December 2003 - cypherpunks-legacy

Anonymous WWW proxies
by Laurent Demailly 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm halfway in the coding of a simple anonymous WWW proxy, but before going any furter, I'd like to know: + If this has not been done before and is available ? (and where) + If there is any interest + Chaining would be a imo good idea (ie cli <-> anonproxy1 <-> anonproxy2 <-> ... <-> server) but how would you manage to tell your favorite web browser to add in its header something like Http-Proxy-List: anonproxy2, ... An alternative would be to have a database of avaibale (running) proxies and that the proxy itself randomly choose a next route ? + A way to solve previous pb and to add in encryption (but would it be fast enough for web browsing ?) would be that each user runs a local proxy (that could be optionnaly used by other folks) that would do pgp encryption/decryption, 'routing' selection,etc... Would ppl with mail remailers and/or W3 experience comment ? (or tell me the pointer toward the already solved, already implemented beast that would do the above) - -- Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|... Freedom Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAgUBMFtiGXk52/beodHxAQETVgP/avWKpD/AUiRPM0ljX0BH0e7q10KYEOdA Hu+/Bsr7PWANdfhefs/ASrJn/kiOIQwo+RGV1K3UKWu7IyYdHHrINZkp0OcFlIR5 8TIfW6/FqBaUwAzuCV0/acUhXW6ah7xpPkgiHJ04Nlu8BKh72QGawJLJDoT2JmIi o67LVdD5ajg= =/kSM -----END PGP SIGNATURE-----

4 6

Re: Mixmaster Licensing Offer Explained
by tcmay＠got.net 17 Dec '03

17 Dec '03

(I've trimmed the mailing lists I'm not on...) At 8:01 AM 9/17/95, Lance Cottrell wrote: > Permission is granted to distribute this document in any media for any >purpose as long as the entire document is distributed with the attached >digital signature intact, or the document is clearly marked as having been >modified with the locations of deleted text indicated. So sue me. :-} (That is, I'll treat this article in the normal way, trimming sections I'm not responding to and making note of elisions only where I think it important to.) ... >The company offering to license Mixmaster is Phoenix DataNet, a Houston >area ISP. John Perry, a person well known to this list and the remailer >community in general, is a Senior Systems Administrator at Phoenix. > >On Thursday I received a call from John. Some others at Phoenix had just >noticed a Mixmaster remailer he had been running on one of their machines. >Phoenix has several large corporate customers who need secure transactions >for some special applications. The core engine of Mixmaster is well suited >to that purpose. They offered to license the code from me to use as the >framework on which to build these other programs. In the process they will >rewrite many basic functions in Mixmaster that need major overhaul (e.g., >key management). We will incorporate those improvements back into >Mixmaster. This should lead to porting Mixmaster to several other >platforms, and to fixing most of my worst coding atrocities. First, I think it generally a Good Thing that remailer software gets commercialized and cleaned-up, or that at least commercial packages exist. (I'm not going to get into commercial vs. non-commercial and Microsoft vs. Gnu issues.) If Lance makes a bunch of money off this, more power to him. However, this commercialization raises some interesting issues. Others have dealt with various concerns about the code integrity, about features added, and even about TLA access. I'll address some liability and legal issues. * Will Phoenix DataNet be making the mix software available for purchase, or are they funding _internal development_? (That is, mixes for their corporate clients, which raises some interesting issues in and of itself, as discussed below.) * If Phoenix is planning to resell Mixmaster, or whatever they call it (as "Mixmaster" may remain a trademark of the appliance company which originated the name), what will be their liability for the various abuses which are likely to occur? None of the existing remailers/mixes has had "corporate" backing, and the "deep pockets" corporations are often presumed to have, so lawsuits have not gone after corporations. * On the other hand, if Phoenix is primarily aiming at internal use, for specified corporate customers, how will they stop others from using the service? If chaining is used, and absent any special "untraceable postage tokens" they might issue (as one way to control access), how will the Nth mix in a chain of M mixes "know" whether an incoming message can be remailed or not? (Schemes to sign the packets obviously flunk the anonymity test.) There are many other interesting issues which crop up when Giant Corporation begins to deploy and use remailers. What if, for example, the Justice Department claims that Phoenix and its customers are using remailers for price fixing and collusion? (Just to be clear on this, I personally have no problems with such collusion....but the Antitrust people see things differently.) (To be sure, telephones can and of course have been used to collude. Partly, wiretaps help here (until voice encryption happens...). But Justice has gone after airline reservation computer systems which they believe were used to "signal" price information. Imagine how overjoyed they'll be to see Phoenix DataNet deploy their system!) Again, don't confuse my arguing points here with any kind of advocacy of the Justice Department/Antitrust Division position. I'm only trying to think out what some of the legal issues will be that face the first U.S.-domiciled company to actually start selling remailers or to set up a remailer network for customers. Interesting times ahead. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: "Hackers"-- brief review and anecdote...
by blancw＠accessone.com 17 Dec '03

17 Dec '03

From: Ray Arachelian And that's where we, the cypherpunks come in, by advocating strong cryptographic protocols and tools, we can keep every machine safe from intrusion; it's not just Uncle Sam's evil minions that should have total privacy; normal citizens need privacy too - the spooks shouldn't be the only ones with it. :-) This message has been brought to you by the Cypherpunks. Use only Cypherpunks brand software ;-D ................................................ Cypherpunk crypto in every computer in every home. <g> .. Blanc

1 0

Intellectual Property and Crypto collision
by John Gilmore 17 Dec '03

17 Dec '03

> ELECTRONIC MEDIA PROTECTED UNDER COPYRIGHT LAW > A presidential task force has recommended that electronic transmission of > books, magazine articles and software should be classified as copies > subject to existing copyright laws. The task force also recommended that > it should be illegal to make or distribute products aimed at decoding > encrypted software without the consent of the copyright owner. Would this make it illegal to produce tools for decrypting key-escrowed software? :-) John

1 0

cypherpunks as a newsgroup
by shields＠tembel.org 17 Dec '03

17 Dec '03

PGP message

1 0

Re: Commercial Mixmaster
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Adam Shostack writes: > Its worth noting that the source code to Julf's Penet remailer > is not public (AFAIK). People use it becuase they trust Julf, or > trust people who trust Julf. People don't use Julf's source code. People use the services provided by Julf's remailer, which runs Julf's source. Trusting anon.penet is relatively simple (conceptually) because the author, distributor, and user of the remailer code (where user = remailer operatror) are all the same person. I would be less likely to trust Julf if I thought he was running software he received (through unknown distribution channels, from an unknown author) as an executable without source. I trust Julf because (a) he seems to be a decent/trustworthy person, and (b) because I think he has enough information available to him to be sure that his system doesn't have intentional back doors nor glaring unintentional ones. If only one of (a) and (b) were true, I'd trust anon.penet.fi a lot less. I've seen messages from people who refuse to use ViaCrypt PGP because they can't see the source. I own a copy because I don't want to worry about licensing when I use it in a commercial context and because I don't think Phil would have been associated with it if the binaries distributed weren't free of known weaknesses different from those document with the freeware PGP or otherwise discloses. My inclination is to feel the same way about distributions of Mixmaster. If Lance is willing to sign the code which is shipped, my hunch is that there's nothing tricky going on. If Lance disappears, and the purchaser turns out to be unknown, I dunno if I'd run it before someone trusted had disassembled it (or someone liberated the source code) and it was inspected and found to be clean. [I think it's useful to continue beating the almost-dead horse of the marketing of Mixmaster because I suspect that the anonymous purchaser of Mixmaster subscribes to the list, and is thereby aware of what potential remailer operators and remailer users are going to like, and not like.] > Why pay for remailers when there are free ones? Speed and > lawyers pop right up as damn good answers. Putting up a couple of > p120s on a T1 in the Carribean isn't cheap, nor is making sure you > have a good lawyer who'll protect the machines when the bad guys show > up with warrants. I'd be much happier to use a fast system on good > legal ground than a freebie. It's safer still to use a system which doesn't keep logs and has otherwise taken steps to minimize inadvertent data leakage. (Imagine me mentioning here all of the by now tiresome ideas about thermite, degaussers, low-level-formats of the HD, etc, etc. Please, please, let's not start that thread again for at least 6 months.) I'm not sure that there are any special lawyer tricks to stop the execution of a search/seizure warrant. An attorney may help you keep items found out of court later. I suppose it'd be possible, if the cops were cooperative and the attorney immediately available and the magistrage/judge who signed the warrant was immediately available to try to stop the execution of the warrant, but that seems pretty far-fetched. I've been reading a lot of search & seizure cases lately for work and haven't seen anything like this mentioned, ever. If anyone's got a cite for "how to stop a warrant search & seizure in progress", please pass it along. I'm sure my boss (and his clients) would be interested. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFuuJn3YhjZY3fMNAQGsRAP+PIm6ZsjfCFetFr0//LPUuBg+tiK9b8Dh 4WXji1ab6kCfB+SCbNhU7IDNCR7pK7c1rWjVL+r0gbded46Um6+mn5hDKagKhztD nqld1vTETJFX9TmsRe3mXBE/TW1pqysoiS3PnM4mZ8b0GjErOdSbNpxOizvBOdhi jLoNKnEGnpA= =3dgI -----END PGP SIGNATURE-----

2 1

Re: CYPHERPUNK considered harmful
by Bill Stewart 17 Dec '03

17 Dec '03

>I haven't seen anyone advocating the "watering down" of any so-called >"teachings" to "hide" any "true potential". The only thing that people >have mentioned is that some of the less clueful out there have a knee >jerk response to the name "cypherpunk". That's all. At least early on, back when we were getting our 15 kilobytes of fame on the front covers of WiReD and the NYT magazine section, the name appeared to be useful for getting attention; Tim and Eric were getting occasional quotes in the mundane press, as was John Gilmore who has had longer-term relationships with some of the press through his other activities. Maybe the NYT isn't the paragon of respectability that it once was..... #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: Commercial Mixmaster
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:34 PM 9/17/95, hallam(a)w3.org wrote: >I seem to remember that Julf took over Stephie's code from Wizvax which >used to >post into the alt.sex.bondage group. I suspect he has modified it since but I >don't think that there is much to it. Actually, it was the code of Karl Kleinpaste that Julf took over...I seem to recall Julf saying this in an article. In any case, this is what Karl claimed last year: "There are 3 sites out there which have my software: anon.penet.fi, tygra, and uiuc.edu. I have philosophical disagreement with the "universal reach" policy of anon.penet.fi (whose code is now a long-detached strain from the original software I gave Julf -- indeed, by now it may be a complete rewrite, I simply don't know); ....Very bluntly, having tried to run anon servers twice, and having had both go down due to actual legal difficulties, I don't trust people with them any more." [Karl_Kleinpaste(a)cs.cmu.edu, alt.privacy.anon-server, 1994-08-29] >How does the cypherpunks remailer work? Does PGP encrypt the signature of a >message so that the identity of the sender is unknown? Or is it simply PEM >style >encryption so that the DN of the sender is in the clear :-( Assuming this is a serious question and not a troll, cypherpunks remailers (at least the ones I have used) completely encapsulate a message. No stuff "dangles outside" the remailed part. When PGP encryption is used, nothing is outside the block. If Alice sends something to Bob's Remailer, Bob decrypts the message and may or may not find further encrypted blocks inside. Envelopes within envelopes. I can't imagine it being done any other way. (I'm not counting the remailers possibly signing the sent messages, as a way of protecting against tampering, but this reveals nothing about the senders.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: WAS_tem (fwd)
by keelings＠wu1.wl.aecl.ca 17 Dec '03

17 Dec '03

Incoming from Rev. Ben: > > On Thu, 14 Sep 1995, James A. Donald wrote: > > > If you draw a picture using paintbrush of an underage person engaging > > in sexual conduct, you are in violation of this proposed legislation. > > Doesn't that directly contradict the stated purpose of existing child [snip] > > Do the lawyers on the list want to pipe up? On cypherpunks?!? Whatever for? I imagine there's already a rousing discussion going on about this somewhere in AOL. Take it there. -- "Remember, obsolescence (Win95) isn't an accident; it's an art form!" keelings(a)wu1.wl.aecl.ca s. keeling, aecl - whiteshell labs

2 1

"Attachments"
by tcmay＠got.net 17 Dec '03

17 Dec '03

Why do people keep sending "attachments"? This was just a text article, and not an application (program), so why was it included as an "attachment"? At 8:27 PM 9/17/95, Michael Shields wrote: >Attachment converted: Macintosh HD:cypherpunks as a newsgroup (????/----) >(00005C4E) The message was, as Microsoft Word 6.0 saw it: -----BEGIN PGP SIGNED MESSAGE----- The general opinion seems to be that the netnews format is very convenient, though we should keep the list; but that entering Usenet or Altnet would lower the S/N. Why not, then, start a new hierarchy? Why not gate cypherpunks not to alt.cypherpunks or comp.security.cypherpunks, but to crypto.cypherpunks? We could feed it freely between us and set up NNTP servers which are open for just crypto.*. c.c would be the only crypto.* group for now, but it would also be easy to add more -- say, for the "respectable" splinter group, or for protocol WGs. We'd get the convenience of netnews without the high profile. I'm willing to run the gateway on news.tembel.org and feed other sites, if people think crypto.cypherpunks is a good idea. Opinions? - -- Shields. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFyEm+yjYMb1RsVfAQF1YQQAneg8c6yUKJUUybqepl52yqyS53OGrpLq YfdrMYaIxMWdWKNpMAAus/g8WjWMwYrrB4p+8/WLMm4HsUEHO2ouNzbraiyMRwaB NEhf0v/91h9jGniZIX5uQyqSdM/VC5YupWV0cITqKte9iLZR77C5hVqXBiLhRcwG YL8GwDP5tYw= =roIF -----END PGP SIGNATURE----- ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2