December 2003 - cypherpunks-legacy

Remailer postage
by jpb＠gate.net 17 Dec '03

17 Dec '03

Russ, Where can I get the Magic Money software? I'm also interested in a combination FV/MM approach to anonymous postage. I'm still waiting to get my linux box set up (hassle with client paying the bill and all that fun stuff) but am considering starting a remailer once I get the site set up. I am concerned about the ethics of having a paymailer feed into the free remailer soup - how would their operators react if I'm effectively making money (no matter how little) off of them? In the interest of preserving anonymity, perhaps their should be a set postage rate - that way someone could use a digital stamp anywhere, helping to confuse the audit trail. I'm not sure if I want to get involved in the hassles of redemption though. It would probably become a major hassle for all the operators to have to do that much accounting on a regular basis. jpb(a)gate.net finger for pgp and ripem keys

5 6

All I did was properly crosspost!
by Carol Anne Braddock 17 Dec '03

17 Dec '03

I first saw the Dubois Letter in alt.security.pgp the 28th. PRZ posted it here the next day. I "crossposted" it to my favorite 10 newsgroups. Just 10. Some creep complained. (we'll get to him a bit later). I didn't get a chance to get back on-line for 3 1/2 days. I was lied to. I am hurt. My mail has been stolen. I haven't read any of you for four days now. My web pages are vulnerable. Is there somebody who can please help me get my 2 megs of mail? I can't get at your keys. http://www.winternet.com/~carolann/coffee.html has the cypherpunk rant links on the page. I'm proud of them, and proud to be on this list. But to take my account away for crossposting to 10 groups is not right. I'll be back with a better chronology. Love Always, Carol Anne ps Hope you like (and feel free to use) my new .sig

2 2

Re: Are 2048-bit pgp keys really secure ?
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> A somewhat disturbing trend has appeared in the low-end cost-sensitive PC > SIMM market. Some supposedly 9-bit SIMMs are actually 8-bit SIMMs plus > a parity generator. This means that the parity checking is essentially > subverted, because the parity bit is generated from the stored contents > of memory at read time, rather than the stored contents when it was > written to. As such, NO bit errors are detected. So why not do a cheap trick: After the small primes check calculate a CRC checksum over the number. Then do the primality check. If it is a prime, store it together with the CRC. The CRC can be checked for every use of the number. (PGP encrypts the secret key and therefore it generates a CRC for the encrypted packet. But this CRC is generate after the primality check.) We already had some SIMM modules with bit errors. They were detected by a parity check. If cheap pc simms don't have a real parity bit, the probability of having such a bug isn't as low as 10^-40. If cheap parity-less simms are available they get sold (cheap and expensive). Hadmut BTW: Some weeks ago they found motherbords with falsified cache rams: They had just the normal DIL-ICs and the normal pins, but the plastic of the ICs didn't contain a chip. The BIOS was modified to give out a message about a good cache ram check at boot time.

1 0

Re: public vs. private replies
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Tim May writes: > [...] has asked that we reply in e-mail to him, to avoid > "cluttering the list more than I already have...," but the logic of > this is faulty. The few lines of a response such as this one, or even > of several such responses, are as nothing compared to dozens or more > people sifting their own archives so they can each independently send > [...] what they find. Hence my public reply. I'd like to amplify this point, which is missed all too often on Usenet and mailing lists. Replies to requests for fairly widely-known factual information should be directed to the forum (i.e. the mailing list, newsgroup, or what have you). This practice not only prevents duplication of effort by the repliers, as Tim mentioned, but also prevents duplication of effort by others interested in the same answer. I try to make a point of replying to the whole list when someone asks for a list of remailers, mail-news gateways, etc. for precisely this reason. As I see it the basic principle rests on a simple comparison of the number of replies desired with the likely number of replies. If you anticipate getting many more replies than you want, you should ask for replies to the entire forum in which you place the query. Otherwise, seek private email. This is certainly not a perfect heuristic, but it's an excellent starting point IMHO. For example, a few months back I wanted to give away an old AM/FM/ shortwave radio, so I posted to a local newsgroup. I asked for initial public replies, so that I wouldn't be flooded with mail before I had the chance to announce that a recipient had been selected (first-come first-served). After the initial expression of interest, further correspondence continued in private. [...] > In my opinion, having personal access > to past posts is several orders of magnitude more important than > having MIDI-MIME JPEG-II TeX players [...] It takes more disk space from one's personal quota, though (for those who suffer under such restrictions). :[ Let's not head down this road again.... "You've gotta keep `em separated !" -Offspring -L. Futplex McCarthy; PGP key by finger or server "The objective is for us to get those conversations whether they're by an alligator clip or ones and zeroes. Wherever they are, whatever they are, I need them." -FBI Dir. Freeh - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLwz5Mmf7YYibNzjpAQEooAQAlj93pc1CuSMTdApaRTg06ONgPkeyqUfY KhdcqzDmEnuWBDdwgO+YtHOHFsOGlPhoFhOijajJzTh97G1TBYn5plBECaZXs1RJ Au9g1uqEAKtFLFYB/jKDaDA/Xzf13irCKb846IAhttKICwQJ8HfLfgPWLHMa1/f1 ldkXYq7DfY8= =7KNc - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLwz6PCoZzwIn1bdtAQGpbwGAqY6tLm7TAN2TluCpD1WOTsR6kMgI2R27 CMExwcLopwSapiPNO0u/IHnzHUq5ij2C =TyKQ -----END PGP SIGNATURE-----

1 0

True Names
by Angus Patterson 17 Dec '03

17 Dec '03

I've been trying to get True Names by Vernor Vinge, and have been told it's out of print (like most good cypunk ), does anybody have it scanned? I realize this is without permission, so does anybody have Vinge's address? (e-mail or otherwise) or could anybody ask him? Btw, does he have any other crypto/anonymity related stories? Thanks in advance.

4 3

Re: Remailer Abuse
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Russ Nelson writes: > Heh. An anonymous remailer paid for by credit card... > Sure, I'll know who used it, but I'm not going to keep that > information. (Yes, yes, FV says that I have to keep records of who > bought what, but I'll label all my information with a random number, > that simply says that X bought information worth Y, not *what* > information.) And if you don't trust a remailer operator, then you > won't use it. I'd be worried about a couple of issues - one is just the transaction cost - can you successfully market remailer use at a buck a shot or whatever you'd be charging beyond FV's 29c stamp, or would you have some convenient way to aggregate bill? Beyond that, though, are some traffic analysis problems - remailers require a fair bit of traffic to be useful, and unless you receive a reasonable amount of encrypted traffic, and support encrypted email for purchasing remailer service and other merchandise, an eavesdropper would have a fairly good source of traffic data on your remailer users, especially since buying and using remailer service requires two messages within an hour or so. An alternative billing mechanism, which wouldn't use Chaum-patented cash, would be to sell a bunch of one-shot random-number tokens. When you sell the tokens, you add them to the database of valid tokens, and when one comes in on a message you delete it. This allows you to sell more than one message or service-period per FV transaction, and separates the purchase and use by a longer time, without adding the need for record-keeping based on the user's ID. It obviously does require encrypted reply messages. Another variant is for the user to send you a bunch of tokens along with the purchase, which you store. Blind signatures would improve the security of this process, but require more computation and may involve Chaum's patents. In this case, the message from the client to you would be encrypted, but you wouldn't have to send a reply, so the request could come in anonymously. Bill

1 0

Re: All I did was properly crosspost!
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- [I'm cc:ing this to C. A. Braddock's new address and her ex-sysadmin, in addition to the cypherpunks list. --L. Futplex McCarthy] Carol Anne Braddock writes: > I first saw the Dubois Letter in alt.security.pgp the 28th. > PRZ posted it here the next day. > > I "crossposted" it to my favorite 10 newsgroups. Just 10. Posting letters asking for $$$ is of course a risky venture on Usenet. We see the PRZ Appeal as a Worthy Cause (tm), but that's just what all the MAKE.MONEY.FAST posters think of their garbage too. If you go sticking out your hand, you'd better be doing it in the right place. My frank reaction as a veteran Usenetter is that 10 newsgroups sounds like rather a lot, especially when that presumably excludes the groups like a.s.pgp to which the letter was originally posted. To which 10 newsgroups did you repost the letter ? [...] > Is there somebody who can please help me get my 2 megs of mail? I believe it's questionable whether your old system is under any legal obligation to provide access to your accumulated mail there. As I recall, Netcom ended up deleting most of the deluge of mail Canter & Siegel received after their infamous spam. However, in this instance it does seem that it would be polite (and good P.R.) to give you access to the mail your account has received. Apologize and ask your former admin nicely, and you might well get it. He could move it to an anon-ftp directory, perhaps encrypted with some public key of yours :) [...] > But to take my account away for crossposting to 10 groups is not right. Well, it depends greatly upon what you posted and where. If I posted the PRZ Appeal to *my* ten favorite newsgroups (including alt.config, alt.religion. kibology, and alt.sexual.abuse.recovery), I'd certainly expect to face trouble and perhaps lose posting privileges. [...] > Login name: carolann In real life: CarolAnne Braddock > Directory: /usr2/carolann Shell: /etc/scripts/tcsh-susp > Last login Thu Jan 5 21:38 on ttyq5 from annex3-1.wintern > New mail received Thu Jan 5 21:16:23 1995; > unread since Mon Jan 2 13:18:25 1995 > Plan: > This account has been disabled permanently. > > Mike Horwath - Admin - Winternet - drechsau(a)winternet.com -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLw0Fu2f7YYibNzjpAQGwoAP/RrXUl3vguSSJSvGDNKsXIMek61Ay5Cvy xFO/NWcyZpzXkqwF3w19DOtke1EQ1NuPP7Z9luN6zF/QkqNwS6Z0mAMc8hcI0kLg F3ESx06UABPJMQoVY63BtaDYuj6Dualjs903koAliIUhpITZ+qsf7jaj3qT1FtMa d3SzHqOWGYM= =876P - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLw0G3CoZzwIn1bdtAQHTCQGAgs4itNl5sAZMFjgMIx4Gef52o49+4q3k m36gnACMfYDMThQyhcOS8udSMFw3YM4Q =uty3 -----END PGP SIGNATURE-----

1 0

GIF_nip
by rah＠shipwright.com 17 Dec '03

17 Dec '03

----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

available NNTP posting sites?
by erc＠s116.slcslip.indirect.com 17 Dec '03

17 Dec '03

Does anyone have a list of NNTP sites that take connections from anyone for posting? My regular NNTP site seems to be hosed, or something, and I have a post that needs to get out, but also needs to originate from this site. Thanks in advance :) -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 801/534-8857 voicemail 801/460-1883 digital pager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi ** PGP encrypted email preferred! ** "What's the use of distant travel if only to discover - you're homeless in your heart." --Basia, "Yearning"

1 0

Vinge reference in Moving Mars
by Hal 17 Dec '03

17 Dec '03

Greg Bear's novel Moving Mars, now out in paperback, has a cute reference to Vernor Vinge's ideas from True Names. p.208: "'Don't stick on the names,' Orianna said, shaping the living room into more Regency. 'All my friends are into Vernoring. They work and play with fake names. I don't know their true ones. Not even their parents know.' "'Why?' "'It's a game. Two rules - nobody knows what you're doing, and you do nothing illegal.' "'Doesn't that take the fun out of doin crypto?' I asked. "'Wow - crypto! Hide in the tomb. Sorry. I shy from two-edged words. We call it Vernoring.' "'Doesn't it?' I persisted. "'No,' Oriana said thoughtfully. 'Illegal is harm. Harm is stupid. Stupid is its own game, and none of my friends play it. Here's Kite.'" The book is pretty good, lots of nano and other hot tech, but not much crypto (sorry, Vernoring)... A little slow in places, though. Hal

1 0