December 2003 - cypherpunks-legacy

US calls for measures against Internet porn
by nobody＠tjava.com 17 Dec '03

17 Dec '03

Apologies if you've seen this before: WASHINGTON DC (Reuter) - The US called Sunday for improved management of the Internet to prevent people seeing pornographic material on the world computer network. A joint statement from the Clinton administration's State Council (Cabinet) and the office of the Republican Party's Planning Committee said there were increasing links between domestic computer systems and the Internet. ``Good use of the Internet is of great importance to increase global information exchanges, promote economic construction and develop science,'' the Associated Press quoted the statement as saying. But because of weak management and lack of control over what enters the Internet, some pornographic and other harmful materials have come onto the system, it said. ``We must take effective measures to deal with this,'' it said. German prosecutors said Friday they had launched an investigation into the U.S.-based online service CompuServe Inc on suspicion that members had sent child pornography over its worldwide computer network. The inquiry prompted the service to block access to 200 sexually-explicit Internet discussion groups and sites where pornographic pictures are available. An explosion in use and ownership of modems in the US is giving an increasingly large number of people access to the Internet. [The amazing thing is how _little_ editing was necessary.]

2 1

throwaway
by an201465＠anon.penet.fi 17 Dec '03

17 Dec '03

[from: WEIRDNUZ.410 (News of the Weird, Dec 15, 1995 by Chuck Shepherd)] LEAD STORY * A 62-year-old woman pleaded guilty in Roanoke, Va., in November to stealing about 500 pieces of mail from her neighbors' mailboxes--her third such offense in five years. She had been found sane and competent for trial but nonetheless diagnosed as having an "irresistible impulse" to steal other people's mail. The judge had kept her confined to her home since her arrest, allowing her full freedom only on Sundays, when there is no mail delivery. [Roanoke Times, 11-21-95] --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

first germany, now china
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

BEIJING (AP) _ China is planning measures to stop obscene or harmful material from entering the country via the Internet, its official news agency reported Sunday. The Communist Party and the State Council, China's cabinet, recently ordered such measures after learning that ``pornographic and detrimental information'' had been disseminated electronically in China, the Xinhua News Agency said. The report said China intended to use the Internet to promote the exchange and transfer of technology and scientific information, while at the same time blocking what it sees as negative influences. It did not provide further details.

1 0

Re: Is this as insecure... (really "Fax crypto")
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

Shamir did a talk on fax crypto in May, 1994. There is no reason that this can't be completely secure, the overlays could be one-time pads. Bill Sommerfeld posted a description of the technique to the list after he went to a presentation on the technique, I'll forward it to anybody that needs a copy. Using the same overlay multiple times, though, would make it completely insecure. I can't believe that they are recommending that that could be a possibility. thad -- Thaddeus Beier thad(a)hammerhead.com Technology Development 408) 286-3376 Hammerhead Productions http://www.got.net/~thad

1 0

Re: Australian "calculatorcard"
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: vin(a)shore.net (Vin McLellan) > Could be one of seven or 8 vendors of so-called "challenge/response" tokens or calculators. Most of those sold in the US and Australia use straight DES (and a token-specific key) to encrypt the "random" challenge number in the token -- but it could be any secret-key algorithm. ----------- This is actually something cryptographic which I know a bit about, so I'll tell you what I know. I had a suitemate a bit back who was working for a local high-tech company as a computer programmer. He used a system somewhat like this, but with some interesting permutations. The main difference was that it didn't use one algorithm. It used quite a few, determined by a hashing of the challenge code. There were a considerable number of challenge codes with distinct hash results that were never used. If the card got too many of those (or too many wrong PINs), it switched to an entirely different set of hashings and encryptions, all of which would warn the server (thanks to their turning out something different in a hash function on the server) that the card had been compromised. I suspect it would also wipe a EEPROM that was storing the valid hash function and algorithms, but he wasn't sure about that. It was all sealed in a plastic block to make sure it was physically hard to reverse-engineer, anyway. -Allen

1 0

Re: For the New Year: A Symbol for Information Freedom
by groundfog＠alpha.c2.org 17 Dec '03

17 Dec '03

In talk.politics.crypto, ptupper(a)direct.ca (Peter Tupper) wrote: > A Symbol for Information Freedom > by Peter Tupper <ptupper(a)direct.ca> > 1996 is off to a discouraging start when it comes to the >future of information freedom. The American Congress seems >determined to impose censorship on the Internet. The legal >status of strong dual-key cryptography is still in debate. >Telephone companies, cable TV services and publishing services >are all eagerly trying to seize control of the Internet and >eliminate the many-to-many nature of the medium. The accidental >wonder that is the Internet seems to be threatened on all sides, >in danger of being destroyed or denatured before reaching its >potential. > My proposal is only a small contribution to the solutions to >this problem. I believe a symbol is needed; a simple yet >recognizable item that will communicate to others that you are: > -for freedom of speech and expression in all realms, >particularly via computer mediated communications. > -against the imposition of arbitrary community standards by >centralized authority on communications. > -for making access to communications available to everyone. > -against the violation of individual privacy by wiretapping, >intercepting computer communications, compiling dossiers by >government or commercial organizations or other forms of >surveillance. > -for making strong, dual-key encryption programs without >back-doors available to the public. > -against building surveillance measures into communications >and financial infrastructures. > -for a future of communications that is by, for and of the >people, not the state or the market. > The symbol I have chosen is the paper clip. Why a paper >clip? > There are many reasons: > Pragmatic: Paper clips are readily available for >practically nothing, all over the world. They can be applied to >collars, lapels, scarves, pocket edges, suspenders and neck ties >without damaging them and without risk of the pin breaking the >skin. > Aesthetic: The paper clip is a simple, elegant design that >is easily recognized the world over. It can be rendered in many >colors or plated with precious metals. > Symbolic: The paper clip is a simple but effective piece of >technology. An individual uses it to bundle together documents >from disparate sources to create a unified document upon a given >subject, which may be dismantled and remade for another topic. >Furthermore, a paper clip may be bent out of its regular shape >and used as an improvised tool for any number of purposes. > Historic: During the German occupation of Norway in World >War II, Norwegians wore paper clips on their collars as a sign of >solidarity against the invaders. > Commercial: While anybody can obtain a plain paper clip >with little trouble, funds for Information Freedom can be raised >by marketing electroplated or designer paper clips. > The cause of awareness of and activism about AIDS had a >simple, readily recognized symbol, the folded red ribbon. Just >as every celebrity who wears a red ribbon, no matter how trite >and self-promoting it is, is a reminder to those watching that >AIDS is happening and that many people are concerned, >celebrities appearing at the Academy Awards or Grammies with a >designer, gold-plated paper clip on their outfit reminds the >world that information freedom is under fire and that people are >concerned. It will make the Internet community a visible reality >in the public sphere. It will bring these issues into the public >eyes, and give those involved a rallying symbol. It will make a >small difference, but it will contribute to the greater good. > Advertising couldn't hurt.

3 2

Ah, the future...
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, 12 31 95 Associated Press reports: Ah, the future ... At least part of what will happen in the coming year seems clear. Cyberspace will be regulated -- kicking and screaming -- and the court battles over free speech will begin. "It's going to throw the Internet into a state of uncertainty for several years," said [Bob] Smith [of Interactive Services Association]. You may recall the question I asked in an earlier message: And when the State DECIDES...? But that's all right... Despite that, business growth on the net will begin to catch up with the phenomenal increase in accounts. Cordially, Jim NOTE. The newsstory's headline? YEAR OF THE INTERNET: What a tangled web we weave. Its dateline? (Dec 31, 1995 - 00:23 EST). Accessed at? Nando News (www.nando.net) Online filename? info306_3.html That message? Date: Wed, 22 Nov 1995 04:16:50 -0500 (EST) From: "James M. Cobb" <jcobb(a)ahcbsd1.ovnet.com> To: cypherpunks(a)toad.com Subject: Secrets of the Internet This critical essay, "Ah, the future..." was composed 12 31 95.

1 0

Re: Australian "calculatorcard"
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- From: David Lesher \ Internet: (wb8foz(a)nrk.com) To: amp \ Internet: (alan.pugh(a)internetmci.com) cc: Cees de Groot \ Internet: (c.degroot(a)inter.nl.net) cc: cypherpunks \ Internet: (cypherpunks(a)toad.com) Subject: Re: Australian "calculatorcard" > sounds like the card i use for remote dialup to certain non-public > systems i use at work. it has a six digit number on the front that > changes every 60 seconds. DS> Do these card systems use a window to handle clock-slip? i'm not sure. i would image so. DS> I'd think you could have the server safely accept # N, N-60 sec, and DS> N+60 seconds; and adjust the server's idea of your card's clock speed DS> from that. DS> What new risk would that create? i would figure the server would give a minute or so for slippage. basically the risk is that it would give someone 3 minutes to do a brute force attack rather than one. if you have decent security on the server side, i.e., disallow the card for 5 minutes or more after 3 or so failed attempts, brute attacks would be minimized. however, if the actual window for a single code is 3 minutes, that increases your chance of hitting it as 3 separate numbers would be valid for a given card at any given time. amp <0003701548(a)mcimail.com> (since 10/31/88) <alan.pugh(a)internetmci.com> PGP Key = 57957C9D PGP FP = FA 02 84 7D 82 57 78 E4 E2 1C 7B 88 62 A6 F9 F7 December 31, 1995 21:59

2 1

Re: Australian "calculatorcard"
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- From: Vin McLellan \ Internet: (vin(a)shore.net) > it's Pretty Good >(tm) security, but like anything not biometric, it is vulnerable to >black-bag attacks. physical possession being all that is required. VM> Actually, all ACE/Server or ACE software modules _require_ a VM> user-memorized PIN. Physical possession of a stolen token is not VM> enough to gain illicit access. >if >you know the algorithm and the serial number of the card and the >time, even that isn't necessary. VM> Bleep! Earth to amp! Check your voltage, lately? The token's VM> serial number has nothing whatsoever to do with the generation of a VM> SecurID's PRN token-code. hmmmm, let me see... yup. you are right. voltage low. give me a second to plug back in... VM> and distribution. The serial number stuck to the back of a SecurID VM> after it is programmed with its secret key -- a unique PRN VM> "significantly longer" than 56 bits -- but they are not the same VM> thing. The cpu in a SecurID doesn't even "know" the serial number VM> stuck on the back of the token. VM> (It would be Pretty Stupid <TM> to glue or emboss a secret on VM> the back of the damn token, wouldn't it?) I should note that Alan is VM> just regergitating one of the most widely circulated rumors about VM> SecurIDs -- which like any popular crypto device attracts a lot of VM> wiLd & w00ly speculation. actually, i was speaking pretty much off the top of my head. it's been a while since i registered it, but all i basically had to tell the server the first time i used it was the s/n. and yes, i think it would be Pretty Damn Stupid to have the s/n have anything to do with the actual seed or pin. VM> Getting the algorithm for SDI's one-way hash is no big deal, VM> given that it sits in software in thousands of SDI customer VM> installations, protected only by contract and trade secret status. VM> (The integrity of the product -- the unpredictability of the VM> token-code PRN series, and the secrecy of a specific token's seed or VM> key -- rightly depends cryptographic strength of the hash, not the VM> secrecy of the algorithm.) Getting a token-specific secret key would VM> hopefully be a much greater challenge. one would certainly hope so. <g> personally, i like the card. it offers pretty good security and thus gives me remote access to systems my employer would otherwise laugh in my face for access to (and did, more than once before we got these things). its main weakness would be a black bag job where someone gains physical posession. at that point, all bets on its securty are off for obvious reasons. luckily, because of the nature of the device, i can simply report it as stolen and it quickly becomes a rather worthless piece of silicon. amp <0003701548(a)mcimail.com> (since 10/31/88) <alan.pugh(a)internetmci.com> PGP Key = 57957C9D PGP FP = FA 02 84 7D 82 57 78 E4 E2 1C 7B 88 62 A6 F9 F7 December 31, 1995 22:15

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33a.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub ek"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash latent ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp. hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)valhalla.phoenix.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut"; $remailer{"shinobi"} = "<remailer(a)shinobi.alias.net> cpunk mix hash latent cut ek reord"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ek ksub"; $remailer{"gondolin"} = "<mix(a)remail.gondolin.org> cpunk mix pgp hash latent cut ek reord"; $remailer{"tjava"} = "<remailer(a)tjava.com> cpunk mix pgp hash latent cut"; $remailer{"pamphlet"} = "<pamphlet(a)idiom.com> cpunk pgp hash latent cut"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'gondonym'} = '<alias(a)nym.gondolin.org> alpha pgp'; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 robo hroller alpha) (gondolin gondonym) (flame hacktic replay) (alumni portal) (vishnu spook wmono) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: all of the "ek" tags have been verified correct. Apologies to those who were inconvenienced by incorrect "ek" tags in the past. Last update: Mon 1 Jan 96 6:49:52 PST remailer email address history latency uptime ----------------------------------------------------------------------- c2 remail(a)c2.org +.-+++-.-*** 47:18 99.99% hacktic remailer(a)utopia.hacktic.nl *****+****** 8:12 99.99% bsu-cs nowhere(a)bsu-cs.bsu.edu #*#+#+##++*# 3:50 99.98% replay remailer(a)replay.com *****+**+*** 6:58 99.98% pamphlet pamphlet(a)idiom.com +--++* 1:32:43 99.97% ford remailer(a)bi-node.zerberus.de -+-++-+--+++ 2:16:40 99.97% hroller hroller(a)c2.org #.-##+-.-#*# 23:11 99.94% flame remailer(a)flame.alias.net +.-----+-++ 2:35:44 99.93% spook remailer(a)valhalla.phoenix.net *.--+-.--.-+ 4:33:40 99.88% amnesia amnesia(a)chardos.connix.com -++--------- 3:31:08 99.85% rmadillo remailer(a)armadillo.com +++++++ #### 15:42 99.81% mix mixmaster(a)remail.obscura.com __.------+- 6:43:02 99.77% extropia remail(a)extropia.wimsey.com --.-------- 5:40:08 99.69% wmono wmono(a)valhalla.phoenix.net * **+ *** * 13:04 98.86% penet anon(a)anon.penet.fi --- *+++++++ 3:07:11 98.86% alumni hal(a)alumni.caltech.edu +###*++*-- # 31:22 98.14% vishnu mixmaster(a)vishnu.alias.net ----- - -* 1:22:32 98.12% portal hfinney(a)shell.portal.com #####+##- # 26:19 97.36% shinobi remailer(a)shinobi.alias.net -+++++++++ 1:33:37 90.69% rahul homer(a)rahul.net -+##*+*+#### 5:20 99.99% tjava remailer(a)tjava.com #+#*#*# :40 89.19% ecafe cpunk(a)remail.ecafe.org -#___.## 16:32:15 67.10% gondolin mix(a)remail.gondolin.org -*+..* 15:03:39 46.77% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0