December 2003 - cypherpunks-legacy

Re: Stronghold
by phelix＠vallnet.com 17 Dec '03

17 Dec '03

>Nope. Like I said, I'm not selling Stronghold or any competing product, I >don't lose anything when someone foolishly buys it, so why should I present >any evidence? I (and several other people on this mailing list) were threatened >by C2Net's lawyers; so to avoid unpleasant disputes, I told them I won't be >publishing whatever I might know about their product. > So, why don't you (and several other people on this mailing list) use the ananymous remailers to present your evidence. Others have wondered why people would use remailers. Here's a prime example. Use the remailer (if you have anything to say).

1 0

Re: "Show me an example of terrorists using the Internet or (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 03 Oct 1997 00:08:09 -0700 > From: Blanc <blancw(a)cnw.com> > Subject: Re: "Show me an example of terrorists using the Internet or > (fwd) > >> Stalkers, thieves, rapists, drug addicts, perverts, etc., or just real > >> animals from the animal kingdom, strike at the most inopportune times, when > >> there are no officially sanctioned police forces around to be of help. > > > >I have to object to the inclusion of drug addicts, they do what they do > >because the legislators and police want to stick their noses in other > >peoples business. If drug addicts resort to crime then society as a whole > >must garner some of the responsibility of putting them in that situation. > > We weren't discussing why people commit crimes against others, Jim. We > were discussing the disagreeability of having & using guns. True but my objection is to the line of reasoning you use to get to where you are. Let me try another example... "Stalkers, thieves, rapists, Jews, perverts, etc., or just real animals..." ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Traffic Analysis (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 03 Oct 1997 05:41:58 -0400 > From: "Robert A. Costner" <pooh(a)efga.org> > Subject: Re: Traffic Analysis > At 02:07 AM 10/3/97 -0500, Jim Choate wrote: > >> For purposes of argument, we could say that a remailer throws away > >> messages that violate usage policies. > > > >Way too high for commercial use. Get it down to something like .01 and that > >would be workable I suspect (haven't done the math). > > You may be confusing actual traffic, with valid customer traffic. (BTW - > the 10% reject figure was totally pulled out of the air. Since there is no > logging on a remailer, I'm just making an educated guess.) Almost all > commercial sendmail implementations reject a large amount of traffic and > call it "spam filtering". It's very effective, but the fact is that > incoming mail traffic is blocked before any program such as a remailer can > see the messages. Some of this is done by IP address, some is done through > other methods. I'm merely suggesting that a commercial remailer will have > similar policies. Duh. Look you picked the numbers and the scenarios, if you got a bitch about 'em talk to yourself...their your ugly baby. > >Course this raises the > >issue of who pays for dumped mail on a commercial box. Should the customer > >pay since it was their action that instigated the drop? Or perhaps the > >remailer since they were selling a service which they didn't provide at > >their discretion? > > For usage policies, I would think it is the originating user's fault. Acceptable. > For > middleman mail rejects, it is the middleman remailer's fault. So how do we rollback the payments if say the nth hop breaks the delivery? If I were a user and one of the remailers dropped the traffic I would want all my money back, I'm paying for delivery to a specific party. It is clear that the n-1 remailers has no claim to the charges since the email was not delivered to the recipient. Yet, it is not fair to take their income simply because some other remailer dropped mail due to a policy problem, which they clearly didn't have since they delivered the traffic to the next hop successfuly. Perhaps the remailer with the restrictive hop should pay the n-1 remailers. This would certainly provide clear financial incentive for remailers to have liberal fair use policies (which I support fully) and act as true commen-carries simply doing a job mechanicaly like the phone system or the network infrastructure itself. The bottem line is that if commercial anonymous remailers will survive they have to be as liberal with handling traffic as my routed is. > For public > key errors, it is the originating user's fault. Is it? If this were commercial systems the key server would NOT be on any remailers involved otherwise we have a prime target for man-in-the-middle attacks. So, assuming the user gets the key and the remailers get the keys from a 3rd party server which delivers the incorrect keys for whatever reason. Who pays for the failure then? To me it looks like the key server, but they aren't involved in traffic control but key control. While it is clearly fair to charge them for costs (say 1 remailer hop) incurred due to bad keys (which could be the original submitters fault), who pays the other remailers who handle the traffic and loose the income through no fault of their own? Also, what happens if the key is good but the software glitches (which is indistinguishable from a bad key at the source level)? Are you proposing we re-send for free all along the chain? I don't think the remailers which succeded will take kindly to that. If the MTBF for a remailer is n then the MTBF for m remailers is n*m. In other words the remailer chain gets less reliable as it gets longer. > >If I understand you the remailer would send outbound traffic to its input > >for distribution to your subscribers? I don't believe it would factor into > >the analysis at all if all the source destinations are the same. Outbound > >traffic from party A that went to party B would be important to track. > > Giving an example that overly simplifies things... I think my idea here was > that for some number of nyms, they would each receive an average of, say, > five messages each day. All five messages would be addressed from the > remailer and PGP encrypted. Let me say it again, traffic analysis doesn't look at the contents, cryptanalysis does. Whether the contents are encrypted or not is irrelevant. The word 'encrypted' NEVER occurs in traffic analysis. You encrypt the contents because it is assumed that the network analysis has already succeeded. Ok, so the recipient has no way to reply to specific parties unless the contents contain the source address in a source encrypted block. In such a case Mallet is going to look at the recipient and begin traffic analysis on them. Which Mallet is going to do as soon as they either submit or recieve traffic from that node anyway. Seems moot. An effective Mallet collects statistics on all participants indiscrimenantly. This is another example of the apparently unrecognized and implicit assumption that Mallet is only going to look at one party in the chain. Bad assumption. Traffic analysis will succeed ONLY if the *network* is analyzed, not some specific node in that network. This sounds like a message pool where a recipient must attempt decode on every packet they recieve. The ones not meant for them fail. I don't believe this is a commercialy viable process because of the amount of work on the recipients machine. I have a further question. The cover traffic that shows up in the recipients mailbox unrequested is spam isn't it? Also, when the recipient uncovers the last block is it going to say "This space intentionaly left blank"? Or can users of your remailer expect to recieve email full of hex gibberish they can't decode since they don't have a key? My suspicion is that if you are sending cover traffic to anything other than a /dev/null recipient with an a priori agreement you are not going to keep your users long. > Four of the messages would be from real people > trying to communicate with the owner of the nym. One would be a bogus > message sent to confuse traffic analysis. Turn those numbers around and you might manage to cover the traffic. The cover traffic MUST be greater than the 'real' traffic to be effective. My suspicion based on about 4 months of playing with MixMaster 1.5 years ago is that this ratio must be several orders of magnitude unless your traffic is measured in the millions+ of transactions per day. > All four real messages would > come into the remailer encrypted to the remailer and addressed to the > remailer. My thought was that fake outgoing messages to the nym would look > identical to real messages, thereby helping obscure the "mix" just a little > better. This helps hide the identity of the sender of the email that is > headed to a nym. All the outgoing traffic better look the 'same' it's nothing but a standard TCP/IP routing header and the contents (which we never look at). The remailer software is irrelevant on this issue. Traffic analysis relies on the stability of the protocols and their source & destination info not what they are used for. As for the rest of it, take the equation I gave in a previous email and feed it into a spreadsheet. Develop the equations that define the network using the same sort of structures and proceedures you use for a travelling salesman problem (check a local library). If you're asking me to do that work then I need money, I'll talk about work for free - I don't do work for free. > email. The remailer keeps this info in an internal database (as it must) > and is not available to anyone other than the remailer software. The remailer only needs records of transactions while a transaction remains un-committed. The only long term record it should keep is the number of transactions processed and how much money is currently on the books. The records are not available unless somebody cracks the box and begins to tool around the OS ... Mallet is pretty sneaky he reads CERT and collects hacker software too. If your remailer is keeping records of transactions after the transactions close you are not secure. You are actualy providing further incentive to Mallet. > Having just spent a year and a half involved in a federal court case over > the 1st amendment right to anonymity on the net, and winning, I'd have to > disagree with you here. Our affidavit specifically mentioned remailers, > among other things. Just exactly where is anonymity mentioned in the 1st? And since it clearly is not how do you extend: ARTICLE I. Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances. Is your claim that the remailer is a press? (I rhetoricaly bet not) If so then every computer irrespective of use is a press and protected. Are you going to follow this line in future cases? Or is your argument that the traffic is speech and therefore the carrier of the traffic is immune to prosecution? If so you may have some problems in the future when the judges and prosecutors get a better clue. Because the 1st's speech clause protects the source of speech not the carrier - that's why the founding fathers specificaly mention freedom of the press - to extend that protection to the carrier. Or did you use the commen-carrier approach? My money is that you used the second line of reasoning which means you can expect it to be over-turned in the coming years. Unless somebody manages to get a court to recognize computers as presses and extend those protections fully or networked computers (not the applications they are put to) in general as commen-carrier the battle isn't over. Now if you throw the 9th and 10th in there (which I further rhetoricaly bet you didn't) you got a winning combo. Rhetorical question: do you realize that all networked computers are remailers at the routed level? Did you extend your argument thusly? ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

New PGP "Everything the FBI ever dreamed of"
by Martin Minow 17 Dec '03

17 Dec '03

An article in today's (Fri, Oct 3) New York Times (CyberTimes) <http://www.nytimes.com/library/cyber/week/100397pgp.html> describes the new release of "PGP for Business Security 5.5," which contains mechanisms that incorporate key recovery mechanism that can either be volontary or be enforced by using PGP's software for controlling a company's SMTP server -- the server can verify that all encrypted messages include the corporate public key (or conform to other corporate policies): "The new version also includes some of the most sophisticated techniques for enforcing this policy through the corporation. The most novel may be a new version of software controlling a company's SMTP server, the machine that acts as the central mailroom for a corporation. PGP provides a software agent that will read all of the mail to make sure that it complies with the corporate policy. This may include requiring all messages to be signed with digital signatures or include a backdoor that the management can use to read the message. If the software agent discovers a message violates the policy, it can either return it to sender or simply log a copy. "PGP implements the backdoor with a central key. Each message is encrypted with both the public key of the recipient and the public key of the management. The message can only be read by someone holding the corresponding private keys, in this case the recipient and the management. The software allows the management to use different master keys for different departments by customizing the software. ... "Bruce Schneier, an encryption expert and author of the popular book Applied Cryptography, said that the new announcement "sounds like everything the FBI ever dreamed of." He also predicts that criminals will find ways to circumvent the restrictions while honest people may be more vulnerable to illicit use of the master key." --- Coincidently, the same issue of the New York Times has an editorial <http://www.nytimes.com/yr/mo/day/editorial/03fri4.html> attacking FBI director Louis Freeh's request that Congress "outlaw the manufacture and distribution of encryption programs the Government cannot instantly crack. Martin Minow minow(a)apple.com

11 15

legal question of DSA-based signatures?
by Anonymous 17 Dec '03

17 Dec '03

I have before me a statement made by Information Security Corp.: "The Comptroller General has ruled that, for the purposes of electronic commerce, DSA-based digital signatures are as legally binding as hand- written signatures." Can anyone verify this?

2 1

Netly News special report: "The Privacy Snatchers"
by Declan McCullagh 17 Dec '03

17 Dec '03

Recently the FBI has started to demand a creepy new anti-privacy law. It requires that all future technologies -- from cell phones to WordPerfect -- include a kind of electronic peephole to let law enforcement agents snoop through your private files and communications without your knowledge or permission. One House committee has already approved the FBI's bill. Such easy access is the fantasy of every unethical policeman and corrupt bureaucrat. Now, the police say they'll never peek through this peephole without a judge's approval. But history reveals that time and again, the FBI, the military and other law enforcement organizations have ignored the law and spied on Americans illegally, without court authorization. Government agencies have subjected hundreds of thousands of law-abiding Americans to unjust surveillance, illegal wiretaps and warrantless searches. Eleanor Roosevelt, Martin Luther King, feminists, gay rights leaders and Catholic priests were spied on. Even Supreme Court justices were monitored. Can we trust the FBI? Visit the Netly News for a special report on The Privacy Snatchers: http://cgi.pathfinder.com/netly/opinion/0,1042,1466,00.html -Declan ------ http://cgi.pathfinder.com/netly/opinion/0,1042,1466,00.html The Netly News (http://netlynews.com/) October 3, 1997 The Privacy Snatchers By Declan McCullagh (declan(a)well.com) ------ ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

1 0

Re: Stronghold
by Anonymous 17 Dec '03

17 Dec '03

Jeff Barber <jeffb(a)issl.atl.hp.com> writes: > This is revisionist history. I can't recall any intimation at the > time that any messages were filtered from the unfiltered list. There were three lists. The unfiltered list did not go through the moderator's hands in any way and continued to received all messages (which is how unfiltered subscribers found out about the problem). The filtered list had the posts approved by the moderated. Then there was supposed to be a "flames" list where the moderator sent posts he had rejected. In theory, the moderated+flames lists should have the same contents as the unfiltered list. Here is the original statement by the moderator laying out his policy: > 3) Cypherpunks who wish to read all posts to the list may do so > by taking advantage of either of two optional lists. The first > (cypherpunk-flames(a)toad.com) will consist solely of messages > expurgated from the main Cypherpunks list. (Those who subscribe > to "flames" will be able to easily monitor my moderating > decisions.) The second (cypherpunks-unedited(a)toad.com) will > contain all posts sent to Cypherpunks. It will be the equivalent > of the current open, unmoderated list. It will appeal to those > who don't want list moderation. > > 6) Because every message submitted to Cypherpunk will be posted > to two of the three sister lists, I don't intend to lose much > sleep over whether or not this or that moderating decision was > perfect. I will do the best job I can, within the constraints > listed here. If I err, it isn't fatal. Everyone who wants one > will have two Cypherpunk venues for their posts. Sounds fair > enough to me. What do you think? Here is a message from a pseudonymous poster laying out what actually happened. Many list members may not have seen this message, unless they were subscribed to the unfiltered list. > Well, as it turns out, a number of messages have made it neither to > cypherpunks nor to cypherpunks-flames. Making matters worse, however, > not only are certain messages being suppressed from both lists, but > even messages mentioning that fact get suppressed from both the > cypherpunks and the cypherpunks-flames lists! and here is a letter to him from the moderator, confirming this fact: > Hi, > > On 7 Feb 1997, Against Moderation wrote: > > > What I object to more strongly and think is wrong is the > > fact that it went to *neither* list. > > Unfortunately, it's not as simple as that. As soon as I can > arrange it with John, I am going to stop moderating the list. > In the interim, I *will not* be sending your post onto either > the Flames or the Moderated lists. This is done for legal > reason. As it is, you have already published a libel on the > unedited list by repeating Dimitri's libel. This exposes you to > legal liability, but as an anonymous poster, you are somewhat > insulated from the consequences of your act. In sum, no messages were filtered from the unfiltered list, which is how cypherpunks who avoided moderation learned of the situation. The messages were eliminated from the regular (moderated) list, but they were not sent to the "flames" list, contrary to the stated policies. No hint was given to the subscribers to the moderated list, which was the majority, that this was being done. Messages referring to these facts were also filtered. A sad episode indeed.

1 0

Anne Wells Branscomb and other information
by Declan McCullagh 17 Dec '03

17 Dec '03

Anne Wells Branscomb has died. She was 68. A longtime communications and computer lawyer, she significantly shaped the world of information and Net-policy. (I met her once, at a Computers Freedom and Privacy conference.) Her short biography is at: http://www.ngi.org/AWB/ On a different note, congratulations to: * Solveig Singleton, the new director of information studies at the Cato Institute. * Bruce Schneier and EPIC's Dave Banisar, for their book released last month, "The Electronic Privacy Papers." * EPIC's Marc Rotenberg and Phil Agre, for their book released this month: Technology and Privacy: The New Landscape, edited by Philip E. Agre and Marc Rotenberg (Cambridge: MIT Press, 1997). * Bob Palacios, former webmaster for the Center for Democracy and Technology, who's moving on to a new job at a Rockville, MD software company. (I understand CDT needs a new webmaster.) Also, I hear the Competitive Enterprise Institute, a free-market thinktank in Washington, DC, is looking for a full-time analyst to do Internet policy work for them. Stuff like privacy, Net-regulation, free speech. Email me for contact info. -Declan ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

1 0

Re: legal question of DSA-based signatures?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: kaye(a)popd.ix.netcom.com Mime-Version: 1.0 Date: Fri, 3 Oct 1997 12:18:36 -0700 Reply-To: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> Sender: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> From: Kaye Caldwell <kaye(a)IX.NETCOM.COM> Subject: Re: legal question of DSA-based signatures? To: DIGSIG(a)VM.TEMPLE.EDU The document to which this refers is posted at: http://www.softwareIndustry.org/issues/docs-org/cg-opinion.pdf At 01:23 PM 10/3/97 -0400, you wrote: >I think I already know the answer to this, but it might be fun to have the >word with the bark on it... > >If you reply to this, I'll pass it on to the cypherpunks list. > >Notice that the question comes through an anonymous remailer. > >Cheers, >Bob Hettinga >--- begin forwarded text > > >Date: Fri, 3 Oct 1997 12:17:32 -0400 >From: Anonymous <anon(a)anon.efga.org> >Comments: This message was remailed by a FREE automated > remailing service. For additional information on this service, > send a message with the subject "remailer-help" to > remailer(a)anon.efga.org. The body of the message will be > discarded. To report abuse, contact the operator at > admin(a)anon.efga.org. Headers below this point were > inserted by the original sender. >Subject: legal question of DSA-based signatures? >To: cypherpunks(a)cyberpass.net >Sender: owner-cypherpunks(a)cyberpass.net >Precedence: bulk >Reply-To: Anonymous <anon(a)anon.efga.org> >X-Loop: cypherpunks(a)cyberpass.net > >I have before me a statement made by Information Security Corp.: > >"The Comptroller General has ruled that, for the purposes of electronic >commerce, DSA-based digital signatures are as legally binding as hand- >written signatures." > >Can anyone verify this? > >--- end forwarded text > > > >----------------- >Robert Hettinga (rah(a)shipwright.com) Philodox >e$, 44 Farquhar Street, Boston, MA 02131 USA >"... however it may deserve respect for its usefulness and antiquity, >[predicting the end of the world] has not been found agreeable to >experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' >The e$ Home Page: http://www.shipwright.com/ >Ask me about FC98 in Anguilla!: <http:www.fc98.ai> > > --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http:www.fc98.ai>

1 0

C'Punk Action Project - Help the Newbie
by Anonymous 17 Dec '03

17 Dec '03

A Law Abiding Citizen wrote: > > I'm new to encryption, having just purchased PGP. I want to abide by > the law, but I don't know who to send a copy of my secret key to. We need to compile a list of people that law-abiding citizens can send copies of their secret keys. I will start the list with those that the LAC has already mentioned. Surely other C'punks will have their own nominees for this position of supreme trust. 1. The FBI guy who shot Randy Weaver's wife. 2. The FBI guy, Kahoe, who ordered evidence of the FBI murder of citizens destroyed. 3. One of the other four top FBI officials who helped with the cover-up? 4. Your drug drug dealer, to pass along to his CIA connection. 5. A Jewish person, to give to the Mossad, to pass on to the CIA. 6. The NYC cop with the toilet plunger in his hand.

3 2