December 2003 - cypherpunks-legacy

REMAIL: Remailer that only remails to other remailers
by ghio＠cmu.edu 17 Dec '03

17 Dec '03

One of the problems in convincing people to run remailers is that they don't want to have to deal with complaints. Someone posted awhile ago that they would be willing to run a remailer that would only remail to other remailers. This would enhance the security of remailer chains while not creating too many political problems for sensitive sysadmins. If anyone's still interested, here's how to do it: ftp cs.cmu.edu cd /afs/andrew.cmu.edu/usr12/mg5n/public get ghio.cp.remailer.tar.gz This is a copy of the remailer that I run on kaiwan. gunzip and untar it. Modify remailer and sendlatents with the proper directory names for your system. Now, you need to modify a line at the end of block.c. Change if (match==0) printf("%s",argv[1]); to if (match!=0) printf("%s",argv[1]); Now it is a pass-address filter instead of a block-address filter. Now put the addresses that you want the remailer to be able to send to in blocked.addresses (you can rename the file in the remailer csh script.) Now create a PGP key for your remailer, set up a .forward file to 'remailer' and you're all set...

1 0

Majordomo
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Was it my breath, or did Majordomo go down again? ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

No Subject
by John Young 17 Dec '03

17 Dec '03

How can I check a newly downloaded PGP2.6 to verify that it is tamper-free before use and back-up? John Young

1 0

CYPHERPUNK OPERATIVE
by Sandy Sandfort 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Okay, somebody needs to fess up. I *know* someone on the Cypherpunks Channel is writing about the Clipper Chip and other crypto-privacy issues for /Expat World/. I thought I was the only one who had even heard of this newsletter for expatriates until I saw some of the crypto articles. Whoever it is, is doing a great job. In the June 15 issue, in the article, "How Big Brother Wants to LIsten, Too," the writer coined the term "Al Gorewellian." Gotta love it. If the writer of these articles is reading this note, please let us know who you are. You deserve the recognition. (If you want to keep a low profile, how 'bout sending me private e-mail? I'd like to discuss some things with you.) S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLgYBPU5ULTXct1IzAQEINgQAhzypoIDVoX5bad9Vd8psttmS5ClRbKqr vNA7L88jallJzrmUL5NZv6SO7NPAFxQzC2bnS2KJv4MpyRFl+ZYIku2cQZfQWShY 3TLUXuqK9HVHED7rCzq3Xq1Kny/fZZ9U74PSLe8fi+L9xsL5Ht0yDEmBYCG3REkv J0npF+9FCHw= =xgFs -----END PGP SIGNATURE-----

1 0

Real truth about Cell phone tracking
by rusty＠hodge.com 17 Dec '03

17 Dec '03

1. Cellular phones "register" (the proper term) themselves whenever they move into a new cell (the coverage area provided by a base or tower - not the proper term. They do this by scanning the control channels when the current one falls below a certian signal strength. If you have cellular monitoring equipment, you will see the registration confirmations transmitted on the control channel, complete with the MIN (mobile identification number, or cellular phone number). The MTSO (mobile telephone switching office) knows what MINs are registered in each cell at a given time. 1a. A cellular phone can be "tracked" if it is turned on. It does not have to be in use. 2. If you are in a fixed position, and your phone is going between service and no service modes, you are at the edge of coverage area, and some of the time the control channel is falling below the scan threshold. It then tries to register with another cell and another until it is successful. It is scanning control channels when the no service lite is on. 3. There is a test mode defined in the NAMPS standard that causes a phone to begin transmitting on a designated frequency. And since the mouthpiece on a cellular phone is not switched off when the phone is on hook, you can easily bug someone's car this way. 4. Many of the cellular-based vehicle tracking systems only use the cellular phone to transmit data back to company headquarters, and do not determine location via triangulation or doppler direction finding techniques. These are not reliable enough for moving targets due to all the RF reflections. Also, my (limited) experience with doppler-based triangulation DFing shows how hard it is to DF a modulated FM signal. And since all cellular phones are transmitting a SAT tone (a 6kHz-ish supervisory audio tone) all the time, I think this would be very hard to do. 5. In major metro areas, individual cells cover extremely small areas... often every mile or two on the freeway, you will see another cell site. So you know exactly where to send a helicopter to. 6. For under $1000, you can buy a box which hooks up to a PC and controls a scanner and decodes the cellular control channels (and reverse channel data too). This includes software for following cellular calls as they hop from cell to cell, paging requests (get a phones attention), and displaying the MINs that register in a given cell (or cells, but you need one receiver for each cell you are monitoring!). 7. From the moment your phone starts ringing, there is an audio path back to the MTSO. When your phone is ringing, it has been assigned a channel and is transmitting. Pressing the send button to answer the phone sends a signal to the MTSO telling the switch to connect the landline to the channel the phone is on. This is especially evident on Ericcison switches (like LA Cellular uses). -- Rusty Hodge <rusty(a)hodge.com>

1 0

Re: Real truth about Cell phone tracking
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: From: Rusty Hodge <rusty(a)hodge.com> : 3. There is a test mode defined in the NAMPS standard that causes a phone : to begin transmitting on a designated frequency. And since the mouthpiece : on a cellular phone is not switched off when the phone is on hook, you can : easily bug someone's car this way. Woo! Built-in infinity-transmitter mode! (Just like ISDN actually) : 6. For under $1000, you can buy a box which hooks up to a PC and controls a : scanner and decodes the cellular control channels (and reverse channel data : too). This includes software for following cellular calls as they hop from : cell to cell, paging requests (get a phones attention), and displaying the : MINs that register in a given cell (or cells, but you need one receiver for : each cell you are monitoring!). These are selling on the black market over here in Britain for 3 or 4 K pounds. People who buy them use them to close phones, then sell time on the cloned phone over a weekend before it's discovered. G

1 0

List wiped AGAIN?
by Michael Handler 17 Dec '03

17 Dec '03

I thought it had been a little quiet... then I saw the subscriber list. Any idea *why* this keeps happening? -------------------------------------------------------------------------- Michael Brandt Handler <grendel(a)netaxs.com> Philadelphia, PA PGP v2.6 public key on request Boycott PSI, Inc. & Canter & Siegel <<NSA>> 1984: We're Behind Schedule

1 0

Re: Crypto export legislation defeated in House Intelligence Cmte.
by Claborne, Chris at ScrippsRanc 17 Dec '03

17 Dec '03

> So much for lobbying. > > Look, something is going on here that doesn't meet the eye. Nothing is > ever unanimous in Washington. These guys were told something by somebody > that caused them to vote like this. You can bet it had nothing to do with > terrorists, drug pushers, or pedophiles. Why don't you expend > some effort to find out what they were told and by whom so we could learn > what this issue is really about because it is NOT about "national security". > Think about it... If you've had the ability to listen to any voice or e-mail traffic you felt like with a simple telco set or inexpensive computer any time, anywhere you felt like, wouldn't you put up a fight? It's like trying to take a gun from a NRA member. Once you have a freedom to do something you aren't going to give up easy. It's only going to be more difficult since NSA, and other three letter orgs are part of the government. Our metro-police, FBI, CIA, XXX, have been able to tap phone and e-mail (illegally or with court permission, or in the name of "national security") as easy as plugging in a toaster. Once citizens start using crypto systems, these three letter orgs are going to have to work for a living. OK, so a crook is using crypto in his communications. Most are so stupid, getting the keys won't be that hard and even better... the crook will still think his comm link is secure. I'll stop here with my arguments for dropping the barriers to crypto. For NSA, finding the right string to pull is probably real easy. The only thing we can do is continue to apply pressure at all fronts. Educating the general public is on one front. EFF has other fronts. ... __o .. -\<, chris.claborne(a)sandiegoca.ncr.com ...(*)/(*). CI$: 76340.2422 PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

Re: Beware of Roman Catholic Corruption
by gbe＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Don't let them lure you into following them into Hell. The 1611 > Authorized (King James) Version of the Holy Bible is the only book > that God ever wrote. All other alleged translations are frauds > written by the Devil himself. So what version of the scriptures did Jesus quote from? Gary B. Edstrom | Sequoia Software | PGP fingerprint: Internet: gbe(a)netcom.com | Programming Services | 2F F6 1B 28 6E A6 09 6C CompuServe: 72677,564 | P.O. Box 9573 | B0 EA 9E 4C C4 C6 7D 46 Fax: 1-818-247-6046 | Glendale, CA 91226 | Key available via finger What is PGP? Subscribe to alt.security.pgp and find out! -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLgaIwkHZYsvlkKnJAQHfJAP+NBbcCDGzobs2IKuBCro9+Cka9VtMrbqi NQY1SZRv6ZMUb7UwF5dd6J0rPJCwjzs9bLNWDxG643BHww0LWlc8+jfw0N6eZX7U jYeso6+jKwSA3+sVfygyI5WTOUe5dUqFQfzHuxDFzZrgej3eejLw16WiwuCRpViL sk345Pw5dQQ= =SlzJ -----END PGP SIGNATURE-----

1 0

Re: Keep Out--The Journal of Electronic Privacy
by John.Schofield＠f903.n102.z1.fidonet.org 17 Dec '03

17 Dec '03

rr> About "Keep Out": you might want to be more precise in your blurbs. As rr> things stand, I'm leery of trusting anything I might see in rr> your journal. rr> RSA is not broken, as far as I know. If you have verifiable details that rr> it has, that'll be quite a scoop. If you meant to say "the _factoring_ of rr> RSA-129," well, you should have said that instead. My apologies to the net. RSA is certainly not broken, and I was aware of that when this press release was written. My word choice was sloppy. In the article, the information comes from people I have interviewed who have direct, first-hand knowledge of the effort--people like Arjen Lenstra, who wrote the software that made the factoring possible. rr> > * An interview with Phil Zimmermann, including his thoughts on rr> privacy in the digital age, export controls on cryptography, the rr> copyright on RSA (the algorithm used in PGP), and information on his rr> struggle with US Customs over exporting PGP rr> A publisher, of all people, really needs to understand what a copyright rr> is. Note that we cannot copyright ideas, only our expression of those rr> ideas. Referring to a copyright on "the algorithm used in PGP" is rr> nonsense. Instead, PKP holds licensing rights to a system _patent_ on rr> using RSA to perform public key encryption. Again, I used sloppy language. And again, my apologies. This is certainly not the last mistake I will make. There will be errors in Keep Out. However, I will do my damndest to make sure Keep Out remains as accurate and unbiased as it can be. And when I make mistakes, I trust Cypherpunks to let me know about them, so I don't repeat the mistakes. It's a damn sure bet I won't be making these two errors again! --John Schofield -- : John Schofield - via mcws.fidonet.org - Public Access (213)256-8371 : ARPA/INTERNET: John.Schofield(a)f903.n102.z1.fidonet.org : UUCP: ...!cheshire!mcws!903!John.Schofield : Compu$erve: >internet:John.Schofield@f903.n102.z1.fidonet.org

1 0