December 2003 - cypherpunks-legacy

REMAIL: Changes to chaos and bsu-cs remailers
by Chael Hall 17 Dec '03

17 Dec '03

Today I installed an updated version of the anonymous remailer on the following remailers: nowhere(a)bsu-cs.bsu.edu remailer(a)chaos.bsu.edu Recent changes: "Refuse" addresses now apply to From: lines as well as To: lines When sending from an address that is refused, you will receive a bounce message (only from chaos remailer) stating that remailer access is denied. When sending to an address that is refused, you will receive a bounce message (only from chaos remailer) stating that remailer recipient is illegal. When you forget the recipient address, you will receive a bounce message (only from chaos remailer) stating that a recipient is required. Please note that all bounces will only occur when using the chaos remailer. -- Chael Hall, nowhere(a)chaos.bsu.edu

1 0

Re: cypherpunks meeting in Mt. View last weekend.
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Hi, Strick, It was a pretty good meeting; large crowd. If you don't mind, I'll turn this into an informal meeting report for the list. I missed the first hour or so. Someone said Phil Zimmerman is working on Voice communication systems and wants volunteers. He's trying to do a portable, no-special-sound-cards, widely deployable system, presumably either trading sound quality for flexibility or depending on Internet or V.FAST? Pavel Curtis talked about LambdaMOO and the emerging democracy there - lots of the users are young, and about half are statists and half are Libs or Anarchists of various sorts. About 5000 people have accounts, it runs on a 256-meg Sun Scorpion and really needs even more horsepower. Interesting stuff on the social evolution there, and the lessons the Wizards learned about letting things develop on their own and staying out of the way while the players create stuff. It's largely a discussion world, I gather. About 2/3 of the participants just use telnet (lambda.parc.xerox.com 8888) instead of clients, which limits the ability of people to do fancy stuff with PGP or machine-assisted characters. Most are young (mean age <24, mode 19, mostly .edu, about 25% female.) parcftp.xerox.com for software. Chip Rosenthal talked about Habitat, an early Commodore-64-client+central-world-server system that he helped put out with QLink, which later became America OnLine. In Habitat, you have a graphical user interface, avatars who start out normal-looking but you can customize appearances (e.g. there's a Head Shop.) To fit in a C64/300baud world, they had to think a lot about what objects they needed and what kind of communication really needed to happen; they also found that when you get LOTS of users out there they can think up stuff lots faster than the sysadmins can, a lesson LambdaMOO also learned. (They spent two intensive weeks planning a quest for Something in a Dungeon for the users; the users found it in half an hour.) (Cooperation works *far* better than central planning!) Since it was originally a gaming world, you could get killed or kill other players, and much dissent and discussion about this gradually occurred. Eventually, enough players asked the Wizards to change this that they had a vote. It came out 50-50, of course, so the Wizards decided you couldn't get killed inside the town boundary but could get killed outside, and folks voted with their feet. The town elected a Sheriff (whose gun didn't work in town either.) Various discussions about how people felt about the Wizards having to obey the rules, etc. C64s eventually got old... Habitat ran partly in America and partly, longer, in Japan; Fujitsu bought out the remains and it's gradually coming back as a new Global Cyberspace Project or something like that. New Fujitsu custom hardware supports the current stuff, and there's a 7-layer protocol stack :-(, etc. Arthur Chandler, disguised in a suit :-), talked about BayMOO, where last week's cpunks virtual meeting was. mud.crl.com 8888. Arthur teaches social science of some sort at SFSU; I forget if it's polisci or anthropology or literature, but he's studying the kinds of social interactions that go on in MOOs. BayMOO has a much different balance of statism that LambdaMOO; some Lambdafolk came over to BayMOO and started talking about how neat it was to have Government and how BayMOO should get some, and people politely informed them they were crazy and ignored them. (Hypnocracy was working quite well, for you old folks in the audience :-) In BayMOO, the folks who run it are janitors, not wizards. BayMOO is basically running on borrowed time on crl.com; since they don't charge by the hour for connections, they're not making any money from all the load it's placing on the Sparc2, so it may eventually have to break up, charge money, or find a new home. Anybody have a machine to donate? The Little Garden may be able to lend some bandwidth, if I'm not misremembering John's comment. The fourth speaker was also very interesting, but memory fade is setting in, so I can't tell you who he was or what he said :-) but he was doing some formal modelling of some of the interactions, and I remember it being neat stuff. Oh, well. Somewhere along the line there was a lot of discussion about security, and how much of it needs to be done by the server, who would then need to be trusted (can you *really* trust a Wizard? :-) vs. peer-to-peer by clients. For people who use clients for their MUDs, it may be a lot more effective. Eric Hughes brought up a topic of how to name people across MUDs, which related to this topic and to several others and led to Notable DIsagreements among participants. The basic suggestion was that people should be able to bring names from other environments, e.g. Haakon of Lambda or Blast of BayMOO. While the primary context was simply MUD/MOOs, it touches on issues like global vs. local name spaces, centralized naming authorities and is-a-person (Tim May opposes it for this reason), server vs. client control, reputation servers, guilt-by-association, etc. Someone sensibly pointed out that you could create a Lapel Pin object in a MOO which could by used to provide any identifying information you want for people who want to look at it, and decide whether or not to trust it based on contents, signatures in it, etc. Tim's opposition is largely to the concept of central naming, which leads to government-controlled id trees instead of web-of-trust, and therefore lack of anonymity. (COmments by various on Clinton National Health ID card and Republican Not-An-Immigrant ID card.) Someone commented that you shouldn't really have A public key, you should have a ring of public keys for different things, so people remember that identity is contextual rather than True Name. Another problem is the unsettled question about how reputation servers should work, and whether by bringing an identity from a given group (e.g. LambdaMoo or CypherWonks) you drag along its reputation, as opposed to providing pointers for people to go look at your reputations in various places you hang out. Dinner was at the sushi-on-little-boats place in Mountain View. The group was separated due to lack of contiguous seating, and it became obvious after a ping or two that this was a Token Ring :-) NTP yielded about 65 seconds RTT; a packet containing begin 644 /vmunix was dropped into the bit bucket by one of the servers... Later icecream split into two discussions, one serious and one centered around Don's powerbook with the Rube Goldberg object-oriented mousetrap-making games. Can't tell you about the serious part, but the mousetraps were fun. Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

2 1

unsubscribe
by katz＠spectrum.cs.bucknell.edu 17 Dec '03

17 Dec '03

unsubscribe katz(a)bucknell.edu

1 0

Re: Wide Spread use of PGP
by mdbomber＠w6yx.stanford.edu 17 Dec '03

17 Dec '03

>I find Bob Cain's comments that PGP should not be used on a netcom account >disturbing. I think the priority that should be set is to get people using >PGP, "in the habit" and then make sure they are using it on a local PC or >Mac. > >Some people, believe it or not, might only have acess to a multi-user >systems. These people should not be denied acess to PGP. This is what I do. I connect to the net through SLIP and then use Eudora to retrieve my mail from a DECstation. PGP is secure that way. However, the password to attach to the POP server goes out in plaintext, and was undoubtedly compromised in the packet-sniffing incident we heard so much about. I have been trying to look into alternatives to plaintext passords flying around, but have only confused myself. What is available? Internet: mdbomber(a)w6yx.stanford.edu Matt Bartley GPS: 33 49' xx'' 117 48' xx'' (xx due to SA :-)

3 2

Need a challenge?
by paul＠hawksbill.sprintmrn.com 17 Dec '03

17 Dec '03

I feel like a real slug posting this here, but we have several positions available for network engineers with heavy multiprotocol router background. If you're thick-skinned and competent, willing to relocate and don't mind forging ahead in a new digital forntier, let me know. The job is in the Washington DC area, the pay is substantial. E-mail to: _______________________________________________________________________________ Paul Ferguson US Sprint Enterprise Internet Engineering tel: 703.904.2437 Herndon, Virginia USA internet: paul(a)hawk.sprintmrn.com

2 1

Another clipper editorial
by Jonathan Corbet 17 Dec '03

17 Dec '03

The following appeared as an unsigned editorial in the 2/14 Christian Science Monitor. It lacks the fire of Safire's piece, but it's nice to see anyway. CLIPPING PRIVACY With the rise of electronic mail, public data networks, and cordless and cellular phones has come a rise in devices to encode data to protect the users' privacy. But law enforcement officials worry that these advances will undercut their ability to secretly gather evidence through wiretaps and other surveillance methods. To respond to law enforcement's need, the Clinton administration reportedly is seeking a bill that would require phone and cable companies to use software designed to allow law enforcement agencies to monitor phone and data transmissions. Earlier this month, the administration decided to push federal agencies to include so-called Clipper Chips in computers and phones they use. If that extends to vendors and contractors, the chip may become a de facto industry standard. The chips were designed in conjunction with the National Security Agency to permit unscrambling of coded data transmissions. These moves represent potential dangers to privacy; they take on added urgency with the imminent marriage of computers, phones, and cable services in ways that reduce the diversity of people's means of communication even as they use those means for more activities. No one doubts the need for effective law enforcement. The government, however, should not be in the business of asking manufacturers to build secret backdoors into their equipment, particularly when government holds the keys. The proposals also raise questions as to how appealing United States technology exports will be overseas if such backdoor access is built in. Congress should take a hard look at any bill that tries to expand the government's ability to peer through the electronic blinds, no matter how well-meaning the motive.

1 0

Re: LEAF, SS7
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

With the mail flood here, I've seen pieces of the answer, but no summary. While Clipper and SS7 both give the Wiretappers part of the traffic analysis, Clipper would be much more effective (if it were widely used by Wiretappees.) SS7 is hard to tap, unless you have the phone company's cooperation, somewhat hard even with it, and Async Transfer Mode will be harder. Also, SS7 can only tell you what phone line is being used; Clipper tells you what *phone* is being used, and one of the major wiretap targets for Clipper are cellular phones, which people normally carry around with them - so Clipper traffic analysis can tell you *who* is talking, once a phone's serial number has been identified, not just what pay phone the conversation is from. The two can be used together, if the Wiretappers are both lucky and persistent. One presumes that if ClipperCellPhones are widely used, they'll start keeping records of which cellphone numbers correspond to which ClipperIDs, by wiretapping (or radiotapping) and listening for Clipper. For instance, if they're tapping SS7, and see a phone call from a well known activist's phone number to a recognizeable cellphone company, they can correlate the phone number to find the ClipperID, which makes tapping easier and puts that cellphone on the fun-to-watch list. Paranoidly :-), Bill

1 0

Re: Wide Spread use of PGP
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

I agree with those who disagree with Bob Cain about use of PGP on insecure machines (i.e. machines you yourself don't control.) Yes, it's less secure than using it on a machine you control yourself. But it still gives you *some* security - for instance, if your correspondent is in some country with limited freedom of speech, such as China or Canada, your crossborder conversations are protected. Sure, the NSA will tap them, but as long as they're not tapping netcom's internal networks, and you're dialing in rather than telnetting in from somewhere else (sending your passphrase across the entire internet for the FBI\\\BadGuys to wiretap), you've gained some security. Of course you should use a personal machine with good security on it to discuss overthrowing your current government or trading in politically incorrect substances, like money. But even so, it increases the use and acceptability of encryption, and makes you more accessible for people in other not-sufficiently-free countries. [Note - I'm just picking on netcom because they're a popular service used by hundreds of subscribers. I'm not aware that they're being wiretapped, and I suspect that the legal implications of trying to do so would be interesting. Tapping their Internet connection would be legally easier than tapping their phones, though.] [Blatant Quasi-Commercial Mention: Some 10baseT hub vendors, starting with the AT&T SmartHub but followed by others as well, provide a no-eavesdropping feature, which prevents packets from being sent to incorrect destinations. Unlike bridges and routers, which limit traffic, the SmartHub replaces the data field with 10101010...., which it can do faster and less expensively since there isn't the complication of buffering, etc. One use in a dialup networking environment would be to put the herd of terminal servers and cpus on smart hubs, which limits the damage that can be done if some user breaks a system and starts snooping the net, since he'll only see packets for the machine he's on and not the whole broadcast. Obviously, in a larger environment, routers, etherswitches, etc. can handle more traffic, but the different technologies can be used together.] Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

ITAR vs. Diffie-Hellman Key Exchange?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

In the discussions about people sniffing the net and the need for encrypted telnets, one problem that has come up is the ITAR hassles that make exporting Kerberos politically incorrect, though John Gilmore has gotten them to admit that the Kerberos bones is none of their businesss :-) However, is Diffie-Hellman exportable? After all, it's not crypto, it's *just* key exchange, and people can plug in their own triple-DES from the usual sources. It looks to me like it's probably legal, though if you were to then transmit the password by XORing with the login key or some such probably-unsafe behaviour it might not be. I had heard somebody say there would be an updated RSAREF version including Diffie-Hellman key exchange, though it's not in the package I just ftp'd from rsa.com. Is this correct, and is there a planned release date? Thanks; Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

5 4

re: rEaL wOrLd EnCrYpTiOn
by Mark Hittinger 17 Dec '03

17 Dec '03

> Sandy writes: >I would like to start a new thread. I want to know what the >people on this list intend to do with cryptography in the "real >world." >... >My interest is more than academic. I am one of the Cypherpunks >involved in creating a digital bank. Sandy - In the real world there are already secret banks. There are already forms of untraceable cash and forms of completely fungible money. These techniques are very ancient and time honored. They are well understood. Many of them have stood the test of time and have not been compromised by various incarnations of police states. Given the existence of efficient, accessible, secret, and widely accepted monetary exchange I can't really see the need for a digital bank from the privacy side. I can't really see anyone who uses the current techniques being interested in a new experimental form unless they are techno-junkies. Nevertheless, please continue. Some of us are techno-junkies. It is already well known to privacy fanatics that you should not use credit cards, debit cards, checks, atm cards, or other forms of electronic money. All transactions are logged and are easily analyzed. Astute people cash their pay check at the employer's bank and pay cash for everything. Admittedly, this is somewhat paranoid, but on the other hand it is fun to defeat the monolithic database builders who want to make money off of selling information that belongs to you. Cypherpunks must concentrate on solving problems that are true problems now. Do not spend time creating a variant of an existing/workable/fun solution. Email privacy was a true problem. Clear text on your pc's hard drive was a true problem. Right now there is the well known problem of ethernet sniffers and the trivial security breaches that can occur. A telnet/lat traffic encrypter is needed badly by the Sun/Dec/HP world. Novell needs something badly as well. Cellular phones desperately need something. The masses just have NO IDEA how badly cellular needs something! Fax machines need a variant of PGP. Pagers probably need it too. I think the larger issue that cypherpunks need to blue sky about is wether they will be content with a role as grey-area political criminals underneath the boot of an ever growing police state. Can crypto be more than a defensive weapon? What would people be defending against? Crypto can do some things but it won't be the total solution. In the end we need to strengthen the rights of the little guy and devise ways to dilute any new state powers that are created by technology. Crypto is just one compartment on our batman utility belt. People always argue that criminals would use these tools. I'm certain of it. Strengthening the state's hand to fight criminals always screws the little guy. The criminals all go to work for the state when its powerful enough! We've seen this over and over. --------- I'd like a 250 Mhz 128 bit hybrid processor with 64 meg of 8 way interleaved memory, a 10 megabyte per second i/o channel, two 3 gig hard disks, two dat drives with compression, and a large diet coke. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAiz4FWMAAAEEALBCb7HZS7V4gbsp9yJ7Yty49jQ9wcgRhkLjNNgdyJbrJZCq 5/sv4Ljy/4AhVhjlJyZS8L3owS8l0ClZVzWw4/kO3KN7MPz4YPPR7+qIlPQVM0yv gWpJ43EZZ8b8cvAkE9HATCKWktY2ReRSX5DLnScDH/n5jivw+MD/UO8fURCVAAUR tCBNYXJrIEhpdHRpbmdlciA8YnVnc0BuZXRzeXMuY29tPg== =VbKi -----END PGP PUBLIC KEY BLOCK-----

1 0