December 2003 - cypherpunks-legacy

Re: Recommendation: Creation of "alt.cypherpunks"
by Timothy C. May 17 Dec '03

17 Dec '03

At 5:49 PM -0600 2/12/97, Firebeard wrote: >>>>>> Timothy C May writes: > >TCM> Since posting my comments I've just seen the proposal that tivoli >TCM> may host a list. > > Whoa, Nellie! Who made that proposal? It certainly wasn't >me! I said that I was taking steps to set up a majordomo to host a >cypherpunks list. Topmost on those steps is creation of the sten.net >or sten.org domain, and getting a personal, >paid-for-out-of-my-own-pocket, ISDN connection. The majordomo will >run off of my personal computer sitting in my apartment, not on Tivoli >hardware sitting in the support lab. As I said, John forced my hand >in his announcement, causing me to 'put up' before everything was in >place, including the domain registration. Yes, my mail comes from >sten.tivoli.com. That doesn't mean that everything I do in life is >connected to Tivoli, IBM, etc. Sorry, I was just going by what I saw in your e-mail address. My point was not really about Tivoli, or IBM, or any other particular company, though. I was making the point that _any_ site distributing a list is likely to face legal pressures not to carry certain items. Read between the lines (or read the unedited list) the discussion by John Gilmore, Sandy Sandfort, and the products of Sandy's company, and legal pressures applied, to see what I mean. --Tim May Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: anonymity and e-cash
by Tim May 17 Dec '03

17 Dec '03

(A copy of this message has also been posted to the following newsgroups: alt.cypherpunks, talk.politics.crypto,sci.crypt) At 1:19 PM -0800 2/12/97, Lee Tien wrote (on the Cypherpunks(a)toad.com list): >The NSA's research report on e-cash says: > > "The ideal situation (from the point of view of privacy advocates) >is that neither payer nor payee should know the identity of the other. This >makes remote transactions using electronic cash totally anonymous: no one >knows where Alice spends her money and who pays her. > > "It turns out that this is too much to ask: there is no way in such >a scenario for the consumer to obtain a signed receipt. Thus we are forced >to settle for payer anonymity." > >Keeping in mind I am only a lawyer, my skim of Schneier (2d ed.) didn't >illuminate. The discussion of digital cash seemed to assume no payee >anonymity. But the immediate previous section of dining cryptographers >involved (it seemed) recipient untraceability. > >Is payee anonymity technically possible? Under what conditions? > >If so, is the issue social, e.g., as NSA notes, the lack of a signed receipt? You missed a very good talk by Ian Goldberg of UC Berkeley at the Saturday Cypherpunks meeting at Stanford, where Ian talked for more than an hour on just this issue. (He also talked for an hour on his crack of the RSA challenge using 250 workstations...this was also a good talk.) It was explicitly stated in Chaum's 1985 paper that methods existed to ensure full untraceability. Chaum has in recent years emphasized a more "surveillance friendly" system in which some of the anonymity is lost. It was the intuition of some of us that "coin changers" could solve this problem, e.g, by having intermediaries to "mix" the coins and thus break the traceability chain. Lucky Green wrote some articles along these lines, and maybe Hal Finney, too. This was a couple of years ago. The notion is similar to what Ian showed, but our arguments were not formal and robust. In August of '95, Doug Barnes released a long article on "Identity Agnostic" systems. (His article is no longer at the www.communities.com Web site, so I can't refer you to it. Maybe he'll post it again.) About a year ago Ian Goldberg considered this issue and came up with a solution which has seemingly reproduced what Chaum was thinking about (but, apparently, did not make completely clear in his papers, for whatever reasons). Ian deals with the issue of "making change" and comes up with a system in which intermediaries, which we may call "e-cashiers" and "moneychangers," can take on the role of the mint/bank. By making "negative deposits" (submitting signed withdrawal slips, effectively), these intermediaries function as moneychangers. And so the one-way anonymous features become two-way (effectively, each of the transactions contributes a "one-way anonymous" component: one-way + one-way = two-way). It is much easier to understand digital cash with the usual diagram showing the usual triangle of CUSTOMER-MERCHANT-MINT and then analyzing the flow of information, who knows what, etc. Drawing such diagrams in e-mail is beyond my patience. This system used online clearing, of course. This "disintermediates" the process, and makes for an "everyone a mint" situation, which has some of the same nice properties that an "everyone a remailer" ecology of remailers and users has. And the principle can be extended further back, to where the usual distinctions between CUSTOMER and MERCHANT vanish (as it sort of does in the real world, where the two parties are merely exchanging one item for another item), and where the role of the MINT is minimal. In fact, Ian showed, the Chaum patents on blinding are NOT USED by the Mint/Bank; only the CUSTOMER uses the blinding patents (and the MERCHANT in some cases, not in other cases). This means that "anyone a mint" does not violate any of the Chaum/Digicash patents, and "mint clients" are likely to be written by third parties. (The _customer_ is presumably on the honor system to abide by the Chaum patents...except the patents are only being licensed to banks...go figure.) (This is where, as I recall, Doug's "agnostic" system came in...it is possible his thinking was similar to Ian's...I don't have Doug's paper handy.) Ian demonstrated this on an actual system, with real live connections to mints in various countries, but with the blinding not used (as I recall). Draw your own conclusions about what this means. It was heady stuff, seeing the result many of us believed to be implicit in Chaum's 1985 paper made real. Everyone a mint. This makes the spread of fully anonymous digital cash harder to stop. Issues of the mint denying one has an account are always real ones, but not important--I think--in the real world. The untraceability of the digital coins means that a mint never knows who is testing it for reliability and "honesty," and the mint cannot set out to "screw" a particular customer by declaring his account not to exist (as the mint almost certainly does not have to know who own which accounts, as deposits can be made anonymously). I hope this helps. I plan to use this result centrally in my talk at the panel discussion on "Governmental and Social Implications of Digital Cash" at the upcoming CFP. --Tim May -- Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: alt.cypherpunks created
by Timothy C. May 17 Dec '03

17 Dec '03

At 3:06 PM -0800 2/12/97, Greg Broiles wrote: >According to DejaNews, Mike Duvos has also issued a newgroup for >alt.cypherpunks: I've already posted two articles to it. I expect it to be the main place I post my words, as it eliminates any possibility that some site admin will "moderate" my essays. (And few of my articles in the last several days have made it to the Main list. They were not flames, but apparently failed Sandy's test of relevance.) --Tim May Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Cypherpunks Distributed Remailer (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 12 Feb 1997 18:47 EDT > From: "E. Allen Smith" <EALLENSMITH(a)ocelot.rutgers.edu> > Subject: Re: Cypherpunks Distributed Remailer (fwd) > > Someone with more experience correct me if I'm wrong (I'm just > starting to learn about mailing list management), but isn't saving > at least the first bounce from a given address good in order to check > what address is the one that's actually bouncing? Admittedly, this only > applies to badly-formed bounces. The rest can just have the address > noted. Hmmm, I can see saving the address causing the bounce in some sort of array that is indexed to the majordomo subscription list for a given remailer. It would not cost anything but overhead to save the entire message. I guess my motivation was not that I cared their mailbox was full or it was a invalid address but that I wouldn't be able to deliver at this time. I just don't see any reason that it helps me to know why they can't receive mail only that they can't. > >Want to volunteer? > > Give me some idea of how much programming knowledge, time, etcetera > is required, please, before I can answer. I'd be renting space on some other > computer (e.g., an account on cyberpass.net) to do it in; the only higher-level > programming language (i.e., beyond Applesoft Basic) that I know anything of > is Perl (and I don't know that all that well); and I am somewhat busy with > other stuff. In other words, it depends. Hmmm, not shure how much programming it would take - never done it myself. I think Perl would be an acceptable language. I certainly hope to do the majority of the scripts on the CDR in Perl myself. Perhaps there is somebody who knows the fine points of how INN cache's messages. Redbeard and I had a short discussion about this issue today relating to tracking messages to reduce mail-loops. I will discuss it with him and see what happens. I know exactly what you mean. I have two full-time jobs and hadn't really thought of taking on the cpunks list in any manner. But hey, that is the spice in life... Give me a couple of days to look at the situation and if somebody don't beat me to it I'll post what I find out. Cool? Jim Choate CyberTects ravage(a)ssz.com

1 0

Re: Network of majordomos
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> What was your chater? Could you Cc a copy to the list? I didn`t save it but it was something along the lines of this: Charter: alt.cypherpunks will serve as a discussion forum for the members of the cypherpunks community. The discussion group previously resided on a mailing list run at toad.com but due to a difference of opinion between the majority of active members of the list and the owner of toad.com, John Gilmore, the list must now relocate onto usenet as a temporary measure while further measures are put in place to re-establish a mailing list format. The group has approximately 1500 members and has been active online for some 5 years. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Recommendation: Creation of "alt.cypherpunks" (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 12 Feb 1997 16:22:28 -0800 > From: "Timothy C. May" <tcmay(a)got.net> > Subject: Re: Recommendation: Creation of "alt.cypherpunks" > I was making the point that _any_ site distributing a list is likely to > face legal pressures not to carry certain items. Read between the lines (or > read the unedited list) the discussion by John Gilmore, Sandy Sandfort, and > the products of Sandy's company, and legal pressures applied, to see what I > mean. This is exactly the reason that my suggestion to anyone setting up a remailer with any sort of controversial content should do it as some sort of outreach of their business. It is too expensive in time, money, and hassles to do for grins and giggles. Jim Choate CyberTects ravage(a)ssz.com

2 1

Re: Network of majordomos (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 13 Feb 1997 00:04:44 +0000 > From: paul(a)fatmans.demon.co.uk > Subject: Re: Network of majordomos > Charter: > > alt.cypherpunks will serve as a discussion forum for the members of > the cypherpunks community. The discussion group previously resided on > a mailing list run at toad.com but due to a difference of opinion > between the majority of active members of the list and the owner of > toad.com, John Gilmore, the list must now relocate onto usenet as a > temporary measure while further measures are put in place to > re-establish a mailing list format. The group has approximately 1500 > members and has been active online for some 5 years. I would like to see that 'temporary measure' changed to one means of distribution and a resource in addition to the remailer chain. I would really like to see this stay in place. Jim Choate CyberTects ravage(a)ssz.com

1 0

Re: anonymity and e-cash
by Hal Finney 17 Dec '03

17 Dec '03

From: tcmay(a)got.net (Tim May) > You missed a very good talk by Ian Goldberg of UC Berkeley at the Saturday > Cypherpunks meeting at Stanford, where Ian talked for more than an hour on > just this issue. (He also talked for an hour on his crack of the RSA > challenge using 250 workstations...this was also a good talk.) I wish I could have heard that, it sounds good... A simple idea we have discussed for full anonymity uses the idea of exchanging coins at the bank. You make an anonymous connection to the bank, supply some ecash you have received along with some blinded new ecash. The bank verifies that the ecash is good and signs your blinded ecash, sending it back to you. You unblind it and have good, fresh smelling ecash which you can keep, spend, or later deposit in your account. If the merchant performs this exchange operation on-line as soon as he receives ecash, then his anonynmity is protected. The customer is protected too, by the blinding he used when he withdrew the ecash earlier. So both sides remain anonymous. It sounds like Ian may have worked out details of a system where third parties do these exchanges. Banks may be reluctant to allow them for liability reasons, and the market, abhoring the vacuum, will supply intermediaries who perform exchanges for a fee. Resolving the various forms of cheating is the hard part. When Lee asks about a signed receipt, it is hard to understand what is the point if the seller is fully anonymous! A signed receipt from a freshly-minted key is not of much use to anyone. If the participants are using persistant pseudonyms then whatever reputation capital they have can be put on the line when cheating happens, although it still may be hard to tell who cheated whom. Did the customer pass bad cash and claim it was good, or did the merchant deposit good cash and claim it was bad? The same thing could happen every day at the supermarket, of course. A customer insists they paid $20 but got change for a $10. If dozens of customers say the same thing has happened to them, we start to mistrust the market, while if several businesses say this particular customer has made the same claim to them, we blame the customer. Hal

1 0

Shameless FC97 Plug: (Was Re: anonymity and e-cash)
by Robert Hettinga 17 Dec '03

17 Dec '03

At 7:08 pm -0500 2/12/97, Tim May wrote: >This "disintermediates" the process, and makes for an "everyone a mint" >situation, which has some of the same nice properties that an "everyone a >remailer" ecology of remailers and users has. And, of course, Ian's going to teach all this fun stuff in Anguilla next week. ;-). E-mail me, and I'll refresh your memory with a workshop program, or just click on the FC97 URL in my .sig, below. We have lots of room. Just don't take American, though American Eagle's okay... Shamelessly yours, P. T. Hettinga Promotional Chairman, FC97 Workshop, Conference, and Exhibition ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Speaker needed
by Tobin Fricke 17 Dec '03

17 Dec '03

If anyone is going to be in south Orange County, California during the third week in March, and is interested in speaking to a group of high school students on Cryptography and the political and economic considerations involved, please contact me via email at tobin(a)mail.edm.net. Thank you. (I'm not on cypherpunks, so don't email the list.) Tobin

1 0

Coalition Letter on Privacy and Airline Security
by Dave Banisar 17 Dec '03

17 Dec '03

A HTML version of this is available at http://www.epic.org/privacy/faa/airline_security_letter.html February 11, 1997 Vice President Albert Gore, Jr. The White House 1600 Pennsylvanpia Ave, NW Washington, DC 20500 Dear Mr. Vice President, We are writing to you to express our views on the serious civil liberties issues raised by recent government activities in the name of airline security. These include recent orders issued by the Federal Aviation Administration, and also proposals recommended by the White House Commission on Aviation Safety and Security and the FAA Advisory Aviation Security Advisory Committee. Many of these proposals were developed in the highly-charged atmosphere following the still-unsolved crash of TWA Flight 800 and reflect a misguided rationale that something had to be done, no matter how marginal in value or violative of individual rights. We all feel strongly that air travel must be safe - nobody wants to feel that to set foot on an airplane or an airport is to take a substantial safety risk. However, basic civil liberties protected by the Constitution should not be sacrificed in the name of improving air safety, especially where the potential benefits are questionable. At the airport ticket counter, passengers check their luggage, not their constitutional rights. Identification One area of concern is a secret FAA order issued in August 1995 and apparently revised in October 1995. The FAA order purportedly requires airlines to demand government-issued photo identification from all passengers before they can board an airplane. It remains unclear whether a passenger must provide that identification and what discretion an airline has to allow, or refuse, any passenger to board if they refuse to provide identification or simply do not have any available. Americans are not required to carry government-issued identification documents. Any requirement that passengers show identification raises substantial constitutional questions about violations of the rights to privacy, travel, and due process of law. The Supreme Court has consistently struck down laws that interfere with the constitutional right to travel. The Court has also overturned laws in a variety of circumstances that require an individual to provide identification in the absence of any specific suspicion that a crime has been committed. In addition, it is unclear that requiring passenger boarding an aircraft to identify him or herself actually makes the people with whom they travel any safer. A bomber with a fake ID is just as effective as a bomber with no ID. We urge the FAA to withdraw its directive and to notify airlines that identification should not be requested for security reasons. At a minimum, the FAA should require airlines to post notices telling passengers that they cannot be denied boarding just because they fail or refuse to identify themselves. Computer Databases and Profiling Another major concern involves the proposed increased utilization of the practice of "profiling" passengers to determine whether they pose a security risk and should thus be searched. This would require the collection of personal information on passengers prior to their boarding a plane. Information that may be collected includes a picture or other biometric identifier, address, flying patterns with a particular airline, bill paying at a particular address, criminal records, and other information. This, and information gleaned from observing the persons with whom the passenger was traveling, would be fed into a computer data base that would be used to decide whether the passenger "fits the profile" and should be subjected to heightened security measures. Under this proposal, the checked luggage of people selected by the computer would be scanned by new sophisticated scanning devices. The risks to privacy are enormous and run not only to those who "fit the profile." For this system to be useful, it must apply to every person who might take a flight, i.e., to everybody. A new government dossier on everyone would have to be created, computerized, and made accessible to airline personnel. In addition, for the system to be useful, it would have to be linked to other data bases and constantly updated. Each time a person changes their address or takes another flight, or does anything related to the characteristics about them deemed significant by the profiling system, the government would track it. All of our experience with the creation and updating of such ever-changing data bases teaches us that the likelihood of inaccuracy at any given moment is high. The FBI, for instance, recognizes that data in its computer system of criminal records has an inaccuracy rate of 33 percent. Such inaccuracy would lead to both a breach of safety and to violations of the rights of innocent people. This proposal is a quick fix that won't fix anything. The proposal also violates a central principle of the Code of Fair Information Practices and the Privacy Act (5 U.S.C § 552a): information given to the government for one purpose ought not be used for other purposes without the consent of the person to whom it pertains. The use of criminal records in such a data base, particularly where those records include arrests that do not result in convictions, is particularly troubling. Profiling also frequently leads to discriminatory practices. Already, we have received numerous reports of discrimination against individuals and families with children who have been refused entry onto aircraft because their names appeared to be of Middle-Eastern origin. In the well publicized example of security guard Richard Jewel, reports indicated that the FBI profile led the police to unfairly target Mr. Jewel for the incident, even in the absence of other evidence. This incident vividly shows the limitations of basing a law enforcement decision on a profile. We urge the FAA and airlines to discontinue the use of passenger profiling. X-Ray Cameras We also view with concern proposals to install in airports new cameras which can depict highly detailed images of individuals' bodies under their clothes. Existing scanners, the development of which was partially funded by the FAA, already show a revealing and invasive picture of a naked body in high detail and the technology is likely to improve. This is clearly a search under the Fourth Amendment and is far more intrusive than a standard metal screening device. Passengers should not be subject to an "electronic strip search" in order to board an aircraft. To expose travelers' anatomies to the general public or even to selected (not by the victim of the unreasonably intrusive search) strangers is extremely embarrassing and shocking to the conscience. We urge the FAA to reject proposals to use body scanners capable of projecting an image of a person's naked body. Secrecy Much of the key decision-making surrounding these proposals has been shrouded by secrecy. The FAA has claimed that it is exempt from open government laws and has refused to release its directives on profiling and identification. Relevant meetings have been closed to the public or limited to participants who can afford to pay expensive fees. We urge the FAA to publish its directives and open all further decision making open to public scrutiny. Conclusion In conclusion, we believe that these proposals raise grave constitutional issues and are likely to produce only minimally beneficial results to improve airline safety. We urge the FAA and the advisory commissions to focus their efforts on improving security in a balanced and rational manner that is open to public scrutiny and consistent with constitutional rights. Sincerely, Houeida Saad American-Arab Anti-Discrimination Committee Greg Nojeim American Civil Liberties Union Maher Hanania American Federation of Palestine James Lucier, Jr., Director of Economic Research Americans for Tax Reform Aki Namioka, President Computer Professionals for Social Responsibility Lori Fena, Executive Director Electronic Frontier Foundation David Banisar, Staff Counsel Electronic Privacy Information Center Ned Stone Friends Committee on National Legislation Judy Clarke, President National Association of Criminal Defense Lawyers Kit Gage, Washington Representative National Committee Against Repressive Legislation Audrie Krause, Executive Director NetAction Sharisa Alkhateeb North American Council of Muslim Womem Simon Davies, Director General Privacy International Robert Ellis Smith, Publisher Privacy Journal Evan Hendricks, Chairman US Privacy Council and Publisher, The Privacy Times Enver Masud Executive Director The Wisdom Fund John Gilmore Civil Libertarian and co-founder, The Electronic Frontier Foundation ------- David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * HTTP://www.epic.org Washington, DC 20003 * PGP Key http://www.epic.org/staff/banisar/key.html

1 0

Re: List! No Way: Creati
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:23 PM 2/11/97 -0500, harka(a)nycmetro.com wrote: >Were it possible to use Perry's PGPDomo, which would effectively >keep out at least the Spammers? That'll keep out the outside spammers; it won't keep out anybody trying to attack the list (if people can do that with remailers, they can figure out how to do it with PGP...) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: anonymity and e-cash
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 12 Feb 1997 janke(a)unixg.ubc.ca wrote: > It's not too hard: The payee forwards a blinded, non-signed coin > to the payer. The payer has the bank sign this, and then returns > it to the payee who strips out the blinding factor. This is correct except for the fact that the payer also has to apply a blinding factor to the coin, thus making it a "double-blinded" coin. It gets signed by the bank, the payer divides the coin by the blinding factor and sends it to the payee, who then strips out his blinding factor. Ecash coins can also be laundered making the above scheme mostly unnecessary. Since most people will probably not look upon fully anonymous ecash highly, laundering will be a more popular option as it cannot be prevented. Mark -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMwJkjyzIPc7jvyFpAQFHcwgAm2TZXg3wVDCtXyHBdq7WX44iA+nIvmHJ GlcXCjyKBEmvRPfkvU/NUnS1cRfjsPh5ZmjNwjBc21lwxjcOLFtu+3Mcd6tNoyYQ 4Abp4lvJLnpGAtAVeSeTAw+7mzwrC0jfWgt2meNbnyp2WxLxg/JA7VGGkS39g4Jm +i3F8H00mFJfmZUGpAiywE7GNobCXeppPJOn/QHA4/FrWJx5hE39qgB7U+AFwYVP PHGy4SSSBeKWciK83DU3Bz6ptygznL7fHW4vOZ8UM5QZjbyiDomVriSuJHw0lKdH r63BhOqYPXgMHgsa28XTlI9AWN5PpaIbvORTHOWv40EF3nGVrWGnMw== =Vpit -----END PGP SIGNATURE-----

1 0

Re: anonymity and e-cash
by Hal Finney 17 Dec '03

17 Dec '03

From: tcmay(a)got.net (Tim May) > You missed a very good talk by Ian Goldberg of UC Berkeley at the Saturday > Cypherpunks meeting at Stanford, where Ian talked for more than an hour on > just this issue. (He also talked for an hour on his crack of the RSA > challenge using 250 workstations...this was also a good talk.) I wish I could have heard that, it sounds good... A simple idea we have discussed for full anonymity uses the idea of exchanging coins at the bank. You make an anonymous connection to the bank, supply some ecash you have received along with some blinded new ecash. The bank verifies that the ecash is good and signs your blinded ecash, sending it back to you. You unblind it and have good, fresh smelling ecash which you can keep, spend, or later deposit in your account. If the merchant performs this exchange operation on-line as soon as he receives ecash, then his anonynmity is protected. The customer is protected too, by the blinding he used when he withdrew the ecash earlier. So both sides remain anonymous. It sounds like Ian may have worked out details of a system where third parties do these exchanges. Banks may be reluctant to allow them for liability reasons, and the market, abhoring the vacuum, will supply intermediaries who perform exchanges for a fee. Resolving the various forms of cheating is the hard part. When Lee asks about a signed receipt, it is hard to understand what is the point if the seller is fully anonymous! A signed receipt from a freshly-minted key is not of much use to anyone. If the participants are using persistant pseudonyms then whatever reputation capital they have can be put on the line when cheating happens, although it still may be hard to tell who cheated whom. Did the customer pass bad cash and claim it was good, or did the merchant deposit good cash and claim it was bad? The same thing could happen every day at the supermarket, of course. A customer insists they paid $20 but got change for a $10. If dozens of customers say the same thing has happened to them, we start to mistrust the market, while if several businesses say this particular customer has made the same claim to them, we blame the customer. Hal

2 1

Re: Recommendation: Creation of "alt.cypherpunks" (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 12 Feb 1997 16:22:28 -0800 > From: "Timothy C. May" <tcmay(a)got.net> > Subject: Re: Recommendation: Creation of "alt.cypherpunks" > I was making the point that _any_ site distributing a list is likely to > face legal pressures not to carry certain items. Read between the lines (or > read the unedited list) the discussion by John Gilmore, Sandy Sandfort, and > the products of Sandy's company, and legal pressures applied, to see what I > mean. This is exactly the reason that my suggestion to anyone setting up a remailer with any sort of controversial content should do it as some sort of outreach of their business. It is too expensive in time, money, and hassles to do for grins and giggles. Jim Choate CyberTects ravage(a)ssz.com

1 0

Re: Cypherpunks Distributed Remailer
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:03 PM 2/11/97 -0600, Jim Choate <ravage(a)einstein.ssz.com> wrote: >What is the current future of the Cypherpunks webpage? Will it continue to >be kept up or is it going down as well? If you mean the one on soda.berkeley.edu, the last I checked nobody had updated it in a year or more, but it was still ticking. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Cypherpunks Distributed Remailer (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 12 Feb 1997 18:47 EDT > From: "E. Allen Smith" <EALLENSMITH(a)ocelot.rutgers.edu> > Subject: Re: Cypherpunks Distributed Remailer (fwd) > > Someone with more experience correct me if I'm wrong (I'm just > starting to learn about mailing list management), but isn't saving > at least the first bounce from a given address good in order to check > what address is the one that's actually bouncing? Admittedly, this only > applies to badly-formed bounces. The rest can just have the address > noted. Hmmm, I can see saving the address causing the bounce in some sort of array that is indexed to the majordomo subscription list for a given remailer. It would not cost anything but overhead to save the entire message. I guess my motivation was not that I cared their mailbox was full or it was a invalid address but that I wouldn't be able to deliver at this time. I just don't see any reason that it helps me to know why they can't receive mail only that they can't. > >Want to volunteer? > > Give me some idea of how much programming knowledge, time, etcetera > is required, please, before I can answer. I'd be renting space on some other > computer (e.g., an account on cyberpass.net) to do it in; the only higher-level > programming language (i.e., beyond Applesoft Basic) that I know anything of > is Perl (and I don't know that all that well); and I am somewhat busy with > other stuff. In other words, it depends. Hmmm, not shure how much programming it would take - never done it myself. I think Perl would be an acceptable language. I certainly hope to do the majority of the scripts on the CDR in Perl myself. Perhaps there is somebody who knows the fine points of how INN cache's messages. Redbeard and I had a short discussion about this issue today relating to tracking messages to reduce mail-loops. I will discuss it with him and see what happens. I know exactly what you mean. I have two full-time jobs and hadn't really thought of taking on the cpunks list in any manner. But hey, that is the spice in life... Give me a couple of days to look at the situation and if somebody don't beat me to it I'll post what I find out. Cool? Jim Choate CyberTects ravage(a)ssz.com

1 0

Re: Network of majordomos (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 13 Feb 1997 00:04:44 +0000 > From: paul(a)fatmans.demon.co.uk > Subject: Re: Network of majordomos > Charter: > > alt.cypherpunks will serve as a discussion forum for the members of > the cypherpunks community. The discussion group previously resided on > a mailing list run at toad.com but due to a difference of opinion > between the majority of active members of the list and the owner of > toad.com, John Gilmore, the list must now relocate onto usenet as a > temporary measure while further measures are put in place to > re-establish a mailing list format. The group has approximately 1500 > members and has been active online for some 5 years. I would like to see that 'temporary measure' changed to one means of distribution and a resource in addition to the remailer chain. I would really like to see this stay in place. Jim Choate CyberTects ravage(a)ssz.com

1 0

Re: NSA Rainbow Series.
by Tobin Fricke 17 Dec '03

17 Dec '03

> 1-800-688-6115 press 0 or just wait for the operator. My second > order consisting of posters and video has not arrived either. It has been > about 6 weeks. The Rainbow order was only 2 weeks. Be prepared that when > you order the Rainbow series you will be getting a large box.Their are > something like 30+ booklets in the series. > There is a set of security posters that include a Santa > poster.And there is also a video with two films on it (Acess Ins and outs > adb Acess Control). How much does all this stuff from the NSA cost? Tobin Fricke (please reply privately, tobin(a)mail.edm.net)

1 0

Transmission of Crypto material and ITAR
by Benjamin Grosman 17 Dec '03

17 Dec '03

Dear All, I have a question regarding the impossible enforcement of ITAR/EAR: Naturally I cannot download crypto software from the US, but most of these sites have mirrors in other countries, such as the UK for PGP, and sweden and finland for lots of things. However, with the way that information is routed throughout the internet from these sites, whenever I, in Australia, request packets containing this data from the UK etc, it invariably passes through the US from coast to coast! Therefore, if ITAR/EAR tries to govern that, aren't they really trying to enforce something totally unenforcable? Surely they cannot expect all gateways operated by, say, Sprint and MCI to packet sniff 'n' search? Can anyone tell me what the ruling is with regards to this? Yours Sincerely, Benjamin Grosman ---------------------------------------------------------------- Benjamin Grosman - Programmer, Magna Data Internet Solutions Quidquid latine dictum sit, altum viditur. [Whatever is said in Latin sounds profound.] ----------------------------------------------------------------

1 0

Re: List for discussing many majordomos
by Tim Bray 17 Dec '03

17 Dec '03

some idiot subscribed me. I know how to use majordomo I know how to read mail headers Majordomo says that the address that it is sending this shit to is not on the list Much & all as I sympathize with the ethos and practice of cypherpunkery, please stop. I have asked in the proper approved way many times, and am still deluged. GET ME OFF THIS LIST! Thank you.

1 0

Re: NSA Rainbow Series.
by Moroni 17 Dec '03

17 Dec '03

Zip,NAda,Nothing. And they have more too. They were backlogged so some people haven't gotten their mail since I last posted about. I called yesterday about my videos and posters and lo and behold I received my two tech manuals today. The people who answer the lines are friendly and usually pretty industrious in getting things out or done. By the way there is supposed to be a department split in the near future so I don't know if manuals will be in one department and posters in another or what. On Wed, 12 Feb 1997, Tobin Fricke wrote: > Date: Wed, 12 Feb 1997 18:03:35 -0800 > From: Tobin Fricke <tobin(a)edm.net> > To: Moroni <moroni(a)scranton.com>, Genocide <gen2600(a)aracnet.com> > Cc: Cypherpunks Mailing List <cypherpunks(a)toad.com> > Subject: Re: NSA Rainbow Series. > > > 1-800-688-6115 press 0 or just wait for the operator. My second > > order consisting of posters and video has not arrived either. It has been > > about 6 weeks. The Rainbow order was only 2 weeks. Be prepared that when > > you order the Rainbow series you will be getting a large box.Their are > > something like 30+ booklets in the series. > > There is a set of security posters that include a Santa > > poster.And there is also a video with two films on it (Acess Ins and outs > > adb Acess Control). > > How much does all this stuff from the NSA cost? > > Tobin Fricke > (please reply privately, tobin(a)mail.edm.net) > > xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx x No success can compensate for failure in the home. x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1 0

Re: subscribe
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Jim Choate wrote: > > > Hi Igor, > > > I will not impact me negatively. I do, however, suggest very strongly > > that hosts should be subscribed to each other thgrough another mechanism > > and not majordomo, in order to prevent mail loops, header rewriting and such. > > Suggestions? What I had in mind was that any messages that get sent on > cpunks(a)ssz.com get sent over to algebra. One mechanism I would like to play > with is a 'linked list' of remailers. Remailer A sends only to B and > receives only from C... > > > A > ^ v > C < B > Then to stop loops B deletes all outgoing mail from B. Since email can be > forwarded from many sites the search must traverse the entire forward chain > killing the message if B appears as a source. I suspect a simple procmail sort > can accomplish this. My next step is to brush up on my procmail. I hope to > have something in a couple of days that will allow you to subscribe > cpunks@algebra to cpunks@ssz and both ends will be filtering. Here's how I do it (it is pretty close to your proposal): 1) I delete duplicate messages (by looking up the database of message-IDs) right away 2) I bounce all incoming messages to several other list servers 3) I pipe the article to majordomo for distribution. Note that majordomo changes headers and I wuold like to feed other servers with UNCHANGED articles. Here's the .procmailrc that takes care of this: (OTHER_HOSTS will be redefined to include, e.g., cypherpunks(a)ssz.com) # Please check if all the paths in PATH are reachable, remove the ones that # are not. # # NOTE: I use lockfiles extensively (and even excessively) because # I do not want to overburden the system. Since I am on a # PPP link that is not always on, sometimes large amounts of # submissions come in simultaneously and that may impair # performance of the overall system. You do not REALLY need # to use these lockfiles otherwise. ################################################################### PATH=/bin:/usr/bin:/usr/local/bin:$HOME/bin MAILDIR=$HOME/Mail # You'd better make sure it exists DEFAULT=$MAILDIR/mbox # VERBOSE=ON LOGFILE=$MAILDIR/from LOCKFILE=$HOME/.lockmail OTHER_HOSTS="cypherpunks(a)zzzz.com" :0 c $MAILDIR/allmail ############################################################ mailbombing ############################################################ end mailbombing :0 * ^TOcypherpunks * !^X-Loop: * !FROM_MAILER * !FROM_DAEMON { # # This recipe removes duplicates! # :0 Wh: msgid.lock | formail -D 128000 msgid.cache # send it to all other hosts :0 c !$OTHER_HOSTS # add X-Loop: :0 fhw | formail -I "X-Loop: cypherpunks(a)algebra.com" # send it to people :0 c | cypherpunks-send-subscribers # Accounting, logging :0 | cypherpunks-accounting } :0: * ^TOcypherpunks-request $DEFAULT # all the rest is trash :0 $DEFAULT # thats where it should be #/dev/null > Another nice advantage of this architecture is that 'rings' of remailers can > be interconnected by simply sending output to more than one site. Might even > be a good stability rule, "Never have a remailer send to more than 1 machine > in its 'own' ring". I see no limit other than resources that would limit the > number of rings an individual remailer might be in. A very good point. > The address is 'cypherpunks(a)ssz.com' but as alluded to above. I would like > to let it run 1 way for a day or so to get an idea of the stability of our > network link. You might consider creating a bogus username on your end. > Subscribe that user to the SSZ remailer and to your own mail list. Then use > procmail to filter all outgoing mail of that user since its incoming would > be from your list and its outgoing would go to mine, which then forwards > them to your list. We might want to call the bogus user 'gatekeeper'. Yes, we really should make darn sure that no loops are poissible before inviting people to subscribe to our lists. > If its agreeable lets get together on the cpunks-hosts list tomorrow and > discuss this a little more. > > If you don't mind, please forward this to the cpunks@toad list with your > responces. I would like to expose it to a little criticism. > - Igor.

1 0

Cypherpunks Distributed Remailer
by Jim Choate 17 Dec '03

17 Dec '03

Hi, We have established the first link between cypherpunks(a)ssz.com and cypherpunks(a)algebra.com. Testing will continue for about 24 hours and we hope to have the link going two-way within a couple of days. If testing proceeds at the current pace we should be ready to go for a 3-way link if anyone will be ready this weekend. If we can get a 3-way going we should be ready for prime time. Jim Choate CyberTects ravage(a)ssz.com

2 1

Re: NSA Rainbow Series.
by Tobin Fricke 17 Dec '03

17 Dec '03

> 1-800-688-6115 press 0 or just wait for the operator. My second > order consisting of posters and video has not arrived either. It has been > about 6 weeks. The Rainbow order was only 2 weeks. Be prepared that when > you order the Rainbow series you will be getting a large box.Their are > something like 30+ booklets in the series. > There is a set of security posters that include a Santa > poster.And there is also a video with two films on it (Acess Ins and outs > adb Acess Control). How much does all this stuff from the NSA cost? Tobin Fricke (please reply privately, tobin(a)mail.edm.net)

1 0