December 2003 - cypherpunks-legacy

IPSEC
by perry＠imsi.com 17 Dec '03

17 Dec '03

For those interested in reading up on the IPSEC work, check out ds.internic.net's "internet-drafts" directory. The following are the drafts that you will want to look at. draft-ietf-ipsec-ah-md5-03.txt draft-ietf-ipsec-arch-02.txt draft-ietf-ipsec-auth-02.txt draft-ietf-ipsec-esp-01.txt draft-ietf-ipsec-esp-des-cbc-04.txt draft-ietf-ipsec-photuris-02.txt I believe that the -ah-xx.txt draft is missing. Perry

2 1

Re: An idea about Java and remailer clients and servers...
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Phil Fraering writes: > Why not "charge" for the ability to send an anonymous message with > the duty to have for a short time (maybe an hour or two) running > on your machine a node in a remailer network? User X on Machine A sends a form via HTTP (or a variant- SHTTP, HTTPS, etc.) to Machine B. User Y on Machine C receives an anonymous mail from Machine B. Suspecting User X, User Y sends a mail to be anonymized and sent back to himself to User X. User X's temporary remailer does as it's told. User Y now has a strong reason to suspect User X has sent the said mail. Cpunks write code and all, but I don't think this one's going to work. :-(

4 4

Re: An idea about Java and remailer clients and servers...
by cman＠communities.com 17 Dec '03

17 Dec '03

> I forgot to add. There is no reason User X has to run his remailer >immediately. His software could simply commit to running a remailer for >1 hour at some specified future date < some threshold. Any messages >sent to him for remailing would be queued until that time. Therefore, >all your technique would tell you is that the user remailed a message >sometime between date X and date Y. if Y-X > few days to week or two, >the intelligence gathered on User X is miniscule. Traffic analysis would >detect User X using the remailer network anyway. > When I've thought about this, it's been from the p.o.v. of message senders being able to earn prepaid service tokens (not unlike digital cash) for offering their machine as a remailer for a set period of time or number of message or total bandwidth or whatever. This activity could be completely asynchronous to any origination of messages, and, in fact, a regular habit of accumulating tokens like this would make for excellent cover traffic.

1 0

R. v. Pecciarich decision is online (fwd)
by craig＠passport.ca 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Defcon agenda
by Samuel Kaplin 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Can some kind soul forward me a copy of the agenda for Defcon? I need dates and times for the various speakers. Thanks, Sam -----BEGIN PGP SIGNATURE----- Version: 2.6.1 Comment: PGP Signed with PineSign 1.0 iQCVAwUBMBVTh+5wXwthmZO1AQGMvgQAhB5RANbZTSPBX+mvdhMiUCnmY2tlYWC3 kTeZc9WNv0qAQSUaYZE0www8pu+X2pZhRaQOKFgbB5cnHvwxoWdgCMj6O8rmDT9X ft/cgB1cls/EOHOysZdPzzx3en+aVM9EedXpLrsx53uTzaG5SHTWVOfY4nexO65e HCTFO93Ct1I= =nNPb -----END PGP SIGNATURE-----

1 0

Part IX: Allegations re Vince Foster, the NSA, and Bank Spying (fwd)
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 24 Jul 1995 23:11:45 -0400 (EDT) From: KALLISTE(a)delphi.com Subject: Part IX: Allegations re Vince Foster, the NSA, and Bank Spying -----BEGIN PGP SIGNED MESSAGE----- Allegations Regarding Vince Foster, the NSA, and Banking Transaction Spying, Part IX by J. Orlin Grabbe July 23, 1995 Gregory Wierzynski Assistant Staff Director U.S. House of Representatives Committee on Banking and Financial Services 2129 Rayburn Building Washington, D.C. 20515 202-225-7502 Dear Mr. Wierzynski: Thank you for email letter, a copy of which is attached. I am not sure why you think my quoting selections from Mr. Jim Norman necessarily implies endorsement or acceptance of them on my part. I have, of course, quoted many, many selections from Mr. Norman, so perhaps you could be more specific with respect to the ones you are concerned about. Perhaps I could be of assistance to your inquiries among the spooks, if only you could describe to me which points you have investigated, and how you have investigated them. I certainly wouldn't want to promote anything that, as you say, "flied in the face of facts." On the other hand, I am greatly concerned about the use by Alltel Information Services (formerly Systematics) of a libel attorney, Charles O. Morgan, in an attempt to intimidate journalists and destroy the First Amendment to the U.S. Constitution. And I am also gravely concerned about the possible leak of U.S. codes and nuclear secrets to a foreign power, which is an issue of *real* national security concern to the U.S. (Of course you and I both know that "national security" is often used to hide the truth about sell-outs of national security from the American people, by clamping a lid on the discussion or reporting of things that are common knowledge among U.S. military and security agencies, and even common knowledge to the general public of the foreign power to which these secrets have been compromised.) Before reading my email, and your letter, I sent you a copy of "Part VIII: Allegations Regarding Vince Foster, the NSA, and Banking Transactions Spying". There you will see from the quotes that the theft of U.S. nuclear secrets by Israel is openly discussed in Israeli newspapers, so I am sure that this is not one of the "off-the-wall" issues to which you are referring. (With respect to that issue, I suggest that you do some investigation in Tel Aviv.) With respect to money laundering I am not concerned, for reasons I have indicated in my essay "The End of Ordinary of Money", Parts I and II, a copy of which I previously provided the Committee. The money-laundering laws ought to be abolished, but in the meantime I do find the selective enforcement of these laws troubling. With respect to "Chuck in Kentucky", I know more than one Chuck in Kentucky, so perhaps you could be more specific which Chuck you refer to. What stories did he tell you, and how is it that they didn't pan out? Since you have already spoken to both Jim and Chuck, I am taking the liberty of sending a copy of this letter (and your letter) to Jim Norman, and to one possible Chuck you may be referring to, so that perhaps they can explain to me their failing to satisfy you as to the accuracy of their information. Now, Mr. Wierzynski, I would like to bring up an issue about your Committee's behavior that is troubling me. I am sure that there is an innocent explanation that I am missing. You will recall the meeting that I had with you and Mr. Stephen Ganis, the Counsel to the Committee, at the Four Seasons in Georgetown on Monday, June 12, 1995. Two days previously I had been playing volleyball in the Mall with Dana Rohrbacher and Jack Wheeler and some others, and I had pulled most of the muscles in my right ankle. So I asked everyone I was meeting to come over to the hotel, and you and Mr. Ganis graciously consented. We met in the Four Seasons lounge, where I was the only person not wearing shoes. You told me that, more than money laundering in Mena, Arkansas, you were interested as to whether there were any documents connecting Vince Foster to Systematics, or whether I knew the name of any Systematics programmers that may have worked to modify the PROMIS software to spy on banking transactions. I told you I couldn't recall seeing any such documents, and that I had come across the name of one programmer, but I had subsequently forgotten it. It was a pleasant meeting, so to be helpful I gave you a copy of Jim Norman's *Fostergate* that had been spiked from *Forbes*. "Why would Steve Forbes kill the article?" you asked. I said I didn't know, but that--since you appeared to know Steve Forbes--you should call him yourself. Now, much to my surprise, I find that the following happened: Just as *Media Bypass* was about to run Jim Norman's article *Fostergate*, they received a letter from Charles O. Morgan, indicating grave consequences if they were so foolish as to print the article. Mr. Morgan claimed to know what was in the article, because, he said, he had received a copy from Mr. Stephen Ganis of your Committee! I am bothered by the fact that while you alleged to me you were investigating Systematics that at the same time you are passing along information to Systematics. I am sure there is an innocent explanation. But consider this: what if I had given you Foster-related documents and the names of Systematics programmers? Would these have been passed along to Mr. Morgan also? As you know, a number of people connected to this whole business have died violent deaths in Arkansas. (Of course, I understand some of them had already been paid off to keep their mouths shut, and didn't, and so--under any standard of morality--deserved what they got.) Well, things are never what they appear, so perhaps you can clear things up for me. Please pass along my concern to Mr. Ganis, and tell him I will be glad to sit down with him and have a drink, or share a line, and have a frank discussion about this issue. (I have nothing against the use of any drug, if used in moderation, and in the appropriate context.) Regards, Orlin Attachment: Your letter to me - --------------------------------------------------------------------- From: IN%"gregorw(a)netcom.com" 23-JUL-1995 19:53:52.82 To: IN%"KALLISTE(a)delphi.com" CC: Subj: RE: Part VII Return-path: <gregorw(a)netcom.com> Received: from netcom13.netcom.com by delphi.com (PMDF V4.3-9 #10880) id <01HT7ZLMQQTC9VUSVZ(a)delphi.com>; Sun, 23 Jul 1995 19:53:50 -0400 (EDT) Received: by netcom13.netcom.com (8.6.12/Netcom) id QAA03469; Sun, 23 Jul 1995 16:51:04 -0700 Date: Sun, 23 Jul 1995 16:51:04 -0700 From: gregorw(a)netcom.com (Gregory Wierzynski) Subject: Re: Part VII To: KALLISTE(a)delphi.com Message-id: <199507232351.QAA03469(a)netcom13.netcom.com> Content-transfer-encoding: 7BIT Orlin -- We're reading your stuff with interest. Thank you for including me in your list of recipients; I pass the material on to my boss and my colleagues on the Committee. I am somewhat surprised, however, that you accept the Norman piece without raising any questions about its sources. We've talked to Jim and tried to check out the sources he thought he could share with us. We have also done a fair amount of investigating on our own using the resources available to us--by which I mean officials inquiries to the spooks. So far we draw a complete blank. Worse, the preponderance of the evidence suggests that Jim's piece is pretty much off-the-wall. Worse still, it appears to fly in the face not just of facts, but simple logic as well. I haven't, by any means, given up on this subject, but pursuing a trail grown cold is difficult to justify when you're paid by the taxpayer. Do you have suggestions on how we could verify some of the elements in the Norman story? I've talked to Chuck in Kentucky and am still in touch with him. But his stories have not panned out, even partially. I would be most interested in your ideas. Best regards. Greg - - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMBP21mX1Kn9BepeVAQGP3AP9Hm/kwmUuz9kNH+q9D728Xe6rdHHPjpT8 bAxwzIK9UsJsIF5oLfjTVWovEtGBj3QvJlmFY7hkVFZAYpx6q4R65NUX/ZpHtKaF QDugRJZJUxKRaD+9CYepFFt6+ZTK8pQr+me3CgY1ZBVbdNZL4LE9rLFA1Z4XD/vL csNGnDpuTq0= =t4hx -----END PGP SIGNATURE-----

3 3

Anyone going to DEFCON
by Dan Veeneman 17 Dec '03

17 Dec '03

QLDM75A(a)prodigy.com (MR ELDON B JENKINS) writes: > I don't know if anyone else from this list is going but I will be > there for the whole conference and wouldn't mind meeting up with some > of the people from this list. [...] I am also planning on attending DefCon, and would be interested in meeting up with some Cypherpunks. > Eldon Jenkins Dan -- system(a)decode.com (Dan Veeneman) Cryptography, Security, Privacy BBS +1 410 730 6734 Data/FAX

1 0

Re: Exporting from Canada (was Re: Let's try breaking an SSL RC4 key)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <m0saTpk-0005BTC(a)nrk.com>, wb8foz(a)nrk.com (David Lesher) wrote: >marc: >> However, goods of U.S. origin are export restricted, unless said >> goods are further processed outside the U.S. so as to result in a >> substantial change in value, so some of the PGP development would >> need to be done in Canada. > >How about compiling it? THAT is "further processing"...... I am not sure that would hold. After all, the disk with the source code to "Applied Cryptography" was denied an export license, because the source code could be compiled into libraries. <What kind of drugs are these people on anyway? They really ought to quit.> - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMBR5PCoZzwIn1bdtAQGSygGAs0JN64qoFfzC0OEL+yV5p/iWecnTtBeJ Fm8a7jsIqtV+FsQg7ATQRcpSxtDOnbS2 =He6y -----END PGP SIGNATURE-----

3 2

Re: Three strikes you're out! for politicians... yeah we wish!
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:52 PM 7/22/95 -0400, Rich Salz wrote: >Better yet do it the way Comedy Central wanted to: > Three strikes your out and term limits. You can run for re-election > but if you lose you get shot. > Or even better -- Gilbert and Sullivan's solution in "Utopia, Ltd." Despotism Tempered by Dynamite. Utopia, Ltd -- the South Sea Paradise that organized itself as a joint stock company -- was originally governed by an absolute despot whose despotism was kept in check by the existence of a Public Exploder. The Public Exploder's job was to blow the King up if he began to oppress the people. The exercise of his office was kept in check because if he blew up the King, he had to replace him. http://diamond.idbsu.edu/GaS/utopia/ DCF "Calynx: Yes. After many unhappy experiments in the direction of an ideal Republic, it was found that what may be described as a Despotism tempered by Dynamite provides, on the whole, the most satisfactory description of ruler--an autocrat who dares not abuse his autocratic power."

1 0

Re: Crisis Overload (re Electronic Racketeering)
by carolann＠censored.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I am a candidate for the Minneapolis City Council, 4th ward. As a registered Independent. Now if I can get a campaign donation to give every resident a copy of PGP, then I've got it made. I did run for Parks Commission in '79. 7,000 votes with no money. Love Always, Carol Anne >Direct mail is useful. But until you've worked to get someone elected, >you are just one more voice in the roar. The '96 campaigns are shaping >up. (I'm already putting the word out for '98...) This is the time to >find people who share our views, and work so that they win their >primaries--or maybe don't even have to fight one. Or maybe its time >_you_ ran. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMBSJGorpjEWs1wBlAQEJKwQAqtAXLCf5yBvvV9A5fYs2PXnKAxZK/7r6 evqMlnA7YzYF1sCxRAbF82EKJm2oZhsdWYP18m/mj9u8+NVIuj639zxcyeXme/5b mMurG2itMzhv8AogQp2fPo9bTM0FjurUYLSCwXiFlv5TVeOXv6qYYD6bjVK7HJGM RkmX40AFiac= =FEwh -----END PGP SIGNATURE----- -- Member Internet Society - Certified BETSI Programmer - Webmistress ************************************************************************* Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 carolann(a)c2.org - carolb(a)spring.com - carolab(a)primenet.com ************************************************************************* My Homepage The Cyberdoc

1 0

Re: Mixmaster for DOS Yet?
by loki＠obscura.com 17 Dec '03

17 Dec '03

At 5:16 PM 7/22/95, bluebird(a)alpha.c2.org wrote: >[Please reply via netmail or Cc: - I have only periodic access to list.] > >Is the Mixmaster user software for DOS platforms completed yet? > >Thanks for any help. Not yet. It should be out shortly after the next Mixmaster release. I will make a lot of noise when I release the DOS code. You will not miss it. ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

The Big Win (doze)..A simple explanation
by carolann＠censored.org 17 Dec '03

17 Dec '03

Now that I've gotten Eudora back, I found this totally simple explanation to it all. It came from Doc Ozone via a via a via So..... >>You make the call... >> >>Be seeing you, >> >>~ronC >> >>------- Forwarded Message >>(via mmesser(a)infinity.com) >> >> Given Microsoft's recently announced acquisition of the Roman Catholic >>Church, I find the following message, received earlier today, extremely >>distressing. >> >> --------------------------------------------------- >> >>The real name of "the" Bill Gates is William Henry Gates III. >>Nowadays he is known as Bill Gates (III), where "III" means the order >>of third (3rd.) >> >>By converting the letters of his current name to the ASCII-values and >>adding his (III), you get the following: >> >>B 66 >>I 73 >>L 76 >>L 76 >>G 71 >>A 65 >>T 84 >>E 69 >>S 83 >>+ 3 >> -------------- >> 666 !! >> >>Some might ask, "How did Bill Gates get so powerful?" Coincidence? Or >>just the beginning of mankind's ultimate and total enslavement??? >> >>YOU decide! >> >>Before you decide, consider the following: >> >>M S - D O S 6 . 2 1 >>77+83+45+68+79+83+32+54+46+50+49 = 666 >> >>W I N D O W S 9 5 >>87+73+78+68+79+87+83+57+53+1 = 666 >> >>Coincidence? I think not >> >>------- End of Forwarded Message -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

(fwd) INTERNET APPLICATIONS ENGINEER/CommerceNet
by bart＠netcom.com 17 Dec '03

17 Dec '03

Found this during my job search. Lacking the skills myself, thought perhaps someone else on the list might be interested. -------------------------------------------------------------- Enterprise Integration Technologies (EIT) is a recognized pioneer in the development of software and services for electronic commerce on the Internet. EIT has played significant management roles in Terisa Systems, a company that develops, markets, licenses, and supports technologies that make secure Internet transactions possible and CommerceNet Consortium, which facilitates the use of an Internet-based infrastructure for electronic commerce to allow efficient interactions among customers, suppliers and development partners. Additionally, EIT was integrally involved in the development of WebSite, a product of O'Reilly & Associates, Inc. The following position is currently available: INTERNET APPLICATIONS ENGINEER/CommerceNet REQ #103 As a CommerceNet development team member you will be responsible for developing Internet-based security-enabled electronic commerce applications. The focus will be integrating secure peer-to-peer messaging technologies, secure distributed hypermedia environments (e.g., World-Wide Web, S-HTTP, and SSL), and relational databases to support a variety of electronic commerce processes. Develop applications in support of public key certification authorities. The first test of an integrated secure email and WWW solutions will be with CommerceNet members from the electronics industry. Will work with these members in the Electronics Industry Pilot who wish to reengineer their Request for Quotation processes using Internet-based technologies. The ideal candidate will have: BSCS or equivalent Programming languages (e.g., C, C++), scripting languages (e.g., Perl) HTML, TCP/IP, SMTP and HTTP experience Experience with relational databases is desirable Experience writing CGI applications for the World-Wide Web Experience with public key and symmetric cryptography If you are interested, send your resume via e-mail to eit-jobs(a)eit.com or you can fax your resume to (415) 617-8019. Please indicate the requisition number of the position for which you are applying. If you want to mail us a resume, please send it to: Enterprise Integration Technologies 800 El Camino Real Menlo Park, California 94025 EOE, Principals only please

1 0

community standards in cyberspace (fwd)
by Jon Lasser 17 Dec '03

17 Dec '03

Nice thought, but... well... I wish the congresscritters thought that way... Jon ------------------------------------------------------------------------------ Jon Lasser <jlasser(a)rwd.goucher.edu> (410) 494-3253 Visit my home page at http://www.goucher.edu/~jlasser/ You have a friend at the NSA: Big Brother is watching. Finger for PGP key. ---------- Forwarded message ---------- Date: Mon, 24 Jul 1995 22:49:43 -0700 (PDT) From: Tildy Bayar <tildy(a)ella.mills.edu> To: bdsm-list(a)blob.best.net Subject: community standards in cyberspace (fwd) > [exerpt] > > DEVIANCE -- COMPARED TO WHAT? > Peter Huber, author of "Orwell's Revenge" and senior fellow at the Manhattan > Institute, points out that "community standards" are no longer definable in > cyberspace. "`Deviance' loses its meaning, when communities of the > like-minded are formed entirely by consent. Freedom of association is so > complete in cyberspace that traditional limits on freedom of speech become > almost impossible to justify constitutionally." (Forbes 7/31/95 p.110)

1 0

Re: Exporting from Canada (was Re: Let's try breaking an SSL RC4 key)
by droelke＠spirit.aud.alcatel.com 17 Dec '03

17 Dec '03

> : marc: > : > However, goods of U.S. origin are export restricted, unless said > : > goods are further processed outside the U.S. so as to result in a > : > substantial change in value, so some of the PGP development would > : > need to be done in Canada. > > : How about compiling it? THAT is "further processing"...... > > Perhaps...but I for one wouldn't trust anyone else to compile my copy > of PGP...would you? I would use a precompiled version of PGP *if* it came from and was signed by someone I trusted. After all - I don't read all the source code - do you? > And, note, it says sustantial change in value...I don't know if this is taken > to mean monetary, or usability...the later might work. > It's an interesting idea. > Jeremy > I would say that if you can sell something that people would otherwise get for free, then you have added value. So, pre-compile for a couple of architectures, and then slap them on a CD-ROM with source. Definite tangable value from the CD-ROM then. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX http://spirit.aud.alcatel.com:8081/~droelke/

2 1

Re: big word listing
by Andrew.Spring＠ping.be 17 Dec '03

17 Dec '03

> >Instead of that, send H(pid,clock,hostname,H(password)) to the server, for >some hash function H(). Then the server only needs to keep H(password) >around, rather than the plain password. This is similar to current >systems, except the plain password isn't sent across the network. > >H() can be whatever you fancy; 25 crypts, MD5, SHA-1, etc. Of course, >I'm sure this is far from being a new idea... Keeping H(password) on the server and logging in with H(blob,H(password)) is no different than keeping the password on the server and logging in with H(blob,password). Anyone who can read the password file on the server can authenticate himself. To protect against packet sniffers monitoring your login stream _and_ system crackers looking at the password file, you need some form of PKC. Free-after-1997 example: g is a generator of a prime p. password is X (0<X<p); password file has g^X mod p. login server generates Y, issues challenge g^Y. expected response is g^XY mod p login client has X, generates (g^Y)^X = g^XY mod p. J. Random SuperHacker can get g^X, and g^Y, but not g^XY. Free-after-2000 example. Server Has RSA Public Key Client has Private Key. Server generates challenge. Client signs [Hash of] challenge. -- Thank you VERY much! You'll be getting a Handsome Simulfax Copy of your OWN words in the mail soon (and My Reply). <Andrew.Spring(a)ping.be> PGP Print: 0529 C9AF 613E 9E49 378E 54CD E232 DF96 Thank you for question, exit left to Funway.

1 0

Re: CALLER ID AVOIDANCE
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>> > If one can afford it, I suggest chaining through >> > 1-900-CUT-TRAX and 1-900-STO-PPER I thought that at least 1-900-stopper kept logs in case they got subpoenaed or sued or had billing disputes or whatever? #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- # Export PGP three lines a time --> http://dcs.ex.ac.uk/~aba/export/ M0V]N9W)E<W,@<VAA;&P@;6%K92!N;R!L87<@+BXN(&%B<FED9VEN9R!T:&4@ M9G)E961O;2!O9B!S<&5E8V@L(&]R(&]F('1H92!P<F5S<SL-"F]R('1H92!R M:6=H="!O9B!T:&4@<&5O<&QE('!E86-E86)L>2!T;R!A<W-E;6)L92P@( T*

1 0

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

> 0. Mobsters still get caught and thrown in jail. > 1. They don't use crypto at all. All records are in the open and >searchable. LEA's wet dream. > 2. They use strong crypto and can't be caught at all. LEA's nightmare. > 3. They use crypto, but are still catchable (oops, the secret is out of >the bag now, cancel all the computer related RICO nonsense.) > 4. They don't use crypto, but keep no records, or hide them well. They >can still be caught by LEA's. > > 3 & 4 are the most likely, and the LEA's shameful little secret. They >cry wolf to set a wolf trap, but meanwhile they're hunting wabbits, not >wolves. Nah, they're hunting sheep, and they've been pretty successful so far. Right after the OKC bombing, Freeh was saying that he needed to ban encryption and get more funds for Digital Telephony to stop terrorists. 2 isn't credible, except for purely-data crimes like money-laundering, tax evasion, and conspiracy. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- # Export PGP three lines a time --> http://dcs.ex.ac.uk/~aba/export/ M0V]N9W)E<W,@<VAA;&P@;6%K92!N;R!L87<@+BXN(&%B<FED9VEN9R!T:&4@ M9G)E961O;2!O9B!S<&5E8V@L(&]R(&]F('1H92!P<F5S<SL-"F]R('1H92!R M:6=H="!O9B!T:&4@<&5O<&QE('!E86-E86)L>2!T;R!A<W-E;6)L92P@( T*

1 0

Questions about Conferences
by jhames＠deltanet.com 17 Dec '03

17 Dec '03

As a relatively new person to cryptography, I am trying to read and research, as well as follow this list, everything I can about the subject. Because of this interest, I have a few questions for the list. 1) What is Defcon? I am not that far from Las Vegas and am interested in the conference and how I might attend. 2) Similarly, how would I get information on Crypto '95? I have read the papers from previous years and I would be interested in running up to Santa Barbara to check it out. And on a different note, 3) Has anyone heard much about the security of First Security National Bank? (www.fsnb.com) I checked out what they have available already and it seems well put together. I realize they haven't released the "white" paper with specific security (cryptographic) specs on it yet, but has anyone heard anything yet? If it is as secure as it claims, I might consider opening an account with them. Thanks, Joel Hames jhames(a)deltanet.com

3 2

Remailer economics, Java & remailers
by cman＠communities.com 17 Dec '03

17 Dec '03

In a previous post I mentioned that in a remailer economy, remailer users should have the opportunity to earn pre-paid service tokens by acting as part of a remailer network. I also mentioned that this had the benefit of providing cover traffic for the remailer user's own activities. Some people pointed out that their ISP agreements forbid them to run remailers (!), and that not everyone is willing to tackle the (as yet undetermined) legal liability or risk of general legal hassle (which we've seen so far) of running a remailer. First of all, the user client should present the user who wishes to earn service tokens with the choice of registering as a terminal or non-terminal remailer link. People get paid more to be terminal links, since that's the person who is most likely to get hassled. Second of all, most of the attacks on remailers, as well as any ISP technique for detecting them, are based on some remailer's use of SMTP which is a logged service operating on a known port. This would be avoided by coevolving Mixmaster with "remailing bandwidth and reputation" servers (spiritual descendents of Raphe's remailer pinging service). Something which is taking a small step in this direction is the WWW front end to remailers available at c2.org as: http://www.c2.org:80/remail/by-www.html. Note that it has lots of security problems, but it has interesting conceptual aspects (it is also extremely easy to use.) Note that if one were using Java, one could fetch the application via Netscape, and run it within an HTML document in a Netscape window, but the sending of the mail could be done using any appropriate network port or protocol without routing back through the server where the document came from -- the applet would just open socket(s) as appropriate and go for it. (Depending on the user's security settings, a variety of "is it ok for this applet to do such-and-so" messages may be displayed.) My gut feeling is that serious remailer users and operators will ultimately want a standalone application (which can still be written in Java, and share code with the applet version), but that's a religious war we don't need to get into again.

1 0

Re: big word listing
by strick at Jihad 17 Dec '03

17 Dec '03

% | see if the password is in it. My question is, are there any pre-built lists of % | this nature? I am currently only using a spelling dictoinary, and would like % | somthing a little bigger. I made one really easily once with a tiny awk program that read files and remembered all the words (in a big table, with the old ``table[word]=1'' trick, then iterate the table and print it out). I probably used 'tr -cd' in front of it to get rid of non-alfa stuff. I fed it netnews -- especially hierachries with folklore, unix, rec.all, sex, etc. And it made a dictionary that cracked several hundred passwords (from a Major University /etc/passwd) in about 24 hours of SparcStation II time (i think ... this was six years ago). I remember finding the word 'creat' -- doubtless obtained from the unix wizards group -- and a whole family of machine-generated accounts whose password was 'pw'. I'm not sure these words exist in dictionaries, but they do in netnews and passwords. anyway -- it's fun to make your own. strick

1 0

ANNOUNCE: Regulatory Arbitrage - Free Speech Server
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

The Free Speech Server ---------------------- In an attempt to preempt senator Exon and his thought police, and to demonstrate to such other utterly misguided, utterly clueless net-illiterates who somehow get ahold of the notion that it is even *possible* to censor peoples words and conversations on the Internet, that what they seek is indeed impossible. This is a simple demo of why it is impossible to censor the net. The Net is international, and in the apt words of Tim May's .sig quote: "National borders are just speed bumps on the information superhighway." The concept of "Regulatory Arbitrage" term meaning of course: shopping for suitable regulations, so if the US has silly "indecency" laws, well just store your words in another jurisdiction. Free Speech Server, jurisdiction Netherlands -------------------------------------------- Alex de Joode has kindly hosted an exon(tm) free speech server on replay.com: http://www.replay.com/exon/ is an automated double-speak translator. It will translate between text in goverment approved thought policed language back into free speech. So, the canonical example, a comlaint against Senator Exon (spit), Exonized(tm) so that even the most zealous US government internet thought police could not complain: ---------------------------------------------------------------------- Senator Exon may I express my annoyance you're a person who is overly sensitive to vulgar speech. This has lowered my opinion of you considerably for your work on the communications decency bill. President Clinton and his crowd of law enforcement officials seem to be overly keen in their attempts to regulate the information super highway. In my opinion they are just understandably scared of losing their much abused so called legitimate wiretap capabilities. It seems highly inappropriate that incompetents like you should be deciding matters about which you have little knowledge. ---------------------------------------------------------------------- Feed that into the WWW forms interface on www.replay.com (click on the unexonize toggle button, and select the "exon" dictionary, and you get back my original message to Exon, ahh much better this really says what I had to say: ---------------------------------------------------------------------- X-Regulatory-Arbitrage-URL: http://www.replay.com/exon/ X-Authors-Preferred-Speech: exon X-Comment: Regulatory Arbitrage in action, free speech server NL Exon fuck you you're a prudish prick. May you rot in hell for your work on the government censorship bill. Slick Willy and his gang of jack booted thugs seem to be fucking falling over themselves in their attempts to censor the net. In my opinion they are just scared shitless of losing their illegal wiretaps. It seems fucking way out of order that assholes like you should be deciding matters about which you know squat. ---------------------------------------------------------------------- The mechanism used to do the translation is phrase replacement, there are facilities for you to add your own phrases if the dictionaries do not cover what you want to say. Please join in and add your own phrases, so that the dictionaries get more interesting. It works by replacing phrases, so in the above: 'fuck you' <-> 'may I express my annoyance' 'fucking way out of order' <-> 'highly inappropriate' 'know squat' <-> 'have little knowledge' etc. Jurisdictional Information -------------------------- The first server is located in the Netherlands, so there are liberal pornography laws, lower age of consent, no thought crimes, freedom of speech, and privacy are still valued, the are no restrictions on "indecent speech", no restrictions on crypto export, etc, etc. The idea is that in your own jurisdiction (US or other oppressive regime with government censorship) you are only saying something within the bounds of censored government speech and thought guidlines, and yet you have a comment, which says what language you *would* use if you weren't being censored, ie you inculde as a header, or a comment in your post what your preferred speech is in terms of a selection of "exon" dictionaries: X-Authors-Preferred-Speech: exon,legislese,sarcasm You haven't actually *said* anything which would require 'correction' by the thought police, rather you have just said what words you would use if you were allowed to. You could also view it as a form of (weak) text stego, saying one thing, but meaning another to a sufficient extent to maintain plausible deniability. Uses ---- It is starting to look like the US will have in place a set of regulations which will make it illegal to use "vulgar speech" or "indecent speech" on the internet. In fact it is looking like you will be able to say less on the internet than could be written in a book in a bookstore or library. Whilst the above example was in terms of 4 letter words, there are dictionaries for several topics, which you as user of the system you can add phrase to for your amusement: exon: "fuck you" <-> "may I express my annoyance" sex: "good fuck" <-> "good sleep" violence: "kick the shit out of" <-> "have a minor disagreement" sarcasm: "that prick Exon" <-> "most honorable Sen Exon esq" legislese: "pillage and loot" <-> "govern" legislese: "tyrannically suppress" <-> "provide protections against" graphic: "lobotomised barney gif" <-> "we love barney" crypto: "fcrypt module" <-> "conventional poetry quatrain" The sky and your imagination is the limit. Oh yes, and 'May I express my annoyance Senator Exon!' :-) Adam -- HAVE *YOU* EXPORTED RSA TODAY? --> http://dcs.ex.ac.uk/~aba/rsa/ --rsa--------------------------8<------------------------------- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) -------------------------------8<------------------------------- TRY: rsa -k=3 -n=7537d365 < msg | rsa -d -k=4e243e33 -n=7537d365

1 0

PGP message and keyring format
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Does anyone know of any documentation describing the format of PGP messages and keyrings, so that other applications can send and receive PGP-compatible messages and work with PGP keyrings? Thanks for any info..

2 1

You have cashed my check....
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

Dear First Virtual, You now present puzzling information. You have cashed my check. So why are you telling me that you have no bank information. You stated that the check itself provided the bank information. If this situation persists, I will forward said materials and correspondence to the State of Minnesota Attorney General's Office, and the U.S. District Attorney's Office for prosecution. For what you have connumicated so far surely appears fraudulent. I don't have much money as it is. But then maybe (considering all of the lag time) this is your scam. Maybe this is entirely legitimate, and just an honest mistake. I have added below your opening correspodence of July 18th, the day before the check cashed. Awaitng your response, Carol Anne Braddock Exhibit #1 - Acct. Acceptance Status >From carolann(a)censored.orgTue Jul 25 17:50:44 1995 Date: Tue, 25 Jul 1995 17:24:22 -0500 From: UnCensored Girls Anonymous <carolann(a)censored.org> To: cab(a)censored.org X-UIDL: 805661824.000 From: sgcs-server(a)card.com To: carolann(a)censored.org Y-Tag: 950611397619 Subject: newacct-result Comments: generated by via-btl.tcl - Enabled Mail (EM) environment for UNIX Date: Mon, 10 Jul 1995 15:35:00 -0400 Reply-to: support-newacct(a)card.com X-Status: The account for Carol Anne Braddock is now activated. Your First Virtual account identifier is: newt-carolann Please SAVE YOUR FIRST VIRTUAL ACCOUNT IDENTIFIER, and use it when you buy or sell information. (NOTE: This account identifier differs from the ID-choice that you provided when you applied for your account. We have added a unique prefix.) You may begin using your account to sell information over the Internet immediately! Exhibit #2 Your Letter Today. >From sgcs-server(a)card.comTue Jul 25 18:32:24 1995 Date: Tue, 25 Jul 1995 18:23:24 -0500 From: sgcs-server(a)card.com To: cab8(a)censored.org Subject: change in account status This is an automated message from First Virtual's Internet Payment System. When we tried to verify the the bank account information associated with Carol Anne Braddock, the verification failed. INVALID ACCOUNT NUMBER Once this matter is corrected, we will be able to pay you for your sales. If you have changed your checking account, please follow the directions below. Otherwise, please send e-mail to: support-payout-failure(a)card.com CHANGING THE CHECKING ACCOUNT NUMBER USED FOR PAYMENT If you wish to change the account number of the checking account used to pay you, please send e-mail to: chgacct(a)card.com The ENTIRE body of your message should contain EXACTLY two lines: Account-ID: your First Virtual account identifier Financial-Changes: yes We will send you a confirming note. After you confirm, we will send you e-mail with a new application-ID and instructions on sending us a check for $10.00 (ten US dollars, to cover our paper processing expenses). -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

2 1

Re: You have cashed my check....
by carolann＠censored.org 17 Dec '03

17 Dec '03

Look at the .sig And if it's a system that's vaporware we all need know about it. And if it is corrected, part 17/713 will have begun to go it's job, in a 'realworld' situation. >Please don't send this here. It has no place on this list. > >-Ekr > > -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0