December 2003 - cypherpunks-legacy

Re: Internet billing scam?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

I tried to telnet to mary.iia.org, and a Sun machine named "mary" did answer; I didn't play around with telnetting to port 25 nad seeing if it did smtp, though I'll try sending mail to bogususer(a)mary.iia.org and see if it bounces. As Steve points out, sometimes credit cards are more useful for services like this than digicash is, but I'd still prefer not to send credit card numbers in cleartext, even if the card vendor is supposed to eat most of the fraudulent use. Would be nice if they'd use some sort of public-key mail system so that they're the only ones capable of fraudulently using the card number, rather than any eavesdropper :-) Bill Stewart

1 0

Re: Forged messages part of "Operation"?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> >> If he starts flooding the newsgroups, what can we do about it? > >If he starts forging mail from other people, he's committing a crime > >and we can get his system administrators to pull his account. > >Perry I don't think you can strictly call it a crime, just abusive rudeness, though if you did something like that in Detweiler-space, it might classify you as a Tentaculer Traitor to Humankind. However, sufficient levels of abuse can get you kicked off systems; though he's been posting lots of verbose human-generated messages rather than mechanized mailbombs, which are clearly over the edge. And he's been mailbombed directly by other rude people; don't know if he's done it to anyone himself.

1 0

Re: Crypto not being used where needed
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

h There are two different problems with eavesdropping cellular calls: - trying to find a *specific* person's calls - trying to find any interesting call. The former is still hard, but if unencrypted cellular credit-auth boxes become widespread, all you'll have to do is set your scanner to listen for 1200-baud tones and match for patterns that look like credit-card requests, since you don't really mind *who* you rip off. This is not good. One way around it is to use public-key crypto; however, simple symmetric-key crypto with different keys per vendor should be adequate, and the paper-trail for setting up credit-card service gives you a key distribution mechanism.

1 0

request for references on random one time pad
by HO JUNYA 17 Dec '03

17 Dec '03

Hi, I am taking part in an engineering design course, where we will be designing and building something of our choice, with an emphasis on electronics... What i proposed to do was basically a one time pad, with a true random number generator to generate the pad. We want to do it on 8 bit xt plug in cards, with the initial transfer of the random pad between the sender and receiver being done over a cable (with the terminals side by side). Then, an arbitrary amount of time later, the two terminals can be separated, and a promiscuous method of transmission can be used to transmit encrypted data. The encrypted data is to be generated by simply XORing the bits of the pad, and the bits of the plaintext, with decryption occuring at the receiving end by XORing the bits of the pad and the bits of the encrypted message, to extract the plaintext bits. Talking to the instructor today, he didn't understand why I wished to use a truly random number generator, since he believed that any pseudorandom number generator, or even something periodic would be just as secure, in practical terms. Is this true? I did not wish to use a pseudorandom number generator (and after all, it's an electronics design course, not software design) or any period function, because i believed that it would be susceptible to brute force attacts by statistical analysis of the encrypted data (are there other ways of attacking it?). Wouldn't this also apply to any textual input as the pad? (eg, verse n of chapter m of book o of the bible) I would like to be able to back up my assertion that using pseudorandom number generators, periodic functions or english texts would not be secure (to what degree?), and that the use of a true random number generator (probably using circuit noise) is theoretically the most secure method available (assuming real randomness and not taking into account the transfer of the pad). Can anyone suggest any references? I was also wondering how difficult it would be to implement DES into this, using random bits for keys, in hardware or software. I'm afraid that we may have to use basic, if we are to talk with the plug-in-card, as i'm not confident of my C abilities, and am not aware of any libraries out there. Any help would be greatly appreciated. I am not on the cypherpunks mailing list yet, however, and would appreciate a Cc: to my email address, in addition to the list itself. Junya ______________________________________________________________________________ "Merci, merci, merci." -La Femme Nikita | hojunya(a)ecf.toronto.edu ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Greetings. We are enjoying rebuffing your latest volley in the newsgroups. You have really gotten desperate, it is clear! Our last exploding shrapnel bomb into the newsgroups (Operation South Pole), was a fantastic success; you have been scurrying madly with the damage control. And szabo(a)netcom.com really is almost dead, contrary to whatever *you* think. Unfortunately one of our key outlets has taken a serious hit, but we overtaxed the site anyway and expected to lose it eventually. This message is a little notice that our Wham, Bam, Thank You Ma'am campaign starts today. When it is finished, you will see a variation of our signature below. We think you will enjoy the `bounces' and some more of the polymorphic paragraphs. Remember the Golden Rule, do unto others as you would have them do unto you! -- and what goes around, comes around! he who lives by the sword, dies by the sword! what's good for the goose is good for the gander! for every action, there is an equal and opposite reaction! It may be next weekend perhaps in two weeks that we mount operation SQUISH. Obviously, a key strike has to be planned carefully and accompanied with feints to be successful and effective. We appreciate all the great ideas you have provided us lately, and the highly entertaining squirming and contortions. Remember, if the guerilla is not losing, he is winning! Take care :-) \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ _________ _________ _________ / / \ \ / / \ \ / / \ \ / / / / / / / / ______ / / / / / / ~~~~ / / / / / __ \ / / / / / / / ~~~ __/ ~~~_/ / / ~~~ / / / ____ / /~\ \ /~~~~_ / / /~~~~~~~ \ \ / / / / \ \ \ ~~~ _ \ / / ~~~~~~~~~ ~~~~ ~~~~ ~~~~~ ~~ ~~~~ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ C y b e r a n a r c h i s t R e p r e s s i o n a n d P o i s o n

1 0

T-Shirt Ordering Update - PLEASE READ
by Christian Void 17 Dec '03

17 Dec '03

Updated Ordering Information: Due to popular demand, we will be accepting checks for orders on a few conditions: The checks must be drawn on US banks for orders placed in the US ONLY. We cannot accept checks from outside the US. Orders placed from outside the US should be paid using a Money Order, or Cashier's Check in US Funds. Also, please include your e-mail address with your order, so we can acknowledge receiving it. The original announcement is below. Thanks! --------------------------------------------------------- "Cypherpunk Criminal" T-shirt Ordering Information --------------------------------------------------------- Part I: Where to get a preview of the design The front of the t-shirt can be obtained via anonymous FTP at netcom.com in pub/cvoid/cypherpunks. The filename is "front.gif" which is based on Jef Poskanzer's "CRYPTO-DATA" DOT warning logo (this file is available as well as "logo.gif"). The back of the t-shirt consists of the upper banner, "cypherpunks(a)toad.com", and the lower banner, "There is safety in large numbers". In the middle is a listing of 7-digit primes in a large block. The typestyle is Fusion and Fusion bold. Outputting this to a GIF is next to impossible due to the resolution needed to reproduce the text. Trust us, it's cool. Part II: What kind of t-shirt is it? What color? Sizes? Custom? Availability? The t-shirts are Hanes Beefy-T's, which are a very strong and durable. The t-shirts will be black, with white and yellow screened on to it. We were unable to come up with a practical way to customize the t-shirts on an individual or group basis, so we opted for this design instead. We will only be making as many as we get orders for, and have no plans to do a second printing. Sizes available are S, M, L, and XL. We may be able to get XXL, XXXL and XS shirts as well. We will post an update in regards to the additional sizes. Part III: How much do they cost? Ordering deadline? The t-shirts will cost $10 each, which will include shipping and handling to anywhere you want them sent (except Mars). We will be accepting orders until February 15th. The t-shirts will be shipped out before February 28th. Part IV: Ordering Information Please make all Money Orders out to "Inky Fingers" (the screening company we use). Please specify the number of t-shirts, and what size you need, and where you want them shipped. We cannot (for obvious reasons) accept personal checks. Cashier's Checks and Money Orders only, please. Orders can be mailed to: V/M/R Attn: Cypherpunks T-Shirt P.O. Box 170213 San Francisco, CA 94117-0213 If you have any further questions, you can send me e-mail here at <cvoid(a)netcom.com> or <cvoid(a)albemuth.tatertot.com>. Anyone who sent e-mail in regards to this will also get this e-mailed to them directly, in case they do not have access to the list. Feel free to forward this to any interested parties. Thanks. -- Christian Void /T71 | "I don't like it, and I'm sorry I | V/M/Research, Inc. cvoid(a)netcom.com | ever had anything to do with it." | P.O. Box 170213 Tel. 1+415-998-0774 | -Erwin Schrodinger (1887-1961) | SF, CA 94117-0213 * PGP v2.3a Public Key Available Via Finger *

1 0

T-Shirt Clarification...
by Christian Void 17 Dec '03

17 Dec '03

Sorry for the bandwidth. It is only Tuesday and has already been a long week. :( Any orders placed outside of the US, paid by check drawn on a US bank are acceptable. Our screening company has expressed concerns over dealing with checks drawn on non-US banks, so we are avoided this type of payment. If anyone has any further questions, or special circumstance, send me a note and I'll see what I can do. Thanks again. Christian Void /T71 | "I don't like it, and I'm sorry I | V/M/Research, Inc. cvoid(a)netcom.com | ever had anything to do with it." | P.O. Box 170213 Tel. 1+415-998-0774 | -Erwin Schrodinger (1887-1961) | SF, CA 94117-0213 * PGP v2.3a Public Key Available Via Finger *

1 0

a simple guide to my remailer
by Eric Hollander 17 Dec '03

17 Dec '03

Here's the Official Guide to the hh remailer. Please post this wherever you think people will find it useful. ----- How to use the hh(a)soda.berkeley.edu Usenet poster and Anonymous Remailer by Eric Hollander This document describes some of the special features of the hh(a)soda.berkeley.edu remailer. Because this remailer is essentially just a modification of the standard Cypherpunk's Remailer, I recomend that you also read soda.berkeley.edu:/pub/cypherpunks/remailer/hal's.remailer.gz. = What does this remailer do? This remailer allows anyone who can send mail to post to Usenet newsgroups, and also to send mail to anyone else on the Internet. Both of these functions can be anonymous (the identity of the sender is hidden from the recipient) or non-anonymous (the identity of the sender is known to the recipient). = Why is this remailer different from the standard Cypherpunks remailers? The main difference between this remailer and the other Cypherpunk remailers is that this remailer allows posting to all Usenet newsgroups, either anonymously, or non-anonymously. It also has the regular remailer functions of forwarding mail, either anonymously or non-anonymously (nonymously?). The other minor difference is that this remailer adds a random time delay for anonymous mail and posting. = A note about header fields This remailer/poster looks at the header of the mail you send it to decide what to do. Some mail programs don't allow easy editting of the header. If your program doesn't allow editting of the header, you can still use the remailer. To do this, send mail in the normal way, but start your message like this: :: Anon-Post-To: rec.fish leaving no blank lines before the :: and a blank line after the header field to be inserted. The remailer will consider the line after the :: to be a part of the header. All of the instructions bellow can be used with actual header fields or the :: format. = How do I use this remailer to anonymously post to Usenet? Send mail to hh(a)soda.berkeley.edu with a header like this: To: hh(a)soda.berkeley.edu Anon-Post-To: rec.fish Subject: I flushed a fish on Friday On Friday, I did a terrible thing, so I'm posting this anonymously... This message will be posted to rec.fish, with nothing to indicate who was the original sender. Only the Subject field will be retained; everything else in the header will be discarded. = How do I post non-anonymously? Send mail like this: To: hh(a)soda.berkeley.edu Post-To: rec.fish Subject: flushing fish How despicable of you to flush a fish! This will be posted to rec.fish non-anonymously; the From and Subject fields will be retained in the post. = Crossposting To crosspost, simply list the newsgroups, separated by commas, with no spaces, like this: Anon-Post-To: rec.fish,alt.ketchup Note that excessive crossposting is an abuse of the net. Some people have to pay for their news, and they don't want to read "how to make money fast" in rec.fish. = Testing I recomend that you post test messages to make sure you are using the remailer properly. Please post these messages to the appropriate test groups (alt.test, rec.test, etc). Also, if you post non-anonymously to a test group, many sites will send you mail confirming that they have received the post. To avoid this, put the word "ignore" in the subject line. = Anonymous mail This remailer is capable of sending anonymous mail. To send mail to foo(a)bar.com, send a message like this: To: hh(a)soda.berkeley.edu Anon-Send-To: foo(a)bar.com Subject: Ronald Sukenick I think you should read something by Ronald Sukenick. and foo(a)bar.com will recieve the message, without knowing who sent it. = Non-anonymous mail forwarding This remailer supports non-anonymous mail forwarding. To use this feature, send mail like this: To: hh(a)soda.berkeley.edu Send-To: foo(a)bar.com Subject: you know who I am This mail is from me! = Testing mail Please test the anonymous remailer functions before you use it "for real" by sending mail to yourself or a friend. = Chaining, encryption, and other issues These features are discussed in detail in soda.berkeley.edu:/pub/cypherpunks/remailer/hal's.remailer.gz. While you're looking at that file, you might also want to check out PGP in /pub/cypherpunks/pgp. If you haven't installed PGP on your machine yet, you should try it out. This remailer doesn't yet support encryption, but it's coming soon. = Remailer abuse This remailer has been abused in the past, mostly by users hiding behind anonymity to harass other users. I will take steps to squish users who do this. Lets keep the net a friendly and productive place. = A note to ucb users This remailer allows posting to ucb.* newsgroups. = If you have other questions or problems send normal mail (without any of the above headers) to hh(a)soda.berkeley.edu. = Copyright This file is copyright 1994 Eric Hollander, all rights reserved. You are free to distribute this information in electronic format provided that the contents are unchanged and this copyright notice remains attached. = Disclaimer This remailer is not endorsed in any way by the University of California. I, Eric Hollander, take no responsibility for the content of posts or messages, and I take no responsibility for the consequences of using my remailer. For example, if you post anonymously, and someone manages to trace it back to you, I am not responsible.

2 1

yet another thing tacked on to my slocal
by hh＠cicada.berkeley.edu 17 Dec '03

17 Dec '03

You can get the ordering info about the Cypherpunks T shirt by sending mail to hh(a)soda.berkeley.edu with "tshirt-info" (spelling counts!) in the subject line. This is part of my plot to subvert all Internet protocols and just use Port 25 for everything. e

1 0

Credit cards vs. digital cash
by szabo＠netcom.com 17 Dec '03

17 Dec '03

Steve Bellovin raises some good points about the function of credit cards. A couple responses: > ...in these cases, customers have the potential to run up a > large bill -- that is, a debt -- between interactions with the > provider... A vendor possessing a > credit card number *will* be paid, with minimum hassle. If the > customer skips town, the card issuer eats the charge. Vendors should be able to get the equivalent protection by buying insurance against customers skipping town, for a similar price. That, and collection enforcement, via local jurisdictions which have been lobbied to pass credit card fraud laws, are two of the main functions served by credit card companies. A third is collection of dossiers on customers, which we would like to put under customer control. For online services, where the customer can be billed in near real-time, the case where a large bill approaches the credit limit is at least exceptional, and might be eliminated entirely. Where the largest bill is much smaller than the credit limit, the customer is put at much smaller risk by putting up a deposit then by exposing their entire credit rating to both the vendor and snoopers who intercept the number. Furthermore, the deposit can be made with a neutral third party which serves the arbitrator function for disputes. In this particular case, phone billing could be done in very small increments, in near real-time, with digital cash. > But there's one more important point to consider: U.S. law on > disputed credit card purchases. This company was operating internationally; one of their customers who posted lives in Kuwait. Do all Internet jurisdictions have laws protecting credit card customers? How are these laws enforced? On whom lies the burden of evidence, legal costs, etc.? I agree that the issue of customer vs. vendor assumption of risk deserves much more attention than we have given it. A major goal is to minimize dependence on the maze of Internet jurisdictions to resolve conflicts. One interesting idea is an online escrow services that holds a customer deposit equal to the amount of the largest possible bill, and uses the escrow to resolve disputed billings. The challenge is minimizing leakage of private information, via the escrow. Nick Szabo szabo(a)netcom.com

2 1