December 2003 - cypherpunks-legacy

papers on anonymous protocols
by Wei Dai 17 Dec '03

17 Dec '03

I found a couple of papers on anonymous protocols that I haven't seen mentioned here before. I'll list them for people who might be interested: Cryptographic Defense Against Traffic Analysis by Rackoff and Simon. http://pct.microsoft.com/papers/ta.ps gives a proof of security for a mix-net like protocol. A. Pfitzmann, B. Pfitzmann, M. Waidner: ISDN-MIXes - Untraceable Communication with Very Small Bandwidth Overhead; Proc. Kommunikation in verteilten Systemen, Feb. 1991, Mannheim, Informatik-Fachberichte 267, Springer-Verlag, Heidelberg 1991, 451-463. describes a protocol for anonymous telephone calls. Wei Dai

2 1

Anonymity thread from sci.research.careers
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Recently I noticed an interesting thread on the Usenet newsgroup s.c.r regarding a Web site with a conferencing system, supposedly anonymous. I repost several articles which some folks on cp might find interesting. Path: !howland.erols.net!news2.digex.net!access1.digex.net!arthures From: "Arthur E. Sowers" <arthures(a)access.digex.net> Newsgroups: sci.research.careers Subject: Review and Warning about the "Biotech Rumor Mill" Date: Mon, 2 Sep 1996 22:16:39 -0400 Organization: Express Access Online Communications, USA Lines: 114 Message-ID: <Pine.SUN.3.94.960902214715.17927F-100000(a)access1.digex.net> References: <lindasj-2908961456130001(a)client9.sedona.net> NNTP-Posting-Host: access1.digex.net Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Sender: arthures(a)access1.digex.net In-Reply-To: <lindasj-2908961456130001(a)client9.sedona.net> Folks, I decided to visit this web site and tell all of you a few things you ought to keep in mind. First, the review: Yes, the "Rumor Mill" is a sort-of web-site "newsgroup". The majority of posts and responses that I saw (not counting the archives) were by "anonymous" posters. A good many were not particularly "hot" (such as "why is company 'X' stock dropping?" and some inane comments). Some were cryptic (meaning to the average person, they might be essentially meaningless). Most were very short (1-2 sentences). A few posts did have some information that I downloaded for use later. One or two mentioned lawsuits (patent infringement). Second, the warning: The Rumor Mill lets you post anonymously (as far as I could see, but I did not try it) but THAT DOES NOT MEAN THAT SOMEONE WILL NOT KNOW WHO YOU ARE. I don't know how the Rumor Mill is operated, but I do know that websites CAN be configured to capture information about browser users who access that site! They can get a large amount of information about you including your name, email address, all sorts of information about your domain & ISP, etc. Your anonymous post may appear to everyone else as anonymous, but the sysop (webmaster) at that site should be presumed to be capable of determining who you are. I myself have seen website "hit statistics" and believe me, it all shows up. You should look in your Web Browser directory for the <cookies.txt> file and note that some web sites that you visit will put short lines of data into your file. You might try to change the attributes on that file to "read only" and see what happens. Sometimes it will thwart the web site, sometimes it will give you an error message. As a matter of fact, I did click on one button and my netscape security window opened up to warn me that the channel to that site was not secure. What else is related to this? There are a number of anonymous remailers out in cyberspace, but it has been stated by a knowledgeable source that a number of them are being operated by law enforcement agencies (presumably to troll for criminal activity). A website which allows rumors to be posted anonymously, especially involving commercial business details (i.e. proprietary) but carries at least no disclaimer that the sysop or sponsors do not use hit statistics data to correlate it with anonymous posters and thereby determine or attempt to determine thier identity is a website that I would avoid using. In the worlds of politics, leaks, trial-baloons, rumor, inuendo, insinuations, etc. are common and make for entertaining reading for those who enjoy it. But in the world of commerce, the wrong blip in the wrong place can lead to lawsuits, prosecution (by, for example, the Securities and Exhange Commission), and other personal information, identity, etc., to fall into hands that I would hope smart people might think about before they make posts. I have the feeling that a simple post to a newsgroup through a remailer would be safer that an anonymous post to the Rumor Mill. At least, I would get into the configuration dialog boxes on your web browser and leave "your name" and "your email address" blank, or put in a dummy name. But then, you can figure out that this is a way to also send forged mail (there was a "fake mail" website about a year or two ago, but the sysops eventually shut it down). There is in fact a website out there that says it can be used for anonymous web browsing (and I expect at some time in the future that they will start charging for its use [think for a minute why these would exist and it will be obvious]), but where I have that little snit of paper is burried on my desk with mountains of uncolated paperwork (sorry). What dothey say about "buyer beware?" Caveat emptor? Eh? Art Sowers ======= On 29 Aug 1996, Linda St. James wrote: > Do you want to have a little fun and perhaps learn something about the > current state of the biotechnology industry? > > Have you a particular company you've been interested in that you'd like > more information on -- but the "inside scoop" seems better than an > official company profile? > > IF SO --- > > > Please take a look at Dr. Martin Leach's BIOTECH RUMOR MILL, one of the > most fascinating sites on the WWW for the biotechnologist. > > In this site, Martin goes to great lengths to have an "all in one > location" center for biotechnology news. Whether it is the daily reports > from PR Newswire, or his reader surveys, you are bound to find something > of interest. But, to prove that the internet imitates real life, some of > the most interesting tidbits are pure rumor. > > In this site, you and your colleagues have an opportunity to post > information in a completely anonymous fashion. Some of the biggest news in > the biotechnology business comes out of the "Rumor Mill" before it hits > the trade journals, or even the Wall Street Journal! Of course, you have > to remember that in any forum where anyone can post anonymously, there is > a certain amount of frivolity as well. But what fun! > > Search Masters International, an industry-leading search firm specializing > in Biotechnology, Pharmaceuticals, and Medical Device industries, is now a > sponsor of this site along with Research Diagnostics. > > Take a look at your earliest convenience: > > The Biotech Rumor Mill is at: http://www.tradesmart.com/rumor > > The Search Masters International home page is at: http://smi.bio.com/ > > Best regards, > > Linda St. James, Office Manager > Search Masters International > Five Hundred Foothills South, Suite #2 > Sedona, AZ 86336 > (520) 282-3553 Phone or (520) 282-5881 Fax > email to lindasj(a)sedona.net > > Path: !howland.erols.net!news2.digex.net!access5.digex.net!arthures From: "Arthur E. Sowers" <arthures(a)access.digex.net> Newsgroups: sci.research.careers Subject: Re: Review and Warning about the "Biotech Rumor Mill" Date: Tue, 3 Sep 1996 13:59:21 -0400 Organization: Express Access Online Communications, USA Lines: 89 Message-ID: <Pine.SUN.3.94.960903133225.2947A-100000(a)access5.digex.net> References: <lindasj-2908961456130001(a)client9.sedona.net> <Pine.SUN.3.94.960902214715.17927F-100000(a)access1.digex.net> <davej-0309960723220001(a)client12.sedona.net> NNTP-Posting-Host: access5.digex.net Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Sender: arthures(a)access5.digex.net In-Reply-To: <davej-0309960723220001(a)client12.sedona.net> On 3 Sep 1996, Dave Jensen wrote: > In article <Pine.SUN.3.94.960902214715.17927F-100000(a)access1.digex.net>, > "Arthur E. Sowers" <arthures(a)access.digex.net> wrote: "Nice" of you to delete ALL of my post instead of dealing with the specific issues, or CONSIDERING that I might have some valid points. > > Art you have gone off the deep end. > > Yes, let's now add web site reviews and critiques to your mix of strange > posts. Personally, I think you miss the whole point of Martin's rumor mill > site, and it is obvious that you didn't read the webmaster's introduction > of how he handles anonymity. I returned to that website a few minutes ago to look over "how he handles anonymity" and nothing in what he said negates the possibility that he (and, by extension, can share "inteligence" information about the source of the rumor and maybe even the identity of the poster). You can have him look at his web hit statistics and he will find my "visit" listed (or at least he should be able to find it, as I did not go to the site "cloaked"). As a matter of fact, the wording of the disclaimers (at .../rumor/post.html) is that "All correspondees identities will be kept confidential." which says to me that he (and you?) may "keep" them confidential (i.e. you may know them, even though you may not broadcast them all over the net, and that may give you some valuable insight into who says what and when). He says at another point "..., an email is sent directly to me and a message is appended to the Rumor Mill." As far as I am concerned, if you go over to the anonymous newsgroups and read about privacy (and get the help file from Julf Helsigius' anon remailer) ANY sysop can read any mail that comes through a sysop's site. And, if I were in a private business, I would see the temptation to "use" that information being just as strong as governments all over the world justify having their own CIAs, NSAs, KGBs, etc., and just as strong as many corporations have their own "intelligence" activities, reverse engineering departments, and private security and investigation units. If you go to any good sized public library and look up under industrial espionage and spying, you will get many books on this. You can try to pull the wool over most of the eyes around here, but it ain't gonna work with me. You would also be advised to work with Martin to rephrase some of his language. He says at another point in a page that "This site is for entertainment purposes only." Hell, thats crap. If I go looking for such gossip and rumors, its because it deals with something that impacts on my life, my job, my career and it better be good poop! Besides, on the esthetics, virtually every (EVERY) post that I clicked on had this overly obvious "Proudly Sponsored by -- SMI" box plastered right on the top. Then right under it is the RDI box. Man, can't you guys show a little "class" and just have this showing just once on the home page and cut out all the repetition? It turns me off. And, you should have thanked me for NOT mentioning all the posts that are now archived that reported problems hitting your SMI site (I didn't read more than one or two of them). > Stick to what you know, Art, which appears to me to be academic career > tracks. No one has ever disputed your commentary in that area. But, like > the restaurant reviewer who thinks he now knows enough about entertainment > to review opera, you have gone over the edge and into territory better > left for those who, like Dr. Martin Leach, really know how to provide > value on the WWW. Your opinion, as usual. But for the rest of you out there, think twice about posting an "anonymous" message to a web site. I've been on the other end of them, and I know that people sit around trying to figure out as much as possible about who its from if they don't get an email identity. Or... how, Dave, would you like it if I tried to go in and put a warning to visitors to that site? Would you and or Martin "censor" my post? After all, at another place on the website is the statement that "I am not responsible for the accuracy of this information although I try to confirm where possible." I know that many "service providers" openly state that they reserve the right to decline or terminate service to any subscriber for any reason at any time. Martin could be in a little "free speech" trouble and you and he might get together (since you are sponsoring, too, and therefore "calling the tune") and talk about this. I should send you a bill for consulting time on this, actually. > > Dave > > Art Sowers Path: !howland.erols.net!news2.digex.net!access2.digex.net!arthures From: "Arthur E. Sowers" <arthures(a)access.digex.net> Newsgroups: sci.research.careers Subject: Re: Review and Warning about the "Biotech Rumor Mill" Date: Wed, 4 Sep 1996 22:03:34 -0400 Organization: Express Access Online Communications, USA Lines: 118 Message-ID: <Pine.SUN.3.94.960904214345.20399A-100000(a)access2.digex.net> References: <lindasj-2908961456130001(a)client9.sedona.net> <Pine.SUN.3.94.960902214715.17927F-100000(a)access1.digex.net> <50i2rr$t6i(a)news.bu.edu> <Pine.PMDF.3.91.960904173108.88691A-100000(a)BIOMED.MED.YALE.EDU> NNTP-Posting-Host: access2.digex.net Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Sender: arthures(a)access2.digex.net In-Reply-To: <Pine.PMDF.3.91.960904173108.88691A-100000(a)BIOMED.MED.YALE.EDU> On Wed, 4 Sep 1996 mmartin(a)BIOMED.MED.YALE.EDU wrote: > About the Biotech Rumor Mill - I think it is a very cool idea. Really, I > do. I have some doubts about the duplicity of the statement *for > entertainment purposes only* but I can live with it. (It just sounds a bit > too much like those ads on late-night TV for psychics; most of the ad is > full of testamonials about how the service accurately predicted things and > how it helps people by predicting events but if you look closely there is > a small disclaimer that says *for entertainment purposes only*. Yeah, > right. But Martin Leach isn't charging for access, so I can live with it.) > > On 3 Sep 1996, Martin Leach wrote: > > > Hi Arthur, > > > > I read your initial comments to Dr. Jensen and feel that are being a little > > paranoid. > > To each his own. <insert tongue in cheek> Just because you are paranoid > doesn't mean they aren't out to get you (or so the saying goes). ha, ha. > > > Information can be readily collected by any adept webmaster that wishes > > to.....so your comments are applicable to EVERY web site. > > Can't argue with that. But, of course, that isn't the point. The point is > that your site (unlike the vast majority of sites) claims to protect > anonymity. If you claim to protect anonymity, then your site should be > held to different standards. > > > Just because > > somebody clicks 'submit' on a form e.g. posting form on my site it does not > > send any extra information that cannot be gathered any other nefarious way. > > I don't think Art was suggesting anything of the sort (Art, feel free to > correct me if I'm wrong). I think he was just pointing out that it is > possible to gather a lot of information about a poster - information that > the poster may not be aware that he/she is giving. People (even > scientists!) are generally unaware about how insecure electronic > transmissions are and I think Art was just trying to raise the level of > awareness. Yep, that is what I had in mind. The anonymous posts may be anonymous to everyone else, but the "masters" at that site have it in their power to know where the post came from and who authored it and that could give them some interesting information to be privy to. Julf Helsingius who used to run the anon.penet remailer was a lot more honest about security and was very upfront about this in his "help" responder. But his site is off the air now. I could make lots of speculations but I won't. But everyone should beware of anything which is offered for "free" by business entities. Sometimes its a PR thing. Sometimes its genuine altruism. And sometimes its a pure scame. I won't openly estimate here how I would partition the fractions between those three possibilities. However, if I were running the "Rumor Mill" I would have a lot more extensive of a disclaimer and explanation (not only for PR but for legal purposes...I would not want to be a party in a lawsuit to "leaked" proprietary information... there is a fair bit of case law on this now). > The reason your site has become a lightning rod for security/privacy > issues is that you claim to protect anonymity. This discussion could be > about any website, but it only seems relevant when a website claims to > protect anonymity. I don't think it was meant to suggest that you (or > anyone who has priveleged access to the site) would actually abuse the > contract of anonymity, but of course you can't warn people about > potential abuse without it looking like you think it is likely that > people will abuse priveleges. (hope that convoluted sentence makes sense) I know what you mean, and if those guys are smart, they will think about this a little. > Anyway, if I had something that could get me fired, sued, or blackballed, > I sure wouldn't want to trust someone's claim of anonymity - especially > since that claim is probably not legally enforcable (i.e., I couldn't sue > the webmaster for damages if s/he made my identity known). Well, the anon.penet service got the local Finnish authorities (i.e. the heat) on their rear ends and that caused the whole service to terminate. The FBI, here, has been known to just go in and confiscate the hardware and software if they want to shut someone down for good cause. Suppose you were a company that didn't like something. Money and lawyers can lead to actions to stop something. I recall a year or two ago that one of the tobbacco companies didn't like the results of a researcher which got published and came out as anti-tobbacco. What did the company do? They used legal manuvering to force the researcher to turn over all of his notes, data, notebooks, manuscript drafts to the tobbacco company. How do you like them apples? By the way, this was reported in an issue of _Science_ back maybe 2 (?) years ago. > This is even > more important if that someone is intimately tied to the industry about > which I have information! I'd be much more likely to send it through an > anonymous remailer (even though those are no longer secure). I'd go for plain paper, handled with gloves that had not been touched on the outside by any of my pinkies, in an envelope, addressed and stamped (without licking), to the Wash Post, NY Times, and FBI, if I had something to blow the whistle about. You know, like in the spy novels written by ex-spooks. > Call me paranoid, if you will. But I sure as heck won't go walking in > downtown at night with $20 bills taped all over me - I'd just be asking > to get robbed, wouldn't I? I don't see that this is any different (except > in degree, perhaps). Right-on! > > Margaret A. Martin > > Yale University > mmartin(a)biomed.med.yale.edu > > > Art Sowers Path: !magnus.acs.ohio-state.edu!lerc.nasa.gov!purdue!news.bu.edu!darwin!leach From: leach@darwin (Martin Leach) Newsgroups: sci.research.careers Subject: Re: Review and Warning about the "Biotech Rumor Mill" Date: 3 Sep 1996 20:02:03 GMT Organization: Boston University Lines: 163 Message-ID: <50i2rr$t6i(a)news.bu.edu> References: <lindasj-2908961456130001(a)client9.sedona.net> <Pine.SUN.3.94.960902214715.17927F-100000(a)access1.digex.net> NNTP-Posting-Host: darwin.bu.edu X-Newsreader: TIN [version 1.2 PL2] Hi Arthur, I read your initial comments to Dr. Jensen and feel that are being a little paranoid. Information can be readily collected by any adept webmaster that wishes to.....so your comments are applicable to EVERY web site. Just because somebody clicks 'submit' on a form e.g. posting form on my site it does not send any extra information that cannot be gathered any other nefarious way. The only additional information they send is whatever they fill in the dialog boxes. an example of info-gathering that can be acheived by any webmaster can be found at: http://www.uiuc.edu/cgi-bin/info together with the web browser + privacy issue. The only information that I have the need to collect is the I.P. (internet protocol) address of the postee. The purpose of this being that I can prevent them posting to my site if they repeatedly post off-topic or abusive posts. In the past I have used this to prevent stock touting on my website and have banned whole sub-domains. (since the i.p. address may be general to the sw region of ATT or AOL). This is all mentioned on the top of the post page (http://www.tradesmart.com/rumor/post.html) that people have to scroll through to get to the posting section. Other information that is automatically collected (by the web server) is the domain name/I.P. address of the people visiting the web site. This allows me to see who (in a very general sense) access my web site. This information is freely available to anyone visiting my website...and I frequently advertise this fact. You can obtain your own copy of the traffic report at this web site by going to: http://www.tradesmart.com/cgi-bin/surfreport.html just fill in your email address and wait. The results will be emailed to you. You do not need to wait for the reply..since the stats processing takes time. good luck on your endeavours and feel free to post something on the Rumor Mill. Whether anonymous or pubicly. Martin Leach Webmaster of the Biotech Rumor Mill. Arthur E. Sowers (arthures(a)access.digex.net) wrote: : Folks, I decided to visit this web site and tell all of you a few things : you ought to keep in mind. : First, the review: Yes, the "Rumor Mill" is a sort-of web-site : "newsgroup". The majority of posts and responses that I saw (not counting : the archives) were by "anonymous" posters. A good many were not : particularly "hot" (such as "why is company 'X' stock dropping?" and some : inane comments). Some were cryptic (meaning to the average person, they : might be essentially meaningless). Most were very short (1-2 sentences). A : few posts did have some information that I downloaded for use later. One : or two mentioned lawsuits (patent infringement). : Second, the warning: The Rumor Mill lets you post anonymously (as far as I : could see, but I did not try it) but THAT DOES NOT MEAN THAT SOMEONE WILL : NOT KNOW WHO YOU ARE. I don't know how the Rumor Mill is operated, but I : do know that websites CAN be configured to capture information about : browser users who access that site! They can get a large amount of : information about you including your name, email address, all sorts of : information about your domain & ISP, etc. Your anonymous post may appear : to everyone else as anonymous, but the sysop (webmaster) at that site : should be presumed to be capable of determining who you are. I myself have : seen website "hit statistics" and believe me, it all shows up. You should : look in your Web Browser directory for the <cookies.txt> file and note : that some web sites that you visit will put short lines of data into your : file. You might try to change the attributes on that file to "read only" : and see what happens. Sometimes it will thwart the web site, sometimes it : will give you an error message. As a matter of fact, I did click on one : button and my netscape security window opened up to warn me that the : channel to that site was not secure. What else is related to this? There : are a number of anonymous remailers out in cyberspace, but it has been : stated by a knowledgeable source that a number of them are being operated : by law enforcement agencies (presumably to troll for criminal activity). A : website which allows rumors to be posted anonymously, especially involving : commercial business details (i.e. proprietary) but carries at least : no disclaimer that the sysop or sponsors do not use hit statistics data : to correlate it with anonymous posters and thereby determine or attempt to : determine thier identity is a website that I would avoid using. In the : worlds of politics, leaks, trial-baloons, rumor, inuendo, insinuations, : etc. are common and make for entertaining reading for those who enjoy it. : But in the world of commerce, the wrong blip in the wrong place can lead : to lawsuits, prosecution (by, for example, the Securities and Exhange : Commission), and other personal information, identity, etc., to fall into : hands that I would hope smart people might think about before they make : posts. I have the feeling that a simple post to a newsgroup through a : remailer would be safer that an anonymous post to the Rumor Mill. At : least, I would get into the configuration dialog boxes on your web browser : and leave "your name" and "your email address" blank, or put in a dummy : name. But then, you can figure out that this is a way to also send forged : mail (there was a "fake mail" website about a year or two ago, but the : sysops eventually shut it down). There is in fact a website out there that : says it can be used for anonymous web browsing (and I expect at some time : in the future that they will start charging for its use [think for a : minute why these would exist and it will be obvious]), but where I have : that little snit of paper is burried on my desk with mountains of : uncolated paperwork (sorry). : What dothey say about "buyer beware?" Caveat emptor? : Eh? : Art Sowers : ======= : On 29 Aug 1996, Linda St. James wrote: : > Do you want to have a little fun and perhaps learn something about the : > current state of the biotechnology industry? : > : > Have you a particular company you've been interested in that you'd like : > more information on -- but the "inside scoop" seems better than an : > official company profile? : > : > IF SO --- : > : > : > Please take a look at Dr. Martin Leach's BIOTECH RUMOR MILL, one of the : > most fascinating sites on the WWW for the biotechnologist. : > : > In this site, Martin goes to great lengths to have an "all in one : > location" center for biotechnology news. Whether it is the daily reports : > from PR Newswire, or his reader surveys, you are bound to find something : > of interest. But, to prove that the internet imitates real life, some of : > the most interesting tidbits are pure rumor. : > : > In this site, you and your colleagues have an opportunity to post : > information in a completely anonymous fashion. Some of the biggest news in : > the biotechnology business comes out of the "Rumor Mill" before it hits : > the trade journals, or even the Wall Street Journal! Of course, you have : > to remember that in any forum where anyone can post anonymously, there is : > a certain amount of frivolity as well. But what fun! : > : > Search Masters International, an industry-leading search firm specializing : > in Biotechnology, Pharmaceuticals, and Medical Device industries, is now a : > sponsor of this site along with Research Diagnostics. : > : > Take a look at your earliest convenience: : > : > The Biotech Rumor Mill is at: http://www.tradesmart.com/rumor : > : > The Search Masters International home page is at: http://smi.bio.com/ : > : > Best regards, : > : > Linda St. James, Office Manager : > Search Masters International : > Five Hundred Foothills South, Suite #2 : > Sedona, AZ 86336 : > (520) 282-3553 Phone or (520) 282-5881 Fax : > email to lindasj(a)sedona.net : > : > --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

4 3

Re: Erasing Disks
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:12 PM 9/11/96 -0700, you wrote: >The paper starts with the comment that most secure data destruction guides >are classified. There is the suspicion that the unclassified ones do not >cover the newer recording materials and techniques, and will not protect >you against government attackers. I disagree. The methods for declassification in the Army and Defense Department security manuals included several approaches: 1) Physical destruction - acid, sandblasters, etc. 2) NSA-Approved Whopping Big Magnets 3) NSA-Approved Hopefully-Bugfree computer programs for some computers. The most secure methods were the unclassified ones - after we sandblasted our RM05 disk packs, the NSA and KGB can't read anything. The less secure methods are the ones that require NSA approval - how strong is a Whopping Big Magnet this year? (Too strong to put near MY computer lab, thank you! :-) The answer tells you something about what the NSA can crack, which they not only don't want known, they don't want to encourage the KGB to erase their own disks better or to use the knowledge to become better at reading stolen Yankee disks. And NSA-Approved computer programs presumably have weaknesses and bugs, like all computer programs; they carry the risk that Reverse Engineers can figure out how to find the data the NSA missed. But shredding the floppy? No need to classify that, no secrets leaked by saying "Yeah, if you dissolve the magnetic film in acid we can't read anything on the etch marks in the mylar." It's Dumb and Safe (as long as you do the paperwork to make sure that you know which magtapes were fed to the shredder, which ones were overwritten with other RILLY SEKRET DATA, and which ones were stolen by the Tape Drive Repair Truck driver.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: 56 kbps modems
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Mon Sep 16 15:59:53 1996 I think I have to throw in some words here, too: 1. BAUD is one distingushable signal form. 2. BPS is bits per second 3. NO transmission over a standard phoneline can have more than 3100 baud, because the frequency of anything transmitted over that line is band limited to 300hz - 3400hz. (If you have ISDN it's not relevant anyway, since you are fixed with 8000hz or 64000 bps->in europe :), 56000 bps in usa) 4. Most modern transmission schemes work with multiple bits per baud. I.e. you transmit 10 bits in one baud if you have a 31000 bps modem. the only limitation in transmission speed is the amount of binary values you can pack into one baud. that on the other hand is limited by the S/N (signal to noise) ratio of your line. If you have a noise of 0.9%, you can't use more than 100 steps or you have ambiguous signals. since people talk about 56000 bps modems (we tried 34000 modems here and they couldn't produce more than 28800 on a very good connection) that would mean, that you have to transmit 18 bits = 262144 (!) distinguishable signal forms per baud. Comments? Remo Pini - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMj1dWhFhy5sz+bTpAQHmVAgAqRHydyZdElXlwMSgdKB6hg1fDBCMfhia JoI5W8n0JLcKe9HYN/H0DPqFHHDIATEhlN3b3OIhYCw52cNJ/e3b9Nbp5RQo+sDX zAogz5wZiDV7EA/gL589lNQZ9VKHlgTYBLzu1tqyJ5cD2KhWEUjvXyN4lYuxcEQT NIaiNPeYXrC0BeoLa/AE8mCrtu+7nhxy5HlSjDiu3lEYaVygKIPQHM3+Ljzq0jkq bmbqJbTyZshos+5gxHyXLsbL8rkpST53YT4Z3clL6PCv1ntNGXtb/loWgIDallYJ bHgfh/bAS5Utg7fpzuVNS8AJV8L2VLirScBd4Bq5RAXZxnoTVVQxOw== =9JSI -----END PGP SIGNATURE-----

5 4

Re: really undetectable crypto
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:26 PM 9/12/96 -0700, Jim_Miller(a)bilbo.suite.com wrote: >Most everybody on the list is familiar with the technique of hiding >encrypted messages in the LSBs of image files. Personally, I would not >use such a technique because don't I believe it's really undetectable. >I assume, without proof, that the LSBs of images files have statistical >properties that are sufficiently different from encrypted data that a >clever person could determine whether or not an image file contained an >imbedded encrypted message. First of all, they should at most be able to tell that there are random-looking-noise bits in there - if they start seeing patterns of ------BEGIN PGP ENCRYPTED SECRET MESSAGE------ you haven't done your job, though there are more subtle patterns that are more annoying to hide, like the slight bias of an RSA-encrypted piece of data; Hal Finney and others have written about this in the past. Hiding Depends substantially on the image source and the compression methods, if any, used on the image. For instance, a 24-bit true-color image or 8-bit grey-scale image from a scanner with 6-bit resolution will be pretty noisy in the LSBs, and if the Bad Guys are clever enough to find the patterns in them, you can be clever enough to find them and encode your initially-pseudorandom cyphertext stegobits in a way that matches the stats of the noise. On the other hand, if you take the LSBs of cartoon data, with large areas of solid colors, and start dithering them with stegobits, it's obvious you're up to something, if not necessarily what it is - be careful. Ron Rivest posted a message on coderpunks mentioning somebody's suggestion of building an internet-phone sort of program that shoves stegobits into the voice compression. I'd be extremely surprised if you could do that with the fancier compression algorithms, such as CELP, LPC, and friends, but it shouldn't be too hard with the looser compression algorithms such as ADPCM and Delta-Modulation, which need 16-32kbps and can run on really dumb processors - you've got more bits per second to hide in, can get away with stealing more of them, and there isn't any real subtle prediction stuff going on that you've got to work around. Given that most of the popular Internet Phone products don't do encryption (sigh...), this would at least be a good cover. (Well, assuming you've got a credible voice conversation going and aren't saying things like "OK, Carlos, let me send you the secret message starting ... NOW".) [tricks #1,2 - picking your cleartext so the RC4/40 cyphertext or MD5s have chunks of the real stego-cyphertext you want - cute.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Juno Newbies are Great!
by Bill Stewart 17 Dec '03

17 Dec '03

OK, there are lots of spammers, clueless newbies, and wannabes there. There are some cool things about Juno - it's free. Anybody can get on it. Easily. Anonymously, more or less, since they don't need to have your whole credit history to be able to charge you money. At most you need a maildrop. - it's free. Anybody can get on it. Without a government. Without a bureaucracy from Washington who are Here To Help Us Provide Universal Access to the Nationalist Infotainment Infrastructure. Without telling us how to run _our_ systems. - it's free. Anybody can get on it. Anybody can try to compete. There aren't any subsidies, so there aren't any rules, except the usual "make sure you've got positive cash flow soon" and "reputation capital can sell lots of stock." - it's free. Nobody has to be on it. If you don't like the management, you can bail, with minimal investments, and go find better. - it's free. Nobody has to be on it, unlike a government-run NII that you need to pay your taxes, do your banking, register cars, keep your draft card up to date and your papers in order, and can get thrown off if they suspend your Internet Driver's License for six months. - it's free. _I_ don't have to pay for it if I don't want it. - it's free. Any newbie, spammer, or 3133T D00D can get on it, act as stupid as they want, and it's ok, because the public knows (or will soon enough) that clueless people live there and not to take any email from juno.com too seriously - it's not like mail from whitehouse.gov or kremvax.su or cnn.com that you know you'd better read and believe every word of. It's as accurate as the National Enquirer, it's the Net Of A Million Lies, and like Television, nothing to panic over. So, like, relax, chill out, and get procmail or BozoWatch or some other filter, and you not only can get rid of most of the junobots, you can use it to get rid of lots of other spam, and use that new Distributed Reputation Service Platform that Anon(a)juno.com is developing to find the interesting 100 messages per day of the 1000 you receive. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: Domain names - Alternic - Authority
by Bill Stewart 17 Dec '03

17 Dec '03

(The Top-Level Domain Name Wars have been breaking out in Cyberia-L, not a usual place for technical discussion, plus popping up and down in Cypherpunks. Hope y'all don't mind me mixing this to both.) Back when domain names first came in, a number of us didn't believe that a centralized organization could pull it off, especially when it was being done by a collaboration of the US military types and the European Phone Companies, who were well known to be clueless. The email world wasn't just the ARPAnet, it included all of UUCP-land, PCs were starting to occupy their spaces, and there were various DECish things and Berknets and other radically non-conformable architectures and overlapping namespaces. UUCPland worked because a few dedicated people, mainly at Bell Labs and some universities, with lots of time and non-beancounted-non-billed funds, kept track of where machines lived, phone-polled sites that couldn't afford it, tried to keep track of which of the umpty-seven machines named "bilbo" or "mozart" could talk to which others so you could occasionally get mail to someone who lived at ucbvax!allegra!mozart!zorro!bilbo!gandalf and know it was the same bilbo!gandalf you'd talked to last week and maybe get mail to people reliably across complex paths. Pathalias was a cool program that took link data and Dijkstra'd it together into a relatively connected bunch of shortest paths. The idea that Somebody Thought They Were In Charge was annoying to many of us, especially Somebody Bureaucratic. Peter Honeyman set up a bunch of his machines as the .FUN domain for a while; it was run by fun people. Rob Pike and Ken Thompson later wrote a marvelous technical rant called "The Hideous Name" about how locally-based addressing makes far more sense than global - it both reflects reality and lets the decisions about naming and such be made by the people and processes that need to make them. Well, domain names eventually became a raving success, just because it was so much easier to say where someone was (administratively, if not physically) than to guess how to get there hop-by-hop. Separating administrative addresses from routing was an important mental step. Stuff like .BITNET and .CSNET were workable, .UUCP had its real problems but eventually became sort-of-defined relative to uunet, a machine set up as a research project that had turned into a small business. One of the things that made it work well was that any given machine only had to know a manageable amount of stuff - you needed your own subdomains, a path to the top of your organization, a way to recognize that given patterns were high-level domains, and a path to the Root Servers - plus you needed somebody Higher Up to enter your name and address in their administrative database so other people could find you. It's easy to find where to look among a few hundred entries (a few technically-cooperative countries, a few zones for non-countries, and a few hundred countries that didn't really have email :-) Occasionally a country comes on board that your internal nameservers didn't recognize, and you need to get your administrator to add .nl or .kr or whatever. >From that relatively short list, which you don't need any blazingly complex database to administer, you can get anywhere. The standard DNS BIND tries to solve a bunch of complex _local_ problems and work portably in many different environments, but doesn't need to be tuned blazingly complexly to work almost anywhere. The systems that need to go beyond that are the servers for .com and to some extent .edu, which have to keep track of a lot more sites, and places that have complex internal structures or are trying to solve fancy problems like mobile users. But www.joesgarage.com doesn't need to do most of that. I think polluting the top-level domain name space is a bad move. While geographically-based names aren't a great choice for representing non-small organizations, they're short, and if you open up the entire top-level you just complicate everyone's life and in a year or two you'll have as many people carving out space at the toplevel as you currently have in .com, raising the ego levels without making the name space any bigger. Now, I suppose there's a certain nice philosophical position of being able to say "You're .gov.fr - we're .microsoft, and we're at a higher level than you!" or "You're .gov.uk - we're .gov.AnTir, and everybody in _our_ kingdom is there because they want to be!" # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: Internet Drivers' Licenses
by Johnny Eriksson 17 Dec '03

17 Dec '03

Mike Duvos writes: > I am now getting more junk email than email from people I > care to correspond with. It seems one can't even read the > scholarly newsgroups anymore without "Come Watch Us Lick > Ourselves on the Web" messages popping up regularly. How inappropriate. Such messages belongs in rec.pets.cats. --Johnny

1 0

EGO_war
by jya＠pipeline.com 17 Dec '03

17 Dec '03

9-13-96. FiTi: "On manoeuvres in the modern military mind." The most interesting challenge is psychological. Participants learn the hard way that they cannot simply command. They must persuade, cajole and win over subordinates, allies and politicians, who may have varying agendas. While lower level command requires physical courage and speed of decision, higher commmand involves moral courage, intellectual vision and perseverance. "Politicians are being pressed by interest groups on all sides, while the military will usually only focus on their aspect of the task. The collision of those two sets of values can be quite a shock." The more subtle message from the historians is the lethal potential of petty jealousies, warring ambitions and clashing egos. ----- http://jya.com/egowar.txt (16 kb) EGO_war

1 0

ISC Meeting Agenda
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Sat, 14 Sep 1996 08:53:40 -0400 (EDT) From: Michael S Baum <baum(a)world.std.com> To: www-buyinfo(a)allegra.att.com Subject: ISC Meeting Agenda Mime-Version: 1.0 ========================================================== MEETING NOTICE ========================================================== Please correspond with: Michael S. Baum, Esq. 33 Tremont Street Cambridge, MA 02139-1227 USA V: +1 617.661.1234 F: +1 617.661.0716 E: michael(a)verisign.com Subject: INFORMATION SECURITY COMMITTEE MEETING NOTICE Dear Committee Member: You are cordially invited to participate in a meeting of the Information Security Committee, Section of Science & Technology, American Bar Association, on Friday/Saturday, October 18-19, 1996, in Boston. The Committee will advance its development of commercial key escrow guidelines as well as consider digital signature legislative initiatives in the several States and other jurisdictions, and continue its consideration of digital signature evidence and liability. Consistent with Section policy, ISC meeting participants MUST be members of both the ABA and the ABA Section of Science and Technology. Please contact Ann Kowalsky, Manager Section of Science & Technology, at ABA offices in Chicago by phone: +1 312.988.5599, fax: +1 312.988.5628, or email: sciencetech(a)attmail.com for membership information. It is possible to become a paid member of the ABA and the ISC at the meeting. Dan Greenwood, ISC member, has kindly agreed to host the meeting at the Information Technology Division of the Commonwealth of Massachusetts. Dan can be reached at 617.973.0071 or DGreenwood(a)state.ma.us for directions & logistical information. Meeting details appear below. I look forward to seeing you in Boston. Sincerely, Michael S. Baum Chair, Information Security Committee Section of Science & Technology, ABA --------------- INFORMATION SECURITY COMMITTEE October 18-19, 1996 Tentative Agenda (see "Meeting Details," next page) (In extended sessions, breaks will be taken as needed.) October 18, 1996 Friday 8:30-9:00 Greetings, breakfast, administrative matters. 9:00-9:30 Introductions, meeting logistics, Guidelines update, questions; PKI-relevant standards reports. 9:30-12:00 Legislative/Regulatory Update (including open conference call with digital signature leg./reg. drafting committee representatives in the US and abroad). 12:00-13:00 Joint lunch with Boston Bar Assn, Computer Law Committee. 13:00-18:00 Continuation of legislative/regulatory update with digital signature leg./reg. drafting committee representatives. 18:00-???? Watering hole discussions; possible continuation of work group meetings. October 19, 1996 Saturday 8:30-9:00 Breakfast, et cetera. 9:00-10:00 Presentation by Key Escrow work group. 10:00-12:00 Breakout sessions on work groups. 12:00-13:00 Working lunch and guest presentation on "Assuring Quality and the Accreditation of Certification Authorities" by invited representative of the Nat'l Inst. of Standards and Tech. 13:00-15:00 Presentations by Work Groups. 15:00-15:30 Path Forward; wrap-up. ISC MEETING DETAILS October 18-19, 1996 Members are urged to participate in one of the work groups that will be presenting/meeting during the ISC's meeting. "Addendum" Work Group Contact: Ruven Schwartz (rschwart(a)research.westlaw.com) Tom Smedinghoff (tsmed(a)mbc.com) Joe Wackerman (jwackerm(a)email.usps.gov) The Addendum Work Group will continue drafting a digital signature trading partner agreement -- integrating the principles of the Digital Signature Guidelines, and developing additional practical commentary for this model form of electronic commerce agreement. Evidentiary Work Group Contact: Stan Kurzban (qbjw99a(a)prodigy.com) or Serge Parisien (parisise(a)droit.umontreal.ca) The Evidentiary Work Group will complete and present a provisional outline for a tutorial on the evidentiary implications of digitally signed information and advance drafting of material for each section of the tutorial. Key Escrow Work Group (KEWG) Contact: Dwight Olson (73522.3542(a)compuserve.com) or Randy Sabett (rsabett(a)venable.com) The KEWG will focus on the legal and technical aspects of commercial key escrow. The group will seek to accurately explore all major issues surrounding this topic, and produce a set of draft guidelines for comment. The proposed guidelines are intended to facilitate secure electronic commerce by clarifying the rights and obligations of the parties involved in voluntary commercial key escrow. The work product may take one or more forms including: (i) a "restatement" of the relevant law and practice, (ii) a model state or federal law or international convention, (iii) a set of principles that can be incorporated by reference into agreements or used for the interpretation of legal aspects of voluntary key escrow, or (iv) a set of "gap filler" provisions. Liability Work Group Contact: Maureen Adamache (rmadama(a)magi.com) The liability work group will meet as necessary to discuss the apportionment of liabilities among PKI providers and users. Previously, this task was considered in the ISC's own work-product, the Digital Signature Guidelines. Future documents that will be considered include Certification Practice Statements, and digital signature legislative and regulatory work product. State Government Digital Signatures Laws & Regulations Contact: Dan Greenwood (DGreenwood(a)state.ma.us) The digital signature legislative and regulatory working group will compile, evaluate and compare the various emerging approaches by states and other jurisdictions. Work product will include a web-based comprehensive "one-stop shop" for jurisdictions wishing to review current approaches. First-time participants (who plan to attend the October 18-19, 1996 meeting) must request attendance and submit a brief work-product (typically 3-5 pages) relevant to the subject matter. Please contact Ruven Schwartz (v: 612.687.8095, f: 612.687.7907, or e: rschwart(a)research.westlaw.com) for details. Meeting Location: McCormack Building (Across Bowdoin Street from the State House) 1 Ashburton Place Room 1, 21st Floor Boston, Massachusetts USA (Contact: Dan Greenwood +1 617.973.0071) Meals: The cafeteria will be available for lunch on Friday for those ISC Members who choose to work through the joint lunch session. On Saturday we will probably order in pizza. Lodging: A very nearby hotel is the Holiday Inn, Government Center, 5 Blossom Street, Boston. The regular rate during our meeting dates is $219.95/night. However, the Reservation Supervisor (Kim) has offered a rate of $199.95 to Committee members who request the "Great Rate" plan. Call reservations at +1 617.742.7630. For a better (but more expensive) hotel near Government Center, try the Parker House at +1 617.227.8600. The Omni Parker House (nicer than Holiday Inn) quoted a rate of $169/night for a single with a king or queen bed and $119/night for a single with a double bed. The rooms are very small - but the hotel is nice. See also a Greater Boston Bed & Breakfast directory: http://www.inovatec.com/bb/resservc/GREATER/GREATER.htm. RSVP: Please confirm your intention to participate to Ann Kowalsky, Section Manager, Section of Science and Technology (sciencetech(a)attmail.com) as soon as possible. See you in Boston! =========================================================================== --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0