December 2003 - cypherpunks-legacy

Unsubscribe
by Thure 17 Dec '03

17 Dec '03

Unsubscribe me please. / Bjoern nv90-btu(a)nada.kth.se

1 0

Pornography Server
by Robert A. Hayden 17 Dec '03

17 Dec '03

In response to the posting about setting up a pornography server (Sorry, I'm afraid I deleted the specific message so I cannot remember who you was :-). That is certainly a way for people to get and use PGP and to get used the remailers. It would get a lot of heavy use as well. Now, if there was a way to batch mailings (so that if, say, six people ordered one item, it would be sent as one letter to all six instead of six different letters, with precedence set to bulk), that would help even more. Now, there are also some practical considerations as well. What materials do you archive? If you put up pictures (gif or jpeg), you will be talking about tremendous amounts of traffic. Once they are uuencoded, even with compression, they can be huge. If you limit yourself to things such as stories and the like, you will have less traffic, but also less use. There is also the legal side of distributing pornography. Interstate transfer is naughty and with Al Gore's Information-Superhighway Patrol, it will raise some very political issues (but, by using a decent blind system, for all the patrol knows, the distributor might be in the recipient's state). Also, and this is really just an interface issue, scripts should be developed that will automate the retrieval process (ie, build and submit the mail message). These would be similiar to the hop.mail or anon.mail scripts, but would be custom to the pornography server. For example: It begins with an input for the file to be retrieved. It will continue prompting for that until the person enters a null (or 'q' or something) It will then list (at least) one dozen remailers, and they can select one (or take a default, and randomize it. Or perhaps randomize it through >1 remailer, although that decreases response time.). They will then have to PGP sign their mail message (so that the ordering software can verify the person placing the order. This is to cut down mail-spoofing to mail-bomb an enemy with porn.) Encrypt it for the appropriate parties Send it on its way. The server can either reply immediately with the appropriate files, or it can batch everything up for processing during low-traffic times (I personally like the first, but dont' really care that much). The mail is then PGP encrypted back to the recipient (by getting the key from a key server, or by having the orderee register their key before hand, with the latter probably being easier, although it does leave a paper trail that can be examined) and sent out with precedence set to 'bulk' so that other stuff is more important on the mail links. It should all be fairly accomplishable with a series of perl and sh scripts on either end. The real question is what to offer. I'll talk more about this from an organizational stand-point if anyone is interested. I'm afriad that I'm really not that good a programmer (even of simple shells) as my field of expertise is in management and other administrative stuff (but obviously not spelling :-) ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> In the United States, they \/ Finger for PGP 2.3a Public Key <=> first came for us in Colorado... -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0

Broadening the use of Cryptography
by Matthew Bernardini 17 Dec '03

17 Dec '03

Maybe I have just missed something in this whole discussion, so please hold back the flames, but has a SIMPLE desktop mailer that encrypts using PGP been writen and widely distributed on any platform ? The common person will only do something if you make it simple for them to access. The attitude of don't complain, write the code youself won't fly with average Joe who wants to help by spreading the use of PGP. Most people have barely just enough time to worry about reading the news and checking their mail, let alone downlaod, compile and implement an encryption scheme. The priority should be to get people encrypting first, then worry about whether they understand the protocol for double-blind remailers. It seems to me that Universities should be the highest priority for spreading the use of PGP. It is the students who are willing to adapt to new technology the quickest. Some sort of product should be developed that can be distributed on the PC and Mac, like Pegasus mail (for those that are familiar with it), that will support PGP. It all comes down to marketing. Why not make a nice free-ware game that can carry a Cypher bill-board with it ? How many people see the Maelstrom start up screen on a Mac ? X-tetris on Unix ? Minesweeper on Dos ? It seems to me that widespread advertising should be a higher priority if PGP is going to succede. Matthew Bernardini

2 1

Re: Oh No! Nazis on the Nets
by qwerty＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Bob Cain said, >It could be the Pandora's box awaiting the opening that the cold war >years never quite showed the balls to attempt. In this unstable and >angry world with people obviously standing ready to do *anything* they >can to get their way, is it appropriate to help them accomplish their >deadly and reckless methods? I dunno, but when you feel you hold the >key to this in your head and respected people think so too it really >make you *stop* and think. Some of us have a lot more respect for humanity than these words of fear express. People like to talk to each other. That's all. Get out there and talk to people instead of gobbling up the media's attempts to tell you people are evil if you set them free to be themselves. The only ones who are evil are those too greedy or at least to narrow minded to see that it's time to bring the rest of the species up to our standard of living. It's you, the "good guys", who are forcing the unfortunate to turn to crime. It is this actively artificial scarcity that causes groups of people to band together to either fight those who do not have enough, or to fight those who do. "Peace and Love," -=Xenon=- <qwerty(a)netcom.com> -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLV456gSzG6zrQn1RAQFEKAQApdNxls7ProP5Kl3hyt4ARfWGP+3V4Mdx PKN0j/4UbUNtCxZKMIMV+9YJioDO5S5wg3IDf2yF6/nesDG+jEmfG59EeBujau4i w3Y8c73sPZQL5ymktV9HUapf444xsXdoeycXjF+sDCPm2USuc3vCp0+Z38nA2X6m OmcOI7xAnFY= =Ng9t -----END PGP SIGNATURE-----

1 0

Re: The Clipper connection
by freeman＠MasPar.COM 17 Dec '03

17 Dec '03

Keith Henson comments on the realities of obtaining subpoenas and wiretaps: > [...] I cannot help but note that if persons of good will should choose to attempt to improve the uniformity and correctness of application of law to circumstances such as those Keith mentions, a well-written expert system with a friendly user interface might be part of the solution. (This observation is a little borderline for cypherpunks but it does in principle involve writing code...) -- Jay Freeman

1 0

PGP Procmail
by Fred Cooper 17 Dec '03

17 Dec '03

A while ago, someone (Matthew Ghio?) posted a procmail recipe for handling PGP msgs... I just switched over to using procmail and would like a copy of this... If someone can contact me for transfer arrangements, or provide with a pointer to its location .... Thanks FRC -- #include <hdrs/disclaim.std> /* Neural Nets catch only dreaming fish. */ Paranoia... It's more than a state of mind. It's a way of life.

1 0

REMAIL: new remailer
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Cypherpunks, After reading Tim's ideas on second generations remailer, I decided to try coding a new experimental remailer which includes some of the features mentioned. Because I am doing a couple of different things, I wrote the scripts from scratch since I need the familiarity with the code that comes from actually writing the whole thing yourself. However, I don't think it will be hard to add these features to Hal's code, if they are found desirable. I've been testing for a while and it seems to work. * Send mail to barrus(a)tree.egr.uh.edu to enter the remailer. Ultimately, mail will be remailed from elee6ue(a)rosebud.ee.uh.edu. That is, there is a "mystery" processing point in between: mail -> barrus(a)tree.egr.uh.edu -> ? -> elee6ue(a)rosebud.ee.uh.edu -> wherever. I imagine it isn't difficult to figure out what the middle processing point is, but I thought I'd distribute things around a bit. * Mail from ? to elee6ue(a)rosebud.ee.uh.edu will be encrypted, even if the mail sent to barrus(a)tree.egr.uh.edu isn't. So mail with a latency delay will be encrypted as it sits at ?; mail with no latency will by encrypted before travelling to elee6ue(a)rosebud.ee.uh.edu. * The remailer elee6ue(a)rosebud.ee.uh.edu has been restored to normal. That is, the "digital cash" (random strings) features has been taken out. * The remailer figures out whether the message is encrypted (with PGP) or not. So no encrypted pasting token; perhaps later I will add RIPEM capability. * Instructions to the remailer are of this form: <instructions and stuff go here> <body of message goes here> The instructions come first, then a space, then your message. The original header of the message is thrown out (see *subject below). For example, a valid message with the new remailer is: - ----------8< cut here >8---------- Anon-To:klbarrus@owlnet.rice.edu Subject:guess Gee, I think I figured out where ? is. - ----------8< cut here >8---------- Of course, message body may be further encrypted with the public key of the remailed-to person, and the entire message (between the cut marks) may be encrypted with the public key of the remailer. * The following instructions are recognized: Anon-To:address Request-Remailing-To:address Cut:cutmarks Latent-Num:num1 Subject:text * Anon-To: and Request-Remailing-To: are really the same. The address specified is where to send the body. If the address is /dev/null, whitehouse.gov, or null, the body is dropped. If you attempt to mail to an*(a)anon.penet.fi, the address will be rewritten to na*(a)anon.penet.fi. * Cut: allows you to specify cutmarks. DO NOT PUT A SPACE AFTER THE COLON UNLESS YOU WANT IT. Thus Cut:-- specifies the cutmarks to be '--' (beginning of line, dash, dash, end of line) while Cut: -- specifies the cutmarks to be ' --' (beginning of line, SPACE, dash, dash, end of line), which is very different. Sendmail is invoked with -oi so putting a lone period in the first column should not end the message. You can specify (nearly) arbitrary cutmarks, which are matched against the body of your message. If an exact match occurs, the rest of the body is not sent. If you specify cutmarks which also happen to be PERL metacharacters, the cutmarks will be changed to the default '--'. I've tried to allow for the metacharacters to be cutmarks, but it just won't go. If you happen to know how to do it, let me know. Try the cutmarks feature out before depending on it to save you. * Subject:text allows you to specify your subject. When mail is received, the original header is thrown out. After all, you can pad and multiply hop your message all over but if the subject remains "How I reverse engineered the Clipper chip" throughout it's trip, then you lose some security. If you do not specify a subject, "Re: your mail" will be used. * Latent-Num:num1 lets you specify how many messages must come in (not necessarily be mailed out) before yours goes. Pick a reasonable number or your mail may sit there for a real long time. * Logging: I'm only logging whether an arriving message was PGP encrypted or not, and the day of the month. This is just to get an idea of usage. * I'll fill out Xenon's remailer disclosure list soon. But this remailer involved three seperate account on three different machines so it might not fit into the current list very neatly ;) Here is the public key for the remailer: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAi1al40AAAEEAJgl2BRKibTRuBPufnNwUnYWU8jyqHOeO5CvOCw8ZhVJm614 Jaa134x8LgfjBRdU4eLMth3D6ldYhtJQ1k2UMHsx9QUAIWVY5mOn0o8wbQNjqAuv 5SFUYBg8qS7U8pdl8Mr0v2Cmyeq9WeRSaoeYxf+D4hQIjMvnMMcTftZ/jd/BAAUR tCFyZW1haWxlciA8YmFycnVzQHRyZWUuZWdyLnVoLmVkdT6JAJUCBRAtXdAtg4Ds 6kta1jMBAY+yA/9XDZZXgG8pTAKky4Zj8KxDSfPZIesXSEN9I/tsV4Zfak9mE8Oc aRs2Wphx6WcasX6/D9lgP8bT/Pnr9NDvqWLg0vC9yxk87D9ny8xNAreVTeH0+/HD 7VaMhiQCEsADut+0FYFs/44N/IeQriOZS48kwM1PdUjVlc2aqMmobsk4SA== =XWIf - -----END PGP PUBLIC KEY BLOCK----- Other things I will be looking at implementing as time permits: * Digital Cash - hopefully with the Magic Money code. * Time Latency - letting a user specify when (timewise) before remailing a message is remailed. I will possibly combine this feature with digital cash. * Avoiding Sendmail - using an SMTP package Peter Honeyman sent me. Maybe just telnetting to port 25 if that's good enough. * Padding - Hal sent me some code to pad inside PGP messages; upon decryption the padding is thrown away. * Other ways to receive mail - that is, something like an altered fsp, custom client/server code, or WWW in Nate's experiment. Essentially materialize the file at the remailer (without mailing to the remailer) to be delivered later. This will probably be undoable since I'm not root. Karl Barrus <klbarrus(a)owlnet.rice.edu> -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLV6NgYOA7OpLWtYzAQF2JQP/YSrLjPbjPIzStLAwTcIazl9rPCr4O3if RWs8YUFJvt+1+2XGkPTdSd+poRykwN/x+9JNK2cCsy8MP4gd8hxOkpaFclAdFLO+ X2e66Y3JVCbXWvGQEG3hUeWIcte2uc5WCXaXhG8FkU6Lhkw9XZFX7la4ZJ7bKmGo ExaTyCJVZu4= =B3D/ -----END PGP SIGNATURE-----

1 0

Re: a protocol (that doesn't work)
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Did you ever wish there was an "unmail" command? I realized about halfway home that the protocol I described not only didn't work, but demonstrated to the world my lack of understanding of the man-in-the-middle attack against Diffie-Hellman. Oh well, I guess I'll keep my day job a little longer... At least I now have a better understanding of just how hard it is to foil man-in-the-middle attacks. >From reading the description of the Interlock Protocol, I saw that it is possible to arrange things so the man in the middle has to do a lot more work. It may be that Robert Cain has come up with a protocol that increases the work necessary to maintain a man-in-the-middle attack to the point where the attack becomes impractical, although not impossible, in theory. However, I think that is this becomes the case, an attacker would simple cut Bob completely out of the picture and change the man-in-the-middle attack to a %100 spoof of Bob. Since Alice and Bob have never met and don't share any secrets, how would Alice be able to tell the difference between the real Bob, and Mallet completely spoofing Bob? In the abstract, I don't see any way. There may be some real-world situations where Alice can tell the difference between Bob and pseudo-Bob. It depends on the situation and what assumptions Alice makes about a properly behaved Bob. If pseudo-Bob doesn't behave the way Alice expects real-Bob to behave, then Alice could get suspicious. But now we've existed the realm of cryptography and enter the realm of human relations. Of course, there's still a lot of money to be made offering imperfect solutions that are good enough for some people. Jim_"still learning"_Miller(a)suite.com

1 0

REMAIL: list of remailers
by Karl Lui Barrus 17 Dec '03

17 Dec '03

Well, it's been a bit since I posted this, I hope I got all the activity over the past month. -----BEGIN PGP SIGNED MESSAGE----- Cypherpunk anonymous remailers, 2/13/94 Q1: What are the anonymous remailers? A1: 1: remailer(a)chaos.bsu.edu 2: nowhere(a)bsu-cs.bsu.edu 3: hh(a)cicada.berkeley.edu 4: hh(a)pmantis.berkeley.edu 5: hh(a)soda.berkeley.edu 6: 00x(a)uclink.berkeley.edu 7: hal(a)alumni.caltech.edu 8: ebrandt(a)jarthur.claremont.edu 9: catalyst(a)netcom.com 10: qwerty(a)netcom.com 11: remailer(a)rebma.mn.org 12: elee6ue(a)rosebud.ee.uh.edu 13: elee7h5(a)rosebud.ee.uh.edu 14: hfinney(a)shell.portal.com 15: barrus(a)tree.egr.uh.edu 16: remailer(a)utter.dis.org 17: remailer(a)entropy.linet.org 18: elee9sf(a)menudo.uh.edu 19: remail(a)extropia.wimsey.com NOTES: 1-6 no encryption of remailing requests 7-19 support encrypted remailing requests 19 special - header and message must be encrypted together 11,16,17,19 introduce larger than average delay (not direct connect) 11,16,19 running on privately owned machines 18 supports RIPEM encryption, caches remailing requests 15 supports different request syntax 5 features USENET posting ====================================================================== Q2: What help is available? A2: Check out the pub/cypherpunks/remailer directory at soda.berkeley.edu (128.32.149.19). chain.zip - program that helps with using remailers dosbat.zip - MSDOS batch files that help with using remailers hal's.instructions.gz - in depth instruction on how to use hal's.remailer.gz - remailer code pubkeys.tar.gz - public keys of remailers which support encryption pubkeys.zip - MSDOS zip file of public keys scripts.tar.gz - scripts that help with using remailers For MAC's, at 129.82.156.104 in /pub/pgpc/ are two files: pgpc22.tar.gz, pgpc22.tar.Z which assist in using the anonymous remailers, including anon.penet.fi. Or try the cypherpunks gopher site (chaos.bsu.edu) and look in "Anonymous Mail" for instructions. Mail to me (klbarrus(a)owlnet.rice.edu) for further help and/or questions. ====================================================================== Q3. Email-to-Usenet gateways? A3. 1: group-name(a)cs.utexas.edu 2: group.name.usenet(a)decwrl.dec.com 3: group.name(a)news.demon.co.uk 4: group.name(a)news.cs.indiana.edu 5: group-name(a)pws.bull.com 6: group-name(a)ucbvax.berkeley.edu NOTES: * This does not include ones that work for single groups, like twwells.com. * Remember to include a Subject: with your post, may cause failures if missing #6 blocks from non-berkeley sites (so use the berkeley remailers :-) -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLV6YtoOA7OpLWtYzAQFwogQAxfy0wgSBBDtFXCMoI6ie1cTJSlw8kPrz wCKwsVN5gOrIIjCiesfbcQCwJYOyQMvOFfem3AI7M/fhKWocObqca8h5dViXi21O ZKXzZM2QeKmlNI35OwpgxUSp6hZa6rI8xJxvG88yadCZ0oNisvz5Ibb0Pab3XH1p 3nk0upVKlSM= =VnOr -----END PGP SIGNATURE----- -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

While not _directly_ an encryption matter, it bears pointing out that pure text seems to be falling under the tender ministrations of the Bureau of Alcohol, Tobacco and Firearms. Reports in talk.politics.guns indicate that the Louisville, KY BATF has informed a non-FFL (i.e., not a gun dealer, thus not under BATF jurisdiction in the matter) Army-Navy store's proprietor that it would be "shut down" if he did not remove from sale some Paladin Press titles on illegal conversion of firearms. According to followups, it's worse: The State of Michigan has outlawed such texts for some time now.

1 0