December 2003 - cypherpunks-legacy

Quantum cryptography
by Duncan Frissell 17 Dec '03

17 Dec '03

J >Does anyone know how quantum cryptography works? J > J > - Joi Almost certainly. DCF "We'll free you sons of bitches whether you want to be freed or not." --- WinQwk 2.0b#1165

3 2

Unsubscribe
by DBS5112＠ibm.MtSAC.edu 17 Dec '03

17 Dec '03

Please, UNSUBSCRIBE me...

3 2

Re: Prodigy Hard Drive Scans
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

> I heard from a friend that Prodigy was scanning user's hard drives. > Basically, when you logged on Prodigy made a complete directory of your > hard drive and uploaded it. Prodigy was using this to find out what > applications you used so they could direct the appropriate advertising > towards you. Apparently, they're suffering several lawsuits now because > of it. > > My friend heard this on the trailing end of a radio talk show. If it was > really happening, it sounds horrible. Could Secure Drive be set up to > stop this kind of attack? > > Can anyone tell me if this is more than a rumour? If it is more than a > rumour, would you be able to point me towards some information about this? Just a rumor, disposed of several years ago. A hot topic of debate around 1990. This rumor arose because Prodigy set aside a block of user disk space for its own files. Sometimes this block had random stuff in it (recall that "erasing" a file doesn't actually overwrite the disk, it just removes pointers to the stuff being erased and allows other stuff to later be overwritten over it). Prodigy used part (a small part, given 1200- and 2400-baud modems in use then) of this block to send back to the main computers, so in principle it could see miscellaneous scraps of erased data. But this was accidental, was a tiny fraction of the disk, was not used or even looked at by Prodigy, and would have absolutely no value in determining applications used. (Think about what a samll random chunk of "erased" disk space would really mean in terms of telling outsiders what applications you use!) Ironically, an old college buddy of mine is now in charge of e-mail for Prodigy, in White Plains, New York. He visited me last summer and I showed him a _real_ computer service (Netcom) and we had a few good chortles about this Prodigy Conspiracy. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power:2**859433 | Public Key: PGP and MailSafe available.

1 0

Re: your mail
by David Vincenzetti 17 Dec '03

17 Dec '03

Some anonymous user sent me a message which is divided in three parts. I am sorry but I did not receive the first one. Can this anon guy please send me the first part again? Thank you.

1 0

Re: New remailer up.
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jon Boone expressed what seems to be a consensus, " I won't hack into mail.netcom.com to demonstrate that it is possible to figure out who used your remailer. But, if one of the admins from netcom wants to send me their syslogs, I'll do my best to put together a correlation." Netcom logs mail. The mail queue is viewable by most anyone willing to set up a mail queue logging routine. If someone wants to see the mail logs after it is no longer in the mail queue they have to be root on Netcom or illegally hack in. If the FDA wants your illegal smart drugs, they might get Netcom to hand over mail logs. If a hacker or the NSA taps into root, they don't need mail logs; they'll just "wiretap" the qwerty account, including its secret key and pass phrase. Is there any OTHER serious but unrelated problems with a Netcom remailer? Now I know what warnings and hints to put in qwerty's .plan: "Since Netcom keeps mail logs, people should only have contact with qwerty via other remailers or send mail out from qwerty only to public sites like Usenet or a mailing list, so the real addresses of the users never shows up on Netcom's logs or in the mail queue. It is also best to use encryption in case someone is reading the contents instead of just the logs." Routing through qwerty will add another layer of difficulty to someone trying to track down a message sender, since if forces them to get Netcom's sendmail logs after the fact or to make their own logs every day of the year from an account on Netcom. Is this legal for say the FDA to do? How about my new idea for a company called "Netlog!" in which I log the mail queue on Netcom and offer to sell CD ROMs containing a year's mail logs from Netcom? These tricks could be made more difficult with traffic analysis countermeasures. However, the issue seems more touchy than this rationalization for the existance of Netcom remailers. Not assuming qwerty remains in its current state, will adding qwerty to a mailing chain, say between extropia to hfinney@shell, using encryption, add to or decrease security? The question needs to be answered, with the assumption that someone IS collecting mail queue logs. How would you have me alter qwerty so that this link ADDED to the security of a chain? More than an hour delay must be avoided by making the scheme more sophisticated, in my view. If I add a 0-30 min. random delay, with added dummy traffic going out from qwerty in a circle through other remailers and back to qwerty's bit bucket, every few minutes, would this make it useful also to SERIOUS remailer users? Before I start throwing out ideas that I'm sure aren't new to readers here, I have a simple question that perhaps I should post to comp.unix.questions or comp.lang.perl, but.... Can I, and how would I, get a perl script to kick in and send out mail every few minutes when I am NOT logged in. Is this possible on Netcom? The question is pretty general, and involves any public access or personal account machine. So send me a remailer or tell me how to patch Hal's. -Nik (Xenon) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLVGOgQSzG6zrQn1RAQFGLAP+N31dNMjnArEOklm4AeruT7pu6LgfNdUM OawRDPY8CYgxYi5kJ4yByh7+uD+Asr7FCMaKacln8YwO6oOz3FlceNupC1czWFI5 NWuS9b4r5ZPKpLClv9K3oY1QvRePc1r0Ypl4SYCtZux/7U787BoyT/VUHmkfwple I6X6+irFXns= =6Klu -----END PGP SIGNATURE-----

1 0

Re: Remailer Tearline Conventions
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > That remail(a)extropia.wimsey.com is in Canada specifically makes > > communications with it fair game for NSA interception, however. > > NSA interception is world wide. On the other hand, extropia uses PGP encrypted messages to its remailer, and NSA PGP-breaking is distinctly *not* world-wide. I assume it doesn't use PGP encryption for the anonymous outgoing side, but you can always encrypt the message before encrypting it for extropia.

1 0

finger user@wasabi.io.com
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Neat stuff! You can finger billstewart(a)wasabi.io.com, even though I don't exactly have an account there... Is the source code available for your finger daemon? It doesn't seem to have any regular-expression matching; it mostly matches exact character strings, presumably case-insensitive. I couldn't figure out how to get it to match spaces, though: requesting 'bill stewart' got all the bills and all the stewarts, rather than getting the lines with bill stewart in them. Thanks!

1 0

Re: contemplating remailer postage
by Hal 17 Dec '03

17 Dec '03

As Jim points out, Matthew's scheme for one-bit-per-stamp has the problem that it requires non-anonymous stamps. Jim suggested a variant on Chaum's digital cash where the stamp numbers would be re-blinded by the recipient so that the remailer would not recognize them (but could verify their validity). Matthew's bitmap idea could still be used, though. The incoming stamp numbers could be hashed down to, say, 24 bits. This could then be an index into a 2^24-bit file, which would take 2 MB. Set the bit when the stamp is used, and reject the mail if the bit is already set. Granted, this would create false rejections. But email is already not perfectly reliable. You could send 160,000 messages before you had as many as 1% false rejections (2^24 / 100). I think this would be better than trying to save this many digital stamps and check through the list each time for duplications. Hal

1 0

Remailer FAQ. Details.
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

I hope I can get a bit more attention to this, now that it has become more sophisticated. Please code warriers, take a break and let the human race know what the existing remailers are all about. I know exactly why they don't have enough traffic; knowledge about them is still insider knowledge. A list of remailer addresses and year-old partial info from a request made my Tim May was all I could find. Specs needed. I will send this to Gary Edstrom for the PGP FAQ if I don't have to spend the rest of my life compiling it. Mail info to qwerty(a)netcom.com. I'm interested in hearing from users as well as operators. -Nik (Xenon) Xenon's Full Disclosure Remailer List. Remailer Fast? OpLog SysLog Subj Batch RD NL CPU Phys PGP BitB ?what else? --------- ------ ----- ------ ---- ----- -- -- --- ---- --- ---- ----------- bsu-cs + ? ?/? + ? ? ? ? ? 23a ? catalyst + N? SM/MQ - - ? - PA M 23a - choas + ? ?/? + ? ? ? ? ? - - cicada ++ ? ?/? - - - - ? ? - - dis.org - ? ?/? - ? ? ? ? ? 23a ? extropia ? ? ?/? + ? ? ? Pr? ? 23a ? jarthur +/-- St SM/MQ? - ? ? ? Un ? 23a - menudo -- ? ?/? - t1 ? ? ? ? - ? merde -/-- ? ?/? - ? ? ? ? ? - ? penet.fi -- St ?/? - t? 24 + Pr H - - pmantis ++ ? ?/? - ? - - ? ? - - qwerty + C SM/MQ - - - - PA M 23a + rosebud ++/- ? ?/? - - - ? ? ? 23a ? remba ? ? ?/? ? ? ? ? ? ? 23a ? shell ++/+/- St ?/? - ? ? ? ? ? 23a - soda ++/- St+? ?/? - ? ? ? ? ? - Subj: Strips Subject header? NL: Non-linear remailing? 123->231. RD: Random delay added (max, in hours)? Batch: Batched remailing? t2 means twice daily. n5 means after 5 messages. CPU: Pr = private. PA = account on public access machine. Un = university. Phys: Physical security of the CPU, especially at night. H/M/L. BitB: BitBucket feature? Fast?: ++ <5 min + 5-10 min. - ~10-30 min delay -- Pinging isn't practical due to long delays, but may be more secure. +/- Sometimes +, sometimes - Normal internet mail delays are common, and are not equivalent in the two directions between any two remailers. Mail still gets through. OpLog: F: Full copies of all mail is archived. My large volume mailing should help put a stop to this. St: Stats logs of when mail was remailed. St+: Stats logs of when and where mail was remailed. St-: Simple counter. N: Operator keeps no logs. SysLog: SM: sendmail logs of when and where mail was exchanged. Root access. MQ: mailqueue accessible by anyone on the site. Could make logs. bsu-cs nowhere(a)bsu-cs.bsu.edu catalyst catalyst(a)netcom.com chaos remailer(a)chaos.bsu.edu cicada hh(a)cicada.berkeley.edu dis.org remailer(a)dis.org extropia remail(a)extropia.wimsey.com jarthur ebrandt(a)jarthur.claremont.edu menudo nobody(a)Menudo.UH.EDU merde remailer(a)merde.dis.org penet.fi anon.penet.fi pmantis hh(a)pmantis.berkeley.edu qwerty qwerty(a)netcom.com rosebud elee7h5(a)rosebud.ee.uh.edu shell hfinney(a)shell.portal.com soda hh(a)soda.berkeley.edu Discontinued remailers still on some lists out there: phantom(a)mead.u.washington.edu remail(a)tamaix.tamu.edu sameer(a)netcom.com (spelling?) sameer(a)berkeley.edu (spelling?) cdodhner(a)indirect.com remailer(a)entropy.linet.org?? 00x(a)uclink.berkeley.edu? remail(a)tamaix.tamu.edu? remailer(a)entropy.linet.org? Background on each remailer: bsu-cs: Run by Chael Hall. Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: History: ?? catalyst: Run by Scott Collins. Machine: personal dial-up account on Netcom. Problems policy: Outgoing address blocking, with proof of ID. Contact catalyst(a)netcom.com. Software: Customized Hal's ? Security: Netcom keeps sendmail logs, which root(a)netcom.com can read. Any Netcom user could also compile his own sendmail logs, by constantly logging mail as it arrives and leaves. Comments: History: ?? chaos: Run by ?? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: Comments: Finger remailer.help(a)chaos.bsu.edu for info using any remailer. ?? gopher chaos.bsu.edu for a collection of info about Cypherpunks. Comments: History: ?? cicada: Run by Eric Hollander. Machine: ??? Problems policy: ?? Contact ?? Software: ?? Security: Tread lightly. Being "phased out". dis.org: Run by ?? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: History: ?? extropia: Run by ?? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: Only accepts PGP remailing. ::/Encrypted:PGP header is optional. Privately owned, in Canada. History: ?? jarthur: Run by Eli Brandt. Machine: Sequent Symmetry. Problems policy: Destination blocking is available w/ sufficient ID. Contact ebrandt(a)jarthur.claremont.edu. Software: the usual, tweaked for MMDF. Hal's? Security: jarthur keeps sendmail logs. Comments: History: Set up late '92. PGP added mid-'93. menudo: Run by ?? Maching: ?? Problems policy: ?? Contact ?? Software: ?? Security: Stores messages and sends them at midnight?? Comments: History: ?? merde: Run by ?? Maching: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: History: ?? penet.fi: Run by Julf (last name?) Machine: ?? Operator owned. Problems policy: Account revokation. Contact ??(a)anon.penet.fi. Software: custom. Security: Comments: By far the most popular remailer, dwarfing in a day what the entire Cypherpunk remailers combined carry in a month. Supports easy return addresses as well as non-anonymous mailing to someone's anonymous address (na1234... instead of an1234...). Your real address is kept on Julf's hard disk, but is fairly safe there, especially if you do not abuse your anonymity to harass someone. On a bad day your mail and especially Usenet posts may be delayed up to two days. Very reliable though. Sends error messages back to you for failed mail. Limited to 48K mail. History: ?? pmantis: Run by Eric Hollander. Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: Tread lightly. Being "phased out". Comments: History: ?? qwerty: Run by Xenon. Machine: dial-up account on Netcom. Problems policy: "What problems?". Contact qwerty(a)netcom.com. Software: Hal's remailer. Security: Netcom keeps sendmail logs, which root(a)netcom.com can read. Any Netcom user could also compile his own sendmail logs, by constantly logging mil as it arrives and leaves. Comments: You must use na1234(a)anon.penet.fi not an1234(a)anon.penet.fi. Finger qwerty(a)netcom.com for a blurb on the remailer and updates on its software. Request-Remailing-To: /dev/null is a bit bucket. whitehouse.gov gets blocked and fully logged. History: Up 2/94. Set up by Xenon who needed more remailers to use to send PGP info to people with, since anon.penet.fi was overloaded. rembe: Run by ? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: ?? History: ?? rosebud: Run by Karl Barrus. Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: History: ?? shell: Run by Hal Finney. Machine: ?? Problems policy: ?? Contact ?? Software: Hal's Remailer. Security: ?? Comments: whitehouse.gov blocked and fully logged. hal(a)alumni.caltech.edu forwards all mail to shell. History: ?? soda: Run by Eric Hollander. Run by: ?? Machine: ?? Problems policy: ?? Blocking of addresses. Mail sent to problem causer. Contact ?? Software: custom. ?? Security: ?? Comments: History: ?? Remailer Public Keys: (I've got these...)

1 0

info on local/regional groups & sublists
by Stanton McCandlish 17 Dec '03

17 Dec '03

For my OUTPOSTS list/FAQ, if you have any (public) inforation about local cypherpunks groups and sublists, like the Austin lists, or the UK branch, please let me know via personal email. Need to put out a new version of the FAQ soon, and am missing much info. All I have so far is: Main general: hughes(a)soda.berkeley.edu Main subscribe requests: cypherpunks-request(a)toad.com Main FTP: soda.berkeley.edu, pub/cypherpunks Hardware general: jdblair(a)nextsrv.cas.muohio.edu Hardware requests: cp-hardware-request(a)nextsrv.cas.muohio.edu Wonks general: cypherwonks-owner(a)lassie.eunet.fi Wonks requests: majordomo(a)lists.eunet.fi (message body of: subscribe cypherwonks [1st & last name] [address]) Austin general: Jim McCoy <mccoy(a)bongo.cc.utexas.edu> Doug Barnes <barnes(a)io.com> Austin req. austin-cypherpunks-request(a)bongo.cc.utexas.edu austin-cypherpunks-announce-request(a)bongo.cc.utexas.edu Austin FTP: ftp.cc.utexas.edu, pub/cypherpunks Any info on other CP groups, corrections to what little I have, pointers to other CP file sites, gopher/WWW/Wais servers, etc. all appreciated. Even some BBS number, snailmail addresses for any local groups that are getting less virtually, more physically organized, etc. That, and relevant other lists (anything that might be consider "online activist" or civil libertarian in nature) and resources. Again, please send via email to mech(a)eff.org rather than on the list. Muchas gracias in advance! -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

1 0