December 2003 - cypherpunks-legacy

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)replay.com> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; $remailer{"q"} = "<q(a)c2.org> cpunk hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 16 Jan 95 6:00:02 PST remailer email address history latency uptime ----------------------------------------------------------------------- rahul homer(a)rahul.net ***********# 3:32 99.99% bsu-cs nowhere(a)bsu-cs.bsu.edu ***+#*****+# 8:27 99.86% ideath remailer(a)ideath.goldenbear.com ---------+-- 2:11:08 99.84% penet anon(a)anon.penet.fi ************ 35:48 99.99% nately remailer(a)nately.ucsd.edu +++ -+-+++++ 1:08:44 99.76% mix mixmaster(a)nately.ucsd.edu -++ .++++++* 1:43:39 99.75% q q(a)c2.org ++---+++++- 1:16:03 99.74% vox remail(a)vox.xs4all.nl --------- - 9:46:45 99.99% soda remailer(a)csua.berkeley.edu .... ..-..- 8:32:46 99.41% alumni hal(a)alumni.caltech.edu +**** -++-*# 1:52:49 99.20% portal hfinney(a)shell.portal.com #*#** -##- * 1:23:04 99.17% extropia remail(a)extropia.wimsey.com ++++++++++++ 3:15:35 97.19% rebma remailer(a)rebma.mn.org _-_.---_..-* 21:48:17 90.00% desert remail(a)desert.xs4all.nl ----.-_.-- 22:09:02 86.57% usura usura(a)replay.com -+**+ +- ++ 33:32 84.49% xs4all remailer(a)xs4all.nl -+**+++- ** 22:59 79.87% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Comments and suggestions welcome! Raph Levien

1 0

RE: CP meeting lost&found
by Johnathan Corgan 17 Dec '03

17 Dec '03

>Did anyone notice a left over coat at the CP meeting? My friend seems to be >unable to locate his. It's a purple Timberland with white leather trims. >The coat has very important mail in the inside pocket. Yes. As we were leaving, Katy was asking around for the owner of the jacket. I assume she probably still has it or it is at SGI for safekeeping. == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)scruznet.com -Isaac Asimov

1 0

Re: How do I know if its encrypted?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Ben writes: > Paul, I think we're after two different objectives here. > You want Alice to be sure that Dave can't read her file; > I want Dave to be sure that he can't read Alice's files. Yeah. Picking threat models is important. Alice's job is easy; she can just encrypt stuff. The problems are a bit different if the file can only be retrieved by Alice, or if she can give retrieval tokens to Bob, Carol, and alt.sex.spam. If Dave is running a free or cheap service, he also may need to prevent his site from becoming load-spammed by the permanent floating warez+porno crowd. (As Eric pointed out, it's a policy-vs-mechanism issue; it's easier to run a service if you've got mechanisms to support any policy you want.) If Dave's charging for service, charging separately for storage and retrieval can help - that lets the one-storage, many-retrieval model work without having to use mechanisms like automatic deletion-after-reading, which may not be useful for some applications. For Dave to be sure he can't read Alice's files, he can't depend on Alice encrypting them - aside from entropy models which are generally not very useful, Alice could always encrypt the data and then publish the key. So he has to do it. Here're 1.5 approaches that can work for some threats: Alice wants to store message M, using a key K known to Alice. (K could be hash H(M) if desired, or sent to Dave along with M.) Dave calculates H(K), encrypts M with K, stores E(M;K) under name H(K), and then discards K. To retrieve files, Alice sends either K or H(K). There's some risk at storage - Dave is receiving the file, so he's vulnerable to cops between the time he PGP-decrypts the message and the time he re-encrypts and destroys the key, but it's brief, and can be automated so he doesn't see it in person; he could still be coerced into eavesdropping future storage unless there's a good blinded variant on the method. Alice needs to keep or K or give it to her friends. If retrievals use K, Dave can decrypt on transmission (some risk, some potential revenue). This has the advantage that Dave doesn't know the access token to retrieve a given file across the net, so he can't tell the cops what to scan for. If retrievals only use H(K), he can't decrypt on retrieval, so even if the cops coerce Alice or bribe Bob into retrieving it, Dave doesn't see the content again; it's probably a lot safer for Dave. The risk is that cops who break Dave's system or coerce him into giving them the files will know to look for H(K) on other systems; scanning the net for anything that might hash to H(K) is much harder. Also, Alice might want to give Bob and Carol H(K) to retrieve the files, but not give them K to decrypt until later, or might send K through other channels that only the In Crowd get. Another extension is for Dave to store the file as H(H(K)), to make it more work to match access tokens against files - Dave has the advantage of not even knowing the access token (which the retrieve-with-K method has) as well as not letting Dave decrypt. Using user-selected keys instead of message hashes is obviously a lot faster, since Dave doesn't have to calculate them, and makes it a bit easier for Alice to memorize the keys instead of storing them, but it requires more Syntax in the requests, and increases the chances of wimpy keys and especially collisions (which essentially never happen in hash-based systems, but are more common if people want to use keys like "Secret Plans".) And Alice can always store the hashes encrypted and stegoed, or store an index file on the datahaven and give her friends the access tokens for that instead of her whole collection. Hashes are also safer for Dave if Alice is compromised or spam is a problem, since he doesn't have to respond to requests for "spam1.gif" or "Nuclear Narcoterrorist KiddyPorn Monthly" or "Windows_for_95.c", which is riskier than requests for 0x402930be89a9c901. Bill

1 0

Re: bug in remailers
by jml＠wizard.synapse.net 17 Dec '03

17 Dec '03

> Litsen, you mentioned that you were getting >the same problem with other remailers. That was because you >were mailing through my remailer to them or from them, right? I sure >hope so. I would hate to think my code effected others remailers! :) > Homer Yah, I'm 99% sure that it what happenned. I'll be testing that today. I've sent a few test messages to your remailer and everythnig came back just fine. The trouble with other remailers is that it can take as much as a full day before a message gets delivered. I'll get back to you. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAy8X2ZIAAAEEALbeB9136vtAk/FOOb8a1rYv7OWAVJZMiWs/CI1Hla9iUxBj hv+KM1rK31cygbk2/y38cZFQupgP34/0HkLKXsl5bP7vifXi5JzyNpeOmYT3Cr/E FqyWRFUo6dyp7AVm23ryZGZAM2qfcdXaslEqWAD3PczAnQ34vKhVa3SvpHjhAAUR tAZ3aXphcmQ= =syn9 -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Scientology [!]
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> -----BEGIN PGP SIGNED MESSAGE----- > > 1/15/95 > > TO: THOMAS M. SMALL > COUNSEL FOR RELIGIOUS TECHNOLOGY CENTER AND BRIDGE > PUBLICATIONS, INC. > > FROM: Lance Cottrell > Operator of remailer@nately and mixmaster@nately My pgp says: Bad signature Does this message come from Lance Cottrell or from Scientology? > I am willing to comply with your request. Oh. If this is true (is it?) and other remailer operators do the same, there will be no anonymous criticism of the Thetans any more. An non-anonymous criticism of this "church" is said to be a thing of a special kind. Mmmh, Hadmut

2 1

Re: Scientology (fwd)
by L. McCarthy 17 Dec '03

17 Dec '03

This is the copy that was sent to the remailer operators' list. Note that the start of "FROM:" is corrupted, and there's some odd line breaking. I'm guessing that's the reason the signature doesn't check (for me, either). -L. Futplex McCarthy Forwarded message: > From remailer-operators-owner(a)c2.org Sun Jan 15 15:08:56 1995 > To: Remailer-Operators(a)c2.org > Message-Id: <ab3f26ae01021004e8c7(a)[137.110.24.249]> > Date: Sun, 15 Jan 1995 11:56:48 -0800 > From: lcottrell(a)popmail.ucsd.edu (Lance Cottrell) > Subject: Re: Scientology > > -----BEGIN PGP SIGNED MESSAGE----- > > 1/15/95=20 > > TO: THOMAS M. SMALL > COUNSEL FOR RELIGIOUS TECHNOLOGY CENTER AND BRIDGE > PUBLICATIONS, INC. > > =46ROM: Lance Cottrell > Operator of remailer@nately and mixmaster@nately > > In response to your email of January 3, 1995 requesting that I block= > anonymous posting to the Internet news groups alt.clearing.technology and a= > lt.religion.scientology. > > Although my remailers have always supported direct posting to news groups,= > this feature has never been advertised or supported. Since direct posting= > from my remailers is never used, I am willing to comply with your request.= > Posting to alt.clearing.technology and alt.religion.scientology has been bl= > ocked. > > By this action I do not admit to any wrongdoing on my part, nor do I wish to= > imply any wrongdoing on the part of any users of my remailers. I am merely= > turning of a feature that I never intended to be used. > > By design it is not possible to prevent users from using my remailers to= > send a message to another computer to be posted. I can not, and will not,= > block mail to other remailers or to mail-to-news gateways. > > Yours, > Lance M. Cottrell > > CC: Cypherpunks(a)toad.com, remailer-operators(a)c2.org, > alt.privacy.anon-server, alt.privacy, > alt.religion.scientology, alt.clearing.technology > > -----BEGIN PGP SIGNATURE----- > Version: 2.6 > > iQCVAwUBLxl9WlVkk3dax7hlAQH5lAP9HWND3nMsoz/Yn6fz36iqtDqI7s3cEllM > Gaajeq4qAR/t5a5CrEyOW1sYq+bxw5UZppREJC5uBbcp7ZP2k/7jprEcq9O7run3 > ZX985aIY8f5kI6GmUemhmQcflgyNDoeDJMFhRBrvDQqCWueLKVUZLNXx9bsMCi94 > EH/mStSfdJY=3D > =3DUgN1 > -----END PGP SIGNATURE----- > > >

1 0

REQUEST: Privacy/Free Speech URLs
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On the request of a few law-related professors and other faculty, I'm trying to put together a web page that brings together resources from all over the net that are related to issues of free speech, privacy, libel, censorship, etc. If you have a few URLS with materials related to the above, I'd appreciate it if you could drop them in an emailee to me. Basically, any URL that ends up pointing to issues of rights and rules on the net, and possibly related software (such as PGP and the like). Thanks much :-) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLxq8aTokqlyVGmCFAQGPXwP+LpyRgw+fuV4HXzt3ObGyu4ME8XsgBbRz Z2yyhVsbeK9DnhJuYPRiaHGjOmO3rl+9qmjisxbmQA8YkmKIyIGB8ViP7RKLoUlg vCUzr00AbQHc9SZKuuQCyOSHirDNZfc/3A92U1MsEXZl/gACoNxOq3+uSqyE9LWu bQrXW4xbl+0= =2H+w -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> I am Pentium of Borg \/ Finger for PGP Public Key <=> you will be approximated

1 0

Re: Pgp where?
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <ab3c722e200210036071(a)[192.187.167.52]>, Dave Del Torto <ddt(a)lsd.com> wrote: >FYI, I keep the most recent version of Mike Johnson's excellent guide on >where to find PGP in: > > ftp.netcom.com:/pub/dd/ddt/crypto/crypto_info/where_is_pgp?.txt I also have an infobot on pgp-faq(a)hks.net. Sending mail there will get you a fast autoresponse with a reasonably recent version of the same FAQ. >Send email to <pgp-questions(a)lsd.com> if you have further questions. And, I'll remind everyone that we need volunteers for the pgp-help mailing list (Dave's on it). It's important that we be able to identify what the worst barriers to PGP use are and the best way to do that is to answer folks' questions. Send mail to pgp-help-request(a)hks.net to be added. Thanks, - - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLxqYhRNhgovrPB7dAQH+4AP/RsK7SdY+KVmxuEn3JU8INnK0XnAsi3et jw5jtTfcFJmIKN0u1PmcFeeOwbrgqahzPvOpTJvXQHA73zi94XLGbAR5hrDRAD7N Sfm/4h6lngQV2tzAephZg0J5aV3X6wcCrhd3h3sG01QeaT8YWBzmeRKTXBpAkpWw Nf7opd5EXhM= =t88d - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxrTxSoZzwIn1bdtAQGTzgGAlbPDZqyvoI+5nSZS8NaAnXL5iUXIVRip bu3AM/mGFK/3Y0AsfKnhr4b3ZnZP1KXS =4gk2 -----END PGP SIGNATURE-----

1 0

Re: Jude Milhon in WIRED
by Hal 17 Dec '03

17 Dec '03

From: tcmay(a)netcom.com (Timothy C. May) > General insults, or political statements, are of course kosher, but > making any kind of snide remarks about Joe Foobar, for example, will > often result in these comments being fed to the at person. (I recently > made some comments here on this list about a public Net person, whom I > do not believe is or was subscribed...a few days later I got a > note from this person objecting to my characterization of his views! I > am assuming someone forwarded the traffic to him.) I felt the same way recently. I had commented here about elec cash prodigy Stefan Brands being among those not getting into the DigiCash demo, it got cross-posted to www-buyinfo (which is read by DigiCash people) and led to a big political stink that may have set back relations between Brands and Chaum and therefore the prospects for high-quality digital cash. I really regretted my words as it was certainly not my intention to stir up bad blood. I still tend to think of this list as a relatively private place to make comments "just among friends", unlike more public venues which feed into a wider cross-section of views and where I try to be much more circumspect. Hal

1 0

request for factorising code
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have had a look at the exported version of Netscape's WWW browser which has support for secure transfer of info, and it says it uses RSA keys limited to 40 (not sure whether this is decimal digits or bits). This is the broken version for export, I am not sure what the non-crippled version uses. I would like to have a go at factorising a number of 40 digits to get a feel for how secure this system is. I suspect not very secure even 40 digits is pretty pitiful for an RSA key size 40 bits would be a joke. I would like to get a feel for how long it takes to factorise a 40 digit number. Does anyone have source code for factorising large numbers. I have code to generate the RSA key pairs and modulus, what I am looking for is code to factorise a number using one of the better algorithms (quadratic sieve, etc.). Adam -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAiwUXUEAAAEEAJnWEHE3juLAyMnEt3hrID3t8tblJvJPfoPz4Plg+2a5y4HA TonXBomkhm8hrRu1umruUUaeW1mxIbpvP413a2JyU7pdyfyoFVpWW5iT9pXYOgSW 65d+5GWe4g4PLrSbJZPBFIezd8xddnx5+5hbRk1K6UpfReQuOynIuJ1VakpnAAUT tB9BZGFtIEJhY2sgPEEuQmFja0BleGV0ZXIuYWMudWs+ =pRe7 -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUALxrGhSnIuJ1VakpnAQHzbAP/Q00RZan2rdMrIYzM3Dp4+620DFGoe0zi bRMvLUlKUuPPfdc5PYh/l7cxXwnj6/ARP6QUCyxlHwS/vKxHNJyhIcgna2yIBQGA NtCKZjZNdEYII9/taC4BXc7nTIvJKuz0EgXVSJwbUXgBjuMFA/ZGOrKr1SFcyLbP qMER2rgg5VM= =AJwi -----END PGP SIGNATURE-----

4 3

Known data havens for pirates? Doubtful
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

I forget who wrote: > blame them. Copyrighted data on a server in a jurisdiction that > doesn't acknowledege the copyrights - a prime use for Data Havens > when they come of age. I suppose you _are_ aware that the US has threatened China with punitive duties on $100 BILLION dollars worth of trade, and that China has started holding some show trials (without shutting down its state-owned CD-piracy factories). It's not going to be easy to find a country more willing and able to ignore international copyright law (Berne Convention etc) than China; however, despite howls of protest even China is likely to knuckle down eventually. What may be likely is distributed piracy markets, such as described in Tim's BlackNet spoof. Read my earlier post on what Lance Rose thinks. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

6 5

Re: How do I know if its encrypted?
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I think we're pretty well agreed that Dave's DataHaven can't ensure that files are encrypted without looking inside them at some point. It's a dilemma: Dave wants to be sure he can't read something, but the only way he can be sure is by reading it. But suppose that Dave's good friend Ender Trent decides to set up a new service, Ender Trent's Trusted Encryption. It's a simple job: people send files to Ender and he returns them encrypted and signed. Now, all Dave needs do is check Ender's signature before accepting a file. At no point does Dave ever decrypt or attempt to decrypt such a file. Ender offers encryption in many different forms. In the simplest, Alice sends the file to Ender, Ender generates a random key, encrypts the file, and sends both back to Alice. Almost as simple, Ender uses the hash of the original file as the key. Presumably, Alice already knows the hash and so Ender doesn't send that back. Alice could supply a public PGP (or other asymmetrical algorithm) key with the file and Ender uses that. If Alice is a frequent customer and likes this method, she might register the key with Ender. Lastly, Alice might want to supply a symmetric key of her own. Because Ender wants to protect people like Dave, he can either print a warning that the key used for encryption might not be secure, or run a password-cracking algorithm on it, or both. Because of the extra effort and reduced security, Ender might not want to offer this, or charge an arm and a leg for it. And Dave might not be willing to accept such files, anyway. How is it better to have Ender do all this rather than Dave? Essentially, it splits the risk. Dave never sees the files, and therefore can't be responsible for their contents. Nor could he make sense out of them, even if he tried really, really hard. He could operate his data haven in all but the most repressive parts of the world. Ender's risk is slim to none. Were he to be held accountable for files he encrypts, public notaries would likewise have to be held accountable for everything they notarize. I don't see that as a problem. Dave might wish to offer an encryption service, as Ender might want to offer a data haven, but, if they're smart, they won't accept files that they themselves encrypted. Ender's encryption need not only be for data havens, of course. Nervous remailer operators might want proof of encryption. Escrow services will likely like Ender. And probably more. If there is a demand for a trusted encryption service, I'll create one after the second trumpet audition for the Oregon Symphony on the first of the month. That's the main reason I'm signing this--to hold myself to it. b& -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEUAwUBLxrj5a7gd9aHWwWVAQH2Hgf0CF+0CIMWiK7d52Gaa8fPpMQy+qAYOBj+ MxJPZJpwxLEzmdT8n+dWjz2+0uPbIXXYa8yEM86UeV9++BzNM7WkOr5tezUuUrYa aM+I4yWJEz/oUpURxi4tt1Jmxn4F0IGQENBweIw+lsgU/TyNweCerKoShLpP4zca iZr1HtkK/7KdEi/wmADtfI6aUHytRyMXYvwKhKiy23eAFyNtZgAz4i77p2Kw6iM6 aTGsQQVjda6AYcVlIcLAJN8v+pQV+RGKA4FGACsxEGHDCQvFd3/WvCD4pupPm80E 9QLhQ2zLIjAkSmkO9flndXq6TOcCtMd3f6u/oGCx1EHKUTdP8nbg =svFy -----END PGP SIGNATURE----- -- Ben.Goren(a)asu.edu, Arizona State University School of Music Finger ben(a)tux.music.asu.edu for PGP public key ID 0x875B059.

1 0

Re: REQUEST: Privacy/Free Speech URLs
by jml＠wizard.synapse.net 17 Dec '03

17 Dec '03

>On the request of a few law-related professors and other faculty, I'm >trying to put together a web page that brings together resources from all >over the net that are related to issues of free speech, privacy, libel, >censorship, etc. > >If you have a few URLS with materials related to the above, I'd >appreciate it if you could drop them in an emailee to me. Basically, any >URL that ends up pointing to issues of rights and rules on the net, and >possibly related software (such as PGP and the like). > >Thanks much :-) Check out Vince Cate's Cryptorebel/Cypherpunk Page at: ftp://furmint.nectar.cs.cmu.edu/security/README.html It has just about everything with links to other sites that have links to other sites that have links to.... it's a web thing. :-) *********************************************** jml(a)wizard.synapse.net PGP encrypted mail preferred. I might disagree totally with what you say but I'll defend your right to say it to the death. ***********************************************

1 0

US News on Policing Cyberspace
by John Young 17 Dec '03

17 Dec '03

US News of January 23 has a cover story on "policing cybersapce", another drumbeat about "the growing threats to your privacy and property in the information age." Not much new for this group except to enjoy another Spielberg gremlin of Jekyll and Hyde cryptography, fearful remailers, slippery digicash, stolen services and personal data, smuggling, terrorism, child pornography, Tennessee BBS, "cybercops" and such. Featuring the FBI's Kallstrom and Tafoya and FLETC and Financial Fraud Institute and Clipper and protective wiretaps, with supporting roles for Kevin Mitnick, Bruce Schneier, Mike Godwin, Marc Rotenberg, John Perry Barlow, Esther Dyson, Robert Corn-Revere. And, a cartoon on how to teach parents fear of the Net for their children. Cypherpunk is not sited, I think, or is it steganoed?.

1 0

Longer than 1048 bit keys
by Jaeson.M.Engle＠josaiah.sewanee.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm using MacPGP 2.6(ui) and noticed that the limit for a key size is the 1048 bit ("military grade" (right)). Is there anyway to circumvent this to make larger, harder-to-break-type keys? TIA, - -J -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLxr4xEiLvmPjc4XdAQFVZgP/UsykAUkO18IFddV+QTOkEK4wwipljb/F U1zkrh3IlUUHg82OVhS7tAtEn68d2NyNvbv5k+00CY+DYv9eSLgSbgTeMyyspFTf ZmQtjQZu0Qe6NVWOVMXAFzfUDhmAAytfssvMHqSEMyxaHdyNNFoK9csSg39VchfF s/VBsHv9sZ4= =JQbl -----END PGP SIGNATURE----- (-: aka: :-) (-: Jaeson M. Engle || jme(a)josaiah.sewanee.edu :-) (-: www server: http://josaiah.sewanee.edu/ :-) (-: It's January 29th! IT'S TIME!!! Ask me for details!:-) (-: Finger 'jme(a)josaiah.sewanee.edu' for my Public :-) (-: PGP block. :-)

1 0

Another internet story: INFO: NBC Nightly News Tonight (fwd)
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 16 Jan 1995 16:44:07 -0500 From: Craig Peterson <craig(a)Mainstream.com> To: Multiple recipients of list <rkba-alert(a)gatekeeper.nra.org> Subject: INFO: NBC Nightly News Tonight A story regarding the Internet, with some sort of mention of NRA.org, should be on the NBC Nightly News with Tom Brokaw tonight. Craig.

1 0

Announce: ChainMail 0.6b applescript for using anon remailers
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

I've written an applescript for using the cypherpunks-style anon remailers with Eudora for the macintosh. It will take a message in Eudora, and construct a chain with MacPGP for encryption, through remailers you've specified, and then deposit it back in Eudora for sending. There are still several features I'd like to add to it, but it's quite useable in it's present incarnation. You need a scriptable version of MacPGP, scriptable version of Eudora, and some sundry scripting additions which are listed (with URLs) in the docs. Send email if you'd like a copy, and I'll mail you a binhex'd copy. I don't want it on any archive sites yet, because it's not really done, or fully beta tested for bugs. (so let that be a warning to you, too.)

1 0

Abuse Complaint out of homer@rahul.net
by Homer Wilson Smith 17 Dec '03

17 Dec '03

Oh, Goody. I get to deal with my first abuse complaint for my remailer. Seems to me that letting others decide what is or is not abuse without at least being able to see the abuse myself would be wrong, that opens the door to just anyone claiming they were abused and my taking action against the alleged abuser. Clearly though if some admin of a system considers something an abuse, one can not just blow them off, we are all responsible for responsible use of the net. Even if this posting came through a chain, this admin is going to try to trace back the chain through the other remailers. So if I give him the remailer it came from, he is going to pester that remailer operator who won't appreciate it. I will soon be able to install blocking on the To: or From: lines. Blocking the From lines is hard, because usually abuse comes through other remailers, so I can't just block that. I can however block To: lines if the person is abusing one particular usenet newsgroup or end receiver. It would seem that if I am going to take action against someone with blocking of some sort, then I have at least a right to see the full posting that is claimed to be abusive. By the way, rahul.net keeps syslog files world readable which I find to be a security leak, as anyone (specifically the Church of Scientology) could find out who is in communication with me and start to harrass them too. Comments on ethics and diplomatic handling of this would be appreciated. Homer

2 1

Economist on EFF
by John Young 17 Dec '03

17 Dec '03

The Economist of January 14-20 washes EFF's dirty laundry. After recounting Berman's boot and EFF droop, the article concludes: "That leaves cyberspace's radical libertarians without a voice in Washington. They're probably delighted."

1 0

Abuse and Remailer Ethics
by Homer Wilson Smith 17 Dec '03

17 Dec '03

I am surprised there isn't a widely agreed upon codification of remailer operator ethics for handling abuse cases. Perhaps there is, and I would appreciate someone pointing me to it. I am not presently on cypherpunks, so please include me in the replies. Here is the situation. homer(a)rahul.net runs with header logging on, it contains, From: To:, Date: and Subject. rahul.net also keeps syslog files for a week, and makes them public to those on rahul.net. B writes me saying he is the 'admin of a listserv' and complains that someone is abusing his list with postings through my remailer. He wants the name and e-mail of the abuser to 'talk to him personally'. Clearly I should not give out the name of a remailer user (if I know it) unless ordered to by a court order. Thus his request is, on the surface of it, absurd. In this case the alleged abuser, A, did not chain his posting so my logs clearly show who it is. Clearly I am always going to know the To: of an abuse because the complaint comes to me from or about that address. If the abuser only uses one remailer, then I am clearly going to know the From: line also, as it is right there in the header logs or rahul.net syslog files (same thing.) If the abuser chains and a complaint comes to me, all I will know about the From: line is that it came from another remailer. However now that I know his name and e-mail, if I get another complaint about him, and he has wised up and started chaining, I could pass his name onto the prior remailer before mine, and that remailer could do the same, until it came back to the first remailer on the chain who could take action. This however would piss off a lot of remailer operators. But now what action is appropriate? Well giving A's name to B is out of the question without a court order, right? Blocking the To: line, namely the abused party, is extreme as that blocks others from posting to that list or group, unless the list or the group wishes to have no anon messages. In which case I probably might consider blocking the end recipient. Blocking the From: line, will stop all further postings from that person, which is fitting if indeed he is 'abusing' people, but he will merely start posting through other remailers, who will then have to go through the same procedure. Perhaps there is some justification then for remailer operators sharing blocked From: lines with each other, that might be a good idea. But who is to decide what is or is not abuse? Surely I can't let others tell me that they have been abused without even reading the message, I have seen it happen all to often that parties claim they are being abused when they are merely being exposed and rightly so. On the other hand, since I am responsible for my own little corner of the net, if something happens that I consider abuse, I certainly have a right to put an end to it if I can. Some questions: Does any single recipient have the right to demand that they be blocked from all anon messages. I would say yes. How about demanding blocking anon messages only from some senders? That is harder to implement. If you block the sender, you block ALL his postings, not just to that party. So you would need to block specific From: and To: combinations. This would not work with chaining at all, even if we did share blocking information. So that is out. Does a list owner have the right to demand blocking to his list, with or without a vote of the list readers? I would say yes. What about a newsgroup? I would say it takes a vote. Are anon voites allowed? Touchy question that was important at one time on alt.r.scientology. Anyhow I would guess that the correct action here is to write the offender and let him know a complaint has been registered against him. I would also educate him as to why he was so easily traced and tell him that if he wants to avoid such in the future to start chaining. However if he is a determined abuser not prone to social embarassment, then the sharing of blocking among remailer operators might become a very good idea. I don't know how you seasoned reops feel about abuse, jpunix went out of business for want of an effective way to deal with it. I think part of the answer is in close cooperation. This might help keep the abuse down, and raise the reputation of reops so that people begin to think of us as responsible service providers rather than anarcho terrorists. However I am very new to this field, so I may have my head stuck up my ass, and I would like to hear back from you on your ideas. Homer Wilson Smith homer(a)rahul.net

1 0

Re: Another problem w/Data Havens...
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Data havens that can split data to two or more locations in seperate >jurisdictions can effectively ignore attention from authorities not >related to the site management or site preformance. Encryption mandated >sites can also take this stance, while encryption is legal in any event. It just occurred to me when reading this another method for ensuring the "I can't tell what's in it" condition with a data haven operator. Why not use a secret sharing system where the contraband data is split into a number of pieces and sent to different havens? It could be argued that the individual pieces are not the same as the whole, and there is absolutely no way the operator could recover the original from a given piece (thus providing plausible deniability.) Using M by N secret sharing, with M < N, you build in some redundancy in case one of the havens gets shutdown. Ok, Eric, go ahead and blast your holes in this argument :) == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)scruznet.com -Isaac Asimov -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLxspxk1Diok8GKihAQG4FAQAjCaFOGC+N5zjQ3zVQstv75wxBp/d0js1 2a3ecWdD/S3Sv70l9Y2N4e4vja8Pps4eR1a7Gtzq/nWcHmZXRGRgCzaaHGCNibF5 RaIJUlGGpaKe/UaQ3XfZH2guRBSUCIi4To7QWf3CzpZoWkR4gmZhhB1AcZrd6Z34 WYqZUBwuISI= =68Mc -----END PGP SIGNATURE-----

4 3

Re: Abuse and Remailer Ethics
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 9:21 PM 01/16/95, Homer Wilson Smith wrote: [snip] > Does any single recipient have the right to demand that they be >blocked from all anon messages. I would say yes. > > How about demanding blocking anon messages only from some >senders? That is harder to implement. If you block the sender, you >block ALL his postings, not just to that party. So you would need to >block specific From: and To: combinations. This would not work with >chaining at all, even if we did share blocking information. So that >is out. > > Does a list owner have the right to demand blocking to his list, >with or without a vote of the list readers? I would say yes. > > What about a newsgroup? I would say it takes a vote. Are anon voites >allowed? Touchy question that was important at one time on >alt.r.scientology. I agree with all of that. Somewhat conditionally with what you say about newsgroups, because while it sounds nice, it would be hard to implement. I'm tempted to say that a newsgroup, by it's nature, doesn't have any mechanism for control/government, once created. And as such, doesn't have any way to "decide" not to accept anonymous posts, or posts from a specific user or remailer. So I'm tempted to say "tough luck" to newsgroups that don't like receiving anonymous posts. The alternative is for people interested to create a moderated newsgroup, where of course the moderator could refuse to allow anonymosu posts with or without the remailer operators cooperation. > Anyhow I would guess that the correct action here is to write the >offender and let him know a complaint has been registered against him. >I would also educate him as to why he was so easily traced and tell >him that if he wants to avoid such in the future to start chaining. Yes, I think that is an excellent course of action. > However if he is a determined abuser not prone to social >embarassment, then the sharing of blocking among remailer operators >might become a very good idea. I'm not so sure about that. It might become neccesary, but blocking remailer delivery to a particular address is a _much_ more desirable solution, in my opinion. If a particular person doesn't want to receive anonymous mail, fine. And it might be good to have a mechanism by which he could make those desires known to all remailers, so he doesn't have to do it individually. But if he does want to receive mail from the remailers, I think he's got to receive all mail from the remailers, and not count on the remailer operators to play Identity Detective and try to screen out people he doesn't like. Same with a listserv and the requests of the listserv operator. A newsgroup is, of course, more touchy, because there really _isn't_ a way for "the newsgroup" to decide not to accept anonymous posts. And I'm not really sure there should be. Part of the answer relies on how "independent" your remailer is. If you _were_ to take no action at all to people who complain about "abuse", would you get in trouble? (from school, company, service provider, country). If you would, then you've got to decide if you are willing to take the heat. And your probably not willing to take the heat for Cantor & Siegel to spam the net. So you've got to do what you've got to do. But, personally, if I ran a remailer on a machine that wasn't subject to political pressure (from school, service provider, whatever), I would never make any effort to cooperate with other operators to track down "offenders", and I'd never exclude any newsgroups from delivery. Because I wouldn't want to play censor and decide what "offense" is worth tracking down, and what isn't. And because even having the _capability_ to track down people is really dangerous, when you get pressure to track down someone you _don't_ want to track down. Much better to say "Can't be done, don't have logs, can't figure out who it was," then to have to admit "well, I've tracked down 5 people in the past month cause someone complained about them." Kind of ruins the point of anon remailers. Best would be to have tracking down be impossible, and it would be close to, if not entirely, impossible if the user took the proper precauations. But even if it's possible, it's probably best not to develop a mechanism to do it.

9 13

Re: 40bit Encryption : Adequate or sadly lacking ?
by kipp＠warp.mcom.com 17 Dec '03

17 Dec '03

In article <3fh5m0$7tg(a)hdxu03.telecom.ptt.nl>, you write: > In article <marca-1201952123120001(a)boulanger.mcom.com>, marca(a)mcom.com > says... > > > >There's no question that 40-bit is less than one would prefer. > >This is why we are/will be supporting 128-bit RC4, for example, > >in US-only products, honoring United States government export > >restrictions. > > Marc, isn't it possible (legally) to deliver products with a replaceble > encryption library (dll). Delivery with a 40-bit key DLL. The user has > the option to install a dll with a different keysize. Somewhat like > winsock... > > Yes, I've seen the article suggesting a foreign office. I think an open > interface would do gooed for the whole field. I.e. ftp, telnet, etc. as > well. Actually, it's probably worse than you think: There are govt's out there that won't let you import code that is "encryption ready". You must prove that your software is tamper proof before it can be imported, and tamper proofing means that you can't bolt on security. Also, I believe the export laws disallow "plug in" security in the US... The crypto legal world sucks.

4 3

Re: Another internet story: INFO: NBC Nightly News Tonight (fwd)
by mclow＠coyote.csusm.edu 17 Dec '03

17 Dec '03

>A story regarding the Internet, with some sort of mention of NRA.org, >should be on the NBC Nightly News with Tom Brokaw tonight. > It did not play out here on the left bank, probably because of the earthquake in Japan. Maybe tomorrow. -- Marshall

1 0

Remailer Abuse (fwd)
by Homer Wilson Smith 17 Dec '03

17 Dec '03

Here is the message I sent to both the complainant and the complainee. Homer Dear ..... , I have been contacted by someone complaining about a posting you made through my remailer. They want me to tell them who you are, which ain't going to happen, but at the same time I don't like getting complaints, you understand? Of course I can not tell you who complained any more than I can tell them who you are. But you know where you have been posting using my remailer, right? Now I have no idea if what you posted was really abusive or not, I did not see the posting or postings, and I know a lot of people complain about 'abuse' when really its just their closed minds being opened up. I was able to 'trace' you because you sent something through my remailer without using chaining. If you had chained I would never know who the posting came from. I was told who it went too and the time, and its right there in my system's syslogs coming from you. If you chain and use PGP, then I could not have traced you. So read the instructions on chaining and make sure you USE it. You will be a lot safer in the future from complaint attempts than if you don't use chaining. If you have questions on how to chain, ask on alt.privacy.anon-server or read the various helps at many of the remailers. I have reposted this letter to alt.privacy.anon-server without your name and sent a copy to the complainant. I expect not to hear anything more about you, ok? Homer Wilson Smith System Adminstrator of Remailer at homer(a)rahul.net

1 0