December 2003 - cypherpunks-legacy

Re: The Remailer Crisis
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 11:14 PM 01/20/95, Rhys Kyraden wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >Okay. Here's my 2-bits. >I run on the MacOS, but how hard could it be to port this code? If you are talking about remailer code, rather, I think. The mac doesn't have a built in mail system, like unix systems generally do, which you kind of need. First you've got to get a hold of a mail system for the MacOS, ideally not POPMail like Eudora, but actual receiving mail directly to your mac, and then you've got to modify it to do remailing. And that modification isn't going to be nearly as easy as in the world of unix with it's .forward files and /etc configuration files that let you pretty much direct output wherever you want. Basically, the amount of code you are going to have to be writing from scratch is going to outweigh any "porting" you are able to do with salvagable code. On the other hand, you could base a remailer on Eudora. Which means that people would right to your normal mail account with mail-to-be-remailed, and by means of some header lines distinguish the mail to be remailed. Eudora can filter mail according to header lines. And Eudora is applescriptable, and can call an external applescript (or actual binary executable program, if it does apple events. Which isn't trivial), and tell it new mail has arrived to be dealt with. Theoretically the external program could even check the body of the message for a :: Request Remailing-To: So they wouldn't need to put anything special in the header, like they don't need to with current remailers, even ones that run out of people's normal shell accounts. Theoretically, you could do that. But it would be rather unreliable, and slow. And if there was a lot of remailer traffic, it would get in the way of your normal email. I'm not sure it's worth putting in the amount of effort neccesary for what you are going to get. On the other hand, the amount of effort neccesary would be much much less then writing remailer code which worked with a mac mail system instead of POP mail, as discussed above. I dunno.

1 0

Re: Key backup (was: How do I know . ..)
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Wed, 18 Jan 1995 19:38:54 -0800 >From: eric(a)remailer.net (Eric Hughes) > > From: "Dr. D.C. Williams" <dcwill(a)ee.unr.edu> > > Safe deposit boxes, by virtue of their accessibility to law enforcement, > are subject to search and seizure under court order and are sealed > in certain cases (probate). This makes them likely to be the first place > to look when the Feds decide that we can't have keys anymore. > >I am not designing systems for the paranoid fantasy of an inspection >of all safety deposit boxes by government agents in search of >contraband. > >I am interested in designing systems which will fit into business as >usual, that are inconspicuous by their prevalance, and which will be a >part of ordinary and usual protection of data by cryptographic means. On the less paranoid side of this, you might check out TIS's Data Recovery Center plans. ftp://ftp.tis.com/pub/crypto/drc/ and below. That location will have some code for interfacing to the prototype DRC in a week or two. Send me e-mail if you want to be on the mailing list for notification of code availability/updates. On the more paranoid side of this, in spite of Steve Walker's relish over the fact that TIS's CKE (Commercial Key Escrow -- his name for the DRC work) keeps keys out of government hands, except in cases of actual search warrant, it looks (according to one privacy-advocate lawyer I discussed this with) as if access can be gained with a mere subpoena -- and, according to Scott Charney (of Justice Dept., if I remember correctly) the currnet view is that if you voluntarily give a copy of your key to your employer, you've abandoned your presumption of privacy and that relieves the gov't of getting a search warrant (and maybe even subpoenna). - Carl

1 0

Supreme Court on Anonymous Bills
by Nathan Zook 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- $.02 (fiat) on Talley v California (recently posted here) It is important to note that this court is expected to significantly reverse some of the landmark cases from the Warren era. We should, therefore, to look to the dissent at least as much as to the court. There can be little question that any attacks on remailers and civilian strong crypto will face challenges on the basis of Free Speech and Equal Protection. The question is: can the state show compelling interest? I believe that it can. Anonymous agents, by their very nature, are immune from state restraint. Since our entire legal system centers around state restraint, I believe that Free Speech and Equal Protection will fall to the four horsemen. When we consider the decision, we note that one of the main reasons for voiding the ordinance on its face was that there were other remedies to the problems that the ordinance claimed to address. No such other remedies will exist in our case, that being part of the point of our systems. Considering the dissent, we see even more room, with the question of Equal Protection might not be extended on the basis that only electronic communications were hampered. There is the general question of political speech. Unfortunately, there is little anonymous _US_ political speech. Furthermore, sedition is a crime, and if the Founding Fathers printed the same things against our government that they did against England (they could do more), they would face a number of criminal charges. I believe, therefore, that both the court and the dissent bode poorly for anonymous encrypted mail. But these are not the only arguments we have. We have the questions of Enforcablity, Distinguishability, Privacy, and the Right to Bear Arms. One may argue with some force that it may be impossible to determine if a person is sending and receiving information (and requests for information) directly, or if they are acting as an anonymizing agent. One may argue with great force this difficulty, combined with the nature of the InterNet, would make general enforcement impossible--leading to the same type of failure as the Prohibition. One may argue forcably that the tools necessary to allow anymous encrypted traffic are the tools necessary to preserve the barest elements of privacy. Finally, since strong crypto has been ITAR limited, one may argue that the tools required are militia-type weapons, and as such, protected Arms. Finger or request keyserver for PGP 2.6.2 (tm) key. PGP<->Mail/News installation incomplete. Factors for modulous are not proven primes. Key may be far weaker than expected. Encode at your own risk. Key ID: 14712B4D 1994/12/26 Nathan H. Zook <nzook(a)bga.com> Key fingerprint = 44 B3 D8 66 3D 55 1E 2E F8 92 22 A6 33 8C DE 24 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLyFKXnmgMs8UcStNAQFU+Af/SwmEoH2g/jZ1CtIRWevWkDQRl6Nnz1xe j8yyMtvrz86cshfD6hBYjCZ+wcihmCXM7NxuHdrbaXihTuCRspJdTheD9xUAr4sk qhqXlj4PqRVThg5FioD5/miuyLO6osJ02DfckpaWk0uJf6OBC9BIiOCzXnDVFaIh dXNfEq4pjkJPFxSR2UU7ru4EUrAKRT5keV2cZ8QjMeeQ5YksveTIO6GeStzJjAJr GQKSzdGF0qoauKsexHvaMDlbARhUEPx7vqufRWUsejkwDW73STZFBoFabcLpaJRs 9KwsSzdYFWlxtDlCpUIRFRAuxRlKCedOpEKRIYfIZy2bWSqqDbCz5A== =sxi2 -----END PGP SIGNATURE-----

2 1

Remailer in a Box transcript
by sameer 17 Dec '03

17 Dec '03

The remailer created with the following transcript was created for test purposes only. It is not to be used as a remailer. infinity:infinity/rtest 3:02pm [10] > /usr/local/lib/boxed-remailer/install_remail Installation version 1.1 Making remail dir Preparing forward file You have the option of running a hidden remailer. If you are running a hidden remailer mail to your remailer gets auto-forwarded to another remailer where it is processed. That way your remailer is less likely to come under attack because no one gets anonymous mail directly from your remailer. Would you like to run a 'hidden' remailer? [N]/y n Your personal address would be a good thing to put in Complaints-To: What should be put in the Complaints-To: header? Remailer Operator <sameer(a)c2.org> Sending anon mail to self in a self-test Remailer test complete Would you like to subscribe to the remailer-operators(a)c2.org list? [Y]/n n Ok.. done creating the anonymous remailer Your old .forward file (if it existed) is now in .forward.0 Run "remailer_remove" (It will be installed in /home/infinity/rtest/bin) To erase the remailer and restore your old .forward file Installing remailer_remove in /home/infinity/rtest/bin Now you have to create a PGP key for the remailer Make sure you choose a key appropriate to a remailer "Anon Remailer <rtest(a)c2.org>" would make a good keyid. Please choose a key length of less than 1024 bits. Otherwise the remailer will produce too much load on the system. Hit return: Pretty Good Privacy(tm) 2.6.2 - Public-key encryption for the masses. (c) 1990-1994 Philip Zimmermann, Phil's Pretty Good Software. 11 Oct 94 Uses the RSAREF(tm) Toolkit, which is copyright RSA Data Security, Inc. Distributed by the Massachusetts Institute of Technology. Export of this software may be restricted by the U.S. government. Current time: 1995/01/21 23:03 GMT Pick your RSA key size: 1) 512 bits- Low commercial grade, fast but less secure 2) 768 bits- High commercial grade, medium speed, good security 3) 1024 bits- "Military" grade, slow, highest security Choose 1, 2, or 3, or enter desired number of bits: 1 Generating an RSA key with a 512-bit modulus. You need a user ID for your public key. The desired form for this user ID is your name, followed by your E-mail address enclosed in <angle brackets>, if you have an E-mail address. For example: John Q. Smith <12345.6789(a)compuserve.com> Enter a user ID for your public key: Anon Remailer <rtest(a)c2.org> You need a pass phrase to protect your RSA secret key. Your pass phrase can be any sentence or phrase and may have many words, spaces, punctuation, or any other printable characters. Enter pass phrase: Enter same pass phrase again: Note that key generation is a lengthy process. We need to generate 464 random bits. This is done by measuring the time intervals between your keystrokes. Please enter some random text on your keyboard until you hear the beep: 0 * -Enough, thank you. ...**** .**** Key generation completed. What did you name your remailer? Anon Remailer <rtest(a)c2.org> What was the passphrase you chose? key Running a self-test of PGP Ran self-test of PGP ************************************************** ************************************************** VERY IMPORTANT DO NOT ANSWER THIS QUESTION LIGHTLY ************************************************** ************************************************** Would you like to send the key that you generated for the anonymous remailer sent to the remailer operators list? This means that your remailer will be publically announced to the world. Make sure that the UserID you chose is of a form reasonable for a remailer, such as "Joe's Remailer <joe(a)c2.org>", or things could be a bit messy. Do not answer this question lightly. Would you like to send your key to the list? [N]/y n infinity:infinity/rtest 3:03pm [11] >

1 0

AA BBS report
by hkhenson＠cup.portal.com 17 Dec '03

17 Dec '03

I have been keeping the net up on the AA BBS case since it started last year. Latest news (1/21/95) is that bail during appeal was denied by the Sixth Circuit, and that Robert is to report to federal prison Feb. 8, in Springfield, MO to serve 3 years, one month. I have no doubt that picking a place that far from his home and family was done on purpose as part of the punishment. Question for Mike Godwin: Who pays transport from Springfield back to Utah so Robert can be present for the bogus kiddy porn trial in a few months? Also being in prison will make it nearly impossible for him to prepare the .gif files his lawyer wants to present in his defense. They set the date (July 12) and place (Dublin, CA) for Carleen (Robert's wife). She is to serve 2 years, 2 months. I think the reason they are letting her start later is so she can be present when their oldest son graduates from high school. AA BBS is still up, and may well stay up for the whole time Robert is in prison. He has no other way to support his family or pay for legal defense. Also, outside of western TN, OK, Utah, and other backwards places, what he is selling is legal--even protected under the First Amendment. (Though some of it *is* kinda gross :-) ) AA BBS is up to about 25,000 files. There is a good chance that they will be available through the internet at some point. Trying to control information in the network age is about as sucessful as pissing into the wind. Keith Henson

1 0

Re: Why emoney? Why not a web of debt?
by davidm＠iconz.co.nz 17 Dec '03

17 Dec '03

>At 6:54 PM 01/20/95, anonymous-remailer(a)shell.portal.com wrote: >> But electronic computers are good at checking out these kinds of >>chains automatically. Suppose there were a web of debt-trust. Each >>person would indicate the other people who's iou's they will accept >>(and the amount they would be willing to take). > >Certainly, that's what money is after all. Pretty much. But how are you >going to transfer these IOUs electronically in a way that is relatively >fraud-proof? Digital money. Ecash. [...] > And another way to look at it is that you are just proposing an >ecash system where every person issues their own ecash, instead of just a >few central banks doing it. The question of how to value ecash issued by different entities of varied credit-worthiness is an interesting one. I had been thinking along the lines of one or more centralised (but independent) credit rating agencies (a la Standard and Poors or Moodys) that one would subscribe to. Then you would value the various edollars in terms of their credit rating -- so you might sell something for $4 of CyberCash (NA) BV ecash, or $5 of FliBiNite NL ecash and so on. But of course, since ecash is worth only what you can get for it, the web of trust model, since it reflects what people will give for it, seems to reflect that underlying value much better. The best way to underpin the value of ecash is for the issuer to (credibly) undertake to convert it into real money. This gets around the problem of no one on the net making enough things you want: the old 'you can't eat cyberspace' saw. McDonalds may not accept ecash, but if a simple trip to the relevant ebank's Web page can put the price of a Big Mac in your real-money account, that is only a timing problem. [Of course, you have to come out from behind the anonymous ecash shield to do that, but that is a problem of being a real person. If you want to keep your wealth anonymous, don't buy a flash car and the latest Monet to go on sale -- invest it in an anonymous corporation.] An ebank along these lines could be set up reasonably cheaply (apart from the technical hurdles ;-), and could easily scale up as needed, and migrate to safer (taxhaven/banking secrecy) jurisdictions when turnover etc warranted it. David

2 1

Remailers-in-a-box
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: > I am waiting for such services to be actually, formally, solidly > announced, not just casual remarks that it might be possible. And of > course the software should be "ready to wear," port-a-potty, so that > the remailer account owner does nothing more than pay for the account. In this model, who deals with mailbombs/spams/requests for address blocks? It is this sort of administrivia (plus the threat of liability) that makes running a remailer troublesome, not a lack of someone's $20/month. I think it's disingenuous to say that "X pays the bills for the network link; X purchased the hardware and keeps it running; the box is in X's house/office; X is the person who reads complaint mail and responds (or fails to); but because Y sends X $20/month, the remailer (and attendant liability for its mis/use) belongs to Y." I realize that there's a certain formal logic to it, but I don't think that anyone - not courts, and not the world-in-general - is going to pay attention to that formalism when it's clear that a machine essentially under the control of X is being used for 'antisocial' means. I'm seriously considering offering this sort of remailer-in-a-box thing, but there's a certain amount of hassle associated with running a remailer. It can be shifted to different parties, but it must be paid for one way or another. I guess it'd be possible to treat remailers as disposable - when one had pissed off enough people, it could be abandoned - but this lack of long-term reliability seems poor. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLyBjVX3YhjZY3fMNAQEI3QP/YdqBbhn5k4Q+NtD3zoJCG7qIfGaQqogH AFFmItuU46rFQHHSxPl+p4fNmX+32yEva04ORq28NWPKggXiXhwN+LQDshWomSU8 gXkysIPdGeogSDxP6+JxXatE81TpuCjOtbGH3KlmCNaRbB0685zBVB7Oj1O/D5it zqM9JuV8yAE= =EQY5 -----END PGP SIGNATURE-----

5 6

Remailer In a Box available for beta testing
by sameer 17 Dec '03

17 Dec '03

I finally got annoyed with Tim clamoring for a Remailer in a Box, so I set it up just now... I just wrote it so there may be some problems I haven't gotten rid of yet. If you want to run a remailer on c2.org: 1) Sign up for a shell account on http://www.c2.org/services/signup.html 2) Log into your account (via dialup [510-549-1383] or telnet [c2.org] once it has been created. (within a day.. I'll automate account creation so it gets made within an hour soon, but right now I am doing it manually.) 3) If you wish, you can setup a .forward file to point to mailfilters or to another account. 4) Run the program /usr/local/lib/boxed-remailer/install_remail. The remailer will be installed, and non-remailed mail will be acted upon according to how the account was setup before you ran the program. 5) Answer the questions, they should be pretty simple. Once an account is created there is a one week free grace period. If you'd like to continue the account you can pay for it. If you have problems and suggestions, make sure you mail me, and I'll fix it. This is still in beta testing, so if you have problems I won't disable the account waiting for payment until the problems are fixed. $10 for one month, $27 for 3 months, $45 for 6 months. -- sameer Voice: 510-841-2014 Network Administrator Pager: 510-321-1014 Community ConneXion: The NEXUS-Berkeley Dialin: 510-549-1383 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 2

Freenet Remailers (Again)
by werewolf＠io.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I keep periodically asking this question, but has any progress been made on making the remailer software compatible with the remailer software found on Freenets? The question is even more pertinent now that we seem to be having a problem maintaining a satisfactory number of remailers operational and reliable. Is there any consensus as to whether it can be done or not? I'd give it a shot using my Cleveland account to see how workable it is (ie, how long it takes for the Freenet operators to shut it down :>). -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLyGQcHBFBj7pSNyhAQGC2wf/ZwzouQWeUXCok0DgfxRUViBQdNsQhKAE sb0ODG5EubBCDFjIr9KacMyv6++OiqlOZfhNH9X+PCKOa21zJ5AjvNazfpETZnrw zRHgQscOlbdG+lLb/DMZSwIt7cKMaRgY2fp26W3nd20ORiWFtzMpXrSVKj5p/RkZ c4ygPUGu6yGUDSltl1HMnZW4yjkU9yOBiGY39xubmF/4idmNcZFFj7rpGEpQMncd 3VNyeCz7+yDhRvcSXP8Qazv38R79d3FTgMTOJ82gcXUSfoSCrvQHQvFkLOcS/xGv pmYX+wSqDvLfT+jKdq3t3D4jwVa0FLBN+dMhpIsrUu4xLDLONnYHWA== =Pg+A -----END PGP SIGNATURE-----

1 0

Computerworld Article
by moulton＠netcom.com 17 Dec '03

17 Dec '03

I have recently seen several messages about the article in the 14-Jan-95 issue of The Economist, I do not recall seeing any mention of a similar, but shorter article in the 16-Jan-95 issue of Computerworld, p.20. The Computerworld article covers much of the same ground, however I will quote the last three paragraphs of the story. Tim May and Cypherpunks are mentioned at the end. At one point in 1994, rank-and-file members were angrily posting "EFF sellout" notes on the Internet. The reason was the EFF's decision to negotiate with sponsors of the fast-moving digital wiretapping bill - an anathema to many privacy advocates - rather than oppose the bill. The legislation, which was strongly backed by the Federal Bureau Of Investigation and quickly passed, requires telephone companies to re-engineer their digital networks to enable court-ordered wiretaps. The EFF agreed not to oppose the bill after cutting a deal to include some privacy protections and exclude the Internet and on-line networks. But the Washington maneuvers did not sit well with some EFF members. "I've written them off" said Timothy C. May, co-founder of the Internet's Cypherpunks discussion group encryption. "They don't represent my interests. They're not a member-driven, grassroots organization."

1 0