December 2003 - cypherpunks-legacy

Re: New remailer up.
by lefty＠apple.com 17 Dec '03

17 Dec '03

>Tapping Netcom's net connections would take more than $20 of effort. >Up it to $50,000 and I'll happily take on your offer. However, I am >going to need assurances that the money will actually be paid. Oh, very, _very_ impressive. Hey, Xenon, _I'll_ do it for only $47,500, but I'll need 50% up front. "Oh, I don't mind a parasite; it's a _cut-rate_ one I object to..." -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

unsubscribe
by bgold＠tlcnet.aps.muohio.edu 17 Dec '03

17 Dec '03

please unsubscribe me from the list Thanks

1 0

Re: SASE Suggestion
by loki＠nately.UCSD.EDU 17 Dec '03

17 Dec '03

:Lance Cottrell writes: : :> I have been meditating on this problem of return :> addresses, and have a proposal. The remailers :> can not be allowed to choose the return path, :> as any corrupted remailer will corrupt the rest :> of the path. : Jim Miller writes: :As I understand it, the remailers don't "chose" the return path, Bob (the :sender of the original message) choses the return path when he creates the :SASE. All the remailers do is interpret the part of the SASE that becomes :readable to them after decrypting the SASE portion sent to them from the :previous hop. If all is working, what becomes readable is the address of :the next hop (closer to Bob) and some misc other stuff (postage, maybe, :and perhaps another encryption key). : :Am I not understanding something correctly? : :Jim_Miller@suite.com : One SASE scheme recently suggested involved sending a request for a SASE to a ramailer, stating the number of jumps required. It then sent it to another remailer, and so on. Each adding a layer, and eventually sending the results to the desired correspondent. I mentioned that if the first remailer was corrupted, that the whole chain was (it would only send to other corrupt remailers). ---------------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.3 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Perry wrote, "However, make no mistake that Netcom can and will cooperate with the police if you use your remailer in a way that the government doesn't like, so it seems that the security afforded isn't that good." So you aren't interested unless you can commit serious felony crimes using a given remailer? I would be happy if criminals stayed away from my remailer. What do you mean by "security"? And if the police find out a personally owned machine was involved, I couldn't imagine them not just swooping in at midnight and taking it away at gunpoint. I hope those privately owned machines don't have logs ;-). In my mind, the whole secret to gaining privacy is not attracting attention in the first place. Using a remailer DOES allow a person to communicate anonymously with someone else, in two directions. If a party has enough power to tap Netcom, then sendmail logs or no sendmail logs, they will find you. and, "Besides, $20 is a paltry sum for the amount of work involved." Think of it as a trophy, which I'm sure most understood. I'm not offering you a job. I appreciate your view though, and since I've posted a request for remailer comments, might you help us all and send me some comments about the various remailers and what types of security each affords? If some wish to use remailers for serious underground activity, which should they use or not use? If they just want to keep bounced mail from telling their system postmaster who they're talking to, then that's a different type of security need. -Xenon

4 3

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Sure, a vanilla user at netcom probably can't track the remailer logs, unless of course there are BUGS in SENDMAIL (gasp!) or SunOS or whatever. But remailers aren't just to keep random users from knowing who you are so you can post better anonymous letters to alt.sex.anonymous. At least some of us would like real privacy, and consider remailers a useful part of this, and this means that if you're using remailers to communicate with your sources for the newspaper article you're writing on the CIA's cocaine delivery shortfalls or the NSA/Trilateralist designs for the National Health Care ID Card or your mayor's child pornography habits, that nobody can track you or your sources down easily. That means that root(a)netcom.com can't do it using the root password, even if they want to comply with the subpoena, and the Secret Service can't do it after confiscating netcom's machines or wiretapping their phones. Non-encrypting remailers can never really get that good, but they can at least d part of the job, and encrypting remailer networks may get that good if there's enough traffic through the system. So meanwhile, are you giving root(a)netcom.com permission to try to identify the source of your mail and win the $20 for finding out whether you're really Xenon or you're really L.D.'s evil twin Skippy? (No idea if they'll try, or if they're even listening....) - Radon

1 0

Josh Quittner`s Newsday c
by Duncan Frissell 17 Dec '03

17 Dec '03

Welcome to new lurkers (if any) from our recent NYT and Newsday publicity. To give you something a little more interesting than "Is Usenet in the Public Domain?" to read, here is my response to Joshua Quittner's column in Newsday. >Tuesday, 01 February 1994 > >CODING UP A BIT OF PRIVACY > >Time is running out for the Cypherpunks. Actually we have all the time in the world. One cannot build a New Information Infrastructure without including the tools that anyone can use to communicate privately. >This is their central question: In a future world where all information >is centralized on a network, where all information is tracked by the bit, >where every purchase you make and every communication can be monitored by >corporate America, how does privacy survive? More of a problem in the past than in the future. When P.J. O'Rourke had lived in a small New Hampshire town for a year or so and went to the store to shop for some clothes the clerk remarked, "That's not the brand of underwear you usually buy." One's life was more of an open book in the village and the tribe than it will be in the electronic village. Particularly since you can build private networks/"places" that exclude anyone you want. >"The whole information highway thing is now part of the public eye," >explain Eric Hughes, a founder of the Cypherpunk movement. "If we don't >change it now, it'll be impossible later." Misquote? It's usually better to do the job early than late but the nature of network communications is such that it's hard to control at any time. >They dread the coming commercial network of televisions and computers, >saying it will displace the Internet and destroy many of the freedoms they >now enjoy. Surely not the anarcho capitalists who probably represent a majority of active cypherpunks. >For the first time, virtually unbreakable codes are now possible, thanks to >computers. I won't say it. Certainly computers make it easier to *use* encryption. >The the U.S. government is concerned, as governments always are, about >the spread of powerful cryptography (terrorists could use it, kidnappers >could use it, drug dealers could use it, Communications intercepts are rarely used to prosecute crimes. >The (Clipper) chip is reviled by Cypherpunks and other civil libertarians >because it provides a back door that law-enforcement agencies could enter, >with the proper warrants, for surveillance. Warrants not required, just a certification that the law enforcement agency has proper authority to do a communications intercept. >"I'm starting a bank, and it's not going to be a U.S. bank," Hughes >says. >The bank will store depositors' money (he's thinking a $200 minimum >deposit) and disburse payments to anyone --- all over the Internet. It >will be based abroad, maybe in Mexico. Where did Mexico come from? >A Cypherpunk network bank is one way to pay for a network of truly >encrypted, private communications, you see. Along with lots of other nice things. Computers have been killing traditional banks for years (ever since they enabled the creation of Money Market Funds in the '70s). Netbank (and its many competitors) will continue the process. *********** Duncan Frissell You don't have to be nice to nation states you meet on the way up if you're not coming back down. --- WinQwk 2.0b#1165

1 0

UNSUBSCRIBE
by Joseph Matheny 17 Dec '03

17 Dec '03

Unsubscribe:mediak@well.sf.ca.us

1 0

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

"So meanwhile, are you giving root(a)netcom.com permission to try to identify the source of your mail and win the $20 for finding out whether you're really Xenon or you're really L.D.'s evil twin Skippy?" I have no answer to that. I don't know what "permission" means in this context. I never discluded Netcom employees though. I doubt they would wish to appear to have lax security by posting the answer though. Does L.D. have an evil twin? I hope he doesn't get a Unix account. Seriously, your comments were the first I've seen that really explain to me what sort of security problem a Netcom remailer faces. Now then, I ask you as well, might you fill in a few of the blanks in the remailer list I posted. I could send it to you if you missed it. What are the "serious" remailers, do they keep mail logs, and are they reliable? -Xenon

1 0

anonymous mail bombers and what to do about them
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Don't feed the animals. Generally, when one person is mail-bombing another, either there has been a fair amount of provocation by at least one of the parties, and escalation of childishness isn't as useful as trying to resolve some of your differences, though it can offer a certain amount of basic 4-year-old ego satisfaction. If somebody's mail-bombing you, and they're root, and they're not doing it anonymously, you don't need to either; the worst revealing your identity will do at that point is encourage them to mail-bomb you. And your system administrator probably already knows who you are by now, assuming the bombing has been at a high rate. If the bomber is root on his home machine, and the bombs include bad words that aren't mere reflections of your words to him, you could always complain to the phone company that you're receiving obscene phone calls. I doubt the policies or laws about that specify whether the calls have to be made in spoken English.... If the bomber is root on his business machine, you can complain to his management, assuming you can locate them. Some managers get very bent out of shape about this and do random clueless things, others conservatively protect their company images, others ask what state and federal laws have been broken and tell you to stifle yourself if the answer is "none". If the bomber is root on his home PC at a university, arbitrary randomness can occur. On the other hand, if you're really L- D-, and the person who is mailbombing you is Perry Metzger, expending large amounts of childishness in his direction will not accomplish anything positive for either of you, and if both of you start sending N copies of each others' mail to each other, exponential growth will not help either of your systems. If you're not really L- D-, but the person who is mailbombing you is still Perry, try talking rationally to him; he can do that just fine if he thinks it's worthwhile. If you're really L- D-, and the person is or is not Perry, we can help. Post your full name, home address with precise latitude and longitude, and we'll be happy to deliver some advanced plutonium products you may find useful in resolving your problems. "Deuterium" (oh - wait - maybe I'm "Tritium" today?) (or was that "Lithium"?)

1 0

Re: anonymous mail
by IGOR 17 Dec '03

17 Dec '03

If there is an admin above him, speak with that admin, also mail cert(a)cert.org and mail the nsf explaining to them what has been happening, or mail kfithen(a)cert.org She is a really nice lady, and she could help you on this. If all else fails, do that and send the fakemail...if you are sure that you wont get caught. Bob \//// (0 0) *------------------------------oOO--(_)--OOo---------------------------------* | Bob Christian II "IGOR" * Internet:Christi1@muvms6.mu.wvnet.edu| | Marshall University ***** E-Mail: Christi1(a)muvms6.wvnet.edu | | Huntington, WV * GET HIGH....LEARN TO FLY! IP-ASEL | | Student/D.J 88.1 WMUL FM * Major:Undecided(CJ/LAW) Minor:AVT | *----------------------------------------------------------------------------* --I love flying because there is no speed limit(^10k) and Radar is your friend! --Marshall assumes no libility for what I say, because my words are MINE!

1 0

Qwerty Remailer Delays
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

It's not very clear how long the delays should be; depends on traffic to/from your remailer and to some extent to/from the other sites your remailer cooperates with and the machine it runs on. If the delay is near-zero, relative to the rest of your traffic, traffic-analysts can see mail going to your remailer, followed quickly by similar-sized mail going to another location, and guess that the two are related, especially if they're reading the mail itself. (For instance, if netcom is a bunch of machines on an Ethernet, and somebody breaks root on one of them, packet-sniffing the net may catch a non-trivial amount of your mail going in at least one direction. It's certainly easier than tapping all the phones if you don't have a warrant.) How much you need also depends on your threat model - do you expect monitoring by netcom users only, active monitoring by root, logfile examination without ongoing monitoring, etc....? If there are a bunch of other messages in between, especially if you're sending most of them to the same destination (e.g. instead of always choosing a random remailer to send through, you pick one remailer and send a batch of N messages to it; and maybe use a different remailer for the next batch) then it's harder to correlate incoming and outgoing messages. One strategy for batching is to accumulate N messages and send them at once, rather than delaying for N minutes. This may cause rather long delays, unless you either get lots of traffic or else give up and send the real message and some fake ones after rand{5..N} minutes. (If you use fixed N, it's easy to track when traffic is low.) Bill

2 1

Re: digital signatures/copyright
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Brian Williams asks: > Could one make a case that the use of Digital signatures in > messages imply's copyright retention by the author? No - you can make a case that the author doesn't want his words to be forged or tampered with, and is using technology rather than law to enforce it. Doesn't affect the rest of the legal situation, though one could try to argue either that the author was or was not expecting copyright. -----BEGIN PGP SIGNATURE----- Version: 2.3z iQCVAgUBLU/2HdCcBnAsu2t1AQF15gP+IqS3o0gNeHng9BSqlk95KzmPwp3oo70p j2FVYHNOeUKgDSAAwvWr+p3/DOwTafSkJf4A5gW33NOKr0E9JZ4In349RAoueTku J94VMajT4i7yhOC8X41RPkVLlCltPDRo04SS8h5UFnEk/zFxiTkvXY9mpBcK3yUw vYY9pbmupSc= =KbXS -----END PGP SIGNATURE----- Bill

1 0

Re: New server up.
by pgpkeys＠wasabi.io.com 17 Dec '03

17 Dec '03

PGP Slave, I hear and obey O Master. Could you please announce my full name, phone number, address, visa card number, a giff of my signature, height, weight and driver's licence number not only to the Cypherpunks mailing list but to many usenet groups as well, If you insist :-) (Can you give me a few more days to comply?...I`m having some trouble getting a copy of your signature. One of the guys in the chem faculty says he knows where he can get one at the weekend...) since you obviously feel I no longer wish to be known to the masses as Xenon, and I instead want them to start calling me and postal mailing me asking for copies of PGP. Thanks asshole. I thought the people on this list were concerned with privacy, but I was wrong. I mention Xenon in my personal .plan, but I ask people to let me keep the small amount of extra privacy I still retain. Hey bud, you`ve clearly misunderstood the whole point of the movement. You get whatever privacy you can make for yourself through technology. Any dolt who goes to the extent of using two remailers and a penet id to hide his identity then puts his nym`s secret key in his True Name signature file gets the privacy he deserves. Anyway, whats the big deal?...noone who read my post will have a clue who you are unless you tell them yourself; and anyone who could track you down from the two bits of info in that post is more than capable of tracking you down the same way I did from the public logs on netcom. I was just waving enough of a red rag at you to make the point forcefully... (remember your the one arguing against putting delays more than 15 minutes in a remailer system...) The point I was making was that you cannot rely on trust such as a lack of logs alone to keep things like remailer chains secure...you *have* to build the security into the technology and the protocols. You must assume that The Bad Guys (tm) have full access to all the logs of all the machines that run remailers...if not directly then by watching the wires. So any remailer scheme has to include dummy traffic, significant delays, and encrypted input way back at the sender`s end. And the protocol has to be such that a remailer chain is as strong as its strongest link, not as weak as its weakest link, meaning if 9 out of 10 remailers have been compromised but the 10`th is run by Honest Joe, then Honest Joe`s trustworthiness is sufficient to defeat the evil forces of TBG with there 9 bogus servers. You wrote, "qwerty account or not, the public logs on netcom show more than enough info to trivially track people down." Trivial? And so you hack out the info that a message went from remailer A through qwerty and on to remailer B, at a certain time. You haven't tracked down anyone my friend. Yo dude, I found *you* didn`t I? And it took me less than 5 minutes. So bite me. PS How to build your own mailer logs on netcom...just stay on long enough and keep typing `mailq`...no problemo...I can`t be bothered but if I could thats how I`d track traffic through qwerty for your $20...

1 0

Re: New remailer up
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

I haven't really kept track of which remailers are how reliable; they're almost all relatively new and experimental, people are hacking software, they go up and down a lot, and I almost never use them anyway. I also don't like keeping track of the syntax and which ::'s are followed by which ##s :-) Julf's anon.penet.fi remailer is serious; he's done a lot of work to get a private machine, payng for a reasonably expensive 64kbps line himself, and has it located somewhere that only 3 people know. (The original was located at a university, and somebody decided they wanted it Closed.) It's also outside the US, which is useful, . On the other hand, it works differently than the one-way anonymous remailers, uses up a substantial fraction of the net.bandwidth into FInland, and costs him real bucks - somebody ought to start a US equivalent and deload him. I'd guess tht extropia is also probably well-run, or at least has good features. But I haven't used it.

4 3

PGPTools Minor Bug
by remailer＠merde.dis.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There is a minor bug in PGPTOOLS.C which needs to be fixed. In pgp_extract_rsa, two lines need to be added. This variable was not being cleared. When the precision was later set to max, there was garbage left in the high-order bytes of the mpi. This caused the size of the MPI to be wrong, and the function would not decrypt 2.2 or earlier packets. It could also occasionally fail to decrypt a 2.3 packet. Sorry about that. Pr0duct Cypher /* Decrypts and extracts the key from an RSA-encrypted block */ /* Returns true if successful, false if not */ int pgp_extract_rsa(struct fifo *f,byte ideakey[16], struct pgp_pubkey *pk,struct pgp_seckey *sk) { struct mpi *p=safemalloc(sizeof(struct mpi)); struct mpi *c=safemalloc(sizeof(struct mpi)); unit *dp=safemalloc(sizeof(unitarr)); unit *dq=safemalloc(sizeof(unitarr)); unit *temp=safemalloc(sizeof(unitarr)); byte result; word16 checksum=0; byte *pp; byte type; word32 length; set_precision(MAX_UNIT_PRECISION); <--------- ADD mp_burn(p->value); <--------- ADD set_precision(bits2units(pk->n.bits+SLOP_BITS)); pgp_examine_packet(f,&type,&length); -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLU4ptsGoFIWXVYodAQG3GQQApg45mfrbfoUP4BhrtmvE+zRGdSp6zx9+ M7GDnJ+vpCVzQj6S7Z+y1RZ4FFAT6yX/63oeVvhW8FzNZ1s5xOZivbIZrhC6WPJU qZiuy/veXD7OrWpUJueucT5xPF/Nsjdx3w2DiAy2x7YtRycpzugMSpSdvJcCcOuK rGBkPV2eJDc= =+WVh -----END PGP SIGNATURE-----

1 0

Re: Archiving mail-lists...
by Matthew Bernardini 17 Dec '03

17 Dec '03

What do you call 1,000 copyright lawyers chained to the bottom of the ocean ? 1)A good start. 2)A drop in the bucket. 3)A boring Swim Party. I can't take five hundred messages in a week from people calling each other names and including 500 lines of previous posts !!!! Give my mailbox a rest, eh ?

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Perry almost wrote: > Anyway, people who want to use the law to restrict distribution of > their software are extremely foolish. Your code is out there > it WILL be copied. Forever. You can't help it. If you don't want > people to use your software, don't write it.

2 1

LPC on ADSP2105
by Tim Newsham 17 Dec '03

17 Dec '03

I have recently finished my senior project on low-bandwidth coding of speech. I outline an implementation of Linear Predictive Coding (LPC) on the ADSP2105. I am making the paper and the source code freely available in hopes that it may interest and possibly help someone. In order to avoid having to mail out copies seperately to everyone who is interested I am putting the paper temporarily on: ftp.uu.net:/tmp/lpc-paper.tar.gz If you know of an archive for which this paper is suitable please let me know how to submit it there or submit it yourself and let me know. The archive is a tar'ed collection of files, to unpack: gzip -d lpc-paper.tar.gz tar xvfp lpc-paper.tar The contents of the archive are: Makefile README a4.sty lpc.ps lpc.tex lpc4b.asm notes.tex schematic schematic.ps source.tex and contain postscript and LaTeX formats of the document. Here is the abstract: \begin{abstract} An implemenation of Linear Predictive Coding, a low-bandwidth speech encoding scheme, built around the ADSP-2105 signal processing CPU is described. The hardware schematics and software source code listing are included. \end{abstract} Tim N. (ps. I am no longer subscribed to the cypherpunks list so if you wish to reply, send the reply directly to me)

1 0

Re: New remailer up.
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ndw1: mail qwerty(a)netcom.com Subject: Re: new server up. :: Request-Remailing-To: cypherpunks(a)toad.com (Skip to end for actual remailer discussion.) PGP Slave, "If you insist :-) (Can you give me a few more days to comply?...I'm having some trouble getting a copy of your signature. One of the guys in the chem faculty says he knows where he can get one at the weekend...)" Thanks again. Now everyone knows to never tell YOU any secrets, no matter how trivial they might be, since you will post them. Who's the 'punk? and, "Hey bud, you`ve clearly misunderstood the whole point of the movement. You get whatever privacy you can make for yourself through technology. Any dolt who goes to the extent of using two remailers and a penet id to hide his identity then puts his nym`s secret key in his True Name signature file gets the privacy he deserves." I'm not sure you understand what -----BEGIN PUBLIC KEY BLOCK----- means. Or were you fingering someone else? Am I missing something? I am using two remailers to help out with the lack of traffic, not to hide my identity. There are many levels of privacy, and the one I am concerned with does not involve anything other than that Usenetters who are NEWBIES being forced to contact me via e-mail. It also involves not having the people I work around who are not my close friends gossiping about, mindlessly, about "what I am trying to hide" with my use of PGP. This is a personal thing, and using a nickname on Usenet is as strong of security as I need to meet this need. When I joined this list and started using Cypherpunk remailers I decided to not maintain my anonymity in a vigorous manner. I think you are trying to show off what a super hacker you are by typing "last qwerty", or even just "finger qwerty" from outside, to see my local site that I telnet in from, then typing the master-hacker magic-line "rusers my.site". I am impressed that you too can type these commands, and you get the Xenon Hacker God Award for the entire year of 1994. However, I would rather talk about remailer security levels than trying to cope with someone embarrassing themselves posting their "discovery" of my "real identity". I am not "hiding my identity", I am maintaining a minimal amount of PERSONAL privacy, at a security level that fits my needs; I am using a NICKNAME. For this purpose, qwerty and catalyst serve me well. I'm not sure why you have so much fun disrespecting a person's privacy. I arrived here with a simple question, "Can I use your remailers for bulk mailing of 1-3MB a day to people wanting the PGP FAQ and MacPGP Guide? What are the qualities of each remailer?" I think I understand the movement quite well, but I understand there IS NO fully secure remailer network which I would bet my life on. And I understand and am acting upon what few seem to care about, which is getting a large number of people outside of the internet-skilled culture using secure encryption. There are 50-100 million Mac and Windows users, and the majority of those with a modem use their internet connection for simple e-mail ONLY. Many only HAVE e-mail in fact. PGP has mass media attention, but very few are using it since they can't get it by a 1-800 number. I hope ViaCrypt will change this, with Mac and Windows versions. -----BEGIN REMAILER DISCUSSION BLOCK----- and, "logs on netcom. I was just waving enough of a red rag at you to make the point forcefully... (remember your the one arguing against putting delays more than 15 minutes in a remailer system...)" Finally we are talking about remailers! Thank-you. My telnet log is public. Netcom's sendmail logs are not (?). There IS a difference. I was arguing against long delays, which should only be needed if no baseline traffic is going on. Many people will not be able to function well if say, mail is batched out at midnight. Rapid two-way communication is very important these days in getting ANYTHING done, be it above ground OR underground. and, "PS How to build your own mailer logs on netcom...just stay on long enough and keep typing `mailq`...no problemo...I can`t be bothered but if I could thats how I`d track traffic through qwerty for your $20..." Now you really do get an award, but not the $20 since that will go to the person who WAS downloading mailq logs from Netcom ;-). You seem to be absolutely right. Here is an outgoing piece of mail sent from qwerty: qwerty: mail alt.test(a)news.cs.indiana.edu Subject: Ignore ignore test. This is a test of 'mailq'.

1 0

Re: New remailer up.
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- (Skip to end for actual remailer discussion.) PGP Slave, "If you insist :-) (Can you give me a few more days to comply?...I'm having some trouble getting a copy of your signature. One of the guys in the chem faculty says he knows where he can get one at the weekend...)" Thanks again. Now everyone knows to never tell YOU any secrets, no matter how trivial they might be, since you will post them. Who's the 'punk? and, "Hey bud, you`ve clearly misunderstood the whole point of the movement. You get whatever privacy you can make for yourself through technology. Any dolt who goes to the extent of using two remailers and a penet id to hide his identity then puts his nym`s secret key in his True Name signature file gets the privacy he deserves." I'm not sure you understand what -----BEGIN PUBLIC KEY BLOCK----- means. Or were you fingering someone else? Am I missing something? I am using two remailers to help out with the lack of traffic, not to hide my identity. There are many levels of privacy, and the one I am concerned with does not involve anything other than that Usenetters who are NEWBIES being forced to contact me via e-mail. It also involves not having the people I work around who are not my close friends gossiping about, mindlessly, about "what I am trying to hide" with my use of PGP. This is a personal thing, and using a nickname on Usenet is as strong of security as I need to meet this need. When I joined this list and started using Cypherpunk remailers I decided to not maintain my anonymity in a vigorous manner. I think you are trying to show off what a super hacker you are by typing "last qwerty", or even just "finger qwerty" from outside, to see my local site that I telnet in from, then typing the master-hacker magic-line "rusers my.site". I am impressed that you too can type these commands, and you get the Xenon Hacker God Award for the entire year of 1994. However, I would rather talk about remailer security levels than trying to cope with someone embarrassing themselves posting their "discovery" of my "real identity". I am not "hiding my identity", I am maintaining a minimal amount of PERSONAL privacy, at a security level that fits my needs; I am using a NICKNAME. For this purpose, qwerty and catalyst serve me well. I'm not sure why you have so much fun disrespecting a person's privacy. I arrived here with a simple question, "Can I use your remailers for bulk mailing of 1-3MB a day to people wanting the PGP FAQ and MacPGP Guide? What are the qualities of each remailer?" I think I understand the movement quite well, but I understand there IS NO fully secure remailer network which I would bet my life on. And I understand and am acting upon what few seem to care about, which is getting a large number of people outside of the internet-skilled culture using secure encryption. There are 50-100 million Mac and Windows users, and the majority of those with a modem use their internet connection for simple e-mail ONLY. Many only HAVE e-mail in fact. PGP has mass media attention, but very few are using it since they can't get it by a 1-800 number. I hope ViaCrypt will change this, with Mac and Windows versions. -----BEGIN REMAILER DISCUSSION BLOCK----- and, "logs on netcom. I was just waving enough of a red rag at you to make the point forcefully... (remember your the one arguing against putting delays more than 15 minutes in a remailer system...)" Finally we are talking about remailers! Thank-you. My telnet log is public. Netcom's sendmail logs are not (?). There IS a difference. I was arguing against long delays, which should only be needed if no baseline traffic is going on. Many people will not be able to function well if say, mail is batched out at midnight. Rapid two-way communication is very important these days in getting ANYTHING done, be it above ground OR underground. and, "PS How to build your own mailer logs on netcom...just stay on long enough and keep typing `mailq`...no problemo...I can`t be bothered but if I could thats how I`d track traffic through qwerty for your $20..." Now you really do get an award, but not the $20 since that will go to the person who WAS downloading mailq logs from Netcom ;-). You seem to be absolutely right. Here is an outgoing piece of mail sent from qwerty: qwerty: mail alt.test(a)news.cs.indiana.edu Subject: Ignore ignore test. This is a test of 'mailq'. qwerty: mailq Mail Queue (58 requests) --Q-ID-- --Size-- -----Q-Time----- ------------Sender/Recipient------------ (much deleted....) UAA29300* 27 Wed Feb 2 20:13 qwerty alt.test(a)news.cs.indiana.edu And some incoming, as bounced off of hh(a)cicada.berkeley.edu: UAA29978* 6 Wed Feb 2 20:20 <hh(a)cicada.berkeley.edu> "|/u1/qwerty/remail/slocal.pl" slocal.pl is part of Hal's remailer scripts. So who has a remailer to send me that will avoid this? Looks like I'd not use qwerty or catalyst as the first or last stop in a remailing chain. But if the only way to track this is AS the mail arrives or goes out, I'd still classify qwerty/catalyst as being good for casual security uses such as my post to Usenet above. It would be a lot faster than anon.penet.fi! Then again, a person could blackmail someone for posting to alt.sex.bestiality. When can I and many others switch from Netcom to a pubic service Unix network that is private/secure? *Again, I'm trying to compile a list of remailers and what levels of security each entails. Such a list does not seem to exist. If you ever want more traffic.... -----END REMAILER DISCUSSION BLOCK----- PGP Slave, despite this misunderstanding, could we declare peace and get on with a discussion about REMAILERS, instead of my nickname. I'm out here to learn and try to contribute what I can. I am sending info about secure encryption to at least a dozen people a day, many of whom would not otherwise get their hands on PGP or even the PGP FAQ, and I have thus become the most prolific user of the Cypherpunk remailers. I am doing this randomly, chained between two remailer at a time. This volume could triple if I started advertising. I don't misunderstand the movement? -Nik (Xenon) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLVBTPASzG6zrQn1RAQH2/QP/dexRZeXe7KRZpADn+hCBUoUExelRJ6hv A6kARzcymCAa3571u1XDauIcmNTPXDQTQ4bf3D5x94eR2AM43NjPcVBWkZcUYgEk ROGkIP3fAFnpBCbn0RZPOhIfYt8NnvWY53knRd5JxJbJ6jQxjRG9SfADs2ip8Fpl v4p6WPlnFHM= =j2FI -----END PGP SIGNATURE-----

1 0

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

I must thank Hal Finney for pointing me to 'gopher chaos.bsu.edu'. I will be much better informed about remailers for having found this site. I'm not sure why it's taken a week for someone on this list to tell me this. -Nik (Xenon)

1 0

A serious question of ethics
by nobody＠pmantis.berkeley.edu 17 Dec '03

17 Dec '03

Ok, I'm in a bit of a quandry. While surfing the net last week, I happened across an address addached to a machine that belongs the the federal reserve. No big deal. I telnetted there on a lark, and entered 'guest' for the account. It dropped me into a shell. It didn't ask for a password. Intrigued, I did a little looking around. Nothing special, a CDRom and about 80 accounts. But(!!), /etc/passwd was there and available and not using shadows. No, I didn't snatch a copy. Quandry(ies) 1) Should I alert someone there about the obvious (and, IMHO serious) seciruty hole? or 2) Should I ignore it? 3) Should I take advantage of it (well, maybe not) ---------- I don't like to see systems so open, no matter who they belong too, and the fact that the governments (whether you like them or not) has one this open REALLY bothers me. But, I also wonder what kind of trouble I could get into. Technically, I violated something just by being there as I didn't have permission, and the fact I accessed the passwd file makes it even worse. If I report it, I could be in deep shit. I could mail to them via a remailer (like penet.fi, so that they could answer for more information if needed). That is a little securer and Julf is out of jurisdiction of the FBI hunting me down. Yes, I'm a little paranoid, but Uncle Sam likes to make examples out of white-collar hackers, and for me it was pure and dumb luck (like a jury would believe a 22 year-old computer geek isn't trying to gain illegal access). Any suggestions? Please? I consider this to be serious (most may not).

3 2

Commodity Jurisdiction success for Kerberos Bones!
by gnu 17 Dec '03

17 Dec '03

( ) United States Department of State ( State Dept ) Bureau of Politico-Military Affairs ( Logo ) Office of Defense Trade Controls ( ) Washington, D.C. 20522-0602 In reply refer to Feb 1 1994 OTDC Case: CJ-012-94 YOUR LETTER DATED: January 13, 1994 REQUEST FOR COMMODITY JURISDICTION FOR: "Kerberos 900104 bones.tar.Z patchlevel 6" software program This commodity jurisdiction (CJ) request was referred to the Departments of Commerce and Defense for their review and recommendations. As a result, the Department of State has determined that the referenced commodity falls under the licensing jurisdiction of the Department of Commerce. Please consult that agency's Office of Technology and Policy Analysis at (202) 482-4145 to determine their requirements prior to export. Should you require further assistance on this matter, please contact Maj. Gary Oncale at (703) 875-5655. Sincerely, (signed -- but it doesn't look anything like the name below) William B. Robinson Director Office of Defense Trade Controls John Gilmore Cygnus Support 1937 Landings Drive Mt. View, CA 94043 -- end of letter from State Department -- Now, what does it mean that we got a Commodity Jurisdiction for the Kerberos Bones? It means that the State Department has formally excused itself from worrying about us exporting the Bones. If the Commerce Department lets us do it, it's fine with the State Department. Exporting the Bones will not violate the International Traffic in Arms Regulations (ITAR). (Doing so might still violate other laws -- the State Dept has expressed no opinion on that.) This is no surprise, since the Kerberos Bones were deliberately emasculated to remove anything that might cause the State Department or the NSA to get upset. The letter just confirms that that effort was a success. I will do a formal check with the Commerce Department, as suggested in the State Department letter. My current understanding is that under Commerce rules (the Export Administration Act), publicly available software can be exported to any destination. In particular, I believe this means that there's nothing to fear from putting up the Bones for ordinary FTP. (There's a serious First Amendment issue being debated, over whether export control laws can prevent you from publishing software via FTP at all -- but even the most paranoid should now figure it's not an issue for the Bones.) I encourage people and companies who are interested in export issues to submit a commodity jurisdiction request for some software that you want to export, and go through the process. In public. The State Department and NSA don't publish their guidelines for what is exportable and what isn't, so the only way we-the-public are going to find out is by asking, and then telling each other. I've set up an FTP archive of such information on ftp://ftp.cygnus.com/pub/export. It includes `cjr.kit', which is the info you need to file your own CJ Requests, and three files regarding Commerce Department licensing. `commerce.gtda.license.faq' in particular is a FAQ from the Commerce Department about when the General license for Technical Data to All destinations lets you export without any paperwork. -- John Gilmore gnu(a)toad.com -- gnu(a)cygnus.com -- gnu(a)eff.org Can we talk in private? Join me in the Electronic Frontier Foundation. Not if the FBI and NSA have their way. Ask membership(a)eff.org how.

1 0

J. Michael Diehl's procmail-pgp
by Sameer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- If J. Mike Diehl is out there (mail to the address I have for him is bouncing) or someone else has that procmail-pgp .procmailrc he has written, I would appreciate it if you sent it to me. Thanks! - -Sameer -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLVCoZni7eNFdXppdAQHzQwP/eXkVO/lN0794NwREP/YXfpF3xVubCYAA TN6F+fjv3zpxkp95GRDbwpIxiw/Aytz/5qXjgJfV0Gatrc8CNPj/zbzBdB0Wc7Yq kcaLJYwoBCazhUy6gC+3w1A79H8Uav8bgbWfx2coBQMhp69+OYyH88GuNf+01m+4 LTNcml4sJEc= =InuS -----END PGP SIGNATURE-----

1 0

Re: A serious question of ethics
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Well, if the Federal Reserve has a guest account with no password, maybe they're inviting guests... Ok,, mailing them through a remailer might not hurt, though it might point out to them that remailers exist, if they haven't figured it out already. Personally, if I were logged on to one of their machines, I'd start looking for the "print" command :-) Signed, Anonymous --

1 0