December 2003 - cypherpunks-legacy

remailers for kids
by Carl Ellison 17 Dec '03

17 Dec '03

To: turet(a)u.washington.edu Subject: Re: K12 Personal Security Newsgroups: comp.society.privacy In-Reply-To: <comp-privacy4.52.6(a)cs.uwm.edu> In article <comp-privacy4.52.6(a)cs.uwm.edu> you write: > >Dear Netters: > >I recently have become involved in a project to implement Internet >feeds to some elementary/high schools. Actually, they already have the >feeds and the hardware, we're putting together a science/math >curriculum, also using Mosaic. I recently (re-)started looking at the >k12 newsgroups, which I haven't done in a few years, since my kids were >small. It struck me that there could be a possibility for abuse of the >system, for example in the 'chat' or 'pen-pals' groups and access to >names/addresses/phone #'s by those with less than salutory intentions. > >Does anyone else have any thoughts or experiences with this, and is >this an appropriate newgroup for this discussion? I hope I'm simply >being parental (fatherly) and not paranoid. > >I would like something like this to be a long thread, since I want to >explore this aspect of things before we just go head-long into the >network with the little kids and expose them to potential problems >later on. > >--Phil Turet >> turet(a)pmel.noaa.gov Funny you should ask this. I had a conversation just yesterday with a relatively new parent who is really scared about the Internet because it leaves kids exposed to wierdos. Rather than ask for elimination of anonymity for weirdos, he was asking for anonymity for the kids -- not just the e-mail address hiding of various remailers but also an automatic filter on postings to remove (or translate) names, addresses and phone numbers. I know of no one who has done anything beyond hiding e-mail addresses but that software exists, at least. (I've cc:'ed them here.) Perhaps some will have thoughts on the rest of the problem. - Carl -- Carl M. Ellison cme(a)sw.stratus.com RIPEM MD5OfPublicKey: 39D9860686A9F075A9A83D49589C677A Stratus Computer Inc. TEL: (508)460-2783 55 Fairbanks Boulevard ; Marlborough MA 01752-1298 FAX: (508)624-7488

1 0

Any cypherpunks building encrypted phone?
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Subject: Any cypherpunks building encrypted phone? > > Hello everyone! I'd like to know if anyone on the list has made >any attempt to construct a true encrypted phone, something at the >level of the AT&T DES phone. I think that it ought not to be too >difficult to build a couple, using existing modems and basic hardware >design. If all the commercial phones are going to be Clipper-based, >we'll have to build the real ones ourselves. > > Lady Ada, Queen of Engines I am working on that exact problem. It is not really that trivial. The encryption has to handle a lot of data real time. I have a license agreement for IDEA and am working on RSA. I am thinking of using tripple DES rather than IDEA because of the cost of the IDEA license. Two questions. One: Does anyone know of a good source of DES chips? Two: How much would you pay for a good encrypted phone? -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLa4m2FVkk3dax7hlAQF4vwP+KppgEM/05FsVJoonnDQrLKcaRJxqvt8y CgJ5OgaFNwAdsJJyQ25SfxaaubP/Q/Ncz3os2ECdxFDGiVOk97tg6DvTfXA5QoSw hFYuKb+7W/KK455I8WdZkeX6O6T/cLDqe94pcJSLSKo2mqwuGUaZ3jdKLAthPtOE DjqkjZettOM= =34Dg -----END PGP SIGNATURE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.3 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

Re: Remailer Reply Blocks
by Graham Toal 17 Dec '03

17 Dec '03

From: Matthew J Ghio <mg5n+(a)andrew.cmu.edu> : Which is why my remailer uses 3DES and adds random padding to the : address before encrypting it. Random padding will thwart many chosen : plaintext attacks, especially if you do some transpositions prior to : encrypting it. Since the text to encrypt is so small, doing five or ten : consecutive DES encryptions with different keys would not use up much : CPU time, but could dramatically increase security. Also I compress the : address slightly by stripping off the high bits so that 8 bytes fit into : 7. Just a few suggestions to keep in mind... You beat me to it :-) I was going to suggest xoring the data with a set of random numbers (generated along with the des key) to shield it from known plaintext, but a few rounds of DES might do just as well. You have to do *something* because there's a known-plaintext '@' in every email addr. : Overall, looks pretty good. BTW, what's the number that it prepends to : your email address when you get a reply? The things I'd improve on it are the need to edit out the indentation when you use the header block in a reply, and that you have to move the block from the end of the file to the top. Either it should start out at the top, or the remailer should search the whole mail for it. On chaining reply blocks: I was wrong about them getting larger and larger as they went through remailers - you don't have to encode the ascii representation of the last remailer's block and then ascii encode that too - you could generate your block by first de-ascii'ing the last block, prepending the return address, and then re-ascii'ing it. That way the previous return addresses would contribute the same size of data in every link in the chain. One thing more has to be done to foil traffic analysis - the encrypted email address has to be padded out a lot so that they can't guess who it was by knowing the lengths of the email addresses of a small set of possible posters. Assuming we're already stripping out the personal names etc in email addreses and just keeping the canonical bits (for example "Graham Toal" <gtoal(a)gtoal.com> -> gtoal(a)gtoal.com then I'd suggest padding with spaces to something like 64 chars, then going up +64 each time for those X400 idiots who might want to post through us :-) That way you won't be able to tell a 128-byte long name from 2 hops of a 64-byte short name. G

2 1

fake pgp messages
by hh＠xcf.Berkeley.EDU 17 Dec '03

17 Dec '03

in the process of doing stuff to fight traffic analysis, i need to generate a bunch of fake pgp messages. it is possible to asciiarmor random bits, but this is pretty easy to spot. does anyone know a good way to generate a large amount of bogus pgp messages? e

4 3

Number Theory
by Matt Thomlinson 17 Dec '03

17 Dec '03

Peter Murphy writes: >... > >and see the major number theorist in this department, Dr. Keith Matthews. >He is a really nice guy, and is always interested in writing and/or >distributing programs for number theory calculations. He even showed me >one of his newest programs, and demostrated it by factoring 2^71 -1 for Is this really that impressive? MapleV and my 386dx-20 just factored it into 212885833 * 48544121 * 228479 in a matter of 23 cpu seconds. >he teaches, and could I post it to the list. Voila! Not only did he have >it printed out on paper, but he also mailed me the relevant LATEX files. way cool. thanks for the legwork.. >{Textbooks: Number Theory} >... >N. Koblitz, "A course in number theory and cryptography", QA3.G7NO.114, Speaking of who .. he's at my university. :) Nice guy; one of the people who offered to help me with the remailer situation last year. Funny thing; last year the computer administrators wouldn't even allow a copy of PGP to reside on their systems -- now it is part of their public account (student-run officially University unsupported software, usable by all). >H. Shapiro, "Introduction to number theory", QA 241.S445 1983, this isn't the Hawk Shapiro..? >D.E.R. Denning, "Cryptography and Data Security", Addison-Wesley, 1982, > QA76.9.A25D461982 sigh. mt Matt Thomlinson University of Washington, Seattle, Washington. phone: (206) 548-9804 Check my home page -- ftp://ftp.u.washington.edu/public/phantom/home.html PGP 2.2 key available via email, or finger phantom(a)hardy.u.washington.edu

3 2

Aliases (general case)
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

Actually, it is legal to use an alias for any number of things, including the phone book, *_so long as the purpose is not to defraud_*; thus, using Mother Teresa Charities might be so construed, while using Sam Jones probably would not be. There are prohibitions against using false ID...driver's lic., passport, and so forth...but not against using an alias. This is all after consultation with my attorney... As a side note, it is possible in Texas to file an "assumed name" at the courthouse of the county(ies) wherein you plan to do business...costs about $15, including the notary fees, and lasts 10 years. You can have almost anything for a name....and what would be more natural than having your new "business name" in the phone book? Nice, legal...and cheap (except a business line is a bit more expensive). Can this be done in other states? Regards, Dave

2 1

Re: Warrantless searches -- A sign of things to come?
by Black Unicorn 17 Dec '03

17 Dec '03

> BUT NO WARRANT WAS SERVED! Does that mean I can get the ACLU up the school's > ass? If the school says they can do that because I pay to live on their > property, then why can't the CHA do what they want? Ah, but you see, you moved into the dorm (and signed a paper) saying you would follow the school's rules. These rules included uncool search and seizure and are allowed since you are not in a home... it's similar to a hotel's right to do room service when you're out at the pool. <- What your talking about is the difference between a lease and a license. Dorm "agreements" generally avoid the terms of art that make an agreement a lease. This is one of the reasons that they are called "Housing agreements." The fact that you do not have a leasehold on the property is one of the legal catches to allow your constitutional rights against search and seizure to be avoided. In fact many of the protections that are afforded leaseholders are denied those who merely have a "license." Such is NOT the case with the majority of government based housing. You cannot SIGN AWAY your rights in most cases. The exceptions are numerous, but a clause in a lease that says "the owner may search and seize whatever he likes" is hardly one of them. -uni- (Dark)

1 0

Re: Dirty Laundry...
by juola＠bruno.cs.colorado.edu 17 Dec '03

17 Dec '03

Peter Wayner says: > In 15 out 16 times, the progressive doubling system will work. No, it will not. I invite Mr. Wayner to produce a single demonstration of this system working. A suitable test should be easy to set up. Should be no trouble at all; I would do it myself except that I'm trying to write a dissertation. In the interest of "fairness," I suggest the following (without looking at the numbers). Most major newspapers, including the WSJ, list the prices of various sorts of futures. I suggest someone simply check the closing prices of a half dozen futures (gold, silver, oil, wheat, corn, and pick two at your convenience) on the 1st of January, 1993. Flip a coin for whether person A or person B does the buying of $10,000 worth of futures, then recheck the price on 1 Feb. If B makes $500 or more, assume the laundering has worked -- if not, double the investment and recheck on 1 Mar. If the Martingale scheme works, at least 5 out of the 6 should have successfully transferred the money by 1 Dec.... - kitten

1 0

Roulette
by rees＠cs.bu.edu 17 Dec '03

17 Dec '03

The Eudaemonic Pie by Thomas A. Bass (Houghton Mifflin Company, Boston, 1985), in chapter 6, discusses the various systems used in beating roulette. It gives the names and dates of people who have beaten the system through the use of martingales, biased wheels, and computers. An interesting book, highly recommended that you check it out. -Dave

1 0

Re: warrantless searches
by Black Unicorn 17 Dec '03

17 Dec '03

The idea of sweeps will never work, they'd have to do it a couple of times a day. I don't even need to go into the unconstitutionality of the whole process. The whole thing boils down to trying to use a simple solution to solve a complex problem, which works for politicians, but no one else. Besides, Handguns are illegal in Chicago, and have been for more than a decade....... <- Well not exactly. It is illegal to possess an unlicensed handgun in Chicago, and Chicago has not issued any new licenses in a decade. An account from a friend of mine went something like this. He had a workshop on the near west side and kept a .32 inside with him. The .32 was obviously unlicensed. Long and short, he ended up at "Gun Court." The process went something like this: If the defendant's skin color was lighter than the tan wall, a small fine ($100) was imposed. Other defendants were given hefty fines and some jail time. Note that the first category was never asked about past records, the second were always asked about past records. The point is this: Even if sweeps work, they won't "Work." Even the judges don't seem to think that getting gun holders off the street is a cure. Or they don't care one way or the other. I do agree that this is just Bayer for cancer. I grow tired of bearing the burden of some flunkies ideas of social engineering. Like I said before. If it's an emergency, declare one and suspend the constitution. Otherwise, come up with a real solution. It's amazing to me that administrations can lop all the low income housing into large poorly built high rises and then complain that crime is too excessive. -uni- (Dark)

1 0