December 2003 - cypherpunks-legacy

No Subject
by holist 17 Dec '03

17 Dec '03

I wonder if this is also old hat to you people. If it turns out to be another FAQ, I promise to read some. At a conference in Budapest yesterday (held by Network Associates) I was interpreting for a certain professor Christoph Fischer, from Karlsruhe University. He claimed to be a premier international hacker-hunter and described several fascinating cases, such as industrial espionage performed by the French secret service commissioned by French companies at Boeing and Siemens (the latter resulting in a 6 billion Deutschmark railway contract going to a French company rather than Siemens), as well as a case of extortion in Germany, when someone he referred to as "some crazy person" attempted to blackmail the German government by threatening to fly model aircraft into the turbines of commercial jet aircraft at take-off, which, as it turned out, is indeed a feasible means of causing a major disaster. The professor was called in by a panicky German government, about ready to send off the cash, to try to locate "the crazy person". The extortionist was sending the notes via e-mail, using what the professor referred to as "e-mail anonymiser servers" in the US. "This is not too widely publicised", he went on to say, "but all insiders are aware that all e-mail anonymiser services in the U.S. are operated by the FBI." He went on to say it took them about ten minutes to discover with the help of their American friends which account the mail was originating from. A more serious obstacle was posed by the fact that it was an AOL account and that the subscriber had specified a bogus credit-card number generated by widely available software for generating feasible bogus credit-card numbers, and installed the internet applications from one of those AOL CD-ROMs that were published in very large numbers. They were forced to begin monitoring some 30 thousand phonelines (another very interesting fact: according to the professor, during the so-called "4+2" negotiations just before the Berlin wall came down, the two Germanies agreed to provide the FBI with direct access to the backbone of the German telephone network - consequently all German telephone calls and a high percentage of all European international calls, so they could listen in on those without even making an effort - in fact, he claimed, it is easier for the FBI to listen to German phonecalls than it is for the German authorities themselves), which, in addition to costing a horrendous amount of money, resulted in a bunch of data every day that took them two days to process. So, Fischer said, it would have been hopeless if the fellow had not owed the German tax authority one and a half million Marks - the tax authority busted him (following the lines of their own, independent investigation), took his computer, and he was busted. Quite a few of the messages to cypherpunks seem to come from anonymous remailers in the US. Comments? holist

3 2

Anon Mail Server?
by James Hillenbrand 17 Dec '03

17 Dec '03

What is a good server that I could send mail through anonymously.. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- -------==== James Hillenbrand ====------- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- ICQ NUMBER (UIN) : 7621556 PERSONAL E-MAIL : JamezHill(a)Audiophile.com ALT. E-MAIL : MegaHertz(a)Audiophile.com HOMEPAGE : http://www.ThePentagon.com/DaMaGe NOTES : Pumpin' BASS lower than you can hear and louder than you can stand! -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

1 0

PipeNet 1.1 and b-money
by Wei Dai 17 Dec '03

17 Dec '03

I've discovered some attacks against the original PipeNet design. The new protocol, PipeNet 1.1, should fix the weaknesses. PipeNet 1.1 uses layered sequence numbers and MACs. This prevents a collusion between a receiver and a subset of switches from tracing the caller by modifying or swaping packets and then watching for garbage. A description of PipeNet 1.1 is available at http://www.eskimo.com/~weidai. Also available there is a description of b-money, a new protocol for monetary exchange and contract enforcement for pseudonyms. Please direct all follow-up discussion of these protocols to cypherpunks.

1 0

PipeNet 1.1 and b-money
by Steve Moyzis 17 Dec '03

17 Dec '03

I don't know if this was supposed to have gone to Bugtraq, or it came to me because I 'visited' their "snoop server" acoupla times. If you already rec'd the original, then "Never Mind". >Date: Thu, 26 Nov 1998 15:33:49 -0800 >From: Wei Dai <weidai(a)eskimo.com> >To: cypherpunks(a)cyberpass.net >Cc: onions(a)itd.nrl.navy.mil >Subject: PipeNet 1.1 and b-money >Sender: owner-onions(a)itd.nrl.navy.mil > >I've discovered some attacks against the original PipeNet design. The new >protocol, PipeNet 1.1, should fix the weaknesses. PipeNet 1.1 uses layered >sequence numbers and MACs. This prevents a collusion between a receiver >and a subset of switches from tracing the caller by modifying or swaping >packets and then watching for garbage. > >A description of PipeNet 1.1 is available at >http://www.eskimo.com/~weidai. > >Also available there is a description of b-money, a new protocol for >monetary exchange and contract enforcement for pseudonyms. > >Please direct all follow-up discussion of these protocols to cypherpunks. >

1 0

Rootfest
by Anonymous 17 Dec '03

17 Dec '03

http://slashdot.org/articles/98/11/26/1841245.shtml "RootFest is a conference for the computer underground, as well as the computer security professionals, engineers, networking people, feds, script kiddies, and anyone else who would like a chance to meet people and learn. When: RootFest 99 will be held May 21-23, 1999. Where: Minneapolis, Minnesota,..." RootMonger

1 0

Re: Old Hat
by Anonymous 17 Dec '03

17 Dec '03

On the morning of Thurs, 26-Nov-98 at 10:17:48 -0800, holist unwisely said: > "This is not too widely publicised", he went on to say, > "but all insiders are aware that all e-mail anonymiser > services in the U.S. are operated by the FBI." > Quite a few of the messages to cypherpunks seem to come > from anonymous remailers in the US. > > Comments? Comment? COMMENTS? How about this, FUDSpreaderBreath: Stick Fischer and his claims up your ass. This is not too widely publicised <whisper, whisper>, I went on to say, but all insiders are aware that this kind of FUD is unadulterated ratshit. While there is no doubt _some_ official presence in the remailer network, the proposition advanced here is preposterous. > He went on to say it took them about ten minutes to > discover with the help of their American friends which > account the mail was originating from. It would probably take more than ten minutes just to find the phone number of their FBI contact, much less find him at his desk and not humping some summer intern, much less expect that he would know a remailer from his no doubt ultra-tight asshole, much less have him run down the pointy-haired manager to give him permission to find and communicate with a suitably cleared propellor head, much less find that the remailer in question was, indeed, operated either by them or by their snaky friends over at the NSA, much less check their surreptitious logs for the offending traffic, much less find that that traffic indeed did not originate from another remailer _not_ under their control, etc. etc. Ten minutes, in bureaucrat time, is about what it takes to rub two brain cells together to make a realistic approximation of a human thought. By this time, action in the physical universe is still a long, long way off. This report is likely to be nothing more than a complete fabrication of the facts, even if the underlying case was real. > just before the Berlin wall came down, the two Germanies > agreed to provide the FBI with direct access to the > backbone of the German telephone network Except that telephone networks don't have "backbones." More fantasy. And there was no single "German telephone network," and probably still isn't. > it is easier for the FBI to listen to German phonecalls > than it is for the German authorities themselves), which, > in addition to costing a horrendous amount of money, > resulted in a bunch of data every day that took them two > days to process. Highly doubtful. First, it's not in the FBI's brief to be doing large-scale foreign-based surveillance of foreign telephone systems. Second, there is no reason to believe that the FBI would have a substantially easier time of processing large amounts of resulting data than would the Germans. The Germans know how to use computers, too, and being congenitally statist, they no doubt have more facilities in place closer to the sources of information than do U.S. authorities at home or abroad. This claim also ignores the fact that the FBI have their hands full right at home and don't have the resources to be conducting large-scale surveillance of the phone calls of entire foreign nations. Oh, sure, we see increasing extraterritorial operation by small numbers of FBI, but that doesn't equate to monitoring the entire German phone system(s) or a significant segment thereof and identifying some nitwit dialing in to AOL. Is AOL even _in_ Germany? If so, what is it called, GOL? Gassholes On Line? The idea that a state security apparatus would find an AOL account to be a significant obstacle is laughable. > So, Fischer said, it would have been hopeless if the > fellow had not owed the German tax authority one and > a half million Marks - the tax authority busted him > (following the lines of their own, independent > investigation), took his computer, and he was busted. So we are to believe that after monitoring the entire German telephone system to identify who was calling in and using a particular AOL account, and successfully pegging him, the Germans were powerless to do anything, and had to call down their Tax Zombies to have an excuse to grab the guy's computer, which presumably then provided them with the "evidence" against him. Right. If the German authorities overhear in a bar that you might have forbidden literature, they will be there the same night, ransacking your home. How is it that with evidence that a certain person was the user of an AOL account they had identified as the source of extortionary messages, they were powerless to break down his door? I could admire the FUD spreaders just a teensy bit if they weren't so completely brain dead. They can't even invent a plausible FUD scenario. That the USG is operating one or more remailers is a no-brainer. That they are operating _all_ U.S. remailers is beyond the realm of reality. That the FBI has more than a casual hand in such things is not likely. Running remailers would be right up the NSA's, uh, alley, but maintaining a traffic watch on virtually _all_ remailers worldwide would be much more their style. Now _there's_ an opportunity for the spooks to have some real fun, though it's anything but certain they would be willing to "share," for a variety of reasons. The capabilities they have are protected as secrets even more than the information they gather. FUDBusterMonger It Ain't FUD til I SAY it's FUD!

2 1

Evil Bandwidth Plot Exposed
by Brown, R Ken 17 Dec '03

17 Dec '03

We're still getting clueless people forwarding us email virus hoaxes. Pen-Pal, Buddy Frogs, Good Times, whatever. And I just realised who has to be responsible! Who has a motive for this "crime"? These things do no-one any real harm, they just take up bandwidth. Networks get saturated and maybe we have to buy more kit. It must be the router manufacturers. Maybe there is a secret team at Cisco or IBM generating new hoaxes to keep the email market growing.

2 1

Otaku Defined
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Resent-Date: Thu, 26 Nov 1998 05:31:08 -0500 X-Sender: dphelan(a)mailhost.pavilion.co.uk Date: Thu, 26 Nov 1998 07:45:22 +0000 To: "Lord Myren" <lordmyren(a)hotmail.com>, wear-hard(a)haven.org From: David Phelan <dphelan(a)pavilion.co.uk> Subject: [WAY OFF TOPIC] Otaku Defined (was Re: Japanese Technomads ) Mime-Version: 1.0 Resent-From: wear-hard(a)haven.org X-Mailing-List: <wear-hard(a)haven.org> archive/latest/5977 X-Loop: wear-hard(a)haven.org Precedence: list Resent-Sender: wear-hard-request(a)haven.org Status: U At 13:16 25/11/1998 PST, Lord Myren wrote: <snip> >Otaku is translated from japanese meaning "fan." This is a somewhat >flawed translation in that there is no way to transfer the powerful >connotative meaning. > <snip> >Unfortunately, I believe something was lost in the translation in the >article. Otaku is rarely used in refence to things other than anime. >This article may have failed the translation or may just be a minor >mislabeling. Otaku can be used in reference to things other than anime, >however it is rarely ever so. >From a no-longer online magazine called JapanInterface (used to be at http://www.php.co.jp/japaninface/) Nerds of a Feather Defining OTAKU by Bill Marsh IN TOKYO a recently arrived friend calls, wants to know daishikyu (ASAP, yesterday) what otaku means. He's just been told by a mutual acquaintance that no serious student of contemporary Japan could possibly not know this word-yet his Japanese accuser, when asked to define otaku, refuses even to try. It isn't easy. Once upon a time, this word-which taken alone translates as "[your] honorable house"-was no more than an obsequious, laboriously indirect way to say "you" or "you and yours." Snobs and bluestockings will use it, but there's nothing inherently sinister about the expression. The story doesn't end there. Japan has long produced bumper crops of korekuta ("collectors" of rare stamps, cars, etc) and mania (folks with a "mania" for Beatles bootlegs, etc) who gather at conventions to compare notes and stockpiles. Haughty yet insecure, many greet each other by asking, Otaku wa nani o nasatteru desu ka? This fastidious formula for inquiring "What're you into?" or "What's your thing?" became a trademark, prompting trend-watchers to smugly label them otaku-zoku (nerd tribes). Enter Tsutomu Miyazaki, arrested in 1989 and eventually charged with the abduction and murder of four little girls. Here was a man capable of videotaping himself cutting up a dead child and sending her bones, the video, and photos of her sandals and clothes to the victim's parents in a cardboard box. When a search of his premises uncovered an eclectic collection of 5,000 videotapes, the image of otaku as benign, shy dorks disintegrated. Surprise! Japan's police and media, used to playing to the crowd and blandly riding herd on the occasional misfit, discovered during the affluent 1980s that their grip on a population easily tamed by fears of what the neighbors might think was slipping. Popping up all over were intense, asocial creatures on very private missions for very private gods. Shunning contact with all but their brethren in obsession, they sent to o-mawari-san (the neighborhood cops who in Japan regularly "check up" on each household) a silent but clear message: Nothing personal, but what I'm into is the kind of thing you and people like you would never understand. Are otaku garden-variety nerds? Psychopaths? Undesirables? What otaku connotes depends on who you ask. Example: A producer friend recently berated his director on an NHK project for shooting from otaku camera angles. The point? He wanted to make a TV program for general audiences, not film-school coteries. The foreword to the superb but dated (1989) Otaku no hon (The Otaku Book, published by JICC) argues that otaku are strictly a post-1980 phenomenon, not the latest gimmick in the ephemeral parade of zoku (tribes) that postwar youth-culture reportage has served up. Their break with the values of seken (the "real world," as the editor parenthetically labels it in English) is not a byproduct of kodoku (isolation) or seijuku (adolescence). Rather, otaku desire to dokuji no sekai ni chujitsu ni ikiru (live faithfully in their own world) and find a ba (place, outlet) to meet others who onaji genso o kyoyu suru (share the same fantasy). The editor offers the example of the rorikon (otaku with a "Lolita complex"): deeply unwilling to become men (i.e., husbands and salarymen), they partake instead of kyodo genso (communal fantasy) via comic books about kaku no bi-shojo (imaginary beautiful girlchildren). Their female equivalents in ambivalence are the yaoi-zoku, girls hooked on perverted, plotless, sexually explicit parodies of conventional comics about the friendship between cute boys. Obviously neither homosexual nor homophobic, both groups prefer the chaste option of onani (onanism) to the perceived compromises of marital consummation. Otaku no hon presents an amazing variety of strategies for sidestepping the social compact. Even familiar types like hakka ("hackers"), gema ("gamers," computer game freaks), or aidorian ("idol-ians," who fixate on singing idols) seem more over the top than their American counterparts. Others, like kamera-kozo ("li'l camera monks" who sneak crotch shots with concealed strobe cameras) and akushon banda ("action banders" devoted to cracking officially "secure" radio and computer systems), aggressively court risks to enact their pranks. Whatever their stripe, the otaku are out there in droves, rifling through the latest aniparoetchimangadojinshi (animation-parody-pervert-comic-connoisseur-mag) at the corner bookstore, terrified that any minute they'll be eaten alive by common sense. from Pop Japanese, Bill Marsh's ongoing column in MANGAJIN magazine Hope that is useful Dave Ph -------------------------------------------------------------- Dave Phelan dphelan(a)pavilion.co.uk CCIE# 3590 http://freepages.pavilion.net/users/dphelan "Anyone who isn't confused really doesn't understand the situation." -- Edward R. Murrow -- Subcription/unsubscription/info requests: send e-mail with subject of "subscribe", "unsubscribe", or "info" to wear-hard-request(a)haven.org Wear-Hard Mailing List Archive (searchable): http://wearables.ml.org --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

European Commission proposal on legal framework for e-commerce
by Bill Stewart 17 Dec '03

17 Dec '03

Forwarded from cyberia-l -- The EU's latest attempts to make electronic commerce convenient while ensuring tax collection and preventing collapse of governments :-) ========= ==== ]] THe text of the new draft is not on line yet, but will probably appear at ]] http://europa.eu.int/comm/dg15/en/index.htm in the next few days (there is ]] a what's new button on the left hand bar) >>> Should be on line on Nov 23rd } Another URL to remember to get acces to european documents } concerning Internet law is : } http://www2.echo.lu/legal/en/labhome.html and for "what's new : } http://www2.echo.lu/legal/en/labnew.html =============== http://europa.eu.int/rapid/start/cgi/guesten.ksh?p_action.gettxt=gt&doc=IP/… IP/98/999 Brussels, 18 November 1998 Electronic commerce: Commission proposes legal framework A proposal for a Directive to establish a coherent legal framework for the development of electronic commerce within the Single Market has been put forward by the European Commission. The proposed Directive would ensure that information society services benefit from the Single Market principles of free movement of services and freedom of establishment and could provide their services throughout the European Union (EU) if they comply with the law in their country of origin. Such services are defined as those provided normally against remuneration, at a distance, by electronic means and in response to the individual request of a customer. The proposed Directive would establish specific harmonised rules only in those areas strictly necessary to ensure that businesses and citizens could supply and receive information society services throughout the EU, irrespective of frontiers. These areas include definition of where operators are established, electronic contracts, liability of intermediaries, dispute settlement and role of national authorities. In other areas the Directive would build on existing EU instruments which provide for harmonisation or on mutual recognition of national laws. The Directive would apply only to service providers established within the EU and not those established outside. "The Single Market's legal framework, combined with the single currency, provide the European Union with a unique opportunity to facilitate the development of electronic commerce", commented Single Market Commissioner Mario Monti. "Electronic commerce adds a new dimension to the Single Market for consumers in terms of easier access to goods and services of better quality and at lower prices. Electronic commerce will promote trade, stimulate innovation and competitiveness and create sustainable jobs. This proposal should ensure that the Union reaps the full benefits of electronic commerce by boosting consumer confidence and giving operators legal certainty, without excessive red tape." The global electronic commerce market is growing extremely fast and could be worth ECU 200 billion by the year 2000. Worldwide, 86 million people were connected to the Internet by the end of 1996 and by 2000, this is expected to reach 250 million individuals. Within the EU, it is estimated that more than 400,000 jobs related to the information society were created between 1995 and 1997 and that one in four news jobs is derived from these activities. Scope The proposal for a Directive, which was foreseen in the Commission's April 1997 electronic commerce Communication (see IP/97/313), covers all information society services, both business to business and business to consumer services, including services provided free of charge to the recipient e.g. funded by advertising or sponsorship revenue and services allowing for on-line electronic transactions such as interactive teleshopping of goods and services and on-line shopping malls. Examples of sectors and activities covered include on-line newspapers, on-line data-bases, on-line financial services, on-line professional services (such as lawyers, doctors, accountants, estate agents), on-line entertainment services such as video on demand, on-line direct marketing and advertising and services providing access to the World Wide Web. Establishment/supervision/transparency The proposal would define the place of establishment as the place where an operator actually pursues an economic activity through a fixed establishment, irrespective of where websites or servers are situated or where the operator may have a mail box. This definition is in line with the principles established by the EU Treaty (Article 52) and the case law of the European Court of Justice. Such a definition would remove current legal uncertainty and ensure that operators could not evade supervision, as they would be subject to supervision in the Member State where they were established. The proposal would prohibit Member States from imposing special authorisation schemes for information society services which are not applied to the same services provided by other means. It would also require Member States to oblige information society service providers to make available to customers and competent authorities in an easily accessible and permanent form basic information concerning their activities (name, address, e-mail address, trade register number, professional authorisation and membership of professional bodies where applicable, VAT number). On-line contracts For electronic commerce to develop its full potential, it must be possible for contracts to be concluded on-line unrestricted by inappropriate rules (such as a requirement that contracts be drawn up on paper). The proposal would therefore oblige Member States to adjust their national legislation to remove any prohibitions or restrictions on the use of electronic media for concluding contracts. In addition, the proposal would ensure legal security by clarifying in certain cases the moment of conclusion of the contract, whilst fully respecting contractual freedom. These provisions would complement the proposal for a Directive on electronic signatures (see IP/98/423). Liability of intermediaries To facilitate electronic commerce, it is necessary to clarify the responsibility of on-line service providers for transmitting and storing information from third party (i.e. when service providers act as "intermediaries"). To eliminate existing legal uncertainties and to avoid divergent approaches at Member State level, the proposal would establish an exemption from liability for intermediaries where they play a passive role as a "mere conduit" of information from third parties and limit service providers' liability for other "intermediary" activities such as the storage of information. The proposal strikes a careful balance between the different interests involved in order to stimulate co-operation between different parties and so reduce the risk of illegal activity on-line. Commercial communications Commercial communications such as advertising and direct marketing, which are an essential part of most electronic commerce services, would be subject to clearly defined rules under the proposed Directive. The proposal defines what constitutes a commercial communication and makes it subject to certain transparency requirements to ensure consumer confidence and fair trading. In order to allow consumers to react more readily to harmful intrusion, the proposal requires that commercial communications by e-mail are clearly identifiable. In addition, for regulated professions (such as lawyers or accountants), the proposal lays down the general principle that the on-line provision of services is permitted and that national rules on advertising shall not prevent professions from operating Web-sites. However, these would have to respect certain rules of professional ethics which should be reflected in codes of conduct to be drawn up by professional associations. Implementation Rather than inventing new rules, the proposal would seek to ensure that existing EU and national legislation were effectively enforced. The development of a genuine Single Market based on mutual confidence between Member States - is stimulated by strengthening enforcement mechanisms. The proposal would seek to do so by encouraging the development of codes of conduct at EU level, by stimulating administrative co-operation between Member States and by facilitating the setting up of effective, alternative cross-border dispute settlement systems. The proposal would also require Member States to provide for fast, efficient legal redress appropriate to the on-line environment and to ensure that sanctions for violations of the rules established under the Directive were effective, proportionate and dissuasive. Mutual recognition/derogations The proposed Directive would clarify that the Single Market principle of mutual recognition of national laws and the principle of control in the country of origin must be applied to information society services so that such services provided from another Member State are not restricted for reasons falling within the scope of the proposal which would not cover taxation, personal data (the free movement of which is covered by Directive 95/46 see IP/98/925), the activities of notaries, representation and defence of clients before a court, gambling activities. Furthermore, the proposed Directive would not interfere with the application of the Brussels Convention on jurisdiction, recognition and enforcement of judgements in civil and commercial matters and the Rome Convention on the law applicable to contractual obligations. The proposed Directive would also allow Member States on a case by case basis to impose restrictions on information society services supplied from another Member State if necessary to protect the public interest on grounds of protection of minors, the fight against hatred on grounds of race, sex, religion or nationality, public health or security and consumer protection. However, such restrictions would have to be proportionate to their stated objective. Moreover, such restrictions could only be imposed (except in cases of urgency) after: * the Member State where the service provider was established had been asked to take adequate measures and failed to do so and * the intention to impose restrictions had been notified in advance to the Commission and to the Member State where the service provider was established. In cases of urgency, the reasons for the restrictions (and the urgency) would have to be notified in the shortest possible time to the Commission and to the Member State of the service provider. Where the Commission considered proposed or actual restrictions were not justified, Member States would be required to refrain from imposing them or urgently put an end to them. The proposal for a Directive on a legal framework for electronic commerce will be forwarded to the European Parliament and the EU's Council of Ministers for adoption under the co-decision procedure. ==========================================

1 0

Re: open-pgp / s/mime interoperability
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>: there is no reason why you can't have PGP >: messages backed by X.509 certificates, and it is trivial to use S/MIME >: with OpenPGP certificates. I'm planning on writing a short >: informational RFC on how to do it once we all get RFC numbers for our >: respective systems. >open-pgp public keys aren't based on X.509 keys, so I would've thought >s/mime implementation would barf on them. Actually S/MIME *could* support the use of PGP keys, but there's a field (the SubjectKeyIdentifier) missing from the CMS SignerInfo which prevents this. This is rather inconsistent, because the same field is present in the RecipientInfo. I'm currently arguing in favour of adding it to SignerInfo on the basis that any argument against it would also apply to RecipientInfo. Not sure whether it'll work though - a couple of list members seem convinced that exactly the same thing which is currently in RecipientInfo won't work if used in SignerInfo. Peter.

2 1