December 2003 - cypherpunks-legacy

PV Advocate on Clipper in `95
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Just ran across a pretty nice (IMHO) short piece of media coverage of Clipper in a local weekly, the [Pioneer] Valley Advocate. This is item #85 in the "Tech Check" section of their list of "95 Things to Watch for in 1995". Joint authors of the whole forecast are: Mark Kendall Anderson, Everett Hafner, Stephanie Kraft, Tom Mudd, Steve Penhollow, Chris Rohmann, David Simons, Michael Strohl, and Rob Weir. ------------------ begin included text ---------------------- 85. Clipper Clipping Along Unfortunately, the failure of the mainstream media to cover the government's steamroller tactics in technology policy may well continue. The ``Clipper Chip,'' what NSA, CIA and FBI spooks see as the ideal data protection measure, stands to become national standard if all goes as planned. That is, as more people communicate with digital devices (computers and TVs and eventually telephones and faxes) the need to scramble and unscramble communications will increase -- ideally so that the phone conversation you have with your uncle or the email you send to a co-worker is private and unintelligible to anyone else. However, in the brave new world as it currently is being designed, the feds will also be able to decode every digital signal the Clipper chip scrambles. Consequently, drug kingpins, mafiosi, and anyone else requiring secure communications will have it (real data encryption is cheap and relatively easy to implement), while the remaining information consumers will have Big Brother to contend with. --------------------- end included text ---------------------- FYI, the Advocate accepts letters at 71632.100(a)compuserve.com. -L. Futplex McCarthy; PGP key by finger or server "The objective is for us to get those conversations whether they're by an alligator clip or ones and zeroes. Wherever they are, whatever they are, I need them." -FBI Dir. Freeh - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLxEBwmf7YYibNzjpAQFdkgQAkciJkPMXESO9yvl3jKaH7WT6H4wGcgfG W8KyX2myH1zOmN/aZAQVSWX/Rtrs3r+gTwIlCf7DVhFnp1n+lImzrs/T8pKTx/25 gh30s6sm0AGrxcxCV8rgKbXT4KCdPOlXT+kTp5wWaLYBqbZlogvyQIivW3GLZ1U/ 9YnjTb0OXNk= =DaLq - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxEC7CoZzwIn1bdtAQEl6AGAtktxeMXLzVqxHi/0qhEgGRtlCg5Oq/aa O/RrNyyqbV8eKzSr/n06bt98bGfRfbgY =ullh -----END PGP SIGNATURE-----

1 0

Re: Too Much!
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 01:16 AM 1/7/95 -0500, L. Todd Masco wrote: >You might want to try reading it from NNTP, via c2.org or hks.net. You >can then use Kill files. At that point, isn't the mailing list simply becoming a newsgroup? For that matter, is there some reason that escapes me why it ISN'T a newsgroup? I suppose the proportion of net.kooks is higher in a newsgroup than a mailing list, but arguably we're ALL net.kooks here. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

Re: Soapbox mode on!(but short)
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 01:22 AM 1/7/95, Carol Anne Braddock wrote: >Dear Paul J. Ste. Marie, > >I was quietly going through my mail after an eight hour layoff. >The first thing you do is lie. > >I have called you a liar. Point Blank! > >And for the honor of this very list, so that there is some >credibility, I shall retrieve from a tin reader the actual >posting, COMPLETE WITH HEADER. Interesting. You did retrieve the message I posted, but not the article from alt.current-events.net-abuse. If you want to call me a liar, that's fine, but post something with some relevance. I'm not in the habit of scanning the news hierarchy for spam, and I'm perfectly willing to believe you stopped after ten groups, but that isn't what I recalled seeing in a.c-e.n-a. I could be remebering things wrong, but if that is the case, kindly post something that actually shows the discussion in a.c-e.n-a was otherwise. >And what makes creeps like you going is the ability to continue, >to spread those lies. And now you're sounding like Martha Siegel. My words were: >> The discussion on alt.current-events.net-abuse seemed to indicate that the ^^^^^^^^^^^^^^^^^^ >> claim of "Just 10" above is a slight understandment. The newsgroups seem to >> have been hit alphabetically, and I believe the total count was in the >> hundreds. Am I rememebering a.c-e.n-a inaccurately, or have you simply decided not to rebut anything in the forum in which it was presented? All I suggested is that your account bore checking out before people leaped to your defense. An unwillingness to have your story verified speaks for itself. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

Re: carrol(
by m00012＠KANGA.STCLOUD.MSUS.EDU 17 Dec '03

17 Dec '03

I would put her in my killfile, but I don't know if vms has a kill file capibility. I use my unix accounts for important email, and do not want to have to sift through the volume I get from the cypherpunks. Otherwise, given that the percentage of interesting posts is going down as a result of carrolann (and perhaps me too now), I think having an elite group capable of banning certain people is perfectly ethical. mike

1 0

cipher magazine
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Someone just gave me this URL. It's probably in the cyphernomicon already, but I had fun rooting around in here and thought I'd pass it around to those who haven't seen it yet. http://www.itd.nrl.navy.mil:80/ITD/5540/ieee/cipher/ Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

how to subscribe
by Jonathan Nelson 17 Dec '03

17 Dec '03

can someone please mail me where to post to get subscribed Jonathan Nelson a015880t(a)bcfreenet.seflin.lib.fl.us

1 0

The Value of Anonymity
by mkj＠october.ducktown.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The value of anonymity, both on the nets and off, seems to be poorly understood, even among its strongest defenders. The positive value of anonymity is not merely about protecting a few special groups such as sexual-abuse victims and whistleblowers. While these are certainly valuable uses, if I believed that anonymity's positive impact were limited to these outside-the-mainstream groups, then I probably wouldn't accept the benefits of anonymity as outweighing its costs. But in fact, I believe that anonymity has crucially important benefits for nearly everyone. There are several good arguments to be made, but in the interest of brevity I'll focus on only one: The explosive development of such personal data industries as targeted marketing and consumer and demographic profiling, have demonstrated that the business community considers personal data to be of great economic value. (There's a parallel observation to be made here about governments, but I won't go into that now.) There are also myriad uses being made of personal data throughout the professions, from labor negotiators to house burglars. It is something of a truism that anyone who knows enough about you can probably find a way to beat you, either legally or illegally, often at great profit to themselves. In an information-age society without extremely strong privacy protections, the chief factor which makes the difference between winners and losers may be how much information each of us has on others, and how much they have on us. Given this degree of economic and social motivation, it is easy to imagine the sort of panopticon which will soon arise on the Internet (and its descendants), unless the strongest possible protections are adopted. (And it is equally easy to imagine who the biggest winners and losers will be.) Relying on government to protect personal privacy is like appointing the fox to guard the henhouse (or, as I seem to recall John Perry Barlow once putting it, "... getting a peeping tom to install your window blinds," or something like that). In addition to the government's own motivations for eroding privacy, all the above economic considerations enter into government through lobbying, desires to maximize tax revenues, fund-raising considerations, and a whole raft of other avenues. Furthermore, the only tools which government could bring to bear would be a complex web of laws and regulations governing the circulation of personal data. Such laws and regulations would have to constantly shift in a never ending cat-and-mouse game with business; and what's more, many of these laws and regulations would necessarily conflict with the free speech rights of private organizations. Bottom line: Anonymity is the only available tool which puts control over my own privacy firmly into my own hands, where it belongs, and does so without infringing on anyone's freedom of speech. Certainly there are drawbacks, and anonymity may invite some abuses; but we have survived anonymity's problems in the past, and 'tis better to suffer in the hell we know than to be dragged into a new and hotter one. The only society without any crime is a society without any freedom. My ($.02) conclusion: For preserving meaningful privacy, and for preventing an ugly and probably irreversible transformation of our world, anonymity is the best, perhaps the only viable tool we have. --- mkj -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLw+MZF11Wd4tm8clAQHC3QP8DrxVrUAUM+UKKeKzosFmCXGLkuwJYGDS nE+pFEFIDC8cq7/35h99oIrCszmnkIjwso8PhwlwqRzuxFTZPMI3XuK5wt95tJCL 6Iy2oQ7wjCv+xnL2QjdAGNl68WD0ZhmPv9Q62cvWYjzRXnQJJF7dZiES5l14/NM2 Ij4rLh8AdEo= =OGBF -----END PGP SIGNATURE-----

2 1

Re: Remailer Abuse
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > >See above. What's the difference between A-->B-->C-->B and A-->B-->C-->D ? >If someone is logging messages and routing, it's less secure, but then so is >the entire remailer system. Prime remailer operators are those who don't >log. > >Maybe message size would tip off snoopers. This can be overcome with minor >tweaking to existing remailer code by tacking on or or eliminating padding >to messages. But logging still makes the whole system extremely vulnerable. > >=D.C. Williams <dcwill(a)ee.unr.edu> > Message size can best be handled by using a remailer which uses messages which never change size. Mixmaster is now ready for testing. It still does not run on Linux or FreeBSD. I don't know what else it does run on. It works great on Sun machines with gcc. Since it is export restricted, send me mail and I will send you the name of the hidden directory to get the file. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLw+btVVkk3dax7hlAQFW/QP9GZAIODaKt/VYsDGWUExiY4NUapvnQpZ/ FWtucyqX+4v9JnJv318PaKEs5xqHMcqtdq0fGZn6qNe1k5MbSVBb5wzfclMQm3LY J7b3qv8zymedXpcmM2hm6bCnbpJkRivIjJTCDmg2yMKRH1Uv+Le5eN2haRxw3d76 e51KLqZJbh4= =BKtC -----END PGP SIGNATURE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Home of "chain" the remailer chaining script. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

Re: The Value of Anonymity
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: mkj(a)october.ducktown.org > The value of anonymity, both on the nets and off, seems to be poorly > understood, even among its strongest defenders. The positive value of > anonymity is not merely about protecting a few special groups such as > sexual-abuse victims and whistleblowers. While these are certainly > valuable uses, if I believed that anonymity's positive impact were > limited to these outside-the-mainstream groups, then I probably > wouldn't accept the benefits of anonymity as outweighing its costs. These are good points. However I think your presentation is a little too oriented towards the libertarian perspective of distrusting government, and also comes off sounding harshly competitive: > It is something of a truism that > anyone who knows enough about you can probably find a way to beat you, > either legally or illegally, often at great profit to themselves. > > In an information-age society without extremely strong privacy > protections, the chief factor which makes the difference between > winners and losers may be how much information each of us has on > others, and how much they have on us. I think most people don't think so much in terms of winners and losers, of beating and being beaten. Rather, I think it will be more acceptable to couch the issue in simple privacy terms. People do value their privacy. I don't think you have to overly justify the value of privacy. A few examples of how little privacy people could actually have in a non-anonymous network of the future should suffice to establish motivation IMO. > Given this degree of economic > and social motivation, it is easy to imagine the sort of panopticon > which will soon arise on the Internet (and its descendants), unless > the strongest possible protections are adopted. I like this phrase! It nicely connotes the transparency of the nets. > Relying on government to protect personal privacy is like appointing > the fox to guard the henhouse (or, as I seem to recall John Perry > Barlow once putting it, "... getting a peeping tom to install your > window blinds," or something like that). In addition to the > government's own motivations for eroding privacy, all the above > economic considerations enter into government through lobbying, > desires to maximize tax revenues, fund-raising considerations, and a > whole raft of other avenues. This is where I think you are getting too libertarian for a broad audience. Also, this wording invites the reader to assume that anonymity will lead to tax avoidance and evading laws. Most people feel that they are paying their own taxes, and if others avoid them then it just increases the burden on themselves. So except to certain selected groups I would avoid playing this angle up. I think your next argument will have wider appeal: > Furthermore, the only tools which government could bring to bear would > be a complex web of laws and regulations governing the circulation of > personal data. Such laws and regulations would have to constantly > shift in a never ending cat-and-mouse game with business; and what's > more, many of these laws and regulations would necessarily conflict > with the free speech rights of private organizations. Be aware that this is in fact the "mainstream" solution to the problem. There was some discussion on comp.org.eff.talk of some kind of committee headed by EFF board member Esther Dyson which issued a statement on privacy protection in the nets. They issued the by-now traditional call for laws along the lines of "information collected for one purpose cannot be used for another purposes". Like, VISA can't sell data on your spending patterns, at least not without telling you. Nobody criticized this point; even the relatively net-aware civil liberties types mostly explicitly endorsed this provision. Laws like this are apparently already in place in Europe. So the momentum is in exactly this direction. I think your arguments are good ones; the government would undoubtedly exempt itself from such rules (the IRS is already starting to use dataveillance and matching to look for discrepencies between tax returns and spending patterns), plus such provisions would seem to require a labyrinth of exceptions, special cases, etc. Eventually I could see laws telling exactly what a business can and cannot do with the names of people who phone or net in for information; yes, they can be kept on a list for up to 6 months and sent additional promotional literature, except that the business must require standard form 11832 to allow the customer to get his name off the list, which must be handled within 5 working days for businesses with more than 100 employees, etc., etc. You could have volumes of this kind of stuff. I think Tim wrote some essays a long time back pointing out the absurdity of this approach, especially if you tried to apply it to private individuals. > Bottom line: Anonymity is the only available tool which puts control > over my own privacy firmly into my own hands, where it belongs, and > does so without infringing on anyone's freedom of speech. Certainly > there are drawbacks, and anonymity may invite some abuses; but we have > survived anonymity's problems in the past, and 'tis better to suffer > in the hell we know than to be dragged into a new and hotter one. The > only society without any crime is a society without any freedom. > > My ($.02) conclusion: For preserving meaningful privacy, and for > preventing an ugly and probably irreversible transformation of our > world, anonymity is the best, perhaps the only viable tool we have. That's a good summary. This is definately an uphill battle, though. I see no significant standards body or organization of influence (except for CPs, to the extent that we have any influence) which is moving in this direction. Add to this the costs of anonymity as Wei has been discussing and it really isn't clear how to proceed. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLxAj1xnMLJtOy9MBAQGujQIAqooWk8OsbJzbAGpxIP+EYnPJM0kA7Ojm /3i04Odoq/YZEH1Fv81/RbwsDahe+AGtmqU+VQ1KpjUTJuPfNKJ4dQ== =w/FH -----END PGP SIGNATURE-----

1 0

Re: Too Much!
by L. Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Paul J. Ste. Marie writes: > At 01:16 AM 1/7/95 -0500, L. Todd Masco wrote: > >You might want to try reading it from NNTP, via c2.org or hks.net. You > >can then use Kill files. > > At that point, isn't the mailing list simply becoming a newsgroup? For that > matter, is there some reason that escapes me why it ISN'T a newsgroup? I > suppose the proportion of net.kooks is higher in a newsgroup than a mailing > list, but arguably we're ALL net.kooks here. Not really, not until a huge number of hosts carry it as a newsgroup. As for why cypherpunks isn't a newsgroup... IMO, it would end up carrying too much traffic and be way too high profile. As is, the people who really want to find it will and a hordes of riff-raff (not all, mind you) are less likely to bother with it. -- Todd - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxBD/yoZzwIn1bdtAQHMrAF8ChmS332TabEbGslXsxzOLqIHEBOnJBYs KIdzflR9PJWsYuNJBH6LrHtBWK/q7ejP =T4k6 -----END PGP SIGNATURE-----

1 0

remailers
by Raul Deluth Miller 17 Dec '03

17 Dec '03

I'm wondering if I understand this remailer debate. Here's my summary (based not so much on reading of cypherpunk traffic, but on my understanding of the basic principles): (*) define an encrypting mailer protocol (basically, just PGP or some such). When a mailer receives an encrypted message, it unpacks (0) a message which may have been doubly encoded (once by originator, once by prior remailer to disguise padding) -- if so, must decrypt twice. (1) the message to be forwarded, annotated with control info (e.g. padding, delay, key to reencrypt under) (2) payment information in whatever format is advertised for that remailer. As I understand it the problem with digital cash is defining physical link for the "cash", without compromising the identity of whoever payed into the account. The proposal-to-date involves a guild of remailers. As I see it, this would be primarily of value for shuffling cash around -- call it a build of bankers instead. Once you've established your "cash"-net, presumably with related services such as drop-boxes and temporary accounts, you could use more flexible mechanisms for anonymous mail, which feed off the cash net where necessary. I've not read Chaum(sp?)'s work on encrypted cash, so perhaps I've ignored some terribly obvious issues. [No PGP signature -- at the moment, I don't have a host sufficiently secure to be worth bothering with.] -- Raul D. Miller N=:((*/pq)&|)@ NB. public e, y, n=:*/pq <rockwell(a)nova.umd.edu> P=:*N/@:# NB. */-.,e e.&factors t=:*/<:pq 1=t|e*d NB. (,-:<:)pq is four large primes, e medium x-:d P,:y=:e P,:x NB. (d P,:y)-:D P*:N^:(i.#D)y [. D=:|.@#.d

1 0

Re: The Value of Anonymity
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Hear, hear! mkj's article on anonymity is worth reading. >From my perspective, the most important thing cryptography offers us is not just the ability to have private conversations without eavesdroppers; it's the ability to change the balance of power from the centralized control and accumulation of information that computers bring back to a level where _you_ can control what happens to your personal data. Do you _like_ starting transactions by giving some big company your Social Security Number which lets them, and everyone else, know everything you've ever done, where you live, how you vote, what you buy? We can move to a society where you can give the other party as much information as they need to do business with you, without having to give them everything else, or connect this transaction to all your others. Sometimes that means giving people more detail than you give them now, usually less. Cryptography becomes the technical glue to control how much you tell somebody on each transaction, anywhere from total anonymity to deep personal information, to let you have a driver's license that says "yes this person is a safe driver" without it becoming the key to your bank account of you lose your wallet, to have voter's registration that doesn't permit fraud but doesn't require universal identification. Some good technical references are the set of papers that David Chaum published about blind signatures and anonymous credentials. Bill

1 0

Re: From me to me to you...The Actual Article
by Erik Selberg 17 Dec '03

17 Dec '03

Carol Anne Braddock writes: > This is the article, and what I did with it. It is complete in it's > entireity, from the bang paths, to the crosspostings. Please study them > Now, the article, > Date: Sat, 7 Jan 1995 01:26:26 -0600 > From: Carol Anne Braddock <carolann(a)vortex.mm.com> > To: carolann(a)vortex.mm.com > Newsgroups: soc.support.transgendered, alt.transgendered, > mn.general, alt.sex.femdom, alt.artcom, alt.sex.bondage, alt.sex, > comp.infosystems.www.users, alt.dreams.lucid, alt.dreams > Subject: (fwd) Re: Phil Zimmermann So, I don't read any of those groups, and I could be dead wrong on all of this. But I'll yap away anyway. Off the cuff, I'd say your article could be inappropriate. Granted it's a good cause, and you're not advertising for yourself but for a charity. However, charitable spam is still spam (and I'm not calling your article spam... spam lite, maybe). I understand your point about feeling a sense of community with the above groups; however, I think that massive "Please help..." postings can be just as annoying as the MAKE.MONEY.FAST postings. Erik Selberg "I get by with a little help selberg(a)cs.washington.edu from my friends." http://www.cs.washington.edu/homes/selberg

1 0

Re: Latency, bandwidth, and anonymity
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

My initial reaction to "Anonymous video conferencing" was "That's when you wear black ski masks and use voice scramblers and call from video payphones", i.e. not very useful. ("Subcomandata Marcos here...") On the other hand, Wei Dai's followup message about > In the longer term, anonymous communication is in danger of being used > only by fringe groups if it falls too much behind the non-anonymous kind > in terms of latency and bandwidth (and cost, I guess). Maybe ONLY drug > dealers, nuclear terrorists, etc., will use anonymous remailers when full > sensory virtual interaction is the must popular way for most people to > communicate and remailers are still the only choice for the > anonymity-conscious. puts a different spin on it. It's a real problem, if not now, then maybe in 5-10 years. I realize that those of us in the Phone Company who have predicted universal Picturephone in the past have been over-optimistic :-), but the video compression people and the faster-chip people keep bringing us closer to having good-quality low-bandwidth video, and ISDN and fast modems are bringing available loop-end bandwidth up to the point that reasonably-priced circuits can carry it. (Long-haul raw bits have been cheap enough for a while; it's the distribution and switching technology that have a lot of the cost, and providing cheap high-bandwidth circuits makes it hard to make money on voice calls.) The approaches to anonymous video conferencing will depend a bit on whether the technology takes off on the nets or the phone system, if those two are still different by then. It's easier to obscure the origins of a call on the nets, where users own large parts, than it is on the phone system, where the Phone Companies own and operate most of it; the latter environment would require Phone Remailers, such as PBXs you call into on T1 lines and get shuffled out on other circuits - it's hard to get adequate mixing except in rather large environments.... Recircuiting on the nets will be left as an excercise to the reader. I suspect the harder parts of the job may be doing the faces and voices right - anonymous voice conference bridges are ok if the participants mostly don't know each other, but they're less useful if people know each other and cops with computerized voiceprint equipment may be eavesdropping (not common now, though computers and models of the human voice are improving; I suppose voice disguisers may improve from the kid's-toy quality to something better if there's a market, or if computers with full-duplex soundcards become more common.) Faces are harder, and they're not really a crypto problem - how do you fake them well? It's not too hard to do a "quayletool" quality solution that generates moving lips in front of a static picture, even timed with an audio feed, but that won't play too well in the business world, and having the camera pointing at your calendar or home page is only semi-useful. If video-calling evolves on the nets, there'll be a lot more need for speed-matching services, and it may be that computer-enhanced video receiving for high-bandwidth users will fund the technology development for face-simulation? If so, maybe you can use it to start with fake stills instead of real ones? Bill

3 2

Re: Data Haven problems
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

dfloyd asks for ideas about preventing spamming in data havens, for the code that he's working on. It's a hard job. A related problem is how to prevent your data haven from becoming the porno-ftp site of the week, and either being swamped with traffic or raided by the Post Office Reactionary Neighborhood Police. One way to stop spamming is to charge sufficient money for the service that using it always pays for itself - spamming is then reduced to a source of profit, e.g. no problem. If people want to hire you to store spam, it's their money they're wasting. But that requires an anonymous digital cash infrastructure, which we don't really have yet. And it's a lot less interesting academically (:-) than finding solutions which can also work in a cooperative system, or at least a system that doesn't charge per transaction. Probably the most important step you can take is to build in operator-selectable filtering, because the problems keep changing. Operators probably need to be able to block storage and retrieval by specific users and sites (It's easier to prevent access by president(a)whitehouse.gov than it is to detect forged requests, and you probably want to keep both real and fake Cantor&Siegel users off, plus the bozo of the month and the broken-remailer of the day.) Some operators may find it useful to limit the amount of data that can be stored or retrieved by a specific user or site, though this is less useful with anonymous and pseudonymous remailers around, since "a specific user" becomes vaguer. Filtering by filename and type can also be useful - if you don't allow files named *.gif and *.jpg, users may be less likely to spam you with pornography. Namespace control in general is an issue - do users get to choose filenames, or list directories, or do they have to know the names of files to retrieve. Another issue is whether files can only be retrieved by the sender - probably a local policy issue. Some sites may only accept encrypted files, which reduces the spam potential considerably, as well as reducing your exposure to the porn police, though it's difficult to do anything about files that are encrypted with a public key whose private key has been posted to the net, or fake crypto headers in an otherwise unencrypted file, unless you put in lots more code to check the insides of files and watch the net for such postings, which is unrealistic. There's also the problem that PGP and especially RIPEM files are non-stealthy, and users may not want to leave even keyids in their files. Bill

8 10

Re: Can someone verify this conjecture for me?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> From: nelson(a)crynwr.com (Russell Nelson) > > It seems like it solves two separate problems: 1) foiling traffic > > analysis, and 2) foiling a cheater remailer. The problems are > > separate, really, because if you really, really trust the remailer (as > > many people do Julf), then 2) isn't a problem. All you need to do is > > solve 1. Or, you can solve 1) by using a single remailer. A > > necessary but not sufficient step to foil traffic analysis is to strip > > headers. There are a couple of advantages of chaining multiple remailers. One is that traffic analysis is an art, rather than a science, and to really foil it, you've got to know how good it is, which is hard. Long-term patterns may show up even though the traffic mixes are pretty good in the short run, and if you can spread out the remailer use and increase the traffic load, plus constantly sending encrypted traffic between remailers, it does make the job harder. If the Bad Guys can isolate their target to a few remailer users, they can often find the real one by rubber-hose or a small number of wiretaps at the user locations instead of the remailers; that's impractical if there are thousands of potential users in multiple countries across the remailer-chain. Another is that if one good trustable remailer can foil traffic analysis, then multiple remailers increases the chance that at least one of them is good. Sure, Julf's a good guy, but what if the KGB has kidnapped his grandmother, or the CIA has planted wiretaps inside his computer - will you know if it's compromised? There's also the reliability issue - what if the Finnish Phone Company decides Julf is using too much of their resources and cuts him off, or the Mafia steals one of your police-informants' remailers, or the California Public Utilities Commission declares email to be a common carrier and insists on auditing all transactions? Multiple remailer in a strongest-link chain reduce the risks. Bill

1 0

Re: Vinge's True Email name ?
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <Pine.BSI.3.91.950109001111.9299A-100000(a)garnet.msen.com>, Lou Poppler <lwp(a)garnet.msen.com> wrote: >I knew that old compuserve account was good for something. >They list Vinge, Vernor San Diego CA 72267.2656(a)compuserve.com Sigh. Please don't use this, people. I'm sure VV has no desire to pay for oodles of mail telling him just how much people like him. Treat it like a home phone number (of course, some people abuse home phone numbers of famous folks...). - - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLxCrChNhgovrPB7dAQF7VgQAqsDQM0h7b0VDmBISGd3o0YqYg4q2HYmQ m0g7VtnX3yEU1vi9N96HPilMwe2JGs/6Frlvf9IKMmzGAIJxEQzGdMLbow54Il1/ akV9siQAH7BvKwaEWkzO8dDi6nl83ZtawVXIQNacIb5v9oEIQwK/vw4aYWitmDAv B0eJJUVT1XI= =u+fn - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxDlzSoZzwIn1bdtAQEXTwGAqVqaYnu+0yy8/d0HSZseTDuxP7BBWqGb PuzL4Xpu2HE7DDrIaALalplmGIYrHnun =zr9V -----END PGP SIGNATURE-----

2 1

Re: Vinge's True Email name ?
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- NOTE: This mutation of this thread has no crypto content, but some (awfully specific) privacy relevance. Todd Masco writes: > Lou Poppler <lwp(a)garnet.msen.com> wrote: > >I knew that old compuserve account was good for something. > >They list Vinge, Vernor San Diego CA [email address omitted] > Sigh. Please don't use this, people. I'm sure VV has no desire to > pay for oodles of mail telling him just how much people like him. Treat > it like a home phone number (of course, some people abuse home phone > numbers of famous folks...). I began composing a reply precisely to this effect, but was stopped by the words "They list...". If the address appears in some standard Compu$erve email directory, then this was hardly a major transgression. Allow me to suggest a compromise. If some enterprising VV fan would volunteer to collect fan mail from c'punks, then forward it all, everyone involved might be fairly satisfied. Disclaimer: I'm not familiar with the details of CI$'s fee schedule; if one pays by sheer volume and not number of messages, then obviously this approach won't alleviate the burden. Maybe then someone could volunteer actually to ask VV whether/how he'd like to hear from fans.... - - -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLxDr62f7YYibNzjpAQGxAwP+LloeLQS/BJcZciApmMWEvmOhSaCQJX8u uuwzprP2ZYTmbsb08lfTHnofS1TXKmoZ3BrYdiqjugaCTKFweg8BSZ2vw5i6KplV x2ArBnejYPKjtqs3C12mf8WJrgjnKdMZ9LxLgjlE1ymELG1bhH0loIyq3YX3x46G 69hvZyz/qQ8= =h05K - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxDtAyoZzwIn1bdtAQHLNAF+LEFF+UniR9jrXSZxd6Ia9L5aJIXjFFt3 J9aUAIUQKXf0o5ytM2nHYUvj7v0cWhn6 =e+gV -----END PGP SIGNATURE-----

2 1

More signal than YOU can handle.
by L. Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- For the moment, all of the archives that Eric just dropped me are on ftp://ftp.hks.net/cypherpunks/All I'll be making some primitive engines to access individual articles by various means but I thought I'd put 'em up in case anybody else with more disk space than brains would like to snarf 'em (following the Shulgin model). (By the way, Glimpse looks like it'll be ideal, since everything is already in its own file, the "since June" archive currently being our /usr/spool/news/... dir.) Look for more info in this space (that sucking sound is my copious free time). - - -- Todd. - -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAwUBLxD1GBNhgovrPB7dAQEOQAQAuTRIVTQOzIbjqrUAFsPu3xHTJAH+3YnX ickYtw627leo3vs7wD2rxGfHNx6As7JbzSI1JwD26zsb2CMqMGgvQHNQ5eD7rW/N 3ICSWACwESWlnL/rAFvVh69mZDM/IUv5C+eSTVHKdlh3KWYbetRvCgkRNQvGVl58 S06pthGBpJ8= =f4fe - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxD1nyoZzwIn1bdtAQEv7wGAhSVywzGivjeo9fZwVrYDRaJx596TPVeJ pjutyvubg3yyKmqFD+Ele62LhiPvhxtX =pooh -----END PGP SIGNATURE-----

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)replay.com> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; $remailer{"q"} = "<q(a)c2.org> cpunk hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 9 Jan 95 6:00:01 PST remailer email address history latency uptime ----------------------------------------------------------------------- nately remailer(a)nately.ucsd.edu ++++++++++ 1:28:30 99.99% rahul homer(a)rahul.net **#**##****# 4:31 99.99% mix mixmaster(a)nately.ucsd.edu ++-+-++-++ 48:36 99.99% penet anon(a)anon.penet.fi *+****+***** 28:32 99.99% vox remail(a)vox.xs4all.nl ----------- 14:34:13 99.99% usura usura(a)replay.com -- -+--+*** 22:31 99.44% bsu-cs nowhere(a)bsu-cs.bsu.edu +##**##***+# 23:14 99.26% ideath remailer(a)ideath.goldenbear.com * --- ----- 2:08:58 99.12% q q(a)c2.org --+--*++-- 2:33:18 98.62% soda remailer(a)csua.berkeley.edu -..-.- ... 8:10:14 98.47% alumni hal(a)alumni.caltech.edu ++ *-**+**** 7:37 97.74% portal hfinney(a)shell.portal.com ** *-#*#*#** 5:32 97.74% c2 remail(a)c2.org *--*+* *+ 1:13:45 95.50% desert remail(a)desert.xs4all.nl _.----.--- 19:54:01 94.80% extropia remail(a)extropia.wimsey.com ++__ +++++ 13:02:14 84.83% xs4all remailer(a)xs4all.nl *-- -+*** 16:29 76.54% rebma remailer(a)rebma.mn.org -*___-__- 31:31:05 70.47% flame tomaz(a)flame.sinet.org -*-*+ 29:22 37.83% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Comments and suggestions welcome! Raph Levien

1 0

Re: Vinge's True Email name ?
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>Lou Poppler says: >> I knew that old compuserve account was good for something. >> They list Vinge, Vernor San Diego CA 72267.2656(a)compuserve.com > Of course, he might have used his true name because he wanted to hear from people. Tom Clancy seems to enjoy the newsgroup created to discuss his books and he posts there regularily. Many people strive to become famous because they love the adolation of the fans. Others don't. Who knows about VV?

4 3

Re: Anonymous payment scheme
by RGRIFFITH＠sfasu.edu 17 Dec '03

17 Dec '03

>At 09:45 AM 1/3/95 -0800, Hal wrote: >> ... As I wrote, banks are >>required to get SS#'s for depositers right now, and I wouldn't expect >>that to change any time soon. If anything, the trend appears to be >>towards more tightening rather than less. ... > >Isn't that only a requirement on interst-bearing, or potentially >interest-bearing, accounts? > > --Paul J. Ste. Marie > pstemari(a)well.sf.ca.us, pstemari(a)erinet.com > Yes, but the account form will have a place for it anyway and the account opening person will demand it. My experience a few years ago was that I had to go to an officer and point out that the account was not interest bearing and so the SS# was not required in order to get the account opened without it.

1 0

HUMOR:...and we thought _PRZ_ had troubles!
by ddt＠lsd.com 17 Dec '03

17 Dec '03

My apologies for this non-crypto posting, but I just _couldn't_ resist sharing. Ironically (incredulously?), paranoia does nothing to improve one's grasp of adjectives and adverbs... Anyway, please, please restrict your replies (if any) to private email amongst yourselves and don't follow my poor example and post anything more about it to the list. BTW..."Half" street?! dave ____________________________________ "Fascinating, Captain." -Mr. Spock =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= cut here =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Newsgroups: alt.alien.visitors Subject: Truth or Paranoia? From: doctor.doom(a)citylink.uu.holonet.net Date: Fri, 6 Jan 95 21:56:00 EST I found the following disturbing post on a BBS in the Washington DC area: Msg # 48 of 83 Date: Fri 12-03-93, 6:29 pm From: UNIT Read: 7 times [1 Reply] Forwarded From: 1900 Half Street, SW Subject: important The story I am about to relate may seem incredulous in many ways even thought it is true and I solemly attest that it is true despite the fact that it seems incredulous in many ways there is verifiable evidence and i urge you to verify the evidence on your own if you should find this incredulous which is the natural response. I am a victim of government sponsored terrorism and racism sponsored by the us government and big corporations which actually work HAND IN HAND with the us government towards these ends. This of course includes the liberal media although some cells of independence remain and not all individual journalists are accessories to the conspiracy. Suffice it to say that democracy does not in any way exist in the United States of AmeriKKKa. The government has been out to get me ever since I was born in 1966 as a result of a specific genetic coding abnormality which makes me unique among the 99.9999 th percentile of the American population and makes people like me marked for harrassment. The abnormality may have been spawned by mass CIA mind control tests conducted in 1961, which affected certain birth patterns. They actually have attempted to cause me to try to kill myself on several occasions and have attempted to drive me crazy by chemical and psychological means including retroactive radio control from the future (any scientist will tell you that radio waves which move faster than light speed are capable of moving backwards in time and thus controlling the past). The constant chemical assaults on my well being mean I cannot leave my apartment except in dire circumstances and then I must breathe through a gas mask. Not only that but people are strategically placed at all places I interact with people out of necessity (I cannot avoid such encounters entirely) to make me self aware and paranoid. These efforts are futile and I continue to defy the Amerikkkan government. On June 11 1986 they deliberately influenced me by radio to be present at the intersection of Sherman Avenue and Harvard Street NW at precisely 1:42 am and I had to cross seven blocks of territory that had been sealed by the police. This is documented. I witnessed seven police forces engaged in a shootout that lasted three hours. THe police forces were shooting at EACH OTHER and I counted at least thirty verifiable casualties. Although this has never made the newspapers due to the government/corporate conspiracy the information is readily obtainable but must be sought through FOIA requests at the FBI. The files are disguised as traffic fatalities and the true cause of death is not noted. Also documentable is my genetic trait which Johns Hopkins in Baltimore will provide upon demand. I am considered a threat to the CIA because of my superior evolutionary status and my radical thoughts. In 1971 the United States abandoned the Bretton Woods system of fixed exchange rates and secretly implemented a dual currency system along with ruling elites from other major countries including the USSR and Red China. I know this because agents have tried to buy me off with this currency which exists solely in the form of informational transactions and has no physical manifestations yet makes a mockery of the valueless Dollar. I am a man of integrity and I refused to participate in this plot. Needless to say the federal deficit is measured in dollars and is therefore nonexistent and irrelevant. The secret currency system is solvent. In 1987 the Wall Street Journal documented the cataclysmic stock market crash but made no mention of the real underlying factors behind it, which again represented a government conspiracy. After I wrote to the Wall Street Journal to point this out, attempts to kill me trebled. There are also listening devices implanted everywhere to monitor my actions and junk mail sorted with DMSO and curare arrives daily. I remove the mail with tweezers and leave it on the counter for the mailman as unreturnable. He wears gloves of course. The only reason I am still alive is because I persist in making my case public at every opportunity, which means the government does not directly try to kill me but relies on third-party means which I have so far avoided. A rental car I obtained in Sausalito in 1989 was irradiated with depleted uranium which increased the total mass of the car by 33% d would have caused me to go over a cliff were it not for the normal precaution I take of always driving 15 mph under the speed limit. But it is this kind of insidiousness which I am consdtantly faced with. I also can only cross the street in crosswalks so that any attempt to kill me with a vehicle could not be blamed on pedestrian error. The only reason I am still alive is because I persist in making my case public at every opportunity, which means the government will not try to kill me directly, since that would verify my claims instantly in the public's eyes. For that reason I urge all of you to write to the media, contact your senators, and do everything you can to let the conspirators know that my story has been heard, and that the eyes of the public are upon the conspiracy. It is only through concerted collective action that I can remain alive and the AmeriKKKan government which has been ruling illegitimately since a secret coup in 1947 (documented at the Library of Congress) can be brought down and freedom restored. -end?-

1 0

Re: for-pay remailers and FV
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

Excerpts from fv: 9-Jan-95 Re: for-pay remailers and FV db(a)Tadpole.COM (2073*) > Also, there is no reason on earth to take FV for payment under > such a scheme, No reason on Earth? Try any of the following: 1. You can actually get paid, in real money, using a system that is operating NOW. 2. It requires no special software for the user of the remailer service, thus preserving a very positive feature of most of today's anonymous remailers. 3. You don't need to have a credit card merchant account (and the technical arrangements for using it) in order to run a remailer service. There are more, but those are probably the top three. > I don't see any reason to get FV involved, unless one were so lame > as to be unable to get signed up directly with the credit card > companies as a merchant -- a process of appropriate complexity > to indicate the posession of at least one (1) clue, which is prob. > desirable in someone who's going to be handling remailer finances Well, I could be wrong, but from the above paragraph I can only infer that you've never actually tried to set yourself up as a merchant. The hardest part is getting approved for a merchant account. Unless you already have an established business or money in the bank, this will *probably* be a showstopper if you want to set up a remailer-for-pay service. Getting a merchant account is never trivial, and getting one in a whole new industry is VERY hard. Once you have a merchant account, establishing the right technical setup to do the actual authorization and purchases is not rocket science, but it certainly requires more than "1 clue" -- in particular, it typically requires hooking up some special hardware, installing and configuring some new software, and some serious thought about the implications for your system's security. None of this is needed if you use FV. Also, as Paul pointed out, the requirement for reversibility applies to ANY credit-card-based service, not just FV. This is NOT an option, it is required by law (reg Z). Excerpts from fv: 10-Jan-95 Re: for-pay remailers and FV Hal(a)shell.portal.com (2603) > Perhaps you could charge some small amount for them, but require VISA > payment, and check the names on the VISA cards. (This doesn't hurt > anonymity when the tokens are actually used because of the blinding.) To > get multiple tokens a person would have to commit some serious real world > name trickery, a considerably higher barrier than making up a pseudonym > on the net. This is workable. It also reinvents a big chunk of what FV does, if you do it yourself. -- NB

2 1

Re: Remailer Abuse
by Rich Salz 17 Dec '03

17 Dec '03

What lists did you post to?

1 0