December 2003 - cypherpunks-legacy

Proposed policy: look like sig
by gwt＠eskimo.com 17 Dec '03

17 Dec '03

Eric said, >Given the objections I've received, I now amend my proposal from "sign >your messages, or else" to "make something that looks like a >signature, or else". This has several consequences that I >particularly like. Wouldn't it "look like a signature" if I just copied at the end of an article the actual signature of some other, signed, article? That would be a true signature, just not mine and not for this article. It sounds as though it would meet the suggested requirement, but I don't see how it would accomplish the goals. I could do it with a macro, or maybe use a special .sig for posts to this list. It wouldn't add anything to my software. What am I missing? -George

1 0

Re: impersonation
by an5877＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Scott, I'm not sure what you mean by dissemination of information not being ergodic -- could you please elaborate. Well, not elaborate, because your style is already quite elaborate, and I can't make heads or tails out of your note. The comparison of Email forgery to rape ("or any other invasion of privacy" -- excuse me, but forcibly shoving your penis into my vagina is not an invasion of my privacy, it is a violent crime on my body, for which you will pay) so enrages me, it makes calm discussion impossible. DEADBEAT <na5877(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBFAgUBLMrfAPFZTpBW/B35AQHTvAGAnV21LCA7m5AeD05EoAUbjuLAHTZK9lHM Y1C/1B2n6wmYAivNaCAbvk+YJHza5Hv5 =wh4r -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Viallage Voice article, etc
by nate＠VIS.ColoState.EDU 17 Dec '03

17 Dec '03

Does anyone have a copy of the Viallage Voice article from the 3rd of August 1993? I don't want to type it in, and I know I saw it on the list a while back. Also, I am compiling a list of articles that explain what we are all about (I know, there is no CypherPunks agenda per se, but there are common goals here), to be given out to the public. If you are in posession of such an article (or know of one, I'll type it in) send it to me, please. Thanks, -nate -- +-----------------------------------------------------------------------+ | Nate Sammons email: nate(a)VIS.ColoState.Edu | Colorado State University Computer Visualization Laboratory | Finger nate(a)monet.VIS.ColoState.Edu for my PGP key | #include <std.disclaimer> Guerrilla Cryptographer | Title 18 USC 2511 and 18 USC 2703 Protected --> Monitoring Forbidden +--------+ Always remember "Brazil"

1 0

pseudospoofing survey
by L. Detweiler 17 Dec '03

17 Dec '03

punks: The following is an essay followed by a survey on pseudospoofing. If you are interested in participating in the survey please reply in email to me under your `true name' only. I will post a summary to the list if there is sufficient data and I'm convinced it isn't strewn with manufactured lies from phantom identities (please do not waste my precious time, pollute my mailbox, or disrupt this survey with any). * * * First, let's review. From my perspective a person can have cyberspatial identities in about 5 basic categories. Under these definitions an `identity' is what appears in the `from' line of a message or other very obvious identifying characteristics of the message, for example, a line at the beginning saying `This is [x], I couldn't post under my regular account but ...', a signature at the end of the message, etc. Under these definitions I'm leaving out the distinctions of `reply capability' associated with anonymous servers etc. 1. `True Name' -- for our purposes let this be defined as the name on your birth certificate, your legal identity. 2. `unique name' or `cyberspatial name' -- this would be a name you associate with all your activities in cyberspace in postings to mailing lists, email, etc. That is, I'm making a distinction about people possibly using the net always under a single pseudonym. 3. `obviously anonymous' -- identifying characteristics in the message (such as origination from an anonymous server, etc.) make it obvious that *anyone* could have posted it. Sometimes called `hit and run'. 4. `pseudonymous' -- a variation of (3) where arbitrary identification is used to build up a reputation under a presumed name, but characteristics of the message make clear that the identity is an *alias* for someone's *unique* identities under (1) or (2). The nicknames associated with the Helsingius server ID's would be an example. 5. `pseudoanonymous' or `pseudospoofed' -- the message could either be someone's `true name' or an invented alias, but *no* characteristics of the message (including the message by the author) can discriminate exactly *which*. This is something like `identity camouflage'. It is a new category of identification that transcends (1) - (4) because it encompasses all of them. * * * Now, I've written a lot on `anonymity' and am a strong supporter and proponent of categories (2), (3), and (4), where the *receiver* of a message is *informed* and *aware* that it can be from *anyone*. However, I believe extreme restrictions should be placed on the use of (5) in a civilized cyberspatial society (such as that which mailing lists and Usenet groups attempt to represent, IMHO). Contrary to all the flames on the list and in my mail box, I continue to believe that this is not incompatible with privacy -- in fact, I believe it *promotes* it. Very serious abuses of (5) can lead to insideous deception and treachery, particularly in the interplay between public and private messages, and I'm absolutely aghast to see the capability for (5) championed as `privacy' here and in my mailbox by many people (or phantoms, I'm in total confusion) I used to respect. But this is all another essay. Above all, I'm *extremely* disturbed and alarmed to perceive what appears to be a systematic propaganda and disinformation campaign on this list and elsewhere in obfuscating the *obvious* and *incontrovertable* distinction between (3) and (4) on one hand (`anonymous' and `pseudonymous') and (5) on the other (`pseudoanonymous' or `pseudospoofed'), ironically perhaps largely via abuse of the lack of protective mechanisms against it here. In (3) and (4), the reciever *knows* that the message can be from *anyone*. In (5), the receiver does *not* know, and may even be *misled* into believing that a message is in categories (1) or (2) when it is in fact in fact `anonymous'. IMHO this is *very* dangerous. To further emphasize this distinction, in some sense categories (1) - (2) are *attributable* to *unique* identities. When I see messages in categories (1) or (2) on a mailing list, in my mailbox, or in Usenet postings, FTP articles, whatever, I can attribute them to unique people by definition. We also might call (1) `accountable', and if an online account under (2) can be traced to a legal identity, it would be also. Categories (3) and (4) are *not* attributable to unique identities. A single person could post anonymously multiple times or pseudonymously under multiple identities. If a person has only one pseudonym, let's say that's `quasi- or semi- accountable'. But not only is (5) *not* attributable to *identities*, it is not `attributable' to any of the previous *categories*! Hence, let's call messages in the categories (1) - (2) `attributable', (3) - (4) `nonattributable', (1) - (4) `uncamouflaged', `white', `open' or `unsurreptitious', and (5) `nonattributable' and `camouflaged', `black', or `surreptitious'. (I leave it to subsequent debate to stabilize on the most descriptive and memorable terms.) This *camouflage* that various cypherpunks promote, apparently up to the highest levels of `leadership', is IMHO inherently subversive. Because no one here seems to be afraid of subversion and anarchy, and even embraces it, let me go further and say it is *destructive* not only to societies but to *any* social interaction, even interpersonal. IMHO It is not just a recipe for anarchy, it is a recipe for chaos and barbarianism, *particularly* when associated with personal mail (including mailing lists). This was all a topic of discussion many months ago, and I paid scant attention at the time because I didn't think it was the interest of the majority of cypherpunks, part of the agenda, generally feasible, or in widespread practice. Recent events suggest to me I am *utterly* mistaken on all counts. In fact, apparently not only are `some' cypherpunks in favor of `black' postings, they are in favor of *concealing* the very existence of the capability, so as to potentially manipulate and brainwash others in an undetected concerted conspiracy! I think I will define this as `evil blackness'. <g> Again, lots of specific examples, anecdotes, and horror stories are another essay. Perhaps some would like to expand on this point (please email me if you treat this in a comprehensive and thorough manner). For now, I just want to make the distinctions clear for the survey, which follows. The survey will help me determine the extent of `blackness' and `evil blackness'. Please try to be as complete as possible in your responses. I will read and be influenced by independent opinions in my mailbox, but again request that you use your True Name only in any correspondence with me. And anyone who flames that this survey is an invasion of privacy, get lost. Let anyone reply under their own free will. I will keep all responses strictly confidential. However, I would like to collect some opinions under true names I can quote later. Please put the key `N/A' (not for attribution) in front of any response you wish me to leave unattributed or in front of the entire message like `message N/A'. Also, I will try to start email conversations with anyone who is particularly knowledgable. * * * 1. What is your `true name'? 2. Do you have a unique online identity other than your true name? 3. How long have you been on the internet? 4. How many mailing lists are you on? 5. Are `black' / `camouflaged' identities feasible or possible on the internet today? If so, how in particular? Comment on public access and UUCP sites if possible. 6. To what extent do you think `camouflaged' identities exist on the internet currently? Where are they used? What mailing lists or newsgroups are particularly dense with `black' postings? Have you ever received any in email? 7. Have you ever posted under a `camouflaged' identity? if so, where? How often? 8. Are you aware of any potential `abuses' of `black' messages? Has it turned into a big problem anywhere? Do you have any horror stories? Are there any `cabals' or `silent conspiracies'? have any debates or projects been `poisoned' or `sabotaged'? 9. Are you neutral on the capability of `black'/`camouflaged' messages, or do you strongly promote/support or condemn it? Is it harmless or dangerous? 10. Is society aware of `black messages'? if not, what would `they' think in general? if so, what is the consensus on the practice? 11. Is it fundamentally technically impossible to prevent *widespread* black messages if there was an incentive or consensus to do so? Or is it feasible with technology? 12. What are internet policies in general on `black' messages? What should they be? Should they be restricted and prevented? allowed? Keep in mind the distinctions of posts to mailing lists, Usenet posts, and personal mail. 13. Please list any resources on this subject: email addresses of specialists, pointers to papers, etc.

3 3

pgp inforequest
by XXCLARK＠indst.indstate.edu 17 Dec '03

17 Dec '03

The PGP23a DOC_2 file says: "Info-pgp is moderated by Hugh Miller, and you may subscribe to it by writing him a letter at info-pgp-request(a)lucpul.it.luc.edu. Include your name and Internet address. If you want to know where to get PGP, Hugh can send you a list of Internet FTP sites and BBS phone numbers. Hugh may also be reached at hmiller(a)lucpul.it.luc.edu." As I presently have no newsgroup access, I attempted to mail to the request add above and the message bounced. Can anyone tell me if this address is still valid... or correct?

1 0

impersonation
by catalyst＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have recently read many arguments here which can be summarized: "Cypherpunks technology makes impersonation easy, abuses unpunishable, and communication untrustable." This is not true. There are two major thrusts to the tech discussed on this list. a) anonymity, i.e., stripping communication of provable identity; b) authentication, i.e., demonstrable proof of identity. Impersonation based on the technology of the former, can have no more, and likely much less, credibility than without. Neither does this technology afford any additional mechanism by which a user bent on forgery can illicitly claim another's identity. The technology of the latter category (e.g., digital signatures) is, in fact, meant to be a significant obstacle to this very act. My identity is my own. An impersonation of me is an unpermitted use of my private property: identity and reputation. It is as reprehensible as any other theft, and -- at least to me -- is as deep an invasion of my privacy as rape. I'm pretty damn pleased that cryptography has provided me a weapon against it: a weapon advocated by cypherpunks; a weapon wielded frequently on this list; a weapon we are all armed with, in the bodies of PGP and PEM. With the honey, often come the bees, and vice versa. The same people who advocate a technology you fear, offer with it a solution far better than unenforceable prohibition (even if we _had_ been the ones to let the genie out of the bottle, we couldn't put it back in: dissemination of information is non-ergodic). Anonymity software adds no affordances to the already considerable array of techniques for deceiving people, simply more reliable 'track covering', and conversely, less credibility. Digital signatures, on the other hand, provide a simple, tested, workable protection. Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLMph2CmBKTQiZpaHAQEjZQP/ef4gBVSIy9+FFHkPyth9ktIjsqQu0W7S ccY4BZGcJGOzA1QmqMKugHM1wQh8jNNtTLxmgSNcB5wUpAuGJaEFOhnKqRUGO4BB oyR8AXXQ5uUDmBQ7krYaqk6xPLWe/K4ZPzcv/AVOZocxVlUGCLPg5z5+IXkyOb/2 FCwscFEBGcs= =hAS8 -----END PGP SIGNATURE-----

2 1

pseudoanonymous correction
by rjc＠pseudospoofer.exploit.org 17 Dec '03

17 Dec '03

rjc(a)gnu.ai.mit.edu writes: > > Very serious abuses of (5) can lead to insideous deception and > > treachery, particularly in the interplay between public and private [opps, a paragraph got cut out somehow, oh well] > The same case can be made for free speech. Allowing hate speech > mongers the protection of free speech could lead to negative public --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it. -- Ray Cromwell | Engineering is the implementation of science; -- -- EE/Math Student | politics is the implementation of faith. -- -- rjc(a)gnu.ai.mit.edu | - Zetetic Commentaries --

1 0

Re: ADMIN: proposed new policy on the mailing list
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

I don't think restricting participation to signed messages is a good idea until we have some way of verifying a signature automatically before allowing it to be posted. Here's one: How do you verify a signature for an anonymous, first time poster? I am not opposed to the concept, just I don't think there's a practical way of doing it. How about this: Require cypherpunks users to register a key and an identity, real or pseudonymous. Then, they can sign with the corresponding private key and nobody else can. The software then filters out bad posts. How do we prevent people from registering a key in someone else's name??? It's beyond me. Wonderer ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

ADMIN: Shall we sign?
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

********************************************************************* *******THIS MESSAGE HAS BEEN SIGNED BY "TIM'S REALLY NEAT SYSTEM"**** ********************************************************************* I see some problems, for me at least: 1. I run MacPGP home machine, and using it is a boring and time-consuming prcess. Many of you know about this. (Ironically, it's more secure for me to run it on my home machine, instead of on Netcom, but it means a lot more work.) 2. I also have plain old PGP running on one of my DOS laptops, and I sometimes use RSADSI's "MailSafe" on this, even to sign. (But not often, that's for sure.) 3. For quick responses, where response time is more important anyway, I cannot see jumping through all these hoops. Ironic, isn't i? 4. If the signatures are not to be verified, or even to be looked at very closely, then the situation presented at the beginning of this message will flourish: phony sigs to beat the delay. 5. Eric alluded to such proliferation being a Good Thing. I think not, as it will trivialize real sigs and will in some sense turn digital sigs into a kind of running joke on the list. Not a good thing, in my view. 6. The sitiuation with L. Dettweiler and S. Boxx, tragicomic as it was, would not have been materially affected. Both would have "signed" their messages in some way and what would then have been accomplished? (In some sense, both _were_ signed: Dettweiler by the origin of his message and the hard-to-spoof "an12070" (or whatever) that S. Boxx used.) While I'm not sure if the LD/S.Boxx situation, and the general claims of "pseudospoofing" are motivating Eric's idea, I certainly don't see a system of "weak" digital sigs (weak meaning no real checking) doing anything. 7. Finally, I have yet to see any serious evidence that this so-called pseudospoofing is going on, that is, that people are pretending to be others. I know Dettweiler _thinks_ that I am using the nyms of Jamie Dinkleacker, Nick Szabo, and others, but this is arrant nonsense. (And to repeat the obvious, as noted above, if I _were_ using other identities in this way, digitally signing the messages would be trivial and would in fact create a false sense of security, as others have also noted.). I've never seen anyone else claim to be me, at least not seriously, nor have I ever suspected such pseudospoofing is actually going on. --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

2 1

Re: Coffee, anyone?
by Larry Gadallah 17 Dec '03

17 Dec '03

> > Hello, _real_ people and cypher-crypto-pseudo-spoofs! > > I almost fell out of my chair laughing at the recent post > revealing the TRUE identities of half the people (I use that > term guardedly these days) in the mail group. It did me a > world of good. > > Try this on for a quick reality check- this is how I view the > issue of anonymity, trust, reputation, validity, etc. in the > Cypherpunk forum: I see the list as a coffee house, buried in > the bowels of a machine at Berkeley. People wander in and out, > some to chat, others to listen. There is no implied social > contract in place among the participants, really, just some > common interests. For the price of a cup of coffee (my time > and my connection to Internet), I can enjoy stimulating > conversation and shoot the breeze. When people present their > ideas, I take their identities at face value (asking for ID's > before making small talk seems a bit gauche). Every now and > then, a message in a bottle comes sailing through the (open) > door- the waiter pulls the message out and reads an anonymous > posting. Those so motivated can put replies in the bottle and > sling it back outside, where the anonymous poster picks it > up. Truly obnoxious messages can be answered by Molotov > cocktails in the same manner <grin>. > > My point is this: we're in a coffee house, not a courtroom. > If I meet someone in a coffee house and want to do serious > business like buying a car, co-publishing a paper, or betting > my career on a set of equations, I (we) would adjourn to a > somewhat more formal setting and follow entirely different > rules for establishing trust and reputation. In the same vein, > I might listen to a chorus of voices spouting political > agendas while sipping my coffee, but I wouldn't expect the > applause and the catcalls to be tabulated and published as > election results. I agree entirely with Detweiler about the > importance of being able to validate people electronically, > but I think it would be a shame to close the door to the > coffee house, take attendance, and charge admission. > .............................................................. > .......... Philippe D. Nave, Jr. | The person who does not > use message encryption pdn(a)dwroll.dw.att.com | will soon be > at the mercy of those who DO... Denver, Colorado USA | PGP > public key: by arrangement. > Hear! hear! I really _like_ my coffee, and I'd hate to see all the interesting people and discussions frightened off by excessive officiousness in the coffee shop. --- --------------------------------------------------------------------- Larry Gadallah Amateur Radio VE4TCP Lac Du Bonnet, Manitoba, Canada IP: [44.135.114.9] SMTP: larry(a)owrlakh.wl.aecl.ca AX25: VE4TCP(a)VE4PIN.#PIN.MB.CAN.NA ---------------------------------------------------------------------

1 0

Interesting reading
by Anonymous 17 Dec '03

17 Dec '03

From: ld231782(a)LANCE.ColoState.Edu (L. Detweiler) Subject: on the CYPHERPUNKS, PSEUDOSPOOFING, and POISON Sender: news(a)yuma.ACNS.ColoState.EDU (News Account) Message-ID: <Oct24.113641.53933(a)yuma.ACNS.ColoState.EDU> Date: Sun, 24 Oct 1993 11:36:41 GMT Nntp-Posting-Host: jenkins.lance.colostate.edu Organization: Colorado State University, Fort Collins, CO 80523 Lines: 999 Recent extremely unpleasant personal experiences in cyberspace have given me, at the same time, deep scars and deep epiphanies. Following are some messages from the Cypherpunks mailing list generally on the subject of `pseudospoofing' -- the possibility that some people are posting or emailing under *different* `identities' from multiple sites, specifically with the intention of camouflage and deception. I have watched the development of anonymity on the internet with a high degree of personal interest, advocacy, and commitment. But this recent realization of the potentials and extent of `pseudospoofing' has deeply disturbed me. The most shocking realization is not just that it is technically feasible but is possibly *widespread* in certain quarters of the Internet. It alarms me that some are championing pseudospoofing (and what I have been calling `black' posts and email) as `liberating' and `refreshing' under the guise of `privacy' or `true/pure anonymity'. > I suspect the > result will be a more honest dialog, a more productive conversation > freed from posturing and, ironically, from the concealment of threatening > truth. I hope we will observe the resulting new forms of good and evil > with Zen patience and allow this quite interesting experiment to > continue. > It's interesting to see the different mental models that people hold > of the net. To me, this equation that one truename means one persona > is not realistic or reasonable. People spawn personas (-ae?) for > many reasons, including psychological exploration, sociological > experiments, sexual thrills, or just for practice at maintaining > personas. I know of several instances in which one person patted > himself on the back circularly, or took half a dozen sides in a > discussion -- and can surmise about others. This sort of thing may > well happen routinely, [...] > [...] the privacy technology `we' espouse can only promote > this. There is no way to maintain this one-to-one equation when > working with pseudonyms, when the human "dongle on the keyboard" is no > longer a viable identifier. I think the Usenet motto, "Live with it", > applies. > Perhaps "support" is better measured by how many people are motivated > enough to go to the effort to make multiple but individually unique, > reputable posts in favor of a proposition, rather than by > simple numerical polls that abstract away knowledge and > motivation, or by how many True Names position themselves > with I'm-on-your-side posts. The idea of `spawning identities' for `psychological exploration, sociological experiments or sexual thrills' repulses me. It sounds to me like advocation of perversions and multiple personality disorders. And much to my shock, horror and disgust it appears to be a major component of the Cypherpunk philosophy. (I even wonder if the mainstream media has been misled about the true cypherpunk agenda, and so far have not been comforted by anyone `real'.) And the idea that `support' for projects be measured by `how many people are motivated enough to go to the effort to make multiple but individually unique, reputable posts in favor of a proposition' is absolutely bizarre. I have been publicly and privately assaulted and ridiculed so thoroughly, searingly, and viciously in both public and private flames by so many apologists and moral relativists on this subject that it has encouraged a certain degree of personal paranoia. In fact, I cannot count a single strong supporter so far. The whole black affair has opened my eyes to the extraordinary potential for grotesque evils such as manipulation, treachery, conspiracies, and brainwashing possible by combining the openess of electronic forums and `pseudospoofing', particularly in private email. I think that anyone who subscribes to this public internet mailing list should be warned that it may be a bizarre `experiment' in pseudospoofing and brainwashing on unsuspecting or unwilling participants. I certainly would never have subscribed if `I knew then what I knew now'. Its deeply upsetting that I may have been trying to cultivate friendships with nothing but phantoms, parasites, and betrayers on the list and in my personal mail or that this has polluted my other online activities. The bizarre perversions found in my personal mail far surpass everything I have posted here, and have quite traumatized me -- something like virginity violated by a rapist. The evasive, blase, flippant, and cavalier attitude by top `leadership' in the group on the subject horrifies me. (One eminent contributor to the list even suggested to me in email that a secret `elite' list existed or was in the works, presumably free of this reprehensible toxic waste.) Many respondents have taken the position that prohibitions against `pseudospoofing' are equivalent to invasion of privacy and government oppression. One very prominent poster suggested, as an insult, that `state run registries of legal persons' were reminiscent of `key escrow' systems like Clipper! I find this quite ironic, given that such a system already exists, called `birth certificates'! Even more upsetting to me the possibility that this practice of pseudospoofing may be infecting and corrupting mail lists devoted to serious project development of Internet technologies. I fear the openess and freedom of these forums is being subtly and insideously poisoned by increasing pseudospoofing -- perhaps a systematic and concerted campaign. It seems to me that resolution of the issues of identification and authentication are absolutely crucial for future internet development, and that some minor sacrifices in current `freedoms' will be the profound investments required for a harmonious future atmosphere. I will have more to say in various forums on the subject in the future. This is an introduction and background. I hope that eminent Usenet contributors will address the multitudes of issues this raises. I have spent valuable reputation capital in pursuing this matter, and have made many new enemies over the past few weeks, and am sure I will be branded as the new premier cyberlunatic by many, but if I am branded a `paranoid ranter' by terrorists and criminals it will only upset me if they're not in jail. I believe this issue of identification has paramount importance to everyone currently involved in `cyberspace' and its future development, perhaps even the #1 issue that must be resolved for basic progress -- how much authentication and identification is to be required? Note1: see talk.politics.crypto for a `user survey' on the subject and possible future postings. Note2: these postings have been edited slightly. ===cut=here=== To: cypherpunks(a)toad.com Subject: on anonymity, identity, reputation, and spoofing Date: Mon, 18 Oct 93 00:05:56 -0600 From: "L. Detweiler" <ld231782(a)longs.lance.colostate.edu> H. Finney <hfinney(a)shell.portal.com> >After going to enormous efforts to create a network of anonymous remailers, >we are hoist by our own petard, as our list receives strange, irrelevant, >and argumentative posts through our own anonymous remailers. (Not all >anonymous posts are like this, but there have been quite a few in the last >few weeks which fall into these categories.) I've been thinking about this a lot lately. I think a large part of the problem as you indicate is associated with reputation. How does one build up a reputation and identity in cyberspace in general? Part of the problem IMHO is that this list software & the internet in general is extremely vulnerable to a lot of different kinds of spoofing. People are very sensitive to the perception of a `consensus' -- they are deeply influenced by what they perceive to be the `majority opinion'. What if that `opinion' was not an accurate representation of reality? what if a few people were creating the illusion that some different kind of consensus existed? what if that `agenda' were actually something inherently wicked like lawlessness or anarchy? what if a conspiracy created the impression that some project or progress was underway when it really wasn't? or that some person was loudly favored or condemned by the `group'? this could be especially problematic if any kind of intimidation were happening `behind the scenes' in email. who would ever know? unless the dissatisfaction reached the list, how would we find out? another problem is that, at the same time being strongly influenced by a lot of flames, people just delete them out of sheer distaste and they may not be around later for inspection. what really is our assurance that all these email addresses actually exist and represent *unique* people? there really is very little currently. I think newsgroups are far less vulnerable to this kind of spoofing, but unfortunately mailing lists are *extremely* vulnerable. (Keep in mind, there are a whole set of other benefits and detriments in *other* categories which I'm not talking about here.) In the former we have thousands of subscribers all checking on each other's honesty. If a suspicious address or opinion pops up, there is some probability someone will notice, and cases of spoofing would probably be noise drowned out in the representative opinion. Also, distribution is centralized, so that `message blocking' is not very feasible. In the latter case, i.e. mailing lists such as this one, there is a much closer knit community that is geographically isolated. Individuals on the list are far more susceptible to spoofing. People are more likely to see *every* message including the `spoofed' ones. There are far fewer people to `check up' and those that are there may not have the technical expertise. What's worse, the list is not `distributed' in a certain sense. If someone wants to get out the message that `something wrong is going on' it could be censored because of the centralization of the distribution. This wouldn't work with Usenet because the distribution of the messages (e.g. NNTP servers) is generally cleaved from the people with strong self-interests in the traffic (e.g. people who post to group [x]). This cyberspace stuff can be a *very* powerful influence on many. It is an electronic community, and peer pressure is *extremely* powerful. Many people do not have an extremely strong internal `moral compass' and could be influenced by this kind of corrupt magnetism associated with a `conspiracy of spoofing'. Note that reputations are crucial in not only persuading us to listen attentively to those we respect, but to `tune out' the lunatics and criminals. * * * Spoofing Regarding the what also gets my vote as `strangest posting of the year' by `S. Boxx', Philippe D. Nave, Jr. <pdn(a)dwroll.dw.att.com> (based on my email, a loyal cypherpunk and fellow Denverite!) wrote: >[...] it seems that the point of the message is that there is a lot >of smoke coming from people who use aliases or anonymous remailer >services to post to the cypherpunks list. Does this posting contribute >to that problem, or have I missed something? [...] >What the hell ?!? I've either missed something significant (and would >appreciate enlightenment) or this is a candidate for 'strangest post >of the year'. If 'S. Boxx' really exists and is the author of this >posting, I apologize- if not, then come out from behind your damn >remailer and quit contributing to the problem. As for monitoring the >list for traitors, go ahead- I post under my own name, and I don't >give a shit what you do with the text. If I was concerned about lurkers >building 'traitor files', I'd encrypt my messages and happily watch you >choke on them. I think I speak for many here in saying that I weigh anonymous postings very little, but don't consider the capability a serious problem. They have very significant purposes in e.g. `whistleblowing' `within the system' that I've always been attracted to. On the other hand, I think there is an implicit assumption by virtually everyone here that addresses on public posts and private email that are not specifically anonymous represent *unique* people. That is, if some people were taking advantage of the loose, free, and open atmosphere here to influence opinion or perception of reputations by posting messages under different presumably `real' identities (defined as anything that is not obviously tagged as anonymous), I and probably everyone else would feel very `upset' in the least and `violated' at the most. It would seem like a very serious breach of community trust, and might even have the effect of derailing positive contributions to the `cypherpunk cause' (whether algorithmic or political, the two chief schools of thought). I recall discussions of this related to the Extropians list, which specifically bars this practice. * * * List suggestions The fact that this `uniqueness of real identities' has always been something of an implicit assumption here bothers me. I think anything this delicate and important should be made formal and explicit. We should not simply assume that `everone is honest and no one would be depraved enough to do this.' I think the following guidelines are very reasonable, and might be part of a list charter agreed to by new members: 1) list members are allowed *one* anonymous identity if any. They are required to associate some name with all anonymous posts via that identity. 2) *no one* is allowed multiple `real' identities and in fact any violation of this is considered an extremely serious breach of netiquette & honesty. 3) completely anonymous posts from `outside' the list are allowed; if no pseudoidentity is given they are assumed to come from `outside'. and if anyone has been posting under multiple `real' identies, I think they owe it to everyone here to `come clean'. I don't see why anyone would go to the trouble but if someone was just unstable or obsessive enough to equate reputation with posting traffic, s/he might go off the deep end. The practice amounts to `spoofing' and any patriotic cypherpunk with some integrity ought to recognize that immediately and condemn it, technical capabilities regardless. I would equate this practice with `lying to one's colleagues'. spoofing is probably the #1 crime against cypherpunk ideology. * * * Reputations As for reputations, what can we do about this? I think that there are a lot of solutions to be experimented with in software. One of the best is just to have archives that are searchable by ID. But archives are very disk-consuming. I have some various other ideas that wouldn't require much beyond the current database maintenance of email addresses. Suppose that along with everyone's name, the following statistics were presented: 1) how long they have been on the list in days, 0 if none at all 2) how many postings they have posted here 3) maybe a posting/age ratio -- some people seem to be very sensitive or tune out people with a high one. 4) another idea: tracking the number of responses a given poster has, average, per original post, measured by `re: [x]' subject tracking. now, look what we get with all these. They are all simple to implement. They all can tremendously help us weigh the various opinions that are out there. They can set up a positive feedback system whereby `good' posters potentially really are quantitatively identified. Regarding (4), one way to `punish' a poster for irrelevant postings is to simply not respond, and they will not get any `credit' in this statistic. The problem with this is that from my experience, sometimes my most authoritative and finely-crafted postings generate the least response. But note the point of all these things: they don't necessarily require any digital signatures to implement. Authentication of postings `allowed' to the group really seems like a separate problem to me. Another simple idea is to have a voting system in response to postings. People's `credit' associated with their postings could be listed in headers too. This of course is far more ambitious, and the generally complex problem of authentication rears its ugly head. In addition to all this, I would like to see protocols that guarantee honesty on the part of the list maintainer. When databases like this are maintained, a little unilateral tweaking here and there can be extremely deleterious to community integrity, honesty, and reputations. Date: Sun, 17 Oct 93 23:58:08 -0700 From: hughes(a)ah.com (Eric Hughes) To: cypherpunks(a)toad.com Subject: Re: on anonymity, identity, reputation, and spoofing [...] That which can never be enforced should not be prohibited. The claim that a person should have only one pseudonym per forum indicates profound misunderstanding. If someone wants to have multiple cryptographically protected pseudonyms, they will be able to; that is one of the main goals of cypherpunks software. The situations you despise will occur. This is reality. Change your own psychology or change your own software. You will not be able to change the other person. Eric From: tcmay(a)netcom.com (Timothy C. May) Subject: Uniqueness and "is-a-person" credentials To: cypherpunks(a)toad.com Date: Mon, 18 Oct 93 10:17:35 PDT [...] I don't like the idea of state-run registries of "legal persons." Better to live with the occasional vagaries of digital pseuodonyms than to ban them. (And multiple identies can have many uses, some good, some not. Welcome to the future.) Since it may touch on our "cypherpunks agenda," I plan to read up on some of these proposals for "is-a-person" credentialling and see how they might relate to schemes for centralized key registration or escrow. Any suggestion besides the "Crypto" proceedings? --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it. Subject: Re: on anonymity, identity, reputation, and spoofing To: cypherpunks list <cypherpunks(a)toad.com> Date: Mon, 18 Oct 93 3:44:35 PDT From: Eli Brandt <ebrandt(a)jarthur.Claremont.EDU> > From: "L. Detweiler" <ld231782(a)longs.lance.colostate.edu> > On the other hand, I think there is an implicit assumption by virtually > everyone here that addresses on public posts and private email that are > not specifically anonymous represent *unique* people. [...] > 1) list members are allowed *one* anonymous identity if any. They are > required to associate some name with all anonymous posts via that identity. > 2) *no one* is allowed multiple `real' identities and in fact any > violation of this is considered an extremely serious breach of netiquette & honesty. [...] > deep end. The practice amounts to `spoofing' and any patriotic > cypherpunk with some integrity ought to recognize that immediately and [...] > crime against cypherpunk ideology. [...] It's interesting to see the different mental models that people hold of the net. To me, this equation that one truename means one persona is not realistic or reasonable. People spawn personas (-ae?) for many reasons, including psychological exploration, sociological experiments, sexual thrills, or just for practice at maintaining personas. I know of several instances in which one person patted himself on the back circularly, or took half a dozen sides in a discussion -- and can surmise about others. This sort of thing may well happen routinely, particularly in the low-rent areas of Altnet, where participation is a kind of game. What's more, the privacy technology `we' espouse can only promote this. There is no way to maintain this one-to-one equation when working with pseudonyms, when the human "dongle on the keyboard" is no longer a viable identifier. I think the Usenet motto, "Live with it", applies. Eli ebrandt(a)jarthur.claremont.edu From: szabo(a)netcom.com (Nick Szabo) Subject: Re: on anonymity, identity, reputation, and spoofing To: jamie(a)netcom.com (Jamie Dinkelacker) Date: Mon, 18 Oct 93 3:29:08 PDT Cc: cypherpunks(a)toad.com [...] In my limited experience creating Internet pseudonyms, I've been quite distracted by the continual need to avoid leaving pointers to my True Name lying around -- excess mail to/from my True Name, shared files, common peculiarities (eg misspellings in written text), traceable logins, etc. The penet.fi site explicitly maintains a list of pointers to the original address. All kinds of security controls -- crypto, access, information, inference -- have to be continually on my mind when using pseudonymous accounts. The hazards are everywhere. With our current tools it's practically impossible to maintain an active pseudonym for a long period of time against a sufficiently determined opponent, and quite a hassle to maintain even a modicum of decent security. Pointers to info and/or tools to enable the establishment and maintenance of a net.nym, beyond the standard cypherpunks PGP/remailer fare with which I'm now familiar, greatly appreciated. Especially nice would be a list of commercial net providers that allow pseudonymous accounts. [...] I hope that we stick to experimenting with pure anonymity in many venues. I suggest we'll find out that purely anonymous posts are not so bad, overall. Some of the recent stuff has been weird or rude, but so have been a lot of True Name flames that have passed thru this list. We find True Name posts easier to deal with because it's what we're used to. Many are comforted by the thought that as a last resort, if a flame is just too evil, the poster can be tracked down and made to pay for his sins. The WELL was so threatened by the thought of anonymity that they required all pseudonyms to be traceable to the True Name, as an explicit policy right from the start of the system. Pure anonymity in all its manifestations is a strange, threatening, fascinating beast in our panoptic social-welfare world. Even those of us at the forefront of harnessing this monster shrink back in fear when it whinnies. [...] Pure anonymity provide voice for a wide variety of new kinds of expression that up until now have been suppressed. Some kinds are good (whistleblowing), some bad (slander). Most are good or bad depending on the situation (asking embarrassing newbie questions, expressing politically incorrect opinions, discussing illegal activities, etc.) I hope we continue experimenting with pure anonymity for a while longer, as well as experimenting with reputation-based pseudonymous systems. Some of what comes out might look very strange, something like tapping into previously concealed areas of our social psyche. I suspect the result will be a more honest dialog, a more productive conversation freed from posturing and, ironically, from the concealment of threatening truth. I hope we will observe the resulting new forms of good and evil with Zen patience and allow this quite interesting experiment to continue. Nick Szabo szabo(a)netcom.com To: cypherpunks(a)toad.com Subject: PSEUDOSPOOFING Date: Mon, 18 Oct 93 03:41:03 -0600 From: "L. Detweiler" <ld231782(a)longs.lance.colostate.edu> I'm absolutely *horrified* and *nauseated* that eminent cypherpunk leader `ZZZ' has come out in total support of what I have been calling `spoofing' or using pseudo-real addresses to post to the list. (It isn't `really' spoofing in the exact sense because as I noted there has only been an *implicit assumption* by all of us here that opinions from unique addresses were themselves unique. so, lets call it) PSEUDOSPOOFING the activity of misleading people into thinking that an identity is unique when it really isn't! i.e. posting behind `real' addresses not specifically noted as anonymous! I consider pseudospoofing a *detestable* and *reprehensible* activity if it exists. Am I the only one who finds this absolutely *repulsive* and *abhorrent*? How long has this been going on? who has been doing it? am I the first to suspect it is happening? how many debates have been affected? how many people have been *harassed* or *intimidated* or *burned* to a *crisp* by pseudospoofers? is this going on in *private email* too? how many debates have been skewed? how many people here DON'T EXIST? Are the other founders T.C.May and J.Gilmore in favor of this too? how much have you guys been doing this? is this really part of the cypherpunk agenda? who here supports this, anyway? does this have anything to do with the bizarre conspiracy theories posts of `S.Boxx'?! is this why `everyone' is opposed to a newsgroup or other change in the `status quo'?! Is this why *I* get *flamed* so much? is this polluting other mailing lists?! E.H. >The claim that a person should have only one pseudonym per forum >indicates profound misunderstanding. If someone wants to have >multiple cryptographically protected pseudonyms, they will be able to; >that is one of the main goals of cypherpunks software. IMHO, this itself represents a `profound misunderstanding' under what actually constitutes an OPEN FORUM. If we are merely conducting some depraved experiment on the psychology of pseudonymity and pseudospoofing on unwilling participants, please say so! I for one never saw *that* announcement when I signed up! calling `pseudospoofing' `one of the `main goals' of cypherpunks software' sounds *criminal* to me. Or maybe I'm missing the point! I guess this is what anarchy really *is* all about! * * * speaking of OPEN FORUMS, `Jamie Dinkelacker' <Jamie(a)netcom.com> objects to my other proposals for reputation tracking statistics: >> >>1) how long they have been on the list in days, 0 if none at all >>2) how many postings they have posted here >>3) maybe a posting/age ratio -- some people seem to be very sensitive >>or tune out people with a high one. >>4) another idea: tracking the number of responses a given poster has, >>average, per original post, measured by `re: [x]' subject tracking. >> > >Each of these suggestions call for data that may contribute to identifying >individuals, tracking their behavior or providing information useful to >decypher some messages. This has a very NSA feel to it. A very ``NSA FEEL''?! all of these statistics could be generated by *anyone* who subscribes to the list! is this an OPEN FORUM or not?! How could *anyone* object to anything so innocuous? A *true* forum would be *representative*. For example, I already have the impression that no one here supports my suggestions whatsoever on list modifications & protocol from E.H.'s comments and jamie(a)netcom.com. Now, humor me, and take the hypothetical situation that these are the same person! how can this be a `forum' if an opinion is not *representative*? what if a single person just `ganged up' on someone they didn't like by overwhelming them with pseudospoofs? what if there was *truly* support for some project but a pseudospoofer ganged up on the proponents and clobbered them with flames? does this sound anything like what has happened on this list in the past? doesn't it throw every `conversation' on this list into spectacularly *grotesque* doubt? wouldn't that be a lot like intimidation at best and *extortion* at worst? would it look like a `clique'? what if this was happening *routinely*? what if people were being *influenced* by what they perceived was the *majority opinion* or the *views of their peers* that were really nothing but DECEPTION AND LIES? what if it was *thwarting progress*? I would consider this nothing but TREACHERY and HIGH TREASON. is all this really one of the `main goals' of the cypherpunk agenda? if so, SIGN ME OFF. Regardless of whether anyone believes in democracy (a `lot' of people here said they didn't a while ago, but now I have my doubts!) the idea of `one man one vote' is SACRED. it means in essence, one man shall not have UNFAIR INFLUENCE. anything less is just the `Golden Rule: He who Has the Most Gold Makes the Rules'. or, `you can be here as long as I always have more *power* than you do and you don't complain!' it is *anti egalitarian*. it is a recipe for anarchy, dischord and chaos. Or perhaps I'm MISSING THE POINT?! maybe that's what somebody *wants*. is *this* what the Cypherpunks really stand for? UNFAIR INFLUENCE. ABUSE OF POWER. MANIPULATION. DECEIT. TREACHERY. EXPLOITATION. SECRET CONSPIRACIES. Date: 18 Oct 93 14:18:10 EDT From: Sandy <72114.1712(a)CompuServe.COM> To: <cypherpunks(a)toad.com> Subject: DETWEILER ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, Lance Detweiler finished his most recent rant thusly: . . . is *this* what the Cypherpunks really stand for? UNFAIR INFLUENCE. ABUSE OF POWER. MANIPULATION. DECEIT. TREACHERY. EXPLOITATION. SECRET CONSPIRACIES. Lance, stop frothing at the mouth and get a life. S a n d y (aka Tim May, Eric Hughes, Nick Szabo, Perry Metzger, Duncan Frissell, Mao Tse-tung, George Herbert Walker Bush and a cast of thousands) >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Date: Mon, 18 Oct 1993 11:55:46 -0800 To: cypherpunks(a)toad.com From: lefty(a)apple.com (Lefty) Subject: Re: PSEUDOSPOOFING >what if people were being *influenced* by what >they perceived was the *majority opinion* or the *views of their peers* >that were really nothing but DECEPTION AND LIES? what if it was >*thwarting progress*? I would consider this nothing but TREACHERY and >HIGH TREASON. is all this really one of the `main goals' of the >cypherpunk agenda? if so, SIGN ME OFF. Works for me. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:. From: tcmay(a)netcom.com (Timothy C. May) Subject: Time for me to come clean... To: cypherpunks(a)toad.com Date: Mon, 18 Oct 93 12:46:40 PDT My experiment has gone far enough. One of you has claimed that the Net entity "tcmay" (Timothy C. May, putatively) is actually "jamie" (Jamie Dinkelacker, putatively). This person has at other times claimed that perhaps Eric Hughes and Jamie are the same person, and that the Net entity "tcmay" is the "lackey of Eric Hughes." It is all getting so confusing! Allow me to clarify. I entered this list under a variety of pseudonyms, with the intent of compiling information on all of you. I have been posting under the identities of Tim May (who has actually never existed....the man behind the mask on the cover of "Wired" was a hired actor, as were the stand-ins for the personnas of Eric Hughes and John Gilmore), Sandy Sandfort, Jamie Dinkelacker, and many others. I disavow any connection to the paranoid "S. Boxx," however. In fact, I think there are only five actual biological entities on the list. Makes for some good conspiracy theories for the paranoids. Finally, I also write under the nym de guerre of "Dorothy Denning." The real Dorothy Denning is too busy grading papers for her freshman crypto class to post, so I fill in. My real name should be apparent to you all. I knew if I used it, the other four of you would not take me seriously. But now the secret's out. David -- David Sternlight When the mouse laughs at the cat, there is a hole nearby.--Nigerian Proverb From: cman(a)IO.COM (Douglas Barnes) Subject: Re: PSEUDOSPOOFING (lions and tigers and bears, oh my!) To: ld231782(a)longs.lance.colostate.edu (L. Detweiler) Date: Mon, 18 Oct 1993 11:21:22 -40962758 (CDT) L. Det writes: > I for one > never saw *that* announcement when I signed up! calling > `pseudospoofing' `one of the `main goals' of cypherpunks software' > sounds *criminal* to me. Or maybe I'm missing the point! I guess this > is what anarchy really *is* all about! It was one of the main reasons *I* signed up... we were working on a TV show about cyberspace, and Paco Nathan explained public key encryption, digital money, and nyms with reputations in his inimitably cheerful and energetic fashion for our cameras. The part he was most excited about (a part that still fascinates me no end) is the possibility of spawning new identities that can acquire reputations, property, prestige, ignominity, whatever, without the need to appeal to a government bureaucracy for validation. Furthermore, the whole notion that there is some kind of implied contract when you join a free mailing list completely absurd, second only to your notion that we are all pushing for the same political agenda (or should be) because we put our names in the same hat at toad.com. It just ain't so, and no amount of wishing will make it so. And, to cap it all off, I have had more external validation of the physical existence of the key members of *this* data space than any other international data space I participate in; in addition to numerous pictures, I've met a number of the folks, who have, in turn, met a number of the folks... cypherpunks is one of the meetingest mailing lists I've ever seen or heard of. Doug PS: the show never got edited, because Steve and I decided to set up io.com. -- ---------------- /\ Douglas Barnes cman(a)illuminati.io.com / \ Chief Wizard (512) 448-8950 (d), 447-7866 (v) / () \ Illuminati Online metaverse.io.com 7777 /______\ From: szabo(a)netcom.com (Nick Szabo) Subject: SILLY FLAMES: pseudospoofing To: ld231782(a)longs.lance.colostate.edu (L. Detweiler) Date: Mon, 18 Oct 93 5:25:22 PDT Cc: cypherpunks(a)toad.com L. Detweiler -- shocked, simply shocked, at the realization that multiple pseudonyms are possible on the net -- explodes: > ....how can this be a `forum' if an opinion > is not *representative*? Perhaps there are differences between a forum and a voting booth? > what if a single person just `ganged up' on > someone they didn't like by overwhelming them with pseudospoofs? what > if there was *truly* support for some project but a pseudospoofer > ganged up on the proponents and clobbered them with flames? Perhaps "support" is better measured by how many people are motivated enough to go to the effort to make multiple but individually unique, reputable posts in favor of a proposition, rather than by simple numerical polls that abstract away knowledge and motivation, or by how many True Names position themselves with I'm-on-your-side posts. On cypherpunks' better days, "support" is measured by what kind of code gets written, not by who flames whom how often under how many names. Of course we all know that writing code does not constitute *true* support, since only Democracy is The One True Way. > doesn't > it throw every `conversation' on this list into spectacularly > *grotesque* doubt? Welcome to the Internet, Detweiler. Perhaps you might get together some physical meetings in Colorado, talk to more cypherpunks on the phone, look at the pictures in Wired magazine (perhaps also faked?), etc. if you are so concerned about being ganged up on by unknown numbers of strangers. (Is it better to be ganged up on by known numbers of strangers? Why of course, that's called Democracy). > the idea > of `one man one vote' is SACRED. Hallelujah! Praise the Lord & pass the card punch! Let's vote ourselves bigger paychecks & unlimited medical care. Let's take a vote on which cypherpunks tools we will implement. Those who vote with the minority get to do the programming work, those in the majority get to tell the minority what to write. I nominate L. Detweiler President of the Cypherpunks. All in favor say "aye" and bow down to His Holiness of the Veiled Booth! > it is > *anti egaltarian*. it is a recipe for anarchy God forbid! Quick, Detweiler, get out your garlic, raise up your cross and abjure these crypto-anarchists before we spread any further! Next thing you know we'll get some elitist, anti-democratic development like untraceable digital cash. Some people will accumulate more digicash than others, and Detweiler won't even know who they are. Horrors! Quick Detweiler, write your electronic leveling tax protocols before its too late. Better yet, get the majority to vote on making us evil crypto-anarchists -- only a small cypherpunk minority once our pseudonyms are unmasked, of course -- make us write them for you. After all, egalitarian software is a basic human right! > UNFAIR INFLUENCE. ABUSE > OF POWER. MANIPULATION. DECEIT. TREACHERY. EXPLOITATION. SECRET CONSPIRACIES. >... Isn't it just dreadful? Nick Szabo szabo(a)netcom.com Date: Mon, 18 Oct 93 08:02:16 CDT From: m5(a)vail.tivoli.com (Mike McNally) To: "L. Detweiler" <ld231782(a)longs.lance.colostate.edu> Cc: cypherpunks(a)toad.com Subject: PSEUDOSPOOFING "L. Detweiler" writes: > I'm absolutely *horrified* and *nauseated* ... If digicash were a reality, I'd send you some with the proviso that you only spend it on clues. Repeat this chant until you attain enlightenment: Pseudospoofing cannot be prevented Pseudospoofing is a reality of online existance No amount of fear and loathing will make it go away If it weren't for fundamentally new concepts like the ability to pseudospoof (that's a lousy term, by the way), the net would not be the quantum change in human communication and human thought it is. > p.s. if anyone doesn't hear from me for awhile, assume I've been > `liquidated' and this isn't really an `open forum' ... No, I'll assume the ELF-2 running your pseudomind blew a fuse. -- Mike McNally To: cypherpunks(a)toad.com Subject: pseudospoofed out Date: Wed, 20 Oct 93 01:13:18 -0600 From: "L. Detweiler" <ld231782(a)longs.lance.colostate.edu> Cypherpunks, I use the internet for a lot of serious activities, and it deeply troubles me to think that I have been vicitimized by pseudospoofers in areas outside of merely the cypherpunks list such as in the numerous FAQs I edit (a very time consuming endeavor) or in my other favorite mailing lists. I feel like my blood has been drained by parasites that suck my prose and passions. Since there is absolutely no support for any `True Names' here whatsoever, I volunteer to drop the subject. And of course I am just another blip on this list, so my ideas for its improvement mean nothing, and I will not *ever* make a proposition again here regarding the subject. however, A PERSONAL REQUEST I humbly request that ANYONE SENDING ME PERSONAL MAIL have the decency to do so under their `True Name' or `obviously anonymously' under the same identity. Do not deceive me for perverted sport. Do not try to build up trust merely so that you can betray it. Do not manipulate me simply because you have the capability or because I am a basically trusting person. This sentiment is equivalent to something like `if a woman doesn't carry a gun then it's OK to rape her' and it is one of the most alarming aspects of what I have seen promoted here and in the general `hacker' community. `nothing is wrong if you can get away with it.' I believe that there is no such thing as a `consequentless action'. Please, do not drag *me* into the gutter because you like to wallow there. If anyone has deceived me in manipulating me with multiple pseudonyms in my personal email, please inform me *now*. I believe this is the absolute least that *anyone* could ask on the internet. Another point to make is that Usenet & current mailing lists are far from the future models. I fundamentally believe that `true name' systems are entirely socially desirable and can be erected without invading privacy. Anyone who claims that `true names' and `privacy' are fundamentally incompatible is simply mistaken. Does `absolute privacy' mean that no one *ever* knows who *anyone* is? It seems to me the ability to differentiate identities or reject their input based on `true names' is a basic right of the listener. You do not have a right to bludgeon me with identical opinions from an unrepresentative arsenal of imaginary identities. I suspect some of the people advocating `absolute privacy' are themselves currently using powerful tools to detect pseudospoofing others do not possess. Is that the cypherpunk Utopian ideal? A place where you can manipulate people without them knowing it? let others drown in mud while you trample atop their backs? Also, please do not deceive the press. T.C. May has recently satirically suggested that some of the Wired pictures are of hired actors. I don't find this funny. If the `cypherpunks' are really something other than that which they claim, it will eventually and inevitably come back to haunt the `movement,' whatever it is (algorithms or ideology? I no longer care). History and society is far more shrewd than that. If pseudospoofing is really the #1 cypherpunk agenda, please make that clear. `We want to fool everyone with brainwashing techniques so they are at the mercy of our whim.' One of my attractions to cyberspace was the promise of making online friends, and I have made many over many months. But the idea that some psychopaths are sending me email just to leech my strong emotions and play with my passions, like a cat does a captured mouse, perhaps even with the support of a large and complex software `arsenal' designed specifically to promote camouflage and manipulation, perhaps on a very widespread scale involving multiple lists, I find reprehensible and inherently evil. Please, choose another lab rat victim. My whole `cyberspatial reality' has been cast into doubt. Who's real? Who's fake? I used to really look forward to reading and responding to my mail, but now I approach it with dread, horror, and nausea. I don't even know if who I am talking to on the phone is who they say they are anymore, or if I really have any true cyberspatial friendships, because of all the pseudospoofing in my mailbox. There are some among you who say `welcome to the real world'. Are you people saying that man's natural state is confusion, desperation, and paranoia? I am not opposed to `pseudonymity' and multiple reputations of course. But the strong sentiments on this list that I should be kept *guessing* I find abhorrent. What is most disturbing is the possibility of a single entity attempting to stick someone's psyche in a vice by systematic and concerted assaults from multiple supposedly `unique' identities in private email. This is like dealing with a tentacled octopus-monster. What could be more depraved? This is nothing but vicious interrogation and brainwashing. I'm simply in favor of truth in advertising, and I think this list has been misrepresented as a `forum' when it's nothing but a hotbed of pseudospoofing, possibly even aided by automatic software tools. Someone tell me, how long have I been arguing with AI programs anyway? Trully, I never would have subscribed if I had realized the `practice' of pseudospoofing was epidemic. I mean, I suspected there were isolated cases, but now it appears a large part of traffic is manufactured flames and froth. Does anyone have any idea how much time has been wasted wading or even arguing with opinions that were nothing but mirages? I'm deeply disillusioned. But of course, who cares? Certainly not the leadership or the followers. I'm not sure that some of the `identities' I've been dealing with over the past few months really have any basic morality. I suspect there are some demagogues that tout `privacy' while really subtly and insideously promoting dishonesty, sociopathism, treachery, and barbarianism. An example: I am on another mailing list where I posted a long article as a `gift' to the subscribers. I got some favorable comments, except from the moderator who said that `people are shocked at what you did.' I asked him. What people? What did they say? He backed down. But imagine that someone slandered me with a worthless pseudonym? and, in fact, even if they mailed *me* would I be able to tell that they didn't care about the reputation of that pseudonym? It seems to me that there is a basic idea of reputation and postings. To a degree, if you haven't earned a reputation in some subject, you should be disqualified from pontificating on it, irrelevant of your arsenal of pseudonyms. Filters based on reputations may help make this a reality. (I would personally like to ban my mailbox of all opinionated pseudonyms who have not read more than 2 of my posts.) I remember `ZZZ' once announcing to the list that J. Markoff had unsubscribed. Who's really in favor of privacy? Is everybody here really interested in `privacy' as an `offensive weapon'? `Privacy' as a way of evading taxes? `privacy' as a way of manipulating or betraying the gullible and trusting for perverted pleasure? `privacy' as destroying social order and promoting anarchy? Really, nevermind. please, don't send me any more blistering flames. These are rhetorical questions. In fact, this is a rhetorical essay. Date: Wed, 20 Oct 93 08:30:42 CDT From: m5(a)vail.tivoli.com (Mike McNally) To: cypherpunks(a)toad.com Subject: Re: pseudospoofed out "L. Detweiler" writes: > [ the funniest thing I've read on the net in years. ] Thank you, thank you, thank you *all* for making this possible. The hours of cleaning crud from my INBOX are *easily* worth this kind of entertainment. I am literally in tears, irritating my officemate with incessant laughter. Mr. Detweiler (if that really *is* your name), thank you especially. You write well, kinda, even if I utterly disagree with you. I think I'll print this out and paste it into my big unabridged next to "hyperbole". -- Mike McNally Date: Wed, 20 Oct 93 08:22:25 CDT From: m5(a)vail.tivoli.com (Mike McNally) To: cypherpunks(a)toad.com Subject: pseudospoofed out "L. Detweiler" writes: > I feel like my blood has been drained by > parasites that suck my prose and passions. I hereby claim this as a .signature for at least one of my identities. -- Mike McNally -- ld231782(a)longs.LANCE.ColoState.EDU

1 0

Re: Subliminal Channels
by msattler＠netcom.com 17 Dec '03

17 Dec '03

I can barely believe *I* am saying this, given my penchant for nibbling on topics only somewhat near crypt, but IMHO it's time for y'all to take this elsewhere. Since it seems to have degenerated into a "is not, is too" exchange between chrome(a)jhunix.hcf.jhu.edu and rjc(a)gnu.ai.mit.edu, I suggest you two continue via email. And *no* using subliminal ascii.... ----------------------------------------------------------------------------- Michael S. Sattler msattler(a)netcom.com +1 (415) 621-2903 Digital Jungle Software Encrypt now; ask me how. (finger for PGP key) All that is required for evil to triumph is for {wo}men of good will to do nothing.

1 0

Content vanquishes PSEUDOSPOOFING
by jamie＠netcom.com 17 Dec '03

17 Dec '03

Members of the True Cause and Final Movement: Someplace in all this 'pseudospoofing' bandwidth, maybe once in a while, it's worth looking at the _content_ of a message. Some mail I read, some I don't; but when I do, I attend to the content. If it's interesting, or new, or informative, or funny, or sometimes pathetic, I pay attention. I don't care who/what wrote it. I'll make my own decisions whether it's news or entertainment, science or fiction. To quote Whitehead, "Ideas have consequences." (So does behavior.) -- ................................ Jamie Dinkelacker Palo Alto CA Jamie(a)netcom.com 415.941.4782

1 0

Re: ADMIN: proposed new policy on the mailing list
by plaz＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN UNSIGNED MESSAGE----- >I don't think restricting participation to signed messages >is a good idea until we have some way of verifying a >signature automatically before allowing it to be posted. Actually, Eric wasn't suggesting restricting participation, just putting a delay on it. But you're right. This proposed policy is pointless. I would probably end up copying and pasting a bogus signature (not bogus for somebody else's message, but bogus for mine) into my message to avoid the delay. The policy, as it stands is rediculously easy to circumvent. I suspect that this would be even less effective than the national 55 mph speed limit. >How do we prevent people from registering a key in >someone else's name??? It's beyond me. You can't. There is simply no way to kill pseudo-spoofing without coming down on the whole internet with a massively intrusive security system. It certainly isn't worth it to me, to hand the net over to big brother to avoid people posting under various aliases. You'd almost certainly end up losing anonymous posting as well. PS - Eric you can take this as a vote "NO". -----END UNSIGNED MESSAGE----- _______________________________________________________________________ Geoff Dale -- insert standard disclaimers here -- plaz(a)netcom.com "We are the shock troops of reality." - Voice of the Friends (Wild Palms)

1 0

Totally Anonymous Remailing
by Robert J Woodhead 17 Dec '03

17 Dec '03

Just toying around with some ideas, and came up with this: Totally Anonymous Remailing (V1.0) An "TAR" goes active on the net at site anon.com. It publishes a Public Key. 1) Creating an anonymous ID. A User sends message to create-id(a)anon.com, encrypted with the TAR's Public key. The message contains four elements: A Public Key generated by the User. A Proposed Pseudonym (ie: "Artful-Dodger") The Proposed Pseudonym encrypted by the User's Private Key. At this point, the TAR can verify that the new user isn't spoofing by giving someone else's public key. It does not reply to the email message, nor does it store the source (which in any case could be another anonymous remailer). If the new Pseudo isn't in use, it gets allocated. If it is, it does not. 2) Sending mail to an anonymous ID Works the same as sending mail to anyone else. However, on receipt it is immediately encrypted with the recipients Public key and placed in a Mail queue. It is _not_ automatically forwarded. 3) Using an anonymous ID. The User sends a message to use-id(a)anon.com, encrypted with the TAR's Public key. The message contains the following: The User's Pseudonym (ie: "Artful-Dodger(a)anon.com") Command Command Specific Parameters The Command and Parameters are encrypted with the User's private Key. This has several nice features that will become apparent later. If the command contains errors, or does not decrypt properly, the anon mailer places an error message into the Pseudonym's mail queue, but does not otherwise reply. Commands would be typical: MAIL <username(s)> { CC <username(s)>} { BCC <username(s)>} { SUBJECT <whatever>} <message> Sends <message> using psuedonym. <messages> ought to be encrypted. POST <newsgroups(s)> SUBJECT <whatever> <message> Posts <message> using psuedonym. You could verify your pseudo was accepted by posting to a worldwide test group. SEND <destination> Sends accumulated mail, in a batch, to the email address specified. So you can log on to any account, even a guest, and get your mail. and so on. Might be nice to make it a shell on top of something like MH, and allow you to manage your mailbox remotely and anonymously. BTW, none of this double-blind crap. If someone wants to reply anonymously, they ought to create their own pseudo. Anon-net: Note that use-id@ has a nice property. Assume there is another anon server, noname.com, which gets a message, encrypted with it's public key, that is a command for Artful-Dodger(a)anon.com. It can simply re-encrypt the message with anon.com's public key and pass it on, never having seen the command because it is encrypted - and only anon.com knows Artful-Dodger's public key, because Artful only sent it to anon once, encrypted with anon's key. The extension - several anon sites passing mail back and forth regularly (all encrypted batches containing several real and fake messages) - is obvious and makes traffic analysis more difficult (especially as the number of sites goes up). There could also be a facility for one-shot "bounces," the ability to use the anon site to bounce an email to a restricted number of addresses (typically, other anon sites). So you could email to noname (using noname's key) and have the message bounced to anon. So you could have an account on anon and yet never directly send email to anon -- it would never at any time have any clue as to your identity. Of course, you'd have to trust the software. And some work needs to be done to ensure the net stays viable even if some of the sites have been subverted. This is only a first draft, probably many mistakes. Comments?

3 2

Off-shore banking and Steve Roberts' flotilla
by Sameer 17 Dec '03

17 Dec '03

I could have the name wrong here. If so, my utmost apologies. Are people here familiar with Steve Roberts, the guy who had a bike called "BEHEMOTH" which he rode around the country, while connected to the networks? He's temporarily settled down now, and planning his next project, a technomadic flotilla which would be a bunch of technomadic folk who would like to live outside the boundaries of any national jurisdiction, touring the world, and earning a living while doing it. One potential income for these people I think, would be an off-shore internet bank implementing digital cash. It might be a good idea for some cypherpunks (Sandy? You said you found an investor, right?) to get in touch with the flotilla-folk and see if something could be arranged. (I'm sorry, I don't have any email addresses on hand.)

1 0

Re: Net Regulation
by Duncan Frissell 17 Dec '03

17 Dec '03

B >From: bill(a)twwells.com (T. William Wells) B >I mostly agree B >with your statements and wish you wouldn't weaken them with B >worthless supporting claims. I'm glad. B >The permanent tourists, of course. The state is, when all is B >boiled down, an instrument of force and it functions most B >"effectively" when it limits itself to that. I guarantee you that B >if the US wanted to crack down on this stuff that it would be B >gone. This year, a third of the prison population is from B >drug-related "crimes"; if they got a bee in their bonnets, you B >and I and a whole lot of other people could take their places. B >(Not, mind you, that I think this'll happen. But it *could*.) Permanent Tourists are outside US jurisdiction. You could grab a very few but only a few. You couldn't affect the non-US persons earning their dough on the nets at all. That's the point of the nets that "foreigners" can be Americans and Americans can be "foreigners" without any loss of income. Once developed, the ability to work from anywhere to anywhere is powerful. It makes one much harder to control. Consider, small cash-intensive businesses located *in* the US report less than half of their income to the government (according to IRS studies). That is among people completely subject to US jurisdiction. B >Yes, that could be prevented, but it won't be prevented by what B >the cypherpunks are doing. Sooner or later, the bodies would have B >to meet the bullets. That's the way of the world, alas. Actually, such problems are rare in the OECD countries. Most enforcement here is indirect. People obey because of fear not direct application of force. Reduce the fear and you reduce the obedience. The threat we represent is a bit to abstract to sell the government on an all-out campaign against us that would be difficult and expensive. I don't think the Feds would "go to the mattresses" to fight us. Duncan Frissell If the KGB and the Stasi couldn't prevail against the winds of institutional "rightsizing", what chance does one aging dyke have? --- WinQwk 2.0b#1165

2 1

A MODEST PROPOSAL
by Sandy 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, I'm tired of playing with L. Detweiler's head on the Cypherpunks list. Let's up the ante. I think we (in northern California, at least) should play with his head in person! I hereby pledge $20, and ask for sufficient matching pledges, to buy Lance, Larry or whatever his REAL name is, a ticket, etc. to come to our next meeting. The offer, though, comes with certain . . . conditions. To take advantage of this offer, Detweiler must agree first post a list of Bay Area Cypherpunks he thinks are fictitious. If we can't produce those people with "official" IDs, we pay him $100 over his round trip air fare, we put him up in a nice hotel and we get him laid. If everyone is "real" we don't pay him squat, and we get to "pants" him on the lawn in front of Cygnus. To quote one of my many avatars, "Works for me." Right, Tim? >"Right, Sandy!" Right, Nick? >"Right you are, Sandy!" Right, Perry! >"You're right as rain, Sandy!" Okay, Alvin? . . . Okay, Alvin? . . . ALVIN!!!!! >"O-kaaaaaay!" S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

on the term `signature'
by L. Detweiler 17 Dec '03

17 Dec '03

Consider the term `signature' in the conventional connotation of a handwritten scrawl. What are the *critical* properties of a handwritten signature of a person [x]? 1) no person [y] can `forge' the signature of [x] 2) the signature of [x] is unique to [x] Look closely at (2). What value would `signatures' have in our society if they could not be traced to unique individuals? Virtually everyone here will probably say `no problem' but this aspect is a very critical aspect of the legal basis for signatures as a certificate of identity. If a person cannot be traced based on their digital signatures, where is the accountability? What if a person signs a document with a `digital signature' and *breaks* that contract? you have no recourse unless the identity is ultimately identifiable and you can take `that body' to court. This `two way street' is the crucial ingredient for the legal value of handwritten signatures. A person can indicate they consent to an agreement or certify something as genuine originating from themselves (one way). But on the other hand, if the agreement is broken or there is some question of authenticity *independent* of the signature (i.e., suppose someone has broken the signature security) there is recourse in retracing the path back to the original signer (the other way). Many here are championing that the loss of (2) with `digital signatures' and completely untracable identities is `liberating'. But there is a price to pay, perhaps very great. It is simply an unworkable system anywhere serious accountability is required (such as related to a job, etc.) Sure, if all people want to do is get into twisted debate contests, the absence of (2) certainly encourages it (speaking from experience). Because digital signatures alone are not really strictly analogous to written signatures because of the lack of property (2) above, perhaps a better term would be `identification tag'. Adding the guarantee that a given signature can be traced back to a human entity, with the use of a database or otherwise, makes them truly `digital signatures'. please cc: me in any replies.

3 2

A favor re Detweiler
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'd like to expend some "reputation capital" here and ask people for a favor. I am worried about Larry Detweiler's obvious mental anguish. We tend to forget that we are dealing with real people on the net, flesh and blood human beings. Larry is obviously going through genuine difficulties here. As a member of our virtual community, I ask that we show him some compassion and consideration. Larry believes that people have been communicating with him in private mail under multiple identities in order to confuse and mislead him. Specifically, he has suggested that Jamie Dinkelacker is a pseudonym employed by Tim May. I gather that he has received email from both names. He also suggests that others have employed these practices. Since I do not live in the Bay area, I have never met Jamie Dinkelacker, although I had the opportunity to meet Tim once when he visited southern California. So I am not in a position personally to assure Larry that Jamie is a real person separate from Tim. But I know many list members are in northern California and I assume several of you have met both Jamie and Tim. I ask those of you who can vouch for Jamie's separate identity to send me private email saying so, which I will forward to Larry. If enough people can do this, perhaps a PGP-style "web of trust" can be established which will reduce Larry's concerns about this particular case at least. (I have considered the possibility that Jamie actually is a pseudonym employed by Tim. This is certainly not inherently impossible, given the structure of the net. As I told Larry, I myself have occasionally posted under apparently-legitimate pseudonyms in other times and places, although never on this list. I certainly don't attach the moral significance to the practice that Larry does. Nevertheless, in this particular case, the situation is so obviously causing mental suffering that I assume that if Larry's charges were true that Tim would have confessed in order to spare Larry this pain.) I know that it's easy to just write people off on the net, the various marginal or fanatical personalities whom one runs into now and then. That is why I am asking this as a personal favor. If you have read and appreciated my essays on digital cash, or on the various legal issues involving crypto exports; if you have used the remailer code I worked on, or PGP for that matter on which I spent hundreds of hours of personal time, then I ask that you help me out with this request. Do it as a favor to me regardless of your feelings for Larry, and I will just hope that my efforts will bring him some peace of mind. Thank you. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLMr+6KgTA69YIUw3AQHCawQApGA27Q+lmrzsN9qpG3Af9DfJLfdHTlWG Ic6FQKNqjfliLHR/z/iVSDTGKIiRRuZm4ZBqARQAvp4jaOBymcWcd5y1/jCPDQto PZjlq6ksvvdpgsQsV2DiwAlRxS9wdo7E+gvmDWJ8tXBApRloATWv4ZQ9AFUwF1Nx jp56uZsaTxs= =91Uh -----END PGP SIGNATURE-----

3 2

Chris Odhner?
by mench＠cs.unr.edu 17 Dec '03

17 Dec '03

please send me mail, chris, this is Pete, the guy who made all those goddamn big brother insdie stickers for you. pete

1 0

Apple, AOCE, and key pair security
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A few months ago, I posted an excerpt from a MacWeek article re AOCE (Apple Open Collaboration Environment), a collection of services to be integrated into the Mac OS to facilitate groupware apps. The MacWeek article said that users would receive their public keys (to be used for digital signatures on documents) from RSADSI, instead of generating them themselves. Scott Collins wrote to disagree, saying that the AOCE software he'd seen didn't work that way. I E-mailed the author of the original article, who stood by what he wrote, saying that "very good sources" said that the keys would be provided to users by outside, allegedly trustworthy, sources. According to the 11/93 Macworld, users will not, in most cases, generate their own key pairs: "When you receive a signed digital document, how do you know that the signature is legitimate and that it isn't from a pretender? In many ways, your digital signature is similar to a credit card; it is issued by a known authority, it has an expiration date, and you can verify its validity. To get your own digital signature from RSA, you take a form to a notary public, who verifies your identity, notarizes the information on the form, and then mails the form to RSA. Based on the notary public's authority to say you are who you claim to be, you eventually receive a disk in the mail with your personal electronic signature. Your electronic signature has a two-year expiration date, and includes some verification information. If someone wants to make sure your signature is valid, he or she contacts the issuing authority listed in the certificate. There will be issuing authorities other than RSA. For example, Apple Computer's security department plans to issue signatures to all Apple employees with employee badges." "AOCE, Apple's plan for groupware", Macworld, 11/93, p. 167. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLMtl4X3YhjZY3fMNAQHyFwQAgz42oEoWb3okT1pZt/buyIhpPls8hMFT WzvhVYSxQnaYzRz5jHRl0YdLUivW71dgHWTKffasZhMAd05Bn3t6m3LTz8zPc4sx LfgN4yvFTl/foepVegzMZPPoDnhb5Sp46cAC0O3+fgaCrmasZaoHIWNBRKsz0wnv hh07sCIsswM= =6i+9 -----END PGP SIGNATURE----- -- Greg Broiles greg(a)goldenbear.com Baked, not fried.

1 0

S.Box and LD SAME???
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Subject says it all... I think these 2 are the same person... bloody idiots sam hill ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

Signing Messages & Other Ramblings
by Panzer Boy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- First, I would like to make sure that Eric Hughes knows that by his simple little push he has gotten someone (me) to install some code for Emacs to auto-sign messages. This, with external editing capabilities of Pine, allow me to sign all my outgoing mail extremely easily. If anyone would like help on this, just send me mail, and I can explain how to do it. L Detweilers obvious disliking towards people not being who they say they are. This is an obvious problem with the net. The net is based on a model of people trusting everyone else. Nothing that is posted or or sent out from net machines has verification on it. Currently this implies that the users need to do their own verification. Creating software that automatically handles signatures in and out, handles the fact that every machine but your own is not to be trusted. Assuming that people are going to be truthful and nice to you all the time is a nice fantasy, yet it rarely happens. It does happen more often on the Net than it does is "Real-Life" though. I have spoofed mail before, mostly as a joke among friends. All of my "targets" were told sooner or later about the joke. Because this information is not new to me, I don't expect all mail to me to be originating from the person it says it's from. You must judge incoming mail, and posts, on their content. If you have questions about the content than demand some sort of proof of who they say they are. People have said they feel "RAPED" when they discover they are talking to people who aren't who they say they are. "Raped" is a harsh word, but chosen obviously for it's violent connotations, even if these connotations are a bit wrong. Being the target of "spoofed" mail is like being conned, obviously no one likes be show that s/he is ignorant. It hurts, but at the same time, you shouldn't expect everyone to play by the "honor-system". When I read mail from people I usually assume it is from the person in the "From:" line. But if the mail is something absurd, or controversial, then I don't automatically assume this. If for example there was a post from Hal Finney about the great new digi-cash system that he had implemented and that it had financial banking from a rich middle eastern country. I would probably check the signature, and then even after that I would probably still wait and see if it was a "black-net" post. Well, this post has gotten to the length were many people will probably not read it, so I will stop here, and continue with some other comments about the new anon-remailer tomorrow. -Matt | Use the normal means to extract my (panzer(a)drown.slip.andrew.cmu.edu) | public key for proof of this message "That which can never be enforced should not be prohibited." -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLMs3K+aKxB8nktcBAQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvtox PkXyfYKnOlzsIjp2toust1Q5A3/n54PBKrUDN9tHVzui6XaCZmKH68fOWYYySKAz 6hanC0R3seYNhUYhoJViCcCG3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht sRjLQr4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

Re: A favor re Detweiler (ha ha ha)
by jamie＠netcom.com 17 Dec '03

17 Dec '03

Hal Finney says: > >Since I do not live in the Bay area, I have never met Jamie Dinkelacker, >although I had the opportunity to meet Tim once when he visited southern >California. So I am not in a position personally to assure Larry that >Jamie is a real person separate from Tim. > Hello, world. Here's a novel thought: let's cut to the chase. My phone number is in my .sig block. Tim's in his. Call each of us back-to-back and have a 3 minute conversation with each. If the caller can't tell that we are different individuals, well ... . Do we sound the same? Are there accents? What about our speech speed and rhythm? Word choice? Sentence structure? If this is an issue to Detweiler, why hasn't he put his suppositions to the test by picking up the phone and, like a responsible adult, identifying himself for a conversation. Instead, we get net.waste.bandwidth. The only person to resolve this is Detweiler (unless Sniveling.Boxx takes me up on my lunch offer and could then vouch for the distinctions between me and Tim). If Detweiler really wanted to know the answer, he could find out for himself. Why should others support his "learned helplessness?" The only reason Detweiler has not executed this test is that he avoids truth. Is Detweiler aka Sternlight? Is that what's really being hidden? Is this all a deception distracting us from the NSA/Straumli perversion? I don't care about his anguish because I personally believe he's fabricated it to toy with us and distract us. But, I must admit, if I'm to be associated with anybody, Tim's not a bad choice: he's brilliant, articulate, wealthy, independent, good-looking and has great taste in music and friends. Not bad things to be nymed with. Hal, I invite your call. Call me mid-mornings PDT. As you know by private email I've sent you, I truly appreciate your posts and learn from them. Call me for a chat. Find out for yourself. C'mon Detweiler, cut to the chase and face the truth. Sheeesh, how can we miss you if you don't go away? ... (sigh). -- ................................ Jamie Dinkelacker Palo Alto CA Jamie(a)netcom.com 415.941.4782

3 2