December 2003 - cypherpunks-legacy

Beware of forged messages
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Someone recently posted a forged message with my name on it to the Cypherwonks list. In the future, all of my messages will be sent PGP-clearsigned. Please ignore (or mail to me) any messages which aren't - particularly if they appear to support Detweiler and his totalitarian schemes, which this particular forgery did. The header of the message in question was a byte-for-byte duplicate of an authentic header from a message I did write; apparently our favorite cyberspatial lunatic has moved beyond just signature blocks. -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLTDdcH3YhjZY3fMNAQGwigQAtPhZpZoC8SXR0tstHQgabIVLq04jzTNz kWOibwRd4Zvvs+tnxkKhkMQU2qR13e4Go0N/RV19cVpqA2Yr3DEnCkCbqKnVz54V qK6Pyu+fw3wNROobzCAsTZw25H4zRgqmxjkSW7hbIQVU35mZt+pLn23BKV+ck3L4 cdZeOer6Q7w= =MXpV -----END PGP SIGNATURE----- -- Greg Broiles "Sometimes you're the windshield, greg(a)goldenbear.com sometimes you're the bug." -- Mark Knopfler

1 0

Forged messages part of "Operation"?
by Mike Ingle 17 Dec '03

17 Dec '03

"greg(a)ideath.goldenbear.com" writes: >Someone recently posted a forged message with my name on it to the >Cypherwonks list. In the future, all of my messages will be sent >PGP-clearsigned. Please ignore (or mail to me) any messages which >aren't - particularly if they appear to support Detweiler and his >totalitarian schemes, which this particular forgery did. > >The header of the message in question was a byte-for-byte duplicate >of an authentic header from a message I did write; apparently our >favorite cyberspatial lunatic has moved beyond just signature blocks. This message forging may be about to become a major problem. In his last post "Current Operational Status", S.Boxx spewed forth: (I hereby flame myself for quoting Detweiler - so don't bother) ---snip---snip--- Operation Octopus - this is the multiple pseudonym and agent project. We plan to have at least a dozen (hence the name) posting simultaneously to many different lists and the newsgroups. But the overhead on this is very significant, and it will take us awhile to gear up and build the infrastructure to the point we can `engage'. You have seen more of these agents lately `out there', but our coordinated attack will take some more planning. Operation Duplicity - extremely top secret. Let's just say, you will be seeing double, and triple, and quadruple, and ... ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ---snip---snip--- If he starts flooding the newsgroups, what can we do about it? I'd watch for forged messages and posts, and if you don't have a key on the servers, check to make sure a forged one isn't posted. --- Mike

4 3

Twelve year flashback to Admiral Bobby Inman
by gnu 17 Dec '03

17 Dec '03

San Jose Mercury, January 8, 1982 (EIGHTY-two), page F-1 CIA boss assail high-tech leaks [The Washington Post] WASHINGTON -- Adm. Bobby R. Inman, deputy director of the CIA, Thursday predicted a "tidal wave" of public outrage and laws restricting scientists if scientists do not agree to voluntary "review" of their work by intelligence agencies. Scientists had better cooperate in making some of their papers secret voluntarily, or they will face tough laws restricting them, Inman told a panel session at the annual meeting of the American Association for the Advancement of Science. Scientists should beware that there are congressional investigations now in progress that will point up the "thoroughly documented" fact that in the buildup of Soviet defense capability "the bulk of new technology which they have employed has been acquired from the United States," Inman said. When the details of this "hemorrhage of the country's technology" come out in public, Inman said, there will be a "tidal wave" of public outrage that will lead to laws restricting the publication of scientific work that the government might consider "sensitive" on national security grounds. "The tides are moving, and moving fast, toward legislated solutions that in fact are likely to be much more restrictive, not less restrictive, than the voluntary" censorship system he has suggested, Inman said. When he was director of the National Security Agency, the codemaking and breaking intelligence agency, Inman led an effort to get prominent private researchers to submit their papers on the mathematical theory of codes to his agency before publication. The NSA also briefly put secrecy orders on some of the private code research in recent years. But in April 1981, cooperation among the National Science Foundation, the American Council on Education and the NSA resulted in a voluntary review system under which scientists can submit their papers to NSA for review and receive a judgement on whether they possibly contain information damaging to the national security. Since then, about 25 papers have been reviewed and none had problems, according to Daniel Schwartz, until recently chief counsel for the NSA. "There are other fields where publication of certain information could affect the national security in a harmful way," Inman said. These include the fields of "computer hardware and software, other electronic gear and techniques, lasers, crop projections and manufacturing procedures." ------- The above news article ran twelve years ago. His tidal wave of crypto censorship didn't appear; instead, a wave of support for free expression ran through the scientific and library community. About half of the technical societies amended their by-laws to disallow closed or censored meetings or conferences. I wonder if Admiral Inman feels the same way today, as he faces Senate confirmation hearings as Secretary of Defense. Will we be seeing the same sort of proposals? How does he feel about export controls on cryptographic software? What should be done with the Skipjack program? If you wonder too, please ask your Senator to ask him about it. Seriously. John

2 1

Re: Forged messages part of "Operation"?
by plaz＠netcom.com 17 Dec '03

17 Dec '03

>Mike Ingle says: >> If he starts flooding the newsgroups, what can we do about it? > >If he starts forging mail from other people, he's committing a crime >and we can get his system administrators to pull his account. > >Perry Any plans or tips on how to prove it in court? _______________________________________________________________________ Geoff Dale -- Cypherpunk/Extropian -- Plastic Beethoven AnarchyPPL - Anarch (Adjudicator) ExI-Freegate Virtual Branch Head plaz(a)netcom.com 66 Pyramid Plaza plaz(a)io.com Freegate, Metaverse(a)io.com 7777 "Subvert the domination paradigm!"

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

someone keeps sending me amusing messages encrypted with key ID 548D21. either you have failed to find my proper key ID or have succeeded in your practical joke.

1 0

Re: Crypto not being used where needed
by smb＠research.att.com 17 Dec '03

17 Dec '03

Although I sincerely agree that the data should be encrypted, is it really that easy to intercept cellular phone calls? I thought you had to go to considerably more effort than programming a scanner to pick up these transmissions - I don't know much about cellular phones, but I thought they hopped frequencies and so forth such that it was a real pain to listen in. Yes, it's really easy to monitor cellular calls. They only hop frequencies when you move between cells -- and most cop calls will be within a single cell, simply because most of the queries happen *after* they've pulled someone over. Things will change somewhat with the so-called personal communicators, since they'll use much smaller cells -- but the basic problem is still the same.

1 0

Re: Crypto not being used where needed
by peter honeyman 17 Dec '03

17 Dec '03

it is trivial to monitor cellular calls. until recently, bearcat scanners included this capability. and i have seen it done on an oki 900 handheld. peter

1 0

IIA, more info
by szabo＠netcom.com 17 Dec '03

17 Dec '03

This just in: -------->snip<-------- The message below was written by a friend who works at UUNET: --- begin included message --- Actually, we set them up. They appear to be real. Note, this is not an endorsement!!! I have no dealings with iia.org directly. I know only what I've heard around the office. They dropped big bucks for a router just for this service. The guy who sent that message appears to have been looking in all the wrong places. Military hosts tables are infamous for their incompleteness and for their tremendous lag time. Whois does indeed have this site's info, and has since December! The sender probably looked in the DDN whois DB which is only for MILITARY SITES. The correct site to check for everything else is rs.internic.net. [ken@rodan(tcsh):107] whois iia.org International Internet Association (IIA2-DOM) 30 South First Avenue Highland Park, NJ 08904 Domain Name: IIA.ORG Administrative Contact, Technical Contact, Zone Contact: Bochicchio, Charleen (CB45) char(a)JOY.ICM.COM +1 202 387 5445 (FAX) +1 202 387 5446 Record last updated on 01-Dec-93. Domain servers in listed order: MARY.IIA.ORG 198.4.75.9 NS.UU.NET 137.39.1.3 The InterNIC Registration Services Host ONLY contains Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information. Someone in our office did send for info and did receive it, though I do not know how long it took for them to reply. Ken Dahl ken(a)uunet.uu.net UUNET Technologies, Inc. ...!uunet!ken --- end included message --- BTW, I faxed the company an account request back in October (and again in November) but have yet to hear anything from them. Peter Johansson peter(a)cs.umbc.edu -------->unsnip<-------- Your guess is as good as mine! d3 `-{> ---- +------------------------------------------------------------------------+ | Pics OnLine MultiUser System 609/753-2540 HST 609/753-2605 (V32bis) | | Massive File Collection - Over 45,000 Files OnLine - 250 Newsgroups | +------------------------------------------------------------------------+

1 0

Re: Forged messages part of "Operation"?
by cfrye＠ciis.mitre.org 17 Dec '03

17 Dec '03

Geoff Dale asks regarding forged signatures and id's: >Any plans or tips on how to prove it in court? Several of us on the list discussed this issue a month or so ago, covering everything from computer-based text analysis tools which derive the probability that two writing samples (one from a known author and one from an anonymous author) were produced by the same individual. Another list member indicated in private email that sentence length and grammar were also fairly invariant, so you could use those measures to build a case. If you'd like more information, I'd be happy to send you some of the list traffic from that discussion. The real question, as Tim May and others have pointed out numerous times, is whether involving the heat is the best way to take care of problems. If we can't learn to effectively stamp out blatant abuses ourselves, then there's no hope for evolving the net.community. I personally think Julf took a much-needed step in shutting down an12070, though there's still the matter of Colorado State. -- Best regards, Curtis D. Frye - Economic Analyst, Software Alchemist, Aspiring Author cfrye(a)ciis.mitre.org "If you think I speak for MITRE, I'll tell you how much they pay me and make you feel foolish."

1 0

Internet billing scam?
by szabo＠netcom.com 17 Dec '03

17 Dec '03

DNS indicated that this organization does in fact have one site, mary.iia.org. Even so, this is not enough for me to trust them with my credit line. This conclusion may apply to many other, more legitimate-looking operations that spring up in the near future. This demonstrates that privacy is only one reason to go to digital cash; the biggest reason may be the massive fraud commonplace in the current electronic system. Online billing is moving towards this incredibly insecure system where our $multi-thousand credit lines are exposed by giving out their short "keys" to numerous unknown entities. Nick Szabo szabo(a)netcom.com Forwarded from COMMUNET: Date: Tue, 4 Jan 1994 16:18:44 -0500 >From: Scott A. Ward 703-614-4719 <wards(a)AMOMEGA.ACQ.OSD.MIL> To: Multiple recipients of list COMMUNET Subject: Warning: International Internet Association A company calling itself the International Internet Association, and billing itself as "the largest non-profit provider of free Internet access in the world" has started advertizing in the Washington, D.C. area, and offering free Internet accounts to individuals who will FAX them, among other things, a credit card number. As an active member of the Member Council of the National Capital Area Public Access Network (CapAccess), I wanted to find more about this organization that supposedly has offices NOT THREE BLOCKS FROM CAPACCESS. Here's the result of my search for the IIA. 1. Their address, listed as "Suite 852 - 202 Pennsylvania Ave, N.W. Washington D.C. 20006", is actually a post office box at Mailboxes, Etc. 2. The company lists no incorporation, trademark or service-mark licenses. 3. They claim your E-mail address would be <userid>@iia.org. However: a. No iia.org is listed in the hq.af.mil hosts table b. No iia.org is listed in the acq.osd.mil hosts table c. No iia.org is listed is the INTERNIC 'whois' database d. No iia.org is listed using the INTERNIC 'netfind' Internet lookup In other words, IIA.ORG does NOT, at this time, exist. 4. Although they apologize profusely in the application, they state that "Without receiving a credit card number, the IIA _cannot_ process an account." 5. Although I have left a message on their voice-mail system, I have received no response from them. (they also apologize in the voice mail that, due to demand, they are operating at a 3-week backlog for applications.) I cannot judge an organization in advance. However, I do think it highly suspicious that, to use their propaganda, "The International Internet Association is able to make this service available through generous private donations, and the extraordinary dedication of its membership." I can say that I am not convinced this organization exists, and highly discourage any Internet user from sending information until you make certain that the IIA is real. =======================================================================

1 0

Filing Income Taxes Electronically
by remail＠tamsun.tamu.edu 17 Dec '03

17 Dec '03

Forwarded from alt.internet.services: I've been involved with electronic tax filing (EFT) for six years now. I develope and sell a tax filing package which allows you to basically enter the data from a completed return and transfer directly to the IRS or to one of our transmission sites. This is a tax filing not a tax prep program. Our main market is tax preparers who buy the program and transmitt direct to the IRS, tax preparers who register with us and transmitt returns to us to transmitt to the IRS and tax preparers who fax us returns and we enter the data and transmitt. As for specifics, yes you need a bell 208 modem to send directly to the IRS. The IRS has several transmission sites all over the country which processes everybody`s returns. And they have a set schedule of when a refund is sent. Basically returns are processed every Tuesday night. What this means is that if your return has been sent and passed the IRS acceptanced tests by Monday night the IRS will process it Tuesday and if you do direct deposit it will be in your bank account in 10 days, if you have it mailed it will be mailed in 12 days. So if you do file electronicaly DO NOT get a Refund Anticipated Loan (RAL) unless your electricity is already off :-). A RAL will get you your money in 3 to 5 days at pre-fixed fee which averages to be about a 150% loan interest rate for a at most 7 day loan. If your interested in doing EFT from your home IBM or clone let me know. We also work with non tax preparers who have registered with the IRS to do electronic filing and have a electronic filing indentification number (EFIN). The IRS can give you these rather quickly, they do a background check to see if you do not owe back taxes or have been convicted of any felonies and if that works you get a EFIN. Once you have an EFIN we can work with you to set you up for EFT. Basically if you transmitt to us we give you the software and charge you per return. What you do is find your clients ( and they are your clients you must see then personally and have them sign a EFT form which gets sent with their W2s to the IRS by you ) enter there returns with our software and send to one of our transmission sites. If interested or any other questions relating to EFT let me know. Dave Hotlosz no sig never had one never needed one, which means I`ll have to get one ------------------------------------------------------------------------- To find out more about this anonymous remail service, send mail to remail(a)tamsun.tamu.edu with the word "remail help" as the only words in the subject field.

1 0

IIA
by szabo＠netcom.com 17 Dec '03

17 Dec '03

>Newsgroups: alt.internet.services >Path: netcom.com!csus.edu!wupost!howland.reston.ans.net!newsserver.jvnc.net!jvnc.net!johnson >From: johnson(a)tigger.jvnc.net (Steven L. Johnson) >Subject: Re: IIA >Message-ID: <1994Jan9.221436.5417(a)tigger.jvnc.net> >Originator: johnson(a)nisc.jvnc.net >Sender: news(a)tigger.jvnc.net (Zee News Genie) >Nntp-Posting-Host: nisc.jvnc.net >Organization: JvNCnet >References: <1.8248.1623.0N27B602(a)satalink.com> >Date: Sun, 9 Jan 1994 22:14:36 GMT >Lines: 20 ???@??? (Mike Fieschko) writes: >MF> + gulfa:/u/john 105> whois iia.org >MF> >MF> + International Internet Association (IIA2-DOM) >MF> + 30 South First Avenue >MF> + Highland Park, NJ 08904 >MF> Well, well. I grew up in Highland Park, a small town across the Raritan >MF> River from New Brunswick. I _believe_ the building on South First is in a >MF> residential area. 30 South First is a blue two story residence complete with Volvo in the driveway and Winnebago (or some such similar beast) in the back yard. There are no signs or markings for IIA (or Intellicom/icm.com, which shares this same address according to whois). There is a single mailbox which has no name on it, personal or company. -Steve "with obviously not enough to do."

2 1

unsubscribe
by zant0001＠gold.tc.umn.edu 17 Dec '03

17 Dec '03

unsubscribe

1 0

Re: Internet billing scam?
by smb＠research.att.com 17 Dec '03

17 Dec '03

DNS indicated that this organization does in fact have one site, mary.iia.org. Even so, this is not enough for me to trust them with my credit line. This conclusion may apply to many other, more legitimate-looking operations that spring up in the near future. This demonstrates that privacy is only one reason to go to digital cash; the biggest reason may be the massive fraud commonplace in the current electronic system. Online billing is moving towards this incredibly insecure system where our $multi-thousand credit lines are exposed by giving out their short "keys" to numerous unknown entities. Nick Szabo szabo(a)netcom.com You raise an interesting point; however, it's far from clear that digital cash is a solution. In fact, it may even be a negative factor in some contexts. Let's look at why some vendors -- whether of network services, hotel rooms, or rental cars -- much prefer credit cards, even though the card issuer will charge them a few percent off the top. The answer is that in these cases, customers have the potential to run up a large bill -- that is, a debt -- between interactions with the provider. Furthermore, this debt is often legitimate, i.e., the customer really did consume that amount of service. A vendor possessing a credit card number *will* be paid, with minimum hassle. If the customer skips town, the card issuer eats the charge. But that's part of their cost of doing business, which they try to minimize via things like credit checks. If credit cards didn't exist, the vendor would have to assume the risk. Most are not nearly as large as the card issuers, and they don't have the lead time to do a credit check in many cases. Their usual answer is to demand a deposit. That's fine with either regular cash or digital cash -- but if and only if you can afford that kind of capital outlay. And those deposits are often very large compared to the final actual bill, because the vendor wants to cover the larger potential bill (i.e., a wrecked car). I suppose one could invent a deposit broker, who took a few percent to cover the short-term loan of (perhaps) large sums, and who issued digital cash tokens. But there's one more important point to consider: U.S. law on disputed credit card purchases. Suppose that this organization really is fraudulent (though the evidence for that varies between slim and none, and the person who sent the original note may be headed for a libel suit). The customer isn't liable for the bill, subject to assorted restrictions and caveats. The card issuer has to eat that, too -- and it's up to them to try to collect from the offending merchant. Why send cash -- digital or otherwise -- to a potentially-disreputable organization, when you can protect yourself quite easily? Digital cash solves some problems very nicely -- but I don't think this is one of them. --Steve Bellovin

1 0

Re: Internet billing scam?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

I tried to telnet to mary.iia.org, and a Sun machine named "mary" did answer; I didn't play around with telnetting to port 25 nad seeing if it did smtp, though I'll try sending mail to bogususer(a)mary.iia.org and see if it bounces. As Steve points out, sometimes credit cards are more useful for services like this than digicash is, but I'd still prefer not to send credit card numbers in cleartext, even if the card vendor is supposed to eat most of the fraudulent use. Would be nice if they'd use some sort of public-key mail system so that they're the only ones capable of fraudulently using the card number, rather than any eavesdropper :-) Bill Stewart

1 0

Re: Forged messages part of "Operation"?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> >> If he starts flooding the newsgroups, what can we do about it? > >If he starts forging mail from other people, he's committing a crime > >and we can get his system administrators to pull his account. > >Perry I don't think you can strictly call it a crime, just abusive rudeness, though if you did something like that in Detweiler-space, it might classify you as a Tentaculer Traitor to Humankind. However, sufficient levels of abuse can get you kicked off systems; though he's been posting lots of verbose human-generated messages rather than mechanized mailbombs, which are clearly over the edge. And he's been mailbombed directly by other rude people; don't know if he's done it to anyone himself.

1 0

Re: Crypto not being used where needed
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

h There are two different problems with eavesdropping cellular calls: - trying to find a *specific* person's calls - trying to find any interesting call. The former is still hard, but if unencrypted cellular credit-auth boxes become widespread, all you'll have to do is set your scanner to listen for 1200-baud tones and match for patterns that look like credit-card requests, since you don't really mind *who* you rip off. This is not good. One way around it is to use public-key crypto; however, simple symmetric-key crypto with different keys per vendor should be adequate, and the paper-trail for setting up credit-card service gives you a key distribution mechanism.

1 0

request for references on random one time pad
by HO JUNYA 17 Dec '03

17 Dec '03

Hi, I am taking part in an engineering design course, where we will be designing and building something of our choice, with an emphasis on electronics... What i proposed to do was basically a one time pad, with a true random number generator to generate the pad. We want to do it on 8 bit xt plug in cards, with the initial transfer of the random pad between the sender and receiver being done over a cable (with the terminals side by side). Then, an arbitrary amount of time later, the two terminals can be separated, and a promiscuous method of transmission can be used to transmit encrypted data. The encrypted data is to be generated by simply XORing the bits of the pad, and the bits of the plaintext, with decryption occuring at the receiving end by XORing the bits of the pad and the bits of the encrypted message, to extract the plaintext bits. Talking to the instructor today, he didn't understand why I wished to use a truly random number generator, since he believed that any pseudorandom number generator, or even something periodic would be just as secure, in practical terms. Is this true? I did not wish to use a pseudorandom number generator (and after all, it's an electronics design course, not software design) or any period function, because i believed that it would be susceptible to brute force attacts by statistical analysis of the encrypted data (are there other ways of attacking it?). Wouldn't this also apply to any textual input as the pad? (eg, verse n of chapter m of book o of the bible) I would like to be able to back up my assertion that using pseudorandom number generators, periodic functions or english texts would not be secure (to what degree?), and that the use of a true random number generator (probably using circuit noise) is theoretically the most secure method available (assuming real randomness and not taking into account the transfer of the pad). Can anyone suggest any references? I was also wondering how difficult it would be to implement DES into this, using random bits for keys, in hardware or software. I'm afraid that we may have to use basic, if we are to talk with the plug-in-card, as i'm not confident of my C abilities, and am not aware of any libraries out there. Any help would be greatly appreciated. I am not on the cypherpunks mailing list yet, however, and would appreciate a Cc: to my email address, in addition to the list itself. Junya ______________________________________________________________________________ "Merci, merci, merci." -La Femme Nikita | hojunya(a)ecf.toronto.edu ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Greetings. We are enjoying rebuffing your latest volley in the newsgroups. You have really gotten desperate, it is clear! Our last exploding shrapnel bomb into the newsgroups (Operation South Pole), was a fantastic success; you have been scurrying madly with the damage control. And szabo(a)netcom.com really is almost dead, contrary to whatever *you* think. Unfortunately one of our key outlets has taken a serious hit, but we overtaxed the site anyway and expected to lose it eventually. This message is a little notice that our Wham, Bam, Thank You Ma'am campaign starts today. When it is finished, you will see a variation of our signature below. We think you will enjoy the `bounces' and some more of the polymorphic paragraphs. Remember the Golden Rule, do unto others as you would have them do unto you! -- and what goes around, comes around! he who lives by the sword, dies by the sword! what's good for the goose is good for the gander! for every action, there is an equal and opposite reaction! It may be next weekend perhaps in two weeks that we mount operation SQUISH. Obviously, a key strike has to be planned carefully and accompanied with feints to be successful and effective. We appreciate all the great ideas you have provided us lately, and the highly entertaining squirming and contortions. Remember, if the guerilla is not losing, he is winning! Take care :-) \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ _________ _________ _________ / / \ \ / / \ \ / / \ \ / / / / / / / / ______ / / / / / / ~~~~ / / / / / __ \ / / / / / / / ~~~ __/ ~~~_/ / / ~~~ / / / ____ / /~\ \ /~~~~_ / / /~~~~~~~ \ \ / / / / \ \ \ ~~~ _ \ / / ~~~~~~~~~ ~~~~ ~~~~ ~~~~~ ~~ ~~~~ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ C y b e r a n a r c h i s t R e p r e s s i o n a n d P o i s o n

1 0

T-Shirt Ordering Update - PLEASE READ
by Christian Void 17 Dec '03

17 Dec '03

Updated Ordering Information: Due to popular demand, we will be accepting checks for orders on a few conditions: The checks must be drawn on US banks for orders placed in the US ONLY. We cannot accept checks from outside the US. Orders placed from outside the US should be paid using a Money Order, or Cashier's Check in US Funds. Also, please include your e-mail address with your order, so we can acknowledge receiving it. The original announcement is below. Thanks! --------------------------------------------------------- "Cypherpunk Criminal" T-shirt Ordering Information --------------------------------------------------------- Part I: Where to get a preview of the design The front of the t-shirt can be obtained via anonymous FTP at netcom.com in pub/cvoid/cypherpunks. The filename is "front.gif" which is based on Jef Poskanzer's "CRYPTO-DATA" DOT warning logo (this file is available as well as "logo.gif"). The back of the t-shirt consists of the upper banner, "cypherpunks(a)toad.com", and the lower banner, "There is safety in large numbers". In the middle is a listing of 7-digit primes in a large block. The typestyle is Fusion and Fusion bold. Outputting this to a GIF is next to impossible due to the resolution needed to reproduce the text. Trust us, it's cool. Part II: What kind of t-shirt is it? What color? Sizes? Custom? Availability? The t-shirts are Hanes Beefy-T's, which are a very strong and durable. The t-shirts will be black, with white and yellow screened on to it. We were unable to come up with a practical way to customize the t-shirts on an individual or group basis, so we opted for this design instead. We will only be making as many as we get orders for, and have no plans to do a second printing. Sizes available are S, M, L, and XL. We may be able to get XXL, XXXL and XS shirts as well. We will post an update in regards to the additional sizes. Part III: How much do they cost? Ordering deadline? The t-shirts will cost $10 each, which will include shipping and handling to anywhere you want them sent (except Mars). We will be accepting orders until February 15th. The t-shirts will be shipped out before February 28th. Part IV: Ordering Information Please make all Money Orders out to "Inky Fingers" (the screening company we use). Please specify the number of t-shirts, and what size you need, and where you want them shipped. We cannot (for obvious reasons) accept personal checks. Cashier's Checks and Money Orders only, please. Orders can be mailed to: V/M/R Attn: Cypherpunks T-Shirt P.O. Box 170213 San Francisco, CA 94117-0213 If you have any further questions, you can send me e-mail here at <cvoid(a)netcom.com> or <cvoid(a)albemuth.tatertot.com>. Anyone who sent e-mail in regards to this will also get this e-mailed to them directly, in case they do not have access to the list. Feel free to forward this to any interested parties. Thanks. -- Christian Void /T71 | "I don't like it, and I'm sorry I | V/M/Research, Inc. cvoid(a)netcom.com | ever had anything to do with it." | P.O. Box 170213 Tel. 1+415-998-0774 | -Erwin Schrodinger (1887-1961) | SF, CA 94117-0213 * PGP v2.3a Public Key Available Via Finger *

1 0

T-Shirt Clarification...
by Christian Void 17 Dec '03

17 Dec '03

Sorry for the bandwidth. It is only Tuesday and has already been a long week. :( Any orders placed outside of the US, paid by check drawn on a US bank are acceptable. Our screening company has expressed concerns over dealing with checks drawn on non-US banks, so we are avoided this type of payment. If anyone has any further questions, or special circumstance, send me a note and I'll see what I can do. Thanks again. Christian Void /T71 | "I don't like it, and I'm sorry I | V/M/Research, Inc. cvoid(a)netcom.com | ever had anything to do with it." | P.O. Box 170213 Tel. 1+415-998-0774 | -Erwin Schrodinger (1887-1961) | SF, CA 94117-0213 * PGP v2.3a Public Key Available Via Finger *

1 0

a simple guide to my remailer
by Eric Hollander 17 Dec '03

17 Dec '03

Here's the Official Guide to the hh remailer. Please post this wherever you think people will find it useful. ----- How to use the hh(a)soda.berkeley.edu Usenet poster and Anonymous Remailer by Eric Hollander This document describes some of the special features of the hh(a)soda.berkeley.edu remailer. Because this remailer is essentially just a modification of the standard Cypherpunk's Remailer, I recomend that you also read soda.berkeley.edu:/pub/cypherpunks/remailer/hal's.remailer.gz. = What does this remailer do? This remailer allows anyone who can send mail to post to Usenet newsgroups, and also to send mail to anyone else on the Internet. Both of these functions can be anonymous (the identity of the sender is hidden from the recipient) or non-anonymous (the identity of the sender is known to the recipient). = Why is this remailer different from the standard Cypherpunks remailers? The main difference between this remailer and the other Cypherpunk remailers is that this remailer allows posting to all Usenet newsgroups, either anonymously, or non-anonymously. It also has the regular remailer functions of forwarding mail, either anonymously or non-anonymously (nonymously?). The other minor difference is that this remailer adds a random time delay for anonymous mail and posting. = A note about header fields This remailer/poster looks at the header of the mail you send it to decide what to do. Some mail programs don't allow easy editting of the header. If your program doesn't allow editting of the header, you can still use the remailer. To do this, send mail in the normal way, but start your message like this: :: Anon-Post-To: rec.fish leaving no blank lines before the :: and a blank line after the header field to be inserted. The remailer will consider the line after the :: to be a part of the header. All of the instructions bellow can be used with actual header fields or the :: format. = How do I use this remailer to anonymously post to Usenet? Send mail to hh(a)soda.berkeley.edu with a header like this: To: hh(a)soda.berkeley.edu Anon-Post-To: rec.fish Subject: I flushed a fish on Friday On Friday, I did a terrible thing, so I'm posting this anonymously... This message will be posted to rec.fish, with nothing to indicate who was the original sender. Only the Subject field will be retained; everything else in the header will be discarded. = How do I post non-anonymously? Send mail like this: To: hh(a)soda.berkeley.edu Post-To: rec.fish Subject: flushing fish How despicable of you to flush a fish! This will be posted to rec.fish non-anonymously; the From and Subject fields will be retained in the post. = Crossposting To crosspost, simply list the newsgroups, separated by commas, with no spaces, like this: Anon-Post-To: rec.fish,alt.ketchup Note that excessive crossposting is an abuse of the net. Some people have to pay for their news, and they don't want to read "how to make money fast" in rec.fish. = Testing I recomend that you post test messages to make sure you are using the remailer properly. Please post these messages to the appropriate test groups (alt.test, rec.test, etc). Also, if you post non-anonymously to a test group, many sites will send you mail confirming that they have received the post. To avoid this, put the word "ignore" in the subject line. = Anonymous mail This remailer is capable of sending anonymous mail. To send mail to foo(a)bar.com, send a message like this: To: hh(a)soda.berkeley.edu Anon-Send-To: foo(a)bar.com Subject: Ronald Sukenick I think you should read something by Ronald Sukenick. and foo(a)bar.com will recieve the message, without knowing who sent it. = Non-anonymous mail forwarding This remailer supports non-anonymous mail forwarding. To use this feature, send mail like this: To: hh(a)soda.berkeley.edu Send-To: foo(a)bar.com Subject: you know who I am This mail is from me! = Testing mail Please test the anonymous remailer functions before you use it "for real" by sending mail to yourself or a friend. = Chaining, encryption, and other issues These features are discussed in detail in soda.berkeley.edu:/pub/cypherpunks/remailer/hal's.remailer.gz. While you're looking at that file, you might also want to check out PGP in /pub/cypherpunks/pgp. If you haven't installed PGP on your machine yet, you should try it out. This remailer doesn't yet support encryption, but it's coming soon. = Remailer abuse This remailer has been abused in the past, mostly by users hiding behind anonymity to harass other users. I will take steps to squish users who do this. Lets keep the net a friendly and productive place. = A note to ucb users This remailer allows posting to ucb.* newsgroups. = If you have other questions or problems send normal mail (without any of the above headers) to hh(a)soda.berkeley.edu. = Copyright This file is copyright 1994 Eric Hollander, all rights reserved. You are free to distribute this information in electronic format provided that the contents are unchanged and this copyright notice remains attached. = Disclaimer This remailer is not endorsed in any way by the University of California. I, Eric Hollander, take no responsibility for the content of posts or messages, and I take no responsibility for the consequences of using my remailer. For example, if you post anonymously, and someone manages to trace it back to you, I am not responsible.

2 1

yet another thing tacked on to my slocal
by hh＠cicada.berkeley.edu 17 Dec '03

17 Dec '03

You can get the ordering info about the Cypherpunks T shirt by sending mail to hh(a)soda.berkeley.edu with "tshirt-info" (spelling counts!) in the subject line. This is part of my plot to subvert all Internet protocols and just use Port 25 for everything. e

1 0

Credit cards vs. digital cash
by szabo＠netcom.com 17 Dec '03

17 Dec '03

Steve Bellovin raises some good points about the function of credit cards. A couple responses: > ...in these cases, customers have the potential to run up a > large bill -- that is, a debt -- between interactions with the > provider... A vendor possessing a > credit card number *will* be paid, with minimum hassle. If the > customer skips town, the card issuer eats the charge. Vendors should be able to get the equivalent protection by buying insurance against customers skipping town, for a similar price. That, and collection enforcement, via local jurisdictions which have been lobbied to pass credit card fraud laws, are two of the main functions served by credit card companies. A third is collection of dossiers on customers, which we would like to put under customer control. For online services, where the customer can be billed in near real-time, the case where a large bill approaches the credit limit is at least exceptional, and might be eliminated entirely. Where the largest bill is much smaller than the credit limit, the customer is put at much smaller risk by putting up a deposit then by exposing their entire credit rating to both the vendor and snoopers who intercept the number. Furthermore, the deposit can be made with a neutral third party which serves the arbitrator function for disputes. In this particular case, phone billing could be done in very small increments, in near real-time, with digital cash. > But there's one more important point to consider: U.S. law on > disputed credit card purchases. This company was operating internationally; one of their customers who posted lives in Kuwait. Do all Internet jurisdictions have laws protecting credit card customers? How are these laws enforced? On whom lies the burden of evidence, legal costs, etc.? I agree that the issue of customer vs. vendor assumption of risk deserves much more attention than we have given it. A major goal is to minimize dependence on the maze of Internet jurisdictions to resolve conflicts. One interesting idea is an online escrow services that holds a customer deposit equal to the amount of the largest possible bill, and uses the escrow to resolve disputed billings. The challenge is minimizing leakage of private information, via the escrow. Nick Szabo szabo(a)netcom.com

2 1

Welcome to IIA (fwd)
by szabo＠netcom.com 17 Dec '03

17 Dec '03

Here's the IIA info message that has caused all the furor: Forwarded message: >From info(a)iia.org Mon Jan 10 14:31:54 1994 The text in this document is how we envision our host machine to look in the very near future. Please be patient if some things are not currently available. We are working on this system daily to improve it. Welcome to the International Internet Association - the largest non-profit provider of free Internet access in the world. We are a Washington based association dedicated to the free flow of information without regard to position or affiliation. We look forward to serving you. In response to your request we need a little more information to set up an account and get you on-line. Please complete the attached form and return to our offices in Washington. You will advance in line quicker if you simply fax back the attached registration form at the end of this document. When received we will provision accounts in the order received. We have responded to over fifteen thousand requests in the last several weeks, and we greatly appreciate your continued patience. WHO AM I ON THE INTERNET? We will assign a USERID (User Identification) which combines your first and last name in accordance with international standards governing E-mail. All accounts will be eight characters or less beginning with the last name and ending with the first initial. For example John Smith will become SMITHJ. If your last name is over seven characters only the first seven characters will be used. If you would like a specific ID, this can be arranged as well as other custom services upon your first login. You need only follow the menu items to custom services and make the electronic request. Since you will gain access to the Internet through the IIA your address to the rest of the internet community will be USERID(a)IIA.ORG where USERID is the name we generated using your last name first initial. WHAT DO I GET? You get an Internet account providing 14,400 BPS capability and lower (9600,2400,1200). 256K of storage allowing you to download files and messages (more can be made available). Kermit, X-MODEM, Y-Modem, and Z-MODEM download protocols to transfer information to your home computer. Menu driven options will allow easy access to GOPHER, World- Wide-Web, Archie, Prospect, Telnet, FTP and a host of others (no pun intended) In short you can do what anyone else anywhere can do on the net and more (we have built in capabilities beyond the general capabilities of the Internet). ACCESS The International Internet Association is able to make this service available through generous private donations, and extraordinary dedication of its membership. We will invite users to join, but will in no way restrict access based on membership. WHAT TO EXPECT You will receive two numbers with your welcome aboard package. One is a direct dial number to either our master node in Washington D.C., or our research facility in New Jersey. If you choose to direct dial it is your responsibility to pay your long distance carrier for the time spent on-line. Your bill will be identical to the cost of calling and speaking to someone. The cost of a phone call. The second option is to receive an 800 number provided by the IIA. The IIA has made arrangements for this service to be provided universally across the U.S. 24 hours a day at the rate of 20 cents per minute. (The 20 cents is billed exactly at cost through the generous contribution of our supporting provider). You need to look at your long distance rate from your current provider and decide the most economical way to reach our nodes. The IIA plans to install local calling points across the U.S. to support our users, as soon as we obtain the funds. WHAT WE NEED FROM YOU: Please complete the enclosed form in its entirety. Pay careful attention to the accuracy of your name and address. We need a Master Card, Visa, Or American Express. When we provision your account you will have access to both the direct dial, and the U.S. 800 number. If you do not use the 800 number you will never receive a charge. If you find the 800 number more economical than direct dial than you will be billed in 10 dollar increments. A charge will be rolled over until all time has been exhausted. Without receiving a Credit Card Number, the IIA cannot provision an account. (We apologize for this inconvenience to our users planning on direct dial. Shortly we plan to rectify this through programming, but until that time we must adhere to the policy of our long-distance provider.) WELCOME ABOARD PACKAGE Your welcome aboard package will contain additional information about the IIA including your USERID and Password (required for login) and instructions on how to login. We will also provide information on the Internet services available. However the majority of the useful information can be found on-line by following the menus to the help section. OUR THANKS The IIA would like to thank-you for your interest in becoming part of the electronic community, and we look forward to serving in the capacity of your host. We trust it will change you life. INTERNATIONAL INTERNET ASSOCIATION APPLICATION FOR FREE INTERNET ACCESS Name ________________________________________ Address ________________________________________ ________________________________________ Fax Line(___)______________ Voice Line (___)____________ Modem Speed (1200) (2400) (9600) (14.4) (Whats a modem?) Credit Account: Required (See attached statement) Visa _______________________Exp-date_____ MC _______________________Exp-date_____ AMEX _______________________Exp-date_____ Signature ____________________ Date _____________________ 1. I understand that the use of this account will be for lawful purpose and accept responsibility for my actions while on-line. I will not hold the IIA responsible for any activities occuring, or initiated by any user who makes knowing use of the ID IIA assigns on my behalf. 2. I agree that any use of the 800 number made available to me by the IIA will be billed to my credit card. I authorize use of this account with regard to voluntary on-line services to which I approve. When completed please fax this document to the following. (202) 387 - 5446 PLEASE NOTE - FAX THIS DOCUMENT DIRECTLY - WE CAN NOT ENSURE PRIVACY IF YOU SEND IT THROUGH THE NETWORK! This form may be copied for the purposes of adding additional Internet users. If you are having difficulties making a clean connection try changing your modem parameters to 7 bits, even parity and 1 stop bit.

2 1