December 2003 - cypherpunks-legacy

RE: The Crisis with Remailers
by blanc 17 Dec '03

17 Dec '03

From: Bruce Baugh >hence my comments from here from time to time that the technological >problems of anonymity are not the true obstacle to widespread use. >there are deeper problems that cpunks skirt around but fail to grasp >because of numerous prejudices. While I hate to lend support to anyone as much a twit as Vulis is, he's got a point here. I don't think most cypherpunks realize how anonymity is perceived out in the net at large. ...................................................................... Bruce: Vulis is not the twit who wrote that paragraph. Vulis is not Vlad. Vulis: "Vlad" is not Vlad. You all need to go out to LD's web site and refresh your memory. .. Blanc

2 1

DataHaven Backup and Offshore Email
by Vincent Cate 17 Dec '03

17 Dec '03

Offshore Information Services announces accounts for datahaven backup purposes. For $168/year you can have 10 MB of disk in a datahaven country to use for backup of important information. Also, we have POP email accounts for $168/year. For full details of our services check out: http://online.offshore.com.ai/services.html -- Vince

1 0

Re: Rumor: DSS Broken?
by Robert Hettinga 17 Dec '03

17 Dec '03

At 9:41 PM -0400 5/18/96, Bill Stewart wrote: > MD5 is at least weakened, maybe broken; there's an abstract by Hans Dobbertin > that says something about generating collisions, and gives an example > (though the abstract doesn't say how general the method is.) That's what I get for not reading the DSS stuff when it came out. I'd heard lots about the MD5 stuff, but I didn't put the two together. It also looks like I'm behind in my reading. Time to buy another edition of Applied Cryptography... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: crosspost re remailers
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 15:43 1996-05-18 -0700, Bill Frantz wrote: >At 7:07 AM 5/18/96 +0200, Benjamin Brochet wrote: >>WHO IS THE MODERATOR OF THIS LIST ? >> >>I've been victim of a spoofing from a german.... he suscribed me to 2200 >>mailing list... also I'd to be unsuscribed from your list ! >> > >There is no moderator. I am just a subscriber like yourself (except I >asked for it.) Did you get a welcome message which included information >like the following? If he was indeed subscribed to 2200 mailing lists, you can assume that he didn't read all the "welcome messages." For people who are stuck with old fashioned mail systems (no filters, no macro language) this is a serious problem. It would be rude to call the victims clueless and subscribe them to even more "clueless mailing lists." Matts

1 0

Re: The Crisis with Remailers
by Bruce Baugh 17 Dec '03

17 Dec '03

At 01:06 PM 5/18/96 -0700, Dimitri Vulis wrote: >hence my comments from here from time to time that the technological >problems of anonymity are not the true obstacle to widespread use. >there are deeper problems that cpunks skirt around but fail to grasp >because of numerous prejudices. While I hate to lend support to anyone as much a twit as Vulis is, he's got a point here. I don't think most cypherpunks realize how anonymity is perceived out in the net at large. Take news.groups, a fairly important group I happen to read regularly. With the exception of Rich Graves' presence, _all_ the uses I see there are for cowardly abuse in a way that lets the poster escape having to answer for his views. I'm not talking about presenting important information where wrong-headed authorities could engage in reprisals, either, but baseless accusations of theft, child abuse, and just plain torrents of obscenity. That's _all_ it's used for (again, with the exception of Rich). There's a problem here. It's one thing to say that the benefits of anonymity outweigh the problems. I'm inclined to that view myself. But it's much harder to defend that view in a forum where anonymity is used so commonly for problematic ends, and to offer anything in the way of constructive solutions. It would be pleasing to see more cypherpunks actively dealing with these problems out there in net.land. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

2 1

News from Burma
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ASIA 'Excommunication' An anglo-Burmese businessman friendly with pro-democracy leader Aung San Suu Kyi has been sentenced to thre years in jail for owning unauthorized telephones and fax machines. James Leander Nichols, also known as Leo Nicholas, was punished for having two fax machines and a telephone switchboard with nine lines in his home, a spokesman for Suu Kyi's political party said. In an effort to discourage contact between Burmese citizens and the outside world, Burma's military government requires people to get permission to own a fax machine, satellite dish, or sophisticated phone system. News Services The Atlanta Constitution/The Atlanta Journal Alec -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZ9ArCKJGkNBIH7lAQFrrAQAw7g/OeEU0IbK+4haxL4r7CWez9R1MqH6 W0Zq1l59XlRDkCCPj34HqrXGchg1Wnnw6LMK7B41JMRl68jvkVLmLnZ9FHwehZ9V R2WzRM+VzHwcpxQ4Fha1pwdq4Lm5naeS+3FiTQDcbTATT7hpBSiLOXhMNSlxFcBP G2KtNA2iZAM= =g8jc -----END PGP SIGNATURE-----

1 0

Re: Interactive Week exclusive - White House to launch "Clipper III"
by rodger＠interramp.com 17 Dec '03

17 Dec '03

On 5/18, Tim May wrote: >A question for Will Rodger: Is this "White Paper" ("The newest proposal is >contained in a 24-page White Paper, a draft of which hit Capitol Hill >earlier this week") related in any way to the one being prepared by Herb >Lin and a bunch of other folks? It was due out about this time, and the >topic seems similar. A bunch of us gave input to Herb and his panel at the >CFP in '95...if this is the same White Paper, looks like we might just as >well have saved our breath. Don't know. This did have full input from security agencies, however. >I read the stuff at the URL, and at first blush it looks to say nothing >about _domestic_ (within the U.S. and Canada) encryption. I'll be anxious >to see what the White Paper says about domestic encryption. > No restrictions domestically nor in Canada. Even so, these CAs and the policy body above it clearly give the govt. more of a role in controlling crypto. >However, as with other proposed crypto laws and "trial balloons," there are >several questions which arise: > >1. Will there be pressures put on the browser companies (Netscape, >Microsoft, etc.) and the e-mail companies (Qualcomm, Microsoft, Claris, >Lotus, etc.) to produce a "world version" that meets export standards with >a single shrink-wrapped package? > >(Recall that last fall some of the various companies stated as their goal >having a single package that could be shipped worldwide. Some of them >claimed having two versions, a domestic U.S. version and an international >version, was too onerous. I am skeptical of this, given that they have >multiple platforms to support, multiple operating systems, etc. But they >claim it is.) > >2. Interoperability. How will U.S. users exchange messages with >international users? Will a U.S. user have to register with the Authorities >to get the proper credentials, protocols, etc.? No indications they would. Idea is each authority could talk to the other and request escrowed keys or info. a la interpol. Of course, as today, there's no guarantee that agreements will always be in place, nor honored. > >3. With products like PGP, there are already international users (lots of >them). Thus, no "export laws" are involved. So, will I be able to >communicate with them using my existing PGP methods? Under the White Paper, yes. > >And if U.S. users can continue to interoperate with international users as >they are now doing, this puts the lie to claims about how key escrow will >be useful for law enforcement. Which makes it look a lot like the old proposal. > >4. And of course there is always the issue of _superencryption_. How a >GAKked program can detect that superencryption is being used has never been >adequately explained (to my satisfaction at least). Entropy measures won't >do it, and forbidding any encryption of messages already containing "BEGIN >PGP" will clearly just be a klugey bandaid. > >5. What about U.S.-based corporations with offshore offices? Is a company >supposed to replace its entire intranet corporate network with a GAKked >system if even a single user is outside the U.S.-Canada? If it's legal now, the paper suggests it should be legal in the future. > >6. What about U.S. persons travelling abroad? > >7. What about packets zinging around the world? Lots of complications if >GAK is insisted upon. And lots of new avenues for "packet laundering." > >8. The issue of why other countries would insist that their citizens GAK >their keys when U.S. citizens don't have to!! >("Yes, Herr Glomlutz, we are insisting that all Germans using Netscape 4.0 >must deposit their keys mit der Key Authority. No, we are not requiring our >own citizens to do this." I don't think this will fly too well.) > >I can't see how other countries will go along with this. The Paper is quite unclear on this, as well. Presumabyt other countries will have equally spiffy stuff they will require be escrowed for export under COCOM. ALl of this, of course, assumes cooperation from OECD, et al. > >And what about the usual problem of "rogue nations" like Iraq, Iran, North >Korea, Israel, and Liberia? Same as before. > >9. Many other issues. (They never answered the similar questions raised the >last time, so I doubt they will this time.) > > >Clipper III, if it turns out to be another worthless proposal which is >laughed out of Washington, will be no real threat. If Clipper III actually >outlaws or places limits on domestic use of crypto (as I think it must, >else it can be too easily circumvented completely), then it will be a >rallying cry which will likely see our membership increase still further, >the anti-Washington rhetoric escalate, and likely some new developments in >the war. Stay tuned.... Will Rodger Washington Bureau Chief Interactive Week.

1 0

(Fwd) Mail Delivery Failure.
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 15 May 96 at 19:01, Mark M. wrote: > > . What if a company does not pay as expected - > > A company could not afford to have such a loss of reputation. > Nobody is going to work for a company that doesn't pay its > employees. Yes, but anonymity would prevent the easy build-up of reputation too: If Joe Anon9876 say: "company ANON1234 Inc screwed me, how peoples will know that it is not a unscrupulous competitor trying to damage their reputation? Now, if Joe Anon9876 decides to disclose to the public that his real name is John Doe to give more weight to his denounciation, and depending on wether or not his bosses *are* or are not crooks, he might very well get some sort of "prediction" on his head. Now, Jim Bell's servers don't have to be completely public. Suppose some servers were built so that the donation address would be known but the list of donation would be kept secret: Such server could thrive. Most "donation" here would not be 2 bucks but rather 20,000 bucks to ensure that the contract would get taken up promptly. And since the targets would not be published, there would be not even a hint that company ANON1234 *might* have put a contract on John Doe (Now, aka Joe Anon9876) . The fact that an open AP server exists makes the later possibility also possible. To have access to the target list would require to be member of a *very* close circle, or maybe, actually, just en employee of ANON_KILLERS4567_Inc. Reputation is standing on the fact that an entity disclose it's existence, accepts to act in full view of significant others, and is prepared to show evidence of good conduct to said significant others. And also on the fact that a challenger to the reputation have to put his own on the opposite platter of the balance. Anonymity makes it hard to do. JFA DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal JFA Technologies, R&D consultants; physists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

3 2

Instant Remailers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:38 AM 5/19/96, Mark M. wrote: >It is possible for someone to operate an anonymous remailer anonymously. >Just get a UNIX shell account under a fake name, pay with cash, and set up >the remailing software. The identity of the operator of such a remailer >would be difficult, if not impossible, to discover. I'm always surprised that this hasn't been happening; maybe it will when the new clients become available. (Doesn't Sameer's system offer such accounts? Couldn't there be dozens of remailers based at c2.org? Of the 16 Type-1 remailers listed in one of Raph's recent reports, only 2 were at c2.org.) Now, can a site which "offers" such accounts be held liable? If the site drops an account when presented with _appropriate_ legal papers (a court order, such as an injunction), and if it takes a "hands-off" policy with respect to what customers run in their accounts, then it ought to be safe from actual liability. (I am not a lawyer, but it seems that having no prior knowledge of acts committed, and complying with court orders, reduces the likelihood of successful suits to near zero. Note that Netcom did _not_ cancel the COS-related accounts, and so extended its legal hassles.) The advantage of "pliable" remailers (which go away when hit) is that: Cost of preparing case to stop a remailer >> cost of setting up a new remailer Thus, it might cost the Church of Scientology $10,000 in various fees to get "account42666(a)c2.org" to stop remailing, but only $20 (or even less) to create "account98410(a)c2.org." Ideally, such remailers should require no involvement at all by the account holder. Just a "start" command, by the account holder. (Not the site administrator, as this could be construed as involvement by him.) But an "instant remailer" (just add water) is needed. Recent questions here on the list about what it takes to run a remailer may mean some advice is needed. Running a remailer function should never be thought of as being the same as running a site. Most of the existing remailers are certainly not being run on machines _owned_ by those running the remailers. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Sendmail Question (was: SMTP Server for sending to anonymous remailers?)
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:09 AM 5/19/96 -0700, you wrote: >If you use popmail (like Eudora), then just tell it the server to use in >"SMTP Host". > > -Lance > I have been following this with no little interest. Using Eudora Pro when I attempt to replace host: smtp1.abraxis.com with *SMTP Host*, I receive the message *Attempting to resolve host: SMTP Host*, and dat's all until I stop the send command. Thanks Alec -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZ9PJyKJGkNBIH7lAQGamwP/e1L3bWlOxCLfcEcSCUK7L2NPyDn3lNoe n4omNWrcUUOzBpQXg2fxPgmfsBDvao84neqbnkLv4HlPdFqDT/WgbNKzaJILYazS 2W2XsuDY5fxDNizKPmv+BSiPCYCMqCdD96g+Pl52Im1F6D9oEYkbe1Kvpb+iZTOj UyQUePJKtbk= =70bm -----END PGP SIGNATURE-----

1 0