December 2003 - cypherpunks-legacy

17 Dec '03

Afabbro quotes someone in Finland saying, re anon.penet.fi: > Some users have flooded the server with hundreds and hundreds of messages. > That slows the server down greatly (posting and e-mailing times up to 3 days). > Some messages might have even disappeared because these hundreds of messages > fill up the diskspace and there is no more room for new messages. I wonder if this could be a concerted denial-of-service attack. Julf's remailer has had the highest profile of any, and he certainly has his share of enemies. Maybe somebody figured it was easy to shove a few thousand messages a day his way. This makes the server slower and less convenient for others to use, as well as putting an extra load on the trans-Atlantic links just for anonymous messages. It also could cost someone some money which could be blamed on Penet. This could be an attractive strategy for an enemy of anonymity. Hal

1 0

Re: Remailer Musings
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Philippe Nave suggests that an anonymous remailer should do more than delete the originator's origin from a message, it should also try to hide its own origin. In some networking protocols, you can do an ok job of that - dialup networks that don't validate origins, for instance, though even there the Phone Company may be able to trace who called whom. With other protocols, you can't cover your tracks very well - TCP/IP messages do carry their originator's IP address, and there's no way you can stop the receiving mailer from logging your address even if you lie to it when generating mail headers; some mailers not only log your address, but refuse to accept connections if you're lying. So they're going to find you anyway, if they're determined enough; the strength in the remailer system comes from the service provided by the remailer itself, and having the remailer forge its address on outgoing connections may annoy the people it connects to as much as being a remailer in the first place. Remailers become much more effective when you have a bunch of them in multiple countries, which makes it much harder for governments to pressure operators, especially if they want to avoid publicity. On the other hand, copyright laws are a sticky situation; Europe and the US operate under common conventions, and there may be more the US can do in, say, Finland for copyright violations than they can do for gambling or income tax evasion for a remailer at credit-suisse.com.ch . Bill

2 1

Fixing "Flooding" with Pretty Good Digital Postage
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Hal Finney writes: > I wonder if this could be a concerted denial-of-service attack. Julf's > remailer has had the highest profile of any, and he certainly has his share > of enemies. Maybe somebody figured it was easy to shove a few thousand > messages a day his way. This makes the server slower and less convenient for > others to use, as well as putting an extra load on the trans-Atlantic links > just for anonymous messages. It also could cost someone some money which > could be blamed on Penet. This could be an attractive strategy for an enemy > of anonymity. (Hal knows this, but for those who are new....) Charging some small amount remailing effectively fixes this problem...if someone want to flood a site with thousands of letters a day, and each one costs them 10 or 20 cents, the remailer site makes a tidy profit, which can then be used to buy more machines, a T1 link or two, etc. This "digital postage" could be a simpler subset of digital money, e.g., collections of numbers which are bought it advance and which can be used once and only once. Anonymity comes in various ways, such as by trading with others (lots of issues here, but not unsolvable ones, I think). "Pretty Good Digital Postage" would solve a lot of these problems, as well as making the remailer economy more normal, more market-driven. (Ultimately, we want "Mom and Pop remailers," with incentives.) No central authority needs to force this to happen, nor to set postage rates. Let those who wish to remail "for free" continue to do so, let those who set their rates too high be taught a lesson in market economics, and let the invisible hand work its magic. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Public Hearings (Clip & DT!)
by Jeff Davis 17 Dec '03

17 Dec '03

From: Stanton McCandlish <mech(a)eff.org> Subject: Clipper/DigTel Hearings Date: Tue, 19 Apr 1994 19:33:27 -0400 (EDT) To: eff-activists(a)eff.org (eff-activists mailing list) This will be in tomorrow's EFFector Online: Subject: Upcoming Congressional Hearings on Clipper and Digital Telephony ------------------------------------------------------------------------- Congressional hearings on the Administration's Clipper/Skipjack initiative, and the FBI's draft Digital Telephony surveillance bill, and their implications for privacy and First Amendment rights, are to be held April 27 and May 3, 1994. Sen. Patrick Leahy (D-VT), of the Senate Judiciary's Technology and the Law Subcommittee, has expressed skepticism of the Clipper encryption scheme, and has called for hearings to examine the problems of this proposal and its implementation. This effort is due in part to all of you who played a vital role by responding to EFF's grassroots campaign to raise fundamental questions about security and free speech issues in relation to the White House proposal. The Senate hearing will be held on April 27, 1994, 9:30am EDT, Hart Building Rm. 216, and should feature testimony from the Digital Security and Privacy Working Group (a broad coalition of industry and public interest organizations, including EFF), Trusted Information Systems' Steve Walker, Whitfield Diffie of Sun Microsystems, a representative of the Justice Dept. (possibly Atty. Gen. Janet Reno), NSA Director Adm. Mike McConnell, and Ray Kammer of NIST. For more information, contact Beryl Howell at the Senate Judiciary Committee: +1 202 224 3406 (voice), +1 202 224 9516 (fax) Note: this is the full Committee's fax, so address faxes to "Berly Howell, Technology and the Law Subcommittee" or delivery may be delayed. Following the Senate Hearings, the House Science, Space and Technology Subcommittee on Technology, Evironment and Aviation will be holding a hearing to address related civil liberties issues of both the Clipper scheme and the FBI "Digital Telephony" proposal, which so far remains unsponsored. The hearing will be chaired by Rep. Tim Valentine (D-NC), and is scheduled for May 3, 1994, 1pm EDT, Rayburn Building Rm. 2318. Witnesses will include Ray Kammer of NIST, NSA's Clint Brooks, representatives from industry in a panel that will include USTA and TIA, expert witnesses Dorothy Denning and David Farber, and EFF's Jerry Berman on behalf of DPSWG. FBI appears not to be making a showing. The House hearing is being held "to review the Administration's policies and legislative proposals dealing with electronic survellance, privacy and security, ...the adequacy of the Computer Security Act in protecting goverment computer systems", and "the Administration's proposed Digital Telephony legislation and decision to promulgate a voluntary federal encryption standard". Futher information can be provided by Tony Clark of the Subcommittee at +1 202 225 8115 (voice), +1 202 225 7815 (fax) -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994 -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

1 0

What the heck is this? Optical noise encryption?
by Stanton McCandlish 17 Dec '03

17 Dec '03

Anyone know anything about this? How secure is this? If you have to have 2 "identical" lasers to pull this off, sounds like this would not be very secure, since there must be a pretty wide margin of error (I mean, how "identical" can 2 lasers be?) ____ from EduPage ____ OPEN SECRET Instead of using mathematical codes to scramble and unscramble messages, Georgia Tech physicists are devising a way of sending a message with electronic noise generated by a flickering laser. By connecting identical lasers over fiber optics, the same random pattern of noise is generated at both the sending and receiving end, and the receiving simply subtracts the noise to uncover the message. (Atlanta Journal-Constitution 4/7/94 E2) __ end _______________ -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

3 2

Re: Privacy and the lack thereof.
by joshua geller 17 Dec '03

17 Dec '03

>> Does everyone do what I do... carry little cash and when you >>want to buy something with cash go to a machine and take it out within an >>hour of your purchase? no. josh

2 1

Phase Cancelling Noise (What the heck is this)
by Jeff Davis 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Message-Id: <199404200614.CAA17953(a)eff.org> Subject: What the heck is this? Optical noise encryption? >Anyone know anything about this? How secure is this? If you have to have >2 "identical" lasers to pull this off, sounds like this would not be very >secure, since there must be a pretty wide margin of error (I mean, how >"identical" can 2 lasers be?) The noise can be phase cancelled. Dan Healy did it all the time in '74 with the Wall of Sound double microphone set up for Grateful Dead. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLbTOCl/ScHuGXWgVAQHBhwQAkjGFC7Yjtjvo85jHTzcBFPvFOhSWM0Md gCGZ4aBr1VsjdG/NcP8/x6xuymZL8/qdk1ihHSyPv3Ev6EJBqBI28PMVCEl99p9+ xlObDyKnBNt8PowKpEeLBB7uMecN2hdMJ/DZM4r9H7rOaXKshraPQDG6mr32rGho Pd/WMM1NsGg= =uPJe -----END PGP SIGNATURE----- -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

1 0

Re: anti-clipper autobomber
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

Ouch! I'm sorry I asked. I won't bother finding out anything else about Serdar, thanks. :-) I don't have any time to waste on megalomaniacs. Can someone convince him to "share" his software? If not, we can write our own. :-)

1 0

CMU's digicash
by bart＠netcom.com 17 Dec '03

17 Dec '03

From: info(a)ivory.educom.edu (E-D-U-P-A-G-E) Subject: E-d-u-p-a-g-e 04/19/94 Date: Tue, 19 Apr 1994 21:12:53 -0400 ... SMALL CHANGE ON THE NET Researchers at Carnegie Mellon University are developing NetBill, a computerized system for tracking and billing users for small transactions, such as a ten-cent charge per document. The developers hope NetBill will evolve into a universal accounting system on the Internet. (Chronicle of Higher Education 4/20/93 A31)

1 0

Re: Remailer Musings
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

It might be worthwhile to create a remailer package for a remailer that only sends to other known remailers. People hesitant about running a full service remailer may still be willing to run a behind-the-front-lines remailer. Jim_Miller(a)suite.com

2 1

remailer@soda
by Erich von Hollander 17 Dec '03

17 Dec '03

remailer@soda (formerly hh@soda) now uses pgp's implementatoin of idea for the encrypted response block function, making it much more secure (i hope). the code will soon be released. e

1 0

blacknet
by Tommy the Tourist 17 Dec '03

17 Dec '03

As someone who would know, for reasons which I cannot divulge, I can assure you that the second round of blacknet posting was pure bullshit. Perhaps the first round was actually a real thing, but the second round was merely something designed to cause annoyance, I believe. ------------ To respond to the sender of this message, send mail to remailer(a)soda.berkeley.edu, starting your message with the following 7 lines: :: Response-Key: ideaclipper ====Encrypted-Sender-Begin==== MI@```%!S^P;+]AB?X9TW6\8WR:.P&2'N\0Q?\$?[H)LU*I'JZ5['LLG0QJ!` HF7+LDJLJ%R?^K*"80#@+H[-_HE-PS5;U5P)P0MJ[:LPSD&Y]'P?2/P`` ====Encrypted-Sender-End====

1 0

Re: Privacy and the lack thereof.
by Jim Sewell - KD4CKQ 17 Dec '03

17 Dec '03

<My computer told me that Graham Toal said:> > > Anyway, if they just want your picture for ID, it doesn't have to > be from the most recent bank transaction. People's pictures are > floating around ... Yes, this is true, but a picture from the ATM machine will place you as the one who got the bill instead of the thief that took your card and guessed your PIN. Proof is hard with current levels of tech since you can't prove something of this nature with computer files. Afterall, it may not even be me typing this right now... You'd have to be here to "catch" me to prove it in court (assuming a sane jury :). Take care Jim (Graham, sorry I sent you a second copy in mail... I forgot to check the header before sending. ) -- Tantalus Inc. Bringing people together Jim Sewell-KD4CKQ 2407 N. Roosevelt Blvd. to have a little fun. Internet: jims(a)mpgn.com Key West, FL 33041 CIS: 71061,1027 (305) 293-8100 "We keep coding and coding and coding..."

1 0

US ID Manual
by killbarny＠aol.com 17 Dec '03

17 Dec '03

The manual below has info on old, current, and proposed info on all D/Ls and IDs. It also contains info on Credit Cards, Alien, Miolitary, and other various types of Federal Identification. There are no PICs of FBI, DEA, CIA, etc--except for 1-800 numbers to confirm who they are. For those that can't find a way to get this, there is the ID Checking Guide for 17.95; send to: Drivers License Guide Co., PO Box 5305-Dept. 94, Redwood City, CA 94063. You can call 1/800-227-8827. This is the one bouncers use at nightclubs. Not as detailed as the one below. For US $149.00, one can purchase the US Identification Manual, on the condition that: 1) Be a previous purchaser of the US ID Manual. 2) Purchase Order or Department letterhead from a government agency or recognized business entity. 3) Proof of licensing with a professional board regulating private investigators, guard services, etc. 4) Xerox of Identification issued to an individual member of a law enforcement department. Send Name, Telephone, Title, Organization, Dept. within Organization, Address, City, State, Zip TO: U.S. Identification Manual, Division Driver's License Guide Company, Dept. 1A 1492 Oddstad Drive Redwood City, CA 94063

1 0

Driver's License info
by trestrab＠GVSU.EDU 17 Dec '03

17 Dec '03

uni writes: >What might be really useful is a list of the different measures >used on all the states ID's. > >For example: > >Maryland uses a magnetic strip, Digitized Photo and a bar code. >All that is printed on a credit card like card and not laminated. >Military ID's are green and white paper with a polaroid and a >signiture, normal lamination. >Illinois is a normal lamination with a complete photo within, >no bar code or strip, no digitized photo record. > >Anyone want to further the list? I wouldn't mind compiling the >information. > Michigan DLs have a Poloroid photo in the lower left corner and are laminated in plastic embossed on the front with the state seal. Jeff trestrab(a)gvsu.edu

2 1

Re: Remailer Musings
by trestrab＠GVSU.EDU 17 Dec '03

17 Dec '03

kitten writes: >On the other hand, part of the rules of being a common carrier are >that one is *required* to cooperate with appropriate >authorities to prevent this sort of abuse and to catch said >abusers if/when it happens. I suspect that Mr. Templeton's >lawyer could make a case that by setting up a remailer >where one cannot "trace calls," one is violating the >requirements of being a common carrier, and thus is >responsible for content. The PO delivers mail whether or not it has a return address, let alone whether it has a _correct_ return address, so I suspect that Mr. Templeton's lawyer would have to be very creative indeed to pass that analogy by anyone who isn't asleep at the wheel. I think his thinly veiled warnings re: remailer operator legal liability are an attempt to intimidate, as it can get expensive to defend yourself even from a very weak claim ....... just ask Phil Zimmerman. Jeff trestrab(a)gvsu.edu

1 0

Side question on money laundering...
by trestrab＠GVSU.EDU 17 Dec '03

17 Dec '03

Phil Fraering writes: >Given that even I, in my isolated little backwater of South >Louisiana, find myself withing 20 miles of a casino, is it >possible that the market is saturating to the point where >an internet casino would not neccesarily be a good idea? > >If there is real anonymous untraceable digital cash for money >laundering with, will "real" casinos see their profits decline >as digital money sucks away that part of their business? > The most likely use of the Internet for gambling is for bookmaking, not casino games. Encryption and untraceable digital cash will allow even those "in [an] isolated little backwater of South Louisiana" to compete for biz with the books in Lost Wages, NV and the larger cities. The only real barrier to entry will be capital sufficient to render the risk of ruin insignificant; thats not a _small_ barrier, though. Jeff trestrab(a)gvsu.edu

1 0

Re: Remailer Musings
by trestrab＠GVSU.EDU 17 Dec '03

17 Dec '03

Lefty writes: >There is not, to the best of my knowledge, any such thing as "a legal >pseudonym". DBAs (doing business as) registrations are "legal psuedonyms", although they don't have any bearing on the discussion at hand. (Just a FYI.) Jeff trestrab(a)gvsu.edu

1 0

magnetic card technology
by Brian D Williams 17 Dec '03

17 Dec '03

There is an interesting article on Magnetic card technology in Phrack37, I could send it to interested parties. It's about 46k. Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced comunication is indistinguishable from noise." --Steve Witham "Have you ever had your phones tapped by the government? YOU WILL and the company that'll bring it to you.... AT&T" --James Speth

1 0

Re: Safeway + Your Privac
by Duncan Frissell 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com P >Hmmm... In this scenario, wouldn't Safeway wind up eating the bad P >checks? I realize that it would be a royal pain in the ass for the P >victim (the checkbook owner) to sort out the mess, but it would seem to P >me that the victim could prove that he/she didn't sign the checks, P >leaving Safeway in the position of having exchanged groceries for P >worthless paper. In the case of a forged drawer's signature (forged signature of the account holder) on a check, the bank that pays on the forgery is liable. This is because in theory a check is an order to your bank to pay on your order and a forgery is not a valid order from you. If a check is paid based on a forged *endorsement* on the other hand, the transaction can be walked back until the person who first accepted the forged endorsement is stuck with the loss. This is because everyone in the endorsement chain has a claim that is based on the validity of prior endorsements. DCF Privacy 101: If you don't want to answer the questions on the form because they invade your privacy -- don't. If you want to complete the form to get something out of someone -- lie. The best way to lie on a form is to select answers out of the "answerspace" of potential answers that give no useful information about you. Given the complexity of human existance, "answerspace" is large enough that you can usually select "true" answers about you that give no useful information. Name: Whatever Address: Mail Drop Phone Number: Voice Mail SS#:???-??-???? Something vetted by SSN.EXE Last Address: Somewhere Overseas Photo ID: Employment/Student ID Credit Card: Secured VISA card Health Security Card: Sorry, I'm a non-resident alien. *Netiquette Alert -- Signature longer than message.* --- WinQwk 2.0b#1165

1 0

Re: Banyan vine use by US Marine Corps...
by Jim Franklin 17 Dec '03

17 Dec '03

Well, it turns out that either there was a mass pranking, or our gateway here at apple had a moment of flatulence, because other coworkers have received random mailing list letters too. Thanks for the info though. jim

1 0

Re: Remailer Musings
by juola＠bruno.cs.colorado.edu 17 Dec '03

17 Dec '03

Does anyone have a cite to support the notion that common carriers are obligated to assist in the identification of users of their services? I got it at the January '94 USENIX tutorial on Internet and the Law. Given that it's still being taught, it should be no problem for anyone with interest to confirm that. I received annoying phone calls for a period of time, and the local phone company (US West) said they'd only get involved once I had an "incident number" (or some such) from the police department, and that information gathered would only be released to the police. I suppose if I actually filed a civil suit against the harassing party (even as a John Doe?) I could then use the discovery process to compel them to release their relevant records - but that's not really the scenario that Brad and 'kitten' seem to imagine. Um, speaking for myself and not Brad, that's exactly the situation where this sort of thing would be problematic. Copyright infringement is a criminal offence as well as a civil tort. So if Brad (or the newswire) wanted to push it, they could try to haul the remailer operator into court. And if he claimed to be a "common carrier," he's supposed to help. If he's unable (read, unwilling by design) to help, then it's possible that a judge could find that he's not a common carrier and therefore liable. Of course, I'm not a lawyer myself. And the law, in its infinite majesty, can do strange things. I personally believe that remailer operators should be considered to be common carriers, but that's a very tricky proposition to justify in a court. - kitten

2 1

Re: Black Net
by lefty＠apple.com 17 Dec '03

17 Dec '03

>lefty(a)apple.com (Lefty) sez: >> Do _not_ mess with those BlackNet folks. You'll wind up face-down >> in a landfill, and spend eternity playing pinochle with Jimmy Hoffa. > >Do you have any evidence that the BlackNet people have committed >violence against someone, either before or after forming BlackNet? Pardon my asking, but Who Wants to Know, and Why Should I Tell You? >> Trust Me On This. > >Nothing personal, I don't trust anyone. Suit yourself, but don't have your next-of-kin come crying to me to tell them which batch of Little Friskies you wound up in. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Anonymous Remailers
by SGT=DARREN=S.=HARLOW%ISB%MCTSSA＠nwsfallbrook3.nwac.sea06.navy.mil 17 Dec '03

17 Dec '03

Since I am new, I have a question concerning remailers. I hear people talking about them, and was wondering what types of systems they are supported on, and how do I get added to one. Thanks, Sgt Darren Harlow - Computer Security MCTSSA, Camp Pendleton, USMC Internet: harlowd(a)nwsfallbrook3.nwac.sea06.navy.mil or another less reliable & slower: harlow(a)mqg1.usmc.mil Voice: Comm: (619) 725-2970 DSN (Autovon): 365-2970 Fax: Comm: (619) 725-9512 DSN (Autovon): 365-9512 PGP Public key available upon request "The views expressed are my own, and always will be..."

1 0

Re: What the heck is this? Optical noise encryption?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> All this "encryption with chaos" stuff just adds up to "look at my > fancy PRNG", which of course is a game that crypto people have been > playing for a long time. I'm starting to get alarm bells go off every > time "chaos" is mentioned. Yeah. On the other hand, chaotic stuff like Mandelbrot and Julia sets are good for generating lots of pretty pictures to hide steganography under, as long as you leave out the coordinates you're generating from.

2 1