December 2003 - cypherpunks-legacy

Re: Another problem w/Data Havens...
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

At 4:33 PM 1/18/95, Paul J. Ste. Marie wrote: >[. . .] As long as >some piece of info is considered to be a thought-crime, everyone who accepts >info from a wide range of sources is at risk. We might have a test case right now for part of that idea--the Scientologists. They're essentially claiming that the various newsgroups should be shut down because somebody put thoughtcrime on them. I would posit that the operator of any automated data transmission/massaging service is not responsible for the data that passes through her equipment. Consider, for example, if I used a bang path to route an illicit email note through, say, apple.com. Does that make Apple Computer responsible for what I send? Tying in with some of Eric's comments, this could be viewed as a fundamental flaw in the 'net: it's the sender, generally, who initiates and controls the connection, not the recipient. We could view this as an advantage: how can you blame me for what somebody else does to my computer without my knowledge, especially if I have no way to stop it short of getting off the 'net completely? >> ... The service could even be advertised as a different form of timestamping >>(or notarizing). Not only do you get the file back signed, but you get it >>back encrypted and signed. ... > >That would still be a useful service, however, but it does transfer the risk >from the DH operator to the encryptor. Since he isn't leaving evidence on a >hard drive, his window of vunerability is somewhat less. Less to nonexistent. If no human sees it on the encrypting site, no human can be responsible for it. "They" would have to ban the service outright, or try to prove that you knew that your site would be used for illicit purposes. If putting a warning to not export crypto software on an ftp site is sufficient protection--and, judging from the number of sites which do no more than that, it is--then a simple statement that the service is not to be used for any illegal purpose should do fine here. > --Paul J. Ste. Marie > pstemari(a)well.sf.ca.us, pstemari(a)erinet.com b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music Finger ben(a)tux.music.asu.edu for PGP public key ID 0x875B059.

2 1

Re: Another problem w/Data Havens...
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> I could write a procmail recipe and a script in about an hour to > automatically secret-share-split and redistribute the incoming submission. > If the authorities attempt to indict you for possessing illegal > information / kiddie porn / whatnot, they have to prove that you > interfered with the automatic redistribution process and examined the > contents of the submission. If you in fact did not look at the submission, > they would have a difficult time doing so. The problem with a procmail script, unlike the ugly on-the-fly SMTP-like splitting method I proposed, is that the suspicious message is in your mail system, intact, and if they nail you before you can dispose of it, they can prove you had it. (Even though procmail does stuff quickly, sendmail still accumulates the material before delivering it, doesn't it?) They still have to prove that there's something illegal or forfeiture-supporting about the way you possessed the message, but by then you're hauled into court and your computer is stolen. The Feds argued in the Steve Jackson Games fiasco that intercepting unread mail in mailboxes is different than intercepting it in transit, and while we can hope that will be overturned, it's better not to be the guinea pig. If your machine never has more than a few bits of the message, they can't catch you in possession of the message - they can only argue that bits of it flowed through your machine, and that's much harder to build a case on, and given the abuse the judge gave the Bad Guys in the SJG case, it's probably easy to prevent them from keeping your machine as evidence, or at least get it back. Your paranoia may vary.... Bill

1 0

Re: Scientologys Attempts
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > > who has the authority to remove alt. groups? jamesd writes: > Anybody has the power. Nobody has the authority. More precisely, anybody has the power to send a rmgroup message, just like anybody has the power to send a cancel message. Aside from ettiquette and ethics, the question is whether most of the news servers out there will respond to them, which is a local decision. The last time I ran a news server was in B News days, so your mileage may vary, but responses to newgroup and rmgroup messages can be turned on and off. I used to leave them turned on; not only did new groups appear on my system without manual intervention, but the Great Renaming took care of itself automatically on my box. > [...] This is a classic case of net abuse. Yep. rmgroup wars happen occasionally on the net, usually about alt.joe.newuser.die.die.die and other spam groups run by (or about) people with more spare time than taste. The difference here is that it's part of an organized group-sponsored censorship attempt, rather than an individual squabble, so it retains some degree of classicity. Bill

1 0

On DH public key crypto
by eric＠remailer.net 17 Dec '03

17 Dec '03

Diffie and Hellman did have a public key cipher based on matrices in their original paper; they knew at the time it didn't work. This is not the same algorithm as the D-H key exchange protocol. Eric

1 0

JP vs Homer
by Nathan Zook 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A side note: "The ultimate hacks of Wall Street." Now THERE is an idea... You think Donald Trump could see the usefulness of e*? Ivan Boskey? (sp) To the point: JP's withdrawal, and Homer's thread point to something that I've felt for a while: The classification of our tools as munitions has an important point--they should not be used by children. A.S.R not withstanding, (such a person has had their childhood robbed) what we are doing is _very serious_. Sometimes we talk about pulling down the entire structure of our governments and economy as if it we a Sunday afternoon parlor exercise, or a pipe dream. It is neither. We are on the verge of a restructuring of our society. Cypherpunk projects are the bleeding edge. Implementation calls for serious, considered efforts. Childish behavior is not only uncalled for, it must be anticipated and prevented, or as a minimum, found and fought. I have long been concerned that the remailers are far to vulnerable to either childish abuse or TLA attacks. The former is reaching the stage of threatening to swamp us, either by resource depletion, or by stigmatizing our efforts. There is little, if anything, we can do to stop a chained, PGP'ed mail bomb, "This is mail bomb number XXX. Boom!" It is therefore in our best interest to not encourage children to send such messages in such a way. I believe Homer's message was erroneous for this reason. We do have considerable interest, however, in maintaining a positive image. Positive image is a multifaceted jewel. We must look to preserve it as much as possible while pursuing our goals. We are capable of controlling mail bombs, for instance, in the following way: Take an incoming message, capture From: line. Strip header. MD5 body. Add to sorted table [From: MD5(message) date]. Check for repetition of first two fields. If reps = 1, forward message. If reps = 2, send message to From: "Possible error. Two copies of message <message> received." If reps = 0 mod 5, send letter to postmaster@From:. "Possible mailbomb or spam. <reps> copies of <message> received from <From:> at your site in the past week." Clear table of entries more than a week old every midnight. If all remailers did this, then no matter where the net was entered, the messages would be rejected. And spammers/bombers would be spamming/ bombing their own postmaster. Probably a bad idea. If not all did it, then add special handling to hit remailer-operator@. This would encourage the operator to auto-magically handle the spam-bomb himself. Dealing with huge files and/or TLA's is a topic for another day. Remember: spook(a)cia.gov, snitch(a)fbi.gov, and cracker(a)nsa.gov are probably all listening, maybe even denning(a)aol.com. Is it a stretch to consider that _they_ might spam-bomb us, trying to discourage the best? Finger or request keyserver for PGP 2.6.2 (tm) key. PGP<->Mail/News installation incomplete. Factors for modulous are not proven primes. Key may be far weaker than expected. Encode at your own risk. Key ID: 14712B4D 1994/12/26 Nathan H. Zook <nzook(a)bga.com> Key fingerprint = 44 B3 D8 66 3D 55 1E 2E F8 92 22 A6 33 8C DE 24 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLx3pBHmgMs8UcStNAQGuhAf+KGYJnYRPAODHvjF4CmakZ1oZKDo2BiFQ 5nkphXtoTgADVQM8XlYhqW3MTKhKo30dfZ0/GMLdaZ+4SCM85thqNvLW1klaandk tuAF4NBTx8f5rb3ufm9iktXv907smf6aUZAwz0T4cl630+/dVPI2Jkit0jid5KmD TzB/bFr1lM7Vp2ZoR+Y6/geYYNx06OMvLl62hTpGP2KtusFs1erRuYXj8UJkXd77 JNnTLjrPdLhx6iIQ6IxNXAISnmIgXPGFVRto/EEgFa8XWUoOBeuRdBGhT4eoNAjX 45YxdJrmlSPxHZDu8P2rldfays31qPCY7qJtSKBdRzYqqyz8LT+4YQ== =luXm -----END PGP SIGNATURE-----

1 0

Re: Abuse and Remailer Ethics
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 9:21 PM 01/16/95, Homer Wilson Smith wrote: [snip] > Does any single recipient have the right to demand that they be >blocked from all anon messages. I would say yes. > > How about demanding blocking anon messages only from some >senders? That is harder to implement. If you block the sender, you >block ALL his postings, not just to that party. So you would need to >block specific From: and To: combinations. This would not work with >chaining at all, even if we did share blocking information. So that >is out. > > Does a list owner have the right to demand blocking to his list, >with or without a vote of the list readers? I would say yes. > > What about a newsgroup? I would say it takes a vote. Are anon voites >allowed? Touchy question that was important at one time on >alt.r.scientology. I agree with all of that. Somewhat conditionally with what you say about newsgroups, because while it sounds nice, it would be hard to implement. I'm tempted to say that a newsgroup, by it's nature, doesn't have any mechanism for control/government, once created. And as such, doesn't have any way to "decide" not to accept anonymous posts, or posts from a specific user or remailer. So I'm tempted to say "tough luck" to newsgroups that don't like receiving anonymous posts. The alternative is for people interested to create a moderated newsgroup, where of course the moderator could refuse to allow anonymosu posts with or without the remailer operators cooperation. > Anyhow I would guess that the correct action here is to write the >offender and let him know a complaint has been registered against him. >I would also educate him as to why he was so easily traced and tell >him that if he wants to avoid such in the future to start chaining. Yes, I think that is an excellent course of action. > However if he is a determined abuser not prone to social >embarassment, then the sharing of blocking among remailer operators >might become a very good idea. I'm not so sure about that. It might become neccesary, but blocking remailer delivery to a particular address is a _much_ more desirable solution, in my opinion. If a particular person doesn't want to receive anonymous mail, fine. And it might be good to have a mechanism by which he could make those desires known to all remailers, so he doesn't have to do it individually. But if he does want to receive mail from the remailers, I think he's got to receive all mail from the remailers, and not count on the remailer operators to play Identity Detective and try to screen out people he doesn't like. Same with a listserv and the requests of the listserv operator. A newsgroup is, of course, more touchy, because there really _isn't_ a way for "the newsgroup" to decide not to accept anonymous posts. And I'm not really sure there should be. Part of the answer relies on how "independent" your remailer is. If you _were_ to take no action at all to people who complain about "abuse", would you get in trouble? (from school, company, service provider, country). If you would, then you've got to decide if you are willing to take the heat. And your probably not willing to take the heat for Cantor & Siegel to spam the net. So you've got to do what you've got to do. But, personally, if I ran a remailer on a machine that wasn't subject to political pressure (from school, service provider, whatever), I would never make any effort to cooperate with other operators to track down "offenders", and I'd never exclude any newsgroups from delivery. Because I wouldn't want to play censor and decide what "offense" is worth tracking down, and what isn't. And because even having the _capability_ to track down people is really dangerous, when you get pressure to track down someone you _don't_ want to track down. Much better to say "Can't be done, don't have logs, can't figure out who it was," then to have to admit "well, I've tracked down 5 people in the past month cause someone complained about them." Kind of ruins the point of anon remailers. Best would be to have tracking down be impossible, and it would be close to, if not entirely, impossible if the user took the proper precauations. But even if it's possible, it's probably best not to develop a mechanism to do it.

9 13

Internet, spamming, etc.
by rparratt＠london.micrognosis.com 17 Dec '03

17 Dec '03

> From owner-cypherpunks(a)toad.com Wed Jan 18 17:00:14 1995 > Date: Wed, 18 Jan 1995 07:54:00 -0800 > I also think this is the one great flaw in the design of the Internet; > namely, that the sender has all the control over what packets flow > over the net. A receiver can ask for a slowdown or cessation, but > there's no obligation to do so. This will be, if anything, the > limiting factor in scalability of the internet. In theory, yes. However, almost all Internet protocols are TCP/IP based. The receiver of a TCP connection can choose not to accept the connection, or to drop it at any time. The window protocol keeps the sender from transmitting faster than any part of the connection can manage. (How do you think ftp transfers between sites with disparate connection speeds would work otherwise?) One could theoretically have a package that sprayed UDP packets at a particular IP address, or even have a modified TCP that ignored disconnects. I think most service providers would regard using such code as being on a par with running a program that tried to telnet sequentially to all known IP addresses, trying common passwords on each. -- Richard Parratt

2 1

Known data havens for pirates? Doubtful
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

I forget who wrote: > blame them. Copyrighted data on a server in a jurisdiction that > doesn't acknowledege the copyrights - a prime use for Data Havens > when they come of age. I suppose you _are_ aware that the US has threatened China with punitive duties on $100 BILLION dollars worth of trade, and that China has started holding some show trials (without shutting down its state-owned CD-piracy factories). It's not going to be easy to find a country more willing and able to ignore international copyright law (Berne Convention etc) than China; however, despite howls of protest even China is likely to knuckle down eventually. What may be likely is distributed piracy markets, such as described in Tim's BlackNet spoof. Read my earlier post on what Lance Rose thinks. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

6 5

Remailer-on-a-CD
by xpat＠vm1.spcs.umn.edu 17 Dec '03

17 Dec '03

>The "Linux mavens" followed by the "black box" stuff sparked an idea... >package. To make it as easy as possible, I'd use the UMSDOS filesystem so >that Linux could be installed on a DOS machine without any reformatting >repartitioning, or similar headaches. >distribution already has) and some boot options, you'd have an "instant >remailer" software package, able to transform any 386SX/4MB RAM DOS macine >or better into a Linux-based remailer site, complete with aliases, loggng >So, am I dreaming, or does this sound viable to y'all? OK, let's ponder the minimum hardware necessary, possible minimal configuration (Intel/clone based): (1) Case. (2) Power supply. (3) Motherboard/CPU and 4mb RAM. (4) Hard drive w/ controller. (5) modem card. (5) No monitor, keyboard, floppy, or video card. (a) would require some "umbilical cord" connection to initially set up from another PC. (b) need to operate on "umbilical", direct and uucp modes. I am just thinking out loud here, but the hardware could be damn cheap (sub $500). You can find old 386 boards with 4mb right on the board (no SIMMs) for next to nothing (the decreasing popularity of 30-pin SIMMs makes this a surplus store reality, as nobody wants to bother to strip out the RAM chips anymore). I have also seen an ad by the KILA company in Boulder, CO who advertise some sort of compact pc-on-a-card deal, that might be applicable. Comments? ------------------------------------------------------------------- P M Dierking |

2 1

Re: Factorisation and Discrete Logs (was Re: EE Times on PRZ)
by Hal 17 Dec '03

17 Dec '03

From: dwa(a)mirage.svl.trw.com (Dana Albrecht) > Choose, at random, "a" such that gcd(a,N) = 1. > > Compute x such that: > > a^x = 1 (mod N) [ Discrete log time! ] DH uses prime moduli, I believe. Solving the DL problem sufficiently to break DH may not let you solve it for composite moduli, not without knowing the factors. Hal

1 0