December 2003 - cypherpunks-legacy

MacPGP a plant?
by Black Unicorn 17 Dec '03

17 Dec '03

Now I'm sure I'm jumping to conclusions, but consider the following: 1> The MacPGP2.3 source is, as near as I can tell, unreleased and unavailable. 2> The output from MacPGP2.3 is easily distinguishable from MSDOS output. (MacPGP headers all messages with "Version 2.3" and not "Version 2.3a") 3> The signature file intended to show the applications is intact from the author is not included with the compressed application on any of the sites I have seen MacPGP2.3 on. The implications are left as an exercise for the reader. MacPGP2.3 has been in release for some time now, yet no one has commented (that I have seen) on the absence of a signature file or detached signature with the release. Is this because I just can't find the signature, or is there no signature available? -uni- (Dark)

1 0

digi-script?
by Stanton McCandlish 17 Dec '03

17 Dec '03

Sorry I didn't find this sooner, but the info is still of interest even if the conf is over. Forwarded message:

1 0

MAIL: remailer list
by Karl Lui Barrus 17 Dec '03

17 Dec '03

Cypherpunks, I was just informed by Chris Walker that the remailer elee9sf(a)menudo.uh.edu is now down. If you send mail, it bounces with "this account is expired". Sheesh, in the space of two weeks I've lost all four remailers I had running at UH. Time to set up another ;) -----BEGIN PGP SIGNED MESSAGE----- Cypherpunk anonymous remailers, 3/3/94 Q1: What are the anonymous remailers? A1: 1: remailer(a)chaos.bsu.edu 2: nowhere(a)bsu-cs.bsu.edu 3: hh(a)soda.berkeley.edu 4: hal(a)alumni.caltech.edu 5: ebrandt(a)jarthur.claremont.edu 6: catalyst(a)netcom.com 7: remailer(a)rebma.mn.org 8: hfinney(a)shell.portal.com 9: remailer(a)utter.dis.org 10: remailer(a)entropy.linet.org 11: remail(a)extropia.wimsey.com NOTES: 1-3 no encryption of remailing requests 4-11 support encrypted remailing requests 11 special - header and message must be encrypted together 7,9,10,11 introduce larger than average delay (not direct connect) 7,9,11 running on privately owned machines 3 features USENET posting ====================================================================== Q2: What help is available? A2: Check out the pub/cypherpunks/remailer directory at soda.berkeley.edu (128.32.149.19). chain.zip - program that helps with using remailers dosbat.zip - MSDOS batch files that help with using remailers hal's.instructions.gz - in depth instruction on how to use hal's.remailer.gz - remailer code pubkeys.tar.gz - public keys of remailers which support encryption pubkeys.zip - MSDOS zip file of public keys scripts.tar.gz - scripts that help with using remailers Or try the cypherpunks gopher site (chaos.bsu.edu) and look in "Anonymous Mail" for instructions. Mail to me (klbarrus(a)owlnet.rice.edu) for further help and/or questions. ====================================================================== Q3. Email-to-Usenet gateways? A3. 1: group-name(a)cs.utexas.edu 2: group.name.usenet(a)decwrl.dec.com 3: group.name(a)news.demon.co.uk 4: group.name(a)news.cs.indiana.edu 5: group-name(a)pws.bull.com 6: group-name(a)ucbvax.berkeley.edu NOTES: * This does not include ones that work for single groups, like twwells.com. * Remember to include a Subject: with your post, may cause failures if missing #6 blocks from non-berkeley sites (so use the berkeley remailers :-) ====================================================================== This is the remailer.data file I use with nestping, a script for pinging anonymous remailers: 01:n:remailer@chaos.bsu.edu 02:n:nowhere@bsu-cs.bsu.edu 03:n:hh@soda.berkeley.edu 04:y:hal@alumni.caltech.edu 05:y:ebrandt@jarthur.claremont.edu 06:y:catalyst@netcom.com 07:y:remailer@rebma.mn.org 08:y:hfinney@shell.portal.com 09:y:remailer@utter.dis.org 10:y:remailer@entropy.linet.org 11:s:remail@extropia.wimsey.com -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLXVIg4OA7OpLWtYzAQFp1gP9EBxByjifFHwNRzXo9/aBAOUlZeeLKlTe r8bDbVCsX3KH3DKPETGZrT5+KbTZOeNAJWbJXb+pv6LCPN0s9cMnQt9hf5znPaS0 ZbYz/JNaMGenqt+oZAy/xN1GWc+0UcuKEyr2dZrqrZB1be6Ilv2G77tIC1H1HZ1b 2GcsRMUair8= =/PYK -----END PGP SIGNATURE-----

1 0

LIST: encrypted
by Karl Lui Barrus 17 Dec '03

17 Dec '03

About receiving this mailing list encrypted.... I beleive Hal Finney is (was?) offering such a service. Basically you send in your public key, and Hal pipes all list mail through pgp and remails it you, from one of his anonymous remailers. I don't think many people opt for this :) but the option is there (unless Hal isn't offering it anymore). He'll probably answer when he reads the list mail! -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

1 0

help getting files off csn.org???
by dan＠kypris.com 17 Dec '03

17 Dec '03

Hey all! Can someone help me out as to how to get the pgp-related stuff off csn.org? Unfortunately I don't have real ftp, only ftp through the ftp-mail-server. I have grabbed the README.MPJ file and immediately sent an ftp request to get files from the ever-changing I_will_not_export/??? directory, but get back a "no such directory". How often does the directory name change? Am I just not going to be able to get them through ftp-mail requests? Thanks, Dan --- Daniel A. Nichols Voice: (214) 307-0474 Kypris Software Systems Fax: (214) 306-3409 2601 Frankford Rd. #2703 E-Mail: dan_nichols(a)kypris.com Dallas TX 75287-4517 NeXTMail Welcome!

1 0

Re: Dorothy Denning
by Black Unicorn 17 Dec '03

17 Dec '03

-> Chill... I thought that our prime objective was to defeat Clipper... even if you don't like Ross, he does have some pull with the people of this country, and that's what we need... we need the *PEOPLE* to fight Clipper. We need the fight not to just be "a group of civil libertarians", but the general populous. Maybe Ross isn't the answer, but at least I've taken a real step to try to oppose Clipper. What the hell have you done, Black Unicorn? Anthony <- In the circles I travel in Mr. Perot is considered a dangerous paranoid. I agree he has the ear of some *PEOPLE* (as you so nicely put it) but as much as you fear the branding of the anti-clipper movement as JUST "a group of civil libertarians," it is possible that there are other brands just as destructive to credibility. Mr. Perot is in my opinion represenative of one such brand. The Good Perot Keeping Seal might sink the "general populous" boat we would so much like to travel on. As far as your efforts in this matter v. mine, Anyone can post some messages to the list Mr. Ortenzi. -uni- (Dark)

1 0

PC Expo, Mac World, Comdex, etc...
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

If a few of us who have a bit of money to spend on disks and duplication could come together (or work apart) we could just go out infront of PC Expo, or any other expo and simply hand out free disks with stuff like PGP, SecureDrive and whatever else, maybe even include a flyer with info about getting more info on issues like clipper and such... Perhaps some sort of self running hypertext demo to show analogies, say via a caricature of Dorothy Denning or Billary Clingon trying to install bugs in the phones of the viewers, cameras in cable TV boxes, microphones in bathrooms etc, all bearing the word "Clipper" on them... :-) (The distribution method isn't my idea, a dude who runs or works for an internet mail/news only carrier approached me and gave me a flyer...) "Get your free PGP disks here, learn about how Uncle Sam is spying on your privacy, etc..." :-) Now for some rude awakenings to follow... are there any laws against handing out >FREE< disks to people exiting or entering a convention center? (hopefully not too many.) Putting up an informercial will reach a lot of people who couldn't care less. Putting this stuff in the hands of those who have the interests of big business will reach a wider bit of the people we need to reach.

1 0

Standard for Stenography?
by Gary Jeffers 17 Dec '03

17 Dec '03

Firstly, congratulations for Sergey Goldgaber's stubborn pushing of this topic, for Bill Stewart's observation: "simple stego-programs, stealthy encryption programs", & for Norman Hardy's notice of the possibility of non-randomness in the low order bits of pixels. Here are my proposed standards & suggestions for stenography. 1. The stenography module is just a simple program for inserting data into a picture. The data is not plaintext! Ideally, stealth pgp is the encryption method. There should be no clever variable positional stenography. No security through obscurity. No "TOWERS of BABBLE". It must be standardized for easy conversation. I agree with Bill Stewart on this: simple stego programs, stealthy encryption programs. 2. The 1st position of the stenography is defined as the 1st pixel transmitted or received. The 1st several pixels should make up the header. The header should be of a fixed size with fixed sized & positioned fields. The header follows: 1____6 7_________17 18>>>>>>> checksum; "STENOGRAPHY"; the encrypted text The numbers refer to pixels. One bit of encrypted data per pixel. The 1st field is a checksum particular to that RSA key. The 2nd field consists of the word "STENOGRAPHY" in caps. The remainder is devoted to the encrypted msg. itself. The checksum is a standardized checksum method that has the same checksum as the RSA key. You need this in case you have given out several public keys. The checksum may also be an integral multiple of the RSA key. The reason for the checksum is in case the recipient has multiple keys, this will help him select the correct one without using huge numbers of cycles. Only 6 bits are used since that would be all that would be necessary & to eliminate the possibility of a huge number that would be large enough to constitute a legal proof. Also, by using a small number, investigators are not given much of a clue. By allowing integral multiples, you allow a fairly large number of keys but also stop small numbers from popping up a lot - no statistical suspensions! The reason for the "STENOGRAPHY" field is to assist your computer in determining if this is a stenography file & that the correct key was chosen without attempting to decrypt the whole file. I know that this presents the possibility of a small "known plaintext attack", but a good encryption system should stand up to such an attack. RSA can ... can't it? 3. No "lossy" picture methods! Two methods immediately suggest them -selves: JPEG & GIF. JPEG is ordinarily a lossy method but I am told that it has a no loss option. GIF is not a lossy method. I hear that JPEG has the ability to carry more bits per pixel than GIF so I would suppose JPEG. Also, while earlier I suggested 1 bit of encrypt per pixel it may be cool to use more. 4. Norman Hardy has suggested something that I have wondered about: are low order bits of pixels really randomly distributed? You graphic/ statistic ace's out there need to check this out & inform us. Possibly, some methods do & some don't? Inquiring cypherpunks need to know! I don't know too much about graphics, so I could use a lot of help. 5. What are the best pictures to use? I would suggest soft focus pin- up girls, mountain ranges, clouds, fields of grain, dense vegetation. Would soft focus help in all these types? note: I think kiddie-porn would be a bad idea. The above suggestions support the stealth method- strong encryption- simple stenography- public key- standardized model. If I have missed anything or you have a better idea, please let us know. Yours Truly, Gary Jeffers

2 1

What's Wrong with the List--Part 2
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

While I'm on a rant about what's wrong with the way the list is going, let me mention another serious problem: * People who want others to "do more." It seems that every few months someone starts loudly whining that others are not doing enough. This is very grating. For example, Detweiler started down his path to neurosis by begging and pleading for folks on the list to do more to help fulfill his vision of a "whisteblowing" group (note that others had discussed this idea, too, so Detweiler cannot claim all the credit). His pleas were eventually answered by Miron Cuperman, who went ahead and newgrouped "alt.whistleblowing" or similar. This is, by the way, now an essentially zero traffic group. More recently, "Xenon" got it into his head that the most important project in the universe was "Stealth PGP." Again, a good idea (and one that Phil Zimmermann, Kelly Goen, and others were calling by that exact same name more than a year ago). But Xenon figured that if he excoriated us enough for not immediately implementing his vision, we'd eventually work on it. He flamed out after a brief stint on the list and says he is now unsubscribed. (Which is too bad, as he had some good ideas. His problem is that he got _too excited_ about some particular ideas. Yes, getting "too excited" can be a problem: when one exhorts others to do the work one cannot or will not do oneself. In other words, badgering, lecturing, and moralizing. Xenon apparently came to see the lack of a rush to his flavor of steganography as some sort of failure of will by the Cypherpunks, and unsubscribed.) These are the dangers. Whenever I feel the urge to exhort others to work harder and longer at some task, I think about this situation. (I have no problem with political rants, exhorting folks to adopt my point of view on something. But I avoid--I hope--asking others to do work that I am unwilling or unable to do. It just isn't right. If one wants others to do something concrete, a less "bossy" approach is called for, and one should be prepared to give something in return.) Closely related to this issue is the habit some have of talking about what "we" have decided "our" goals are and how these goals of "ours" should be fulfilled. (As a sidenote, L. Detweiler kept asking what the "Cypherpunks goals" were and what the "leaders" expected to be done. When many folks told him in no uncertain terms just what kind of anarchy the List is, poor Detweiler just couldn't handle it. I think "control freaks" like Detweiler want plans, want others in harness to fulfill these plans, and want to boss others around.) I'll stop with the rants for now. Take my comments any way you like, but I hope they are taken in the spirit in which they are given--as honest observations of some of the problmes affecting a list with nearly 800 subscribers. Cheers! --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

HUMOR: Sternlight on the CPSR Clipper Petition
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Cypherpunks, And now for some humor amidst my rants. This is a post I did that makes light of David Sternlight's bizarre assertion that the anti-Clipper petition of the CPSR contains few valid signatures because he, David Sternlight, asked those who signed the petition to send him e-mail....and he only got 35 responses! QED, the CPSR either faked the signatures or others forged messages. (Sternlight even cites "cypherpunks" as likely culprits, noting that they are skilled at creating phantom identities....I guess Detweiler was listened to by at least one kindred soul.) The methodological flaws in Sternlight's line of reasoning are too obvious to go into here, and Sternlight has sunk to a new low in terms of respect. His claims that he was recently a senior government policy advisor give me new insights into why the government is as screwed up as it is. Finally, I've avoided flaming Sterno in public, and I had some qualms about kicking him while he's so much of a fool over this issue, but my satirical urges got the best of me. Here it is: Newsgroups: comp.org.eff.talk,alt.privacy.clipper,alt.security.pgp,talk.politics.crypto,alt.security.ripem,alt.fan.david-sternlight From: tcmay(a)netcom.com (Timothy C. May) Subject: Re: CPSR Clipper Petition test results Message-ID: <tcmayCM320o.6I0(a)netcom.com> Date: Thu, 3 Mar 1994 09:50:47 GMT Matt Austern (matt(a)physics2.berkeley.edu) wrote: : The US government claims that over 100 million people voted in the : 1992 Presidential election. Fewer than 50 people, however, personally : told me that they voted in that election. : It won't play, fellas. 50 people out of 100 million? Clearly, this : supposed "election" didn't really happen. This effect is far more widespread than you suspect. Several days ago I posted a request in rec.skate for people to send me e-mail if in fact they watched the Olympics--any or all of it. While the pundits at CPSR (Central Polling for Sports Research) would have us belief that _more than_ 100 million Americans (which is "many" but not "most") watched some or all of the Olympics, I received a paltry 3 responses, and one of these was a string of moronic insults, so I really only count 2 valid response. Could 100 million Americans have watched the Olympics if I only received 2 valid responses to my poll? My many years advising the government in senior policy postions, and my Ph.D in statistics tells me "Not on your life." Applying the Black-Scholes significance test (with a quartile scatter factor normalized to the Kolmogorov constant), I have concluded that the actual number of Olympics watchers was 135 plus or minus 7.32. I thus conclude that CBS, the Olympic Committee, the Tonya Harding Kneecapping Club, and the ever-treacherous CPSR are all lying to us! I will, however, not discuss this matter any further! (At least not until I do.) --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0