December 2003 - cypherpunks-legacy

Anonymous mail servers?
by analyst＠netcom.com 17 Dec '03

17 Dec '03

Are there any anonymous mail<-->ftp servers around? I am thinking specifically about people getting pgp and other (soon to be contraband?) cypherpunks tools. It would be nice if there were a server for at least these items. I suppose you would send an appropriately composed message with a body consisting of the request and an anonymous return address preceded by the anonymous address of the server. Has this already been done? Blacknet, if it exists, works like this doesn't it? Where are the BlackNet access instructions? ------------------------------------------------------------------------------ Benjamin McLemore analyst(a)netcom.com --

1 0

Re: Subscriber encapsulation
by ferguson＠icm1.icp.net 17 Dec '03

17 Dec '03

> >> systems' to solve all sorts of sticky problems, but none have ever > > >ideal anonymous environment is a GOO THING (tm)). Anon mail from > > Is a GOO THING the solution to a sticky problem? Absolutely. Remeber "Vinegar and Honey..." Remember "Medusa, The Executioner and (now) The Pervert?" Lions and tigers and bears (oh my).... - Paul

1 0

Mon Dieu!
by an53310＠anon.penet.fi 17 Dec '03

17 Dec '03

In re: L. Detweiler What manner of puling, wretched clericalist is this, this Perverted Excutioner, driving us bold revolutionaries to distraction? Verily, I urge you to screen his vileness from yourselves rather than give him treat; a cur such as he should be cut off, not entertained by our work of words. Nor should he or his minions be given entrance to our forum; were this a public square, (tho I dearly love to ride him forth on a rail) he could rant as he pleases, but he is fouling our parlor and drives forth newcomers who have not learned to ignore this stinking, drooling idiot in the corner covered in suppurating sores, screaming about conspiracies and evildoings imagined in madness or opium dreams. Aye, I would call him out, I would, had I not learned better in years gone by... ++ ++ Evariste Galois ++ L'Ecole Polytechnique ++ ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

CHAOS gopher maintenance
by ferguson＠icm1.icp.net 17 Dec '03

17 Dec '03

Who's in charge of the chaos.bsu.edu gopher? I was just browsing the contents and it is not very up-to-date with cypherpunk information... - Paul

2 1

Long Litanies of Lies
by L. Detweiler 17 Dec '03

17 Dec '03

Hello again. I just wanted to talk about the idea of pseudospoofing `crossings'. It seems to me that people who are rampant pseudospoofers have built up a life of fear and paranoia. They are always posing the question, What if I say this? Will it reveal my identity? There is so much information that we have flitting through our brains, and it is impossible to track where it originated from. It invariably blurs! I mean, if I talk to someone with my tentacle, and he says that he is proud that his wife is going to have a baby, and then I meet him in person and say `Congratulations' out of good wishes, he says, `how did you know I was going to have a baby?' and the pseudospoofer has to work himself out of another uncomfortable rock-and-hard place. Imagine having to hesitate like a liar to say *anything* or answer *any* question you are ever asked. What pernicious, sweaty, hellish torture! I have information from G.Broiles (a tentacle? hee, hee) and others that top cypherpunks, E.Hughes in particular, have developed pseudospoofing and style analysis software. If so, I think this is somewhat pathetic. I mean, think of all the time they are wasting trying to keep track of who said what, and what who knows about what, and what they can and can't say at a given time. Good lord! If everyone had to do this all the time, we would collapse in a nervous breakdown. It's really pathetic that anyone would call so much extra overhead baggage `Liberating'. Why would anyone go through so much trouble to promote a lie? The answer is that they are not honest! `Power over their victims' I mean, is this really Communication? Respect for one's peers and colleages? Seems more like AntiCommunication to me. It's interesting that the idea `community' and `communication' have the same root. No coincidence there! If you don't have one, you don't have the other! But many psychopunks recognize this already, and this is why they continually searingly rant against any kind of Community, like a Government or a Democracy or a Meeting. Pseudospoofing reminds me of the way that criminals justify their crimes in the face of every clue and signal that is screaming at them at the top of its lungs to stop betraying themselves and their friends and cease with their depravity. A heroin junkie could have an arm full of collapsed veins, lost his home, his family, his honesty, his money, his dignity, his sanity, his life. And to the end he will say I Must Have My Heroin. But pseudospoofers are masters at their kind of systematic manipulation. They enjoy it, they thrive on it, it is their vicarious sexual thrill. It is like a chess game involving different pieces and scenarios and positions and attacks and countermeasures and feints and .... What does my opponent know about this tentacle? Does he really trust it? I think every pseudospoofer is something of a pathological liar at heart. He enjoys weaving complex scenarios and keeping track of what he said to who, and how to make sure that no one walks into each other or any of his long litany lies collide with each other in a `crossing'. But My Gosh, Cyberspace is inherently unconducive to concealing the truth where people want to find it. There are just too many myriads of possibilities for arbitrary crossings between independent identities and opportunities for honest people to discover the truth in the face of lies. Who is Inside? Who is Outside? A conspiracy will always collapse under its own weight. The only question is, who will be crushed beneath it? (That reminds me of that story about the Zen of Cyberspace, where a corrupt king dies and a platform carried by his sycophants crushes them. I have it somewhere in my extensive archives if anyone is interested.) It is like the RSA key spoofing trick -- you might be able to send someone a fake key, but then they go to communicate with their party over a random line anywhere in cyberspace (the IP protocol means that different packets may take different paths at different times, the beauty of robust fault-tolerant routing) and suddenly the recipient realizes from the gibberish that he has been pseudospoofed. You might be able to keep up a deception at first, but suddenly some independent channel is touched by your target that you have no control over, and the whole illusion collapses. The biggest problem with pseudospoofing, deception, and lies in Cyberspace is when a climate arises wherein people are not skeptical by nature, even though they claim they are. For example, many people have told me that they are sure they have never signed a fake key, or used one, of a person that does not exist. But my own experience with others and the key server design would seem to contradict this. Top developers seem to defend, even delight and revel in the `toxic waste' in the PGP Web of Trust. Today's key servers are quite corrupted with fake keys, many of them from the Cypherpunk pseudospoofer cultists. So people think that this `web of trust' is actually trustworthy when it is just a `web of lies'. The problem is that they do nothing *actively* to seek out fake identities and corruptions in the Web, even when encouraged to do so. If everyone passively accepts a Lie, and someone actively continues to orchestrate it, the Lie Stands. Once again, a great new technology exposes the human weakness that lay largely obscured before its invention, in this case the inherent laziness and gullibility of people. This Cypherpunks list is a classic case where people can continue to believe in a lie despite many signs that there is a deception going on. It involves the magnetic, powerful effect of peer pressure. If all your friends do drugs, you believe it is a Liberating Experience unequivocally. Faith replaces Knowledge. If your eminent leaders say that pseudospoofing is a Liberating Experience, you believe it. After all, they were profiled in NYT and Wired! Who are we to question their authority? In an environment (the Internet) where the default expectation should be that *everyone* is a tentacle, because nothing prevents it, everyone to the contrary believes that everyone is real! This illusion of reality in cyberspace is very hard to dispell, even though people claim they cannot ever be fooled! The problem is that lies can sometimes pick up their own destructive momentum, like a snowball rolling down a hill. People can begin to believe in fantasies, like a meme-virus propagating like a toppled line of dominos, like a crowd that turns riotous with a few circulating shouts. However, sometimes the Truth erupts amidst the lies in the same way! By the way, I still haven't heard anything from J.Gilmore, E.Hughes, or T.C.May on their personal knowledge of pseudospoofing on the Cypherpunks list. E.Hughes wrote something in RISKS but it seems evasive to me (more on this later). I would appreciate if you guys or someone else could send me your public statement on pseudoanonymity in email. Many people have been talking about all the anarchy, dischord and disunity on the list lately, and maybe a public statement by a cypherpunk `official' would help stop all the rampant speculation and fingerpointing. That is usually the respectable approach among any professional organization! (That reminds me of P.Metzger complaining that `Cypherpunks' was just too darn subversive sounding as a name! ROFL) I have to wonder what you guys are really trying to accomplish without public announcements, and why one has been so long unforthcoming! Kind of reminds me of a big conspiracy or hoax! If you flinch and cower every time your leadership and `movement' are subject to scrutiny people will think you're nothing but a batch of liars, or pseudospoofers (the difference is not great). In fact, maybe a ban against pseudospoofing might rescue the list from the hellish ulterior grouchiness and atmosphere of noise and frustration that it has always had in the past and scared away a lot of respectable people (for example, Markoff). But that's an awful lot to hope for. On the other hand, the CryptoAnarchists have always come out in favor of Anarchy, of course, and maybe the recent violent seizures on the list, the continual tick-tick-ticking torture of the time bomb, are what they have in mind.

1 0

Cryptosplit 2.0
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

On Colin Plumb's suggestion, I rewrote my first Shamir secret sharing program to work over GF(2^8). I didn't do this the first time because I thought writing all the low level GF math routines would be a pain -- so I opted out by using G++'s Integer class to work over Z_p. Imagine my surprise when it turned out the math code over GF is easier. The hard part was actually generating the tables for x=g^n and n=lg x (g=primitive element), but I got maple to do it for me after I read the docs. Multiplication is simply the macro A*B=g^(lg A + lg B) (3 table lookups) and addition is, of course, XOR. And x^-1 is just two table lookups unlike the euclidean algorithm I needed to work over Z_p. (p being huge) Since I'm working over GF(2^8), I adapted my program to work on arbitrary length binary files instead of integers. Now you can take any file and split it up into m pieces, k being needed for reconstruction. The program is much more usable now. It's also written in C now, not G++. As before, if you want it, e-mail me. -Ray -- Ray Cromwell | Engineering is the implementation of science; -- -- rjc(a)gnu.ai.mit.edu | politics is the implementation of faith. --

1 0

Software filtering agents
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

My knowledge of neural net software is limited to a cartoonish understanding of the theory behind them, but as I understand it they might be a useful tool for identifying the author of a given text stream. Comments? Anyone on the list familiar with neural net implementation, or in need of some sort of academic project? :) -- Greg Broiles greg(a)goldenbear.com Baked, not fried.

2 1

"Pretty Good Paranoia" and "Dining Detweilers Net"
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Pseudospoofer Wannabees, Are you unable to pseudospoof the way The Pervert can? Do you find yourself using your True Name instead of a wonderful nym like The Executioner or Psychopunk? Well, now there's hope. After buying our product, "Pretty Good Paranoia," you too will be able to indulge in florid flights of fracturous fantasy, constructing long, rambling missive like this: "My tortured and WRACKED soul is becoming INCREASINGLY MADDENED AND DISGUSTED by the unspeakable actions of the leading SickoPunks in beaming RADIO SIGNALS into my cranial cavities while I dream of slaying Miss Medusa and her TENTACLES of depravity and cyberspatial indifference." Yes, you can _own_ the computer program that generated this stupendous piece of prose. Fool your friends, amaze your enemies. Send 620 digital marks to "Paranoids 'R Us," Box 666, Boulder, CO, 12070. Offer not good in Sector R. As a special bonus you'll all receive instructions on how to implement your own "DD-Net." Based loosely on David Chaum's DC-Net, in the "Dining Detweiler Net" each player flips a coin. Heads, he barfs on his neighbor to the right, tails, he just sits there and drools. A great time will be had by all. Not. --Klaus! von Future Prime (My nom de humor on the Extropians list.)

1 0

On Hypocrisy, Stoning, and Forgiveness
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

There is a saying, `let he who is without sin cast the first stone.' Some people have perverted this saying to their own ends, as many people have done with the teachings of the enlightened saint and god-among-men Jesus Christ. Some people believe that this means that one should never attempt to uncover other's faults, and prod them into reforming their behavior. Nothing could be a greater lie. The context of the quote was that a riotous crowd was about to kill a man for his sins, by public stoning. `Let he who is without sin cast the first stone.' But notice that the public was not asking the man to reform himself or repent. They had already made up their mind. There would be no forgiveness. They had judged him, and his sentence was Execution. What about in the context where a crowd has *not* decided upon their Judgement for a crime? They know that someone is guilty of it, but they have not yet committed to stoning them, forgiving them, or even being upset, or whatever. What is the meaning of the saying there? The saying is meaningless in this context. It is like division by zero. Undefined. So, it is either, in punishment `let he who is without sin cast the first stone.' In forgiveness, it is `let he who is with sin cast the first confession.' Another concept At Stake is that of Reputation in accusation. If a criminal is correctly called a criminal by a hypocrite, who is the criminal? who is the hypocrite? The answer is that the criminal is accountable for his criminality and the hypocrite is accountable for his hypocrisy. But it is not the case that the hypocrite's hypocrisy nullifies the criminal's criminality, of course. Also, if a criminal calls an honest person a hypocrite in an attempt to discredit him, it is just another Lie and another black mark on the criminal. That's the situation with criminals, is they like to dig holes and drag down and bury as many other people they can in the process. Finally, regarding hypocrisy, a great many people are attempting to discredit one or the other of L.Detweiler or S.Boxx by flimsy, incorrect `proofs' that L.Detweiler == S.Boxx. Uh, who gives a damn? Please redirect your analytical energies into resolving far more interesting and nontrivial theorems like E.Hughes == P.Ferguson or T.C.May == H.Finney. We now return to our regularly scheduled program. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

please remove me from the list
by hblau＠cs.cuhk.hk 17 Dec '03

17 Dec '03

Dear System Admin, Please remove me from the mailing list. The group are helpful and rich!! Thank you! H.B. Lau

1 0

Re: newsgroup v news-list
by Jim choate 17 Dec '03

17 Dec '03

> > You're a little new to the list for all the text you're generating. If you'd > wait about a month, you'd see all of your questions answered, examples of > situations that would match or disprove most of your assumptions, and many > many examples of the sort of thing that Detweiler is lobbing into the list. > > Everyone has different ideas of what the list is about and for. When the fol ks > who've been on it for more than a year can't agree on what it's about, it's > irritating to have a new person spout off their opinion on the matter. > > I imagine some folks have given you some indication of Detweiler's history, b ut > in case they haven't given you the complete flavor, let me add my two cents: > imagine a true paranoic with the DTs from alcohol withdrawal locked into a > room with a terminal... Every stray impulse that crosses his mind causes a > flurry of keystrokes to make the pink spiders go away... > > The guy is far enough gone that we're not really talking about censorship -- > any more than dealing with a crank phone caller is censorship. He's > dripping vitriol, not opinion. > > -Bill > Why should how long I have been on the list have anything to do with what I can contribute? Why should I wait a month to figure it out experimentaly when I can ask a couple of questions now, race up the learning curve, and move on to othe more important agendas. We are talking about limiting access to the list (for whatever reason), THAT is cencorship. I personaly find the idea that a person has to 'earn' the right to make a statement on a mail-list or newsgroup as counter-free speech. I oppose your view. How long have you been playing w/ computers? Maby you haven't been doing it long enough to make posts either....

2 1

wassup?
by Barbara L Marco 17 Dec '03

17 Dec '03

Hey, can ya'll send me some info on ya'lls organization? Thanks.

1 0

RISKS DIGEST 15.27 (fwd)
by Anonymous 17 Dec '03

17 Dec '03

Let's review: Newsgroups: comp.risks Subject: RISKS DIGEST 15.27 Date: 16 Nov 93 17:19:19 GMT Reply-To: risks(a)csl.sri.com RISKS-LIST: RISKS-FORUM Digest Tuesday 17 November 1993 Volume 15 : Issue 27 FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator Contents: Re: The Snakes of Medusa and Cyberspace (mathew, Alex Glockner, Perry E. Metzger, Jamie Dinkelacker, Arthur Abraham, Peter Leppik, Brad Hicks, Neil McKellar, Leonard Mignerey, L. Detweiler) The RISKS Forum is a moderated digest discussing risks; comp.risks is its USENET counterpart. Undigestifiers are available throughout the Internet, but not from RISKS. Contributions should be relevant, sound, in good taste, objective, cogent, coherent, concise, and nonrepetitious. Diversity is welcome. CONTRIBUTIONS to risks(a)csl.sri.com, with appropriate, substantive "Subject:" line. Others may be ignored! Contributions will not be ACKed. The load is too great. **PLEASE** INCLUDE YOUR NAME & INTERNET FROM: ADDRESS, especially .UUCP folks. PLEASE SEND REQUESTS FOR SUBSCRIPTIONS, archive problems, and other information to risks-request(a)csl.sri.com (not automated). BITNET users may subscribe via your favorite LISTSERV: "SUBSCRIBE RISKS". Vol i issue j, type "FTP CRVAX.SRI.COM<CR>login anonymous<CR>AnyNonNullPW<CR> CD RISKS:<CR>GET RISKS-i.j<CR>" (where i=1 to 15, j always TWO digits). Vol i summaries in j=00; "dir risks-*.*<CR>" gives directory; "bye<CR>" logs out. The COLON in "CD RISKS:" is essential. "CRVAX.SRI.COM" = "128.18.10.1". <CR>=CarriageReturn; FTPs may differ; UNIX prompts for username, password. There are also alternative repositories, such as bitftp(a)pucc.Princeton.EDU . If you are interested in receiving RISKS via fax, please send E-mail to risks-fax(a)vortex.com, phone +1 (818) 225-2800, or fax +1 (818) 225-7203 for information regarding fax delivery. PLEASE DO NOT USE THOSE NUMBERS FOR GENERAL RISKS COMMUNICATIONS; instead, as a last resort you may try phone PGN at +1 (415) 859-2375 if you cannot E-mail risks-request(a)CSL.SRI.COM . ALL CONTRIBUTIONS CONSIDERED AS PERSONAL COMMENTS; USUAL DISCLAIMERS APPLY. Relevant contributions may appear in the RISKS section of regular issues of ACM SIGSOFT's SOFTWARE ENGINEERING NOTES, unless you state otherwise. ---------------------------------------------------------------------- Date: 11 Nov 1993 12:13:34 -0000 From: mathew(a)mantis.co.uk (mathew) Subject: Re: The Snakes of Medusa and Cyberspace (RISKS-15.25) "L. Detweiler" <ld231782(a)longs.lance.colostate.edu> writes at length about the evils of what he calls "pseudoanonymous posting". I shall try to keep this reply brief. I am interested not only in the issue of pseudonymity, but in the structure of Detweiler's allegations. His posting appears to me to be an artfully crafted conspiracy theory. He begins by defining "pseudoanonymously": >`Pseudoanonymously' -- the message identification is of a `fake' identity, a >person that does not exist despite the implicit indications of the message >(such as a signature with a realistic name, including a phone number, etc.) He notes that pseudoanonymous postings are active deception, rather than passive concealment of identity, and points out that he could set up a pseudonymous account for the purpose of fooling people into thinking that the pseudonym was a different person. Pardon me, but what on earth does this have to do with RISKS? The practice of publishing under a pseudonym has been common for centuries; ironically, Detweiler himself quotes "Shakespeare", believed by many to be a pseudonym. He does on to hypothesize that people might be less wary of pseudonymous identities they don't recognize than they are of anonymous ones; he talks of megalomaniacs stalking the net. Well, if I see someone post to the net under a name I don't recognize -- like (say) L. Detweiler -- then I assign that person (whom I don't know) exactly the same probability of being a megalomaniac as I assign an anonymous user I don't know. Perhaps even a higher probability, as what megalomaniac would wish to remain *anonymous*? Detweiler then points out that a user could post messages under a pseudonym, complimenting himself. Again, this is nothing new. Authors have been known to review their own books, written under pseudonyms; or to write letters to newspapers criticizing themselves. Detweiler claims that public use of pseudonyms is often "dishonest, immoral, and unethical"; he demands that "others should be informed if it is occurring". Well, I hereby inform everyone that it is occurring, and has occurred for centuries, and will carry on occurring. It is not a new risk brought in by technology. Perhaps the problem is that people have got used to the Internet being restricted to institutionalized settings, where user accounts are numbered, and verified to be unique by some central authority. As the Internet spreads into the real world, so the real-world practice of pseudonymity will inevitably spread into the Internet. When everyone has a computer, everyone can have a pseudonym; just as anyone with a pen and paper can develop a real-world pseudonym. Detweiler next moves on to consider the use of pseudonyms in private communication. This, again, is nothing new. Look at the "Henry Root" letters (or "The Lazlo Letters"), Victor Lewis-Smith's crank phone calls, or any of thousands of similar examples. He complains that digital signatures do not solve the problem; unfortunately, he seems to be under the mistaken impression that written signatures are better. In fact, it is quite possible for a person to have multiple handwritten signatures. Then, he moves on to what he calls the "dangerous, insideous [sic], and treacherous" uses of pseudonyms. He gives an example of an anarchist organization using pseudonyms to aid the destabilization of governments, democracy, law enforcement, and so on. Every good conspiracy must have a secret enemy trying to destroy the world. He speaks of carefully-guarded mailing lists and secret societies, and explains that the anarchists could send spoof communications to public addresses, magazines, and the like. I hate to sound repetitive, but again, this threat is nothing new. Look at the spoof "LSD tattoo" announcements purporting to come from police officers, or the pranks played against government departments. Consider campaigners who write multiple letters under pseudonyms to send to politicians. Detweiler then goes even further, talking about "pseudospoofers" as using "brainwashing and an illusion of peer pressure to manipulate unknowing subscribers", with campaigns of "mental assault" to attack doubters. Of course, sinister mind-control techniques are a classic part of any conspiracy theory. Next comes the masterstroke. He explains that the secret pseudospoofer cabal would attack people like him by "disparaging, discouraging and discrediting them publicly and privately as 'paranoid ranters' and 'conspiracy theorists'". So now anyone who criticizes his position is instantly One Of Them, a venomous snake who cannot be trusted, and further evidence of the Great Conspiracy. He suggests that they "might even be able to make a real-world pariah from simulated ire and criticism directed at a single strong opponent, say, L. Detweiler, from many simulated identities in cyberspace". Thus, he hopes, everyone who replies to RISKS criticizing his bizarre fears will become another piece of evidence in his favour. He finishes off by suggesting that the evil pseudospoofers might already be infiltrating public mailing lists, discussion lists concerning email and security software, network administrators' mailing lists, CERT, the DNS databases, and so on. He likens pseudospoofing to a virus infecting the Internet. Again, like most conspiracy theories, the picture painted is one of an insidious threat which has already subverted our most cherished institutions! I'm sorry if this seems impolite, but the entire article seems to me to be 10% misconceptions and 90% pure conspiracy theory. (Oh no! Mathew is One Of Them!) I find such things amusing, but I for one would appreciate it if this sort of nonsense was kept out of RISKS in future. mathew ------------------------------ Date: Thu, 11 Nov 93 14:37:22 EST From: Alex Glockner <glockner(a)cosc.bsu.umd.edu> Subject: Re: Pseudospoofing (RISKS-15.25) While I should be grateful to L. Detweiler for reminding us of the possibility of pseudospoofing on the Internet (sidenote: his anonymity FAQ makes for great reading...), we should also remember that this is `just another' case of network problems that have always existed `out there in the real world'. The RTC (the US-sponsored agency that is responsible for selling off assets of failed Savings and Loan institutions) recently sold a beachfront property to the Audubon Society, a large US environmental group, which in cooperation with a developer would create a preserve from the property. Whoops. Turns out it wasn't the environmental group -- officially, the National Audubon Society incorporated in New York State -- but a group, allegedly associated with the original failed developer, that chose to register in another state with the name "Audubon Society". If the allegation is correct, the developer saved a lot of money from the original purchase price this way... (My apologies for the lack of a citation; this appeared in the Washington Post in October 1993) |> ... These are related to the potential of waging a systematic campaign of |> propaganda, disinformation, or brainwashing unleashed on an unsuspecting |> public by a subversive organization. In American politics, we call this `lobbying'. Any number of groups are misleadingly named and directed to achieve an agenda (*which* groups, of course, depend on your own beliefs, so I won't try to name any). The fact is that most (all?) states have rules that you can choose any name (or more to the point, *names*) that you want as long as 1) the state cannot prove that it is in the public interest to deny your name change or 2) you are not intending to defraud anyone or escape legal obligations. Stage names and pen names are also long-established instances of this, also. Pseudospoofing isn't anything new; it's just a new guise of something thousands of years old...what's the first C program everybody writes? "hello, world"? :-) Alexander Glockner, Asst. Professor, Dept. of Computer Science, Bowie State University Bowie MD 20715 (301) 464-6609 glockner(a)cosc.bsu.umd.edu ------------------------------ Date: Thu, 11 Nov 93 20:36:23 EST From: pmetzger(a)lehman.com (Perry E. Metzger) Subject: The Perils of Pseudospoofing (Detweiler, RISKS-15.25) I was amused to see that the article contained an elaborate, and amusingly paranoid, scenario, that describes, thinly veiled, the way that Mr. Detweiler apparently thinks that the "Cypherpunks" mailing list operates. "Cypherpunks" is an informal group of privacy and cryptography advocates -- the lists members include such varied individuals as Phil Zimmerman (the author of PGP), Mike Godwin of EFF, John Gilmore, Phil Karn, a gentleman from CPSR who's name I forget, and other fairly illustrious crusaders for privacy and personal data security in the digital age. Some members of the list are radical libertarians such as myself, who often point out (with some glee) that cryptographic techniques, which are essentially unstoppable because even high school students can now implement extremely secure cipher systems, will likely ultimately eliminate the capacity of the government and others to nose in where they do not belong. With this introduction, I will explain what has happened: Mr. Detweiler has apparently decided that many members of the group are in fact the same person (posting under multiple identities) and that the entire mailing list is a monstrous plot to undermine Truth, Justice, and The American Way. The allegation that most of the mailing lists members are identical is bizarre -- anyone is free to check for themselves that people like Tim May, Eric Hughes, and others are real people. However, Mr. Detweiler became convinced that because so many people disliked his rantings on the list that they all had to, in fact, be the same person. I suppose the notion that more than one person might disagree with him did not cross his mind. I am not a qualified psychiatrist and do not pretend to be one, but I do know paranoid delusions when I see them. As an example: >The CryptoAnarchists might even be able to make a real-world pariah from >simulated ire and criticism directed at a single strong opponent, ... I suppose it never occurred to Mr. Detweiler that he could simply look up folks like Eric Hughes (whom I believe lives in Berkeley), Tim May (whom I believe lives in Aptos, CA), and others, and verify that they exist and have differing voices and the like. However, people who are suffering from insane fantasies rarely bother to listen if people tell them that they have insane fantasies. The following paragraph speaks for itself: >In fact, the CryptoAnarchists might even infiltrate sensitive internal mailing >lists like those maintained by CERT (Computer Emergency Response Team). ... Perry Metzger ------------------------------ Date: Thu, 11 Nov 1993 01:45:05 -0800 From: jamie(a)netcom.com (Jamie Dinkelacker) Subject: Personal Singularity In a recent Cypherpunk post, the venerated individual E.Hughes suggested individuals make themselves known, and mention L.Detweiler's amorphous post to .risks. First, I'm honored to be mentioned along with May, Szabo, Finney, Hughes, ... indeed, fine company these electrons keep! Jamie Dinkelacker is in fact and in blood an independent individual, living in Silicon Valley, who is finding profit from all the attention he's getting. He goes so far as to post his phone number for people who would care to call and offer consulting contracts for marketing management in the Bay Area. More to the point: Jamie Dinkelacker is the only name I've used posting on the net. Does Detweiler truly exist as an individual? Can anyone attest to his existence as separate from S.Boxx, Jim Riverman, David Sternlight? Who'll take a stand on his behalf? Jamie Dinkelacker Palo Alto CA Jamie(a)netcom.com 415.941.4782 ------------------------------ Date: Thu, 11 Nov 93 15:14:39 -0800 From: a2(a)ah.com (Arthur Abraham) Subject: "L. Detweiler"'s single personality problem I would like to attest from personal knowledge that the following personalities each emanate from a separate flesh and blood person: G.Broiles, A.Chandler, J.Dinkelacker, H.Finney, E.Hughes, M.Landry, T.C.May, N.Szabo I myself emanate from yet another flesh and blood person. I have communicated with "L. Detweiler" in the past, and have frequently been amazed by his postings. His/her decline in the past month or two has been somewhat disturbing. It seems to illustrate how it is occasionally possible for strongly held positions, that seem to rely on an slightly unbalanced view of the world, to actually originate in unbalanced minds. ------------------------------ Date: 15 Nov 1993 20:27:55 GMT From: leppik(a)uxa.cso.uiuc.edu (leppik peter) Subject: Re: pseudospoofing (RISKS-15.25) IMHO, I fail to see the real "risk" in pseudospoofing. Keep in mind that such famous people as Mark Twain and Marilyn Monroe never actually existed (they were "pseudospoofed," as it were, by Samuel Clemens, and Norma Jean, respectively). The only possible risk that exists is if people lose their perspective, and forget the distinction between the network and the real world. Beyond that, the use of realistic-sounding nom-de-plumes for various reasons is a long and time-honored tradition. I see no reason why it should stop merely because the medium has become modulated electric fields, rather than ink and paper. (Did William Shakespeare really exist? Some people with nothing better to do still argue about this question....) Peter Leppik-- p-leppi(a)uiuc.edu If people have a hard time understanding General Relativity, what makes us think computers will do any better? ------------------------------ Date: 15 Nov 93 21:11:08 GMT From: mc/G=Brad/S=Hicks/OU1=0205925(a)mhs.attmail.com Subject: Re: Snakes of Medusa and Cyberspace (RISKS-15.25) "If your best friend jumped off of a cliff, would you? Did your mother ask you this? Every four years, lemmings jump off of cliffs. There are no five-year-old lemmings ... unless they've learned to think for themselves." - recent TV ad for radio KPNT 105.7 FM, St. Genevieve/St. Louis, MO OK, by now everybody knows that the lemmings story is a fake, but it's still a potent metaphor, and a relevant one to any discussion of what Mr. L. Deitweiler has termed "pseudospoofing." (Does Mr. Deitweiler exist? In my experience, most real people have first names.) For those of you who've just subscribed, "pseudospoofing" is the use of "spoofed" SMTP mail connections, multiple anonymous mail servers, or other techniques to enable one person to send e-mail messages appearing to be from multiple people. And if you missed Mr. Deitweiler's previous jeremiads, you might not know that this idea scares the water out of him. For example, consider this paragraph from the introduction to his latest lengthy posting on the subject, this one on RISKS Forum Digest, volume 15 issue 25, 10 Nov 1993: > ... These are related to the potential of waging a systematic campaign > of propaganda, disinformation, or brainwashing unleashed on an > unsuspecting public by a subversive organization. Propaganda? I'll answer to that charge myself; I write propaganda for a small not-for-profit educational organization ... if you'll allow me to define propaganda as anything intended to influence people's opinions. (When I do it, it's a forceful essay. When you do it, it's called spin doctoring. When somebody we both think is "evil" does it, it's called propaganda.) But the warnings of disinformation and brainwashing are something else altogether. Not for nothing did David Brin in his novel _Earth_ refer to a UseNet-like system as "the Net of a million lies." All manner of lies have appeared on the Net, from the US government's facile attempt to persuade us that Clipper is a harmless alternative to existing systems and won't be mandatory, to a recent (wonderfully funny) hoax having to do with modem taxes, that fooled even net veterans like Pat Townson of Telecom Digest. But does pseudospoofing make it easier to lie successfully via the Net? If I post a message here that says that I've met J. R. "Bob" Dobbs, and he really exists, will you believe me? Of course not; you know that I don't live in Dallas. (weak grin) You also know, by now, that J. R. "Bob" Dobbs is a myth built around a piece of 1950s clip art, and exists only in the same mystical realm as Santa Claus, Lazarus Long, the Easter Bunny, the World-Wide Satanic Conspiracy, John Galt, the Risen Lord Jesus Christ, the Tooth Fairy, and Wise and Benevolent Government. And you're not going to change your mind on the existence or non-existence of any of these things just because I, or anybody on the Net, told you otherwise. Would you change your mind if ten people on the Net told you so? A hundred? A thousand? Mr. Deitweiler has written that if I were to create (let us say) a hundred and twenty three alternate (fake) net.identities, and each of them sent him mail telling him that black was really white, that he would be in imminent danger of dying at the next zebra crossing. He calls this process "brainwashing." To compare pseudospoofed argumentation to brainwashing is to show that you are far, far too susceptible to peer pressure, and also to irresponsibly diminish the seriousness of brainwashing. As Wilson documented in Leary's _Neuropolitics_, there is a technology for breaking down a person's resistance to ideas and lifestyles that are foreign to them, and "re-imprinting" them with the ideas and values of a new group. But among other things, it requires control of a person's physical environment, food, movement, social environment, and all punishments and rewards. Not for nothing do cult leaders take their converts to remote retreats, "deprogrammers" tie their captives to chairs in remote hotel rooms, fundamentalist preachers preach "separation from the world," and the military isolate recruits from all outside contact, control their every waking moment, and bully them mercilessly during the early weeks of boot camp. But you cannot exert that kind of control over anyone's life or body or mind via the Net. All you can do is create fake peer pressure. And if you're that susceptible to peer pressure, Gods' pity on you. You need to learn to judge arguments by their quality, not by the number of people who say that they agree with them. Does pseudospoofing have dire implications for democracy? Well, no, because in the political context, pseudospoofing isn't that different from what interest groups do now. Do you really think that, for example, everybody who joins the AARP to get the club discounts agrees with everything that organization's lobbyists tell Congress? I doubt it, and any Congressman with any sense doubts it, too. What's more, with the rise of 800-number generated automatic telegrams, clipped coupons, and so forth, a new term has entered American political discourse, the term "astroturf campaign" -- that is, a fake grass roots campaign. Sure, pseudospoofing provides another way to create a fake grass roots campaign. But will anybody be fooled? No. Congressional staff already look for close similarities between supporting messages and inform their bosses of them. Somebody with enough determination could hand-write a thousand letters to Congress trying to influence a piece of legislation, carefully varying each one so that they look like they came from separate constituents. Without pseudospoofing, they would put them in separate envelopes and drop them in mailboxes all over the city over a course of days. With pseudospoofing, they could write a program to batch them out to anon mail servers or spoof them into SMTP mailers over the course of many days. But either way, the =real= work would not be in the mailing process, but in the laborious task of hand-writing a thousand entries while keeping them all different. Who is capable of such an effort? Now, after thinking about the arguments above, if you are still terrified of the possibilities of pseudospoofing, take this challenge: try to design a system that allows anonymous email and anonymous transactions that =doesn't= permit pseudospoofing. Such a system, it seems to me, will have to have =some= entity that knows which aliases go with which real.people, and such a system is by definition not anonymous. After a hundred-plus lines, I am not going to go into the arguments about whether or not anonymity is itself a good or a bad thing. Suffice it to say that there are people, not involved in plotting the overthrow of society or any of Mr. Deitweiler's other paranoid fancies, who believe that anonymity is valuable. All that I hope that I hope to accomplish with this message is to persuade you of is that there is little basis for fear that "the treacherous and toxic effects of pseudospoofing" will lead to "brainwashing" or "general destabilization of governments, democracy, laws, and law enforcement." J. Brad Hicks Internet: mc!Brad_Hicks(a)mhs.attmail.com X.400: c=US admd=ATTMail prmd=MasterCard sn=Hicks gn=Brad ------------------------------ Date: Mon, 15 Nov 1993 15:22:51 -0700 From: Neil McKellar <mckellar(a)cs.ualberta.ca> Subject: Conspiracy 101? (Detweiler, RISKS-15.27) In his article, " The Snakes of Medusa and Cyberspace: Internet identity subversion", L. Detweiler outlines a variety of methods by which 'pseudospoofing' can be used to influence public opinion and research (at least on the Internet). Having read a fair share of spy fiction in my time, none of these methods comes as a surprise to me. :-) And all these methods can be used AGAINST the conspirators in his scenario. Perhaps it's time to pull out my copy of "Schroedinger's Cat" by Robert Anton Wilson, and bone up on conspiracy theory. :-) Neil McKellar (mckellar(a)cs.ualberta.ca) "Just because you aren't paranoid, doesn't mean they aren't out to get you." ------------------------------ Date: Thu, 11 Nov 1993 14:39:20 -0500 (EST) From: Leonard Mignerey <MIGNEREY(a)cua.edu> Subject: Re: Snakes of Medusa and Cyberspace... I fail to see the difference between electronic pseudospoofing and print media pen names. It to me that all of Mr. Detweilers arguments hold for that scenario as well. The problem is not in pseudospoofing as much as in an individual relying on a single medium as a source of information. Certainly in the "War of the Worlds" incident, Orsen Wells pseudospoofed a number of people into believing that the Martians and actually landed. This unhappy group of individuals relied solely on their radios (and a single channel at that) for their information. If we are to dive so deeply into cyberspace that it becomes the total extent of our research on important issues, then I think the problem is not in the pseudospoofers but in the pseudospoofed. Leonard J. Mignerey, The Catholic University of America, Washington, DC 20064 Director, Management Information Systems INTERNET: mignerey(a)cua.edu ------------------------------ Date: Sun, 14 Nov 93 19:57:16 -0700 From: "L. Detweiler" <ld231782(a)longs.lance.colostate.edu> Subject: Pseudospoofing (ld, RISKS-15.25) Many people have emailed me to say that they are skeptical of my scenario about the Internet CryptoAnarchist pseudospoofing conspiracy published in RISKS-15.25. The scenario was built painstakingly from hundreds of messages I have reviewed on the subject over many weeks. I would like to present some of the more interesting pieces of `evidence' (but withhold the more substantial pieces) that there is at least, in one quarter of the Internet, a very strong, systematic, and dedicated attempt to pseudospoof, and a very concerted effort, possibly, to cover it up and viciously attack those who seek to expose it. My informal poll of pseudospoofing posted to the cypherpunks mailing list and talk.politics.crypto was unanswered by top Cypherpunk leadership, and many poll responses were very evasive, and several in the form `yeah, I have done it' with little additional information. The Cypherpunk mailing list and my private mail were my greatest source of inspirations for `Medusa's Snakes in Cyberspace'. For example, three prominent cypherpunks have suggested to me that there is a secret mailing list for `project development' free of `paranoid ranters'. I asked a cyperpunk leader about the existence of the list, and he said that `your question does not allow anything other than an incriminating answer.' * * * Here is a paragraph from a posting on the Cypherpunks list on Oct. 18 1993: ``In my limited experience creating Internet pseudonyms, I've been quite distracted by the continual need to avoid leaving pointers to my True Name lying around -- excess mail to/from my True Name, shared files, common peculiarities (e.g. misspellings in written text), traceable logins, etc. The penet.fi site explicitly maintains a list of pointers to the original address. All kinds of security controls -- crypto, access, information, inference -- have to be continually on my mind when using pseudonymous accounts. The hazards are everywhere. With our current tools it's practically impossible to maintain an active pseudonym for a long period of time against a sufficiently determined opponent, and quite a hassle to maintain even a modicum of decent security. Pointers to info and/or tools to enable the establishment and maintenance of a net.nym, beyond the standard cypherpunks PGP/remailer fare with which I'm now familiar, greatly appreciated. Especially nice would be a list of commercial net providers that allow pseudonymous accounts''. This paragraph contains an astounding amount of data on the possibility of a highly refined, intense, extended, insidious, global, and systematic pseudospoofing effort. Some of the details it suggests, in particular: 1) Based on the context that surrounded this excerpt and the message, the author is intentionally conflating `pseudonymity' (identification of the message implicitly indicates, `this is a pseudonym', such as origination from anon.penet.fi) with `pseudoanonymity' (the deception that `I am a real person'). This is a classic cypherpunk tactic. I have hundreds of subtle variations of this obfuscation in my collection. 2) The author starts with `in my limited experience in creating'... but clearly the author has *extensive* experience with meticulous practice and knowledge that rivals that of the most literate RISKS postings on the subject (for example, the anon.penet.fi site, the possibility of style analysis for identification, etc.) 3) The author clearly has an obsession to completely dissociating all traceability to his actual identity and a virtually fanatical aversion to `pointers to my True Name lying around'. This includes extensive considerations for deleting mail, detecting shared files on a filesystem, and `common peculiarities' like consistent misspellings. 4) The author refers to his efforts at deception as `security controls' and categorizes them in general categories of `crypto, access, information, inference' -- clearly he has dedicated an extreme amount of systematic thinking and effort to the `project' of pseudospoofing. He laments, sounding somewhat like an NSA administrator, that it's `quite a hassle to maintain even a modicum of decent security'. 5) There is an identifiable tone of paranoia in the message that most rational humans would not associate with casual anonymity. `The hazards are everywhere'. The author laments, `It's practically impossible to maintain an active pseudonym for a long period of time against a sufficiently determined opponent'. 6) The objective characterization of a `sufficiently determined opponent' indicates the author considers attempts to trace the pseudoanonymity by what I have been calling `demon exorcists' is an inevitable inconvenience that must be addressed. The author clearly considers it a routine hazard and has encountered and evaded it before. He considers his routine deceptions something like a game strategy. 7) Despite already obviously being an unsurpassed expert, the author requests `pointers to info and/or tools to enable the establishment and maintenance of a [`pseudoanonym'], beyond the standard cypherpunks PGP/remailer far with which I'm now familiar, greatly appreciated.' This may also disguise an attempt to appear to be unsophisticated or determine what extent other `octopuses' are existent in Cyberspace. 8) The author asks for a `list of commercial net providers that allow [pseudoanonymous] accounts' without regard to *geography* whatsoever, suggesting that it is no constraint. That is, the author may have no problem with accounts spread very wide geographically. This is in stark contrast to the standard request, `does anyone know a site in [x] area?' to avoid long distance charges. Clearly, the author has an *obsession* with maintaining *multiple* `pseudoanonyms', possibly over a very *widespread* geographical area, has a paranoia over exposure of one of his `tentacles' but also has conceived and probably practiced countermeasures, and spends a great deal of time polishing his techniques and arsenal. The author is not interested in casual anonymity as a hobby. He is interested in systematic pseudospoofing, virtually as a *profession*. He may even be spreading *disinformation* about his own practices and the extent of his own knowledge. The author continues: ``Another big problem I see with [pseudoanonymous] reputations is entry. If most people are blocking posts from new pseudonyms, how does one get a new reputation established? I've had several years to establish a net.reputation for [...], and it might take a long time for any of my [pseudoanonyms] to catch up. Altruistic sponsorship requires trusted friends knowing the True Name, but that public sponsorship itself provides important clues to that Name.'' This paragraph further promotes pseudospoofing, now suggesting its use in reputable forums: 1) Again, the author alludes to his arsenal of multiple pseudoanonyms, and expresses regret that it will take *a long time* of concerted pseudospoofing for before his other pseudoanonyms may `catch up'. 2) The author appears to be attempting to subvert mechanisms that bar pseudoanonymous identities, trampling on their right to do so in his obsessive promotion of the `reputation' associated with his various name tags. 3) From the context of the message, and the references to `sponsorship by a true name', the author appears to actually be alluding to *identity databases* and ways of infiltrating them with pseudoanonyms. He laments that this `public sponsorship itself provides important clues pointing to that name.' This could be interpreted as a deliberate attempt at deception and corruption of a `True Name' database by conspiracy, and the `clues' that would `point' to a perpetrator of the crime. Actually, because of the blurring of identities and misinformation this author promotes, I think that this paragraph may potentially be another disinformation stab -- the apparent owner of the message may be *itself* a pseudoanonymous identity, *itself* built up over `several years'! (The author posts from the site netcom.com, a site that is notorious for requiring essentially no proof of identity to receive an Internet account.) The author continues with classic cypherpunk dogma that blurs pseudonymous and anonymous identities with pseudoanonymity (`pure anonymity'), and vilifies those who feel `threatened' by the latter: ``I hope that we stick to experimenting with pure anonymity in many venues. I suggest we'll find out that purely anonymous vposts are not so bad, overall. [...] Pure anonymity is a strange, threatening, fascinating beast in our panoptic social-welfare world. Even those of us at the forefront of harnessing this monster shrink back in fear when it whinnies. [...]'' Now, superimpose the `Medusa's Snake's and Cyberspace' essay in your mind as you read the following: ``Pure anonymity provides a voice for a wide variety of new kinds of expression that up until now have been suppressed. [...] I hope we continue experimenting with pure anonymity for a while longer [...]. Some of what comes out might look very strange, something like tapping into previously concealed areas of our social psyche. I suspect the result will be a more honest dialog, a more productive conversation freed from posturing and, ironically, from the concealment of threatening truth. I hope we will observe with Zen patience and allow this quite interesting experiment to continue.'' * * * Since the above posting was to a public list, I will reveal the author of the message I have been dissecting. He is the same person who took my short comment at the end of the `Medusa's Snakes & Cyberspace' essay as an *accusation* that some pseudanonyms may be listed. He writes in RISKS-15.26: >I'd like to assure the readers of RISKS that I am in fact a unique person, >distinct from the other names L. Detweiler listed. Of the people on his list >I know from personal contact, all are distinct people in Real Life(tm). Well >before his post to RISKS, L. Detweiler was provided means of personally >verifying that many of the names he listed are distinct True Names (eg phone >numbers he can call), but it doesn't seem to help. Let's dissect these statements with an eye to rigor. `I am in fact a unique person [...]' means nothing in the question of pseudanonymity -- Medusa may have one of her Snakes claim that `I am a unique person' without lying. Next, `Of the people on his list I know from personal contact, all are distinct people in Real Life(tm)'. But this can be taken to mean only that more than one person is represented by a list of pseudoanonyms. Note the author is careful not to mention *which* people he knows from personal contact. That, after all, might reveal `important clues pointing to that Name'! Also, there is a problem that members of a `cult of pseudospoofers', who subscribe to the `pseudoreligion of pseudoanonymity', as this person apparently does, may twist language to the point of actually maintaining that different pseudoanonymous identities *are* different `people', even when typed in at a keyboard by the same individual! This would not be unlike a fanatic religious sect maintaining that acts of `terrorism' are actually `holy liberation' when commited in the name of God! The author says he is `distinct from the other names L. Detweiler listed.' But again, this is not a guarantee of uniqueness of flesh! The use of the word `name' instead of `people' is quite suspicious in our context! The whole *issue* is that beyond the uniqueness of mere ASCII `names'! The person goes on to state that `Well before his post to RISKS, L. Detweiler was provided means of personally verifying that many of the names he listed are distinct True Names (eg phone numbers he can call) but it doesn't seem to help.' The people I listed are separated by vast geography in their posting sites, with a concentration in California. Furthermore, I have been in private correspondence with all of them over many weeks, and I am unsure of what specifically Mr. Szabo is referring to as my opportunity to verify that `many of the names' are `distinct True Names'. I have never before posted a list of this set of names before! The lack of specific information is highly suspicious in our context! Furthermore, in our context, the issue would not be whether `some' real people are represented in the list, but whether *all* names listed correspond to the legal identities of *unique* human beings! (A complex and widespread pseudospoofing effort actively being orchestrated by some, which very possibly spans many states, may not even be thwarted by the necessity of establishing interstate telephone numbers!) * * * Finally, I have very strong tangential cues that the `Medusa's Snakes in Cyberspace' essay is far more true than hypothetical. Over many weeks I have encountered strong stonewalling, evasion, and counterattacks from some of the most prominent cypherpunks in response to my specific allegations in email. This included a mailbombing, a mailbombing threat, four letters to my site postmaster, two from cypherpunk leaders, one referring to `your latest paranoid descent into fantasy in RISKS', my `violent threats', without quoting any of my statements in particular (I find the thought of a physical threat abhorrent), and suggested `I have a strong feeling you are going to have a very hard time getting a job in the computer industry' in part from the essay. Another called my efforts against pseudospoofing a `a nonsensical, paranoid, one-man jihad against cypherpunks'. Apparently because the lamentations and supplications to my postmaster have largely been ignored, one cypherpunk suggested that `I intend to go beyond your postmaster on the next try, to various former classmates and old friends of mine who are computation center employees, faculty, and administration members at CSU now.' Incidentally, there is a strong overlap between the people perpetrating the above activities and those I credited at the end of my essay. Elsewhere, one cypherpunk suggested that `I better start looking over my shoulder'. Another, in what might be termed `psychopunk humor,' wrote `I'm going to come kill your family with a rusty razor blade' (the latter broadcast on the entire mailing list) and suggested it demonstrated my personal problems in being upset by such a message. These tactics are all quite shocking to me, and I am not sure how to respond to these letters except to perceive them as outrageous and desperate attempts to intimidate and censor me indirectly where other approaches have failed. I warn others of the searing hostility they may encounter on the cypherpunks list -- with philosophies promoted there that are increasingly blurred with raw criminality -- and against any attempts to find an antidote to poisonous pseudospoofing. L. Detweiler ------------------------------ End of RISKS-FORUM Digest 15.27 ************************

1 0

Secure Phone?
by wisej 17 Dec '03

17 Dec '03

The following add copy appeared in TIME the other week, in a special gift advertising section: GIVE THE GIFT OF PRIVACY All it takes to eavesdrop on most cordless calls is another cordless phone, scanner, or even a baby monitor. That's why every Motorola Cordless Phone features Secure Clear.sup.TM tech- nology. Secure Clear.sup.TM scrambles voices, so all an eavesdrop- per hears is garbled noise. (M) MOTOROLA Motorola and Secure Clear are trademarks of Motorola, Inc. (c) 1993 Motorola, Inc. Comments? Jim Wise wisej(a)acf4.nyu.edu jaw7254(a)acfcluster.nyu.edu

1 0

STRATEGIC INVESTMENT POINTER
by Sandy 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, For those of you who asked, here is the contact information for "Strategic Investment": Strategic Investment Agora, Inc. 824 E. Baltimore St. Baltimore, MD 21202-4799 (410) 234-0691 S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Cryptosplit 2.0
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Norm Hardy posted some code for Shamir secret sharing here about a month ago, a nice short routine. At around the same time, I created a program to do the same thing and uploaded it to soda. It is still in /pub/cypherpunks/incoming as secsplit.zip. It contains a DOS executable and source for building under Unix or DOS. I did the polynomial calculations a little differently from Norm and Ray; their approaches may be more efficient. But I did go to some effort with the random-number generation on which the security of the scheme depends. My code uses the IDEA.C module from PGP for the pseudo-random generator, seeding it with the time of day and an MD5 hash of the file being split. So I think this should be pretty secure in terms of the randomness involved. The purpose of this program, as with Ray's and Norm's, is to split a file into n pieces (all as big as the original file) such that any k of them are sufficient to recover the original file, but k-1 pieces give you NO information about the contents of the original file (other than its size). One possible application is to split up your PGP secret key file this way and distribute the pieces to trusted friends such that several of them have to cooperate to recover your key. Then if you accidentally lose your key you can get the pieces back from your friends. Hal

4 3

"Reason" mag. article on public key crypto
by trestrab＠GVSU.EDU 17 Dec '03

17 Dec '03

About a month ago, I posted a small extract from an article entitled "Hide and Peek" by Lee Dembart. I came across the complete text of the article while looking for something else at gopher.internet.com. If you're interested in this piece, e-mail me and I'll send you a copy. (a note for Extropian list members - I nosent the piece to the list, and have provided a pointer to the message number so you can retrieve it.) Jeff trestrab(a)gvsu.edu trestrail(a)delphi.com

1 0

Public-key secret sharing
by Mike Ingle 17 Dec '03

17 Dec '03

Has anyone combined polynomial secret sharing with public-key cryptography to create a public-key secret sharing system? For example, encrypt a file with a session key, SK. Use secret sharing to split SK into n parts, with m required for decryption. Encrypt each of the n parts with a different person's public key. Publish the encrypted file and public-key encrypted pieces of the key. To decrypt, m of the trustees use their secret keys to recover their shares of SK, combine them, and retrieve SK to decrypt the file. This has the advantage of requiring only one copy of the file, and requiring no pre-arrangement with the trustees. Is there a better way to do this (especially so the size of the file does not grow linearly with the number of trustees)? When is PGP 3.0 with the toolkit coming out? This should make it easy to implement these things, along with digicash and other projects. The MPI library and conventional crypto is fairly accessible, but the code which creates PGP-format packets is not easy to call from another program. --- MikeIngle(a)delphi.com

1 0

Re: Traffic analysis and file size
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Scott Morham asks about how well file sizes are preserved by encrypted remailers. Generally speaking, in creating a nested encrypted remailing request, at each stage PGP will attempt to compress the input, then encrypt it, which preserves its size but adds a block to the beginning of about the size of the public key (typically 100-150 bytes), then makes it ASCII, which increases the size by 1/3, then adds a small header block of 50 to 150 bytes or so. Since the compression is ASCII-encoded encrypted text, the best it can do is to "undo" the ASCII encoding or compress by about 1/4, but I don't know if it actually does that well. Probably it compresses by somewhat less. So generally each chain will add a few hundred bytes and scale the size of the message up by probably 10 or 20 percent. I think that this will probably allow pretty reliable matching of incoming and outgoing messages on the basis of size alone, at least, more reliable than I would be willing to count on to prevent attacks by this means. Scott also suggests using .zip compression at some point, but this isn't likely to help much since encrypted files look random and are basically not compressible. What we have talked about here is adding random padding to change the file size. Because encrypted files do look random, you can generally pad them with random bytes pretty easily and undetectably. This depends somewhat on the file format but it is basically easy. I wrote some perl scripts to pad .pgp public-key-encrypted files undetectably. The extra bytes are ignored when the file is decrypted. The scripts aren't really production- quality since they just use perl's built-in random numbers. Good random numbers should be used. Hal hfinney(a)shell.portal.com

1 0

Re: Remailers: Turnaround Times?
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Coerr asks about turnaround times for the remailers. Karl Barrus posts a list of remailers approximately every month. On that list he shows which remailers have high-speed, continuous connections to the internet and which have intermittent connections which introduce larger than normal delays. In my experience, the direct-connected remailers generally respond within a minute or two. The other ones introduce delays ranging from an hour or so up to overnight. A good test is to send a "ping" (remail to self) message to each remailer and see how quickly responses arrive. In my experience, the extropia remailer tends to take a few hours, while the rebma remailer is usually a day or sometimes longer. I don't have recent values for the others. Hal Finney hfinney(a)shell.portal.com

1 0

Secure Clear
by XXCLARK＠indst.indstate.edu 17 Dec '03

17 Dec '03

wisej <wisej(a)acf4.NYU.EDU> asked: > (M) MOTOROLA > Motorola and Secure Clear are trademarks of Motorola, Inc. (c) 1993 > Motorola, Inc. >Comments? Don't have one, but know two who do. Scramble, as I understand the meaning of the word, they don't. Last I knew, "Secure Clear" is simple frequency inversion, and can be defeated by: a $15 kit added to a scanner, or; tuning the freq on a single sideband receiver. I've even heard of individuals who had trained themselves, or been trained, to understand the freq inverted signal. Check out Cincinnati Microwave's spread spectrum frequency phones. I don't know if they use frequency hopping or direct sequence, but they may be secure against all but military and LEA types... and the really determined and accomplished hardware hacker.

1 0

Real People
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

Hey, there was an interesting series of articles in RISKS 15.25, 15.27, and 15.28x that covered the `Cryptoanarchist' movement. Many cypherpunks may be interested in this analysis. Has it shown up here? I missed it if it did. Boy, the tentacles are *really* pissed off from that E.Hughes == P.Ferguson insinuation in my recent messages. Joe Thomas <jthomas(a)access.digex.net> told me that `you're getting on my nerves' and accuses me of `damaging the list discussion' here. I'm very hurt and upset by this claim. Why don't you lay off a little? I'm just trying to do my job. Some people are born demons, and some people are born exorcists! He says he met P.Ferguson at the D.C. cypherpunks meeting `this spring' (last spring?). What was the date on that, anyway? Who else was there? He said he didn't get to talk to P.Ferguson for very long, but he did see his Virginia driver's license. So, according to J.Thomas <jthomas(a)access.digex.net> anyway, P.Ferguson exists! Thanks for this valuable entry in the Real People Trust Web. Would anyone like to vouch for Joe Thomas, <jthomas(a)access.digex.net>? BTW, I heard that access.digex.net had lax authentication standards like netcom.com. Could anyone send me mail clarifying what is actually required for authentication at these sites? BTW, many thanks to L.Detweiler for his lone help in helping me break a corrupt conspiracy and massive cyberspatial hoax. It's really tough going lately, and we're really being bombarded with some of the most vicious material the tentacles can muster. But we can stand the heat, and we're going to stay in the kitchen, and continue to fight the raging arson flames to make cyberspace safe for honest people. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

Dead mans stick
by Black Unicorn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -> From: "Alan (Miburi-san) Wexelblat" <wex(a)media.mit.edu> To: cypherpunks(a)toad.com Subject: Give me your password- OR ELSE! It seems like it would be relatively simple to program in a sort of dead-man switch at the time of creation of the secret key. [...] As you can imagine, there are increasing levels of personal security you might employ. For example, using the duress phrase might be set up to change the pass-phrase to something *you* don't know but which is known by a trusted other party (wife, mother, agent/lawyer, etc.). Knowing this phrase doesn't help them since that phrase can't access your secret until *after* you've given the duress phrase and the software has disabled your normal access phrase. <- The problem with the duress phrase seems to be this: One would use such a phrase when physical site security had been compromised no? Let's assume government types (which seems to be the hint I get when you suggest the alternate pass phrase being held by your lawyer. It's fairly easy to duplicate the key and stick it somewhere on a floppy and try the passwords extracted from you via rubber hose method on the copy rather than the original. In fact, if people being to use duress codes, it seems that this would become standard practice, if it's not already. In as far as the idea behind a duress code is to keep you from being beaten repeatedly by making it impossible for you to decode the information alone, copying the encrypted key defeats this method. :( - -> - --Alan Wexelblat, Reality Hacker, Author, and Cyberspace Bard Media Lab - Advanced Human Interface Group wex(a)media.mit.edu Voice: 617-258-9168, Pager: 617-945-1842 PUBLIC KEY available by request "To pleasure!" "To passion!" "To paradise!" "To pain!" "Tonight!" <- -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLPmWBhibHbaiMfO5AQEQuQQApDtaIxVjjZvdUYD9Jl6FZGdq62SpPM+y KMqsIvSOhPOK2kOsoAyLuIN4+bXVUyTHiAkYX/ye2q2gqj9yrOLvkGyH6yak5YFi xoOCYx6qGScHeoqwpJKoRTTwUjAo79ZmXupA+ylX527eQDILwZJa+W+wSln/rXhG zajsBTeG/mw= =B4y+ -----END PGP SIGNATURE-----

1 0

Motorola Ad
by jbhicks＠aol.com 17 Dec '03

17 Dec '03

In the November 29, 1993 issue of Time Magazine, opposite p. 67, there is an interesting ad: > Give the Gift of Privacy > > All it takes to eavesdrop on most cordless calls is another > cordless phone, scanner or even a baby monitor. That's why > every Motorola Cordless Phone features Secure Clear (TM) > technology. Secure Clear (TM) scrambles voices, so all an > eavesdropper hears is garbled noise. > > Motorola > > Motorola and Secure Clear are trademarks of Motorola, Inc. > (C) 1993 Motorola, Inc. - James -

1 0

taxes (net)
by Black Unicorn 17 Dec '03

17 Dec '03

-> --------------------- Tax Havens on the Net --------------------- compiled by James R. Hart Leichtenstein net access: ---f- languages: German, Alemanni currency controls: none bank secrecy: excellent preferred legal entities: allows any type found anywhere in the world (!) establishment (limited liability, unlimited duration) company limited by shares foundations and trusts taxes: none for income outside Leichtenstein. Net worth tax of 0.01% on capital and reserves (min. 1,000 Swiss francs), local resident taxes tax treaties: not party directly or indirectly to any exchange-of-information agreements double-tax treaty exists only with Austria n.b.: bankers won't assist law enforcement officials with drug, fraud, theft, or tax investigations. They might assist in money laundering and insider trading investigations, informing the customer first. Yes but, Liechtenstein, Not LEIchtenstein. :) You'll find it difficult to invest less than 1.5 million in Liechtenstein secretly. -uni- (Dark)

1 0