December 2003 - cypherpunks-legacy

Response to CBS News "drive-by" attack on the internet
by Brad Dolan 17 Dec '03

17 Dec '03

January 10, 1995 Eric Ober President, CBS News 524 W. 57th Street New York, NY 10019 Dear Mr. Ober: In its 1/9/95 evening news broadcast, CBS aired a segment presenting a number of people who argued that the content of school libraries, written communications, and electronic communications should be censored for the common good. Since CBS did not present anyone with an opposing point of view, I assume the position presented is believed by CBS to be correct and not controversial. At first I was concerned about your network's apparent lack of support of first amendment rights to freedom of speech and of the press. Then I realized that these freedoms are only to discuss topics which could not result in physical or moral harm to anyone. I have some friends who share your concerns. They have been trying for years to reduce availability of morally dangerous materials like _The_Catcher_In_The_Rye_ and _Heather_Has_Two_Mommies_. They will be so excited to hear that you are now on their side. Sincerely, Brad Dolan bdolan(a)well.sf.ca.us

1 0

Re: Anonymous videoconferencing applications
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Alan Bostick writes: > I thought so too, at first; but then I thought of this obvious application: [lurid details omitted ;] "Ever seen your children bound and blindfolded from across the globe ? You will...." > Whether technology is going to be developed for the convenience of > kidnappers and terrorists is an open question. I'd answer, "Undoubtedly," but I wonder just how readily available such technology would be to, uh, the rest of us. > But there is clearly > at least this one clear use for anonymous video conferencing. Perhaps headhunters would find it handy for anonymous job interviews with candidates who prefer to remain nameless, but not jobless.... -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLxIrqmf7YYibNzjpAQGE9AQAlSGdkOEWsbXICCygoa4Sr+Gj9y91xHeS 3YpA40lODXDmvAoIxWRtpOt2k3a1G381xwxaSCh7b+Wh90V4dknS/ysvu/VLLdUG k1H/eGttn+TzcVPARc0fxExDV5yNxueDRaqil1sDnsgtVyBMzCmu6jdHKL4molku 5zN0SLh2RLY= =zmcz - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxIstCoZzwIn1bdtAQFiIQF9Ho6rMKp+ii7kSgFalxf8j+05ZHTFkxCc /LQUDOvxy1jXK5+EpaOwP/LyI5fru7YQ =ZD2g -----END PGP SIGNATURE-----

1 0

Re: Data Haven problems
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 07:25 PM 1/9/95, dfloyd(a)io.com wrote: > ... Of course, the DH will be hidden by a good remailer (anon.penet.fi), but >it is trivial to use traffic analysis to find where the DH lies. Just >monitor traffic from/to the remailer and do a series of store/retrives. >Then for confirmation, forge a mail from the dh site to the remailer with >the password (obtained from sniffing) to yourself. ... Hmm, hmm. Using c'punk remailers with encrypted send blocks fixes one problem, especially if the c'punk mailers do some sort of file splitting and reassembly along the lines of what happens to IP packets that are too large for a given link. What would also help would be a mechanism for randomly varying the encrypted send-to block. The password replay attacks can be fixed by encrypting the transmitted password along with a timestamp/sequence number. One problem that remains would be a trail left by the increased traffic to/from a DH vs a normal user. That could only be fixed by a multitude of DH sites. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

2 1

Re: DH Traffic Volume Analysis
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Paul J. Ste. Marie writes: > One problem that remains would be a trail left by the increased traffic > to/from a DH vs a normal user. That could only be fixed by a multitude of > DH sites. Ubiquitous remailing -- having a significant portion of the net population bouncing around randomly fluctuating encrypted traffic as background noise -- should help to cover both remailers and data havens. It would be nice to have more people firing off occasional encrypted stuff to muddy the waters. (Picture yourself in Bridge over the River Kwai if it helps ;) -L. Futplex McCarthy; PGP key by finger or server - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLxIkLGf7YYibNzjpAQGZfgQAp464Szt+W1pvcHQRLH39kmato3tQaHIn mNSNjeXBwWqrgIXYoLAQfcX1qvVb0NJQikGc4P7Xo/o7Aa2LOIWTt6TRxXlUkaod gmYr6XGvoCST1eciMeMTKRjVRJgA6p4/GmQwQwmvFtTus1waS5T+RsNX0nbCu3ng eg3sZ5s7pKI= =973H - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxIlNCoZzwIn1bdtAQFGBQF/Zl+lLTMyM55oRF2PSsA0ld13i/I1uyvW sD3C3JkqgQ9XsDjGquKXoPwDCsAEgN6E =7MWJ -----END PGP SIGNATURE-----

1 0

Re: for-pay remailers and FV
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Pierre Uszynski <pierre(a)shell.portal.com> > Finally, I do not believe that introducing payment in the remailer > system would curb abuse in any significant way. Significant abuse is > that which causes significant problems for the operators: posting > secret religious technology, forging prime minister mail, harrassing a > member of any number of opposite persuasions, etc... Do you think for a > minute that a 5 cents postage is going to stop these messages now? And > how about when remailers do attain good reliability and untraceability, > for 3 cents? I had suggested an idea a while back where you would try to address the abuse issue directly rather than charging per message. I agree with Pierre that any reasonable per-message charge will not help in many forms of abuse, although it should address the worst spam attacks. The idea is to have a sort of digital cash token, but it is free. The key is that each person just gets one of these, but they are reusable. After a remailer sends a message, it waits and sees if it gets any complaints. If not, the token is re-blinded and made available to the original user via some kind of pool. He can then send another message. But if he commits abuse, he doesn't get his token back. Obviously there are problems with this, the worst probably being how we can keep people from acquiring lots of tokens under different names. Perhaps you could charge some small amount for them, but require VISA payment, and check the names on the VISA cards. (This doesn't hurt anonymity when the tokens are actually used because of the blinding.) To get multiple tokens a person would have to commit some serious real world name trickery, a considerably higher barrier than making up a pseudonym on the net. Another problem is that as stated above, you could only send one anonymous message every day or two. Perhaps we relax the rules and let people have a few of these tokens; they can then abuse the system a few times but each time they lose a token. A similar idea might work for the data haven problem, although I don't understand exactly what is intended there. This approach is a variation on the "is a person" credential, which attempts to make sure that each person only gets one of something. A lot of situations would benefit from such a credential, although some people don't like them. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLxIw2RnMLJtOy9MBAQGWCgH6A1SFyzZDDhd/NVrMck5SAf3mS4IOl5On aJNFKUopZi4Fb7tqQfbFukDl/lF+clnBDBNh/yXAsFcABJaWaTUzZA== =pLOT -----END PGP SIGNATURE-----

1 0

Re: Traffic generation
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Joe Block writes: > As an added security measure, when a valid control message is received, > an identical length stream of random garbage should then be encrypted and > passed into the remailer pool. This would be easier if remailers supported > some sort of bit sink command to trash a message rather than pass it along. Lance Cottrell's Mixmaster software supports this -- just use Anon-To: null - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxI43yoZzwIn1bdtAQFNJwGAyLeVNnXjphXZFF9tznd4BI09+e4ec3z7 XjLgNg3qtNoxUM44ZkW0xsME+ot5B4A/ =q5OQ -----END PGP SIGNATURE-----

1 0

Re: Data Haven problems
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

dfloyd asks for ideas about preventing spamming in data havens, for the code that he's working on. It's a hard job. A related problem is how to prevent your data haven from becoming the porno-ftp site of the week, and either being swamped with traffic or raided by the Post Office Reactionary Neighborhood Police. One way to stop spamming is to charge sufficient money for the service that using it always pays for itself - spamming is then reduced to a source of profit, e.g. no problem. If people want to hire you to store spam, it's their money they're wasting. But that requires an anonymous digital cash infrastructure, which we don't really have yet. And it's a lot less interesting academically (:-) than finding solutions which can also work in a cooperative system, or at least a system that doesn't charge per transaction. Probably the most important step you can take is to build in operator-selectable filtering, because the problems keep changing. Operators probably need to be able to block storage and retrieval by specific users and sites (It's easier to prevent access by president(a)whitehouse.gov than it is to detect forged requests, and you probably want to keep both real and fake Cantor&Siegel users off, plus the bozo of the month and the broken-remailer of the day.) Some operators may find it useful to limit the amount of data that can be stored or retrieved by a specific user or site, though this is less useful with anonymous and pseudonymous remailers around, since "a specific user" becomes vaguer. Filtering by filename and type can also be useful - if you don't allow files named *.gif and *.jpg, users may be less likely to spam you with pornography. Namespace control in general is an issue - do users get to choose filenames, or list directories, or do they have to know the names of files to retrieve. Another issue is whether files can only be retrieved by the sender - probably a local policy issue. Some sites may only accept encrypted files, which reduces the spam potential considerably, as well as reducing your exposure to the porn police, though it's difficult to do anything about files that are encrypted with a public key whose private key has been posted to the net, or fake crypto headers in an otherwise unencrypted file, unless you put in lots more code to check the insides of files and watch the net for such postings, which is unrealistic. There's also the problem that PGP and especially RIPEM files are non-stealthy, and users may not want to leave even keyids in their files. Bill

8 10

PRESS RELEASE - RSA Licenses Commercial Distribution Rights to RSAREF (long)
by Christopher Allen 17 Dec '03

17 Dec '03

-----BEGIN PRIVACY-ENHANCED MESSAGE----- Proc-Type: 4,MIC-CLEAR Content-Domain: RFC822 Originator-Certificate: MIICRjCCAdsCBQJTAAAEMA0GCSqGSIb3DQEBAgUAME4xCzAJBgNVBAYTAlVTMRMw EQYDVQQIEwpDYWxpZm9ybmlhMSowKAYDVQQKEyFDb25zZW5zdXMgRGV2ZWxvcG1l bnQgQ29ycG9yYXRpb24wHhcNOTQwNjI3MDAwMDAwWhcNOTUwNjI2MjM1OTU5WjCB 4DELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExKjAoBgNVBAoTIUNv bnNlbnN1cyBEZXZlbG9wbWVudCBDb3Jwb3JhdGlvbjETMBEGA1UEERMKOTQxMTQt MzYxNTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNj bzEeMBwGA1UECRQVNDEwNC0yNHRoIFN0cmVldCCmNDE5MRIwEAYDVQQMEwlQcmVz aWRlbnQxGjAYBgNVBAMTEUNocmlzdG9waGVyIEFsbGVuMHAwDQYJKoZIhvcNAQEB BQADXwAwXAJVKa43Pd6AhLaYGRLMwvGGvZ7dtzK+XpsRtwKYEDQKHE8swS09ViEg MKuMa/+weQXDBpqQ6SDj/xgHGzmwGhkbeitPWr/6Du5gemMLrhhTs8eMhAXLXwID AQABMA0GCSqGSIb3DQEBAgUAA1YAEkQDfJmroAMZD5v1F7fPK38y4waoX0FSpdsf jcXf04URcEJc5dCFm0DzrMPMdVpNz5tpSBy0ZUeg/xqbwRfHIW34bMAVLc9kojIi AGXlHL/q8HRCIx== Issuer-Certificate: MIIB6TCCAVYCBQJBAAAKMA0GCSqGSIb3DQEBAgUAMFwxCzAJBgNVBAYTAlVTMSAw HgYDVQQKExdSU0EgRGF0YSBTZWN1cml0eSwgSW5jLjErMCkGA1UECxMiQ29tbWVy Y2lhbCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05NDA1MDUwMTEwMDRaFw05 OTA0MzAwMTEwMDRaME4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh MSowKAYDVQQKEyFDb25zZW5zdXMgRGV2ZWxvcG1lbnQgQ29ycG9yYXRpb24wcDAN BgkqhkiG9w0BAQEFAANfADBcAlUpc+2/Ec+bydwsB6enemznB/aQwd4gp2YSI3FW PHl2tc/aa7HZFA0qCL/0Ol6ituC+yUEO3IWKQ5U8hhl1RVqmW7mzwNOr2yeHIFA5 rqXvAvMvlGpvAgMBAAEwDQYJKoZIhvcNAQECBQADfgA2QEssX/nG3spHBpbkU4KV oQdVhxtQEmjuIrqBVI9jQRntacJ0tw1m5MsLV6hNMV/mD0yKmDc9ywSF7ZWIipVY tz8E52yQEprR+JxTad+/ZtTI0wEvEM5313jUF4ivF86eOuZDqHd4zbRHk6ggIAGH 86GFbMaWDaKoGUrde2== MIC-Info: RSA-MD5,RSA, J9l0zSgqnVqK8a9QQ3Ml+O6tv58PsVmCELOQTqj1i8HCQoHpJ+bEmayf4WyIbqoY y4xFecAPQfP5hpHPLVoLX4IM7kNT0UhDHW8XklfhhAVE1+Y0Og== Date: Mon, 09 Jan 1995 09:00:00 -0800 Subject: PRESS RELEASE - RSA Licenses Commercial Distribution Rights to RSAREF From: Christopher Allen <ChristopherA(a)consensus.com> Organization: Consensus Development Corporation, San Francisco, CA USA Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-Text-Source: ftp://ftp.consensus.com/pub/consensus/pr/RSAREF-PR.txt X-HTML-Source: http://www.consensus.com:8300/RSAREF-PR.html Summary: RSA announces that it is licensing commercial distribution rights of its RSAREF software to Consensus Development, allowing for implementation of commercial Privacy Enhanced Mail (PEM) applications. Keywords: press release, consensus development corporation, rsa data security, rsaref, commercial license, support, marketing, maintenance, encryption, digital signature, source code, tool kit, PEM, privacy enchanced mail RSA Licenses Commercial Distribution Rights to RSAREF ===================================================== RSA announces that it is licensing commercial distribution rights of its RSAREF software to Consensus Development, allowing for implementation of commercial Privacy Enhanced Mail (PEM) applications. Press Release - ------------- REDWOOD SHORES, CALIFORNIA--JANUARY 9, 1995--RSA Data Security, Inc. and Consensus Development Corporation jointly announce today at the RSA Data Security Conference that Consensus Development is licensing the commercial distribution rights of RSAREF from RSA Data Security. RSAREF (pronounced "R.S.A. reff") is short for "RSA reference implementation" and is a cryptography source code toolkit designed to allow developers to create PEM (Privacy-Enhanced Mail)software and other encryption/authentication tools. Until now, RSAREF has been an unsupported RSA product approved for use only as part of freeware and not-for-profit software applications. Consensus Development will now be able to market and license RSAREF to commercial software developers, and provide software support and future enhancements to the RSAREF source code library. This announcement is significant because it is the first program of its kind to make the RSAREF implementation of RSA's popular patented authentication technology available to commercial vendors. "Data mailed, posted, or put on servers on the Internet is inherently untrustable today, " said Jim Bidzos, president of RSA. "Tampering with electronic documents takes no special skills, and leaves no trace.With the availability of RSAREF for both free software as well as commercial software there is no need for this situation to continue." Now that a commercial license to RSAREF is available, applications may now be developed and sold that incorporate Privacy-Enhanced Mail's authentication and encryption capabilities. Christopher Allen, President of Consensus Development adds "The PEM standards have been under development for a couple of years and only now are coming to fruition. The ability to offer both freeware developers and commercial software vendors a license to RSAREF will kickstart the adoption of PEM-capable mail software." Consensus Development will be creating an email discussion list for software developers interested in RSAREF. To join the discussion, send a message to <listproc(a)consensus.com> with the body of the message requesting "subscribe RSAREF-DEV-L firstname lastname". Background - ---------- The RSA cryptosystem was invented and patented in the late 1970's by Drs. Rivest, Shamir, and Adleman, at the Massachusetts Institute of Technology, who started RSA Data Security in Redwood City, California, in 1982. Digital signatures are produced using the RSA Cryptosystem, which is a public-key cryptosystem. Each user has two keys - one public and one private. The public key can be disclosed without compromising the private key. Electronic documents can be "signed" with an unforgeable signature by using a document/private-key combination to produce a signature unique to the author and particular document. Anyone using an application that supports RSAREF and has the public key of the author can subsequently verify the authenticity of the document. Applications of digital signatures are endless: expense reports, electronic forms and purchase orders, contract revisions, engineering change orders, even tax returns can be electronically signed to speed electronic document flow and eliminate fraud. Furthermore, digital signatures can also be used to detect any virus before a program is executed, since any change whatsoever is detected. One reason that the paperless office has never materialized is that paper must still be printed so that handwritten signatures can be applied. RSAREF eliminates that necessity. Applications supporting RSAREF could have prevented last year's computer fraud at Dartmouth College, in which students were tricked into missing an important midterm by a fraudulent electronic mail message claiming to be from university faculty. Corporate Profiles - ------------------ RSA Data Security, Inc. <URL=http://www.rsa.com/> is the acknowledged world leader in encryption technology, with over three million copies of its software encryption and authentication installed and in use worldwide. RSA is a defacto standard for encryption and digital signatures, and is part of existing and proposed standards for the Internet, CCITT, ISO, ANSI, IEEE and business and financial networks around the globe. RSA develops and markets platform-independent software developers' kits, end-user products, and provides comprehensive consulting services in the cryptographic sciences. RSA technology has been embedded in the products of many companies, including Microsoft, IBM, Apple, Oracle, General Magic, DEC, Sun, Novell, Lotus, Motorola, Northern Telecom, AT&T, WordPerfect, General Electric, Hughes Aircraft, and many others. The company is headquartered in Redwood City, California. Consensus Development Corporation <URL=http://www.consensus.com:8300/> is a software development and consulting firm specializing in the support of organizations that need long-distance collaboration via wide-area networks and the Internet.Consensus Development has been offering consulting and software tools in the area of collaboration support since 1988 and is based in San Francisco, California. Clients include Aladdin Systems, American Information Exchange (AMIX), America Online, Apple Computer, Attain, Authorware, Berrett-Koehler Publishers, Claris Corporation, Component Integration Laboratories, Connectix Corporation, Digicash bv, Group Technologies, InterCon, ON Technology, Portfolio Systems, RSA Data Security, Ronin Publishing, Software Ventures, Visa International, and Xanadu Operating Company. Contact - ------- Kurt Stammberger RSA Data Security, Inc. 415/595-8782 <kurt(a)rsa.com> Christopher Allen Consensus Development Corporation 415/647-6383 <ChristopherA(a)consensus.com> $$ - ------------------------------------------------------------------------ ...Christopher Allen Consensus Development Corporation.. ...<ChristopherA(a)consensus.com> 4104-24th Street #419.. ... San Francisco, CA 94114-3615.. ... o415/647-6383 f415/647-6384.. ...Mosaic/WWW Home Page: .. ...Consensus Home Page .. -----END PRIVACY-ENHANCED MESSAGE----- Created with RIPEM Mac 0.8.5 b1

2 1

Pornography, What is it?
by root 17 Dec '03

17 Dec '03

From: ravage(a)bga.com To: cpunks the world over Hi all, I am very interested in the data haven issue now that I have my site up. The aspect of pornography is a problem that has to be faced. To this end, I would like to ask that we look at how pornography is defined. >From my own view, I fail to see any way to truly define pornography as anything other than the ravings of a neurotic (both on a personal and a societal level). Every example of pornography I have seen has been put in that category because it contravenes some personal or group taboo. Take care.

3 5

Rumored CBS "hit" on internet coming
by Brad Dolan 17 Dec '03

17 Dec '03

This may be old news or it could be bogus but fyi anyway: >From parsons(a)bga.com Mon Jan 9 05:16:49 1995 >From: Brad Parsons <parsons(a)bga.com> >Subject: CBS/C.Chung Plan Hit Job on Internet? (fwd) >To: bdolan(a)well.sf.ca.us > > >Brad, Could you forward this to the cypherpunks list? Thanks.--BJP > >---------- Forwarded message ---------- >Date: Mon, 9 Jan 1995 03:48:01 -0600 (CST) >Subject: CBS/C.Chung Plan Hit Job on Internet? > >A friend tells me that CBS and Connie Chung plan a hit job on Internet >on the evening news today, 1/9/95. Apparently it may be in the context >of youths supposedly learning how to make bombs from online info. In >case I don't get to watch it, could somebody make it a point to watch >it and give us a summary of the report. Thanks. Reply, if you're inclined, via e-mail. I'm off the list until the Carol Ann stuff dies out. - Brad Dolan, bdolan(a)well.sf.ca.us

3 2