December 2003 - cypherpunks-legacy

Re: Recommendation: Creation of "alt.cypherpunks"
by Firebeard 17 Dec '03

17 Dec '03

>>>>> Timothy C May writes: TCM> Since posting my comments I've just seen the proposal that tivoli TCM> may host a list. Whoa, Nellie! Who made that proposal? It certainly wasn't me! I said that I was taking steps to set up a majordomo to host a cypherpunks list. Topmost on those steps is creation of the sten.net or sten.org domain, and getting a personal, paid-for-out-of-my-own-pocket, ISDN connection. The majordomo will run off of my personal computer sitting in my apartment, not on Tivoli hardware sitting in the support lab. As I said, John forced my hand in his announcement, causing me to 'put up' before everything was in place, including the domain registration. Yes, my mail comes from sten.tivoli.com. That doesn't mean that everything I do in life is connected to Tivoli, IBM, etc. -- #include <disclaimer.h> /* Sten Drescher */ Unsolicited bulk email will be stored and handled for a US$500/KB fee. It is by caffeine alone I set my mind in motion, it is by the beans of Java that thoughts acquire speed, the hands acquire shaking, the shaking becomes a warning, it is by caffeine alone I set my mind in motion. -- Carlos Nunes-Ueno, 3/29/95

1 0

Re: Cypherpunks Distributed Remailer (fwd)
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"ravage(a)einstein.ssz.com" "Jim Choate" 12-FEB-1997 18:43:56.23 > From: "E. Allen Smith" <EALLENSMITH(a)ocelot.rutgers.edu> >> Umm... because you'll eventually accumulate _lots_ of addresses >> that don't work, which will slow things down tremendously in sending >> mail out? >The current subscription is between 1,000 and 2,000 I don't think that is >_lots_. All we need to do is count the number of bounces per address in >a given period, the SSZ end is trying to decide between weekly or >monthly cleanings, and then clear that address. At no point would I need >to archive the original bounce. Someone with more experience correct me if I'm wrong (I'm just starting to learn about mailing list management), but isn't saving at least the first bounce from a given address good in order to check what address is the one that's actually bouncing? Admittedly, this only applies to badly-formed bounces. The rest can just have the address noted. >> Well, loki(a)cyberpass.net has made the offer to host the entire >> list... and Lance is certainly making money at it. While this would have >> some problems in comparison with the distributed list idea (namely more of >> a choke point), it would decidedly help. >I certainly hope they get a cpunks address made available. I will certainly >subscribe cpunks@ssz so that the distributed remailer will benefit from >that input. However, one of the major realizations is that as long as one >anything is involved in the list it is capable of being shutdown at any >time with no warning. It also makes it much easier to compromise. I would >like to see servers in several countries myself. Agreed. >> >Is anyone interested in acting as a mail-to-news gateway? >Want to volunteer? Give me some idea of how much programming knowledge, time, etcetera is required, please, before I can answer. I'd be renting space on some other computer (e.g., an account on cyberpass.net) to do it in; the only higher-level programming language (i.e., beyond Applesoft Basic) that I know anything of is Perl (and I don't know that all that well); and I am somewhat busy with other stuff. In other words, it depends. -Allen

1 0

security
by zac speidel 17 Dec '03

17 Dec '03

does any 1 here a hacker??? --=====================_855792302==_ Content-Type: TEXT/HTML; CHARSET=us-ascii Content-ID: <Pine.SUN.3.91.970212160438.11558F(a)crl.crl.com> <BASE HREF="www.well.com/user/fritoy/sample.html"> <html> <title>Skinhead Oi Oi</title> <script>  </script> </head> <body bgcolor=#000000 text=#FFFFFF link="FF0000" vlink="8888FF" alink="FF00FF"> <script>   </script> </head> <body> <BODY BGCOLOR=000000 text="#000000" link="#0000ff" vlink="#c00c0" onload="scroller()"> <CENTER><FORM> <BR><BR><BR> <input type="button" Value="Close" onClick="if (confirm('Are you sure you want to close this window?'))window.close();else (alert('OK, this window will not close yet.'))"> </FORM></CENTER> <BR> <CENTER><P><FORM name="forma"><INPUT NAME="david" VALUE=" Speidel(a)lightspeed.net The End Is HERE!!! The world is falling apart" type="hidden" ><INPUT NAME="scroller" VALUE="" size="35"></FORM></P> </CENTER> </BODY> </html> --=====================_855792302==_--

1 0

Re: Network of majordomos
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> What was your chater? Could you Cc a copy to the list? I didn`t save it but it was something along the lines of this: Charter: alt.cypherpunks will serve as a discussion forum for the members of the cypherpunks community. The discussion group previously resided on a mailing list run at toad.com but due to a difference of opinion between the majority of active members of the list and the owner of toad.com, John Gilmore, the list must now relocate onto usenet as a temporary measure while further measures are put in place to re-establish a mailing list format. The group has approximately 1500 members and has been active online for some 5 years. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Remove My Name
by KENNETH A. LEONE 17 Dec '03

17 Dec '03

I CONTINUE TO RECEIVE MAIL. PLEASE REMOVE MY NAME FROM THE MAILING LIST. THANK YOU

1 0

Been good to know ya ...
by Rabid Wombat 17 Dec '03

17 Dec '03

Later, all. And thanks to John for all the work he has put in to maintaining the list. Last one to leave, turn out the lights. -r.w.

1 0

Pre-alpha Cpunx-resource FAQ comments sought
by omegam＠cmq.com 17 Dec '03

17 Dec '03

Okay folks. I have worked on this much of the day. This is a more formalized outline as well as a somewhat fleshed out version of section 1 of the FAQ I am attempting to produce. I submit this to the group for commentary and suggestions as well as pointers to the relevant info. This should be enough to give a flavor of what I am trying to do. Anything in [] needs to be located and/or verified by myself. I realize that this won't please everyone and some may not care. So be it. Those who do care, please help me make it less of a FAQ based on my subjective experience and more of a useful general reference. Here it is... -----BEGIN PGP SIGNED MESSAGE----- Cypherpunks Resources FAQ version 0.000000002 Compiled, edited & maintained by Scott Harney "Omegaman <omegam(a)cmq.com>" This document lists resources for readers interested in Cypherpunk issues and goals. The primary intention of this document is to get new readers of the group to explore the background issues that Cypherpunks attempt to address. It also includes pointers to many common cryptographic implementations and tools. Furthermore, pointers and instructions for various newsreaders and email-filters are provided to help users filter out some of the net's inevitable noise and glean the most useful information they can from this forum. This FAQ does not attempt to explictly define who the Cypherpunks are or answer questions about the philosophy. That is an exercise for the reader who utilizes the pointers within to find the answers on their own. After exploring these resources, the hope is that the reader will become a more effective and insightful contributor to alt.cypherpunks -- even if he/she is opposed to the goals of the group. This FAQ is not intended to be an exhaustive reference. A quick perusal of this FAQ should reveal the impossiblity of such a task. Rather, it is a jumping-off point. Almost all of the references below contain voluminous further references. If your mission-critical Cypherpunks site is not explicitly included, it is 99% likely to be referred to by at least one of them. This FAQ is propagated monthly to alt.cypherpunks. It can also be obtained be sending email with the subject and/or body "get cpunks faq" to omegam(a)cmq.com. As with nearly all net.publications, this document is in a constant state of contruction. When information in the FAQ is updated, I will also post a "what's new" message for those who are interested in reading additions/corrections without wading throught the entire FAQ again. - -------*********------- Author's Note/Disclaimer ---------*********--------- I maintain this FAQ solely on a voluntary basis. I am doing this because I think it is necessary. It would be contrary to the anarchic nature of the Cypherpunks to attempt to call this an official FAQ of the Cypherpunks group. Anyone who disagrees with the editing decisions and pointer selections I have made in this FAQ is free to. What this means is that you are encouraged to send comments, suggestions, corrections, new questions, and answers to me. I may or may not include them in future revisions of the FAQ. I do ask that somewhere in the subject of your mail redarding this FAQ you include the text "(CFAQ suggest)", so procmail can file such comments appropriately and I can address them in a more efficient manner. If I use your suggestion or answer to a question, I will attribute the reference to you unless you request that I do not. You are free to create your own Cypherpunks-resources FAQ if you don't like mine. - - Scott _______________________________________________________________ Omegaman <mailto:omegam@cmq.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send e-mail with "get key" in the "Subject:" field to get a copy of my public key _______________________________________________________________ - -------*********--------*********---------********--------*********------ Premliminary Outline Section 1 - Introduction and General Information. Q1.1 Does this newsgroup/mailing-list have a charter? Q1.2 How did the group get started? Q1.3 What do Cypherpunks want? Q1.4 What happened to the toad.com mailing list? Are there archives? Q1.5 Are there other groups besides Cypherpunks who share these goals. Q1.6 What have the Cypherpunks done to advance their goals other that merely talk about them? Q1.7 I'm interested, what can I do? Q1.8 What are all these terms and acronyms anyway? (A Quick n' Dirty Glossary) Section 2 - Crypto in Action Q2.1 Pointers galore to PGP resources. Q2.2 Point to Schneir's site and include biblio info on Applied Crypto Q2.2 Point to cryptlib toolkits Q2.3 RSA, of course. Q2.4 pointers to disk encryption utilities for various platforms Q2.5 pointers to Raph's remailer site and other remailer info sites. remailer software. software to make remailer usage simpler (premail, PIdaho) Q2.6 pointers to the various digital cash purveyors and to explanations of how Chaumian digital cash works. Q2.7 pointers to Apache-SSL site and info, Stronghold, Q2.8 SSH Q2.9 Pointers to sites describing how various types of crypto actually work. sci.crypt faq Q3.0 But how do I know if it's good crypto? Point to snake Oil FAQ? Schneir's essay. Use your brain. Section 3 - Crypto and the Law Q3.1 Froomkin's site obviously.. John Young's also obvious. EFF has a good archive too. Karn case, others. Q3.2 Pointers to government's current position on crypto. ie. EAR, ITAR Q3.3 Pointers past Clipper failure info. Section 4 - Who's who & (recent) History of Crypto. Q4.1 A couple of good general history sites exist. also Codebreakers bibliographical reference. Q4.2 Enigma is a common question, point to relevant sites. Q4.3 Whit Diffie--some interviews etc are available Q4.4 Bruce Schneir same Q4.5 Phil Z and PGP history and interviews. Q4.6 Jim Bizdos Q4.8 Dorothy Denning (got to include the enemy too) Q4.7 Pointers to news on breaks of ciphers Q4.8 NSA site. [Others? I'm getting sleepy, names escaping me at the moment] Section 5 - Help! I want to know more but I'm drowning in noise Q5.1 Point to filtered lists in existence Q5.2 news2mail gateways as source of list. mail filtering tools come into good use. point to a bunch of them. Q5.3 Point to kill-file info for various newsreaders and platforms. [Possibly include generic examples from own experience and list user's experience who wish to contribute. Specific names will be ommitted of course. Also score information for those interested] Q5.4 point to information on other utilities and verification-type schemes [NoCeM's] Section 6 - Personal motivations, thank-you's, etc. *********----------**********----------**********---------*********---- Section 1. Introduction and General Information Q1.1 Do the Cypherpunks have an official charter? No. Cypherpunks are anarchic in nature so the notion of an official charter is directly contrary to such ideals. The two statements below are from Original Cypherpunks (OC's) Eric Hughes and Tim May. The first was part of the original welcome message to the mailing list hosted at toad.com. The second was suggested by Tim to the original list and commented upon by the readership. Both statements are accepted by much of the readership as good indicators of what Cypherpunks are about. Eric Hughes' statement: "Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow Cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy." Tim May's statement: "Alt.cypherpunks is for the unmoderated discussion of cryptography and the political, social, and economic implications of unrestricted, strong cryptography. The Cypherpunks grpup has existed since 1992 and has been central in the debate about strong crypto, government restrictions, crypto anarchy, and in showing weaknesses of various ciphers and security products. The mailing list has had as many as 1500 subscribers, plus gateways to newsgroups and Web sites. It is expected that 'alt.cypherpunks' will be a free-wheeling forum for many viewpoints. As it is unmoderated, readers are strongly advised to learn how to use filters and other tools for making virtual anarchies manageable for their own tastes." Q1.2 How did the group get started? Needless to say, the history of such things is fuzzy at best. Eric Hughes and Tim May had some discussions which led to Eric Hughes, decision to host a meeting. Concidently, the first meeting occurred the same week PGP 2.0 was released. John Gilmore offered his site to host a mailing list, and thus Cypherpunks were born. see Q1.2, Q1.4, and Q1.6 for references containing more detail. also see: [Wired article URL] Q1.3 What do Cypherpunks want? Such a simple question with no simple, short answer. Please explore the following sites. Tim May's provacative (and large!) Cyphernomicon http://www.oberlin.edu/~brchkind/cyphernomicon/ The Berkeley Cypherpunks site is another good starting point. ftp://ftp.csua.berkeley.edu/pub/cypherpunks/Home.html Also see: http://www.offshore.com.ai/security/ - Vince Cate's Cryptorebel/Cypherpunk Page http://www.eskimo.com/~joelm/ - Joel McNamara's Electronic Privacy Page Q1.4 What happened to the toad.com mailing list? Are there archives? As with all Cypherpunks issues, there is much controversy surrounding the dissolution of the original list hosted by John Gilmore's machine @toad.com. Some say that noise devoured the list to such a point as to make it useless, driving away the "good posters". Others argue that the failed attempt at moderating the list to eliminate some of that noise was the final nail in the coffin. Whatever the reason, Gilmore told the Cypherpunks that it was time to find a new home. Running a mailing list with 1500+ subscription base and the enormous volume that the list had is not a simple task. The physical running of the list on a single machine requires enormous computational resources as well as constant human intervention. Perhaps the resultant newsgroup and distributed mailing list approach is more in line with Cypherpunk ideals. "Cypherpunks know that a widely dispersed system cannot be shut down." Archives of the original list are available to some degree at: http://infinity.nus.sg/cypherpunks/ http://weber.u.washington.edu/~phantom/cpunk/index.html Users interested in running a "node" of the distributed mailing list version of this newsgroup are encouraged to subscribe to Igor Chudov's discussion list on the subject. Send a message to majordomo(a)algebra.com with the body "subscribe cypherpunks-hosts" Q1.5 Are there other groups besides Cypherpunks who share these goals? The following organizations and sites share Cypherpunk goals to a greater or lesser extent. The EFF(Electronic Frontier Foundation) http://eff.org http://eff.org/pub/ITAR_export/HTML/hot.html & http://www.eff.org/pub/Privacy/hot.html - more specific references & extensive archival information EPIC (Electronic Privacy Information Center) http://epic.org Voter's Telecommunications Watch http://www.vtw.org Center for Democracy and Technology http://www.cdt.org The Cryptography List at C2Net is also a good resource. send a message to Majordomo(a)c2.net with the body "subscribe Cryptography" The Coderpunks list at toad.com is a technical discussion forum. Send a message to majordomo(a)toad.com with the body "subscribe coderpunks" Q1.6 What have the Cypherpunks done to advance their goals other that merely talk about them? Many Cypherpunks are professionals in the computer security field. Others work for companies and corporations which create and distribute products utilizing strong cryptography. Cypherpunks are also directly responsible for the creation and running of Type I and Type II(mixmaster) Cypherpunks anonymous remailers (surprising, eh?). see Q2.5 Cypherpunks have also produced software to make good crypto easier for the masses. [Get permission from PGP-front end producers to reference here] The Linux-IPSEC project is another good example. [see & subscribe ref?]. Mykotronx exposure and dumpster diving excursion. [reference?] see Q1.4(list-archive sites) Q1.7 I'm interested, what can I do? First of all READ before you post. Observe simple etiquette. Don't clutter the group with "me too" posts and questions which you can easily find the answer to yourself. Contribute signal, not noise. As of this writing, RSA, inc. is hosting a contest to crack the government standard DES 56 bit algorhythm. See [http://www.rsa.com/contest] for full details. Also see Peter Trei's site for software and info. Host a portion of the distributed mailing list. See Q1.5. Run an anonymous or pseudonymous remailer. see Q1.6 for site references and software. Use strong crypto. Encourage friends to use it as well. Increase the amount of encrypted traffic on the net. Can you code? There are plenty of projects and opportunites yet to be explored. Black Unicorn writes: "Where is highly sophisticated stego? Where are larger keys for symetric ciphers? Where is a fully functional and secure "stealth PGP"? Where are anonymous and encrypted WWW clients and hosts which permit chaining? If the crypto war is going to be lost it will be lost in the chill of development when crypto regulation is put into place. If you don't make the guns in the first place, the government has a much easier time taking them away." Q1.8 What are all these terms and acronyms anyway? Here's a quick-n-dirty glossary. GAK = Government access to keys. Government euphemisms for GAK include "key escrow" and "key recovery" (actually important for corporations, but misused in recent USG proposals) USG = United States Government ITAR = International Trade and Arms Regulations. Regulations export of arms from the US. Strong Crypto is regulated as a weapon by this document. see Q3.2 EAR = Encryption Algorhythm Regulations (a guess, look it up) Recent proposals by Clinton Administration. see Q3.2 TLA = Three Letter Acronym/Agency. Refers to USG agencies (typically involved in law enforcement) FBI, CIA, NSA, etc. NSA = National Security Agency. This highly secretive agency is responsible for the protection of USG secrecy via encryption as well as the spying on other governments by breaking encryption algorhythms. see Q4.8 DES = US Data Encryption Standard algorhythm. see Q2.9 RSA = a company and a public key algorhythm. see Q2.9 and Q2.3 net.loon/kook = a purely subjective characterization. Signal-to-Noise ratio = Signal refers to on-topic posts. Noise, the opposite. A high S/N ratio means the list is putting out a lot of signal("good posts"). Subjective, but fairly obvious. See Section 5 for pointers no how to reduce (what you think is) noise Memes = [get a good definition here] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [Rest of FAQ goes here :) This is a pre-alpha FAQ, intended only to solicit commentary and suggestions.] -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: latin1 iQCVAwUBMwJViqb3EfJTqNC9AQHigwP+IAXu+PO7aGiR/zZxz91PhnYuYvTy3jMN HzO4djcx44auPMjh6pFpmWJuYRcoxVHXCh2JO4UOR3cNYloxikwY4hGgYx8jLgN1 XORQztiCGMI/2ScVsi8tH6eJLCuZxmE7s8semel4CC8xH3H74vCiBNZD6iyyIXOG oMkSnOVFAQg= =Fdky -----END PGP SIGNATURE-----

1 0

Pre-alpha Cpunx-resource FAQ comments sought
by omegam＠cmq.com 17 Dec '03

17 Dec '03

Okay folks. I have worked on this much of the day. This is a more formalized outline as well as a somewhat fleshed out version of section 1 of the FAQ I am attempting to produce. I submit this to the group for commentary and suggestions as well as pointers to the relevant info. This should be enough to give a flavor of what I am trying to do. Anything in [] needs to be located and/or verified by myself. I realize that this won't please everyone and some may not care. So be it. Those who do care, please help me make it less of a FAQ based on my subjective experience and more of a useful general reference. Here it is... -----BEGIN PGP SIGNED MESSAGE----- Cypherpunks Resources FAQ version 0.000000002 Compiled, edited & maintained by Scott Harney "Omegaman <omegam(a)cmq.com>" This document lists resources for readers interested in Cypherpunk issues and goals. The primary intention of this document is to get new readers of the group to explore the background issues that Cypherpunks attempt to address. It also includes pointers to many common cryptographic implementations and tools. Furthermore, pointers and instructions for various newsreaders and email-filters are provided to help users filter out some of the net's inevitable noise and glean the most useful information they can from this forum. This FAQ does not attempt to explictly define who the Cypherpunks are or answer questions about the philosophy. That is an exercise for the reader who utilizes the pointers within to find the answers on their own. After exploring these resources, the hope is that the reader will become a more effective and insightful contributor to alt.cypherpunks -- even if he/she is opposed to the goals of the group. This FAQ is not intended to be an exhaustive reference. A quick perusal of this FAQ should reveal the impossiblity of such a task. Rather, it is a jumping-off point. Almost all of the references below contain voluminous further references. If your mission-critical Cypherpunks site is not explicitly included, it is 99% likely to be referred to by at least one of them. This FAQ is propagated monthly to alt.cypherpunks. It can also be obtained be sending email with the subject and/or body "get cpunks faq" to omegam(a)cmq.com. As with nearly all net.publications, this document is in a constant state of contruction. When information in the FAQ is updated, I will also post a "what's new" message for those who are interested in reading additions/corrections without wading throught the entire FAQ again. - -------*********------- Author's Note/Disclaimer ---------*********--------- I maintain this FAQ solely on a voluntary basis. I am doing this because I think it is necessary. It would be contrary to the anarchic nature of the Cypherpunks to attempt to call this an official FAQ of the Cypherpunks group. Anyone who disagrees with the editing decisions and pointer selections I have made in this FAQ is free to. What this means is that you are encouraged to send comments, suggestions, corrections, new questions, and answers to me. I may or may not include them in future revisions of the FAQ. I do ask that somewhere in the subject of your mail redarding this FAQ you include the text "(CFAQ suggest)", so procmail can file such comments appropriately and I can address them in a more efficient manner. If I use your suggestion or answer to a question, I will attribute the reference to you unless you request that I do not. You are free to create your own Cypherpunks-resources FAQ if you don't like mine. - - Scott _______________________________________________________________ Omegaman <mailto:omegam@cmq.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send e-mail with "get key" in the "Subject:" field to get a copy of my public key _______________________________________________________________ - -------*********--------*********---------********--------*********------ Premliminary Outline Section 1 - Introduction and General Information. Q1.1 Does this newsgroup/mailing-list have a charter? Q1.2 How did the group get started? Q1.3 What do Cypherpunks want? Q1.4 What happened to the toad.com mailing list? Are there archives? Q1.5 Are there other groups besides Cypherpunks who share these goals. Q1.6 What have the Cypherpunks done to advance their goals other that merely talk about them? Q1.7 I'm interested, what can I do? Q1.8 What are all these terms and acronyms anyway? (A Quick n' Dirty Glossary) Section 2 - Crypto in Action Q2.1 Pointers galore to PGP resources. Q2.2 Point to Schneir's site and include biblio info on Applied Crypto Q2.2 Point to cryptlib toolkits Q2.3 RSA, of course. Q2.4 pointers to disk encryption utilities for various platforms Q2.5 pointers to Raph's remailer site and other remailer info sites. remailer software. software to make remailer usage simpler (premail, PIdaho) Q2.6 pointers to the various digital cash purveyors and to explanations of how Chaumian digital cash works. Q2.7 pointers to Apache-SSL site and info, Stronghold, Q2.8 SSH Q2.9 Pointers to sites describing how various types of crypto actually work. sci.crypt faq Q3.0 But how do I know if it's good crypto? Point to snake Oil FAQ? Schneir's essay. Use your brain. Section 3 - Crypto and the Law Q3.1 Froomkin's site obviously.. John Young's also obvious. EFF has a good archive too. Karn case, others. Q3.2 Pointers to government's current position on crypto. ie. EAR, ITAR Q3.3 Pointers past Clipper failure info. Section 4 - Who's who & (recent) History of Crypto. Q4.1 A couple of good general history sites exist. also Codebreakers bibliographical reference. Q4.2 Enigma is a common question, point to relevant sites. Q4.3 Whit Diffie--some interviews etc are available Q4.4 Bruce Schneir same Q4.5 Phil Z and PGP history and interviews. Q4.6 Jim Bizdos Q4.8 Dorothy Denning (got to include the enemy too) Q4.7 Pointers to news on breaks of ciphers Q4.8 NSA site. [Others? I'm getting sleepy, names escaping me at the moment] Section 5 - Help! I want to know more but I'm drowning in noise Q5.1 Point to filtered lists in existence Q5.2 news2mail gateways as source of list. mail filtering tools come into good use. point to a bunch of them. Q5.3 Point to kill-file info for various newsreaders and platforms. [Possibly include generic examples from own experience and list user's experience who wish to contribute. Specific names will be ommitted of course. Also score information for those interested] Q5.4 point to information on other utilities and verification-type schemes [NoCeM's] Section 6 - Personal motivations, thank-you's, etc. *********----------**********----------**********---------*********---- Section 1. Introduction and General Information Q1.1 Do the Cypherpunks have an official charter? No. Cypherpunks are anarchic in nature so the notion of an official charter is directly contrary to such ideals. The two statements below are from Original Cypherpunks (OC's) Eric Hughes and Tim May. The first was part of the original welcome message to the mailing list hosted at toad.com. The second was suggested by Tim to the original list and commented upon by the readership. Both statements are accepted by much of the readership as good indicators of what Cypherpunks are about. Eric Hughes' statement: "Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow Cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy." Tim May's statement: "Alt.cypherpunks is for the unmoderated discussion of cryptography and the political, social, and economic implications of unrestricted, strong cryptography. The Cypherpunks grpup has existed since 1992 and has been central in the debate about strong crypto, government restrictions, crypto anarchy, and in showing weaknesses of various ciphers and security products. The mailing list has had as many as 1500 subscribers, plus gateways to newsgroups and Web sites. It is expected that 'alt.cypherpunks' will be a free-wheeling forum for many viewpoints. As it is unmoderated, readers are strongly advised to learn how to use filters and other tools for making virtual anarchies manageable for their own tastes." Q1.2 How did the group get started? Needless to say, the history of such things is fuzzy at best. Eric Hughes and Tim May had some discussions which led to Eric Hughes, decision to host a meeting. Concidently, the first meeting occurred the same week PGP 2.0 was released. John Gilmore offered his site to host a mailing list, and thus Cypherpunks were born. see Q1.2, Q1.4, and Q1.6 for references containing more detail. also see: [Wired article URL] Q1.3 What do Cypherpunks want? Such a simple question with no simple, short answer. Please explore the following sites. Tim May's provacative (and large!) Cyphernomicon http://www.oberlin.edu/~brchkind/cyphernomicon/ The Berkeley Cypherpunks site is another good starting point. ftp://ftp.csua.berkeley.edu/pub/cypherpunks/Home.html Also see: http://www.offshore.com.ai/security/ - Vince Cate's Cryptorebel/Cypherpunk Page http://www.eskimo.com/~joelm/ - Joel McNamara's Electronic Privacy Page Q1.4 What happened to the toad.com mailing list? Are there archives? As with all Cypherpunks issues, there is much controversy surrounding the dissolution of the original list hosted by John Gilmore's machine @toad.com. Some say that noise devoured the list to such a point as to make it useless, driving away the "good posters". Others argue that the failed attempt at moderating the list to eliminate some of that noise was the final nail in the coffin. Whatever the reason, Gilmore told the Cypherpunks that it was time to find a new home. Running a mailing list with 1500+ subscription base and the enormous volume that the list had is not a simple task. The physical running of the list on a single machine requires enormous computational resources as well as constant human intervention. Perhaps the resultant newsgroup and distributed mailing list approach is more in line with Cypherpunk ideals. "Cypherpunks know that a widely dispersed system cannot be shut down." Archives of the original list are available to some degree at: http://infinity.nus.sg/cypherpunks/ http://weber.u.washington.edu/~phantom/cpunk/index.html Users interested in running a "node" of the distributed mailing list version of this newsgroup are encouraged to subscribe to Igor Chudov's discussion list on the subject. Send a message to majordomo(a)algebra.com with the body "subscribe cypherpunks-hosts" Q1.5 Are there other groups besides Cypherpunks who share these goals? The following organizations and sites share Cypherpunk goals to a greater or lesser extent. The EFF(Electronic Frontier Foundation) http://eff.org http://eff.org/pub/ITAR_export/HTML/hot.html & http://www.eff.org/pub/Privacy/hot.html - more specific references & extensive archival information EPIC (Electronic Privacy Information Center) http://epic.org Voter's Telecommunications Watch http://www.vtw.org Center for Democracy and Technology http://www.cdt.org The Cryptography List at C2Net is also a good resource. send a message to Majordomo(a)c2.net with the body "subscribe Cryptography" The Coderpunks list at toad.com is a technical discussion forum. Send a message to majordomo(a)toad.com with the body "subscribe coderpunks" Q1.6 What have the Cypherpunks done to advance their goals other that merely talk about them? Many Cypherpunks are professionals in the computer security field. Others work for companies and corporations which create and distribute products utilizing strong cryptography. Cypherpunks are also directly responsible for the creation and running of Type I and Type II(mixmaster) Cypherpunks anonymous remailers (surprising, eh?). see Q2.5 Cypherpunks have also produced software to make good crypto easier for the masses. [Get permission from PGP-front end producers to reference here] The Linux-IPSEC project is another good example. [see & subscribe ref?]. Mykotronx exposure and dumpster diving excursion. [reference?] see Q1.4(list-archive sites) Q1.7 I'm interested, what can I do? First of all READ before you post. Observe simple etiquette. Don't clutter the group with "me too" posts and questions which you can easily find the answer to yourself. Contribute signal, not noise. As of this writing, RSA, inc. is hosting a contest to crack the government standard DES 56 bit algorhythm. See [http://www.rsa.com/contest] for full details. Also see Peter Trei's site for software and info. Host a portion of the distributed mailing list. See Q1.5. Run an anonymous or pseudonymous remailer. see Q1.6 for site references and software. Use strong crypto. Encourage friends to use it as well. Increase the amount of encrypted traffic on the net. Can you code? There are plenty of projects and opportunites yet to be explored. Black Unicorn writes: "Where is highly sophisticated stego? Where are larger keys for symetric ciphers? Where is a fully functional and secure "stealth PGP"? Where are anonymous and encrypted WWW clients and hosts which permit chaining? If the crypto war is going to be lost it will be lost in the chill of development when crypto regulation is put into place. If you don't make the guns in the first place, the government has a much easier time taking them away." Q1.8 What are all these terms and acronyms anyway? Here's a quick-n-dirty glossary. GAK = Government access to keys. Government euphemisms for GAK include "key escrow" and "key recovery" (actually important for corporations, but misused in recent USG proposals) USG = United States Government ITAR = International Trade and Arms Regulations. Regulations export of arms from the US. Strong Crypto is regulated as a weapon by this document. see Q3.2 EAR = Encryption Algorhythm Regulations (a guess, look it up) Recent proposals by Clinton Administration. see Q3.2 TLA = Three Letter Acronym/Agency. Refers to USG agencies (typically involved in law enforcement) FBI, CIA, NSA, etc. NSA = National Security Agency. This highly secretive agency is responsible for the protection of USG secrecy via encryption as well as the spying on other governments by breaking encryption algorhythms. see Q4.8 DES = US Data Encryption Standard algorhythm. see Q2.9 RSA = a company and a public key algorhythm. see Q2.9 and Q2.3 net.loon/kook = a purely subjective characterization. Signal-to-Noise ratio = Signal refers to on-topic posts. Noise, the opposite. A high S/N ratio means the list is putting out a lot of signal("good posts"). Subjective, but fairly obvious. See Section 5 for pointers no how to reduce (what you think is) noise Memes = [get a good definition here] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [Rest of FAQ goes here :) This is a pre-alpha FAQ, intended only to solicit commentary and suggestions.] -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: latin1 iQCVAwUBMwJViqb3EfJTqNC9AQHigwP+IAXu+PO7aGiR/zZxz91PhnYuYvTy3jMN HzO4djcx44auPMjh6pFpmWJuYRcoxVHXCh2JO4UOR3cNYloxikwY4hGgYx8jLgN1 XORQztiCGMI/2ScVsi8tH6eJLCuZxmE7s8semel4CC8xH3H74vCiBNZD6iyyIXOG oMkSnOVFAQg= =Fdky -----END PGP SIGNATURE-----

1 0

Remove My Name
by KENNETH A. LEONE 17 Dec '03

17 Dec '03

I CONTINUE TO RECEIVE MAIL. PLEASE REMOVE MY NAME FROM THE MAILING LIST. THANK YOU

1 0

Re: anonymity and e-cash
by janke＠unixg.ubc.ca 17 Dec '03

17 Dec '03

Lee Tien <tien(a)well.com> writes: > [...] > Is payee anonymity technically possible? Under what conditions? > [...] It's not too hard: The payee forwards a blinded, non-signed coin to the payer. The payer has the bank sign this, and then returns it to the payee who strips out the blinding factor. I think this is discussed in Schneier. Leonard

1 0

Re: John Gilmore the fascist cocksucker
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Why you are doing this, Paul? > > - Igor. It would appear that someone I gave my password to the other day (I recieve no sensitive mail through this account) so they could use it to test a machine has a rather infantile sense of humour and have taken my critical posts to the list to mean that I want to spam a mailing list with dreck like this. I shall ensure the offending fool is castrated forthwith... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Spam posts from my acct.
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

Cpunks, A number of spam mails (I counted about 100 in my incoming mail) were sent to the list from my account last night. I do not take particular precautions with my password for this account as there is no sensitive mail sent through it, I recall in particular giving the password to someone to test out a machine recently and I believe they may be the culprit. Again, my appologies for the inconvenience and you have to admit that while his method may have been less than subtle his message was certainly something we can all relate to ;-) Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Recommendation: Creation of "alt.cypherpunks"
by Timothy C. May 17 Dec '03

17 Dec '03

At 5:49 PM -0600 2/12/97, Firebeard wrote: >>>>>> Timothy C May writes: > >TCM> Since posting my comments I've just seen the proposal that tivoli >TCM> may host a list. > > Whoa, Nellie! Who made that proposal? It certainly wasn't >me! I said that I was taking steps to set up a majordomo to host a >cypherpunks list. Topmost on those steps is creation of the sten.net >or sten.org domain, and getting a personal, >paid-for-out-of-my-own-pocket, ISDN connection. The majordomo will >run off of my personal computer sitting in my apartment, not on Tivoli >hardware sitting in the support lab. As I said, John forced my hand >in his announcement, causing me to 'put up' before everything was in >place, including the domain registration. Yes, my mail comes from >sten.tivoli.com. That doesn't mean that everything I do in life is >connected to Tivoli, IBM, etc. Sorry, I was just going by what I saw in your e-mail address. My point was not really about Tivoli, or IBM, or any other particular company, though. I was making the point that _any_ site distributing a list is likely to face legal pressures not to carry certain items. Read between the lines (or read the unedited list) the discussion by John Gilmore, Sandy Sandfort, and the products of Sandy's company, and legal pressures applied, to see what I mean. --Tim May Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: anonymity and e-cash
by Tim May 17 Dec '03

17 Dec '03

(A copy of this message has also been posted to the following newsgroups: alt.cypherpunks, talk.politics.crypto,sci.crypt) At 1:19 PM -0800 2/12/97, Lee Tien wrote (on the Cypherpunks(a)toad.com list): >The NSA's research report on e-cash says: > > "The ideal situation (from the point of view of privacy advocates) >is that neither payer nor payee should know the identity of the other. This >makes remote transactions using electronic cash totally anonymous: no one >knows where Alice spends her money and who pays her. > > "It turns out that this is too much to ask: there is no way in such >a scenario for the consumer to obtain a signed receipt. Thus we are forced >to settle for payer anonymity." > >Keeping in mind I am only a lawyer, my skim of Schneier (2d ed.) didn't >illuminate. The discussion of digital cash seemed to assume no payee >anonymity. But the immediate previous section of dining cryptographers >involved (it seemed) recipient untraceability. > >Is payee anonymity technically possible? Under what conditions? > >If so, is the issue social, e.g., as NSA notes, the lack of a signed receipt? You missed a very good talk by Ian Goldberg of UC Berkeley at the Saturday Cypherpunks meeting at Stanford, where Ian talked for more than an hour on just this issue. (He also talked for an hour on his crack of the RSA challenge using 250 workstations...this was also a good talk.) It was explicitly stated in Chaum's 1985 paper that methods existed to ensure full untraceability. Chaum has in recent years emphasized a more "surveillance friendly" system in which some of the anonymity is lost. It was the intuition of some of us that "coin changers" could solve this problem, e.g, by having intermediaries to "mix" the coins and thus break the traceability chain. Lucky Green wrote some articles along these lines, and maybe Hal Finney, too. This was a couple of years ago. The notion is similar to what Ian showed, but our arguments were not formal and robust. In August of '95, Doug Barnes released a long article on "Identity Agnostic" systems. (His article is no longer at the www.communities.com Web site, so I can't refer you to it. Maybe he'll post it again.) About a year ago Ian Goldberg considered this issue and came up with a solution which has seemingly reproduced what Chaum was thinking about (but, apparently, did not make completely clear in his papers, for whatever reasons). Ian deals with the issue of "making change" and comes up with a system in which intermediaries, which we may call "e-cashiers" and "moneychangers," can take on the role of the mint/bank. By making "negative deposits" (submitting signed withdrawal slips, effectively), these intermediaries function as moneychangers. And so the one-way anonymous features become two-way (effectively, each of the transactions contributes a "one-way anonymous" component: one-way + one-way = two-way). It is much easier to understand digital cash with the usual diagram showing the usual triangle of CUSTOMER-MERCHANT-MINT and then analyzing the flow of information, who knows what, etc. Drawing such diagrams in e-mail is beyond my patience. This system used online clearing, of course. This "disintermediates" the process, and makes for an "everyone a mint" situation, which has some of the same nice properties that an "everyone a remailer" ecology of remailers and users has. And the principle can be extended further back, to where the usual distinctions between CUSTOMER and MERCHANT vanish (as it sort of does in the real world, where the two parties are merely exchanging one item for another item), and where the role of the MINT is minimal. In fact, Ian showed, the Chaum patents on blinding are NOT USED by the Mint/Bank; only the CUSTOMER uses the blinding patents (and the MERCHANT in some cases, not in other cases). This means that "anyone a mint" does not violate any of the Chaum/Digicash patents, and "mint clients" are likely to be written by third parties. (The _customer_ is presumably on the honor system to abide by the Chaum patents...except the patents are only being licensed to banks...go figure.) (This is where, as I recall, Doug's "agnostic" system came in...it is possible his thinking was similar to Ian's...I don't have Doug's paper handy.) Ian demonstrated this on an actual system, with real live connections to mints in various countries, but with the blinding not used (as I recall). Draw your own conclusions about what this means. It was heady stuff, seeing the result many of us believed to be implicit in Chaum's 1985 paper made real. Everyone a mint. This makes the spread of fully anonymous digital cash harder to stop. Issues of the mint denying one has an account are always real ones, but not important--I think--in the real world. The untraceability of the digital coins means that a mint never knows who is testing it for reliability and "honesty," and the mint cannot set out to "screw" a particular customer by declaring his account not to exist (as the mint almost certainly does not have to know who own which accounts, as deposits can be made anonymously). I hope this helps. I plan to use this result centrally in my talk at the panel discussion on "Governmental and Social Implications of Digital Cash" at the upcoming CFP. --Tim May -- Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

huge test
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

1 Additional 2 Add ## 3 Add ## 4 Add Stuff at bottom

1 0

PGP Media Sues NSI To Open the Domain Name Registration Market
by mf＠MediaFilter.org 17 Dec '03

17 Dec '03

PRESS RELEASE PGP Media, Inc. New York, New York March 20, 1997 PGP Media Sues To Open the Domain Name Registration Market PGP Media, Inc., d/b/a name.space(tm) (http://namespace.pgpmedia.com) ("PGP"), announces that it has commenced an action in Federal Court in New York City against Network Solutions, Inc. ("NSI"), seeking, among other things, to open access to the domain name registration market to allow open, unrestricted competition for the offering of Domain Name registration under potentially limitless Shared Top Level Domains. PGP believes that the Internet has long since become a vibrant and maturing market in which certain de facto monopolists, operating for profit, have been allowed to flout the laws of the United States and other countries which are expressly aimed at preventing such conduct. A copy of the Complaint in that action is now available on the name.space(tm) web page referred to above. With the commencement of this case, PGP is now accepting registrations of domain names under an expansive list of Shared TLDs. An initial registration under a TLD listed on the name.space(tm) web page may be made for $10. When, as a result of the lawsuit or otherwise, the names registered become universally resolvable and the PGP Name Servers become "root," an additional charge of $15 will be imposed to fully register the name for the first full year of use following such universal resolvability. PGP intends to charge a $25 renewal fee for each subsequent year of use of names registered through its registry. In addition, PGP iS also accepting suggestions for additional Shared TLDs to be added to the PGP Registry. The fee which will be charged for such additional Shared TLDs has not yet been determined. For additional information regarding the lawsuit or to receive regular updates, please contact mjd(a)pgpmedia.com.

1 0

Re: FBI Visits JPUNIX
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

In regard to an email which was purported to be subjected to suppression Anonymous wrote: > The first time it was sent via a remailer, it was bounced for ill- > defined reasons. The second time it was sent, the remailer was shut > down, and remains shut down. Mark M. wrote: > Speaking as "XXXXXXXXX" (or, at least, one of the "XXXXXXXXXs"), I did receive > the following message which originated from "TruthMonger." Shortly after I > received the message, anon.nymserver.com closed down all of its free, > anonymous accounts due to "abuse." Anonymous continued: > Efforts to send it through a second remailer also failed, with no > notice from the server of any problems being received. Other email > sent through the remailer at the same time encountered no difficulties. Later the same day John Perry wrote: > Due to an FBI investigation that was opened recently naming > myself and jpunix as suspects, I have decided that the heat taken by > remailer operators due to those individuals that can't control > themselves has become unacceptable. The message in question is below. Draw your own conclusions. XXXXXXXXX, I thought I would reply privately to you, since you seem to at least have a willingness to allow the possibility of compromises to the security of the encryption methodologies behind PGP programs, among others. To begin with, I'm not sure whether you realize it, or not, but the Navy's spook tenacles run deeper, and extend further, than those of any of the more notable or visibly involved agencies who lurk in the background of security and privacy issues. One of the reasons for this is that their physical existence could be said to mirror the Internet in many respects. The very nature of their 'global' home (the sea), has always permitted them access to people and regions which are denied to others. Also, they are often in the position to be involved in what looks to be merely the 'transporting' of people and information. Whether providing escort services or getting drunk in foreign bars, the expertise of naval intelligence has always lain in the area of observation, first and foremost. By far the greatest tool of intelligence agencies on the Internet, has been traffic analysis. Their techniques are sufficiently sophist- icated that I would not be surprised to find out that they can tell more about us from our Internet activity than can be learned from the satellites capable of reading the newspaper over our shoulder as we sit in the park. Traffic analysis involves all measurable quantum of information, the chief concerns being the patterns and timing of data transfer, from which everything ranging from content and motivation can be deduced. If you wish to think in terms of back-doors, then you would be well advised to go beyond the concepts of 'passwords' and 'holes' and try to think in terms of patterns and timing, and other such 'structures' which are peripheral to concerns regarding 'code' and 'mathematics.' i.e. As well as considering the 'content' of what a program returned, you must also consider 'when' the program returned the result, and the patterns in the timing, as well as the content. An analogy could be made to a person who, being interrogated, answers all questions with a predictable rhythm and then 'pauses,' however slightly, in answering a certain question. You can see that what is revealed by the 'content' of the answer can be greatly insignificant compared to what is revealed by the 'delay' in answering. To expand your concept of 'back-doors' and 'holes,' you have to ask questions such as: "Does it take a program or hardware longer to return a result of '0', than to return a result of '1'?" "What factors can be introduced into the hardware and/or software that can influence the patterns and/or timing of various processes and the results they return?" "Can key searches be made more efficient by analyzing such things as rhythm, syntax, etc? What 'details' or 'qualities' of an individual, group, or 'arena of concern' can be analyzed for the purpose of being able to group them into structures which can be searched for?" "How can 'assigning' a value to certain sequences of numbers be used as a pattern to 'filter' the input data into a form which is easier to analyze?" You are aware of 'tricks and techniques' that apply to mathematics and are widely known. i.e. The process of shifting and adding numbers when multiplying by the number '11'. However, what about those quantum of information which are of no consequence to those seeking for the 'final result' of that multi- plication? Can the peripheral effects of mathematic calculations be used to analyze what has taken place, to narrow the scope of inquiry? My nephew describes numbers as getting 'wider' as they get larger, and he does quick checks of his result through his 'feel' for how much 'wider' a number should be when he is done, even in complicated equations which he ill-understands. (He reminds me of Steven Wright, who claims that someone told him that his socks didn't match, and he replied, "Sure, they do. I go by thickness.") I am currently working on a project which involves merging chaos theory with traffic analysis and other processes to analyze the effects that algorithms display when processed through the filters of varying hardware and software structures and methodologies. The RSA algorithm and accompanying RSAREF subroutines were our first focus, for the very reason that there were certain factions behind the scenes of the Zimmerman/RSA agreement who seemed to have an inordinate amount of interest in the subroutines being chained to the algorithm (for reasons that have nothing to do with patent protection). Those whose expertise goes far beyond my own in this area look at the initial results of the analysis as confirming that their is a 'relationship' between the RSA algorithm and the RSAREF subroutines which will enable them to break the system down into workable units for fairly quick analysis. What is interesting is that the results from small probes into other encryption systems show the same potential for exploitation using varying analysis methodologies and processes. (One fairly well-known encryption routine is almost lame enough to reveal its secrets to anyone with a pencil and a stopwatch, as well as the file size and time it takes to encrypt.) While I would rather you didn't publicize the preceding information, as a general rule, I think that is something that should be shared with anyone who is seriously focusing their efforts on better methods of encryption and analysis of encryption methodologies. I am aware of two other groups who are working along the same lines, although with a narrower range of variables than ourselves, and I am certain that there must be more than a few other entities out there who are also pursuing this line of research.

2 1

encrypt_1.html
by Lynx_User＠linux.nycmetro.com 17 Dec '03

17 Dec '03

Reuters New Media [World Book 1997 Multimedia Encyclopedia. Built upon the questions kids ask most. IBM] [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Previous Story: U.S. Bill To Ban Internet Gambling Introduced Next Story: Rational Unveils Software With Microsoft _________________________________________________________________ Thursday March 20 2:56 PM EST Clinton Admin. To Offer Encryption Bill Shortly WASHINGTON - The Clinton administration plans to introduce legislation soon that would clearly affirm that encryption users in this country are free to use any type or strength of encryption technology, a senior administration official said. Currently, no such explicit law is on the books. Under Secretary of Commerce William Reinsch also told a Senate Commerce Committee hearing the bill would explicitly state that participation in so-called "key management infrastructure" would be voluntary. Key refers to the password or software "key" that can read encrypted information. The bill also would: -- Spell out the legal conditions for the release of "recovery information" to law enforcement officials. The bill also provides legal safeguards for third-party "key recovery agents" who have properly released such information. -- Criminalizes the misuse of keys and the use of encryption to further a crime. -- Offers, on a voluntary basis, firms that are in the business of providing public cryptography keys the opportunity to obtain government recognition. Such recognition, Reinsch said, would allow firms to "market the trustworthiness implied by government approval. The testimony came in a hearing on two bills introduced by Senate lawmakers that would remove almost all export curbs on encryption technology. The administration's newest export policy, enacted through executive order in November and in effect since January 1, allows export of stronger encryption than previously allowed. But it requires companies to incorporate features within two years allowing the government to crack the codes by getting access to the software keys. Administration officials said they opposed the export provisions in the two Senate bills, saying that the export liberalization goes too far. The bills were offered by Sens. Patrick Leahy (D-Vt.) and Conrad Burns (R-Montana). Copyright, Reuters Ltd. All rights reserved _________________________________________________________________ ________________________ ___________ Help _________________________________________________________________ Previous Story: U.S. Bill To Ban Internet Gambling Introduced Next Story: Rational Unveils Software With Microsoft _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments

1 0

Re: PGP Security
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:markm@voicenet.com to Harka <=- In> The fundamental problem with the current remailer network, as others In> have noted before, is that it is a free service open to abuse by In> anyone. If remailers were commercialized, this would eliminate the In> spam problem and would provide the remailer operator with resources to In> legally defend him or herself. Currently, there is no modivation for an In> operator to continue the service when legally threatened. Personally I believe, that the fundamental problem with remailers is, that there are simply too few of them. If there were a few hundred or even thousand around the world, it would be much harder to crack down on the R-network and the individuals, who run the remailers. In need is a remailer program, that even not so technical people could easily run from their common Windoze machine. Jgrasty's winsock remailer is a good step in the right direction (although it didn't work for me personally). Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! --> http://www.eff.org */ /* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ ___ Blue Wave/386 v2.30 [NR] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMzJEKTltEBIEF0MBAQGgfwf/QePG5nHUjZajUjmskX/CwW+WSvMcDE13 +EiILayy/lE4WQQeGCK8Q0/gcmVqTNtvug3gSRYyUqmadDgzfAlpFg4Vn5pv3I1Z Spf8WNiRpQ1EhHIXPaW4zwMRvAAeySQG/WMmRFzzYWSb2MydlHy3e/XhDy8OtBe3 5IwcGimZE+820eXgdXdCPM2xg3Bri8tUlqBvrVvD+hPi8e5hw3eNc/i1Jf1GP4+w WIhLLzkRe+AYxXEpUrK5c2D1HiNO3KRWqmTiufTjXHZPnu8DW5BXODTbBoqnyOBi syCctfLGD85zFo199FYVsQ4ThFE897qo3U4v9JQuHifRw0GQS5GCiQ== =f+dR -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

gambling_1.html
by Lynx_User＠linux.nycmetro.com 17 Dec '03

17 Dec '03

Reuters New Media [IBM DB2] [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Previous Story: Wired Summit Newsroom Echoes To Click Of Mice Next Story: Clinton Admin. To Offer Encryption Bill Shortly _________________________________________________________________ Thursday March 20 2:57 PM EST U.S. Bill To Ban Internet Gambling Introduced WASHINGTON - A bill to ban all forms of gambling on the Internet has been introduced in the U.S. Senate. "Given the tremendous potential for abuse, addiction and access by minors, online gambling should be prohibited," Sen. Jon Kyl, an Arizona Republican, said. He was joined by two other Republicans and three Democrats in offering the bill. Currently, only computer gambling on sports events is prohibited. The legislation would extend criminal penalties to companies who offer all types of computer gambling. Communications companies regulated by the U.S. Federal Communications Commission would be required to discontinue services to any companies they carry that offer gambling. Kyl said the bill also eliminates ambiguity about the definition of bets and wagers to make any form of online betting illegal. The bill was introduced on the same day as the U.S. Supreme Court heard arguments about a 1996 law banning transmission of sexually explicit material on the Internet to anyone younger than 18. The Clinton administration argued that the law should be upheld to protect young children. Opponents said it violated free-speech rights of adult Internet users and should be found unconstitutional. A decision in the case is due by July. Copyright, Reuters Ltd. All rights reserved _________________________________________________________________ ________________________ ___________ Help _________________________________________________________________ Previous Story: Wired Summit Newsroom Echoes To Click Of Mice Next Story: Clinton Admin. To Offer Encryption Bill Shortly _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments

1 0

Re: FINALLY, "SOME" TRUTH Re: Anonymous Nymserver: anon.nymserver.com
by Toto 17 Dec '03

17 Dec '03

Attila T. Hun wrote, in blood: > on or about 970313:1533 TruthMonger <an7575(a)anon.nymserver.com> said: > + To reiterate my original observations: > +1. The development of RSA was funded and controlled by the spooks. i.e. > +- The National Science Foundation and the Navy. > +2. The campaign of persecution against Phil Zimmerman ground to a halt > +once he agreed to PGP using the spook-developed RSAREF subroutines to > +implement the RSA functions, instead of PGP's original subroutines. > about a year ago when Phil's prosecution was dropped, I wrote a > rather lengthy message here about PKZ, the prosecution turning to > vapour, surprise funding for PGP, Inc. (which is substantial), and > the issue of being compromised. What I found interesting about TruthMonger's missive was that the replies he received as a result of merely 'questioning' certain things regarding the holy icon of PGP, he got back replies/rants, from normally rational list subscribers, which were scathing rebukes to issues he or she hadn't even raised. I wonder if you had a similar experience with the post you mention. > ANYONE who has managed to walk away from a fed hate/hatchet job has > been compromised to some extent. No shit, Sherlock. > + If people with guns came to me and told me that software I had > +written now had to use their subroutines, instead of my own, then I > +would consider my software 'compromised', regardless of whether or not > +I could immediately discern any anomalies in it. > + It is far, far easier to 'build' a back-door, than to 'find' one. > > you got that one right! > just the ability to _backtrack_ into the algorithms is a start. > One piece of clear text and you're toast. You can't tell me the guy who designed the Rubik cube didn't know how to 'beat' it when he was done. > + It never fails to amaze me how the back-doors that software makers > +intentionally build into their products for their own convenience > +suddenly become 'bugs' when hackers, among others, take advantage of > +them. > + One hacker I know used to find most of his hacks into AT&T UNIX by > +screwing up his system (i.e. - corrupting the passwd file) and then > +calling in the AT&T support techs and observing their tricks and > +techniques (and then improving on them). > > ...ask a few of the old line unix hacks at Murray Hill (where I was > "granted" my name....) however, AT&T was never as bad as a few of > the others (Sperry comes to mind...) and most of AT&T's access > points were not open and exploitable without you enabling them (by > giving them access). I know a hacker who could get Support Techies to perform all of their secret black-magic in front of him just because he had the abilty to act extremely stupid. (If he asked you the time of day, you'd write it down for him, and explain it to him.) > however, 20 years ago, the feds were scary enough with "new" > crypto; 4 AM rousts that noone believed the feds would do. > warrants? yeah, right! If the feds arrested you, you were > "obviously" guilty or they would not have arrested you. I think we can expect the day to come when the Feds make their major public relations tune "If you don't have anything to 'hide', then why do you need crypto?", thus pointing out to 'decent folk' that the CypherPunks are all drug smuggling, tax-dodging pedophiles. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: encrypt_1.html
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:lynx_user@linux.nycmet to Harka <=- In> Clinton Admin. To Offer Encryption Bill Shortly In> WASHINGTON - The Clinton administration plans to introduce In> legislation soon that would clearly affirm that encryption users in In> this country are free to use any type or strength of encryption In> technology, a senior administration official said. In> Currently, no such explicit law is on the books. Obviously, by making a law, that strangely enough tries to legalize, what is legal already, the administration is trying to bait people into "voluntary" key escrow, which are in my opinion the actual main points of the law... In> The bill also would: In> -- Spell out the legal conditions for the release of "recovery In> information" to law enforcement officials. The bill also provides In> legal safeguards for third-party "key recovery agents" who have In> properly released such information. etc.etc... What a bunch of bullshit. Now, that the backdoor "Clipper" doesn't work due to enough awareness, they now try all the windows of the house of cyberspace to do their black-bag job of getting a lock on the front-door, that they'd have a master-key for... Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! --> http://www.eff.org */ /* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ ___ Blue Wave/386 v2.30 [NR] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMzJYADltEBIEF0MBAQFbFgf9HEgRLdqaE9jiWXBr8ztkLPTLAaQ5BfRE e4Q6KEYC/zGXUOEtxUEN755rIHo8PNwwSM7ovbEGf7La15O4AnNxRKbVvFbUWGTv nVw3eMDiy/mt11DqMQ316zAIv0sIpXJhspxHTSMWU++uIR3pVUGq31weFPUN4f4B RruaJwEmf1dvVVJkXHgDsrC8HiECSrBidvz57vfpeZpIj4BscEdycBEAH8zmnPic t3Hi9sc5Gc6DQz6ThbaMAj2bHhWEwPuw3GiKe2yzM6A2D/DeIZrlJ0dE2hK6DMXV jz2/DKNQYp9kS1d6vojPdYYEaPXR/upg6Otqno3SJ71DEMqcc49IDA== =vBCY -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

3 2

Cyberpromo hacked
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

http://www.anonymizer.com:8080/http://www.cyberpromo.com

1 0

Re: ADV Weekly Transcripts
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Regarding 1968 view of population control: _Stand on Zanzibar_ John Brunner Thanks

1 0

No Subject
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

BELIEVE the Children! Toto <toto(a)sk.sympatico.ca> writes: > Dale Thorn wrote: > > > > Really? Define _common_. I have lived in the Mid West for about 85% of > > > my life, and I know no one who learned these things from their parents. > > > > C'mon guys. Parents diddling with their kids is more than common - > > probably 1/3 of all fathers do something sexual with one or more > > of their children at some point. People just suppress it. > > I can't believe it could be that common without the government > finding a way to 'tax' it. Def: relative humidity - the sweat on snow's balls as he fucks his sister. BELIEVE the Children!

1 0

Jackboots in Canada
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- AP 3/21/97 Quebec Spurred by a new outbreak of bombings, the Canadian government agreed Thursday to toughen laws to help Quebec stamp out a war between motorcycle gangs that has killed more than 30 people. [snip] ...Hell's Angels and Rock Machine...have been battling for control of the illegal drug trade in Canada. Canadian justice minister, Allan Rock, said the measures would include broadening laws on search warrants, electronic eavesdropping and bail conditions for arrested gang members. -----BEGIN PGP SIGNATURE----- Version: 4.5 iQCVAgUBMzKOOiKJGkNBIH7lAQHrAwP+P/0YSzXsLKlLe5YAzOVC0QB31uNhmvim HsSdPbulXccXCV0WIeG5uCtzCLXliR759KunfxEs2GithcIpfcDDKa4SFJv9+SVi PqmWXAxs+qNQ/uQqsDo97zuk+tNhO0631XRkh1LS+tL9Q6pCJfSpNl3Ntvhtyafv OD01c5tLwts= =AqwJ -----END PGP SIGNATURE-----

6 6

BXA on Crypto Plans
by John Young 17 Dec '03

17 Dec '03

Excerpt of BXA head William Reinsch statement on Goodlatte's SAFEncryption Bill HR 695 on March 20, 1997: The Administration has stated on numerous occasions that we do not support mandatory key escrow and key recovery. Our objective is to enable the development and establishment of a voluntary key management system for public-key based encryption. We believe the Administration's policy is succeeding in bringing key recovery products to the marketplace. Our attention is now turning toward how we can best facilitate the development of the key management infrastructure that will support those products. To that end, we will shortly submit legislation intended to do the following: Expressly confirm the freedom of domestic users to choose any type or strength of encryption. Explicitly state that participation in the key management infrastructure is voluntary. Set forth legal conditions for the release of recovery information to law enforcement officials pursuant to lawful authority and provides liability protection for key recovery agents who have properly released such information. Criminalizes the misuse of keys and the use of encryption to further a crime. Offers, on a voluntary basis, firms that are in the business of providing public cryptography keys the opportunity to obtain government recognition, allowing them to market the trustworthiness implied by government approval. ---------- Full statement: http://jya.com/bxahr695.htm

1 0

[alt.best.of.cypherpunks]
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thanks for the laugh. - ------- Forwarded Message From: snow <snow(a)smoke.suba.com> Subject: Re: PGP on AOL To: harka(a)nycmetro.com Date: Fri, 21 Mar 1997 07:46:08 -0600 (CST) Cc: cypherpunks(a)toad.com > Hi there, > I want to help a friend of mine to set up PGP. She's using Win 95 and > is on AOL. Can anybody recommend some good shells, that would make > make it easier for her? Remington .20 Gauge. Use the finest shot you can find, it tends to penetrate walls less. Good luck. - ------- End of Forwarded Message Zooko PGP sig follows -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMzKSYUjbHy8sKZitAQHrUgL/TC6JSEVU8QZq00WGt0Yp76AT9pPdgog0 3IUpFE17b+QPz9Lwn1FprL6oaSnAZgz7qnuGj+nel3VNd1R/Tjfa/5qnFiDj++q7 a1+ScrPkfZKQy9DaL9VCavqvTZNoyur0 =7yuN -----END PGP SIGNATURE-----

1 0

Re: FINALLY, "SOME" TRUTH Re: Anonymous Nymserver: anon.nymserver.com
by Kent Crispin 17 Dec '03

17 Dec '03

On Fri, Mar 21, 1997 at 03:06:41AM -0600, Toto wrote: > Attila T. Hun wrote, in blood: [...] > > > > you got that one right! > > just the ability to _backtrack_ into the algorithms is a start. > > One piece of clear text and you're toast. > > You can't tell me the guy who designed the Rubik cube didn't know > how to 'beat' it when he was done. With all due respect, Toto, this is not a valid point. It is easy for someone to design and implement something they can't beat. Whether PKZ designed in, or was coerced into installing, a backdoor into PGP is an interesting speculation, but immaterial. The only real data you have is the code itself. -- Kent Crispin "No reason to get excited", kent@songbird.com,kc@llnl.gov the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html

1 0

UK TTP Paper
by John Young 17 Dec '03

17 Dec '03

Forward from Cyberia-L: Making absolutely no comment on the subject of licensing of certification authorities, you may be interested in a UK paper entitled LICENSING OF TRUSTED THIRD PARTIES FOR THE PROVISION OF ENCRYPTION SERVICES - Public Consultation Paper on Detailed Proposals for Legislation, March 1997. You can obtain a full document at http://www.dti.gov.uk/pubs. E. Michael Power Coordonnateur Secrétariat au commerce électronique Ministère de la Justice Canada ---------- This paper links to David Herson, the reputed GCHQ spy who admitted the EU/FBI wiretap pact: Information on any of the current TTP projects can be obtained from David Herson (DG XIII/7) at the European Commission (e-mail david.herson(a)bxl.dg13.cec.be) or from the Commission Web site at www.cordis.lu/infosec/

2 1

Re: FINALLY, "SOME" TRUTH Re: Anonymous Nymserver: anon.nymserver.com
by Toto 17 Dec '03

17 Dec '03

Kent Crispin wrote: > > On Fri, Mar 21, 1997 at 03:06:41AM -0600, Toto wrote: > > Attila T. Hun wrote, in blood: > [...] > > > > > > you got that one right! > > > just the ability to _backtrack_ into the algorithms is a art. > > > One piece of clear text and you're toast. > > You can't tell me the guy who designed the Rubik cube didn't know > > how to 'beat' it when he was done. > With all due respect, Toto, this is not a valid point. It is easy > for someone to design and implement something they can't beat. > Whether PKZ designed in, or was coerced into installing, a backdoor > into PGP is an interesting speculation, but immaterial. The only > real data you have is the code itself. I wasn't referring to either PKZ or PGP, but to 'systems', in general. In designing systems of any type, one can often have elements of design which aren't in the blueprint. An example would be an architect who designs a room to echo (or not echo) sound in a certain way, for use as a concert hall or music studio. No amount of analysis of the blueprints will show this 'hidden' design unless the person looking is thinking in the same terms as the designer. Certainly, if the blueprints described the room as a 'sound room', then this might give some a clue as to the hidden elements, but still would not inherently reveal every aspect of what was involved in the design. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

WebWorld 9
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

Re: encrypt_1.html
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> | The fact that they are pushing key escrow must indicate that > |someone has developed a program that they can't crack and don't > |have a back-door to. > | I wonder which one it is? This ignores the basic law of conpiracy theorism: Suspect everyone and everything. I believe the current push to establish key escrow systems, which will inevitably lead to enforced domestic GAK in a number of countries is possibly a double cross. If mandatory GAK is introduced who will be the most likely to ignore the legislation and continue using non-GAK crypto? - The anarchists and other "terrorist" groups of course. This would seem to suggest the govt. is trying to lull these groups into a false sense of security believing their non-GAK crypto to be strong. This would in turn seem to suggest that the NSA, GCCS etc. have broken a number of currently used algorithms that are believed strong by the civilian research community. At the end of the day though this is pure speculation and the spectre of GAK still looms over us and must be defeated, however, as conspiracy theories go I happen to think it is one of my more believable delusions.... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Explosion...
by Progress＠utkform.com 17 Dec '03

17 Dec '03

ANNOUNCING: World Class MLM LAUNCHES even as we speak. Just gone public with top positions now being filled with major leaders from across the industry. Your eyes have seen it first! Act NOW! * World Class Executive Leadership/Financial Backing/Over 150 Years Comb. MLM Experience! * Diverse Product Lines Being Developed - Health, Beauty, Nutrition, Telecommunication, and more! * Fast Paying NEW Compensations Plan (from the Creator of the Unilevel/Binary). * International Expansion. * No Product Purchase Required. * Expert Internet Support. * Television Infomercial's. * Certified Training Courses. * Residual Income/No Brainer Qualification. * Forced Spillover/New Two Wide System. * Company LEAD Sharing Program! (FREE) Looking for Leaders to handle the massive downlines now forming! I am working with the frontline of the company. Contact me NOW if you think you qualify. Send an Email to: explosion1(a)juno.com with 'explosion' in the subject line. I will contact you personally as soon as possible. Thank you. --------------------------------------------------------------------------------------------------------- || Do Not Hit Reply. If you want more info, send an email || to: explosion1(a)juno.com with 'explosion' in the subject. || This is a one time email. ---------------------------------------------------------------------------------------------------------

1 0

NYU's PGP Key-Signing Seminar - a critique
by Sergey Goldgaber 17 Dec '03

17 Dec '03

I am writing regarding the PGP Seminar to be held on the 27th of March. Your informative session is laudible. And, I would like to take full advantage of the key-signing session to follow. However, there is a certain concern which it would be prudent to address first. http://www.nyu.edu/pages/advocacy/awareness/pgp.html provides instructions for the session, which state: "8. At the seminar Tim and Ilya will confirm the identity of all participants and the participants will identify their own keys. 9. After the seminar Ilya will e-mail all the participants the keyring with all the keys, along with the instructions on how to sign them." This conflicts with the guidelines for hosting pgp key signing sessions as presented in the alt.security.pgp FAQ (a relevant excerpt is attached to this message). The FAQ states: "6. Each person securely obtains their own fingerprint, and after being vouched for, they then read out their fingerprint out loud so everyone can verify it on the printout they have." ~~~~~~~~ The concern I have is that this discrepancy undermines the web of trust model for PGP. The participants of the NYU session will not have the opportunity for verifying the identity of the owners of the keys that they are signing. They must rely on a central authority ("Tim and Ilya"). I realize that this may be a simpler, and perhaps a more convenient method of conducting a key-signing session, perhaps ideally suited to a session aimed at novices. However, I feel that the security provided by PGP is thereby undermined. We must not forget that security is the whole reason that even the novices at your session are using PGP for in the first place. I hope this issue can be addressed before the session begins. ............................................................................ . Sergey Goldgaber <sergey(a)el.net> System Administrator el Net . ............................................................................ . To him who does not know the world is on fire, I have nothing to say . . - Bertholt Brecht . ............................................................................ 6.8. How do I organize a key signing party? Though the idea is simple, actually doing it is a bit complex, because you don't want to compromise other people's private keys or spread viruses (which is a risk whenever floppies are swapped willy-nilly). Usually, these parties involve meeting everyone at the party, verifying their identity and getting key fingerprints from them, and signing their key at home. Derek Atkins <warlord(a)mit.edu> has recommended this method: _________________________________________________________________ There are many ways to hold a key-signing session. Many viable suggestions have been given. And, just to add more signal to this newsgroup, I will suggest another one which seems to work very well and also solves the N-squared problem of distributing and signing keys. Here is the process: 1. You announce the keysinging session, and ask everyone who plans to come to send you (or some single person who *will* be there) their public key. The RSVP also allows for a count of the number of people for step 3. 2. You compile the public keys into a single keyring, run "pgp -kvc" on that keyring, and save the output to a file. 3. Print out N copies of the "pgp -kvc" file onto hardcopy, and bring this and the keyring on media to the meeting. 4. At the meeting, distribute the printouts, and provide a site to retreive the keyring (an ftp site works, or you can make floppy copies, or whatever -- it doesn't matter). 5. When you are all in the room, each person stands up, and people vouch for this person (e.g., "Yes, this really is Derek Atkins -- I went to school with him for 6 years, and lived with him for 2"). 6. Each person securely obtains their own fingerprint, and after being vouched for, they then read out their fingerprint out loud so everyone can verify it on the printout they have. 7. After everyone finishes this protocol, they can go home, obtain the keyring, run "pgp -kvc" on it themselves, and re-verify the bits, and sign the keys at their own leisure. 8. To save load on the keyservers, you can optionally send all signatures to the original person, who can coalate them again into a single keyring and propagate that single keyring to the keyservers and to each individual. This seems to work well -- it worked well at the IETF meeting last month in Toronto, and I plan to try it at future dates. http://www.nyu.edu/pages/advocacy/awareness/pgp.html Awareness Week 1997 Pretty Good Privacy Seminar Thursday, March 27 at 12:00 pm Warren Weaver Hall, Room 313 [INLINE] This is a Blue-Ribbon event, CANYU will distribute Blue Ribbons to participants This seminar sponsored by the Computer Advocacy @ NYU and the Academic Computing Facility. The seminar will explore the need for use of cryptography for communications in every day life, and demonstrate how PGP (Pretty Good Privacy) can be used at NYU. This workshop is a part was preceded by another seminar titled "Encryption: Padlocks for the digital age". Speakers: * Tim O'Connor * Ilya Slavin A key signing session will follow the seminar. The instructions follow: 1. If you have already created your key, skip to the following step. + You can create your new key on one of the IS machines (and, most likely, many other computers at NYU) by following the steps outlined in the following document. 2. Once your key is generated and signed by yourself, extract your public key from the key ring by typing pgp -kxat userid keyfile.asc where keyfile.asc is a name of the file you want to copy your key to. 3. Send this file with your name and a mention of the seminar to slavin(a)acf2.nyu.edu before 7:00 PM on March 26, 1997. 4. Ilya will compile a master keyring with all the keys before the seminar starts. 5. Please write down (or print out) the output of the following command: pgp -kvc where <userid> is your name or e-mail address that appears in your key. 6. Ilya will have printouts of userids and fingerprints of all keys sent to him. 7. Bring two photo IDs (either a passport or other respectable form of ID) to the seminar so that we can verify your identity. 8. At the seminar Tim and Ilya will confirm the identity of all participants and the participants will identify their own keys. 9. After the seminar Ilya will e-mail all the participants the keyring with all the keys, along with the instructions on how to sign them. 10. Once the keys are signed, the participants will e-mail their signed keyrings to Ilya, who will add their signatures to the master keyring. 11. As soon as Ilya receives all the signed keys, he will e-mail the complete keyring to all the participants, who can add the new signatures to their own keyrings. ______________________________________________________________________ Computer Awareness Week '97 / Ilya Slavin / Last Modified: 3/6/97

2 2

Re: UK govt. to ban PGP (was Re: UK TTP Paper)
by John Young 17 Dec '03

17 Dec '03

>: In Grey's words, ``All over Europe, the lights are going out'' >: >: Ross There does appear to be a coordinated global action to issue policies on TTP, GAK and the like at this time. OECD is due to shortly release its crypto policy, as is the USG according to BXA. The FBI issued its wiretap payment plan yesterday. Herson publically admitted the EU-FBI wiretap pact. All are apparently guided by The Wassenaar Arrangement amongst two dozen or so countries to act in concert, and to go public with dual-use controls in unison. So, Clint Brooks' comment at CFP about a new policy coming out for stronger crypto is a surely a harbinger of global GAK, in the guise of TTP or Key Recovery, as was speculated here, and as Rensch's statement to the House yesterday affirms. It's a policy sure to appeal to nationalists and chauvinists: strong protection for a nation's interest and commerce with GAK; without it no protection from predatory (rogue) nations (and criminals). But, as the Crypto AG engineer asked, "Who will protect us from NSA?" And its predatory clients and contractors, the Germans and French and others are asking, now that they are suffering the unilateral spying of their highest tech "friends."

3 2

"why privacy" revisited
by Wei Dai 17 Dec '03

17 Dec '03

The question "why privacy" has at least two different meanings. The first one, "why do you value privacy for yourself" has a fairly obvious answer. Privacy implies control over one's personal information, and more control is clearly preferable to less. But the question also has a second meaning, "why do you think everyone should have more privacy?" The answer to this question is not so obvious. Just because each individual wants more privacy for himself, it doesn't follow that everyone will be better off when everyone has more privacy. Cypherpunks accept the idea that the widespread deployment of cryptography will increase privacy for everyone (or at least everyone who owns a computer and an Internet link). They also argue that this is a good thing. The reason most often cited is that privacy serves as a barrier for coercion. But privacy is also a barrier to almost every other kind of social relationship. For example, economists recognize that many market failures/inefficiencies are caused by information asymmetries (i.e., the fact that in a potential exchange one party has more information about the exchange than the other. The canonical example for this is the used car market.) Increased privacy would seem to only exacerbate these problems. What arguments can be made that the benefits of increased privacy outweigh its costs, considered for society as a whole?

1 0

Re: Dorothy and the four Horseman
by Toto 17 Dec '03

17 Dec '03

Douglas Barnes wrote: > > Aldrich Ames is actually a great example of why Key Escrow is > NOT a good idea. Any measure that concentrates keys in one or > several locations creates a tempting target for spies, > criminals and corporate espionage types. How much better do the > GAK proponents plan to protect keys than, say, the names of all > our agents in the former Soviet Union? > > Doug

1 0

Re: "why privacy" revisited
by Jonathan Gaw 17 Dec '03

17 Dec '03

when i talk to people like the Direct Marketer's Assn., they honestly don't understand what the fuss is about. Their attitude is, quite literally, "What's the harm being done here?" what do you think the community interested in privacy protection can do to best illustrate to the general public the "harm" in the collection of personal information? Jonathan Gaw At 09:28 AM 3/22/97 -0800, Timothy C. May wrote: > >Much as I agree with the point that privacy is desirable, I find the >"market efficiency" arguments unpersuasive, at least as presented below: > >At 1:01 PM +0000 3/22/97, Adam Back wrote: > >>You requested an argument couched market economic terms as to why >>reduced privacy might be a bad idea for the market efficiency. >>Consider: >> >>Less privacy is a bad thing in market economics terms, because as >>privacy takes a downwards spiral, which leads to ever increasing >>government intervention, increasing sizes of governments, fascism, >>etc. the free market economy will go to hell. Poverty, and food >>shortages will result, a la the former USSR, which is slowly >>recovering from the decline caused by statist, facist policies. We on >>the other hand, absent pressure from outside government, law >>enforcement and secret services circles are collectively headed into >>that fascist driven downward spiral.in economics. > >Or, since we all understand perfectly well that *credit cards* and *checks* >and other forms of *electronic payment* are not private in the way cash is, >Adam's argument could read as follows: > >"Using credit cards and checks is a bad thing in market economics terms, >because as privacy takes a downwards spiral, which leads to ever increasing >government intervention, increasing sizes of governments, fascism, etc. the >free market economy will go to hell. Poverty, and food shortages will >result, a la the former USSR, which is slowly recovering from the decline >caused by statist, facist policies. We on the other hand, absent pressure >from outside government, law enforcement and secret services circles are >collectively headed into that fascist driven downward spiral.in economics." > >In other words, I submit the fallacy of this comment, that traceable >payment schemes such as credit cards and checks have _not_ destroyed the >U.S. and Western economies as evidence that Adam's thesis is incorrect. > >(One might point to the correlation between increased credit and check >instruments over the past 50 years and the rise of government spending, but >such a correlation would not, in any reasonable view, be causative. I'll >elaborate on this if there's real interest.) > > >--Tim May > >(I'm not arguing against privacy. I just don't see the validity of some of >the attempts to "prove" that privacy enhances markets (whatever that means) >and that non-privacy undermines markets. Such arguments are mostly >unpersuasive and depend strongly on assumptions and interpretations and >selective admission of facts.) > >Just say "No" to "Big Brother Inside" >We got computers, we're tapping phone lines, I know that that ain't allowed. >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Higher Power: 2^1398269 | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." > > > > > ****************************************************** Jonathan Gaw The Star Tribune Minneapolis, Minnesota jonathan(a)gaw.net *********Wasting Digital Bandwidth Since 1986*********

3 2

Cypherpunks Bottleneck [was Cypherpunks & Ecash]
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 05:04 PM 3/21/97 -0800, you wrote: |[Hmmmhhhh...after noticing that a message I sent off this morning at 9 had |not gone out as of late this afternoon, I looked to see if other messages |I've sent off have gone out. I found that a message I sent out last night, |23 hours ago, has not arrived at my site, nor have I seen any followups by |others to it. So I am sending it again. I will go back through my messages |and look for other such non-sends. I suggest others do the same. I don't |know what the problem is, but it's worse in this respect than the problems |with toad.com.] | Tim: Last Thursday night I got word of Perry's shut down from the PGP Users List; I had not seen it posted during the day so I forwarded it to the cypherpunks list. It showed up at my location 5 minutes ago. I have the consolation of knowing mine was not the only one delayed. I seem to have noticed messages being repeated this afternoon. Alec -----BEGIN PGP SIGNATURE----- Version: 4.5 iQCVAgUBMzNAMiKJGkNBIH7lAQFDEQQAj1RSJBtJ+vNv/iwPFTTcs6RNBpqq93tN H0j3toYnuFwuAThR5uI4qyuCto0dVhygl17cgZpLjo85CXDLe3SswN05fTZvhKCB 5E2Doq5OHo01S9cOzUigr6Q5oRR/ZEqGUTZSJmKzw1l0NzA+hDLvs+/zK4wb8yiX Zb//53oBjIg= =INC3 -----END PGP SIGNATURE-----

2 1

Re: Market Failures, Monocultures, and Dead Kids (Oh My!)
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

BELIEVE the children! Vulis wrote: > Out in the hobbsian wild, if the parents abuse their offsprings (kill them, > fail to train them), then the offsprings won't reproduce and the parent's > genes won't perpetuate. Do we really need a more coersive system of > punishing "child abuse"? We don't (yet) live in the "hobbsian wild". Children do what they are taught. If the are taught to react to the slightest provocation with violence, then they will, when they grow up (notice I didn't say mature), react similarly. If we wish to live in a society of reasonable people, our children need to be raised respond reasonably to provocation. This means get violent when, and only when necessary. So, yes. I would say we need a fairly coersive system for punishing child abuse. We also need a clear defination of what child abuse really is. BELIEVE the children!

1 0

Re: "why privacy" revisited
by Wei Dai 17 Dec '03

17 Dec '03

On Fri, 21 Mar 1997, Timothy C. May wrote: > The best arguments are not those couched in terms of "benefits" to > society/markets, but in terms of "lowest common denominators." I favor the > "Schelling point" view, and have espoused it here often. > > In most Western systems, a reasonable Schelling point is that various > actors agree not to try to enter the "private spaces" of others. For > example, my neighbors and I agree not to enter each other's houses to pry > and inspect. > > (The Schelling point is that this "boundary" point is essentially agreed > upon even though my neighbors and I have never formally negotiated it...as > with animals and their "territories," certain equilibrium points are > reached.) > > In Western systems, it is recognized that the _costs_ of coercively > entering another's home and/or private space are too high, and so we > declare there to be a "right of privacy." In reality, what we mean is that > we accept a private domain as a Schelling point. I think you're answering the third meaning of "why privacy", "why DOES privacy exist?" This is a positive rather than a normative question (which is what I was asking). I agree with you that most likely privacy exist because in some sense it is an equilibrium in the game of life. But what I'm asking is whether it is a desirable equilibrium, and whether a new equilibrium involving more privacy is better than what we have now. > I reject the argument Wei Dai mentions, that market benefits could obtain > if society rejected privacy, for two reason. First, because in an important > sense rights are not the slaves of corporate or personal business > interests. (E.g., my interest in Alice's television viewing habits does not > trump her right to keep me out of her house.). Second, because so-called > "market efficiency" is largely an illusion anyway. Certainly no real market is perfectly efficient, but some markets are relativly more efficient than others, and most markets are more efficient than alternative forms of economic organization (e.g., socialism) so I don't see how you can call "market efficiency" an illusion. The inefficiencies I was talking about were relative to the case where both parties have the same information. Also, I don't quite understand your first argument. It seems to suggest that privacy should exist for no reason in particular. If this is the case then it doesn't make sense to argue about the costs/benefits of privacy. But it is my understanding that most cypherpunks believe more privacy benefits everyone, and therefore work to making more privacy for everyone. What I'm looking for are arguments that support this belief.

4 3

Re: Report from Supreme Court on CDA arguments
by Toto 17 Dec '03

17 Dec '03

Timothy C. May wrote: > Nothing I have seen in the interpretations of the CDA would "excuse" me > from saying "Fuck" (or worse) in a forum if I knew readers under 18 might > see it. (Some of the pro-CDA folks talk about possible exceptions for, say, > two 17-year-olds discussing sexual problems between themselves). > > This was the main reason I did "Tim's Vernacular Translation of the Bible" > as an alternate .sig. (Included below, by the way.) > -- > [This Bible excerpt awaiting review under the U.S. Communications Decency > Act of 1996] > And then Lot said, "I have some mighty fine young virgin daughters. Why > don't you boys just come on in and fuck them right here in my house - I'll > just watch!"....Later, up in the mountains, the younger daughter said: > "Dad's getting old. I say we should fuck him before he's too old to fuck." > So the two daughters got him drunk and screwed him all that night. Sure > enough, Dad got them pregnant, and had an incestuous bastard son....Onan > really hated the idea of doing his brother's wife and getting her pregnant > while his brother got all the credit, so he pulled out before he > came....Remember, it's not a good idea to have sex with your sister, your > brother, your parents, your pet dog, or the farm animals, unless of course > God tells you to. [excerpts from the Old Testament, Modern Vernacular > Translation, TCM, 1996] Perhaps this sig could be used in all replies to government agencies in regard to CDA and other censorship matters. Is it in the public domain? -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: FBI Visits JPUNIX
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

jim bell wrote: > > At 10:35 PM 3/20/97 -0500, John Perry wrote: > > Apparently some high-ranking > >official has been receiving anonymous email coming from my site that > >is of a threatening nature. This official has decided to call in the > >FBI as I was visited by said organization. I am shutting down remailer > >operations immediately. > I think you should name the "high-ranking official" involved. If there actually is one. > We (and you) might also point out that as far as you know, these threatening > notes could have been send by GOVERNMENT people, in an attempt to shut down > the system. Perhaps there was no threatening note. Perhaps there was no visit from the FBI. The attempt to destroy the cypherpunks list failed. The next logical target would be the remailers. Two remailers go down in the same week, both being tenacles of C2Net. Greg Broiles once again happens upon the scene of the accident, and predictably warns everyone of the grave dangers and liabilities facing remailer operators. How long until he publicly calls for the remailers to be "killed," as he did with the cypherpunks list? Instead of solutions to the problems facing small remailers, we have schills coming out of the woodwork to proclaim that remailers are only feasible for Big Business to operate. Corporate takeover of the list failed, now corporate takeover of the remailers seems to be the new agenda. I suggest that, instead of wasting time on a new battle, we simply resurrect all of the arguments over list control and re-post them as arguments over remailer control, simply substituting the word "remailer" everywhere that the word "list" occurs. Truthmonger Cindy ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4 3

Re: LA Times article on crypto anarchy
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Hal Finney wrote: > "'Activity in cyberspace ultimately forecasts the end of national > control,' said David Post, visiting associate professor of law at > Georgetown University." > The article goes on to mention digital cash, crypto policy debates, > problems with the CDA, Germany's attempt to block access to Radikal > magazine and anti holocast info on the net, and other topics which we > have discussed at length. It is good to see these ideas beginning to > enter the mainstream. > This is what this list and this movement is capable of. A lot of > these ideas would not have received their prominence if it were not > for the cypherpunks. And of course there are powerful forces arranged > in opposition. Of course, those who attempt to point toward those powerful forces will be be subjected to ridicule as paranoid conspiracy theorists. And when they point out the facts concerning the underlying alliances and motivations behind various actors on the list, then they will be met with rebuttals that so-and-so had a beer with them, once, and they seemed like a nice person. Big news flash! Nazi's attend the opera and kiss babies. Money buys people (even those who deny it to themselves). I wish I had a dime for every post I've seen on this list that denigrates those that suggest that the list is both followed by, and subjected to interference by, clandestine agencies and agents. "What? Our 'How to build a Nuclear bomb' list is being subjected to surveillance? How silly!" Buy a clue, dudes and dudettes. Cryptography is the new Nuclear technology of the Information Age. Big Brother is paying attention. > How easy they find it to distract us, to fill the list > with irrelevant discussions! When I see so many posts which are purely > flame bait, or which seem to go out of their way to explore trivia as > though it were of interest, I believe that in at least some cases they > are intentionally designed to thwart our efforts. Most people who recognize this still fail to see the 'thwarting' that takes place by those whose sole purpose is to spread disinformation while seeming to agree with the consensus opinion on the list. The subtle slants which are a constant undercurrent in their posts are seldom seen as an attempt to undermine the issues they appear to be supporting. > I'm not calling for censorship, but I'd like people to be aware of what > is going on. Before responding to an off-topic or flaming post, consider > the motivations of the creators of the thread. Is it possible that this > is purely an attempt to fill the list with noise, to drown out discussion > on more important and relevant topics? In some cases, undoubtedly, but anyone who thinks that the flames and off-topic posts are the enemy on this list are _not_ aware of what is going on. Noise will deflect idiots and lightweights from following the crucial issues surrounding cryptography, but this in no great loss. The true loss to the list is when the supposedly intelligent members lose the capacity to distinguish critical points raised on the list because they have allowed themselves to fall into the same personality based mode of censorship as was forcefully imposed on the list. Look at the number of people on the list who _boast_ about their killfiles. They are idiots. Even those who profess to use their filters as an information tool seem to base their filtering on personality, to a large degree. The result? They are filtering _into_ view those the disinformation artists who will lick their dick in order to lead them away from areas they don't want to receive too much attention. The result of the sheep mentality of cliques who killfile each other is that if a list member wants to raise an issue outside of his or her own _clan_ on the list, then they must make NOISE sufficient to draw in the members of other clans, whose other members will read their replies. Your post might waken a few of the converted to remind them that it takes an effort to stay on track, but if you had found a way to work the word "cocksucker" into the list, you would have reached a wider audience, and perhaps done some good where it will be more effective. (Or, better yet, badmouth the list Icons.) The fact of the matter is, spotting spooks and schills on this list is a minor matter of the simplest of traffic analysis, given the fact that so many list members are content to focus their attention only on the _visible_ enemies that those who use deceit and deception have to make little effort to cover their tracks. > Simply being aware of the attack will, I suggest, go a long way towards > reducing its impact. I think that all list members would be well-advised to read your post and give it serious thought. I think, however, that they should also make an attempt to broaden the concepts you deal with, in their own mind, in order to adjust their view as to the true nature of the traffic on this list really is. TruthMonger

2 1

Re: Cypherpunks & Ecash in WSJ, Chaum,and Amazing Revelation by NSA
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Hal Finney <hal(a)rain.org> writes: ... > In my travels around the web, I find that First Virtual is being > relatively successful for small amounts like shareware fees. It is > easy to get started with FV; you fill out their web page and make a call > to their 800 number with your credit card info. You're ready to go in > a few minutes. I'm sure there are a lot more people buying things with > FV than with Digicash. ... I just had an idea for an interesting demo project. Perhaps someone wants to take it up and to put a spin on it to promote privacy/cryptography. Most (perhaps all) states' motor vehicle departments allow you to connect to their computer (usually via a modem) and map licence plate numbers into names/addresses. Typically you must first set up an account and pay, e.g., $200, and then something like $4 is deducted from the account for each query. Obviously, only someone who performs a lot of queries (like a p.i. or a lawyer) would set up an account. It occurred to me that it might be "interesting" for someone to set up accounts with all the states that have this service; and to establish a Web site that would do quantity 1 queries for a reasonable fee, like $FV10. I recall that someone got hold of the Washington State database and operated such a service for free for a few days as a demo. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: More disinfo from Cocksucker John Gilmore
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

paul(a)fatmans.demon.co.uk writes: > > >no longer trusted Gilmore to > >host the list. > > > > On the planet I live on, the list moved because Gilmore was no longer > > willing to host the list > > On the other hand the majority of the list members, including myself, > would say that the reason the list moved was because of the > censorship imposed by statist cocksucker Gilmore. > > The list rapidly disentigrated into infighting and flame wars as soon > as the censorship was announced, several people suggested new list > solutions before Gilmore anounced he was closing the list, I remember > talking in private email with Igor and several others about the > distributed mailing list solution immediately the censorship was > announced. > > > Question: > > > > Is this true dissinformation or does this scumbag Russian sociopath > > believe his own lies? > > Question: > > 1. Is this bot generated or does "Casey Iverson" really exist? - I > would say he is a real person due to the level of context sesitivity and > quoting in his posts, however, it is beyond my comprehension that > anyone could be this inane... Unfortunately, New York City is the home to several people who in a more restrictive society would have been committed - Case Iverson, Ray Arachelian, the lying crackpot Charles Platt from alt.torture... > 2. If "Casey" does exist does he suck John Gilmore`s cock or is he > more of a Sandfort man? Neither Gilmore nor Sandfart have cocks long enough to reach from California... But Iverson may be sucking Arachelian's cock. > 3. Could the level of stupidity in his posts be easily emulated by a perl > script or would this require more complicated code including inducing > gramatical errors, anti Russian rants and turns of phrase that simply > fail to scan right in the context in which they are generated? With difficulty. A program's output would likely sound more intelligent. > 4. Is there a low bandwidth stego channel hidden in his rants, with > the data transmitted as integers giving the apparent IQ of the writer > for each message? Yes, but it's a very low bandwidth channel capable of transmitting single digits only. > 5. If he does exist and is sentient is he an NSA schill wasting our > time and effort to stop us doing crypto? A very good point, Paul. You may have noticed that Cocksucker John Gilmore spreads lies and disinformation, he makes up hard numbers which can be proven to be false - but it would require an effort that could be used more productively e.g. on setting up more remailers. Consider several of Cocksucker John Gilmore's recent claims made through his subservient mouthpiece Rich Graves. In article <5gl63i$4eu(a)quixote.stanford.edu> Cocksucker John Gilmore wrote: >comparing me to Vulis doesn't work, I don't think. He'd have >mailbombed the list subscribers at the drop of a hat; and in >the case of cypherpunks, he and GruBoursy did, to such an >extent that the list had to move from toad.com to cyberpass.net. >I'm sure I've disappointed some people by doing nothing of the >kind. Doesn't stop Seth from saying I'm obsessed, of course. This is a lie. I haven't mailbombed cypherpunks. There were several mail loops during the list's existance on toad.com, none of which were caused by me. The list moved because of Gilmore's censorship, which Graves forgets to mention at all. list. In article <5gkfag$36o(a)quixote.stanford.edu> Cocksucker John Gilmore/Graves further wrote: >>In any case, I personally would not ever absolutely reject posts >>arbitrarily from someone if I was moderating a list, even if 99.9% of >>their posts were absolute junk. (I've been in such situations---try >>moderating an biological evolution newsgroup and fend of all the >>creationists.) > >You've never met Dr. Vulis, then. Imagine 50 messages a day like this: > >http://infinity.nus.sg/cypherpunks/dir.archive-96.10.24-96.10.30/ > >|Timmy May has tons of dandruff (and dried up semen) in his beard. >|Is he Jewish??? >| >|--- >| >|Dr.Dimitri Vulis KOTM >|Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps The cypherpunks mailing list is archived at several sites. As I pointed out, it's possible to search the archives and to verify that in the several years that I've been on this list, there was not a single day when I posted 50 articles; not a single day when I posted even 15 articles; and probably less than 10 days when I posted more than 5 articles. Cocksucker John Gilmore is lying again. In the same article Gilmore/Graves wrote: >Vulis also posted megabytes of Serdar Argic screeds, just to be annoying, >and with the stated intention of disrupting the list. That's called a >denial of service attack. More lies. I have repeatedly stated that it is NOT my intention to disrupt the mailing list. The total size of the Serdar Argic material is under 200K. I'd be surprised if the total size of my contributions to cypherpunks over the years adds up to more than a couple of megabytes. But of course we know that Cocksucker John Gilmore is a pathological liar, so we can do something more useful than digging through the archives. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1

Re: For-pay remailers (was: PGP Security)
by Toto 17 Dec '03

17 Dec '03

Hal Finney wrote: > Rather than try to design or envision a grand infrastructure with > everything working perfectly like a smoothly running machine, let's wait > and see how for-pay remailers fare once they appear. There's nothing > like the profit motive to unlease creativity. I'm sure methods for > providing high quality service can be found. That sounds much better than "Let's sit on our asses and see if the for-pay remailers fare, _if_ they ever appear, while the attacks continue knock off more remailers." One of the main reasons the CypherPunks list continued as it did was because of those who actively made plans for its continuance, instead of sitting on their asses. Are you and Greg working as a team, here? -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: Crypto Info War
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

John Young wrote: > > Congressional Record: March 19, 1997: > > The Senate > > ***** > > DOD AUTHORIZATION--INFORMATION WARFARE [5] > Committee on National Security: Subcommittee on Military Procurement > and Subcommittee on Military Research and Development held a joint > hearing on fiscal year 1998 Department of Defense authorization > request--Information Warfare. Testimony was heard from the following > officials of the Department of Defense: > Vice Adm. Arther K. > Cebrowski, USN, Director, Navy Space, Information Warfare, Command and ^^^ ^^^^^^^^^^^^^^^^^^^ > Control, Chief of Naval Operations; ^^^^^^^^^^^^^^^^^^^^^^^^^ > and Marvin Langston, Deputy Assistant Secretary, > Navy C41/Electronic Warfare/Space Programs, Office of the Assistant ^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^ > Secretary of the Navy (Research, Development and Acquisition); ^^^^^^^^^^^^^^^^^^^^^ Who was it who funded the development of RSA? Can you say "Navy?" Sure, you can. TruthMonger

2 1

Security of SSL proxies
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

A number of vendors are now selling SSL proxies which implement secure tunnelling for web browsers using a non-crippled SSL implementation running on the client machine. Has anyone considered the total security level provided by one of these systems? I can see three problems with this approach: 1. The security stops a few feet short of the browser, making a MITM attack possible (see below). 2. Security and authentication is handled by the proxy and not the browser. This means that the browser (and browser user) never get to see the usual indicators that their connection is secure (or "secure" for non-US users). 3. If you use a proxy like this to protect traffic for an entire company, the proxy provides the same type of target as a GAK key center: An attack which compromises this compromises security for the entire company. The first one is a practical problem, the second one is more perceptual. Consider the following possible attack: A nice authenticoded ActiveX control ("the tee proxy") installs itself on your machine and hooks itself into the chain of proxies by either moving the SSL proxy to a different port or changing the browser config entry so it's the first proxy in the chain. It then scans all data being forwarded for credit card numbers/PINs/whatever and forwards them to God knows where. There are various simple defences (eg the SSL proxy checks to make sure the browser still goes to it first), but in the end it's just a cat and mouse game - the tee proxy could spoof the registry calls (there was an article in DDJ which explains how to do this), or disable the check, or hook directly into the proxy service by patching the DLL (this was explained in MSJ I think). In short, because the security stops a few feet short, it's possible to attack the system. A related problem is that fact that the browser isn't aware that a layer of security is being applied to the connection, and so will act as if the connection was insecure (ie it won't display the usual signs that the link is secured, and will give annoying warnings when navigating secure web sites). Finally, pulling personal certs into/through the proxy is rather complex, requiring the cooperation of the CA in issuing specific types of certs (one browser-specific one for the browser and an identical-content but proxy-specific one for the proxy), and all sorts of complex juggling by the user to install them. This probably makes the use of certs in this environment fairly luser-proof, which more or less means no certs. Are there any other problems which people are aware of? There was a bit of a fuss made about these proxies being the end of ITAR when they were first announced, but since then things seem to have gone quiet. Peter.

1 0