December 2003 - cypherpunks-legacy

Signature Stripping and anon servers
by gkremen＠netcom.com 17 Dec '03

17 Dec '03

Article 17408 of alt.privacy: Xref: netcom.com alt.privacy:17408 Newsgroups: alt.privacy Path: netcom.com!gkremen From: gkremen(a)netcom.com Subject: Signature stripping and anon servers? Message-ID: <gkremenCtMrv2.190(a)netcom.com> Organization: NETCOM On-line Communication Services (408 261-4700 guest) Date: Thu, 28 Jul 1994 03:18:38 GMT Lines: 25 I am new to this group so please forgive my ignorance. I am looking at putting together a local anonymous server. However, people here have signatures that might give them away. They also forget that they have signatures. Is there a general (and I know that you can't cover all cases) of stripping signatures? What I was thinking about was: Read last 100 lines of message if a line begins with -- then if no MIME v1.0 header present then delete last 100 lines else if -- is part of part-boundary then ignore else delete last 100 lines Does anyone have any gross problems with this methodology? If so or if you have any suggestions, send mail to me and I will post the best stuff. Thanks in advance. Gary

2 1

Latency vs. Reordering
by Jeff Gostin 17 Dec '03

17 Dec '03

hughes(a)ah.com (Eric Hughes) writes: > For the Nth time, it's not latency, it's reordering which is important. True. For small numbers of files re-ordering is important. On the large scale, latency serves both purposes. I tend to think of these things on the large scale, which is the reason I pointed things that way. --jeff

2 1

Attention: the us.* hierarchy and its effect on the gun groups
by d9bertil＠dtek.chalmers.se 17 Dec '03

17 Dec '03

WHATS UP: There is discussion over at news.groups to start a new top-level hierarchy named us. The main argument being that the US of A should have an own hierarchy since everyone else has one. Now you might have whatever opinion on that, that is not core of the matter, but some people are trying to sneak in something very bad under cover of the us.* hierarchy question. They, and I'm talking of a cabal of seven persons calling themselves the "US Hierarchy Coordinating Committee" out of a net population of twenty million, want to sneak through severe changes in the newgroup creation procedures that would put them in absolute command of the us.* hierarchy. TODAY: Today when a new newsgroup is to be created, anyone can propose it, a period of discussion where anyone can participate follows and its fate it decided by a vote, in which anyone can participate. TOMORROW: In the us.* hierarchy groups can only be created by the cooperation of the US Hierarchy Coordinating Committee. After they have decided on a name for the group, and 'firmed up the charter', they will start a public discussion by announcement on a (by them) moderated group. If they decide that the group get enough support they will create it. The US Hierarchy Coordinating Committee is not elected by anyone. They are totally self-appointed. Their proposal does not include any rules or guidelines on how new cabal members are choosen, nor any ways to depose the current ones. To quote them directly: "The Committee feels that it would be better to wait until the hierarchy exists for a while so that the lay of the land may be better understood before proposing a whole system of rules for changes to the Committee, the creation guidelines, and the structure of the hierarchy." They themselves want to write the rules (if any) by which they themselves can be replaced, but they don't want to show us the rules, we should just accept them, they say. WHY: Why rip up the old democratic guidelines and replace them with this oligarchic mess? They say it is to make the us.* hierarchy more efficient and easy to use. Proposals to concentrate power in the name of efficiency always makes me wary. THE NEXT 40 LINES OF THIS MESSAGE SHOULD BE UNNECESSARY: Because this proposal should not be judged after how much good the the Comittee might do, and certainly not after what good things *they* claim they'll do, but after what bad things they *can* do since their proposal totally lacks any checks and balances. So what I have written upto this point should be enough to make you jump to the "WHAT CAN I DO" part:) MY FEAR: There have been much talk recently about how Usenet is lawless, about how various nastiness float around here, and about how the wild frontier needs to be tamed. I think that is what they intends. This is an attempt to impose authority on the net, put barbed wire across the frontier. I doubt that any controversial newsgroups will pass the comittee. I suspect that us.rec.guns will be as impossible to get past the comittee tomorrow as rec.illegal.drugs would be today. So therefore I urge everyone who has interests that is ever so slightly non-mainstream, either in reality or as pictured by the media, or feels that your interests might slide out of the mainstream soon, to vote NO to the us.* hierarchy, if you want a place to discuss your interests on on Usenet tomorrow. Around here I'm thinking of you who are any or all of pro-rkba, anti-WoD, anti-BATF, anti-censorship's, anti-clipper, libertarians, etc etc. [only 4 of which is correct about me, but that is irrelevant:) ] SO WHAT? So what? This will only cover the us.* hierarchy? The rest of Usenet will be as before? Right? Well yes and no. Formally that is right, but the net is growing at an amazing rate. New sites are added daily, many of them schools and schools lower and lower on the age scale is getting access. What do you think they will choose if given the choise between getting only the pg-13 us.* hierarchy, the R-rated normal Usenet or the X-rated altnet? Especially since the us.* hierarchy advertises itself as handling the US-specific issues on the net, I think most new sites in the US will play it safe and only get the us.* hierarchy. And the way the net is growing new sites will soon be in the majority and not long after that take up 90% of the total net sites. So if you want to say something that more than 10% hear, you'll have to go through the us.* hierarchy, and you better hope your interest is covered by the cabal-approved charter of a cabal-approved newsgroup. And if you have angered any of the cabal-members in the past you are f*cked. period. WHAT CAN I DO: You can vote NO to the proposed us.* hierarchy. A us.* hierarchy might or might not be a good idea, but under these rules it would be a disaster. It should be possible to just reply to this message (press 'R' on rn/trn/rrn), edit out all quoted text except the 1 line between the dashes, and send it off. You should however check that your mail is going to "voting(a)qualcomm.com" and not to me before sending it off. --------- I vote NO on this us.* hierarchy proposal. --------- After voting you should recieve an ack by mail within a day or two. If not then remail your vote. The voting closes on August 8, so vote early! IMPORTANT CAVEAT: In their CFV the cabal plainly writes that they will *not* accept the usual 'more than twice as many yes as no' criteria for group creation, and if they get defeated they also plainly state that they will rewrite their proposal and refile it immediately without waiting 6 months as is the normal procedure. They claim they can do this since there arn't any formal rules for HIERARCHY creation, just NEWSGROUP creation. Well most people assumed that in the absence of specified rules, the group rules would have jurisdiction, since a hierarchy is just a bunch of individual groups, but the cabal seems determined to steamroller this through despite any opposition. Kinda makes me wonder if they'd even follow their own rules, provided they ever write any that is. Therefore it is of the utmost importance that they are made to realize that the opposition to their oligarchic proposal is compact. Explain the gravity of the situation to all your on-line friends and collegues, and get them to vote too. This is doubly important if they are sysadmins or similiar. Get them to state that they will not carry a us.* hierarchy that does not abide by normal newgroup creation procedures. Thanks -bertil- ADDITIONAL INFORMATION: The full text (the little there is) is available on news.announce.newgroups under the Subject "CFV: us.* hierarchy" and with Article ID <us_hierarchy-CFV1(a)uunet.uu.net> A SECOND OPINION: Quoted without permission under the fair use doctrine from a call to vote NO posted on news.groups by John De Armond: * New rules are being proposed by a new defacto cabal that replaces the voting system that has worked well for the most part, with a system of "bosses" who control what gets created and what doesn't. And it replaces defined criteria for passage or failure with the "judgement" of the bosses. It replaces the will of the users with the will of a few men sitting on high. This is the antithesis of the net spirit. * The proposed group creation criteria is most unsatisfactory. The newly formed cabal proposes to replace the current vote with an "interest poll" whereby if 100 people sorta indicate an interest in the group it is created regardless of the number of negative votes. This is NOT the way to create new groups. * The makeup of the cabal has been decreed from the cabal and no procedure for removing or replacing members is contemplated in this proposal. The highly controversial nature of several of the proposed cabal members combined with no mechanism for removal almost guarantees a spoils system with no checks and balances at all. "Piss me off and your group fails" isn't the way to run the net. * This vote is being conducted in a very abnormal manner, without the usual CFD discussion period. If changes are needed in the current group creation process, the proper way is to implement them in accordance with the old procedures until those procedures are formally changed. Change via fiat is again the antithesis of the net culture. For all those reasons and more, I urge everyone to REJECT this proposal and vote NO. This is a BAD heirarchy and a BAD proposal and deserves to die. -- Legal Notice: Exporting 'personal data' to non-European countries without special license issued by the Computer Inspection Agency ('Datainspektionen') for each specific case (message) is a crime. Personal data include names, even my name. If you read this message outside Europe, I'm a criminal.

1 0

Re: Cryptosplit note
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

It uses rand() when it needs random numbers for the coefficients of the polynomial. I don't know what kind of security risk that poses, but it really should be using something better. It definitely should. It will be trivially crackable. (Well, trivally after someone writes the program I mean, which is more tedious than difficult). (Next question to determine *how* tedious... what do you do to initialise the random sequence? - oh, never mind, I should look at the code, except it's probably not worth the effort now. Just make sure people only use it for fun and not serious data hiding. Ask on sci.crypt if anyone wants to take a crack at decrypting the exored data, given the source code.) Where can I get Blum-Blum-Shub source or documentation on the algorithm? Can't help on that one, sorry. They don't tell us nasty furriners. g

1 0

Anonymous Remailer list
by Jeff Gostin 17 Dec '03

17 Dec '03

C'Punks, I'm looking for a list of Anon Remailers that hopefully have most/all of the following features, or at least get me in the ballpark. Failing that, perhaps just a list of remailers would be nice. Requested features: o I would like to be able to send a PGP [2.3-present versions!] file with commands-etc to be decoded and processed by the Anon Remailer. This allows me to not have to send my password-etc in plaintext. I realize that this will have to wait until after my first email to the remailer, as it has to get my key. o Allows embedded PGP files: One for the remailer, which contains both a second PGP message and commands for the remailer. o Allows passwording of anon accounts (I know, they probably all do this....) o Reports back errors in command syntax-etc, using a pgp encrypted file. o Uses latency and/or reordering. o Relatively quick (this might countermand latency -- I'm not sure which is more important to me) I'm just getting started with remailers, and am interested in secure, anonymous communications. --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

Remailer ideas (Was: Re: Latency vs. Reordering)
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

I was thinking some about remailers and means to create more effective ones. I think the idea of padding messages has been kicked around (has anyone implemented it?), but what about random compression? Some messages are compressed, others are padded, some are left alone, perhaps shooting for a median message size (everything coming from this mailer tries to be 9k, or as close as possible). Of course, this requires a standard so that other remailers downstream can make the message readable. Another thing that occured to me is the thought that if there were an organized web or remailers, remailers could bounce messages between them automatically- a header could identify the number of bounces perhaps, I haven't thought too much about the implications of doing so, but if every message through the web bounced around 30 times with reordering, padding/compression, PGP, etc. then traffic analysis would be pretty damn hard, I would think, even for someone monitoring the entire web of remailers' traffic. This all assumes that: - remailers can agree on a standard for the above needed features - a semireliable web of remailers can be maintained - some method fordealing with denial of service attacks can be found (a coredump sent to the web could play all sorts of hell, as could an 'evil' remailer that sneaks in and changes the how-many-times-through identifier). The third problem could be delat with by deciding on a size limit- if a message is over 65k (or whatever) it is bounced- if you're sending something big, split it. The first one could probably be done- if someone (grin- if I find any time soon, this is a project I'd like to do) wrote a nice package that was easy to install and use with a feature set that could be agreeable to most. The second one is the problem, but could be dealt with by the first by establishing automated communication- when someone installs the package, send a control message another remailer already part of the web which 'registers' it, and then the web consistently tries to maintain itself by checking on the others and dropping ones that go down off the list. Some sort of method would have to be found for ones that drop off then later come online again so that control messages didn't have to be manually initiated every time, but that shouldn't be that hard. What are the problems in the above? Would Perl be a good choice for doing this? I saw some code from a remailer some time ago, but lost my mailbox a while back (which could also mena that this is a dry rehash of an old discussion... apologies if I am rewriting someone elses thoughts). Anyone still have this? Am I talking out my ass? -j -- "Blah Blah Blah" ___________________________________________________________________ Jamie Lawrence <jamiel(a)sybase.com>

3 2

Please verify key for remailer@soda
by Jeff Gostin 17 Dec '03

17 Dec '03

Hello fellow C'punks! As my last message said (for those who read it), I'm just getting into anon remailers. I just picked up the docs and PGP key for the remailer@soda. I would appreciate it if people would send me fingerprints of the key. This is so that I know it hasn't been tampered with, or at least can be reasonably sure. Thanx, in advance! --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

2 1

RE:
by Blanc Weber 17 Dec '03

17 Dec '03

From: David K. Merriman It has been brought up on the Cypherpunks mailing list that Microsoft is proposing to include public-key escrow as a *built-in* "function" of future products - Chicago and Daytona have been specifically mentioned. ...................................................................... .......... No, this is not correct. It was speculation from Tim May on possible developments, based on his interpretation of recent events and on email which I sent to him. This email was referring to the fact that his concerns notwithstanding, it is not an easy thing to implement a privately-held key escrow system into a desktop operating system, that Microsoft is not talking about implementing a 'software Clipper', and is presently only *examining* the international ramifications of software key-escrow and non-escrowed strong encryption security. Please give it this question the benefit of the doubt and postpone your conclusions about this until I can get an official statement, thanks. Blanc

3 2

(fwd) Possible compromise of anon.penet.fi
by nzook＠math.utexas.edu 17 Dec '03

17 Dec '03

Path: math.utexas.edu!news.dell.com!tadpole.com!uunet!spool.mu.edu!howland.reston.ans.net!gatech!news-feed-1.peachnet.edu!news.duke.edu!eff!news.kei.com!hermes.oc.com!convex!cnn.eng.convex.com!barnett From: barnett(a)convex.com (Paul Barnett) Newsgroups: alt.privacy Subject: Possible compromise of anon.penet.fi Date: 27 Jul 94 22:09:28 GMT Organization: CONVEX News Network, Engineering (cnn.eng), Richardson, Tx USA Lines: 29 Message-ID: <barnett.775346968(a)cnn.eng.convex.com> NNTP-Posting-Host: zeppelin.convex.com Someone has been collecting email addresses, apparently from postings to Usenet, and forging them to anonymous postings through anon.penet.fi to alt.test. The text of the posting states the REAL email address of the poster, under a posting attributed to the anonymous ID assigned to that poster. I received a notification that an anonymous ID has allocated for me, followed by a confirmation of a posting to alt.test. Looking in alt.test, you will see as many as 500 similar postings. Most of the anonymous IDs are numbered sequentially. However, there are some lower numbered anonymous IDs, presumably in previous use by the addressee named in the text of the message. These anonymous addresses are now compromised. I am posting to this newsgroup because there appears to be some correlation between the contributers to this newsgroup and the addresses that were forged to the messages. It may be coincidental, but I thought this was a fair place to post a warning anyway. My condolences to those people that have been caught in this net. This is one of the most despicable forms of net.terrorism that I have encountered. -- Paul Barnett Convex Computer Corp. MPP OS Development Richardson, TX

2 1

(fwd) WWII Enigma traffic
by Jim choate 17 Dec '03

17 Dec '03

Newsgroups: sci.military Path: bga.com!news.sprintlink.net!sundog.tiac.net!usenet.elf.com!news2.near.net!MathWorks.Com!news.duke.edu!godot.cc.duq.edu!newsfeed.pitt.edu!uunet!ncrgw2.ncr.com!ncrhub2!ranger!military From: lharnisch(a)delphi.com Subject: WWII Enigma traffic Message-ID: <CtMKns.J91(a)ranger.daytonoh.ncr.com> Sender: military(a)ranger.daytonoh.ncr.com (Sci.military Login) Organization: Delphi (info(a)delphi.com email, 800-695-4005 voice) Date: Thu, 28 Jul 1994 00:43:04 GMT Approved: military(a)ranger.daytonoh.ncr.com Lines: 13 >From lharnisch(a)delphi.com Does someone know the location of archives (or preferably microfilm) containing undeciphered German Enigma traffic? It isn't important whether it was cracked by the Allies during the war... am simply seeking some original German traffic to test computer program.... I have already gone through messages in the journal Cryptologia...... Pls E-mail me if you know of some sources... Thanks.... Larry Harnisch

1 0