December 2003 - cypherpunks-legacy

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Perry Metzger wrote, "Tapping Netcom's net connections would take more than $20 of effort. Up it to $50,000 and I'll happily take on your offer. However, I am going to need assurances that the money will actually be paid." This is exactly the point I was trying to make. I wanted the word "trivial" to be clarified by those who were being so vocal about dismissing a remailer on Netcom. You'll also need a good lawyer when Netcom finds your tap ;-). But I'm sure some skilled hacker will be able to tell me the site and I'll happily be out $20, in say, a couple days? No use hacking my password, as I keep no logs (for now). The reason it's only $20, is that I am indeed honestly interested in knowing something about my remailer's security, and I don't know enough internet/Unix to risk being a total sucker. -Xenon

2 1

Re: SASE Suggestion
by loki＠nately.UCSD.EDU 17 Dec '03

17 Dec '03

:Lance Cottrell writes: : :> I have been meditating on this problem of return :> addresses, and have a proposal. The remailers :> can not be allowed to choose the return path, :> as any corrupted remailer will corrupt the rest :> of the path. : Jim Miller writes: :As I understand it, the remailers don't "chose" the return path, Bob (the :sender of the original message) choses the return path when he creates the :SASE. All the remailers do is interpret the part of the SASE that becomes :readable to them after decrypting the SASE portion sent to them from the :previous hop. If all is working, what becomes readable is the address of :the next hop (closer to Bob) and some misc other stuff (postage, maybe, :and perhaps another encryption key). : :Am I not understanding something correctly? : :Jim_Miller@suite.com : One SASE scheme recently suggested involved sending a request for a SASE to a ramailer, stating the number of jumps required. It then sent it to another remailer, and so on. Each adding a layer, and eventually sending the results to the desired correspondent. I mentioned that if the first remailer was corrupted, that the whole chain was (it would only send to other corrupt remailers). ---------------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.3 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Perry wrote, "However, make no mistake that Netcom can and will cooperate with the police if you use your remailer in a way that the government doesn't like, so it seems that the security afforded isn't that good." So you aren't interested unless you can commit serious felony crimes using a given remailer? I would be happy if criminals stayed away from my remailer. What do you mean by "security"? And if the police find out a personally owned machine was involved, I couldn't imagine them not just swooping in at midnight and taking it away at gunpoint. I hope those privately owned machines don't have logs ;-). In my mind, the whole secret to gaining privacy is not attracting attention in the first place. Using a remailer DOES allow a person to communicate anonymously with someone else, in two directions. If a party has enough power to tap Netcom, then sendmail logs or no sendmail logs, they will find you. and, "Besides, $20 is a paltry sum for the amount of work involved." Think of it as a trophy, which I'm sure most understood. I'm not offering you a job. I appreciate your view though, and since I've posted a request for remailer comments, might you help us all and send me some comments about the various remailers and what types of security each affords? If some wish to use remailers for serious underground activity, which should they use or not use? If they just want to keep bounced mail from telling their system postmaster who they're talking to, then that's a different type of security need. -Xenon

4 3

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Sure, a vanilla user at netcom probably can't track the remailer logs, unless of course there are BUGS in SENDMAIL (gasp!) or SunOS or whatever. But remailers aren't just to keep random users from knowing who you are so you can post better anonymous letters to alt.sex.anonymous. At least some of us would like real privacy, and consider remailers a useful part of this, and this means that if you're using remailers to communicate with your sources for the newspaper article you're writing on the CIA's cocaine delivery shortfalls or the NSA/Trilateralist designs for the National Health Care ID Card or your mayor's child pornography habits, that nobody can track you or your sources down easily. That means that root(a)netcom.com can't do it using the root password, even if they want to comply with the subpoena, and the Secret Service can't do it after confiscating netcom's machines or wiretapping their phones. Non-encrypting remailers can never really get that good, but they can at least d part of the job, and encrypting remailer networks may get that good if there's enough traffic through the system. So meanwhile, are you giving root(a)netcom.com permission to try to identify the source of your mail and win the $20 for finding out whether you're really Xenon or you're really L.D.'s evil twin Skippy? (No idea if they'll try, or if they're even listening....) - Radon

1 0

Josh Quittner`s Newsday c
by Duncan Frissell 17 Dec '03

17 Dec '03

Welcome to new lurkers (if any) from our recent NYT and Newsday publicity. To give you something a little more interesting than "Is Usenet in the Public Domain?" to read, here is my response to Joshua Quittner's column in Newsday. >Tuesday, 01 February 1994 > >CODING UP A BIT OF PRIVACY > >Time is running out for the Cypherpunks. Actually we have all the time in the world. One cannot build a New Information Infrastructure without including the tools that anyone can use to communicate privately. >This is their central question: In a future world where all information >is centralized on a network, where all information is tracked by the bit, >where every purchase you make and every communication can be monitored by >corporate America, how does privacy survive? More of a problem in the past than in the future. When P.J. O'Rourke had lived in a small New Hampshire town for a year or so and went to the store to shop for some clothes the clerk remarked, "That's not the brand of underwear you usually buy." One's life was more of an open book in the village and the tribe than it will be in the electronic village. Particularly since you can build private networks/"places" that exclude anyone you want. >"The whole information highway thing is now part of the public eye," >explain Eric Hughes, a founder of the Cypherpunk movement. "If we don't >change it now, it'll be impossible later." Misquote? It's usually better to do the job early than late but the nature of network communications is such that it's hard to control at any time. >They dread the coming commercial network of televisions and computers, >saying it will displace the Internet and destroy many of the freedoms they >now enjoy. Surely not the anarcho capitalists who probably represent a majority of active cypherpunks. >For the first time, virtually unbreakable codes are now possible, thanks to >computers. I won't say it. Certainly computers make it easier to *use* encryption. >The the U.S. government is concerned, as governments always are, about >the spread of powerful cryptography (terrorists could use it, kidnappers >could use it, drug dealers could use it, Communications intercepts are rarely used to prosecute crimes. >The (Clipper) chip is reviled by Cypherpunks and other civil libertarians >because it provides a back door that law-enforcement agencies could enter, >with the proper warrants, for surveillance. Warrants not required, just a certification that the law enforcement agency has proper authority to do a communications intercept. >"I'm starting a bank, and it's not going to be a U.S. bank," Hughes >says. >The bank will store depositors' money (he's thinking a $200 minimum >deposit) and disburse payments to anyone --- all over the Internet. It >will be based abroad, maybe in Mexico. Where did Mexico come from? >A Cypherpunk network bank is one way to pay for a network of truly >encrypted, private communications, you see. Along with lots of other nice things. Computers have been killing traditional banks for years (ever since they enabled the creation of Money Market Funds in the '70s). Netbank (and its many competitors) will continue the process. *********** Duncan Frissell You don't have to be nice to nation states you meet on the way up if you're not coming back down. --- WinQwk 2.0b#1165

1 0

UNSUBSCRIBE
by Joseph Matheny 17 Dec '03

17 Dec '03

Unsubscribe:mediak@well.sf.ca.us

1 0

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

"So meanwhile, are you giving root(a)netcom.com permission to try to identify the source of your mail and win the $20 for finding out whether you're really Xenon or you're really L.D.'s evil twin Skippy?" I have no answer to that. I don't know what "permission" means in this context. I never discluded Netcom employees though. I doubt they would wish to appear to have lax security by posting the answer though. Does L.D. have an evil twin? I hope he doesn't get a Unix account. Seriously, your comments were the first I've seen that really explain to me what sort of security problem a Netcom remailer faces. Now then, I ask you as well, might you fill in a few of the blanks in the remailer list I posted. I could send it to you if you missed it. What are the "serious" remailers, do they keep mail logs, and are they reliable? -Xenon

1 0

anonymous mail bombers and what to do about them
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Don't feed the animals. Generally, when one person is mail-bombing another, either there has been a fair amount of provocation by at least one of the parties, and escalation of childishness isn't as useful as trying to resolve some of your differences, though it can offer a certain amount of basic 4-year-old ego satisfaction. If somebody's mail-bombing you, and they're root, and they're not doing it anonymously, you don't need to either; the worst revealing your identity will do at that point is encourage them to mail-bomb you. And your system administrator probably already knows who you are by now, assuming the bombing has been at a high rate. If the bomber is root on his home machine, and the bombs include bad words that aren't mere reflections of your words to him, you could always complain to the phone company that you're receiving obscene phone calls. I doubt the policies or laws about that specify whether the calls have to be made in spoken English.... If the bomber is root on his business machine, you can complain to his management, assuming you can locate them. Some managers get very bent out of shape about this and do random clueless things, others conservatively protect their company images, others ask what state and federal laws have been broken and tell you to stifle yourself if the answer is "none". If the bomber is root on his home PC at a university, arbitrary randomness can occur. On the other hand, if you're really L- D-, and the person who is mailbombing you is Perry Metzger, expending large amounts of childishness in his direction will not accomplish anything positive for either of you, and if both of you start sending N copies of each others' mail to each other, exponential growth will not help either of your systems. If you're not really L- D-, but the person who is mailbombing you is still Perry, try talking rationally to him; he can do that just fine if he thinks it's worthwhile. If you're really L- D-, and the person is or is not Perry, we can help. Post your full name, home address with precise latitude and longitude, and we'll be happy to deliver some advanced plutonium products you may find useful in resolving your problems. "Deuterium" (oh - wait - maybe I'm "Tritium" today?) (or was that "Lithium"?)

1 0

Re: anonymous mail
by IGOR 17 Dec '03

17 Dec '03

If there is an admin above him, speak with that admin, also mail cert(a)cert.org and mail the nsf explaining to them what has been happening, or mail kfithen(a)cert.org She is a really nice lady, and she could help you on this. If all else fails, do that and send the fakemail...if you are sure that you wont get caught. Bob \//// (0 0) *------------------------------oOO--(_)--OOo---------------------------------* | Bob Christian II "IGOR" * Internet:Christi1@muvms6.mu.wvnet.edu| | Marshall University ***** E-Mail: Christi1(a)muvms6.wvnet.edu | | Huntington, WV * GET HIGH....LEARN TO FLY! IP-ASEL | | Student/D.J 88.1 WMUL FM * Major:Undecided(CJ/LAW) Minor:AVT | *----------------------------------------------------------------------------* --I love flying because there is no speed limit(^10k) and Radar is your friend! --Marshall assumes no libility for what I say, because my words are MINE!

1 0

Re: digital signatures/copyright
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Brian Williams asks: > Could one make a case that the use of Digital signatures in > messages imply's copyright retention by the author? No - you can make a case that the author doesn't want his words to be forged or tampered with, and is using technology rather than law to enforce it. Doesn't affect the rest of the legal situation, though one could try to argue either that the author was or was not expecting copyright. -----BEGIN PGP SIGNATURE----- Version: 2.3z iQCVAgUBLU/2HdCcBnAsu2t1AQF15gP+IqS3o0gNeHng9BSqlk95KzmPwp3oo70p j2FVYHNOeUKgDSAAwvWr+p3/DOwTafSkJf4A5gW33NOKr0E9JZ4In349RAoueTku J94VMajT4i7yhOC8X41RPkVLlCltPDRo04SS8h5UFnEk/zFxiTkvXY9mpBcK3yUw vYY9pbmupSc= =KbXS -----END PGP SIGNATURE----- Bill

1 0