.misc and our local news administration group. I also Cc'd several PC and networking magazines via email, and cross-posted to a .test group so that I would have verification of the propagation of the article in hand. Fact: Today, as was the case 15 hours after it was posted, article <llurch-1510951157410001(a)tip-mp3-ncs-3.stanford.edu>, to which there was that netcom followup, is missing, presumed canceled, from the core Stanford news servers nntp and csd-newshost. It is present on the secondary news host morrow.stanford.edu, and on external sites. No one has been able to provide any explanation for this. Supposition: the canceler either screwed up or canceled the cancel or, more likely, forged a repost after seeing the netcom followup. For some reason, however, the article did not make it back onto nntp or csd-newshost. Fact: Later that night and in the morning, I received copies of the forged cancels of my messages as seen from nasa.gov, rand.org, and mcom.com. I posted them to news.admin.net-abuse.misc. Supposition: an individual or group has gone great lengths, engaging in quite a bit of highly illegal and unethical behavior, in order to cover up security and networking bugs in Microsoft products. Opinion: they have failed. In a big, big way. - -rich graves distributed computing and communication systems stanford university llurch(a)networking.stanford.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMITf34ND7LjhcPQ9AQGlsQP+KFNuOehBPLExKjJc0e/7bv8iAF29bYgi o4ioLYuwx4AKtR2hER85PWWPNBuDO+G8uqDBcDNzKZ+VxrNDWvhP9oSfTy9ry9OM p5hkcQfB/MqqeDZ5nFOXmTkI2y+EI3az1lHWBr9kQuSalpAVkXTx0/qeW9WWYVFZ cuZ8+Tf3W7o= =G/Dk -----END PGP SIGNATURE----- Unanswered letters to henrysa(a)microsoft.com:

1 0

Re: Netscape PR
by Charles Gimon 17 Dec '03

17 Dec '03

Forwarded message: > > If you wish to get an official statement from Netscape, you should > contact our PR department. Their number is 415-528-2802. > They don't have e-mail?

1 0

Re: I want to learn!
by stevenw＠iglou.com 17 Dec '03

17 Dec '03

>>From: VINCENT810(a)aol.com >>Message-Id: <951017234254_126621887(a)mail06.mail.aol.com> >>To: Cypherpunks(a)toad.com >>Subject: I want to learn! >>Sender: owner-cypherpunks(a)toad.com >>Precedence: bulk > >>Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs. > > Me Too, I'm catching on but some help would help ! ^^^^^^ Looks like this is now a proper noun, thanks to AOL. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more +1 415 390 9732 | than just a place to find pictures | of people having sex with dogs." stevenw(a)iglou.com | -- Time Magazine, 3 July 1995

2 1

ABA Draft Digital Signature Guidelines Open for Comment
by Michael Froomkin 17 Dec '03

17 Dec '03

The long-delayed ABA draft digital signature guidelines are now available for public comment. This is potentially an important document, and is worth some time for those interestested in the legal and economic effects of digital signatures. An internet version and more info can be found at: http://www.intermarket.com/ecl/digsgleg.html The comment period ends Nov 30, 1995, so don't delay. Due to the ABA's Section on Science and Technology's fear that its intellectual property will be ripped off, the document is in a strange "read-only" format, relying on the "Common Ground Mini-Viewer". The program has been designed to prevent users from printing their own copy of the document. Paper copies can be ordered from the ABA for $15 (see website for details). I would apologize on behalf of the ABA Information Security Committee for this user-unfriendly method of distributing the document (it certainly makes quoting from it in your comments difficult!), but the Chair of the Committee, Michael Baum, unilaterally removed me from the Committee a few days ago. I nonetheless urge you to read this interesting document. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's hot here. And humid.

1 0

Re: I want to learn!
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

>>From: VINCENT810(a)aol.com >>Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs. > Me Too, I'm catching on but some help would help ! > Leo_Martensen_at_~~HEID-DHS(a)ccmail.odedodea.edu Okay, places to start. Go to the cypherpunks ftp site ftp.csua.berkeley.edu/pub/cypherpunks and look around. TCMay's "Cyphernomicon" FAQ is a must, although it's really really big. It's been Weblinked somewhere, but I fail to recall. It's also been ZIPped somewhere. Buy Bruce Scheiner's (sp?) "Applied Cryptography." Actually, don't. A new Second Edition is coming out next month. Read the list, hopefully not posting lame newbie messages like "I want to learn how to be a cypherpunk!!!!" Smile.

1 0

Re: I want to learn!
by Rob.Lowry＠on-ramp.ior.com 17 Dec '03

17 Dec '03

> >>Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs. > > Me Too, I'm catching on but some help would help ! > > > Leo_Martensen_at_~~HEID-DHS(a)ccmail.odedodea.edu 1)Read the FAQ (sorry.. don't have the address for it handy.. Tim, ya got it?<g>) 2)Read up on crypto, politics and economics.. mighty dry reading for most, but damn useful around here. 3)Practice safe encryption- Use PGP or any other encryption you are comfortable with. But be sure to always use it. (Wrap that data) 4)Develope a strong urge for privacy and then strongly fight to protect it. This means you may have to write letters to Congress and the Senate, may have to defend yourself to non-crypto orientated folks, and so on.. 5)Practice what you preach, and preach what you practice. Share the knowledge with anyone who is interested.. 6)Send $10.50 to me for the genuine 'Cypherpunks Starter kit' which includes a cheat sheet of really cool Jargon, a pair of black sunglasses, and high quality laser reprints of the FAQ.. mail that to: Cypherpunk PO Box 288 Rockford, Wa 99030 <g> RobL ------------------|----------------------------------------------------------- Rob Lowry | PO Box 288 | Rockford Wa 99030 | ral(a)otc.mhs.compuserve.com robl(a)on-ramp.ior.com

1 0

Anonymity: A Modest Proposal
by John Curtis 17 Dec '03

17 Dec '03

I think that what you propose could be modeled as an anonymous remailing distributed process. If designed correctly, such a process could be made extremely difficult to shut down (even for us!) There are more than enough texts written on how to do this correctly; no need to reinvent the wheel.

1 0

Re: Postscript in Netscape
by Rob.Lowry＠on-ramp.ior.com 17 Dec '03

17 Dec '03

>> Obviously everyone should heed perry's warnings and emasculate >> their postscript interpreters before using them to view files >> of unknown origin. > >WRONG!!! Netscape claims to be "secure" - hence it is Netscape's job to >be secure - regardless of the user's use of their product. Otherwise, >the ads should read: > > "Netscape can be used securely by sufficiently knowledgeable > users who have emasculated their postscript interpreters before [SNIP] I have to disagree here.. There is such a thing as overstating the obvious. And a statement such as the one you propose is definately in that range. If the user is knowledgable about system ops that come from external apps, such as the PS interpreters, Java or whatever, then they should take appropriate security measures themselves. If they are not skilled or versed in such subjects, you can bet they will be after the first incident of 'cyber-vandalism'. Ignorance is not bliss, and you, and only you, are responsible for protecting yourself in 'cyberspace'. Heck, I can see it now: "Sex can be used by sufficiently knowledgeable users who have educated their partners before using them to attempt comply to acts of contortion, sustained physical activity, voluntary dehydration, and who have removed all other known, unknown, and/or undisclosed partners from their systems. Otherwise, sex unsafe and should not be attempted." Again, overstating the obvious... RobL ------------------|----------------------------------------------------------- Rob Lowry | PO Box 288 | Rockford Wa 99030 | ral(a)otc.mhs.compuserve.com robl(a)on-ramp.ior.com

1 0

50 attacks on Netscape - please send the check
by fc＠all.net 17 Dec '03

17 Dec '03

50 Attacks: a.k.a. Why Not to Run Hot Java in your netscape (or other) browser: Concept 1 - Hot Java code that, once started, takes and retains control of the viewer. It includes hot buttons, etc. that let you use common resources on the net, store favorite places, etc. When you push any button in this window, it simulates Hot Java within its own code, but all reads and writes contain code to restart the program (such as the "remember favorite places" button, etc.). Attack 1 - It records all entries and sends them to an unfriendly. This includes credit card numbers, etc. Attack 2 - It reroutes all traffic through a known site to record information about all of your accesses. Attack 3 - It selectively multiplies dollar values on purchases up by a factor of 10 when you authorize purchases through their store. Attack 4 - It reroutes all purchases through their intermediary and adds 20% for the service, thus becoming the middle person in all your transactions. Attack 5 - It replaces select information from select sites with false or misleading information - particularly about the competition. Attack 6 - It reports certain sites as down, thus damaging the reputation of those sites. Attack 7 - It sends requests to sites and ignores their answers to increase hit rates on key vendors that pay for their W3 sites based on usage. Attack 8 - It gets dirty pictures using your credit card information and sends it to another recipient. Attack 9 - It implements an anonymous remailer for smut, thus making you the smut capital of the network. Attack 10 - It waits till you save another Java code from the net and replaces the code with its own code and a pointer to the code you thought you got. Attack 11 - It waits till you save a file and overflows your disk with garbage. Attack 12 - It sends displays that flash on the screen at a rate that causes epilectic seizures. Attack 13 - It puts up subliminal messages to cause you to accept its subsequent request to overwrite a .com file onto your disk. Attack 14 - It analyzes your typing style to determine psychological factors and stores that information in a database. Attack 15 - It analyzes your typing style to determine psychological factors and, if you are a child, connects you to child pornography rings. Attack 16 - It sends requests for URLs to numerous addresses on your network, records results, and returns a network map to the attacker. Attack 17 - It uses spare time when you are not computing to participate in codebreaking activities, including the breaking of netscape codes. Attack 18 - It sends massive quantities of email to mailing lists creating the impression that you are not a nice person (a spammer) Attack 19 - When it recieves incoming email, it sends copies to newsgroups who now have access to all your personal incoming mail. Attack 20 - When you send outgoing email, it sends copies to newsgroups who now have access to all your personal outgoing mail. Attack 21 - When you send outbound email, it adds insulting or abusive humor to the end of your signature line. Attack 22 - It is used to send and receive email as part of a right wing group's coordination activities aimed at overthrowing the government. Attack 23 - It slowly fades your screen till you think the display is going bad, forcing you to buy a new display. Attack 24 - It slowly degrades performance causing you to think you need a faster computer. Attack 25 - It sends threatenning email to the President under your name, getting you arrested. Attack 26 - It sends embarassing email to the New York Times getting you fired. Concept 2 - Hot Java code that sends all of your messages through my computer and gets the results back from my computer by rewriting URLs on-the-fly. Attack 27 - Attack 3 from above, but with more intelligence so that amounts are changes less obviously. Attack 28 - Attack 4 from above, but it also changes the costs on incoming information so that you can't detect the price change in the process. Attack 29 - Attack 5 from above, except that it is more sophistocated - like creating misspellings or poor formatting or moving the locations in maps so that when you push on one part of a map, it sends a different part to ther server. Attack 30 - Attack 6 from above, except that instead of reporting servers down, it makes them seem very slow, or misses lines of pictures, etc. to make them look bad but without causing trouble reports. Attack 31 - Records all credit card transactions and forward information to services that pay to know what you buy. Attack 32 - Determines whether you look at dirty pictures and, if so, sends the information to criminals to use against you in shakedowns. Attack 33 - Replaces legitimate calls to children's pages with child pornography - including solicitations for where you can become a star. Attack 34 - Adds subliminal messages to sound files that cause you to enter a murderous rage (as in the claims about acid rock a few years back). Attack 35 - Adds dirty pictures to video files causing you to become sex-crazed and commit sex crimes and have bad dreams. Attack 36 - Causes simulated waviness on the screen, resulting in dizziness and increased sick time at work. Attack 37 - Introduces high frequency buzzing that irritates people and causes them to become more violent and less cooperative. Attack 38 - Introduces low frequency beating (similar to the tactics used against the Branch Dividians and in Viet Nam) to weaken your resolve and then asks you to confirm the upload of a program. Attack 39 - Creates subliminal feedback to your use of the Web to get you to tend toward particular services and away from others. Attack 40 - Adds background advertising to all your pictures. Attack 41 - Replaces the background information provided by Web sites with the attackers background advertising. Attack 42 - Shifts frequencies of sound files from select other sites so they seem off-pitch and don't reflect well on those companies. Attack 43 - Reroutes all of your Web requests through the NSA and CIA so they can do better intelligence. Attack 44 - Causes select Web sites to require User ID and Password information before use (particularly company Web sites) so as to get you to reveal your UIDs and passwords. Attack 45 - Renames Web sites so that your remembered sites only work for a few days and then the pointers appear to go away. Attack 46 - Puts a lot of really interesting things on your screen, thus making you believe that the Web is really great, and then removes them from accessibility when you try to get them again. Attack 47 - Universally replaces the work AND with OR in all Web information. Attack 48 - Randomizes all 5-digit numbers sent via the Web, thus confusing all zip codes contained in address fields. Attack 49 - Sends a series of high frequency sounds combined with screen flashes designed to cause permanent brain damage. Concept 3 - There is a chosen plaintext attack against the RSA (published in the 1980s in a Crypto conference (IACR?). Attack 50 - Use your Hot Java capability to sign selected message after message till the attacker derives your private key. I think this takes one or two messages per bit of private key. Bonus Attack (no extra charge) - If they use your PGP random number information, they get your PGP key too! Netscape: Please send your check for US$50,000 to the address below. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

6 5

Digital Signature Guidelines
by Patrick Horgan 17 Dec '03

17 Dec '03

It seems that your embedded viewer doesn't want to work on my UNIX box. It makes it quite hard to comment on your guidlines. Apparently, from the way you're presenting this you have no real desire to get any industry consensus. Perhaps you only want people that use Windows to have an oportunity to comment. Mac users and Unix users not welcome. I find the whole need to have yet another viewer annoying. Haven't you guys heard of industry standards? Annoyed, Patrick J. Horgan -- _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

2 1

Re: Anonymity: A Modest Proposal
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 6:53 AM 10/18/95, Hal wrote: >Now, since I have set it up this way, which was about two years ago, I >have not received a single complaint about operating the remailer at >alumni.caltech.edu. Nobody sends me mail saying "your system is >accepting objectionable messages." Instead, all the complaints I get are >about the Portal remailer (averaging one per week, probably). People >complain when they receive a message or newsgroup posting that they find >objectionable. They don't care if some system is accepting messages. >They care about the system which is sending them. > >This has always been the weak link in the remailer system: the last >remailer in the chain takes the political and legal heat. If there is >ever a libel or copyright infringement suit, or criminal prosecution, >against a remailer it will almost certainly be against the last remailer >in the chain. Those are the source of the complaints and those are the >ones which people try to shut down. Well, when some folks want to circumvent this kind of last-link accountability (even if they are the _only_ link), they simply forge their headers--so why not incorporate that tactic into the remailer net? Also, maybe apropos...It seems to me that there should be a way, within the remailer net, to synthesize forged-path strings with the "Human ID through insecure channel" remarks you made a few days ago. Ted

2 1

SciAm Bye-Byes Privacy
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Scientific American, November, 1995 Rights of Privacy Technology has its eyes on you Privacy, as George Orwell pointed out, rests on some level on a bargain between people and their machines. Long before 1984, communications technology had the potential to become surveillance technology. Now it is. Not, as Orwell might have predicted, because Big Brother wants to keep his subjects in thrall but simply because most people want it to be. By giving up some protective anonymity, people get safety and service. A majority seem to think the bargain a very good one -- which is why everybody should look very carefully at the fine print. Somewhat ironically for the nation that gave birth to Orwell, Britain is leading the way in creating the kind of society that he taught the world to fear. More than 300 British city streets are wired for 24-hour surveillance by closed-circuit television cameras. From control rooms, police and private security officers scan everything that moves, or doesn't, and dispatch police officers to investigate anything suspicious. More cities are getting wired all the time, often by popular demand. Whatever qualms Britons have about privacy, they are more concerned about crime. The cameras do seem to reduce crime -- at least in the areas underneath the cameras. Academics point out that surveillance seems to have no impact whatsoever on the overall level of crime, which is rising, but people just don't seem to care about where the muggers go when they leave their neighborhood -- particularly when their neighborhood wasn't too good to begin with. Safety is not the only reason to embrace surveillance. At the Olivetti Research Laboratory in Cambridge, for instance, Andy Hopper and his staff have for years worn tiny badges that inform their computers where they are each minute. The point is convenience. Computers automatically bring to the screen the work of the person sitting in front of them. Calls are forwarded to the telephone nearest wherever they happen to be -- unless the computers detect three or more badge wearers gathered in the same office, in which case they are assumed to be in a meeting, and calls are forwarded to their voice mail. To make life more convenient still, Hopper is trying even cleverer technologies. Some chairs now contain compasses that monitor whether they are pointed at a screen, and, if not, the screen is dimmed to save power. Such devices, Hopper reckons, are crucial to making computers effortlessly easy to use. As he puts it, "You can't have personalization without identification." But the search for personalization in a high-tech world may create an uncomfortable situation in the global village. Villages are safe places but not very private ones. Mrs. Grundy, peering from behind her lace curtains, did stop housebreakers. but she also tried to halt many other things of which she disapproved. There are signs that Grundyism is returning to Britain. Many of the crimes recorded by surveillance cameras are worryingly petty. Arrests for urinating in public have soared. For better and for worse, cameras that can see in the dark now line romantic walks to the beaches in seaside towns. In Britain, as elsewhere, technology and politicians are about to deepen the privacy dilemma. Cameras are being linked to smarter computers that can identify people. Some drivers receive tickets without human intervention. Video cameras check their speed and read their license plates. Along with a ticket, the owner is sent a photograph of the car and driver at the time the speeding was clocked. A number of companies are touting technology that can recognize faces by matching video images to digitized photographs (from, say, drivers' licenses). The British government, like many others, is also discussing plans for a national identity card that would, by giving everyone a number, make it easier to keep track of personal data. The selling point is convenience. Much of the work of filling out forms in bureaucratic Britain is simply to give one branch of government information that another part already has -- or to correct information that bureaucrats have got wrong. Convenient though it may be in theory, the combination of national identity schemes and surveillance cameras promises to give governments many of the powers of an all-seeing God. And there are many reasons to worry that mere humans would not be as merciful or as competent. Two aspects of surveillance will prove crucial in determining the practical terms of the new privacy bargain now being struck: choice and reciprocity. Unlike the subject of video surveillance, the wearer of one of Olivetti's badges can remove the device and disappear from the system. His electronic identity is entirely a voluntary one: if he wishes to forward all the telephone calls the old-fashioned way, by hand, there is nothing to stop him. Surveillance becomes less intrusive if it is optional. But choice cannot be a cure for all the potential ills of surveillance. As electronic personalization makes electronic identification more important, that choice becomes harder to manage. One problem is forgery. If electronic identities can be taken on and off like sweaters, the risk that fraudsters will be able to put on somebody else's identity rises. Besides, as such identification becomes more important, the sheer effort required to live anonymously will render choice moot. Anonymity will simply become too much work. Real village traditions offer hope for the lazy and the identifiable. In village life, surveillance was reciprocal: if Mrs. Grundy knew a lot about you, you also knew a lot about her -- and you knew what she knew about you. Technology should further extend this reciprocity. The badges in the Olivetti lab provide a way of locating any badge wearer. But they also allow badge wearers to track anybody who is trying to locate them. There can indeed be no personalization without identification, but there is increasingly little excuse for identification without notification. The same computers and networks that send faces, names and numbers whizzing around the world could also be required to send notification back to each of those identified, each time they have been spotted. Even as the world becomes more personalized and less private, there is no reason for the electronic global vilage to become less personable than a thatched one, or less fair. Photo caption: Video cameras will scan the crowd at the 1996 Olympic Games in Atlanta. The security system can transmit images for identification. --John Browning ---------- The issue also has a brief report by Paul Wallich on "Meta-Virus: Breaking the hardware species barrier," which reviews recently-publicized security flaws in the Net, with quotes by William Cheswick of AT&T Bell Labs on the issue and Hot Java.

1 0