December 2003 - cypherpunks-legacy

REMAIL: digicash
by nobody＠rosebud.ee.uh.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Cypherpunks, I've been experimenting with a primitive digital cash system for remailers. Originally I had hoped to combine the remailing and banking functions of the elee7h5@rosebud remailer, but for now I have an even more primitive cash system implemented at elee6ue@rosebud. It seems to be performing as expected. A digital cash accepting remailer, along with a good positive reputation system, is the "crypto-anarchist" answer to labeling anonymous mail with subjects and/or usernames. (Of course, a subject that enables anonymous mail to blend in is great - such as "Re: your mail"). (Incidentally, since running pgp to get the signature from a pgp-signed message is expensive, I patched the script I use for positive reputation to give the option of checking signatures or not, if anybody is interested.) Currently, the only objection I've heard to anonymous mail is "somebody can abuse it"; future remailers will require payments, helping to address this concern. Basically, the remailer recognizes a Digicash pasting token, and for now the cash is a string of letters and numbers. Before remailing, the digicash is extracted and looked up in a cash list (which I create). If the cash is in the list, it is assumed to be valid, and the list is rewritten minus the cash string just used. If the cash isn't present, it is assumed to be invalid, and an insufficient funds message is remailed instead. The remailer does not keep a list of "spent" cash strings, so there is the possibility of duplication (once in every 36^60 times). As far as correlating the cash used to individual and a message, I can only assure you I could care less about the required bookkeeping. The pasting token looks like the others, and you use it in a similar way - - ----------8< cut here >8---------- :: Digicash: <here is the string> - ----------8< cut here >8---------- For example, I "paid" for the remailing of this message with - ----------8< cut here >8---------- :: Digicash: BcKjSoUEQaTam9xPs0oso2j0UVVb1M6OyxTn8QSX0rdT3eUIH4Vq1rXEpYH1D - ----------8< cut here >8---------- (Now, the above cash string should be invalid! :-) The way I'm distributing valid cash for the remailer is by email - mail me and I'll send you some valid cash strings. No charge :-) Karl L. Barrus <klbarrus(a)owlnet.rice.edu> -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLKsyGYOA7OpLWtYzAQG/QAQAwNbDbKOdnWJ4g/tt8+0AdtR+5TzETfaU DaodN1LDs7+w46/KlyIoI/B9+C710U1f46dnd81MxMm6eTGcbwnkrTBhz7QlO7NH 1joVaoe8TVljk2RZnCYmpYbzXjuogZcAuuZKVWY3ES2iElKZLr24oCZbHWljPV4o griHzfbmHYI= =54L7 -----END PGP SIGNATURE-----

1 0

Re: Digicash: good description
by stig＠netcom.com 17 Dec '03

17 Dec '03

In <01H3JF7JM47M8WXVML(a)delphi.com>, Mike Ingle wrote... > Does anyone know where I can get a good, lucid ASCII description > of digicash systems? > > --- MikeIngle(a)delphi.com > I haven't tested it, but I pulled a postscript to ascii converter off the net recently (alt.hackers I think)... I'll make it available as netcom.com:/pub/stig/src/gsascii.shar.gz Stig ;; __________________________________________________________________________ ;; Stig(a)netcom.com netcom.com:/pub/stig/00-PGP-KEY ;; It's hard to be cutting-edge at your own pace... 32 DF B9 19 AE 28 D1 7A ;; Bullet-proof code cannot stand up to teflon bugs. A3 9D 0B 1A 33 13 4D 7F

1 0

Re: Orange book, the NSA, and the NCSC
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

>Message-Id: <m0ohwxY-00022PC@khijol> >From: khijol!erc(a)uunet.UU.NET (Ed Carp) >Subject: Re: Orange book, the NSA, and the NCSC >Date: Wed, 29 Sep 1993 01:32:27 -0800 (PDT) >Even if a Cray can crack a PGP-encrypted message in, say, an hour, flooding >the system with messages would tend to obscure real traffic with obscure >junk. Hey, I can encrypt /vmunix with a random key as fast as the next >person. :) I still have my copy of (what I call) pgp-ran. I forgot what it was called when it was posted and I can't find the sources now. It puts rannos in PGP format. Does a copy of the sources exist on one of the servers? It's too fast to be doing any encryption but it would be good to have one which produces messages PGP recognizes as real, only for a public key which isn't on file. If PGP rejects a message, it wouldn't take up any Cray cracking time. - Carl Sample: -----BEGIN PGP MESSAGE----- Version: 2.1 tJaHof1c+6P+Llz8D7E4Nt7sETVMtqqazEhcjX4hRIgdtTZwPeocLjIP3dbkIF+7 JfXt2QOIYulFC+1RcdtoA233TTbbYZXi5uPv+d3WMcbObQf3tMfuCXlWqBxCaIkT 3zD1R6MdXnry4KplWJTZg5vK6gMUpxogkrV1lhS8J9uBHYmeh63BzmLtGXBvIpPt Uli6G12PylQ693YexPfk1qR7BSrK863QfZKmOB1BmG7j9TBuigSXKjSL19Vx4MCX mM90Nz1z5wW2DXkl328BZPNOMiAEvCcVOZJcM/PFvm7z9fY1VV2ukD9wm91V/RqN ZNm1/glIyDLCSgq3VqnQfzpzeqrWTCksQLhPrGYdJjgcDKTY07oTuRHM7yjO0H7E ScU9jsbsP7ISFcr6XTNFlUSgG1v78q/PGTMp/nWOieho6MiRfvXEEplKeUFa+FpE Y2uYdEmAiHodTKuz5F39ucIMwNnuSQzrGhDklpkHxMkEWT3PYvNHLVT8i6q1LdgR +j1jMZr9lPC7i5L7oYC0tVwPQaEb4ks2HiaU7FRhUTc3Nny1/0psJZ8Z0A0slhis D8A+BSfWl8Nyj/ojzRP8rLWfMKLxrtduqetrwMBVIOIsNwPABe9sqTL2dWnJEE3u kZSxbo5pwl3g03hT0O9HZzlwau0eliBK7T =7W70 -----END PGP MESSAGE-----

1 0

Re: Disturbing statistics on wiretaps
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

>From: "George A. Gleason" <gg(a)well.sf.ca.us> >Subject: Re: Disturbing statistics on wiretaps >Message-Id: <93Sep29.023420pdt.14278-2(a)well.sf.ca.us> >Date: Wed, 29 Sep 1993 02:34:18 -0700 >And of course it should be remembered that there is still an old drug-war >thing on the books which allows 72 hours' interception without a court >order. Now depending on how that's interpreted, 72 hours are a lot of >conversations. This stuff can be used for background intelligence and >investigation where it never winds up in court but is used to get >information to be used in other ways. "It's what they don't tell you..." This can't be true. I read DERD's paper on wiretap law and she certainly didn't mention anything like this. You must be making it up. :-) ? No, :-( - Carl

1 0

Fidonet, policies, privacy, and power.
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

The following is from Fidonet Policy Documet 4.06, dated May 5 1989. It's marked as not being in force yet, as it's awaiting ratification; dunno if it ever was or not. ---------- 2.1.3 Responsible for All Traffic Entering FidoNet Via the Node The sysop listed in the nodelist entry is responsible for all traffic entering FidoNet via that system. This includes (but is not limited to) traffic entered by users, points, and any other networks for which the system might act as a gateway. If a sysop allows "outside" messages to enter FidoNet via the system, the gateway system must be clearly identified by FidoNet node number as the point of origin of that message, and it must act as a gateway in the reverse direction. Should such traffic result in a violation of Policy, the sysop must rectify the situation. 2.1.4 Encryption and Review of Mail FidoNet is an amateur system. Our technology is such that the privacy of messages cannot be guaranteed. As a sysop, you have the right to review traffic flowing through your system, if for no other reason than to ensure that the system is not being used for illegal or commercial purposes. Encryption obviously makes this review impossible. Therefore, encrypted and/or commercial traffic that is routed without the express permission of all the links in the delivery system constitutes annoying behavior. See section 1.3.6 for a definition of commercial traffic. [...] 2.1.6 Private Netmail The word "private" should be used with great care, especially with users of a BBS. Some countries have laws which deal with "private mail", and it should be made clear that the word "private" does not imply that no person other than the recipient can read messages. Sysops who cannot provide this distinction should consider not offering users the option of "private mail". If a user sends a "private message", the user has no control over the number of intermediate systems through which that message is routed. A sysop who sends a message to another sysop can control this aspect by sending the message direct to the recipient's system, thus guaranteeing that only the recipient or another individual to whom that sysop has given authorization can read the message. Thus, a sysop may have different expectations than a casual user. 2.1.6.1 No Disclosure of in-transit mail Disclosing or in any way using information contained in private netmail traffic not addressed to you or written by you is considered annoying behavior, unless the traffic has been released by the author or the recipient as a part of a formal policy complaint. This does not apply to echomail which is by definition a broadcast medium, and where private mail is often used to keep a sysop-only area restricted. 2.1.6.2 Private mail addressed to you The issue of private mail which is addressed to you is more difficult than the in-transit question treated in the previous section. A common legal opinion holds that when you receive a message it becomes your property and you have a legal right to do with it what you wish. Your legal right does not excuse you from annoying others. In general, sensitive material should not be sent using FidoNet. This ideal is often compromised, as FidoNet is our primary mode of communication. In general, if the sender of a message specifically requests in the text of the message that the contents be kept confidential, release of the message into a public forum may be considered annoying. There are exceptions. If someone is saying one thing in public and saying the opposite in private mail, the recipient of the private mail should not be subjected to harassment simply because the sender requests that the message not be released. Judgement and common sense should be used in this area as in all other aspects of FidoNet behavior. 2.1.7 Not Routing Mail You are not required to route traffic if you have not agreed to do so. You are not obligated to route traffic for all if you route it for any, unless you hold a Network Coordinator or Hub Coordinator position. Routing traffic through a node not obligated to perform routing without the permission of that node may be annoying behavior. This includes unsolicited echomail. If you do not forward a message when you previously agreed to perform such routing, the message must be returned to the sysop of the node at which it entered FidoNet with an explanation of why it was not forwarded. (It is not necessary to return messages which are addressed to a node which is not in the current nodelist.) Intentionally stopping an in-transit message without following this procedure constitutes annoying behavior. In the case of a failure to forward traffic due to a technical problem, it does not become annoying unless it persists after being pointed out to the sysop. [...] 4.2 Routing Inbound Mail (Net Coordinator Responsibilities) It is your responsibility as Network Coordinator to coordinate the receipt and forwarding of host-routed inbound netmail for nodes in your network. The best way to accomplish this is left to your discretion. [...] You are not required to forward encrypted, commercial, or illegal mail. However, you must follow the procedures described in section 2.1.7 if you do not forward the mail. ---------- (end of Fidonet policy quote) The gist of Section 9 of the policy document, together with the Appendix of Fidonet "case histories" seems to be that the various Fidonet Czars can kick you out of the net if they consider you "excessively annoying". As far as I can tell, the ability (perhaps the right) to fuss around in other folks' business and other folks' mail is one of the factors (along with the ability to create and enforce any number of rules and regulations) which makes people think it's fun to run a BBS. The opportunity to exercise power seems to be a powerful motivator, whether it's on the net, on a BBS, or otherwise. Suggesting that we need to address that tendency in the "online" community before we address it in the general populace seems misguided to me. -- Greg Broiles greg(a)goldenbear.com Baked, not fried.

2 1

How about a pgp RFC...
by Brad Huntting 17 Dec '03

17 Dec '03

If you've followed the PEM working group in recent years, you may have come to the conclusion as I have that it is not going anywhere, and probably never will. In an effort to make e-mail crypto more wide spread, I suggest we draw up an internet-draft on the PGP message format, and the algorithms used to send and receive messages. At the moment I can think of nothing PEM can do that PGP cant. Granted there are problems scaling the web-of-trust model, but PGP is also capable of using a top down model (really just a subset of the web model). One thing such a draft is sure to do is send a clear signal to the PEM group that they must either start swimming or sink. brad

4 3

Re: misc crypto stuff
by mycal (voices through your head ＠ 88.1MHz) 17 Dec '03

17 Dec '03

On Thu, 30 Sep 93 18:33:08 GMT, "J. Eric Townsend" <jet(a)netcom.com> wrote: > "mycal (voices through your head @ 88.1MHz)" writes: >> [my prediction deleted] > > Already happened. The fellow used something like PGP, if not PGP, to > encrypt stuff to disk. If I remember correctly (Mike G., help me out > here) he was asked to cough up the passwords in court as part of the > legal proceedings. (I remember this only because of the following > discussion of 'can a court make me give out my passwords?) No call > for banning of encryption by The Media(tm). > Yes but if this is true it still was an isolated case, was they guy sending stuff to other ppl encrypted? Was he receiveing porn from over seas? Or was he just protecting his personal notes? The Media and the sheep, i mean ppl, wouldn't be moved to take a hard position if it is just one guy protecting his diary, even if it contained lots of evidance. But give them a network of child porno guys, and a well done under cover operation that gives just enough information that uncrackable crypto was used and that the police were lucky in catching these guys with inside info and that there are many encrypted messages flowing in and out, and throughout the US that could be pornographers just like these guys, or worse, and the police are powerless to do anything, even if they suspect wrong doing. Just watch the Media jump all over this one. mycal

1 0

Re: Disturbing statistics on wiretaps
by Matthew B. Landry 17 Dec '03

17 Dec '03

>>And of course it should be remembered that there is still an old drug-war >>thing on the books which allows 72 hours' interception without a court >>order. Now depending on how that's interpreted, 72 hours are a lot of >>conversations. This stuff can be used for background intelligence and >>investigation where it never winds up in court but is used to get >>information to be used in other ways. "It's what they don't tell you..." > >This can't be true. > I don't know if this specific law is true or not, but a lot of those drug war laws are the type of thing that would make a sane person say "This can't be true". Only it is. For example, say that I mow lawns for spare cash as a teenager. When I go off to college here at AU, I pay some of my tuition with money from my lawn savings. AU takes some of my tuition and pays Mariott for providing meal plan service. Mariott pays its staff's wages with the money from AU. The staff pays their rent out of their wages. Perfectly natural chain of events, and it happens all the time. Now we introduce a new factor. One of my lawn customers, without my knowledge (because it was none of my business) sold drugs. He put some of the proceeds from the drug sale into my pocket when he paid me for services rendered. _All_ of the assets of _every single person and organization I mentioned above_ are now considered tainted with drug money, and are legally government property. The Mariott corporation would suddenly belong to the DEA. So would everything else. Every single piece of property involved could be auctioned off to the highest bidder, and the government would keep it all. Fortunately for AU and Mariott, I never mowed lawns in High School. Thus, I couldn't possibly have drug dealers for customers. This is the kind of hysteria-backed power that Joe McCarthy most likely dreamed about. This is the kind of power that Hitler had. This, incidentally, is very much like what Castro did in Cuba that made him so unpopular here in the US. So think before you say "that couldn't be true", because it probably is. -- Matthew B. Landry ml7694a(a)american.edu (Finally!) mbl(a)ml7694a.leonard.american.edu

2 1

POISON PILL :-)
by Sandy 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I wrote: . . . What could be done have the computer screw up the cop's data days, weeks or months after the seizure? Of course, I would never do such a thing myself, nor would I advise anyone else to do so. I do, however, have a passing academic interest in the subject. Same for you folks too, right? Perry responded: Why wouldn't you? Its your machine, so what you do to it is perfectly legal. You are under no obligation to make your equipment suitable for people who wish to steal it. Well duh, Perry. Let me rephrase that: . . . nor would I advise anyone else to do so. I do, however, have a passing academic interest in the subject. Same for you folks too, right? * * >>> please note! >>>> | <<<< please note! <<< \___/ (smiley face for the humor impaired) But all seriousness aside, Perry also offers a suggestion about altering the ROMs on the disk controllers and then using a special operating system. Sounds like a terrific idea. Just how hard is this to do? How about somebody writing a how-to manual for this? Or maybe all we need is a sticker that says: !!WARNING!! This Machine is Booby-Trapped Use at Your Own Risk S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re: POISON PILL
by msattler＠netcom.com 17 Dec '03

17 Dec '03

At 19:29 9/30/93 -0600, J. Michael Diehl wrote: >How about we take a copy of the public domain bios source, or disassemble one >ourselves. We hack the code a bit... Then we burn a new prom to install into >our machines. AND WE EPOXY THE MOTHER TO THE DAMNED BOARD! We build a card to >stick in our machine which receives a radio signal which contains a decription >key to be supplied to the bios hacks mentioned above. So we use a protable >radio transmitter to send the password to our machine. Our bios waits for this >password for use in decripting the filesystem. If the bios doesn't get this >password, it trashes the cmos and does whatever other mean things it wants to. What interests me the most about this (and similar proposals) is who will be signing up to test this baby on their own computers. Oh well, I guess that's what employer's hardware is for :-) ----------------------------------------------------------------------------- Michael S. Sattler msattler(a)netcom.com +1 (415) 358-3058 Digital Jungle Software Encrypt now; ask me how. (finger for PGP key) "Don't Panic!" -- Douglas Adams "Don't Panic. Stay Cool." -- PRZ

1 0