December 2003 - cypherpunks-legacy

Re: Secure anonymouse server protocol: comments please
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 07:24 PM 9/2/96 +0000, paul(a)fatmans.demon.co.uk wrote: >The following is a very sketchy plan for a secure protocol for an >anonymous server which allows replies without storing a recipient >database in the clear. Several people have talked about this sort of thing recently, inluding William Geiger, Doug Floyd, and myself. Lutz Donnerhacke's Jenaer Anonymous Service <anon(a)as-node.jena.thur.de> actually implements it (send it mail saying "help".) Rather than using a human-selected userid, it uses the PGP keyid to make IDs like anon-1a2b3c4d(a)as-node.jena.thur.de. >This system has 1 huge fault, we can encrypt a uses ID with the >servers public key to see what his ID in the encrypted database is >and therefore identify him, maybe we need two seperate server public >keys, and when IDs come in encrypted with key1 (the one it releases) >it decrypts with secretkey1 then encrypts with publickey2 (the one it >keeps secret) If you encrypt the id using raw RSA and constant padding, this is a risk. If you encrypt it using PGP, which uses a random session key, it's not. If you encrypt it using raw RSA and pad the id with a random nonce, it's also no risk. In the latter two cases, the encrypted material is different every time, so you can't compare with previous messages. The Jenaer nymserver avoids this by using a remailer approach - you send an encrypted message with a Reply-To: header telling where to send the accumulated mail (which may, of course, be another nymserver), and it delivers it using mixmaster. This frees you to send your pickup requests by anonymous remailer as well. It's still not risk-free, since if Bad Guys crack the remailer or force the operator to operate it while they monitor it, they can see pickup requests, but it's far more difficult to do that than to just steal the box, and there's no database on the box that's useful to steal. Lutz does recommend chaining your Reply-To: to another nymserver, but it's already very secure. I don't remember if he gets fancy and requires the pickup requests to be signed by the key of the owner or not; the only difficulty with this is the syntax of PGP, which is "fixed in 3.0". Hal Finney has also suggested a system that, instead of delivering anonymous email to the recipient, sends a message saying "You have anonymous mail, receipt #123456. Send back this ticket to pick it up." and you can extend the syntax to handle automatic blocking requests and automatic deliver-everything requests. This is fairly easy to extend for anonymous mailboxes and datahaven code. I've wavered between the delete-on-retrieval model, which is fine for email and not very useful for samizdat, or the delete-after-some-time-period-or-request model, which is useful for both but makes it easy for users to turn you into the local pirate-warez-and-child-pornography server. If you extend the model and charge digicash for storage, it becomes a much cleaner solution. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

No Subject
by nobody＠replay.com 17 Dec '03

17 Dec '03

patrick b cummings <hack5(a)juno.com> wrote: > their is a new mailing list for all you > hackers > just email your name or handle and e-mail address and youll be subscribed > send information to hack5(a)juno.com k00l d00de.... c'mon Varney, we know its you.

1 0

No Subject
by Ben＠explorateur.quaternet.fr 17 Dec '03

17 Dec '03

suscribe me

1 0

Re: What is the EFF doing exactly?
by James A. Donald 17 Dec '03

17 Dec '03

At 06:52 AM 9/3/96 -0500, Jon Lebkowsky wrote: > "Uncompromising" is not an "element of legislative influence," at least not > on this planet. Dead wrong: The pols always say "We would like your help in writing legislation, but if you want to contribute to the legislation you must accept reasonable compromise". But we do not want legislation, so we do not want to help write legislation. We want to delay legislation for as long as possible, for the longer the delay, the more the balance of power favors the net and disavors the pols. Therefore the correct strategy is simply to attack any politician who shows any interest in legislating on our issues. We have no friends on Capitol hill, and if we did have friends, it would still be necessary to denounce them as enemies. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: What is the EFF doing exactly?
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

agree with all of BS's points... >Anonymous remailers support several things I want to do, >and that I want other people be able to do: >1) Let people have private conversations without being identified >by third parties. >2) Let people have private conversations without being identified >by each other, voluntarily and respecting each others' rights. >3) Let people broadcast things to the public that they might >be afraid to do otherwise. >4) Let people broadcast things to the public without their >reputations, good or bad, affecting readers' reactions. >5) Let people experiment with different personality and >conversation styles, though this doesn't strictly require anonymity. >6) Let people communicate with government officials without risk. I suspect all these items can be accomplished using means other than anonymous remailers. anonymous remailers are a good start, but possibly there is still technology waiting to be invented to support some of these features. one possibility that I'm very interested in: consider that Usenet was not built from the ground-up to support anonymity, nor was the sendmail system. when anonymity was introduced to Usenet, everyone went crazy, and it was only marginally supported. I think I may work on some technical proposals along these lines for future posting here, because much of this dialogue has me thinking. what cpunks might consider doing is creating an alternative message distribution system like Usenet that starts from the premise that anonymous communication is allowed and trying to grow it. btw, McCullagh's and other's claims about "ghettoization" of anonymity strike me as very specious. as long as people can use anonymity in some forum they want, I think that's acceptable. what's the equivalent of a "ghetto" in cyberspace? you can't go into a meeting of professionals wearing a ski mask, although you might be able to create such a forum yourself. does that mean you are in some kind of a "ghetto"? oh, brother.

2 1

Re: Pseudocrypto detector is going wild
by winsock＠c2.net 17 Dec '03

17 Dec '03

Is it just me, or is the snake-oil frequency factor scaling up? We used to get this stuff quarterly, and now it's monthly, if not weekly! slither-squeek I think enquirer must be overloaded with ammo, and I am sure in the mood for it now. me

1 0

SecurID White Paper
by Peiter Z 17 Dec '03

17 Dec '03

SecurID Vulnerabilities White-Paper Due to increased recent interest that has been witnessed on the net about the SecurID token cards and potential vulnerabilities with their use, we offer a white paper on some of the vulnerabilities that we believe have been witnessed and/or speculated upon. This paper is being put forth into the public domain by Secure Networks Incorporated and is available at the following URL : ftp://ftp.secnet.com/pub/papers/securid.ps Topics dealt with in the paper include: . Race attacks based upon fixed length responses (still valid even with the current patch) . Denial of Service attacks based upon server patches . Server - Slave separation and replay attacks . Vulnerabilities in the communications with the ACE Server . A quick analysis of the communications with the ACE Server . Problems with out-of-band authentication We hope this paper provides insight, enlightenment, and is helpful to the security community in general. thanks and enjoy, Secure Networks Inc.

1 0

Re: What is the EFF doing exactly?
by Jon Lebkowsky 17 Dec '03

17 Dec '03

At 12:04 PM 9/3/96 -0700, Stanton McCandlish wrote: >> I, unlike EFF, have never compromised my efforts to make strong crypto, >> unescrowed strong crypto, and digitial communications, free from the FUD >> spouted by government and media alike. I, unlike EFF, have never >> compromised my efforts to resist the expansion of a wiretap state. I, >> unlike EFF, have never proported to be a political represenative for these >> positions and folded under the weakest of pressures like a reed. > >EFF has done none of that either. > >Compromise: 1. a settlement in which each side gives up some demands or >makes concessions. 2. a) an adjustment of opposing principles, systems, >etc., by modifying some aspects of each b) the result of such an >adjustment. 3. something midway between two other things 4. a) exposure, >as of one's reputation, to danger, suspicion, or disrepute b) a >weakening, as of one's principles, ideals, etc.) as for reasons of >expediency. > >1 did not occur. EFF yielded nothing on any of the issues you mention. >On Digital Telephony, which you clearly allude to, EFF opposed >implementation of the wiretapping provisions of the CALEA bill from start >to finish, and was instrumental in stripping most of them out, replacing >them with new privacy protections. 2 did not occur. Our mission remains >unedited from the day it was adopted, and EFF is just as committed to those >principles now as ever. We don't have a system, in the relevant sense, >as such. There was no such adjustment, ergo no result of one. 3 does >not apply in any relevant sense (our steadfast assault against the CDA is >a "compromise" under such a definition because it was neither a total >victory, nor a total loss - yet I'm certain this is not the definition of >"compromise" that you intend). 4a is not relevant (that's the >security/secrecy-related definition, a nonsequitur in this context). 4b >is simply a restatement of 2a - simply didn't happen. Our results speak >for themselves on this. Compromise is not necessarily a bad thing; without some give and take, we sorta run right over each other. OTOH, I do agree that a strong position is necessary at this juncture. -- Jon Lebkowsky http://www.well.com/~jonl jonl(a)hotwired.com

2 1

Re: Schelling Points, Rights, and Game Theory--My article
by ddfr＠best.com 17 Dec '03

17 Dec '03

Tim May mentioned my article on this subject. It is: "A Positive Account of Property Rights," Social Philosophy and Policy 11 No. 2 (Summer 1994) pp. 1-16. It can be found from the academic part of my web page: http://www.best.com/~ddfr/Academic/Academic.html David Friedman

1 0

EDyson CPF 95 item
by Stanton McCandlish 17 Dec '03

17 Dec '03

If anyone does did that up, please bounce one my way, so I can add it to the archives. Any other good stuff from that CFP would be of value too. Ditto for CFP96. I think the newest CFP transcripts we have are 94. -- <HTML><A HREF="http://www.eff.org/~mech/"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org/"> Electronic Frontier Foundation </A><P> Online Activist </HTML>

1 0