December 2003 - cypherpunks-legacy

Re: Info about Linux
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

Matt Bartley <mbartley(a)localhost.acs.uci.edu> writes > Michael D. Crawford <crawford(a)scruznet.com> writes >> ...a serial card with a 16 >> character buffer that works just fine is available quite cheaply. > >Which card is this? My hacked-together clone currently has a 16550A >card. I have had lots of RS232 problems. For example, my mouse on >com1: doesn't seem to work in Linux's (gpm/selection). I don't want to recommend a particular card until I've tried one myself. I'm using the old fashioned one-character-buffer card. I will ask a friend who has had some success. Selection doesn't work at all unless you have the 1.1.something kernel or later. The 1.0 kernel that ships with Yggdrasil doesn't support selection. The "even" numbered kernels are regarded as stable release for regular people to use. The "odd" releases, 1.1.x, are development versions that are not expected to be stable, which is why it's not what you get on Yggdrasil. Release 1.2 is coming Real Soon Now. You can get the development kernels, and I think the Y. CD has a tar file with a fairly recent 1.1.x kernel. I also recommend using a bus mouse. I'm using the Logitech bus mouse; I previously had used a Microsoft serial mouse. I get a lot better performance from the bus mouse - my cursor moves when I move the mouse, with much greater reliability than the serial mouse did. (I mentioned using Linux for a firewall router) >Could this be done via dialup? I can get into a dialup SLIP server >which dynamically assigns addresses, and I just in the past week got >my Linux box to connect to it. It might be possible to make a router work on a LAN with dynamic addresses, but I doubt it. Much better would be to either apply to InterNIC for a class C network number, or ask your service provider to assign you a whole subnet of addresses for yourself (if they only do dynamic addressing, they probably won't want to do this. They may be reluctant in yielding up any of their address space in any case.) >Also, what is the difference between a router, a gateway, and a >firewall? A router connects two different cables, which may be of the same or different physical media, so that IP packets can hop from one cable to another. The router also knows how to direct packets that are meant for distant destinations: it passes them on to the next router. One might connect two ethernets with a router, or an ethernet and a SLIP/PPP modem connection. Routers are also often referred to as gateways, but I prefer the more precise meaning, in which a gateway is a machine that connects two incompatible networking protocols, by translating the higher level services. For example, there are Internet SMTP to UUCP mail gateways in every Unix box, as well as the Internet/CompuServe and Internet/AOL gateways. There are other kinds, such as the network file service gateways to allow Macintoshes to do AppleShare mounts from an NFS server - the FastPath and Gator boxes do an NFS mount from the fileserver, then act as appleshare servers. When a Mac reads a file using AppleShare, the gateway reads the file using NFS and passes along the results. A firewall is a single point of connection between a "protected" and a "public" network. It is usually combined with a router. It uses such things as filtering packets based on protocol, port number, source and destination addresses to try to keep hackers out of a network. Services which are desired to run through the firewall, but which are risky, are handled by proxy servers on the firewall, so in this sense it is a gateway. There is a very good book out on this topic, from the folks who maintain AT&T's firewall, entitled Firewalls and Internet Security, by William R. Cheswick and Steven M. Bellovin, ISBN 0-201-63357-4. I recommend it to anyone who runs a machine on the Internet - and to anyone who wishes to penetrate one: it has a pretty detailed guide on how to hack machines. (The authors recommend subscribing to 2600 magazine!) You don't need to have a firewall to tighten up the security on your machine. Read this book if you're going to put a Unix box of any sort on the Internet, or you might wake up some day to find someone's erased your hard disk from the other side of the globe. To be complete, I should also mention bridges. A bridge is a sort of primitive router, that connects two or more LAN sections. The sections have the same physical media. This is done for fault isolation, to extend the maximum cable length, to allow star topology on bus nets like ethernet, and to reduce traffic on the whole net somewhat (the bridges don't pass packets that are destined for the same cable segment that they originated on, but they do pass broadcast packets). Bridges used in organizations that require multiple protocols on the same net (eg., AppleTalk and IP). Twisted Pair Ethernet Hubs are a sort of bridge. There is a serious problem with bridges, in that they make the entire network appear to be on the same segment of cable to higher-level protocols, so an IP broadcast will stimulate every machine on the campus net. When I was at CERN, working on the NA47 experiment, I would do "ruptime | grep na47" to find what workstations were lightly loaded in my building. This resulted in the central network police bearing down on my experiments sysadmin, as my broadcasts were asking every machine in the lab - thousands! - what their load was, and they were all responding simultaneously. (In such a case it is a much better idea to use multiprotocol routers - I can't fathom why CERN doesn't do this.) >> There is a security enhancement I mean to try once I've set up my own >> full-time router... >Be sure to post to comp.os.linux.announce when this is available! I will, of course. Another idea is to foil dictionary attack on my passwd file by varying the encryption algorithm somewhat. It won't necessarily be a more secure algorithm, but to hack my password file you'd have to run a dictionary attack just for my machine. I'm not so convinced that the Cypherpunks list wants to hear all this, but it's probably of interest to you that Linux is the cheapest way to get complete Unix/X11 development tools on a machine that you can be root on. Most of you can't edit the password file, tinker on the kernel, or reboot your campus Unix machines, but if you have at least a 386 you can do all this. If you wanted to make, say, a hardware encryption card for Unix, you'd be best off using Linux so you'll have the full kernel sources to ease writing your device driver. Regards, Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

1 0

Re: cypher bickering
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- William A. Kennedy writes: > they seem to stay up through the night just to bicker about it. Nah, we'd be up anyway ;) Seriously, I don't think there's a practical issue, in light of the existence of Todd Masco's signing service. Perhaps at some time far in the future Eric will raise the stakes, but we can cross that bridge when we come to it. I simply changed my c'punks list alias to point to the signing service instead of the list itself, and everything else continues as before. Regarding placing a direct SLIP connection between my machine and the nearest workstation in the office, I will investigate the option. It may again be an issue to get permission to start plugging extra cables into a machine owned by the dept. - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuNJFmf7YYibNzjpAQEQqgP+MtmQ5enRtUigqo2iVSqRd+w3vAmGfR8Q rdnHCtUugxIf+70/jhS8RtyVGudVC4nBaqzaXRsSVAb0AlELClmsg85kDg74mAUi 59y+RCYWBFvMZ0wOuhq+9kohfASJK1k/VHOwZhnCLKyV+S5xZnn369e3KRVcurLJ 4P89xac7Weg= =DpF8 - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuNLkCoZzwIn1bdtAQHxOAF8DFx6jqicmEOR4H72Qi8oHbSMwRkyjst5 TFT2J1YyIstTNPCH5Tj2WVwvJHSiSMWr =DnS5 -----END PGP SIGNATURE-----

1 0

Re: making public keys public
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Eric Hughes writes: > > If you're not going to make the public key public, why use public key > > cryptography at all ? Save time and effort and use a symmetric cipher. > > You can't do authentication with a shared secret key, because there's > nothing to differentiate the two sides of the link. Is it really important to distinguish the two sides ? The additional threat is that an attacker could spoof my correspondent to me, once she's grabbed my secret key. But a) I thought we were assuming that other people being spoofed is _their_ problem, not ours, and b) if she's nabbed my key, odds are she's hacked my account anyway, leaving me with much larger problems. > In addition, a closely held public key might be held by 10 people; Hmm, `closely-held' suggests that the `public' key is being passed around as a secret over some channels, in which case it might as well be a secret key being passed around over those channels to the 10 people. > with secret keys there are 90 different private keys instances to > manage. Wouldn't there only be 45 ? I agree that this is quite a few, but it's a reasonable tradeoff between disk space and processing speed unless you're communicating with a large number of people. - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuLvdWf7YYibNzjpAQG0GQP9FIJkCLF4XbZEoydrVfCnHg32FGL5EQ1A 2286GqvVQuy6hwtqV888TOZmLkQpMjrmq+paTQpozu5s8L4z/L9WZbbyk0C/alMv faTwpUe1neSStR3KbrxK0BuP70OBKBbdZZfHI/t4Kn8jTimeBA/IG2Iou/8gecX2 g8d0otexmwI= =FtUZ - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuLwpyoZzwIn1bdtAQFUfgGAsdDHynQfWLxX+cmCz9vxkzwQ0sIikuVG XCp0rwhl/C1P1HXBF2Xk135HXa7RO6kC =OnyQ -----END PGP SIGNATURE-----

1 0

Re: future entrapment
by frissell＠panix.com 17 Dec '03

17 Dec '03

>>* establish a local WWW server hosting some useful information >>* configure the server to record the IP addresses of people who >> access it, and cross-reference them to obtain geographical >> locations as registered with NIC. Feed this into a GIS and >> track local accesses. >>* have a list of people who I want to nail. >>* filter all HTTP requests through a script that >> - checks the list of victims >> - if a request for a file comes in from one of the >> targets, munge the outgoing web page to include >> a <IMG SRC= ...> tag pointing to a foreign site >> carrying images deemed pornographic in my jurisdiction >> - ring the console bell >> >>As soon as someone on the hit list downloads a file, you have prima >>facie evidence that they are probably in posession of some kiddie porn. >>Instant search warrant time ... "But your Honor, I had graphics turned off for speed." "The Geheimestaat Polezi has to prove not only that I connected but that I actually got something." "Too bad my swap file is on a partition that was corrupted when the ossifers grabbed my machine." The ancient question, do you possess something if it is encoded and cannot be decoded? DCF

1 0

RE: Date?
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Is it really Christmas eve already where you are? Hehe, you caught me fiddling with my system date to generate a 2048 bit key with PGP. Actually, if it were Christmas Eve already, that would mean that the pain of holiday shopping had already past.... ======================================================================= Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)netcom.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan ======================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLuMiW01Diok8GKihAQFs0QP/UplPL2g2t86goL1o5xK3gkv9IM6nGeEW GCe41PX3Q4yiYkopIz+1bXe9kGYvrd9jJ0fusM9CRp+QnaiizzZxudAL7BGRlsGD 9c0jLLR9KtFmiiSQM5pgBIMEzXC3zPY+Xm+hPhV6/URx84qxrcjneOrnOJjBtjkO ekZ8ApHUhxo= =wNu9 -----END PGP SIGNATURE-----

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut post ek"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)xs4all.nl> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"myriad"} = "<remailer(a)myriad.pc.cc.cmu.edu> cpunk pgp hash latent cut ek"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 5 Dec 94 6:00:01 PST remailer email address history latency uptime ----------------------------------------------------------------------- xs4all remailer(a)xs4all.nl ++##******+* 7:31 99.99% usura usura(a)xs4all.nl ++##******-* 13:31 99.99% alumni hal(a)alumni.caltech.edu +##**-*+*+** 11:24 99.99% penet anon(a)anon.penet.fi +++++++++*** 1:00:13 99.99% c2 remail(a)c2.org +****-++++-- 37:40 99.96% flame tomaz(a)flame.sinet.org ***#***+*++* 8:43 99.92% nately remailer(a)nately.ucsd.edu ++++++++++++ 44:54 99.92% portal hfinney(a)shell.portal.com ###*-****** 6:46 99.85% jpunix remailer(a)jpunix.com ###****+*++* 8:11 99.83% vox remail(a)vox.xs4all.nl .-.-------- 10:32:31 99.99% desert remail(a)desert.xs4all.nl ----------- 8:03:49 99.99% myriad remailer(a)myriad.pc.cc.cmu.edu ###*****+** 5:11 99.70% rahul homer(a)rahul.net ###**** **** 4:32 99.37% bsu-cs nowhere(a)bsu-cs.bsu.edu #*.# ** *+-* 50:33 99.05% mix mixmaster(a)nately.ucsd.edu -+-+- 59:51 98.94% ideath remailer(a)ideath.goldenbear.com ###**** *** 8:21 98.77% extropia remail(a)extropia.wimsey.com +---.--+++ 3:59:21 98.42% rebma remailer(a)rebma.mn.org -_.--..*-.. 22:38:33 98.13% soda remailer(a)csua.berkeley.edu -....-. 12:55:27 86.22% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Comments and suggestions welcome! Raph Levien

1 0

cypher bickering
by William A. Kennedy 17 Dec '03

17 Dec '03

internet: kenned09(a)ssw.alcoa.com I am a relatively new member to this list. There is so much potential for great discussion because the topic is technically challenging and politically sensative. That's why it is extremely frustrating to see the list contributors, and it's moderator getting all tied up in their collective underwear over whether or not the moderator can and/or force people to affix a digital signature to every posting. What's worse, they seem to stay up through the night just to bicker about it. In the paper world, I send out many things that I don't sign. I don't sign them because it is of no significance that it be proven that I sent it. It also might be that the information is of such a general nature that it makes no neverminds who sent it. I submit that digital signatures are the same way. But, as Tim May proposed, it could be the "secret-decoder-ring" phenomenon at work. By digitally signing all of our postings we prove that we are committed members of the "cause." But to whom are we proving our dedication. We would be demonstrating it to people who, by nature of their own interest in this list, are already committed. Oh, but wait a minute. Maybe we're afraid that people who don't even own digital signature software, are posting there ideas on our favorite subject. Isn't the posting of any ideas on cryptography by anyone more important than who's doing the posting?

1 0

crypto, why not catching on?
by William A. Kennedy 17 Dec '03

17 Dec '03

internet: kennned09(a)ssw.alcoa.com This is a response to Tim May's well-thought-out piece on "why cryptography has not caught on." I think cryptography _has_ caught on. There are people in the crypto debate now that weren't there two years ago; perhaps even one. I think we should not measure the commitment to the cryptography debate buy counting the amount of encrypted traffic . There just isn't that much that people send that needs to be encrypted. Our debate should, and does, focus on the rights of people to have the technical tools to insure the privacy of messages and other communication that they deem to be worthy of special handling. Thanks to people like Phil Zimmermann and Romana Michado, and many others I'm sure that I don't even know about, we have those technical tools and should now be fighting for the right to use them. Interestingly enough, I sent a message to Phil and got a response from his vacation program. In it he tells us that, if we think that our message to him needs to be encrypted, then please allow more time to get it read.

1 0

Re: public accounts / PGP / passphrases
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Thanks to Derek, Jonathan, Rich, Mike Duvos, and Scott Collins for the responses to my query. It seems everyone agrees that the PGP private key is not trivially breakable without the pass phrase, so I'm keeping my pass phrase. All of the techniques mentioned were familiar to me, except this bit from Mike Duvos: > Given the state of Unix security, I would certainly not want to > type my passphrase into a Unix box unless I was the only user, > was directly connected to the box through a wire I could see, and > had just done a fresh boot after verifying the MD5 hash on all > the OS binaries. Could you clarify where the `clean' copy of the hash of the OS is being stored, if not on the machine in question ? I must confess that I'm not personally prepared to push my machine into an early grave by rebooting before I sign or encrypt anything. Besides, I'd be pushing _myself_ into an early grave if I did that. YMMV. I have a 386 at home, on which I suppose I could run PGP, but that doesn't help. Why ? Simply because going home to dial in is a major inconvenience. Leaving aside my unwillingness to stay home in the evening just to use my public account, it's utterly impossible for me to leave work during the day whenever I want to use PGP. The only solution I can imagine is to keep a notebook computer running Linux at work, and dial in to the DECstation five feet away from my desk at work. I've no idea how to convince the tech staff here to add a dedicated phone line to my lab for this purpose. Any better suggestions on using PGP safely during the workday ? - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuLpDGf7YYibNzjpAQEu5gP8CVtFJwKVGalnl8c4F52vrfzK7NV3JRMh AB2w9L8ePbpggSM65YGN4kkuUyS8BMi6sbLUS2GtupVK6/vaKK/kDngKMIB+XS5D GOLbKy8iieEm7NEwO5C4cwV8qnRorQ1Ox+l+LaGPOc/pl+ecT4rJtEGlBbj9NZV0 4p8E6Kw/66w= =BMWc - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuLqOCoZzwIn1bdtAQHdcwF9FjHQgEomyI/m8ShddvEhCCbq4qbhPwEQ NMk4ookuD8nTs0/ov3DKqDHfQrxwjeTU =5rbF -----END PGP SIGNATURE-----

2 1

;-) The definitive argument for e$: tainted cash
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Fun Facts to Know and Tell About *Your* Legal Tender... > >From the August 1993 American Bar Association Journal >> >> > >> >"The mere presence of trace amounts of cocaine on a common object ... >> > is insufficient to support a felony conviction of cocaine." Lord v. >> > Florida, 91-2147. >> > >> >"[T]he evidence of the narcotic-trained dog's alert to [tainted] currency >> > is of extremely little probative weight. . . . It cannot be doubted >>that >> > contaminated currency is widespread. The presence of trace narcotics on >> > currency does not yield any relevant information whatsoever about the >> > currency's history." US District Court Judge Thomas Wiseman of >>Nashville, >> > Jones v. DEA, No. 3:91-0520 (April 21, 1993). >> > >> >"The probability that every single person in the United States is >> > carrying drug-tainted money is almost certain." -- Dr. James Woodford, >> > forensic chemist in Atlanta. Woodford cites a 1989 experiment by Miami >> > toxicologist Dr. William Hearn, who gathered 135 dollar bills from banks >> > in twelve cities. 131 had traces of cocaine. >> > >> >It also cites a 1985 study by the Miami Herald, which asked eleven >>prominent >> >local citizens to supply a $20 bill for testing, including the Catholic >> >archbishop, George Bush's son Jeb, and Janet Reno. Ten out of the eleven >> >bills had traces of cocaine. >> > >> >Finally, there's a reference to an until-now secret 1987 DEA study >>showing >> >that 1/3 of the money at the Federal Reserve Building in Chicago was >> >tainted with cocaine. It's thought that cocaine is transferred from some >> >bills to agencies' high-speed sorting equipment [...] Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0