December 2003 - cypherpunks-legacy

Forged messages (was: TC May advertises cypherpunks as keeping your taxes from going to 'people of colour')
by Matthew J Ghio 17 Dec '03

17 Dec '03

"gtoal(a)gtoal.com" <gtoal(a)pizzabox.demon.co.uk> writes: > Perhaps Detweiler was right after all about certain cypherpunks having > a hidden agenda... seems TC May's rationale for running the cypherpunks > list isn't to do with enhancing individual liberties but rather keeping > all us WASPS safe from 'people of colour'... > > I want nothing to do with a list run by racists. Unsubscribe me now > please (cypher(a)an-teallach.com) > > G A few headers from the message: Received: by toad.com id AA16763; Sat, 15 Jan 94 05:13:04 PST Received: by toad.com id AA16671; Sat, 15 Jan 94 05:09:48 PST Received: from gate.demon.co.uk ([158.152.1.65]) by toad.com id AA16667; Sat, 15 Jan 94 05:09:42 PST Received: from pizzabox.demon.co.uk by gate.demon.co.uk id aa06847; 15 Jan 94 13:04 GMT Received: by pizzabox.demon.co.uk (AA25018); Sat, 15 Jan 94 13:01:35 GMT Date: Sat, 15 Jan 94 13:01:35 GMT Message-Id: <9401151301.AA25018(a)pizzabox.demon.co.uk> From: "gtoal(a)gtoal.com" <gtoal(a)pizzabox.demon.co.uk> Reply-To: Graham Toal <gtoal(a)pizzabox.demon.co.uk> To: cypherpunks(a)toad.com Subject: TC May advertises cypherpunks as keeping your taxes from going to 'people of colour' Note that pizzabox.demon.co.uk [158.152.8.236] doesn't tell where it got the message from. Could it have been longs.lance.colostate.edu? I liked Detweiler better when he just used anon.penet.fi. P.S. I sent myself a test email by telnetting to pizzabox.demon.co.uk 25, but it identified the IP address I telnetted from... hopefully the site administrators at demon.co.uk have recognized the problem and taken steps to prevent further detweiling. But be on your lookout, this will only hold him off until he can find another SMTP port to spoof from.

2 1

WARNING: IGNORE ANY RECENT POSTINGS FROM MY SITE
by gtoal＠gtoal.com 17 Dec '03

17 Dec '03

I've just caught someone logged on to Matthew Ghio's account mg5n(a)glenn.res. andrew.cmu.edu abusing my system to post mail purportedly from "anon(a)detweiler.com". I suspect it was aimed at cypherpunks though since I'm now no longer subscribed, I don't know what he posted. I can't tell the recipient from the minimal logs here. I've notified the andrew.cmu.edu postmaster that someone may have abused Ghio's account and be using it to hack from. Graham

1 0

SecureDrive 1.1 & 1.2
by W. Kinney 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hal <hfinney(a)shell.portal.com> writes: >Mike wants to protect himself against a PGP-style investigation into >export of software. But if 1.2 is put up for FTP, it could conceivably >lead to such an investigation. And Mike would presumably be a >potential target. > >This is a confusing situation. What rights does Mike have to control a >derivative product like 1.2, given that he is releasing it under the >Gnu Public License? Legal questions aside, one might hope that within the Cypherpunks at least there might be more of an ethic of respecting the wishes of an author. Edgar seems awfully casual about exposing other people to legal difficulties without their consent, and justifying that by some bullshit technicality doesn't change the reality of it one bit. I for one am most unimpressed. -- Will -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLTfaV/fv4TpIg2PxAQG8TgP7B1RCFmNquI1ctKdLqVutIcWy8S8ycM3F wjZXGuCRiDZnRQh6q+WTp7aG5p07suF0qmVCFZnvAmrLBZx/PfsFxRPuSZML5J4R b+Clw9uq2rADxUbClgekp7oL4MXmOuXjYCiXdc2CoogME2s4fZRdT9cdteS6hieW kQOWTzfGQzw= =CQtw -----END PGP SIGNATURE-----

1 0

Using the tools we have
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The detman has been blathering for weeks about how he will subvert the list and we now see all sorts of rants impugning the reputations of certain cypherpunks. Postings are reiterated with the message that so and so said this or that and this person is a nazi, or some such drivel. I have no idea who said what because many of the technowizards don't avail themselves of the technology which they themselves have made available and promote as a powerful new tool for the future. Positive reputations? Without an electronic sig, you don't have one. Future? It's here. If even we don't use the available tools, then they are indeed worthless. Expect a long campaign of det-rants if people don't take steps to negate this bullshit now. I personally don't want to see the list go back to the way it was in the days of an12070. Many of you have been hard at work developing NET tools for the future, I applaud you for it but it seems that you will soon need them-like now. It's a pain in the ass for me to sign stuff and I am probably the least techno-capable of all of you. I do it because I see the writing on the wall, you see it too. The time is now punks. Scott G. Morham !The First, Vaccinia(a)uncvx1.oit.unc.edu ! Second PGP23a Public key by request! and Third Levels ! of Information Storage and Retrieval !DNA, ! Biological Neural Nets, ! Cyberspace -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLTefRz2paOMjHHAhAQFhfwP9EKM24d0ha4jktJhykLiIRU31MjJ5ne8q V7YDgKFfYnaj5SmwcSCDSDyeKfEBlKdEW32MJlNRmE+OpgINv/+IlZivJzof3bCx Qqr/FS2erUHGRTcDo1D164PEMaNbqAwCgSfVaaW1EnzNbGqv/4q0aVV17IlOl7Zq gPmbueEPfrs= =nTSc -----END PGP SIGNATURE-----

1 0

Detweiler is really losing it...
by remail＠tamsun.tamu.edu 17 Dec '03

17 Dec '03

Question: has anybody actually had any contact with Detweiler recently? I know he used to be a rational and respectable Usetter; keeper of the Privacy FAQ, runner of an autoposter service for other people's FAQs, etc. I'd like to think this is all somebody's research project or piece of performance art, but otherwise... it's pretty ugly to watch this disintegration happen. The deterioration has been marked even within the last few weeks. The RISKS posting was coherent enough, and no more paranoid than say, the average talk.politics.guns poster. My opinion is just from his language, logic, reaction to other people - whether his conspiracy theories are true are not is pretty irrelevant. Multiple identites mapping to one person is hardly unusual in electronic spaces, but most people regard tracking them down as a challenge or an entertainment, not as the cause for desperate rage and paranoia. Cf. the netsport of hunting down John Palmer identities. Is he actually a student at Colorado State? If so, and he's genuinely sending out death threats, the recipients might seriously consider forwarding them there. Not to get him in trouble, but perhaps to get someone to look into the situation before this accelerating downward curve gets where ever it is going. There's plenty of nuts on the net, but the level of their nuttiness is stable enough. I don't think I've ever seen someone fall apart like this before. Of course, maybe it *is* just performance art... Laura -- -------------- Laura Burchard / burchard(a)digex.net ---------------- "It didn't take very much reductio to get right down to absurdium from where you started." ------------------------------------------------------------------------- To find out more about this anonymous remail service, send mail to remail(a)tamsun.tamu.edu with the word "remail help" as the only words in the subject field.

1 0

On leaving the list; and forgeries
by gtoal＠gtoal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ah. Now I see why Matthew was forging mail from my site. Thanks for your concern Matthew, but the mail was indeed from me, and pizzabox is quite secure since I run home-brew fingerwarz and pidentwarz daemons. I'll pgp-sign this confirmation just to keep everyone happy. Yes, I have unsubscribed from cypherpunks because I don't want to be part of a list which is advertised elsewhere on the net as being sympathetic to people who don't want their tax money going to coloured people. If he'd said he didn't want his tax money going to unemployed people or poor people, I could have understood his viewpoint (though not sypmathised with it), but to explicitly single out coloured people in a posting soliciting like-minded people for cypherpunks tells me its time to move on. And as for doug@netcom's rant, I'm not even going to dignify it with an answer. G : Note that pizzabox.demon.co.uk [158.152.8.236] doesn't tell where it got : the message from. Could it have been longs.lance.colostate.edu? I : liked Detweiler better when he just used anon.penet.fi. : : : P.S. I sent myself a test email by telnetting to pizzabox.demon.co.uk : 25, but it identified the IP address I telnetted from... hopefully the : site administrators at demon.co.uk have recognized the problem and taken : steps to prevent further detweiling. But be on your lookout, this will : only hold him off until he can find another SMTP port to spoof from. -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLThdO3CRCOmNcN2dAQG80QP/aWyl1C2AsVpxtR/Jvtaj2egf+CAtXtZq KSYzmo2xLe/8iTJdD495Ttjrsp/hSB9Z630EU0bTfPQ7o82uf75JE3F1oz+tzRiq LlNjpUwaEX3PVZNQkyiSrZ7dEALWbkaGVZgCsrXWXcvuGjdf/BSZpCSNtgj0O39h ZENhzUN+dfM= =X/Zc -----END PGP SIGNATURE----- PS Matthew - I'll mail the andrew.cmu.edu postmaster and tell him it was a misunderstanding.

1 0

Apology to Graham Toal & Cypherpunks
by Matthew J Ghio 17 Dec '03

17 Dec '03

I'd like to apologize for stating that the post made by Graham Toal <gtoal(a)pizzabox.demon.co.uk> was a forgery. It has now come to my attention that it was not. Graham Toal had always posted from <gtoal(a)an-teallach.com> until today, when he suddenly posted from: "gtoal(a)gtoal.com" <gtoal(a)pizzabox.demon.co.uk>, talking about a racist post by TC May that I had never seen, and asking to be removed from the list. Naturally, I got suspicious. I still don't know what's going on with the email address switching, but I guess the recent events on cypherpunks have made me a bit overly paranoid. Hopefully, I haven't made a complete fool out of myself over this misunderstanding. I guess we have another good reason to sign with PGP...

1 0

update noon
by hkhenson＠cup.portal.com 17 Dec '03

17 Dec '03

Update Saturday noon. Back from seeing Robert's sons and friend pick up his computer equipment and a 10 minute chat with Postal Inspector Dirmeyer, and a San Jose Police officer by the name of Weidner. At least one point is clear, David Dirmeyer and Lance White are the same person, I simply asked him, and he admitted it. I also found out why he was willing to talk to me during the search. He figured that anybody who starts quoting chapter and section from the Federal Code is a lawyer. [Dirmeyer reminds me somewhat of one of my cousins when he was about 18. My cousin was tall and gangly, and given to putting on a hick act.] Dirmeyer/White seemed completely unconcerned with having generated any liability for the government under the ECPA or the Newspaper Privacy Protection Act (2000aa). He backed this up by being very proud of getting the system (well, most of it anyway) back to the sysop in under a week. [The EFF *has* had a positive effect, this is the first time I ever heard of any LEA's caring how long they take to return a computer.] He was very confident that a judge would dismiss any civil lawsuit brought by the users because of what he perceived as criminal obscenity activities by the sysop. How actions, criminal or not, of one person (the sysop) cancels the rights of others (email customers) to recover from those who block access to their email is beyond me. If that did not get them off the hook, they would get out of civil liability claims because they interrupted people's email access for such a short time, as opposed to the lengthy time the Secret Service kept Steve Jackson's BBS. I can almost quote the relevant sections of the ECPA, and *I* don't remember any time limits under which the civil penalties of law do not apply, "But Judge, I only exceeded the speed limit for a *few* miles!" I wonder how the Postal Service would react to locking *their* patrons out of a local office and away from their mail boxes for a week? I expressed my hope (as a San Jose resident and taxpayer) to Officer Weidner that the Post Office had agreed to take responsibility for any civil liability arising out of the case. He was close to uncivil in stating that I had no standing in the case, and it was none of my concern. He advised me to butt out of being involved in any way. He asked if I had ever *seen* the material on that BBS, (my answer was no) and expressed the opinion that I would be smeared by it and greatly regret getting involved. Back to Dirmeyer, I asked him about the warrant. He said what he did is ordinary investigation practice, including sending people unsolicited material and then picking it up under a warrant. I asked him if the Judge knew, and he assured me the Judge was fully aware that the person getting a warrant for "Lance White's" correspondence was also Lance White. He also said the Judge was aware of the 2000aa and ECPA issues, and that they were under orders not to look at anything labeled email. For some reason, this did not reassure me. Robert's sons and a friend got the last pieces of the computer down to the lobby and we parted company with a few comments on my part about Postal Service agents legally sending kiddy porn through the mail, like the Nebraska case recently ruled entrapment by the Supreme Court. Just one minor thing to add. Because of a persistent back injury, I am on crutches most of the time. I was making my way across the lobby of the old Post office nearing the doors. Dirmeyer and Weidner passed me, opened the doors, went through and let them swing shut in my face. I guess scum like me is below their notice. Keith Henson

1 0

Secure Drive versions
by Mike Ingle 17 Dec '03

17 Dec '03

My only problem with Secure Drive 1.2 is that it doesn't include the bug fixes which needed to be included. If Edgar wants to use my 1.1 code to make 1.3, great. But the two-drives bug needs fixing, and I wrote a cracker which tests 1000 passphrases per second on the 1.0 version. The 1.1 version iterates the passphrase hash to prevent this. As for how it's distributed, I've always requested that it not be exported, and there is a message in the new distribution asking that foreign sites not carry it if they somehow obtain a copy. --- Mike P.S. All these forged messages are becoming a problem. Detweiler may succeed in his effort to make us not know who's real and who's a tentacle. Ignore anything from a remailer, which (a) has a name at the bottom, or (b) sounds like Detweiler. As for what to do about SMTP spoofing, any ideas? Next he will start posting denials of real messages. That way we won't know what messages are real and falsely denied, and which ones are false and the denials are real.

1 0

Re: Using the tools we have
by Jeremy Porter 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <2h9gen$55r(a)uudell.us.dell.com> you write: > >From owner-cypherpunks(a)toad.com Sat Jan 15 19:33:39 1994 >From: VACCINIA(a)UNCVX1.OIT.UNC.EDU >Subject: Using the tools we have >To: cypherpunks(a)toad.com >-----BEGIN PGP SIGNED MESSAGE----- > >The detman has been blathering for weeks about how he will subvert the list >and we now see all sorts of rants impugning the reputations of certain >cypherpunks. Postings are reiterated with the message that so and so said >this or that and this person is a nazi, or some such drivel. I have no idea >who said what because many of the technowizards don't avail themselves of the >technology which they themselves have made available and promote as a >powerful new tool for the future. Positive reputations? Without an electronic >sig, you don't have one. Future? It's here. If even we don't use the available >tools, then they are indeed worthless. One usefull thing that could be done, is to design a list, that will only post pgp-signed messages. To subscribe to the list, you send your pgp public key, and it sends back its private key. In order to for a recieved message to get sent out, it must be signed by the author. In order to make anonymous posting possible a person would need to create a "anonymous" key, with the anonymous remailer address in it. The annonymous account would still have to sign the messages so and identity could be track through this method. In order to prevent some kinds of abuses, the list server could send a password back to you encrypted with the private key you sent it. You would have to send it the password back encrypted with the server's public key. This would verify that the key was created by a particular users at a specific site. (OK, it would be possible to subvert this, but it is significantly more difficult.) The person that runs the list server can sign the list server's key to vouch for the listserver. For added security you could do something even better. The list server only posts messages that are "trusted" at a specified level, or it adds a trust factor to the message. If the list maintainer has met you and has signed his key, the list server will believe you are real. With the web of trust and introducers, the list server will quickly be able to identify most of the people on the list as being real or "pseudo". In particular this will cut down on the number of forgeries posted to the list. There are some technical problems with this, due to the hassel of signing and or encrypting the messages. Lack of anonyminity, etc. This could even convince most SANE people that there is no conspiracy, i.e. someone you trust to act as an introducer, believes that the other person you are talking with is real. Of course if there really is a conspiracy it doesn't really help. One of the things I've been thinking about recently, is about excerpt of messages and signatures. When you reply to a message and copy part of it there is nothing that prevents someone from editing the text. And of course the digitial signature is not longer valid because of the >'s or other characters in the body, plus you probably don't want to quote the whole message. Duplicating the entire message to prove that two or three lines were actually writen by a particular user id, is pretty wasteful. I suppose someone could write a signing program that signs each line idividually, but that does not sound like a good idea either. A 128bit hash would eat nearly 10% of each line. The hashes can be signed in the signature section at the end. After rereading some of Schneir book, it looks like you can't generate a MD5 hash for less than 64 bytes. You would need to pad lines or generate a hash for every two lines. It would still require some fancy software to handle the extracts and preserve the signature information. Currently most peoples software doesn't even easily support normal PGP/RSA signatures, much less anything so fancy. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLThtW3NeM/yj7Ik1AQEWgAQAh5tqTP1YvTQy09GhqlX85tkt8yH55Lz1 TRcZA5mJ8k9OXqgVLwkIHVUPViX+m+iSLuLR+QWbgUV04uPS/V8wzrnDNWRKvkQE qmYR3ZSr3agouXQygmFMtPgHzQpkzHNxV6rVSM6Wq7hEj/2lga7+lptHRW9Zy0tC SLL+0C6Jcpc= =rKLG -----END PGP SIGNATURE----- -- Jeremy Porter ----------------- Systems Enginneering ---- Dell Computer Corp. --- jerry(a)terminus.us.dell.com -------- ------------------------------------------------------------ Support your Second Amendment rights to encryption technology.

3 2