December 2003 - cypherpunks-legacy

Re: Higher Sources and PGP
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Duncan Frissell <frissell(a)panix.com> writes: > >From the Higher Sources website. They were offering security services > including PGP training. Can Aliens factor large numbers? So, the 39 kibologists didn't commit suicide!!! > http://www7.concentric.net/~Font/pro/main.htm#1 > > Higher Source's Internet World Wide Web > services include: ... > PGP, Privacy and > Security Training ... They were murdered by Cocksucker John Gilmore!!! --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1

Re: [IMPORTANT] PRNG
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Timmy May digs into his cesspool of a mind for his mailing list fertilizer. _ / ' | /><oo><\ Timmy May //[ `' ]\\

2 1

RE: Hard to Tax Scenario
by James O'Toole 17 Dec '03

17 Dec '03

I think that the mythical "Doctor Ann" operating in this supposedly hard to tax scenario, may have operating costs that are higher than non-anonymous doctors, and when these operating costs approach her taxation costs, this "hard to tax" scenario becomes uneconomic. Because the operating costs will be roughly linear as a function of Ann's gross, whereas the taxes are roughly linear as a function of Ann's net, Ann will discover that it is cheaper to operate non-anonymously once her volume of business is sufficient. This is one of the reasons that black-market (non-reporting) organizations generally aren't common at large scale. There are plenty of other reasons: higher cost of capital, difficulty of proving disputes, etc. Crypto (and other anonymizing technology) may lower Ann's operating costs, but for any large organization, the %-of-gross will dominate the %-of-net fee that the tax authority charges for operating on the white market. However, Ann has another alternative, which large organizations will also have. Ann can operate completely non-anonymously, but bleed profits out of her business through the use of anonymized business partners who exist solely to assist Ann in hiding her profits. Crypto might make this scheme more foolproof for Ann, by enabling her to anonymously own and operate a network of covert subsidiaries that she does business with openly, and which collect most of her profits, but which themselves are for some reason not vulnerable to the tax authority. Traditionally, multi-national businesses do this using transfer pricing and offshore subsidiaries, and their battle with the tax authority has several features: taxes based on GROSS for transactions crossing borders that inhibit tracking (customs duties, higher withholding taxes for more anonymous trading partners, etc.) legal requirements for consolidated reporting, with rewards paid to informers who expose conspiracies shifting the burden of proof to Ann in cases of suspected self-trading with transfer pricing. (this means that if Ann can't prove who her anonymized trading partner is, and it therefore could be a covert subsidiary of herself, then she automatically loses) The gross-basis taxation is the most likely cost-effective tool that tax authorities could use to combat crypto-based tax evasion, in my opinion. I'd like to see the cypherpunks-quality analysis of how crypto/ecash would help the anonymous Doctor Ann function in a society whose tax system was more like Europe's VAT system. ---------- Date: Mon, 16 Dec 1996 16:47:14 -0800 From: Hal Finney <hal(a)rain.org> To: cypherpunks(a)toad.com Subject: Hard to Tax Scenario Cc: hanson(a)hss.caltech.edu Sender: owner-cypherpunks(a)toad.com Precedence: bulk Robin Hanson, inventor of the Idea Futures prediction market, is a very creative and thoughtful writer who has posted to this list occasionally. He says he sent the message below to the CP list over the weekend, but I didn't see it. I am including it (in bits and pieces) in its entirety for the benefit of others who may also have missed it. Robin Hanson, <hanson(a)hss.caltech.edu>, writes: > Hi. The volume here is too high for me to subscribe regularly, but I > subscribed recently so I could ask the following question: > > How well thought out is the notion that widespread crypto could > allow a large fraction (>30%?) of the economy to avoid taxation? > > I've heard this speculation many times, and just saw it in print in, > in David Friedman's article in the summer '96 issue of Social > Philosophy and Policy. But I have trouble imagining how it could > work. For those who don't know, by the way, David Friedman is the son of Nobel prize winning economist Milton Friedman. Both father and son have libertarian leanings, and David in particular has tackled some of the hardest problems which would be faced by an anarchic society. > Imagine Ann is a doctor who wants to ply her trade without taxation. > Patients go a local high res medical net booth, which Ann runs from > long distance using several real time digital mixes. To do this, Ann > spends most of each day in her expensive home VR room. So we are imagining a future scenario in which medicine is commonly if not universally practiced via these remote means? Or do we have two classes of doctor, the anonymous virtual ones and the identified ones that you go and see in person? I ask because at least some of the difficulties Ann faces seem due to her virtual practice. > Patients pay Ann in untraceable cash, which she uses to pay for > groceries and other net services. Her cover story about why she > spends so much time in her home VR room, and how she pays for > groceries, is that she is a receptionist for some sham company. The need for a cover story raises the question of from whom Ann has to keep her secrets. In a society where (we will stipulate) 30% avoid taxation, the moral significance of not paying taxes will be different than it is today. We had some interesting posts in an earlier discussion on this list describing the situation in Italy, where apparently tax avoidance is raised to a higher degree than in the U.S. It sounded like it has the approximate moral status that speeding does here, a minor infraction which almost everyone does some if not all of the time. In some sub-cultures no doubt the tax avoidance rate would be even higher. In such a society Ann may not have to care that much about keeping her secrets, as long as she doesn't have too high a profile at tax time. > Ann has many collegues which she does business with regularly, > including equipment suppliers, a pharmacist, a nurse practitioner, > emergency substitutes, and various specialists. Ann has never met any > of these people in person, and they all show each other fake faces, > voices, and even rythms of walking and speaking. Ann's social life > outside VR is entirely divorced from her work life. Well, that last part is true for me already; I telecommute to a company 300 miles away and have no social life with my co-workers. For that matter my wife and I have practiced cocooning for several years, and I haven't had a close friend from work since the early 1980's. Being married makes this easier, of course. The other part of this scenario, where Ann interacts with her co-workers via fake faces, does seem disturbing. I could imagine, though, that this might be common in such a culture. Maybe everyone pretties themselves up when on the videophone. If there is widespread understanding that most faces are at least somewhat false, then perhaps going all the way to a completely faked up face would seem more acceptable. But to someone from my generation it will be hard to accept. > To convince patients to trust her, Ann gets bonded by a certification > service. To obtain this certification, Ann must be careful to not > refer to any people who know her "true name", such as her teachers at > the physical school she physically attended. And Ann must somehow > assure the certification service that she will not resell the > certification, allowing others to pretend that they are her. It is possible that we might see a more performance-based certification rather than a recommendation based one. My wife is a physical therapist, and she had to pass a licensure exam given by the state which qualifies her to practice. In an earlier message to me Robin pointed out the crucial role played by recommendations in hiring decisions. Certainly I would be much more likely to hire someone who listed his previous jobs and for whom I could get good recommendations by his earlier supervisors than an applicant who insisted that this information was confidential. Robin also suggested that there could be a selection effect, so that the doctors from good schools with good grades would use these advantages to maximize their income, and so the only anonymous ones would be the ones who didn't have these qualifications. This could lead to a situation where most anonymous service providers were assumed to be inferior to regular ones, so they would get less money even if they were actually just as good. (I apologize to Robin if I missed the point of his earlier discussion or am presenting it incorrectly.) Even with such disadvantages, a doctor like Ann might accept a lower fee at first while she builds up her reputation as an anonymous doctor with talent and ability. After a few years she could hope to have overcome the stigma which (we will suppose) anonymous doctors face and display some strong recommendations based on her successes. In the long run this could be a winning strategy due to the tax savings. (I haven't given the problem of reselling certificates enough thought to discuss it in any detail. There have been some discussions of "is a person" credentials which could apply, but that opens up a big can of worms.) > If Ann ever slips up, revealing her true name to a virtual associate, > failing to convince a physical associate of her sham employment, > or if anyone ever breaks through her realtime digital mixes, Ann > is open to expensive blackmail, she may have to start over with a > new virtual persona, and may have to go to jail for a long time. This is an interesting problem which I haven't seen discussed before in this form. In Vinge's original "True Names" people were afraid of harrassment and physical threats if their identity were discovered, but Robin's example of the danger of being exposed as a tax evader could be very bad as well. If there is this much tax avoidance, we might assume that tax rates are high, and penalties for tax evasion are high as well. On the other hand, if tax evasion is nearly universally practiced, perhaps there are strong cultural pressures against turning someone in. There is also the question of how good the technology is for anonymous communication. At best it would appear to require a widespread infra- structure, and if this is used largely for tax evasion it is hard to see how it could survive. So I think this would be a very significant issue to be faced by the prospective 'nym. > It seems to me that Ann is paying a high price for an ability to > avoid taxation, and at current tax rates it is hard for me to believe > that she wouldn't just rather pay the taxes. What am I missing? > > Robin D. Hanson hanson(a)hss.caltech.edu http://hss.caltech.edu/~hanson/ It is hard to judge how high the various prices are that she pays. The socialization aspect may not be important if she has friends outside work. The risks of being caught will depend on factors we don't know, like the technology and legal system. Rather than assuming that tax rates are the same, it might be more plausible to assume they have gone up in order to keep revenues stable. Another problem which Robin didn't mention is the issue of insurance payments. It is hard to see how Ann's patients can get reimbursed for their expenses if we assume that Ann is in effect a "black market" doctor. This problem may be somewhat specific to the medical scenario, but I suspect that many other professions are going to have trouble switching to a cash basis. Anyone whose customers are businesses, for example, will face the problem that the businesses' books will need to show that an expense is justified in order to deduct it. This will be a major problem for the "anonymous firm" we have discussed occasionally. One difficulty I find with this scenario is its science fictional nature. It is hard for me to consider details about the life of a doctor who works via VR. Also, if we are already in a situation where 30% of people are avoiding taxes there will certainly have been major changes in society, but I don't know what they will be. This makes it hard for me to focus on the issues specific to Ann's anonymity. However I do like Robin's choice of a concrete and vivid example like this. Hal

2 1

ALERT: White House denigrating your right to secure your privacy (3/28/1997)
by Shabbir J. Safdar 17 Dec '03

17 Dec '03

============================================================================== ___ _ _____ ____ _____ _ / _ \| | | ____| _ \_ _| | THE CRYPTO BATTLE HAS BEGUN! | |_| | | | _| | |_) || | | | CLINTON ADMINISTRATION PROPOSES CONTROL OF | _ | |___| |___| _ < | | |_| ENCRYPTION FOR AMERICANS ON U.S. SOIL |_| |_|_____|_____|_| \_\|_| (_) March 28, 1997 Do not forward this alert after May 1, 1997. This alert brought to you by: Center for Democracy and Technology Eagle Forum Electronic Frontier Foundation Voters Telecommunications Watch Wired Magazine _____________________________________________________________________________ Table of Contents What's Happening Right Now What You Can Do Now Background What's At Stake Supporting Organizations _____________________________________________________________________________ WHAT'S HAPPENING RIGHT NOW On March 26, 1997, the Clinton Administration proposed draft legislation which would, for the first time, impose DOMESTIC RESTRICTIONS on the ability of Americans to protect their privacy and security online. In its current form, the draft bill seeks to impose a risky "key-recovery" regime which would compel American citizens to ensure government access to their private communications. Law enforcement and national security agents would not even need a court order to access private decryption keys. Congress is currently considering three separate bills which would prohibit the government from imposing "key-recovery" domestically, and encourage the development of easy-to-use, privacy and security tools for the Net. As more and more Americans come online, the Administration's plan is a giant step backwards and would open a huge window of vulnerability to the private communications of Internet users. Americans expect more when conducting private conversations with their doctors, families, business partners, or lawyers. Please read the Alert below to find out what you can do to protect your privacy online. ________________________________________________________________________________ WHAT YOU CAN DO 1. Adopt Your Legislator Now is the time to increase our ranks and prepare for the fight that lies a head of us in Congress. The time to blast Congress or the White House with phone calls and emails will come, but now is not the appropriate moment. Instead, please take a few minutes to learn more about this important issue, and join the Adopt Your Legislator Campaign at http://www.crypto.com/adopt/ This will produce a customized page, just for you with your own legislator's telephone number and address. In addition, you will receive the latest news and information on the issue, as well as targeted alerts informing you when your Representatives in Congress do something that could help or hinder the future of the Internet. Best of all, it's free. Do your part, Work the Network! Visit http://www.crypto.com/adopt/ for details. 2. Beginning Monday March 31, call the White House Internet public interest advocates continue to work the Hill in support of the three true encryption reform bills in Congress, Pro-CODE, SAFE, & ECPA II. If you still feel a need to voice your opinion, however, you can call the White House to express your opinion. Step 1 - Beginning Monday March 31, call the White House Call 202-456-1111 9am-5pm EST. Ignore the voice mail survey and press '0' to get a comment line operator. Step 2 - Tell them what you think about intrusions into your privacy! Operator: Hello, White House comment line! SAY YOU: I'm calling to oppose president's Internet encryption bill. THIS -> It infringes on the privacy of Americans. We need a solution to the encryption issue that protects privacy, and this is not it. Operator: Thank you, I'll pass that along to the President. 3. Spread the Word! Forward this Alert to your friends. Help educate the public about the importance of this issue. Please do not forward after May 1, 1997. _____________________________________________________________________________ BACKGROUND Complete background information, including: * A down-to-earth explanation of why this debate is important to Internet users * Analysis and background on the issue * Text of the Administration draft legislation * Text of Congressional proposals to reform US encryption policy * Audio transcripts and written testimony from recent Congressional Hearings on encryption policy reform * And more! Are all available at http://www.crypto.com/ ________________________________________________________________________ WHAT'S AT STAKE Encryption technologies are the locks and keys of the Information age -- enabling individuals and businesses to protect sensitive information as it is transmitted over the Internet. As more and more individuals and businesses come online, the need for strong, reliable, easy-to-use encryption technologies has become a critical issue to the health and viability of the Net. Current US encryption policy, which limits the strength of encryption products US companies can sell abroad, also limits the availability of strong, easy-to-use encryption technologies in the United States. US hardware and software manufacturers who wish to sell their products on the global market must either conform to US encryption export limits or produce two separate versions of the same product, a costly and complicated alternative. The export controls, which the NSA and FBI argue help to keep strong encryption out of the hands of foreign adversaries, are having the opposite effect. Strong encryption is available abroad, but because of the export limits and the confusion created by nearly four years of debate over US encryption policy, strong, easy-to-use privacy and security technologies are not widely available off the shelf or "on the net" here in the US. A recently discovered flaw in the security of the new digital telephone network exposed the worst aspects of the Administration's encryption policy. Because the designers needed to be able to export their products, the system's security was "dumbed down". Researchers subsequently discovered that it is quite easy to break the security of the system and intrude on what should be private conversations. This incident underscores the larger policy problem: US companies are at a competitive disadvantage in the global marketplace when competing against companies that do not have such hindrances. And now, for the first time in history, the Clinton Administration has DOMESTIC RESTRICTIONS on the ability of Americans to protect their privacy and security online. All of us care about our national security, and no one wants to make it any easier for criminals and terrorists to commit criminal acts. But we must also recognize encryption technologies can aid law enforcement and protect national security by limiting the threat of industrial espionage and foreign spying, promote electronic commerce and protecting privacy. What's at stake in this debate is nothing less than the future of privacy and the fate of the Internet as a secure and trusted medium for commerce, education, and political discourse. ______________________________________________________________________________ SUPPORTING ORGANIZATIONS For more information, contact the following organizations who have signed onto this effort at their web sites. Center for Democracy and Technology http://www.cdt.org Press contact: Jonah Seiger, +1.202.637.9800 Eagle Forum http://www.eagleforum.org Press contact: Phyllis Schlafly, +1.314.721.1213 Electronic Frontier Foundation http://www.eff.org Press contact: Stanton McCandlish, +1.415.436.9333 Voters Telecommunications Watch http://www.vtw.org Press contact: Shabbir J. Safdar, +1.718.596.7234 Wired Magazine http://www.wired.com Press contact: Todd Lappin, +1.415.276.5224 ______________________________________________________________________________ end alert ==============================================================================

1 0

RE: Hard to Tax Scenario
by Vincent Cate 17 Dec '03

17 Dec '03

> Robin Hanson, <hanson(a)hss.caltech.edu>, writes: > > > How well thought out is the notion that widespread crypto could > > allow a large fraction (>30%?) of the economy to avoid taxation? > [...] > > Imagine Ann is a doctor who wants to ply her trade without taxation. The good doctor Ann is not in the easy 30%, unless she is selling a medical book she wrote over the Internet, or something like that. There will be people who are much easier to tax than others, and I think Ann is one of those. Today painters, plumbers, etc often give big discounts for cash payments. The reason is they do not want to report their earnings. Today many many people on welfare do odd jobs and take their checks to places with signs like "Checks cashed - no ID required - 6%". They probably actually show ID, but the merchant cashing the check does not write down a social security number. The guy on welfare does not have this earning tied to his social security number. This is a very good thing for him, because if the government knew he earned $100 they would take $95 off his welfare check. So it is much like he is avoiding his 95% tax bracket. And it is amazing to me how many people think, "those evil businesses, taking advantage of those poor people who are too stupid to open a bank account and so pay 6% to cash checks". This is rational self interest at work here, not stupidity. If you add the painters, welfare people, drug dealers, etc. We could well be close to 30% of the economy long before all the cypherpunks form corporations in Anguilla. - Vince Cate

1 0

RE: Hard to Tax Scenario (fwd)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

For my views on taxes see http://www.law.miami.edu/~froomkin/articles/arbitr.htm A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | "Cyberspace" is not a place. U. Miami School of Law | P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

Re: remailer spam throttle
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

> > That's a good idea, but it'll take up a lot of disk space at the > > machine running the remailer. Right now, remailers that provide > > latency don't keep an e-mail for more than about 12 hours. Once > > you start keeping them around for a few days (a reasonable grace > > period for a first-time user), it's a lot more disk space. > > How 'bout this: > > There is (as we all know) a newsgroup for anonymous messages, Simply > encrypt the message with one half of a public key pair, and send the other > to the individual with a message saying that there is a message waiting > for you on alt.anonymous.messages with a subject of ^CHojnafy&Ys9. This is > the key to decrypt the first level. If you do not have access to usenet, > you can get the message from www.dejanews.com &etc. I don't like this for only one reason: you'll be wasting disk space at thousands of usenet sites. I happen to think that alt.anonymous. messages is a really wasteful communications channel. If it were used for all the traffic now caried by the remailers, many syadmins would stop carrying it (a lot of useless traffic). I would have if I had carried it. :-) Also it's not fair to assume that everyone with access to e-mail can also get web or usenet. One example that's still fairly common in a user on a corporate computer behind a firewall. > The encryption by the endpoint remailer is not intended to > supply complete privacy, but rather to provide an additional level of > protection for those who don't encrypt to begin with. If the key is generated by the remailer, then a LEA might go on a fishing expedition trying to figure how the key was generated and whether they can generate the same key again. It's safer not to generate random keys. > This has the benefit of (1) not dumping the email into a persons > mail box, so they don't get "spam" they don't want. (2) getting possibly > illegal material off the remailer machine as quickly as possible (well, > off the remailer portion anyway, if the news spool is on the same machine, > that is a different legal battle) and (3) disassocating the sender and > receiver a little more. These are all good things; I just wish they could be accomplished in a less wasteful manner. To replicate a file at thousands of usenet servers which can only be decrypted by one person is, in my opinion, selfish net-abuse. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: remailer spam throttle
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

paul(a)fatmans.demon.co.uk writes: > > > Well, they can compile the list of addresses off of USENET postings and > > > such and then compute the hashes of the compiled names and identify > > > those that are on the anon acceptance list. Not that it completely > > > invalidates the idea, but certainly it is a problem. > > If a time delay isn`t a problem a remailer could operate on the list > with a MAC, if someone wants to find out if a name is on the list > they submit a request to the remailer operator who daily executes a > batch job using a (memorised) key to verify the hashes against one > another. > > Of course this gives no protection against the scenario of a law > enforecement agency or shady TLA comprised of men in long black > trenchcoats demanding the operator reveal the key to the MAC. I > suppose there is always "I have forgotten the key, officer"..... ;-) Yes. The remailer should contain as little "interesting" information as possible at any given time, even if it's encrypted. > > X sends 1000 copies of child porn/seditious libel to 100 people believed no > > to be using remailers right now. The remailer keeps the 100 e-mails onits > > hard disk and e-mails each receipient a ping, inviting them to agree to the > > disclaimer terms and to retrieve their anonymous e-mail. The first recipie > > to retrieve the e-mail gets upset and contacts the feds. The feds figure, > > remailer still has the 99 other e-mails and the information on who's suppos > > to receive them in its queue; why not seize it and take a look. > > A possible solution to this is to set a time limit, say 24 hours on > how long a proposed recipient may take to respond to a request for > permission to send the mail. The remailer then sends the mail > simultaneously to all those who agreed, those who declined to accept > the mail or failed to repond are removed from the recipient list. *If* the remailer keeps the e-mail until the recipient agrees to the disclaimer and fetches it, then the timeout period should be longer than 24 hours. Not everyone checks their e-mail every 24 hours. E.g., sometimes I'm away and don't check it for 3 or 4 days. A friend of mine checks hers once or twice a week because she doesn't get much. Of course I'm advocating something more draconian - discard the e-mail at once if the recipent isn't known and e-mail them how they can get their mail next time. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: remailer spam throttle
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Adam Back <aba(a)dcs.ex.ac.uk> writes: > Dimitri Vulis <dlv(a)bwalk.dm.com> writes: > > Adam Back <aba(a)dcs.ex.ac.uk> writes: > > > [encrypt the message and send the recipient the key, discard the > > > key, when they request the message they supply the key] > > > > That's a good idea, but it'll take up a lot of disk space at the > > machine running the remailer. Right now, remailers that provide > > latency don't keep an e-mail for more than about 12 hours. Once > > you start keeping them around for a few days (a reasonable grace > > period for a first-time user), it's a lot more disk space. > > "Disk is cheap." I just bought a 3.8Gb quantum for $300. That's 4 > times cheaper Gb/$ ratio than last disk I bought a year ago. I paid over $700 for a 2GB disk about 18 mos ago. Yes, disk prices are falling through floor - giving the lie to the scum that tries to control Usenet "spam" - but is it really worth it to have to maintain a huge spool space to support a remailer? If you really think you can afford a few GB of extra disk storage, start up a Usenet site of virtue. > 1Gb encrypted message pool? No problem. > > Don't have the resources for the 1Gb disk? Your ISP will be charging > you many times that for your leased line. > > If it's an issue charge postage to cover your storage and transmission > costs. > > However, I suppose if you're using an ISP shell account, and have no > leased line, you may have more space restrictions. It should be possible to run a remailer on an average $19.95/mo shell account. Most of them come with a disk quota of a couple of megabytes. I do think that keeping a lot of mail in the queue (more than is kept by the remailers that use latency now) would make such accounts unsuitable for remailers. > A better idea, (for both ISP shell account and leased line version) > would to send the recipient the encrypted data, you keep the key :-) > > (View it as a secret split where the parts happen to be different > size, you keep the small one). > > They send you the data and you decrypt, send it back and discard the > key. You could store 16 million keys on your 1Gb remailer spool > partition. That 16 million keys would represent 16 Gb of delivered > encrypted email. > > You could still cope with a fair number of messages in 1Mb remailer > key spool in your home file space on an ISP based shell account. > > I think this solves remailer resource objections. yes, this sort of solves the storage problem. Thinking how this might work... Alice's remailer gets an e-mail for Bob. Alice's remailer generates 2 pseudo-random numbers, K and L, and uses K to encrypt the message with a symmetric cryptoscheme. Alice's remailer sends the encrypted message and L to Bob with the following note: if you want to receive the key to decrypt this message, send back L and acknowledge the disclaimer. Alice's remailer retains the triple (K,L,Bob). Because it's small, it can be kept for a long time. If Bob sends back L, the remailer sends Bob K so he can read his message. I see a few problems with this. I'm sure it can be improved. 1. What if Bob is another remailer, unknown to Alice? 2. What if Bob doesn't have the program to decode his message? (It's fair to assume that everyone can fine PGP. It's not fair to assume that everyone can find e.g. triple DES.) 3. What if the LEA's decide that the collection of triples on Alice's computer is worth looking at, for instance, for the list of addresses. (OK, they could be encrypted probably.) 4. What if the LEA's decide to find out how K, L are generated? > You still have the problem of saturation of your network bandwidth. > You can probably encrypt (it's symmetric key, say IDEA) fast enough > for encryption overhead to be less of a problem than the saturation of > the bandwidth of your leased line. I think IDEA or triple DES would be fast enough for this. > Your other problem is user acceptance -- your average user may still > object to receiving Mb's of junk which while the contents don't offend > him (he can't read it), the sheer volume may annoy him. Given how some people react very negatively to what they consider "unsolicited e-mail", I think it might be a bad idea to send them large encrypted messages w/o confirming that they want them. But it's also a bad idea to keep an unknown's e-mail on the remailer. The only way out, IMO, is to *discard* an unknown's e-mail and to tell him what positive action he can take so future e-mails don't get discarded. And by the way: a remailer should probably keep a list of people who have been told about the need for a positive action, so they won't get duplicate notices more than every week or so. If X sends Y 10 e-mails and the remailer sends Y 10 identical notifications with the instructions how to enable receipt, Y might get justifiable upset. When Alice's remailer gets an e-mail for Bob, it should do something like: try to fetch Bob's public key from a well-run key server / \ success failure | | encrypt the e-mail discard the with bob's key and e-mail! pass it to Bob | was the form letter sent to Bob in the last 7 days? \ / no yes \ / exit send bob the form letter Wow, isn't that a perry flow chart. :-) ... > > Suppose a LEA wants to search the computer hosting the remailer. > > They come across a bunch of encrypted files. > > The operator has to convince the LEA that they don't have the means > > to decrypt the e-mails or even to figure out who they're from. > > Well you can't can you? It may be hard to prove a negative to a LEO who doesn't know what the hell you're talking about. You have a file in your spool that was encrypted with a key that your program generated, but now you no longer have the key? Well, tell us how the key was generated. ... > I agree with what you're saying that technological aptitude can > provide some metric of cluefullness. And that cluefullness usually > correlates with good net citizenly behaviour (eg understanding what a > remailer is, and not legally threatening, or setting the Feds on to > the human owner of a bot. > > However there exist quite a few counter examples: cluefull people who > do not use PGP, or consider it to be too much hassle (quite a lot of > them hang out on cypherpunks, and will actually object if you send > them encrypted email, even though spending most of their time on > cpunks arguing about the usefulness and essentiality of these tools > for privacy). Well - if generating and publishing a PGP key were a requirement to be able to receive anonymous e-mail, I'm sure they'd do it. Some people (like Dale) legitimately question certain uses of PGP, but I think in this case it's worth encouraging its use. > Also some journalists are pretty clueful (or useful to be able to send > information too, shall we say, journalists as a group having a bad > rep), and not many can handle PGP. Hmm - I'm sure John Markoff and even Declan can handle PGP. If, for example, Jon Schwartz can't handle PGP (and I don't know whether he can :-), then he doesn't deserve any anonymous tips. Free market in action. Later - thanks a lot for the extensive comments. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 2

[ANNOUNCEMENT] Cyclic codes
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Timmy `C' Mayonnaise sexually molests little children, farm animals, and inanimate objects. o-:^>___? Timmy `C' Mayonnaise `~~c--^c'

2 1

Re: Microsoft ammunition
by Lucky Green 17 Dec '03

17 Dec '03

At 12:49 PM 3/28/97 -0800, Bill Frantz wrote: > Whether your personal files are stored on a >local disk or on a server doesn't matter. What matters is whether random >downloaded code (again, Java or ActiveX doesn't matter) can use your >authority to read/modify those files. The ActiveX model of, "It's signed >by XYZ Corp. Of course it's safe." is so much bullshit.* The Java >approach of running untrusted code in a safe box is better, but doing it by >validating the safety of object code requires trusting a large complex >verifier. JavaSoft has moved into the right direction. Their JECF is largely capabilities based and in fact, Java security in general in moving towards capabilities. That won't help you against attacks via the underlying insecure OS, such as Windows 95/NT, MacOS, or UN*X which the typical user will be running, but it is miles ahead of the initial sandbox model. >* See Norm Hardy's paper, "The Confused Deputy", which I believe is still >available through the EROS page at the University of Pennsylvania. I was a talk by Norm that made me see the light. Secure computing requires capabilities. And there is anecdotal evidence that it was Norm who indirectly pointed JavaSoft to the solution to their leaking sandbox problem. Time for my usual plug: if you are unfamiliar with capabilities based operating systems or don't know why they are the only currently available solution to a whole host of computer security problems, do a search for "KeyKOS". It should get you started. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

2 1

RE: Hard to Tax Scenario
by Robert Hettinga 17 Dec '03

17 Dec '03

At 8:44 pm -0500 on 3/29/97, Hal Finney wrote: > I think Robin's example of an anonymous doctor is a bit extreme, > since doctors typically do hands-on work. Ain't quite so far-fetched as it looks. At the ACM 50 year thing a bit ago, they were doing telemedical diagnoses. The Army has a teleoperated meatball-surgery system for battlefields. Onion routed surgery, anyone? > Yes, I think there is general agreement that these methods will not work > well for large businesses. Another issue is the requirement to keep > fraudulent records, etc., which may involve a large number of people in > the conspiracy. Right, but, in a <ducking> geodesic </duck> market, large entities dissolve anyway because (another of my wildly unsubstantiated claims) large firms' internal transfer pricing efficiencies aren't any higher than those of the open market. > I gather that similar dodges are employeed today by wealthy lawyers and, > yes, doctors, to hide some of their income. They hire offshore companies > to perform some services, which are actually under their control via > shell corporations, trusts, etc., set up in banking-secrecy jurisdictions. > Presumably crypto could smooth the way somewhat and open these methods > up to more people, but I don't see it as a particularly essential ingredient. I think, soon enough, we're all going to be sole proprietors of some kind, transacting business on our own behalf on the net, and cash will always king in that kind of world. Frankly, corporations have no way to hide, or they would. Heck, when you think about it, corporations, as legal entities, anyway, can't survive in an environment where laws can't work, anyway. (By the way, I'm going to embarass Doug Barnes now by naming a law after him. He said a thing of beauty at FC97: "Any transaction protocol which has, as one of it's steps, '...and then you call the cops', isn't a real good idea on the internet." Shall we call it Barnes' Law, anyone? Sure, lots have said it before, but no one's said it better...) > These all assume a model where the transaction is open, but where the > ownership issues are hidden. However I think we have been talking about > simpler methods, where the fact of the initial income is what is hidden. Right. Or, if the income is actually earned and spent on the net. There, cash is the best payment method because it settles instantly without the recordkeeping overhead -- much less the indirect cost of law-enforcement :-). > Or she takes some work on the side > via an anonymous network, and the cash goes straight into her pocket. Oops. I shoulda read further, I guess. :-). > If receipt-skimming is facilitated by the untraceable nature of ecash, > then presumably sales tax can be under-reported as easily as income tax. Or capital gains, or any other book-entry tax. > I don't know how or whether crypto could help with the more elaborate > techniques you are really asking about, dummy trading partners and such. > If you're really paying taxes on your gross receipts, then presumably > the only way to save is to hide those receipts. You could do this by > taking some fraction of your work anonymously, even if most of your > income is reported. I think of this stuff at the boundry between cypherspace and meatspace as the equivalent of turbulence. And, as the joke goes, turbulence is a hard problem. :-). However, I do know that as it becomes more and more easy to buy and hold assets on the net, particularly financial assets (the largest category thereof) and, someday, maybe even actual meatspace-physical *stuff*, this problem, like that of punching through the turbulence at the sound barrier, or that any other "barrier" for that matter, will be not such a big deal. (Another paragraph of Proustian proportions, that...) Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

1 0

National Citizen-Unit Tracking Database coming soon
by Brad Dolan 17 Dec '03

17 Dec '03

National Citizen Dossier System Being Quietly Set Up That's what the headlines should be saying, anyway. Instead they're saying things like: (_Knoxville Journal_, 3/27/97) Governor's Budget Includes Money to Set Up Gang-Tracking Network [...] [A]s part of the governor's anti-gang proposals, he's proposing to spend $625,000 worth of state and federal money to set up a gang-tracking computer database and network. Four agents of the Tennessee Bureau of Investigation will be assigned to do nothing but gather and maintain information about gangs in the state's four regions. They will analyze and compile the information on computer for dissemination throughout the state, the Southeast, and the nation - but not for public use. Law enforcement agencies will be able to use it and update it. Information on the database could include a picture, a description, the gang affiliation, criminal convictions, crimes that a person is suspected in, and possible nicknames. [...] Other press reports have indicated that the database will include "domestic terrorist groups" and will incorporate a great deal of additional data, such as a roster of vehicles which should be given special attention at the now-innumberable roadblocks and checkpoints. The important thing to note is that - as I understand the description of the program - a person does not have to commit a crime to be included in the database. They just have to have contact with a person or group which is already in it. Didn't somebody named Jospeh McCarthy get himself in trouble over this kind of thing? bd

1 0

Heaven's Cypherpunks
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

If you like weird connections, how about a Cypherpunks-Heaven's Gate link? If you like really weird connections, how about a Cypherpunks- Heaven's Gate-Solar Temple link? If you like really, really weird connections, how about a Cypherpunks-Heaven's Gate-Solar Temple- Waco link? Lest you think I jest, let me explain that what I am about to tell you is fairly easy to verify and document, and is not based on vague allusions to some psychic vibrations from the comet, which seem to be rather commonplace lately. In the early 1970's there was a small group in Canada, known as the Bartonian Metaphysical Society. The group was joined by an individual named C.J. Parker, who had just had his first experience of "the end of the world" as a member of Herbert W. Armstrong's Worldwide Church of God. Parker became a teacher and leader in the group, which soon became the Institute for Applied Metaphysics, with metaphysical retreats in Saskatchewan, Ontario and Quebec. There were often UFO reports surrounding the dates of their intensive seminars in Eastern Canada, which received press coverage, I believe. Parker was involved, according to both himself and many others, in the founding of the New Covenant Club during his involvement with IAM. This was centered around the belief that the "old covenant" with God, which involved circumcision, had now been replaced with a "new covenant," which involved vasectomies. Later, some of the Eastern leaders began indicating that if vasectomies were a good way of indicating one's dedication to spirituality in the end-times, then castration was even better. Parker was soon involved in a second "end of the world" when Winifred Barton made her prediction in the mid-to-late 1970's. After her prediction appeared (to some) not to come true, then many left the group and quite a few migrated to other groups, including the Solar Temple. Parker migrated to Texas, where he was involved in the music business, and in running clubs for mob interests. He managed clubs in Waco and Killeen, Texas, where he apparently became involved with David Koresh, although that might have been at a later date. He was arrested and convicted in Bell County, Texas for assault on police officers there, sometime around 1980. Parker became a recording artist and soon afterward moved to Tucson, Arizona, where he continued to dabble in music and metaphysics, travelling across the SouthWestern U.S., as well as up and down the west coast. He started a computer company in Tucson, called "Pearl Harbor Computers," which was based on the belief that computers were the work of Satan, that Bill Gates and Microsoft were tenacles of the Satan, and that those who wished to fight evil must dedicate themselves to promoting other operating systems, UNIX in particular. Parker apparently fathered an organization called the "Circle of Eunuchs" that was dedicated to recruiting individuals who had the skills and the intelligence to develop systems and methodologies which could serve to work against what he saw as the plans of Satan to bring domination over the whole earth At various times, he has had vehicles registered in the states which were his main recruiting area: Texas, Arizona, California, New Mexico, and Oregon. (He also made limited recruiting trips to Germany, Poland, and, I believe, Russia.) Parker spent time in California where he was in contact with Do, who shared his fetish for mixing computers and spirituality, and it was apparently Parker who introduced him to the concepts underlying the New Covenant Club. Parker and Do also shared an affinity for mixing spirituality and alien theories, and decided that the Internet was going to be the battleground of the future in the fight between good and evil. Parker was also involved with a group in Berkeley, California, Basis, Inc., which was heavily involved in a Unix time-sharing enterprise and gave Parker access to a wide variety of young students and programmers to introduce to his belief system. Parker named the evil protagonist in the manuscript after the login name for one of Basis' founders, "Gomez." Parker wrote the book under the pseudonym of "son of gomez," as Basis' Gomez was his mentor in the world of UNIX. Parker was responsible for a manuscript titled "The Xenix Chainsaw Massacre" that contained a character, Bubba Rom Dos, which was loosely based on Do, including veiled references to his sexual inclination toward youngsters. Among those in the Circle of Eunuchs, it was also referred to as Part I of "The True Story of the Internet," which they foresaw as the vehicle that would prove the manuscript prophetic. Parker and his tenacles used the Internet to quietly spread the manuscript among those thought to be potential recruits, even as Do's group began making their impact on the Internet. Parker believed that Phil Zimmerman's troubles were a result of his group using Zimmerman's PGP to spread the manuscript secretly across the Internet. He apparently impressed upon Do the need to use PGP to secure any communications which were of a nature that they could cause undue trouble for groups which were working against Satan and Gates. Parker's second manuscript, Part II , began as "TV World" and later was changed to "WebWorld and the Mythical Circle of Eunuchs." This manuscript was apparently supposed to be converted to hypertext, with complete graphics, by Higher Source, and several chapters were in the works, but about a week before the El Rancho suicides, Parker was told that he should go ahead and release it in its present form, because Higher Source would not be in a position to complete the work. Parker began converting the second manuscript to hypertext himself and has had members of his organization releasing it on the Cypherpunks list. Chapters of the manuscript have been released from various points in the U.S., Canada, the U.K., and Russia. Although the manuscript had already been completed around a year before this, Parker, after receiving word to begin its release, began making _changes_ in the manuscript, apparently as a result of no longer having a need to so heavily disguise the connection between the Circle of Eunuchs and Do. A prologue was written for "WebWorld," sent to the Cypherpunks list on March 18, 1997, in which the opening strains contained the quote, "Why didn't I _do_ something?" The word "do" was in bold hypertext. Then, the next word in bold format was the word _me_, indicating that the first bold word should be pronounced as in the musical notes, do, re, me. The sentence containing the world _me_? It was a reference to Do soon being 'picked up,' "This time, they are coming for _me_." And the new opening sentence of the manuscript? A veiled reference to the fact that those left behind had been warned of their last chance to 'escape' the fate that awaits them. "The great tragedy of it, is that it didn't have to happen. Not at all... we were warned." The URL's of the manuscripts are: http://bureau42.base.org/public/webworld/ http://bureau42.base.org/public/xenix/xenbody.html They are apparently hosted by David E. Smith <dsmith(a)prairienet.org> I don't believe that he is a member of Parker's inner circle, although he does have many connections to hackers and phreaks in the Edmonton, Alberta area. Except for the prologue, the sections of the original manuscript seem to be in small print, with the newly written sections in large print. The new sections appear to use the Cypherpunks as analogous to the space aliens, and a new character, Jonathan, representing one of the Heaven's Gate members, is added. "He rode the river of tears once again, only this time the journey was _toward_ the CypherPunks, and toward freedom." It is my understanding that the "Magic Circle" is quite active in both Western Canada and the Southwest U.S. They seem to be a very secretive organization with ties to a number of groups, including the Solar Temple cult in Quebec, and a Diamond System (?) Freudian-Sufi sect centered in the Bay area. I dropped all involvement with these people a year or so ago, as I decided that involvement with them is unhealthy. I hope that you will make an effort to check out what I have told you, and perhaps expose any activities which could lead to more deaths and castrations. I don't want to be involved with anything further to do with them, as I am uneasy about being connected with them in any way, shape, or form, although I still keep track of their activities through certain members who are on the periphery of their organizations. C.J. Parker is a nome-de-plume he took on as a musician, and I can't recall his real name, but it shouldn't be too difficult to find, given the fact that he has a criminal record in the U.S. which should link the pseudonym with his birth name. He also might be located by tracking him through his record releases, which were done in Canada, I believe. TruthMonger

2 1

Re: PSYOPS/infowar
by jim bell 17 Dec '03

17 Dec '03

At 10:47 PM 3/29/97 -0500, Robert Hettinga wrote: >This is surely going to piss some people off, but let's some fun with this, >shall we? > >At 9:30 pm -0500 on 3/29/97, Greg Broiles wrote: > >> According to Ronald Duchin, graduate of the US Army War College and >> former special assistant to the Secy of Defense and director of the >> Veterans of Foreign Wars, activists fall into one of four categories: >> radicals, opportunists, idealists, and realists. He recommends a >> three-step strategy to neutralize activists: >> >> 1. isolate the radicals > >Tim May >Kelly Goen >Phil Zimmermann (then) >Belize, say I'm PISSED! Ya forgot me!!! B^) Jim Bell jimbell(a)pacifier.com

2 1

Re: Money Laundering Conference
by Robert Hettinga 17 Dec '03

17 Dec '03

At 12:13 pm -0500 on 3/30/97, Black Unicorn forwarded to DCSB: > This is a formal invitation to you to attend the upcoming 8th > International Oceana Conference on Money Laundering, The Caribbean & Latin > America, Cybercrime, Financial Crytography and International ^^^^^^^^^^^^^^^^^^^^^ Wonder where they got *that* from? :-) > Financial Crimes on May 6-7, 1997 at the Sonesta Beach Resort and Casino > Curacao, Curacao, Netherlands Antilles. This conference sponsored by > Oceana Publications, Inc. in cooperation with the > Association of International Bankers of the Netherlands Antilles (IBNA), > The Association of the Compliance Officers of the Netherlands Antilles > (CONA), and the Centre for International Financial Crimes > Studies, College of Law, University of Florida will provide global and > regional coverage of Money Laundering and International Financial Crimes. > > > (See, http://www.oceanalaw.com/seminar/ml2toc.htm) Hey!!! There's an *echo* in this room. What's the propagation delay here? Say, what, 3 months? Sheesh. Don't ever look behind you. They might be gaining... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

1 0

WebWorld 21
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

WebWorld 22
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

Re: National Citizen-Unit
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In> Governor's Budget Includes Money to Set Up Gang-Tracking In> Network In> [...] In> [A]s part of the governor's anti-gang proposals, he's In> proposing to spend $625,000 worth of state and federal money In> to set up a gang-tracking computer database and network. In> Four agents of the Tennessee Bureau of Investigation will be In> assigned to do nothing but gather and maintain information In> about gangs in the state's four regions. <snip> In> Information on the database could include a picture, a In> description, the gang affiliation, criminal convictions, In> crimes that a person is suspected in, and possible In> nicknames. -=> Quoting In:bdolan@usit.net to Harka <=- In> The important thing to note is that - as I understand the In> description of the program - a person does not have to commit a In> crime to be included in the database. They just have to have In> contact with a person or group which is already in it. This has been going on in Germany for several years now under the name "Raster-Fahndung" (cross-reference-search). What it means is as you write it: even mere contacts to suspected "terrorists, gang-members, drug-dealers" etc. is enough, to get you flagged as "suspected supporter of [see above]". An example of how one could get into that was being presented by a german civil liberties group: Let's say, there is a non-permitted demonstration going on in City A of "anarchic chaots" (the german term for ultra-left-wing groups). The police installs street barriers around the city and screens the drivers licences in search of potential demonstrators. Bob drives up, shows his ID and happens to be believed by the police man to be somehow affiliated with the demonstration. They might search his car and will let him go after that, if nothing is found. However, his name will be put in a central database as "suspected supporter of unconstitutional groups". That is enough to target his entire family and close friends with possible surveillance etc., if the police (or actually the interior intelligence agency "for the protection of the constitution") chooses to. Bob will never know of that and although, he has nothing to do with the demonstrators, his name will be in such a database as a suspect. That example shows, that the law can be (mis)used to almost unlimited surveillance on pretty much everybody to the hearts extent of the "law-enforcement" agencies. And guess what? They will. Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! -> http://www.epic.org */ /* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMz83nTltEBIEF0MBAQGNnwf8CL7L2pEY1Qfnfh+5D5LWwTb/DXWAr6+C TJcsuBYA8MQ94tNhM7DDwBLlf60AKVgKJjh/BX6JEOWMrXLXewkDxNCj9PG1iDwV bPXmEsI8ovX8EZJrNjFAhF7pG83bwHzD+23xpamx+9fYq6T2hHpZse7XEavYNBqv 0+8vJiCxsvuLn9q8CWng+KgNYmCk9JXJUj+8jUvJJHgbXt+Bkvech4mfL7cW7nvN HPAMXalKWaWrcroJAnz/2bi2JlMovfVftU1u79CUrPi9rPMYJJAaD28VEfeCHd5T e9WfTnu6F3C67CEZ0TCR+toQxLM5RgNej3mv69OiVyntNnmaPD9GeQ== =1e2d -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

2 1

National Citizen-Unit #22
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

WebWorld 22

1 0

rot13 Encoder/Decoder
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

http://otto.cmr.fsu.edu/~davis_t/rot13.cgi

1 0

Privacy? Not in Canada!
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

From: ag434(a)freenet.hamilton.on.ca (David Buchanan) Newsgroups: alt.security.pgp,talk.politics.crypto Subject: Re: If you want privacy, don't come to Canada! Date: 30 Mar 1997 22:26:41 -0500 Organization: Hamilton-Wentworth FreeNet, Ontario, Canada. CRIMINALS WON'T BE THE ONLY TARGETS Criminals won't be the only targets if strong non-escrowed encryption is outlawed although criminals provide a convenient excuse for governments seeking to extend their power over their own citizens. Even in Canada, a nation which can hardly be described as a police state, there is good reason to fear the security and intelligence apparatus will be used by the government against its legitimate and law-abiding political opponents. Let me give you two examples. 1) BUREAUCRAT'S "LET'S GET HIM" MEMO Within the last couple of weeks, the Canadian public learned from news reports about a meno written by a top level federal bureaucrat in which he complained about the activities of a private citizen and suggested that his fellow government officials should "take a look at this guy." The private citizen was a law-abiding, former military officer whose freedom of information requests had exposed mismanagement and corruption in the government. This memo was particularly chilling because the recipients included officials of the tax department and the Canadian Security and Intelligence Service (CISIS) -- two agencies well suited to bringing pressure to bear on private citizens. Although the bureaucrat was caught in the act this time, it is quite disturbing that a senior civil servant believes such a memo to be normal and acceptable. 2) NEO-NAZI PLANTED IN OPPOSITION PARTY During the last Canadian federal election, the ruling Progressive Conservative Party (PCs) was losing voters to the Reform Party, a moderate, small "c" conservative party based in Western Canada. The PC's campaign strategy was to accuse Reform of being "extremists" or "racists." About the only evidence of this that the PCs were able to produce was the founder and leader of a small neo-nazi style group who had attempted to infiltrate the Reform Party with little success. Subsequently the public learned that the neo-nazi was actually a paid agent of the Canadian Security and Intelligence Service (CISIS), an agency ultimately controlled by the Progressive Conservative government. There have been the expected denials from CISIS but the most plausible interpretation of these events is that the Progressive Conservative government tried to sabotage the electoral chances of the Reform Party by planting a neo-nazi on its fringes. CISIS is one of the government agencies that definitely would have access to all of the material obtained from the proposed key escrow or key recovery type systems. WHY HONEST CITIZENS SHOULD BE WORRIED The increasing use of email and other data telecommunications will greatly expand the amount of private and personal information on private citizens that governments can collect, archive, and sift through whenever they need weapons to use against their legitimate political opponents. This information can be collected very cheaply and used in ways that are difficult for the government's victims to counter or even detect. For example, a simple telephone call to a cooperative bank official just before the a target attempts to renew a line of credit for his business. The only effective way to prevent this is with the wide availability and use of strong non-escrowed, non-key-recovery encryption. As for those trusting souls out there who still believe they have nothing to hide, ask yourself this question: Would you be willing to email carbon copies of all your email messages and online data transmissions to one of your political opponents? If secure encryption is banned, this is exactly what you will be doing and you had better be prepared to agree with everything the government does on every issue or take the consequences! DB --

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"wazoo"} = "<remailer(a)wazoo.com> cpunk mix pgp hash latent cut ek"; $remailer{"shaman"} = "<remailer(a)lycaeum.org> cpunk pgp hash latent cut ek"; $remailer{"hidden"} = "<remailer(a)hidden.net> cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 31 Mar 97 6:49:14 PST remailer email address history latency uptime ----------------------------------------------------------------------- hidden remailer(a)hidden.net **######.### 51:35 99.99% lucifer lucifer(a)dhp.com ++++++++++++ 36:24 99.98% cyber alias(a)alias.cyberpass.net *+**+++*+++* 38:16 99.91% weasel config(a)weasel.owl.de ++--++-++++ 2:21:10 99.89% replay remailer(a)replay.com **-**-+*-+-* 1:32:14 99.81% balls remailer(a)huge.cajones.com ###+*##* +## 2:27 99.73% squirrel mix(a)squirrel.owl.de ++--++-++++ 2:44:37 99.58% dustbin dustman(a)athensnet.com + ++ +-++ + 49:04 99.35% exon remailer(a)remailer.nl.com #*+# +##* ** 4:34 99.25% reno middleman(a)cyberpass.net +-++ +.-+- 50:50 98.87% winsock winsock(a)rigel.cyberpass.net -----+---- - 3:56:33 98.65% jam remailer(a)cypherpunks.ca * ** ** * 11:13 98.54% extropia remail(a)miron.vip.best.com ___.._.-.- 27:38:30 96.60% mix mixmaster(a)remail.obscura.com ___.+_.-* 33:58:31 94.45% shaman remailer(a)lycaeum.org ++-++-+ -+ 28:03 86.87% nym config(a)nym.alias.net ***#**-#-# 13:11 80.62% haystack haystack(a)holy.cow.net 52:19 -4.36% middle middleman(a)jpunix.com + 35:43 2.13% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Stego Question
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Stego Question: How many bodies does it take to spell, "I _told_ you I was crazy!"

1 0

Re: PRESS REPORT - IMPORTANT?????
by Ray Arachelian 17 Dec '03

17 Dec '03

Is this for real or a troll??? On Mon, 31 Mar 1997, Anonymous wrote: > *** London Times, 30/03/1997 *** > > >Factoring problem broken: > > > >One of the main systems used by computer privacy > >programs around the world such as those used on > >the internet to prevent third parties eavesdropping > >on credit card transactions has been proven insecure, > >The RSA algorithm, based on the difficulty of "factoring" > >large numbers appears to have a weakness, a press > >release by the IACR (International Association for cryptologic > >research) reads as follows: > > >"Leading researcher Ari Lenstra last night announced major > >progress had been made towards a solution to the factoring > >problem, a result obtained by Sergei Ripov, researcher at > >an obscure university in the former Soviet union, shows > >conclusively that there exists a solution to the problem > >that is of polynomial time complexity, although this solution > >has yet to be found this signals the beginning of the end for > >a number of cryptosystems based on this problem, please note > >a trivial solution to factoring also suggests a trivial solution > >to the ECDLP and therefore a number of other systems such as > >Diffie-Hellman and the El-Gamal group of cryptosystems should > >be considered insecure" > > > >We were unable to contact the IACR for futher information. > >The leading internet products company Netscape refused to > >comment saying only "We regularly review data security > >issues concerning all of our products". > > =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= For with those which eternal lie, with strange eons even death may die.

1 0