December 2003 - cypherpunks-legacy

WWW Anonymous Remailer Software release
by nate＠VIS.ColoState.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have modified my WWW Anonymous remailer interface and put it up for ftp on vangogh.vis.colostate.edu in /pub/nate/remailer There is a README in there which should explain how to set it up, but if I missed anything, please tell me. The remailer no longer needs you to tell it that you're using the remailers, it just knows. Hope you like it, - -nate - -- +-----------------------------------------------------------------------+ | Nate Sammons <nate(a)VIS.ColoState.Edu> <nate(a)yuma.ANCS.ColoState.Edu> | | Colorado State University Computer Visualization Laboratory | | Data Visualization/Interrogation, Modeling, Animation, Rendering | +-----------------------------------------------------------------------+

1 0

On return addresses
by hughes＠ah.com 17 Dec '03

17 Dec '03

I've been troubled for many months by an invariant in all forms of return address schemes: The outside world contains sufficient _persistent_ information to find a real adress. There are lots of clever schemes to split this information up so as to require reassembly between many parties, but the information is still out of one's control. (I use 'reassembly' rather than 'collusion' since the latter indicates an intent; see my rant of a few days ago.) The fundamental problem seems impenetrable. So how do we solve it? By abandoning return addresses and using mail spool facilities. Consider the following service. 1. I have a machine and I'll sell you an address on it, say "onyma(a)privacy.net". This address is _not_ an account, merely an address. Your mail is password or public key protected. 2. When mail come in for you, it sits in a spool. This service comes with a spool of a certain size and an allowance for checking your mail at a certain rate, with overages at extra cost for both. (This is to bound known promised capacity of the machine by a sufficient amount of money to pay for it.) 3. Your mail sits in the spool until you access it with, say, a POP client like Eudora. Just point the client at a different address to pick up mail. The server can further support a number of protocols for getting the mail, including a mail server command of "send me a mailbox file of my waiting mail". The main advantage is that the only _persistent_ information out in the world is the address itself and the authenticator (password or public key). The address is already public and the authenticator is arbitrary, so no identity information is persistent. A complete chain could still be forged between sender and receiving pseudonym, but we now have some amount of forward secrecy. If in fact an intermediate link does discard connection information, it is gone forever. With any kind of SASE, however, the information therein, however encrypted, still contains a full path back. Now consider two ways of getting your mail out of this service, supposing you don't trust the service with your identity. A IP redirector can be with POP service to conceal origin from the mail service. An IP redirector is a remailer for packets, with a bidirectional link set up when the service starts and removed when it goes away. Matt Blaze has a name for this--'packet laundry'--which is a wonderful but politically unfortunate term. The IP redirectors can be chained just like remailers. With a mail server, the command to 'send me my mailbox' can be sent to a remailer address with an encrypted remailing block prepended. In this case, however, the encrypted remailer block is provided with the mail command that requests the mailbox and it is not by design stored persistently. (By design. It could, of course, actually be stored.) The address on the other side of the first remailer hop could be another mail spooing service, in addition. The elimination of persistent identifying information for return paths is a worthwhile design objective. I propose that we start thinking about it more thoroughly. Eric

1 0

Archiving on Inet
by Jim choate 17 Dec '03

17 Dec '03

I would like to ask all subscribers who are not addressing the issues of this question to please move their responces to private mail. I have no interest in exploring your personalities or views of others personalities. If a global network is to survive there must be a commen understanding of what is public domain and what is private or commercial. At the present time this is completely new ground. The fact is that the copyright laws of the US are of little interest to a net user in Moscow, Russia or Pretoria, S. Africa. If as a cpunk you don't feel that a anonymous regulatory agency can protect your privacy why do you feel they can protect your intellectual property? The issue has direct bearing on both intellectual property and the wide spread use of cryptographic techniques. As a active cpunk it seems to me that your first motivation after producing the actual code is to creat a atmosphere where it can be used for the betterment of all. To create a useable global community (what I am striving for) it seems to me that entries on that network must be public domain by default. Otherwise every country who joins, and by reduction every potential user, will have to agree on how to recompense each and every user who desires to be paid for their submissions. This, to me, leads incontrovertibly to the conclusion of a beurocratic nightmare that will not significanly assist anyone other than the regulatory agencies. The only other answer that seems even close to working (and I consider this a stretch of the imagination) is one where everyone is given access for free and the governments regulate the traffic completely and pat for it with tax dollars. As to the issue as it applies to community bbs'es. I run such a system and am in the process of getting it on the net. As part of this project I have 2 other systems that I will be providing feeds for. These systems are all run by individuals who have these boxes sitting in their den. By insisting on a priori copyright of all material it is my opinion that you are creating a situation which will prevent the growth of such systems. Now if we don't have regulatory agencies and the sites are indipendant (and I assume self supporting) how can we expect some Joe or Jill to put up a system to help the people in their neighborhood if they have to keep looking over thier shoulders for the copyright police? The answer is they won't put up such systems and we all loose. By providing strong crypto tools for business and individuals to protect their intellectual and commercial property we are creating an open door atmosphere which motivates people to join the network for their own enjoyment and edification. This to me is more important than keeping the present view (as applied to non-networked environments) of copyright. It is time that we as uses of Internet set a precedence before the legislators set one for us that will in the long run only assist those already in power by strangthening the need for regulatory agencies. I strongly suggest that you all consider this idea from the global and long term view. I think you will find that the view "information wants to be free' is the way to go. To this end I propose that organizations such as EFF and cpunks take the position of a priori public domain status of network submissions. Also that all individuals who wish to retain intellectual or commercial rights either use strong crypto w/ e-mail distribution of keys or a change be implimented in message headers such that sites who don't wish to carry such material can filter it, along with this should be a requirement that any such non- crptographicly secure material must contain a fair use policy at the beginning of each and every document. It is time we quite letting big brother tell us what we can do with our ideas and how to distribute them.

1 0

Re: New Remailer Up.
by nobody＠qwerty.org 17 Dec '03

17 Dec '03

Jon Boone wrote, " Is the sendmail (I assume you are using sendmail for SMTP services) daemon set up so that it *doesn't* log to /usr/spool/mqueue/syslog [or any other syslog facility]? Otherwise, it may well be possible to track the usage of the remailer through browsing the syslog logs. This is one of the problems (it seems to me) with using a remailer and *not* having root access. Unless you can convince your sysadmin to remove the syslog mechanism that sendmail uses, you may be exposing your users (presumably by accident)." No, fortunately for other users, I do not have root access on Netcom ;-). So who is going to be doing this browsing? Other Netcom users can't read the mqueue: qwerty: cd /usr/spool qwerty: ls cron lpd.lock news news4 uucp locks mail news2 rwho uucppublic lpd mqueue news3 secretmail uumaps qwerty: cd mqueue mqueue: Permission denied qwerty: ls -la total 480 drwxr-sr-x 15 bin 512 Feb 2 01:38 . drwxr-xr-x 13 root 512 Feb 2 01:38 .. drwxr-sr-x 4 root 512 Feb 2 01:38 cron drwxr-sr-x 2 uucp 512 Feb 2 08:30 locks drwxrwsr-x 2 daemon 512 Feb 2 03:47 lpd -rw-r--r-- 1 root 4 Feb 2 01:38 lpd.lock drwxrwsrwt 4 root 430080 Feb 2 08:37 mail drwxr-s--- 2 root 18944 Feb 2 08:37 mqueue drwxr-xr-x284 netnews 12288 Feb 2 05:29 news drwxr-sr-x 2 netnews 512 Aug 28 17:03 news2 drwxr-sr-x 2 netnews 512 Aug 28 17:03 news3 drwxr-sr-x 2 netnews 512 Jan 16 19:56 news4 drwxr-sr-x 2 root 512 Jan 31 14:40 rwho drwxrwsrwx 2 bin 512 Nov 3 08:49 secretmail drwxr-sr-x 11 uucp 512 Feb 2 01:38 uucp lrwxrwxrwx 1 root 20 Nov 26 15:48 uucppublic -> /usr/hack/uucppublic drwxrwxr-x 5 netnews 12288 Feb 2 05:48 uumaps "Is the sendmail (I assume you are using sendmail for SMTP services) daemon set up so that it *doesn't* log to /usr/spool/mqueue/syslog [or any other syslog facility]? Otherwise, it may well be possible to track the usage of the remailer through browsing the syslog logs." I'm using Hal's remailer, so ask him the details of what I have running. How many of those private sites with remailers having root, keep NO personal logs? Any? I would like to compile a more detailed listing of the details about each remailer's capabilities, situation, and policy statements. If someone sends anonymous mail through my mailer victimizing someone in a criminal manner, and law enforcement convinces Netcom to check the logs, then more power to them. If someone sends mail discussing large doses of vitamin C, when vitamin supplementys are banned a year from now, and the FDA wants to arrest them, and Netcom allows them to see the mqueue then that would be unfortunate indeed. I am running a remailer. Here is the situation. What more can I offer? I would ask people to look at the various remailers and ask in a street smart practical manner what the pros and cons of each one is. What, exactly, does the mqueue record? How long does it get saved? I needed remailers to maintain some simple privacy by distancing myself from the character Xenon. No 5AM fone calls and letters from people asking me to send them PGP.... I figured if I was going to become the largest volume user of the remailers, I should become a remailer myself. The other option was to use the Netcom account to directly mail out what I am sending to people, but that wasn't as fun of an idea. -Xenon

2 1

RE: fwd: Canadian gov't eavesdropping
by Mike Markley 17 Dec '03

17 Dec '03

| From: Eli Brandt <netmail!ebrandt(a)jarthur.Claremont.EDU> | To: cypherpunks list <cypherpunks(a)toad.com> | Subject: fwd: Canadian gov't eavesdropping | Date: Tuesday, February 01, 1994 7:26PM | | Received: from relay2.UU.NET by netmail.microsoft.com with SMTP (5.65/25-eef) | id AA07450; Tue, 1 Feb 94 19:59:09 -0800 | Received: from toad.com by relay2.UU.NET with SMTP | (5.61/UUNET-internet-primary) id AAwbln22133; Tue, 1 Feb 94 22:55:33 -0500 | Received: by toad.com id AA05602; Tue, 1 Feb 94 19:30:49 PST | Received: by toad.com id AA05533; Tue, 1 Feb 94 19:26:28 PST | Return-Path: <ebrandt(a)jarthur.Claremont.EDU> | Received: from jarthur.Claremont.EDU ([134.173.42.1]) by | toad.com id AA05527; Tue, 1 Feb 94 19:26:21 PST | Message-Id: <9402020326.AA05527(a)toad.com> | In-Reply-To: <94Feb1.201622est.83288(2)(a)ivory.educom.edu>; | from "E-D-U-P-A-G-E" at Feb 1, 94 8:21 pm | X-Arcane-Subliminal-Header: fooquayleglorkpsilocybinrkbapinkyogsothothquux | X-Mailer: ELM [version 2.3 PL11] | | > Date: Tue, 1 Feb 1994 20:21:46 -0500 | [...] | > HIGH-TECH SNOOP GADGET. A super-secret branch of the Canadian Security | > Intelligence Service has awarded three contracts to a Montreal firm to make | > equipment that can quickly isolate key words and phrases from millions of | > airborne phone, fax, radio signals and other transmissions. The hardware | > has the "Orwellian potential to sweep through ... and keep records of all | > conversations," said one CSIS critic. (CTV National News, 01/31/94 11:00 | > pm). | | Dunno how feasible this kind of keyword recognition presently is, | but here's another reason to encrypt. I'd be curious to see how they are going to do voice recognition on random conversations. Unless I am very sadly out of date you need to teach the pattern matcher individual voices. | | > EDUPAGE. To subscribe to Edupage send e-mail to listproc(a)educom.edu, | > containing the following text: SUB EDUPAGE yourfirstname yourlastname. To | | Eli ebrandt(a)jarthur.claremont.edu | | -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Mike Markley || The opinions here do not represent the mmarkley(a)microsoft.com || opinions of my employer. Attempts to || associate the two are pointless. "I want to look at life, In the available light" - Neil Peart -

4 3

remailers
by werner＠mc.ab.com 17 Dec '03

17 Dec '03

Hi, Can a remailer be used to post to an arbitrary Usenet group? Is the above a stupid question?

1 0

Re: remailers
by nobody＠qwerty.org 17 Dec '03

17 Dec '03

werner asked, "Can a remailer be used to post to an arbitrary Usenet group?" newsgroup(a)news.cs.indiana.edu posts things quickly via e-mail. When I use anon.penet.fi for Usenet, I often use this, since it is quite a bit faster than using anon.penet.fi's posting feature. "Is the above a stupid question?" Is this a stupid answer? Both are in various FAQs. -Xenon

1 0

system logging
by pgpkeys＠wasabi.io.com 17 Dec '03

17 Dec '03

> Greetings. > > New remailer: qwerty(a)netcom.com. > > No logs. Only a "counter" that works by appending the word "R" or "ER" to a > text file so I can get an idea if anyone is using it. However, I'm sure the > Netcom and other site's mail logs will be enough to track serious abusers > of anonymity down, without my help. This remailer is dedicated to honest > people who desire PRIVACY. People should be aware that whether Niko makes personal logs on his qwerty account or not, the public logs on netcom show more than enough info to trivially track people down. By the way it's very bad practice to forge From: lines, especially with completely non-existant site names like qwerty.org...perhaps you should ask netcom to register it for you. Or if they charge real money for it, your postmaster at columbia.edu might do it for free if you asked him nicely.

1 0

Re: fwd Canadian gov't eavesdropping
by nobody＠qwerty.org 17 Dec '03

17 Dec '03

Mike Markley say, "I'd be curious to see how they are going to do voice recognition on random conversations. Unless I am very sadly out of date you need to teach the pattern matcher individual voices." But of course they will just collect voice samples from everyone soon, and use them to IDENTIFY you. It'll probably be put on our US national health care cards. Ever since I started worrying about leaving DNA on postage stamps, I've started to think what can be done will be done. -Xenon

1 0

Josh Quittner's Newsday column on Cypherpunks
by gnu 17 Dec '03

17 Dec '03

Date: Wed, 02 Feb 1994 10:41:42 est From: "josh quittner" <quit(a)newsday.com> To: gnu(a)cygnus.com Subject: newsday column Hiya John: Here's the little column I did for my newspaper on the cypherpunks meeting I sat in on last month. Thought you might be interested. I know it's laymanlike, but if you want, you have my permission to distribute it to your list. I told Eric I'd send him a copy, but I left his email address at home, so if you'd be good enough, would you either pass this on to him or email me his address so I can? Thanks. Hope all is well with you. Be glad you're not freezing your ass off back here. Regards, -jq PUBLICATION DATE Tuesday. February 1, 1994 EDITION NASSAU AND SUFFOLK SECTION DISCOVERY PAGE 53 OTHER EDITIONS 59 C HEADLINE Life In Cyberspace COMPUTERS IN THE ^90s Coding Up a Bit of Privacy BYLINE Joshua Quittner DATELINE MOUNTAIN VIEW, Calif. LENGTH 91 Lines MOUNTAIN VIEW, Calif. THIS MUST BE HOW the Founding Fathers looked when they hacked out the Constitution: A roomful of young men, mostly - frazzled hair, eager eyes, wild beards, arms flailing and fingers jabbing the air, reaching for big ideas. You can't help but feel it; urgency tempers their voices. The earnest men plan and argue in this corporate conference room as the last sun rays of a winter Saturday afternoon fade in through a skylight. Time is running out for the Cypherpunks. There is much work to be done before the information highway arrives. The information highway - that 500-channel shopping mall / cineplex championed by cable and telephone companies - is a noxious concept to the people in this room. They are not technophobes or Luddites, these Cypherpunks. Instead, they are a collection of clever computer programers, engineers and wire heads from some of the nation's best-known Silicon Valley software houses and hardware shops. This is their central question: In a future world where all information is centralized on a network, where all information is tracked by the bit, where every purchase you make and every communication can be monitored by corporate America, how does privacy survive? If you go to a bookstore now and buy a book, you can pay in cash. No one knows your name or what you purchased. "What happens to cash transactions on the information highway?" they ask. The Cypherpunks believe that they can preserve your privacy through good cyphers, or codes. But they must hurry, must get their codes out and their networks up and running. "The whole information highway thing is now part of the public eye," explains Eric Hughes, a founder of the Cypherpunk movement. "If we don't change it now, it'll be impossible later." The Cypherpunks know what technology is capable of. We visit them today because they represent one edge of the national debate on the structure of the information highway. And as we all know, extreme positions help define the middle. Many of the Cypherpunks have been heavy Internet users for years and hope to preserve the communal spirit of that freewheeling world of interconnected computer networks. They dread the coming commercial network of televisions and computers, saying it will displace the Internet and destroy many of the freedoms they now enjoy. So the Cypherpunks, with the kind of zeal they professionally bring to marathon, 72-hour sessions hacking computer code, are plotting to keep free networks alive. That's "free" in the sense of unfettered, unmonitored, uncensored. One way they're going about it is by spreading easy-to-use, cheap cryptography. Cryptography is the science of keeping two-way communication private. Computers, it turns out, are revolutionary cryptographic tools, able to encode and decode files quickly. For the first time, virtually unbreakable codes are now possible, thanks to computers. The Cypherpunks post cryptographic software on the Internet where anyone can access it, and can encode their communications, including electronic mail, pictures and video. But the U.S. government is concerned, as governments always are, about the spread of powerful cryptography (terrorists could use it, kidnapers could use it, drug dealers could use it, all of them on cellular phones that encode conversations). It currently is pushing its own commercial cryptographic standard, through a special chip known as the Clipper. The chip is reviled by Cypherpunks and other civil libertarians because it provides a back door that law-enforcement agencies could enter, with the proper warrants, for surveillance. By getting good, unbreakable cryptography out there now, the Cypherpunks hope, whatever the government finally decides will be moot. Software has a wonderful property, the Cypherpunks are fond of saying: Once it's created, it can never be destroyed. It can be copied infinitely, from computer to computer, spreading like a secret. Come what may, unbreakable Cypherpunk code, and Cypherpunk networks, will be out there forever, they hope. But just to be safe, the Cypherpunks are toying with different network-related plans to create an economy of "digicash" - network money that, like the dollars in your pocket, isn't tied to a user's credit cards or other personal identification. Digicash will help pay for Cypherpunk networks and will allow people to purchase goods without revealing their identity. "I'm starting a bank, and it's not going to be a U.S. bank," Hughes says. He's standing at the whiteboard now. A strawberry-blond ponytail dangles down his back and he grasps a magic marker in his hand. "We have several long-term strategies, one of which is the elimination of central banks." He tells the assembled crowd what they already know. Heads nod. Some people take notes. Hughes is a self-employed programer in Berkeley. His hand flies across the whiteboard, sketching out a schematic diagram, showing how his bank will operate. The bank will store depositers^ money (he's thinking a $200 minimum deposit) and disburse payments to anyone - all over the Internet. It will be based abroad, maybe in Mexico. A Cypherpunk network bank is one way to pay for a network of truly encrypted, private communications, you see. "Is this going to lead the way to portable laptop ATM machines?" someone asks in the back. People snicker. "Have you thought about its name?" someone else asks. "First Bank of Cyberspace!" yells one person. "First Internet Bank!" yells another. "The Nth National Bank!" Laughter. Billy goat beards bob. There is much work to be done. --end of story-- -- josh quittner vox: 516-843-2806 fax: 516-843-2873 quit(a)newsday.com

1 0