December 2003 - cypherpunks-legacy

Re: fwd Canadian gov't eavesdropping
by nobody＠qwerty.org 17 Dec '03

17 Dec '03

Mike Markley say, "I'd be curious to see how they are going to do voice recognition on random conversations. Unless I am very sadly out of date you need to teach the pattern matcher individual voices." But of course they will just collect voice samples from everyone soon, and use them to IDENTIFY you. It'll probably be put on our US national health care cards. Ever since I started worrying about leaving DNA on postage stamps, I've started to think what can be done will be done. -Xenon

1 0

Josh Quittner's Newsday column on Cypherpunks
by gnu 17 Dec '03

17 Dec '03

Date: Wed, 02 Feb 1994 10:41:42 est From: "josh quittner" <quit(a)newsday.com> To: gnu(a)cygnus.com Subject: newsday column Hiya John: Here's the little column I did for my newspaper on the cypherpunks meeting I sat in on last month. Thought you might be interested. I know it's laymanlike, but if you want, you have my permission to distribute it to your list. I told Eric I'd send him a copy, but I left his email address at home, so if you'd be good enough, would you either pass this on to him or email me his address so I can? Thanks. Hope all is well with you. Be glad you're not freezing your ass off back here. Regards, -jq PUBLICATION DATE Tuesday. February 1, 1994 EDITION NASSAU AND SUFFOLK SECTION DISCOVERY PAGE 53 OTHER EDITIONS 59 C HEADLINE Life In Cyberspace COMPUTERS IN THE ^90s Coding Up a Bit of Privacy BYLINE Joshua Quittner DATELINE MOUNTAIN VIEW, Calif. LENGTH 91 Lines MOUNTAIN VIEW, Calif. THIS MUST BE HOW the Founding Fathers looked when they hacked out the Constitution: A roomful of young men, mostly - frazzled hair, eager eyes, wild beards, arms flailing and fingers jabbing the air, reaching for big ideas. You can't help but feel it; urgency tempers their voices. The earnest men plan and argue in this corporate conference room as the last sun rays of a winter Saturday afternoon fade in through a skylight. Time is running out for the Cypherpunks. There is much work to be done before the information highway arrives. The information highway - that 500-channel shopping mall / cineplex championed by cable and telephone companies - is a noxious concept to the people in this room. They are not technophobes or Luddites, these Cypherpunks. Instead, they are a collection of clever computer programers, engineers and wire heads from some of the nation's best-known Silicon Valley software houses and hardware shops. This is their central question: In a future world where all information is centralized on a network, where all information is tracked by the bit, where every purchase you make and every communication can be monitored by corporate America, how does privacy survive? If you go to a bookstore now and buy a book, you can pay in cash. No one knows your name or what you purchased. "What happens to cash transactions on the information highway?" they ask. The Cypherpunks believe that they can preserve your privacy through good cyphers, or codes. But they must hurry, must get their codes out and their networks up and running. "The whole information highway thing is now part of the public eye," explains Eric Hughes, a founder of the Cypherpunk movement. "If we don't change it now, it'll be impossible later." The Cypherpunks know what technology is capable of. We visit them today because they represent one edge of the national debate on the structure of the information highway. And as we all know, extreme positions help define the middle. Many of the Cypherpunks have been heavy Internet users for years and hope to preserve the communal spirit of that freewheeling world of interconnected computer networks. They dread the coming commercial network of televisions and computers, saying it will displace the Internet and destroy many of the freedoms they now enjoy. So the Cypherpunks, with the kind of zeal they professionally bring to marathon, 72-hour sessions hacking computer code, are plotting to keep free networks alive. That's "free" in the sense of unfettered, unmonitored, uncensored. One way they're going about it is by spreading easy-to-use, cheap cryptography. Cryptography is the science of keeping two-way communication private. Computers, it turns out, are revolutionary cryptographic tools, able to encode and decode files quickly. For the first time, virtually unbreakable codes are now possible, thanks to computers. The Cypherpunks post cryptographic software on the Internet where anyone can access it, and can encode their communications, including electronic mail, pictures and video. But the U.S. government is concerned, as governments always are, about the spread of powerful cryptography (terrorists could use it, kidnapers could use it, drug dealers could use it, all of them on cellular phones that encode conversations). It currently is pushing its own commercial cryptographic standard, through a special chip known as the Clipper. The chip is reviled by Cypherpunks and other civil libertarians because it provides a back door that law-enforcement agencies could enter, with the proper warrants, for surveillance. By getting good, unbreakable cryptography out there now, the Cypherpunks hope, whatever the government finally decides will be moot. Software has a wonderful property, the Cypherpunks are fond of saying: Once it's created, it can never be destroyed. It can be copied infinitely, from computer to computer, spreading like a secret. Come what may, unbreakable Cypherpunk code, and Cypherpunk networks, will be out there forever, they hope. But just to be safe, the Cypherpunks are toying with different network-related plans to create an economy of "digicash" - network money that, like the dollars in your pocket, isn't tied to a user's credit cards or other personal identification. Digicash will help pay for Cypherpunk networks and will allow people to purchase goods without revealing their identity. "I'm starting a bank, and it's not going to be a U.S. bank," Hughes says. He's standing at the whiteboard now. A strawberry-blond ponytail dangles down his back and he grasps a magic marker in his hand. "We have several long-term strategies, one of which is the elimination of central banks." He tells the assembled crowd what they already know. Heads nod. Some people take notes. Hughes is a self-employed programer in Berkeley. His hand flies across the whiteboard, sketching out a schematic diagram, showing how his bank will operate. The bank will store depositers^ money (he's thinking a $200 minimum deposit) and disburse payments to anyone - all over the Internet. It will be based abroad, maybe in Mexico. A Cypherpunk network bank is one way to pay for a network of truly encrypted, private communications, you see. "Is this going to lead the way to portable laptop ATM machines?" someone asks in the back. People snicker. "Have you thought about its name?" someone else asks. "First Bank of Cyberspace!" yells one person. "First Internet Bank!" yells another. "The Nth National Bank!" Laughter. Billy goat beards bob. There is much work to be done. --end of story-- -- josh quittner vox: 516-843-2806 fax: 516-843-2873 quit(a)newsday.com

1 0

unsubscribe wjm@mit.edu
by wjm＠MIT.EDU 17 Dec '03

17 Dec '03

unsubscribe wjm(a)mit.edu

1 0

Re: New Remailer Up.
by nobody＠qwerty.org 17 Dec '03

17 Dec '03

Jon Boone wrote, " Is the sendmail (I assume you are using sendmail for SMTP services) daemon set up so that it *doesn't* log to /usr/spool/mqueue/syslog [or any other syslog facility]? Otherwise, it may well be possible to track the usage of the remailer through browsing the syslog logs. This is one of the problems (it seems to me) with using a remailer and *not* having root access. Unless you can convince your sysadmin to remove the syslog mechanism that sendmail uses, you may be exposing your users (presumably by accident)." No, fortunately for other users, I do not have root access on Netcom ;-). So who is going to be doing this browsing? Other Netcom users can't read the mqueue: qwerty: cd /usr/spool qwerty: ls cron lpd.lock news news4 uucp locks mail news2 rwho uucppublic lpd mqueue news3 secretmail uumaps qwerty: cd mqueue mqueue: Permission denied qwerty: ls -la total 480 drwxr-sr-x 15 bin 512 Feb 2 01:38 . drwxr-xr-x 13 root 512 Feb 2 01:38 .. drwxr-sr-x 4 root 512 Feb 2 01:38 cron drwxr-sr-x 2 uucp 512 Feb 2 08:30 locks drwxrwsr-x 2 daemon 512 Feb 2 03:47 lpd -rw-r--r-- 1 root 4 Feb 2 01:38 lpd.lock drwxrwsrwt 4 root 430080 Feb 2 08:37 mail drwxr-s--- 2 root 18944 Feb 2 08:37 mqueue drwxr-xr-x284 netnews 12288 Feb 2 05:29 news drwxr-sr-x 2 netnews 512 Aug 28 17:03 news2 drwxr-sr-x 2 netnews 512 Aug 28 17:03 news3 drwxr-sr-x 2 netnews 512 Jan 16 19:56 news4 drwxr-sr-x 2 root 512 Jan 31 14:40 rwho drwxrwsrwx 2 bin 512 Nov 3 08:49 secretmail drwxr-sr-x 11 uucp 512 Feb 2 01:38 uucp lrwxrwxrwx 1 root 20 Nov 26 15:48 uucppublic -> /usr/hack/uucppublic drwxrwxr-x 5 netnews 12288 Feb 2 05:48 uumaps "Is the sendmail (I assume you are using sendmail for SMTP services) daemon set up so that it *doesn't* log to /usr/spool/mqueue/syslog [or any other syslog facility]? Otherwise, it may well be possible to track the usage of the remailer through browsing the syslog logs." I'm using Hal's remailer, so ask him the details of what I have running. How many of those private sites with remailers having root, keep NO personal logs? Any? I would like to compile a more detailed listing of the details about each remailer's capabilities, situation, and policy statements. If someone sends anonymous mail through my mailer victimizing someone in a criminal manner, and law enforcement convinces Netcom to check the logs, then more power to them. If someone sends mail discussing large doses of vitamin C, when vitamin supplementys are banned a year from now, and the FDA wants to arrest them, and Netcom allows them to see the mqueue then that would be unfortunate indeed. I am running a remailer. Here is the situation. What more can I offer? I would ask people to look at the various remailers and ask in a street smart practical manner what the pros and cons of each one is. What, exactly, does the mqueue record? How long does it get saved? I needed remailers to maintain some simple privacy by distancing myself from the character Xenon. No 5AM fone calls and letters from people asking me to send them PGP.... I figured if I was going to become the largest volume user of the remailers, I should become a remailer myself. The other option was to use the Netcom account to directly mail out what I am sending to people, but that wasn't as fun of an idea. -Xenon

2 1

digital signatures/copyright
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A question for Mike Godwin and other attorneys on the list: Could one make a case that the use of Digital signatures in messages imply's copyright retention by the author? Does digital signature=copyright or is it at least equivalent? Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced comunication is indistinguishable from noise." --Steve Witham -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLU/2HdCcBnAsu2t1AQF15gP+IqS3o0gNeHng9BSqlk95KzmPwp3oo70p j2FVYHNOeUKgDSAAwvWr+p3/DOwTafSkJf4A5gW33NOKr0E9JZ4In349RAoueTku J94VMajT4i7yhOC8X41RPkVLlCltPDRo04SS8h5UFnEk/zFxiTkvXY9mpBcK3yUw vYY9pbmupSc= =KbXS -----END PGP SIGNATURE-----

2 1

New US keyserver now fully operational - pgp-public-keys@io.com
by pgpkeys＠wasabi.io.com 17 Dec '03

17 Dec '03

The US-based keyserver 'pgp-public-keys(a)io.com' is now open to the public. Come one, come all! Here is the current file as returned by 'Subject: help'. This site is a PGP key server SLAVE site. It behaves very similarly to the European PGP master sites, but there are a few small differences which will be noted below. The most noticable difference is that it answers your requests immediately instead of waiting for a daily batch job to run :-) The particular installation at io.com does *not* log the details of requests for keys, however the fact that you have sent mail to the key server at all is logged in the daily sendmail logs. These logs will be erased automatically after one week. PGP Public Keyservers --------------------- There are PGP public key servers which allow one to exchange public keys running through the Internet and UUCP mail systems. This service is NOT supported in any way whatsoever by the schools or organizations on which these servers run. It is here only to help transfer keys between PGP users. It does NOT attempt to guarantee that a key is a valid key; use the signators on a key for that kind of security. This service can be discontinued at any time without prior notification. Each keyserver processes requests in the form of mail messages. The commands for the server are entered on the Subject: line. To: pgp-public-keys(a)io.com From: johndoe(a)some.site.edu Subject: help Sending your key to ONE server is enough. After it processes your key, it will forward your add request to other servers automagically. For example, to add your key to the keyserver, or to update your key if it is already there, send a message similar to the following to any server: To: pgp-public-keys(a)io.com From: johndoe(a)some.site.edu Subject: add -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.2 <blah blah blah> -----END PGP PUBLIC KEY BLOCK----- COMPROMISED KEYS: Create a Key Revocation Certificate (read the PGP docs on how to do that) and mail your key to the server once again, with the ADD command. Valid commands are: Command Message body contains ---------------------- ------------------------------------------------- ADD Your PGP public key (key to add is body of msg) *** Note: your update is forwarded to a master server and may take a few days to reappear INDEX List all PGP keys the server knows about (-kv) VERBOSE INDEX List all PGP keys, verbose format (-kvv) GET Get the whole public key ring GET 0xA1B2C3 Get a single key by Key ID *** Note: the master servers allow you to omit the 0x in front of the Key ID. The slave servers do not. GET userid Get a single key by User ID MGET substr List all keys which match "substr" *** Note: this is different from the master servers which return the keys themselves, not just a listing of their Key IDs. Also the master servers accept a wild-card expression; at the moment we do not. LAST days Get the keys updated in the last `days' days *** Note: not yet implemented ------------------------------------------------------------------------ Examples for the MGET command: MGET michael Lists all keys which have "michael" in them MGET @iastate.edu Lists all keys which contain "@iastate.edu" Check the Usenet newsgroup alt.security.pgp for updates to this system and for new sites. Based on a document originally by Michael <explorer(a)iastate.edu>

2 1

No Subject
by bob＠USCWS4.gat.com 17 Dec '03

17 Dec '03

unsubscribe bob(a)USCWS4.gat.com

1 0

Re: New Remailer Up.
by nobody＠qwerty.org 17 Dec '03

17 Dec '03

Jon wrote, " Aside from traffic obscuring random messages, a forced, random delay and a medium sized load of traffic seem to be the best ways to defeat the use ..." How LONG should the such a random delay BE, at max? I am not willing to add more than 10-15 minutes, max. Is this worth it then? Hours is just too primitive when it comes to electronic communications. Even minutes! -Xenon

1 0

test
by Joseph Reagle Jr. 17 Dec '03

17 Dec '03

Regards, Joseph M. Reagle Jr. | reagle(a)umbc.edu | It's celluar peptide cake with mint frosting! jreagl1(a)umbc8.umbc.edu | -- Worf

1 0

Re: digital signatures/copyright
by smb＠research.att.com 17 Dec '03

17 Dec '03

It's worth noting that U.S. copyright law makes explicit provision for copyrighting anonymous works.

1 0