December 2003 - cypherpunks-legacy

CRYPTO - New US keyserver now fully operational -
by fringeware＠illuminati.io.com 17 Dec '03

17 Dec '03

Sent from the cyberdeck of: pgpkeys(a)wasabi.io.com (PGP Slave Key Server) The US-based keyserver 'pgp-public-keys(a)io.com' is now open to the public. Come one, come all! Here is the current file as returned by 'Subject: help'. This site is a PGP key server SLAVE site. It behaves very similarly to the European PGP master sites, but there are a few small differences which will be noted below. The most noticable difference is that it answers your requests immediately instead of waiting for a daily batch job to run :-) The particular installation at io.com does *not* log the details of requests for keys, however the fact that you have sent mail to the key server at all is logged in the daily sendmail logs. These logs will be erased automatically after one week. PGP Public Keyservers --------------------- There are PGP public key servers which allow one to exchange public keys running through the Internet and UUCP mail systems. This service is NOT supported in any way whatsoever by the schools or organizations on which these servers run. It is here only to help transfer keys between PGP users. It does NOT attempt to guarantee that a key is a valid key; use the signators on a key for that kind of security. This service can be discontinued at any time without prior notification. Each keyserver processes requests in the form of mail messages. The commands for the server are entered on the Subject: line. To: pgp-public-keys(a)io.com From: johndoe(a)some.site.edu Subject: help Sending your key to ONE server is enough. After it processes your key, it will forward your add request to other servers automagically. For example, to add your key to the keyserver, or to update your key if it is already there, send a message similar to the following to any server: To: pgp-public-keys(a)io.com From: johndoe(a)some.site.edu Subject: add -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.2 <blah blah blah> -----END PGP PUBLIC KEY BLOCK----- COMPROMISED KEYS: Create a Key Revocation Certificate (read the PGP docs on how to do that) and mail your key to the server once again, with the ADD command. Valid commands are: Command Message body contains ---------------------- ------------------------------------------------- ADD Your PGP public key (key to add is body of msg) *** Note: your update is forwarded to a master server and may take a few days to reappear INDEX List all PGP keys the server knows about (-kv) VERBOSE INDEX List all PGP keys, verbose format (-kvv) GET Get the whole public key ring GET 0xA1B2C3 Get a single key by Key ID *** Note: the master servers allow you to omit the 0x in front of the Key ID. The slave servers do not. GET userid Get a single key by User ID MGET substr List all keys which match "substr" *** Note: this is different from the master servers which return the keys themselves, not just a listing of their Key IDs. Also the master servers accept a wild-card expression; at the moment we do not. LAST days Get the keys updated in the last `days' days *** Note: not yet implemented ------------------------------------------------------------------------ Examples for the MGET command: MGET michael Lists all keys which have "michael" in them MGET @iastate.edu Lists all keys which contain "@iastate.edu" Check the Usenet newsgroup alt.security.pgp for updates to this system and for new sites. Based on a document originally by Michael <explorer(a)iastate.edu>

1 0

Prodigy Hard Drive Scans
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

I heard from a friend that Prodigy was scanning user's hard drives. Basically, when you logged on Prodigy made a complete directory of your hard drive and uploaded it. Prodigy was using this to find out what applications you used so they could direct the appropriate advertising towards you. Apparently, they're suffering several lawsuits now because of it. My friend heard this on the trailing end of a radio talk show. If it was really happening, it sounds horrible. Could Secure Drive be set up to stop this kind of attack? Can anyone tell me if this is more than a rumour? If it is more than a rumour, would you be able to point me towards some information about this? -john. jdblair(a)nextsrv.cas.muohio.edu

1 0

Re: Prodigy Hard Drive Scans
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

> I heard from a friend that Prodigy was scanning user's hard drives. > Basically, when you logged on Prodigy made a complete directory of your > hard drive and uploaded it. Prodigy was using this to find out what > applications you used so they could direct the appropriate advertising > towards you. Apparently, they're suffering several lawsuits now because > of it. > > My friend heard this on the trailing end of a radio talk show. If it was > really happening, it sounds horrible. Could Secure Drive be set up to > stop this kind of attack? > > Can anyone tell me if this is more than a rumour? If it is more than a > rumour, would you be able to point me towards some information about this? Just a rumor, disposed of several years ago. A hot topic of debate around 1990. This rumor arose because Prodigy set aside a block of user disk space for its own files. Sometimes this block had random stuff in it (recall that "erasing" a file doesn't actually overwrite the disk, it just removes pointers to the stuff being erased and allows other stuff to later be overwritten over it). Prodigy used part (a small part, given 1200- and 2400-baud modems in use then) of this block to send back to the main computers, so in principle it could see miscellaneous scraps of erased data. But this was accidental, was a tiny fraction of the disk, was not used or even looked at by Prodigy, and would have absolutely no value in determining applications used. (Think about what a samll random chunk of "erased" disk space would really mean in terms of telling outsiders what applications you use!) Ironically, an old college buddy of mine is now in charge of e-mail for Prodigy, in White Plains, New York. He visited me last summer and I showed him a _real_ computer service (Netcom) and we had a few good chortles about this Prodigy Conspiracy. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power:2**859433 | Public Key: PGP and MailSafe available.

1 0

Re: your mail
by David Vincenzetti 17 Dec '03

17 Dec '03

Some anonymous user sent me a message which is divided in three parts. I am sorry but I did not receive the first one. Can this anon guy please send me the first part again? Thank you.

1 0

Re: New remailer up.
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jon Boone expressed what seems to be a consensus, " I won't hack into mail.netcom.com to demonstrate that it is possible to figure out who used your remailer. But, if one of the admins from netcom wants to send me their syslogs, I'll do my best to put together a correlation." Netcom logs mail. The mail queue is viewable by most anyone willing to set up a mail queue logging routine. If someone wants to see the mail logs after it is no longer in the mail queue they have to be root on Netcom or illegally hack in. If the FDA wants your illegal smart drugs, they might get Netcom to hand over mail logs. If a hacker or the NSA taps into root, they don't need mail logs; they'll just "wiretap" the qwerty account, including its secret key and pass phrase. Is there any OTHER serious but unrelated problems with a Netcom remailer? Now I know what warnings and hints to put in qwerty's .plan: "Since Netcom keeps mail logs, people should only have contact with qwerty via other remailers or send mail out from qwerty only to public sites like Usenet or a mailing list, so the real addresses of the users never shows up on Netcom's logs or in the mail queue. It is also best to use encryption in case someone is reading the contents instead of just the logs." Routing through qwerty will add another layer of difficulty to someone trying to track down a message sender, since if forces them to get Netcom's sendmail logs after the fact or to make their own logs every day of the year from an account on Netcom. Is this legal for say the FDA to do? How about my new idea for a company called "Netlog!" in which I log the mail queue on Netcom and offer to sell CD ROMs containing a year's mail logs from Netcom? These tricks could be made more difficult with traffic analysis countermeasures. However, the issue seems more touchy than this rationalization for the existance of Netcom remailers. Not assuming qwerty remains in its current state, will adding qwerty to a mailing chain, say between extropia to hfinney@shell, using encryption, add to or decrease security? The question needs to be answered, with the assumption that someone IS collecting mail queue logs. How would you have me alter qwerty so that this link ADDED to the security of a chain? More than an hour delay must be avoided by making the scheme more sophisticated, in my view. If I add a 0-30 min. random delay, with added dummy traffic going out from qwerty in a circle through other remailers and back to qwerty's bit bucket, every few minutes, would this make it useful also to SERIOUS remailer users? Before I start throwing out ideas that I'm sure aren't new to readers here, I have a simple question that perhaps I should post to comp.unix.questions or comp.lang.perl, but.... Can I, and how would I, get a perl script to kick in and send out mail every few minutes when I am NOT logged in. Is this possible on Netcom? The question is pretty general, and involves any public access or personal account machine. So send me a remailer or tell me how to patch Hal's. -Nik (Xenon) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLVGOgQSzG6zrQn1RAQFGLAP+N31dNMjnArEOklm4AeruT7pu6LgfNdUM OawRDPY8CYgxYi5kJ4yByh7+uD+Asr7FCMaKacln8YwO6oOz3FlceNupC1czWFI5 NWuS9b4r5ZPKpLClv9K3oY1QvRePc1r0Ypl4SYCtZux/7U787BoyT/VUHmkfwple I6X6+irFXns= =6Klu -----END PGP SIGNATURE-----

1 0

Re: Remailer Tearline Conventions
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > That remail(a)extropia.wimsey.com is in Canada specifically makes > > communications with it fair game for NSA interception, however. > > NSA interception is world wide. On the other hand, extropia uses PGP encrypted messages to its remailer, and NSA PGP-breaking is distinctly *not* world-wide. I assume it doesn't use PGP encryption for the anonymous outgoing side, but you can always encrypt the message before encrypting it for extropia.

1 0

finger user@wasabi.io.com
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Neat stuff! You can finger billstewart(a)wasabi.io.com, even though I don't exactly have an account there... Is the source code available for your finger daemon? It doesn't seem to have any regular-expression matching; it mostly matches exact character strings, presumably case-insensitive. I couldn't figure out how to get it to match spaces, though: requesting 'bill stewart' got all the bills and all the stewarts, rather than getting the lines with bill stewart in them. Thanks!

1 0

Running regularly
by Hal 17 Dec '03

17 Dec '03

> Before I start throwing out ideas that I'm sure aren't new to readers here, > I have a simple question that perhaps I should post to comp.unix.questions > or comp.lang.perl, but.... Can I, and how would I, get a perl script to > kick in and send out mail every few minutes when I am NOT logged in. Is this > possible on Netcom? Most public Unix systems will not let you do this, in my experience. The two Unix commands which usually give you the ability to run programs at regular intervals are "at" and "crontab". You can read the man pages and try running these to see if they are enabled for you. I had an idea for how to get around this, so that people could run batching remailers which sent out mail, say, every 30 minutes or whatever. (Unlike Xenon, I am of a generation which is accustomed to waiting more than a few seconds for mail to travel across the country!) The idea was simply for someone who DID have an account which would let them use at or cron, to run a program which would simply send a "ding" message (not to be confused with a "ping" message :) at regular intervals to a list of subscribers. This message could have a special header field so that the remailer programs could easily recognize it and take whatever action they wanted, like running Karl Barrus' script to scan a directory for pending outgoing remailer mail and send it out. (Karl has had batching running for months, as well as postage-stamp-based remailers (albeit with non-anonymous stamps). He is way ahead of most of this discussion.) Hal

2 1

Re: contemplating remailer postage
by Hal 17 Dec '03

17 Dec '03

As Jim points out, Matthew's scheme for one-bit-per-stamp has the problem that it requires non-anonymous stamps. Jim suggested a variant on Chaum's digital cash where the stamp numbers would be re-blinded by the recipient so that the remailer would not recognize them (but could verify their validity). Matthew's bitmap idea could still be used, though. The incoming stamp numbers could be hashed down to, say, 24 bits. This could then be an index into a 2^24-bit file, which would take 2 MB. Set the bit when the stamp is used, and reject the mail if the bit is already set. Granted, this would create false rejections. But email is already not perfectly reliable. You could send 160,000 messages before you had as many as 1% false rejections (2^24 / 100). I think this would be better than trying to save this many digital stamps and check through the list each time for duplications. Hal

1 0

Remailer FAQ. Details.
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

I hope I can get a bit more attention to this, now that it has become more sophisticated. Please code warriers, take a break and let the human race know what the existing remailers are all about. I know exactly why they don't have enough traffic; knowledge about them is still insider knowledge. A list of remailer addresses and year-old partial info from a request made my Tim May was all I could find. Specs needed. I will send this to Gary Edstrom for the PGP FAQ if I don't have to spend the rest of my life compiling it. Mail info to qwerty(a)netcom.com. I'm interested in hearing from users as well as operators. -Nik (Xenon) Xenon's Full Disclosure Remailer List. Remailer Fast? OpLog SysLog Subj Batch RD NL CPU Phys PGP BitB ?what else? --------- ------ ----- ------ ---- ----- -- -- --- ---- --- ---- ----------- bsu-cs + ? ?/? + ? ? ? ? ? 23a ? catalyst + N? SM/MQ - - ? - PA M 23a - choas + ? ?/? + ? ? ? ? ? - - cicada ++ ? ?/? - - - - ? ? - - dis.org - ? ?/? - ? ? ? ? ? 23a ? extropia ? ? ?/? + ? ? ? Pr? ? 23a ? jarthur +/-- St SM/MQ? - ? ? ? Un ? 23a - menudo -- ? ?/? - t1 ? ? ? ? - ? merde -/-- ? ?/? - ? ? ? ? ? - ? penet.fi -- St ?/? - t? 24 + Pr H - - pmantis ++ ? ?/? - ? - - ? ? - - qwerty + C SM/MQ - - - - PA M 23a + rosebud ++/- ? ?/? - - - ? ? ? 23a ? remba ? ? ?/? ? ? ? ? ? ? 23a ? shell ++/+/- St ?/? - ? ? ? ? ? 23a - soda ++/- St+? ?/? - ? ? ? ? ? - Subj: Strips Subject header? NL: Non-linear remailing? 123->231. RD: Random delay added (max, in hours)? Batch: Batched remailing? t2 means twice daily. n5 means after 5 messages. CPU: Pr = private. PA = account on public access machine. Un = university. Phys: Physical security of the CPU, especially at night. H/M/L. BitB: BitBucket feature? Fast?: ++ <5 min + 5-10 min. - ~10-30 min delay -- Pinging isn't practical due to long delays, but may be more secure. +/- Sometimes +, sometimes - Normal internet mail delays are common, and are not equivalent in the two directions between any two remailers. Mail still gets through. OpLog: F: Full copies of all mail is archived. My large volume mailing should help put a stop to this. St: Stats logs of when mail was remailed. St+: Stats logs of when and where mail was remailed. St-: Simple counter. N: Operator keeps no logs. SysLog: SM: sendmail logs of when and where mail was exchanged. Root access. MQ: mailqueue accessible by anyone on the site. Could make logs. bsu-cs nowhere(a)bsu-cs.bsu.edu catalyst catalyst(a)netcom.com chaos remailer(a)chaos.bsu.edu cicada hh(a)cicada.berkeley.edu dis.org remailer(a)dis.org extropia remail(a)extropia.wimsey.com jarthur ebrandt(a)jarthur.claremont.edu menudo nobody(a)Menudo.UH.EDU merde remailer(a)merde.dis.org penet.fi anon.penet.fi pmantis hh(a)pmantis.berkeley.edu qwerty qwerty(a)netcom.com rosebud elee7h5(a)rosebud.ee.uh.edu shell hfinney(a)shell.portal.com soda hh(a)soda.berkeley.edu Discontinued remailers still on some lists out there: phantom(a)mead.u.washington.edu remail(a)tamaix.tamu.edu sameer(a)netcom.com (spelling?) sameer(a)berkeley.edu (spelling?) cdodhner(a)indirect.com remailer(a)entropy.linet.org?? 00x(a)uclink.berkeley.edu? remail(a)tamaix.tamu.edu? remailer(a)entropy.linet.org? Background on each remailer: bsu-cs: Run by Chael Hall. Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: History: ?? catalyst: Run by Scott Collins. Machine: personal dial-up account on Netcom. Problems policy: Outgoing address blocking, with proof of ID. Contact catalyst(a)netcom.com. Software: Customized Hal's ? Security: Netcom keeps sendmail logs, which root(a)netcom.com can read. Any Netcom user could also compile his own sendmail logs, by constantly logging mail as it arrives and leaves. Comments: History: ?? chaos: Run by ?? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: Comments: Finger remailer.help(a)chaos.bsu.edu for info using any remailer. ?? gopher chaos.bsu.edu for a collection of info about Cypherpunks. Comments: History: ?? cicada: Run by Eric Hollander. Machine: ??? Problems policy: ?? Contact ?? Software: ?? Security: Tread lightly. Being "phased out". dis.org: Run by ?? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: History: ?? extropia: Run by ?? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: Only accepts PGP remailing. ::/Encrypted:PGP header is optional. Privately owned, in Canada. History: ?? jarthur: Run by Eli Brandt. Machine: Sequent Symmetry. Problems policy: Destination blocking is available w/ sufficient ID. Contact ebrandt(a)jarthur.claremont.edu. Software: the usual, tweaked for MMDF. Hal's? Security: jarthur keeps sendmail logs. Comments: History: Set up late '92. PGP added mid-'93. menudo: Run by ?? Maching: ?? Problems policy: ?? Contact ?? Software: ?? Security: Stores messages and sends them at midnight?? Comments: History: ?? merde: Run by ?? Maching: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: History: ?? penet.fi: Run by Julf (last name?) Machine: ?? Operator owned. Problems policy: Account revokation. Contact ??(a)anon.penet.fi. Software: custom. Security: Comments: By far the most popular remailer, dwarfing in a day what the entire Cypherpunk remailers combined carry in a month. Supports easy return addresses as well as non-anonymous mailing to someone's anonymous address (na1234... instead of an1234...). Your real address is kept on Julf's hard disk, but is fairly safe there, especially if you do not abuse your anonymity to harass someone. On a bad day your mail and especially Usenet posts may be delayed up to two days. Very reliable though. Sends error messages back to you for failed mail. Limited to 48K mail. History: ?? pmantis: Run by Eric Hollander. Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: Tread lightly. Being "phased out". Comments: History: ?? qwerty: Run by Xenon. Machine: dial-up account on Netcom. Problems policy: "What problems?". Contact qwerty(a)netcom.com. Software: Hal's remailer. Security: Netcom keeps sendmail logs, which root(a)netcom.com can read. Any Netcom user could also compile his own sendmail logs, by constantly logging mil as it arrives and leaves. Comments: You must use na1234(a)anon.penet.fi not an1234(a)anon.penet.fi. Finger qwerty(a)netcom.com for a blurb on the remailer and updates on its software. Request-Remailing-To: /dev/null is a bit bucket. whitehouse.gov gets blocked and fully logged. History: Up 2/94. Set up by Xenon who needed more remailers to use to send PGP info to people with, since anon.penet.fi was overloaded. rembe: Run by ? Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: ?? History: ?? rosebud: Run by Karl Barrus. Machine: ?? Problems policy: ?? Contact ?? Software: ?? Security: ?? Comments: History: ?? shell: Run by Hal Finney. Machine: ?? Problems policy: ?? Contact ?? Software: Hal's Remailer. Security: ?? Comments: whitehouse.gov blocked and fully logged. hal(a)alumni.caltech.edu forwards all mail to shell. History: ?? soda: Run by Eric Hollander. Run by: ?? Machine: ?? Problems policy: ?? Blocking of addresses. Mail sent to problem causer. Contact ?? Software: custom. ?? Security: ?? Comments: History: ?? Remailer Public Keys: (I've got these...)

1 0