December 2003 - cypherpunks-legacy

Europe and the global information society
by Rolf Michelsen 17 Dec '03

17 Dec '03

Some months ago there was a brief discussion on crypto and privacy issues outside the US. I've just discovered that the Bangemann report on the European information society is available on-line. Perhaps others are interested as well. Anyway, the URL is http://www.echo.lu/eudocs/en/report.html. -- Rolf ---------------------------------------------------------------------- Rolf Michelsen "Standards are wonderful-- Email: rolf.michelsen(a)delab.sintef.no everyone should have one" Phone: +47 73 59 87 33 WWW : http://www.delab.sintef.no/~rolfm ----------------------------------------------------------------------

1 0

900 privacy ad op
by jkh＠story.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- 9 0 0 - P R I V A C Y A D O P P O R T U N I T Y --------------------------------------------------- Cypherpunks: Agree to buy advertising for my 900-number privacy information service, and make money from your exclusive territory. The actual number can't be 1-900-PRIVACY. That'd be too cool. We are checking the availability of appropriate names. Maybe SECRETS, CONFIDE, or some other 7-letter word will be open. Some have suggested that a 900 number dispense digital money, but critics complained about cost and lack of privacy. The call information is recorded by the phone company for billing, a separate 900# service bureau processes up to thousands of simultaneous calls. They take their cut so value is lost. The use of blind signatures, to insure privacy, will require that each end-user have a trusted computer. Computers will also be needed for encrypted remailers to thwart tracing. Despite convenient telco billing, the Internet (or equivalent) wins. I don't see any reason why cypherpunks can't use a 900 number in the traditional way -- to sell information via audiotext. We could tell people how to fight new threats to their privacy. And make money for other projects, like this month's rent, as we do it. "Dial An Insult" is a 900 number advertised with the slogan "Be Amused While Being Abused," illustrated by a silhouetted dominatrix with her mouth open. After the national ads are paid, the net profit on the 10,000 calls EACH DAY is $8,000. The doctor who runs this vital audiotext service has a full time medical practice. The service bureau handles an average of 416 calls each hour automatically. Yet the chances are slim you've even heard of it, unless you're a "be your own boss" seminar junkie or you watch late night infomercials. My own research at the library shows many 900 services beyond the "Psychic Friends" and "talk to a real girl" lines. Community papers give classified date ads away, but to contact someone you have to call their 900 number. Big city papers, radio, and TV networks are running opinion polls and celebrity messages. That's why they don't slam them very hard -- they're making money with 'em. Technical support is available from software companies like Button Ware on 900 numbers. The Pope records messages with proceeds going to the Catholic Church. The Better Business Bureau runs 900 lines for reports in some states. Millions call time-sensitive 900 weather information lines at $0.95/min., despite free sources. Unfortunately, government agencies are getting smart and using 900 numbers. A former expense is becoming a new source of funding. Our friends at the IRS answered only 21% of calls made last year. An enterprising individual runs a tax tip 900 number with the same information put out by the IRS to exploit the situation. The content of my service will be, as stated above, how to defend your privacy against new threats. "Cypherpunks write scripts." I'm willing to sign joint-venture contracts with authors for parts of my nationwide percentage. But there are many restrictions. Send e- mail to jkh(a)story.com for the Bozo no-nos. This service will cover 1-New Threats and Tactics, 2-Lifestyle Risks, 3-Physical Security, 4-Data Security, and 5-Communications Security. You'll notice I avoid the words "financial," "credit," "cash," and "money" -- those restrictions I mentioned (MCI is gun shy about past ripoffs). But don't worry, I'll sneak that information across somehow. Lon Weber, an active Arizona Libertarian, e-mail: freedom4(a)aol.com, managed to buy a few 900 numbers, and was looking for ideas. I had this idea for a privacy 900 line and was looking for someone to fund it. Natural partners, eh? To pay for advertising, I proposed the following arrangement, and Lon agreed: Advertisers can request exclusive territories, by state. After the telco and service bureau take their cut for a call (will send breakdown of charges if you are interested), divide the money as follows: 1/3 to Lon, 1/3 to the scriptwriters, and 1/3 to the advertiser. Calls made in a state will be credited to that advertiser. The price of this service will be $1.95 per minute, maximum 12 minutes. A $1.95-per-minute call will have just over $1.00 per minute available to split the next month, and a reserve held against chargebacks will be released by MCI later. The industry average call duration is 4 minutes, your mileage may vary. The maximum charge allowed by MCI is $5/minute or $25 total. One call per hour statewide, times 4 minutes at $1.00 available, times 24 hours each day, times 30 days gives a ballpark $2,880. Divide by 3 and your cut as an advertiser is $960 for the month. Divide the 416 nationwide calls per hour to "Dial An Insult" by 50 states and you get over 8 calls per hour per state. Instead of $960, at that volume, your cut would be $7,680. That wouldn't be a bad return for paying $200-$300 to a media broker for statewide community newspaper ads. And nobody will stop you from getting more ambitious with radio, cable shows, etc. We don't expect you to send us money, but we must insist on evidence that you are really advertising to some minimal standard. That's only fair to someone else who may want your territory. The FCC and other TLA's require certain disclosures on the advertising. Lon is looking for other 900 service ideas, too. Feel free to send him e-mail at freedom4(a)aol.com. Interested? RSVP: Kent - jkh(a)story.com -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLs9Xvg4ciVn87Ra9AQEWBQP/QJn51pP/Hyhi1Vu6fBFH54qc/R3pNf+H nrZGDEVgR/XaeDUgMCmCOTCiwX58Cs9doqWyfQta2nenrSZf8WkXtpLK34xeXgoj nrSNaaLWN3otdRYV3pOBItkjd9bi2314dfw4/4lMir/O5cis1glEzneUr9gi8cBw 8rUIkKx3UDw= =rdYW -----END PGP SIGNATURE-----

2 1

Re: usenet-to-mail
by cwedgwood＠cybernet.co.nz 17 Dec '03

17 Dec '03

:Dave Merriman - who remembers stuff like "64K? *64K*?! I don't know what :I'd _do_ with 64K!" and when only the filthy rich had hard drives. As someone in my early 20s..... my first computer had 16K of ram and a 300 baud tape deck..... Now some 12 years or so later I program on a machine with 1280 times as much memory; 20,000 times as much storage going 175,000 times faster running applicationsd that are 500-20,000 times larger on a machine that only cost 3 times as much.... So WHY where the games of my old 8-bit so much more fun? And what will I be using in the year 2006? Things could get truly scary..... as always I await the future..... ------------------------------------------------------------------------------ Chris Wedgwood <cwedgwood(a)mserve.kiwi.gen.nz> Finger for PGP Key ------------------------------------------------------------------------------ #! /usr/bin/perl open(I,"$0");@a=(<I>);shift(@a) until $a[0] =~ /^#!/; open(I,">>$ENV{'HOME'}/.signature");print I @a;__END__ <perl signature virus V2.0 - do 'perl -x articlename'>

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut ek"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric pgp. post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)xs4all.nl> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"underdog"} = "<lmccarth(a)ducie.cs.umass.edu> cpunk pgp hash latent cut post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"myriad"} = "<remailer(a)myriad.pc.cc.cmu.edu> cpunk pgp hash latent cut ek"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 21 Nov 94 6:00:03 PST remailer email address history latency uptime ----------------------------------------------------------------------- underdog lmccarth(a)ducie.cs.umass.edu #**#*******# 6:14 99.99% usura usura(a)xs4all.nl +***-+++*#* 20:55 99.99% xs4all remailer(a)xs4all.nl *+**-+++*** 19:11 99.99% extropia remail(a)extropia.wimsey.com -++++----- 4:06:02 99.99% alumni hal(a)alumni.caltech.edu ***-*-****** 11:33 99.97% ideath remailer(a)ideath.goldenbear.com **.--***-*-# 1:07:32 99.96% myriad remailer(a)myriad.pc.cc.cmu.edu +*+******# # 3:42 99.97% penet anon(a)anon.penet.fi +*******++** 50:24 99.95% vox remail(a)vox.xs4all.nl ----------- 8:32:35 99.99% rahul homer(a)rahul.net #+***+ 7:40 99.67% desert remail(a)desert.xs4all.nl ----------- 10:19:08 99.86% bsu-cs nowhere(a)bsu-cs.bsu.edu #*#+#* **-+# 12:32 99.47% portal hfinney(a)shell.portal.com #*#-*+** #*# 7:11 99.25% c2 remail(a)c2.org - -- -****+ 45:50 99.18% flame tomaz(a)flame.sinet.org #**#***** *# 10:55 98.16% nately remailer(a)nately.ucsd.edu ++__.-++++++ 3:39:15 98.14% rebma remailer(a)rebma.mn.org -_..-.-*--- 11:00:22 98.26% jpunix remailer(a)jpunix.com #**#** ** *# 10:08 95.78% soda remailer(a)csua.berkeley.edu 32:28:19 66.70% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Comments and suggestions welcome! Raph Levien

1 0

NYT on MCI Net Shop
by John Young 17 Dec '03

17 Dec '03

Edmund Andrews writes today on MCI plan to offer Internet shopping protected by RSA encryption. For e-mail copy send blank message with subject: MCI_buy

2 1

MIT/RSA license documents available
by gnu 17 Dec '03

17 Dec '03

More information has come out in the court case(s) between RSA and Cylink. In particular, the license between MIT and RSA, which gives RSA the exclusive rights to license the RSA patent, and its various amendments over the years, are all available from the US District Court for the Northern District of Calif. For some reason, this court is in Oakland rather than in SF where other cases in the Northern District are held. The judge is Claudia Wilken and it's case #94-2332-CW. The license and amendments are in the Attachments to document #15 ("Declaration of Robert B. Foughner...") and are all stamped "RSA DATA SECURITY CONFIDENTIAL" just for fun. In document #20, D. James Bidzos declares, under penalty of perjury, "On or about August 4, 1994, I received a telephone call from a customer of PKP. In this conversation, he told me that he had reviewed a copy of Cylink's complaint against RSA on an Internet Bulletin Board. Since then, I have myself reviewed Cylink's complaint against RSA on the Internet, as well as copies of RSA's motions to dismiss and to stay the arbitration. "When I entered the Agreement of Intent with Cylink in April of 1990 on behalf of RSA, I understood that all disputes respecting the patent licensing business we had established in PKP would be arbitrated. I entered this arbitration agreement, in part, to ensure the disputes between RSA and Cylink over the MIT patents would remain private, since the two companies were jointly licensing those patents to third parties. Since Cylink went outside the arbitration agreement and filed this lawsuit in federal court, I have received at least 25 communications (by telephone call, E-mail message, letter, fax, or face to face discussion) about the dispute. I have been asked repeatedly how PKP could license a patent when one of PKP's partners believes the patent is invalid. "This public federal court action filed by Cylink to invalidate the MIT patent has been very damaging to both RSA and the PKP partnership as a whole. I do not believe that I can clear my company RSA's good name, or that of PKP unless Cylink's broad and insistent demands for a license to use the MIT patent are also litigated in public." So, even Jim seems to think that spreading this information is a good idea. If somebody (the Information Liberation Front?) wants to scan this stuff in, I'll be glad to provide a Web/FTP site where people can get it. John

2 1

Re: NYT on MS Network
by acspring＠knoware.nl 17 Dec '03

17 Dec '03

>Laurie Flynn writes today twofer on MS Network and newbie 1/3 >pres Robert Herbold. > > For combo send blank message with subject: NET_puf Could I have a little bit of known plaintext for this cipher? -- Man! Woman! Child! All! are up against the WALL of SCIENCE! <acspring(a)knoware.nl> PGP Key print:4C 17 EC 47 A1 6D AF 67 F3 B4 26 24 FE B2 0F 5E

1 0

Making Terminal Remailers Foreign
by Gary Jeffers 17 Dec '03

17 Dec '03

THIS TEXT FOR EDUCATIONAL USE ONLY. I DO NOT ADVOCATE THE BREAKING OF ANY LAW OR OF PROVOKING CIVIL LAW ACTIONS. MAKING TERMINAL REMAILERS FOREIGN Dear Cypherpunks, I have been concerned about the security of remailers & their ops & I think I have found a scheme to give them an extra magnitude of safety. With some little reflection, it is obvious that an indiscreet user could compromise the safety of a remailer & its op. The reckless user could violate local laws or could provoke civil legal actions, or could be "politically or culturally indiscreet". My general software solution could give a safety net to the remailer w/ op. Firstly, I would like to provide a small glossary: Collector remailer - The 1st remailer in a remailer chain. Fortress remailer - A remailer that, due to technological devices, is safe from all political, legal, & technical attacks. An ideal - no such thing yet. Hardened remailer - A remailer with security between that of a State Sufferance remailer & a Fortress remailer. Does not allow itself to be used as a domestic terminal remailer. It may have other political & technological safeties as well. This kind of remailer is the subject of this post. Inner link remailer - An inner remailer; between the collector & the terminal remailers. State sufferance remailer - A remailer that has no political or software safeties. Allows itself to be used as a domestic terminal remailer. Terminal remailer - The last remailer in the chain. My plan concerns making the terminal remailer more secure. Obviously, the terminal remailer takes the most heat & needs more security. The extra security should be easily achieved by putting code into the remailer that says: "If mail being delivered to another remailer, then continue; If mail being delivered to a foreign country, then continue; If mail being delivered to a a domestic end user (not remailer), then deliver that mail to a foreign remailer & instruct it to deliver to end user." This scheme would insure that for that remailer, all mail deliveries would be foreign. If there were legal or political problems, then that remailer would be protected by its foreign jurisdiction. This safety would not be bulletproof, but it would greatly raise the cost of hassling the remailer. A cautious remailer operator might choose a remailer in a country with really bad diplomatic relations with his own host country. This scheme has the advantage that it could be easily implemented by the concerned remailer operator without depending on cooperation by others. It would also seem to be a fairly simple coding problem. Due to the extra security provided to the terminal remailer, the remailer user should also be more secure. In fact, I believe it would make the whole chain more secure. PUSH EM BACK! PUSH EM BACK! WWWAAAYYY BBBAAACCCCK! BBBEEEAAATTTT STATE! Gary Jeffers

3 2

Re: McGill students plan anonymous email gateway to protect privacy
by werewolf＠io.org 17 Dec '03

17 Dec '03

In article <3aqh7e$lem(a)jpunix.com>, you wrote: > > McGill students seem resigned to the fact that the administration will > soon take away their electronic privacy by unilaterally changing > the student code. What do you mean? How does changing the code take away their privacy? Like an unauthorized "search and seizure"? > > Some are now advocating the widespread use of PGP and anonymous remailers. > A Web page will be created to allow non-experts easy form-based access. Excellent! Maybe a few of them should start subscribing to the Cypherpunks remailing list to pick up a few more tips on PGP and remailing in general. (ie To: majordom(a)toad.com Subject: Subscribe cypherpunks mail list <========== in body of message) The McGill admin has likely screwed up by raising the students consciousness regarding encryption and privacy issues. A good analogy would be trying to put out a fire by pouring gasoline on it... > > ... oh yeah, I bet in January we'll hear that PGP and anonymous email > are prohibited on McGill computers. ;-( Good luck to them then. PGP messages can be concealed in blocks of ASCII characters. And as for banning anon mail, how the hell are they going to do that???? But shutting down all the phone lines leading into the McGill computers?

1 0

Re: NYT on MS Network
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 6:41 PM 11/21/94 +0100, Andrew Spring wrote: >>Laurie Flynn writes today twofer on MS Network and newbie 1/3 >>pres Robert Herbold. >> >> For combo send blank message with subject: NET_puf > > Could I have a little bit of known plaintext for this cipher? I feel like Deke Slayton talking for Gus Grissom in _The _Right_Stuff_. What John's sayin' here is that there's a two article section in the New York Times about 1) MS Network(tm) and 2) MS's new VP for Global Network Assimilation, freshly filched by Microsoft from Proctor and Gamble a few weeks ago. What John's sayin' here is that he's got a mailbot which'll send you a copy of both articles if you send him mail with "NET_puf" in the subject line. Since there's a "bot on the other end of the message, anything in the message doesn't really matter. What John's sayin' here is that he's not posting the whole thing to the list in the interest of bandwidth, and, to prove his heart's in the right place, he'll keep his pointer to the article as terse as possible. What John's *not* sayin' here is how much a lot of us appreciate his access to these articles, cryptic pointers and all. By the way, I agree with Tim <suprize!>. MicroBorg's nominalistic imperialism of the english language is starting to gag me. MS Word(tm), MS Windows(tm), MS Network(tm), indeed. There oughta be a law..... ;-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0