December 2003 - cypherpunks-legacy

Hardening lists against spam attacks
by jamie＠comet.net 17 Dec '03

17 Dec '03

A stopgap measure.... Perhaps an X-header that changes weekly, monthly, whatever. Is there a way to configure the list software to reject a message that doesn't have the X-header? This won't stop all spam, but it'd put a damper on a bunch of it. A lot of spammers don't even know what an X-header is (though a lot do), much less how to put one in a message. Lists are one of the last havens from spam, and though spam seems to be the grafitti and billboards of the future, I don't feel particularly amenable to having to waste time hitting the "D" key. jamie ------------------------------------------------------------------------------ jamie(a)comet.net | Comet.Net | Send empty message | Charlottesville, Va. | to pgpkey(a)comet.net | (804)295-2407 | for pgp public key. | http://www.comet.net | "Information wants to be $1.98." -I dunno who said it. ------------------------------------------------------------------------------

6 9

Re: Hardening lists against spam attacks
by John H West 17 Dec '03

17 Dec '03

The idea of distributing tokens by clever and complicated schemes seems interesting as a thought-experiment, but I wouldn't want to have to study the fine art of "cypherpunk posting technique" in order to insert my rare comments into a discussion thread. Charging posting fees is also interesting, but as already discussed, has many weaknesses. An easy solution would be to grant unlimited posting rights to anyone with more than one month's membership in the list. This idea could be called "the endorsement scheme." If anyone wishes to make an anonymous post, their submission would go into a "general pool" along with all the submissions from non-members and people who have subscribed for less than one month. The "general pool" would be a webpage somewhere which has on the screen an "Approve" button which would bring up a "Username/Passowrd" box. Anyone with more than three months membership in the list could apporove messages from the general pool. If the senior member (_any_ _one_ senior member) feels that a post in the general pool is worth sending on to the full list, then the message gets general distribution, date- and time-stamped: "Determined by --your_name_here-- (not the author) to be of possible interest to at least one member of the list." (no problem ... Vulis could still approve his "Huge Cajones Remailer" and his "Suck_My_Big_Juicy_Cock" postings, and none of us will ever figure out where they're coming from) Senior members would never be in any way reprimanded for any item that they forwarded, unless through some "call-for-votes" type of action their item-inclusion privileges were curtailed (that'll never happen). No one can "disapprove" or otherwise block any message from forwarding to the list. The principle to be followed for which items to approve would be "essentially everything." The idea is to strive to not block postings, but to leave "herbal remedy" ads hanging unendorsed. Maybe the unendorsed posts could expire if unendorsed after 72 hours -- of course, the item would be immediately removed from the general pool when it received an endorsement and went to the list. We have to be careful to not cause any legal liability to fall onto an endorser for approving an item (eg, source-code) which is later determined to be, eg, an ITAR violation, a copyright violation, etc. The endorsement must have an effective disclaimer. john

2 1

Re: FinCEN reports from GAO
by John Young 17 Dec '03

17 Dec '03

The GAO reports Woody cites(*) and others are available online at: http://www.access.gpo.gov/su_docs/aces/aces160.shtml Here's a list on money laundering reports, and one which reports on the burgeoning federal law enforcement agencies. (*) Money Laundering: Progress Report on Treasury's Financial Crimes Enforcement Network (Letter Report, 11/08/93, GAO/GGD-94-30). Money Laundering: Characteristics of Currency Transaction Reports Filed in Calendar Year 1992 (Fact Sheet, 11/10/93, GAO/GGD-94-45FS). Money Laundering: U.S. Efforts To Fight It Are Threatened By Currency Smuggling (Chapter Report, 03/09/94, GAO/GGD-94-73). Money Laundering: The Volume of Currency Transaction Reports Filed Can and Should Be Reduced (Testimony, 03/15/94, GAO/T-GGD-94-113). (*) Money Laundering: Needed Improvements for Reporting Suspicious Transactions Are Planned (Chapter Report, 05/30/95, GAO/GGD-95-156). Money Laundering: Stakeholders View Recordkeeping Requirements for Cashier's Checks as Sufficient (Letter Report, 07/28/95, GAO/GGD-95-189). Money Laundering: Rapid Growth of Casinos Makes Them Vulnerable (Letter Report, 01/04/96, GAO/GGD-96-28). Counterfeit U.S. Currency Abroad: Observations on Counterfeiting and U.S. Deterrence Efforts (Testimony, 02/27/96, GAO/T-GGD-96-82). Money Laundering: U.S. Efforts to Combat Money Laundering Overseas (Testimony, 02/28/96, GAO/T-GGD-96-84). Money Laundering: A Framework for Understanding U.S. Efforts Overseas (Letter Report, 05/24/96, GAO/GGD-96-105). ---------------------------------------------------------------------- Federal Law Enforcement: Investigative Authority and Personnel at 13 Agencies (Letter Report, 09/30/96, GAO/GGD-96-154). [Excerpt] Pursuant to a congressional request, GAO provided information on the 13 federal agencies with the largest number of law enforcement investigative personnel. ATF - Bureau of Alcohol, Tobacco and Firearms DS - Bureau of Diplomatic Security CPDF - Central Personnel Data File DEA - Drug Enforcement Administration FBI - Federal Bureau of Investigation INS - Immigration and Naturalization Service IRS - Internal Revenue Service NCIS - Naval Criminal Investigative Service NPS - National Park Service OPM - U.S. Office of Personnel Management GAO found that: (1) 10 agencies employ over 90 percent of federal law enforcement investigative personnel and 3 agencies have 700 or more such personnel; (2) these agencies investigate criminal violations including organized crime, bank fraud, civil right violations, illegal immigration, violations of mail integrity and security, custom, drug trafficking, and money laundering violations, income tax violations, and passport and visa fraud; (3) the agencies derive their investigative authority primarily from statutory laws which are implemented through executive orders, agency regulations, and interagency agreements; (4) the 13 agencies employed about 42,800 law enforcement investigative personnel at the end of fiscal year (FY) 1995 and, except at the Immigration and Naturalization Service (INS), 100 percent of the personnel could execute search warrants, make arrests, and carry firearms; (5) there was a 19 percent overall increase in investigative personnel between 1987 and 1995; and (6) the change in the number of law enforcement investigative personnel ranged from an increase of about 66 percent at INS to a decrease of about 14 percent at the Naval Criminal Investigative Service.

1 0

Kremlin v1.04
by Mark Rosen 17 Dec '03

17 Dec '03

I'm sure you all remember my program, Very Good Privacy, and have been waiting for the release of the new version with bated breath. Well, it's finally here! Only, after being contacted by PGP, Inc. regarding a possible trademark violation, I've changed its name to Kremlin. Remember: it's like an iron curtain for your data. The new version still uses the same algorithms. The algorithms can be grouped into three categories: ASCII and Vigenere, which give little security, but are extremely fast, DES, NewDES, and Safer SK-128, which will protect against all but the most well-funded adversaries, and Blowfish, IDEA, and RC4, which are perhaps the most secure algorithms available today. The key-size of the algorithms ranges from 64-bits (actually 56-bits) in DES to 128-bits in IDEA, NewDES, and Safer SK-128, and infinite length in ASCII, Blowfish (up to 448-bits), RC4, and Vigenere. If the "Hash Passkey" option is checked, then the passkeys are hashed with a 64-bit per-source file salt using SHA1 to form a 160-bit passkey; extra bits not used by the fixed-length algorithms are discarded. Without the "Hash Passkey" option checked, the passkey is only XORed with the salt and retains its original size. If the "Encrypt Headers" option is checked, then the filename and file size of the files are encrypted, giving an attacker no information about the source files. Once the files have been encrypted, you have the option of securely deleting them by overwriting them a user-definable number of times with random data; the most secure encryption algorithm in the world is useless if the plaintext is left unsecured on the hard drive. All of this is done through one simple dialog box. To launch Kremlin, just drag a file or directory (or a combination of files or directories) onto the Encrypt icon on the Windows 95 desktop. To decrypt a file, just double-click on it and enter the passkey; no unwieldy tabbed dialog boxes or file directory navigation boxes. Plus, as a added bonus, anyone who orders 10 or more copies of Kremlin will receive a can of Spam (TM) for free! For more information on Kremlin, e-mail mrosen(a)peganet.com To download Kremlin, go to: http://www.geocities.com/SiliconValley/Pines/2690

1 0

new restrictions in EAR (over ITAR)
by Adam Back 17 Dec '03

17 Dec '03

(from "http://jya.com/bxa123096.txt") : a. ``Software'' specially designed or modified for the : ``development'', ``production'' or ``use'' of equipment or ``software'' : controlled by 5A002, 5B002 or 5D002. : b. ``Software'' specially designed or modified to support : ``technology'' controlled by 5E002. large integer libraries? (modexp functions?) : c. Specific ``software'' as follows: : c.1. ``Software'' having the characteristics, or performing or : simulating the functions of the equipment controlled by 5A002 or 5B002; : c.2. ``Software'' to certify ``software'' controlled by 5D002.c.1; this one (I presume) is addressed at people like microsoft with CAPI certifications, you can't export the signing software : c.3. ``Software'' designed or modified to protect against malicious : computer damage, e.g., viruses; - Virus scanning software? (Winn Schwartau's info warfare hype is rubbing off on the spooks) Makes one wonder, if it's purportedly in the national security interests to bar the export of virus scanners (of any quality), logically it's also in the national security interests for the NSA to write and distribute virii. - Programs which checksum themselves as a crude check against viruses/modification? (some _operating systems_ qualify on this basis) - md5file from rfc1321? (rfc1321 is the MD5 rfc, md5file checksums files with md5, useful for checking what's changed)? - firewalls! (whoops there goes a few more million in US trade) Madness, Adam -- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: Hardening lists against spam attacks
by Bovine Remailer 17 Dec '03

17 Dec '03

So, we had a spike of spam attack around Christmas, primarily using the mechanism of subscribing the cypherpunks list to other mailing lists. Now, everybody is off designing methods to limit postings to the list. You know what this reminds me of? The enthusiasm displayed by the the current US government administration to get bills passed that would curtail even more rights of its citizens in the wake of the TWA flight 800 crash. Cypherpunks, you have met the enemy and it is you.

2 1

benefits of EAR (not)?
by Adam Back 17 Dec '03

17 Dec '03

Reading through "http://jya.com/bxa123096.txt": > 1. This interim rule has been determined to be significant for > purposes of E.O. 12866. A cost benefit analysis has been prepared and > is available upon request by contacting James A. Lewis at (202) 482- > 0092. Anyone availed themselves of this offer of a CBA for EAR? Just curious as to what the supposed benefits are :-) Adam -- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

4 3

Join Us "Special Conference Call"
by carrollw＠cadvision.com 17 Dec '03

17 Dec '03

Hello opportunity seeker, For most people, finding the RIGHT opportunity that provides the FREEDOM and the right CASH flow to earn a living working from HOME is a DREAM at best. Team 2000 has joined a company that has all the INGREDIENTS for this wish to be fulfilled and I extend a very CORDIAL invitation for you to join our Team 2000 TOLL FREE conference CALL on: THURSDAY Evening, January 2, 1997 You are invited to a Special Toll Free Conference Call with ... 1. The President of Idea Concepts, Ken Hampshire 2. The Co-founder of Idea Concepts, Steve Miles 3. Other key leaders of Idea Concepts 4. The Team 2000 Leaders 5. Most importantly: YOU Hear about the products, compensation plan and exciting late breaking news on this call! Please, write this number down now and put it on your calendar for Thursday night, January 2, 1997. At the appropriate time for you,(in your time zone) call 1-800-556-3844 9:30 pm Eastern Standard Time 8:30 pm Central Standard Time 7:30 pm Mountain Standard Time 6:30 pm Pacific Standard Time You may call in 2-3 minutes before the actual time. If you call in too soon you will get a busy signal, so just keep dialing back in. Your questions will be answered Thursday night on the TOLL-FREE Conference Call. In the meantime you may wish to review information on our website and follow the links: http://www.ideaconcepts.com Best Regards for a Healthy, Happy and Prosperous New Year! Wayne J Carroll Team 2000 - Leader

1 0

Travel Discounts
by travlpls＠netside.com 17 Dec '03

17 Dec '03

Fuck_God_Up_The_Ass, How would you like to save 65% on all your leisure and business travel? Save at thousands of fine hotels, resorts and condos, all around the world. Also, save on airfare, cruises, car and RV rentals, special attractions and MUCH MUCH more!! That's just the tip of the iceberg! For a limited time only, we are offering a golf package which includes 50% off green fees at over 2,000 golf facilities. This travel package will pay for itself the first time you use it!! *START SAVING NOW!! SIMPLY HIT REPLY AND TYPE "DISCOUNTS"*

1 0

stupid remailer-ignorant stud3nt caught by NY polic3
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

http://www.nytimes.com/yr/mo/day/news/national/psychopaths-educ.html Potential Killer or Just Disturbed? Psych Class Seeks Distinction By KAREN W. ARENSON NEW YORK -- The 20-year-old man with a Mohawk haircut, multicolored pigtails, tattooed arms and rings on every finger was an engineering student at a New York college when he sent e-mail to a public official threatening to torture him and rape his young daughter. The FBI arrested the student a few days later as he sat in his pajamas eating breakfast. Late last year, the case landed on the desk of Dr. Naftali Berrill, a forensic psychologist who had conducted court-ordered examinations of Joel Rifkin, the serial killer, and Colin Ferguson, the Long Island Rail Road killer. Now, Berrill is using the e-mail case in the class he teaches at John Jay College of Criminal Justice in Manhattan. The class is part of the college's fastest-growing area of study: forensic psychology. Six years ago there were 96 students in the masters program; now there are 271. "There is a fascination with this stuff," said Berrill, who assigns movies like "Klute," "Silence of the Lambs" and "Psycho" as homework, along with articles in scientific journals. "Popular culture has gone nuts with the idea of taking someone who has committed a crime and profiling the person, thinking about why he did it, what is behind it." The goal on a recent day was to get his students to judge whether the tattooed man was fit to stand trial, whether he was legally responsible for his behavior, or whether he might be considered legally insane, and whether he is in need of treatment. Berrill had evaluated the man and knew the court's ruling, but he wasn't about to tell his students until the exercise was over. "How should the young man be handled?" he asked the students. "Is he really dangerous or is he only sick? Is prison appropriate or does he need medical treatment?" First, the students wanted more information. They did not have the young man to question, so they began firing questions at their professor. Did the young man have prior problems with the law? Berrill shook his head no. Any history of psychological problems? Berrill reported that the young man had "apparently always been an odd duck, a person who felt separated from the group and who capitalized on his oddness." Since his arrest, he says he has had fleeting ideas of killing himself. How did he behave when arrested? He spoke quietly and his speech was fluent, articulate and terse. His reaction was more surprise than remorse. Any other unusual behavior? He used to have fantasies of protecting people beset by attackers. Sometimes he sensed the taste of chocolate, even when he had none in his mouth. Sometimes he walked around New York City with knives strapped to his chest and arms. For half an hour, the psychological sleuthing continued: What kind of family history did he have? He was the last of several children in an Irish-American working-class family, and he had brothers who had been arrested for drug use. Was he overprotected and coddled? The young man had said he was well cared for, but it was difficult to learn whether there was true affection. Finally, the students were ready to lay out their theories. The young man showed signs of a narcissistic personality disorder or a histrionic personality disorder, some said. He might have sent the e-mail message just to get attention, adding the rape threat for shock value but not really as something he intended to carry out. One group thought the student himself had been abused. And some saw his threats as reflections of his own sexual inadequacy. Some students suggested blood tests and psychological tests to see if he was depressed. For many students, the analysis was better than an evening in front of the television set. "I love it," said Adrienne Higgins, a former florist who returned to college and hopes to go on for a Ph.D. in neuropsychology. Eva Norvind, who has a master's degree in health education and counsels sexual deviants, calls the class one of her most challenging. Some students go on to earn doctoral degrees in psychology and begin a practice. Others go to law school, and still others go into social service or police work. But Berrill estimates that about a third of the students take the class to indulge in their own fascination with crime. Berrill got to the heart of the question: "If you were in law enforcement, is he a dangerous person?" Most class members nodded yes. The most telling piece of evidence, said one student, was "the fact that he was walking around the city, like an armed bomb waiting to go off." And the dissenters? "He needs help. I am very concerned about the homicidal and suicidal thoughts." Another commented, "In terms of being dangerous, he has no history. His use of e-mail shows a fear of social contact, and that doesn't fit the character type of a killer." Berrill was pleased. He had one more question: Does the young man have a shot at the insanity defense? No, most students said. "He was aware of everything he was doing," said one. "But he would be helpful to an attorney." Berrill beamed. In his view, the class had captured the important elements. "If I were asked by a judge," he told them, "I would say he is dangerous. Always err on the conservative side. He is in need of mental health services. But incarceration? No. He is not psychologically equipped to deal with real criminals or psychopaths." The court concurred. Earlier this year, a judge put the young man on probation and directed him to seek psychological counseling. - Igor.

1 0