December 2003 - cypherpunks-legacy

Re: fwd Canadian gov't eavesdropping
by nobody＠qwerty.org 17 Dec '03

17 Dec '03

Mike Markley say, "I'd be curious to see how they are going to do voice recognition on random conversations. Unless I am very sadly out of date you need to teach the pattern matcher individual voices." But of course they will just collect voice samples from everyone soon, and use them to IDENTIFY you. It'll probably be put on our US national health care cards. Ever since I started worrying about leaving DNA on postage stamps, I've started to think what can be done will be done. -Xenon

1 0

Josh Quittner's Newsday column on Cypherpunks
by gnu 17 Dec '03

17 Dec '03

Date: Wed, 02 Feb 1994 10:41:42 est From: "josh quittner" <quit(a)newsday.com> To: gnu(a)cygnus.com Subject: newsday column Hiya John: Here's the little column I did for my newspaper on the cypherpunks meeting I sat in on last month. Thought you might be interested. I know it's laymanlike, but if you want, you have my permission to distribute it to your list. I told Eric I'd send him a copy, but I left his email address at home, so if you'd be good enough, would you either pass this on to him or email me his address so I can? Thanks. Hope all is well with you. Be glad you're not freezing your ass off back here. Regards, -jq PUBLICATION DATE Tuesday. February 1, 1994 EDITION NASSAU AND SUFFOLK SECTION DISCOVERY PAGE 53 OTHER EDITIONS 59 C HEADLINE Life In Cyberspace COMPUTERS IN THE ^90s Coding Up a Bit of Privacy BYLINE Joshua Quittner DATELINE MOUNTAIN VIEW, Calif. LENGTH 91 Lines MOUNTAIN VIEW, Calif. THIS MUST BE HOW the Founding Fathers looked when they hacked out the Constitution: A roomful of young men, mostly - frazzled hair, eager eyes, wild beards, arms flailing and fingers jabbing the air, reaching for big ideas. You can't help but feel it; urgency tempers their voices. The earnest men plan and argue in this corporate conference room as the last sun rays of a winter Saturday afternoon fade in through a skylight. Time is running out for the Cypherpunks. There is much work to be done before the information highway arrives. The information highway - that 500-channel shopping mall / cineplex championed by cable and telephone companies - is a noxious concept to the people in this room. They are not technophobes or Luddites, these Cypherpunks. Instead, they are a collection of clever computer programers, engineers and wire heads from some of the nation's best-known Silicon Valley software houses and hardware shops. This is their central question: In a future world where all information is centralized on a network, where all information is tracked by the bit, where every purchase you make and every communication can be monitored by corporate America, how does privacy survive? If you go to a bookstore now and buy a book, you can pay in cash. No one knows your name or what you purchased. "What happens to cash transactions on the information highway?" they ask. The Cypherpunks believe that they can preserve your privacy through good cyphers, or codes. But they must hurry, must get their codes out and their networks up and running. "The whole information highway thing is now part of the public eye," explains Eric Hughes, a founder of the Cypherpunk movement. "If we don't change it now, it'll be impossible later." The Cypherpunks know what technology is capable of. We visit them today because they represent one edge of the national debate on the structure of the information highway. And as we all know, extreme positions help define the middle. Many of the Cypherpunks have been heavy Internet users for years and hope to preserve the communal spirit of that freewheeling world of interconnected computer networks. They dread the coming commercial network of televisions and computers, saying it will displace the Internet and destroy many of the freedoms they now enjoy. So the Cypherpunks, with the kind of zeal they professionally bring to marathon, 72-hour sessions hacking computer code, are plotting to keep free networks alive. That's "free" in the sense of unfettered, unmonitored, uncensored. One way they're going about it is by spreading easy-to-use, cheap cryptography. Cryptography is the science of keeping two-way communication private. Computers, it turns out, are revolutionary cryptographic tools, able to encode and decode files quickly. For the first time, virtually unbreakable codes are now possible, thanks to computers. The Cypherpunks post cryptographic software on the Internet where anyone can access it, and can encode their communications, including electronic mail, pictures and video. But the U.S. government is concerned, as governments always are, about the spread of powerful cryptography (terrorists could use it, kidnapers could use it, drug dealers could use it, all of them on cellular phones that encode conversations). It currently is pushing its own commercial cryptographic standard, through a special chip known as the Clipper. The chip is reviled by Cypherpunks and other civil libertarians because it provides a back door that law-enforcement agencies could enter, with the proper warrants, for surveillance. By getting good, unbreakable cryptography out there now, the Cypherpunks hope, whatever the government finally decides will be moot. Software has a wonderful property, the Cypherpunks are fond of saying: Once it's created, it can never be destroyed. It can be copied infinitely, from computer to computer, spreading like a secret. Come what may, unbreakable Cypherpunk code, and Cypherpunk networks, will be out there forever, they hope. But just to be safe, the Cypherpunks are toying with different network-related plans to create an economy of "digicash" - network money that, like the dollars in your pocket, isn't tied to a user's credit cards or other personal identification. Digicash will help pay for Cypherpunk networks and will allow people to purchase goods without revealing their identity. "I'm starting a bank, and it's not going to be a U.S. bank," Hughes says. He's standing at the whiteboard now. A strawberry-blond ponytail dangles down his back and he grasps a magic marker in his hand. "We have several long-term strategies, one of which is the elimination of central banks." He tells the assembled crowd what they already know. Heads nod. Some people take notes. Hughes is a self-employed programer in Berkeley. His hand flies across the whiteboard, sketching out a schematic diagram, showing how his bank will operate. The bank will store depositers^ money (he's thinking a $200 minimum deposit) and disburse payments to anyone - all over the Internet. It will be based abroad, maybe in Mexico. A Cypherpunk network bank is one way to pay for a network of truly encrypted, private communications, you see. "Is this going to lead the way to portable laptop ATM machines?" someone asks in the back. People snicker. "Have you thought about its name?" someone else asks. "First Bank of Cyberspace!" yells one person. "First Internet Bank!" yells another. "The Nth National Bank!" Laughter. Billy goat beards bob. There is much work to be done. --end of story-- -- josh quittner vox: 516-843-2806 fax: 516-843-2873 quit(a)newsday.com

1 0

unsubscribe wjm@mit.edu
by wjm＠MIT.EDU 17 Dec '03

17 Dec '03

unsubscribe wjm(a)mit.edu

1 0

New US keyserver now fully operational - pgp-public-keys@io.com
by pgpkeys＠wasabi.io.com 17 Dec '03

17 Dec '03

The US-based keyserver 'pgp-public-keys(a)io.com' is now open to the public. Come one, come all! Here is the current file as returned by 'Subject: help'. This site is a PGP key server SLAVE site. It behaves very similarly to the European PGP master sites, but there are a few small differences which will be noted below. The most noticable difference is that it answers your requests immediately instead of waiting for a daily batch job to run :-) The particular installation at io.com does *not* log the details of requests for keys, however the fact that you have sent mail to the key server at all is logged in the daily sendmail logs. These logs will be erased automatically after one week. PGP Public Keyservers --------------------- There are PGP public key servers which allow one to exchange public keys running through the Internet and UUCP mail systems. This service is NOT supported in any way whatsoever by the schools or organizations on which these servers run. It is here only to help transfer keys between PGP users. It does NOT attempt to guarantee that a key is a valid key; use the signators on a key for that kind of security. This service can be discontinued at any time without prior notification. Each keyserver processes requests in the form of mail messages. The commands for the server are entered on the Subject: line. To: pgp-public-keys(a)io.com From: johndoe(a)some.site.edu Subject: help Sending your key to ONE server is enough. After it processes your key, it will forward your add request to other servers automagically. For example, to add your key to the keyserver, or to update your key if it is already there, send a message similar to the following to any server: To: pgp-public-keys(a)io.com From: johndoe(a)some.site.edu Subject: add -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.2 <blah blah blah> -----END PGP PUBLIC KEY BLOCK----- COMPROMISED KEYS: Create a Key Revocation Certificate (read the PGP docs on how to do that) and mail your key to the server once again, with the ADD command. Valid commands are: Command Message body contains ---------------------- ------------------------------------------------- ADD Your PGP public key (key to add is body of msg) *** Note: your update is forwarded to a master server and may take a few days to reappear INDEX List all PGP keys the server knows about (-kv) VERBOSE INDEX List all PGP keys, verbose format (-kvv) GET Get the whole public key ring GET 0xA1B2C3 Get a single key by Key ID *** Note: the master servers allow you to omit the 0x in front of the Key ID. The slave servers do not. GET userid Get a single key by User ID MGET substr List all keys which match "substr" *** Note: this is different from the master servers which return the keys themselves, not just a listing of their Key IDs. Also the master servers accept a wild-card expression; at the moment we do not. LAST days Get the keys updated in the last `days' days *** Note: not yet implemented ------------------------------------------------------------------------ Examples for the MGET command: MGET michael Lists all keys which have "michael" in them MGET @iastate.edu Lists all keys which contain "@iastate.edu" Check the Usenet newsgroup alt.security.pgp for updates to this system and for new sites. Based on a document originally by Michael <explorer(a)iastate.edu>

2 1

digital signatures/copyright
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A question for Mike Godwin and other attorneys on the list: Could one make a case that the use of Digital signatures in messages imply's copyright retention by the author? Does digital signature=copyright or is it at least equivalent? Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced comunication is indistinguishable from noise." --Steve Witham -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLU/2HdCcBnAsu2t1AQF15gP+IqS3o0gNeHng9BSqlk95KzmPwp3oo70p j2FVYHNOeUKgDSAAwvWr+p3/DOwTafSkJf4A5gW33NOKr0E9JZ4In349RAoueTku J94VMajT4i7yhOC8X41RPkVLlCltPDRo04SS8h5UFnEk/zFxiTkvXY9mpBcK3yUw vYY9pbmupSc= =KbXS -----END PGP SIGNATURE-----

2 1

No Subject
by bob＠USCWS4.gat.com 17 Dec '03

17 Dec '03

unsubscribe bob(a)USCWS4.gat.com

1 0

Re: New Remailer Up.
by nobody＠qwerty.org 17 Dec '03

17 Dec '03

Jon wrote, " Aside from traffic obscuring random messages, a forced, random delay and a medium sized load of traffic seem to be the best ways to defeat the use ..." How LONG should the such a random delay BE, at max? I am not willing to add more than 10-15 minutes, max. Is this worth it then? Hours is just too primitive when it comes to electronic communications. Even minutes! -Xenon

1 0

test
by Joseph Reagle Jr. 17 Dec '03

17 Dec '03

Regards, Joseph M. Reagle Jr. | reagle(a)umbc.edu | It's celluar peptide cake with mint frosting! jreagl1(a)umbc8.umbc.edu | -- Worf

1 0

Re: digital signatures/copyright
by smb＠research.att.com 17 Dec '03

17 Dec '03

It's worth noting that U.S. copyright law makes explicit provision for copyrighting anonymous works.

1 0

Re: system logging
by nobody＠qwerty.org 17 Dec '03

17 Dec '03

PGP Slave, Could you please announce my full name, phone number, address, visa card number, a giff of my signature, height, weight and driver's licence number not only to the Cypherpunks mailing list but to many usenet groups as well, since you obviously feel I no longer wish to be known to the masses as Xenon, and I instead want them to start calling me and postal mailing me asking for copies of PGP. Thanks asshole. I thought the people on this list were concerned with privacy, but I was wrong. I mention Xenon in my personal .plan, but I ask people to let me keep the small amount of extra privacy I still retain. You wrote, "qwerty account or not, the public logs on netcom show more than enough info to trivially track people down." Trivial? And so you hack out the info that a message went from remailer A through qwerty and on to remailer B, at a certain time. You haven't tracked down anyone my friend. -Xenon

2 1

unsubscribe
by DBS5112＠ibm.MtSAC.edu 17 Dec '03

17 Dec '03

(mailing to cypherpunks-request(a)toad.com doesn't seem to work)... please unsubscribe me from the list... thanxs

1 0

anonymous mail
by nobody＠pmantis.berkeley.edu 17 Dec '03

17 Dec '03

There's a jerk that's been mail-bombing me, and I can't do anything because he's root at his site. Would it be ethical to use a remailer to bomb him back? Or maybe I shoudl simply fakemail a message to alt.fan.rush-limbaugh(a)anon.penet.fi with his name and have the contents say something like 'Limbaugh sucks', or post to alt.sex.wanted with the subject 'SWF virgin seeks man for first time'. Any ideas on how to get someone back, or at least make life annoying?

2 1

Notes on key escrow meeting with NSA
by Matt Blaze 17 Dec '03

17 Dec '03

A group from NSA and FBI met the other day with a group of us at Bell Labs to discuss the key escrow proposal. They were surprisingly forthcoming and open to discussion and debate, and were willing to at least listen to hard questions. They didn't object when asked if we could summarize what we learned to the net. Incidentally, the people at the meeting seemed to base a large part of their understanding of public opinion on Usenet postings. Postings to sci.crypt and talk.politics.crypto seem to actually have an influence on our government. A number of things came out at the meeting that we didn't previously know or that clarified previously released information. What follows is a rough summary; needless to say, nothing here should be taken as gospel, or representing the official positions of anybody. Also, nothing here should be taken as an endorsement of key escrow, clipper, or anything else by the authors; we're just reporting. These notes are based on the collective memory of Steve Bellovin, Matt Blaze, Jack Lacy, and Mike Reiter; there may be errors or misunderstandings. Please forgive the rough style. Note also the use of "~ ~" for 'approximate quotes' (a marvelous Whit Diffie-ism). NSA's stated goals and motives for all this: * DES is at the end of its useful life * Sensitive, unclassified government data needs protection * This should be made available to US Citizens * US business data abroad especially needs protection * The new technology should not preclude law enforcement access They indicated that the thinking was not that criminals would use key escrowed crypto, but that they should not field a system that criminals could easily use against them. The existence of key escrow would deter them from using crypto in the first place. The FBI representative said that they expect to catch "~only the stupid criminals~" through the escrow system. Another stated reason for key escrow is that they do not think that even government-spec crypto devices can be kept physically secure. They do expect enough to be diverted to the black market that they feel they need a response. NSA's emphasis was on the foreign black market... There seems to be a desire to manipulate the market, by having the fixed cost of key escrow cryptography amortized over the government market. Any private sector devices would have to sell a much larger number of units to compete on price. (This was somewhere between an implication and an explicit statement on their part.) When asked about cryptography in software, "~...if you want US government cryptography, you must do it with hardware~". Clipper chips should be available (to product vendors) in June. You can't just buy loose chips - they have to be installed in approved products. Your application interface has to be approved by NIST for you to get your hands on the chips. An interesting point came up about the reverse-engineering resistance of the chips: they are designed to resist reverse engineering the data in the chip without destroying the chip. It is not clear (from the information presented at the meeting) whether the chips are equally resistant to destructive reverse-engineering to learn the skipjack algorithm. They said the algorithm was patented, but they may have been joking. ("~And if that doesn't scare you enough, we'll turn the patent over to PKP.~") The resistance to reverse engineering is not considered absolute by NSA. They do feel that "~it would require the resources of a national laboratory, and anyone with that much money can design their own cryptosystem that's just as strong.~" They repeated several times that there are "~no plans to regulate the use of alternate encryption within the US by US citizens.~" They also indicated they "~weren't naive~" and didn't think that they could if they wanted to. There were 919 authorized wiretaps, and 10,000 pen register monitors, in 1992. They do not have any figures yet on how often cryptography was used to frustrate wiretaps. They do not yet have a production version of the "decoder" box used by law enforcement. Initially, the family key will be split (by the same XOR method) and handled by two different people in the athorized agencies. There is presently only one family key. The specifications of the escrow exploitation mechanism are not yet final, either; they are considering the possibility of having the central site strip off the outer layers of encryption, and only sending the session key back to the decoder box. The escrow authorities will NOT require presentation of a court order prior to releasing the keys. Instead, the agency will fill out a form certifying that they have a legal authorization. This is also backed up with a separate confirmation from the prosecutor's office. The escrow agencies will supply any key requested and will not themselves verify that the keys requested are associated with the particular court order. The NSA did not answer a question as to whether the national security community would obtain keys from the same escrow mechanism for their (legally authorized) intelligence gathering or whether some other mechanism would exist for them to get the keys. The masks for the Clipper/Capstone chip are unclassified (but are protected by trade secret) and the chips can be produced in an unclassified foundry. Part of the programming in the secure vault includes "~installing part of the Skipjack algorithm.~" Later discussion indicated that the part of the algorithm installed in the secure vault are the "S-tables", suggesting that perhaps unprogrammed Clipper chips can be programmed to implement other 80-bit key, 32 round ciphers. The Capstone chip includes an ARM-6 RISC processor that can be used for other things when no cryptographic functions are performed. In particular, it can be used by vendors as their own on-board processor. The I/O to the processor is shut off when a crypto operation is in progress. They passed around a Tessera PCMCIA (type 1) card. These cards contain a Capstone chip and can be used by general purpose PC applications. The cards themselves might not be export controlled. (Unfortunately, they took the sample card back with them...) The card will digitally sign a challenge from the host, so you can't substitute a bogus card. The cards have non-volatile onboard storage for users' secret keys and for the public keys of a certifying authority. They are building a library/API for Tessera, called Catapult, that will provide an interface suitable for many different applications. They have prototype email and ftp applications that already uses it. They intend to eventually give away source code for this library. They responded favorably to the suggestion that they put it up for anonymous ftp. Applications (which can use the library and which the NSA approves for government use) will be responsible for managing the LEAF field. Note that they intend to apply key escrowed Skipjack to other applications, including mail and file encryption. The LEAF would be included in such places as the mail header or the file attributes. This implies that it is possible to omit sending the LEAF -- but the decrypt chip won't work right if it doesn't get one. When asked, they indicated that it might be possible wire up a pair of Clipper/Capstone chips to not transmit the LEAF field, but that the way to do this is "~not obvious from the interface we give you~" and "~you'd have to be careful not to make mistakes~". They gave a lot of attention to obvious ways to get around the LEAF. The unit key is generated via Skipjack itself, from random seeds provided by the two escrow agencies (approximately monthly, though that isn't certain yet). They say they prefer a software generation process because its correct behavior is auditable. Capstone (but not Clipper) could be configured to allow independent loading of the two key halves, in separate facilities. "~It's your money [meaning American taxpayers].~" The LEAF field contains 80 bits for the traffic key, encrypted via the unit key in "~a unique mode <grin>~", 32 bits for the unit id, and a 16 bit checksum of some sort. (We didn't waste our breath asking what the checksum algorithm was.) This is all encrypted under the family key using "~another mode <grin>~". They expressed a great deal of willingness to make any sort of reasonable changes that vendors needed for their products. They are trying *very* hard to get Skipjack and key escrow into lots of products.

2 1

RE: fwd: Canadian gov't eavesdropping
by fnerd＠smds.com 17 Dec '03

17 Dec '03

Mike Markley says- > I'd be curious to see how they are going to do voice recognition on > random conversations. Unless I am very sadly out of date you need to > teach the pattern matcher individual voices. I remember a story from a conference in the sixties where someone wanted to prove the point that it's much easier to make a recognizer for all voices if you're only looking for a certain word. So he built a "watermelon" box. He sits this up on the podium with him and gives his talk, which naturally at some point gets to... "...a single word, for instance 'watermelon.'" *beep!* Then later there's a Q&A period, of course... A: Please step up to the microphone... Q: You mean all this thing does is recognize the word "watermelon," *beep!* and that it can recognize the word "watermelon" *beep!* no matter who says it? A: That's right, it's an any-speaker, "watermelon" *beep!* recognizer. Q2: Why the word... "watermelon" *beep!* exactly? ... -fnerd *BZZZT! AAAAARRRRROOOOGAH!* quote me - - cryptocosmology- sufficiently advanced communication is indistinguishable from noise - god is in the least significant bits -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

Remailer FAQ. Info request!
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

I have only seen unsatisfying info on the remailers out there. If people know the details up front, the Cypherpunk remailers will become more popular. Different people have different needs for remailing as well. Please help me out with this. I would appreciate info from operators as well as users of remailers. If you do not want to disclose a specific bit of info, I will enter it as "N/A". If I get no answer at all I will leave it as "?". Send responses to qwerty(a)netcom.com. If you wish your remailer be taken off the list I will comply. -Xenon Xenon's Full Disclosure Remailer List. Remailer Who's Fast? PGP? Logs? Comments ---------- ----- ------- ------- ------ ------------------------------------ bsu-cs NSA? + ? ? Strips Subject. catalyst Scott + Y(2.3a) ? choas NSA? + ? ? Strips Subject. cicada Eric ++ N ? Tread lightly. dis.org NSA? - Y(2.3a) ? extropia NSA? ? Y(2.3a) ? Only accepts PGP remailing. jarthur Eli +/-- ? ? menudo NSA? -- ? ? merde NSA? -/-- ? ? batches out at midnight?? penet.fi Julf -- N Stats <48K. Overloaded. Slow. pmantis Eric ++ N ? Tread lightly. qwerty Xenon + Y(2.3a) Count rosebud NSA? ++/- Y(2.3a) ? shell Hal ++/+/- Y(2.3a) Stats+ soda Eric ++/- N Stats+? Can post to Usenet ++ <5 min - ~10-30 min delay -- pinging isn't practical due to long delays + ~10 min +/- sometimes +, sometimes - Normal internet mail delays are common, and are not equivalent in the two directions between any two remailers. Mail still gets through. Full: full copies of all mail is archived. My large volume mailing should help put a stop to this. Stats: logs of when mail was remailed. Stats+: logs of when and where mail was remailed. None: operator keeps no logs. Count: simple counter. bsu-cs nowhere(a)bsu-cs.bsu.edu catalyst catalyst(a)netcom.com chaos remailer(a)chaos.bsu.edu cicada hh(a)cicada.berkeley.edu dis.org remailer(a)dis.org extropia remail(a)extropia.wimsey.com jarthur ebrandt(a)jarthur.claremont.edu menudo nobody(a)Menudo.UH.EDU merde remailer(a)merde.dis.org penet.fi anon.penet.fi pmantis hh(a)pmantis.berkeley.edu qwerty qwerty(a)netcom.com rosebud elee7h5(a)rosebud.ee.uh.edu shell hfinney(a)shell.portal.com soda hh(a)soda.berkeley.edu Discontinued remailers still on some lists out there: phantom(a)mead.u.washington.edu remail(a)tamaix.tamu.edu sameer(a)netcom.com (spelling?) sameer(a)berkeley.edu (spelling?) cdodhner(a)indirect.com remailer(a)entropy.linet.org?? 00x(a)uclink.berkeley.edu? hal(a)alumni.cco.caltech.edu? remail(a)tamaix.tamu.edu? remailer(a)entropy.linet.org? Background on each remailer: bsu-cs: Run by Chael Hall. Machine: ?? Problems policy: ?? Contact ?? Software: ?? Comments: ?? History: ?? catalyst: Run by Scott Collins. Machine: personal dial-up account on Netcom. Problems policy: ?? Contact ?? Software: ?? Comments: ?? History: ?? chaos: Run by ?? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Comments: finger remailer.help(a)chaos.bsu.edu for info. ?? History: ?? cicada: Run by Eric Hollander. Machine: ??? Problems policy: ?? Contact ?? Software: ?? Comments: being "phased out". dis.org: Run by ?? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Comments: ?? History: ?? extropia: Run by ?? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Comments: ?? History: ?? jarthur: Run by Eli Brandt. Maching: ?? Problems policy: ?? Contact ?? Software: ?? Comments: ?? History: ?? menudo: Run by ?? Maching: ?? Problems policy: ?? Contact ?? Software: ?? Comments: Stores messages and sends them at midnight?? History: ?? merde: Run by ?? Maching: ?? Problems policy: ?? Contact ?? Software: ?? Comments: ?? History: ?? penet.fi: Run by Julf (last name?) Machine: ?? Operator owned. Problems policy: Account revokation. Contact ??(a)anon.penet.fi. Software: custom. Comments: ?? History: ?? pmantis: Run by Eric Hollander. Machine: ?? Problems policy: ?? Contact ?? Software: ?? Comments: being "phased out". History: ?? qwerty: Run by Xenon. Machine: dial-up account on Netcom. Problems policy: "What problems?". Contact qwerty(a)netcom.com. Software: Hal's remailer. Comments: ?? History: Up 2/94. Set up by Xenon who needed more remailers to use to send PGP info to people with, since anon.penet.fi was overloaded. rosebud: Run by Karl Barrus. Machine: ?? Problems policy: ?? Contact ?? Software: ?? Comments: ?? History: ?? shell: Run by Hal Finney. Machine: ?? Problems policy: ?? Contact ?? Software: Hal's Remailer.? Comments: ?? History: ?? soda: Run by Eric Hollander. Run by: ?? Machine: ?? Problems policy: ?? Blocking of addresses. Mail sent to problem causer. Contact ?? Software: custom. ?? Comments: Was keeping full logs till Xenon's bulk mailing venture. ?? History: ?? Remailer Public Keys: Anonymous Remailer <catalyst(a)netcom.com> 1024-bit key, Key ID C0EA49, created 1993/08/30 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCNAiyBTjoAAAEEAMIKpRnqXb82TOQpx/vEDwGPXndXaxtfiZeSLZqullWCEbd4 YkCHG/F1i3Wzq4Pgz6nSbb58vMS5RonY7+ZC6IHI8zBpp9oMW3u+lqbk8Z61x49d xwAKlE7Zsk/pOeGrqbsidm83WUqlSGgyOpvq0A8LzT4+WPra8ZvHue9jwOpJAAUR tChBbm9ueW1vdXMgUmVtYWlsZXIgPGNhdGFseXN0QG5ldGNvbS5jb20+iQCVAgUQ LIaqhIOA7OpLWtYzAQH4sgQAsc6s3X75LwWTV65Dw76wdSRKuoI57F2ZZWjSOIQK n1CWUn6YEYOIs3kkdHNd0uz9Mspoy+6BsnWGSW11r8k88VThEoVpJ74o91apR1ML yCEdD7O/+nZK8N484+mN2BcKOdeze4QvgTt+qHHUd+Q5alW9VfXtbNImmSnI3FC/ 8n4= =Hh6a -----END PGP PUBLIC KEY BLOCK----- Remailing Service <remailer(a)dis.org> 512-bit key, Key ID 64E8A7, created 1993/03/05 Also known as: Anonymous Remailer <remailer(a)utter.dis.org> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQBNAiuX3kAAAAECAMd6YkS3ylajgNSzX+wYLrpW03D+99OFvePQLlR5N+R5iZBr y4FbAMeDj+eCeEAqiEyNjUxHN5tGlqx1g6tk6KcABRG0JFJlbWFpbGluZyBTZXJ2 aWNlIDxyZW1haWxlckBkaXMub3JnPokAVQIFECwomeN8p7i9YJH3xQEBDhEB/A7+ RLEw2bGJeBdBy0yXn5mIenda/tHHs9NGXJZR5BvOsU9EwVY+9s86E33R2/tgqAjY UYc5MiWS0r1+H9Zw+FeJAJUCBRArmsesg4Ds6kta1jMBAW4zA/4waabkcIHN93Jy /9OMXhRDqrRf2kickmeUWOGHF0KALLo37kAqfDvMNDtFs1u3WbdaBWdTSiLR8qIM 6TQNq0IEhAeny07AVweLlIpJc7lVN7biHqVIPknxJTAI/xscybuMUin3yALzFpWR 54uFMbd45iuKWBJ2/IGdUYcd39H0FbQsIEFub255bW91cyBSZW1haWxlciA8cmVt YWlsZXJAdXR0ZXIuZGlzLm9yZz6JAJUCBRArmsmdg4Ds6kta1jMBAbdwA/9m2GYJ 978xxchux7nnl4HAo3N+A2Nx+n40kQftWNiyJwivrG8kYwDI24QYaUpr2l6+2HDd xedEOFsX6DiHbDQK5J7dGYOigASmZHPs39lEdJ3AHvrTVYVYjOxBMQ2W6p+Q5rbn qxfmVlqRMzPRosPJ1gpbfcTzIpqznwSTl7tztQ== =v3Hk -----END PGP PUBLIC KEY BLOCK----- Remailer <remail(a)extropia.wimsey.com> 1024-bit key, Key ID B5A32F, created 1992/12/13 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCNAisrAP0AAAEEAJr3OwIfOIOoh9JndwwqFg+VyWFTAyM8S0B7wyGKI+A9sMAB mbSOIU52EszvLdZk8NH8mrOD9m3EZlt9gXOjln881RMilAunnzdXaJ6ffBKqPL+l yiefCbCo6wScVNfMSV6Di/2HMoFzVqukwRjTx8lqKt6hgy0uedtwcCemtaMvAAUR tCVSZW1haWxlciA8cmVtYWlsQGV4dHJvcGlhLndpbXNleS5jb20+iQCVAgUQK2SV p4OA7OpLWtYzAQG8eQP9F9ye/F/rXhJLNR5W/HV5k+f6E0zWSgtmTTWUYyydfJw+ lKDEDH6v+OFOFE3+fuTIL5l0zsNMSMdF5u7thSSWiwcFgaBFQF9NWmeL/uByOTSY tsB6DQSbw656SBH7c7V7jvUsPit/DubwBXZi9sOlULau3kQqXeeQxPhNE+bpMy6J AJUCBRArKwSLk3G+8Dfo40MBAXYAA/4hCVDFD0zG47pYPMg+y7NPE5LktWt2Hcwt Z4CRuT5A3eWGtG8Sd5QuHzbE4S9mD3CFn79bxZi0UDhryD8dsCG4eHiCpAcZqSvR JSkpgamdRaUQHNmMxv5goxHhRem6wXrKxZQNn5/S0NtQOrS6QKhFlGrzDIh/2ad1 J9qpyzJ/IYkARQIFECsrA9RLrSJixHgP9wEBNcEBewWpzywKk/SBDwocXebJmsT6 zug/ae78U/cu9kTX620Xcj1zqOdx9Y9Ppwem9YShaQ== =I7QE -----END PGP PUBLIC KEY BLOCK----- jarthur remailer c/o <ebrandt(a)jarthur.claremont.edu> 512-bit key, Key ID 7D154B, created 1993/04/04 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQBNAiu+hVUAAAECAMVjEfl2IMNgSOJ+/fx1V6EbH50ofa6K4r1PBKMmkcHQextP ghwC4lXIgaAWUlLJ9x61+qf4jB5fpNUZLrF9FUsABRG0NWphcnRodXIgcmVtYWls ZXIgIGMvbyA8ZWJyYW5kdEBqYXJ0aHVyLmNsYXJlbW9udC5lZHU+iQCVAgUQK8M/ BIOA7OpLWtYzAQGJRAP9GIVi0qoQW4bjU9sikIPG4zIEbQ9O3rU1vd2uCrrnGQMM tdE9NoOx4umoVZKYTpCc96TlFQetb2UVd9JhaayXO7+nwNNHYgApkRJboolq9UzU wCRBA8k1EMAkdzCjzYglpZIQJz2yNP50Izu7g2LMbC1pHQX3CHVL7YlQrKGNLz4= =ItNk -----END PGP PUBLIC KEY BLOCK----- Qwerty Remailer <qwerty(a)netcom.com> 1024-bit key, Key ID 5505D9, created 1994/02/01 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCNAi1NtgAAAAEEALD07N5RllpklGhOQaiYtRupb+8Jm1M34ya8rxmcNUCVndcb JgH9EW1Z2VvkJ3vTcEOOBK9jM/HCIGDqBbQZR8VOLbLNOD7VQIzTpyTOmZJCMSZG bqZtRtP6KDtMcTx1SgHq9LiRNz5YUyB3WOV963y8W/x00QS4yGkgCDZkVQXZAAUR tCNRd2VydHkgUmVtYWlsZXIgPHF3ZXJ0eUBuZXRjb20uY29tPokAlQIFEC1OzEgE sxus60J9UQEB224D/jUcYRnXmIj9nt4Y7sjGYTmO+v7b9W+rsxYLn6+hCGmx5iQJ zPr3ggvm8ylBZnNp3WUxssDlb9GyiK801vzm6HDXWd/yCeGXHX7YB2DDFd5WrK70 /XGTMGv3gvNnExIM+UVv5tl8y/YXOfeLWWGttD6a60MkUNxAOGT9qBsUTqJNiQCV AgUQLU3TdWkgCDZkVQXZAQH1ygP/TCY7T0PdNVRUVbEpN9YsbxFKhFT/7+hZTySr Md0j2GrObjcRc7aa0c9lEZrtKpaDCJkgF+7k20z1eQpw7zD/dO+ZsSqni62TLGYa pdTsAiYbev90Nb+1S2ST36KvIgJSmQS6zvgpToTRpGwYhJhqTZhTo8Z2U5ufb+SF TsNMd0Q= =BXnK -----END PGP PUBLIC KEY BLOCK----- Remailer (remailer(a)rebma.mn.org) 1024-bit key, Key ID BA80A9, created 1992/11/26 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCNAisUI2QAAAEEAKgm07Hsje5KpmXYd5azk0R6AES+qK7LcofnVGojUs7GBghD WbwrmW8oOEOhRorlShRALKeYspV4xYIw4WDkJcJxuf1B254scz1urF/Eem3zPW9b yPAx7W/cGwvs6SouZvFcSDq4v1zApvGE9hP4szPzHeGmVr0NVNeaDK0guoCpAAUR tCBSZW1haWxlciAocmVtYWlsZXJAcmVibWEubW4ub3JnKYkAlQIFECtkldODgOzq S1rWMwEBnx8D/1p9vNDfnSzgKhd0q0xF0KTQWBzbQgXFeWLTUwLPLN30vGQRZHVc IrOSzjCOSflhcl0zc7tp7q+GQkVT5P/PIUG0yeL0mFi+oUswcws14LRaelYmVbgw OsjwJ7g4vwKICqzOWRVsdtSurMfw/65LzdgSUNPS18pGpD/4MJF3kHpkiQCVAgUQ KxQkYRiQVHeOVJ+HAQHXOAP/Usb0O200RU8V13GRQs/D4CSRuZKiWuolSZXH/fLd BLUC1b69WoXTKGBaC+DvvRvv7EyfDM78jWeHQUrayF3UmTHgVUIDly3KpTNUWOTU 0TpVppFzkG8EPWdTG1SF5HRZcNznR/4A0eBE2THbYwZG+mGx4zJer86TzyilKfsM is4= =jbyA -----END PGP PUBLIC KEY BLOCK----- remailer03 <elee7h5(a)rosebud.ee.uh.edu> 1022-bit key, Key ID ABFBB3, created 1992/12/02 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCNAiscKOYAAAED/jmrZbh5t5HgEHDGE2zzFZx3sIplEjIFRFsLpCfJYBfN36Rm uT8VGIyCcUSmCTqEOJ5HJZF58CUCOsy3B215ptOvbZdGijC3Qs7FbtGHKGA49q0v gBgVIcjjyppRI9YjfqlI2gUKDLPceCTw20ODAA7UTKYIa3IBS32zjcrFq/uzAAUR tCZyZW1haWxlcjAzIDxlbGVlN2g1QHJvc2VidWQuZWUudWguZWR1PokAlQIFECtk lUeDgOzqS1rWMwEBUdAEAIosaOm/+kTsQI53GAqPXr08v5AAfwup5lDiUbCWp17C ueYHZrP4zolAqQ7kyWrkIeHgJHkX3yB6YH/jQ0MeDZERXS69kq2SGVQSH6inGoF9 3WerfGRpdONa597JVcRpklzMUz6bmXnhsiEm/K1FP9pNOZYyS6h/3gs92ikezq3X iQBVAgUQKxwo79I3XvyZ21fpAQG27AIAk7r8plkjpH1X9uQcsqFqjdjJtXGmHCeA dLV7tiviHlljDe2RqOKkjfFsQtzZV+yjCNXr8OhW0TiE0J5WqBwECA== =VK3C -----END PGP PUBLIC KEY BLOCK----- Remailing Service <hfinney(a)shell.portal.com> 510-bit key, Key ID 5620D5, created 1992/11/15 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQBNAisGf+IAAAEB/ieS6th8hI1QBjGpmctVvsIxZBtmpykVXc3psh0XVfH4sECS ugouk2zm/PJtt59A2E5SO3xjpDjeKlkQ745WINUABRG0LFJlbWFpbGluZyBTZXJ2 aWNlIDxoZmlubmV5QHNoZWxsLnBvcnRhbC5jb20+iQCVAgUQK3Azm4OA7OpLWtYz AQHzawQAwZPaJUR9iNwyKMDm4bRSao0uu381pq6rR3nw0RI+DSLKTXPqDaT3xBmL dVv1PVguLcoao/TRLkAheV7CIxodEiI9lAC2o6lqSXCP+vm3jYmulSgUlKafXYbj LAbZpsKRAUjCpyx0wlYmoHhkA+NZDzMcWp6/1/rM/V1i4Jbt2+GJAJUCBRArBpKv qBMDr1ghTDcBASTlBACfTqODpVub15MK5A4i6eiqU8MDQGW0P0wUovPkNjscH22l 0AfRteXEUM+nB+Xwk16RG/GdrG8r9PbWzSCx6nBYb7Fj0nPnRPtS/u69THNTF2gU 2BD0j2vZF81lEHOYy6Ixao2b6Hxmab2mRta2eTg7CV6XP3eRFDPisVqgooAWgw== =arSc -----END PGP PUBLIC KEY BLOCK-----

1 0

contemplating remailer postage
by jim＠uu4.psi.com 17 Dec '03

17 Dec '03

Although lot of people (including me) have mentioned Digital Stamps, or remailer postage, when describing advanced remailers, I've yet to see a good description of a practical remailer postage mechanism. I assume it will be (or has been) modeled after one of the Chaumian digital cash protocols. If there has been work done on a remailer postage mechanism, could somebody post the details? (or a reference) Here's what I think would make up a practical remailer postage mechanism: I think that each remailer should issue its own stamps, rather than using a central digital postage service. The existence of a centralize digital postage service creates a single point of failure for the entire remailer system. It also complicates the protocol needed to validate digital stamps and check for double spending. Of course, having each remailer issue its own stamps would increase the complexity for the users of the remailer system. However, I believe the increased user-side complexity can be completely hidden within a good set of scripts (e.g. the scripts could maintain a subdirectory for each remailer to hold stamps for that remailer). If all digital stamps have the same "denomination", then the protocol for obtaining stamps can be greatly simplified. You wont need to engage in a cut-and-choose protocol with the remailer (see page 121, Digital Cash Protocol #4, Applied Cryptography). To obtain 100 stamps from R1, Bob would generate and blind 100 uniqueness strings (random numbers large enough that they are unlikely to collide with anyone else's) and send them all to R1. R1 would simply sign all 100 of them and send them back. Bob would unblind them and store them in his "R1_stamps" subdirectory. Given the low value of individual stamps, it is probably not necessary to try to determine who is attempting to double spend stamps. Therefore, stamps wouldn't need the identity strings used in Digital Cash Protocol #4. Also, since the remailer is both "bank" and "merchant", there's no chance of the "merchant" cheating the "bank". ... When Bob wants to route a message through R1, he place an R1 stamp at the appropriate level within the nested envelopes. These stamps can also be used in SASE's. When R1 receives a stamped message (or SASE) it will check the signature of the stamp. If the signature doesn't verify, R1 discards the message. If the signature verifies, R1 checks the uniqueness string against his archive of "used" stamps. If the uniqueness string is present in the archive, the stamp has already been used and the message will be discarded. If the uniqueness string is not present in the archive, R1 will route the message on to the next hop. Finally, R1 places the uniqueness string in his "used stamp" archive. Seems simple enough. The major sticking point (to me) is the remailer's "used stamp" archive. This could grow to be very large. Something needs to be done to keep the archive from getting too large. One idea is to have the remailer periodically change the key it uses to sign stamps. Changing the "stamp validation key" effectively invalidates all unused stamps signed by that key. If you haven't used the stamp by that time, you're out of luck. The remailer can purge its "used stamp" archive whenever it changes its "stamp validation key". Of course, invalidating peoples' unused stamps out from under them is not a nice thing for a remailer to do. The remailer could provide a mechanism whereby people could get new stamps from old, unused stamps. To make this work, the remailer would have to retain the previous "used stamp" archive for a while to give people a chance to get new stamps. However, there still needs to be a limit on how long the remailer retains the "used stamp" archives for old validation keys. If you wait too long, you would lose any chance to get new stamps from old. Comments welcome. Jim_Miller(a)suite.com

2 1

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Out of personal curiousity concerning the claims of how trivial "traffic analysis" of the qwerty or catalyst remailers on Netcom would be for "anyone" to carry out, I offer $20 to the first person to reveal from which SITE this message originated from. Please do not announce my name or login ID. Just the site. I am logged into a friend's account and I am remailing this with no encryption just through qwerty(a)netcom.com. It is now 5:41 PM EST. You do not have to reveal your methods to receive the award, which I will mail to you. Happy hacking you WIMPS. If you wish to remain anonymous, mail the answer to qwerty(a)netcom.com and my lips are sealed except for announcing success. -Xenon

3 2

Message returned to sender
by daemon＠fidonet.fidonet.org 17 Dec '03

17 Dec '03

(Invalid host or address: cypherecho(a)f21.n216.z1.fidonet.org) The address you are trying to send to does not exist on this side of the gateway. If you have any problems, email the postmaster of this gateway for assistance. Please note that the biggest reason for bounced messages is due to a simple typo. Please, double check your spelling! A copy of the original message is listed below: -----8< cut here 8< ------------------------------------ >From owner-cypherpunks(a)toad.com Wed Feb 2 12:30:16 1994 Received: from relay2.UU.NET by zeus.ieee.org (4.1/Z-3.46-01.31.94) id AA12961; Wed, 2 Feb 94 12:30:16 EST Received: from toad.com by relay2.UU.NET with SMTP (5.61/UUNET-internet-primary) id AAwbnp25485; Wed, 2 Feb 94 12:25:12 -0500 Received: by toad.com id AA24880; Wed, 2 Feb 94 09:11:06 PST Received: by toad.com id AA24877; Wed, 2 Feb 94 09:11:05 PST Return-Path: <ravage(a)wixer.bga.com> Received: from ghostwheel.bga.com ([198.3.118.4]) by toad.com id AA24873; Wed, 2 Feb 94 09:10:58 PST Received: from wixer.UUCP by ghostwheel.bga.com with UUCP id AA05678 (5.65c/IDA-1.4.4 for cypherpunks(a)toad.com) Wed, 2 Feb 1994 11:09:24 -0600 Received: by wixer (5.65/1.35) id AA09079; Wed, 2 Feb 94 11:08:26 -0600 Message-Id: <9402021708.AA09079@wixer> Subject: Archiving on Inet To: cypherpunks(a)toad.com Date: Wed, 2 Feb 94 11:08:26 CST From: Jim choate <ravage(a)wixer.bga.com> X-Mailer: ELM [version 2.3 PL11] I would like to ask all subscribers who are not addressing the issues of this question to please move their responces to private mail. I have no interest in exploring your personalities or views of others personalities. If a global network is to survive there must be a commen understanding of what is public domain and what is private or commercial. At the present time this is completely new ground. The fact is that the copyright laws of the US are of little interest to a net user in Moscow, Russia or Pretoria, S. Africa. If as a cpunk you don't feel that a anonymous regulatory agency can protect your privacy why do you feel they can protect your intellectual property? The issue has direct bearing on both intellectual property and the wide spread use of cryptographic techniques. As a active cpunk it seems to me that your first motivation after producing the actual code is to creat a atmosphere where it can be used for the betterment of all. To create a useable global community (what I am striving for) it seems to me that entries on that network must be public domain by default. Otherwise every country who joins, and by reduction every potential user, will have to agree on how to recompense each and every user who desires to be paid for their submissions. This, to me, leads incontrovertibly to the conclusion of a beurocratic nightmare that will not significanly assist anyone other than the regulatory agencies. The only other answer that seems even close to working (and I consider this a stretch of the imagination) is one where everyone is given access for free and the governments regulate the traffic completely and pat for it with tax dollars. As to the issue as it applies to community bbs'es. I run such a system and am in the process of getting it on the net. As part of this project I have 2 other systems that I will be providing feeds for. These systems are all run by individuals who have these boxes sitting in their den. By insisting on a priori copyright of all material it is my opinion that you are creating a situation which will prevent the growth of such systems. Now if we don't have regulatory agencies and the sites are indipendant (and I assume self supporting) how can we expect some Joe or Jill to put up a system to help the people in their neighborhood if they have to keep looking over thier shoulders for the copyright police? The answer is they won't put up such systems and we all loose. By providing strong crypto tools for business and individuals to protect their intellectual and commercial property we are creating an open door atmosphere which motivates people to join the network for their own enjoyment and edification. This to me is more important than keeping the present view (as applied to non-networked environments) of copyright. It is time that we as uses of Internet set a precedence before the legislators set one for us that will in the long run only assist those already in power by strangthening the need for regulatory agencies. I strongly suggest that you all consider this idea from the global and long term view. I think you will find that the view "information wants to be free' is the way to go. To this end I propose that organizations such as EFF and cpunks take the position of a priori public domain status of network submissions. Also that all individuals who wish to retain intellectual or commercial rights either use strong crypto w/ e-mail distribution of keys or a change be implimented in message headers such that sites who don't wish to carry such material can filter it, along with this should be a requirement that any such non- crptographicly secure material must contain a fair use policy at the beginning of each and every document. It is time we quite letting big brother tell us what we can do with our ideas and how to distribute them.

1 0

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Perry Metzger wrote, "Tapping Netcom's net connections would take more than $20 of effort. Up it to $50,000 and I'll happily take on your offer. However, I am going to need assurances that the money will actually be paid." This is exactly the point I was trying to make. I wanted the word "trivial" to be clarified by those who were being so vocal about dismissing a remailer on Netcom. You'll also need a good lawyer when Netcom finds your tap ;-). But I'm sure some skilled hacker will be able to tell me the site and I'll happily be out $20, in say, a couple days? No use hacking my password, as I keep no logs (for now). The reason it's only $20, is that I am indeed honestly interested in knowing something about my remailer's security, and I don't know enough internet/Unix to risk being a total sucker. -Xenon

2 1

Re: New remailer up.
by lefty＠apple.com 17 Dec '03

17 Dec '03

>Tapping Netcom's net connections would take more than $20 of effort. >Up it to $50,000 and I'll happily take on your offer. However, I am >going to need assurances that the money will actually be paid. Oh, very, _very_ impressive. Hey, Xenon, _I'll_ do it for only $47,500, but I'll need 50% up front. "Oh, I don't mind a parasite; it's a _cut-rate_ one I object to..." -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

unsubscribe
by bgold＠tlcnet.aps.muohio.edu 17 Dec '03

17 Dec '03

please unsubscribe me from the list Thanks

1 0

Re: SASE Suggestion
by loki＠nately.UCSD.EDU 17 Dec '03

17 Dec '03

:Lance Cottrell writes: : :> I have been meditating on this problem of return :> addresses, and have a proposal. The remailers :> can not be allowed to choose the return path, :> as any corrupted remailer will corrupt the rest :> of the path. : Jim Miller writes: :As I understand it, the remailers don't "chose" the return path, Bob (the :sender of the original message) choses the return path when he creates the :SASE. All the remailers do is interpret the part of the SASE that becomes :readable to them after decrypting the SASE portion sent to them from the :previous hop. If all is working, what becomes readable is the address of :the next hop (closer to Bob) and some misc other stuff (postage, maybe, :and perhaps another encryption key). : :Am I not understanding something correctly? : :Jim_Miller@suite.com : One SASE scheme recently suggested involved sending a request for a SASE to a ramailer, stating the number of jumps required. It then sent it to another remailer, and so on. Each adding a layer, and eventually sending the results to the desired correspondent. I mentioned that if the first remailer was corrupted, that the whole chain was (it would only send to other corrupt remailers). ---------------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.3 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Perry wrote, "However, make no mistake that Netcom can and will cooperate with the police if you use your remailer in a way that the government doesn't like, so it seems that the security afforded isn't that good." So you aren't interested unless you can commit serious felony crimes using a given remailer? I would be happy if criminals stayed away from my remailer. What do you mean by "security"? And if the police find out a personally owned machine was involved, I couldn't imagine them not just swooping in at midnight and taking it away at gunpoint. I hope those privately owned machines don't have logs ;-). In my mind, the whole secret to gaining privacy is not attracting attention in the first place. Using a remailer DOES allow a person to communicate anonymously with someone else, in two directions. If a party has enough power to tap Netcom, then sendmail logs or no sendmail logs, they will find you. and, "Besides, $20 is a paltry sum for the amount of work involved." Think of it as a trophy, which I'm sure most understood. I'm not offering you a job. I appreciate your view though, and since I've posted a request for remailer comments, might you help us all and send me some comments about the various remailers and what types of security each affords? If some wish to use remailers for serious underground activity, which should they use or not use? If they just want to keep bounced mail from telling their system postmaster who they're talking to, then that's a different type of security need. -Xenon

4 3

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Sure, a vanilla user at netcom probably can't track the remailer logs, unless of course there are BUGS in SENDMAIL (gasp!) or SunOS or whatever. But remailers aren't just to keep random users from knowing who you are so you can post better anonymous letters to alt.sex.anonymous. At least some of us would like real privacy, and consider remailers a useful part of this, and this means that if you're using remailers to communicate with your sources for the newspaper article you're writing on the CIA's cocaine delivery shortfalls or the NSA/Trilateralist designs for the National Health Care ID Card or your mayor's child pornography habits, that nobody can track you or your sources down easily. That means that root(a)netcom.com can't do it using the root password, even if they want to comply with the subpoena, and the Secret Service can't do it after confiscating netcom's machines or wiretapping their phones. Non-encrypting remailers can never really get that good, but they can at least d part of the job, and encrypting remailer networks may get that good if there's enough traffic through the system. So meanwhile, are you giving root(a)netcom.com permission to try to identify the source of your mail and win the $20 for finding out whether you're really Xenon or you're really L.D.'s evil twin Skippy? (No idea if they'll try, or if they're even listening....) - Radon

1 0

Josh Quittner`s Newsday c
by Duncan Frissell 17 Dec '03

17 Dec '03

Welcome to new lurkers (if any) from our recent NYT and Newsday publicity. To give you something a little more interesting than "Is Usenet in the Public Domain?" to read, here is my response to Joshua Quittner's column in Newsday. >Tuesday, 01 February 1994 > >CODING UP A BIT OF PRIVACY > >Time is running out for the Cypherpunks. Actually we have all the time in the world. One cannot build a New Information Infrastructure without including the tools that anyone can use to communicate privately. >This is their central question: In a future world where all information >is centralized on a network, where all information is tracked by the bit, >where every purchase you make and every communication can be monitored by >corporate America, how does privacy survive? More of a problem in the past than in the future. When P.J. O'Rourke had lived in a small New Hampshire town for a year or so and went to the store to shop for some clothes the clerk remarked, "That's not the brand of underwear you usually buy." One's life was more of an open book in the village and the tribe than it will be in the electronic village. Particularly since you can build private networks/"places" that exclude anyone you want. >"The whole information highway thing is now part of the public eye," >explain Eric Hughes, a founder of the Cypherpunk movement. "If we don't >change it now, it'll be impossible later." Misquote? It's usually better to do the job early than late but the nature of network communications is such that it's hard to control at any time. >They dread the coming commercial network of televisions and computers, >saying it will displace the Internet and destroy many of the freedoms they >now enjoy. Surely not the anarcho capitalists who probably represent a majority of active cypherpunks. >For the first time, virtually unbreakable codes are now possible, thanks to >computers. I won't say it. Certainly computers make it easier to *use* encryption. >The the U.S. government is concerned, as governments always are, about >the spread of powerful cryptography (terrorists could use it, kidnappers >could use it, drug dealers could use it, Communications intercepts are rarely used to prosecute crimes. >The (Clipper) chip is reviled by Cypherpunks and other civil libertarians >because it provides a back door that law-enforcement agencies could enter, >with the proper warrants, for surveillance. Warrants not required, just a certification that the law enforcement agency has proper authority to do a communications intercept. >"I'm starting a bank, and it's not going to be a U.S. bank," Hughes >says. >The bank will store depositors' money (he's thinking a $200 minimum >deposit) and disburse payments to anyone --- all over the Internet. It >will be based abroad, maybe in Mexico. Where did Mexico come from? >A Cypherpunk network bank is one way to pay for a network of truly >encrypted, private communications, you see. Along with lots of other nice things. Computers have been killing traditional banks for years (ever since they enabled the creation of Money Market Funds in the '70s). Netbank (and its many competitors) will continue the process. *********** Duncan Frissell You don't have to be nice to nation states you meet on the way up if you're not coming back down. --- WinQwk 2.0b#1165

1 0