December 2003 - cypherpunks-legacy

Re: The Remailer Crisis
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Tim urges recently that we need to do something about the "remailer crisis." I remember Sameer once mentioning that he could set up remailer-in-a-box accounts for possibly anonymous 'sponsors' who'd be the legal owners therefore indemnifying Sameer (the tolerant sysadmin) of responsibility. I know he allows 'remail-to-yourself' blind-server accounts for $10 / meg or something. That's probably a bit expensive for a sponsor of a public remailer (any stats on average remailer traffic?). I never did here any more from sameer or anyone else about remailers-in-boxed-accounts. I for one would be willing to 'sponsor' a remailer account on any system with a small fee - I can't run my own as my private site looks at the world through PPP. I suggest that 'sponsored' remailers are a better way of making remailers economically viable for people like Sameer, who are the real, if not nominal, administrators. Though I hardly use remailers, those who do would probably make better (and more easily executed) use of their money if they sponsor remailer accounts on Cypherpunk ISPs like c2, rather than pay a (truenamed, legally vulnerable) operator for any single remailer. Sameer's blind-server code can come in use to make any link between the sponsor and her sponsored account very hard to detect. The advantages of sponsoring remailer-site operators to create remailing accounts, rather than pay an individual remailer operator, are many: 1. innocent until proven guilty - presumably sponsors do use remailers a lot; but not necessarily. So the payment transaction can be via truename, rather than via some complicated anonymous means, and still leave the sponsor unimplicated 2. legal - an operator of a single remailer is vulnerable - technically, if not root, and legally otherwise. an administrator of a Cypherpunk ISP is not, and does not have the legal right to monitor a customer's traffic, and with blind-servers even detailed logging don't lead back to the owner of an account, the sponsor, from any _specific_ remailer (though a pool of sponsors exist for a pool of remailer account) 3. technical - it's not possible to ban a single remailer, as they may be _many_ on a site. If the site is much more than just remailers, it's not really possible to ban the entire site. 4. traffic analysis - more remailers addresses will make traffic analysis harder, and chaining more fun - you could chain through multiple accounts on a single site with little loss in reliability (though you'll still want to go through more sites) 5. remailer explosion - more reliable remailers (due to the '-in-a-box', more users, wider distribution Comments? ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

Spam Busters!
by Nathan Zook 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Yeah, the numbers should be higher. This was just a hypothetical! nzook(a)bga.com said: > There is little, if anything, we can do to stop a chained, PGP'ed mail > bomb, "This is mail bomb number XXX. Boom!" It is therefore in our best > interest to not encourage children to send such messages in such a way. I > believe Homer's message was erroneous for this reason. People, please! Before critisizing a method, look at the threat model! I plainly stated that my method was not intended to deal with real trouble. tcmay: "The From: line is notoriously misleading". But it still gives enough that we need remailers in the first place, right? The "From:" was a token. It wasn't meant as a literal. For id'ing postmaster, all you need is the xx.xx.xx.xx, right? jalicqui "Unless your remailer was the terminal remailer for a significant number.." But in a serious spam/mailbomb attack, someone would _have_ to get a bunch, right? With the changing session keys, and a chain, the best we could hope for would be to stop it on its way out. (or use for padding ;-) Incidently, a per/customer volume limit would also control the binaries. Since we have little hope of id'ing the true originator, we might have to limit a site. (bad) OTOH, if someone tried to send binaries, only to find that they couldn't get more than 1M out an hour, they would probably give up & go somewhere else. We might also hit the chained pgp bomber this way, as the messages would likely be fairly large? XXX But this all misses a point that I would like to stress. We are in what the military refers to as "low-intensity combat". Right now, we don't have a continuous stream of spam-bombs floating through our systems. (Well, we did, but jp shut down :-(( ) Right now, we (other than PRZ) don't have serious legal troubles. Right now, our remailers are too weak to be a significant problem to the TLAs (any more than a forged From:). The way to win a low-intensity battle is to avoid escalating unless you are sure you can win. Eventually, we will have to standardize packets. Eventually, we will have to employ very sophisticated techniques to deal with spam-bomb. But maybe we don't do that today. Maybe we do just enough to catch a bunch of the most juvenile. Then the next bunch is smarter. Then we catch them. We keep going. You see, I doubt that we can take on a spammer that knows the net as well as anyone here. But I don't doubt that word can get out that the remailers nail spammers. Of course, we risk becoming the latest challenge to the juvenile, but I think that this is far less likely than it appears at first because we are, after all, "really cool". My suggestion is to avoid, for as long as possible, letting on to _anyone_ just how sophisticated our systems are, just how much can be done, until we are sure we can win the unavoidable battles. XXX This also strongly points to per-line blocking of remailers. Since the necessary steps to catch a sUPer bomber appear to be impossible/ impractical, we must offer annon-blocking for those poor souls that request it. Perhaps annon-block for a month at a time. This is part of that PR that we need to watch. To put it another way, if our services make it easy(er) for someone to engage in an activity that we oppose, and that can hurt (subjective) someone else, we are facing a moral responsiblity for our actions. We should attempt to fulfill that responsibility. I believe that the phone company even allows people to change numbers for free if they are receiving harassing calls. And we want to be better though of than the phone company, right? XXX BTW, do you have to be a remailer operator to be on the list? If not, I'ld like to know how to subscribe... Finger or request keyserver for PGP 2.6.2 (tm) key. PGP<->Mail/News installation incomplete. Factors for modulous are not proven primes. Key may be far weaker than expected. Encode at your own risk. Key ID: 14712B4D 1994/12/26 Nathan H. Zook <nzook(a)bga.com> Key fingerprint = 44 B3 D8 66 3D 55 1E 2E F8 92 22 A6 33 8C DE 24 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLyBfUHmgMs8UcStNAQE7Ygf/Wg5+hKErgpqi+4J7jOAw97AitUnYn+z+ QJqAw4ar6hQEY/taC6ru5S8YjKYHwmXdR7n7YjSFjEy8aYwXSr4SaALICNhQsyrU jcSuaMY0oUN2obYV6TxYtdVWaQVF9XBqW/8AlIcs+ZF4Yi7gqUdgf4aApuapW14e drVi6PgV5ccg8a+wGBCdJhDy5AK0BJRtxUxtLDeb+MkaTOfk/ylLfBdbFV1iK7Ek qDmpAZdd+FpwKoqBTm+jbCa/kemwFN5touLeLijRWjEuoqFK0x/YYRYsAjJUNqu/ Qt6YWqvat8t7UYlTauVsQ/9XJNxADxmWlrKaaQTxmsHrobq0h4s+RA== =ykck -----END PGP SIGNATURE-----

1 0

Purshottam
by John Young 17 Dec '03

17 Dec '03

>----- Forwarded message (Andrew Purshottam <andy(a)eon.netcom.com>) -----< Dear Mr. Purshottam, Mail to <andy(a)eon.netcom.com> boings.

1 0

Why emoney? Why not a web of debt?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

[summary -- digital silk road along a web of debt-trust] Umm... money is not anything mystical -- it is just a convienient way to trade and settle debts. It was invented to solve the hassels of trading a pound of butter, for a box of eggs, that for a tightly woven basket, and finaly that for the gun you wanted in the first place. Yuch! accounting!! But electronic computers are good at checking out these kinds of chains automatically. Suppose there were a web of debt-trust. Each person would indicate the other people who's iou's they will accept (and the amount they would be willing to take). Thus I might take (up to $10 of) Jo's, who might take Carol's who might take Terry's, etc. To buy something from me online, you will need to produce an IOU from Jo, Carol or Terry. I would hand it to Jo for verification. Jo would accept it or reject it (perhaps after talking to some other folks online). If it were a CarolIOU, or a TerryIOU I would insist Jo trade it for a JoIOU. All the details could be hidden behind a nice little GUI. Jo and I would continuously balance the books between us by trading JoIOUs for NoybIOU's. After a while one of us might well end up with enough extra IOUs that we want to get paid. Perhaps the other would perform services directly, or pay FRN's or gold, or whatever. If one of my friends wasn't able run an online IOU server, I could probably trade things with my friend for IOU's. Not that I'm running a bank or any thing. With out every one being on line though I don't see an easy way to prevent double spending. Is there a offline multiple exchange token system invented yet? Noyb

2 1

Re: IRS to keep unreviewable secret dossiers on US citizens
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 12:44 PM 1/20/95 CST, xpat(a)vm1.spcs.umn.edu wrote: >Excerpts from : St Paul Pioneer Press, Jan 29, 1995 > >"IRS plans to collect more data on individuals to nab tax cheats" [...] Here's the text from the recent EPIC annoucement on this--it covers the exemption the IRS is claiming from the FOIA in a bit more detail (sorry if people have already seen this): ======================================================================= [6] IRS Initiates Massive New Database ======================================================================= On December 20, the Internal Revenue Service announced in the Federal Register that it was planning a new database to monitor compliance of taxpayers in a project entitled Compliance 2000. The database would contain information on all individuals in the U.S. who conduct certain financial transactions and would be segmented by different criteria: Any individual who has business and/or financial activities. These may be grouped by industry, occupation, or financial transactions, included in commercial databases, or in information provided by state and local licensing agencies. The new database will combine private and public sector databases in a single searchable entity. A number of federal financial databases from the IRS will be enhanced with state, local and commercial sources. The Federal Register notice describes the non-tax databases: Examples of other information would include data from commercial databases, any state's Department of Motor Vehicles (DMV), credit bureaus, state and local real estate records, commercial publications, newspapers, airplane and pilot information, U.S. Coast Guard vessel registration information, any state's Department of Natural Resources information, as well as other state and local records. In addition, Federal government databases may also be accessed, such as, federal employment files, federal licensing data, etc. Finally, even though the proposed system would use frequently inaccurate "commercial databases" such as direct marketing records, taxpayers would not be able to review their records to ensure that they are accurate and up to date: "This system is exempt from the access and contest provisions of the Privacy Act." EPIC is filing comments asking the IRS to reconsider its use of commercial databases and to ensure that there are greater safeguards on the collection and use of personal information. A copy of the Federal Register notice is available at cpsr.org /cpsr/privacy/epic/IRS_compliance_2000_notice_txt Comments on the proposed system must be received by January 19, 1995, and sent to Office of Disclosure, Internal Revenue Service, 1111 Conn. Ave, NW, Washington, DC 20224. EPIC's Comments are available at cpsr.org /cpsr/privacy/epic/epic_irs_compliance_2000_comments.txt --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

2 1

Send Me The Stuff
by Master-X 17 Dec '03

17 Dec '03

Please e-mail me with the stuff.

1 0

Re: T.A.Z. on Disk
by Mark Grant 17 Dec '03

17 Dec '03

On Fri, 20 Jan 1995, Angus Patterson wrote: > I also saw another e-book site that had some more of his stuff, can't > remember what it was though. There's some more on the WWW at http://www.uio.no/~mwatz/bey/index.html. Mark

2 1

Re: traffic analyzing Chaum's digital mix
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Wei Dai <weidai(a)eskimo.com> > I have been thinking about the problem of traffic analysis of a > remailer. > [...] > The basic approach is to use this raw traffic information to calculate a > SCORE for each user of the remailer with respect to Alice, where the > user with the highest SCORE is the person Alice is most probably > communicating with. The idea is that with a Chaumian mix, every time > Alice sends a message to Bob there is always a pattern of Alice sending > a message to the mix, followed by Bob receiving a message from the mix > during the next batch. By counting the number of such correlations for > each user over a period of time, and taking into account the fact that > users who receive more messages from the mix will have higher numbers > of coincidental correlations, a SCORE can be calculated so that it would > be a good indication over the long run of the probability that a particular > user is communicating with Alice. This sounds like a good idea. It was very interesting to see your earlier result on the impact of dummy messages on this approach. Even a relatively small number of batches without dummy messages allows continual accumulation of incriminating information. I know that the Eurocrypt 89 proceedings had some articles on cryptanalyzing Chaum's mixes. My library has an excellent crypto selection but is missing this volume. Can anyone who has read this say whether there is anything in those papers that isn't obvious? Another interesting aspect of your analysis is the possible role of latency. Earlier I had thought of latency as primarily a way of doing mixing, an alternative or addition to batching which mixes messages without holding them up quite as much. But in terms of this in/out analysis latency could play a part in blurring the batch boundaries, adding more uncertainty and making the job of the analyst harder so he would need more data to establish his scores. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLx/jixnMLJtOy9MBAQGFzwH/diYW0NSddacKyXGvsBc53FsR47R+4BSS pVprHz2LfpVl7U2FFAePMjZIGr5w24hA6nxn1brAO9v6JkVzgUabvA== =Vehs -----END PGP SIGNATURE-----

3 2

RE: Remailers-in-a-box
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >I guess it'd be possible to treat remailers as disposable - when one >had pissed off enough people, it could be abandoned - but this lack >of long-term reliability seems poor. Someone had posted a protocol scheme that would allow new remailers to advertise their existence on a newsgroup, which would cause any number of auto pinging "reputation" services to begin monitoring this new remailer automatically. Once reliability, etc., was established, the reputation services would "add" this node to the remailernet. Similar actions would take place if a remailer just "went away". Quality of service, features, etc., would be part of the advertisement, and would result in a form of competition between remailers. Similarly, reputation services would have differing criteria for "blessing" a site, which would result in a form of competition between the _reputation servers_ for a good reputation. The key to this whole scheme is in the automation of the process. Done correctly, it would result in a self-organizing, self-healing ecology of remailers, that would naturally gravitate toward providing the features and services in most demand. Yeah, sure. Looks good on paper, anyway. Lots of real-life hassles to work out, but it _probably_ could be made to work. == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)scruznet.com -Isaac Asimov -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLyB9001Diok8GKihAQEZAAP+MU2qaWZahpOgsdoyk7XuHvAnMbNGgalw zJqLNz4H8knRINEZsDsTR7pIMbnhMWxlRfDtgXXNCE8KXvdCA3FkVyG4MItFn5vF fQZxw9rg87m/B9YwEOEah9N4RhNXs2RHsB8dVinMkncw9REklWbGkydcxf0EvKkc Y6JgzEkX54w= =Tu9L -----END PGP SIGNATURE-----

1 0

Hakim Bey URL, etc.
by dmandl＠panix.com 17 Dec '03

17 Dec '03

The URL for the Hakim Bey web site (someone might have already posted this) is: http://www.uio.no:80/~mwatz/bey/ Except from the Hakim Bey interview in "Axcess" magazine (conducted last summer): "I have to admit I felt a certain intense interest, perhaps even amounting to a potential enthusiasm, when this tech was first being discussed," Bey told me. I'd read William Gibson like the rest of us, and I certainly understood his dystopian point, but nevertheless, when Tim Leary and people like that began to get enthusiastic, I had to investigate on that level. I haven't seen much evidence that what Uncle Tim thought was going to happen is really happening. Once again, any technology could be democratic if it were distributed, you know what I mean? It's a simple Marxist thing about means of production. There's nothing inherently authoritarian--at least at first glance--to any technology, although one could argue about how technology then shapes the society that has already shaped the technology in a kind of feedback loop that can move towards greater and greater authoritarianism or lack of autonomy. The potential for what, back in the 50's and 60's, people were calling electronic democracy, is obviously still there as a potential structure. You can see certain elements of it in the Net, but when you're talking about the high tech involved in virtual reality you're really talking about something that is not accesible to most people. And I think it probably never will be. There's never going to be any cheap VR kit that's going to allow a dock worker in Manila to get on some kind of cyberspace Internet, much less a dock worker in Atlanta--or me, for example." Bey was equally gloomy about the future of the Internet. "My impression is that 90 per cent of what goes out over it is completely unrelated to any kind of freedom interests, autonomy proposals or projects, or struggles for genuine non-hierarchical, non-authoritarian group dynamic. Most of it is just chit-chat--banal chit-chat that could just as easily be carried out over an old-fashioned party line phone." Unabashed in my online addiction, I couldn't help but ask if he saw _any_ way to realize the internet as a T.A.Z. "I'm led to believe, through conversations with people who are much more techie and active than I am, that cypher--unbreakable code--is the key. So the cypherpunks are the people to keep an eye on at this moment. They tend to be the ones who are most active around freedom of speech issues...whether legal or extra-legal. Even so, Bey felt that the powers that be will never allow the "Information Superhighway" to develop unchecked. "I think Clipper was a declaration of war on the Net. The fact that the egg is on their face, because within ten minutes some hacker figured out how to beat the Clipper, is an indication of--oh, let's call it an area of chaos. Within areas of chaos, either horrible destruction and disease and death occur. Or, if you're flowing the right way, and if all hearts are beating in unison to a certain degree, then that area of chaos can become the T.A.Z. Now I've said over and over again that there's no such thing as a T.A.Z. that's only on the Net, and I maintain that that's true. In order to have autonomy, you have to have physicality. Autonomy is not something that can only exist in the imagination or in the world of images. I think that it involves the entirety, the whole axial being, and that is rooted in the earth and concerns physicality, materiality, the body--mortality, if you like--as contrasted to the spurious immortality of cyberspace. But I still maintain that, at least in theory, the Net could be an adjunct to the T.A.Z., could be a tool or a weapon, even, if you want to look at it that way, for the construction of the T.A.Z." -- Dave Mandl dmandl(a)panix.com

1 0