December 2003 - cypherpunks-legacy

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- qwerty(a)netcom.com gains a bit bucket. :: Request-Remailing-To: /dev/null Bye bye mail. "BB" entered into my counter. Comments? Are slashes OK in a header line? - -Nik (Xenon) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLVElIwSzG6zrQn1RAQE1qAP9Fu4tDpJclibx3CuzHGICpshNwULdYmn2 zfBMC+wuHGWvDvTtDX0+0HxfxLouOKAvvESJFt35Y0YSszT8KZmarSz5msOA179v +trsnSPw/BhjNvKQlhxHm7HpOr8JNoL3gB2zHz3EISEkdDtvRE3LRj4wu20P8DaP 7reDXreuDE4= =n99G -----END PGP SIGNATURE-----

1 0

Study of National Cryptography Policy
by Herb Lin 17 Dec '03

17 Dec '03

February 3, 1994 To: Whom It May Concern Subject: A Study of National Cryptography Policy This message should be forwarded to any and all individuals or groups that may be interested. ----------------------------------------------- In a message broadcast electronically and by fax in December 1993, the Computer Science and Telecommunications Board (CSTB) of the National Research Council (NRC) issued a call for nominations of possible committee members who would undertake a study of national policy with respect to the use and regulation of cryptography. This report was requested by the U.S. Congress in the Defense Authorization Bill for FY 1994. That message said that ALL committee members (and associated staff) would have to be cleared at the "SI/TK" level. Since that time, there has been some discussion of a study that would only require SOME members of the study committee to be cleared. Thus, in the interests of casting the broadest possible net to capture the necessary expertise, we are re-issuing the call for nominations to find those people who otherwise fit the criteria below but who would have been reluctant to accept security clearances or to undergo the required investigation. It is expected that the study committee will be a high-level group that will command credibility and respect across the range of government, academic, commercial, and private interests. The committee will include members with expertise in areas such as: - relevant computer and communications technology; - cryptographic technologies and cryptanalysis; - foreign, national security, and intelligence affairs; - law enforcement; - commercial interests (both users and technology vendors); and - privacy and consumer interests. Committee members will be chosen for their stature, expertise, and seniority in their fields; their willingness to listen and consider fairly other points of view; and their ability to contribute to the formulation of consensus positions. The committee as a whole will be chosen to reflect the range of judgment and opinion on the subject under consideration. Note that NRC rules regarding conflict of interest forbid the selection as committee members of individuals that have substantial personal financial interests that might be significantly affected by the outcome of the study; in addition, individuals currently employed by the federal government are ineligible to serve on the study committee. Please forward suggestions for people to participate in this project to CSTB(a)NAS.EDU by February 11, 1993; please include their institutional affiliations, their field(s) of expertise, a note describing how the criteria described above apply to them, and a way to contact them. For our administrative convenience, please put in the "SUBJECT:" field of your message the words "crypto person". If you would like a copy of the original solicitation, please send a request to CSTB(a)NAS.EDU. On the National Research Council The National Research Council (NRC) is the operating arm of the Academy complex, which includes the National Academy of Sciences, the National Academy of Engineering, and the Institute of Medicine. The NRC is a source of impartial and independent advice to the federal government and other policy makers that is able to bring to bear the best scientific and technical talent in the nation to answer questions of national significance. In addition, it often acts as a neutral party in convening meetings among multiple stakeholders on any given issue, thereby facilitating the generation of consensus on controversial issues. The Computer Science and Telecommunications Board (CSTB) of the NRC considers technical and policy issues pertaining to computer science, telecommunications, and associated technologies. CSTB monitors the health of the computer science, computing technology, and telecommunications fields, including attention as appropriate to the issues of human resources and information infrastructure and initiates studies involving computer science, computing technology, and telecommunications as critical resources and sources of national economic strength. A list of CSTB publications is available on request.

1 0

Re: contemplating remailer postage
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Matthew J Ghio writes: > How about this: > > Issue numbered stamps sequentially. Encrypt them and > add a cryptographic checksum to each stamp. You then > create a database such that one bit of data corresponds to > one stamp. With a mere 64K database, you could issue and > keep track of 524288 postage stamps. That ought to last > you a few years. (At 100 letters a day, it would last over 14 > years. Most cypherpunk remailers get considerably less > than 100 emails a day.) > > > If the remailer constructs the stamp, rather than just signs it blindly, it could keep a log of which stamps were issued to which users. The remailer could then use this information to figure out the original sender of a stamped message regardless of how many other remailers the message passed through. To thwart this, users would have to purchase stamps anonymously. However, this begs the question: How does the user anonymously purchase stamps for the first remailer? I suppose you could use "free" remailers to send anonymous purchase requests to stamp-issuing remailers. The system I described does not require you to purchase stamps anonymously. You can purchase stamps directly from each remailer without giving the remailer the opportunity to record which stamp went to which user. To understand why this is true you need to understand how blind signatures work. The book "Applied Cryptography (Bruce Schneier)" gives a good description of the properties of blind signatures. That is how I learned about them. The remailer could still record the fact that you purchased stamps, thus alerting the bad guys that you plan to use the remailer system. However, I don't think it is possible to prevent the bad guys from learning that you use remailers. I assume the bad guys will be logging all traffic to the remailers and would learn about your use of remailers, stamps or no stamps. Jim_Miller(a)suite.com

1 0

ADMIN: list statistics
by hughes＠ah.com 17 Dec '03

17 Dec '03

I gathered some list statistics for the subscriber base as of Thursday, February 3, 1994, 12:00 noon. 657 subscription addresses total. 49 contain the string 'cypher' and are suspected gateways, either to individuals or large groups, so the exact amount is extremely hard to pin down. Here are the subscribers, broken down by top-level domain 300 com USA commercial 204 edu USA educational 25 org USA organizational 18 ca Canada 15 net networks 13 us USA geographical 10 uk United Kingdom 9 uucp UUCP links 8 se Sweden 7 gov USA government 7 au Australia 6 fi Finland 5 no Norway 4 de Denmark 3 mil USA military 3 it Italy 2 fido Fidonet 2 za South Africa 2 mx Mexico 1 ve Venezuela 1 su USSR (er, someone call a NIC) 1 si ( ? Slovenia ? ) 1 sg Singapore 1 nl Netherlands 1 jp Japan 1 in India 1 ie Ireland 1 hk Hong Kong 1 gb United Kingdom 1 fr France 1 es Spain 1 ee ? 1 ec Ecuador If anybody knows for sure where SI and EE are, I'd love to know. My list of ISO country codes is a little old. Here are the top individual domain names. We can see who has market share, at least. 51 netcom.com 16 aol.com 9 mcimail.com 8 well.sf.ca.us 7 delphi.com 6 world.std.com 5 umich.edu 5 shell.portal.com 5 microsoft.com 5 cleveland.Freenet.Edu 5 CompuServe.COM 4 phantom.com 4 panix.com 4 gnu.ai.mit.edu 4 crl.com 4 apple.com 3 ucsu.Colorado.EDU 3 toad.com 3 prodigy.com 3 nyx.cs.du.edu 3 mason1.gmu.edu 3 engin.umich.edu 3 ecf.toronto.edu 3 anon.penet.fi 3 access.digex.com 3 CUNYVM.CUNY.EDU Happy lack of trails. Eric

6 8

Message returned to sender (fwd)
by Jim choate 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Re: SASE Suggestion
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Lance Cottrell writes: > One SASE scheme recently suggested involved sending a > request for a SASE to a ramailer, stating the number of > jumps required. It then sent it to another remailer, and > so on. Each adding a layer, and eventually sending the > results to the desired correspondent. I mentioned that > if the first remailer was corrupted, that the whole chain > was (it would only send to other corrupt remailers). > Oh, I see. I was confused as to which scheme you were talking about. You were refering (I think) to the "prepaid mailer" idea Tim May described in his "Re: Anonymous Anonymous ftp" post of Jan 27. Jim_Miller(a)suite.com

1 0

Re: A question of ethics.
by pgpkeys＠wasabi.io.com 17 Dec '03

17 Dec '03

>Ok, I'm in a bit of a quandry. While surfing the net last week, I >happened across an address addached to a machine that belongs the the >federal reserve. No big deal. I telnetted there on a lark, and entered >'guest' for the account. It dropped me into a shell. It didn't ask for >a password. Intrigued, I did a little looking around. Nothing special, >a CDRom and about 80 accounts. But(!!), /etc/passwd was there and >available and not using shadows. No, I didn't snatch a copy. > >Quandry(ies) > >1) Should I alert someone there about the obvious (and, IMHO serious) >seciruty hole? > > or > >2) Should I ignore it? > >3) Should I take advantage of it (well, maybe not) > >---------- > >I don't like to see systems so open, no matter who they belong too, and >the fact that the governments (whether you like them or not) has one this >open REALLY bothers me. > >But, I also wonder what kind of trouble I could get into. Technically, I >violated something just by being there as I didn't have permission, and >the fact I accessed the passwd file makes it even worse. If I report it, >I could be in deep shit. > >I could mail to them via a remailer (like penet.fi, so that they could >answer for more information if needed). That is a little securer and >Julf is out of jurisdiction of the FBI hunting me down. > >Yes, I'm a little paranoid, but Uncle Sam likes to make examples out of >white-collar hackers, and for me it was pure and dumb luck (like a jury >would believe a 22 year-old computer geek isn't trying to gain illegal >access). > >Any suggestions? Please? I consider this to be serious (most may not). Go to a COCOT and call Ms Flanagan below. *Not* the Tech contact, who is most likely the person who fucked up and will want to cover his butt. The admin contact should be more sympathetic... 20th and C Streets, NW Washington, DC 20551 Domain Name: FRB.GOV Administrative Contact: Flanagan, Elizabeth R. (ERF7) erf(a)FED.FRB.GOV (202) 452-2672 Technical Contact, Zone Contact: Drzyzgula, Robert P. (RPD5) rcd(a)FED.FRB.GOV (202) 452-3425 Record last updated on 14-Aug-91. Domain servers in listed order: NS.UU.NET 137.39.1.3 UUCP-GW-1.PA.DEC.COM 16.1.0.18 UUCP-GW-2.PA.DEC.COM 16.1.0.19

1 0

Canadian voice recognition article
by cmckie＠ccs.carleton.ca 17 Dec '03

17 Dec '03

Spy Agency works on eavesdropping device for phones, faxes New snoop gadget would identify voices carried through air The Canadian Press Used on page 1, Ottawa Citizen, Monday January 31, 1994 An elite wing of Canada's spy agency is secretly developing devices that can monitor and identify voices carried through the air by phone, fax and radio signals, according to a broadcast report citing government documents. The Communications Security Establishment is a super-secret branch of the Canadian Security Intelligence Service that specializes in gathering signals intelligence - SIGINT to insiders. Since 1989, the CSE has awarded three contracts worth $1.1 million to a Montreal firm to make machines that can quickly isolate key words and phrases from the millions of signals the CSE monitors each day, CTV reported Sunday. In May 1983, the CSE awarded the Centre de Recherche Informatique de Montreal a contract to develop a "speaker identification system," which can pick voices from the electronic haze and identify them. "Its frightening," says Bill Robinson, a researcher with the peace group, Project Ploughshares. "It has Orwellian potential to sweep through everybody's conversations. As computers get faster and faster, theoretically, one would be able to keep records of all conversations." The CSE is supposed to provide the federal government with foreign intelligence, but parliamentarians have often voiced concerns about the agency's potential to violate the privacy of Canadians. Liberal MP Derek Lee, the head of a Commons committee that oversees Canada's spy agency, said the CSE is overstepping its mandate. "Have they been asked, or have they decided for themselves to take on a new role that requires them to analyse the human voice? And if they have, they've gone beyond what I think they've told us." The CSE is accountable to Parliament through the defence minister. But Defense Minister David Colonette told CTV her was unaware of the CSE's latest electronic snooping projects. "This is the first I've heard of this," Collenette said. "It is certainly something I'll discuss with my officials." While in Opposition, the Liberals pledged to make the CSE more accountable. With a budget of about $250 milliojn and more than 800 employees the CSE operates out of a building on Heron Road in Confederation Heights surrounded by a barbed-wire fence. Its work is considered so sensitive that employees are told not to take commercial flights, in case the plane is hijacked and they are held hostage.

1 0

Remailer Tearline Conventions
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

* Reply to msg originally in CYPHERPUNKS Uu> From: edgar(a)spectrx.saigon.com (Edgar W. Swank) Uu> Someone (not me) asked about remailer tearline conventions to Uu> eliminate automatic sigs: Uu> I'm the one who brought this up "months ago" and the short answer to Uu> your question is "no." Uu> Hall Remailer <nowhere(a)bsu-cs.bsu.edu> Uu> added a "cut line" of Uu> --ignore-- Uu> At the time I brought this up, the attitude of most remailer operators Uu> (Chael Hall and Miron Cuperman notably excepted) was that anyone who Uu> couldn't figure out how and remember to turn off their auto sig didn't Uu> deserve any privacy. An astonishing bit of Internet provincial fuckheadedness, I must say! When one considers that there are _many_ other nets that gate into Internet these days and innumerable store-and-forward host systems whose message handling processes are _completely_ beyond the control of the end user (even smug Cypherpunk geniuses), this attitude mystifies me. Uu> I recommend that you always use the wimsey (extropia) remailer as the Uu> first (or only) leg of a remailer chain. It is also the only Uu> Cypherpunks remailer outside the USA (it's in Canada) which will make Uu> tracing msgs a little more difficult for USA authorities. That remail(a)extropia.wimsey.com is in Canada specifically makes communications with it fair game for NSA interception, however.

2 1

Re: On return addresses
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Eric Hughes writes: > I've been troubled for many months by an invariant in all forms of > return address schemes: The outside world contains sufficient > _persistent_ information to find a real adress. > > [stuff deleted] > > So how do we solve it? By abandoning return addresses and > using mail spool facilities. > > [more stuff deleted] > > 1. I have a machine and I'll sell you an address on it... > > 2. When mail come in for you, it sits in a spool... > > 3. Your mail sits in the spool until you access it with... a > mail server command of "send me a mailbox file of my > waiting mail". > > [even more stuff deleted] > > The elimination of persistent identifying information > for return paths is a worthwhile design objective. I > propose that we start thinking about it more thoroughly. > > Eric > Let me see if I understand your idea correctly. I am picturing something like the following: There will exist a bunch of remailers that, in addition to forwarding mail, will also sell mailboxes. (I'm combining the remailer with the mail spools to add to the mix of messages to and from). The "mailboxes" are actually e-mail addresses referring to a pseudo-account on some machine that hosts a remailer/mail spooler. Bob would purchase a number of mailboxes scattered throughout the remailer/mail spooler system. Bob would give out the address of one of these mailboxes to people so they can send "reply" messages to him. Messages addressed to Bob's "public" mailbox would be spooled by the remailer hosting that mailbox. Periodically (perhaps frequently), Bob would send an anonymous message (via other remailers) to the remailer hosting his public mailbox to command the remailer to send the contents of his mailbox to one of his other mailboxes. The remailer wouldn't necessarily know it's sending to another mailbox, it's just sends to an address supplied in the command message. Bob repeats this process to move his messages from his second mailbox to his third mailbox, and so on. Eventually, he moves his messages from his Nth mailbox to his "real" address. Is this approximately what you had in mind? I left out IP redirectors and POP clients because I'm not familiar with them. Jim_Miller(a)suite.com

1 0

CRYPTO - New US keyserver now fully operational -
by fringeware＠illuminati.io.com 17 Dec '03

17 Dec '03

Sent from the cyberdeck of: pgpkeys(a)wasabi.io.com (PGP Slave Key Server) The US-based keyserver 'pgp-public-keys(a)io.com' is now open to the public. Come one, come all! Here is the current file as returned by 'Subject: help'. This site is a PGP key server SLAVE site. It behaves very similarly to the European PGP master sites, but there are a few small differences which will be noted below. The most noticable difference is that it answers your requests immediately instead of waiting for a daily batch job to run :-) The particular installation at io.com does *not* log the details of requests for keys, however the fact that you have sent mail to the key server at all is logged in the daily sendmail logs. These logs will be erased automatically after one week. PGP Public Keyservers --------------------- There are PGP public key servers which allow one to exchange public keys running through the Internet and UUCP mail systems. This service is NOT supported in any way whatsoever by the schools or organizations on which these servers run. It is here only to help transfer keys between PGP users. It does NOT attempt to guarantee that a key is a valid key; use the signators on a key for that kind of security. This service can be discontinued at any time without prior notification. Each keyserver processes requests in the form of mail messages. The commands for the server are entered on the Subject: line. To: pgp-public-keys(a)io.com From: johndoe(a)some.site.edu Subject: help Sending your key to ONE server is enough. After it processes your key, it will forward your add request to other servers automagically. For example, to add your key to the keyserver, or to update your key if it is already there, send a message similar to the following to any server: To: pgp-public-keys(a)io.com From: johndoe(a)some.site.edu Subject: add -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.2 <blah blah blah> -----END PGP PUBLIC KEY BLOCK----- COMPROMISED KEYS: Create a Key Revocation Certificate (read the PGP docs on how to do that) and mail your key to the server once again, with the ADD command. Valid commands are: Command Message body contains ---------------------- ------------------------------------------------- ADD Your PGP public key (key to add is body of msg) *** Note: your update is forwarded to a master server and may take a few days to reappear INDEX List all PGP keys the server knows about (-kv) VERBOSE INDEX List all PGP keys, verbose format (-kvv) GET Get the whole public key ring GET 0xA1B2C3 Get a single key by Key ID *** Note: the master servers allow you to omit the 0x in front of the Key ID. The slave servers do not. GET userid Get a single key by User ID MGET substr List all keys which match "substr" *** Note: this is different from the master servers which return the keys themselves, not just a listing of their Key IDs. Also the master servers accept a wild-card expression; at the moment we do not. LAST days Get the keys updated in the last `days' days *** Note: not yet implemented ------------------------------------------------------------------------ Examples for the MGET command: MGET michael Lists all keys which have "michael" in them MGET @iastate.edu Lists all keys which contain "@iastate.edu" Check the Usenet newsgroup alt.security.pgp for updates to this system and for new sites. Based on a document originally by Michael <explorer(a)iastate.edu>

1 0

Prodigy Hard Drive Scans
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

I heard from a friend that Prodigy was scanning user's hard drives. Basically, when you logged on Prodigy made a complete directory of your hard drive and uploaded it. Prodigy was using this to find out what applications you used so they could direct the appropriate advertising towards you. Apparently, they're suffering several lawsuits now because of it. My friend heard this on the trailing end of a radio talk show. If it was really happening, it sounds horrible. Could Secure Drive be set up to stop this kind of attack? Can anyone tell me if this is more than a rumour? If it is more than a rumour, would you be able to point me towards some information about this? -john. jdblair(a)nextsrv.cas.muohio.edu

1 0

Re: Prodigy Hard Drive Scans
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

> I heard from a friend that Prodigy was scanning user's hard drives. > Basically, when you logged on Prodigy made a complete directory of your > hard drive and uploaded it. Prodigy was using this to find out what > applications you used so they could direct the appropriate advertising > towards you. Apparently, they're suffering several lawsuits now because > of it. > > My friend heard this on the trailing end of a radio talk show. If it was > really happening, it sounds horrible. Could Secure Drive be set up to > stop this kind of attack? > > Can anyone tell me if this is more than a rumour? If it is more than a > rumour, would you be able to point me towards some information about this? Just a rumor, disposed of several years ago. A hot topic of debate around 1990. This rumor arose because Prodigy set aside a block of user disk space for its own files. Sometimes this block had random stuff in it (recall that "erasing" a file doesn't actually overwrite the disk, it just removes pointers to the stuff being erased and allows other stuff to later be overwritten over it). Prodigy used part (a small part, given 1200- and 2400-baud modems in use then) of this block to send back to the main computers, so in principle it could see miscellaneous scraps of erased data. But this was accidental, was a tiny fraction of the disk, was not used or even looked at by Prodigy, and would have absolutely no value in determining applications used. (Think about what a samll random chunk of "erased" disk space would really mean in terms of telling outsiders what applications you use!) Ironically, an old college buddy of mine is now in charge of e-mail for Prodigy, in White Plains, New York. He visited me last summer and I showed him a _real_ computer service (Netcom) and we had a few good chortles about this Prodigy Conspiracy. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power:2**859433 | Public Key: PGP and MailSafe available.

1 0

Re: your mail
by David Vincenzetti 17 Dec '03

17 Dec '03

Some anonymous user sent me a message which is divided in three parts. I am sorry but I did not receive the first one. Can this anon guy please send me the first part again? Thank you.

1 0

Re: New remailer up.
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jon Boone expressed what seems to be a consensus, " I won't hack into mail.netcom.com to demonstrate that it is possible to figure out who used your remailer. But, if one of the admins from netcom wants to send me their syslogs, I'll do my best to put together a correlation." Netcom logs mail. The mail queue is viewable by most anyone willing to set up a mail queue logging routine. If someone wants to see the mail logs after it is no longer in the mail queue they have to be root on Netcom or illegally hack in. If the FDA wants your illegal smart drugs, they might get Netcom to hand over mail logs. If a hacker or the NSA taps into root, they don't need mail logs; they'll just "wiretap" the qwerty account, including its secret key and pass phrase. Is there any OTHER serious but unrelated problems with a Netcom remailer? Now I know what warnings and hints to put in qwerty's .plan: "Since Netcom keeps mail logs, people should only have contact with qwerty via other remailers or send mail out from qwerty only to public sites like Usenet or a mailing list, so the real addresses of the users never shows up on Netcom's logs or in the mail queue. It is also best to use encryption in case someone is reading the contents instead of just the logs." Routing through qwerty will add another layer of difficulty to someone trying to track down a message sender, since if forces them to get Netcom's sendmail logs after the fact or to make their own logs every day of the year from an account on Netcom. Is this legal for say the FDA to do? How about my new idea for a company called "Netlog!" in which I log the mail queue on Netcom and offer to sell CD ROMs containing a year's mail logs from Netcom? These tricks could be made more difficult with traffic analysis countermeasures. However, the issue seems more touchy than this rationalization for the existance of Netcom remailers. Not assuming qwerty remains in its current state, will adding qwerty to a mailing chain, say between extropia to hfinney@shell, using encryption, add to or decrease security? The question needs to be answered, with the assumption that someone IS collecting mail queue logs. How would you have me alter qwerty so that this link ADDED to the security of a chain? More than an hour delay must be avoided by making the scheme more sophisticated, in my view. If I add a 0-30 min. random delay, with added dummy traffic going out from qwerty in a circle through other remailers and back to qwerty's bit bucket, every few minutes, would this make it useful also to SERIOUS remailer users? Before I start throwing out ideas that I'm sure aren't new to readers here, I have a simple question that perhaps I should post to comp.unix.questions or comp.lang.perl, but.... Can I, and how would I, get a perl script to kick in and send out mail every few minutes when I am NOT logged in. Is this possible on Netcom? The question is pretty general, and involves any public access or personal account machine. So send me a remailer or tell me how to patch Hal's. -Nik (Xenon) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLVGOgQSzG6zrQn1RAQFGLAP+N31dNMjnArEOklm4AeruT7pu6LgfNdUM OawRDPY8CYgxYi5kJ4yByh7+uD+Asr7FCMaKacln8YwO6oOz3FlceNupC1czWFI5 NWuS9b4r5ZPKpLClv9K3oY1QvRePc1r0Ypl4SYCtZux/7U787BoyT/VUHmkfwple I6X6+irFXns= =6Klu -----END PGP SIGNATURE-----

1 0

Re: Remailer Tearline Conventions
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > That remail(a)extropia.wimsey.com is in Canada specifically makes > > communications with it fair game for NSA interception, however. > > NSA interception is world wide. On the other hand, extropia uses PGP encrypted messages to its remailer, and NSA PGP-breaking is distinctly *not* world-wide. I assume it doesn't use PGP encryption for the anonymous outgoing side, but you can always encrypt the message before encrypting it for extropia.

1 0

finger user@wasabi.io.com
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Neat stuff! You can finger billstewart(a)wasabi.io.com, even though I don't exactly have an account there... Is the source code available for your finger daemon? It doesn't seem to have any regular-expression matching; it mostly matches exact character strings, presumably case-insensitive. I couldn't figure out how to get it to match spaces, though: requesting 'bill stewart' got all the bills and all the stewarts, rather than getting the lines with bill stewart in them. Thanks!

1 0

Running regularly
by Hal 17 Dec '03

17 Dec '03

> Before I start throwing out ideas that I'm sure aren't new to readers here, > I have a simple question that perhaps I should post to comp.unix.questions > or comp.lang.perl, but.... Can I, and how would I, get a perl script to > kick in and send out mail every few minutes when I am NOT logged in. Is this > possible on Netcom? Most public Unix systems will not let you do this, in my experience. The two Unix commands which usually give you the ability to run programs at regular intervals are "at" and "crontab". You can read the man pages and try running these to see if they are enabled for you. I had an idea for how to get around this, so that people could run batching remailers which sent out mail, say, every 30 minutes or whatever. (Unlike Xenon, I am of a generation which is accustomed to waiting more than a few seconds for mail to travel across the country!) The idea was simply for someone who DID have an account which would let them use at or cron, to run a program which would simply send a "ding" message (not to be confused with a "ping" message :) at regular intervals to a list of subscribers. This message could have a special header field so that the remailer programs could easily recognize it and take whatever action they wanted, like running Karl Barrus' script to scan a directory for pending outgoing remailer mail and send it out. (Karl has had batching running for months, as well as postage-stamp-based remailers (albeit with non-anonymous stamps). He is way ahead of most of this discussion.) Hal

2 1

Re: contemplating remailer postage
by Hal 17 Dec '03

17 Dec '03

As Jim points out, Matthew's scheme for one-bit-per-stamp has the problem that it requires non-anonymous stamps. Jim suggested a variant on Chaum's digital cash where the stamp numbers would be re-blinded by the recipient so that the remailer would not recognize them (but could verify their validity). Matthew's bitmap idea could still be used, though. The incoming stamp numbers could be hashed down to, say, 24 bits. This could then be an index into a 2^24-bit file, which would take 2 MB. Set the bit when the stamp is used, and reject the mail if the bit is already set. Granted, this would create false rejections. But email is already not perfectly reliable. You could send 160,000 messages before you had as many as 1% false rejections (2^24 / 100). I think this would be better than trying to save this many digital stamps and check through the list each time for duplications. Hal

1 0

Remailer FAQ. Details.
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

I hope I can get a bit more attention to this, now that it has become more sophisticated. Please code warriers, take a break and let the human race know what the existing remailers are all about. I know exactly why they don't have enough traffic; knowledge about them is still insider knowledge. A list of remailer addresses and year-old partial info from a request made my Tim May was all I could find. Specs needed. I will send this to Gary Edstrom for the PGP FAQ if I don't have to spend the rest of my life compiling it. Mail info to qwerty(a)netcom.com. I'm interested in hearing from users as well as operators. -Nik (Xenon) Xenon's Full Disclosure Remailer List. Remailer Fast? OpLog SysLog Subj Batch RD NL CPU Phys PGP BitB ?what else? --------- ------ ----- ------ ---- ----- -- -- --- ---- --- ---- ----------- bsu-cs + ? ?/? + ? ? ? ? ? 23a ? catalyst + N? SM/MQ - - ? - PA M 23a - choas + ? ?/? + ? ? ? ? ? - - cicada ++ ? ?/? - - - - ? ? - - dis.org - ? ?/? - ? ? ? ? ? 23a ? extropia ? ? ?/? + ? ? ? Pr? ? 23a ? jarthur +/-- St SM/MQ? - ? ? ? Un ? 23a - menudo -- ? ?/? - t1 ? ? ? ? - ? merde -/-- ? ?/? - ? ? ? ? ? - ? penet.fi -- St ?/? - t? 24 + Pr H - - pmantis ++ ? ?/? - ? - - ? ? - - qwerty + C SM/MQ - - - - PA M 23a + rosebud ++/- ? ?/? - - - ? ? ? 23a ? remba ? ? ?/? ? ? ? ? ? ? 23a ? shell ++/+/- St ?/? - ? ? ? ? ? 23a - soda ++/- St+? ?/? - ? ? ? ? ? - Subj: Strips Subject header? NL: Non-linear remailing? 123->231. RD: Random delay added (max, in hours)? Batch: Batched remailing? t2 means twice daily. n5 means after 5 messages. CPU: Pr = private. PA = account on public access machine. Un = university. Phys: Physical security of the CPU, especially at night. H/M/L. BitB: BitBucket feature? Fast?: ++ <5 min + 5-10 min. - ~10-30 min delay -- Pinging isn't practical due to long delays, but may be more secure. +/- Sometimes +, sometimes - Normal internet mail delays are common, and are not equivalent in the two directions between any two remailers. Mail still gets through. OpLog: F: Full copies of all mail is archived. My large volume mailing should help put a stop to this. St: Stats logs of when mail was remailed. St+: Stats logs of when and where mail was remailed. St-: Simple counter. N: Operator keeps no logs. SysLog: SM: sendmail logs of when and where mail was exchanged. Root access. MQ: mailqueue accessible by anyone on the site. Could make logs. bsu-cs nowhere(a)bsu-cs.bsu.edu catalyst catalyst(a)netcom.com chaos remailer(a)chaos.bsu.edu cicada hh(a)cicada.berkeley.edu dis.org remailer(a)dis.org extropia remail(a)extropia.wimsey.com jarthur ebrandt(a)jarthur.claremont.edu menudo nobody(a)Menudo.UH.EDU merde remailer(a)merde.dis.org penet.fi anon.penet.fi pmantis hh(a)pmantis.berkeley.edu qwerty qwerty(a)netcom.com rosebud elee7h5(a)rosebud.ee.uh.edu shell hfinney(a)shell.portal.com soda hh(a)soda.berkeley.edu Discontinued remailers still on some lists out there: phantom(a)mead.u.washington.edu remail(a)tamaix.tamu.edu sameer(a)netcom.com (spelling?) sameer(a)berkeley.edu (spelling?) cdodhner(a)indirect.com remailer(a)entropy.linet.org?? 00x(a)uclink.berkeley.edu? remail(a)tamaix.tamu.edu? remailer(a)entropy.linet.org? Background on each remailer: bsu-cs: Run by Chael Hall. Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: History: ?? catalyst: Run by Scott Collins. Machine: personal dial-up account on Netcom. Problems policy: Outgoing address blocking, with proof of ID. Contact catalyst(a)netcom.com. Software: Customized Hal's ? Security: Netcom keeps sendmail logs, which root(a)netcom.com can read. Any Netcom user could also compile his own sendmail logs, by constantly logging mail as it arrives and leaves. Comments: History: ?? chaos: Run by ?? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: Comments: Finger remailer.help(a)chaos.bsu.edu for info using any remailer. ?? gopher chaos.bsu.edu for a collection of info about Cypherpunks. Comments: History: ?? cicada: Run by Eric Hollander. Machine: ??? Problems policy: ?? Contact ?? Software: ?? Security: Tread lightly. Being "phased out". dis.org: Run by ?? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: History: ?? extropia: Run by ?? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: Only accepts PGP remailing. ::/Encrypted:PGP header is optional. Privately owned, in Canada. History: ?? jarthur: Run by Eli Brandt. Machine: Sequent Symmetry. Problems policy: Destination blocking is available w/ sufficient ID. Contact ebrandt(a)jarthur.claremont.edu. Software: the usual, tweaked for MMDF. Hal's? Security: jarthur keeps sendmail logs. Comments: History: Set up late '92. PGP added mid-'93. menudo: Run by ?? Maching: ?? Problems policy: ?? Contact ?? Software: ?? Security: Stores messages and sends them at midnight?? Comments: History: ?? merde: Run by ?? Maching: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: History: ?? penet.fi: Run by Julf (last name?) Machine: ?? Operator owned. Problems policy: Account revokation. Contact ??(a)anon.penet.fi. Software: custom. Security: Comments: By far the most popular remailer, dwarfing in a day what the entire Cypherpunk remailers combined carry in a month. Supports easy return addresses as well as non-anonymous mailing to someone's anonymous address (na1234... instead of an1234...). Your real address is kept on Julf's hard disk, but is fairly safe there, especially if you do not abuse your anonymity to harass someone. On a bad day your mail and especially Usenet posts may be delayed up to two days. Very reliable though. Sends error messages back to you for failed mail. Limited to 48K mail. History: ?? pmantis: Run by Eric Hollander. Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: Tread lightly. Being "phased out". Comments: History: ?? qwerty: Run by Xenon. Machine: dial-up account on Netcom. Problems policy: "What problems?". Contact qwerty(a)netcom.com. Software: Hal's remailer. Security: Netcom keeps sendmail logs, which root(a)netcom.com can read. Any Netcom user could also compile his own sendmail logs, by constantly logging mil as it arrives and leaves. Comments: You must use na1234(a)anon.penet.fi not an1234(a)anon.penet.fi. Finger qwerty(a)netcom.com for a blurb on the remailer and updates on its software. Request-Remailing-To: /dev/null is a bit bucket. whitehouse.gov gets blocked and fully logged. History: Up 2/94. Set up by Xenon who needed more remailers to use to send PGP info to people with, since anon.penet.fi was overloaded. rembe: Run by ? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: ?? History: ?? rosebud: Run by Karl Barrus. Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: History: ?? shell: Run by Hal Finney. Machine: ?? Problems policy: ?? Contact ?? Software: Hal's Remailer. Security: ?? Comments: whitehouse.gov blocked and fully logged. hal(a)alumni.caltech.edu forwards all mail to shell. History: ?? soda: Run by Eric Hollander. Run by: ?? Machine: ?? Problems policy: ?? Blocking of addresses. Mail sent to problem causer. Contact ?? Software: custom. ?? Security: ?? Comments: History: ?? Remailer Public Keys: (I've got these...)

1 0

info on local/regional groups & sublists
by Stanton McCandlish 17 Dec '03

17 Dec '03

For my OUTPOSTS list/FAQ, if you have any (public) inforation about local cypherpunks groups and sublists, like the Austin lists, or the UK branch, please let me know via personal email. Need to put out a new version of the FAQ soon, and am missing much info. All I have so far is: Main general: hughes(a)soda.berkeley.edu Main subscribe requests: cypherpunks-request(a)toad.com Main FTP: soda.berkeley.edu, pub/cypherpunks Hardware general: jdblair(a)nextsrv.cas.muohio.edu Hardware requests: cp-hardware-request(a)nextsrv.cas.muohio.edu Wonks general: cypherwonks-owner(a)lassie.eunet.fi Wonks requests: majordomo(a)lists.eunet.fi (message body of: subscribe cypherwonks [1st & last name] [address]) Austin general: Jim McCoy <mccoy(a)bongo.cc.utexas.edu> Doug Barnes <barnes(a)io.com> Austin req. austin-cypherpunks-request(a)bongo.cc.utexas.edu austin-cypherpunks-announce-request(a)bongo.cc.utexas.edu Austin FTP: ftp.cc.utexas.edu, pub/cypherpunks Any info on other CP groups, corrections to what little I have, pointers to other CP file sites, gopher/WWW/Wais servers, etc. all appreciated. Even some BBS number, snailmail addresses for any local groups that are getting less virtually, more physically organized, etc. That, and relevant other lists (anything that might be consider "online activist" or civil libertarian in nature) and resources. Again, please send via email to mech(a)eff.org rather than on the list. Muchas gracias in advance! -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

1 0

CONTENT AND QUALITY NET DISCUSSION.
by CCVARGA＠delphi.com 17 Dec '03

17 Dec '03

GENTLEMEN, MOST OF MEANINGFUL DISCUSSION ON THE NET HAVE BEEN BOTH WELL THOUGHT AND INTELLECTUALLY "NON'TRIVIAL". THE REMAILING OF MULTIPLE COPIES OF HIGH NOISE INFORMATION DRIBBLE WOULD CAUSE ME TO LOOK AT THE TRAFFIC ON THE NET AND AS : IS IT WORTH IT? RIGHT NOW, THE NUMBER OF UNSUBSCRIBE MESSAGES LEADS ME TO BELIEVE THAT IT IS NOT. IF THIS IS WHAT TOAD WANTS, SO BE IT. IF THERE IS AN INDIVIDUAL AMONG YOU THAT WOULD LIKE TO MAKE A CASE FOR CONTINUED SUBSCRIPTION, I WOULD REALLY APPRECIATE SERIOUS REPLY'S. CCVARGA(a)DELPHI.COM

1 0

Subscribe
by jwc00＠cas.org 17 Dec '03

17 Dec '03

Subscribe cypherpunks Jim Cooper

1 0

Re: Prodigy Hard Drive Scans
by David Michel 17 Dec '03

17 Dec '03

Prodigy durring installation sets up a temp/swap file on your hard disk. Now this part is a funtion of DOS, Delete a file and all the data is there just the FAT entry is gone. So what ever is on the disk at the location of the temp/swap file is what can be seen at the prodigy end. davidm(a)chey.com

1 0

Re: CONTENT AND QUALITY NET DISCUSSION.
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From: CCVARGA(a)delphi.com > > GENTLEMEN, MOST OF MEANINGFUL DISCUSSION ON THE NET HAVE BEEN BOTH > WELL THOUGHT AND INTELLECTUALLY "NON'TRIVIAL". THE REMAILING OF > MULTIPLE COPIES OF HIGH NOISE INFORMATION DRIBBLE WOULD CAUSE ME TO > LOOK AT THE TRAFFIC ON THE NET AND AS : IS IT WORTH IT? > RIGHT NOW, THE NUMBER OF UNSUBSCRIBE MESSAGES LEADS ME TO BELIEVE > THAT IT IS NOT. IF THIS IS WHAT TOAD WANTS, SO BE IT. IF THERE IS > AN INDIVIDUAL AMONG YOU THAT WOULD LIKE TO MAKE A CASE FOR > CONTINUED SUBSCRIPTION, I WOULD REALLY APPRECIATE SERIOUS REPLY'S. > CCVARGA(a)DELPHI.COM So--another noisemaker complaining about noise on the list. Why don't you decide for yourself whether it's worth continuing your subscription? Would you actually base your decision on the number of people who tell you that it's worth continuing? If you're new to the list, why don't you stick around for a while and see what you think? If not, you're probably fully capable of deciding for yourself now whether this is the place for you. Related issue: The number of people unsubscribing because of excessive noise who are so rude and clueless as to post their unsubscribe requests to the entire list (thereby increasing noise) is really getting to me. Almost no tangential or "off-topic" thread pollutes this list as much as unsubscribe requests that everyone has to read. The cypherpunks welcome message clearly states that unsubscribe messages should be sent to cypherpunks-request(a)toad.com. Simple. Again, the list administrator is a human being, not a machine, so those requests may take a couple of days to process. Big deal. Losing your patience and whining to the list is as useful as pushing the elevator call button a hundred times, and has the added disadvantage of getting hundreds of people really angry. It also makes you look like a clueless newbie. I usually send these messages to individuals, not the whole list, but it seems that there's been an increase in unsubs sent to all of us. Again, folks, if you want to unsubscribe (which I'm not encouraging you to do), it's cypherpunks-request(a)toad.com --Dave.

1 0