December 2003 - cypherpunks-legacy

Re: All I did was properly crosspost!
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- [I'm cc:ing this to C. A. Braddock's new address and her ex-sysadmin, in addition to the cypherpunks list. --L. Futplex McCarthy] Carol Anne Braddock writes: > I first saw the Dubois Letter in alt.security.pgp the 28th. > PRZ posted it here the next day. > > I "crossposted" it to my favorite 10 newsgroups. Just 10. Posting letters asking for $$$ is of course a risky venture on Usenet. We see the PRZ Appeal as a Worthy Cause (tm), but that's just what all the MAKE.MONEY.FAST posters think of their garbage too. If you go sticking out your hand, you'd better be doing it in the right place. My frank reaction as a veteran Usenetter is that 10 newsgroups sounds like rather a lot, especially when that presumably excludes the groups like a.s.pgp to which the letter was originally posted. To which 10 newsgroups did you repost the letter ? [...] > Is there somebody who can please help me get my 2 megs of mail? I believe it's questionable whether your old system is under any legal obligation to provide access to your accumulated mail there. As I recall, Netcom ended up deleting most of the deluge of mail Canter & Siegel received after their infamous spam. However, in this instance it does seem that it would be polite (and good P.R.) to give you access to the mail your account has received. Apologize and ask your former admin nicely, and you might well get it. He could move it to an anon-ftp directory, perhaps encrypted with some public key of yours :) [...] > But to take my account away for crossposting to 10 groups is not right. Well, it depends greatly upon what you posted and where. If I posted the PRZ Appeal to *my* ten favorite newsgroups (including alt.config, alt.religion. kibology, and alt.sexual.abuse.recovery), I'd certainly expect to face trouble and perhaps lose posting privileges. [...] > Login name: carolann In real life: CarolAnne Braddock > Directory: /usr2/carolann Shell: /etc/scripts/tcsh-susp > Last login Thu Jan 5 21:38 on ttyq5 from annex3-1.wintern > New mail received Thu Jan 5 21:16:23 1995; > unread since Mon Jan 2 13:18:25 1995 > Plan: > This account has been disabled permanently. > > Mike Horwath - Admin - Winternet - drechsau(a)winternet.com -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLw0Fu2f7YYibNzjpAQGwoAP/RrXUl3vguSSJSvGDNKsXIMek61Ay5Cvy xFO/NWcyZpzXkqwF3w19DOtke1EQ1NuPP7Z9luN6zF/QkqNwS6Z0mAMc8hcI0kLg F3ESx06UABPJMQoVY63BtaDYuj6Dualjs903koAliIUhpITZ+qsf7jaj3qT1FtMa d3SzHqOWGYM= =876P - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLw0G3CoZzwIn1bdtAQHTCQGAgs4itNl5sAZMFjgMIx4Gef52o49+4q3k m36gnACMfYDMThQyhcOS8udSMFw3YM4Q =uty3 -----END PGP SIGNATURE-----

1 0

GIF_nip
by rah＠shipwright.com 17 Dec '03

17 Dec '03

----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

available NNTP posting sites?
by erc＠s116.slcslip.indirect.com 17 Dec '03

17 Dec '03

Does anyone have a list of NNTP sites that take connections from anyone for posting? My regular NNTP site seems to be hosed, or something, and I have a post that needs to get out, but also needs to originate from this site. Thanks in advance :) -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 801/534-8857 voicemail 801/460-1883 digital pager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi ** PGP encrypted email preferred! ** "What's the use of distant travel if only to discover - you're homeless in your heart." --Basia, "Yearning"

1 0

Vinge reference in Moving Mars
by Hal 17 Dec '03

17 Dec '03

Greg Bear's novel Moving Mars, now out in paperback, has a cute reference to Vernor Vinge's ideas from True Names. p.208: "'Don't stick on the names,' Orianna said, shaping the living room into more Regency. 'All my friends are into Vernoring. They work and play with fake names. I don't know their true ones. Not even their parents know.' "'Why?' "'It's a game. Two rules - nobody knows what you're doing, and you do nothing illegal.' "'Doesn't that take the fun out of doin crypto?' I asked. "'Wow - crypto! Hide in the tomb. Sorry. I shy from two-edged words. We call it Vernoring.' "'Doesn't it?' I persisted. "'No,' Oriana said thoughtfully. 'Illegal is harm. Harm is stupid. Stupid is its own game, and none of my friends play it. Here's Kite.'" The book is pretty good, lots of nano and other hot tech, but not much crypto (sorry, Vernoring)... A little slow in places, though. Hal

1 0

Anonymity in Donating
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Some nice examples of the preservation of anonymity in charitable donations, both for the donor and for the recipient, caught my attention today. An article by Clare Ulrich in the December 1994 Communique (Vol.18 No.3), published by The Cornell Campaign, pays tribute to an anonymous donor to Cornell U.: "While some acts of generosity are marked by a name on a building or a plaque on a wall, others, so to speak, can be counted among the philanthropic `whodunits.' These are the anonymous gifts, and Communique would like to profile several innovative projects that one anonymous donor helped launch this year. According to the donor, anonymity provides greater freedom to `pick and choose' projects that are personally interesting. This donor is particularly attracted to programs that involve computer technology or promise to generate benefits beyond the scope of the immediate project. [...] The same donor who declined recognition for these high-tech projects also provided support for 24 high school juniors from Boys Harbor in Harlem to attend the six-week Cornell Summer College Program in 1994, as well as the two previous summers. [...] Although this anonymous donor may not be interested in getting a name on something, he certainly leaves an indelible mark on the quality of education at Cornell." Closer to home, our dept. chair Dave Stemple broadcast a request for donations to an anonymous recipient: "One of our undergrad majors lived in Amherst Crossings, which burned down last week. As a result this student, a senior who had planned to graduate this spring, is destitute and needs help or he will be unable to complete his degree. If you would like, you can contribute clothes or money (cash only please in order to maintain the student's anonymity) to him. [...]" Incidentally, I received my B&W C'punks shirt from Kevin Prigge a few weeks ago, and consider myself a very satisfied customer. I made a point of wearing it on the flights both ways for a recent vacation I took in California. On the return trip, I was delayed at O'Hare for over an hour due to a leaky window on the airplane. A man in his 50s or 60s approached me and asked, with a smirk, what a Cypherpunk was. I explained a bit, mentioning the passage of the DT bill. Noting the mention of the NSA on the shirt, the man mentioned that his son is working at Apple "with the NSA".... -L. Futplex McCarthy; PGP key by finger or server "The objective is for us to get those conversations whether they're by an alligator clip or ones and zeroes. Wherever they are, whatever they are, I need them." -FBI Dir. Freeh - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLwyA6mf7YYibNzjpAQFENAQA09JTWr501ZJliFWK4efY8py2OhgBq8gy rqYvrGX+EZ49Uq+IDU2DjiiPBHuYPOE23wb/QfouhmKaSSUMqifYTd+uau247Cot CC+CYceBvH3oK35oTr7CahSqb4JLUNs4atOkoYtpbYPG5qrR8yJkAGBKbVzQZHKt ioUFB5xhYKA= =QD4b - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLwyB+CoZzwIn1bdtAQEgkAF+OBkRShMO+Et/Kr8AkPXPz564xgNnhzfP WPSO0W0UCpkg/e7bQIliMCXiyzp7nHQr =1IBd -----END PGP SIGNATURE-----

1 0

RSADSI Conference - Extra Passes?
by chen＠intuit.com 17 Dec '03

17 Dec '03

A cohort of mine is in need of a pass to next week's RSADSI conference, which, unfortunately, is sold out. So if anyone has a pass that they're not planning to use for a half-day or so, please drop me an e-mail and I will be in your debt. Thanks! -- Mark Chen chen(a)intuit.com 415/329-6913 finger for PGP public key D4 99 54 2A 98 B1 48 0C CF 95 A5 B0 6E E0 1E 1D

1 0

for-pay remailers and FV (Was Re: Remailer Abuse)
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 4:10 PM 01/06/95, Nathaniel Borenstein wrote: >I hate to say it, because I generally tend to take the pro-FV side of >most arguments :-), but I think Jonathan's closer to the mark in this >case. If mail goes through ten remailers, and they ALL charge via First >Virtual, then the last one in the chain won't have to know who you are, >but it will have to know your FV billing account. Thus it, together >with FV, have enough information to break anonymity. > >This is NOT the same as saying that ANY one operator, together with FV, >can burst anonymity; it means that the last one + FV can do so. I Hmm. Maybe I don't completely understand how this is going to work, but won't _every_ remailer in the chain need to know your FV billing account? How would the rest of them charge via FV without knowing your billing account? What Russell was suggesting (I think), was that only the first would bill via FV directly, so only the first would need to know your billing account, and then he'd settle up with the others at the end of the month. (A particular variation of that scheme is what you mentioned later in your message, and I'll get to that). But assuming that every remailer along the chain _was_ charging via FV, I fail to see how only the last one would need your billing account; seems to me they all would, and thus any one could collude with FV to violate your anonimity. [...] >Personally, for my taste this is sufficiently anonymous for any >reasonable purpose. HOWEVER, I can imagine how to make it even more >anonymous. Imagine that there are ten for-profit anonymous remailer >operators who form an "anonymous remailers consortium". Each of them >operates TWO remailers, a for-pay one and a free one, but the free one >will only take things that have come directly via some consortium >member's anonymous remailer, so your message has to be paid for once, at >the entry point to the overall system. Now you can build up a chain >that STARTS with a payment, but then threads its way through a bunch of >less traceable systems. where the operators can't give tracing >information even under court order. The consortium members would >probably have to agree to some revenue sharing arrangements, but you >could make this work. Yeah, that's a specific instance of the type of thing Russel was proposing in the message you were replying to. An instance which avoids many of the critisisms I made directly after Russell's message, but not all. The remailer operators still have to have an organization and remain in close contact, which I am uncomfortable with because it seems to make collusion more likely. And it's still dificult to intermix for-pay and free remailers within your chain, or even just for-pay remailers from several different consortiums. And there are a variety of problems in that inability. [The consortium, as far as I can tell, would also find it rather dificult to charge more for a longer chain, I can't think of any way for them to charge anything excpet a uniform amount regardless of length of chain, unless you give the first remailer a way to tell the length of your chain, which is undesirable. I'm not sure if this is a problem.] >I think this level of engineering is overkill -- for my personal level >of paranoia, I would settle for a single for-pay anonymous remailer >located in a country with very different laws than those that governed >the payment system. Such a system would probably be "breakable" for And this level of paranoia would be perfectly well surved by a Julf/penet style remailer, which _would_ work well with an FV-payment system, as I agreed before. The cypherpunks chained remailernet system as a whole is overkill for your paranoia needs, but appearantly not for the needs of those who use it over Julf's. It appears to me, that an FV-style payment scheme can't be added to the cypherpunks chained remailer system without dropping it's security to the level of Julf's. Which might be good enough for you, but not good enough for me, or presumably for anyone else that uses cypherpunks remailers. [Do you understand how cypherpunks remailers work, and the difference between them and a julf/penet style remailer? Do you understand how encryption is used in a cypherpunks-style remailer chain to make it so each individual remailer only knows the next remailer along the chain, and not the entire rest of the chain?]

2 1

Re: ecash trial issues explained
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> From: Wolfgang Roeckelein <wolfgang(a)wi.WHU-Koblenz.de> > > >-> Digital cash should not be "anonymous" -- paper currency isn't. Serial > > There seems to be a misconception here what is meant with anonymous. Paper cash > is anonymous: I can't derive the person I got the note from from the note > itself. So if I meet a guy in the street, he gives me a pack of cigarettes and > I give him cash, this transaction is anonymous. It isn't difficult to make paper cash less anonymous, though, by tracking serial numbers. This is occasionally done in "law enforcement" situations - recording the notes used to pay ransom or bribes. It wouldn't be difficult to add serial-number recording equipment/mechanisms to automatic bank-teller machines, to record what serial numbers would be given out to whom. (This can be done either by adding scanners to the ATMs themselves, or by scanning the money before putting it into the ATM, and having the ATM record that transaction #43 dispensed the 105th-110th bills in the stack. Scanning can either be done by OCRs, or by replacing the human-readable numbers with bar-codes, as some of the paranoids periodically suggest the US Treasury is about to do as part of some heinous plan. However, the original posters' assertion that digital cash should not be anonymous is not a technical statement, it's a value judgement, and in my opinion it's a bad one. There are a lot of genuine social needs that anonymity can support, and a lot of bad things that can be done with traceable money. Aside from that, traceability costs money. Original gold and silver money didn't need to be traceable, though coiner's and assayer's marks were useful, and it is easier to keep track of your pile of gold bars if they're numbered. But paper money has serial numbers largely to prevent easy copying; gold is a lot harder to counterfeit, unless you've got a king who insists that coins with his face on them should be worth N times as much as anonymous coins. Bill

1 0

Re: GIF_nip
by rah＠shipwright.com 17 Dec '03

17 Dec '03

> Watch your Cc: headers, s'vous plait? AAK! Eudora's "reply-to-all" strikes again! Grovelling in your general direction, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

No Subject
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Factoids lifted from apple-internet-users(a)medraut.apple.com: >Jonathan P. Sullivan <jsullivan(a)arpa.mil> wrote : > Here are some other stats culled from an article in the 12/22/94 edition of > Washington Technology: > >* Approximately 300,000 attacks have been made on DoD computers >* Hackers have successfully compromised 350 DoD computer systems >* 88% of all information warfare attacks succeed >* 96% of those successful attacks are never noticed >* Only 4% of those noticed are reported Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1