December 2003 - cypherpunks-legacy

SHI_fty
by jya＠pipeline.com 17 Dec '03

17 Dec '03

7-22-96. NYP, Page One: "Microsoft Sees A Major Shift For Computers." John Markoff MS is preparing to release new software that would bring the most fundamental change to personal computers since the machines were invented in the 1970's. Demonstrated last week and to be distributed free to the public, the software is designed to blend the multimedia technology of the Web with Windows 95. PCs would treat each parcel of material as a document with all the stand-alone capabilities of a Web page. Each of these documents would have hyperlinks so that the creator of a document could make it available for reading, listening or viewing anywhere on the Web. "This is going to make enormous changes possible," said Jesse Berst, editor of Windows Watcher. "It's analogous to the advent of the automobile." "We're moving into a new world; we now have a new metaphor," said John Seely Brown, director of the Xerox Corporation's Palo Alto Research Center. A potentially troublesome aspect to Microsoft's new thrust is the extent to which it will further blur the distinctions between data that sit safely on a person's own computer and data flowing around the Internet. While certain measures of privacy and security control are built into Microsoft's current and planned software, it is still working to develop better security for Internet software. ----- http://jya.com/shifty.txt SHI_fty

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"treehole"} = "<remailer(a)mockingbird.alias.net> cpunk pgp hash latent cut ek"; $remailer{"nemesis"} = "<remailer(a)meaning.com> cpunk pgp hash latent cut"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)rigel.cyberpass.net> mix cpunk pgp hash latent"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 alpha) (flame replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: The remailer list now includes information for the alpha nymserver. Last update: Mon 22 Jul 96 6:49:22 PDT remailer email address history latency uptime ----------------------------------------------------------------------- jam remailer(a)cypherpunks.ca ***-**+***** 17:17 99.99% replay remailer(a)replay.com ***+****+*** 6:16 99.98% alumni hal(a)alumni.caltech.edu *##+*+#*#### 2:13 99.98% nymrod nymrod(a)nym.jpunix.com +##++#*##### 2:54 99.98% lead mix(a)zifi.genetics.utah.edu +++-++++++++ 39:07 99.90% portal hfinney(a)shell.portal.com +##+**###### 1:56 99.87% amnesia amnesia(a)chardos.connix.com ----------+ 2:57:13 99.84% alpha alias(a)alpha.c2.org +**-+ .-+*++ 5:10:18 99.75% c2 remail(a)c2.org +++-+ .-+++* 5:36:10 99.57% vegas remailer(a)vegas.gateway.com * * *-**#*#* 22:44 99.39% extropia remail(a)miron.vip.best.com ____.------ 18:58:11 99.29% mix mixmaster(a)remail.obscura.com ++--+-+---+ 1:53:12 99.26% treehole remailer(a)mockingbird.alias.net -.--+ --+-- 4:28:09 98.80% penet anon(a)anon.penet.fi ---+------- 11:01:15 98.58% haystack haystack(a)holy.cow.net # *# +##+# 9:28 97.42% ncognito ncognito(a)rigel.cyberpass.net --._--+-.- 13:38:58 97.03% lucifer lucifer(a)dhp.com -++-++++ ++ 47:19 89.37% nemesis remailer(a)meaning.com + ***** 34:32 86.49% flame remailer(a)flame.alias.net -.----- 4:18:14 52.45% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

3 2

Re: Borders *are* transparent
by Peter Trei 17 Dec '03

17 Dec '03

Jeff wrote: > The retail version of Netscape Navigator sold in US stores > has been the US version for almost a year now. The first run > were the export version, because the marketing people thought > it would be easier. When I explained the issue, they made the > change to the stronger US version immediately. > --Jeff This, I think, is one place where the activities of members of this list have had a real effect. Last September, three or four semi-overlapping efforts succeeded in brute-forcing 40 bit RC4 (used in export-quality SSL). This had three main effects: 1. Raising the issue in the media, and thus in the public consciousness. 2. Within a month, the government was starting to talk about permitting the export of stronger (but GAK'd) encryption products. 3. It enabled people like Jeff to argue successfully that releasing only an export-strength product was no longer a viable option.In practical terms is probably the most important effect of the crack: I know of at least one other company where it led directly to the release of both domestic and export versions. Any one up for a distributed brute force attack on single DES? My back-of-the-envelope calculations and guesstimates put this on the hairy edge of doability (the critical factor is how many machines can be recruited - a non-trivial cash prize would help). Peter Trei trei(a)process.com "Exportable strong encryption" is an oxymoron.

12 18

Cookie Monster on a Diet
by Duncan Frissell 17 Dec '03

17 Dec '03

I love telling Netscape to inform me before it accepts cookies. It's fun seeing who asks and whether they'll let you in The WSJ site won't let you in if you don't accept 2 cookies from it. It looks like they are an encrypted version of your username and password. Maybe Netscape could add a protocol which would let your instance of Netscape tell the server that you are on a diet and the Doctor told you not to accept any cookies. DCF

1 0

Re: Symantec's Your Eyes Only
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:17 AM 7/18/96 -0400, Clay Olbon II wrote: >My point was not that govts want to escrow communication keys, it was that >this is appearing more and more in commercial products marketed to >businesses. I run the computer system for a small office and I would >rather not see employee email - maybe I am just naive. However, there >obviously is a demand for this type of product. It must come from either a >lack of understanding of crypto, or a freeh-style authoritarianism on the >part of corporate executives. I wouldn't rule either one out. If it is >the latter, I'm not sure there is anything we can do. A larger organization feels that it has to maintain control over its systems by bureaucratic methods. Smaller organizations can figure out by direct experience whether someone is trustworthy or not. This is not restricted to encryption software, however. Large organizations attempt to determine what their employees should be doing with their time as well. This method of social organization works fine when mass producing large quantities of identical physical products. It is, however, incompatible with small-run, custom production of goods and services in which individual imagination and knowledge play a big part. In the current environment, management can't predict in advance what is the optimal thing that the "workers" should be doing at any given time. What we call "forcing contracts" (you do this, I pay you) are replaced in the modern age with "incentive contracts" (you produce a desired outcome, I pay you). This means that as time goes on many businesses approach closer and closer to the one-man firm model in which everyone buys and sells everyone else's services on the spot market. This didn't work in the past because of the friction of the transaction costs involved but those costs have declined dramatically. In this environment, others don't care how much time you surf the web or what you encrypt as long as your output is of the desired quality and quantity. Indeed, the average firm size has been declining in the US for 15 years or so. Companies may attempt to resist this dissolution and they may attempt to maintain traditional controls on their workers but if it is true that the Nets make it possible for the greater efficiencies of the one-man firm (no downtime paid by the buyer) to come into play, new small firms will eat the dinosaurs. DCF

1 0

Re: Length of passphrase beneficial?
by William Ehrendreich 17 Dec '03

17 Dec '03

> I disagreed with that assesment. Breaking into a home is easy. > > Adam > > > > -- > "It is seldom that liberty of any kind is lost all at once." Yes and ultimately more obvious. There are about 10 zillion ways that someone could hide a pass phrase. Bits are bits. Under the assumption that breaking into a home may be easy, you have to look at the possibility that this is what the person is looking for. You know, "Big brother broke into my house to subvert my freedoms", ploy. What a great way to get your self on Date Line.

1 0

Re: Digital Watermarks for copy protection in recent Billboard
by Alex F 17 Dec '03

17 Dec '03

> Paged through a recent (June or July 13) edition of Billboard > magazine yesterday. There was an article about the music industry, > the internet, and copyright issues. Didn't have a chance to read in > thoroughly, but it mentioned using digital watermarks which contained > info on to who (CC number) and when the material was sold... the > watermarks allgedly could survive if a CD was taped, copied several times > and redigitized. > Easy enough. > The anti-piracy scheme is only useful for direct sale to a customer > though. If you buy music anonymously, how is it traced? This only > works for pirating on-demand purchases. This is probably yet another case of people not thinking ahead. As usual. People buying CDs at a garage sale & getting arrested for piracy. Wonderful. > > Other issues: what if an eavesdropper steals the music or video? It's If they steal it, well, who cares? If there is something worked out so that they could trace STOLEN (not traded or sold) CDs then fine, arrest them. Do you really think though that anyone would waste so much time over $8? > If it uses a credit-card number as (part of) an ID, that's pretty > bad. Someone can sniff for CC numbers if they know how it's stored. Probably not done that way. My guess is that the disk ID is assigned to the disk at the time of manufacturing. At the point of purchase the customer is forced to give name, address, ID, whatever. This is then stored in a database along with the disc ID (serial num) which is prolly printed in the ISBN number or cross referenced with that in a national database or something, or just printed right on the disc. Anyway, a number is given to you from the CD, and not vice versa, I would imagine. > > The system will have to rely on proprietary tech and security through > obscurity. Even know how watermarks are stored without understanding > the math, one must be able to somehow garble the sound without > distorting it, but which renders the watermark useless. Actually, this would be quite easy. The "watermark" would be a signal that plays inband, but out of our hearing range during the entire CD. The human ear can only hear in the 20-20,000 (Hz, KHZ?, whatever) range. It would be trivial to add a digital ID signal at, say 30,000 or 15 or something like that. This could then be decoded, if need be. This seems the easiest and most efficient way. This could also be defeated with a lot of $$ (and/or a LOT of HD space). If the frequecy is known (it can be found out) it can easily be run through recording studio eqipment that can very effectively isolate the frequency and cut it out. If you have a LOT of HDD space (digital audio at 2 stereo tracks, not sure of the sampling rate or bit resolution, takes about 20MB of HDD space per minute (2 tracks, good sampling and bit rate) ) you could probably find the freq. fairly easily by isolation and just edit it out, and write the new stuff to a CD-R. If the signal is purely digital, I would imagine that it might be even easier that if it were an analog signal (?). Someone w/ good equipment (Digital Labs' stuff, or SAW (Software Audio Workshop) would be able to do this w/o much problem. The question is is the price/effort worth it? In quantity maybe. On an individual basis, only if you already happen to have the erquipment. I have a suspiscion that this type of thing will not really come to any kind of fruition due to not only the ability to defeat this, but mainly due to things like buying at a garage sale, etc. If it did, only MASS market piraters would be investigated. (Another example of a law creating it's own violators. Don't make the law, there won't be mass piratingof "clean CDs" Alex F =-=-=-=-=-=-=-=-=-=-=-=-=- Alex F alexf(a)iss.net Marketing Specialist Internet Security Systems =-=-=-=-=-=-=-=-=-=-=-=-=-

1 0

RE: INFO: Submit your testimony to Congress for hearings on July 25!
by geeman＠best.com 17 Dec '03

17 Dec '03

Simon Spero says: "paranoid rants have their place; however, if they keep bursting into cypherpunks without knocking first, there could be an accident. Lithium.... it's not just for watch batteries anymore." Seems to apply here, no? ---------- From: initialization[SMTP:initialization@nemesis.meaning.com] Sent: Sunday, July 21, 1996 6:23 PM To: cypherpunks(a)toad.com Subject: Re: INFO: Submit your testimony to Congress for hearings on July 25! vtw(a)vtw.org writes: > UPCOMING HEARING INFORMATION http://www.crypto.com/events/ after that. ... etc etc etc etc > This is an amazing time for Big Brother, who, in the person of VTW, is gathering the names and addresses of all who oppose it, one by one, under the Rube of "testimony" and "democracy"? What do you think will happen next? You think Big Brother is going to hear what you say and say "oh my god they are right!" and then turn around and mend its ways? NO! You will be marked as a trouble maker in your file, and rounded up or worse, when the time comes! They have duped many into participating, and others, prominent ones like Blaze, Diffie, Schneier, Zimmermann, have been blackmailed into working for them. Turn your back on this sham "democracy". Fuck their "hearings". And demand truth from "VTW". VTW=NSA+FBI front.

1 0

Re: Boycotts and Etiquette
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:04 PM 7/22/96, Alan Horowitz wrote: >My own decision to not interlocute with Sternlight is premised as >follows: His viewpoint is invariant and, by now, efficiently disseminated. >Briefly, he is a Statist and he never heard of any degree of Statism that >offends his sensibilities. I understand he's old enough to have been >around when Stalin was still running things in the USSR. David probably >was finding good things to say about Old Joe. And more importantly, >about J Edgar Hoover. Actually, David came out _against_ both Digital Telephony and mandatory key escrow, as I recall. For me, his process of conversion took entirely too long, as most of saw in the ostensibly voluntary Clipper program the seeds of a mandatory regimen. But he _did_ come out against these programs. I think this refutes the point that he's never heard of any degree of Statism that offends his sensibilities. >I pay by the minute for my internet access; many others do as well. If I >decide to ignore Sternlight, it is a business decision, not a moral one. Understandable. I find that _writing_ an article, even a short one like this, takes about as much time as adding 10 people to my filter file or hitting the "delete" key 50 times, so filtering out stuff I don't want to read has never been an issue. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RE: evidence from the NIC - interpret and use as you will.
by geeman＠best.com 17 Dec '03

17 Dec '03

Damn ... if this isn't a smoking gun, I don't know what is! What's the phrase? "Now go away" ..... ---------- From: ante[SMTP:ante@nemesis.meaning.com] Sent: Sunday, July 21, 1996 6:53 PM To: cypherpunks(a)toad.com Subject: evidence from the NIC - interpret and use as you will. Damn ... if this isn't a smoking gun, I don't know what is! See who is sleeping with who. These are the supporters of the sham "hearings". Voters Telecomm Watch (VTW-DOM) 115 Pacific St., #3 Brooklyn, NY 11201 Domain Name: VTW.ORG Administrative Contact: Safdar, Shabbir (SS155) shabbir(a)PANIX.COM (718) 596-7234 Technical Contact, Zone Contact: Panix Network Information Center (PANIX5) hostmaster(a)panix.com +1 212 741 4400 Record last updated on 27-Sep-95. Record created on 06-May-94. Domain servers in listed order: NS1.ACCESS.NET 198.7.0.1 NS2.ACCESS.NET 198.7.0.2 The InterNIC Registration Services Host contains ONLY Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information. Blaze, Matt (CRYPTO-DOM) 101 Crawford Corners Rd Room 4G-634 Holmdel, NJ 07733 Domain Name: CRYPTO.COM Administrative Contact: Blaze, Matt (MB19) mab(a)CRYPTO.COM (908) 949-8069 Technical Contact, Zone Contact: Network Information and Support Center (PSI-NISC) hostinfo(a)psi.com (518) 283-8860 Record last updated on 06-May-93. Record created on 06-May-93. Domain servers in listed order: NS.PSI.NET 192.33.4.10 NS2.PSI.NET 38.8.50.2 The InterNIC Registration Services Host contains ONLY Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information. Center for Democracy and Technology (CDT2-DOM) 1634 Eye Street, NW Suite 1100 Washington, DC 20006 USA Domain Name: CDT.ORG Administrative Contact: Weitzner, Daniel (DW151) djw(a)CDT.ORG (202) 637-9800 Technical Contact, Zone Contact: Palacios, Bob (BP282) bobpal(a)CDT.ORG (202) 637-9800 Billing Contact: Kolb, Danielle (DK1006) dkolb(a)CDT.ORG (202) 637-9800 Record last updated on 19-Apr-96. Record created on 20-Dec-94. Domain servers in listed order: NS.CAIS.COM 205.177.10.10 NS2.CAIS.COM 199.0.216.1 The InterNIC Registration Services Host contains ONLY Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information.

1 0