December 2003 - cypherpunks-legacy

Re: Defeating fingerprints
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"sinclai(a)ecf.toronto.edu" "SINCLAIR DOUGLAS N" 18-MAY-1996 04:15:33.26 >Not that random playing with carcinogenic chemicals is a good idea, but... >I've found that if you use just one reagent from epoxy glue, the collagen >in your skin will disolve. You can sculpt it into whatever shape you want, >and it will stay that way for an hour or so. I don't remember if it was >the resin or the hardener though. This was regular 5 minute epoxy. I somehow doubt that the collagen is dissolving. You may be loosening the keratinized dead skin cells and pushing them around, and then they flake off in some length of time (probably speeded up by this treatment). Any signs of redness, etcetera in the skin afterwards? Unusual sensitivity of the fingertips, especially to pain? One thing to keep in mind is that fingerprints aren't just from the whorl pattern that you see. They're also from that the sebaceous (oil) glands in the skin are arranged along those whorls. You need a pretty resistant barrier to stop these. I've been told by the son of a cop that the combination of a pair of latex gloves with a couple layers of cotton gloves stops both the oils and the normal pressure patterns. -Allen

1 0

Re: Rumor: DSS Broken?
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:05 PM 5/19/96 -0800, Jim Bell wrote: >It should occur to all of us that if the NSA was actually doing the job we >are vastly over-paying them to do, it is THEY who should be finding, >exposing, and correcting these kinds of cryptography faults. They may have; they're just kind of selective in who they expose them to :-) Also, there are expert cryptographers outside the NSA, and outside the US; you might check where Dobbertin lives. And this is a Good Thing. >Another question: If the government provided DSS, and it's now toast, SHA-1 isn't toast; it's MD5 that might be at least a bit crunchy. (The NSA gave us SHA, and later added a correction that appears to make it stronger, unless there's something really subtle and nasty inside.) DSS isn't toast either, though the subliminal-channel stuff makes it necessary to look very carefully at any applications to find out what else is being done with them, which you can't always do. One of the purposes of DSS appears to be that it provides signatures without providing encryption, so the Feds can trust the Public to have it. Except of course that subliminal channels _do_ toast that part of it. On the other hand, NIST has been saying that DSS isn't covered by any patents, which the PKP folks had some very negative, skeptical comments about, before PKP fell apart; it probably still is covered by the Cylink/Stanford patents until they expire next year, though it's not covered by RSA. The patent licensing hassles probably have kept a lot of people from using it, except for specific sales to the government. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: SEVERE undercapacity, we need more remailer servers FAST
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"llurch(a)networking.stanford.edu" "Rich Graves" 18-MAY-1996 09:07:35.05 >On Thu, 16 May 1996, Bill Stewart wrote: >> ================================================================== >> This message was posted from the anonymous remailer at www.jim.com. >> Send any complaints to webmaster(a)www.jim.com . >> Please don't post any copyrighted material longer than fair use quotations. >> And did you know that Scientology's highly overpriced documents say that >> "<random paragraph quotation>" >> =================================================================== >Once I was more or less done laughing and got off the floor, it occurred >to me that this could provide a revenue stream for anonymous remailers. >You'd charge advertisers sub-pennies for these little trailers. I >understand that Sameer is getting very little Ecash for his >remail/by-www.html, but maybe if he sold advertising space? It's an interesting idea. One wonders if EFF would be interested in such a sponsorship? One could even add, say, an ACLU promotion to the end of messages without getting cash from the ACLU - this might encourage them to give more backing in case of a legal dispute. (You scratch my back, I scratch yours... I'm not meaning to be offensive to the ACLU, BTW.) -Allen

1 0

Re: Sendmail Question (was: SMTP Server for sending to anonymous remailers?)
by John Deters 17 Dec '03

17 Dec '03

At 12:42 PM 5/19/96 -0400, you wrote: >At 12:09 AM 5/19/96 -0700, you wrote: >>If you use popmail (like Eudora), then just tell it the server to use in >>"SMTP Host". >> -Lance >I have been following this with no little interest. Using Eudora Pro when I >attempt to replace host: smtp1.abraxis.com with *SMTP Host*, I receive the >message *Attempting to resolve host: SMTP Host*, and dat's all until I stop >the send command. > >Thanks > >Alec Alec, What he meant was that you should replace the contents of the SMTP server's field with the address of the first remailer in your chain. For example, if I wanted to send this through the Holy Cow remailer, I'd put this in the SMTP server field: haystack(a)holy.cow.net Remember, though, that several things OUT OF YOUR CONTROL have to happen for your mail to be anonymised successfully. First, if you are behind a "firewall" (i.e. doing this at work through your work's net connection) your firewall may be implementing what is known as a "proxy." That means even though you're using the SMTP protocol, you may not be *directly* talking to the SMTP client of the remailer. It may "look" like you're able to SMTP out to whoever you want to send mail, but in reality, the firewall can intercept your request, and "pretend" to be some other SMTP server. It then accepts your outgoing mail, and forwards it to the real destination. Abraxis sells firewalls. Also, your firewall may be configured to not pass SMTP out at all, but rather to require you to send any SMTP traffic directly to it. That means you can not change your SMTP server to anything outside of your local net. In either case, firewalls are certainly capable (and employers within their rights, but that's another useless thread) to log and/or read your mail. Anonymity lost, at least to your employer. Finally, the anonymous remailer may (or may not) have some kind of logging turned on. I don't know why they would (what's the value if they do) but if some law enforcement agency orders them to discreetly monitor traffic, you lose again. Unless you PGP encrypt your mail to the remailers before it leaves your machine for the big bad net, someone else can read it. And, no matter what, persons unknown can tell that your machine sent some message to the remailer. (This is known as "traffic analysis".) Therefore, I'd *highly* recommend not e-mailing anything illegal over the net, remailer or no. -j, annoying, yes. Illegal or harassing, no. -- J. Deters >From Senator C. Burns' Pro-CODE bill, which I support and you can find at: http://www.senate.gov/member/mt/burns/general/billtext.htm " (2) Miniaturization, disturbed computing, and reduced transmission costs make communication via electronic networks a reality." +---------------------------------------------------------+ | NET: jad(a)dsddhc.com (work) jad(a)pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'33"N by 93^16'42"W Elev. ~=290m (work) | | PGP Key ID: 768 / 15FFA875 | +---------------------------------------------------------+

1 0

Re: Is Chaum's System Traceable or Untraceable?
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:10 AM 5/19/96 -0400, Simon Spero wrote: >> > (On the other hand, I have had a longstanding faith that the system can be >> > made to be both payer- and payee-anonymous. Moneychangers, for example.) .. >This scheme can't be used with the ecash API, and I believe is not looked >on kindly when applying for ecash licences. It makes you a lot more >vulnerable to traffic analysis There are at least two reasons for wanting payee anonymity - general privacy - criminal activities, e.g. ransom, where payee doesn't trust payer. In the latter case, the facts that collaboration is required, special software is needed, and licenses are violated are not really a problem - the Bad Guy can give the payer the code along with the ransom note, and doesn't care about the license. Traffic analysis is a concern, but you're probably not going to collect ransom from the same person on a regular basis, and for blackmail, you can keep changing the payment address, and you're a bit less worried about the payer's location being noticed than if you were collaborating in something like tax evasion. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: SEVERE undercapacity, we need more remailer servers FAST
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

What countries are noticeable for being anti-Scientology? They would appear to be good locations for special-purpose remailer ultimate-output ends. -Allen

2 2

5 MINUTE CYPHERPUNKS SURVEY
by Sally D. McMillan 17 Dec '03

17 Dec '03

Hi! Im writing a paper for school on E-commerce and would like to include a brief section on the role of Cypherpunks in E-commerce. If you would, please email me your responses to the following questions. Some of these questions are broad, but please limit your response to each question to 0-100 words. Also, I am NOT attempting to stereotype the Cypherpunks, but am instead interested to learn whether there is a shared view among them. THANKS! PS- PLEASE RESPOND TO MY EMAIL DIRECTLY by FRIDAY, 5/24/96 : 103007.3426(a)compuserve.com 1. Would you call yourself a Cypherpunk? (Y, N, Not Sure) 2. What is the role of Cypherpunks in the DEVELOPMENT of secure E-commerce transactions? 3. What is the role of Cypherpunks in the MAINTENANCE of secure E-commerce transactions? 4. Why do Cypherpunks care about E-commerce? (Please limit to 100 words or fewer.) 5. What is a punk? What is a Cypherpunk? Can you distinguish between those who are up to no good, trying to crack security and those who try to crack security in order to maintain it? Do Cypherpunks, in your opinion, fall into either category? 6. What is the greatest security threat to E-commerce transactions? 7. On a scale of 1-10, how dangerous is it to give your credit card number to a vendor over the internet? (Please provide one number only for this answer.) 8. On a scale of 1-10, how would you rank your own knowledge of E-commerce and related security issues? (Please provide one number only for this answer.) May I quote part of or all of your answers in my paper? Would you like to be referenced by name, email address, or as Anonymous? Please provide pertinent details. THANK YOU FOR FILLING OUT THIS QUESTIONNAIRE! Please forward your responses to me at: 103007.3426(a)compuserve.com

1 0

Re: New Remailer (hidden)
by Bill Stewart 17 Dec '03

17 Dec '03

Cool. I've got a test message going now. Does your remailer accept PGP-encrypted email? It's really critical for high-security applications, at least for first remailer hops, but your key's not on the MIT keyserver. BTW, how do we know you're not a plant? :-) Aside from having an interesting nym, you've probably got the first remailer that makes it difficult to tell who's running it. You could be Sameer, or you could be Louis Freeh, but we don't know. At least folks like Xenon were known to be real people.... Even if you _are_ a plant, of course, we can still use your system, but I'd want to do encrypted email through other remailers on one end or the other. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: anonymous companies
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"unicorn(a)schloss.li" "Black Unicorn" 18-MAY-1996 11:16:57.48 > At 06:42 PM 5/16/96 -0700, Wei Dai wrote: > > Solution: smart contracts. This is Nick Szabo's idea of building > > contractual obligations into cryptographic protocols so that the parties > > have no choice but to fullfil them. But again we don't know whether this > > will actually work for this problem. >But what happens when there are nuances or circumstances which contracts >do not anticipate? This "complete" reliablity is also a curse for >flexibility which fast moving entities need to survive. That's an argument for combining them with escrow agencies. If the escrow agency is less likely to need to intervene, then they'll charge less... the principle of insurance company risk estimation. -Allen

2 2

Re: Why does the state still stand:
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"jimbell(a)pacifier.com" "jim bell" 18-MAY-1996 02:54:47.09 >On the other hand, the government also has enormous "obligations" that keep >it close to bankruptcy. It wouldn't take a great deal of interference in >its ability to collect taxes to put it solidly in the red based on current >receipts. And remember, if the individuals who populate government could be >persuaded that their tenure would be forcibly shortened if they didn't >resign, they wouldn't stick around. Once that cohesiveness of jointly >sucking on the government tit is eliminated, I think they'll cut and run. >These people are working for a fat paycheck and the promise of a retirement >package, and it wouldn't take much convincing to show them that they won't >get either for very long. I'm convinced that's why so many Senators and While quite a lot of people in the government are working just for the paycheck, there are also some idealists - and some who are working for a "power paycheck" rather than a "cash paycheck." I'm willing to bet that that's the case with the NSA and its _general_ opposition to cryptography. You'll have three basic groups: A. Those who are idealists. This can be divided into two categories. 1. Those who idealize the power of government, such as via a devotion to democracy. These oppose cryptography because it weakens the government. 2. Those who are primarily interested in protecting America from everyone else. These promote cryptography, and need to be supported. 3. Those who (stupidly) believe in the US government enough to "just follow orders," as the Nuremberg phrase goes. If you can get the type 2 idealists in power, these will do the right thing. B. Those who want power. These oppose cryptography because they will lose power if it is widely implemented. C. Those who are just there to get a paycheck. These will act in most situations about like an idealist of type 3, but when push comes to shove won't be willing to back it up seriously. I'd appreciate feedback from anyone who's dealt with the intelligence community more than I have (not particularly difficult) to confirm or deny the above classification system, and give some idea as to the proportions within the NSA, government in general, etcetera. -Allen

1 0

Edited Edupage, 16 May 1996
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)elanor.oit.unc.edu" 16-MAY-1996 23:29:38.03 >AOL TEAMS UP FOR E-COMMERCE >America Online has cut deals to license encryption, digital signature, and >electronic transaction and funds transfer technologies from a variety of >companies, including CyberCash, IBM infoMarket, RSA Data Security, Terisa >Systems and VeriSign. "These new relationships will provide the building >blocks for a secure electronic commerce platform," says AOL's VP of product >marketing. The online service plans to integrate the electronic commerce >technologies into both its online service and its Global Network Navigator >Internet access service. (Investor's Business Daily 16 May 96 A9) Well, at least they're making moves to get cryptography to the AOL masses.... although somehow I suspect that they'll roll over and play dead for any and all GAK pressure, and won't use any variety of truly anonymous digital cash. >ATTEMPT TO BLOCK USE OF CANADIAN SATELLITES >MCI Communications, AT&T and EchoStar Satellite all have filed additional >complaints this week with the FCC about proposals made by rivals >Tele-Communications Inc. and TelQuest Ventures that cite Ottawa's refusal to >allow American companies to beam their programs into the United States as >cause for the FCC to deny the application. (Toronto Financial Post 16 May 96 >p3) An ex-FCC official says the American regulator is unlikely to approve >the use of four Canadian satellites by US-based TelQuest Ventures and >Tele-Communications Inc. to beam signals to the American market unless >Canada's market is opened up to U.S. services. (Montreal Gazette 15 May 96 G3) One wonders what the FCC would do if they weren't US-based companies, and if it weren't from satellites from such an interlocked-with-the-US country as Canada. -Allen >Edupage is written by John Gehl (gehl(a)educom.edu) & Suzanne Douglas >(douglas(a)educom.edu) Voice: 404-371-1853, Fax: 404-371-8057. >*************************************************************** >Edupage ... is what you've just finished reading. To subscribe to Edupage: >send mail to: listproc(a)educom.unc.edu with the message: subscribe edupage >Jack Kerouac (if your name is Jack Kerouac; otherwise, substitute your own >name). ... To cancel, send a message to: listproc(a)educom.unc.edu with the >message: unsubscribe edupage. (If you have subscription problems, send >mail to educom(a)educom.unc.edu.)

1 0

(Fwd) Re: TCM: mafia as a paradigm for cyberspace
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Sorry Vlad Z. Nuri, but this message was intended for Cypherpunks, to be cc'd to you. Unfortunately, I wrongly addressed it. To CPunks: the reply that should have hit CPunks: ============================================================ To: jf_avon(a)citenet.net Subject: Re: TCM: mafia as a paradigm for cyberspace Date sent: Sun, 19 May 96 19:52:45 -0700 From: "Vladimir Z. Nuri" <vznuri(a)netcom.com> there is no ethical basis for killing. please kindly keep your trash out of my mailbox I've evaluated all sides of the story, and am not influenced by corrupt machiavellianism ============================================================= -------Original Message Follows ------- From: Self <Single-user mode> To: "Vladimir Z. Nuri" <vznuri(a)netcom.com> Subject: Re: TCM: mafia as a paradigm for cyberspace Reply-to: jf_avon(a)citenet.net Date: Sun, 19 May 1996 01:59:00 On 18 May 96 at 12:43, Vladimir Z. Nuri wrote: > maybe talk to Jim Bell some more. perhaps > eventually you will perfect the method of perpetrating the perfect > killing!! I really do admire you, because killing people without > getting caught is surely a great unrecognized art, and one of the > most unappreciated and misunderstood. something that has only been a > dream to the blighted wretches prior to our glorious new phases of > cyberspatial technology, which makes human morality completely > obsolete. I think that you are writing way out of context. First, wether or not the AP scheme is used for the control of government, as Jim Bell pushes it, does not mean that it will not be implemented for other purposes, such as killing successful businessman or your neighboor's son who is screwing your wife (noticed that she smiles all the time since a while? ) . Second, everybody like Jim Bell who is pushing the AP scheme is doing so on ethical basis: that the coercion the government imposes on to the individuals by regulations, and guns backed taxation justifies the killings. I have to see yet any cypherpunks who seems to agree with AP that envision another use than govt control. Third, you will notice that even Jim Bell discusses issues of anonymous transactions and businesses that, if conducted properly, makes the AP scheme irrelevant. So, it seems that AP is only a tool instead of being an end in itself. Fourth, you lack some basic psychological insight: intrinsic murderers do enjoy the knowledge of the details of their actions and the derived perception of power. AP prevents that by anonymising everything: a donator cannot know if he caused the death of somebody (unless he spends several tens of grands himself, but then, there are other, more satisfying ways for a power seeker to fullfill his passions...) . You seems to oppose the proposed violence entailed by AP but you positively blank out what everybody who reflected on AP put in the opposite pan of the balance, i.e. the ethical standards of contemporary govt actions. And you'll also note that the anonymity issue generate more interest from more CPunks because it (hopefully) will acheive the same goal without any killing. Until you accept to evaluate both side of the story, your recriminations opinions are as evident as the magnetic monopole... jfa DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal JFA Technologies, R&D consultants; physists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

5 6

Re: SEVERE undercapacity, we need more remailers
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

It occurs to me that a certain number of companies have schemes that could easily be used to set up anonymous, transient mailing output ends on anonymous remailers. These are AOL (with its famed lack of true credit card verification) and free email services such as Juno. The idea would be to have a remailer address that took in mailings, then sent any that were to go other than to another remailer via a temporary account. Now, this would have the potential problem of decreasing remailer reputation among those in such companies; for AOL, it would also decrease the chance of anyone paying attention to the remailed messages (people deleting stuff from @aol.com automatically, etcetera). -Allen

1 0

Re: Senator Leahy, your public key please?
by Bill Stewart 17 Dec '03

17 Dec '03

Senator Leahy is the first member of Congress to publicize a PGP key. (There are already fake keys for Bill and Hillary Clinton and Al Gore.) A Washington-area Cypherpunk recently visited Senator Leahy's office and asked if he could verify that the PGP key posted to the net for Senator Leahy was correct*, so he could sign it; while it would be difficult to fake responses to the "PGP Public Key" entry on his web page, it could be done, and a fake key could be publicized in other ways. He was told that there's some Congressional silliness about the issue - what's the political implication of having someone sign your key? Postmaster(a)senate.gov is fine, but are there ethics questions if ACT UP, Big Oil or the Christian Coalition signs it, or if Newt Gingrich or your party's Majority Leader refuses to sign it - are those endorsements? Tim May pointed out that you don't _need_ anybody's permission to sign their key; just do it and send to the keyserver. Even if they don't like you. >What if, for example, Sen. Leahy _did_ end up in the web of trust for Aryan >Nation? Even if he never intended it, this could have some severe PR >repercussions. >An exciting new world we're entering. It's really hard to get handed a straight line like this and have to pass it up, but I'm _not_ going to create an Aryan Nations key, and I'm _not_ going to send it to keyserver(a)canopener.worms.mit.edu. Black Unicorn's experience at Senator Leahy's office implies there are too many clueless Congresscritters around who would recognize the political potential and make a Law to Do Something about it, just as Georgia recently made a law against making links to people's web sites without their permission. While the Republicans in Congress, having somehow found themselves on the side of Free Speech with Leahy against Clinton's administration, may be able to pass laws reducing the government's encryption-export and wiretapping efforts, a good scare like this could make it more difficult. Sigh. :-) I haven't Cc:d this to Leahy - Should I? Meanwhile, what should we do about PGP key signatures? PGP 3.x is still being developed, and keyservers can be updates as needed. While I agree that keyservers don't need to validate keys - that's a job for the web of trust, and the keyserver-admin could sign keys if he/she/it wanted to - it may make sense for the keyservers to only accept keys in messages signed by the key itself. (Just signing the key doesn't help much here; you need to sign the key-plus-signatures.) Does it make sense to include some similar capability in PGP itself? Leahy has at least signed his own key... # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: Instant Remailers
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

Someone said: > >It is possible for someone to operate an anonymous remailer anonymously. > >Just get a UNIX shell account under a fake name, pay with cash, and set up > >the remailing software. The identity of the operator of such a remailer > >would be difficult, if not impossible, to discover. Then someone else said: > (Doesn't Sameer's system offer such accounts? Couldn't there be dozens of > remailers based at c2.org? Of the 16 Type-1 remailers listed in one of > Raph's recent reports, only 2 were at c2.org.) This happened. Remember robo(a)c2.org? Whatever happened to it? (Anyone ever figure out who the real operator was?)

1 0

Re: The Crisis with Remailers
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"loki(a)infonex.com" 18-MAY-1996 20:02:12.04 >I was invited to the digicash API design meeting precisely to make sure it >could be used in remailers. It will not be using the current API. The >problem is that Mixmaster requires exact knowledge of the size of every >object in the message, to maintain constant message size. I could set aside >room for one, two, three coins, but there is no guarantee that the payment >will be made with only that many coins. The current API is going to be high >level. It will does not allow the program to know anything about the >internals of the payment. I need to be able to specify payment of amount X >using no more than N coins. As soon as I have that level of control, you >will see postage in Mixmaster. Good. I can see doing a limited postage now, actually, with relatively simple modifications - the postage goes to the initial remailer front end and to the remailer that sends out the message to something other than another remailer. -Allen

1 0

Re: Remailers & what they get out of it...
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"ravage(a)ssz.com" "Jim Choate" 18-MAY-1996 09:43:06.96 >As long as the remailer is run a 'grins & giggles' affair you are right. There is the increase in reputation capital in _some_ quarters possible through running a remailer. (On the other hand, in authoritarian quarters, it would tend to decrease one's reputation capital...) >To me the biggest problem with the crypto work right now is that not enough >professionals are involved. If more remailers and such were initiated as >a business there would be legal avenues to explore. Also, in this vain is >the apparent lack of support for commercial ventures by developers of such >apps as MixMaster (whose license explicity prohibits commercial use). It prohibits commercial use? That's silly. Is it a holdover from when the idea was to turn Mixmaster into a company? >And for the record, yes, we expect to charge real $$$ for access. Our >current plan is $10/month for each account. Money orders prefered. We have >at this point pondered e-cash methods but it doesn't seem popular enough >at this juncture. How would you be doing this? Only remailing from accounts that have paid up, or what? -Allen

1 0

Re: Is Chaum's System Traceable or Untraceable?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 18-MAY-1996 14:30:54.29 >I agree with Jim Bell on this completely. I don't know if Chaum has been >seduced by the Dark Side, or is looking to get digicash widely deployed by >"respectable" institutions, or is telling the truth (that his system >_never_ provided for real untraceability), but I know that Cypherpunks >should always strive for full untraceability. Given what I've picked up (including what institutions he's chosen to deal with, the behavior of these institutions - MTB's dropping of merchants disapproved of by Mrs. Grundy et al, and other information), I am willing to bet that the second is the priority. Once his patents run out, all bets are off... but it looks like he's wanting to get ecash accepted before then. Otherwise, everyone may be using various non-anonymous (or GAKed anonymous) methods like credit card encryption. Unless I'm reading the ecash protocols wrong, using the current version of the software some degree of payee anonymnity is possible. -Allen

1 0

Re: A cryptographic alternative to escrow agents (Matts' half coin)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"unicorn(a)schloss.li" "Black Unicorn" 18-MAY-1996 11:46:08.35 >The mint is the escrow agent. It still (obviously) needs to be trusted. The mint will need to be trustworthy anyway; otherwise, you can get a "final round" problem in which they print up lots of ecash and spend it before the value completely plummets, or they get lots of requests to cash existing ecash in. -Allen

1 0

Re: SEVERE undercapacity, we need more remailer servers FAST
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:07 AM 5/20/96, E. ALLEN SMITH wrote: > What countries are noticeable for being anti-Scientology? They would >appear to be good locations for special-purpose remailer ultimate-output ends. But any country that is "anti-Scientology" is likely to be repressive in various ways we would find inimical to our goals. Germany is a prime example: yes, they have placed restrictions on the CoS, but they have also ordered crackdowns on Internet sites. Whatever one may think of Scientology, or Catholicism, or Baalism, or whatever, crackdowns by the government ("anti-Scientology," "anti-Catholic," etc.) is not a good thing. (The issue of how believable the claims of CoS are is no more relevant than similarly outlandish claims that taking communion is eating the flesh of JC. And the issue of CoS seeking legal actions against those they claim are violating their copyrights is separable from their religious status. As I have said many times, "Newsweek" would likely take similar actions in similar circumstances.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: The Crisis with Remailers
by lcs Mixmaster Remailer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > not!!! I should have made this clear, but imho no matter how favorably > the public sees anonymity, I still believe there will be little > incentive to run remailers until there is some kind of ecash > scheme. I hope this is not true. Some of us simply believe it is important to help people with unpopular opinions speak without fear of harassment. I for one will continue to operate a free remailer even if the technology becomes available to charge for the service. I hope others will, too. Some people do care about things other than money. I hope the reason there aren't more remailers out there is simply that it is sort of a pain to set one up, rather than simply because nobody cares. > >People seem to forget that anyone can drop a letter into the mailbox with > >no return address. Did the Unabomber bring negative publicity to the > >postal service, causing people to demand that return addresses become a > >requirement? :-/ > > agreed, but the subject at hand was not whether anonymity is good or bad, > but whether there is some incentive to run remailers. Well, wanting there to be remailers is a good incentive to run one. Another good incentive is if you ever want to send a truly sensitive anonymous message. If you chain through your own remailer, then you can be absolutely sure that at least one remailer in your chain is not run by "bad guys." > I would be interested if any longtime remailer operators posted > statistics about the amount of mail going through their services. Usage statistics are publicly available from mixmaster remailers by sending mail with subject "remailer-stats". Whenever I've checked, the number of messages through the lcs mixmaster remailer has been around 300/day. This is neither a longtime remailer nor a particularly accurate statistic, but it should give you some idea. mix-admin(a)anon.lcs.mit.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZ//ZETBtHVi58fRAQHePQP+JQcCu/zDfhRB1BLOea+OSENfM6qRxj0h KlYtV5O+IgcmlfZ+vupbtds6IrL8GN5YAQ7kpLoSCIUPC3+r4X0ppJjqgETEYI23 cJoZU9tG3Csj+KNSRn7tDjXdPFcGooqemvhV5SERiQEkAYqzRBDCcd7VQTOGgls5 TTRHxUQ1F+c= =DOAo -----END PGP SIGNATURE-----

1 0

Re: Rumor: DSS Broken?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:05 PM 5/19/96 -0800, jim bell wrote: >At 08:33 AM 5/19/96 -0400, Robert Hettinga wrote: >>At 9:41 PM -0400 5/18/96, Bill Stewart wrote: >>> MD5 is at least weakened, maybe broken; there's an abstract by Hans >>>Dobbertin >>> that says something about generating collisions, and gives an example >>> (though the abstract doesn't say how general the method is.) >> >>That's what I get for not reading the DSS stuff when it came out. I'd heard >>lots about the MD5 stuff, but I didn't put the two together. >> >>It also looks like I'm behind in my reading. Time to buy another edition >>of Applied Cryptography... > >It should occur to all of us that if the NSA was actually doing the job we >are vastly over-paying them to do, it is THEY who should be finding, >exposing, and correcting these kinds of cryptography faults. Has anybody >ever heard any evidence that the NSA has ever acted in this sort of >responsible role? I was rather impressed by NSA's role in the creation of DES. The strengthened it against an attack which was not publicly known, and didn't, in the process, reveal the attack. (See AC2.) ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

CAPITALISTS' SUCK
by qut＠netcom.com 17 Dec '03

17 Dec '03

! Date: Sun, 19 May 1996 20:28:04 -0400 ! From: "Perry E. Metzger" <perry(a)piermont.com> ! ! >Dave Harman writes: ! > ! > CAPITALISTS' SUCK ! ! What witty social commentary. Information wants to be free.

1 0

PGP MIME INTERNET DRAFT considered harmful.
by paul.elliott＠hrnowl.lonestar.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Summary: The PGP MIME INTERNET DRAFT, draft-elkins-pem-pgp-03.txt, contains a design error with respect to signatures on binary data. This error results from the failure to recognize the distinction between those features of MIME which are necessary to represent complex data and those features of MIME that are used to transport the data. The design error will result in the following negative results if PGP-MIME is widely used with binary data. (1) Huge unnecessary inefficiency whenever binary data is sent signed and encrypted. (2) The signatures on PGP MIMEd objects can not be extracted from a MIME context and used where MIME programs are not available. (3) Many users will rightly refuse to sign the entities the PGP-MIME draft envisions. This reduces the utility of PGP-MIME. (4) If users do sign these files, they will be signing data for which there are no commonly available inspection tools. This will eventually result in a security breach. - ---------------------------------------------------------------------- The problem is that when binary data is to be signed the data is to be PGPed _after_ base64 has been applied and the MIME headers added. This is required by the draft: > >3. Content-Transfer-Encoding restrictions > > Multipart/signed and multipart/encrypted are to be treated by agents > as opaque, meaning that the data is not to be altered in any way > [1]. However, many existing mail gateways will detect if the next > hop does not support MIME or 8-bit data and perform conversion to > either Quoted-Printable or Base64. This presents serious problems > for multipart/signed, in particular, where the signature is > invalidated when such an operation occurs. For this reason it is > necessary to REQUIRE that ALL data signed according to this protocol > be constrained to 7 bits (8-bit data should be encoded using either > Quoted-Printable or Base64). Note that this also includes the case > where a signed object is also encrypted (see section 6). This > restriction will increase the likelihood that the signature will be > valid upon receipt. > > Data that is only to be encrypted is allowed to contain 8-bit > characters and therefore need not be converted to a 7-bit format. > > In this the draft follows RFC1847. [Encrypted & Signed binary data.] Now when there is a data path for PGP's cyphertext, PGP provides a binary data path for its plain text. Thus, the inner base64 that PGP MIME internet draft requires is totally unnecessary. It will cause a 30% increase in the size of those messages that are encrypted and signed and large amounts of CPU time will be used applying & removing the base64. It is worth noting that huge amounts of binary data will be transferred by MIME, so the above represents a significant problem. [Signed binary data.] Now let us consider the question of what PGP-MIME draft requires users to sign. Suppose we want to send a signed .gif file to a sysop. The sysop wants to store the .gif in his download section. Suppose the sysop wants to store the signature as a detached signature so that people who download it can check the authorship. But the signature proposed by the PGP-MIME draft is useless for this purpose. It has MIME headers attached and it has been base64'ed. People who download such a file from a BBS have no use for it, unless they have MIME. Or suppose we send as signed .gif file to the maintainer of a WEB page. He stores the .gif on an insecure UNIX system connected to the internet. Suppose, a year later the maintainer wants to check if the .gif has been tampered with. Can the maintainer store the signature on a floppy and use the signature for later checking? No, the only way the signatures specified by the draft can be used, would be to add MIME headers and apply base64. The maintainer will have to store the entire MIME message, .gif and all if he wants to check the signature later. Or let us consider an .gif artist. The artist has a policy of only signing works that he can be proud of. He does not sign his sketches, because he does not want sketches to tarnish his reputation. Before signing and releasing a work, he examines it with several different gif viewers and paint programs. But what does the draft PGP-MIME want the artist to sign? It wants him to sign a file that has been base64'ed and with mime headers added. The artist can not examine the file to be signed with any of his gif viewers or paint programs. Everyone's mother has told them to "Never sign anything unless you have read the fine print first." But here we have a file that has been scrambled so that it can not be inspected with the commonly available tools. The artist refuses to sign. Not only does he not know what he is signing, but the base64 offends his artistic standards. Who can be proud of base64? Necessary perhaps, but lets face it, base64 is an horrible kludge built to meet the deficiencies of a network. If users get in the habit of signing binary files which represent multimedia data, and which can not be examined with commonly available inspection tools, it is inevitable and predictable that sooner or later this will cause some kind of negative security event. Now there is some justification for the way the draft handles text. Different operating systems and machine architectures represent text in different ways, so that it is necessary that digital signatures be taken over some "canonical" format so that signatures will check on different operating systems. Even after text has been mangled by Quoted-Printable it can still be read after a fashion by the person asked to sign it. Operating systems and machine architectures also differ in the way they represent binary data. The differences in the ways integers, floating point numbers and other such thingies are represented are well known. However, such differences must be handled at the application level. The location within a file of integers, floating points, etc must be set by the application programmer/designer. PGP, MIME, and base64 can not deal with these differences, because the location of integers and floats can not be specified in advance for an arbitrary data file. Thus, from the point of view of PGP and base64, these differences do not exist and binary data may as well be a stream of bytes. Thus, in the case of binary data, base64 is not more "canonical" than the original data. There is no good reason to sign the base64 rather than the original data. Once a file has been base64ed, the file can not be examined with the usual inspection tools. The draft has chosen to treat text and binary data similarly. This results in negative results mentioned above, but the developer and draft author do not have to deal with any logic to handle text and binary data separately. User utility and security have been sacrificed for the convenience of simplicity for the draft author and the PGP-MIME developer. The typical user of MIME software is not necessarily technically sophisticated. When the deficiencies and disasters associated with software patterned on this draft become apparent, not everyone will know exactly which software component is at fault. The problems associated with the draft (or its successors) may adversely affect the reputation of PGP. Now some descendant of the draft could become a standard or the draft could become a de-facto standard through wide-spread use. Such a standard could become a barrier to the acceptance of other software without the draft's deficiencies. Thus, the draft could permanently inflict poor software on the world. (Look at the memory architecture of the IBMPC for one example. Or look at the MSDOS operating system for another example.) The draft should be withdrawn. People should rethink and create a better plan to combine the benefits of PGP and MIME. It should accommodate the user who wishes to mail a generally usable PGP signature (that is, one that can be used outside the context of MIME) along with multimedia binary data. It should not ask a user to apply a signature to any data that cannot be examined with commonly available tools. It should not require anyone to sign an artifact of a data transfer system such as base64. It should not require any additional space overhead (more than that which may be necessary for transport) when signing and encrypting. - -- Paul Elliott Telephone: 1-713-781-4543 Paul.Elliott(a)hrnowl.lonestar.org Address: 3987 South Gessner #224 Houston Texas 77063 -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: cp850 iQCVAgUBMaBPRPBUQYbUhJh5AQH2hwP+J1ADSzD3Yx4gvUIvAwN+EDikIN2IaHhM j+znIlt9QPzl5SSp44H+JnhoivhKR3562ACI1nexNMZ9E2MrPNioiGmrmz0uGwM6 Px/k2HbioQrgqmmP0IO/98cTZGA71pK7iNk7AZbWpEW4XfWkyRDW9hQzrCEZXXw8 jQwM/VHUPl8= =BvoZ -----END PGP SIGNATURE-----

1 0

New type2.list/pubring.mix
by John A. Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello Everyone, WOW! It was apparently an exciting weekend while I was gone. I'm sorry the shinobi remailer announced it's retirement but the exciting thing seems to be this mysterious "middle-man" remailer. If it works as the maintainer says, we can have a whole new avenue for setting up undetectable remailers. Anyway, I've updated the type2.list/pubring.mix combination on jpunix.com to reflect the retirement of shinobi and the creation of the middle-man remailer. The lists are available by anon FTP as well as http://www.jpunix.com. John Perry - KG5RG - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMaBlT1OTpEThrthvAQHpwAP+I4XqvV7PqkY2q+6cnYiPerqByfYEQa8Y 22efJIGNN4SwHFptI5Hf2sTcT03G5stFXeDbt6GkJYozHfp860Ms00LusYcZhVr2 I8YJc6SzzWqYQnorJE72aausb9f5D1R7eq+2zza0QL7JTOTGVYyA4k/r6pzhf/xU DrQJDFjhEH0= =fU3G -----END PGP SIGNATURE-----

1 0

Re: My meeting with Chaum (Also: ecash full anonymity and a legal question)
by Jüri Kaljundi 17 Dec '03

17 Dec '03

Sat, 18 May 1996, Ian Goldberg wrote: > I am, in fact, going to Canada, and was considering writing a version of > the library while I was there. Now, Chaum has a patent on 2 lines of > code (blinding the coin before it goes to the bank, and unblinding the > value returns). Believe it or not, I would like to stay within the law. BTW why isn't some other company besides DigiCash selling similar software product as the Ecash mint & client? Are there some international patents or trade secrets involved? There is a real market for similar software solution and it should not be too hard to write, considering it is a financial system and there is big money involved. Public domain ecash software would be an interesting effort to accomplish. In case of full source availability it should be possible to develop commercial systems based on public software, it might even be more secure than commercial software which source is available for review to only certain persons. There is also a problem with Digicash licencing: they licence only to banks, and usually only to one bank in each country. I believe there are also many companies that are not banks, who would also like to issue ecash for specific purposes. Setting up an separate company issuing electronic cash, not connected to any of the existing banks, is something that probably will happen sooner or later. Of course there are problems of legislation and clients trusting the company, but those are not problems that the software manufacturer like Digicash should decide. Jüri Kaljundi jk(a)stallion.ee AS Stallion

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"treehole"} = "<remailer(a)mockingbird.alias.net> cpunk pgp hash latent cut ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 alpha) (flame replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: The remailer list now includes information for the alpha nymserver. Last update: Mon 20 May 96 6:47:47 PDT remailer email address history latency uptime ----------------------------------------------------------------------- lead mix(a)zifi.genetics.utah.edu ++++++++++++ 39:10 99.99% alpha alias(a)alpha.c2.org +++++-*-++-+ 1:14:55 99.99% exon remailer(a)remailer.nl.com +****+****** 4:01 99.99% mix mixmaster(a)remail.obscura.com +++++++++-++ 2:00:18 99.99% haystack haystack(a)holy.cow.net --++*--*#### 45:13 99.98% flame remailer(a)flame.alias.net +-++++++++++ 1:33:36 99.94% vegas remailer(a)vegas.gateway.com **##**--*#*# 22:41 99.92% portal hfinney(a)shell.portal.com ##########+ 4:00 99.90% ecafe cpunk(a)remail.ecafe.org +## ##*-#### 9:39 99.89% c2 remail(a)c2.org ++++* +-++-* 1:08:50 99.83% amnesia amnesia(a)chardos.connix.com ---+++----+ 4:41:28 99.75% replay remailer(a)replay.com ***+**+*+*** 5:18 99.65% alumni hal(a)alumni.caltech.edu *#####*##* + 4:36 99.56% treehole remailer(a)mockingbird.alias.net +--..+---+-+ 2:53:30 99.47% penet anon(a)anon.penet.fi . __-_ -_ 54:09:03 98.83% extropia remail(a)miron.vip.best.com ____-* .. 26:11:30 80.57% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

No Subject
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

I like the idea about bed hopping. But have we worried about AIDS (VIRUS)? >Hi. > >Pardon my ignorance, but I had a few questions haunting me since a >while. > >Is there a way to have a remailer de-localize itself and relocalize >itself over the internet? > >For example, could there be several machines around the worlds that, >when you send an e-mail to it, is routed to differents physical >places of the world depending on where the actual remailer process is >actually running? Could there be such a thing as a virtual machine >runing a remailer that gets to hop from physical machine to physical >machine around the world? > >Just an idea to avoid jurisdiction problems. > >Just asking, probably quite futilely... > >Thanks > >JFA > > DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal > JFA Technologies, R&D consultants; physists, technologists and engineers. > > PGP keys at: http://w3.citenet.net/users/jf_avon > ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 > Unsollicited commercial e-mail will be proofread at US165 $/h > Any sender of such material will be considered as to have ac- > cepted the above mentionned terms. >

1 0

RAC_ket
by jya＠pipeline.com 17 Dec '03

17 Dec '03

5-19-96. WaPo: "From Out Of the Shadows." Book review. Spies Without Cloaks: The KGB's Successors By Amy Knight Princeton University Press. 318 pp. $24.95 Knight suggests that Russia's new security forces are not only continuing the same kinds of skulduggery as they undertook in the past but are now also expertly manipulating public opinion in Russia and the rest of the world to obscure and disguise what they do. What Knight suggests is that the old client-master relationship between Russia's elite and the KGB has not only been reversed but may even have vanished, because these "children of the KGB" have subsumed large chunks of Russia's economy and government. If *Spies Without Cloaks* is correct, much of Russia today is little more than a mutant KGB, the communist ideology it once served now replaced by ruthless devotion to great-power politics and bottom-line capitalism. The book is worth reading for its applicability to the transformation of the US and international intelligence "communities" into free-market racketeering of espionage technologies and expertise and insider secrets -- as WaPo reported May 2 on high-tech intel patrons Perry and Deutch. RAC_ket

1 0

Feds Web Crypto
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Washington Post, May 20, 1996 Feds on the Web Federal agencies' efforts to link up with the citizenry over the World Wide Web take a step forward today. Officials plan to announce a pilot program in which 1,000 to 2,000 people will try their hands at secure Web transactions with federal agencies. It's set to start later this month. The vision for the "Paperless Transactions for the Public Project": a taxpayer files a return to the Internal Revenue Service over Web links that use advanced cryptography to confirm to the agency that the return's really coming from the right party. Or, a retiree goes into a Social Security Administration computer to check benefit information. VIPs, civil servants and ordinary folks are to be issued special "key cards" to take part in the test, which will use cryptography from Frontier Technologies Corp., a Wisconsin networking company. Officials promise the vision is not that far away. --

3 2

Ooops
by Rev. Mark Grant, ULC 17 Dec '03

17 Dec '03

I see my brilliant idea has already been suggested. Remind me never to post when I'm a hundred messages behind in future... Mark

1 0

Re: SEVERE undercapacity, we need more remailer servers FAST
by Rich Burroughs 17 Dec '03

17 Dec '03

At 01:08 AM 5/20/96 -0700, tcmay(a)got.net (Timothy C. May) wrote: [snip] >And the issue of CoS seeking legal actions against those they claim are >violating their copyrights is separable from their religious status. Not at all. Their actions are based on their religious doctrines, as passed down by Hubbard. "Always attack, never defend." Their claims of copyright violation are part of an ongoing effort to silence those who criticize their illegal and immoral practices. They should be examined in that context. > As I >have said many times, "Newsweek" would likely take similar actions in >similar circumstances.) AFAIK, "Newsweek" does not file lawsuits just for the purpose of harassment, as Hubbard counselled his followers to do. AFAIK, "Newsweek" does not hire PIs to harass those who criticize them. Tim, do you think "Newsweek" articles have ever been posted to the Net? If so, did the magazine sue everyone who posted them? The "Church" doesn't even want to admit that fair use is a possibility. "Newsweek" is also not a non-profit coporation. Not only is CoS tax exempt, but they claim to have "trade secrets" as well. That's having your cake and eating it... Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

Long-Lived Remailers
by Rev. Mark Grant, ULC 17 Dec '03

17 Dec '03

With regard to the problems of remailers being shut down when we want long-lived addresses, wouldn't seperating the input and output be one possibility? That is (like Hal's Alumni remailer) you'd send mail to 'remailer(a)anon.ai' and it would be forwarded via a disposable account elsewhere. All messages would appear to come from 'disposable(a)foo.com' and if that account was shut down a new one could be opened to replace it while incoming mail simply backed up at the main remailer account. The only potential problem I could see would be that the disposable ISP might have logs which could track the outgoing messages back to the other account. You'd also obviously need to open the disposable account anonymously or using an ISP who'd protect your identity. Mark

1 0

Re: The Crisis with Remailers
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:01 AM 5/20/96 -0400, E. ALLEN SMITH wrote: >From: IN%"frantz(a)netcom.com" 17-MAY-1996 15:56:36.35 > >>Perhaps what is needed is a non-profit, charitable 501c foundation to >>encourage anonymous communication. Those who support the idea could make >>tax deductible contributions which would be used for grants, public >>education etc. etc. to encourage anonymous communication. It could be >>called, "The Federalist Foundation" because the Federalist Papers were >>published anonymously. > > Hmm... I wonder if it would be good for this Foundation to itself >operate some for-pay remailers, in order to make some money from sources >besides contributions? Possible disadvantages: > A. It could get sued, and thus lose funds > B. If its prices were set too low, it could wind up driving other >remailers out of the market (combination of low price with likelihood to still >be there), and thus become a vulnerable point. In general, I think this foundation should limit itself to: (1) Supporting the creation of techniques for anonymous communication (e.g remailers, nym servers etc.) This could include grants for theoretical work and grants for the production of out-of-the-box public domain systems. (2) Public education on the need and value of anonymous communication. (3) Demonstration projects to help create a market where none exists. Whenever there is a market, the foundation, like governments, should not participate as a competitor. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: AP
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 20 May 96 at 10:28, Jim Ray wrote: > >A long time ago (few hours) JFA replied to Vlad Z. Nuri (but > >Jim Ray seemed to indicate that >his other name was L. > >Detweiller) : > >I think that you are writing way out of context. > > >First, wether or not the AP scheme is used for the control of > >government, as Jim Bell pushes it, does not mean that it will not > >be implemented for other purposes, such as killing successful > >businessman or your neighboor's son who is screwing your wife > >(noticed that she smiles all the time since a while? ) . > >Second, > >everybody like Jim Bell who is pushing the AP scheme is >doing so > >on ethical basis: that the coercion the government imposes >on to > >the individuals by regulations, and guns backed taxation >justifies > >the killings. I have to see yet any cypherpunks who >seems to > >agree with AP that envision another use than govt control. > > > I disagree BECAUSE of the other likely uses, & see below. Just the one I pointed out in theses two paragraphs. I don't like the scheme either. > >And you'll also note that the anonymity issue generate more > >interest from more CPunks because it (hopefully) will acheive the > >same goal without any killing. > > our > anonymity-baby threatens to have govt. kill it in the crib, It is not yours, it only *is*. > with the support of the people. Here, again, Jim Bell would probably say that this sentence proves him right... > I have not respected a US > president in my lifetime, yet I get _pissed_ when they get > shot/shot at. I somehow agree with you here. > Killing seems to be a first resort for some, > and IMO ends do not justify means. Well, here, you are threading on a very difficult path. Of course, the ends does never justifies the means in an *uncoerced* context. But what JB says, is that AP would be a justified "self defense" against coercion. It is only that the self-defense uses statistics. You'll note that the psycho-epistemology necessary to commit murder is quite close to the one necessary to coerce poeples to pay taxes. Thus, he might pretend (JB) to only turn the living expression of an idea against itself. Personnally? I still was not able to sort it out... Ciao JFA DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal JFA Technologies, R&D consultants; physists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

1 0

The Ontology of Nyms, Trust, Belief, etc.
by tcmay＠got.net 17 Dec '03

17 Dec '03

[I've changed the thread name from "Sen. Leahy..."] At 10:50 AM 5/20/96, bryce(a)digicash.com wrote: >Indeed we have, and it verged on philosophical territory, and >I would really enjoy discussing the issue again with you >sometime, although perhaps we've gotten about as much as we can >get out of it in e-mail. Yes, I also enjoyed the MITM ontological debate--up to a point. Technology reifies what were once philosophical abstractions, and brings them to the fore. >Unfortunately PGP 2 only allows one kind of certificate. The >"key-signature". To PRZ and most other people, it is a >certificate asserting a mapping between a key and a true name. >To me it is as I described above. To TCMay, it is a kind of >endorsement. It's just too bad that PGP 2 doesn't have >different _kinds_ of certificates to represent these different >assertions. Until a certificate technology like that is >implemented, and probably even after that time, we need to >avoid confusing these various meanings for "key-signatures". I agree with this point, that the "scalar" nature of key-signings is not very rich. A Digression on Tensors: The next step up would presumably be "vector" signings, where one has multiple attributes, just as with ratings, reviews, etc. And the step after that would be "tensor" signings--it's perhaps a leap into the abyss, but tensors have an interesting property that a value in one direction, for example, and a value in another direction, say, do not "vector add" to some resultant value. While "wind" acts as a vector field, with a north wind and and a west wind giving a northwest resultant, think of "stress" (as in a crystal, a piece of glass, a structural member): stress in one direction is independent of stress in another direction, and they don't add as vectors do. Hence, the "stress-energy tensor" is needed to describe the stress in a material...or the gravitational field! (This is just a conjecture that this model might be useful at some point. Near term, I think even having "user-defined" belief fields would be a useful step. And I don't think it needs to be hacked into a next version of PGP...it seems better to add these things on later.) >Now more seriously, the alacrity with which I bring up >disagreements with Tim should in fact be construed as a measure >of my _respect_ for his opinions and for his mind, rather that >as a lack of respect for same. Thanks, and I promise I'll respect you in the morning, too. (g) That several of us (and probably many of those who aren't commenting) have differing interpretations of key signings, trust, belief, identity, proof, etc., is not surprising to me. (I didn't put "Licensed Ontologist" in my .sig for nothing. Actually, it's also meant as a tweak of some local Santa Cruzans who want professions licensed by the State and ordered to report various forms of physical, psychic, and existential "abuse" to the proper licensing authorities. I get a great rise out of them (in scruz.general) by announcing that "my clinic" refuses to narc out its patients to the authorities...I love getting threats from them saying that they plan to contact Sacramento to "have your license revoked." Predictably, and sadly, I've never gotten a call from any state authorities on this...I can always hope.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

An alternative to remailer shutdowns
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Several remailers have shut down recently. This may be in part a byproduct of the ongoing struggle between dissidents and adherents of the Church of Scientology. Also, levels of abuse seem to be increasing in general as more people come on the net and learn to use the remailers. Since by their very nature remailers prevent accountability, there is nothing to stop one or more persons from sending illegal material which will cause the remailers to be threatened by legal actions. I was contacted by the FBI on Friday due to some threatening mail which was apparently sent through my remailer. According to 18 USC 875(c), "Whoever transmits in interstate commerce any communication containing any threat to kidnap any person or any threat to injure the person of another, shall be fined not more than $1,000 or imprisoned not more than five years, or both." I may not be able to continue operating either of my remailers (alumni.caltech.edu and shell.portal.com) for much longer due to this kind of abuse. Shutting down remailers not only reduces the number available for general use, it also causes problems for people who are using the remailers to manage pseudonyms. If their reply chains used a remailer which shuts down they have to reconstruct the chains, which is at least a nuisance. There was also a posting recently to comp.org.eff.talk by Jonathon Cline, jcline(a)trumpet.aix.calpoly.edu, about efforts to set up fully anonymous nym based mailing lists. He mentioned that the decrease in the number of remailers is causing problems with their plans. An alternative I am considering would reduce the utility of the remailer while still allowing these "consensual" uses to continue. Presently the remailers deal with abuse via "block lists", sets of addresses that mail can't be sent to. Generally these are created when someone complains about some mail they have received. By setting up blocking, at least they will not get harrassing anonymous mail once they have complained. But in some cases, as in the case that is causing me headaches now, even one message is too much. My thought is to turn the block list concept on its head, and make it a "permit list". Simply, the remailer will only send mail to people who have voluntarily indicated their willingness to receive it. Someone who has not sent in a message granting this permission will not be sent mail. For larger forums such as newsgroups and mailing lists, permission may be granted by some consensus mechanism. Most would be blocked, but a few like alt.anonymous.messages and the cypherpunks list would be permitted, and others could be added if they wished. This should hopefully essentially eliminate complaints about abuse, much more effectively than the current method of block lists. People who want to test the remailer by sending mail to themselves, as most people do when they are learning, can simply register themselves on the permit list. People who want to receive anonymous mail, or participate in anonymous mailing lists, can register themselves. People who want to use nyms can register themselves. People who run other remailers can register. It's all voluntary, and if someone does get some objectionable message at least they will know that they granted permission. They can always ask to be taken off the list. Feedback welcome - Hal Finney -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBMaDr2BnMLJtOy9MBAQHWBAIAlh2uIanxTnI+GBqZ1zWcBE/AgF2TtQA/ TztTYczW7FI8ktAa3WVtsUkJeIOYxUDfC2jLvhHuGMXhEPs+jVijJg== =QajL -----END PGP SIGNATURE-----

2 1

Re: PGP MIME INTERNET DRAFT considered harmful.
by elkins＠aero.org 17 Dec '03

17 Dec '03

[Note: CC'd to the pgp-mime list.] Paul Elliott writes: > [Encrypted & Signed binary data.] > Now when there is a data path for PGP's cyphertext, PGP provides a > binary data path for its plain text. Thus, the inner base64 that PGP > MIME internet draft requires is totally unnecessary. It will cause a 30% > increase in the size of those messages that are encrypted and signed and > large amounts of CPU time will be used applying & removing the base64. This design decision actually serves a purpose. The scenario is as follows: Suppose you are a company which has west-coast and east-coast offices, and the only connectivity which exists is via the open Internet. Suppose further that you wished to send out a company memorandum to all the employees. Obviously you will want to sign and encrypt your message. However, one it reaches your offices, you would like to have the encryption "layer" stripped leaving just the signed message. Now, if when you generated that message you did not restrict yourself to 7 bits, there is a likely probability given todays software, that you are not going to be able to transmit that message over an SMTP framework. Now, this does present some bloat for people who do not strip the encryption, but it seems far better to design the protocol such that this case will work. > [Signed binary data.] > Now let us consider the question of what PGP-MIME draft requires users > to sign. Suppose we want to send a signed .gif file to a sysop. The > sysop wants to store the .gif in his download section. Suppose the sysop > wants to store the signature as a detached signature so that people who > download it can check the authorship. But the signature proposed by the > PGP-MIME draft is useless for this purpose. It has MIME headers attached > and it has been base64'ed. People who download such a file from a BBS > have no use for it, unless they have MIME. [...several other examples deleted...] PGP/MIME is _not_ meant to be used in this fashion! It never was! PGP/MIME is only to be used for transport, not for long term storage. If you need a persistent signature, you should generate a detached signature as an attachment. > If users get in the habit of signing binary files which represent > multimedia data, and which can not be examined with commonly available > inspection tools, it is inevitable and predictable that sooner or later > this will cause some kind of negative security event. By this argument nobody should bother signing e-mail or news posts. I haven't seen any good tools to handle this easily for PC's and Macs. New proposals have to be made before the tools become available. This draft is the result of experience with what does and doesn't work. For example, the application/pgp content-type which many people like is horribly broken for what it's probably used for 95% of the time. > There is no good reason to sign the base64 rather than the original > data. Once a file has been base64ed, the file can not be examined > with the usual inspection tools. Yes, base64 is just another stream of bytes, but there are FEW places on the Internet SMTP framework that can support BINARY transport. BINARY streams often contain very long lines which existing software simply can't handle. There is also another reason to sign the encoded version. Remember that it also includes the content headers of that part. This is very important especially for automated processing of messages. > The typical user of MIME software is not necessarily technically > sophisticated. When the deficiencies and disasters associated with > software patterned on this draft become apparent, not everyone will know > exactly which software component is at fault. The problems associated > with the draft (or its successors) may adversely affect the reputation > of PGP. Bad implementations can always adversely affect your reputation, even if the theory behind it is solid. The average non-technical user which you have been describing in this message will should not even be aware of the underlying details if the implementation is done correctly. > The draft should be withdrawn. People should rethink and create a better > plan to combine the benefits of PGP and MIME. You are more than welcome to submit your proposal the the pgp-mime mailing list. [send mail to pgp-mime-request(a)lists.uchicago.edu with a subject of "subscribe"] We've seen a lot of different proposals go by, and none of them have stood up to PGP/MIME. From my point of view, most of the problems that people have with the draft is their failure to understand what it is to be used for. Many people have the impression that PGP/MIME is meant to be the end-all-be-all for PGP. But it's not! PGP/MIME is meant to securely transmit messages across the Internet in a manner which all platforms can use. PGP/MIME is text based because most transport systems in use are. Nowhere is anyone saying "thou shalt not use PGP without MIME." I think if more people understood that, we wouldn't have so many objections to it. > It should not require any additional space overhead (more than that > which may be necessary for transport) when signing and encrypting. The note in parens is interesting. What you consider overhead I consider necessary for transport. me

5 4

encrypted open books
by Wei Dai 17 Dec '03

17 Dec '03

On Mon, 20 May 1996 jamesd(a)echeque.com wrote: > Look up cypernomicon, "open encrypted books" There is indeed a short section in the Cyphernomicon about encrypted open books. Unfortunately it doesn't describe it in detail, and since the hks.net archive is down, I can't look up Eric Hughes' original e-mail on the topic. If anyone has a copy of it in his personal archive, please repost it. I'm sure other people would be interested as well. Here is the section from Cyphernomicon: 12.16.1. Encrypted open books, or anonymous auditing - Eric Hughes has worked on a scheme using a kind of blinding to do "encrypted open books," whereby observers can verify that a bank is balancing its books without more detailed looks at individual accounts. (I have my doubts about spoofs, attacks, etc., but such are always to be considered in any new protocol.) - "Kent Hastings wondered how an offshore bank could provide assurances to depositors. I wondered the same thing a few months ago, and started working on what Perry calls the anonymous auditing problem. I have what I consider to be the core of a solution. ...The following is long.... [TCM Note: Too long to include here. I am including just enough to convince readers that some new sorts of banking ideas may come out of cryptography.] "If we use the contents of the encrypted books at the organizational boundary points to create suitable legal opbligations, we can mostly ignore what goes on inside of the mess of random numbers. That is, even if double books were being kept, the legal obligations created should suffice to ensure that everything can be unwound if needed. This doesn't prevent networks of corrupt businesses from going down all at once, but it does allow networks of honest businesses to operate with more assurance of honesty." [Eric Hughes, PROTOCOL: Encrypted Open Books, 1993-08-16] Wei Dai

1 0

Interesting bit in the US ecash License Agreement...
by Ian Goldberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here's a bit of the US license agreement for the ecash software that some of you may have missed: > The downloaded software is licensed only for and will be used only for > your internal testing as part of the aforementioned experiment, subject > to all the terms and conditions of this Agreement, and will not be > sublicensed or made available to any third party or used directly or > indirectly for revenue generating or commercial purposes. Note that last clause. It seems (probably due to the client using RSAREF, or something like that) that using the ecash software "directly or indirectly for revenue generating or commercial purposes" is illegal. Someone might want to fix that... - Ian "read _before_ you sign" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMaDUdUZRiTErSPb1AQERugQAx200/FFgIyC6/bBMoKUqlNFy97dcyo3K Zh40GsltK03Pdv551lZAjZ0T5wtjJBlhpCFgECiPRsU0D7TxYgbkQcGpKl0HwFn1 fCIjPAbcKPgnhq6/Emu4MAywqiB38MX3K5bXH13N2NVu27aucP5Xm/K4iTcGSBRT Sz5rQxa6cQ4= =S+zL -----END PGP SIGNATURE-----

1 0

WELCOME TO THE NEW ROMAN EMPIRE
by qut＠netcom.com 17 Dec '03

17 Dec '03

> On Sat, 18 May 1996, Duncan Frissell wrote: > > > It was understandable to be poor when all the world was poor. It is > > understandable to be poor in those nations today that make the > > accumulation of wealth a crime for most people. It is not understandable > > to be poor (for long) in the US where one can reliably get out of poverty > > simply by doing three simple things: > > > > 1) get a high school diploma EVERYONE GETS A HIGH SCHOOL DIPLOMA --> HIGH SCHOOL DIPLOMAS BECOME WORTHLESS EVERYONE GETS A PHD --> PHDS BECOME WORTHLESS > > 2) get married EVERYONE GETS MARRIED --> MARRIAGE BECOMES SPIRITUALLY BANKRUPT > > 3) get any job EVERYONE GETS A JOB --> EVERYONE TAKES THE PAYCUT > > Only about 2 tenths of 1% of those who satisfy those three requirements > > incomes below the official poverty line. HOW DO YOU EXPLAIN THE TENS OF MILLIONS IN APPALACHIA WHO GRADUATED MARRIED AND WORK IN POVERTY > > Like most libertarians, I dislike the government. I don't care what a > > person's income is. When I was self-supporting on an income of $200 a > > month in 1979, I was below the poverty level for a single person myself. > > I am not enamored of the rich or poor members of the dependendant classes > > of course. IT DOESNT MATTER WHAT THE GOVERNMENT IS DOING WRONG ITS BRAIN IS BUSINESS > > I try and keep in mind that 80-90% of the "take" in government > > programs for the "poor" goes to unpoor government employees. IT DOESNT MATTER WHAT THE GOVERNMENT IS DOING WRONG ITS BRAIN IS BUSINESS > > DCF > > > I've done all these things - and rather more in the way of education. But > while I don't fall on or near the poverty line, I'm still poor as a church > mouse. What am I doing wrong? YOUR WHITE LIKE THE 100000000S SUFFERING IN POVERTY IN THE NEW ROMAN EMPIRE > Sean Gabb.

5 8

Re: Virtual machines?
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 20 May 96 at 2:32, Dave Harman wrote: > ! Is there a way to have a remailer de-localize itself and > ! relocalize itself over the internet? > ! > ! For example, could there be several machines around the worlds > ! that, when you send an e-mail to it, is routed to differents > ! physical places of the world depending on where the actual > ! remailer process is actually running? Could there be such a thing > ! as a virtual machine runing a remailer that gets to hop from > ! physical machine to physical machine around the world? > ! > ! Just an idea to avoid jurisdiction problems. > This is just what crypto remailers do. > Public key encryption with To: 's encrypted at each hop threading > through several servors. Just to let you know: this is *not* what I meant. I did not speak of the location of the message, but of the location of the *remailer* itself. DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal JFA Technologies, R&D consultants; physists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

1 0

Re: SEVERE undercapacity, we need more remailer servers FAST
by Rich Burroughs 17 Dec '03

17 Dec '03

At 09:53 AM 5/20/96 -0700, jamesd(a)echeque.com wrote: >At 02:08 AM 5/20/96 EDT, you wrote: >> What countries are noticeable for being anti-Scientology? >> They would appear to be good locations for special-purpose >> remailer ultimate-output ends. > >Scientology was illegal in Australia last time I heard. They declared >that you could not be a religion and charge a fee for religious service >the way that Scientology charges. They then defined them as practicing >medicine, and hit them with snake oil laws. And Germany, or course, as Tim mentioned. CoS suckered the US State Dept. into putting pressure on the Germans, and the Scientologists on a.r.s. have made plenty of Nazi allusions when discussing the German "bigotry." I know that there was a big crackdown in England while Hubbard was still alive, though the anti-Scientology laws there were rescinded some time ago, I believe. At one point foreign Scientologists weren't allowed into the country. There may still be a lot of anti-CoS sentiment there. Ironically, if someone had asked me this questions a few weeks ago, I probably would have answered, "The Netherlands." Rich p.s. I'm a bit more caught up on my facts now. The NOTS materials (newer than the OT materials in the Fishman affidavit) were posted to a.r.s. through hacktic recently. I'm assuming that was the cause of the CoS pressure to shut them down. The NOTS materials were not in the public record (like parts of the old OT materials were, as they were evidence in the Fishman case), so the court's ruling in the case against Karin Spaink and her ISP, XS4ALL, wouldn't seem to apply towards their being posted. IANADL (I am not a Dutch lawyer...) ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

No Subject
by unknown＠example.com 17 Dec '03

17 Dec '03

! With regard to the problems of remailers being shut down when we want ! long-lived addresses, wouldn't seperating the input and output be one ! possibility? That is (like Hal's Alumni remailer) you'd send mail to ! 'remailer(a)anon.ai' and it would be forwarded via a disposable account ! elsewhere. All messages would appear to come from 'disposable(a)foo.com' and ! if that account was shut down a new one could be opened to replace it ! while incoming mail simply backed up at the main remailer account. ! ! The only potential problem I could see would be that the disposable ISP ! might have logs which could track the outgoing messages back to the other ! account. You'd also obviously need to open the disposable account ! anonymously or using an ISP who'd protect your identity. That's silly. The problem isn't liability but lack of popular knowledge on setting up a remailer. The more remailers, the liability is reduced. GOALS 2000: 2,000 QUT

1 0

Re: Is Chaum's System Traceable or Untraceable?
by Tim Dierks 17 Dec '03

17 Dec '03

At 9:10 AM 5/20/96, Ian Goldberg wrote: >In article <199605190626.BAA62897(a)rs5.tcs.tulane.edu>, >Matthew Carpenter <mcarpent(a)mailhost.tcs.tulane.edu> wrote: >>My PDA receives >>back any coins as change if needed, and logs info about the transaction >>for my financial records. >> >>When I get back home I 'deposit' my change using the same ATM interface. >>This also removes from my home computer the copies of the coins I spent, >>and automatically updates the transaction records on my PC. >> >>So are there any flaws with above procedure? > >Yup; with the current protocols, there's no way to do change. For the shop >to pay you change, besides suddenly losing your anonymity as a payee, you >would have to go online immediately to clear the coins, which assumedly >is infeasable. > >However, if you use the "fully anonymous" protocol, change becomes trivial. >You don't have to go online; the payer (the shop) does, which it assumedly >already is. Another benefit is that coins received in this way as change >are immediately spendable by you, without having to go online in between. > >The "fully anonymous" protocol turns out to be _exactly_ what is needed >for situations like this. Not that full anonymity isn't a Good Thing, but couldn't this be solved by having the merchant (who presumably is on-line) provide PDA <-> mint connectivitiy for the purposes of getting change, exchanging coins, etc.? My assumption is that all the ecash protocols are not subject to a MITM attack, which I would just presume to be good practice. Also, given the fully anonymous protocol as you've described it (both payor and payee blind the coins), what's to prevent the merchant from depositing your change before he gives it to you? Unless your PDA is online, you'll be home before you find out the hot dog vendor shorted you. (It's my understanding that the current digicash system does not support Chaum's method of revealing the identity of double-spenders). - Tim Tim Dierks -- timd(a)consensus.com -- www.consensus.com Head of Thing-u-ma-jig Engineering, Consensus Development

2 1

Re: My meeting with Chaum (Also: ecash full anonymity and a legal question)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 17:13 5/20/96, Jüri Kaljundi wrote: >BTW why isn't some other company besides DigiCash selling similar software >product as the Ecash mint & client? Not that I am aware of. David Chaum (DigiCash) holds the patents on the blinding technology that lies at the core of Ecash. >Public domain ecash software would be an interesting effort to accomplish. >In case of full source availability it should be possible to develop >commercial systems based on public software, it might even be more secure >than commercial software which source is available for review to only >certain persons. Coin based software that uses blinding would infringe on DC's patents. >There is also a problem with Digicash licensing: they licence only to >banks, and usually only to one bank in each country. That is not the case. At this time, there is only one Ecash issuing bank in each country that has an Ecash issuing bank. There is no reason why there might not be several Ecash issuing banks in a given country in the future. >I believe there are >also many companies that are not banks, who would also like to issue ecash >for specific purposes. Such companies could negotiate a deal with one of the current Ecash issuers in which the company gets exclusive use of one of the many currencies that all Ecash mints are capable of issuing. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: New Remailer (hidden)
by Raph Levien 17 Dec '03

17 Dec '03

Bill Stewart wrote: > > Cool. I've got a test message going now. > Does your remailer accept PGP-encrypted email? > It's really critical for high-security applications, > at least for first remailer hops, but your key's not on > the MIT keyserver. At present, middleman accepts only Mixmaster format messages. Obviously, if it also supported type-1 messages, it would be important to accept PGP encrypted messages as well. > BTW, how do we know you're not a plant? :-) > Aside from having an interesting nym, > you've probably got the first remailer that > makes it difficult to tell who's running it. > You could be Sameer, or you could be Louis Freeh, > but we don't know. At least folks like Xenon were > known to be real people.... I am able to vouch for the fact that middleman is not a plant. > Even if you _are_ a plant, of course, we can still use > your system, but I'd want to do encrypted email through > other remailers on one end or the other. Always a good idea. Raph

1 0

Religions, Scientology, and Ritual Cannibalism
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:53 PM 5/20/96, jamesd(a)echeque.com wrote: >At 01:08 AM 5/20/96 -0700, Timothy C. May wrote: >> But any country that is "anti-Scientology" is likely to be >> repressive in various ways we would find inimical to our goals. >> [...] >> >> (The issue of how believable the claims of CoS are is no more relevant than >> similarly outlandish claims that taking communion is eating the flesh of >> JC.) > >The Australian law is (or was) based on the idea that if you charged someone >$2500 for eating the flesh of christ, it then becomes legitimate for the >government to check out whether or not the customer was getting actual >flesh of Christ. This seems to me a lot less repressive than the American >FDA. Caveat: I'm an atheist, a non-believer in the supernatural. When I die, my CPU and consciousness will vanish. If there are various gods and goddesses, sprites, trolls, Supreme Being(s), I see no evidence of them. Having said this, I don't want _any_ government intervening in religion, for any purposes. If the Church of Zed says that one's tithing to the Church will buy one eternal salvation and healthy gums, I don't want some government demanding to see "proof." (Inasmuch as at most one religion is right, this makes the remaining N - 1 religions automatically fraudulent in some sense. This is why the "Schelling point" in mostly-free societies is "we won't interfere with religions and their various bizarre claims...caveat emptor.") As far as I'm concerned, if a church can convince some yokels to pay $2500 for getting to eat a couple of pounds of Jesus every year (cooked, or Jesus tartare?), I'd say they've got a pretty good racket going. More supernatural power to them, I say! (And if the Clams can convince some out-of-work actors in Hollywood to pay $250,000 to be e-metered, have their engrams analyzed, and eventually "go clear," it seems like L. Ron made good on his bar bet with Heinlein that he could invent a new religion and make millions of buck. As another SF put it, "think of it as evolution in action.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

No Subject
by unknown＠example.com 17 Dec '03

17 Dec '03

! On Mon, 20 May 1996, Dave Harman wrote: ! ! > Qut may attend the meeting to verify the racial compositions of the group. ! > Results will be reported here. ! ! Please do. I'll buy you a beer. Qut has some skills in determining persentages of oriental race. It is widely suspected rich(a)c2.org of being an oriental. Thank you for the offer of a beer, however we boycott Coors because of Jewish connections. Qut

1 0

Re: SEVERE undercapacity, we need more remailer servers FAST
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 01:08 AM 5/20/96 -0700, Timothy C. May wrote: > But any country that is "anti-Scientology" is likely to be > repressive in various ways we would find inimical to our goals. > [...] > > (The issue of how believable the claims of CoS are is no more relevant than > similarly outlandish claims that taking communion is eating the flesh of > JC.) The Australian law is (or was) based on the idea that if you charged someone $2500 for eating the flesh of christ, it then becomes legitimate for the government to check out whether or not the customer was getting actual flesh of Christ. This seems to me a lot less repressive than the American FDA. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0