December 2003 - cypherpunks-legacy

Re: negative reputation (was: WRITTEN CODE)
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:53 PM 11/18/95 -0500, a new entity, as yet unnamed wrote: >Logically, a pseudonym is simply a public key. However you may want >to give it a human-readable name so other people may more easily refer >to it. If you decide to do this, I suggest that you do not name the key >on its first post because there is a high probability that you will decide >to disgard the key. If you name it and throw it away, then you have >unnecessarily cluttered up the limited name space. > > - a new entity, as yet unnamed Here's the new entity's key, signed :-) I haven't added it to the PGP key servers; I'll leave that up to you... -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7.1 Comment: PGP available outside U.S.A. at ftp.ox.ac.uk mQCNAzCuftgAAAEEAL35udZ/l0s590SjtzSM9eAepxAGe9Mp38ZoTsvfmNQh008W sLtiYKmSYKBPuuRZIpYBZEjLZry5p6xHUpsKuflNXy7sdeHBviU+x8J57ip4DLx2 +tlv4dtjLKxzVGEqEfWOb3oRHCJ1t2IgV5A9RBzp2SXke56pTo2Fr67QcvwZAAUT tBxhIG5ldyBlbnRpdHksIGFzIHlldCB1bm5hbWVkiQCVAwUQMK61KfnzJsm1fsvF AQGJeAP/c0DO4e1y4SIpLAF9vJwqr6ewFHWopHJRprWUUyBhH+TRehOQLPgocwR/ 7lOILgfizrLshu5W5fOyY+pjBVj6LssF8dILMe81I5LjlDT58NVtkfPDdkHNxFpf fgEmJlKYYfsCrXDlwn0RAFwzLC1x+1okAoixhvLWx7ygr1rpyKA= =PED/ -----END PGP PUBLIC KEY BLOCK----- #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Re: CANADIAN PRESS REPORTS (was Re: CSE gets flak on TV)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here (the real one) ... On Sat, 18 Nov 1995, Perry E. Metzger wrote: > I hope everyone realizes that Detweiler is probably arguing with > himself, three levels deep. I must admit that the levels he stoops to > in order to draw attention to himself are pathetic. Why don't you just > stick to posting as Vlad Nurzi? Its more dignified. Deitweiler certainly is getting around ... but I'm beginning to have my doubts whether it is Deitweiler who is spoofing me. And Deitweiler might be Vlad Nurzi or whoever, but it seems that whoever is spoofing me -- whether it is Detweiler or not -- is privy to certain "facts" ... verifiable facts ... some of which are very worrisome. And its not just whatever news is breaking over the wire. anonymous-remailer(a)shell.portal.com writes: > > > > Here is the TRUE unedited story for the list which Deitweiler felt he > > had to TWIST to the nth degree. His attempt at making mountains out > > of mole hills will not succeed with this one. > > This story truly is a non-starter. Big deal. It really has no > relevance to this international list. This is simply a Canadian matter. I take this last comment back. It was premature. I think that this is in fact very relevant to this list. And it's not just a Canadian matter. My little spoofing-shadow, Mr. Mystery-Writer, seems to not only have a juvenile sense of humour, but seems to have a handle on some pretty sensitive information. His information isn't limited to how Canada was able to outbid the United States on a wheat deal with China, but his information encompassess matters of an order of greater significance, especially when Mr. Mystery-Writer wrote: > And that's the fleshed out version of the story. > > I'm just sorry that our Prime Minister is in such a bad position because > of the timing of this "Jane Shorten's" revelations. She also revealed > that Canada spied on Japan. > > To think ... Canadian Prime Minister Chretien is a guest of the Japanese > people today. Talk about some awkward moments. I mean, what on earth do > you talk about?? > > George Bush and Sushi?? Whoever it was who wrote this, they took a real swipe at a former President of the United States. This is very, very serious. Joking about Japanese / American relations is very black humour and is one thing, but taking an open swipe at a former American President is grossly inappropriate and was completely another, I thought. But, ironically, Mr. Mystery-Writer had incredible foreshadowing skills. > Let's see ... over the last couple of days, we've had one provincial > Premier resign over "BingoGate" -- kickbacks from bingo games, another > premier is under some pretty heavy fire for some insider trading in a > company he promoted in Hong Kong, (actually his wife got stock she never > had to pay for), while Canada in conjunction with the normally very > neutral Swiss have frozen accounts pertaining to about $20 million or so > in kickbacks from Airbus Industries to a "senior Canadian politician". > > And all these stories ... coincidentally ... broke back to back. This to me was the kicker ... especially in light of news which just broke tonight. Mr. Mystery-Writer was trying to throw a clue. And boy, what a clue it was. It wasn't the former President of the United States that he was speaking of ... it was the former Prime Minister of Canada. It was reported today that former Canadian Prime Minister Brian Mulroney has launched a $50 Million pre-emptive lawsuit against the Royal Canadian Mounted Police and the Canadian Department of Justice for their possible future allegation or possible future charge of taking kickbacks from Airbus Industries while the former Prime Minister held public office. This is one heck of a newsflash ... especially considering the co-operation of the normally secretive and discreet authorities in Switzerland. Can you imagine if former President George Bush had in fact launched a $50 Million pre-emptive lawsuit against the Federal Bureau of Investigation and the Department of Justice, because they were investigating him for something?? Or if George Bush tried to stop a news story through libel chill? My shadow was right (even if he did announce before the wires, did), Canadian politicians are beginning to drop like flies. Let the "Jane Shorten" Film-Fest begin. Can you pass the popcorn? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

VB4 secure mail software
by Cybie＠cris.com 17 Dec '03

17 Dec '03

To the guy who was interested in writing a secure mail program that worked with MS Exchange in VB4, e-mail me... I was also thinking of working on something like that, we could probably work together on this.

1 0

Re: (CANADIAN PRESS REPORTS)
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

Detweiler wrote... >On Sat, 18 Nov 1995, jim bell wrote: > >> >anonymous writes: >> >> I still feel such a sense of violation with what LD did, such an >> >> utter sense of helplessness at the character assassination I've >> >> suffered at his hands, >> > >> >So use PGP, sign your messages. Simple solution. >> >> Absolutely! Anybody who uses anonymous remailers to post to public areas, >> and does not use digital signatures to prevent spoofing when it is obviously >> needed, is a fool or worse. > >Most people believe THAT a digital signature is evidence that I am who my >signature _says_ I am when it really doesn't do that at all. It isn't >reliable at all. > >Unfortunately, I've learned the hard way NOT to do that. Digital >signatures don't prevent spoofing. > >In fact, I think that thinking something is secure when it isn't leads >to even more trouble, and could even lead to many tragedies. > >In a nutshell, here's the problem. > WARNING! WARNING! WARNING! BIG "IF" COMING UP! BIG "IF" COMING UP!!! >If someone takes my pgp secret keyring and my password, then they can ^^ >sign a message *digitally* so that people believe the spoofed message is >really from me. In fact, since most people tend to rely on a pgp message >far more than a non-pgp message, most people would be absolutely >convinced that the message was in fact from me. Pardon me, but what was the point of that last comment? It is an obvious statement of fact that yes, IF IF IF somebody had a secret key AND password, he could duplicate a signature. Digital signatures allow a person to exclude others from being able to sign messages as if they are from him. True, a person could simply publish his secret key and password, at which point everyone could sign notes as if they came from him, but that wouldn't be "interesting" because most people would have no reason to do so. >Signing with PGP is just not a solution. It is, apparently, in the vast majority of possible situations. Why would you even try to disagree? Oh, yes, I forgot... you're Detweiler.

1 0

[NOISE] Review: GoldenEye
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just got back from the new Pierce-Brosnan-as-007 flick. It had a few typical "hacker" stereotypes, and a couple of interesting crypto relevant references. * Boris, the stereotypical hacker, was hacking through American banks. A screen had the words "Department of Justice" and the DoJ logo; underneath were the words "Clipper Chip" and a list of banks. * The archvillian's plan involved a massive money transfer and an EMP pulse; he very briefly explained the effects of what would happen if every computer in London were rendered non- functional. Possible crypto-anarchy bits. * Boris should learn the value of strong passphrases. His password for the massive mainframe which will be used in the archvillain's scheme is a five-letter dictionary word, which didn't change (and it was used on two different computers), and he revealed it indirectly (it was a word puzzle). * A few on-computer-screen references to "encryption". * Boris and the mastermind kept bantering about "breaking codes." * Boris' computer in Russia - in his apartment - has a domain ending in ".comp.math.edu"; when his screen lights up with the words "INCOMING EMAIL" he goes into a live chat (complete with graphics). Above-average action/adventure flick. The technical mistakes are forgiveable in the interest of dramatic license. Don't watch it for the techno/crypto bits, though. Watch it because lots of things blow up :) Dave----- David E. Smith, c/o Southeast Missouri State University 1210 Towers South, Cape Girardeau MO USA 63701-4745 +1(314)339-3814, "dsmith(a)midwest.net", PGP ID 0x92732139 http://www.midwest.net/scribers/dsmith/ - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMK1btCoZzwIn1bdtAQFmOgF/ZLYc3sT1L5sQS+wqmS5U6wsx9jL86job Ie6DU65FIuSZF6vFDBDNZFxZxs0HuaR6 =5PGz -----END PGP SIGNATURE-----

2 1

reputations: discussions and meta-discussions
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Sat, 18 Nov 1995, Bill Stewart wrote: > Here's the new entity's key, signed :-) I haven't added it to the > PGP key servers; I'll leave that up to you... As we know, a public key certificate is a binding between the key and some attribute, as asserted by the signer. In this case you have asserted a binding between my key and the string "a new entity, as yet unnamed". I don't understand why you did this. Would you please explain? The only reason I can think of is that you wanted to provide evidence for the key's creation date by timestamping it. If that was the case, I thank you. But in the future, to avoid confusion, perhaps you can create a new ID "timestamp" for the key and sign that instead. ------------- On a different subject, given the likelihood of an increasing number of new identities showing up on this list, I propose that we create a new mailing list (cypherpunks-reputations) devoted to the discussion of reputations of cypherpunks participants. A significant number of posts on cypherpunks are already discussions of this sort. I believe it would be benificial to create a seperate channel for these meta-discussions so they do not interfere with regular cypherpunk topics. By encouraging discussions about reputations of specific entities, we may also gain some insight on the general properties of reputation systems. In this sense by creating this new list we create an interesting self-referential loop -- cypherpunks-reputations contains meta-discussions about cypherpunks, which in turn contains meta-discussions about cypherpunks-reputations. Examples of posts appropriate for this new mailing list would include: * knowledge, intelligence, style and quirks of cypherpunks participants * exchange of keys and certificates * speculation on connections between entities * kill file entry recommendations I do not have the physical resources to serve such a mailing list, so I hope someone who does will volunteer. - keyid D072FC19 (still unnamed) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMK8CnY2Fr67QcvwZAQGUJgP9G8ER/qH8OKvSbOtPYwaDQMkVyKFWafxH Ukbm0lKgCwS97cEKufxJH49VCRkxrd+t+ia5IRNDxewB1xlcjAKRvp4MK8Ps6MTy FbhmEpfhB4pnfE5l+e8VnZSoD79j0Sv6C80C48NL6NJNV6PhhTS9B5lXxW/qJv9D 3ZTpTf5AjZI= =e4DU -----END PGP SIGNATURE-----

1 0

Real-life example of why National ID cards won't work
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- #Date: Fri, 17 Nov 95 16:18:55 PST #From: medic(a)netvision.net.il #To: shomronnews(a)felix.dircon.co.uk #Subject: Update 755 SNS News Service "Interior Ministry Scandal" November 19, 1995..26 Cheshvan 5756..Number 755..Update from Israel ... Following a report released by Yediot Achronot Newspaper, Interior Minister (Labor) Ehud Barak has ordered an immediate investigation into allegations of wrong-doing by senior Ministry officials. The report states that falsified ID cards and other Ministry permits are being sold to Arabs. Among those mentioned in the newspaper story is Chaim Ben-Atar, the Director of the Ministry's East Jerusalem Office, a Member of Knesset, and past members of the Mossad and GSS (Shin Bet). The Yediot report also alleges that Police officials silenced investigations over the past two years (that may have prevented terrorist attacks) for the fear of revealing names of top officials involved in the Ministry false documentation scam. The investigations involved senior officers in the IDF Civil Administration, IDF officers, senior Ministry of the Interior officials and officials in the Jerusalem Municipality. Some of the allegations: 1) In the East Jerusalem Branch of the Ministry of the Interior, Arabs that are not entitled by law may still receive ID cards, travel permits to Jordan, and other official documentation in return for cash payments or "favors". 2) Senior officials in the security service of the State have abused their connections with the east and west Jerusalem Ministry Offices, and have offered permits to travel abroad in return for cash payments. The permits were given to Arabs that would not be able to obtain them legally. 3) Interior Ministry workers have received favors and cash payments from Arab and Jewish agents in return for issuing travel documents, ID cards and passports. 4) Chaim Ben-Atar, the Director of the East Jerusalem Interior Ministry Registration Office has provided five Arab residents of Gaza with ID cards stating they live in East Jerusalem. 5) Ben-Atar also employed an Arab woman during a four-year period whose brother is a "religious fanatic activist in East Jerusalem". The Arab woman who assisted Ben-Atar has access to highly classified information. She was released from her position one year ago for "personal reasons." 6) During an investigation into wrong-doing by the past head of the Allenby Bridge crossing, information pointing to wrong-doing by other senior IDF officers and Jerusalem Municipality workers was uncovered as well. The Ministry chose not to pursue the investigation against them. The cases against them were silenced by Interior Ministry officials. (Yediot Achronot ..11/19..Page 5). ...

1 0

Re: remailer abuse
by Corey Bridges 17 Dec '03

17 Dec '03

At 05:27 PM 11/19/95 -0800, Greg Broiles wrote: >... > If A wants to send >messages to B, but B doesn't want to receive them, should A be forced to >stop sending? My rambling $.02: I haven't thought all this through, but I have an emerging stance. Just this week I've started ploughing through the Cyphernomicon, and was smacked in the face with the eminently pragmatic Mr. May's statement that any law that cannot be enforced should not exist. Up until, say, this week, I'd always been in favor of Caller ID. I'd figured if anyone wants to call me, I have the right to know who it is. By default, I had adopted this position concerning email. Now, one day I will receive an anonymous email. Will I be offended? Maybe. Can I do anything about it? Not likely. Anonymous communication is only going to get easier. Current congressional prattling notwithstanding, the onus of responsibility will have to shift to the recipient. For example, I could configure my mail program to automatically throw away any incoming message with "anonymous" in the "From" header. (Or any message from *(a)pseudo.goldenbear.com, for that matter) If junk mail continues to bother people, it's only a matter of time until mail programs' filtering capabilities become much more sophisticated. (Of course, for all I know, there already ARE programs that do what I'm about to propose.) People can maintain a "do not accept from" list, containing every anonymous remailer they've ever heard about, or an "accept only from" list, containing just the people they wish to converse with. I think it's this second option that will become increasingly important. Sure it's your right to send me whatever the hell you like, just as it's my right to ignore you completely. Bringing this back to my hobby-horse of Caller ID, you end up with even greater protection than an unlisted number--let the whole world know my number--no one'll get through unless I already know him. And then in the brave unregulated future, if you make a new friend, you merely swipe his public-key business card through your PDA, which adds it to your "accept calls and emails from" list. And to take a stab at another pair of Greg's questions, if A is sending messages from his account on X's system to B, and B doesn't want to receive them, should B have the right to make X stop A? No. (Not that I think the law is going to realize that any time soon.) Should X have the right to stop A? Hell yes--it's his system. Let A find a more open-minded ISP if he doesn't like it. Corey Bridges Security Scribe Netscape Communications Corporation 415-528-2978

2 1

ecash as pgp
by sameer 17 Dec '03

17 Dec '03

This is really frustrating. I'm trying to figure out how to use this damn ecash software to setup a prototype ecash-accepting remailer. For one thing, there's no documention. Secondly, from what I can tell, it's like PGP. To integrate it into other software you have to do all sorts of nasty output parsing. why the hell can't it just produce nice, terse, informative, UNIX-like output? it's late, i'm tired, I'm going to sleep. (the party was fun, btw, thanks to everyone who showed up.) -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

3 3

Re: Recompiling PGP262i under microsoft.
by Joe Turner 17 Dec '03

17 Dec '03

For those that might benefit, I have included some notes I have gained through my wanderings through PGPland, towards an easy PGP-mail program for Windows. Below I have included sketchy details in compiling PGP under as an MS-DOS app, WIN16 DLL, and Win32 DLL. I won't be able to provide specific details, until I recover data from my backup tapes (I had a nasty drive failure, and have been lethargic in recovering). I finally get my IBM PC/RT configured for TCP/IP and my PC explodes. :<. If anything here is wrong, or fuzzy, feel free to post corrections, etc., as this is all from my alcohol soaked, nicotine riddled brain. Compiling PGP under MSVC 1.5 & 2.x ========= === ===== ==== === = === To compile PGP under MSVC 1.5 (I believe there is a supplied Microsoft C make file that was written for Quick C) you will need to create a project and add the files necessary. Be sure to include the already compiled RSAREF.LIB in the project files. Unfortunately, there is one very annoying problem with Microsoft Visual C, in which it will regenerate the dependencies from the source code files without preprocessing the #ifdefs. You will have to edit the make file and take out all of the UNIX sys/whatever stuff. I believe this is the biggest hurdle, but you might try using the Quick C make file, although I don't think it will work without modification (Microsoft seems disenchanted with compatibility, even between revisions of their own software). You may also have some trouble with type conversion, but I think its intuitive to overcome that. (its been a while...). If anyone knows of an easier way to do this, I will be more than happy to listen. Compiling RSAREF as a DLL under MSVC ========= ====== == = === ===== ==== This is easy, but you may have trouble with the dependencies again. The most important thing is to create a .DEF file and put all of the export declarations in there. Unless you plan on rewrite PGP to load the DLL dynamically, simply link against it so save a few headaches (remember you still need a .DEF file or you will get unresolved errors!). Compiling PGP as a Windows DLL ========= === == = ======= === I was able to find someone in Australia (sorry, the name eludes me at the moment) who managed to port PGP to a Windows DLL, under Borland C. I only installed Borland C++ 4.0 today, so much of my work/play has been targeted towards Microsoft Visual C++ 1.5/2.0 under NT (besides I was waiting on PGP3.0). If anyone wants these files (for Borland) I will send them out when I recover them (hopefully). It includes modifications to no more than three files, and includes both reentrant and non-reentrant entry points. I also have the mail program (MAPI) that this guy wrote in executable form. He was very careful about the Austrailian equivalent of the ITAR, so he would only send the modified files, which I will pass on for those who are interested. If you want to do the same thing under MSVC, the same changes apply. Hope that help some. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzCXvuAAAAEEALiDFkQgR9leZVf5X0HLPdUFmtfyp3X0nFMi7RjqIsv1pAh9 ZZFVwkBlo01APJcw4ncPrpjGKvu8P7t0a6nB+tIZliGGvmCt/SSVyc44RdTz1KV2 TlsA/NW1WF4yBARK1aCuHgrtwfOhV8hBqh88TlJ/DSMxDXCM1+w0jdWG+cPtAAUR tC9Kb2UgTi4gVHVybmVyIChpbnNlY3VyZSkgPHR1cm5lckB0ZWxlY2hlY2suY29t Pg== =sGFY -----END PGP PUBLIC KEY BLOCK----- -- Joe N. Turner Telecheck International turner(a)telecheck.com 5251 Westheimer, PO BOX 4659, Houston, TX 77210-4659

1 0