December 2003 - cypherpunks-legacy

Re: Remailers and ecash
by Anonymous 17 Dec '03

17 Dec '03

Using a remailer doesn't hide the fact that the sender is using a remailer. An eavesdropper who monitors incoming messages to the remailers can easily learn who is using them. A constant bandwidth connection will at least disguise *when* the messages are sent.

2 1

Re: Remailers and ecash (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 1 Oct 1997 11:03:36 -0400 > From: Anonymous <anon(a)anon.efga.org> > Subject: Re: Remailers and ecash > Using a remailer doesn't hide the fact that the sender is using a > remailer. An eavesdropper who monitors incoming messages to the > remailers can easily learn who is using them. A constant bandwidth > connection will at least disguise *when* the messages are sent. Huh? An eavsdropper can't use a clock to note when the packet was sent? I don't think so... ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: DejaVu: Cypherpunks as Philosopher Kings
by Blanc 17 Dec '03

17 Dec '03

Attila T. Hun wrote: > the sleezeball, who intends to make J Edger look like a piker at > surveillance, has the gleam of unabridged power in his eyes. Louis > F[reeh,uck] is charming, even disarming, as he tells a Congressional > committee: > > "We are potentially the most dangerous agency in the > country if we are not scrutinized carefully." (Jun '97) ............................................................................ Since he says "we are ... dangerous ... if .... we are not scrutinized carefully", I interpret this to mean that he is advising and warning that the agency therefore *needs* to be kept under watchful surveillance, lest it develop to the level of its worst potential. .. Blanc

2 1

RE: "Show me an example of terrorists using the Internet or crypto"
by rab＠stallion.oz.au 17 Dec '03

17 Dec '03

Cynthia Brown wrote: > On Wed, 1 Oct 1997, Alex Le Heux wrote: > > > You people just don't get it do you? A gun has one purpose: To kill. > Just like > > any other tool, a gun, if it is available _will_ be used at some > point. > > > > So making sure there are lots of guns around only serves to make a > lot of > > people very dead. This is a Bad Thing. > > > > Gun control laws are not the issue. It's a matter of mentality. In > Europe, > > where we have rather strict guncontrol laws, and have had them for a > long > > time a decent human being will not even think of shooting someone > else. In the > > US, where guns are tradition and part of the American way, many > people would > > not think twice before shooting someone. The result of this is that > the > > number of people getting killed by guns is enourmous, be they > criminals, > > little kids, old grannies, or presidents. > > > > This sucks. > > I agree wholeheartedly. Uncontrolled guns do not solve problems, they > > create them. If most households have at least one firearm, it makes > it > that much easier for a criminal to obtain one by stealing yours while > you > are at work. > > Canada may be regulated to death according to most libertarians, but I > for > one like it that way. I can walk alone and unarmed at night in > Ottawa, > Toronto, etc. without fearing for my life. Can a female resident of > Washington or New York say the same? Our schools do not have metal > detectors > at the entrances because they are not needed. > > IMNSHO the best way to fight crime is not with bigger guns than the > "bad > guys", but with better social programs such as universal health care, > and > improved day care so single parents can show their kids what a > productive > lifestyle looks like. This takes longer than blowing the brains out > of some > teenager that feels his only path to a better life is through crime, > and it > doesn't give the same adrenalin rush. However, it works at the source > of > crime, and not the consequences. This kind of talk makes me sick. For a start universal healthcare is totally unaffordable, when there is little or no cost the end-user over use of the services provided are inevitable, just look at Medicare here in Australia. Social security above certain levels leave recipients unmotivated to take responsibility for their own lives and is a bad example to their children, who will probably number largely among those teenagers who do turn to crime. > Cynthia, unrepentant bleeding-heart liberal Robert, unrepentant dry. > =============================================================== > Cynthia H. Brown, P.Eng. > E-mail: cynthb(a)iosphere.net | PGP Key: See Home Page > Home Page: http://www.iosphere.net/~cynthb/ > Junk mail will be ignored in the order in which it is received. > > Klein bottle for rent; enquire within. > > >

1 0

please send cyberpunk remailing list
by H. Smith 17 Dec '03

17 Dec '03

Thamks H. Smith

2 1

Re: Remailers and ecash
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >On Wed, 1 Oct 1997, Anonymous wrote: >> Using a remailer doesn't hide the fact that the sender is using a >> remailer. An eavesdropper who monitors incoming messages to the >> remailers can easily learn who is using them. A constant bandwidth >> connection will at least disguise *when* the messages are sent. > >Using a constant bandwidth connection just to the remailer network is >a waste. Better set up such a connection to a Pipe-net or Onion >Router network. The you can use the pipe for other services then >mail. A welcome side benefit would be that this conceals the use of >"mail" remailers Agreed, mostly. But your solution would be more expensive. "Constant bandwidth" does not mean you have to soak up every available bit, it just means you your usage should be consistent and look the same from the outside whether you are sending things or not. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDJ3+5aWtjSmRH/5AQHmxQf9EMHzudkOYcFu6eCB2saHw7DVZqaIesfL KCsPrszA8HlE6UrsiaRGbF9z+8etGOnTrQT0ApConGDpGoOj97oUpN4wy2xy0BwJ eo3dXG3uihH3IyesgHLbYEYlqgyZVx2hrpbQ/Hfz0SaWbfunBLgswnemhIyt5jEO kuxBkG/YrFiO4ZTIAcnBVku2xcPKxL4cRsNNE3CrqJZTVcmM9Kk/OoIuYKjBoDa1 5X+/b3JNQZE2e4Rdra0DljmSq4fE1o6vswNuMhKh0wzRXi7hm3D+irS2xtX7bg25 5tw+CquYwRJaJ8PfyTX2DrBl0C4R2HvFpZUr1X89CTwM1xlFbzpKwg== =mmcG -----END PGP SIGNATURE-----

1 0

Re: Remailers and ecash
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Bill Stewart wrote: >Latency is essential to security, though high volume reduces the >latency that's needed to get a given level of security. Latency may be a means to get security in the current remailer design, but it is a means to the end and not the end itself. This doesn't mean we shouldn't use latency to get security, but it is undesirable, like using cinderblocks for construction. The reason I point this out is that it is important to separate design choices to achieve a goal from the goal itself. If we had a remailer network in which each customer had a constant bandwidth connection to one or more remailers, you could have zero latency mail. (Actually, this would be nice to use with those Comsec phones.) It is my understanding that serious naval vessels like aircraft carriers use constant bandwidth channels to defeat traffic analysis. That is, to every place they might wish to communicate, they continuously broadcast encrypted information. Most of the time the channel is empty, of course, but nobody outside can tell when. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDHpnZaWtjSmRH/5AQF2Awf6AoTd0EnojWRoLGsTqVgkZdirRWqFcNNk nYE7Eh455GxPPfsapn/Q811cmzflrC6TUE6sY0sga/hdpQy4IgPsgRDnC5d+LCWR gO8CEwGXkd6Gl3DEduIL2k7eKeuXoZqK1VVgcEnY4Vsci4yJhcl/FLOx5yGcEVNM 850LGQz/PgEg1XhoMpeOkSBh7vtX+nMOyENzALwf11sg/64tKRCCTHfqgfKSn1tC IT6yrZ2NqUvMPxbomZ4U9DPsc0oz0TggrqHQneNWw1lYjzPDpXRn8jiSlalTZcFs kYFeyQQbw23e0Y/Qevtjn8/QngF/4BcyC21mPxaz35U1EwiFV0Lp/Q== =tfWS -----END PGP SIGNATURE-----

4 3

An e$Lab competitor?
by Robert Hettinga 17 Dec '03

17 Dec '03

Now I know how the Wright Brothers felt when they found out about Langley and Bell... ;-). Cheers, Bob Hettinga --- begin forwarded text Mime-Version: 1.0 Date: Wed, 1 Oct 1997 09:37:44 -0700 From: jmuller(a)brobeck.com (John D. Muller) Subject: An e$Lab competitor? To: e$lab(a)vmeng.com Sender: <e$lab(a)vmeng.com> Precedence: Bulk List-Software: LetterRip 2.0.1 by Fog City Software, Inc. List-Subscribe: <mailto:requests@vmeng.com?subject=subscribe%20e$lab> List-Unsubscribe: <mailto:requests@vmeng.com?subject=unsubscribe%20e$lab> From MecklerMedia's http:/www.internetnews.com E-Transaction Lab for Financial Firms Opens in NYC [October 1] New York City-based Transaction Information Systems (TIS), an integration and information technology consulting company, opened FLITE <http://www.flitelab.com>, an open software factory dedicated to building electronic commerce solutions for the financial industry. In addition to TIS, the founder of FLITE, there are approximately 20 member firms, including Digital Equipment Corp., ad agency Foote, Cone and Belding, IBM, Lotus Development Corp., Reuters, Sybase, and Visa. FLITE is physically located in the former home of the historic New York Lawyers' Club at 115 Broadway in downtown Manhattan. FLITE allows sales, marketing, and information technology executives to interact with a variety of online trading systems, 401(k) management products, three-dimensional visualizations of financial data, and other electronic commerce and interactive customer service solutions. "This one-of-a-kind software factory enables financial institutions to increase sales and market reach via the rapid deployment of their financial products through multiple distribution vehicles, including the Internet, kiosks, display cellular phones and TV sets," said Bob Gold, President of TIS. "In one place, they can experience and visualize more electronic commerce and customer service applications for the financial industry than anywhere else. FLITE's design process and electronic commerce tools allow us to roll out transactional Web sites in half the time and at half the cost of the industry average." FLITE is a working lab that financial institutions can use to produce innovative products. Marketing/sales executives use the facility to learn to think interactively and develop Internet strategies, build product prototypes rapidly and conduct focus groups. Technology staffs can use the facility for jointly developing interactive products with FLITE engineers, use FLITE's specialty rooms (user interface optimization, 3-D visualization and quality assurance testing), and get hands-on training and knowledge transfer. As a factory, FLITE has specialized machinery and tools for building transactional Web sites and delivering products through interactive distribution channels, TIS said. FLITE has a variety of hardware servers, workstations, laptops, kiosks, televisions, display phones, touchscreen monitors, and financial trading equipment. "FLITE combines the promise of new technology with the city's financial heritage," said Gold. "Unlike other companies who have put research and development facilities in the suburbs, TIS believes that its downtown location in the heart of Wall Street attracts the top talent in the industry and makes it accessible to financial industry executives." --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Encrypting Pagers is Easy! [Overview, technical tradeoffs, crypto]
by Bill Stewart 17 Dec '03

17 Dec '03

One of the articles on the White House Pager Hack quoted a government official saying that encrypting pagers would be complicated and difficult. http://jya.com/potus-hack.htm http://www.inch.com/~esoteric/pam_suggestion/formal.html In fact, it's available today from several sources: 1)Digital PCS, in TDMA, GSM1900, and CDMA, though US coverage isn't complete (as of May 97, AT&T had service in 40% of the US land area, 80% population, and the GSM1900 players are expecting wide coverage later this year (e.g. PacBell and OmniPoint), plus Sprint PCS and other players are there.) There's a white paper on AT&T's Digital PCS at http://jya.com/digipcs.html which talks somewhat about the security. Phil Karn's posted some articles in the past about on the NSA's armtwisting that kept the cellphone encryption from being strong enough for serious security, but if it's not good enough for the White House, that's somewhat their fault. 2)Motorola's extremely cool PageWriter 2000 is a ~2"x2" programmable beeper with keyboard, 160x240 screen, crypto, operating system, and infrared. http://www.mot.com/MIMS/MSPG/Products/Two-way/pagewriter/ says it uses the Flex Operating System and ReFLEX 2-way paging; the person who showed me the beta version said OS9 and GSM. I'd guess that Flex is OS9 with bells and whistles added, and that the pager's CPU is a 68000-family chip, and that either he's wrong about GSM or there's a second flavor coming out that does GSM. In any case, it's user-programmable, and Motorola has crypto support. 3)If you insist on pager service that's not part of the cellphone or beeper you were carrying already, or want wider coverage, it's still not very hard, and it can be done with or without the paging service's cooperation. 4)PCMCIA cards in your PDA can get alpha pager, CDPD, ARDIS, RadioMail, etc. A cypherpunk replied that the difficulty is the fault of US anti-crypto policy. It's also the fault of spectrum licensing policies creating a small number of players in most markets and restricting what they can do "in the public interest", which has slowed deployment of new radio technology. Making money at it may still be hard, since the government interference fragments on the market and raises costs, but that's a separate problem, and if you can piggyback on existing developments like PCS and CDPD, it's a lot easier. Technology tradeoffs -------------------- Pager-company approaches vs. end-user-based - for the former, you have to convince the pager service and hardware companies there's a market; for the latter, you don't change the service, just send encrypted data using the alpha pager protocols, and soup up your pager to decrypt it. For PCS or CDPD or other radio data systems, it's also just data. If the pager company does the encryption, it's vulnerable to wiretaps and escrow. Relays - in a user-based system, you can either have the message sender do the encryption, which means distributing your code and keys widely, or run a relay box, e.g. Web page with SSL that handles the crypto and paging, letting people who want to page you use a standard web browser. Pager technology vs. crypto horsepower - basic pagers don't have a lot of horsepower, but a general-purpose 8-bit processor chip should be able to do RC4 in near-real-time, and maybe other symmetric-key algorithms. Public-key needs more horsepower - is it too slow for a pager-sized system? Digital cellphones use plenty of CPU to handle voice and dumb crypto, in not much more space, though they do use a lot more battery. If you don't want to custom-build your own pagers, use a pager card in a PDA - the Newton's had this for a while, and has a RISC CPU, so it's fast, and there are HP DOS-based palmtops which are slower, though the new Windows CE machines are probably faster than the previous generation. There'll probably be Pilot PCMCIA versions, though that's slower, and you can use Pilot with Metricom today and use Ian's PGP tools. The upcoming Psion 5 uses a StrongArm CPU; don't know if it does PCMCIA. Crypto issues ------------- What about the crypto protocols themselves? Public-key is straightforward; if you use 1024-bit keys you can even skip the symmetric-key layer and just send 128-character messages (or longer if you want to do Baudot or 7-bit ASCII :-) If you do public-key from the end user, it's secure, but all users need to use your public key to send you messages. If you do public-key from the pager company, all messages are encrypted, but the system is vulnerable to eavesdroppers and Escrow Cops. Does the response channel for two-way paging let you send arbitrary data, e.g. a Diffie-Hellman keypart? Secret key has more choices, with varying vulnerabilities - shared secret with pager company - dumb, works fine, you'd probably have the pager company set the secret key along with the pager parameters, and of course it's an obvious target for escrow and eavesdropping. For a mass-market service, this would be the most likely approach. Alternatively, you could have the manufacturer set the keys, along with setting the pager's internal ID, though that's a major security risk for both official and unofficial escrow (or, as Eric Hughes put it, "an opportunity for simultaneous employment" :-) - user-managed relay from public-key to user's secret-key - instead of paging you, people send public-key messages to your computer (email, web page, etc.), which decrypts and re-encrypts with your secret key. For larger organizations, like the White House Communication Agency or corporate or military groups, this could be run by a shared system which knows all the group's keys. - in either of these cases, you'd probably want to use the shared secret key to exchange a random session key rather than to encrypt the message directly, to reduce known and chosen plaintext attacks. Using RC4 directly doesn't work (known plaintext -> you lose), but can you do things like send IV, and encrypt using (Secretkey,IV) as a key? Or use secretkey XOR IV? Hash(Secretkey,IV) would be better, but probably too slow, though I suppose you could do some cheap hash? traffic analysis questions - if you buy the pager service in cash, it's not very traceable - but how long will this be legal? The relay approaches let your users send you pages without knowing your pager number, which is good, but a phone tap or other eavesdropper can presumably figure out who your relay is sending the message to. Thanks! Bill Bill Stewart, stewarts(a)ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

2 1

None
by Anonymous 17 Dec '03

17 Dec '03

How good will it be to have total conformity? What will be left of singularity? And personality? And you and me? CM

1 0