December 2003 - cypherpunks-legacy

GLAAD report on filtering software: "Access Denied"
by Declan McCullagh 17 Dec '03

17 Dec '03

======= Date: Tue, 2 Dec 1997 14:16:07 -0500 From: Cathy Renna <CathyR(a)twbg.com> To: "'Declan McCullagh'" <declan(a)well.com> Hi Declan-- I am greatly appreciating your comments and articles about the summit (Loren Javier and I are attending right now. Here is our release about the filtering software report. Cathy Renna Washington, DC Media Resource Center Gay & Lesbian Alliance Against Defamation (GLAAD) (202) 986-1360 fax: (202) 667-0902 renna(a)glaad.org VISIT THE GLAAD WEB SITE AT http://www.glaad.org! ALERT LINE 1-800-GAY-MEDIA "GLAAD" and "Gay & Lesbian Alliance Against Defamation" are registered trademarks of the Gay & Lesbian Alliance Against Defamation, Inc. MEDIA RELEASE FOR IMMEDIATE RELEASE Contact: Liz Tracey, GLAAD (212) 807-1700 pgr. (800) 946-4646 pin# 1423527 e-mail: tracey(a)glaad.org GLAAD RELEASES GROUNDBREAKING INTERNET FILTERING SOFTWARE REPORT NATION'S ONLY LESBIAN & GAY MEDIA ADVOCACY GROUP EXAMINES COMPLEX ISSUES IN "ACCESS DENIED" NEW YORK, TUESDAY, DECEMBER 2, 1997-The Gay & Lesbian Alliance Against Defamation (GLAAD) today announced from the historic Internet Summit the release of their comprehensive and groundbreaking report on Internet Filtering Software and ratings systems, "Access Denied: The Impact of Internet Filtering Software on the Lesbian and Gay Community." In the wake of the Communications Decency Act decision, Reno v. ACLU, and with the Internet Summit: Focus on Children being held through tomorrow in the nation's capital, GLAAD has completed an exhaustive survey of how Internet filtering software, and future proposed ratings systems affect the lesbian and gay community. The findings mark the first time a lesbian and gay media advocacy organization has produced research and analysis of such depth on the issue of Internet access. "The majority of software currently on the market, as well as new products in development, place informational Web sites serving the lesbian, gay, bisexual and transgender community in the same categories as sexually explicit sites," the executive summary reports. "The software developers are either unable or unwilling to consider that information about sexual orientation and identity (e.g., a gay square dancing site) has nothing to do with sexual behavior, and everything to do with culture and identity." "Access Denied" contains sections analyzing the legal, political and social implications of enforced invisibility on the Web. It also includes overviews written by members of groups such as Gay and Lesbian Parents Coalition International (GLPCI) and Peacefire (an entirely youth-run cyberliberties group), as well as testimonials from lesbian, gay, bisexual and transgender youth, who, as seen in the report, are those most directly affected by the lack of access to important information via the Web or Internet newsgroups. "I urge everyone who uses the Interent to read this report, and learn the troubling implications of the widespread use of filtering software," states Joan M. Garry, GLAAD Executive Director. "As a mother, I can assure you that while GLAAD has examined the disturbing aspects of filtering, we never lost sight of the youngest users of the Internet-our children. Whether it is through the testimonials of lesbian and gay youth, or an essay written by a gay father, the voices in this report must be heard now-perhaps soon, they will be much harder to find." The report also includes a thorough review of the currently available software, ratings systems and search engines, recommendations for industry leaders on how to make the Internet both friendly and fair, as well as a proposal for a future ratings system, FAIRsite, which would measure the accessibility and accuracy of various ratings systems and software. GLAAD is a national organization that promotes fair, accurate and inclusive representation of individuals and events in the media as a means of combating homophobia and all forms of discrimination based on sexual orientation or identity. -30-

1 0

A Netly Thanksgiving (guess I should have posted this earlier)
by Declan McCullagh 17 Dec '03

17 Dec '03

=========== http://cgi.pathfinder.com/netly/opinion/0,1042,1602,00.html The Netly News (http://netlynews.com/) November 28, 1997 A Netly News Thanksgiving by Declan McCullagh (declan(a)well.com) Here at the Netly News, we have a feast of things for which we're thankful during this holiday season: Ricochet radio modems. MacOS 8. A Supreme Court that supports free speech online. DVD. Cable companies offering 400 Kbit/sec Net-connections. But we're also grateful to the personalities who made this year an unforgettable one: Heaven's Gate: A special Netly thanks to these suicide cultists for providing us with seemingly unlimited article fodder. From the blinking red alert headline of their celestial home page to the computer-generated painting of a resident of the kingdom of heaven, their web site was a treasure trove for journalists. Buried in the invisible space at the bottom of the home page were hundreds of hidden words: UFO, space alien, extraterrestrial, misinformation, second coming, end times, alien abductions, Yoda, Yoga. Wonderful stuff. Louis Freeh: The butt of a thousand jokes on the Net ("Freedom isn't Freeh"), the FBI director emerged this year as the arch-enemy of strong encryption. We had worried that Deputy Attorney General Jamie Gorelick's departure might mean fewer good stories from the Justice Department. But Freeh came to the rescue, saying publicly that Americans should not be allowed to buy encryption products without a backdoor for law enforcement. [...]

1 0

Re: Pasting in From:
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

gburnore+NOspam(a)netcom.com (Gary L. Burnore) > :If Gary Burnore is so concerned about "forgery", maybe he ought to > :start using that PGP key he keeps advertising in his .sig to > :actually sign his posts. Unless he does, he's still vulnerable to > :forgery from his fellow Netcom users who are still allowed to insert > :arbitrary From: lines in their Usenet posts. Actually, forging a > :post with Gary Burnore's name and address in the From: line can be > :much more convincingly (no disclaimers) done from a throwaway > :Netcruiser account, and with less effort than learning the proper > :protocol to do it through a remailer. > > > Please specify how PGP signing the inside of a post will stop UCE-Baiting. PGP signing a post is a lot like the new anti-counterfeiting measures in US currency, only a lot more effective. But if some bozo decides to start printing up three dollar bills with a portrait of Mickey Mouse, and others are foolish enough to accept them, what are you going to do? It's hard to protect people from their own stupidity. I'd contend that a $3 bill isn't even a counterfeit or forgery, since there is not genuine equivalent which it seeks to fraudulently duplicate. Maybe it's time that the brain-dead software that mindlessly harvests e-mail addresses from the net was shut down. That sounds like the real problem. > :Munging of addresses is better left to the discretion of the poster. > :Let those who perceive a need for this "capability" use it. At > :least one of the mail2news gateways implements that as an option for > :those desiring it. I'm in favor of leaving that choice with the > :poster. > > Please specify how PGP signing the inside of a post will stop UCE-Baiting. I'm not sure what comment you intended to make about that paragraph, since it appears that you inadvertantly pasted in your comment from the last paragraph again. The text you're supposedly commenting on nowhere mentions PGP. > :Mr. Burnore made a similar "forgery" complaint here several months > :ago and was advised to PGP sign his posts and request source-level > :blocking if he perceived forgery to be a problem. He has evidently > :not taken the trouble to implement the first suggestion and, > :assuming he took the second suggestion, he's posted no evidence to > :suggest that it's not been effective. > > The second has been effective. I've not denied that. Since you've already found a solution to the problem that works, there seems to be no need to do anything more drastic to solve it. > I can see however, that > allowing anon posts with someone elses' address in the from line is a great > tool for UCE-Baiting. I fail to see any other reason for it in an anonymous > post. What other reason would there be for putting a REAL email address in > the from line of an ANONYMOUS post? For one thing, to identify posts as originating from one's pseudonym, which *MIGHT* be a "real" e-mail address. Most times I've seen it used, though, it has been used to place identifying information in the From: field which many newsreaders use to identify posts so that they are recognizeable by the reader. > Again, it's nothing to do with the CONTENT. It has more to do with the ability > to post to an mlm group with someone elses' email address. Oh, and btw, if a > NETCOM customer is caught doing this, his/her account is terminated. The key word there is "caught", and then you'd have to convince Netcom to actually do something about it. It is my understanding that spammers routinely utilize Netcom's OPEN SMTP SERVERS to send out their spam, using whatever From: field they wish, and Netcom doesn't seem to care. Anyone using those same servers to send mail to a mail2news gateway could forge someone's name and e-mail address to a Usenet post, couldn't they? Also, even if a complaint to Netcom got an individual account shut down, that wouldn't stop some other Netcom user from doing the same thing, nor would it stop the first Netcom user from opening another account under a phony name and repeating the process, or even doing it from a non-Netcom account. So if my e-mail address were being forged via Netcom, would they be able to source-block it as the remailers currently can do? If not, doesn't your own ISP have a bigger abuse potential than the remailer net? > AGAIN IT'S NOT FORGERY THAT'S A PROBLEM. IT'S UCE BAITING. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ There's no need to shout. Perhaps you've forgotten two earlier posts you made to this NG in the past couple of weeks in which you said: -> Subject: Re: Controlling the From: line in PIdaho -> -> Hopefully replay has corrected this as others have suggested so that the above -> CAN'T be done. It's a simple way to forge someone else's name. Early last ^^^^^ -> year comes to mind. -> -> [...] -> -> Posting anonymously is a valid thing to do, posting with someone else's name -> in the From line is simply forgery. Try sending your message from a hotmail ^^^^^^^ -> address or other site where you can just make up a name if you want this sort -> of thing. And in another post: -> Subject: Re: 'from' other than anonymous -> -> [...] -> -> Again, a forged from line (Forged as in someone's _REAL_ email address shows ^^^^^^ ^^^^^^ -> up) is a BAD THING. You claimed to be concerned about FORGERY back then, now you're saying "IT'S NOT FORGERY THAT'S A PROBLEM". Which is the case? > AGAIN. Please specify how PGP signing a post will stop UCE Baiting based soley > on the from line. But you were given two solutions, so if one of them works, then you don't need the other one. --

1 0

Announcing availability of Crowds 1.1.1 for Win95, WinNT, Unix
by Aviel Rubin 17 Dec '03

17 Dec '03

Crowds: A system for anonymous web transactions Top 10 reasons why you might be interested in Crowds 10. The price - crowds is free 9. Easy to install - download the code, untar, and run. Then, simply point your browser proxy settings to it and you can browse anonymously 8. Public service - by running the crowds code, you provide others with anonymity, even if you don't use it all the time. 7. Big brother is on the net - this helps you hide 6. It's nobody's business what you are browsing 5. For this to work, there needs to be a large user community 4. Portable - now works on Windows95, WindowsNT, and all versions of Unix we tried 3. Win Crowds T-shirts and coffee mugs - details to come 2. Take a stand for privacy 1. Don't be the last person on the Internet to obtain privacy More information, including full source code is avilable at http://www.research.att.com/projects/crowds. - Mike Reiter - Avi Rubin ********************************************************************* Aviel D. Rubin rubin(a)research.att.com Secure Systems Research Dept. Adjunct Professor at NYU AT&T Labs - Research 180 Park Avenue http://www.research.att.com/~rubin/ Florham Park, NJ 07932-0971 Voice: +1 973 360-8356 USA FAX: +1 973 360-8809 --> Check out http://www.clark.net/pub/mjr/websec/ for a new book on web security (The Web Security Sourcebook). *********************************************************************

1 0

Re: CDT and the Threat of Gov't Intervention
by Declan McCullagh 17 Dec '03

17 Dec '03

Besides demonstrating that cyberporn is a topic that will never disappear, the Kids and the Net summit has highlighted the tensions between the different types of Net-advocacy groups here in Washington. The civil liberties groups (ACLU, EPIC, EFF, CPSR), and journalism, publishers, and media groups have lined up on one side [http://www.ifea.org/] saying the government shouldn't pressure the Internet to self-censor (or be censored by the Feds). They held a counter-summit press conference yesterday. Even the libertarian Cato Institute is in this corner. On the other side, the Center for Democracy and Technology [http://www.cdt.org/] is participating in the summit along with antiporn groups, high tech firms, and "censorware" vendors. CDT says that the Net needs to self-regulate or face the wrath of the U.S. Congress. (Folks at CDT generally take pro-industry positions and have been involved in many compromises in the past: wiretapping, "harmful to minors," and jail time for use of encryption in a crime.) CDT, however, has called for the development of multiple rating systems. You could easily tell the difference between the two outlooks today. ACLU associate director Barry Steinhardt and CDT director Jerry Berman debated this afternoon. "If we sit back and we offer nothing... that's not a solution for the American public," Berman said. He said that CDT is "looking to balance free speech rights" with other values. -Declan At 11:04 -0400 12/2/97, Michael Sims wrote: >What "they" are saying: > >SF Chronicle: > >"Internet Self-Regulation Draws Wide Praise But advocates for free >speech call for extreme caution > >Jon Swartz, Chronicle Staff Writer > > Civil libertarians and porn peddlers yesterday praised the Internet >industry's attempt at sweeping self-regulation to keep smut out of >the hands of children and the government at arms' length. ..." > > >Civil libertarians praised sweeping self-regulation, eh? I hope >everyone realizes this is CDT that is doing this. They continue to >claim they are a civil liberties group, and continue to push for >restrictions on civil liberties. Has the ACLU considered setting up >a group which describes itself as "conservative and pro-family" in >its press releases and pushes continually for the elimination of >censorware and ratings? Such a trojan horse group could hardly do as >much damage to the censor crowd as CDT continues to do to the >free-speech crowd, but perhaps it would achieve some measure of >compensation. > >"Pros: [of "filtering"] Filtering does block out almost all >inappropriate material." > >I sure am glad our message is getting out. > >"Education. A series of TV spots and school-sponsored programs >touting filtering software will debut next fall." > >What a treat. Bennett? Know anything about this one? > > >Plenty more to come on this subject, I'm sure. > > >-- Michael Sims

3 2

Cantsin Protocol No. 2
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Anonymous <anon(a)anon.efga.org> wrote: >Monty Cantsin writes: >> You can't see it up here, but this is a signed message using a >> protocol which is modestly titled "Cantsin Protocol No. 1". >> Suggestions for improvement are most welcome. > >A very interesting idea! Please consider the following suggestions >if you like, or feel free to ignore them. Your suggestions were very helpful. Thank you for making them! I'm calling the latest version "Cantsin Protocol No.2" and its identifying number is "25BA1A9F5B9010DD8C752EDE887E9AF3". It is similar to Cantsin Protocol No. 1, but the bug with the hash of the public key is fixed. Instead of concatenating the values p, g, and y, you concatenate "p:<p> g:<g> y:<y>" and compute the hash. p, g, and y should be represented as ASCII hexadecimal digits without leading 0s. The hashes should now be correct SHA1 hashes. >One problem with signatures which have no indication at the top is >that two passes over the data are necessary: the first to scan and >find the start-of-signature indicator, and another to go back and >calculate the hash. Signatures such as S/MIME and PGP have enough >information at the top of the signed message to allow one pass >processing. My thinking on this is that passes are cheap these days. I want the signature to be unobtrusive which probably can't be done if only one pass is required. Incidentally, a nice feature of these signatures is that they can be moved around in the file just by changing the offset. You don't need to control the secret key to do it. >> The first line is "16A5942B6EED349ECF4594C784DFD177 [Cantsin >> Protocol No. 1]". The hexadecimal number was chosen randomly and >> is the indicator that this is a Cantsin Protocol No. 1 signature. >> The number was chosen randomly and it is somewhat unlikely that >> anybody else will accidently choose it. > >You might want to think about what happens if the document itself >contains (maliciously, or perhaps because it is talking about your >signatures) the string in question (as yours does and this one does >as well). This could throw off an automated signature checker. The signature checker should ignore bad or incomplete signatures. I would consider this to be a bug in the software and not a bug in the protocol. A bad signature simply lacks meaning and an error message need not be reported. That might seem a little callous, but actually it's how we should regard signatures. The current model seems to be "computer, check the signature on this file and tell me if it's good", whereas the correct (in my view) model is, "computer, extract all of the material from this file which is properly signed and throw out the rest." (Of course, you could imagine a smart editor which highlighted the areas of a document which were signed by various parties. It seems a little early to implement this.) If it's not authenticated, you shouldn't even look at it. I've taken to putting the To: and Subject: header lines at the bottom of my messages for this purpose. There's really no need to keep any of the header fields. The header fields can be put at the end just as unambiguously as at the beginning, but at the end they can be signed. >> The second line in the signature is an SHA1 hash of the public key. >> The hash is computed on the concatenation of the hexadecimal ASCII >> forms of p, g, and y respectively. There should be no leading zeros. >> (Remember to leave off the newline!) > >Presumably you could use the key hash to look up the key to use for >verifying the message. Strictly speaking it's there to save space. If we put the public key components in every signature it wouldn't be much harder for the key management software to compute a hash on them somehow. This does not have to be standardized. >This has a mild denial of service attack. Someone else could create >a key with different boundaries between p, g, and y but which would >create the same string as this concatenation, and therefore the same >hash. If you left the "p: ", "g: ", and "y: " in place it would >prevent this. PGP's key fingerprints have had the same problem. ACK! I knew about this problem, but I couldn't remember exactly how it worked. So I said, "Monty, let's not be dumb like those PGP guys. Let's concatenate the keys together and compute the hash. Nobody will ever..." Thank you very much for pointing this out. >> The fourth line contains an offset and a length to specify the area >> of the text which is signed. The offset is relative to the >> signature itself. That is, the first character of the Cantsin >> Protocol No. 1 code is at position 0. As signatures are usually >> appended, the offset will usually be the additive inverse of the >> length. > >It is intriguing that this can be used to sign a subset of the text. >Presumably there could be multiple signature blocks each of which >signed different subsets, possibly with different keys. One problem >is that it is not obvious to the human reader what part of the text >is signed. A nice effect with PGP and S/MIME signatures is that even >readers who don't have the tools can have some slight confidence in >signatures, because other readers will often report it when >signatures don't verify. With a signature that only covers a portion >of the text, people might assume that if there are no reports of >failure, more of the text is signed than is the case. This is not a >technical problem but is a social phenomenon which may not interact >well with this signature format. People who want this feature should type something like "BEGIN CANTSIN PROTOCOL NO. 2" and "END CANTSIN PROTOCOL NO. 2" into the text at the right points. >You need to specify a canonical line ending format. Based on the >count values in your document, it appears that you are counting line >terminators as being one character long. Your count value of 1CB9 >corresponds to decimal 7353, there are exactly 7353 characters from >the first character of your message body to the beginning of your >signature magic number, if line ends are one character. > >The specific characters for line endings need to be specified as well >for the hash to be calculated consistently. Your hash appears to be >calculated with LF as the line ending (although the hash program is >broken, see below). Probably CR/LF would be preferable for the line >endings as that is a widely used internet standard as well as being >common on windows. My feeling on this is that this is outside the scope of a signature protocol. The protocol should not make any assumptions about what is being signed nor should it modify what is being signed. I use LF to terminate lines and would recommend this to others, but it is not part of the Cantsin Protocol No. 2 specification. In any event, if we must put in patches to handle the poor fidelity of electronic mail, the patches should go in afterwards. When a signature checking program finds ">From" it should replace it with "From" and see if it can get the right checksum. Likewise, it should try the various line endings until it gets a match. There can't be more than about 12 variants, so this shouldn't create an onerous burden on the machine. (And, I suppose, it would be possible to add a field after the length or after the hash which made a suggestion about the line ending.) >> You also need to be able to compute SHA1 hashes. I've been using >> something called "sha1file" which, I believe, originated at Adam >> Back's web site. > >That program has a bug. The routine SHA1_update in the file sha1.c >is missing a line: > > CENSORED BY THE UNITED ST > A > TES GOVERNMENT CENSORED BY THE UNITED STATES > GOVERNMENT CENSORED B > Y THE UNITED STATES GOVERN > MENT CENSORED BY THE UNITED > STATES GOVERNMEN > T CENSORED BY TH >*** E UNITED STA *** MISSING *** > T > >Correcting this will make your hashes be correct. Another great suggestion. The hashes should be correct now. Incidentally, in another thread I've been talking about partial signatures. The code above is an example of where this would be useful. In some countries we are not allowed to express ourselves freely without persecution. If I wanted to provably quote somebody who included forbidden ideas in their message, it wouldn't be possible without partial signatures. >> El Gamal is simple enough that the signature on this message can be >> checked using standard Unix tools such as dc version 1.1. Let's >> say M is the SHA1 hash of the message. It is checked by verifying >> the truth of this equation: (y^a * a^b) mod p = g^M mod p. > >El Gamal is a rather lengthy signature, although the verification >equation is relatively simple. DSS has a shorter signature. This might be a good thing to add to a later Cantsin Protocol. >There are some subtleties to choosing El Gamal keys, but with the >2048 bit values you have chosen you are pretty safe. Schneier doesn't mention this, although presumably this information will show up in one of his references. Do you know offhand of a published source which covers this? >Also, you can't really justify using 2048 bit keys when your hash is >only 160 bits. The hash becomes the weak link for keys beyond about >1024 bits, and unless you use a stronger hash your key strength is >misleading. This is why DSS is only specified up to 1024 bits. This is just intuition, isn't it? Since we really don't know how hard it is to factor it seems hard to claim we know the ratio of difficulty between breaking SHA1 and El Gamal. Factoring could be broken before SHA1. Not that any great science was applied to the choice of a 2048 bit prime, it just seemed like a good size. ;-) Also, I think it is a mistake for people to communicate the strength of a system by choosing various key lengths based on general popular views. It's probably better to say "I estimate this system requires at least 2^x operations to break." We've seen this with people choosing short keys so nobody will get the idea that it is secure. This just seems all wrong to me. The key length is only one way in which a key could be insecure. Monty Cantsin's authentication key, for example, is not kept very securely. But, the way to communicate that is to say "this key is not kept all that securely." However, in Cantsin Protocol No. 2 the size of the prime chosen is completely unspecified. There doesn't seem to be a reason to restrict the choice other people will make regarding the length of the prime. I could imagine choosing a short key for control over a semi-persistent identity. The advantage is that you can claim somebody else brute forced the key for statements you wish to repudiate. Similarly, I could imagine choosing an obnoxiously long key to make it hard for people who don't have super fast machines to associate with you. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm Subject: Cantsin Protocol No. 2 To: cypherpunks(a)algebra.com 25BA1A9F5B9010DD8C752EDE887E9AF3 [Cantsin Protocol No. 2] 94C43229A76383D818D39952F7A41ACA0394C6FE C602F22D31BBC6245643E58AD8EB260B58DC1250 -2B49 2B49 CEDDBC793332877C29C3BF084DDD8DE8113E6C80E13995BCAFACE2E7D719194A8CAEB987D2DAC013204F1A2909B1FADCB7EFE39F0F764B140CA5711D057B4EF1EF880ACAF1FF19FB5E92E4A8E4F1CE4B0F18CBB37274629EDACFF412C5A971C20869A956497491F41F3D0E7791F85E18ED638B0552A275CF2F24002646084CB3BCF0AE52A38826D1D986CBE460B793836291326C3636A452B54A79DE949CB6A12FD1852D9FC438D6D7E63989CC031161B8872E1EE60D0C4521FCF7096B98E1DEF560432314258359370763BCE5D3D4610B097DC68C1EDCD1F3D5084069C74191C798383C3BF822EC97DE84531B20ECCB36B13EC9153252C88FFAFE71CD65B197 AFC25A731FAD9BB9A373B7D9972EA9CED870CC6FDACE0B2A2AEAC4F0C33115B15E689CBF943B757F8690C945CC1CB29E4F86276EB0643E215ADB92CEFE1394DD8320DDF703D4212EFEFA59081C21BBD2ED6282304D2DB496735BBCB3E5B802C2B78037EC041DDD8BBC1E4712CF18E56237E5BCDB37127F538BEF1E0038949B42F88140E608F02282570388D07785841069FD76EFC78E170E12DC1CF6570E7D67603707E15717704EBF8DE50014141DC8F8C80432333B5647B176093A45834F4460BDD2465306AE56156EFE1D0686F0FB4F7743CED116F47121EB4970B4CFDBEC6E56E90AADAA97836E95F3723B3216E99EC9FDE324943AFF6F257880423DFCE7

2 1

Re: Pasting in From:
by Charlie Comsec 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- stewarts(a)ix.netcom.com (Bill Stewart) wrote: > At 12:14 AM 12/01/1997 -0500, Robert A. Costner wrote: > >Best I can tell, the only reasonable good purpose for this is to create a > >persistent nym identity without a reply to capability. > > Actually, setting the reply to point to your nymserver address > is the one legitimate use I can see for it, though that > capability probably should be provided by the nymserver. > The reason for chaining through remailers is to gain anonymity. I can think of a couple of scenarios in which pasting in a From: header pointing to a 'nym might be advantageous: 1.) Posts when the nymserver is down, or; 2.) Posts from an insecure location where installation of one's secret keyring is not desirable. (The "newnym" servers require that send requests be PGP-signed with the nym's secret key.) - --- Finger <comsec(a)nym.alias.net> for PGP public key (Key ID=19BE8B0D) -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBNIRnYwbp0h8ZvosNAQE6Xwf/SJQbKnIhFSP2nXd7dBQauf5ygoIrGqOt 6vFW644xxELC37iwW5tWI7Cr0N1Ipk9Py1UDzHSNYEeUGqUxgWGQ8BZhoNRg9i2t pqTr/YIRTjVxPETidpnKhyUgL6lz3bESpdiQLAKm1VwdWV3OhtNTlzL/Wu1hO33W +IxisotkksQ+OsCrfdkBRu6FarS90LGWa7Zqo3xNHZs599P/tVMrc2BYq7znXcZX gG4YwUhL2qWZJDhiWpTVWb/OH0Cq1UCnc/7AgMBjbQFt0ZCHghJXxc4DfmUG9L6J MHmpv82j7th8roMjM3FRGUzaqJxVBSoBKZPyBuRaLMgiaaupWku5EQ== =ZqJJ -----END PGP SIGNATURE-----

1 0

Transforming Defense
by John Young 17 Dec '03

17 Dec '03

The National Defense Panel presented yesterday to the Secretary of Defense its 95-page report on the future of US defense: "Transforming Defense: National Security in the 21st Century." It's available in PDF format at: http://www.dtic.mil/ndp/FullDoc.pdf (386K) The report proposes an impressive 30-year overhaul for the military, with a recommendation that the two-major-wars strategy be replaced with that of preparing for one major war and a host of more limited defenses overseas and at home to combat enemies who will not challenge superior conventional armaments but will utilize "asymmetrical" NBC weapons, terrorism, information warfare. We've converted the Executive Summary to HTML: http://jya.com/ndp-pr.htm And a section on "Homeland Defense" which proposes a role for military forces to "protect against all enemies foreign and domestic" by providing intelligence, training, equipment and other aid to justice and law enforcement. http://jya.com/home-def.htm As noted in the NYT today, the report asks for a shakeup in intelligence, with renewed emphasis on training human spies to compensate for what technology cannot do. Along that line, the NYT also reports today on a huge Libyan deeply-buried pipeline system under construction which is suspected of being a distribution system for troops and equipment as well as CB weapons, placed underground to escape satellite spies. The report is based on descriptions of engineers and corporations working on the project. One feature of the NDP report, as well as other closed defense panel meetings, is the need for weapons to attack underground structures -- like those vast catcombs in Lybia and North Korea, and the US for that matter -- Cheyenne Mountain is still being re-hardened regularly, and its electronics re-Tempested, not that the local skinheads will not find a way to hack the bunker as trusted EEs and sys admins.

1 0

Network Associates Announcement!!!
by Network Associates, Inc. 17 Dec '03

17 Dec '03

~ NETWORK ASSOCIATES ANNOUNCEMENT ------------------------------- Network Associates, Inc., is proud to announce that we have named TruthMonger<toto(a)sk.sympatico.ca> our Chief Director of Security, adding his (or her) immense reputation capital to our already respected corporate image. No communications purporting to be from Network Associates, Inc., should be considered valid unless signed by the key provided below. TruthMonger is also authorized to accept payment, in cash only, of any money due to Network Associates, Inc., and all of our subsiduaries, at the following address: NETA c/o TruthMonger Box 281, Bienfait, Saskatchewan CANADA S0C 0M0 Network Associates, Inc., plans to use TruthMonger's extensive key-forging experience to help make digital signatures basically meaningless, in order to help lessen the potential legal and/or criminal repercussions of any future Key Escrow legislation. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGP for Business Security 5.5 Comment: "I Broke PGP!" mQGiBDSEmSYRBADgXaNjJkY7NmVjhXJGg0+8Sua4oYJ+tkG959T1lYFsCLVity0V fRH6ygoHaRe/YiXxqQnbXyt3Fo6oF8MdXDWLMTkpR1NZn5kIcUnDrGv6G3Y+bW8j fHy79JjX17OPPJS5FLIaATubngiRNJMwpn34cQIM812iDgUfrdxiFUQSwQCg/6ju lTyy+oFaxBTTUsBlYbkhDpUD/2PxF1JN53oHiCZb62PXoVE/QfN7i+ABpR0PW5jC TiaQwh7jEbVctYnzhSPjccUJSQ+XEwTbjrCS4xYftoIlkRsVSzbFcRIbelDP7kQw GM2UExhsHVNhpsq+benT7LfcFnACYYu6GjMIY+v3CfJYidJ94DN3E5D60Q+UEz/M sTEUBAC8h94Xk1l8IsItOPNbj8k0o7yfll8cqKHbe1CpSUBS6nZ0kwBq5WONkptx O4zBOsxlf/WnVo6C5ojgB2TeFWZoXj98X7S4QaVvHM3YFJuIHLw8gcS3HHahLphh bKGlffWF3FfQCJr2Rd6fk2SeZp2TZoCqLKt8UMwxbGjQa39dD7QvTmV0d29yayBB c3NvY2lhdGVzLCBJbmMuIDx0b3RvQHNrLnN5bXBhdGljby5jYT6JAGMEEBECACMF AjSEmSYXCgARh4SIT1mMRHX7HCWvKiZqcerSJDgECwMBAgAKCRA314vi4fVSmhyZ AJ9M8SPYgr4apBO0PAJwjg2bQDcvrACdF2vW+SsVL4r3EMP2vlHfZ0fSinKJAKAE EAEBAAoFAjSEmqUDBQF4AAoJEJ8TeU28wEKx7rED/2dajEBpvE/KtSUW9CbSPKyr 3rzULey4iBHOcrPqSgD7z6iXAs16O6sBWclrr30IJ/IdJ5kaTsNXjcmny2GpMUSq 1jbf3quenBIN6zkZLx08ZRPyHjdlmS7/PSOkvI7gKe3NLRjJ9QImytY1uLoAIHjO iFXLyTq2kGW/fMK85g4QuQQNBDSEmSsQEAD5GKB+WgZhekOQldwFbIeG7GHszUUf Dtjgo3nGydx6C6zkP+NGlLYwSlPXfAIWSIC1FeUpmamfB3TT/+OhxZYgTphluNgN 7hBdq7YXHFHYUMoiV0MpvpXoVis4eFwL2/hMTdXjqkbM+84X6CqdFGHjhKlP0YOE qHm274+nQ0YIxswdd1ckOErixPDojhNnl06SE2H22+slDhf99pj3yHx5sHIdOHX7 9sFzxIMRJitDYMPj6NYK/aEoJguuqa6zZQ+iAFMBoHzWq6MSHvoPKs4fdIRPyvMX 86RA6dfSd7ZCLQI2wSbLaF6dfJgJCo1+Le3kXXn11JJPmxiO/CqnS3wy9kJXtwh/ CBdyorrWqULzBej5UxE5T7bxbrlLOCDaAadWoxTpj0BV89AHxstDqZSt90xkhkn4 DIO9ZekX1KHTUPj1WV/cdlJPPT2N286Z4VeSWc39uK50T8X8dryDxUcwYc58yWb/ Ffm7/ZFexwGq01uejaClcjrUGvC/RgBYK+X0iP1YTknbzSC0neSRBzZrM2w4DUUd D3yIsxx8Wy2O9vPJI8BD8KVbGI2Ou1WMuF040zT9fBdXQ6MdGGzeMyEstSr/POGx KUAYEY18hKcKctaGxAMZyAcpesqVDNmWn6vQClCbAkbTCD1mpF1Bn5x8vYlLIhkm uquiXsNV6z3WFwACAg/+McnUlkw0KkNcBxN0w/mvo7/2QcEWXyfXiqpIcGj/DytA l0nh77hd+RPPqqXQHgkp56hPpp7nK8gAZnkxJcycOYMbPIgKvAGi9gQO7bd2oth7 TWUlfimTIYPrscLJNn/HQ5nA8mU28Ajq/Zlq/0XhpsQiRH5Ygr2IW1tldrrgiOho pYHsdPOkxZaPIHFKIqt6l/GtBnPA6+KYul53pfBt4DTPSk02RYsD9u/pqoJ/oEYW BrO/FzsKXzpIJxWCNvVm8GlakEw2isZ9zT4H5KRqhRLc9+SyeupF5ztosZKNs0dn nGaWVrCjx28G86xVnONi6fntGzL57Pb5JRvyrAbFDEXfL9rUrgLFx78LY4fSavP8 caB3IkQomuXZezQGusy4LMhna0ZYNioHyFzZU2DYU0EcuG8qrz+sKEIaYIpCiBPq IohclEgsA9ygaPjefiTpCEb07gGGD0rh6aRYpaQGCd8sSWIqm8IWql+ePkqwVWR8 WHyZWH6STvUQsZCE1GhJQqyai4i6KnVNrYzYF2UinP7d5AYUsaRGypdHsFDx9Yhg YC5OFsR0BXnz9bm3tn3SSoVDp7b9Xo9V3FpiQ+9ZgjXD2eEbWumv/upoVu2ekbiK CM4Dt3OoBPQBpkFan5FqCSY7255yCPU9YzQ7mmEpFWvfbSNR/Cls+ZT2GR7T1nOJ AEYEGBECAAYFAjSEmSsACgkQN9eL4uH1UpoCiACgnAXXUm5yyak30HJL1FeYdh0B xekAnA/VnnGkzVY1kQRQNpWQXdHdpL5F =3BX/ -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Pasting in From:
by Jonathan Wienke 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At 12:03 PM 12/1/97 -0800, stewarts(a)ix.netcom.com wrote: >Besides Usenet, other popular tactics for retribution are >sending death threats to politicians, sending child pornography >to mailing lists, forging messages _from_ politicians, etc. >Disclaimer/warning headers help, but can't stop it all. > >At 10:07 AM 12/01/1997 -0500, Andy Dustman wrote: >>Two basic points also about "forgeries". First, you can forge headers >>pretty easily without any programs other than telnet. Second, if this > >This was before Gary Burnore's attacks on the remailer networks, >but it's also an obvious tactic for either flamers or Feds to use >for getting remailers shut down. If somebody forges a Usenet posting >with telnet, it's not _your_ problem (usually). If they use your remailer, >it is your problem. And if they get remailers closed down a lot, >it's all of our problems. > >>2) Whenever a From: line is pasted, a disclaimer will be inserted at the >>top of the body, stating that the original sender has set the From: line, >>and that the identification cannot be verified. The fact that it is up at >>the top of the body should mean people should actually see it before >>reacting. > >It's worth also repeating it at the bottom. Putting it in the headers >is invisible with most newsreaders, though. > >By the way, one technical risk with From:-pasting is that you need to >parse or substitute special characters including parens and anglebrackets. >Otherwise it's easy for people to paste in syntactically incorrect headers, >which really annoy some gateways and mail clients - nested parens are >a particular problem. > >Basically, I think you're getting yourself in for excitement >and adventure and really wild stuff by supporting this :-) Sounds like a good reason for remailers to use throwaway email accounts at Juno, MailExcite, Yahoo, etc. as their exit points. Wasn't somebody working on this? -----BEGIN PGP SIGNATURE----- Version: PGP for Business Security 5.5 iQA/AwUBNIOSQcJF0kXqpw3MEQKcHACg+nSiTVlonZCH3hUhRQ2+DXYTtIcAoOTf DVa/LBltFF527mdtcs3adDsR =6WNy -----END PGP SIGNATURE----- Jonathan Wienke PGP Key Fingerprints: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC "If ye love wealth greater than liberty, the tranquility of servitude greater than the animating contest for freedom, go home from us in peace. We seek not your counsel, nor your arms. Crouch down and lick the hand that feeds you. May your chains set lightly upon you; and may posterity forget that ye were our countrymen." -- Samuel Adams "Stupidity is the one arena of of human achievement where most people fulfill their potential." -- Jonathan Wienke Never sign a contract that contains the phrase "first-born child." RSA export-o-matic: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

2 1