December 2003 - cypherpunks-legacy

NYM REMAILER PROPOSAL
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- lcottrell(a)popmail.ucsd.edu (Lance Cottrell) is known to have said: LC>I propose two changes: >1) To facilitate replying to nyms, I should be able to send mail to the >remailer indicating the nym it should appear to be from. Then a recipient >would simply hit reply, and the response would go back to the real sender. LC>2) I propose the use of message pools rather than return addresses. With >enough subscribers, the best way to do this would be using mailing lists. >There already exist many tools which could filter out all pool message >other than yours. Does anyone have the help-file for the anonymous pool of the extropia- remailer, the one of <pool0-request>? In the interest of widespread usage, please post it to the entire list. If you can, please also let us know if there is a way for us to subscribe via an anonymous remailer to an address we designate, like for instance with the command subscribe special(a)address.here where the special address given is obviously different from the one in the header of the subscription message (which would merely be a remailer). - ----------------------------------- Does anyone know more about Sameer's C2-services? In the interest of widespread usage, please post a summary to the entire cypherpunks-list. Also urge others to copy, forward and post elsewhere. - ----------------------------------- Last, I support the idea of a while ago that the remailer-operators mailing list should be open for public subscription so all those interested can get on and follow what is happened there. But how do we subscribe? Let us know, Sameer! - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLusxRyoZzwIn1bdtAQEzugGA0qpI3qGADLNL6cR70de+syh24r3I2rT3 zdEkgeq28mdQBDj8RkznVYR4q4ZUBVRh =jzKL -----END PGP SIGNATURE-----

1 0

Storm Brewing Over Forged Bob Rae Posting?
by werewolf＠io.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Anybody taken note of the ruckus about a forged posting from Bob Rae (the premier of the Canadian province of Ontario)? Seems like some joker posted a fake message from Rae through Hal's remailer at portal. Now all the lame press (and some even LAMER USENET readers) are screaming foul. I bet there will be renewed interest in the cypherpunk remailer's in the next few days :> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLusyQnBFBj7pSNyhAQHmhwf/YsmkqGBE+9o/m37BVZc/eztTXjZK/DF/ mwV4MnrqhwMXGax7+AEvfiPkI9yv2Q2Y65t9Tx0QRyZk3V9ISg1zi+cHBso4VI0A zzc2lsjFpopZbTsRujwFFLc3Spj46GJSLhxEnI6UW0k+TI6MpfaT3s2Di3m3XxZs S3dwFgAJumb/Be/h4fEBBbJqvRz3znHO9uCpmsICkijrnBlLd/hF/+L7RbTBuPKH cMW0HWCTXgneFkli+tGlSI8qjDSiIP2YMnZRFFl9ykOvw130b/+UTmeM+0+yrnPX fzdFyJAQQMER5nn/bP3ML5mSbyqZ7pW7k0AH9V6oeccSGj6Zmbvm0w== =Qe95 -----END PGP SIGNATURE-----

7 8

[cpunks] Re: public accounts / PGP / passphrases
by tim werner 17 Dec '03

17 Dec '03

>Date: Mon, 5 Dec 1994 05:24:12 -0500 >From: "L. McCarthy" <lmccarth(a)ducie.cs.umass.edu> >...The only solution I can imagine is to keep >a notebook computer running Linux at work, and dial in to the DECstation >five feet away from my desk at work. I've no idea how to convince the tech >staff here to add a dedicated phone line to my lab for this purpose. Any >better suggestions on using PGP safely during the workday ? Well, for one thing you don't need a phone line in your scenario. You can probably just connect the serial port of your laptop to one of the decstation serial ports, using a null-modem cable (pins 2 and 3 swapped; 4 jumpered to 5; 6, 8, and 20 jumpered to each other; and 7 passed through, or something like that) But I agree that the idea of buying a laptop so you can use PGP at work is odious. There must be a better way. tw

2 1

A few articles of interest...
by alano＠teleport.com 17 Dec '03

17 Dec '03

For those who have not seen it... The January 1995 issue of Dr. Dobbs has tw articles of interest. - Bruce Schneier has an article on GOST. (A Soviet varient on DES.) - An article on RC5 by Ron Rivest! (Which includes source code!) Dr. Dobbs has had a number of good crypto related articles as of late. (Having a regular column by Bruce Scheier could be part of it...) Also, for those who are interested in Windows 95 (users 0)... Andrew Schulman has an article on Windows 95 from the inside. (This is part of his new book and the reason he got kicked off of the beta team.) Interesting reading. | "Encryption ROT13s your mind." | alano(a)teleport.com | |"Would you rather be tortured by the government | Disclaimer: | |forces or the people's liberation army?" -mklprc | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.|

3 2

Re: BofA+Netscape
by amanda＠intercon.com 17 Dec '03

17 Dec '03

> Would you mind elaborating? Sure. Netscape has managed to alienate many IETF working groups, including HTML, HTTP Security, IP security, and so on by implementing and distributing half-cooked "extensions" to HTML & HTTP without a lot of forethought. As a result, they've greatly multiplied existing interoperability problems, and created a very confused environment in precisely those areas that most need standardization and consensus (security and HTML itself). That help? --Amanda

1 0

Four11 Free Listing Thank You - KEEP THIS MESSAGE!
by mailbot＠sled.com 17 Dec '03

17 Dec '03

========================================================================== _______ ___ ___ ___ _ _ ______ /__ / / / / /___/ /| /| FREE LISTING THANK YOU _____ / /__/ /__/ / \ _|_ _|_ KEEP THIS MESSAGE! ========================================================================== THANKS Thanks for adding your listing to the Four11 Online User directory. We hope you find this directory a helpful resource and we encourage you to send any comments about the service to comments(a)Four11.com. If the directory puts you in contact with a lost friend or colleague, please let us know. Please send your friends a copy of our free listing form or direct them to our home page at URL http://www.Four11.com/. YOUR PASSWORD Below is your password. PLEASE KEEP A RECORD OF YOUR PASSWORD IN A SAFE PLACE. You will need it for searching the directory, changing your listing, and accessing other free services. You can change your password by sending an e-mail to change(a)Four11.com. Remember to include you current password as the body of the message. Your password is "thibsi". YOUR LISTING Your listing will appear in the directory, usually within 24 hours, but you can access the directory immediately. For complete information on the services now available to you, send an e-mail to info(a)Four11.com. TO SEARCH To search the Online User Directory, connect to our Web page at URL http://www.Four11.com/ or request an e-mail search form by sending an e-mail to finduser(a)Four11.com. TO OBTAIN SOMEONE'S PGP KEY To obtain someone's PGP Public Key, connect to our Web page at URL http://www.Four11.com/ or send an e-mail to key(a)Four11.com and include the person's e-mail address as the body of the message. ========================================================================== * Online User Directory * PGP Key Server * _______ ___ ___ ___ _ _ ______ /__ / / / / /___/ /| /| info(a)Four11.com _____ / /__/ /__/ / \ _|_ _|_ http://www.Four11.com/ SLED Corporation * humans(a)sled.com * (415)323-2508 * Fax: (415)326-0730 ========================================================================== (c) 1994 SLED Corporation, All Rights Reserved chief nerd has spoken

1 0

Four11 Membership Form
by mailbot＠sled.com 17 Dec '03

17 Dec '03

========================================================================== _______ ___ ___ ___ _ _ ______ /__ / / / / /___/ /| /| MEMBERSHIP FORM _____ / /__/ /__/ / \ _|_ _|_ ========================================================================== In response to your recent request for free access to the Four11 Online User Directory, you have been sent two messages via e-mail. The first message includes your password and this message is the second. If you do not receive your password within 24 hours, please contact us at support(a)Four11.com. We hope you find the Online User Directory a helpful resource. If you find this service useful and wish to support it as well as take advantage of additional features, please consider becoming a member. A Four11 membership provides the following benefits: + Expanded Listing With Alternative Names And Display Message + Additional Group Connections + Search Agents + PGP Public Key Certification And Storage On Key Server + Hot Link To A Personal Web Page If you wish to become a member ($20.00 USD), follow the instructions on this form. If you wish to learn more about these benefits, send an e-mail to info(a)Four11.com. ========================================================================== PGP USERS If you are a PGP user and wish to store your public key on our key server, request a special membership form by sending an e-mail to upgrade-pgp(a)Four11.com. All others should use this form. ========================================================================== THREE STEPS TO A MEMBERSHIP 1. Pay a sign-up fee ($20.00 USD) which also covers the first year of service. (Our current yearly renewal is $10.00.) 2. Receive a notification from us via e-mail. 3. Enjoy your member benefits. ========================================================================== PICK A PAYMENT OPTION BELOW: TO SIGN-UP BY PHONE (VISA and MASTERCARD ONLY) Call (415) 323-2508 BEFORE CALLING, please read the Acceptable Use Policy below. TO SIGN-UP BY FAX OR MAIL (VISA, MASTERCARD, OR CHECK) 1. Print a copy of this form and follow the remaining instructions. 2. Read the Acceptable Use Policy at the end of this form. 3. Please check the name and e-mail address below. If not correct, CLEARLY print the correct information in the space to the right. Please do not cross out the original information. Name: Anne E Mous Primary E-Mail Address: cypherpunks(a)toad.com 4. Print Your Day Time Phone Number Clearly: ____________________________ (In case there is a problem with your order.) 5a. If you are paying by credit card: Total Charges: $20.00 USD ( ___MC, ___ VISA ) Credit Card No. (PRINT CLEARLY): ______________________________________________________________________ Expiration Date:_______________________ Signature:____________________________________________________________ Fax this entire form to (415) 326-0730 or mail it to: SLED Corporation PO Box 309 Redwood City, CA 94064 5b. If you are paying by check: Mail this entire form with a check for $20.00 USD ($27.00 CAN) to: SLED Corporation PO Box 309 Redwood City, CA 94064 When we have processed your payment, we will send a notification to your primary e-mail address. Thanks for your business! ACCEPTABLE USE POLICY Four 11 Directory Services are offered by SLED subject to rules governing the use of these systems and related services. By subscribing to and using Four11 Directory Services, you agree to pay all applicable fees and to abide by this Acceptable Use Policy and applicable rules. 1. You agree to use your own name and other personal information. 2. You agree to not use the system for any purpose that is illegal. 3. You agree to not use the directory to contact persons in a way that they find objectionable. 4. You agree to not copy information from the database for commercial purposes and/or financial gain. 5. SLED reserves the right to terminate a users access to the system. 6. SLED makes no warranties. Additional information can be obtained by requesting our FAQ (send an e-mail to faq(a)Four11.com or connect to URL http://www.Four11.com/) If you have any legal questions or concerns, please read the FAQ. ========================================================================== * Online User Directory * PGP Key Server * _______ ___ ___ ___ _ _ ______ /__ / / / / /___/ /| /| info(a)Four11.com _____ / /__/ /__/ / \ _|_ _|_ http://www.Four11.com/ SLED Corporation * humans(a)sled.com * (415)323-2508 * Fax: (415)326-0730 ========================================================================== (c) 1994 SLED Corporation, All Rights Reserved chief nerd has spoken

1 0

Children's Books Mentioning Privacy
by DarScott＠aol.com 17 Dec '03

17 Dec '03

On Tuesday I will be giving a talk on Children's Books with Freedom Themes, but I have not found anything on e-mail privacy or privacy in general. Any suggestions? Fiction or Nonfiction. Dar Scott

2 1

Re: Netscape competence
by amanda＠intercon.com 17 Dec '03

17 Dec '03

Excuse me, but Adam Shostack didn't write that paragraph you quoted. Amanda Walker <amanda(a)intercon.com> did, as I recall. Nope, Adam wrote it. I just followed up to him with additional vitriol :). Amanda Walker InterCon Systems Corporation

1 0

Clarification of my remarks about Netscape
by Amanda Walker 17 Dec '03

17 Dec '03

Several people have asked me to clarify my recent comments about Netscape. I am more than happy to oblige. First of all, let me begin by saying that I am a biased observer, and that all of this is my personal opinion. My annoyance with Netscape is also closer to the surface this week than it normally is, due to a variety of factors (including having just returned from the San Jose IETF meeting). My initial comment, and the ones that follow in this message, are thus more frank than is my usual style on, say, public Usenet newsgroups. That being said, here are some of the data that has gone into my impressions of Netscape so far. (1) Netscape plays very fast and loose with HTML. Rather than participating in the existing standardization efforts, they have indiscriminately added "extensions" to it that are not supported by any other client software, and which in some cases go directly against HTML's markup-oriented structure. This only adds more confusion to an already muddy area, delays the prospects for a standard HTML specification, and divides the WWW into "WWW Classic" and "Netscape-compatible". Personally, as a strong proponent of universal interoperability, I find this reprehensible. There is no need to bypass existing efforts just to add cosmetic value to your own software. (2) The Netscape Secure Sockets proposal has an extremely poor security model. It is not an end-to-end security model, but rather relies on transport level security, which is in my view dangerously inadequate for reasons which should be obvious to most of the folks on this list. It is also tied directly to the RSA certification hierarchy. Now, for those of us who have X.509 certificates rooted in the RSA Commercial Certification authority, that's fine, but it also means that any other WWW client that wishes to interoperate with Netscape's "secure servers" must license TIPEM from RSA Data Security, and consequently pay RSA's rather high royalties, unless the software is free (in which case RSAREF can be used). This serves as a direct barrier to competition from other commercial vendors. This is not all bad--I happen to like RSADSI's products and technology--but promoting a transport-level security system instead of an end-to-end one is to my mind simply irresponsible. There has been no peer review of Netscape's security model--it was simply implemented by fiat, without regard for the IETF standards process. I find that this leaves a very bad taste in my mouth. I also heard similar sentiments from a wide variety of other attendees at the IETF, including members of the IP Security working group, people who attended the Secure HTTP BOF, and others. This leads me to believe that it's not just a matter of me leaping to wild conclusions. (3) Netscape is viewed as a "loose cannon" by most of the other commercial players in the WWW arena, mainly because they have introduced a fair amount of FUD into the HTML standardization effort, while simultaneously promoting themselves as being standards-based. Members of Apple's "Cyberdog" project and Microsoft's web projects, who *are* trying to contribute to the standards process, had particularly excoriating things to say in this regard. Now, as I said, I am biased and my comments about Netscape are strictly my person opinions. I will be perfectly willing to revise these opinions as I receive more data. For example, if Netscape takes a more active part in the standards process, works with RSA to secure wider availability of the underlying technology required by their proposals, and generally demonstrates a willingness to play nicely with other children, that would be great, and I'll just as strongly defend them as I am panning them now. However, in my view, they have not shown a good initial track record. Only time will tell. Amanda Walker InterCon Systems Corporation

1 0

The Four Horsemen
by Mats Bergstrom 17 Dec '03

17 Dec '03

>From the recent essay "Anarchy" by T.C. May: The use of encryption by "evil" groups, such as child pornographers, terrorists, abortionists, abor- tion protestors, etc., is cited by those who wish to limit civilian access to crypto tools. We call these the "Four Horsemen of the Infocalypse", as they are so often cited as the reason why ordinary citizen-units of the nation-state are not to have access to crypto. A problem with the Four Horsemen is the various definitions currently in use on the Net. Two of them are generally agreed upon: Drug Dealer and Terrorist. Usually either Pedophile or Pornographer is the third. The fourth varies the most: Tax Evader, Spy etc. Abortionist and Abortionist-Killer are new prospects. Who were the Original Four? (No, I'm not asking about White, Red, Black and Pale.) Mats quit

2 1

Real-time surveillance of the police
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In the December '94 issue of Wired, ("Watching the Detectives", p. 141), Sandy Sanfort describes Bob Fleming's work to make real-time permanent recordings of the body positions of police officers. One could place a small sensor on each wrist and ankle, and record the positions (and velocities) of the cops body to with a _centimeter_, anywhere in a city. The advantage for cops is that a fallen officer can be quickly located, and a cop's claim to have witnessed an event can be corroborated by demonstrating that he was actually there. The advantage for society is that the cop's behaviour, such as billy-club swinging velocity, can be monitored. It could detectgunfire, too, by measuring the kick that is transmitted down the cop's wrist. This would work to the extent that the equipment is actually mounted on the cop it claims to belong to, so some manner of authentication would be needed. Also discussed is the idea of car or helmet mounted cameras, transmitting images continuously, to be stored by a neutral third-party, in the event of a legal challenge, either from the accused claiming that the cop is lying, or of claims of police brutality. After the Rodney King incident, I had the notion, (which I did not act on to actually promote, I'm sorry to say), that organizations representing people that feel persecuted by the law could issue disposable cameras to all there members. For example, if a street gang felt the cops were thumping their members with unwarranted enthusiasm, the gang could purchase a case of cameras at the local Price Club, and everyone could carry them to photograph the cops. In addition, cameras could be unobtrusively mounted on car hoods, perhaps with three or four such cameras multiplexing their images onto a single videotape (one wants a wide, but not necessarily tall aspect ratio; three such cameras with fisheye lenses could cover the hole perimer of a car). The VCR would be in a fireproof safe welded to the car frame (or use a surplus flight recorder package), so it would take extra effort for a cop to conceal the evidence of wrongdoing after mistreating the driver. It would also be handy for assigning responsibility in traffic accidents. Yes, that's right - keep surveillance cameras going on _yourself_. If you're not doing anything illegal, you've got nothing to fear from taping everything you do. Of course, after the difficulty the City of Santa Cruz had in establishing a Police Review commission, and considering that its powers were eviscerated in light of a lawsuit threat by a police union, I expect that it will be difficult to convince our Nation's Finest to adopt this new technology - though I'm sure they'd be happy to apply it to parolees and those serving on probation. Adoption could be initially achieved, though, by pointing out to private security firms that their liability could be reduced by monitoring their employees - obvious slackers could be immediately fired, troublesome guards could be disciplined, and the firm could demonstrate in court that the guard was nowhere near the scene when the plaintiff claimed to have been beaten by a guard. Private security guards have nowhere near the influence that police unions do, and so would have little power in arguing against it. Later on, cities faced with expensive lawsuits could strike a deal with the liability insurance companies to save money if the city cops use this stuff. After the DT fiasco, and the mention yesterday of the DOJ's new Big Brother Database, I thought you'd like to hear that someone's working on giving Big Bro the stick too. I personally feel that a society that _needed_ to do this to its cops is an abhorrent society. But perhaps we could strike a deal with Big Bro - if you don't tap our phones, we won't pass laws to tap your cops. Best Wishes in this Holiday Season, -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLusCMKJTibhK6XY5AQF+IAP+MCHtgnCbJc96lrOcoNt0HWal4nNF7JVN t6qIM6DDdGp5+IEimHTzgkUlUSZ4ojcIYEbjaae8Q58VRMOQ9zFaZlIWSeTTgZiQ wXIicZJreKeonTI0mwZauAbtmuEy3vWRp19Qf2fYwaMOY3QLy1vhTgG7g2iRpccI T6YspCxcYdw= =YK34 -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCPAy7JYr8AAAEEAJ4GpoYcH5abkSq5FZQ9LxoP9oKKQDXHRGZT8QCcnVZ8o87H p9kEaUJIyzGbMHpO7C09qShwcrII2VfCZ77iWlBglmdLEa/dKXRCSWMFF52RcSDh zJF8m0wE2SZ9x4Y6KuXM3RwJVdEKLhsAImxckvfj0UBvb5xtJ6JTibhK6XY5ABEB AAG0LU1pY2hhZWwgRC4gQ3Jhd2ZvcmQgPGNyYXdmb3JkQHNjaXBwLnVjc2MuZWR1 PokAVQMFEC7p5d9yRW2Du2TJYQEB7YMB/2ToOoN7aVNUnGyykxKAVjvMDcMGgSPM IR3+wUqzpAyH43tEwKBHStYj2jSlHimRXWi6lpvSwZ7rKsOtQoeSlnCJAJUDBRAu yWQXolOJuErpdjkBAaRSA/48+f7RqKXbsLJIEx8b0A0XuA/671B6L7PiC3BS5kMh QtIlRxFlgTLUp03D2TlbEyqoaJwwIjE71k3+V2rM712WGiDlQSRjtrU21/QDNzbZ C48r+pUBO7bLHe/16ED8tgsSONH+7DIdQGw6uN1v4aTiOk2HxgDHGa3RjEewbrfW 2w== =bZwx -----END PGP PUBLIC KEY BLOCK----- Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

2 1

What Happened to Xenon ?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Anybody know what became of Xenon ( qwerty(a)netcom.com ) ? I did a finger of his account and got back unknown user ... He seemed like somebody who was in the spot light , funny that he just dropped out of sight . ^X

1 0

Broadcasts and the Rendezvous Problem
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Seems to me that one of the fundamental building blocks necessary to a host of anonymous services is a means of rendezvousing in a manner that is not vulnerable to traffic analysis. The obvious solution to this is through the use of a broadcast medium. Has anybody created an alt.* group purely for remailer-associated rendezvous? If not, it seems like that would be a very worthwhile direction to pursue: with such a mechanism, nodes of a "remailer net" can surface and disappear with minimal disruption to the net. Folks spend a lot of time bemoaning the transience of specific instances of remailer nodes: why not turn this into an advantage by architecting a network of system that is resilient against the destruction and/or compromise of individual nodes? - -- Todd Masco | "'When _I_ use a word,' Humpty-Dumpty said, in a rather cactus(a)hks.net | scornful tone, 'it means just what I choose it to mean - cactus(a)bb.com | neither more nor less.'" - Lewis Carroll - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLut3AioZzwIn1bdtAQHocwGAq/KWiFGi2nJ4Kuve/0jUv1xX5aAJknWc NRfJUts3Y0PfKZZbSETEwYPNfX48O4TB =NIBb -----END PGP SIGNATURE-----

2 1

comments on emoney story
by steven＠echonyc.com 17 Dec '03

17 Dec '03

There's been a few comments about my Emoney story in the December WIRED and I thought I'd clarify a couple of things. FROM JOHN YOUNG: >And, yes, for the Chaum-uncharmed, Mr. Chaum was rude to Mr. >Levy. Whether Mr. L. is rude in kind to Mr. C. is an exercise >left to the reader. For the record, I didn't consider Chaum rude to me. Actually our interviews (which were considerably lengthy) were quite cordial and not at all contentious. In fact, I think gracious would be be a better way to describe Chaum's behavior towards me. Perhaps John is thinking that David's reticence to publicly talk about some personal stuff is akin to rudeness. If that's what came out in the story, it was certainly unintentional. And I certainly hope I was not rude to Chaum in the article. I tried to portray him fairly, give him his say, and explain his work so that people would agree with me that it is extremely important. BTW, Chaum has indicated that he had no problem with the article. FROM KAWIKA DAGUIO: > ><As you can guess there are two opposing camps on [anonymity]: > ><U.S. Government Agencies AAA .. ZZZ DigiCash Corporation ><The American Bankers Association - vs - assorted cypherpunks ><Microsoft Corporation assorted privacy advocates ><The Borg at least one Libertarian > > ******************************* >Whoa! Much of content of the discussions I had with Mr. Levy >concerned the importance of protecting privacy and security for >everyone. None of those comments made the cut. Yes, I have >concerns about fully anonymous digital cash, but while I am not a >full on crypto-anarchist, neither am I a crypto-facist. I confirm this, and it wasn't my intent to make Kawika a crusader against anonymity, but someone who, as he says, has concerns about anonymous cash. I've gotten some good feedback on the article, but unfortunately on the bio line Wired misspelled my email address (!) so I'm probably missing some of the best remarks. _______________________________________________________ Steven Levy steven(a)well.com steven(a)echonyc.com author, Hackers, Artificial Life, Insanely Great contributor, Macworld, Wired "When the going gets weird, the weird turn pro." _______________________________________________________

1 0

Re: DDJ on RC5
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Alan Olsen writes: > The January 1995 issue of Dr. Dobbs has tw articles of interest. [...] > - An article on RC5 by Ron Rivest! (Which includes source code!) Does it differ substantially from the code in the preprint, ftp://theory.lcs.mit.edu/pub/rivest/rc5/rc5.ps ? - - -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLut/PGf7YYibNzjpAQG6UwP/SR+SJoimlppN79PrW2B3W8otK3ZbkQX7 YTbdIy84mloYHLTLpY+XnzTSJ+yY6rarqi/QFia2MNpKoLySBmRVFU2LuGcZyj+b Xh3w7GPqJF3Re2acfdRicIjY3QTU3dryTqC9v9qEq90rCGWXZAHryoV7ALwPnoG0 UvxogTSS2bY= =5twK - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuuAdSoZzwIn1bdtAQHqdQF+MMVvMfQgFJF7sne7Dn0ACypFccBbWjgn TOc7YK2sL5RxxzNGyB+Bid+50vNT0rIt =1Fv5 -----END PGP SIGNATURE-----

1 0

Globe and Mail Article On Forged Posting
by werewolf＠io.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ok, here is the text of the story about the "Forged Bob Rae Posting" from the Toronto Globe and Mail. An examination of the story only indicates how far our journalists and politicians have to go in understanding the Internet! ============================================================================ Tories cause uproar in legislature Rae furious after Harris distributes prank letter circulating on Internet - From THE GLOBE AND MAIL, Toronto, December 9, 1994 pg A6 BY JAMES RUSK and MARTIN MITTELSTAEDT Queen's Park Bureau TORONTO - Progressive Conservative Leader Michael Harris caused an uproar in the Ontario Legislature yesterday by presenting a prank letter circulating on the Internet computer system that is purported to have been written by Premier Bob Rae. The computer message has Mr. Rae making tasteless references to Ontario's Attorney-General Marion Boyd and commenting on the trial of Karla Homolka, who was convicted in the slayings of two Ontario schoolgirls. A copy of the letter obtained by The Globe and Mail warns that "this message is NOT from the person listed in the from line. It is from an automated software remailing service" in California. This message was on the letter from the time the company received it and passed it on to the computer bulletin board where Internet users can read it, said Gwen Rachlin, director of operations for Portal Communications of Cupertino, Calif., through which the message was posted. However, the copy distributed by the Conservatives yesterday did not contain any notice that it was a fake, and Mr. Harris made the sensational claim that the letter could indicate a security lapse in the Premier's Office. A furious Mr. Rae criticized Mr. Harris outside the legislature, accusing him of leading to the "Americanization of Canadian politics" through the use of "dirty tricks. "I really do think that Mr. Harris has reached a genuine new low. I think it's a low that I hadn't anticipated he would hit, but in my book he's hit it," Mr. Rae said. It is relatively easy for an Internet user to send fake messages on the system, which links millions of computer users around the world. But Mr. Harris said a lapse could have occurred in the Premier's Office, allowing someone to send the letter. Mr. Harris told reporters that he raised the issue out of a sense of worry that foreign governments could get on the Internet and place fake messages about the province. He was quick to add that he didn't think the Premier wrote the letter. "Clearly it didn't come from the Premier or anyone close to the Premier. But it does raise the security question," Mr. Harris told reporters. Mr. Rae lashed out at what he called "the dirty tricks stuff, the right-wing nonsense that he's coming up with every day. . . and then this stuff." When Mr. Rae found out Mr.Harris's aides had distributed the letter to the media, he said he couldn't believe the party "would engage in that kind of tactic. This is unbelievable. Today, you have managed to lower the tone of this place. " The Premier then stormed out, and the Speaker called a 15-minute recess to allow the tempers of the MPPs, many of whom were shouting at each other, to cool. It was the last day of this sitting of the House. The copy of the letter distributed by the Tories to the media had the obscene references blacked out, although Mr. Harris had given Mr.Rae an original copy. A press release issued by the Conservatives referred to Mr. Rae as "road-kill on the Information Highway," and exulted, "Internet Bob: the hacker is hacked. " Mr. Rae called these comments "bizarre." The phony message, which was posted on Saturday in a computer bulletin board called ont.general, was discovered by the Premier's Office on Tuesday, but the office decided that it could do nothing about it. Mr. Rae recently announced that he had an address on the Internet. Ont.general is a computer bulletin board on which Internet users discuss life and public issues in the province, said Larry Sherman, president of Internet Seminars of Woodbridge. A message can be removed from the board only by whoever posted it, and it was decided that to make a fuss about it would draw unnecessary attention to it, an official in the Premier's Office said. The official, who asked not to be named, said the office has not launched an investigation into where the message came from. Ms. Rachlin said the company received a call from police about the letter yesterday afternoon. But she said the company had already had "some incidents" with the source of the message. She added that she was ready to co-operate with the police. The source of the message was an account that provides a service that allows people anonymous access to the Internet, she said. Mr. Sherman said it is very easy to post a false message on a bulletin board and to make it appear that it came from a computer different from the one that sent it. By going through a California bulletin board, "obviously someone has gone way out of their way to send that in," Mr. Sherman added. Even so, the message can be traced, said Rick Broadhead, co- author of The Canadian Internet Handbook. "If they [the sender] have gone through a service, it is going to take some more work to trace it," Mr. Broadhead said. But looking at the log records of the computer service, police can follow the message back to the originating computer. The use by the Conservatives of the fake letter again puts the spotlight on the party. Last months, the Tories played pranks at an NDP convention sending in a camera crew that shot pictures ridiculing Mr. Rae, including a doctored video sequence that seemed to give the Premier a stutter. The picture were broadcast as dinner-time entertainment at a Conservative convention the same weekend. The Tories also bought a copy of a labour bill sold at an NDP fund raising and paraded it around their convention like captured trophy. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLuuWG3BFBj7pSNyhAQG9mQf+PkUbz0M1KGoEF74yhFppu90+P7NUP0QW ew1Hzb0kTX214vCGSepo5+UTD2VRE9xuLSbQKH3HQAaXwL+LTS1sCUcRSOdWHG+4 u0NcNHVsY/rBojeEirWDa+5+Ma1fsfYKa9hq0qdzimbvP5UUQA/y9PGkh7o1Y/fn ad3v6t2ttOEHrYu7YBq4DX9HUcMGMJrGY3FQQhKEzuWnIRyc/x33XFj/M9x8p+uf wh9h4FJFE5jWp520P3mmAK0+10F/IbmxUJ2f4RTBawOwEVViOM6gYm1XnCsxO1YB BG9HPLBJUMquLkpPu9GxtmNsX5Dmtcipr8ZADz/szT3b7bxIUzqHww== =SNgW -----END PGP SIGNATURE-----

1 0

Re: Broadcasts and the Rendezvous Problem
by L. Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Timothy C. May writes: > Isn't this what "alt.anonymous.messages" is all about? > > (It's been at my Netcom site for many months now...I don't recall who > created it, but it seems to me it was one of us.) Alas, it is not available at MIT. I'll have to scrounge for a server that carries it (volunteerings of feeds welcome!); Though netcom is our IP provider, I'd rather not get news from them. > > Folks spend a lot of time bemoaning the transience of specific instances > > of remailer nodes: why not turn this into an advantage by architecting > > a network of system that is resilient against the destruction and/or > > compromise of individual nodes? > > I'm not sure what you mean by this. More remailers are always a good > thing, and offshore sites are especially good, but I'm not sure what > you mean by your last point. (Following details of the current system might be wrong. Please correct me where necessary.) My thought is this: If we were to design and implement a system, perhaps a two-tiered system with "fortress" and "intermediary" remailers as has been suggested, it's desirable to build a system that will continue to work even if a large portion of the nodes are removed (whether by Earthquake of Sun Devil). This is the system we'll have to build if we stop resisting the notion that remailers regularly come and go with little warning. The rendezvous problem is not currently addressed in a satisfactory way: premail/remailer-ping, or its equivalent, hardwires in the location of a known set of remailers and finds the subset that corresponds to remailers having a common characteristic (usually just whether they're working reliably or not). That's not a very good approach: a human has to add a new remailer into the "net" by adding it to the systems polled. Not only is the human intervention a Bad Thing, but having a central registry of remailers is bad infrastructure. A more "web-of-trust"-like mechanism is desirable. So, a dispersed view of the remailer net, both entry points and intermediary points, is necessary. In order to build such a system, we must solve the rendezvous problem: how does "premail++" know where to send its mail and how does remailer A know where to find remailer B (and B find exit point C)? This is where my train of thought dovetails with the newsgroup question: bringing a new remailer on line could be achieved by broadcasting a message through a newsgroup specifying the location and type of the remailer. If necessary, one or more pseudonymous automatic testing agents could pick up the message and put the remailer through a barrage of tests, broadcasting a "remailer certification" with a certain duration. "Premail++" and remailers could find their next hop by examining current certifications and choosing one with desired characteristics, scoring by trusted testing agents and other criteria (including the passage of time since the last certification). If an exit-remailer is chosen early in the game, multiple paths to the exit-remailer can be used to improve reliability (exit- remailers would also probably have a shorter cycle of certification). Technically, this is feasible. I could write the code fairly easily (though I'm not offering to do so at this time: if I do, pieces will be offered as fait accompli). My question is whether this strikes anybody else as a desirable design: we would end up with a net of remailers that is fairly resilient and not dependent upon any one list of remailers. If a node goes down, the net adjusts in rather short order and service is not disrupted. This picture needs to be fleshed out a bit more, but I thought I'd bounce this around before solidifying it in any particular way. - -- Todd Masco | "'When _I_ use a word,' Humpty-Dumpty said, in a rather cactus(a)hks.net | scornful tone, 'it means just what I choose it to mean - cactus(a)bb.com | neither more nor less.'" - Lewis Carroll - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuuBmSoZzwIn1bdtAQEI9QF/fX2LPoUwzlKYJqJ1s0vb/mIX4NzT1jOo UNHdiOYNJ+vgpPQyIZ9OQynMuKfSVgU/ =vn6H -----END PGP SIGNATURE-----

3 2

Re: Real-time surveillance of the police
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 2:04 PM 12/11/94 -0800, Timothy C. May wrote: >This was an idea explored in detail by David Brin in 1990 in his novel >"Earth." Video cameras are ubiquitous and have a major effect on >casual street crime. Hard to forget Brin's description of little old ladies sitting on their front porches, "armed" will full-sensoria headgear, laying in wait for extremely uneducated juvenile miscreants... Humorous. >This scenario is a likely way that "position escrow" will evolve, from >a voluntary escrowing (incl. timestamping, etc.). "Those with nothing >to hide" will agree to escrow their movements...this will exculpate >them in suspected crimes, etc. A slippery slope. In "City of Angles", Kim Stanley Robinson(?) talks about just a virtuous all-surveilling governmental "privacy" authority which is supposed "protect" your privacy from the police, who had to subpoena the information to get it. > >On the topic of how these localizers actually work, I'm not at liberty >to talk about the technology. It's novel, and uses a *lot* if digital >signal processing. It doesn't use GPS and it's not a variant of >cellular telephones. I wonder if they're using an active/transponder system. That's what O'Niell's Geostar system was designed with in the early '80's. It would have put up cheaper sattellites and smaller earth transponders. The way you saved on transponder size was with very small bursts at very high power. You could send a signal to a small net of satellites 30,000 miles up with a box initially no bigger than an HP12C, and which would shrink more with time. The feds never liked Geostar 'cause they already had the passive/receiver GPS in the works, and they wanted to "amortize" the social cost of an essentially military (hence the requirement for a passive system) system on the backs of commerce. The only thing which saved GPS for mere mortals like us was the MIC's usual severe understimate of Grove's Law and the exponential cost effectiveness of integrated circuits over time. If my hunch is correct, with lots more local antennas, the power requirements of the tranceiver, and as a result, the tranceiver size, gets pretty small. Small enough to be worn on one's ankle. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

Re: Remailing Services Questions
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Anonymous writes: > If you can, please also let us know if there is a way for us to subscribe > via an anonymous remailer to an address we designate, like for instance > with the command > > subscribe special(a)address.here > > where the special address given is obviously different from the one in the > header of the subscription message (which would merely be a remailer). Could you explain this a bit more ? I'm not sure what you're asking. > Does anyone know more about Sameer's C2-services? > In the interest of widespread usage, please post a summary to the entire > cypherpunks-list. Also urge others to copy, forward and post elsewhere. First, here's an excerpt from http://www.c2.org:80/services/: - - --- begin included text ----------------------------------------------------- Fully blind anonymity If you want to protect your privacy and still have mail go to your normal mailbox (either at work, at school, or through any other way you get internet mail), you can sign up for the blind anonymous server. You can set up an alias with us and mail to your alias will get to you, even though we have *no* idea who you are or where mail to you ends up going. This is available for only $10 for about every five megs of traffic which goes through the system. When you sign up you will get about one meg of free traffic. Also available is a Blind Server Client to make things easier. - - --- end included text ------------------------------------------------------- I reproduce below the current contents of http://www.c2.org/services/blindserver.html: - - --- begin included text ----------------------------------------------------- The Blind Anonymous Server by Sameer Parekh <sameer(a)c2.org> Copyright 1994 Introduction I hatched up the Blind Anon Server because of Eric Hughes's comments about the safety in ignorance. I wanted to run an anon server, maybe similar to Julf's remailer, but I did *not* want to know the connection between anon-ids and real IDs. I still wanted it to be easy to use so that someone who wanted to send mail to an anonymous person need only send it to a standard mail address, instead of using Hal's remailer return address block, which is an incredible pain to use. The system I have hatched up is relatively secure. If you take the proper steps to secure your identity from me, even if I were keeping complete logs, I would still know nothing of your true identity and if my records were subpoenaed, I could freely hand over the contents of my records without any worry that the privacy of my users will be violated. The system requires all commands to be pgp signed. Thus you will create a public/private keypair for your anonymous identity, and all administrative commands to the list regarding this identity must be signed by that key. You can send list commands from any address-- an anon remailer, a friend's address, Julf's remailer, whatever.. and as long as it is signed by your identity's key, all will be well. If you don't want to deal with every detail of the server, you can just use the blind client program that's been written to make using the server much easier. Setup First you have to create your alias on the anonymous server. Creating the alias is easy, but setting it up to work right takes a bit of effort and bookkeeping on your part. (Maybe I'll write a client which can take care of all the bookkeeping.) Create a pgp keypair with a User ID of the form "Psuedonym <alias(a)omega.c2.org>". Send your public key to admin(a)omega.c2.org with the subject line, "addkey". This will create for you an anonymous id which can be accessed via "alias(a)omega.c2.org". You should only send one key to the server in any single addkey request. You have to choose an account name which hasn't been used before. In order to get the list of all account names which have been used and are not available, send a message with the subject "sendused address" to admin(a)omega.c2.org and the list of unavailable names will be sent to address, with the body of your request tacked on to the top, so you can use a remailer for the "address" and the body can be an encrypted mailing block-- you need not reveal your identity to me in any case. Starting an account gives you 1000 credits. Now if you would like to send a message to someone from your newly formed alias, you can send a signed message to the administration address (admin(a)omega.c2.org) with the "mailmessage" command. For example: ::mailmessage To: barney(a)black.net Subject: here's the plans to the stealth bomber Keywords: bomber Here's the plans... - - --END OF MESSAGE-- The message will be sent out from omega.c2.org just as if you had sent it out using a standard mail program from omega.c2.org. Then comes the more complex part. You have to tell my anonserver how mail to your alias will actually get to you. There are various levels of security which you can use. Because the remailernet is not very reliable, the idea is that you setup a number of paths which mail can get to you through, so that if one path goes down you can still use the other paths to get mail. You can either configure it so that mail to you goes through every path (for reliability with less security) or one path chosen at random (more secure but less reliable). To add a path to your list of paths, you must send a signed message to the list, with the lines ::addpath firsthop PATH INFORMATION GOES HERE - - --END OF PATH-- The firsthop is the first hop along the path between my anon server and you. It can be your address, in which case there is a good deal of reliability, but you get absolutely no good security. The "path information" is what gets tacked onto the top of the body before the message gets sent to the first hop. Suppose your firsthop was Hal's remailer, hfinney(a)shell.portal.com.. You would have something like: ::addpath hfinney(a)shell.portal.com :: Encrypted: PGP - - -----BEGIN PGP MESSAGE----- Version: 2.3a hEwCKlkQ745WINUBAfwPrO+z9LMBz7boyyC7gUqX/QCEZkXmJCeZYoskgtH5qqbi y4mYUL5a0ApbzrhPs8ULkPnW2c4Pfr1AfYSSgvrzpgAAAEvJtPOuQsW8IVQfl+iW CAr2gd5jax+t75qbux5U/RRxlbsq4cOeGrO/i/6Km6m71Vsdj0rquEQBvREnXxdj 81YsBM9QlFNxQAB8rrQ= =Ylli - - -----END PGP MESSAGE----- - - --END OF PATH-- That pgp message is encrypted for Hal's remailer. When Hal's remailer gets the message, it will have this block on the front of the body. Hal's remailer can then decrypt it.. Maybe on the inside of this block you can put: :: Anon-Send-To: So then there's only one remailer on the chain between myserver and your real address. For more security you can embed *another* hop to another remailer with another encrypted address block. This can continue for as long as you want. The longer the path, the more secure, but the less reliable. Once the path has been added, you will be sent mail (through the anon server) encrypted with your key (all mail to your alias will be sent out encrypted with your key) with the pathnumber that your command created. Store this path number in a safe place, because you will need to use it when you test all your paths for reliability. You can create multiple paths in this fashion. The remailer defaults to "spray" mode-- this means that mail to your alias will be sent through *each* of your paths. This adds reliability at the expense of security. (It makes traffic analysis easier.) If you would like to turn off spray mode, send a command to admin(a)omega.c2.org: ::randmode To turn spray mode on: ::spraymode You can actually use this spray mode for more than just an anon-server. If you'd like to create a mailing list, you can generate a keypair, distribute to everyone on the mailing list the secret key, and everyone can send into the anon server a path to themselves. Using spray mode, mail to the address will go out to every path. This of course means that anyone can subscribe or unsubscribe (Removing paths is described below) people to/from the list. The Credit Scheme When you startup an account, you get 1000 credits. When mail is sent out along one of the paths, credit is deducted from the account-- 1 credit per 512 bytes of traffic. Note that if you are in spray mode credits are deducted for every path which is active for your alias. If your account does not have enough credit, when a message comes in you will get mail detailing the size of the message that was lost and the amount of credits you have in your account. (Size is listed in 512 byte blocks) More credits will be added to your account upon receipt of payment for additional credits to your account. The one thousand credits is in general enough to take care of occasional mail using the 'nym. Only if you use the 'nym heavily should you expect to run out of credits. Removing paths If a certain path which you have active flakes out and becomes ineffective, you need some way of turning that path off so you're not paying for it in spray mode, and so you don't lose mail in random mode. That's what the disablepath command is for. To run the disablepath command you simply send the command (signed, as always) to admin(a)omega.c2.org: ::disablepath pathnumber Pathnumber, here, is the number of the path which was assigned when you created that path. Hence it is useful for you to keep good records of your active and disabled paths. It is possible to reenable a path once it has been disabled. In order to do this you need to remember the path number and the remailer that it's associated with. To recover a path you just send: ::recoverpath firsthop pathnum And the path with the number pathnum is reactivated, with the firsthop that you give it in the recover command. Path Verification You will likely want to keep tabs such that you know when a given path flakes out on you. For this reaon the "regping" option is available. This command lets you tell the system how often you want the anon-server to send a message through every path of yours, with the pathnumber in the message (encrypted, of course) so that you can keep tabs on which paths are flaking out on you. To set your ping frequency, use the regping command: ::regping frequency Where frequency can be none, hourly, daily, weekly, or monthly. Remember that you are still being charged for these testpings. The system defaults to weekly. To get a list of all your active paths, use the command "showpaths". This command will send out a listing of the pathnumber and first hop of each of your active paths: ::showpaths Defeating Traffic Analysis The system works in concert with remail(a)c2.org, which does the work to defeat traffic analysis. All mail to each path is first sent through remail(a)c2.org for added difficulty in traffic analysis. remail(a)c2.org is a standard cypherpunks remailer with PGP with a few added features. All outgoing mail is not delivered immediately upon receipt. Outgoing messages are stored in a pool until five minutes after each hour, when all messages in the pool are delivered in a random order, ignoring the order in which they came in. Every minute there is also a chance that a random uuencoded message is injected into the remailernet. Each message injected into the remailer net is sent through a random path of the remailers in the remailernet, usually between five and 20 hops. - - --- end included text ------------------------------------------------------ > Last, I support the idea of a while ago that the remailer-operators mailing > list should be open for public subscription so all those interested can get > on and follow what is happened there. But how do we subscribe? > Let us know, Sameer! remailer-operators is a Majordomo-managed list. Send mail to majordomo(a)c2.org with "subscribe remailer-operators" in the body to subscribe to the list. The list address is (surprise) remailer-operators(a)c2.org. Hope this helps. I don't know anything about the Extropia message pool, sorry. - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuuINWf7YYibNzjpAQHhywP/W7F29XQGxxQ5m6trH4XgHaocfoSVr5h2 zSgjucQ3RkvNk++n8lX4LFKnqrd6s8tXoWm/dqKtUjLEOfP3lgLua3quh2x8PSSm zzjklsrrdhCxKo5wwaacgaq1DtUP2AjTHhxjh9OFmuiI7tqw/N0Br9RyuGyKYxdt LSvzP6e9+xA= =BszC - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuuJeioZzwIn1bdtAQEXNAF/Q5ziXcXXBxdnV7bbNqZGMV8f9kJhD+d2 nfdNgEqH1183JG5AyMokIdsCqaEeM5qd =IKyL -----END PGP SIGNATURE-----

1 0

Re: Netscape competence
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Marc Andreessen writes: > In article <199412091814.NAA07757(a)hermes.bwh.harvard.edu>, adam(a)bwh.harvard.edu (Adam Shostack) wrote: > > > It my personal feeling that Netscape doesn't have the right > > talent mix to develop secure software. For example, they may well get > > the RSA parts right, and then store the passphrase in a text file, > > 'for ease of use.' > > My goodness, that's a bit malicious and unsubstantiated, isn't it? Excuse me, but Adam Shostack didn't write that paragraph you quoted. Amanda Walker <amanda(a)intercon.com> did, as I recall. BTW, welcome to the list.... - - -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuuJZ2f7YYibNzjpAQERXQP/SJnxzt7tckazsBBtfQrKA3c08RLjYUs9 1xK3b/WqqFvmCDyMpwQg5yLzEk7uq7SFp725FMP/jZ8ZUnvpQGBxPdEaFOxpjlHU cPZOb1R1OzLQ2m0023H6LyBM3WMlCd7Nah+zOqaoTbQ1kofE9hZ2gXEfljurUy+8 7scWCfdrZfw= =sIUK - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuuKryoZzwIn1bdtAQF/jgF/SPy47fk1vvZgyXl8UBBDuASGJn+COQC5 84E+ICfuxxvxR4GauaaLLwCPdzH4l1DL =KuB4 -----END PGP SIGNATURE-----

1 0

Re: BofA+Netscape
by marca＠neon.mcom.com 17 Dec '03

17 Dec '03

At 3:08 PM 12/11/94, James A. Donald wrote: >Amanda complained that Netscape pisses all over the >standardization committees. > >Well guys, the victor has room to move. It must come as a big >shock to Apple, Microsoft, and IBM, but reality is that Netscape >can set WWW standards and they cannot. > >If they indulge the standardization committees by listening to >them first, and then deciding to ignore them, the committee >should be thoroughly greatful. For the record, we're not trying to set standards -- we're trying to build products with functionality that our customers want and need. We'll succeed or fail on the basis of whether we do that, not whether or because we set standards. We fully realize that being proprietary or isolated from existing or future standards only locks us out of our market, which does us no good at all. That doesn't mean that we're not going to innovate when we need to, but it means we're not going to be anything other than totally open and standards-compliant. To that end, we aggressively support all current standards (HTML, HTTP, URLs, NNTP, Gopher, SOCKS, FTP, you name it), are a charter member of W3O (with a concomitant $150K commitment), and from day 1 have made SSL available to the broader community and have given it to the W3O security working group (of which we are a full participant) exactly in parallel with SHTTP and the three or four other proposals that have been submitted for consideration by other companies and third parties. I fully expect we'll be supporting other security standards and approaches as they emerge, and we certainly welcome realistic suggestions on what we should do, when, and how. Cheers, Marc -- Marc Andreessen Netscape Communications Corporation Mountain View, CA marca(a)mcom.com

2 1

Re: Netscape competence
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Adam Shostack writes: > Until you hire the experts mentioned below, I'll continue to > assume that your talent mix does not include said experts. Whoops, sorry, Marc A. had the attribution correct after all. Amanda W. made some similar comments, but apparently I'm conflating the two. Please ignore my prior message. - - -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuuKRWf7YYibNzjpAQEU/AQA5T/HnMDdRp2xMkDO7//G0ycCZnkEUwpv bz0MG8mUDE6XD2iTMCt/+VUDk6sx5BpNrofZOx0A57/XYsAxc0WsXk0Rb0Kh6o7x sPFTL6BJq97sFYbObO2uXvN5bbEQ1CL40rfZghds+exWhNix2fiNfy3SSaihd+qR kZl7CiLt7wY= =V6JA - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuuLhCoZzwIn1bdtAQFi3QF+KaUcUOTrly37pZkowVc313X3qq+4Jy/j O9X/cSYleflVJl1rplCHm8cKB1KE0ICF =a9ik -----END PGP SIGNATURE-----

1 0

Articles on RC5 and GOST in January 95 Dr Dobbs Journal
by schneier＠chinet.chinet.com 17 Dec '03

17 Dec '03

In the Jan 95 issue of Dr Dobbs Journal, you will find the following: An editorial on the public release of RC4 (without code). An article by me on GOST (with code). An article by Ron Rivest on RC5 (without code). Remember, you can export cryptographic source code in paper form. Bruce

5 4

Re: What Happened to Xenon ?
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

It seems he lost his Internet access(I think he moved to work at some university which does not have an Internet node). The Macintosh Cryptography Interface Project list which he started to make some porgress in getting a mac like inter -face for PGP still exists. I can give you the necessary info if you'd like. -RH- --------------------------------------------------------------------------------- Reuben Halper I'm not growing up, I'm just burnin' out." Montclair High - Green Day - Montclair, NJ E-mail: fhalper(a)pilot.njin.net PGP 2.6ui Public Key available upon request ---------------------------------------------------------------------------------

1 0