December 2003 - cypherpunks-legacy

Re: CANADIAN PRESS REPORTS (was Re: CSE gets flak on TV)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here (the real one) ... On Sat, 18 Nov 1995, Perry E. Metzger wrote: > I hope everyone realizes that Detweiler is probably arguing with > himself, three levels deep. I must admit that the levels he stoops to > in order to draw attention to himself are pathetic. Why don't you just > stick to posting as Vlad Nurzi? Its more dignified. Deitweiler certainly is getting around ... but I'm beginning to have my doubts whether it is Deitweiler who is spoofing me. And Deitweiler might be Vlad Nurzi or whoever, but it seems that whoever is spoofing me -- whether it is Detweiler or not -- is privy to certain "facts" ... verifiable facts ... some of which are very worrisome. And its not just whatever news is breaking over the wire. anonymous-remailer(a)shell.portal.com writes: > > > > Here is the TRUE unedited story for the list which Deitweiler felt he > > had to TWIST to the nth degree. His attempt at making mountains out > > of mole hills will not succeed with this one. > > This story truly is a non-starter. Big deal. It really has no > relevance to this international list. This is simply a Canadian matter. I take this last comment back. It was premature. I think that this is in fact very relevant to this list. And it's not just a Canadian matter. My little spoofing-shadow, Mr. Mystery-Writer, seems to not only have a juvenile sense of humour, but seems to have a handle on some pretty sensitive information. His information isn't limited to how Canada was able to outbid the United States on a wheat deal with China, but his information encompassess matters of an order of greater significance, especially when Mr. Mystery-Writer wrote: > And that's the fleshed out version of the story. > > I'm just sorry that our Prime Minister is in such a bad position because > of the timing of this "Jane Shorten's" revelations. She also revealed > that Canada spied on Japan. > > To think ... Canadian Prime Minister Chretien is a guest of the Japanese > people today. Talk about some awkward moments. I mean, what on earth do > you talk about?? > > George Bush and Sushi?? Whoever it was who wrote this, they took a real swipe at a former President of the United States. This is very, very serious. Joking about Japanese / American relations is very black humour and is one thing, but taking an open swipe at a former American President is grossly inappropriate and was completely another, I thought. But, ironically, Mr. Mystery-Writer had incredible foreshadowing skills. > Let's see ... over the last couple of days, we've had one provincial > Premier resign over "BingoGate" -- kickbacks from bingo games, another > premier is under some pretty heavy fire for some insider trading in a > company he promoted in Hong Kong, (actually his wife got stock she never > had to pay for), while Canada in conjunction with the normally very > neutral Swiss have frozen accounts pertaining to about $20 million or so > in kickbacks from Airbus Industries to a "senior Canadian politician". > > And all these stories ... coincidentally ... broke back to back. This to me was the kicker ... especially in light of news which just broke tonight. Mr. Mystery-Writer was trying to throw a clue. And boy, what a clue it was. It wasn't the former President of the United States that he was speaking of ... it was the former Prime Minister of Canada. It was reported today that former Canadian Prime Minister Brian Mulroney has launched a $50 Million pre-emptive lawsuit against the Royal Canadian Mounted Police and the Canadian Department of Justice for their possible future allegation or possible future charge of taking kickbacks from Airbus Industries while the former Prime Minister held public office. This is one heck of a newsflash ... especially considering the co-operation of the normally secretive and discreet authorities in Switzerland. Can you imagine if former President George Bush had in fact launched a $50 Million pre-emptive lawsuit against the Federal Bureau of Investigation and the Department of Justice, because they were investigating him for something?? Or if George Bush tried to stop a news story through libel chill? My shadow was right (even if he did announce before the wires, did), Canadian politicians are beginning to drop like flies. Let the "Jane Shorten" Film-Fest begin. Can you pass the popcorn? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

VB4 secure mail software
by Cybie＠cris.com 17 Dec '03

17 Dec '03

To the guy who was interested in writing a secure mail program that worked with MS Exchange in VB4, e-mail me... I was also thinking of working on something like that, we could probably work together on this.

1 0

Re: (CANADIAN PRESS REPORTS)
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

Detweiler wrote... >On Sat, 18 Nov 1995, jim bell wrote: > >> >anonymous writes: >> >> I still feel such a sense of violation with what LD did, such an >> >> utter sense of helplessness at the character assassination I've >> >> suffered at his hands, >> > >> >So use PGP, sign your messages. Simple solution. >> >> Absolutely! Anybody who uses anonymous remailers to post to public areas, >> and does not use digital signatures to prevent spoofing when it is obviously >> needed, is a fool or worse. > >Most people believe THAT a digital signature is evidence that I am who my >signature _says_ I am when it really doesn't do that at all. It isn't >reliable at all. > >Unfortunately, I've learned the hard way NOT to do that. Digital >signatures don't prevent spoofing. > >In fact, I think that thinking something is secure when it isn't leads >to even more trouble, and could even lead to many tragedies. > >In a nutshell, here's the problem. > WARNING! WARNING! WARNING! BIG "IF" COMING UP! BIG "IF" COMING UP!!! >If someone takes my pgp secret keyring and my password, then they can ^^ >sign a message *digitally* so that people believe the spoofed message is >really from me. In fact, since most people tend to rely on a pgp message >far more than a non-pgp message, most people would be absolutely >convinced that the message was in fact from me. Pardon me, but what was the point of that last comment? It is an obvious statement of fact that yes, IF IF IF somebody had a secret key AND password, he could duplicate a signature. Digital signatures allow a person to exclude others from being able to sign messages as if they are from him. True, a person could simply publish his secret key and password, at which point everyone could sign notes as if they came from him, but that wouldn't be "interesting" because most people would have no reason to do so. >Signing with PGP is just not a solution. It is, apparently, in the vast majority of possible situations. Why would you even try to disagree? Oh, yes, I forgot... you're Detweiler.

1 0

reputations: discussions and meta-discussions
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Sat, 18 Nov 1995, Bill Stewart wrote: > Here's the new entity's key, signed :-) I haven't added it to the > PGP key servers; I'll leave that up to you... As we know, a public key certificate is a binding between the key and some attribute, as asserted by the signer. In this case you have asserted a binding between my key and the string "a new entity, as yet unnamed". I don't understand why you did this. Would you please explain? The only reason I can think of is that you wanted to provide evidence for the key's creation date by timestamping it. If that was the case, I thank you. But in the future, to avoid confusion, perhaps you can create a new ID "timestamp" for the key and sign that instead. ------------- On a different subject, given the likelihood of an increasing number of new identities showing up on this list, I propose that we create a new mailing list (cypherpunks-reputations) devoted to the discussion of reputations of cypherpunks participants. A significant number of posts on cypherpunks are already discussions of this sort. I believe it would be benificial to create a seperate channel for these meta-discussions so they do not interfere with regular cypherpunk topics. By encouraging discussions about reputations of specific entities, we may also gain some insight on the general properties of reputation systems. In this sense by creating this new list we create an interesting self-referential loop -- cypherpunks-reputations contains meta-discussions about cypherpunks, which in turn contains meta-discussions about cypherpunks-reputations. Examples of posts appropriate for this new mailing list would include: * knowledge, intelligence, style and quirks of cypherpunks participants * exchange of keys and certificates * speculation on connections between entities * kill file entry recommendations I do not have the physical resources to serve such a mailing list, so I hope someone who does will volunteer. - keyid D072FC19 (still unnamed) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMK8CnY2Fr67QcvwZAQGUJgP9G8ER/qH8OKvSbOtPYwaDQMkVyKFWafxH Ukbm0lKgCwS97cEKufxJH49VCRkxrd+t+ia5IRNDxewB1xlcjAKRvp4MK8Ps6MTy FbhmEpfhB4pnfE5l+e8VnZSoD79j0Sv6C80C48NL6NJNV6PhhTS9B5lXxW/qJv9D 3ZTpTf5AjZI= =e4DU -----END PGP SIGNATURE-----

1 0

ecash as pgp
by sameer 17 Dec '03

17 Dec '03

This is really frustrating. I'm trying to figure out how to use this damn ecash software to setup a prototype ecash-accepting remailer. For one thing, there's no documention. Secondly, from what I can tell, it's like PGP. To integrate it into other software you have to do all sorts of nasty output parsing. why the hell can't it just produce nice, terse, informative, UNIX-like output? it's late, i'm tired, I'm going to sleep. (the party was fun, btw, thanks to everyone who showed up.) -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

3 3

Real-life example of why National ID cards won't work
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- #Date: Fri, 17 Nov 95 16:18:55 PST #From: medic(a)netvision.net.il #To: shomronnews(a)felix.dircon.co.uk #Subject: Update 755 SNS News Service "Interior Ministry Scandal" November 19, 1995..26 Cheshvan 5756..Number 755..Update from Israel ... Following a report released by Yediot Achronot Newspaper, Interior Minister (Labor) Ehud Barak has ordered an immediate investigation into allegations of wrong-doing by senior Ministry officials. The report states that falsified ID cards and other Ministry permits are being sold to Arabs. Among those mentioned in the newspaper story is Chaim Ben-Atar, the Director of the Ministry's East Jerusalem Office, a Member of Knesset, and past members of the Mossad and GSS (Shin Bet). The Yediot report also alleges that Police officials silenced investigations over the past two years (that may have prevented terrorist attacks) for the fear of revealing names of top officials involved in the Ministry false documentation scam. The investigations involved senior officers in the IDF Civil Administration, IDF officers, senior Ministry of the Interior officials and officials in the Jerusalem Municipality. Some of the allegations: 1) In the East Jerusalem Branch of the Ministry of the Interior, Arabs that are not entitled by law may still receive ID cards, travel permits to Jordan, and other official documentation in return for cash payments or "favors". 2) Senior officials in the security service of the State have abused their connections with the east and west Jerusalem Ministry Offices, and have offered permits to travel abroad in return for cash payments. The permits were given to Arabs that would not be able to obtain them legally. 3) Interior Ministry workers have received favors and cash payments from Arab and Jewish agents in return for issuing travel documents, ID cards and passports. 4) Chaim Ben-Atar, the Director of the East Jerusalem Interior Ministry Registration Office has provided five Arab residents of Gaza with ID cards stating they live in East Jerusalem. 5) Ben-Atar also employed an Arab woman during a four-year period whose brother is a "religious fanatic activist in East Jerusalem". The Arab woman who assisted Ben-Atar has access to highly classified information. She was released from her position one year ago for "personal reasons." 6) During an investigation into wrong-doing by the past head of the Allenby Bridge crossing, information pointing to wrong-doing by other senior IDF officers and Jerusalem Municipality workers was uncovered as well. The Ministry chose not to pursue the investigation against them. The cases against them were silenced by Interior Ministry officials. (Yediot Achronot ..11/19..Page 5). ...

1 0

"Junk E-Mail"
by Ray Cromwell 17 Dec '03

17 Dec '03

Is anyone else getting lots of junk e-mail lately? I'm getting all kinds of direct marketing crap to both of my main accounts and I haven't posted to usenet in months. I pretty much only post to cypherpunks, and that is rarely. And I never put my real email address on web sites that ask for them. I fear I am on some kind of direct marketing e-mail "list". I've warned the perpetrators that if I get another ad from them, they better expect a denial-of-service attack from me on their site and lots of mail-bombs. sick of the clutter, -Ray

2 1

Re: Recompiling PGP262i under microsoft.
by Joe Turner 17 Dec '03

17 Dec '03

For those that might benefit, I have included some notes I have gained through my wanderings through PGPland, towards an easy PGP-mail program for Windows. Below I have included sketchy details in compiling PGP under as an MS-DOS app, WIN16 DLL, and Win32 DLL. I won't be able to provide specific details, until I recover data from my backup tapes (I had a nasty drive failure, and have been lethargic in recovering). I finally get my IBM PC/RT configured for TCP/IP and my PC explodes. :<. If anything here is wrong, or fuzzy, feel free to post corrections, etc., as this is all from my alcohol soaked, nicotine riddled brain. Compiling PGP under MSVC 1.5 & 2.x ========= === ===== ==== === = === To compile PGP under MSVC 1.5 (I believe there is a supplied Microsoft C make file that was written for Quick C) you will need to create a project and add the files necessary. Be sure to include the already compiled RSAREF.LIB in the project files. Unfortunately, there is one very annoying problem with Microsoft Visual C, in which it will regenerate the dependencies from the source code files without preprocessing the #ifdefs. You will have to edit the make file and take out all of the UNIX sys/whatever stuff. I believe this is the biggest hurdle, but you might try using the Quick C make file, although I don't think it will work without modification (Microsoft seems disenchanted with compatibility, even between revisions of their own software). You may also have some trouble with type conversion, but I think its intuitive to overcome that. (its been a while...). If anyone knows of an easier way to do this, I will be more than happy to listen. Compiling RSAREF as a DLL under MSVC ========= ====== == = === ===== ==== This is easy, but you may have trouble with the dependencies again. The most important thing is to create a .DEF file and put all of the export declarations in there. Unless you plan on rewrite PGP to load the DLL dynamically, simply link against it so save a few headaches (remember you still need a .DEF file or you will get unresolved errors!). Compiling PGP as a Windows DLL ========= === == = ======= === I was able to find someone in Australia (sorry, the name eludes me at the moment) who managed to port PGP to a Windows DLL, under Borland C. I only installed Borland C++ 4.0 today, so much of my work/play has been targeted towards Microsoft Visual C++ 1.5/2.0 under NT (besides I was waiting on PGP3.0). If anyone wants these files (for Borland) I will send them out when I recover them (hopefully). It includes modifications to no more than three files, and includes both reentrant and non-reentrant entry points. I also have the mail program (MAPI) that this guy wrote in executable form. He was very careful about the Austrailian equivalent of the ITAR, so he would only send the modified files, which I will pass on for those who are interested. If you want to do the same thing under MSVC, the same changes apply. Hope that help some. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzCXvuAAAAEEALiDFkQgR9leZVf5X0HLPdUFmtfyp3X0nFMi7RjqIsv1pAh9 ZZFVwkBlo01APJcw4ncPrpjGKvu8P7t0a6nB+tIZliGGvmCt/SSVyc44RdTz1KV2 TlsA/NW1WF4yBARK1aCuHgrtwfOhV8hBqh88TlJ/DSMxDXCM1+w0jdWG+cPtAAUR tC9Kb2UgTi4gVHVybmVyIChpbnNlY3VyZSkgPHR1cm5lckB0ZWxlY2hlY2suY29t Pg== =sGFY -----END PGP PUBLIC KEY BLOCK----- -- Joe N. Turner Telecheck International turner(a)telecheck.com 5251 Westheimer, PO BOX 4659, Houston, TX 77210-4659

1 0

Ponzi Web
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

NY Times, 11-20-95, front page. If Medium Is the Message, the Message Is the Web By John Markoff San Francisco, Nov. 19 -- The Associated Press was formed in the mid-19th century when a group of newspapers decided to invest jointly in a newfangled medium -- the telegraph -- to speed the collection and dissemination of information. Last week, A.P. announced that it would adopt a newer-fangled medium -- the World Wide Web -- to begin distributing its articles and photographs over the global Internet. It was simply the latest, but perhaps most historically significant, move yet by an old-line media organization into the World Wide Web, the Internet multimedia information-retrieval system that appears on the verge of becoming a mass medium itself. If the medium is the message, then the message these days is the World Wide Web. In short order the Web, which three years ago was little more than a research tool for physicists and computer hobbyists, has flourished. It is being embraced by media concerns, consumer-product companies and businesses of various stripes that are creating thousands of so-called Web sites each month, with the number of computers playing host to one or more of these sites already exceeding 100,000. Conservative estimates place the number of people who have used the Web in the millions, and it is not hard to find more breathless estimates in the tens of millions. Capable of letting people use computers to send and receive text, sound, still images and video clips, the Web incorporates elements of the various print and electronic media that have preceded it. And yet, the Web is poised not to replace its predecessors but to take a place alongside them as a social, cultural and economic force in its own right. Its complementary role is already evident: many radio stations and all the major television networks have Web sites promoting their programs and stars. Newspapers, including The New York Times, are devising cyberspace editions. And few movies anymore are released without a promotional Web site, including "Goldeneye" the James Bond film that opened this weekend at theaters everywhere and on the Web at the address http://www.mgmua.com/bond. The site offers the movie's theme song performed by Tina Turner, more than a dozen video clips from the film and illustrated biographies of the cast members. Prime-time television commercials by Toyota and other advertisers now routinely include a Web address. And Procter & Gamble, whose advertising has long helped underwrite the mass media, has even staked out prime Web real estate by reserving addresses that include flu.com and toiletpaper.com. "We are poised on the edge of a new medium," Clay Felker, director of the magazine program at the University of California at Berkeley's graduate journalism school, said. "It's going to change the nature of how we acquire information." As with each mass medium that has arrived before it, the Web has reached this threshold through a confluence of a key technology, a ready audience and a stream of corporate backers willing to bet that profitable businesses can be built on it. But few experts are willing to declare that the Web has taken its place in the mass media pantheon because the profitable business formulas have yet to be found. Newspapers and magazines make money by selling individual copies, subscriptions and advertising space. Radio and television stations sell air time to those with money and a message. Movie theaters sell tickets. But on the Web so far, despite seed-money by adventurous advertisers and some tentative efforts to charge for access to sites or services, there is no certainty that this medium will achieve the critical mass that capitalism demands of its mass media. "How do you make a business out of the World Wide Web?" asked Norman Pearlstine, editor in chief of Time Inc., which has an experimental Web site called Pathfinder that offers selected contents from the company's magazines (http://www.pathfinder.com) But because ad revenue alone is not carrying the freight, Time Inc. will begin testing ways to charge visitors to its site. And yet, the technological prerequisites are firmly in place. The Web is an outgrowth of the Internet, which began as an academic research experiment in the late 1960's. For more than two decades the Internet remained largely inaccessible, used mainly by computer scientists and Pentagon researchers, university scholars and students. Then came the World Wide Web. Like the Internet, the Web began as a tool to let scientists easily and quickly share information. Conceived in the late 1980's by Tim Berners-Lee, who was then a software designer at CERN, the Swiss physics research center, the basic Web technology was first put to use in 1990. The big breakthrough came in 1992, when student researchers at the National Center for Supercomputing Applications in Illinois created Mosaic, a simple software tool called a Web browser. Mosaic permitted access to information anywhere on tke World Wide Web by letting the user point and click a computer mouse on highlighted words or images on the screen. The browser, which became available in commercial versions like Netscape Communications' Navigator, not only made Web sites easily accessible, it prompted businesses, organizations and even individuals to create new Web sites by the thousands. Thus did the Web quickly become a standard and accepted way for the growing millions of the computer-literate to communicate and to entertain and inform themselves. And unlike each previous mass medium, the Web does not require its audience to be merely passive recipients of information. For very little money, and with a modicum of computer skills, virtually anyone can create his or her own Web site. Anyone with a modem is potentially a global pamphleteer. One consequence of this democratization is that the Web can be a remarkably anarchic forum compared with the old-style mass media. "Think of this as television colliding with the telephone party line," said Paul Saffo, a computer industry consultant at the Institute for the Future, a Menlo Park, Calif., research firm. "In terms of social consequences, the Web is a great experiment. It's going to deliver us community with a vengeance -- and we may find we don't want it." ----- NYT, 11-20-95, Business Section. Losses From Computer Breaches Are on the Rise, a Study Finds By Peter H. Lewis Financial losses from computer break-ins and other security breaches are on the rise, according to a survey of corporate computer-security managers, with nearly half of all companies reporting losses as a result of hackers, viruses, sabotage, corporate spies and incompetent employees. At least 20 of the 1,290 companies responding to the annual security survey from Information Week magazine and the consulting firm Ernst & Young, reported losses of more than $1 million last year. But the poll also found that companies were more aware of the risks arising from growing reliance on computer networks, and were taking stronger steps to protect their information systems. "There is definitely increased awareness on the part of senior management," said Daniel White, national director of information security at Ernst & Young's Chicago office. But Mr. White said that despite increased vigilance by computer security officers, the lack of security tools made it risky to conduct electronic-document interchange and other sensitive business operations on the Internet. "Lots of organizations are using the Internet in a thoughtful way for marketing and information dissemination," Mr. White said. "But do I really want to use it" for an electronic-document transaction? "Not yet." Details of the survey, the third annual one, are in the Nov. 28 issue of Information Week, available this week. Among other findings were that nearly 80 percent of companies surveyed had at least one full-time information-security officer, a slight increase from last year. Of those, 45 percent report directly to the corporation's chief information officer, reflecting the growing recognition of the importance of computer security, Mr. White said. Nearly 70 percent of those responding said their companies had sustained a serious virus attack in the last year, a sharp rise from 54 percent two years ago. -----

1 0

Visual Basic 4.0 encryption prog.
by Eric Anderson 17 Dec '03

17 Dec '03

I just scored a copy of visual basic 4.0 and I was wondering how feasible it would be to write a program for Window$ 95 that would use RSA or IDEA and the Win95 exchange interface. I plan on buying Applied Cryptography probably on Fri. when I get paid. My requirements/goals are: 100% compatibility with M$ Exchange, ease of use (Point & Click/ drag & drop) and last but not least, STRONG public key encryption using "off-the shelf code. So my ??? Is this: Is it possible? Or should I just go out and buy a C++ compiler. I don't really care about ITAR or any of that other BS, I just won't put MY name on it.

1 0

RE:
by Eric Anderson 17 Dec '03

17 Dec '03

---------- From: anonymous-remailer@shell.portal.com[SMTP:anonymous-remailer@shell.portal.com] Sent: Friday, November 17, 1995 7:31 PM To: cypherpunks(a)toad.com Subject: Shoe-horning Mondex onto the Internet -- still won't fit >+ According to inside sources, is grossly vulnerable to replay attacks >(offline multi-spending to different parties) >-- Mondex has security holes >-- Customers who defraud Mondex-using banks have legal deniability in a >court of law: they can simply request banks to produce the security >protocols as evidence; if they refuse the case is thrown out of >court (precedent: UK and US phantom-ATM withdrawal cases) HEY-sounds GREAT to me, I'm ALL FOR IT!!!

1 0

Cypherpunks in Sydney (Australia) Meeting
by Greg_Rose＠sibelius.sydney.sterling.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I mentioned some time ago that if there was sufficient interest I'd organise a Sydney Cypherpunks get-together. It was supposed to be in mid-November :-(, but you can't have everything. In the absence of consultation with anyone, I've booked a small suburban chinese restaurant for the venue. This seems in keeping with other cypherpunks meetings (not that I've ever been to one...) Date: Wednesday December 6th. Time: 7:00pm Place: Mee Ton Restaurant 139 Concord Road Concord The restaurant is easy to get to, only 20 minutes by car from the city and easy to park. If driving out from the city along Paramatta Road, you just have to be careful not to turn onto the freeway. Concord Road is *second* and crosses back over the freeway. The restaurant is about 400 metres north of Paramatta Road, on the eastern side. It's also only a short walk from North Strathfield station. If enough people are using Public transport I can organise a pickup from (the main) Strathfield station (a little more convenient in terms of frequency of trains). I'm anticipating maybe ten-fifteen people. They have a nice, light banquet menu for $12 per head, everything included except alcohol. RSVP, please, by Friday the 1st, and tell me whether you are interested in a PGP key signing at the same time. I will post this to aus.org.auug, sage-au-nsw, sci.crypt. Any other suggestions appreciated, and don't hesitate to pass around the details. - -- Greg Rose INTERNET: greg_rose(a)sydney.sterling.com Sterling Software VOICE: +61-2-9975 4777 FAX: +61-2-9975 2921 28 Rodborough Rd. http://www.sydney.sterling.com:8080/~ggr French's Forest 35 0A 79 7D 5E 21 8D 47 E3 53 75 66 AC FB D9 45 NSW 2086 Australia. co-mod sci.crypt.research, USENIX Director. -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMLAX/6RQkCwJ0+ZNAQFU1AP/Y4d6RUieAKMoz4MJCeX5OXyhCNfTfrMp /szVqe2ICn+9F+T+Ggad1XKSsO3NBk1Lmo478NUYHuCDuMODSgM0YRxRo7SuEd9d joFtpUIAjBAs+e0beO7DI934XFSvDQini+YT2NxDtUtEM0c4fVh96oQyJguSnWP2 Mx8ZubrzoDs= =R65K -----END PGP SIGNATURE-----

1 0

Re: remailer abuse
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 22:43 11/19/95 -0800, Timothy C. May wrote: >Yes, anonymous communication is getting easier, and the costs of trying to >stop it are becoming impossibly high. It would essentially require a police >state to stop, and even then it probably couldn't be stopped... Considering that there are well known ways of spoofing IP addresses, if you really want to, you can be anyone. (They must be well know. I know at least one. <grin>) >2. Sender pays the costs of transmission. That is, if someone wishes to >send 10 megabytes to a site, at least _he_ (or _she_) pays the freight. >This is of course the way things now work with the U.S. postal system, with >"Postage Due" no longer common... I think we lack direct charges for network traffic because detailed accounting for use of each net-link is too expensive. The situation is similar to that of the telephone system in the 1950s, where the switches which connected local calls did not have enough smarts to do charging, and so started the tradition of "free" local calls. When lots of people start sending full motion video over the net we may see ISPs develop use based charging schemes. I should add that one of the reasons I use Netcom is that they do NOT charge for connect time or network traffic. There is a market for known, fixed costs too. Bill ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

Re: Mbone seminar 21st Nov 16:15UTC: FIREWALLS AS A NETWORK SECURITY
by Danny Cox 17 Dec '03

17 Dec '03

Piete, I read variuos bits about using the MBone for conferences etc including this one, and I'd like to be able to listen to them. Can you point me to any tools which I can use to access it and give me some pointers as to how to use them ? Thanks, Danny Cox

1 0

Re: "Junk E-Mail"
by James A. Donald 17 Dec '03

17 Dec '03

At 06:47 PM 11/19/95 -0500, Ray Cromwell wrote: > > Is anyone else getting lots of junk e-mail lately? Yes. When people spam usenet, they get hit by a large highly organized counter attack. When they spam people by email, no large counter attack -- we need a place were people go to share knowledge of email abuse. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: remailer abuse
by Corey Bridges 17 Dec '03

17 Dec '03

At 05:27 PM 11/19/95 -0800, Greg Broiles wrote: >... > If A wants to send >messages to B, but B doesn't want to receive them, should A be forced to >stop sending? My rambling $.02: I haven't thought all this through, but I have an emerging stance. Just this week I've started ploughing through the Cyphernomicon, and was smacked in the face with the eminently pragmatic Mr. May's statement that any law that cannot be enforced should not exist. Up until, say, this week, I'd always been in favor of Caller ID. I'd figured if anyone wants to call me, I have the right to know who it is. By default, I had adopted this position concerning email. Now, one day I will receive an anonymous email. Will I be offended? Maybe. Can I do anything about it? Not likely. Anonymous communication is only going to get easier. Current congressional prattling notwithstanding, the onus of responsibility will have to shift to the recipient. For example, I could configure my mail program to automatically throw away any incoming message with "anonymous" in the "From" header. (Or any message from *(a)pseudo.goldenbear.com, for that matter) If junk mail continues to bother people, it's only a matter of time until mail programs' filtering capabilities become much more sophisticated. (Of course, for all I know, there already ARE programs that do what I'm about to propose.) People can maintain a "do not accept from" list, containing every anonymous remailer they've ever heard about, or an "accept only from" list, containing just the people they wish to converse with. I think it's this second option that will become increasingly important. Sure it's your right to send me whatever the hell you like, just as it's my right to ignore you completely. Bringing this back to my hobby-horse of Caller ID, you end up with even greater protection than an unlisted number--let the whole world know my number--no one'll get through unless I already know him. And then in the brave unregulated future, if you make a new friend, you merely swipe his public-key business card through your PDA, which adds it to your "accept calls and emails from" list. And to take a stab at another pair of Greg's questions, if A is sending messages from his account on X's system to B, and B doesn't want to receive them, should B have the right to make X stop A? No. (Not that I think the law is going to realize that any time soon.) Should X have the right to stop A? Hell yes--it's his system. Let A find a more open-minded ISP if he doesn't like it. Corey Bridges Security Scribe Netscape Communications Corporation 415-528-2978

2 1

Paid Delivery (was Re: remailer abuse)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:21 AM 11/20/95, Corey Bridges wrote: >At 05:27 PM 11/19/95 -0800, Greg Broiles wrote: >>... >> If A wants to send >>messages to B, but B doesn't want to receive them, should A be forced to >>stop sending? > >My rambling $.02: > >I haven't thought all this through, but I have an emerging stance. Just this >week I've started ploughing through the Cyphernomicon, and was smacked in >the face with the eminently pragmatic Mr. May's statement that any law that >cannot be enforced should not exist. Thanks. It's always heartening to see that someone is affected positively by one's arguments. >Up until, say, this week, I'd always been in favor of Caller ID. I'd figured >if anyone wants to call me, I have the right to know who it is. By default, >I had adopted this position concerning email. Now, one day I will receive an >anonymous email. Will I be offended? Maybe. Can I do anything about it? Not >likely. Anonymous communication is only going to get easier. Current Yes, anonymous communication is getting easier, and the costs of trying to stop it are becoming impossibly high. It would essentially require a police state to stop, and even then it probably couldn't be stopped...for example, I could always set up a "Tim's Quoting Service," which passes on anonymous mail to a recipient with the "Hey, someone says this..." Could I be prosecuted? Not even in a police state. Just one of dozens of approaches to skirt such laws. However, anticipating your next point, this does not mean anonymous communication bandwidth will become infinite. Solutions are predictable. See below. >congressional prattling notwithstanding, the onus of responsibility will >have to shift to the recipient. For example, I could configure my mail >program to automatically throw away any incoming message with "anonymous" in >the "From" header. (Or any message from *(a)pseudo.goldenbear.com, for that >matter) > >If junk mail continues to bother people, it's only a matter of time until >mail programs' filtering capabilities become much more sophisticated. (Of >course, for all I know, there already ARE programs that do what I'm about to >propose.) People can maintain a "do not accept from" list, containing every >anonymous remailer they've ever heard about, or an "accept only from" list, Many of us do this all the time. The Macintosh (and Windows) mail program I currently use is "Eudora Pro," from Qualcomm. Extensive filtering options. Certainly it is possible to set up filters to put mail from "anonymous" into mailboxes, or the trash. And just as possible, though a bit more involved, to put mail from _desired_ sources into boxes, or have a priority flag raised, etc. What if one is "bombarded" by mail, thousands of messages a day, or many megabytes? There are two main options, besides meaningless clamoring for legislation against "junk mail": 1. Some services, like Prodigy, allow one to discard a message before reading it, with no charge. (Seeing the sender and message name only.) This does not solve the problem completely, but it certainly eliminates cost to the enduser. The service provider still has the mail, but at least his network connections are likely to not be much affected....still possible to bring the service to its knees, which brings up the second approach....: 2. Sender pays the costs of transmission. That is, if someone wishes to send 10 megabytes to a site, at least _he_ (or _she_) pays the freight. This is of course the way things now work with the U.S. postal system, with "Postage Due" no longer common: if the sender doesn't In the real world, nothing is really free, so the whole economics of the Internet has been deceiving for quite some time. The notion that one can "spam" for free, shipping megabytes to thousands of sites, has led to strange notions about the economics of the Net and, as a result, for calls for new laws about "unwanted e-mail," "spamming," etc. Of course, most users on the Net are now paying for connectivity one way or another. Even U.C. Berkeley, one of the pioneers in Unix and campus connections to the Net, has subcontracted out it's Net connections to Netcom, with students and faculty paying around $15 a month. A sign of the times. (There are also reasons why at least so far it has proven viable to _not_ charge for individual transmissions. Various kinds of subsidies.) Filtering is a solution for the reader not to have see stuff he doesn't want to see, but he or his ISP may still receive the stuff, even if it gets discarded, which is why the long term solution is likely to involve paid deliveries. (Needless to say, this is not currently part of the Net, and I'm not suggesting it will happen anytime soon, or because I happen to think it's a solution. Rather, what I'm saying is that it's a _technological_ and _market_ solution to the "problem" of spammage and "unwanted mail filling up our mailboxes." How it happens is unclear. But think of how markets generally evolve to deal with what would naively be seen as unsolvable crises or shortages. Long before we all are getting gigabytes of unwanted stuff every day, alternatives will develop. I am confident that paid delivery is one of the keys.) >And to take a stab at another pair of Greg's questions, if A is sending >messages from his account on X's system to B, and B doesn't want to receive >them, should B have the right to make X stop A? No. (Not that I think the >law is going to realize that any time soon.) Should X have the right to stop >A? Hell yes--it's his system. Let A find a more open-minded ISP if he >doesn't like it. Amen. Exactly. >Corey Bridges >Security Scribe >Netscape Communications Corporation ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Interesting. And now I'm even happier to have partly made a convert. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: WRITTEN CODE
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Sat, 18 Nov 1995 s1113645(a)tesla.cc.uottawa.ca wrote: > Curious, where is uncg.edu? Your French name doesn't make me think you're > in the States (as an .edu address might suggest, but then not necessarily > either). (univ of Calgary?) I think the University of Calgary is actually in the .ca domain. It's a Canadian address. Its just like your very own domain. Your machine tesla is on uottawa.ca. Your University of Ottawa address is not in .edu, but is in .ca. It's interesting though, that you brought up Calgary. Calgary, as I assume our Ottawa poster knows, was very busy over the last week. Grand Central station. All of the politico's seemed to transit the city. Reform Party Leader, Preston Manning, and Conservative Party Leader, Jean Charest, held duelling fund-raising dinners this last Wednesday in Calgary. And Canada's ambassador to the United States, the Prime Minister's nephew -- Raymond Chretien -- left Washington and spoke to the Calgary Chamber of Commerce about NAFTA on Friday. Chretien was particularly troubled by remarks from Senate Majority Leader Bob Dole, about wanting to re-open Chapter 19 in the NAFTA. Following his Chamber of Commerce address, Chretien was quoted as saying, "For us, Chapter 19 is the heart of NAFTA. And this dispute mechanism has been put in there to take into account the fact that we are a much smaller economy, a much smaller country. We have to rely on those tri-national panels to defend our interests." Chretien for now is chalking up the threatening comments to political posturing in the run-up to the presidential election next year, otherwise he said, "we will have a serious problem." Chretien also played down security concerns after a knife-wielding intruder broke into his uncle's (the Prime Minister's) home at 24 Sussex. Despite living in Washington, D.C., Chretien said he doesn't fear for his public safety. When he was asked about the lack of visible protection during his visit to Calgary, he said: "I'm just a humble public servant." Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

3 2

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33a.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp hash cut reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash latent ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp. hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)valhalla.phoenix.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut ek"; $remailer{"shinobi"} = "<remailer(a)shinobi.alias.net> cpunk mix pgp. hash latent cut ek reorder"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (robo syrinx c2) (flame hacktic replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. remailer email address history latency uptime ----------------------------------------------------------------------- ecafe cpunk(a)remail.ecafe.org --*+* *+* .- 3:47:29 99.20% robo robo(a)c2.org #** *##+ ## 1:57 99.04% hacktic remailer(a)utopia.hacktic.nl *** ***+* ** 9:23 98.98% spook remailer(a)valhalla.phoenix.net ++* ** +* ** 19:50 98.83% wmono wmono(a)valhalla.phoenix.net ++* ***+* * 12:53 98.69% rmadillo remailer(a)armadillo.com ++++++ ++ ++ 36:16 98.69% hroller hroller(a)c2.org ##+ ## :51 98.68% mix mixmaster(a)remail.obscura.com ----+-+ + - 1:13:12 98.54% flame remailer(a)flame.alias.net *** * +* * 17:08 98.26% replay remailer(a)replay.com ++* ** 7:26 98.05% portal hfinney(a)shell.portal.com * +* ## 3:56 97.99% vishnu mixmaster(a)vishnu.alias.net **+** + * 16:08 97.79% bsu-cs nowhere(a)bsu-cs.bsu.edu #** *#-+* # 3:17 97.03% ideath remailer(a)ideath.goldenbear.com ------- - - 6:03:13 95.95% penet anon(a)anon.penet.fi -----..- - 11:16:54 95.74% alumni hal(a)alumni.caltech.edu *+* + ++ # 5:01 95.02% ford remailer(a)bi-node.zerberus.de _ _-.-+ +++ 17:34:27 92.75% extropia remail(a)extropia.wimsey.com -..-- ----- 5:46:08 92.40% c2 remail(a)c2.org +++ + + + 53:15 91.60% rahul homer(a)rahul.net -**+*#++* * 8:22 97.99% syrinx syrinx(a)c2.org +- ++ 5:13:50 28.61% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: "Dear Newt" Letter...
by rwizard＠mindspring.com 17 Dec '03

17 Dec '03

At 04:38 PM 11/20/95 -0500, Robert Hettinga wrote: > >My, *this* looks interesting... > > >Cheers, >Bob Hettinga ... >Dear Mr. Speaker: > > We are writing to express serious concerns about the >Administration's efforts to continue to restrict the ability >of computer users at home and abroad to protect their personal >and private information over electronic networks through the >use of encryption technology. The Administration seems ... As a constituent and campaign volunteer of Mr. Newt, I think I will drop a hard copy of this off at his office along with a healthy dose of *my* views ! Thanks for posting it. rwizard(a)mindspring.com ================================================= "The Internet is already full - Go Away !" ================================================= -----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzChH30AAAEEAL4nhMMmeqVZXx2UYZgyZfjgm+oVkbLkVhgr7Z8rBPWd1FwX wv+vQlX7smRbYF+FymeUKlWiKl8hhkueo5iObyek5C32a5NP0snYQYJDfwn9UE6P hJGBpYcjiKU8XzUXfpfAC95FGkCqrLCp1kfDhLpqJChUK1GN8Va+auujevB9AAUT tCVSYW5keSBXaWxzb24gPHJ3aXphcmRAbWluZHNwcmluZy5jb20+ =KccN - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMKl1wVa+auujevB9AQGJJwQAs9Y13pi2Rq5vFKc9RRIfed7Qkx63RFpz J1AhkBLE+HEixfjhx3WEmg5hAloae8N2N7/gpPXs3i/TcOQ/XMXtd9L4SSlGieIJ FrJDF6aktnHoBetKMsaRIFtIC0rXYZCMLktYjTXICPDwZMKWnWy9M5vGYNApS2Rz DKcZp5UWIIA= =ZmFv -----END PGP SIGNATURE----- ----Begin Geek Code--- GAT d- s+:+ a+ C++++ UH++++L++++ P+ L++ E--- W+++ N+ K- w++++ O-- M-- V PS--- PE+++ Y++ PGP++ t+++ 5+++ X++ !R tv- b+ DI+++ D+ G-- e* h---- r+++ y++++ ---End Geek Code---

1 0

Re: Good Enough?
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 1:24 PM 11/14/95, Derek Atkins wrote: >Hi. > >First, I must warn you that generating keys on behalf of users is in >general a very bad thing to do. Instead, you might want to provide a >simple way for users to generate keys and get them certified. The >biggest problem is that there is not an easy way to get a good set of >random numbers on a server platform. On the other hand, users can get >a great deal of randomness on their own client machines. If they can >run netscape, then they can run PGP. .... I don't like to harp on this but you have stated the scenario so clearly, that I ask: If the user cannot trust you to generate keys for him, why should he trust the code that you provide to him? That code can have errors like the old Netscape code except planted on purpose so that the private key is guessable in 2^40 tries. There are two answers, I think. The code is public and the user hopes that any flaws will be publicized. The second is to use keyed information (not timing but character information) to provide the random seed. That is the idea behind my post a few weeks ago: "Using deterministic programs to select private RSA keys" Some may find that method less hazardous then trusting the culture of publishing flaws in code. I can forward that posting to anyone interested.

1 0

Re: Micropayments article?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:46 AM 11/20/95, Lucky Green wrote: >Would somone please send me a pointer to the micropayment article? http://theory.lcs.mit.edu/~rivest/ I am copying the list because, perhaps counterintuitively, it will save bandwidth and overall effort. The reasons are left as an exercise in game theory for the student. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Micropayments article?
by Lucky Green 17 Dec '03

17 Dec '03

Would somone please send me a pointer to the micropayment article? TIA,

1 0

Re: "Junk E-Mail"
by Chris Claborne 17 Dec '03

17 Dec '03

At 06:47 PM 11/19/95 -0500, you wrote: > > Is anyone else getting lots of junk e-mail lately? I'm getting all >kinds of direct marketing crap to both of my main accounts and I haven't >posted to usenet in months. On a related note, Compuserve had a note on their system last week from the sysop. Their customers are receiving unwanted e-mail advertisements from the Internet. Compuserve sysops are attempting to block the spaming but are finding it difficult because the advertiser is coming in via different routes. They are also attempting to stop them using the court system. The advertiser, according to the Compuserve sysop, threatened a mail-bombing if Compuserve tried to block them!!! This would be a just cause to call in the CSOF (Cypherpunk Soldier of Fortune) for a "measured response". ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

2 1

[NON-LIST] Re: reputations: discussions and meta-discussions
by Bill Stewart 17 Dec '03

17 Dec '03

(This really should be in private mail; keyid D072FC19 (still unnamed) can reach me using anon.penet.fi or alpha.c2.org or a reply-block remailer to get replies.... Or if you prefer, send me one-way remail and I'll post replies in alt.anonymous.messages.) At 02:17 AM 11/19/95 -0800, - keyid D072FC19 (still unnamed) wrote: >On Sat, 18 Nov 1995, Bill Stewart wrote: >> Here's the new entity's key, signed :-) I haven't added it to the >> PGP key servers; I'll leave that up to you... > >As we know, a public key certificate is a binding between the key and >some attribute, as asserted by the signer. In this case you have asserted >a binding between my key and the string "a new entity, as yet unnamed". >I don't understand why you did this. Would you please explain? >The only reason I can think of is that you wanted to provide evidence >for the key's creation date by timestamping it. If that was the case, >I thank you. But in the future, to avoid confusion, perhaps you can >create a new ID "timestamp" for the key and sign that instead. Are you asking why I used the string "a new entity, as yet unnamed", or why I certified it? If the former, it's because when I loaded the PGP key block into my public key file, that's who it said it was, and it matched the name in your cypherpunks posting. If you're asking why I certified a key used by a nym, I started doing that a couple months ago, as an experiment about what it means to certify keys and how to provide better continuity for keys used by nyms, and signing yours seemed like an appropriate thing to do (since you chose to name your key as belonging to the same string you signed your message with.) I have the policy of only signing one key for a given namestring with the key I use for signing nyms, so it gives a certain evidence of uniqueness as well as the timestamping effect. Since you also commented on cluttering up namespace, I didn't send the key to the keyserver myself; that's up to you. Has it been a wildly successful experiment? Well, no :-) But I've at least had to think about some of the issues more, and a couple of people have gotten their nym keys signed. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0