December 2003 - cypherpunks-legacy

Re: Info War
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 7:15 PM 7/20/96 -0400, EVERHART(a)Arisia.GCE.Com wrote: >* I'd expect some comments on the automatic running of downloaded images >and how to secure them. Java? Reported at Princeton to be totally >unsecurable....no models exist. I think a more accurate assessment of what the Princeton people think is that the state of Java security is much like the state of Unix (pick your flavor) security when people first started attacking Unix. Since then it has been fix the holes as they are found. Neither has a coherent security model. Now the Princeton people can tell us all how I miss-interpreted their position. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

Does JPUNIX Remailer Have a Help File?
by Mark Terka 17 Dec '03

17 Dec '03

2 1

Re: Does JPUNIX Remailer Have a Help File?
by John A. Perry 17 Dec '03

17 Dec '03

On Fri, 1 Sep 1989, Damien Lucifer wrote: > I beleive the jpunix nym server is running the alpha nym package, the > documentation of which should be all but identical to the docs for > alpha.c2.org. You can see that document at http://alpha.c2.org This will also work. John Perry - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers.

1 0

the VTW---FBI Connection
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

We have received information that VTW is run and supported by the FBI, which we have suspected for reasons listed here. I) They appear to have no financial support or funding source. They do not accept donations. They have no corporate funds. And yet they appear to be a thriving business. II) They are secretive about their location, and do not seem to have a headquarters. The address listed in the NIC is a vacant lot in of all places Brooklyn, NY. They do not have a listed telephone. III) On a tip from a "friend" we learned that the power leader behind VTW is a cleancut man with the unusual name "Shabbir M. Safdar." Not exactly a common name. Several people say they've met him. Our "friend" says that Mr. Safdar is in reality an agent of the FBI. IIII) We didn't believe this without external verification. So we called the Brooklyn office of the FBI and asked for Agent Safdar. No such person. I called the Washington office. No such person. Checked if there is any agent named Safdar. They don't give out this info. Then we tried to find ANY public records on a Safdar, with no luck. No driver's license in NY, DC, NJ, etc. No phone, etc. Odd that such a person does not exist and yet runs a "human rights" organization? Then Alice called the NY FBI office. Asked for Agent Safdar. Guess what? "He's not in. Can I take a message". No message, thanks. He'll get the message all right. Now the big question: What is the FBI trying to do getting all these names? What else has "VTW" been doing? And what other organizations like them are there? Who else is in on it? What does this say about EPIC, CDT, EFF? Are Blaze and Schneier dupes, or willing participants? What about their ISP? I think we are all owed an explanation. This is serious. Maybe FOIA or a lawsuit before they burn the files. What do you want to bet "VTW" quietly fades away after a few prefunctory denials, and gets replaced by another organization in due course? Faithfully, Net reporter team Alice and Bob

7 6

SHI_fty
by jya＠pipeline.com 17 Dec '03

17 Dec '03

7-22-96. NYP, Page One: "Microsoft Sees A Major Shift For Computers." John Markoff MS is preparing to release new software that would bring the most fundamental change to personal computers since the machines were invented in the 1970's. Demonstrated last week and to be distributed free to the public, the software is designed to blend the multimedia technology of the Web with Windows 95. PCs would treat each parcel of material as a document with all the stand-alone capabilities of a Web page. Each of these documents would have hyperlinks so that the creator of a document could make it available for reading, listening or viewing anywhere on the Web. "This is going to make enormous changes possible," said Jesse Berst, editor of Windows Watcher. "It's analogous to the advent of the automobile." "We're moving into a new world; we now have a new metaphor," said John Seely Brown, director of the Xerox Corporation's Palo Alto Research Center. A potentially troublesome aspect to Microsoft's new thrust is the extent to which it will further blur the distinctions between data that sit safely on a person's own computer and data flowing around the Internet. While certain measures of privacy and security control are built into Microsoft's current and planned software, it is still working to develop better security for Internet software. ----- http://jya.com/shifty.txt SHI_fty

2 1

Boycotts and Etiquette
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:19 AM 7/22/96, Igor Chudov @ home wrote: >Honestly, this boycott campaign looks out of place on Cypherpunks, at >least to me. I mean, we are for freedom of speech, aren't we? >Sternlight is talking about on-topic things. How come that renowned >defenders of freedom of speech resorted to name calling and attempts to >push their opponent out of the public forum? Note that I have not called for a boycott of Sternlight. The voices you here adding their name to a list are biasing the statistics. Those who don't want to respond to Sternlight, or me, or Vulis, Bell, or VZNuri/LD, should simply *not respond*! A novel idea, eh? I think I have been relatively polite to David, though I sure do wish he'd "pull his punches" with his gratuitous insults (e.g., by ending posts with dismissive remarks about the moral beliefs of his opponents, to name one example). I call these "ad hominem" remarks, in that they call into question the motivations or the basic competence of others to comment, though perhaps David believes that since they are "true," they cannot be ad hominem. {It ain't ad hominem, it's truth.) Perhaps a better word is "disrespectul," in the sense that I get the impression that David thinks nearly everyone who engages in argument with him is either childish (a term he characterized my views as :-}), or foolish, or disingenuous, or oafish, or deceiving, or... Some examples: "...so your contention is false on its face." "Some live in the conversation in their head and require that everything be spelled out. Very well, then:" "Isn't that nice. Some creep is proud enough of his skill at accessing the trivially available InterNIC finger data that he posts it to invoke harassment. And being a coward as well, he hides behind an anonymous remailer." "Another attempt to accuse, read minds, and impute motives." ..... Actually, I started to go back through the Sternlight CP posts I have saved (*), and found a curious thing: the intelligent comments vastly outweighed the "one line repartee" insults! I believe the majority of Net participants (here, in the crypto newsgroups, etc.) lose sight of the good comments because of the flamish ones. (* Indeed, I may have skewed my sample toward less-flamish posts, as I delete most of the simple insult posts.) I believe David would be better served by not yielding to the temptation to add throwaway lines, such as he used in replying to me: " Where I come from we call that "theft". Your ethics may vary in California." This is unneeded, and adds to a tone of ad hominem attack. It is roughly equivalent to making snide remarks about the motives of Kallstrom, Denning, Freeh, etc. Not very persuasive. In fact, in one analysis of the nature of flaming he noted: "And when on occasion (as happens) I rise to provocation, my take on it isn't that the other guy posted "flame bait" but that I allowed myself to be out of control. It's always possible to respond with the standard weapons against provocation when such is deliberate: rapier-like wit, reductio ad absurdum, literate sarcasm, or simple silence aka the filter file. Actual contumely in a response is seldom necessary, except perhaps by reference on rare occasion. We're not children here." Good advice. I agree with him here, and will not try to collect more examples of rudeness...Perhaps we react too strongly to the "Sternlightisms" and lose sight of the better points? Still, in my several years of seeing his posts in sci.crypt, talk.politics.crypto, talk.politics.org.eff (?), and elsewhere, I've seen that often his policy points get lost in the clutter of arguing with others on non-substantive points, of getting pulled into nonsensical crap about "SternFUD," "Bowdark," the "UnDoctor," and whom he has *Plonk*ed. Personally, as a neo-Calvinist who believes that those with whom I disagree on matters of politeness and basic morals are best punished by silence from me, I have often simply ignored threads that involve this kind of pettiness. (But, like David himself said, sometimes I, too, get pulled in...) There is a spectrum of rudeness and "disrepect." I certainly don't hold myself up as a standard of politeness. At one end are some truly rude folks, much ruder than Sternlight, me, or even Perry ("Llywarch Hen" and Vulis come to mind, recently). At the other end are some truly polite folks, such as Hal Finney and Bill Stewart, who make their points while avoiding personal characterizations or cleverly-worded insults. Rather than wasting list space with talk of "pledges" and boycotts, maybe a better approach is for us all to concentrate on better posts.... --Tim May (P.S. I don't intend to pull my punches on the "controversial" posts I like to write, such as about guns, or Ritalin, or "queer rights." While these posts apparently are "offensive" to some here, this kind of post is perfectly "fair game" as I see it.) Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 3

evidence from the NIC - interpret and use as you will.
by ante 17 Dec '03

17 Dec '03

See who is sleeping with who. These are the supporters of the sham "hearings". Voters Telecomm Watch (VTW-DOM) 115 Pacific St., #3 Brooklyn, NY 11201 Domain Name: VTW.ORG Administrative Contact: Safdar, Shabbir (SS155) shabbir(a)PANIX.COM (718) 596-7234 Technical Contact, Zone Contact: Panix Network Information Center (PANIX5) hostmaster(a)panix.com +1 212 741 4400 Record last updated on 27-Sep-95. Record created on 06-May-94. Domain servers in listed order: NS1.ACCESS.NET 198.7.0.1 NS2.ACCESS.NET 198.7.0.2 The InterNIC Registration Services Host contains ONLY Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information. Blaze, Matt (CRYPTO-DOM) 101 Crawford Corners Rd Room 4G-634 Holmdel, NJ 07733 Domain Name: CRYPTO.COM Administrative Contact: Blaze, Matt (MB19) mab(a)CRYPTO.COM (908) 949-8069 Technical Contact, Zone Contact: Network Information and Support Center (PSI-NISC) hostinfo(a)psi.com (518) 283-8860 Record last updated on 06-May-93. Record created on 06-May-93. Domain servers in listed order: NS.PSI.NET 192.33.4.10 NS2.PSI.NET 38.8.50.2 The InterNIC Registration Services Host contains ONLY Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information. Center for Democracy and Technology (CDT2-DOM) 1634 Eye Street, NW Suite 1100 Washington, DC 20006 USA Domain Name: CDT.ORG Administrative Contact: Weitzner, Daniel (DW151) djw(a)CDT.ORG (202) 637-9800 Technical Contact, Zone Contact: Palacios, Bob (BP282) bobpal(a)CDT.ORG (202) 637-9800 Billing Contact: Kolb, Danielle (DK1006) dkolb(a)CDT.ORG (202) 637-9800 Record last updated on 19-Apr-96. Record created on 20-Dec-94. Domain servers in listed order: NS.CAIS.COM 205.177.10.10 NS2.CAIS.COM 199.0.216.1 The InterNIC Registration Services Host contains ONLY Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information.

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"treehole"} = "<remailer(a)mockingbird.alias.net> cpunk pgp hash latent cut ek"; $remailer{"nemesis"} = "<remailer(a)meaning.com> cpunk pgp hash latent cut"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)rigel.cyberpass.net> mix cpunk pgp hash latent"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 alpha) (flame replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: The remailer list now includes information for the alpha nymserver. Last update: Mon 22 Jul 96 6:49:22 PDT remailer email address history latency uptime ----------------------------------------------------------------------- jam remailer(a)cypherpunks.ca ***-**+***** 17:17 99.99% replay remailer(a)replay.com ***+****+*** 6:16 99.98% alumni hal(a)alumni.caltech.edu *##+*+#*#### 2:13 99.98% nymrod nymrod(a)nym.jpunix.com +##++#*##### 2:54 99.98% lead mix(a)zifi.genetics.utah.edu +++-++++++++ 39:07 99.90% portal hfinney(a)shell.portal.com +##+**###### 1:56 99.87% amnesia amnesia(a)chardos.connix.com ----------+ 2:57:13 99.84% alpha alias(a)alpha.c2.org +**-+ .-+*++ 5:10:18 99.75% c2 remail(a)c2.org +++-+ .-+++* 5:36:10 99.57% vegas remailer(a)vegas.gateway.com * * *-**#*#* 22:44 99.39% extropia remail(a)miron.vip.best.com ____.------ 18:58:11 99.29% mix mixmaster(a)remail.obscura.com ++--+-+---+ 1:53:12 99.26% treehole remailer(a)mockingbird.alias.net -.--+ --+-- 4:28:09 98.80% penet anon(a)anon.penet.fi ---+------- 11:01:15 98.58% haystack haystack(a)holy.cow.net # *# +##+# 9:28 97.42% ncognito ncognito(a)rigel.cyberpass.net --._--+-.- 13:38:58 97.03% lucifer lucifer(a)dhp.com -++-++++ ++ 47:19 89.37% nemesis remailer(a)meaning.com + ***** 34:32 86.49% flame remailer(a)flame.alias.net -.----- 4:18:14 52.45% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

3 2

ITAR's 40 bit limit
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Sat Jul 20 19:41:41 1996 Another paradox of the US export regulations. The NSA is allowing 40 bit crypto exports. So as a hypothetical example assume that I write a crypto program that uses 40 bit RC4 to encode data (licensing from RSA). I then get an export license using the accelerated process for 40 bit RC4. I then export my program to Alice who wants to use it to transmit messages to Bob. If she uses my program to encrypt messages to Bob, any reasonably powerful attacker can decrypt her messages. However, what if she runs the program three times with three different passwords. (Ignore the problems of Inner-CBC and Outer-CBC for now.) Now the file is triple RC4 encoded with the equivalent of 80 bit security. Alice and Bob now have strong crypto. And if they run the program five times they have 120 bits of effective protection. The problem of using Inner-CBC is a little tricky, but if we assume that I can export in a DLL format, a Windows program could be written that calls the DLL repeatedly to layer it into triple or pentuple CBC RC4. The entire above discussion is entirely theoretical. I realize that it's a moot point since strong crypto is already perfectly accessible outside of the US. And that strong crypto algorithms can be exported in non-machine readable format (another paradox). (And that running 5-layer RC4 is a really inefficient block cipher.) I just wanted to point out yet another reason why ITAR regulations over crypto are not effectively preventing strong crypto. They are merely making it difficult for American business. - -- David F. Ogren | ogren(a)concentric.net | "A man without religion is like a fish PGP Key ID: 0x6458EB29 | without a bicycle" - ------------------------------|---------------------------------------- Don't know what PGP is? | Need my public key? It's available Send a message to me with the | by server or by sending me a message subject GETPGPINFO | with the subject GETPGPKEY -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMfFutuSLhCBkWOspAQFH7gf9GDjh1tcktyx3Lo4iSxDFTFoB7fuuJO0l SNlkYH1Akchl02b/CWc6CDSAZ8hxoUfoZpqTD7U0xTs1QqOM7y45r1/RvAet870s mkWL7gS5RmiiGN1bgtm844RPAtAhaE0uzT6wJsPQSfAv94CvZGNJEtF2p5lASs2F fK50gmlSbjhhHoh85s/7Ugl7XzTmRGoZzdKQCGpkc6yTJu/aKDyWU3HVSEY9F4Y3 AaHkardJehv/9xqoxks5eqnwjTSJ8+cAptT1iBo6hW+CKv89wQKK/F8RbQb2FWL2 z4GqFfQHdbxVbnspDNtIRUP5qhJuFRhmuS/ARfTYgTN50Gm5g/Cz2w== =2k+F -----END PGP SIGNATURE-----

2 1

Re: Bare fibers
by jim bell 17 Dec '03

17 Dec '03

At 03:20 AM 7/23/96 -0400, Rabid Wombat wrote: > >> >> Doesn't that make it vulnerable (detectable) to Tempest attacks? >No. >Transmitting light via fiber doesn't emit EM. >Anyway, the original post, as I recall, was about keeping sensitive data >on a second hard drive, connected via (very thin, therefore harder to >notice) fiber. Tempest monitoring was not a factor. It occurs to me that a bare fiber could actually be (randomly) hung across treetops, roofs, power lines, and various other structures, over a many-block distance in suburban areas. Such a fiber wouldn't be protected very well, but it would probably last a few months. It would also be exceedingly hard to find its terminations, and tracing it would be a real pain. (It probably wouldn't be visible against a bright sky more than a meter or two away.) Jim Bell jimbell(a)pacifier.com

4 3