December 2003 - cypherpunks-legacy

Anonymous Mail via Port 25
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Awhile ago, someone mentioned that at some colleges & universities, the dialup lines don't require you to log in immediately. Rather, they let you specify which system to telnet to, and then you log in there. Telnets are usually limited to machines in the University's domain, but they often don't restrict what ports you can telnet to. So you can telnet to port 25 and send an anonymous mail which would be very difficult to trace. Does anyone know of any such systems? Anywhere in the U.S. or Canada? I'm thinking of using such mail ports for a new anonymous remailer I'm working on, and I want to make tracing the mail as difficult as possible. Please post modem numbers...

1 0

theories about lack of crypto
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

sorry if this appears twice; I sent a copy through one of the new anonymous remailers last night and it looks like it didn't make it. Or I messed up somehow ;) -----BEGIN PGP SIGNED MESSAGE----- Tim May brings up some interesting and valid points about crypto protocols. I think there are several reasons surrounding the slow pace of crypto protocol (particularly software) development; rather than list them let me explain the difficulties in setting up a "data haven" (as far as I can see): I - Difficulties 1. The usual stuff like finding the time to code and maintain software, including getting access to a workstation (or whatever, some net connected computer given that my home computer is a PC running MSDOS). 2. Say all this code gets written. To really be able to run a data haven, I'd need to own the machine it runs on, to have the power to call all the shots. Yes, maybe my internet provider charges $x per megabyte, but I seriously doubt I'd be allowed to use up 100 Megs of disk space, even if I payed (and charged a bit more for storeage to cover my expenses). Now I can get a SLIP account for about $50 a month where I live, and so if I had a spare computer to devote, I'd be set, sort of. I'd definitely need the machine to be available on a network, otherwise it would be too inconvenient and nobody would use it. Of course, I'd also need an easy to use digital cash system to accept payments. Same thing with top-notch anonymous remailers; to be able to turn off logging, and be in control of a hundred details, I need to own the machine. Same thing with digital banks. Who would use a bank that runs off of an account from an internet provider? Besides, I'd need to own the machine to setup the appropriate security measures, etc. 3. Legal issues. This is the biggest problem. By running a data haven (and this applies to many other cryptographic protocols, particularly ones that guarentee anonymity, etc.) I pretty much open myself up to a legal can of worms. All it takes is one person to store pirated software, one person to send death threats through my "strong" anonymous remailer, one person to forward Clarinet posts to usenet, and I'm potentially in for a battle. Craig Neidorf (phrack) went to court and racked up a legal bill of $100,000, all for the government to drop its case. Consider if somebody posted anonymous soliciting pirated software. Let's say in a year, I set up an anonymous remailer and digital bank, and it really is anonymous. Somebody posts, soliciting the source code for Chicago (just an example), offering $10 million dollars. Some anonymous person sends it off, and receives payment. Neither party is traceable, and both are very happy. Except me. How screwed do you think I'd be facing the legal department of Microsoft? Yeah, the solution is to relocate off-shore; this is not feasible for me. This is only the tip of it since a large number of the more interesting and useful protocols are patented. Sure, maybe the concept of software patents suck, but the fact it, it's legal until a court overturns it. And I don't have the money to mount a legal battle. There is a balance to be struck between offering totally anonymous remailing (for example) and keeping enough logs to keep out of potential legal trouble. The problem is that the balance falls closer to the logging side, which would scare off potential users/customers. II - Incentives Really, what are the incentives for running these services? None as far as I can tell, other than the satisfaction of doing it. Johan Helsingus (Julf of anon.penet.fi) spends hours a day maintaining his site, responding to complaints, etc. He provides a valuable service, which obviously is very popular... all the same, I'll bet when he asked for a donation of $5 per account to help defray costs, he got almost no response. III - Usage Why aren't people using DC-Nets, data havens, etc.? Because I don't think there is a reason to. I'm not saying that it's a waste of time to develop this software; it's just for now it'll be confined to experimental usage, research purposes, or just as a challenge to surmount. I mean, I know what a DC-Net is, but I can't think of a single reason I'd actually use one, other than for the heck of it. IV - Platforms Well, for me, it would be MS-DOS. I love UNIX too, but my home computer is 10 times more convenient to develop for. >it all...remailers appear and then vanish when the students go away or lose >their accounts, features added make past learning useless, and so on. Life All I can say is for the near future, I don't see any of this stuff being done by anybody other than "hobbyists". "The Internet Casino" This sounds great, in fact, I've thought of writing a crypto version of roulette or blackjack... something that would use a bit-committment protocol to committ to a shuffle or sequence of random number, and play you. Afterwards, you could check logs to verify you weren't cheated. Maybe I'll actually find some time this summer to write it, > Later protocols have not fared as well. Why this is so is of great > importance. I'm interested in hearing your theories about this, Tim. I too wish things were different, but I just can't do much about it. I still think we are in a "ease of use" phase. Most people on this list don't even pgp sign their messages, largely because it isn't convenient. It isn't surprising later protocols aren't faring well. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLchxHIOA7OpLWtYzAQGP1QP9HbB+1eHhF5otXP9ShcC7mu5vSDVTeIf2 SNr4u28WOgRRHFP4MQcsvYp7VM0ELNhIdMXpCiThgl2kVj0oomLNboCpW0HNW9jn 4dux0K0hGJqsoxeZhqvNEybIQiVPHg0VFdkwI6q79V+oHynlOOaNZyJXad6ZFwsv xxUlGjLdmK8= =AAzE -----END PGP SIGNATURE-----

1 0

Re: Keyserver service outage
by schirado＠lab.cc.wmich.edu 17 Dec '03

17 Dec '03

>During the coming week, the Massachusetts Institute of Technology will >begin formally distributing PGP 2.5, a new version of PGP that is >based on the RSAREF 2.0 cryptographic toolkit, under license from RSA >Data Security, Inc., dated March 16, 1994. When that distribution >becomes available, the keyserver will return running PGP 2.5. At that >time, the keyserver will no longer accept keys that are identified as >having been created by versions of PGP lower than 2.4. (PGP 2.4 is >Viacrypt PGP.) Questions: 1) What involvement, if any, does Phil Zimmermann have in the creation of this "new version of PGP"? 2) Will "PGP 2.5" continue to be freeware; i.e., has RSA changed its stance on licensing? 3) If the answer to 2 is "yes", has the strength of the encryption been compromised in any fashion? 4) Isn't this some sort of transparent "back door" grab by some unknown person(s) as a method of encouraging people to switch by fostering the belief that versions of PGP lower than 2.4 are somehow illegal or otherwise illegitimate? (The last is only semi-sarcastic.) Basically, I think I speak for a hefty chunk of list subscribers when I say: I want to know who's behind this.

2 1

ANNOUNCEMENT: Preliminary announcement of May physical meeting
by hughes＠ah.com 17 Dec '03

17 Dec '03

PRELIMINARY ANNOUNCEMENT ======================== Different Date: The May cypherpunks meeting will be May 21, the _third_ Saturday of the month, for various scheduling reasons. New Location: We will now be meeting at Silicon Graphics, not at Cygnus Support as previously. Thanks to Katy Kislitzin for arranging this. Audio Available: We will be doing MBONE. SGI is already all set up for it. Theme: The theme is "Protocols". Contributions are encouraged. If you have original work, great. If you want to digest and present a paper from the literature, good. In either case, prearrangement is highly desirable. Mail hughes(a)ah.com. See you then. Eric it's like PGP 2.3 and 2.4 (modulo maintenance tweaks) but uses RSAREF for its crypto. Thus it is entirely U.S.-legal. I wonder what Sternlight will say to this. Eli ebrandt(a)hmc.edu "Users of PGP 2.5 should be aware that if copies are found outside of the U.S. and Canada, they could be charged with contributing to a conspiracy to export munitions to a foreign national."

1 0

Re: Anonymous phone calls...
by SGT=DARREN=S.=HARLOW%ISB%MCTSSA＠nwsfallbrook3.nwac.sea06.navy.mil 17 Dec '03

17 Dec '03

One of the problems of using the pre-paid cards was brought to light recently in the Olympic incident of Harding/Kerrigan. Harding's husband bought one of the cards to make phone calls and they traced the calls back to him via the card, since you have to present valid ID to purchase those. Sgt Darren Harlow - Computer Security MCTSSA, Camp Pendleton, USMC Internet: harlowd(a)nwsfallbrook3.nwac.sea06.navy.mil or another less reliable & slower: harlow(a)mqg1.usmc.mil Voice: Comm: (619) 725-2970 DSN (Autovon): 365-2970 Fax: Comm: (619) 725-9512 DSN (Autovon): 365-9512 PGP Public key available upon request "The views expressed are my own, and always will be..."

5 4

Re: Keyserver service outRAGE
by Hal 17 Dec '03

17 Dec '03

Let's not fly off the handle. This _could_ be a very promising development. IF source code is available, this would be, at last, a U.S.-legal, free version of PGP. Let's wait and see what Phil Zimmermann has to say. Hal

3 2

Re:The Value of Money
by GRABOW_GEOFFREY＠tandem.com 17 Dec '03

17 Dec '03

blancw(a)microsoft.com writes: >I understand this much: there is some gold and other actual metal >located in a vault, sitting there as a symbolic standard of wealth, >worth, value. Everyone stakes a claim to it, and they exchange that >claim to others in substitution for something else (dog, rifle, gas in >the car, baby-sitting). These claims can circulate as fast as a >computer can calcualte & transfer them, and that is all that circulates >while the standard continues to sit in the vault, not being used for >anything by anybody. As long as you hold a claim to this lump of >stuff, you're Somebody - a force to contend with in the Market Place. Didn't Nixon take the U.S. off of the gold standard? G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | "What we demand are rigidly defined | | Oyster Bay, New York | areas of doubt and uncertainty!" | | | -------------------- | | grabow_geoffrey(a)tandem.com | Clipper, SkipJack & Digital Telephony | | | JUST SAY NO!!! | |----------------------------------------------------------------------| | PGP fingerprint = C9 95 0F C4 E9 DD 8E 73 DD 99 4E F5 EB 7A B6 1D | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re:Visual Basic (yes, Basic!), and "VBX" tools
by GRABOW_GEOFFREY＠tandem.com 17 Dec '03

17 Dec '03

Tim May writes... >Buried deep in Bill Garland's message, I found the following: > >> 6. Learn Unix. Maybe I'll get a shell account on Sameer's machine. >> I've been a DEC RSTS/VMS Basic-Plus/VAX BASIC V2 programmer for >> too long, and I've not yet become unixificated. I don't even >> know if I could read a C++ program. I'm obsolete...again. > >Maybe not. The tide may be shifting a bit. "Visual Basic," from >Microsoft, is coming on like gangbusters for Windows programmers. I agree 100%! Just check out some of the ZIP files of Windows programs on the FTP sites. Many of them include VBRUNxxx.DLL and VBX files. These are the telltale signs that the product was written in VBASIC. Even WinPGP was written using it! G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | "What we demand are rigidly defined | | Oyster Bay, New York | areas of doubt and uncertainty!" | | | -------------------- | | grabow_geoffrey(a)tandem.com | Clipper, SkipJack & Digital Telephony | | | JUST SAY NO!!! | |----------------------------------------------------------------------| | PGP fingerprint = C9 95 0F C4 E9 DD 8E 73 DD 99 4E F5 EB 7A B6 1D | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Anonymous phone calls.
by GRABOW_GEOFFREY＠tandem.com 17 Dec '03

17 Dec '03

I asked this a while ago, but my mail system has some problems and I don't know what the responses were, if any.... Is there any way to make a phone call anonymously? Caller ID can be blocked somewhat with one of those *## numbers dialed before the call is made. Is there a way to route a call through a series of phone-type remailer systems? This would allow one to make a call that would be as hard to trace as anonymous mail. Any ideas? G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | "What we demand are rigidly defined | | Oyster Bay, New York | areas of doubt and uncertainty!" | | | -------------------- | | grabow_geoffrey(a)tandem.com | Clipper, SkipJack & Digital Telephony | | | JUST SAY NO!!! | |----------------------------------------------------------------------| | PGP fingerprint = C9 95 0F C4 E9 DD 8E 73 DD 99 4E F5 EB 7A B6 1D | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4 3

Re: Anonymous phone calls.
by Black Unicorn 17 Dec '03

17 Dec '03

Is there any way to make a phone call anonymously? Caller ID can be blocked somewhat with one of those *## numbers dialed before the call is made. Is there a way to route a call through a series of phone-type remailer systems? This would allow one to make a call that would be as hard to trace as anonymous mail. Any ideas? < G.C.G. - <- There's a 1-900 number that is supposed to do this. Which I could remember what it was.

3 2

Advertisement
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

I realize that one-time pads are sort of outri these days, but what do you use when there are no computers around? I've written three programs in C which [1] construct a TeX-printable sheet of pads with pseudo-random numbers (use your own rand() function), [2] automatically encrypt a message using modular summing rather than XOR (easier to do if you don't have a computer handy), and [3] decrypt the message. They aren't the best examples of C coding, but they work. The first program is included below, conventionally encrypted with PGP. For a total of just 12 [TWELVE] Tacky Tokens I'll release the password. Please send your COIN.DAT contributions by encrypting with the PGP key below and posting to alt.test with the subject: IGNORE - NEON. Cast your bread upon the waters. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCVAi2/ZzEAAAEEOQGMwT6H90aJMTmkf3bLdMVyJ3hyBDoh8ruQfa2x/8tTEPhs 0dyOMroWwMMFQHY5Gdc7etULE6G3W8Q8CGotwFIEUMCXEc9UBeePv3WaU3ovZ/Dz bdvnTeH8KYpQhV68bi1jvX3ahM2tk5jRwK8zP9+YHv5ZpbQlubVI6pRIYxGNuGfP zntP48UABRG0CG5lb24gPEA+ =CTOG -----END PGP PUBLIC KEY BLOCK----- Since I don't know how to do a zero-knowledge (0-k) proof, I post part of the documentation below, as proof that it exists: PAD CONSTRUCTION ---------------- Cut each pad out seperately as shown, and staple together. A hot-melt glue gun can also be used for binding. The figure "EAF45" is a random value generated as a lable for each pad (see line #12 of OTP.C). 18 12 25 04 18 13 15 19 15 12 15 10 12 08 27 29 18 24 19 20 S 24 20 17 06 25 21 12 04 00 11 T 21 16 24 08 24 28 16 20 25 04 A 02 17 11 25 12 25 02 16 16 28 P 24 12 15 10 14 08 18 00 25 29 L 10 23 07 05 07 15 08 10 18 24 E 18 02 02 22 03 25 20 25 03 14 13 14 26 09 25 11 00 16 03 10 12 18 23 20 20 17 10 02 19 23 EAF45 Page 3 (etc.) -----BEGIN PGP MESSAGE----- Version: 2.3a pgAADYzOLESSLoz1Lddh5LT3bg8J5abD8CJL16I4c+9ws8KIMpnTgJjCRWysFpfn 70huIgY6tPzmRA2P7B9/foTcQ8oMNao/FAiOw8m5Hym1SKk1OdMNL+ryWRa4okTH dtBJgAg+JNFVnM5IuKy2XGnIaDwUxuF5wsgqMzXVWr0aOMFj307IYrISubo4JarG y48cRn6UOXLIFb72+Ua1aJIwTnskfEqxvPSFUOutZEPXrRUocyTWu0udD7Jdzhu1 Iq1doB1HeG1Mm0+yppwFEevCvHZKVzueWDfCZTo/b/ia2eyUZAkq6Q4BaLW4HW1j /V4R1+zxLK/MW8jeb8OMDMpzI3iEjHM/G0fm1JCfIRa3zlbOetWthxZSDlikfKaH fhUa8usOqmXlvAl/vP2thejeGfTZFQnqiLnhtj2jmJa1EKe0RAqL8ffak7/tXJHh 188oKIOuFRyKoe2lAk2oRzhvG7L99B9OZHD05L8dZD7JsVUkat6ryV2HNNlWcHuD BgT3ukYemnLKc8FQjzcqFF5gYS7grlxH5J5uFXlhdlVEsvE+hNebr8wfMmeno+Dg e4JK6RJuIxtb+YUf2oduQ7aIyw+YgWbRGVXP5rnmrQtpxZDRgfhvCYPr5IocKo79 AOkGAIjG6iihc4RektOWBc5FfwWkrSvhZ45/kxuuABnrBlQ+568c3KZybGfk8MtL n3PwKZwTaJ8O3jwYwFZceuVsgtdvKTxJvf/rH7MbwojudEwgZLg421bgCXuLUYIC AW5Qf3Lbv3SYlL+ZRjJ1GE4OUl0M3//gBvbezJphkyMVQXmmuh9Kkwisouv/Dov5 FkBvvYCAeNM/QtwwNi9HkawoOVhfO9tRFFYXVXphOx+bNBjRzWSJ4Q9ONXa3S/XG +J0vN4CA9YwzORh4e5Z45C08MmYxltfB0hVDNFEKTw0UZGFV7vlX12z5eCeoUs0K BBtWBqwxjxWRcF/HRy0d+oYG7aSbHSeJfnhXiRYuF8Z0+b7ZJLg/tjwec3K9KZ2d le4lU25pQXMLNGaBQRrwesofIWD9pwY8ZRNtEZOGZlfLWr0qqf1qITM6gTBjJBPj dhGXa8YClLqETO9gQUWI4NAZXfV+nxrBbrUYz/Ky2DD1A6SAwUm2fR/yIZDDo1+8 M9lD8EgqXAx3h02tGQ7/mj3P3c94GNturdRXzxHaXgZ+mHIj0yIaMpXRujTCs/f6 W3FTzJJMbY+bZNWE0D1eVGiwzzc5tILFDWbqGppC7YuMvYc2MA3VUoEeUa0dW9Al +JMvMvd2FP97VkQyYTLz1IBmyWBcLE6qf840Gn6qL7G7C7d1THG2PBer0TgDZm/w i6xS/hvKD4cK9yU1YBNV7apchFDs2sdyCQk/xbNckhZcbPsCSwmA7SY0sJsP3UNO CsAJ9UZbtpdZ20sakvx0Fw3CHHedJUYIU+HdGEsHUNuRVTvrR94chjEmvfhlFhPt 6+g4BTCMACz6orefPhR4vC8b3CFkvRWZvsBLP+31HvXwHMzyzNXYLtMNw/H3T+Ti LUu1iMr0ZuqDmVlmoCsegrgEbBm2c2pcZt6t3tEkcG46dEWe4i6FSs1RJAp6YM3b k1V+VOUl2pqv34JoFOIbllsSPH373PNrdW6s/DVhtre0eogMT/5tGEvQEOm59qe2 h/4DTzfzK3QbUMFTrIL43YeQVn3rAYI9+rtaaPQonnS0adzPmZ8VWDYKEsierutm M8nw1X0+zz5Gc1bsbcEuPxTVI7LSrtc6YB6HWZFFPpSAk1v4fnsjgfpq3eymUvIg uaeFfdv5xaBI7qu4lROxt8NyJqLSrcUOz1LhwwIpGhY1GNFLtj9el/VeYZ8iGqk1 7CilWSPO6mmI4k/yYM/qLWVTfVltdwnehVIlUyqf2ZTLPIYdRPJB6/pOmwf8xuMY xYVgvOHEwpSaH2yiP9yl1OHS7gOyWPMgfMb5yK56SssNt0x2FFTJKJMbWwADYPDU msvuZ2+g5BP1bOD0gt3DFV8/ShO6zqIMnsHVz57JqchBppuMT9egckkAjn+ReW9T 8+dRVrmYj7t8FMxcVAtyKL1x80Zmxt22IN4UBFCjW9SoTey3hMzzgBQPyw0nbpBJ ncNmflBEB4ROpXqgfr80WU2mmPFuNKkgQw2fOqbFtZ0sLs8b6UjBCPUZyiE0teJ6 Abs6VL2IOTHOIe6/n5tmTwZU4Ey3N+fbmQaFx9ilyROcJKD3kIaOCBAjygwQxg/g Xnfo4q2P/v90y//KavuiSeXklSzuQ6aHuSXNeSHw754E8kFRhRhQFS7TktcC0g+t CLtqQviUrxQQOzF4CbQPehONtajrGNdopST1Xvok2QVTPlK7YebEeEMEZvtSIKQo /D+9OIWUwnob11gM5rJFgwyj2zTsqlgAnlSm9PumHdSpqVzlMz3EJ47QXVhNfb3i fhvZHgjbtnPd9sGFgurwmentdJg00j8X1vfFaPMXiE/oEMF41GtQQGGI+sJTcq98 z/F0XQaoK/ilRWQ7nPVpch9knvHc8NIHQIrvYpJPneo3gw53VJ2wCTqLr45g2IVU 3N4I6B41ooaSUk4FqL1sh9BWvOxGbn6u1MUa3WjBtPIxwYB38AQJWtkKYBExckUI 7Lua0lSpeddiqB1skB9KmsqoGzVJJxFVEEaeFM2WZQyvOJtnWqqkWNMEP210mgmB 26Lgbebr/Inmn0TEXw4zfIcEFsUZ/yu2xV6KFxK7HDZiKZKv0HBgsG30KPxI2bGd 8pOVuXJu/u2L6EHPWJxZKEb6fVifbuxPJDSz4PwO8rUhW2sUSeXWfyJQXGcJhaU9 5D0zXPaZ/ZBmAZSCXEs278D06uYEcpSw29KquRSH4F2DLy17WrXMtj74U+1eub/C U5+Mt89D3yR8x0OJbLkJMi5mB2YKv3Mv2OZdr+cIQAC6qs/Mg45jl78kBXMqg3w0 +bho9omOYqv2aXeLzYD1aXX99MoBw5tP+fcguchKxWHxVgwTdwE87eGsbnRSWry2 myaVLImpBcaMfWwzaeoEknnanqJAaGJ9sjHyEaoPPSPUMOqGKN7xGsSBF4cyyM5D Jt2YDjU2aYqjlxLTTchv/YYJhXaY/6jDQOygXjMBqjZji8GRZ9IGNFIezXX3+0bC KqUlPRmuOPMj3cZVidvaEwMejKOsr/8QjaseStICPiTuJO6RlcP8Dx9AQTLxj5q/ 8WVgKiTyd68t6Aq/50EUZRYRU+64lAQ7/WIr6dNkAd4dz20aIA5ZG5NF91Rfhylo pa8VA54y8t6xNMmojBzMrHu9bJuS9C9tN84AccXgRutlsOH7XnWlIfo6kV98Q39b WOS7EIBIdt/1tQZf9TPrm8lvD3Ne/WK/ghAzjxPWTj9Bmnfuv5QlzH8rahYPQsT9 ajxLIRpIkc07A1aQUMTGqCeH+nGU1RW04pfni2JJgUTlgxNymkwP5/NBNG6NWXp7 YtfENuHVIVlszASOuEAqqA9QLktI0oAgThiICvfLsSZqf0dFElevlKUllZSCqBZU ctt6+A6g4iaLFcUO16nZQtpGDPy3ufQwEI+YpeQWO/X0O59TXECME/bmaXacIwwa 8lKJ3yNivnMzN7sl+vdQRg50b7uAAO2e9C18WM19dizqdMgGY9zWx2bc9UsTbV23 5SIDiL2szeeqqnqAild39EMMHvAzdHn6ze+iMwQnLk3Yng1VWsf2AtadzVrnCV+K AS/fw/CnLUOX3xQBsnskT1Sj9udu+TsGZ96d5F8yBX1e1y4lhq1NFXBl92qQnIps xLa71IwgA/YexiZXpNO9rthSEfmiOUFLLkHbI8FGJbWBRv///mFdz3Kjsb4hTuD4 FqfJxxQ2eRgHskShUkgI539hOe9uqRIoZ/qG8idtoi9JFp2PflzwSVrre0vqlRt6 +0gfnAvBWDMbH4Zj6lByuMPE6jljxPt+42yMmRPB0WtkaNAnw1/6XjVn0a2p1bLe 3qvMup0P9NPSPfqA1fRvK2y4OzEAB8xDHLh8b05pDwiMD9GE9553PtEkfL+4IhT2 HhXKeT14Zii8e3VA85u2ymNeqmq6EReNi7XSTuX/nWneL07FiPhKlW4RVvSYb5e8 g+2ZgG8Fd37aoPlVuCCXPv2Z/yNzu0Z4E9ft5FqnbdXMsQUt91NrAS+3h2hMdDa7 qZgzhtOscDhCTVoa0lg0Zgr4ggVnS/uajDBybOYn+qd4QWZpPH51Ayc9J5iLADNQ 8x98OAnXtelSqHm5ptCSvwIvzdP/mEOC0F100J/4OVJj69GFn85t0NaPmNoaZFpy +E39PNNJ2G33YvcXQebc5Id/dv+cPlITeHY9CBX4qyvU+WkhK0K29MU1stpU+q47 X00VnG3SempqkKDni+a1W5p6sftZ7eUN6vPCNY2chNP0vurHkFCctWU8k8FKkBwc 4PxteGtcsIW8YDF6fHxkZNqZPSFkddoxmleZ+C6lBV60278bjpUGXmWGzjOvfCdq RIYu1iZmv2srvVMVJeL0WJL7PFyKr3sS6/3feGZNoBTC/1ju1sN/mWvBR0xL0zAf Kxcra9o/xLmaUIZ3X+j0k6vXafv52Vm0BvvB62F6wanZFSdqBAx8xZ3A/KvYbRV8 4pOY+QFSJqOYv7gERx44ODw= =GuJh -----END PGP MESSAGE-----

1 0

Re: Advertisement
by Black Unicorn 17 Dec '03

17 Dec '03

-> The first program is included below, conventionally encrypted with PGP. For a total of just 12 [TWELVE] Tacky Tokens I'll release the password. Please send your COIN.DAT contributions by encrypting with the PGP key below and posting to alt.test with the subject: IGNORE - NEON. <- Is there a mac version?

1 0

Server clusterfuck
by Black Unicorn 17 Dec '03

17 Dec '03

-> From: Derek Atkins <warlord(a)ATHENA.MIT.EDU> Sigh... You know, when things are on a delicate balance, a single message sent too soon can really screw things up. I can tell you for certain that your questions *will* be answered in due time, please wait for the final arrangements to be made. No, PGP 2.5 is *NOT* available (this second). Yes, there is one in the works, and I expect it Real Soon Now. Also, please do not condemn Bal or his keyserver for not accepting keys from versions of PGP before 2.4 -- as I understand it, that was part of the agreement in order to make 2.5 happen, but I really don't know all the details. <- Then this should have be stated in the "press release" message he sent. As should have the details, what were available, of the PGP 2.5 release. The fact that the limitations on the keyserver were imposed only makes me wonder more. I hope the code of 2.5 is looked at real carefully. -uni- (Dark)

3 2

Re: Keyserver service outage
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Adam Shostack writes: > I think folks outside the US can legally run 2.4 or 2.5, as > there are no restrictions in their countries on using that software. > The difficulty is getting it outside of the US without getting anyone Not true. The problem is copyright, which is honored by Berne Convention signers even if they don't have software patents or patent-after-publishing rules like the US. This includes Europe, the U.S., and many other places. ViaCrypt 2.4 is copyrighted by ViaCrypt, and RSAREF is copyrighted by RSA, so you won't be able to use 2.5 source outside the US either; not sure about binaries. There's an easy cure for this, though - if some non-North-American wants to write an RSAREF-compatible software package in C and distribute it as freeware, then it can be used in non-US versions of things that require RSAREF. An interesting question is whether PGP 2.5 will include any restrictions on the non-RSAREF portions of the source code, like not talking to earlier PGPs, or the RSAREF interface glue not being exportable or whatever. But we'll see real soon. Bill

1 0

Re: Server clusterfuck
by Black Unicorn 17 Dec '03

17 Dec '03

-> As I said, I do know that the limitation son the keyserver were part of the bargain to get a legal non-infringing freeware version of PGP... Take that any way you want. Onoce I see the code and can peruse it, I will probably trust 2.5 as much as I have trusted other versions of the code. > I hope the code of 2.5 is looked at real carefully. Trust me, it will be! -derek <- Fair enough Mr. Atkins. And thanks! -uni-

1 0

RE: Anonymous phone calls.
by David Scheidt 17 Dec '03

17 Dec '03

> I asked this a while ago, but my mail system has some problems and >I don't know what the responses were, if any.... > > Is there any way to make a phone call anonymously? Caller ID can be >blocked somewhat with one of those *## numbers dialed before the call >is made. Is there a way to route a call through a series of phone-type >remailer systems? This would allow one to make a call that would be as >hard to trace as anonymous mail. > > Any ideas? > I know that the PBX my school is behind shows up in the outside world as one of a limited set of trunk numbers. This means that calls to the real world will show up as a number other than the one you are calling from, and also that it is not likely to be the same number on any given pair of calls. A friend discovered this when dealing with an AT&T long-distance relay operator. They have an 800 number you call, and then they will bill the number that their ANI pulls off. I should think that AT&T of all people would have a good enough system that if it were possible to get the number they would manage it. The Operator, whom my friend knew, commented that the number was odd, and this led to some expirmentation which confirmed the number was not his, and a couple of other similiar things. I would suspect that there are many other PBX's which operate in a similiar manner. david -------------------------------------------------------------------------------- David Scheidt scheida(a)yang.earlham.edu "If we don't remember what we do, how will we know who we are?" -Ronald Reagan

1 0

Toolkits, Bugs, and Interfaces
by bart＠netcom.com 17 Dec '03

17 Dec '03

Ten days ago Tim May ended a post on Toolkits: "For digital money to succeed, there had better not be flaws and loopholes that allow attackers to drain your money away or to cause confusion and doubt amongst your customers!..." I think near certainty of correct function is needed for all cryptographic software to find acceptance with the general public. Of the the aspects needed, algorithmic correctness has received most attention here thusfar. I want to second Tim's call for a Toolkit in particular relation to two other needs: a facile user interface and freedom from bugs. These are necessary so that when Alice Anyone feels the need for crypto, she can get software, easily used, that prevents foolish misuse, and is both free of bugs and weakness to attack. At the state of the art, we cannot guarantee these any more than we can assert the future security of our algorithms. But our best approach is to get working tools into the hands of testers and critical users to begin the process of debugging and revision. I would suggest that cypherpunks both write and test code. I recommend two books to stimulate thought on debugging and interface design, both of which I enjoyed reading. "Digital Woes: Why we should not depend on software" by Lauren Ruth Weiner is a new, (First printing - Sept.93) work about bugs. In 209 pages, backed by 365 citations to the literature (often comp.risks), it offers a view of the range of software failures that have occurred. Perhaps we can attend to history and not need to repeat it. Donald Norman's "Design of veryday Things" is an outstanding work on interface design. An excerpt that I read in Dr. Dobbs one morning made me rush to a bookshop and buy it before noon! HOW TO DO THINGS WRONG If you set out to make something difficult to use, you could probably do no better than to copy the designers of modern computer systems....: * Make things invisible. Widen the Gulf of Execution: give no hints to the operations expected. Establish a Gulf of Evaluation: give no feedback, no visible results of the actions just taken. Exploit the tyranny of the blank screen. ... * Be inconsistent: change the rules. Let something be done one way in one mode and another way in another mode. This is especially effective where it is necessary to go back and forth between these modes. ... * Make operations dangerous. Allow a single erroneous action to destroy invaluable work. Make it easy to do disastrous things. But put warnings in the manual; then when people complain, you can ask, "But didn't you read the manual?"

1 0

MacPGP Help Needed
by MWayne＠eworld.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Greetings-- I am trying to add a key to my public ring..when I indicate which text file to read, I get an ewrror message...as follows: > No keys found in 'Spectrum:Desktop Folder:Untitled 1'. > Keyring add error. > For a usage summary, type: pgp -h > For more detailed help, consult the PGP User's Guide. I am using MacPGP 2.3 (v1.05), the file is a text file, the key was generated with the ViaCrypt version of PGP Thanks in advance - --Mitch -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLcgc1TIAcJ9oIU2VAQF1PwP+MpLtaa/+Qn2FV4UtobQSve4L0Sg+daGK vYxbvzdtBlk83LYH8Lm1zE1xXmet5mqND0uvaJVZvXI9iFKcNOZ8vBmg/GKCdGOe reoACv8cgIdl5uWo/yP5LwWAdVsDawelOl+fnw7/KIl8+IUmL4eJ99QagI0QynHm Kve9LHuJIb4= =RyJ+ -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCPAi2eV7AAAAEEAM2RhjhZynZHT7jCXVFTuJLsoq0OIiEgI/bSsPyrkZK8Y4Lt YZRSimv1Z3sX+pswbMuIIzxxUjAtlm3ICEHxXlNDhULphLqYCoMnodtwJNqxYZ9V qmSyndYs8CHuoTjBSjvQjmEgtrgC+RTzRI07p+EXOPSD9Ba3JDIAcJ9oIU2VABEB AAG0H01pdGNoIFdheW5lIDxNV2F5bmVAZVdvcmxkLmNvbT6JAJUCBRAtvgRS/O3L BWk4oUkBAesLA/0bB9RaUb1FWpi2wFZBnT/Ee/mpHPAlEU7KaqXppPYmdt592TN6 J5S95iXKBCz4YXw4mvaBQX6xB9aeFotKNlxDrUOO9EIEnyeLxRHNy7rVT/VPfCVt 8GZo8O3JFdmphqpoBhWdxtatbE1MJxj1AI0DSvd0viZeQqf3Qvbg3cyhMIkAlQIF EC2372oyAHCfaCFNlQEBRGoEAIeL9+jJiVCtMpbS0jXfJdGG9HcFXBnkOklg3XYc cHNwo+z4BbbxmBzRLToztmtfHIfZ9urebu4kbCUG3F3kkXawSbd4fn/bsYpyfBaO sUfaRSeBtK2yPh4LlW0yVdDZhDzAjpX51Lu5SF+vbs9yC0vHlGJ1ArurzRCvowUa xOATtCdNaXRjaCBXYXluZSA8NzEyNDEuMzUzNEBjb21wdXNlcnZlLmNvbT60HU1p dGNoIFdheW5lIDxNSFdheW5lQGFvbC5jb20+ =m2yi -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Keyserver service outage
by MWayne＠eworld.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- OK--so what about those of us who use MacPGP 2.3? Is there a new version 2.5 for Mac? If so where do I get it if I can't ftp to a site (sorry folks...don't hate me 'cause I don't have full Net access (yet!!))... - --Mitch -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLciSCzIAcJ9oIU2VAQEOGwP/bnX4Y/E2mPkPJdGmE1RXDMrLObrEtS19 XtrPVoAb3cZyqXE2IK9wWpBe65TwuMD8SxSk//hEe6Mw2j+mWoDOfOCwYAII+F86 wpuHdTLnDxThS109H5VyvH++g1/+n6xpAcAZFs4KILnLjXwcJMBabrnGDTjuS/Ld D76Ny9wKPiQ= =VYWy -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCPAi2eV7AAAAEEAM2RhjhZynZHT7jCXVFTuJLsoq0OIiEgI/bSsPyrkZK8Y4Lt YZRSimv1Z3sX+pswbMuIIzxxUjAtlm3ICEHxXlNDhULphLqYCoMnodtwJNqxYZ9V qmSyndYs8CHuoTjBSjvQjmEgtrgC+RTzRI07p+EXOPSD9Ba3JDIAcJ9oIU2VABEB AAG0H01pdGNoIFdheW5lIDxNV2F5bmVAZVdvcmxkLmNvbT6JAJUCBRAtvgRS/O3L BWk4oUkBAesLA/0bB9RaUb1FWpi2wFZBnT/Ee/mpHPAlEU7KaqXppPYmdt592TN6 J5S95iXKBCz4YXw4mvaBQX6xB9aeFotKNlxDrUOO9EIEnyeLxRHNy7rVT/VPfCVt 8GZo8O3JFdmphqpoBhWdxtatbE1MJxj1AI0DSvd0viZeQqf3Qvbg3cyhMIkAlQIF EC2372oyAHCfaCFNlQEBRGoEAIeL9+jJiVCtMpbS0jXfJdGG9HcFXBnkOklg3XYc cHNwo+z4BbbxmBzRLToztmtfHIfZ9urebu4kbCUG3F3kkXawSbd4fn/bsYpyfBaO sUfaRSeBtK2yPh4LlW0yVdDZhDzAjpX51Lu5SF+vbs9yC0vHlGJ1ArurzRCvowUa xOATtCdNaXRjaCBXYXluZSA8NzEyNDEuMzUzNEBjb21wdXNlcnZlLmNvbT60HU1p dGNoIFdheW5lIDxNSFdheW5lQGFvbC5jb20+ =m2yi -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Keyserver service outRAGE
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: From: Black Unicorn <unicorn(a)access.digex.net> : This is silly. : Why a server would want to use licensed code is understandable. : Why a server would try to restrict keys generated by versions other : than 2.4 & the mysterious 2.5 is moronic. They were told to as part of the deal to get the license. : I will not use this server regardless of which version I have and use, : and I urge others to resist the use of this server as well. : This policy only serves to create suspicion and drain confidence in : versions of PGP over 2.3a. No no, you missed the point! 2.5 will be made *public*! It's not another private viacrypt job. : I ask the following questions: : Will source code be available for PGP2.5? Of course. : Who was responsible for the modifications that make PGP2.5, version 2.5? : I ask the operators of the remaining servers to remove the MIT server : from their automatic mirror update list and to avoid a policy of excluding : keys generated by any "non-conforming" software in their own operations. I don't think they'll listen. They understand the politics better than you do. : I ask users of PGP not to add future keys to the offending server. Why? Add it to any one and it'll end up there. : I call on cypherpunks to estlablish less formal key servers and develop : more stealthy and secure methods of key distribution. Now you're just talking crap. Uni, hush now, shut up, and listen. You've entirely missed the point here. This is a major tactical strike for pgp. We finally have an entirely legal pgp, thanks to some excellent net.politics from the guys at MIT. The restriction on what new keys they accept was part of the deal, but stop and think what it really means - is it going to affect *anybody*? And what's to stop you fetching 2.5 and loading/re-dumping your old key from that version? This is *good news*, and we don't need any half-cocked wallies spreading FUD over what is the best thing to happen to pgp ever. G

1 0

Re: Anonymous phone calls.
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >> Is there any way to make a phone call anonymously? Caller ID can be >> blocked somewhat with one of those *## numbers dialed before the call >> is made. Is there a way to route a call through a series of phone-type >> remailer systems? This would allow one to make a call that would be as >> hard to trace as anonymous mail. > There's a 1-900 number that is supposed to do this. > Which I could remember what it was. I think it's 1-900-STOPPER. Not sure, use it at your own risk. Routing calls through many locations is possible if you aren't wound up about toll fraud; once upon a time it was SOP, back when MCI and the rest all had 7-digit local dialups which gave you another dialtone; folks who wanted to make tracing a call tougher could call a local dialup, use a "k0de" and call a dialup across the country, use a "k0de" to call a third dialup, and so forth; finally use another "k0de" to call the real target. Signal quality decreases with each hop. I imagine that folks still do this with PBX's and the like, though my impression is that there isn't much left for a phreak to do these days. Don't forget our friend Mister Payphone. Not stylish, but still relatively anonymous. Also useful may be the pre-paid calling cards; Pat Townson (sp?), the Telecom Digest moderator, was selling them for awhile. I understand they're also available in truck stops and on college campuses, but can't remember seeing them. (Haven't gone looking, though). I've got a few of the ones that Pat was selling left, if anyone wants to pony up some Tacky Tokens. The ones I've seen involve an 800 number, so somebody knows you made the call - but if it's a peculiar little reseller connected to an aggregator who buys time from whoever's got it cheapest, it may be hard to track them down to make them talk. And, of course, there are any number of ways to "borrow" a phone with varying degrees of legality/morality - lots of places around town here have "courtesy phones" where you can make a local call; just ask a salesperson in a department store, or look around at a university. If you've got a lineman's set - or a cheap $10 phone with alligator clips instead of an RJ-11, any phone line can be yours, for a few minutes. I guess the short answer is that the really anonymous ways aren't convenient or legal, if it's a long-distance call. Remember, blocking caller ID means that the called party doesn't know who called, but the phone company still does. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLcjbqX3YhjZY3fMNAQHszQP/VFbx/H7wIHTgo0q1cs7KtWL7BDaaNCMH TF5xjGCYnnvJiCblw4uPjiMsHMwq01fO8duqD6H5+9KtBtAG8dEAD9IMUTITS+/3 mE2mGNRYI9xpIyzCLevTC5llTRIMhHhx/XweWtuJyf3vJzlwkRH7s8VHAdSeoO08 73Vj8XCcszU= =YjOb -----END PGP SIGNATURE-----

2 1

Re: Anonymous phone calls.
by daily%cbpi.UUCP＠DMC.COM 17 Dec '03

17 Dec '03

> Is there any way to make a phone call anonymously? Caller ID can be >blocked somewhat with one of those *## numbers dialed before the call >is made. Is there a way to route a call through a series of phone-type >remailer systems? This would allow one to make a call that would be as >hard to trace as anonymous mail. > Any ideas? < G.C.G. The best way to make a truly anonymous call is to hack a pbx. Most of them have a feature(This feature is turned off by default on AT&T pbx) that allows you to call into the pbx from any phone and get a second dial tone. Sometimes there is a code(4-8 digits on AT&T) you must enter to get the second dial tone. Also, you might have to dial the trunk access code (usually 8 or 9) to get an outside dial tone. The first dialtone lets you enter an extension # in the pbx. The reason that this is the best way is because if you are using a 900 service to make the anon call, you get billed at the number you are calling from, so if there were a trap on the line you were calling, they'd have the 900 service provider's number, the 900 service provider would have your number, and you'd no longer be anonymous. With the pbx hack, the likely hood of a trap being on this line is next to nothing. If there were a trap on the number you were making the anon call to, they would only get the number of the trunk that your call left the pbx on, not the number you were calling from. jim(a)cbpi.com

1 0

MFC, was [Visual Basic (yes, Basic!), and "VBX" tools
by Pat Farrell 17 Dec '03

17 Dec '03

In message Wed, 4 May 94 13:36:38 -0700, hughes(a)ah.com (Eric Hughes) writes: >> fortuitous decision to incoporate Windows "foundation classes" (a C++ >> notion, of course) into Visual Basic > > Classes are C++. Foundation classes are Microsoft Foundation Classes, > are just a large library that Microsoft wrote which is also included > in the C++ compiler products. It is correct that MFC is simply a set of C++ classes, which are included (and their source) in the Microsoft Visual C++ environments for Windows and Windows NT. But there are significances to MFC that should be mentioned. (They are also included in the Samatec [sic] compiler products. Probably others RSN) First, MFC (and related parts of MSVC) makes writing Windows applications orders of magnitude easier than using the old SDK approach. Just as with the Borland class suite, no one who has used MFC will ever go back to hand-coding SDK calls, except for the occasional wild hack. Secondly, and IMHO more importantly, MFC 2.5 makes it easy to write OLE 2.0 compliant applications. OLE is the foundation of Microsoft's "component software development" approach (see last month's Byte for a good overview). OLE is how Microsoft expects folks to hook applications together in a seemless way. OLE is used currently in Office to make Word, Excel and Powerpoint interoperate transparently, and its use will grow when Chicago is released (RSN, I know) With little work, a programmer should be able to make an OLE server that allows users to drop Word, Excel, or other documents into an "encryption server" or write an OLE client that uses the server. Most of this can also be done with Visual Basic, which is a cool tool. But Visual C++ is still C, so it makes grabing parts of PGP or PGPTools and building them into the servers and clients is much more "native" Thirdly, MFC effectively isolates the programmer from the OS. As a long time assembly hacker, I wasn't too keen on this. But MFC makes porting trivial for most Windows and Windows for Workstations (aka NT) apps, and RSN we are supposed to get MFC for the Macintosh. This will cover some huge portion of the desktop computing universe. Once you are above 95% of the market, I don't care about arguing the last percent or two. For those on this list that like to "write code" and speak some C or C++ I strongly recommend looking at Visual C++ and MFC. At $129 for the "competitive upgrade" it is even pretty cheap. Please followup off list if you need more info, like recommended configurations, etc. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Re: The Value of Money
by werner＠mc.ab.com 17 Dec '03

17 Dec '03

>Date: Wed, 4 May 1994 17:24:13 -0400 (EDT) >From: Llywelyn <samman(a)CS.YALE.EDU> > >Unless of course you have a $ bill that is a specie note. I have a few ten >dollar bills that state that they are redeemable for specie. I have some funny money, myself. I have several of the original federal reserve notes, that came out after the U.S. went off the silver standard. They look just like a silver certificate, except they say they are redeemable in "lawful money" instead of "silver". A couple of years later, once the fuss had died down, they changed them to say that they ARE "lawful money". Of course, if you took one of the original federal reserve notes to a federal reserve bank to redeem it, they just gave you another one, but the impression they gave the public was that you COULD get silver (i.e., what the public considered to be "lawful money") if you really wanted it. I had an interesting experience in the late '70s with a torn $50 bill. A friend's pit bull had chewed it, but it was mostly still there. Neither of us had a bank account, as we were trying to pretend we were bigshots (no paper trails, etc.). Since I was travelling occasionally to Wash, DC, I told him I could take it to the treasury department and get a good one. They took the bill away from me, and gave me a check for $50! I had to get my girlfriend to cash it. tw

1 0

Re: EFF Summary of May 3 1994 Clipper and Digital Telephony Hearings
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

Dr. Farber suggested that at >the very least Congress weld into law a guarantee that Clipper remain >voluntary, that the Judiciary be an escrow holder. He cautioned, in the >words of Benjamin Franklin, "They that can give up essential liberty to >obtain a little temporary safety deserve neither liberty nor safety" Ben Franklin also said, "Three can keep a secret if two are dead."

1 0