December 2003 - cypherpunks-legacy

Re: anonymous mailing lists
by Hal 17 Dec '03

17 Dec '03

From: ichudov(a)algebra.com (Igor Chudov @ home) > A nice, albeit quite expensive, way of pretection from traffic analysis > is to create a mailing list (or a newsgroup) and forward all messages to > all users of that mailing list or newsgroup. Of course, since messages > are encrypted, only the recipients will be able to decrypt them. This was discussed here several years ago, under the name "anonymous message pools". Myron Cuperman, the operator of the extropia remailer implemented one, although I don't know if it is still running (I haven't gotten any mail from it for years). It was basically just a mailing list specifically for this purpose, that you would use as your anonymous return address. Of course a problem is that there may not be enough people signed up to provide much privacy protection. Hal

1 0

Re: Alternic.net (was domain zapping)
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 09:03 AM 6/28/96 -0700, Bill Stewart wrote: > If you don't do it carefully, > you'll end up needing a bunch of Above-Top-Level nameservers that > serve the names of the tens of thousands of top-level domains. Five thousand top level domain names is quite manageable, no big problem provided that their servers are reasonably stable -- and if the unstable ones do not work well, big deal. A hundred thousand would be a problem. Assume a top level domain typically lasts forever, and a top level server typically lasts ten years. Assume two new top level domain names appear each day, and that it typically takes a several of months of reliable service to be added to the most generally accepted lists. This does not seem to constitute an intolerable burden to most domain name server administrators. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: anonymous mailing lists
by Hal 17 Dec '03

17 Dec '03

Wei Dai did some nice statistical analysis of this type of attack sometime a year or two ago. Even with countermeasures such as you suggest, if they are not perfect, so some information leaks correlating incoming and outgoing messages, Wei showed that it was possible to deduce the owners of the nyms surprisingly quickly. The countermeasures do work - if you get and send exactly 50 pieces of 4K byte email every day, no matter what, then correlations don't exist - but they are expensive to do perfectly. For now we have much worse weaknesses; none of the current return-address systems are really safe, other than posting encrypted mail to newsgroups (and even that may be a problem if they suspect who you are and are monitoring your computer link to see if you download certain messages). Hal

1 0

Re: crypto and bagpipes [NOISE]
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:55 PM 6/28/96 -0400, Declan B. McCullagh wrote: >Excerpts from internet.cypherpunks: 27-Jun-96 Re: crypto and bagpipes >[NO.. by "Perry E. Metzger"@pierm >> No one who has heard sustained bagpipe playing can deny the fact that >> bagpipes are indeed an instrument of war, with no legitimate place in >> peaceful everyday society. > >Hmm... Carnegie Mellon University is the only school in the country with >a bagpipe major, you know. You haven't lived until you've heard a >screeching 'pipe at 3 am in front of Hunt Library. I guess this explains the pro-censorship outlook of the students and staff there. Maybe someone should be investigating the evil effects of bagpipes on the mind. (The Freudian implications of bagpipe playing alone should get someone there to do something about it...) --- |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

fbi botches intel "ecspionage" case
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

"economic espionage" (ecspionage?) is in full swing as being promoted as the new bogeyman to justify spending billions of dollars to our intelligence agencies, both military and the FBI. we already have a very good example where this has backfired. I was watching Nightline on Tues night or so in which there was info about how the FBI helped get an informant into Intel in a *very* sensitive position, where he was able to film the pentium chip plans. he said he sold them, as I recall, to iraq, syria, china, etc. at the end of the show, the reporter stated that the FBI was seeking stronger laws against theft of "intellectual property" in congress that might solve the problem. there was much lamentation over the fact the criminal in question only got about 33 months of prison time or something. the FBI emerged with great egg on their face. I would say if anyone wants to ridicule them for getting into covering "ecspionage" cases, this is a prime candidate case. is this what they are aiming for? heh, heh. == somehow we have missed a good public debate about ecspionage in the country. there were a few NYT editorials, but it is clearly being used as a very major aspect of promoting the new post-cold-war spy and intelligence strategy without almost any notice by major analyists. I was thinking about all the objections I had to the FBI ecspionage treatment that were never raised on the program: 1. there was an implicit assumption that merely having the plans to the chip would allow other countries to somehow slaughter us in economic competition. but INTEL has spent billions of dollars on physical infrastructure without which the plans are virtually useless. it would take other countries years to get the kind of equipment necessary to produce the pentium, by which it might actually be yesterday's technology that no one cares about any more. 2. we have a tradition of separation of church and state in this country, and also separation of the public government and private industry. suddenly we have the FBI saying they want to infiltrate companies to deal with economic espionage. well, these companies have their own policy, and what do they gain by having a government agency working inside them? in the above case I note, it led to exactly the *opposite* of what was intended: the theft of *highly*sensitive* plans by an FBI mole. 3. hence, one wonders if the FBI could do a better job of combating ecspionage than companies are already doing, or if they are just going to botch it as has already been spectacularly proven in this case. 4. we could have companies that are run like the NSA to prevent "theft of information" (in quotes because I wonder if this will be considered a crime in future decades, just as heresy and blasphemy were once considered crimes a long time ago but no longer are today). however, we have the old "openess vs. security" catch-22. we can't have technological development without some degree of openess. 5. what is "intellectual property"? I think a very good case can be made that there isn't really any such thing, that the term itself may be thought in the future as something like an oxymoron. there is a big red flag going up here: why do we need all kinds of laws to combat this? is it really a problem? can anyone actually point to a very sinister situation in which massive amounts of cash were lost by a company due to ecspionage? as the steve jackson games incident proved, companies are liable to vastly exaggerate their losses to the point of fantasy. they have a tendency to think that "their information" is worth hundreds of thousands of dollars when it may actually be freely legally obtainable. if someone else can give more info on this case (apparently a book is coming out about it or something) including the guy's name, I'd appreciate it, I didn't take any notes so this is a bit fuzzy.

4 3

Re: crypto and bagpipes [NOISE]
by Michael Myers 17 Dec '03

17 Dec '03

At 12:37 PM 6/29/96 -0500, Adam Shostack wrote: >Damnit, Perry, the fact that you don't like them doesn't mean we >should outlaw them! :) > >Adam > >Perry E. Metzger wrote: >| vinnie moscaritolo writes: >| > >>>Mr Brooks, the piper, (...) >| > >>>claims he wasn't playing a musical >| > >>>instrument, but practising with a weapon! >| > >>> >| > >>>The imagination boggles if his claim is successful! >| >| No one who has heard sustained bagpipe playing can deny the fact that >| bagpipes are indeed an instrument of war, with no legitimate place in >| peaceful everyday society. >| >| Perry Of course...when bagpipes are outlawed... -- Michael Myers Vote Libertarian....you'll sleep better! Don't like abortion? Don't have one. Don't like guns? Don't buy one. | Don't like bagpipes? Don't play one! | blackavr(a)aa.net E-mail for PGPv2.6.2 public key \____________ http://www.aa.net/~blackavr/homepage.htm ________________/

1 0

No Subject
by nobody＠flame.alias.net 17 Dec '03

17 Dec '03

I would appreciate any information members may have regarding the security/safety of the new nym server nym.alias.net (in "alpha" state) who posted here about 3 weeks ago. Nym.alias.net reportedly is the same machine as anon.lcs.mit.edu. Specifically, is the individual running the nym _known_ to cypherpunks, or is this an unknown about whom I should have serious doubts. The admin states that nym.alias.net is the same machine as anon.lcs.mit.edu. Any information or insight regarding the wisdom of using ths nym would be welcome. Information concerning the nym I obtained by sending a message to help(a)nym.alias.net; the administrator can be reached at admin(a)nym.alias.net.

2 1

Important News from The Wall Street Journal Interactive Edition
by The Wall Street Journal Interactive Edition 17 Dec '03

17 Dec '03

Dear Wall Street Journal reader: If you haven't visited the Money & Investing Update in a while, we wanted to let you know we've made some dramatic changes. On April 29, we became The Wall Street Journal Interactive Edition (http://wsj.com) That means we've expanded, to bring you the entire spectrum of business coverage provided by The Wall Street Journal. You'll see not only our pioneering, continually updated coverage of the markets, but all the most important stories in technology, marketing, the law--even sports and weather. We've also added new features we hope make the Interactive Edition even more useful, such as Personal Journal, which enables you to create your own personalized view of today's news, and the ability to build and monitor your own personal stock portfolio. As a trial subscriber to Money & Investing Update, we are eager to have you try the Interactive Edition. So, your User Name and Password for the Update are valid for the Interactive Edition as well. Plus, as a special thank you for your early support, your access to the Interactive Edition WILL CONTINUE TO BE FREE THROUGH AUGUST 31, 1996, after which time a very modest subscription fee will be required to continue. But remember, NO CREDIT CARD OR OTHER PAYMENT INFORMATION is required until after August 31, and ONLY THEN if you decide you want to join us as a paid subscriber. Until then, read the Interactive Edition as often as you like at no charge. To see the Interactive Edition, you can jump directly to the front page at http://wsj.com/edition/current/summaries/front.htm, or take a brief tour of the most interesting new features at http://wsj.com/tour.htm. We look forward to hearing your reactions to our interactive efforts, since the comments of readers like you have already played a powerful role in shaping our future. Please write us at the address below with any questions or comments. Neil Budde Editor The Wall Street Journal Interactive Edition info(a)interactive.wsj.com P.S. If you experienced difficulty accessing the Interactive Edition during our first few weeks, we apologize. Reader interest completely exceeded our expectations. However, we've made a number of major system improvements since then and we encourage you to come back and try again. -------------------------------------------- If you don't want to receive future mail from the WSJ-ANNOUNCE list, simply reply to this message with UNSUBSCRIBE WSJ-ANNOUNCE3 in the message body.

1 0

Re: anonymous mailing lists
by Hal 17 Dec '03

17 Dec '03

From: Jeffrey A Nimmo <janimmo(a)ionet.net> > On Fri, 28 Jun 1996 ichudov(a)algebra.com wrote: > > Then users of alpha.c2.org will have to install mail filters that > > automatically delete all incoming mail not intended to be read by them > > (they can't read such messages anyway). > > How exactly would this be done? Since messages from alpha.c2.org > are conventionally encrypted, they don't contain key id's. > > Wouldn't that require every recipient to store his/her passphrase > and call pgp for every message to see if it could be decrypted? This in > and of itself would be a more serious security breach, not to mention an > _enormous_ drain on site resources. Since the PGP is run on private computers, and only at mail-reading time, there should be no problem entering the conventional encryption passphrase and checking to see whether the messages decrypt. Actually PGP puts a pattern at the beginning of the encrypted portion, so successful decryption can be checked very quickly, without much of a computational load. Hal

2 1

Re: fbi botches intel "ecspionage" case
by jim bell 17 Dec '03

17 Dec '03

At 12:25 PM 6/29/96 -0700, Vladimir Z. Nuri wrote: > >"economic espionage" (ecspionage?) is in full swing as being >promoted as the new bogeyman to justify spending billions of >dollars to our intelligence agencies, both military and >the FBI. >we already have a very good example where this has >backfired. I was watching Nightline on Tues night or >so in which there was info about how the FBI helped >get an informant into Intel in a *very* sensitive >position, where he was able to film the pentium chip >plans. he said he sold them, as I recall, >to iraq, syria, china, etc. [snip] >I was thinking about all the objections I had to the >FBI ecspionage treatment that were never raised on the >program: >1. there was an implicit assumption that merely having >the plans to the chip would allow other countries to somehow >slaughter us in economic competition. but INTEL has spent >billions of dollars on physical infrastructure without which >the plans are virtually useless. it would take other countries >years to get the kind of equipment necessary to produce the >pentium, by which it might actually be yesterday's technology >that no one cares about any more. It's worse than this. I can recall talk of a big problem WITHIN INTEL trying to tranfer the process to produce a part between (as I recall) two Intel semiconductor fabs, Fab IV and Fab V, which are buildings only a couple hundred feet apart! And obviously, this was done with the full cooperation of everyone within Intel, and did not require the interfacing with any other company. The idea that you can just steal the "plans" for a chip and build it yourself is crazy. >2. we have a tradition of separation of church and state in >this country, and also separation of the public government >and private industry. suddenly we have the FBI saying they >want to infiltrate companies to deal with economic espionage. >well, these companies have their own policy, and what do >they gain by having a government agency working inside them? >in the above case I note, it led to exactly the *opposite* >of what was intended: the theft of *highly*sensitive* plans >by an FBI mole. I was even more disgusted with the FBI: I kept hearing them claim, "We did not authorize him to break the law." Huh?!? Maybe they didn't, this time, but does this mean, implicitly, that this country has sunk so low that the FBI thinks it has the legal authority to "authorize" somebody to break the law????? Jim Bell jimbell(a)pacifier.com

2 1