December 2003 - cypherpunks-legacy

Message returned to sender (fwd)
by Jim choate 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Re: SASE Suggestion
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Lance Cottrell writes: > One SASE scheme recently suggested involved sending a > request for a SASE to a ramailer, stating the number of > jumps required. It then sent it to another remailer, and > so on. Each adding a layer, and eventually sending the > results to the desired correspondent. I mentioned that > if the first remailer was corrupted, that the whole chain > was (it would only send to other corrupt remailers). > Oh, I see. I was confused as to which scheme you were talking about. You were refering (I think) to the "prepaid mailer" idea Tim May described in his "Re: Anonymous Anonymous ftp" post of Jan 27. Jim_Miller(a)suite.com

1 0

Re: A question of ethics.
by pgpkeys＠wasabi.io.com 17 Dec '03

17 Dec '03

>Ok, I'm in a bit of a quandry. While surfing the net last week, I >happened across an address addached to a machine that belongs the the >federal reserve. No big deal. I telnetted there on a lark, and entered >'guest' for the account. It dropped me into a shell. It didn't ask for >a password. Intrigued, I did a little looking around. Nothing special, >a CDRom and about 80 accounts. But(!!), /etc/passwd was there and >available and not using shadows. No, I didn't snatch a copy. > >Quandry(ies) > >1) Should I alert someone there about the obvious (and, IMHO serious) >seciruty hole? > > or > >2) Should I ignore it? > >3) Should I take advantage of it (well, maybe not) > >---------- > >I don't like to see systems so open, no matter who they belong too, and >the fact that the governments (whether you like them or not) has one this >open REALLY bothers me. > >But, I also wonder what kind of trouble I could get into. Technically, I >violated something just by being there as I didn't have permission, and >the fact I accessed the passwd file makes it even worse. If I report it, >I could be in deep shit. > >I could mail to them via a remailer (like penet.fi, so that they could >answer for more information if needed). That is a little securer and >Julf is out of jurisdiction of the FBI hunting me down. > >Yes, I'm a little paranoid, but Uncle Sam likes to make examples out of >white-collar hackers, and for me it was pure and dumb luck (like a jury >would believe a 22 year-old computer geek isn't trying to gain illegal >access). > >Any suggestions? Please? I consider this to be serious (most may not). Go to a COCOT and call Ms Flanagan below. *Not* the Tech contact, who is most likely the person who fucked up and will want to cover his butt. The admin contact should be more sympathetic... 20th and C Streets, NW Washington, DC 20551 Domain Name: FRB.GOV Administrative Contact: Flanagan, Elizabeth R. (ERF7) erf(a)FED.FRB.GOV (202) 452-2672 Technical Contact, Zone Contact: Drzyzgula, Robert P. (RPD5) rcd(a)FED.FRB.GOV (202) 452-3425 Record last updated on 14-Aug-91. Domain servers in listed order: NS.UU.NET 137.39.1.3 UUCP-GW-1.PA.DEC.COM 16.1.0.18 UUCP-GW-2.PA.DEC.COM 16.1.0.19

1 0

Canadian voice recognition article
by cmckie＠ccs.carleton.ca 17 Dec '03

17 Dec '03

Spy Agency works on eavesdropping device for phones, faxes New snoop gadget would identify voices carried through air The Canadian Press Used on page 1, Ottawa Citizen, Monday January 31, 1994 An elite wing of Canada's spy agency is secretly developing devices that can monitor and identify voices carried through the air by phone, fax and radio signals, according to a broadcast report citing government documents. The Communications Security Establishment is a super-secret branch of the Canadian Security Intelligence Service that specializes in gathering signals intelligence - SIGINT to insiders. Since 1989, the CSE has awarded three contracts worth $1.1 million to a Montreal firm to make machines that can quickly isolate key words and phrases from the millions of signals the CSE monitors each day, CTV reported Sunday. In May 1983, the CSE awarded the Centre de Recherche Informatique de Montreal a contract to develop a "speaker identification system," which can pick voices from the electronic haze and identify them. "Its frightening," says Bill Robinson, a researcher with the peace group, Project Ploughshares. "It has Orwellian potential to sweep through everybody's conversations. As computers get faster and faster, theoretically, one would be able to keep records of all conversations." The CSE is supposed to provide the federal government with foreign intelligence, but parliamentarians have often voiced concerns about the agency's potential to violate the privacy of Canadians. Liberal MP Derek Lee, the head of a Commons committee that oversees Canada's spy agency, said the CSE is overstepping its mandate. "Have they been asked, or have they decided for themselves to take on a new role that requires them to analyse the human voice? And if they have, they've gone beyond what I think they've told us." The CSE is accountable to Parliament through the defence minister. But Defense Minister David Colonette told CTV her was unaware of the CSE's latest electronic snooping projects. "This is the first I've heard of this," Collenette said. "It is certainly something I'll discuss with my officials." While in Opposition, the Liberals pledged to make the CSE more accountable. With a budget of about $250 milliojn and more than 800 employees the CSE operates out of a building on Heron Road in Confederation Heights surrounded by a barbed-wire fence. Its work is considered so sensitive that employees are told not to take commercial flights, in case the plane is hijacked and they are held hostage.

1 0

Remailer Tearline Conventions
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

* Reply to msg originally in CYPHERPUNKS Uu> From: edgar(a)spectrx.saigon.com (Edgar W. Swank) Uu> Someone (not me) asked about remailer tearline conventions to Uu> eliminate automatic sigs: Uu> I'm the one who brought this up "months ago" and the short answer to Uu> your question is "no." Uu> Hall Remailer <nowhere(a)bsu-cs.bsu.edu> Uu> added a "cut line" of Uu> --ignore-- Uu> At the time I brought this up, the attitude of most remailer operators Uu> (Chael Hall and Miron Cuperman notably excepted) was that anyone who Uu> couldn't figure out how and remember to turn off their auto sig didn't Uu> deserve any privacy. An astonishing bit of Internet provincial fuckheadedness, I must say! When one considers that there are _many_ other nets that gate into Internet these days and innumerable store-and-forward host systems whose message handling processes are _completely_ beyond the control of the end user (even smug Cypherpunk geniuses), this attitude mystifies me. Uu> I recommend that you always use the wimsey (extropia) remailer as the Uu> first (or only) leg of a remailer chain. It is also the only Uu> Cypherpunks remailer outside the USA (it's in Canada) which will make Uu> tracing msgs a little more difficult for USA authorities. That remail(a)extropia.wimsey.com is in Canada specifically makes communications with it fair game for NSA interception, however.

2 1

Re: On return addresses
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Eric Hughes writes: > I've been troubled for many months by an invariant in all forms of > return address schemes: The outside world contains sufficient > _persistent_ information to find a real adress. > > [stuff deleted] > > So how do we solve it? By abandoning return addresses and > using mail spool facilities. > > [more stuff deleted] > > 1. I have a machine and I'll sell you an address on it... > > 2. When mail come in for you, it sits in a spool... > > 3. Your mail sits in the spool until you access it with... a > mail server command of "send me a mailbox file of my > waiting mail". > > [even more stuff deleted] > > The elimination of persistent identifying information > for return paths is a worthwhile design objective. I > propose that we start thinking about it more thoroughly. > > Eric > Let me see if I understand your idea correctly. I am picturing something like the following: There will exist a bunch of remailers that, in addition to forwarding mail, will also sell mailboxes. (I'm combining the remailer with the mail spools to add to the mix of messages to and from). The "mailboxes" are actually e-mail addresses referring to a pseudo-account on some machine that hosts a remailer/mail spooler. Bob would purchase a number of mailboxes scattered throughout the remailer/mail spooler system. Bob would give out the address of one of these mailboxes to people so they can send "reply" messages to him. Messages addressed to Bob's "public" mailbox would be spooled by the remailer hosting that mailbox. Periodically (perhaps frequently), Bob would send an anonymous message (via other remailers) to the remailer hosting his public mailbox to command the remailer to send the contents of his mailbox to one of his other mailboxes. The remailer wouldn't necessarily know it's sending to another mailbox, it's just sends to an address supplied in the command message. Bob repeats this process to move his messages from his second mailbox to his third mailbox, and so on. Eventually, he moves his messages from his Nth mailbox to his "real" address. Is this approximately what you had in mind? I left out IP redirectors and POP clients because I'm not familiar with them. Jim_Miller(a)suite.com

1 0

CRYPTO - New US keyserver now fully operational -
by fringeware＠illuminati.io.com 17 Dec '03

17 Dec '03

Sent from the cyberdeck of: pgpkeys(a)wasabi.io.com (PGP Slave Key Server) The US-based keyserver 'pgp-public-keys(a)io.com' is now open to the public. Come one, come all! Here is the current file as returned by 'Subject: help'. This site is a PGP key server SLAVE site. It behaves very similarly to the European PGP master sites, but there are a few small differences which will be noted below. The most noticable difference is that it answers your requests immediately instead of waiting for a daily batch job to run :-) The particular installation at io.com does *not* log the details of requests for keys, however the fact that you have sent mail to the key server at all is logged in the daily sendmail logs. These logs will be erased automatically after one week. PGP Public Keyservers --------------------- There are PGP public key servers which allow one to exchange public keys running through the Internet and UUCP mail systems. This service is NOT supported in any way whatsoever by the schools or organizations on which these servers run. It is here only to help transfer keys between PGP users. It does NOT attempt to guarantee that a key is a valid key; use the signators on a key for that kind of security. This service can be discontinued at any time without prior notification. Each keyserver processes requests in the form of mail messages. The commands for the server are entered on the Subject: line. To: pgp-public-keys(a)io.com From: johndoe(a)some.site.edu Subject: help Sending your key to ONE server is enough. After it processes your key, it will forward your add request to other servers automagically. For example, to add your key to the keyserver, or to update your key if it is already there, send a message similar to the following to any server: To: pgp-public-keys(a)io.com From: johndoe(a)some.site.edu Subject: add -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.2 <blah blah blah> -----END PGP PUBLIC KEY BLOCK----- COMPROMISED KEYS: Create a Key Revocation Certificate (read the PGP docs on how to do that) and mail your key to the server once again, with the ADD command. Valid commands are: Command Message body contains ---------------------- ------------------------------------------------- ADD Your PGP public key (key to add is body of msg) *** Note: your update is forwarded to a master server and may take a few days to reappear INDEX List all PGP keys the server knows about (-kv) VERBOSE INDEX List all PGP keys, verbose format (-kvv) GET Get the whole public key ring GET 0xA1B2C3 Get a single key by Key ID *** Note: the master servers allow you to omit the 0x in front of the Key ID. The slave servers do not. GET userid Get a single key by User ID MGET substr List all keys which match "substr" *** Note: this is different from the master servers which return the keys themselves, not just a listing of their Key IDs. Also the master servers accept a wild-card expression; at the moment we do not. LAST days Get the keys updated in the last `days' days *** Note: not yet implemented ------------------------------------------------------------------------ Examples for the MGET command: MGET michael Lists all keys which have "michael" in them MGET @iastate.edu Lists all keys which contain "@iastate.edu" Check the Usenet newsgroup alt.security.pgp for updates to this system and for new sites. Based on a document originally by Michael <explorer(a)iastate.edu>

1 0

Prodigy Hard Drive Scans
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

I heard from a friend that Prodigy was scanning user's hard drives. Basically, when you logged on Prodigy made a complete directory of your hard drive and uploaded it. Prodigy was using this to find out what applications you used so they could direct the appropriate advertising towards you. Apparently, they're suffering several lawsuits now because of it. My friend heard this on the trailing end of a radio talk show. If it was really happening, it sounds horrible. Could Secure Drive be set up to stop this kind of attack? Can anyone tell me if this is more than a rumour? If it is more than a rumour, would you be able to point me towards some information about this? -john. jdblair(a)nextsrv.cas.muohio.edu

1 0

Re: Prodigy Hard Drive Scans
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

> I heard from a friend that Prodigy was scanning user's hard drives. > Basically, when you logged on Prodigy made a complete directory of your > hard drive and uploaded it. Prodigy was using this to find out what > applications you used so they could direct the appropriate advertising > towards you. Apparently, they're suffering several lawsuits now because > of it. > > My friend heard this on the trailing end of a radio talk show. If it was > really happening, it sounds horrible. Could Secure Drive be set up to > stop this kind of attack? > > Can anyone tell me if this is more than a rumour? If it is more than a > rumour, would you be able to point me towards some information about this? Just a rumor, disposed of several years ago. A hot topic of debate around 1990. This rumor arose because Prodigy set aside a block of user disk space for its own files. Sometimes this block had random stuff in it (recall that "erasing" a file doesn't actually overwrite the disk, it just removes pointers to the stuff being erased and allows other stuff to later be overwritten over it). Prodigy used part (a small part, given 1200- and 2400-baud modems in use then) of this block to send back to the main computers, so in principle it could see miscellaneous scraps of erased data. But this was accidental, was a tiny fraction of the disk, was not used or even looked at by Prodigy, and would have absolutely no value in determining applications used. (Think about what a samll random chunk of "erased" disk space would really mean in terms of telling outsiders what applications you use!) Ironically, an old college buddy of mine is now in charge of e-mail for Prodigy, in White Plains, New York. He visited me last summer and I showed him a _real_ computer service (Netcom) and we had a few good chortles about this Prodigy Conspiracy. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power:2**859433 | Public Key: PGP and MailSafe available.

1 0

Re: your mail
by David Vincenzetti 17 Dec '03

17 Dec '03

Some anonymous user sent me a message which is divided in three parts. I am sorry but I did not receive the first one. Can this anon guy please send me the first part again? Thank you.

1 0