December 2003 - cypherpunks-legacy

Anonymity Offense
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Cypherdudes, Hal noted: >As Tim says, it is no secret on this list that the remailers are not >presently secure. I posted a long message a few months ago outlining >possible attacks on the remailers. It's worth noting that Karl Barrus' >remailer does batch up messages and send them out once a day. If enough >people use it that will help mix them up. There is still the message size >to match them up, though (and, believe it or not, the Subject:line!). >The traffic volume problem should be solved by having a source of random >messages which traverse the network, mixing in with user messages. This >will help, but you still have the problem that only user messages will leave >the network. The most bogus problem of the remailer system is lack of traffic. I mean how many messages go thru a given remailer a day? 1? 10? 100? This makes it pitifully easy to track messages. Padding them to the same size helps but if you have to track ten messages around (even though the problem becomes more egregious at each site) so what. Queing is a drag if you have to wait a day to get enough mail to send out. If I wanted it to take that long I'd send it snail mail. More traffic = shorter que time needed to make things a bummer for trackers. Random traversing messages are a reasonable temporary solution but Remailer publicity (thus, more traffic) is an important part of getting better anonymity going. Tell your friends, send all your punk postings thru at least one remailer (that will put some traffic through them!). This method is a passive one, how can we subvert the system now in place to make traffic more invisible? >The biggest problem is that many remailers are on unsecure systems. The PGP >keys and passwords for these remailers are on the disk IN THE CLEAR. Anyone >who can get privileges on these systems (many hackers, these days, not to >mention the NSA) can get the remailer's keys and decrypt any messages sent >to those remailers. Karl's monthly posting shows which remailers are on >private machines; those are the only ones which have any hope of being secure >against the NSA. If you believe this you've already seceded the battle to the NSA. Formidable opponents != Defeat. Great respect for NSA ability is neccesary but independent minds (especially working together) can exhibit Davidian qualities. Exactly, how is tracking done? I've heard the general issues of file size and physical compromise but what programs and access codes are needed to obtain such info? How does one access SMTP mail channels, sendmail ques and mail logs? How can we subvert their attempts? Can we use the known router algorithms and network bookkeeping methods at hop sites to disguise where messages are traveling? I guess what I'm saying is can we use the complexities of the system itself, rather than our own system alone to make traffic analysis a drag. We know the weakness of our system, what are the weaknesses of the analyzers systems. What are the possibilities for an analyzers systems, how do we attack them? I'll start by looking at various RFC's but a little offense rather than defense can only make us more aware. Even if it doesn't seem possible for goliath to lose. I think today I'll be: Stranger

1 0

CFS (was Re: Will Mike Ingle's name be a household word like "Buttafuoco"?)
by Matt Blaze 17 Dec '03

17 Dec '03

In cypherpunks Perry Metzger write: ... >There is also cypherpunk Matt Blaze's "CFS" filesystem for unix >machines, which is very powerful but unfortunately unreleased to the >public, ... With any luck, and barring unforseen lawyerly problems, CFS should be released (at least within the US) by around Xmas. The upside is that it's been made considerably stronger (cryptographically speaking) than the version in the paper, and I now believe it's roughly as strong as three runs of the underlying cipher (DES in this case) but with greatly reduced latency. Stay tuned... -matt

1 0

Cyberspatial Bill of Rights
by L. Detweiler 17 Dec '03

17 Dec '03

Of interest to some... ===cut=here=== Date: 04 Dec 93 14:20:40 EST From: Marty Winter <76407.3521(a)compuserve.com> To: "SEA.LIST" <sea-list(a)panix.com> Subject: Electronic Bill of Rights Courtesy Friends & Lovers BBS, Selkirk, NY Posted with the permission of Frank Connolly of The American University. Information on how to contact him is at the end of this document. ++++++++++++++++++ The following document might be of interest... Called the Bill of Rights and Responsibilities for Electronic Learners, it is a model policy statement regarding the rights and responsibilities of individuals and institutions regarding computers and electronic networks in education. Although the project was begun as part of EDUCOM, it is now an initiative of the American Association of Higher Education (AAHE). Your comments and suggestions for gaining consideration and discussion of the Bill on campuses, in school districts and professional forums would be appreciated. =============== TEXT OF BILL FOLLOWS =========================== PREAMBLE In order to protect the rights and recognize the responsibilities of individuals and institutions, we, the members of the educational community, propose this Bill of Rights and Responsibilities for the Electronic Community of Learners. These principles are based on a recognition that the electronic community is a complex subsystem of the educational community founded on the values espoused by that community. As new technology modifies the system and further empowers individuals, new values and responsibilities will change this culture. As technology assumes an integral role in education and lifelong learning, technological empowerment of individuals and organizations becomes a requirement and right for students, faculty, staff, and institutions, bringing with it new levels of responsibility that individuals and institutions have to themselves and to other members of the educational community. ARTICLE I: INDIVIDUAL RIGHTS The original Bill of Rights explicitly recognized that all individuals have certain fundamental rights as members of the national community. In the same way, the citizens of the electronic community of learners have fundamental rights that empower them. Section 1. A citizen's access to computing and information resources shall not be denied or removed without just cause. Section 2. The right to access includes the right to appropriate training and tools required to effect access. Section 3. All citizens shall have the right to be informed about personal information that is being and has been collected about them, and have the right to review and correct that information,. Personal information about a citizen shall not be used for other than the expressed purpose of its collection without the explicit permission of that citizen. Section 4. The constitutional concept of freedom of speech applies to citizens of electronic communities. Section 5. All citizens of the electronic community of learners have ownership rights over their own intellectual works. ARTICLE II: INDIVIDUAL RESPONSIBILITIES Just as certain rights are given to each citizen of the electronic community of learners, each citizen is held accountable for his or her actions. The interplay of rights and responsibilities within each individual and within the community engenders the trust and intellectual freedom that form the heart of our society. This trust and freedom are grounded on each person's developing the skills necessary to be an active and contributing citizen of the electronic community. These skills include an awareness and knowledge about information technology and the uses of information and an understanding of the roles in the electronic community of learners. Section 1. It shall be each citizen's personal responsibility to actively pursue needed resources: to recognize when information is needed, and to be able to find, evaluate, and effectively use information. Section 2. It shall be each citizen's personal responsibility to recognize (attribute) and honor the intellectual property of others. Section 3. Since the electronic community of learners is based upon the integrity and authenticity of information, it shall be each citizen's personal responsibility to be aware of the potential for and possible effects of manipulating electronic information: to understand the fungible nature of electronic information; and to verify the integrity and authenticity, and assure the security of information that he or she compiles or uses. Section 4. Each citizen, as a member of the electronic community of learners, is responsible to all other citizens in that community: to respect and value the rights of privacy for all; to recognize and respect the diversity of the population and opinion in the community; to behave ethically; and to comply with legal restrictions regarding the use of information resources. Section 5. Each citizen, as a member of the electronic community of learners, is responsible to the community as a whole to understand what information technology resources are available, to recognize that the members of the community share them, and to refrain from acts that waste resources or prevent others from using them. ARTICLE III: RIGHTS OF EDUCATIONAL INSTITUTIONS Educational institutions have legal standing similar to that of individuals. Our society depends upon educational institutions to educate our citizens and advance the development of knowledge. However, in order to survive, educational institutions must attract financial and human resources. Therefore, society must grant these institutions the rights to the electronic resources and information necessary to accomplish their goals. Section 1. The access of an educational institutions to computing and information resources shall not be denied or removed without just cause. Section 2. Educational institutions in the electronic community of learners have ownership rights over the intellectual works they create. Section 3. Each educational institution has the authority to allocate resources in accordance with its unique institutional mission. ARTICLE IV: INSTITUTIONAL RESPONSIBILITIES Just as certain rights are assured to educational institutions in the electronic community of learners, so too each is held accountable for the appropriate exercise of those rights to foster the values of society and to carry out each institution's mission. This interplay of rights and responsibilities within the community fosters the creation and maintenance of an environment wherein trust and intellectual freedom are the foundation for individual and institutional growth and success. Section 1. The institutional members of the electronic community of learners have a responsibility to provide all members of their community with legally acquired computer resources (hardware, software, networks, data bases, etc.) in all instances where access to or use of the resources is an integral part of active participation in the electronic community of learners. Section 2. Institutions have a responsibility to develop, implement, and maintain security procedures to insure the integrity of individual and institutional files. Section 3. The institution shall treat electronically stored information as confidential. The institution shall treat all personal files as confidential, examining or disclosing the contents only when authorized by the owner of the information, approved by the appropriate institutional official, or required by local, state or federal law. Section 4. Institutions in the electronic community of learners shall train and support faculty, staff, and students to effectively use information technology. Training includes skills to use the resources, to be aware of the existence of data repositories and techniques for using them, and to understand the ethical and legal uses of the resources. August, 1993 * Frank Connolly The American University * * FRANK(a)American.EDU 119 Clark Hall * * (202) 885-3164 Washington, D.C 20016 *

1 0

Review of Crypto-Rebels in Cryptologia
by smo＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

In the October issue of Cryptologia, Louis Kruh reviews the "Crypto Rebels" article by Stephen Levy that appeared in Wired. Shawn smo(a)gnu.ai.mit.edu Article liberated without permission. ---------------------------------------------------------------------- Cryptologia. Vol. XV11, Number 4 (October 1993) >From the column "Reviews and Things Cryptologic" by Louis Kruh. Crypto Rebels Write-Up [Wired 1.2] Wired is a new magazine aimed at the "Digital Generation." The cover story in its second issue examines the growing "Cypherpunk" movement to insure individual privacy. According to the author, Cypherpunks believe that all information about an individual belongs to that person and opinions, medical records, personal data collected by local, state or national governmental agencies, communications sent by the individual or any other information should be available only if the person involved chooses to reveal it. And the means through which this privacy would be maintained is by the widespread use of virtually unbreakable public-key cryptography. Opposing forces are U.S. government agencies who seek to insure their ability to read public-key encrypted messages by the continuance of electronic surveillance and by having access to public-key cryptography's secret keys when authorized by a judge. The author suggests that the government cryptologic monopoly was destroyed in 1975 when Whitfield Diffie created public-key cryptography. His later work with Martin Hellman is recounted along with the implementation of the Diffie-Hellman system by three MIT computer scientists who founded RSA Data Security to market their patented algorithms. A well known figure in academic crypto circles, Georgetown Professor Dorothy Denning, counters Cypherpunk beliefs by pointing out that "Organized Crime leaders, drug dealers, terrorists, and other criminals could conspire and act with impunity" if electronic surveillance was illegal and authorized agencies did not have access to private keys used in public-key cryptography. The article explores many views and contains a great deal of fascinating information. ----------------------------------------------------------------------

1 0

Re: The Darkness of Hell
by Black Unicorn 17 Dec '03

17 Dec '03

You know, your article would have been excellent without the typical anti-drug rhetoric. It almost seemed like you were just using the medusa analogy to make cypherpunks the proper forum for your rant. The war on drugs in the United States (which I become more and more hesitant about capitalizing) is the single most effective weapon against privacy today. You really need to seek attention elsewhere. Too bad Melody didn't get some better acid. She'd have saved us all a lot of trouble. Arguement for legalization if you ask me. -uni- (Dark)

1 0

Re: Escobar and Cellular Ph0n3z
by Black Unicorn 17 Dec '03

17 Dec '03

I'm not sure about your speculation that the NSA provided the equipment. I have a feeling that it was a third party vendor actually. When cellular was just beginning to be used the FBI came up with a similar box. As I recall it just waitied for certain selected ESN's to go active and then listened to every call they made and/or received. Of course you had to be within range of the car or the cell it was using. The article on the box was in the Chicago Trib. I'll see if I can find it, but I sort of doubt it as I can't really nail down the year in my head. I'll try a nexis search. In any case, the article was boosting third partys and their contrubution to the war on drugs. I might add however, that the equipment did not triangulate. -uni- (Dark)

1 0

Anonymity Offense
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

FYI, here is the number of remailed messages passing through my remailer for the past couple of months. The first number is the number of messages on that day, and the remainder of the line is the date. 2 Sun Oct 3 3 Mon Oct 4 8 Wed Oct 6 1 Thu Oct 7 3 Fri Oct 8 1 Sun Oct 10 1 Tue Oct 12 1 Thu Oct 14 1 Fri Oct 15 2 Mon Oct 18 8 Tue Oct 19 1 Wed Oct 20 3 Thu Oct 21 2 Fri Oct 22 1 Sat Oct 23 1 Sun Oct 24 5 Mon Oct 25 3 Tue Oct 26 9 Wed Oct 27 5 Sat Oct 30 2 Wed Nov 3 3 Thu Nov 4 1 Fri Nov 5 8 Sat Nov 6 1 Sun Nov 7 9 Mon Nov 8 3 Tue Nov 9 10 Wed Nov 10 7 Thu Nov 11 4 Fri Nov 12 1 Sat Nov 13 7 Sun Nov 14 4 Mon Nov 15 5 Tue Nov 16 6 Wed Nov 17 26 Thu Nov 18 1 Fri Nov 19 9 Sat Nov 20 6 Sun Nov 21 2 Mon Nov 22 4 Wed Nov 24 16 Fri Nov 26 10 Sat Nov 27 54 Sun Nov 28 37 Mon Nov 29 36 Tue Nov 30 33 Wed Dec 1 18 Thu Dec 2 19 Fri Dec 3 18 Sat Dec 4 Here is the corresponding table for just encrypted messages. These are included in the counts above. 2 Sun Oct 3 3 Mon Oct 4 2 Wed Oct 6 1 Thu Oct 7 1 Fri Oct 8 1 Thu Oct 14 1 Tue Oct 19 1 Wed Oct 20 3 Thu Oct 21 1 Fri Oct 22 3 Sat Oct 23 1 Sun Oct 24 5 Mon Oct 25 3 Tue Oct 26 9 Wed Oct 27 4 Sat Oct 30 1 Wed Nov 3 1 Fri Nov 5 3 Sat Nov 6 3 Mon Nov 8 2 Tue Nov 9 4 Wed Nov 10 2 Thu Nov 11 1 Fri Nov 12 1 Sat Nov 13 1 Mon Nov 15 1 Tue Nov 16 13 Thu Nov 18 4 Sat Nov 20 3 Sun Nov 21 2 Wed Nov 24 1 Thu Nov 25 8 Fri Nov 26 6 Sat Nov 27 20 Sun Nov 28 22 Mon Nov 29 20 Tue Nov 30 23 Wed Dec 1 11 Thu Dec 2 5 Fri Dec 3 4 Sat Dec 4

1 0

Re: Escobar and Cellular Ph0n3z
by Andrew Loewenstern 17 Dec '03

17 Dec '03

lex(a)mindvox.phantom.com (Lex Luthor) writes: > This is sophisticated, no question about it. I imagine the > equipment/circuits are available to do all this to the general > U.S. public, but still, I think the NSA probably provided the > equipment as it was probably all integrated together and fairly > idiot-proof to use. Maybe one big box, with a few of these big > boxes being dispersed about the country-side. The FBI used the same stuff a couple of years back to catch the people who kidnapped that Exxon executive. Considering how easy it is to pick up cellular transmissions and the way it works (cells with limited range), I believe it is something well within the resources of the FBI to develop. I really don't think the NSA has much of a hand in any of the things we hear about, unless it has something directly to do with crypto (which this does not, except, as Lex pointed out, that escobar probably should have been using strong crypto...). andrew

1 0

Re: Will I be on a wanted poster?
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> > In my opinion, this is the best example yet since PGP of "cypherpunks > > writing code" because of the implications that this program has > > on privacy. (I'm using it to keep a personal space for my tax > > records, private correspondence, PGP dir, etc.), but Mike's > > suggestion for encrypting an entire BBS itself is a good point. > > What if *every* sysop encrypted their BBS with Secure Drive? > > No more Steve Jackson Games cases. I hope this happens. Computer > theft and unreasonable seizure is a real problem. As far as I know, a system like SecureDrive, KFS, or CFS, is really only as secure as the running machine is. Generally, when a BBS is 'seized' (forfeited? ;), it is running when the feds get there. Right now, if they have any clue (and from what I hear, the FBI has much more of a clue than the SS when it comes to this type of investigation), they usually take pictures of the setup to make sure they can put the machine back together when they get it to wherever they are taking it to. If encrypting file-systems become a problem, a disk could be developed (probably pretty easily) to retrieve the key from memory before they power it down. andrew "Touch that keyboard and die!!"

1 0

Pablo and NSA
by Black Unicorn 17 Dec '03

17 Dec '03

Ok, so I take it back. +++ From: theprez(a)whitehouse.gov.com Subject: WE ARE INDEED WATCHING ! Lines: 10 Organization: University of Zurich, Department of Computer Science X-Newsreader: IBM NewsReader/2 v1.00 Date: Fri Dec 03 09:03:21 EST 1993 NEUTERS - Botoga 3.12.93 Police and military officials announced yesterday that they had help from American National Security Agency officials in tracking down Pablo Escobar. The NSA provided Columbian officials with the tools necessary to decipher communication between the Columbian drug lord and his cohorts. Escobar had been communicating by computer using the American Pretty Good Privacy (PGP) software product which was compromised by NSA officials working at a remote listening station in the Columbian jungle. +++ Haw Haw Haw. -uni- (Dark)

1 0