December 2003 - cypherpunks-legacy

Re: Remailer Chaining Security? [LONG]
by usura＠vox.hacktic.nl 17 Dec '03

17 Dec '03

:But how does one go about chaining through the remailers? I tried this :and the message got lost. If indeed you can, does it just involve using :more than one (anon-to) line in the header? Note-1: [R-R-T: stands for Request-Remailing-To: ] Note-2: [You is in this doc abraxas(a)cyberspace.org, substitute that adress for own if you want to receive the test message yourself] First you should test only one remailer: you > remailer 1 > RRT- you This is what you send: -- TO: remailer(a)jpunix.com :: Request-Remailing-To: abraxas(a)cyberspace.org Test of remailer at jpunix.com ------------------------------------------------ This is what you receive: -- You will receive this message from jpunix.com From: remailer(a)jpunix.com To: abraxas(a)cyberspace.org Test of remailer at jpunix.com -- If this is succesful you add another remailer: you > remailer 2 > RRT- rem 2 >> RRT you This is what you send: --- TO: remailer(a)jpunix.com :: Request-Remailing-To: nobody(a)kaiwan.com :: Request-Remailing-To: abraxas(a)cyberspace.org Test of remailer at jpunix.com and RRT kaiwan.com ----------------------------------------------------- Remailer nobody(a)kaiwan.com will receive this message from remailer(a)jpunix.com ------ From: remailer(a)jpunix.com To: nobody(a)kaiwan.com :: Request-Remailing-To: abraxas(a)cyberspace.org Test of remailer at jpunix.com and RRT kaiwan.com ------ Because the message has the header pasting tokens [::] the remailer at kaiwan.com knows where to send it to. You will receive this message from kaiwan.com From: nobody(a)kaiwan.com To: abraxas(a)cyberspace.org Test of remailer at jpunix.com and RRT kaiwan.com --------------------------------------------------------- You can keep adding remailer this way, everytime you receive a test message back you add another remailer: if you stop receiving test messages, the last remailer added is most likely "down". You can check that by using that remailer directly. --------------------------------------------------------- The above is simple unencrypted remailing. If you want to have an encrypted chained remailing, you first have to "design" the chain. 1] send to jpunix.com there RRT kaiwan.com 2] at kaiwan.com RRT vox.hacktic.nl 3] at vox.hacktic.nl RRT abraxas(a)cyberspace.org First you make the 3rd stage: -- :: Request-Remailing-To: abraxas(a)cyberspace.org Test of PGP'ed remailing trough jpunix, kaiwan and vox. -- The above is encrypted whit the PGPpubKEY of VoX.hacktic.nl and will result in this: -----BEGIN PGP MESSAGE----- Version: 2.6 for VoX Labz. hIwCWd90FI1WkT0BA/9I6ILVhl5ZpsgKgHye+ng9CokwzdW1pMgcd0ecigppAODe 53LlyVw/hl1ERYIzWW9W4vnuh7sLgu9XjxB515FtT5VSyZLZrhKIF7XtACga2On+ 1NmsecLTrgXYcc4k0Y+l66Hs06z92yhFvjXruDBS2Pame0VDtgZo+4aPntioDaYA AABJsVIWRaJkCib+uek9Pr6GqFP7lwaMqq8XFnFxY42h3Wn3c5DikrzmwKGK5xVs hmiZnEhJgXvR7jS2cNNOk/geG4SnUqvMTzpq6w== =b0bT -----END PGP MESSAGE----- -- Then you than proceed to the 2nd stage the message wich has to leave kaiwan.com: :: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.6 for VoX Labz. hIwCWd90FI1WkT0BA/9I6ILVhl5ZpsgKgHye+ng9CokwzdW1pMgcd0ecigppAODe 53LlyVw/hl1ERYIzWW9W4vnuh7sLgu9XjxB515FtT5VSyZLZrhKIF7XtACga2On+ 1NmsecLTrgXYcc4k0Y+l66Hs06z92yhFvjXruDBS2Pame0VDtgZo+4aPntioDaYA AABJsVIWRaJkCib+uek9Pr6GqFP7lwaMqq8XFnFxY42h3Wn3c5DikrzmwKGK5xVs hmiZnEhJgXvR7jS2cNNOk/geG4SnUqvMTzpq6w== =b0bT -----END PGP MESSAGE----- But kaiwan.com has to know where to send it to, so the 2nd stage msg is: :: Request-Remailing-To: remail(a)vox.hacktic.nl :: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.6 for VoX Labz. hIwCWd90FI1WkT0BA/9I6ILVhl5ZpsgKgHye+ng9CokwzdW1pMgcd0ecigppAODe 53LlyVw/hl1ERYIzWW9W4vnuh7sLgu9XjxB515FtT5VSyZLZrhKIF7XtACga2On+ 1NmsecLTrgXYcc4k0Y+l66Hs06z92yhFvjXruDBS2Pame0VDtgZo+4aPntioDaYA AABJsVIWRaJkCib+uek9Pr6GqFP7lwaMqq8XFnFxY42h3Wn3c5DikrzmwKGK5xVs hmiZnEhJgXvR7jS2cNNOk/geG4SnUqvMTzpq6w== =b0bT -----END PGP MESSAGE----- The above is then encrypted whit the PGPpubKEY of kaiwan.com: -- Stage 1: This new encrypted message gets the headers for jpunix to remail: :: Request-Remailing-To: nobody(a)kaiwan.com :: Encrypted: PGP -----BEGIN PGG MESSAGE----- and the PGP encrypted message from stage 2 -----END PGP MESSAGE----- --- Stage 0: the message you send to jpunix.com is the encrypted message [with the PGPpubKEY of jpunix.com] of stage 1 plus a Encrypted: PGP header. To: remail(a)jpunix.com :: Encrypted: PGP -----BEGIN PGG MESSAGE----- and the PGP encrypted message from stage 1 -----END PGP MESSAGE----- -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0

ANNOUNCE: June SF Bay Area physical meeting
by hughes＠ah.com 17 Dec '03

17 Dec '03

ANNOUNCEMENT ------------ The June meeting will be held tommorrow, Saturday, June 11, at Silicon Graphics. This will be our second meeting at SGI. We're no longer at Cygnus; thanks again to John Gilmore for the use of Cygnus facilities. Thanks to Katy Kislitzin for arranging the use of SGI facilities. This month's meeting will be about "Keys and Key Distribution." Contributions are always welcomed; on-topic will have priority, but off-topic will be fine if we have time. This month's meeting will be mostly roundtable discussion. There will be no MBONE this month. Look for it next time. Date: Saturday, June 11, 1994 Time: 12:00 noon - 6:00 p.m. Place: Cafe Iris, Building 5 Silicon Graphics Mt. View, CA, USA Theme: "Keys and Key Distribution" Eric ----------------------------------------------------------------------------- DIRECTIONS: Silicon Graphics, Inc. Building 5 (SGI Cafeteria) 2025 North Shoreline Boulevard Mountain View, CA >From 101 take Shoreline East. This is towards Shoreline Amphitheatre. It's also "logical east", and points more north that east. (That is, it's east with respect to 101 North, which points west near the exit.) If you're coming in on 101 South, you'll cross over the bridge. Continue on Shoreline and go past a whole bunch of other SGI buildings. Turn right onto Steirlin Court at the big red metal sculpture. There will be even more SGI buildings surrounding you--take note of the building numbers. Go almost to the end of this street. Building 5 is on the right.

1 0

Re: Crime and punishment in cyberspace - 3 of 3
by Patrick Juola 17 Dec '03

17 Dec '03

> > Well, that's one view of rights. However, most attempts to base so > called natural rights (i.e. rights that are somehow intrinsic to human > existence) have been largely unsuccesful. It's a tough argument to make. > Seems to me the 'inalienable rights' that are mentioned in our founding charter carry this argument quite well. I suspect they also 'prove' them as well. Proof by declaration of self-evidence? ``We hold these truths to be self-evident.... that [all humans] are endowed by their creator with certain inalienable rights." If, for some reason, I claim that the right to liberty is *not* self-evident, it can be very difficult to convince me otherwise. This is one of the difficulties of natural-rights arguments; that they tend to assert certain rights (right to privacy, right to property, right to personal space, right to free speech, &c) axiomatically when they are often the subject of the discussion. Patrick

1 0

Re: Regulatory Arbitrage
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Excuse me while gush... As usual, Eric is right. [great discussion about how regulation only creates markets elsewhere...] Arguably (only arguably...) some economic regulation is good for us: like a *few* pharmaceutical and food regulations, maybe. Eric points out that internet commerce and e-money, e$ for short, reminds one of something that has been going on for a long time with another E$, this time Eurodollars. (Kind of like AOL, eh?) Eurodollars were invented to get around American tax and currency regulations, and those of other countries. You had all these American corporations funding themselves through subsidiaries in Carribbean countries like the Netherlands Antilles. (Any time you see "Companyname, N.V.", the "NV" is Dutch for "we funded this with offshore dollars" ;-). George Soros, who founded Quantum Fund, N.V., is evidently happy with the results of this knowlege. He recently made the fastest billion dollars in history pointing out the folly of the European currency exchange rate mechanism, much to the chagrin of the Bank of England and other central banks whose money he pocketed. I remember a Milton Friedman quote, something to the effect that regulations only benefit a market's producers, not its consumers. Current day Japan, states with barber and bartender "licences", and Smoot/Hawley America in the 1930's might be good examples of that. If there's a market for those goods/services elsewhere, people *will* buy there. With internet commerce and e$ ,"elsewhere" is everywhere... But we know that already, don't we? I can't wait until the rest of the information, or the software, or the intellectual services buying public figure that out. The only way to prevent that is to regulate economic commerce on the internet, which makes me shudder to think about. Although, if the paradigm holds, it won't make much difference. It'll be like stopping capitalism itself. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

3 2

Re: NIST to propose cryptographic APIs
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

At 4:26 PM 06/09/94 -0700, Brad Shantz wrote: >that is a slam at RSA. (as such...Bidzo's seems to think that everyone hates >RSA. Everyone's out to get them.) I believe that tends to happen when one thinks about crypto a lot... -j

1 0

Re: Crime and punishment in cyberspace - 3 of 3
by Blanc Weber 17 Dec '03

17 Dec '03

From: Jim choate "Rights are the items of a citizens characteristic which are outside the ability of that government to control within its charter. Rights come before a government forms. If they didn't then you would not be able to give it a charter." This is true in the sense that one has the right to exist and to function and in general to be oneself independent of artificial government operations. In Nature, you have a "right" to anything you like, but there may be no one besides yourself there to appreciate that fact and to deliver it. When a group of individuals associate and create agreements/charters, the delineation of rights serves to protect their separateness - their property, their privacy, their character - against encroachments from the group, by defining consciously where the boundary lines are to be drawn - what the individual can expect to keep, in exception to what everyone expects to share. Once a group considers itself an official "society" of like-minded individuals, they often begin to demand "rights" which do not naturally belong to them or their society - or which they have not explicity agreed to share: . the right to have what others have created/produced (like a service which nature does not automatically arrange for delivery - ex: optical cables & the internet at 3200 bps) . the right to access what is not their own (outside of what nature has naturally endowed them with - ex: computers) "Self protection is a requirement in general against another individual and not a society." A society of like-minded individuals can also be a threat to the safety of non-conformists, depending on how the group decides to respond to those who are not exactly like the others. Blanc

3 2

Re: NIST to propose cryptographic APIs
by bshantz＠spry.com 17 Dec '03

17 Dec '03

Excellent point. From: jamiel(a)sybase.com (Jamie Lawrence) Subject: Re: NIST to propose cryptographic APIs >>that is a slam at RSA. (as such...Bidzo's seems to think that everyone hates >>RSA. Everyone's out to get them.) >I believe that tends to happen when one thinks about crypto a lot... :::::::::::::::::<<< NETWORKING THE DESKTOP >>>::::::::::::::::: Brad Shantz Internet : bshantz(a)spry.com SPRY Inc Ph# (206) 447-0300 316 Occidental Avenue S. 2nd Floor FAX (206) 447-9008 Seattle, WA 98104 ---------------------------------------------------------------- "In gopherspace no one can hear you scream." ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

1 0

Hum, 100 - 78.4 = 21.6 % spying
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Harry Bartholomew writes: > If anyone has Macworld perhaps we might contact the author for > further details. It seems to me a startling point to be told > that one in five email users IS being spied on. How many more > encryption buffs might emerge if this were common knowledge? The Macword survey is old news - about six months, if I remember right. I'll see if I can dig up my copy. I think we'd all turn into encryption buffs if the real extent of E-mail surveillance was known; there are plenty of curious or nosy folks out there with legitimate (or otherwise) access to root, or the local equivalent. I'm not thinking of policy-oriented systematic plans of oversight, but the occasional fishing expedition on a Friday night when everyone else is off of the machine, and [..]. I've run into too many folks who admit to a once-in a-while exploration of /usr/spool/mail to think that anything in there is really secret. It's educational to see what happens to traditional notions of ethics when paychecks are a week late, the managers are locked in the conference room, and people are starting to wonder about who gets laid off next. -----BEGIN PGP SIGNATURE----- Version: 2.5 iQCVAgUBLfinEH3YhjZY3fMNAQHsuQP/U9+TNjmkKrwDGzrG1xcEyrIpyFSJZkBX 2jcZqlyxzm+MR2QJ0hUiBaTyFjdy862Ro6Mc9RkGldswdM5PB8iJVrxZwaoA9dMj VOF4pPQjt0HzmFnjolhjK7+O1Gvx8zKxlUZtyCPftULCublFeTuQpRYg81FSOn9U xp0GDcNKUnc= =64Dg -----END PGP SIGNATURE-----

1 0

Re: Cop On The Net - Watch Your ***
by jamesh＠netcom.com 17 Dec '03

17 Dec '03

Forwarded message: > From owner-cypherpunks(a)toad.com Thu Jun 9 23:51:13 1994 > Date: Thu, 9 Jun 1994 20:38:05 -1000 (HST) > From: NetSurfer <jdwilson(a)gold.chem.hawaii.edu> > Subject: Cop On The Net - Watch Your *** > To: cypherpunks(a)toad.com > Message-Id: <Pine.3.07.9406092005.b20232-b100000(a)gold.chem.hawaii.edu> > Mime-Version: 1.0 > Content-Type: TEXT/PLAIN; charset=US-ASCII > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > > Just when you thought it was safe to surf in the sunlight... > > > -NetSurfer > > #include standard.disclaimer > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > == = = |James D. Wilson |V.PGP 2.4: 512/E12FCD 1994/03/17 > > " " " |P. O. Box 15432 |finger for key / Viacrypt Reseller > > " " /\ " |Honolulu, HI 96830 |====================================> > \" "/ \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > > ---------- Forwarded message ---------- > Date: Fri, 10 Jun 1994 00:13:43 -0400 > From: E-d-u-p-a-g-e <info(a)ivory.educom.edu> > Subject: E-d-u-p-a-g-e 06/09/94 > > CYBERCOP > A former New Jersey police officer now spends his time cruising for > suspects in cyberspace and has been involved in dozens of criminal > investigations, including a sting operation that nabbed a pedophile who > lured young rape victims via a bulletin board service. (Tampa Tribune > 6/8/94 BayLife 5) > > E-MAIL PRIVACY > A survey of 301 companies by Macworld Magazine showed that 78.4% of > the firms do not spy on employee e-mail or search their electronic files. > Sen. Paul Simon (D-Ill.) has drafted legislation requiring that companies > tell their workers that their e-mail might be monitored. (Tampa Tribune > 6/8/94 BayLife 5) > > PAT ROBERTSON EYES VIETNAMESE CABLE TV > Religious broadcaster Pat Robertson wants to build a cable-TV > system in Vietnam and is confident a deal can be struck after meeting with > government and TV officials in Hanoi. The proposed system will use > microwave technology to beam dozens of channels to homes. (Investor's > Business Daily 6/8/94 A9) > > > > > -- JJH -- My loathings are simple: stupidity, oppression, crime, cruelty, soft music. -Vladimir Nabokov

1 0

Privacy Postage
by Joseph Block 17 Dec '03

17 Dec '03

Here's a suggestion for the remailer operators who log usage. When it comes time to create a dummy message for traffic spoofing, loop it N steps through the remailer web and have it end up at a randomly selected message sender's address. I suggest weighting the selection according to the number of messages the sender has sent. Since the dummy is encrypted anyway, this will also help the people using the remailers to spoof traffic analysis attempts as well. Combined with random delay, this should make life a little more hellish for anyone analyzing the traffic, as the dummies will no longer be distinguishable by being eventually swallowed by a remailer. The minor inconvenience of occasionally having an unwanted postage stamp clutter one's mailbox is just the price of doing business with the remailer. Hell, I'll even design a nice ascii postage stamp file for anyone who decides to implement this. jpb

1 0