December 2003 - cypherpunks-legacy

Remailer Technology
by L. Detweiler 17 Dec '03

17 Dec '03

Hello darlings! I was playing with your remailers recently, yesterday in particular, and was a bit disappointed in them for a variety of reasons. I got a list of the current ones from K.Barrus some time ago but even this supposedly up-to-date list had a lot that appeared not to work. Out of ~20 on the list, ~8 sent back a ping message. One kept sending me some strange error. In another test, I sent out an informative posting to a whole bunch of mailing lists recently through some of the remailers. The remailers seem to be very fragile and can be overcome by a huge onslaught of postings. It appears that every new message spawns a new process, and the machines get overloaded and don't have memory left to do anything. Kind of a serious flaw! One could mess them up doing this. Good thing that no one has any malicious feelings toward the cypherpunks or their remailers, or this might have already happened. As a solution to the `spawning' problem, here is a possibility: I am just guessing, but I bet the perl script is grabbing in the message from the incoming socket at the beginning, and then closing the socket, and then going about its business to send the message out. But during this period, new messages can be sent to the now `clear' socket, hence spawning a new process. A solution would be to keep the socket `busy' for the duration of the execution of the perl code. Another solution is to have the messages sent into a buffering script, and something else continuously running in the background to go through the queue to send messages. Finally, I was wondering if anyone else was doing Ping tests on the remailers for run times and whether they post them. If there is interest I would be willing to write a script to automate this process and post the results say every week, so that people can keep abreast of what remailers are active and responsive. If we want a strong infrastructure for all our evil deeds, we have to make sure that it is resilient! Thanks, and please don't flame me for trying *earnestly* to contribute!

2 2

Examples of Digital cash in use
by Aviel David Rubin 17 Dec '03

17 Dec '03

I am compiling a list of places that are actually using digital cash. If anyone knows of current implementations, or of any plans that will probably be implemented, can you please send me the info.? Thanks a lot.

1 0

SunFed protests NSA procurement in High Performance Workstations 2
by gnu 17 Dec '03

17 Dec '03

---------------------------------------------------------------------------- The Florida SunFlash SunNews: SunFed Protest, Sun Foundation Grants SunFLASH Vol 61 #17 January 1994 ------------------------------------------------------------------------------ 61.17.A Subject: SunFed Files Protest with GAO If you have questions regarding this announcement, please contact John Leahy at (703) 204-4818. SUN FEDERAL FILES AGENCY PROTEST WITH THE GOVERNMENT ACCOUNTING OFFICE Company Challenges "Round Two" of the NSA-HPW2 Workstation Procurement VIENNA, Virg. -- January 12, 1994 -- On Jan. 7, Sun Microsystems Federal, Inc., the original awardee of the National Security Agency (NSA) HPW2 (High Performance Workstation) contract, filed a formal protest with the Government Accounting Office (GAO) challenging the rebid of the procurement. It is Sun Federal's contention that the Maryland Procurement Office (MPO) has violated Federal Acquisition Regulations (FAR) by substantially changing the requirements of the original solicitation. The company is asking the GAO to direct the MPO to cancel this solicitation and issue a new specification based on current requirements. Sun Microsystems Federal, Inc., is the leading vendor of open client-server computing solutions to the government. It is a wholly owned subsidiary of Sun Microsystems, Inc., with headquarters in Milpitas, Calif.

1 0

Re: The Packwood Memorial Diary Server
by drzaphod＠brewmeister.xstablu.com 17 Dec '03

17 Dec '03

> Need it be any more secure than the crypto system you would use on your > own harddisk (which could get confiscated)? > > Jim_Miller(a)suite.com Both crypto systems should be as secure as possible; however, if your documents are spinning somewhere in v-space then you've lost one piece of security: The Physical Lock. If any organization DOES find a way to break the code, then they can easily go thru the public archive and read EVERYTHING. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - DrZaphod #Don't Come Any Closer Or I'll Encrypt! - - [AC/DC] / [DnA][HP] #Xcitement thru Technology and Creativity - - [drzaphod(a)brewmeister.xstablu.com] [MindPolice Censored This Bit] - - 50 19 1C F3 5F 34 53 B7 B9 BB 7A 40 37 67 09 5B - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

1 0

Re: Randomness of a bit string
by m5＠vail.tivoli.com 17 Dec '03

17 Dec '03

Jim Thompson writes: > its a joke, you didn't get it, or Ray's bought into > the biggest joke of 2 years hence. No, it was a joke, and I'm just ignorant. Duhh. Thanks to everybody who sent mail and didn't call me an idiot. -- | GOOD TIME FOR MOVIE - GOING ||| Mike McNally <m5(a)tivoli.com> | | TAKE TWA TO CAIRO. ||| Tivoli Systems, Austin, TX: | | (actual fortune cookie) ||| "Like A Little Bit of Semi-Heaven" |

2 1

unsubscribe
by Godzilla's Home Boy 17 Dec '03

17 Dec '03

UNSUBSCRIBE

1 0

remailer multiple paths?
by Mark W. Eichin 17 Dec '03

17 Dec '03

Is there any value to the idea of breaking up a message and sending the parts of it by different "remailer paths" to the ultimate recipient? Shouldn't this reduce the risk of remailer compromise as much or more than simply nesting remailers? You'd need a good way of breaking up the message; if you were encrypting already, it'd probably do well enough to put byte x into message (x mod n) where you're sending n messages. (You could even slice it at the bit level, but that's a little harder to do in a trivial script...) Or would you? is breaking up the message at all good enough, or is it necessary that "nothing of value" can be produced from the pieces? Haven't thought this through, but perhaps others here have. (The concept could even be used with an anonymous pool, sort of a "collect the whole set!" type of reading mechanism...) It could be argued that the various binary.pictures groups are already run this way :-) _Mark_ <eichin(a)paycheck.cygnus.com> ... just me at home ...

2 1

Re: Anonymous Anonymous ftp
by loki＠nately.UCSD.EDU 17 Dec '03

17 Dec '03

:Jim Miller asks for an example: : : :> > - prepaid mailers, good for sending a packet to a :> > destination. With the final address nested insided a :> > series of encrypted packets, no mix along the way can :> > identify Bob without extensive collusion with other :> > mixes. :... :> I understand how you can do 2-way anonymous communication via message :> pools and Penet-style systems, but I don't "get" prepaid mailers. Could :> you post an example showing how two people can converse anonymously via :> prepaid mailers. : :I'll use Lisp-like notation to encapsulate the sending of a packet to :a remailer "Bob." If Alice wishes to send a packet to Bob, she creates :this packet: : :(Bob (more stuff)) : :I'm assuming encryption, which several remailers support and which all :users and all remailers should be using. : :Bob gets this packet, decrypts with his private key and recovers the :"more stuff." He may discover "more stuff" contains some digital money :for his troubles, instructions on how much latency (number of :messages, for example) to use, and where to send the resulting packet. :All kinds of stuff can fit in here. But that's not the point. : :If Alice wanted to send a message to Zeke, through a bunch of :remailers, she might create this initial message: : :(Bob (Charles (Doris (Ed (........ (Zeke (final stuff))))....))) [Lots of stuff removed] : :Well, enough for now. There could be some fatal flaws, but this is the :direction I've been thinking about. Eric Messick and Hugh Daniel had :some ideas about "onions" about a year ago, but I never fully grokked :--Tim May : : : :-- :.......................................................................... :Timothy C. May | Crypto Anarchy: encryption, digital money, This will not work if Yancy is not trustworthy. She could then send the message through a chain of compromised remailers, to create the prepaid mailer packet. This would also happen, though less harmfully, any time the chain hit a bad node. Letting the nodes choose the other nodes is fatal. ---------------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.3 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

2 1

Re: Crypto and 4th A.
by Lee Tien 17 Dec '03

17 Dec '03

Roy: I'm a lawyer, and I've not run across any law review articles that discuss cryptography in relation to privacy or Fourth Amendment rights. The classic treatise on Fourth Amendment search and seizure is by LaFave. I haven't looked at it recently, but it might discuss crypto. One "brute-force" approach to the legal literature is to go to the law library and scan the Index to Legal Periodicals, which is organized by subject as well as author. I don't think you'll find anything under crypto, but you'll find LOTS of stuff about the Fourth Amendment. It'll take time, but by scanning the titles of the articles you'll be able to tell if there's anything about crypto. Some law libraries also have an index of recent articles on CD- ROM, which is easier to search but is typically less comprehensive. Also check under the name Tribe, L. Tribe is the nation's leading constitutional scholar IMHO and at the first Conference on Computers, Freedom and Privacy he gave a talk on "technology and the Constitution." I don't recall his talking about crypto at all, but he did use as an example the cases involving privacy and wiretapping, i.e., Olmstead v. U.S., Katz v. U.S. Katz is the case which set forth the notion of "reasonable expectation of privacy." (REP) Tribe was a Supreme Court clerk who worked on this opinion, I believe. Tribe's one-volume treatise, "American Constitutional Law," briefly discusses constitutional dimensions of privacy law in one section. It is good, but only current up to 1988, as I recall. Having said that, it becomes obvious that you may want to focus on the law of REP and how it intersects with technological change. For instance, advocates of Digital Telephony, Clipper et al often make the argument that "we're only trying to maintain the status quo -- we just want to keep the existing practical balance that comes from most communications being plaintext." Yet in the same discussion -- almost in the same breath -- the same advocates of "maintaining the status quo" will remind you that you have NO REP in such things as your hair fibers, DNA obtained from saliva under a postage stamp, etc., and therefore "we don't need a search warrant." Clearly, forensic technologies have improved greatly over the years, but the law has not consistently followed a "status quo" approach. Law enforcement is better described as having a "ratchet" approach; they want to keep all the gains from improvements in forensic and surveillance technology, but not the losses. (I am indebted to Mike Godwin of EFF for this point, which he made publicly in a panel with an Assistant U.S. Attorney back in January.) BTW, keep in mind that there's an (arguably) crucial difference between the privacy implications of something like hair fiber or DNA forensic analysis and encryption/decryption relative to communications. Analyzing my hair fibers reveals no information about anyone else. With most communications there is a threat to the privacy of more than one person. I'm curious -- what's the thesis or general thrust of your article? I could say more, but that's probably enough for now. We can take this discussion to e-mail rather than the list if Cypherpunks find it too tangential. Lee Tien tien(a)well.sf.ca.us

1 0

No Subject
by nobody＠eli-remailer 17 Dec '03

17 Dec '03

Dear List, Actually what I am looking for is a country like Switzerland or Lichenstein where a numbered(or anonymous) accounts are possible and where confirmation of deposits(wire transfer) can be done to the Internet(note that direct internet connectivity is NOT required) only Email.... Anyone know of Institutions like this(i.e. email addresses for correspondance are needed) Thank you in advance Anon

1 0