December 2003 - cypherpunks-legacy

PGP-integrated mail reader for Windoze?
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Hello, Not being a Windows user, I wonder what do you think is the best mail reading program for windows 95 that has some pgp integration? The mail criteria, pretty much, is ease of use and some degree of fool proofness. Thank you. - Igor.

1 0

Re: PGP-integrated mail reader for Windoze?
by Lucky Green 17 Dec '03

17 Dec '03

At 11:39 PM 3/25/97 -0600, Igor Chudov @ home wrote: >Hello, > >Not being a Windows user, I wonder what do you think is the best >mail reading program for windows 95 that has some pgp integration? >The mail criteria, pretty much, is ease of use and some degree of >fool proofness. Eudora Pro 3.0 <http://www.eudora.com/> and PGPMail <http://www.pgp.com/>, without a shadow of a doubt. Neither is free, but you sure get your money's worth. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

Re: Corrupted "From:" headers in my posts
by Toto 17 Dec '03

17 Dec '03

Adam Back wrote: > > Here's one example for the problem I've been having: > : > A million monkeys operating under the pseudonym > : > "Thomas M. McGhan" <tmcghan(a)gill-simpson.com> typed: > : > : actually, there are only 5737 of us... > Do these appear to other people the same as above? I realized, recently, that the header problems could probably be resolved in a short period of time by consulting the person who has had to deal with this type of thing for many years, having hosted the CypherPunks list for quite some time. I emailed John Gilmore, asking his advice, and he informed me that he has run into this problem before, and would be happy to provide the solution, on one condition. He wants one million monkeys to send 5737 messages to the list, saying "John Gilmore is NOT a cocksucker." Then, he will provide the solution, and not a moment before. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

game theoretic analysis of junk mail
by Wei Dai 17 Dec '03

17 Dec '03

The junk mail problem (also known as spam) is well known to just about everyone who receives e-mail. There has also been many solutions proposed. Noticeably, the idea of having e-mail senders include ecash payments with their mail has come up several times (I believe as the result of independent discovery). In order to evaluate the effectiveness of this proposal, I will construct a game theoretic model of the interaction between the sender and the recipient of an e-mail, and compare the solutions with and without the ecash payment option. The Model Players: A - Sender, B - Recipient A: Send mail? / \ no / \ yes / \ (0,0) B: Read mail? / \ no / \ yes / \ (0,0) B: Accept offer? / \ no / \ yes / \ (0,-c) (s,r-c) Assumptions: - sending the e-mail is costless to the sender - c (the cost of reading a piece of e-mail) is known to both the sender and the recipient. - s and r (the profit of the proposed deal to sender and receiver, respectively, both assumed to be non-negative) are distributed according to the probability density function f(s,r). The sender knows s and r before sending the e-mail, but the receiver does not learn s and r until he reads the e-mail. Solution of the game: To solve this game, we apply the method of backward induction. In the last stage of the game, B decides whether to accept A's offer. Clearly he always accepts since r-c >= -c. Therefore, in the next to last stage, B knows that the expected payoff if he reads the mail is the expected value of r-c, E(r)-c, so he will read if E(r)-c > 0. Finally, we come to A's decision. If A knows that B will not read, then he is indifferent between sending and not sending. However, if we assume that there is a small probability that B will read and accept irrationally, then we can conclude that A always sends the mail. Conclusions To summerize, if E(r) > c, B always reads the mail and accepts the offer, otherwise B never reads. A always sends regardless of the value of the parameters. Now we can see the outcome is not socially optimal. For example if E(r) < c, both A and B would be better off if A only sends when r>c. The above model is not very realistic. The most unrealistic assumption is that the sender knows the exactly value of his offer to the recipient. However I believe the model captures the essence of the junk mail problem. Next time I will analyze the proposed solution of adding the option of a pre-payment. For those who want to try it themselves, I give the game tree here: A: Send mail? / \ no / \ yes / \ (0,0) A: Decide pre-payment p | | | B: Read mail? / \ no / \ yes / \ (-p,p) B: Accept offer? / \ no / \ yes / \ (-p,p-c) (s,r-c)

2 1

A new classical cipher
by klimt gustav 17 Dec '03

17 Dec '03

If answer please mail to : alexandermail(a)hotmail.com A new classical cipher by Alexandre PUKALL : This crypto is in Normal Pukall's Cipher mode 1 ( NPC mode 1 ) Try to break it ! ORISI / DERME / LOEEE / RNDNO / EEPRA / ITSUL / SEUOC / ELEDE / OSEGE / IRUEU / LTUUA / LEARP / RACLO / ROPRA / IETST / AUDEN / EUSMO / ROTTN / NNREF / NLEID / FEERE / EISNE / ROTO / This crypto is in Enhanced Pukall's Cipher mode 1 ( EPC mode 1 ) Try to break it ! REHUA / AVRLL / CELYU / CAICC / ATNOP / TGBEX / RMETE / LLSDO / SEEQE / MACVD / EDFVE / ESENE / MLMPL / EICPU / TEIEM / NCPAP / ELEHT / OPNRU / CAUEA / DFSNS / REANC / CCDLE / RISEU / USESA / EIDTS / MLTOA / MIOGF / ULORD / STHUA / LEUSU / CANIL / AOMUP / IEALS / BNXLD / RIUEI / EECOE / EITDN / GCLDE / JENKE / GOEAP / ESLTD / IEZOR / SEELM / AO / --------------------------------------------------------- Get Your *Web-Based* Free Email at http://www.hotmail.com ---------------------------------------------------------

1 0

Your Site Builder Network Membership!
by Site Builder Network 17 Dec '03

17 Dec '03

Welcome to Site Builder Network - Guest Membership. We went to your site(s) and were unable to find the Microsoft Internet Explorer logo and link which would qualify you for level 1, or an ActiveX control which would qualify you for Level 2. You are currently a guest member and have access to the Guest Download Area. Your ID and password are listed below for your convenience. Do you think you qualify for Level 1 or 2? Would you like to? Your registration may have failed due to any of the following reasons: You did not register the exact URL where the IE logo and/or the ActiveX control are located. ==================================================== Our automated system can only check pages, not entire sites. Please go back to http://www.microsoft.com/sbnmember/apply/apply.asp , click 'upgrade your membership' then enter your ID and password (which is listed below). This will bring up your registration information. Be sure to list the exact URL where the IE logo/link is located as well as the exact URL the ActiveX control is located (if applicable), and we will check your site again. In the meantime, enjoy your Guest Membership, and we will notify you of your membership status within 5 days after you apply for an upgrade. You are displaying the IE logo, but it is not linked to anything, or it is linked incorrectly. ===================================================== If you are displaying the Internet Explorer logo, please return to your site and check the link. When you click the logo, does it send you to http://www.microsoft.com/ie/ ? When you are ready to have your site checked again, please go back to http://www.microsoft.com/sbnmember/apply/apply.asp , click 'upgrade your membership' then enter your ID and password (which are listed below). This will bring up your registration information. Be sure to list the exact URL where the IE logo/link is and we will check your site again. In the meantime, enjoy your Guest Membership, and we will notify you of your membership status within 5 days after you apply for an upgrade. You have an intranet or secured site. ====================================== Please send an .htm page, or your html code as a text file to SBN(a)microsoft.com and we will check your site that way. Be sure to delete any confidential or sensitive information. Please send your ID and password in the email (Both are listed below.) so we can upgrade your membership more quickly. Please note that it could take up to 10 days due to the manual upgrade. You think you have done everything by the book and can't understand why your registration failed. =================================================== Perhaps the connection failed due to your server being down or heavy internet traffic. Or there may be a typographical error in your registered URL's. Please go back to http://www.microsoft.com/sbnmember/apply/apply.asp , click 'upgrade your membership' then enter your ID and password (which are listed below). This will bring up your registration information. Be sure to list the exact URL where the IE logo/link is as well as the exact URL the ActiveX control is located (if applicable), and we will check your site again. In the meantime, enjoy your Guest Membership, and we will notify you of your membership status within 5 days after you apply for an upgrade. You are using neither the IE logo or an ActiveX control, but would like to upgrade your membership. ==================================================== To find out how to qualify for Level 1 and/or Level 2, please go to http://www.microsoft.com/sbnmember/levels/levels.asp. You will find detailed instructions on qualifying your site for Levels 1 and 2. When you are ready to have your sites re-checked, please go back to http://www.microsoft.com/sbnmember/apply/apply.asp , click 'upgrade your membership' and follow the instructions. Once again - welcome to Site Builder Network, and enjoy your Guest Membershipbenefits. The Microsoft Site Builder Network Team ======================================== ID: 643361 Password: writecode ========================================

1 0

Confirmed Usenet Faggots 1.01
by Pittsburgh Admin 17 Dec '03

17 Dec '03

On Wed, 19 Feb 1997, aga wrote: > On Tue, 18 Feb 1997, Dr.Dimitri Vulis KOTM wrote: > > > Date: Tue, 18 Feb 97 00:32:19 EST > > From: "Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> > > Reply-To: freedom-knights(a)jetcafe.org > > To: freedom-knights(a)jetcafe.org > > Subject: Re: Is Thomas Lee Another Homosexual Net-Terrorist? > > > > (Back from WashDC, not Phila) > > > > "Dr. Jai Maharaj" <jai(a)aloha.com> writes: > > > > > One Thomas Lee has been complaining that he has trouble > > > with my posts in certain newsgroups (he will not say which > > > posts in which newsgroups) and has caused one or more > > > others to terrorize my ISP with false, unfounded > > > complaints. When I asked this Lee character directly > > > about this, he answered: > > > > > > Thomas Lee <tfl(a)psp.co.uk> wrote at 04:49 pm on 2/16/97: > > > > > > > > In message <3.0.1.32.19970216062849.007a7860(a)aloha.com>, > > > > "Dr. Jai Maharaj" <jai(a)aloha.com> writes: > > > >> . . . I will attempt to help you understand if you will let me know >> > > > as to which posts in which newsgroup you are referring to. > > > > > > > Sorry Jai - If you don't know which groups you are off topic in, > > > > I'm sure not going to help you. > > > > Please stop mailing me. > > > >-- > > > > Thomas Lee > > > > tfl(a)psp.co.uk > > > > > > Evidently, Lee cannot substantiate his claims -- a behavior > > > typical of many other members of the homosexual Lynch Mob > > > which attempts to terrorize the Net. > > > > I hope he dies from AIDS like Jason Durbin and all other Usenet faggots. > > > > --- > > > > Dr.Dimitri Vulis KOTM > > Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps > > > > Thus we see that what is needed is a permanent list of -confirmed- > Usenet Faggots to be kept up and updated periodically. So when you > update this list, please do it by single digit increments, so that the > next list is "UseNet Faggots 1.02" etc. > > ====================================== > Confirmed Usenet Faggots 1.01 > > Peter Berger > Jason Durbin > J.D Falk > Tim Skirvin > Hardrock Llewellyn > > ====================================== > > note these are *confirmed* Usenet Faggots. > please add any more confirmed faggots that you know about. > > thank you, > aga.admin > UseNet Freedom Council > ufc(a)pgh.org > > post to: > alt.censorship, alt.fan.karl-malden.nose, alt.god.grubor, alt.underground, soc.culture.usa, news.groups, alt.usenet.admin, news.admin.censorship, mail.cypherpunks, alt.webgod, alt.wired, soc.men, news.admin.misc

1 0

Re: [OFF TOPIC]Comments about CFP '97
by Toto 17 Dec '03

17 Dec '03

Lucky Green wrote: > At 08:55 PM 3/25/97 -0800, Timothy C. May wrote: > >At 4:07 PM -0800 3/25/97, Bill Stewart wrote: > > > >>>--Tim May, who was comped into the conference and who only paid for one > >>>night at $130, preferring to drive in from elswhere and use the saved money > >>>for something permanent, a new Stihl chainsaw. > >>Just in case the Assault Rifle and pistols aren't enough? :-) > Stihl chain saws are *the best*. Stihl chainsaws are the choice of serial killers from Texas to Xenix. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: Corrupted "From:" headers in my posts
by Alec 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:27 AM 3/26/97 -0600, Toto wrote: |I emailed John Gilmore, asking his advice, and he informed me that |he has run into this problem before, and would be happy to provide the |solution, on one condition. | | He wants one million monkeys to send 5737 messages to the list, saying |"John Gilmore is NOT a cocksucker." | Then, he will provide the solution, and not a moment before. OK, John, count me in. #1! "John Gilmore is NOT a cocksucker." Alec -----BEGIN PGP SIGNATURE----- Version: 4.5 iQCVAgUBMzkeTSKJGkNBIH7lAQHI3QP8DgE91P6O1jF00rBJkv0h2KiXwBf72sXo xrrwRg36PLnYK0+6se5Ldh3mro4J25a7pNdErOlMCEEnkuLz2HHDApgF+bikzEw4 WvZa/3OlSAd1o54/HbMuHnfmZBfsLiEiYIzGGDVJsqTzjiUdqvYJpH3Caq605qT5 5uN7A3fhACc= =Rh5N -----END PGP SIGNATURE-----

3 2

Re: Anonymous mail as spam?
by Toto 17 Dec '03

17 Dec '03

snow wrote: > > At 10:49 PM -0800 3/25/97, snow wrote: > > > What would I do if I were a spammer? > > > Submit the _same_ coin to every mailing I sent out. It will pass > > >your coin filter, and so you see the message, but will fail when you try > > >to spend it, or clear it. What do I care, you've already seen the message. > > I should always try to clear your coin and if I like your message send you > > a new coin. If I can't clear your coin, then your message goes to > > /dev/null. > > This assumes a system where coins can be cleared in real time, and > that people read thier mail while online. At least the second is not an > assumption that can be bourn out. > > > I hope those public key operations are cheap. :-) > > Or at least less than 10 cents. I believe that the 'money-point' for UCE (unsolicited commercial email) spammers is somewhere around .02% for most of their offerings. In other words, they need to send out 10,000 emails and get a response just to break even. So, to make it unprofitable for them to spam god and everybody, it would only take a small surcharge. i.e. a penny or less. I don't actually object to the average Jane/Joe trying to use the 'new medium' to turn a buck, since I don't think that they should be denied the same opportunity as the mega-buck corporations. However, I would like to see the cost of operations for these types of activities be substantial enough that they will be forced to adopt a method of operations that will ensure that there is least a chance that I will be interested in what they have to offer. As things stand, I could buy some UCE/spamming software and send out my proverbial "How To Make $$$ Licking Your Own Dick" missives and probably make some money, since it would not cost me much to send my messages to a few million people. If it was actually costing me even a small sum to send each message, then I would no longer be able to afford indiscriminate spamming, but would still have the option to use hardwork and intelligence to narrow the field of recipients to only include those who might be interested in my offer, such as Bill Frantz, Jim Bell, and Bill Stewart. I truly believe that the InterNet should be left accessible to those without a lot of resources/cash, and that any effort to control abuse through cost should be so minimal as to not interfere with the ability of those who are currency-challenged to participate in its benefits. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

4 4

Re: New WinSock Remailer Available; Compatible with Win95
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Joey Grasty <jgrasty(a)gate.net> writes: > You can now download the latest version (version ALPHA1.3B) of the > WinSock Remailer from my webpage at: > > http://www.cyberpass.net/~winsock/ ... > The WinSock Remailer is the Windows version of a cypherpunk remailer. > This version, ALPHA1.3B, runs under Windows 3.1 and Windows 95. > A version for Windows NT will be released shortly. ... > I need to know if you have success with any of the following untested > configurations: > > a) Windows NT (now known not to work) What exactly is the problem with NT (if any)? You might want to take a look at the source code to the cancelbot I published last year - it has some winsock calls that work fine under NT. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 2

Re: [Proposal:] Revolving Web Mirrors
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

"Timothy C. May" <tcmay(a)got.net> writes: > At 9:00 AM -0600 3/26/97, William H. Geiger III wrote: > > >>How does this actually provide any benefit to anyone? Search engines ala > >>Altavista etc. are entirely too unreliable and too slow to pick up on > >>these magical mirrors, especially if they are as dynamic as they would > >>appear to be. And if there's a central "come here and get all the > >>mirrors!" page, the Bad Guys can simply block that page too. > ... > >Does Altavista, ...ect accept notification of new URL's and if so what is > >the average lag time between receiving notice and the URL making it into > >the search engine? > > > >The problem that I am trying to address is that a determined State could > >block all static mirrors over a period of time. By making these sites > >dynamic it makes the job much more difficult for them. > > Why not have e-mail notification about mirrors? To whom? > (Like Raph's remailer list, where an e-mail version is sent out in tandem > with the Web site update.) > > Sure, some Big Mommy filtering services will block the Web sites, but they > probably are completely unequipped to try to interfere with e-mail. It's a piece of cake to scan all incoming e-mail and to see who's getting notifications of the new locations of the "banned pages". It doesn't matter if the "authorities" are the local gubmint or a corporation... If the incoming e-mail is encrypted then the authorities can scrutinize all incoming encryped e-mail and ask the recipients what's in it, why it's encrypted, and whether it's solicited or not. If the notofications of the "banned pages" locations are unsolicited, they have good grounds for a complaint to your ISP. If they're solicited... the recipient's in trouble. But if the notifications are a small part of traffic on a large- volume mailing list, like this one, then the recipient can claim that they've subscribed to the mailing list for the other content (like the ASCII art :-). --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: improving public acceptance: "alt" mail domain
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Andy Dustman <andy(a)CCMSD.chem.uga.edu> writes: > FYI, anonymous.net is registered to John Gilmore. SHIT!!! Someone, quick, complain to the InterNIC. Who let the cocksucking NSA shill kidnap a domain name? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: [OFF TOPIC]Comments about CFP '97
by Robert Hettinga 17 Dec '03

17 Dec '03

At 11:55 pm -0500 on 3/25/97, Timothy C. May wrote: > Yes, inasmuch as I already have a Troy-Bilt chipper/shredder for disposal > of the byproducts of home defense. > > (Bought even before I saw "Fargo."] Actually, what you *really* want is one of those 400-lb-flywheel jobs that the tree surgeons use to mulch big tree limbs up with. I worked behind one one summer in college. They are *indeed* impressive. Don't forget to freeze everything before you put it in there, though. Works cleaner and faster. Actually, there was a case a few years where a guy did exactly that with his wife, her deep-frozen and all. Only problem was the cops figured it out after they found out he had rented one of these things shortly before she disappeared. Though they didn't find anything of her after the critters in woods behind his house had their "one *tasty* burger", John Law did break the tree mulcher down and find DNA-confirmed microscopic bits of her in the machine's um, interstices... Remember, return the tools clean folks, or you don't get your deposit back. Reminds me of the headless biker we talked about here a while ago. Whoops! Gotta run. Time for lunch! I *love* this list... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/

2 1

TEMPEST Doc
by John Young 17 Dec '03

17 Dec '03

We've digitized several chapters of the US Army Corps of Engineers "Electromagnetic Pulse (EMP) and TEMPEST Protection for Facilities." http://jya.com/emp.htm Pretty good specs for what to do outside the laboratory to protect against compromising emanations (and rude nukes), many previously discussed here. Reminder: Joel McNamara hosts the non-classified cornucopia: http://www.eskimo.com/~joelm/tempest.html

1 0

Re: KRAP
by Toto 17 Dec '03

17 Dec '03

Jeremey Barrett wrote: > > Key Recovery Agents Plan > I dunno, but they couldn't have picked a better acronym :-) Good eye. I read about it and never noticed their truth-in-advertising acronym. You are hereby awarded 50,000,000 Toto Eca$h credits. (1,000,000,000,000,000,000 = 1 peso) -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

New remailer
by Kevin McGowan 17 Dec '03

17 Dec '03

Features: cpunk pgp pgponly hash cut ksub Public key for remailer(a)neva.org -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzL2F4AAAAEEAL2G5u427j6LBWgUi8S1OlCsnaPhoB6h4V0xS2FQfuIQQS9Q dtTL/p406sdGAKtQEm/BecIgY+MLNKNukuOU9ifgz7jAs3kmm7i4yS714ua4vwag Kg3fJIOiNxIk38ieKJE0s3vfPMZPeGNt8x8y7jfxZuMvuVyjNrYJG4a+gwxNAAUR tBoyTXVsZXMgPHJlbWFpbGVyQG5ldmEub3JnPg== =ta0J -----END PGP PUBLIC KEY BLOCK-----

1 0

WebWorld 17-18
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

No Subject
by TruthMonger 17 Dec '03

17 Dec '03

its deployer. Subject: Re: game theoretic analysis of junk mail Bryce wrote: > If I send a message to cpunks, and it is destined to reach > 1000 mailboxes, do I have to include USD 100.00 with my > message, which will be split by the majordomo into 1000 > 10-cent pieces? Yikes! And then I have to hope that all of > the cypherpunks return my deposit. Sounds like a bad bet. All discussions of eca$h charges for email seem to refer to a figure of $ .10 as a reasonable sum. I suspect that this is due to people subconsciously equating email with snail mail. I think that email, however, is a creature of its own design, and its essence lies somewhere between snail mail and conversation. Think about this: What if, everytime you spoke to someone during the day, you had to pay a dime? How would this change the interpersonal rapport that goes on daily between friends, acquaintances, and strangers? What if you are a polite person, who thanks others regularly? And it costs you a dime every time you do so? What if people rarely reply, "You're welcome." and it ends up costing you an arm and a leg to be polite? This is just a simple conversational example, to illustrate that a small cost can have major ramifications when applied to various situations. The Internet and the Web indeed have the potential to bring global change in the arenas of knowledge and communications, but the question is, will it do so in a manner that promotes equality, or in a manner that promotes elitism and increased class-structures? The concept of limiting UCE/Spam through use of an email surcharge may be viable, but then one has to deal with issues surrounding those who have a need to communicate and few funds to devote towards doing so. For example, people with disabilities who have legitimate needs to receive support and information via support forums. The minute that $$$ enter the picture, then a class-system begins to develop, and all sorts of individual, corporate and government entities come out of the woodwork to level the playing field, or to build many different levels on the playing field. The Internet's future may well parallel the development of the public school system, in some ways. Public education was indeed something which raised the level of all, but private schools made certain that those who had the edge kept it. My view is that the nadir point in any new direction that society takes comes fairly early after its inception. Thus the near future is the time when it will be decided which direction the Net and the Web will move, and in what areas its potential will be developed. Those who shape the Internet and the Web in the next year or so will have a vast effect on the future. TruthMonger

1 0

Re: Corrupted "From:" headers in my posts
by Dale Thorn 17 Dec '03

17 Dec '03

Alec wrote: > At 01:27 AM 3/26/97 -0600, Toto wrote: > |I emailed John Gilmore, asking his advice, and he informed me that > |he has run into this problem before, and would be happy to provide the > |solution, on one condition. > | He wants one million monkeys to send 5737 messages to the list, saying > |"John Gilmore is NOT a cocksucker." > | Then, he will provide the solution, and not a moment before. > OK, John, count me in. #1! > "John Gilmore is NOT a cocksucker." EHHHH! John Gilmore IS a cocksucker. This "yes" vote makes up for 10 "no" votes, so you folks better get real busy.

4 4

UK domestic crypto regulation proposal *is* Clipper
by John Gilmore 17 Dec '03

17 Dec '03

I've seen several comments on cypherpunks that misconstrue the UK proposal. E.g. Phillip Hallam-Baker said: > First off the proposals are not intended as a Trojan horse for > the Clipper chip "or any other colonial scheme". > ... > They are emphatically not trying to introduce a Clipper chip proposal. Unfortunately, I believe he is wrong. It's worse than Clipper, since it outlaws the competition. The proposed legislation would make it illegal to offer the UK public any service related to key management, including simply signing peoples' keys, without being licensed by the state. This licensing scheme includes a GAK requirement, an interoperability requirement, and a whole pile of requirements that may need a little translation. This means that there would only be *one* public-key infrastructure in the UK (they claim this as a feature for end-users, since it provides interoperability -- though they apparently haven't picked *whose* PKI they are going to enshrine as a monopoly). Unfortunately it would be completely subverted by the government. Users would have no choice about whether to use a different infrastructure, say from another country, or by setting it up themselves using PGP, Secure DNS, or whatever. The "trust" they offer is 100% sham, since you yourself don't get to pick who you trust. They do. "It will be necessary to ensure that TTP security personnel are competent, suitably qualified, trusted, & have successfully completed a recognised security vetting procedure." Translation: "Public key certification authorities will need a security clearance." "Checks will need to be undertaken to ensure that the background and other business interests of [TTP company] directors would not compromise the trust placed in a TTP." And later, "Checks will be made to ensure that those who own, or effectively control, an organisation, are suitable candidates for ownership of a TTP." Translation: "We will only license people who we believe will turn over anyone's key on demand. If they show any sign that their customers could actually trust them to keep private keys private, their license will not be approved." It explicitly states: It will be a criminal offence for a body to offer or provide licensable encryption services to the UK public without a valid license. This isn't a requirement on USERS, it's a requirement on OFFERERS. However, what this means for users is that if you want to use digital signatures, you have to use a Traitorous Third Party. It will be illegal for anyone else to offer you a digital signature service. Perhaps you could use encryption without using digital signatures, but you've just lost most of the benefits of public-key cryptography. I believe the proposal outlaws Secure DNS services. Merely signing the keys of sub-domains, for free or for money, would be illegal. You will only be able to secure the Internet if you first subvert the Internet by turning over the keys. And while the government mentions in several places that it isn't interested in access to authentication keys, the proposal still requires that anyone providing authentication services (like signing keys) be a licensed TTP and subject to GAK. John Gilmore

2 1

Re: improving public acce
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In> Adam Back, <aba(a)dcs.ex.ac.uk>, writes: > What we need to do, is to arrange a wide-spread anonymous mail system > on the internet, which is accepted as unchangeable on a practical > basis, where no reply addresses, and no indication of sender is given, > and it accepted as a given that the sender can not be traced. Hmm, could a NYM account maybe serve as entry and exit point for a remailer? That would - - have the advantage, that the remailer, the domain and the operator aren't even known ("Anonymity for anonymous remailers" - my former proposal of usage of "shared account" remailers becomes an actual possibility here) and therefore shut-downs are unlikely. With the exception of the NYM-account, which is trivial to replace. - - make traffic analysis even harder, for alone by the reply block chain an incoming and outgoing message would "disappear" in other traffic, not to mention, that the NYM account remailer (and the attached reply block chain) could be only one adress in an even longer chain of remailers. - - encrypt even plain-text messages at least on their way through the reply block chain conventionally, thereby adding to resistance to traffic analysis. - - even out the message load of the available remailers by using preferrably the remailers with only little traffic for the reply block chain, yet again helping against traffic analysis of the general remailer network. Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! --> http://www.eff.org */ /* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ ___ Blue Wave/386 v2.30 [NR] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMzoCVTltEBIEF0MBAQEWPwf/VnssE40IAI0IbHsuzMpYcEg2NaivLXTL teqLYujZJEZPOKh+N+/uZrsPx1qyzppLXtPHLfbG7H4YGsZLX/nDcesRfwHMC5z5 R8SE90VEKkTRIWGE5OsXaeJaNWhb+GBJzzRosGlgLv6YT5lTuMO5jfuNxdmbcprh M2W6RPRljNpg2SRlq/Y1Ci8dOAJFigQUoiZju0+ZrmnZUCddE0Ot5zDA/su8yKX2 5/Ul4/1ccZeBJNbZbZF/c4zEDshZcWqwD+5vAdg9yIhyixMPsJb184+SKLl/Nwrb nAkDIn7QBWJiRJnW2ZYl2KmuKmjPGhZ2FSvCuAjYD5K3eCvuh9wO9A== =uiY3 -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

Re: remailer spam throttle
by Hal Finney 17 Dec '03

17 Dec '03

dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) writes: > With the present scheme, if a remailer is "raided", it has precious little > interesting stuff on it at any one time. Now consider the scenario: > > X sends 1000 copies of child porn/seditious libel to 100 people believed not > to be using remailers right now. The remailer keeps the 100 e-mails onits > hard disk and e-mails each receipient a ping, inviting them to agree to the > disclaimer terms and to retrieve their anonymous e-mail. The first recipient > to retrieve the e-mail gets upset and contacts the feds. The feds figure, the > remailer still has the 99 other e-mails and the information on who's supposed > to receive them in its queue; why not seize it and take a look. This is a potential problem, but there are some other considerations. First, there is no particular reason why one recipient of some email from the remailer should know or even suspect that other people have the same email waiting. Then, to defend against raids like this, the material could be separately encrypted to each recipient. There would be no way to know that material sent to one recipient matched material sent to someone else. The raiders would just find a bunch of encrypted files. Of course, if it were a sting operation, with the recipients being lured or entrapped into requesting information they shouldn't, then the sender might avoid using these countermeasures. However, there wouldn't really be any need to use a remailer for a sting operation like this, it could be done just by offering the material from an ordinary address. More generally, I think we need to keep in mind what a remailer does and what it doesn't do. The essential function of the remailer is to provide anonymity via mixing messages. It does not provide confidentiality of message contents. That has to be taken care of by encryption. And, as I wrote yesterday, it doesn't (can't) keep secret who the people are who send and receive anonymous mail. All it can do is to disguise which particular people send and receive to each other. The same is true of a DC-net or a perfect Chaumian mixnet. These systems do not disguise their particpants, or protect the confidentiality of their message contents; they only hide the knowledge of who is talking to whom. Having said that, I do like some aspects of this idea: > There's a big distributed database of pgp keys on the several keyservers. > Add a bit to the database specifying whether the key owner wants to receive > anonymous e-mail. By default set it to true for the existing addresses. (The "default true" is going to allow the same kinds of abuse which we have seen in the past. Some remailers may be able to tolerate this, but as we have seen, many can't.) > When the final remailer in the chain wants to send someone an anonymous > message, it attempts to retrieve a key from the keyservers. > > If it fails to find a key, it junks the mail (you don't want to keep it > around, it's baiting the LEAs!) and instead sends a notification to the > recipient that some anon e-mail was addressed to it, but it was junked; > and if they want to receive anon e-mail, they need to give a pgp key > to one of the key servers this remailer uses. This is what I like. It's a lot simpler than trying to keep a copy of the anonymous mail and deliver it later when the person asks for it. Just let him know that someone is trying to reach him anonymously, and let him enable that if he wants to be able to receive the next anonymous message that comes in for him. You can load his permission message down with all kinds of disclaimers that say he knows he's likely to receive obscene, threatening and illegal material, that he doesn't mind, that he knows the remailer is an automated system which doesn't look at the contents, etc. Not only does this give you a defense but it makes the person think about what he's getting into, so he will in fact be better prepared when something bad comes his way. Plus, having taken positive action to enable receiving anonymous mail, he will hopefully be more knowledgable about how to request that you stop, and it won't be such a big deal. He opens the pipe, and if he gets a face full of sewage, he closes up the pipe right away. You warned him. > If it finds a key, it looks at the anon mail bit; if it's on, it encrypts > the e-mail with the recipient's key and sends it; otherwise it junks it. > > Obviously, the key servers would need to be modified to allow users to > specify whether they want anon e-mail when then store their keys, and > to change this setting any time. Key servers wouldn't be the only place to store this information. I think the remailer could keep its own list, especially if it were defaulting to "off". This way recipients wouldn't have to generate and submit PGP keys, which is more work than just sending a reply to a remailer giving the OK to receive anonymous mail. > Right now, there's a very large number of addresses in the key servers. > Instantly making them into a list of addresses that accept anon mail > will make it hard (hopefully infeasible) for the LEAs to investigate > everyone willing to accept anon e-mail as a suspect in sending it. More cautious or politically vulnerable remailers might default in the other direction. It would be a matter of the individual situation. Hal

2 1

Re: PKC
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Warning: if you fuck Tim Maya in the ass, a rabid tapeworm might bite your penis. /\ _ /\ | | 0 0 |-------\== \==@==/\ ____\ | \_-_/ _|| _||

2 1

Re: remailer spam throttle
by Bill Stewart 17 Dec '03

17 Dec '03

>From a legal perspective, Greg is right. However, from a practical perspective, the important impediments to running remailers are (1) mail recipients hate you and send lots of complaints and (1a) usenet readers hate you and send lots of complaints (if you still support news posting.) Andy's model of a remailer in which the remailer sends the recipient a delivery notice with a disclaimer/waiver/etc. and the recipient returns it to pick up the message raises the level of politeness and lowers the amount of surprise compared to current remailers, so it's a potentially big win. If I start up a remailer again some year, other than a middleman, it'll definitely need this kind of feature. Building the positive public reputation of remailers and remailer operators is a critical part of keeping the remailer system running, at least as much as convenient, widely-deployed software. For posting to Usenet, the "we have an anonymous posting, anybody want it" approach doesn't sound highly practical, though it could be done, but I'd probably limit postings to moderated newsgroups (where a human will be filtering out the blatant spam and abuse) and flame-tolerant newsgroups like alt.anonymous.messages and alt.flames. I find this highly frustrating, since one of the big wins about remailers is posting to talk.politics.* and alt.religion.scientology and other groups where posting your opinion with your name on it may be unsafe. There's also the problem of publishing acceptable newsgroup lists, since failing messages silently is unfriendly to users, but there's a traffic analysis problem (Bad Guys can watch who fetches remailer use policies and build up their dossiers.) Most of the problem with (2) Third Parties _can_ be helped a bit by disclaimers, by plausible deniability, by not having logs to subpoena, and by having remailers that you're willing to shut down with profuse apologies to head off lawsuits. It isn't a perfect job if someone really wants to go for blood by making you defend repeated lawsuits (especially if they're really targeting you, e.g. posting their Secret Documents through your remailer themselves to entrap you.) But it'll let most remailer users defend against most reasonable complaints. I do also agree with Greg that getting the sender of a message to indemnify you isn't worth the recycled electrons used for the log file you aren't keeping. That's especially the case if you're forwarding messages received from other remailers, unless you can get other remailer operators to indemnify you, in return for which you'd probably have to indemnify them. No thanks. At 01:58 AM 3/25/97 -0800, Greg Broiles wrote: >I think there are two broad models of complaints/problems with remailers: >1. The recipient is angry because they received a message they didn't >like. (because it's an advertisement, or it's rude, or [....] >2. A third party is angry because the sender sent some information to the >recipient which the third party thinks should not have been sent. >(copyright, >trademark, defamation, tortious interference [...] >Your "contract" model (which looks like you really mean it to be a >waiver of warranty/damages and/or an indemnification agreement) >addresses (1) to the point of overkill, but it doesn't reach (2), >because there's no contract with the third party, who is the party who's >likely to be filing suit. >(Indemnification by the sender might work, if you worded the contract >correctly - but then you've got to abandon anonymity, and the value of >indemnification from person you don't know whose assets/finances are >unknown is pretty low.) > >Further, some fraction of the messages causing concern are message sent >or available to minors .. whose contracts (modulo some exceptions) are >voidable at their option. :( >>..[disclaimers].. >[doesn't help 2 for same reason] # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1