December 2003 - cypherpunks-legacy

Undeliverable Message
by MAILER-DAEMON＠usmc.mil 17 Dec '03

17 Dec '03

To: <cypherpunks(a)toad.com> Cc: <remailer-operators(a)c2.org> Subject: Re: PA Remailer Concerns Message not delivered to recipients below. Press F1 for help with VNM error codes. VNM3043: CPL JASON P JONES@IRM711@MCLB Albany VNM3043 -- MAILBOX IS FULL. The message cannot be delivered because the recipient's mailbox contains the maximum number of messages, as set by the system administrator. The recipient must delete some messages before any other messages can be delivered. The default limit is 1000 messages. Administrators can set lower limits if required using the Change mailbox settings function available in the Manage User menu (MUSER). The 1000 message limit is the maximum allowed by the Mail program. If this limit is reached, the recipient must delete some of the messages before the mailbox can accept any more incoming messages. ---------------------- Original Message Follows ----------------------[I'm sending this to the cypherpunks and remailer-operators lists. Replies are directed to c'punks, just to avoid crossposting followups, but I read both lists. -Futplex] Mark writes: [re: a new Pennsylvania law] > More likely the law will be used when a remailer operator wont play ball with > the local LEA and surrender any existing logs. Then the LEA can simply throw > the operator into a court under this legislation. > > If (when?) something serious is perpetrated and planned using a remailer then > they will have the motivation to shut them down. I would very much like to see this law tested. I think it could prove fairly important to attack it with a well-planned, benign test case rather than wait for the next National Liberation spam or a death threat. I don't live in PA, but I would be willing to participate as the defendant in a test case under the right circumstances. Presumably I would open an account with an ISP in Penna., set up a remailer on the account (need to find an ISP that clearly allows that), and have somebody send a message through it. We would need to design a promising test case and find an attorney willing & able to offer pro bono services. Any comments or suggestions, esp. from legal types (who of course are not offering formal legal advice to anyone :) ? Is this realistic ? What would it take to elicit a prosecution for such a test case ? -Futplex <futplex(a)pseudonym.com>

1 0

Illegally canceled articles on Microsoft Security Bugs
by anonymous＠replay.com 17 Dec '03

17 Dec '03

(A copy of this message has also been posted to the following newsgroups: alt.security, comp.os.ms-windows.apps.misc,comp.os.ms-windows.win95.misc,alt.religion.scientology,news.admin.net-abuse.misc,comp.protocols.smb,comp.os.ms-windows.advicacy,comp.os.ms-windows.networking.tcp-ip) -----BEGIN PGP SIGNED MESSAGE----- Could somebody please tell me who illegally canceled my article <llurch-1510951157410001(a)tip-mp3-ncs-3.stanford.edu>, referenced in the followup article below, as well as several other articles I posted this morning? It was cross-posted to several groups, but I don't think it should have triggered any spam-cancelers, and I see nothing in news.admin.net-abuse.misc. I'd find the cuplrit myself, but Stanford only saves the last 100 or so messages in control. See the rather prominent blinking link on the Web page below for the other PGP-signed article that was canceled. Thanks in advance. Followups set to news.admin.net-abuse.misc. Don't bother canceling this article, my friend. By the way, the other articles were saved and emailed as well. - -rich jabba(a)deathstar.stanford.edu and other accounts moderator of a certain list http://rescomp.stanford.edu/~llurch/innocuous/faq.html PGP key available on MIT server and via finger -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIHC9oND7LjhcPQ9AQHTZgQAxGQZGTFDrzUTfyWCuLTUP2VbIp6IwK/Y NJjy7ke4rgZH+bjegb1h2ig/lALEhnX4+uhurhDJ0wq6du2p5V/DUlsNHCcWvotL GHyd/ZLzXGq6OYRoPijUHAdDBPD2wWIdAfsYNiTgv3iezBJL+2cCq/YLiPd22KyF MROQwF05Hoc= =1K2B -----END PGP SIGNATURE----- I will be charitable and assume that it was someone else I've pissed off (lord knows there's several), and not someone working directly for Microsoft or the Church [spit] of Scientology, who were both maligned in the canceled posts. In article <petrichDGID4I.5GG(a)netcom.com>, petrich(a)netcom.com (Loren Petrich) wrote: > Newsgroups: > alt.security,comp.os.ms-windows.apps.misc,comp.os.ms-windows.win95.misc > Path: > nntp.Stanford.EDU!news.Stanford.EDU!agate!howland.reston.ans.net!newsfeed.internetmci.com!news.sprintlink.net!noc.netcom.net!netcom.com!petrich > From: petrich(a)netcom.com (Loren Petrich) > Subject: Re: More Microsoft Security Bugs > Message-ID: <petrichDGID4I.5GG(a)netcom.com> > Organization: NETCOM On-line Communication Services (408 261-4700 guest) > References: <llurch-1510951157410001(a)tip-mp3-ncs-3.stanford.edu> > Date: Sun, 15 Oct 1995 21:02:42 GMT > X-Original-Newsgroups: > comp.os.ms-windows.win95.misc,alt.security,comp.os.ms-windows.apps.financial,comp.os.ms-windows.apps.utilities,comp.os.ms-windows.apps.word-proc,comp.os.ms-windows.apps.misc,alt.fan.bill-gates,comp.os.ms-windows.advocacy,alt.destroy.microsoft,comp.os.ms-windows.nt.admin.misc > Lines: 9 > Sender: petrich(a)netcom2.netcom.com > Xref: nntp.Stanford.EDU alt.security:21764 > comp.os.ms-windows.apps.misc:13757 comp.os.ms-windows.win95.misc:38436 > My favorite example of such a bug is in BOB's password protection. > If you mistype it 3 times, it will ask if you want another one. The only > defender of this "feature" has been -- get this -- JoanieDearest (at > least if memory serves me correctly). > -- > Loren Petrich Happiness is a fast Macintosh > petrich(a)netcom.com And a fast train > Visit my ftp site; its address is (in WWW syntax): > ftp://ftp.netcom.com/pub/pe/petrich

2 1

Next EFF-Austin General Meeting : Cryptography (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Japan-CIA
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Japan-CIA Tokyo (AP) -- Japan said that its relations with Washington could be seriously damaged if a report that the CIA spied on Japanese representatives at auto talks proves true. The New York Times reported Sunday that the CIA eavesdropped on conversations between Japanese negotiators and automakers during the talks in Geneva this year, reporting the results daily to U.S. Trade Representative Mickey Kantor. According to the report, Kantor was provided with summaries of conversations between Japanese bureaucrats and executives from Toyota Motor Corp. and Nissan Motor Co. Toyota called the alleged eavesdropping ``unthinkable,'' but refused to comment further.

1 0

Re: PA Remailer Concerns
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:13 AM 10/16/95, Futplex wrote: >I would very much like to see this law tested. I think it could prove fairly >important to attack it with a well-planned, benign test case rather than wait >for the next National Liberation spam or a death threat. > >I don't live in PA, but I would be willing to participate as the defendant in >a test case under the right circumstances. Presumably I would open an >account with an ISP in Penna., set up a remailer on the account (need to find >an ISP that clearly allows that), and have somebody send a message through it. > >We would need to design a promising test case and find an attorney willing & >able to offer pro bono services. I'm not a lawyer, though I hang out on the "Cyberia" list and I watched a lot of the OJ trial. :-} Seriously, it is hard to "design a promising test case" in this way. They--the Pennsylvania law enforcement authorities--don't have to take the bait. They can just do nothing, until an incident arises which provokes them. Maybe next year, maybe five years from now. Such an incident is likely to be one that they figure will make for a popular prosecution. One of the Four Horseman, probably. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

5 4

Re: Netscape question transformed
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 13 Oct 1995, Derek Atkins wrote: > > Why would a compony like Netscape jeapordise themselves by > > even letting out a beta version so hackers have time to find bugs > > before the full version is released. Don't take me wrong I have only > > been on the net fer a little over a year and Love Netscape. And If I > > knew what I was Doing I would love to help them..... > > I don't think that this can jeopardize a company... I agree. I don't think it can jeopardize the company either. After all, we're talking about a company that has a market capitalization of more than TWO BILLION US DOLLARS. Two Billion Dollars can buy a lot of talent. Even if Netscape has to spend $100 Million on this problem, that sum represents only 5% of Netscape's total market capitalization. I'm certain that Netscape has established a crisis control centre which is manned and readied. That a proper spin control program has been implemented, and that a reasonable firm like Skadden Arps has been retained. And I'm confident, that Netscape is drawing not only on its own resources but that it's drawing on those who share Netscape's interests. Even if Skadden doesn't let you past security without a seven figure retainer, I'm sure that if one of those nice boys from Morgan Stanley, ... someone with snazzy Princeton ties ... maybe one of the ones who orchestrated the Netscape IPO calls over to Skadden, Arps, Slate, Meagher & Flom, I'm sure that one of those fellows will have their call returned by any partner at Skadden. They're professional that way. > What would you > rather see? A company makes a beta release for people to attempt to > break, fixes the bugs, and then releases a better product? Or would > you rather see a company release a product, tell people it is secure, > and then get bitten by numerous holes in it? Well, I'm not sure that I'd want to make any representations or imply any warranties whatsoever. > From a PR perspective, it sounds much better to take the first tact. > Similarly, you will get a better product using the first method. > Using the second method, NOT beta-testing your product, has a greater > chance of jeopardizing a company. At least if they put out a beta, if > the press calls, they can say "this is nor our final product -- we > wanted to let people give it a try and find problems, so that we can > fix them before we start shipping". We aren't just talking about a pre-alpha (Netscape beta) product. We are speaking of something else here. We're talking not only about a problem in their NEW code, we're talking about a very big problem in the middle of their EXISTING code. A huge security hole in the code that everyone is and has been running -- from 850,000 Deutsche Telecom customers, throughout AT&T's internal organization and throughout their worldwide customers, and god only knows how many individuals in the United States and abroad. This is an extremely serious software design issue. It is equivalent to designing and then building a house and forgetting to include any plumbing, and no one really noticing, and no one really saying anything about it. And when someone like Joan Rigdon calls from the Wall Street Journal, I hope that Netscape doesn't try to snow her. She's been up and down the street ... and probably knows all about snow. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

"Corporatocracy"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:42 AM 10/16/95, Michael Froomkin wrote: >Those seeking more info on the conference will find it at: >Http://www.multicorp.com/wec. > >They are asking over $500 in registration fees, which strikes me as wildly >excessive, so I'm not advocating attendence. Excessive registration costs for conferences have long bothered me, as Michael knows first-hand. I just declined to go to the Hacker's Conference this year because the registration has risen to $400 for 2 days. That they supply a midnight buffet is hardly justification for charging $200 a day, in my opinion. (My direct comparison is to science fiction conventions, where the hotel rooms run $70 a day and overall registration--with a nice program book!--is $40 or less.) Doug Barnes informed me that the money laundering conference, for which he wrote those great trip reports, cost $1000 for two days (gulp!). His corporation picked up the tab, natch. It's pretty clear to me that things are getting out of hand. I find myself priced out of most conferences, not because I can't "afford" them, but because I find paying $400 or $600 or more for a short conference to be a poor use of my money, compared to other things (like mortgage payments, books, investments, new doodads for my computer, toys, vacations, etc.). Conferences seem to be priced to take advantage of the tax laws and to soak corporations, which can write off the conferences. (No, I find there is no way I can "write off" the various conferences I'd like to attend.) Needless to say, I'm not saying conference organizers don't have the "right" to charge these exorbitant fees. Clearly they find customers. But it's also my right to avoid these "conference taxes." --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Cardinal Wins Okay for First Online Bank
by Sameer Parekh 17 Dec '03

17 Dec '03

http://www.yahoo.com/headlines/current/business/stories/bankonline_289001.h… -- Sameer Parekh sameer(a)corp.sgi.com

1 0

Bug Bounty [noise]
by Alan Olsen 17 Dec '03

17 Dec '03

Something I noticed about the Netscape Bug Bounty that seems to not have been mentioned here... "Linux users need not apply." (Check the rules as to which versions qualify and see what I mean.) | Visualize whirled keys | alano(a)teleport.com | |"It's only half a keyserver. I had to split the | Disclaimer: | |other half with the government man." - Black Art | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

2 1

Forged cancels of posts critical of Microsoft, *apparently* through internetmci.com or nasa.gov
by Richard Charles Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- These are the forged cancels for my articles critical of Microsoft. *Many Thanks* to the person who forwarded them to me; our server expires control way too fast. Somebody did an acceptable forge on the Message-ID, but the Path is quite wrong. Can anybody help me catch this fool? I'm somewhat out of my element here. The most serious posts are available on the Web at http://www-leland.stanford.edu/~llurch/win95netbugs/IP-Security-Bug.txt.asc, and on the gopher archive at gopher://quixote.stanford.edu/1m/win95netbugs. - -rich graves networking systems stanford university llurch(a)networking.stanford.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIH0IIND7LjhcPQ9AQFojQP/UrB/Us1PK8ne1GnsFxqXXVCJpanEKciH p9wqVMfBJOTBdkYBHkuSHkdeaJfXz6QfEQYGZr6HIN/DD8A/VNOSB+dgCbBUYcOj 2/b+x+7CBfGvEsrbIVLxWl/Eua5pIcjWLLmfgYu3dCneDOqrXO9ehZSDg1JD9tTt Av6lQIxTuVM= =V+nf -----END PGP SIGNATURE----- [You always think of something after signing, don't you?] Also emailed to postmaster(a)internetmci.com and postmaster(a)news.msfc.nasa.gov. Was that right? Doesn't microsoft.com get its news feed from internetmci? OK, I'll Cc them, because I know they don't want anyone to believe that this was done by a Microsoft employee. The cancel for <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU>, only, is legitimate, and provides a very good comparison. I'm sure the forger studied it; so should we. Path: rand.org!usc!howland.reston.ans.net!swrinde!elroy.jpl.nasa.gov!sdd.hp.com! hplabs!unix.sri.com!news.Stanford.EDU!not-for-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: comp.os.ms-windows.win95.misc,comp.infosystems.www.browsers.ms-windo ws,comp.os.ms-windows.apps.winsock.misc,alt.winsock,comp.os.ms-windows.networkin g.tcp-ip,comp.protocols.tcp-ip.ibmpc Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanfo rd.EDU> Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.ED U> Date: 13 Oct 1995 15:55:40 -0700 Organization: Stanford University Lines: 1 Message-ID: <45mqpc$hn(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU> was cancelled from within trn. Path: rand.org!usc!howland.reston.ans.net!newsfeed.internetmci.com!news.msfc.nas a.gov!elroy.jpl.nasa.gov!sdd.hp.com!hplabs!unix.sri.com!news.Stanford.EDU!not-fo r-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: comp.os.ms-windows.win95.misc,comp.infosystems.www.browsers.ms-windo ws,comp.os.ms-windows.apps.winsock.misc,alt.winsock,comp.os.ms-windows.networkin g.tcp-ip,comp.protocols.tcp-ip.ibmpc Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanfo rd.EDU> Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.ED U> Date: 13 Oct 1995 15:58:14 -0700 Organization: Stanford University Lines: 1 Message-ID: <45mqu6$iu(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU> was cancelled from within trn. Path: rand.org!usc!howland.reston.ans.net!newsfeed.internetmci.com!news.msfc.nas a.gov!elroy.jpl.nasa.gov!sdd.hp.com!hplabs!unix.sri.com!news.Stanford.EDU!not-fo r-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: control,comp.protocols.tcp-ip.ibmpc,comp.os.ms-windows.networking.tc p-ip Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanfo rd.EDU> Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.ED U> Date: 13 Oct 1995 16:00:48 -0700 Organization: Stanford University, CA 94305, USA Lines: 1 Message-ID: <45mr30$kh(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU> Path: rand.org!usc!math.ohio-state.edu!uwm.edu!lll-winken.llnl.gov!fnnews.fnal.g ov!unixhub!news.Stanford.EDU!not-for-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: comp.os.ms-windows.win95.misc,comp.os.ms-windows.win95.setup,comp.os .ms-windows.apps.winsock.mail,comp.os.ms-windows.apps.winsock.misc,comp.os.ms-wi ndows.apps.winsock.news Subject: cmsg cancel <45nvip$ab6(a)nntp.Stanford.EDU> Control: cancel <45nvip$ab6(a)nntp.Stanford.EDU> Date: 14 Oct 1995 02:32:23 -0700 Organization: Stanford University Lines: 1 Message-ID: <45o038$3ip(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu <45nvip$ab6(a)nntp.Stanford.EDU> was cancelled from within trn.

1 0

RE: robo remailer RE: robo remailer
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

nobody(a)REPLAY.COM (Anonymous) wrote: > Is the remailer "robo(a)c2.org" a PGP remailer? > In the remailer-list, it is not listed as such and yet it has a > public PGP key (dated 5/7/95)? Also, is it robo or ROBO, or > doesn't the case matter? >From what I heard last week, the remailer operator's account at c2.org expired and was cancelled, thus the remailer is down. Previously, it had been a full-fledged cypherpunk-type remailer, with Type II (Mixmaster) capabilities, to boot. Such are the uncertainties of using remailers. What would have been nice, of course, would have been for Sameer (sameer(a)c2.org) or whoever runs Community Conexxion, to post a bulletin here giving everyone a few days' notice before pulling the plug on this remailer. Undoubtedly, people are still chaining through it and wondering why their messages/posts are not showing up. NOTE: People with anon reply blocks from alpha.c2.org that chained through robo need to replace them, or risk lost messages!

2 1

PGP out of RAM
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

It seems PGP has been too successful. I downloaded the entire keyring from keys.pgp.net; it's almost 9Mb of ASCII armour. However, I can't get PGP for DOS to process the files. It, understandably, gives me an Out Of Memory error. Is there any sneaky way of getting around this, barring the obvious switch to PGP for Linux? It seems PGP is constrained to the basic DOS 640Kb, or 704Kb if I remove my VGA card.

1 0

was: My chat with Goeff Greiveldinger
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

Previous post: >I've heard cracking into Equifax and TRW is considered a rite of passage in >the phreaker crowd. The security would have to *damn* tight (as in forget >it) for it to be trustworthy. And since it would probably be the big three >credit rating agencies (I forget the other one), their track record is not Here are the three credit reporting orgs plus the medical reporting org. The cost is $8 to get your report. ---------------------------------------- CBI Equifax Credit Information Services PO Box 740256 Atlanta, GA 30374 ---------------------------------------- Trans Union Consumer Relations Center 208 South Market Wichita, KS 67202 ---------------------------------------- TRW National Consumer Assistance Center PO Box 749029 Dallas, TX 75374 ---------------------------------------- Medical Information Bureau PO Box 105 Essex Station Boston MA 02112 ----------------------------------------

1 0

Weekly MixMaster list
by John A. Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here is the current type2.list/pubring.mix as it stands on vishnu.alias.net. Please note that the email addresses for mixmaster(a)spook.alias.net and wmono(a)spook.alias.net have changed. These addresses NO LONGER WORK! Please make note of the new addresses. type2.list vishnu mixmaster(a)vishnu.alias.net bb460f08811a98682def423d30852d11 2.0 spook remailer(a)valhalla.phoenix.net ca8c8679f7b1cbdcff46d780fba97673 2.0 flame remailer(a)flame.alias.net 64bbf500097b541a8ddcb2dd80373238 2.0b11 anon mixmaster(a)anon.alias.net e3ca4cc5beb9934ae6d52dd27da80332 2.0.2b secrets secret(a)secret.alias.net bc2e4251dbddfa74dfae8b274904c2be 2.0.2b wmono wmono(a)valhalla.phoenix.net f68e6add16880b60eb48a4a4330e2e36 2.0.1 mix mixmaster(a)obscura.com db91418edac3a4d7329feaee0b79c74f 2.0.1 knight mixmaster(a)aldebaran.armory.com 6bb0d89a29fd188c67b8e04516b5af33 2.0 robomix robo(a)c2.org 3d523f1fd30b5a1c57214960a00f1c4e 2.0b11 syrinx syrinx(a)c2.org 6c4e7372e84d7092e0d0e69c20d5be46 2.0b11 rebma mixer(a)rebma.mn.org e7d84921298b0aadaf8f050d145ccf03 2.0b11 replay remailer(a)replay.com e3e2b4d67314b6165ee03b0b0ae07a7f 2.0b11 hacktic remailer(a)utopia.hacktic.nl bf61835a7b3cfa59c409caeab4e8a222 2.0b11 crynwr remailer(a)crynwr.com 64c62de6b347b3050fbb6e94c649112d 2.0b11 gondolin mixmaster(a)gondolin.org 1d767b08fefa0a79d508be73e472d326 2.0.1 q q(a)c2.org c44e1cb0f0709465c21b07ac972bf973 2.0.1 Armadillo remailer(a)armadillo.com 7251877ae6fed509ebf7567715974d1b 2.0.1 pubring.mix mix mixmaster(a)obscura.com db91418edac3a4d7329feaee0b79c74f 2.0.1 - -----Begin Mix Key----- db91418edac3a4d7329feaee0b79c74f 258 AATL25WGQY5CMM0/xBjYtuN6IT75h+aBQwwKqZZc isOrqdsl8HWAzARrB0iAtcr34c2qqPBzSRNa5UE8 d3jOYu/wp9K9M5abUSRogcDl7gkPlqxc+e72SdKd 2Gdgib8VDGVLpJdaPk4uSY/pkmsYB30OaQH3W8dU PPciTvSJKAYcTQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- vishnu mixmaster(a)vishnu.alias.net bb460f08811a98682def423d30852d11 2.0b11 - -----Begin Mix Key----- bb460f08811a98682def423d30852d11 258 AAShg2h4xGHueryUFNsFBbtSGZBcj+oDImFMkOZA EQPcbeG6ReEnTnoQ8HBgwtx9isMT9hZ93lBaRY07 ygupHQRi6f+FnlQEZTKqOe+8E+WyDx+ox/1ywgt+ KGFOW+t8WRXA/loKuqD0KH4pwpe7FYE0arGbtm4J EscGM2DE3TeS3QAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- knight mixmaster(a)aldebaran.armory.com 6bb0d89a29fd188c67b8e04516b5af33 2.0 - -----Begin Mix Key----- 6bb0d89a29fd188c67b8e04516b5af33 258 AATOSyg7N2PVg9VgA8voDWglq6ESNBLqH0heB2iE NfvmR/VnyAHCb4ZBtHzvM7ZRBdXYmH/Jt490wg6O ZCbhcIceFKSsibLEH77+111isAhUbHvn0Nh9gOI7 5ngjOGDQaLQvGUbNHRXQaPAZ0rc4lv9gmChJONOJ 7sFC2J96QR4aewAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- robomix robo(a)c2.org 3d523f1fd30b5a1c57214960a00f1c4e 2.0b11 - -----Begin Mix Key----- 3d523f1fd30b5a1c57214960a00f1c4e 258 AATQ2zxiRZ5bQuNBKHEvg11R7L69Hc9ZrjTon3o3 s7fbXmuEaiym48sHoRLAttZ3ADuH1FgbuYt1DF+L Il9Yp5U9znm9MX0rS8xq1iGg7YDED/3x6OWIp7za 17+pWnYmEF+Rz6YZ2o/67ujcBfrJ/odz+SVlaGqF rWWjaG/oWdqWWwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- syrinx syrinx(a)c2.org 6c4e7372e84d7092e0d0e69c20d5be46 2.0b11 - -----Begin Mix Key----- 6c4e7372e84d7092e0d0e69c20d5be46 258 AATKhnhAIHXRCKZAi2tehJfQ9s+IsVPjEQQk5xwQ 60VXzmgkC2YirmDFeLz1feNgCMd78GkKHYK5p9WM HBkPNTDPLraJhJLNDHeHqGtqAI4BTHq/lZ/RMyOH GV/X5TaUEG69IGb2Rl8OnzNWF9fhKwH6PTE+QiQX kIcxJnVW+yYOpwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- rebma mixer(a)rebma.mn.org e7d84921298b0aadaf8f050d145ccf03 2.0b11 - -----Begin Mix Key----- e7d84921298b0aadaf8f050d145ccf03 258 AASjOGqzTLdjweTMiwirrpVNqXj/ODJVyh9pEo5i q5ERILOd1hMNKY9XLNFYM30mUR/Fkh0MnYI/ujWz OTb0rR2a31nvmaLMdaB75nTdGJwHitCmo8k2eTjL XQsXV6zKrzXGp8H8NO34DAFWJy1qVcev+6lLAWGy j/fsJJyJNtl94wAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- replay remailer(a)replay.com e3e2b4d67314b6165ee03b0b0ae07a7f 2.0b11 - -----Begin Mix Key----- e3e2b4d67314b6165ee03b0b0ae07a7f 258 AATZBfJhv+DGg4OEfQfgVnzZZpumEZHI9CES+Ux2 dBp9RBPpJnAtLpcAyCIkNjSaik0togcKhFgcR3nt XIrWclJ/uO/Z1fqW7ESLwzXozCpqnG5S/y6mUPuL yzA9bqtAGd+pvxuK/Cw2Zzx+1QGp0VtWb46KxqvC S4POHYFljkrQiQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- hacktic remailer(a)utopia.hacktic.nl bf61835a7b3cfa59c409caeab4e8a222 2.0b11 - -----Begin Mix Key----- bf61835a7b3cfa59c409caeab4e8a222 258 AATkwgy72zwwavCHn1OytNMsBYAIBnCFa2hcbZPi IN6eS4jDgFdld5DlcqqzdN6Lxv96i0Dg7ElFyAFR 5zmof3oaNqh5vbq/fTEbvFtX9EGyuqkfN6fKoAEv G7gtmkfosoIg/jnI8AL9KC/J5mGaxrWYB6XBe+v9 iI1pOSbPsDCsdQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- crynwr remailer(a)crynwr.com 64c62de6b347b3050fbb6e94c649112d 2.0b11 - -----Begin Mix Key----- 64c62de6b347b3050fbb6e94c649112d 258 AATLe0CWPSn844FCeL7FzUlf+vE2qfYBPs/8PYYm BfITjknJjD0dk7vXhX9Qc5PFgDWRHhVoIRlFT3sc Jp2UVFLOZ5zn/WiT9Wa1tZsqejDf3MRIDT/K6cHB uB/SUaxLzNfk/wG1uBTUHukdjwCyDxNLHuYA5mVz opYJhQR0Nc/ESQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- spook remailer(a)valhalla.phoenix.net ca8c8679f7b1cbdcff46d780fba97673 2.0 - -----Begin Mix Key----- ca8c8679f7b1cbdcff46d780fba97673 258 AATZXVb4yP3MGt/ZCR5FtrHPMgYNyXHBmnG8KWO0 UaT5jbMqBdRQEzOVrCN/5RXerpS8Hctbc5MrwhSr fh/byQLwLkY50zYAxWSRBpaAJgZtCnQtVTgmt9yu BDiCE2OasFnZlwsi+9t8+c5R2bS3C6UhjQsgybbF Aw7xWK3v3fPJqQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- flame remailer(a)flame.alias.net 64bbf500097b541a8ddcb2dd80373238 2.0b11 - -----Begin Mix Key----- 64bbf500097b541a8ddcb2dd80373238 258 AAS5NFs7yPSFv+WwpO26/2OS7CYJDtrhlrEasf8S jJ9P0jqWXuorDIMKT3YfvSkk2xKqAHiHrOFEqltY plIUCoXyAf/7CmNyPYdTN6xNxO74ZIsTQnNgAJT3 6a8+JL92DZJM6pYfhpSvPq7lj5X0h6Hj/oCAlqiS 31TZJkd2jenjDQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- gondolin mixmaster(a)gondolin.org 1d767b08fefa0a79d508be73e472d326 2.0.1 - -----Begin Mix Key----- 1d767b08fefa0a79d508be73e472d326 258 AATAwVkC3FI6NDi0GJvH+FBIK6MYVHvXofEoKMTc u7P1rI7yCW00JOF71k373wyepZDksw9wjZdrHZAB uyN7SICMaKPRvMA4rseZFjefzYaoFf5tO0OqFgcQ /pMOPDwYl0nHyuLJvqjpADMDtatQaN2+/T/HtcMX Q1KCcLk24jEWbQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- q q(a)c2.org c44e1cb0f0709465c21b07ac972bf973 2.0.1 - -----Begin Mix Key----- c44e1cb0f0709465c21b07ac972bf973 258 AATDBaiKBy4jPlRUIQmVvcjO/GhWLbsls+mKloml 5EScYl+3fGw04P4xVcWOSledFVxKVfNy+xTVI8pE XGXSr0cRUIa1NttzNPk/KObb5SvkeqGtWAyRiWBS G91MkWM6LbqzKPcu6gUON47wJCJCzdvgbUIeVJIT MnyBvMWJX5CKAwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- Armadillo remailer(a)armadillo.com 7251877ae6fed509ebf7567715974d1b 2.0.1 - -----Begin Mix Key----- 7251877ae6fed509ebf7567715974d1b 258 AASWRIpH97WDVCNc/kiLqvmxqwN9cAAbZFi+FIwr gCixQRTtD/SXuXd62iIqRMp3xm4c+uSnTzLijIxi fCYLacNMVeh0PXAszfFIh6CBicPq1UWt82Wu5dqw K/goNULqNDUypGQtOfOpHSQKPwAphXplKhv75OZs SjtMoEcv0CCk3wAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- secrets secret(a)secret.alias.net bc2e4251dbddfa74dfae8b274904c2be 2.0.2b - -----Begin Mix Key----- bc2e4251dbddfa74dfae8b274904c2be 258 AATBBbpmFw7omad8hpvxQiylmoi5MBXs5SivpcY6 65jnhZIiL9HvTE+Rq+30STccDsQWze0/iZthg1RL tCXYtABwkfsHOf60/aq1aOBobkquzBItvzQMG0W/ TkVinZYUTqfdytl/pfLDIQiXv7Z0t98MrLsmVopE 1NQS7sH6g9srFwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- anon mixmaster(a)anon.alias.net e3ca4cc5beb9934ae6d52dd27da80332 2.0.2b - -----Begin Mix Key----- e3ca4cc5beb9934ae6d52dd27da80332 258 AATZuNYrX4bw6A01PA00qMr7KeJsnHIq9wYoSc5P OrHUEvPUoCxmLfuhwF9eEfSkV4t9DLPIMhKXM4iL Afhv2IZKeWaA98q4NHb6E7Gg6/e6uCI1O3nmXXK8 la4ij9RneCHig5K6JlCh3MJTkuW/IEYQjMrz2/H5 RUDEwx+/HL5K0QAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- wmono wmono(a)valhalla.phoenix.net f68e6add16880b60eb48a4a4330e2e36 2.0.1 - -----Begin Mix Key----- f68e6add16880b60eb48a4a4330e2e36 258 AASe+l+eIE1GYugbIPDG87h9wIFD0KqLWrMiN0PN RBCmRwsHOu1mZDnJTPlg7RXI17+DJMkk+huGPTuA T+KilAv8WFKWmvHuOpIBwxVBMXFKHsrQYHES63t0 UMQvRCv9LXZZvmiBWKrZp5vQaSOZKYLf4v3pQw7U SsbB5geSP9fQ2wAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- John Perry - KG5RG - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by mkpgp, a Pine/PGP interface. iQEVAwUBMIJKdaghiWHnUu4JAQHNJQf/YVjJn/WFKTi5gdjtnkOy5DprQYcoiAZ3 44/d4fq34cYdghEaK2WnROXqUn+nQbd2xqDt68KdG9Y+AsyzYo0oue+ec/juevH7 CobBO/E45dR2Ey7eUBhp/cjAJcF/R+BCGPFsrvVFjZETUhRougqWP/d0w1nxyuUI Z0BPqiLEU/Zi7tTf++qK12YFHc0bBFk52jc2rjlwk4MDcra/Gihf834fZ6QB3nRT mcpKaWQB2NODXwT8VOr19Fv44EyKx+QsNMX5DREcLB/GxKZjgsSArFSGRg6AiR+k VMAwO07JSXr85/EKrbepSIWQQM19jGB7tQq6UpkLERbFQmx/yrgAwA== =jYbQ -----END PGP SIGNATURE-----

1 0

Re: [NOISE] PGP out of RAM
by Herb Sutter 17 Dec '03

17 Dec '03

At 07:35 10.16.1995 -0400, SINCLAIR DOUGLAS N wrote: >It seems PGP has been too successful. I downloaded the entire keyring >from keys.pgp.net; it's almost 9Mb of ASCII armour. However, I can't >get PGP for DOS to process the files. It, understandably, gives me an >Out Of Memory error. Is there any sneaky way of getting around this, >barring the obvious switch to PGP for Linux? It seems PGP is constrained >to the basic DOS 640Kb, or 704Kb if I remove my VGA card. Use the 32-bit DOS version; that solves most memory problems. (Caveat: I haven't tried rings that large myself, so if you're already using the 32-bit version then I'm wrong.) Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

1 0

OS$ Hackwork
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

URL: http://www.oss.net/oss/ [Condensed version of ad in Wash Post 10-16-95] Register Now For OSS '95: Fourth International Symposium Global Security & Global Competitiveness: Open Sources Solutions. 7-9 November 1995 in Washington DC ----- [Excerpt on workshops] Hacker Panel (will be repeated 9 Nov 95). Winn Schwartau, Chris Goggans, Eric Hughes, Emmanuel Goldstein on specific vulnerabilities of typical national communications and computing infrastructures, with specific suggestions for improving both defense and counter-intelligence against electronic terrorists and criminals. Invited commentary from DISA, NSA, FBI. ----- Spys, Scholars, Hackers, Competitive Intelligence Analysts, Law Enforcement Analysts, Private Investigators, Journalists, and Information Brokers Unique conference, acclaimed in the international media and respected in professional circles. Addresses open source intelligence (OSINT) strategy, policy, collection, production, and hands-on specifics. Of vital interest to all those who consider themselves experts or "knowledge workers". OSS '95 will feature 25 world-class speakers in plenary session, 25 interactive interest and training groups, and 75 carefully-screened international exhibits. Subject Area Themes [with TLA$ galore, gov and ex-s in biz] 7 Nov: Economic Competitiveness & Information Warfare 8 Nov: Military Operations Other Than War 9 Nov: Transnational & Domestic Law Enforcement This year's conference includes several half-day pre-conference workshops on 6 November [including "two hacker workshops"]: 1) an orientation on open source intelligence for first-time attendees, 2) the National Military Intelligence Association will conduct a workshop on "Defensive Information War Technology", and 3) the Operations Security Professionals Society will conduct sessions on open source counterintelligence and open source operations security measures. ---------- To register or exhibit: Voice: (703) 242-1700 / Facsimile: (703) 242-1711 <http://www.oss.net> or <oss(a)oss.net> Open Source Solutions, Inc. International Public Information Clearinghouse 11005 Langton Arms Court, Oakton, VA 22124

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33a.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp hash cut reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp. hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)valhalla.phoenix.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"gondolin"} = "<mixmaster(a)gondolin.org> cpunk mix hash latent cut ek ksub reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; $remailer{"ncognito"} = "<ncognito(a)gate.net> cpunk"; $remailer{"precip"} = "<mixmaster(a)mix.precipice.com> cpunk mix pgp hash latent cut ek reord"; $remailer{"ecafe"} = "<remail(a)ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. remailer email address history latency uptime ----------------------------------------------------------------------- replay remailer(a)replay.com +-**+*+***** 10:11 99.96% ideath remailer(a)ideath.goldenbear.com --.-------- 5:23:14 99.81% mix mixmaster(a)remail.obscura.com +--+---+ -- 1:32:40 99.24% hacktic remailer(a)utopia.hacktic.nl +-**-*** * 12:11 99.06% portal hfinney(a)shell.portal.com #-####* ** 3:14 99.02% alumni hal(a)alumni.caltech.edu -*** + +* 8:12 98.64% bsu-cs nowhere(a)bsu-cs.bsu.edu -#+#**# * 13:10 98.50% vishnu mixmaster(a)vishnu.alias.net *-+** * ** 11:44 98.49% rmadillo remailer(a)armadillo.com +-+- +++ +++ 49:21 98.47% ecafe remail(a)ecafe.org #--*-++- 12:28 98.33% penet anon(a)anon.penet.fi -- +- - -++ 2:32:53 97.85% syrinx syrinx(a)c2.org +-+ ---- --+ 1:49:27 97.81% spook remailer(a)valhalla.phoenix.net +- +*+ ** ** 27:04 97.74% wmono wmono(a)valhalla.phoenix.net *-+ ** * *** 12:20 97.69% flame remailer(a)flame.alias.net +-** + *** 29:29 95.55% gondolin mixmaster(a)gondolin.org _____.-*- 30:45:37 94.88% c2 remail(a)c2.org +-+ +++ ++ 1:13:25 94.79% extropia remail(a)extropia.wimsey.com ..------ -- 5:32:18 94.02% rahul homer(a)rahul.net # +-+*# ** 4:39 99.20% ford remailer(a)bi-node.zerberus.de --. -- 10:53:23 76.55% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

The NSA Visits Compendium
by tcmay＠got.net 17 Dec '03

17 Dec '03

* Does the NSA really visit companies planning to include crypto modules and ask them to weaken or remove the crypto modules? * How do such visits occur? * What happens if a person or company simply refuses to meet with the Men in Black and says "This is a free country--get lost!"? * What pressures are brought to bear on companies to induce them to weaken crypto, even for domestic-only use, or to remove hooks? * Is there concrete evidence of these things? We've all heard that the NSA sends representatives to software companies planning to included crypto or crypto "hooks" in software. There have been anecdotal reports of visits to many software companies. The question is: how _real_ are these reports and what are the mechanics of the visits? Are they urban legends, or real? I asked these questions at the last Bay Area Cypherpunks meeting, and got some interesting responses. In particular, I was interested in the comparison to the other report about academic papers being submitted to a review board, since the late 1970s. Whit Diffie of Sun and Matt Blaze of AT&T (or, as Matt put it, maybe BT&T or CT&T, depending) shared their experiences. They confirmed that such a panel _does_ exist, but that it is fairly ineffectual. Apparently many people publish without approval. (Anyway, I'm citing this as a parallel to what I'm looking for: direct confirmation of NSA pressure and visits.) I have volunteered to compile a compendium of reports, with or without names attached (see details below), to pin down the extent of NSA coercion or "subtle encouragement" of companies. I believe this is a valid "Cypherpunks-type project," as it is aimed at using the Net to compile a listing of experiences software developers have had. To kick things off, I'll start the list below: --- Example: Large relational data base company. NSA Actions: Visits on a regular basis by two NSA representatives ("always two"). Pressured them to drop plans for a strong domestic crypto module. Source: Personally told to me by programmer at the company, 1995-10-14. He wishes the company not to be named. Description: The NSA was concerned about plans the company had for a domestic-only 128-bit RC4 usage, and "sat on" the company's CJ request for an exportable version of their product using 40-bit DES. After hearing nothing for a long while, and pestering the NSA (or maybe the State Department), the company finally backed-down on the plans for the 128-bit RC4 use, told the NSA this, and then the government rapidly approved the 40-bit version for export. Coincidence? --- So, send me your examples. Supply as much detail as you can, including company names if possible. I'll accept "unnamed sources" if they are _primary_ sources, but no "friend of a friend told me that...," unless the details look very convincing. Use remailers if you wish. Use my public key if you wish, too, though remailers accomplish the same thing, at least for getting the details to me anonymously. My public key is: pub 1024/54E7483F 1992/11/20 Timothy C. May <tcmay(a)netcom.com> 11-20-92 Key fingerprint = 8C 79 1C 1B 6F 32 A1 D1 65 FB 5F 57 50 6D D3 28 (I don't have MacPGP integrated into Eudora Pro---perhaps the NSA paid Qualcomm a visit?--so I'm not a huge fan of getting PGP-encrypted messages unless there's a real need.) I'll be releasing reports on this on a regular basis. The next one when I've accumulated several examples. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Netscape rewards are an insult
by an402976＠anon.penet.fi 17 Dec '03

17 Dec '03

====== On Sat, 14 Oct 1995, Henry Wertz wrote: On Sat, 14 Oct 1995, Dr. Frederick B. Cohen wrote: > The idea that Netscape (like Microsoft) thinks they can get free > testing services from all over the net by real experts just by offerring > a tee shirt is down right offensive. > > I have a better idea. How about an open market in break-in > software. We crack Netscape and offer the crack code to the highest > bidder. Bids start at US$25K per hole. For the insult, Netscape has to > outbid the competition by a factor of 2 to get the details of the hole. > Here's how it works: *cut* You know, this all seems kind of greedy to me.. It used to be people would find holes for *fun* and not for profit. It's still possible to do that you know 8-). ====== It almost sounds like extortion, doesn't it? RingZero --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

[Honk] FR $ec vs US $ec
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Excerpted from: URL: http://www.oss.net/zhi/95-7-oss OSS Notices, July, 1995 France Identifies USA as "Main Adversary" The following material is so important that we have chosen to reprint it in its entirety from Intelligence Newsletter, which we continue to recommend highly. Call them at (33 1) 44 88 26 10 for a sample issue or to order your subscription. FRANCE: Ringing the Alarm Bells "For the first time in France, a boss of the country's Direction de la Surveillance du Territoire (DST) spoke in public at a seminar on the theme "Companies and Business Intelligence" that was laid on by the Institute des Hautes Etudes de Defense Nationale (IHEDN) at the French Senate on July 4. As he himself declared on the occasion, Philippe Parant agreed to speak out 'despite the special nature' of his functions in order to alert French business circles of the dangers of 'economic warfare'. To be sure, the main aim of the gathering which drew a full house was to ring the alarm bell. According to Gen. Bernard Norlain, head of IHEDN, economic warfare now forms part and parcel of 'an overall approach to defence'. IHEDN will dispense a course on business intelligence to 30 high-level trainees in the fall. "Most of those who spoke at the seminar identified the U.S. as both the main adversary in the war and the best model of how it is fought. This was especially the case of Francois David, head of French export credit guarantee agency COFACE who said the only response to the U.S. 'could be European' in scale. Elsewhere, Remy Pautrat, deputy dead of France's Secretariat General de la Defense Nationale (SGDN) paid tribute to the French president for signing a decree on April 1 that gave birth to a Comite pour la Competitivite et la Security Economique under the authority of the French Prime Minister. Pautrat said the Committee formed "the nerve center of a more ambitious system" that was currently being set up, partly in secret." FRANCE-the DST's New Defences "During the seminar cited above DST chief Philippe Parant reckoned that economic, scientific, and industrial espionage had increased considerably over the past few years. It now accounted for 60% of cases that come to the authorities' attention compared to 40% for political, diplomatic, and military spying. Methods had also changed because state-sponsored espionage had increasingly taken a back seat to a type practices by private intelligence companies, international audit firms, head-hunter concerns, as well as insurance and reinsurance companies. Parant said that effective defence against the onslaught could not come from government services alone. "If that were the case the game would be lost in advance," he declared. He suggested that as many staff as possible in big companies be made aware of business intelligence concerns. In addition he called for "genuine information-management training in engineering universities." For maximum impact, he said, such training should not be dispensed by security services but rather by specialists in each specific discipline." L'Expansion Cover Story With the above background in mind, we can now better understand the cover story in L'Expansion of 10-18 July 1995. This prestigious journal, widely regarded as the French equivalent of Forbes, Fortune, and Business Week, appears to have been manipulated by French civilian intelligence and self-promoting private sector business intelligence activities. The cover story of L'Expansion is nothing less than a call to arms for the French business community, and the opening declaration of war on the United States of America. Unfortunately, this article was very likely drafted in active cooperation with French civilian intelligence experts, and should be considered a "covert media placement". I have taken a personal interest in the article because it links me with President William Clinton, Director of Central Intelligence John Deutch, and the founder of Kroll Associates, Jules Kroll. I am honored. Sadly, the article, while identifying me as the apostle of open source intelligence, is gravely in error when it identifies me as the linch-pin for a new covert strategy to undermine the French economy, and also alleges that I have been actively discouraged from implanting myself in France by the French authorities. There are three "realities" that need to be explored here. First, there is a budget battle going on in France, and the French civilian intelligence services are doing everything they can to "hype" the threat and obtain increased manning and funding. This should not surprise us, but the apparent subversion of the previously prestigious journal L'Expansion to the desires of French civilian intelligence, is cause for concern. Second, my sources in France tell me that the larger French companies, especially those in the defense sector, do not take this threat seriously because they are much superior to U.S. companies at the business of industrial espionage. A very well-informed source has suggested to me that this cover story is the result of an alliance between French civilian intelligence (attempting to increase its budget) and General Pichot-Duclos of INTELCO, who is attempting to increase his business practice among the small businesses in France foolish enough to believe in this exaggerated threat. Finally, for the record, I wish to note that I was invited to France by Mr. Francois Leotard, the Minister of Defense, with the explicit approval of Prime Minister Balladur, in order to join Admiral Pierre Lacoste, General Jean Heinrich, and General Jeannou Lacaze in speaking to a very select group of 300 French leaders from government, industry, and the academy on 23 October 1993. We spoke about the need to reinvent intelligence and significantly increase reliance on open sources. The presentations that these distinguished flag officers and I made have been published in a book called Defence and Intelligence, available (in French) from Editions L'Harmattan, 5-7, rue de l'Ecole-Polytechnique, 7500 5 Paris. Robert D. Steele, Publisher Open sources Solutions, Inc. International Public Information Clearinghouse 11005 Langton Arms Court, Oakton, Virginia 22124-1807

1 0

Re: The NSA Visits Compendium
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

I don't know anything about uninvited visits, but I did once interview the designer of a major product about getting an export license. He said that the NSA were fairly thorough in their review of the product. The most interesting thing that he mentioned was thatthe company had to guarantee that the data would never be encrypted sequentially by two _different_ algorithms. Apparently double encryption by 40-bit RC-4 was okay, but using different algorithms was verboten. This seemed odd to me at the time and I asked him twice about it. He agreed that it was weird, but they had no problem with guaranting it. This led me to these notions: *) Maybe double or triple DES isn't that great an idea. Maybe the NSA knows some neat algorithms that can create group-like actions even if the encryption process isn't a group. *) Maybe there was a communications problem and no one knew what was being asked. *) Maybe the cryptanalysis boys never really talked that much to the folks who go around regulating export. After all, denying export licenses for small details is like telling people that certain small details can confound analysis. This is a leak of information from the NSA which doesn't seem to like these things. In general, I think communications between the NSA and the companies begin when software companies make unofficial inquiries about what is exportable. -Peter

2 1

Re: NEW Netscape RNG hole
by Phil Karlton 17 Dec '03

17 Dec '03

[I sent this to the wrong address last week. A side effect seems to that I now I have an anonymous ID.] RingZero wrote: > However, Netscape had not revealed enough information about > their RNG to allow myself or other reviewers to determine how > critical it was. If, for example, this seeding function were > called once every time a secure connection were established, > losing a handle would be a major problem. Yes. The README was not as explicit on this point as my original message. SEC_SystemInfoForRNG is indeed among the global initialization routines. > This seems like a good reason to ask for the code for > SEC_RandomUpdate(). As was stated in the README, I cannot publish that code. It's derived from (and remarkably similar to) code that Netscape has licensed. It's not ours to divulge. > You show us from what sources you gather bits, > but you don't show us how you mix them or, for that matter, > stream out "random" bits. There seems to be little point in extracting isolated lines of code out of the source to "prove" that we use the functions we claim to use. If you have familiarity with RSAREF or the BSAFE toolkit, you will be able to see how we mix and extract the "random" bits. PK -- Philip L. Karlton karlton(a)netscape.com Principal Curmudgeon http://www.netscape.com/people/karlton Netscape Communications Corporation

1 0

Re: Netscape rewards are an insult
by Jonathan Zamick 17 Dec '03

17 Dec '03

At 10:11 AM 10/16/95, RingZero wrote: >====== >On Sat, 14 Oct 1995, Henry Wertz wrote: > >On Sat, 14 Oct 1995, Dr. Frederick B. Cohen wrote: > >> The idea that Netscape (like Microsoft) thinks they can get free >> testing services from all over the net by real experts just by offerring >> a tee shirt is down right offensive. >> >> I have a better idea. How about an open market in break-in >> software. We crack Netscape and offer the crack code to the highest >> bidder. Bids start at US$25K per hole. For the insult, Netscape has to >> outbid the competition by a factor of 2 to get the details of the hole. >> Here's how it works: >*cut* > You know, this all seems kind of greedy to me.. It used to be people >would find holes for *fun* and not for profit. It's still possible to do >that you know 8-). >====== > >It almost sounds like extortion, doesn't it? I have to admit I'm a little surprised. I think there are a couple conflicting dynamics here. On the one hand, many people here see strengthening security and encryption in use as a no-holds benefit. The more that is out there, the better it is, and the more its in use, the better off things will be. On the other hand, Netscape is a hot stock company. Its ok to work for recognition, and to donate time for the betterment of the community even if it profits others. (Eventually such things come around, which is the classic value of a net reputation.) However, when sudden, large profits hinge on your work, it is harder to take the philosophical route. Its a tough thing. I can certainly see both sides. Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

1 0

Re: proposal: "security spectrum scale" (SSS)
by williams＠va.arca.com 17 Dec '03

17 Dec '03

Vlad Nuri writes: > it seems to me what is lacking in all this is a *security spectrum*. > unfortunately security experts sometimes have a tendency to equate > *any* security weakness with a catastrophic one. while this is a good > approach in general, i.e. to be as conservative as possible, in > practice there can be no doubt that some security weaknesses are far > less severe than others. Unfortunately, severity is a question of perspective. In some environments, an operating system crash could be considered catastrophic. In others, it just means reboot and continue. I'm not a policy wonk, but security is relative to what you care about. > to aid this serious problem, I propose the creation of a > UNIFIED SECURITY SPECTRUM RANKING. There already was a USSR, but I think it ultimately failed :-} For some starters, you should check out: A Taxonomy of Computer Program Security Flaws Landwehr, C.E., Bull, A.R., McDermott, J.P., and Choi, W.S. ACM Computing Surveys, Volume 26 Number 3, September 1994 Which organizes flaws according to how they enter a system, when during the lifecycle they enter, and where in the system they manifest themselves. Some additional papers are available at the NRL web site. > this would be a list of all the different types of security weaknesses > a system can have, and their LEVEL OF SEVERITY. it would attempt to > rank every type of security breach possible. then, when a new > security weakness is discovered, it could be ranked A1 or B5 or C6 > or whatever. this would be a sort of technological "richter scale" > that would allow the novice to immediately understand that a given > bug that was recently discovered (say, the recent netscape bugs) > was, say, not really as potentially severe as the Morris worm. To whom? The only way to unify security rankings is to constrain the problem by assuming an environment and intended uses for the system. It sounds like you are assuming a low assurance workstation with an internet connection which is used for non-critical home or business purposes. Ironically, the digraphs you propose look sort of like Orange Book ratings. Evaluation results, however, tell you something (not everything by a long shot) about how trustworthy a product is. Your rating seems to indicate the exact opposite. How about a B2 product with a G3 flaw? I believe that that flaw rating is *exactly* the same problem as product security rating. But that's a different discussion. > however, if we do this, I hope that a good scale that is pretty general > and doesn't need extensions can be done from the start, before its widespread > usage, so that later changes do not confuse users. there is already > confusion in the media about two slightly different richter scales, this > is a pity. Any flaw rating system needs to consider how it will deal with advancing protection technology. For example, susceptability to viruses is much less critical than it would be if there were no anti-virus software available. Similarly, having a microkernel operating system makes me less susceptable to crashes. Should a flaw rating decrease as technology adapts to deal with it? Also, how do you rate situations where flaws are combined to mount an attack? For example, I crack a weak password to get a guest account. Then I snag an unprotected password file and crack it to get root. Then I leave an undetected trapdoor to get back in later. --Jeff Williams <mailto:williams@arca.com>

2 1

Let's refocus... (was Re: Netscape rewards are an insult)
by William McVey - wam 17 Dec '03

17 Dec '03

Jonathan Zamick wrote: > >On the one hand, many people here see strengthening security and encryption >in use as a no-holds benefit. The more that is out there, the better it is, >and the more its in use, the better off things will be. > >On the other hand, Netscape is a hot stock company. Its ok to work for >recognition, and to donate time for the betterment of the community even if >it profits others. (Eventually such things come around, which is the >classic value of a net reputation.) However, when sudden, large profits >hinge on your work, it is harder to take the philosophical route. As a (partial) solution to this problem, how about if rather than continuing to poke holes at netscape, we start an effort to bring one of the free Web Browsers, say Mosaic or Athena into line so it can be used instead of Netscape to perform secure transactions. This way our efforts are still oriented toward better personal encryption and better transaction security, but our work doesn't so directly benefit a for-profit company (something I have very little interest in doing without being employed by that company.) Personally, I see one of the cypherpunk's main objectives is to increase the security and privacy of people using computers and networks. I think this effort would further that goal. Sure, Mosaic may not have 75% of the market share on Web browsers, but that's probably because it is missing some basic functionality like encryption. -- William

1 0