December 2003 - cypherpunks-legacy

Re: Remailer Tearline Conventins
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Someone (not me) asked about remailer tearline conventions to eliminate automatic sigs: Though this subject came up some months ago, I never noticed any final decision. Is there now an accepted tearline convention for the generic cypherpunks remailers? The mail handler here and at most of my other accounts automagically adds the host address and/or my address to all outgoing mail, which is...well..._counterproductive_ when sending mail to a remailer. The extropia remailer by accepting encrypted messages avoids this problem, but most of the other remailers seem to have no provisions for excluding extraneous text and address footers. Was there ever a "8<----(cut here)" arrangement agreed upon and incorporated into the remailers? I'm the one who brought this up "months ago" and the short answer to your question is "no." One remailer Hall Remailer <nowhere(a)bsu-cs.bsu.edu> added a "cut line" of --ignore-- [no indentation in actual use]. I tested this when Hall first announced it and it seems to work. You would be advised to test it yourself before relying on it. Unfortunately the Hall Remailer is one of the remailers that does not support encryption. AFIK, this "cut line" code was never propagated to any other Cypherpunks remailers. At the time I brought this up, the attitude of most remailer operators (Chael Hall and Miron Cuperman notably excepted) was that anyone who couldn't figure out how and remember to turn off their auto sig didn't deserve any privacy. I recommend that you always use the wimsey (extropia) remailer as the first (or only) leg of a remailer chain. It is also the only Cypherpunks remailer outside the USA (it's in Canada) which will make tracing msgs a little more difficult for USA authorities. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLU5FJt4nNf3ah8DHAQECYQP/f2LDs7Tq1PfrH4PQBOR0Iu1XIrCDztZB dVapPFSjfF2Y20ljWqHsMK7xjUpfLpaXluFogav9DpGgey/zrO48MJJf8gFBGsJA 7gsOUl3Yc3VDPWvWI18zN4MgYeeEfRoTXIToWSeiadJmiEMq5m0hqs1bjZwOmmSr rewqGMxMUeI= =U43w -----END PGP SIGNATURE----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

Re: SuperPing1.2
by nobody＠qwerty.org 17 Dec '03

17 Dec '03

If it wasn't obvious, SuperPing is the sort of utility that only needs to be run say once a day by ONE person out there. Since I did it today, and I haven't reported any down links, you can be rest assured the network is fully connected, at least the remailers listed in the code. -Xenon

1 0

Re: Remailer Tearline ConventiOns.
by nobody＠qwerty.org 17 Dec '03

17 Dec '03

Edgar wrote, "I recommend that you always use the wimsey (extropia) remailer as the first (or only) leg of a remailer chain." I'm not too familiar with extropia these days. Does it have a direct internet connection? What is its characteristics? I'm trying to make up a more useful list of remailers, with details, since different users do have different needs for remailers. Thanks. -Xenon

1 0

WWW Anonymous Remailer Software release
by nate＠VIS.ColoState.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have modified my WWW Anonymous remailer interface and put it up for ftp on vangogh.vis.colostate.edu in /pub/nate/remailer There is a README in there which should explain how to set it up, but if I missed anything, please tell me. The remailer no longer needs you to tell it that you're using the remailers, it just knows. Hope you like it, - -nate - -- +-----------------------------------------------------------------------+ | Nate Sammons <nate(a)VIS.ColoState.Edu> <nate(a)yuma.ANCS.ColoState.Edu> | | Colorado State University Computer Visualization Laboratory | | Data Visualization/Interrogation, Modeling, Animation, Rendering | +-----------------------------------------------------------------------+

1 0

On return addresses
by hughes＠ah.com 17 Dec '03

17 Dec '03

I've been troubled for many months by an invariant in all forms of return address schemes: The outside world contains sufficient _persistent_ information to find a real adress. There are lots of clever schemes to split this information up so as to require reassembly between many parties, but the information is still out of one's control. (I use 'reassembly' rather than 'collusion' since the latter indicates an intent; see my rant of a few days ago.) The fundamental problem seems impenetrable. So how do we solve it? By abandoning return addresses and using mail spool facilities. Consider the following service. 1. I have a machine and I'll sell you an address on it, say "onyma(a)privacy.net". This address is _not_ an account, merely an address. Your mail is password or public key protected. 2. When mail come in for you, it sits in a spool. This service comes with a spool of a certain size and an allowance for checking your mail at a certain rate, with overages at extra cost for both. (This is to bound known promised capacity of the machine by a sufficient amount of money to pay for it.) 3. Your mail sits in the spool until you access it with, say, a POP client like Eudora. Just point the client at a different address to pick up mail. The server can further support a number of protocols for getting the mail, including a mail server command of "send me a mailbox file of my waiting mail". The main advantage is that the only _persistent_ information out in the world is the address itself and the authenticator (password or public key). The address is already public and the authenticator is arbitrary, so no identity information is persistent. A complete chain could still be forged between sender and receiving pseudonym, but we now have some amount of forward secrecy. If in fact an intermediate link does discard connection information, it is gone forever. With any kind of SASE, however, the information therein, however encrypted, still contains a full path back. Now consider two ways of getting your mail out of this service, supposing you don't trust the service with your identity. A IP redirector can be with POP service to conceal origin from the mail service. An IP redirector is a remailer for packets, with a bidirectional link set up when the service starts and removed when it goes away. Matt Blaze has a name for this--'packet laundry'--which is a wonderful but politically unfortunate term. The IP redirectors can be chained just like remailers. With a mail server, the command to 'send me my mailbox' can be sent to a remailer address with an encrypted remailing block prepended. In this case, however, the encrypted remailer block is provided with the mail command that requests the mailbox and it is not by design stored persistently. (By design. It could, of course, actually be stored.) The address on the other side of the first remailer hop could be another mail spooing service, in addition. The elimination of persistent identifying information for return paths is a worthwhile design objective. I propose that we start thinking about it more thoroughly. Eric

1 0

Archiving on Inet
by Jim choate 17 Dec '03

17 Dec '03

I would like to ask all subscribers who are not addressing the issues of this question to please move their responces to private mail. I have no interest in exploring your personalities or views of others personalities. If a global network is to survive there must be a commen understanding of what is public domain and what is private or commercial. At the present time this is completely new ground. The fact is that the copyright laws of the US are of little interest to a net user in Moscow, Russia or Pretoria, S. Africa. If as a cpunk you don't feel that a anonymous regulatory agency can protect your privacy why do you feel they can protect your intellectual property? The issue has direct bearing on both intellectual property and the wide spread use of cryptographic techniques. As a active cpunk it seems to me that your first motivation after producing the actual code is to creat a atmosphere where it can be used for the betterment of all. To create a useable global community (what I am striving for) it seems to me that entries on that network must be public domain by default. Otherwise every country who joins, and by reduction every potential user, will have to agree on how to recompense each and every user who desires to be paid for their submissions. This, to me, leads incontrovertibly to the conclusion of a beurocratic nightmare that will not significanly assist anyone other than the regulatory agencies. The only other answer that seems even close to working (and I consider this a stretch of the imagination) is one where everyone is given access for free and the governments regulate the traffic completely and pat for it with tax dollars. As to the issue as it applies to community bbs'es. I run such a system and am in the process of getting it on the net. As part of this project I have 2 other systems that I will be providing feeds for. These systems are all run by individuals who have these boxes sitting in their den. By insisting on a priori copyright of all material it is my opinion that you are creating a situation which will prevent the growth of such systems. Now if we don't have regulatory agencies and the sites are indipendant (and I assume self supporting) how can we expect some Joe or Jill to put up a system to help the people in their neighborhood if they have to keep looking over thier shoulders for the copyright police? The answer is they won't put up such systems and we all loose. By providing strong crypto tools for business and individuals to protect their intellectual and commercial property we are creating an open door atmosphere which motivates people to join the network for their own enjoyment and edification. This to me is more important than keeping the present view (as applied to non-networked environments) of copyright. It is time that we as uses of Internet set a precedence before the legislators set one for us that will in the long run only assist those already in power by strangthening the need for regulatory agencies. I strongly suggest that you all consider this idea from the global and long term view. I think you will find that the view "information wants to be free' is the way to go. To this end I propose that organizations such as EFF and cpunks take the position of a priori public domain status of network submissions. Also that all individuals who wish to retain intellectual or commercial rights either use strong crypto w/ e-mail distribution of keys or a change be implimented in message headers such that sites who don't wish to carry such material can filter it, along with this should be a requirement that any such non- crptographicly secure material must contain a fair use policy at the beginning of each and every document. It is time we quite letting big brother tell us what we can do with our ideas and how to distribute them.

1 0

Re: New Remailer Up.
by nobody＠qwerty.org 17 Dec '03

17 Dec '03

Jon Boone wrote, " Is the sendmail (I assume you are using sendmail for SMTP services) daemon set up so that it *doesn't* log to /usr/spool/mqueue/syslog [or any other syslog facility]? Otherwise, it may well be possible to track the usage of the remailer through browsing the syslog logs. This is one of the problems (it seems to me) with using a remailer and *not* having root access. Unless you can convince your sysadmin to remove the syslog mechanism that sendmail uses, you may be exposing your users (presumably by accident)." No, fortunately for other users, I do not have root access on Netcom ;-). So who is going to be doing this browsing? Other Netcom users can't read the mqueue: qwerty: cd /usr/spool qwerty: ls cron lpd.lock news news4 uucp locks mail news2 rwho uucppublic lpd mqueue news3 secretmail uumaps qwerty: cd mqueue mqueue: Permission denied qwerty: ls -la total 480 drwxr-sr-x 15 bin 512 Feb 2 01:38 . drwxr-xr-x 13 root 512 Feb 2 01:38 .. drwxr-sr-x 4 root 512 Feb 2 01:38 cron drwxr-sr-x 2 uucp 512 Feb 2 08:30 locks drwxrwsr-x 2 daemon 512 Feb 2 03:47 lpd -rw-r--r-- 1 root 4 Feb 2 01:38 lpd.lock drwxrwsrwt 4 root 430080 Feb 2 08:37 mail drwxr-s--- 2 root 18944 Feb 2 08:37 mqueue drwxr-xr-x284 netnews 12288 Feb 2 05:29 news drwxr-sr-x 2 netnews 512 Aug 28 17:03 news2 drwxr-sr-x 2 netnews 512 Aug 28 17:03 news3 drwxr-sr-x 2 netnews 512 Jan 16 19:56 news4 drwxr-sr-x 2 root 512 Jan 31 14:40 rwho drwxrwsrwx 2 bin 512 Nov 3 08:49 secretmail drwxr-sr-x 11 uucp 512 Feb 2 01:38 uucp lrwxrwxrwx 1 root 20 Nov 26 15:48 uucppublic -> /usr/hack/uucppublic drwxrwxr-x 5 netnews 12288 Feb 2 05:48 uumaps "Is the sendmail (I assume you are using sendmail for SMTP services) daemon set up so that it *doesn't* log to /usr/spool/mqueue/syslog [or any other syslog facility]? Otherwise, it may well be possible to track the usage of the remailer through browsing the syslog logs." I'm using Hal's remailer, so ask him the details of what I have running. How many of those private sites with remailers having root, keep NO personal logs? Any? I would like to compile a more detailed listing of the details about each remailer's capabilities, situation, and policy statements. If someone sends anonymous mail through my mailer victimizing someone in a criminal manner, and law enforcement convinces Netcom to check the logs, then more power to them. If someone sends mail discussing large doses of vitamin C, when vitamin supplementys are banned a year from now, and the FDA wants to arrest them, and Netcom allows them to see the mqueue then that would be unfortunate indeed. I am running a remailer. Here is the situation. What more can I offer? I would ask people to look at the various remailers and ask in a street smart practical manner what the pros and cons of each one is. What, exactly, does the mqueue record? How long does it get saved? I needed remailers to maintain some simple privacy by distancing myself from the character Xenon. No 5AM fone calls and letters from people asking me to send them PGP.... I figured if I was going to become the largest volume user of the remailers, I should become a remailer myself. The other option was to use the Netcom account to directly mail out what I am sending to people, but that wasn't as fun of an idea. -Xenon

2 1

RE: fwd: Canadian gov't eavesdropping
by Mike Markley 17 Dec '03

17 Dec '03

| From: Eli Brandt <netmail!ebrandt(a)jarthur.Claremont.EDU> | To: cypherpunks list <cypherpunks(a)toad.com> | Subject: fwd: Canadian gov't eavesdropping | Date: Tuesday, February 01, 1994 7:26PM | | Received: from relay2.UU.NET by netmail.microsoft.com with SMTP (5.65/25-eef) | id AA07450; Tue, 1 Feb 94 19:59:09 -0800 | Received: from toad.com by relay2.UU.NET with SMTP | (5.61/UUNET-internet-primary) id AAwbln22133; Tue, 1 Feb 94 22:55:33 -0500 | Received: by toad.com id AA05602; Tue, 1 Feb 94 19:30:49 PST | Received: by toad.com id AA05533; Tue, 1 Feb 94 19:26:28 PST | Return-Path: <ebrandt(a)jarthur.Claremont.EDU> | Received: from jarthur.Claremont.EDU ([134.173.42.1]) by | toad.com id AA05527; Tue, 1 Feb 94 19:26:21 PST | Message-Id: <9402020326.AA05527(a)toad.com> | In-Reply-To: <94Feb1.201622est.83288(2)(a)ivory.educom.edu>; | from "E-D-U-P-A-G-E" at Feb 1, 94 8:21 pm | X-Arcane-Subliminal-Header: fooquayleglorkpsilocybinrkbapinkyogsothothquux | X-Mailer: ELM [version 2.3 PL11] | | > Date: Tue, 1 Feb 1994 20:21:46 -0500 | [...] | > HIGH-TECH SNOOP GADGET. A super-secret branch of the Canadian Security | > Intelligence Service has awarded three contracts to a Montreal firm to make | > equipment that can quickly isolate key words and phrases from millions of | > airborne phone, fax, radio signals and other transmissions. The hardware | > has the "Orwellian potential to sweep through ... and keep records of all | > conversations," said one CSIS critic. (CTV National News, 01/31/94 11:00 | > pm). | | Dunno how feasible this kind of keyword recognition presently is, | but here's another reason to encrypt. I'd be curious to see how they are going to do voice recognition on random conversations. Unless I am very sadly out of date you need to teach the pattern matcher individual voices. | | > EDUPAGE. To subscribe to Edupage send e-mail to listproc(a)educom.edu, | > containing the following text: SUB EDUPAGE yourfirstname yourlastname. To | | Eli ebrandt(a)jarthur.claremont.edu | | -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Mike Markley || The opinions here do not represent the mmarkley(a)microsoft.com || opinions of my employer. Attempts to || associate the two are pointless. "I want to look at life, In the available light" - Neil Peart -

4 3

remailers
by werner＠mc.ab.com 17 Dec '03

17 Dec '03

Hi, Can a remailer be used to post to an arbitrary Usenet group? Is the above a stupid question?

1 0

Re: remailers
by nobody＠qwerty.org 17 Dec '03

17 Dec '03

werner asked, "Can a remailer be used to post to an arbitrary Usenet group?" newsgroup(a)news.cs.indiana.edu posts things quickly via e-mail. When I use anon.penet.fi for Usenet, I often use this, since it is quite a bit faster than using anon.penet.fi's posting feature. "Is the above a stupid question?" Is this a stupid answer? Both are in various FAQs. -Xenon

1 0