December 2003 - cypherpunks-legacy

Re: PGP timeline FAQ... comments requested
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Fri, 22 Dec 95 13:37:35 GMT, you wrote: [..] Great job. A couple of suggestions... Version histories, with differences in each version. Also good to debunk the "PGP before version x isn't safe to use" myth. Might also want to throw in info about PGP hacks (mainly outside US), development of other software like SecureDrive, SFS, HPack (an archiver that uses PGP keys for digital signatures of files or encryption), development of anonymous remailers that use PGP, and even something about planned future developments (PGP 3.0, PGPPhone, etc...) >Long live the Pretty Good revolution, >Adam Back <aba(a)dcs.ex.ac.uk> Merry solstice, --Mutant Rob

1 0

[Rant] Flame threads
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Well, this is getting real unpleasant... So far we have at least three distinct flame threads going on and all of them are being pretty fucking pointless. I am gpoing to address a few issues concerning this just to get them off my chest and then I am going to drop the issue. Alice and the Net Scrooge thread: I agree that Netscape owes a bit more to people who help them out, but some of your statements come from so far into left field that they are suffering from lack of oxygen. Where does AT&T come into the break of SSL and Netscape? AT&T may licence Netscape, but they do not own it. As a licence, I cannot see how they would bear any financial responsibility for fixes, breaks or other security breaches. The only reason I can see for the anger directed against them is because they are a big company. Still, your arguments do not follow. As for Netscape... They have been trying pretty damn hard to clean up their act. They are actually FIXING bugs that are being reported and not just forwarding them to Dave Null. This is an incredible improvement over past versions. I think the IPO has had a positive effect becuase now they have to act like a real company and have real quality control. This is a good thing! Hopefully they will keep up the good work on bug fixes. (We will see if they have yet fixed the HP4 print header bug in 2.0b4 though...) The Anti-Jeff/Matt/AT&T/Netscape thread: People are not a wholly owned subsidiary of their company. I judge people by their actions and not who they work for. Jeff Weinstien has worked pretty hard to get things done right within Netscape. That is not an easy feat. (I know this from experience.) He may sound defensive at times, but who would not after some of the shit he has to take from idiots who have no clue as to what it takes to get things done in a corporate environment. So far he seems to be doing a pretty damn good job for Netscape and the crypto community at large. As for Matt Blaze. He has done more for the crypto community as a whole that most anyone I can name. His accomplisments are pretty impresive. Anyone who can break Clipper and describe the break in just eight pages deseves a bit more credit than the anon-twits give him credit for. (Plus CFS and the various other crypto code he maintains and distributes.) So far the attacks on Jeff and Matt as being somehow corrupt seem more to weaken any efforts this list has and not to help them. Fred Cohen: You have no respect for the freedom or opinions of others. You expect the net to operate under your terms and under your rules. You want people to be "responsible". From what I have read here that seems to mean "punishable". I do not like some of flames I have seen, but I do not threated legal action against them. You have. I have meet the keeper of the list. He is a very nice guy and i would not want to see him go through hardship because of some whacko with a faschist control complex. Fred -- Go somewhere else. I suggest you get together with Dan Gannon and his ilk. I think you will find him more to your liking. (Or maybe the $cientologists. They are into sueing anyone who disagrees with them. I am sure they will help you start a list with your control fetishes in mind. Maybe you can borrow a few of their lawyers.) BTW, Fred has been killfiled on my mailreader. I am sick of listening to the twit. To understand what an honor this is... He is the only person I have killfiled on this or any mailinglist. Sorry to inject this much noise to the list. I am pretty damn hot over the amount of shit I have waded through in the last few days. The legal threats from Fred were the final straw. If toad.com ever needs financial support fighting legal battles from twits such as Fred, they will have my support! I know Perry will find all of this off topic. It probibly is... It just needed to be said due to my own peace of mind. Back to the regular scheduled flamethrowing... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMN4ToeQCP3v30CeZAQFQHQf/U7xnRgq+J50EbEE2qXyPTDjKxq3O1Px1 kY2TtVfSCa5202PL8n7PrMDq9OSvz+IlK1/jmGR8vwncbUerWbZCht23rzK5Kxfn FnCMPZg0/dCSg/2wsh4O71VU759Gs7lv7cPW2PX2Cjv2RhQ5dqixjui1Tai6DHvG MSUREvyZf113DJEpWp9GzIARaZVoUK74YgKHnQxjZjYtTI7AqMs+45bf9DyBwYkc HugoHdsJJ4YuAoozSfuejIkPqlxLY9FDc+4jZBpf6VUr7NpAhYEhrg4VdeENe293 Vd5rJZb0295rDeqIz16hOkoTlQ7vSIglttXufzFNjQVcqaV8YJPSQw== =QObR -----END PGP SIGNATURE----- | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

2 1

Only accepting e-mail from known parties
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

owner-cypherpunks(a)toad.com writes: > Eric Murray wrote: > > | Where we're headed is mail filters with PGP imbedded (PGP 3 will > | make this much easier) that check incoming mail for a valid signature > | for certain PGP keyid/fingerprints and pass that mail along. > | Other mail that doesn't match gets tossed into a 'junk' folder > | or thrown away if you really don't want to talk to anyone that you > | don't already know. > > I agree with the assesment of where we may be going, but the > technology is available now. (Marshall Rose uses it; if you want to > get mail into his private mailbox, offer him some $ via imbedded FV > authorizations in the mail, and it goes into his inbox. If he thinks > it was worth his time, he doesn't charge you.) > > Anyway, the code is defeintely available now. The back end is a > little kludgy, but it was needed for an auto ley retreival script. > This could easily be hacked to include a +pubring=$people line. The > script gives you a keyid, which you can then use to filter on, ie: <shell script> This is much better than nothing. This would stop the e-mail being sent to everyone who's ever posted to Usenet. I see a couple of attacks: 1. Alice only accepts signed e-mail from Bob. Carol receives a signed e-mail from Bob to Carol, sends 10,000 e-mails to Alice (via sendmail) with From: bob, same body+signature, possibly varying message-ids and subjects. 2. Alice only accepts signed e-mail from Bob. Carol, a rogue sysadmin, intercepts an e-mail from Bob to Alice, sends 10,000 more copies of it to Alice (via sendmail) with From: bob, possibly varying message-ids and subjects. As I keep pointing out, pgp-signing the body is not enough. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

5 8

ROS_pig
by John Young 17 Dec '03

17 Dec '03

12-25-95. NYPaper: "Fear Of Freedom: The urge to censor persists." Anthony Lewis column. The very essence of the on-line world is freedom. The effect of the "indecent" prohibition of the telecom bill will be to reduce all users of cyberspace to the level of children. That is exactly what Justice Felix Frankfurter found unconstitutional writing for the Supreme Court in 1957, about a Michigan law that banned sales to anyone of material unsuitable for children. "Surely," he wrote, "this is to burn the house to roast the pig." "Coming Soon to Computers Everywhere, a World's Fair." John Markoff. In an era when the Internet has become synonymous with commercialism and instant fortunes, Carl Malamud's commitment to public service has set him apart. Mr. Malamud maintains that there are still two ways to build the Internet. One is the high-stakes high-visibility route of initial public offerings in the stock market, the money-raising approach being pursued by people like Netscape Communication's founders, Jim Clark and Mark Andreeson. The other route, Mr. Malamud maintains, is by soliciting funds and building viable public works projects that benefit the common good. 2 in 1: ROS_pig (13k)

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33a.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub ek"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash latent ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp. hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)valhalla.phoenix.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut"; $remailer{"shinobi"} = "<remailer(a)shinobi.alias.net> cpunk mix hash latent cut ek reord"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ek ksub"; $remailer{"gondolin"} = "<mix(a)remail.gondolin.org> cpunk mix pgp hash latent cut ek reord"; $remailer{"tjava"} = "<remailer(a)tjava.com> cpunk mix pgp hash latent cut"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'gondonym'} = '<alias(a)nym.gondolin.org> alpha pgp'; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 robo hroller alpha) (gondolin gondonym) (flame hacktic replay) (alumni portal) (vishnu spook wmono) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: all of the "ek" tags have been verified correct. Apologies to those who were inconvenienced by incorrect "ek" tags in the past. Last update: Mon 25 Dec 95 6:45:54 PST remailer email address history latency uptime ----------------------------------------------------------------------- hacktic remailer(a)utopia.hacktic.nl ***+*+****** 7:48 99.98% c2 remail(a)c2.org -+++++++.-++ 1:29:45 99.96% replay remailer(a)replay.com ******+***** 9:47 99.95% portal hfinney(a)shell.portal.com .#**+####### 11:36 99.94% bsu-cs nowhere(a)bsu-cs.bsu.edu #*#-####*#+# 12:47 99.91% rmadillo remailer(a)armadillo.com ++ +++++++++ 39:31 99.89% shinobi remailer(a)shinobi.alias.net ++--_.--++++ 4:25:47 99.88% alumni hal(a)alumni.caltech.edu -+*++##+###* 15:14 99.86% ford remailer(a)bi-node.zerberus.de .-+++++-+-++ 4:08:57 99.85% flame remailer(a)flame.alias.net ***+**++.-- 5:58:46 99.75% hroller hroller(a)c2.org -##+####.-## 47:58 99.75% spook remailer(a)valhalla.phoenix.net * *+* **.--+ 3:44:23 99.69% vishnu mixmaster(a)vishnu.alias.net #*++*** --- 1:19:08 99.68% tjava remailer(a)tjava.com # :23 99.48% mix mixmaster(a)remail.obscura.com +-+++____.- 20:55:03 99.27% extropia remail(a)extropia.wimsey.com -.-.-----. 14:54:08 99.16% wmono wmono(a)valhalla.phoenix.net * *+* * ** 13:17 98.94% amnesia amnesia(a)chardos.connix.com ----- --++- 3:09:50 98.65% penet anon(a)anon.penet.fi _....-.--- * 13:40:31 98.35% gondolin mix(a)remail.gondolin.org --____.-*+ 18:46:33 96.41% rahul homer(a)rahul.net *#++***-+##* 21:00 99.97% ecafe cpunk(a)remail.ecafe.org -####**-# 27:03 65.05% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

New release (v1.3.2) of CFS encrypting file system available
by Matt Blaze 17 Dec '03

17 Dec '03

[Perhaps this isn't the best time for me to post this here; apologies in advance if this sparks another flame fest. -matt] Source code for the latest version (release 1.3.2) of CFS, the Cryptographic File System, is now available upon request for research and experimental use in the US and Canada. CFS pushes encryption services into the Unix(tm) file system. It supports secure storage at the system level through a standard Unix file system interface to encrypted files. Users associate a cryptographic key with the directories they wish to protect. Files in these directories (as well as their pathname components) are transparently encrypted and decrypted with the specified key without further user intervention; cleartext is never stored on a disk or sent to a remote file server. CFS employs a novel combination of DES stream and codebook cipher modes to provide high security with good performance on a modern workstation. CFS can use any available file system for its underlying storage without modification, including remote file servers such as NFS. System management functions, such as file backup, work in a normal manner and without knowledge of the key. CFS runs under SunOS and several other BSD-derived systems with NFS. It is implemented entirely at user level, as a local NFS server running on the client machine's "loopback" interface. It consists of about 5000 lines of code and supporting documentation. You must have "root" access to install CFS. CFS was first mentioned at the work-in-progress session at the Winter '93 USENIX Conference and was more fully detailed in: Matt Blaze. "A Cryptographic File System for Unix", Proc. 1st ACM Conference on Computer and Communications Security, Fairfax, VA, November 1993. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfs.ps.) and in Matt Blaze. "Key Management in an Encrypting File System", Proc. Summer '94 USENIX Tech. Conference, Boston, MA, June 1994. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfskey.ps.) Version 1.3 of CFS also includes ESM, the Encrypting Session Manager. ESM provides shell-to-shell encrypted sessions across insecure links and requires no OS or network support. It is useful for typing cfs passphrases when logged in over the network. ESM needs RSAREF 2.0 to compile and is tested only on SunOS and BSDI. ESM is the first released part of a suite of session encryption tools that are described in Matt Blaze and Steve Bellovin. "Session-layer Encryption." Proc. 1995 USENIX Security Workshop, Salt Lake City, June 1995. (PostScript is available from ftp://research.att.com/dist/mab/sesscrypt.ps) The new version of CFS differs from the version described in the papers in a few ways: * The DES-based encryption scheme has been strengthened, and now provides greater security but with the online latency of only single-DES. * Support for the smartcard-based key management system is not included and a few of the tools are not included. * An impoved key management scheme now allows chaning the passphrase associated with a directory. * The performance has been improved. * The security of the system against certain non-cryptanalytic attacks has been improved somewhat. * User-contributed ports to a number of additional platforms. * Hooks for adding new ciphers. * 3-DES, MacGuffin, and SAFER-SK128 encryption options. * Timeout options allow automatic detach of encrypted directories after a set time or period of inactivity. CFS is distributed as a research prototype; it is COMPLETELY UNSUPPORTED software. No warranty of any kind is provided. We will not be responsible if the system deletes all your files and emails the cleartext directly to the NSA or your mother. Also, we do not have the resources to port the software to other platforms, although you are welcome to do this yourself. The software was developed under SunOS and BSDI, and there are also unsupported user-contributed ports available for AIX, HP/UX, Irix, Linux, Solaris and Ultrix. We really can't promise to provide any technical support at all, beyond the source code itself. We also maintain a mailing list for CFS users and developers; subscription information is included with the source code. Because of export restrictions on cryptographic software, we are only able to make the software available within the US and Canada to US and Canadian citizens and permanent residents. Unfortunately, we cannot make it available for general anonymous ftp or other uncontrolled access, nor can we allow others to do so. Sorry. Legal stuff from the README file: * Copyright (c) 1992, 1993, 1994, 1995 by AT&T. * Permission to use, copy, and modify this software without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software and in all copies of the supporting * documentation for such software. * * This software is subject to United States export controls. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. If you would like a copy of the CFS source code, please read to the end of this message and then send email to: cfs(a)research.att.com DO NOT REPLY DIRECTLY TO THIS MESSAGE. You must include a statement that you are in the US or Canada, are a citizen or legal permanent resident of the US or Canada, and have read and understand the license conditions stated above. Be sure to include an email address in a US- or Canada-registered domain. The code will be sent to you via email in a "shar" shell archive (a little over 300K bytes long).

1 0

Re: corporate bashing
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Fred seems to have been slipping through my filters in recent days. Though I usually trash any message containing a reference to him, I thought that this latest escalation into the ionosphere of net-sillies begs to be brought to heel... On 24 Dec 95 at 17:20, Fred Cohen wrote: > and that anonymity should be used as an escape from > responsibility for what they do and say. If you want to > remain free to speak your mind, you have to become > responsible in at least two ways: > > 1 - You must top slandering people. > 2 - You must stop using anonymity as a way to avoid being > responsible. > > When I say must, I am not intending to mean anything less. > If the cypherpunks continue to do these two things, they will > rapidly find that they are doing more to destroy all of our > rights to free speech in the Internet than they ever did to > encourage freedom of expression. There are several things wrong with this, but first, just on the surface: Fred has now dropped his cyberdrawers and stands before us displaying the ugly engine of his manhood, the handle by which he maintains a grip on his pointless existence. He reveals himself to be yet another in that small, tired parade of self-appointed lightning rods -- people with so little of import in their lives that they have to resort to trolling for what they can claim are offenses against them, then flex the borrowed, imagined musculature of mindless law to rise in self-righteous threats of exercise of vindictive wrath. This is worse than "My big brother will kick your ass!" It is like a 90-pound weakling going to the beach with a large but retarded cousin in tow. The idea is to troll to get sand kicked in his face, then to point to the drooling cousin and use him as a lever to gain and exercise control over the hapless dupes of the ruse. Freds have existed on BBS's, and before the technological age in most small clubs and societies. In the Internet they show up in newsgroups and on mailing lists, and when crossed they ALWAYS descend to threats of legal action. So predictable, so utterly dull and unimaginative, they are like the party guest who has that inappropriate laugh, who doesn't seem to notice that pairs of people are together, who approaches people oddly and, in the end, makes a scene and reveals himself to be a complete fruitcake. Unmoderated fission looking for a place to fulminate. Fred, you've come to the wrong place. If you want to be ignored, just pack your terminal and stay home with the sitcoms. Noone asked you to interject your trolls and threats here. You invited yourself, and whatever you are suffering is of your own creation. Speaking of Freds brings me to a more interesting aspect of this nonsense: How do we know there is only one Fred? Fred doesn't sign his messages... oh-oh. This attack of deja vu feels like I've had it before. Why do I get the feeling that Fred is about to embarrass himself terribly by blurting out some of the poison that fills his soul? Let him who hath not slandered cast the first suit. We Jurgar Din (that will have to suffice: I do not yet live in a free country) +"The battle, Sir, is not to the strong alone. It is to the+ +vigilant, the active, the brave. Besides, Sir, we have no + +election. If we were base enough to desire it, it is now + +too late to retire from the contest." -Patrick Henry 1775 + -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMN8TVEjw99YhtpnhAQFDngH/cTzEDHzxYZ7Z9jOmoALxaIdxpgpvlIr+ /zsZndz1KfQlqUunH5i7YsJS7tm/XOsrRcWQgKQEr9WaI8wRgrqh5g== =Hl/v -----END PGP SIGNATURE-----

3 2

Re: Bidzos on C-Span 2
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 5:41 PM 12/25/95, John Young wrote: >If you care, Jim is smoothly hawking a beautiful world of >easy-going crypto on C-Span 2, at least in NYC at 5:35 PM. Actually, he did a pretty good job of towing the er, party line. Lots of good opportunities for analogical heavy lifting in arguments with statists. "Suppose you had a very strong door which protected your whole house and made it inviolate. Suppose then the government then wanted to have copy of your door keys on the off-chance you turn into a crack dealer someday...", etc. Except for the fact that he wants Uncle to protect his patents, that is... ;-). This was done on December 8 at the Commonwealth Club in SFO. Were there c'punks there? The questions sounded like it... He also said something about some kind of magic badge with biometric/PK software which would allow you to work anywhere there was a network connection. Reminiscent of our discussions about Xerox PARC's ubiquitous computing stuff, Gerry O'Neil's 2081, etc. I feel a rant coming on about this "information toaster" stuff, Metcalfe's fight with Alsop in Infoworld, etc. Guess I'll start it tomorrow. Take cover everybody... Merry Christmas! Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/ >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Only accepting e-mail from known parties
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

How about one-time electronic stamps. I generate a large-ish number of long-ish random numbers. I store these into a data base on my system. I send one e-stamp to all of the people I want to communicate with and vice versa. Each person uses the e-stamp in the header or some other area of their message to me easily accessible to my mail bot. My bot reads the e-stamp and then checks the data base to see if the stamp is valid. If not, then /dev/null. If so, then: a) send the message to me; b) delete the used e-stamp from the data base; c) send a confirmation of received message with a new e-stamp in it. Thoughts? (I see one problem with this but it should be able to be worked out once the basic method is agreed to). --tallpaul

4 4

Re: bashing (fwd)
by Daniel Miskell 17 Dec '03

17 Dec '03

Allan, shut the hell up. This thread is truely unnecessary, can we just let it die? Munster --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________

1 0

Re: Only accepting e-mail from known parties
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Dec 25, 1995 14:53:19, 'Adam Shostack <adam(a)lighthouse.homeport.org>' wrote: > The basic problem is that (personal) spam is a social, not a >technical problem. If someone wants to annoy you via the internet, >they can do so. You can raise the cost of their annoying you, but you >need to be careful not to make it difficult to talk to you. > I agree in many ways. On a personal level, I am far more interested in the *social* are of this form of privacy. It is more a problem of the data-hermit than privacy. And in a society increasingly generating narcissistists, I see the problem getting worse. Negroponte of the MIT Media Lab can sing the praises of the personal e-newspaper with personal filters to cut out everything uninteresting while culling the world new feeds for desired information. I see this feeding into the narcissitism problem. E.G. Imagine two people who "feel" that members of the other gender are "only interested in one thing." Each wakes up in the morning and looks at their personal e-paper. She reads nothing of particularly nasty rapes, serial rapists at large, rapists who have been convicted, and rapists who an uncaring pro-male system has let out to rape again (i.e. been found not guilty). He reads nothing of particularly nasty robberies of men by women, serial robberies by prostitutes, female robbers who have been convicted, and robbers who an uncaring pro-female system has let out to rob again. Both believe that their custom filtered feeds are the *real* events going on in the world and are far more accurate than any non-customized news feed. I hope nobody takes this as a generic attack on the privacy issues that the list is devoted to. I am a great supporter of privacy and pro-privacy tek. But I see myself as a realist on privacy issues, not as a privacy-utopian or a privacy-dystopian. We live in a post-Faustian world. It is divided into two groups of people. First are those who understand the post-Faustian character and devote themselves to getting used to it and even having fun with the new opportunities while understanding that the new world also generates new problems (like furthering data-narcicism). Second are those classic-reactionary forces (from all parts of the political spectrum) who whine about how the post-Faustian world is personally unfair to them and how everybody in the world has a personal obligation to them to move the world back to its pre-Faustian origins. --tallpaul PS to Tim May: I understand your posts on material that is off-topic. I usually agree with your posts. But I see the issues I discussed above as far more on topic (even if highly mediated) than, say, the ongoing discourse on the differences between an Army Captain and a Navy Captain.

1 0

Encryption Discrimination from Sun
by mpd＠netcom.com 17 Dec '03

17 Dec '03

I was just browsing through the rules for the million dollar contest just announced by Sun Microsystems to encourage the writing of killer applets in Java, Sun's new architecture- independent program format. The URL is http://javacontest.sun.com/rules/index.html in case anyone is interested. While reading the contest rules, I found the following one particularly interesting... "No entries may include encryption as a feature or part of an applet." This was made even more curious by the later revelation that one of the criteria for judging entries was... "The applet should be able to transfer information from one point to another, with no possibility of interception or other interference during the process." Doubtless the reason Sun nixed encryption is because this is an international contest, and they did not want to deal with legal hassles involving international borders and different laws in every country. Nonetheless, they seem to have missed an excellent opportunity to encourage the migration of privacy software into the new realm they are creating. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

2 1

Bidzos on C-Span 2
by John Young 17 Dec '03

17 Dec '03

If you care, Jim is smoothly hawking a beautiful world of easy-going crypto on C-Span 2, at least in NYC at 5:35 PM. At a session in San Francisco, probably a recording. Jingle jangle.

1 0

Bidzos Coda
by John Young 17 Dec '03

17 Dec '03

The Bidzos show was recorded 12/8/95 at the Commonwealth Club in SF. It finished here at about 5:45 PM. Only caught a piece. Jim was answering written questions about a range of crypto and Internet security issues from the audience. Among other things, he says they're working on an encryption program "closely tied to the OS of portables, to protect the data if the machine is lost or stolen." He also said, "don't throw tomatoes," but they're doing something with "private key escrow" for those who want to provide access to their encrypted material in case of death or other emergency. Maybe some other idle sinner saw more, or was at the realtime tomato-chucker.

1 0

(cpx) Re: Bidzos on C-Span 2
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 5:41 PM 12/25/95, John Young wrote: >If you care, Jim is smoothly hawking a beautiful world of >easy-going crypto on C-Span 2, at least in NYC at 5:35 PM. Actually, he did a pretty good job of towing the er, party line. Lots of good opportunities for analogical heavy lifting in arguments with statists. "Suppose you had a very strong door which protected your whole house and made it inviolate. Suppose then the government then wanted to have copy of your door keys on the off-chance you turn into a crack dealer someday...", etc. Except for the fact that he wants Uncle to protect his patents, that is... ;-). This was done on December 8 at the Commonwealth Club in SFO. Were there c'punks there? The questions sounded like it... He also said something about some kind of magic badge with biometric/PK software which would allow you to work anywhere there was a network connection. Reminiscent of our discussions about Xerox PARC's ubiquitous computing stuff, Gerry O'Neil's 2081, etc. I feel a rant coming on about this "information toaster" stuff, Metcalfe's fight with Alsop in Infoworld, etc. Guess I'll start it tomorrow. Take cover everybody... Merry Christmas! Cheers, Bob -------------------------------------------------- The e$ lists are brought to you by: Making Commerce Convenient (tm) - Oki Advanced Products - Marlboro, MA Value-Checker(tm) smart card reader= http://www.oki.com/products/vc.html Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk See your name here! Be a charter sponsor for e$pam, e$, and Ne$ws! e-mail rah(a)shipwright.com for details... -------------------------------------------------

1 0

Re: (cpx) Re: Bidzos on C-Span 2
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Oops. You can shoot me now... Sorry, folks! e$pam first and let god sort 'em out. Fixing that little problem this week, as a matter of fact. Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/ >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: New Release of CFS
by dxm＠alpha.c2.org 17 Dec '03

17 Dec '03

Matt Blaze writes: > [Perhaps this isn't the best time for me to post this here; apologies > in advance if this sparks another flame fest. -matt] > > Source code for the latest version (release 1.3.2) of CFS, the Cryptographic > File System, is now available upon request for research and experimental > use in the US and Canada. Dear Mr. Blaze: As you seem to have noticed, a few subscribers to cypherpunks are more interested in exploring their own personal psychopathologies than in the creation and spread of strong cryptography. Please do not feel that you need to apologize for their actions, and especially please do not restrict your actions and/or posts because of them. To correct merely one of the many mis-statements made by these people desperate to draw attention to themselves, the Linux community is NOT interested in 'out-of-the-box'. If we were interested in 'out-of-the- box', we would be running OSs that COME in a box. What we ARE interested in is source (or, if source isn't available, at least 128 bit keys). If you provide source, we'll port it. It's that simple. While support is nice, and appreciated, it is NOT NEEDED. We can take care of ourselves. So, on behalf of the Linux community and those of us running CFS, thank you very much for your contribution. And please don't let a couple of idiots like these lower your opinion of the over 1 million Linux users who appreciate your efforts and support. -- Deus Ex Machina dxm(a)alpha.c2.org

1 0

Assault presses with cop killer computers.
by James A. Donald 17 Dec '03

17 Dec '03

While channel surfing around 6PM today on Christmas day, I saw President Clinton announce the grave international threat posed by terrorists, drug dealers and money launderers wielding computers (Only three horsemen -- he left out child pornographers.) He was immediately followed by an Expert In Television Expertise, who told us that computers were getting more and more powerful, and doing more and more things, and that Something Must Be Done. The Expert did not actually use the phrase "The first Amendment was never intended to protect modern assault presses using cop killer computers", but that was the message. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

HRB Systems Data Storage Encryptor
by nobody＠flame.alias.net 17 Dec '03

17 Dec '03

Check out http://www.hrb.com/encryption/ssp.html, your exclusive source of the Ultron Crypto-Engine (tm)

1 0

Re: New release (v.1.3.2) of CFS Unix encrypting file system available
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

>Source code for the latest version (release 1.3.2) of CFS, the Cryptographic >File System, is now available upon request for research and experimental >use in the US and Canada. Does anyone know if this code has made it across the pond yet? If so please post the ftp location to sci.crypt or comp.os.linux.misc. I don't read this list. Thanx.

1 0

Re: Assault presses with cop killer computers.
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Dec 25, 1995 23:36:00, 'Kevin L Prigge <Kevin.L.Prigge-2(a)cis.umn.edu>' wrote: >According to rumor, James A. Donald said: >> >> While channel surfing around 6PM today on Christmas day, I saw >> President Clinton announce the grave international threat >> posed by terrorists, drug dealers and money launderers wielding >> computers (Only three horsemen -- he left out child pornographers.) > >Probably because child pornographers have been dealt with in >the recent bill signed by Bill, which mandates 24-30 months >for transmitting child porn, double if a computer is used. > see Reuters, "Clinton acts to tougher penalties" 23 Dec 95 08:40 clari.news.crime.sex Message-ID: <Rclinton-pornographyURN-1_5DN(a)clari.net> see AP, "Clinton signs porn bill," 23 Dec 95 09:40 clari.news.crime.sex Message-ID: <Aclinton-pornoURCBj_5DN(a)clari.net> What is most interesting is how far the four horsemen have rampaged and the destruction they have already done. The internet is not the *least* regulated as those pushing for "tougher penalties" claim. One can argue, using the new federal doubling of prison terms when computers are used, that it is the *most* regulated. One can also see how far the combination of sexual hysteria and fear of new technology has fed into and been used by politicians from throughout the political spectrum. It also shows how much of the government threat to privacy is a social, not a technological, issue. While people argue about heat-death-of-the-universe encryption algos, a different form of hot air is producing the heat death of civil liberties. While cyber-libertarians talk about how strong crypto algos are needed to protect property and how "the statists in Washington" are trying to take away their crypto, right-wing pro-capitalist politicians have already taken away civil liberties. While crypto-radicals talk about how strong crypto algos are needed to lead the revolution and how "the nazis in Washington" are trying to take away their crypto, sexual hysterics calling themselves "radical feminists" have already helped take away many civil liberties. I support strong crypto. I support powerful and secure algos. I see it as a wonderful development of technology to protect individual privacy. But privacy is only one right of the citizen; it is only one of the many civil liberties under attack. I am also disturbed by the number of discussions on the list that may be on topic but avoid *these* social issues, E.G. Army vs. Navy Captain? how cheap is AT&T? Bizdos: confused executive vs. conspiratorial swine? Are CFS programmers being treated nicely? Fred Cohen: nice guy victim or swine? Why Alice should use PGP. Ever heard of bit fiddlin' while Rome burns? --tallpaul

1 0

Re: Only accepting e-mail from known parties
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 14:33 12/25/95, tallpaul wrote: >Thoughts? (I see one problem with this but it should be able to be worked >out once the basic method is agreed to). I assume that the "Problem" is that by only giving each corespondent ONE E-Stamp, you are single streaming your connections with them (ie: Are talking Half-Duplex). Not only are they restricted to one message "in-flight" but they can not start another message until they have done a capture run to acquire your ACK and get the new key.

1 0

Austin CPunk Video Update
by combee＠techwood.org 17 Dec '03

17 Dec '03

First, a lot of thanks to all of you who sent me ideas for the Cypherpunk video we are working on here in Austin. I'm sorry I haven't individually acknowledged all of you, but it was been a busy couple of months. Here is our status: We have agreed on the meeting infrastructure, with a video working group meeting twice a month of planning/strategy meetings and at other times for filming, editing, and so on. We have decided to do a 30 minute video with segments dealing with crypto history, basic theory, popular applications, and possible futures. We may go one to produce further videos which look at these topics in more detail. We have a outline of the segments of the video. The outline was originally conceived for a 60 minute program, so some items might have to be cut. This outline should be available online sometime soon off my web page at http://www.yak.net/combee/crypto/ (URL not yet active). This program will initially air on Austin's public access stations, but we have nebulous plans to distribute it once that requirement is met. Questions? Just write to me or to all the Austin CPunks at austin-cpunks(a)einstein.ssz.com. -- eebmoC .L nimajneB | Benjamin L. Combee (REVERSE) gro.doowhcet@eebmoc | combee(a)techwood.org (ENGINEERING) \eebmoc\ten.kay.www\\:ptth | http://www.yak.net/combee/ (RESERVE)

1 0

Re: a new idea: stocks == currency
by Mark Hittinger 17 Dec '03

17 Dec '03

> I've not seen promoted by any single author yet (although I have seen > some prominent cpunks argue the opposite). There was a book written some time ago called "SuperMoney" that basically argues this point (that stocks were not only money, they were *better* than money). One example would be a deposit at a bank. How can you tell if there is a potential solvency problem at the bank? One quick and easy check is to look at the value of the stock of the bank! You see this behavior in currencies when you are exchanging a stronger one for a weaker one or vice versa :-) PS: I read Prechter's "turn of the tidal wave" book over the holidays, and although it is mostly dry, it is an interesting read. Regards, Mark Hittinger Netcom/Dallas bugs(a)freebsd.netcom.com bugs(a)ritz.mordor.com

1 0

Re: HRB Systems Data Storage Encryptor
by James A. Donald 17 Dec '03

17 Dec '03

At 09:45 AM 12/26/95 +0100, Anonymous wrote: >Check out http://www.hrb.com/encryption/ssp.html, your >exclusive source of the Ultron Crypto-Engine (tm) The web page proudly announces: "is the only NSA-approved Type I data encryptor available today." There are probably some people ignorant enough to regard that as a recommendation. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0