December 2003 - cypherpunks-legacy

Re: Storm Signals
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

> > > > 1: Somebody's roommate (a Green Beret) has been called back into > > > > 6 months of active service. He was not told where he'd be. > > > Perhaps Bosnia? > > > > I doubt it. [...] > > > > Military action also requires political will, and with the recent change > in power in the US govt there is no way anything is going to happen for at > least six months. Freshmen congressmen do not sign off on a war the first True. But clandestine operations don't require the approval of Congress. In fact, the prez never has to admit they exist. Ever. Read the Pentagon Papers. -Rat

2 1

Re: Microsoft TrueName (tm)
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

Praise Bob! The Rev. Ivan Stang's been preaching that for years! Long live the Slackmaster! Registered<BETSI>BEllcore Trusted Software Integrity system programmer *********************************************************************** Carol Anne Braddock "Give me your Tired, your Poor, your old PC's..." The TS NET REVOKED PGP KEY NO.0C91594D carolb(a)spring.com carolann(a)mm.com ************************************************************************ COMING SOON TO AN INTERNET NEWSGROUP NEAR YOU...............CENSORED.COM

1 0

Re: Storm Signals
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Frankly, I'm quite puzzled by these signs. I can't think of any country that > seems due for a quick invasion by the USG, but the increase in granularity of > the GPS information suggests an operation of greater magnitude than just a > strike against terrorists, drug cartels etc. The normal clear transmission mode of GPS is intentionally "granulated." It was during ODS that the "granularity" was turned off rather than on. This was to allow them to purchase commercial GPS equipment for use in the Gulf theater. It could simply be a return to that standard mode. - -NetSurfer #include <standard.disclaimer> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> == = = |James D. Wilson |V.PGP 2.7: 512/E12FCD 1994/03/17 > " " o " |P. O. Box 15432 | finger for full PGP key > " " / \ " |Honolulu, HI 96830 |====================================> \" "/ G \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxS1iSoZzwIn1bdtAQHrdQGA4SP5Eawy54J11nCmwI2WzbYPojKeM8S+ gE1DtpEO025SZ7JsBcgoXFBdllLHclvZ =Nl9j -----END PGP SIGNATURE-----

1 0

Remailing pricing and cover traffic
by Pierre Uszynski 17 Dec '03

17 Dec '03

We have been debating payment systems for remailers under the following assumptions: a) Reliable remailers will have to justify professional management by making money for their owners. b) End-of-chain remailers will need to make money to cover for their legal expenses. c) Payment would limit abuse. I already countered the last point. Let me try to deal with the first two to conclude that many professionally run remailers may very well stay free or close to that for a long time: Remailers are only one of many kinds of businesses that have been described on this list. Others will include reputation markets, near-traditional banking systems, stamp issuers, certification agencies, data havens etc... But we have also seen that nearly all other forms of businesses already now cannot but run afoul of a tentacular law at some time or other. We have concluded that many of these businesses would migrate to cypherspace, hiding their locations, owners, books, assets and other information too dangerous to keep in the open. Each such organisation will generate lots of traffic, in part under control of whoever is trying to do business with it. So they are potentially easily traceable and subject to legal or violent consequences. A possible solution is of course for their sites to be remailers too. Lots of non-descript remailers, trading lots of encrypted traffic, a lot of it remailer management info and bogus filler traffic. When you are one of many, and people correspond with you only through limited traffic anonymous response blocks, then the remailers help you stay hidden by providing cover traffic. But for this to work you must consistently attract a lot of cover traffic through your remailer(s). If others undercut your stamp price, or best your reliability status, you are in trouble because traffic will migrate to other more competitive remailers, and you will be left dry on the sand with the task to generate believable cover traffic yourself. You are also competing with the cypherspace customers hiding their own personal traffic under cover of "everyone-a-remailer" remailers. It may well be much simpler for cypherbusinesses to stay competitive on the "middle" remailer market, even at a loss, and to transmit volumes of believable (because real) cover traffic. End-of-chain (or more precisely "clear-text") remailers can be expected to be a minority as, after all, they are only needed to post to public forums. Maybe these will charge a fee. For the others, the most and biggest "porn GIFs" go through (even for free), the better... However, large free remailers may then arise suspicion: There is little reason to run a heavy traffic remailer for free, apart from getting cover traffic. Competition may then settle at a small price, far from enough to keep the remailer running, but enough to not be too conspicuous. Or better, non-profit remailers may become ubiquitous, being used in part to provide cover traffic and in part to transfer money from the cypherspace businesses to cover for the cost of the computers and obvious living expenses. Between cypherbusinesses, everyone-a-remailer operations, and a few real non-profits, most remailing may stay close to free for a long time. Untraceable money will be useful for all kinds of things, but maybe not so much for remailing. Pierre. pierre(a)shell.portal.com

2 1

Re: Microsoft TrueName (tm) (fwd)
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >From: Censored Girls Anonymous <carolb(a)barton.spring.com> >To: cypherpunks(a)toad.com >Subject: Re: Microsoft TrueName (tm) >Praise Bob! The Rev. Ivan Stang's been preaching that for years! >Long live the Slackmaster! I wondered why one of the few registered hosts for Microsoft were called "Bob" - now it makes sense. (But they've got a good sized chunk of netblks registered...) - -NetSurfer #include <standard.disclaimer> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> == = = |James D. Wilson |V.PGP 2.7: 512/E12FCD 1994/03/17 > " " o " |P. O. Box 15432 | finger for full PGP key > " " / \ " |Honolulu, HI 96830 |====================================> \" "/ G \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxVXWioZzwIn1bdtAQFrygF+LKX95qYx46I4dr7TL5WBZd3brfu8VqcE BDR+o9c/Vqu1XTGTNiS2Ij4JCEm/R4Dw =CMgM -----END PGP SIGNATURE-----

1 0

Why use plastic for remailers and DH?
by Angus Patterson 17 Dec '03

17 Dec '03

This point may have been raised before, but anyway, unless you're using a swiss-bank issued credit card for a numbered account (if that's at all possible), or a bogus name on the card, why would anybody want to use something as completely traceable as a credit card to pay for a remailer or a data haven?

3 2

Re: Storm Signals
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Sam Kaplin writes: > Todd Masco writes: > > 1: Somebody's roommate (a Green Beret) has been called back into > > 6 months of active service. He was not told where he'd be. > > Perhaps Bosnia? I doubt it. The only sort of Bosnian engagement that might make sense would involve a fairly conspicuous effort with a large number of troops. I can't see what a few thousand Green Berets could accomplish there. Frankly, I'm quite puzzled by these signs. I can't think of any country that seems due for a quick invasion by the USG, but the increase in granularity of the GPS information suggests an operation of greater magnitude than just a strike against terrorists, drug cartels etc. Is it time for Bay of Pigs II already ? ;) -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLxOY7Gf7YYibNzjpAQF7nwP+KUk7o1bpM76wmGrzv+KZIgi8kby1XHIj 4FzXLLZGLC8bVGGniv1NkLR76XH6HeLfWpaJu4LeCCBE6RbsgUD+bqEQeTdijpVg OJzOWM/Rt6/vTJT+/yiVpFBbPDgG1sXvy4SlQX0wSATNzjbdNHxoorory1fOmjRi 6RF2tHYFbTM= =Yk81 - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxOZ9ioZzwIn1bdtAQFF/QGAiqkCeSwdxCMlF0AeO6jOJkaxKQ4EAe68 +AYM/slciv3rbqrkw6nRf19LM7AmXBsG =lDeV -----END PGP SIGNATURE-----

9 9

Re: Getting on the list
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 06:57 PM 1/11/95 EST, Paul J. Ste. Marie wrote: (something I didn't mean to send out to cypherpunks) Sorry. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

How do I know if its encrypted?
by marko＠millcomm.com 17 Dec '03

17 Dec '03

I keep seeing the idea that to keep out of trouble remailers and Data Havens should require that data be encrypted before it is accecpted. My question is how do I know it is encrypted? If I say that anyone sending me data to be massaged by my system must first encrypt it, how do I know they are in fact complying with that request? After all this is the area for the paranoid's to hang out in. I see some possible options. Most don't seem to workable. I could ... (1) Look at the incomming data, which of course would be impractical and defeat the whole idea. (2) Force them to pgp it, but that could be defeated by having enough of a pgp sig. that my system is fooled. Not to mention they must use *MY* idea of what good encryption is. After all I could say you must use my encryption software that has a backdoor I know of, i.e. clipper, or that costs money and can only be bought from me. This last point would be one way of making sure you made some money, but does seem impractial. (3) Peform a histogram analysis on it, if it doesn't pass a certain threshold reject the whole thing. Although cute, I don't like this one. (4) Encrypt it with my own key and decrypt it before squirting it back out. This doesn't seem to gain me anything though since it could be said that I still have the ability to look at the data. (5) Only acecpt data from a remailer or other service that would be guranteed to be encrypted. This seems like it would lead to a 'good ole boy' network that could exclude service providers it doesn't like. etc. etc. Whos to say that the data isn't encrypted? I could be hidding a real message in that eagale spread of a porn picture. 'Simple, don't allow porn but only accecpted images.' Well that certainly sounds like a can of worms waiting to squirm around your toes. Is the question of what is encrypted data similar to what material is porn or some other 'evil' data? Am I missing something in this simple requirment of only dealing with encrypted data? Or am I simply blowing something way out of proportion? -Mark ---------- Mark Oeltjenbruns marko(a)Millcomm.com N0CCQ SnipIt Research Finger for PGP key. 'My other key is 2048 bits.'

5 4

Re: How do I know if its encrypted?
by daleh＠ix.netcom.com 17 Dec '03

17 Dec '03

You wrote: > > My question is how do I know it is encrypted? > >Calculate an entropy measure of some sort. Entropy is a measure of >disributional skew. Maximum entropy means minimum skew. > >For human-readable text of any sort, the monogram entropy, i.e. the >entropy of individual characters, will _always_ be detectably less >than maximal. Encrypted text will always be near maximal. The two >are easy to distinguish. ASCII-armored encrypted text will always be >right at 6 bits per byte. > >For speed of implementation, you don't need even to look at much text. >You can get a statistically significant measure quite quickly from the >first couple of kilobytes. > >And since you're only really worried about detecting non-randomness, >you don't even need to calculate the exact entropy but rather an >approximation of it. This approximation can be done with entirely >fixed point arithmetic, if you're a bit clever about it. > >A practical system would cut out a notch at 6/8 for ASCII armor, which >would make approximation techniques a bit tricky. More practical is >just to detect ASCII armor with a regular expression recognizer and >de-armor it before the entropy check. > >Eric > > Won't work! You can always embed an encrypted message in what 'looks' like plaintext. A trivial example: Encrypt a message with a caesar cypher, then build a story where the first char of each word maps to each subsequent char from the encrypted text. At the cost of expanding the size of the message by a factor of 5 to 10 you've hidden the encrypted message in what looks like a letter to your mother (or a news story in the NY Times, etc.) This is old technique. Dale H.

3 2