December 2003 - cypherpunks-legacy

Re: The Remailer Crisis
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

At 12:39 PM 1/20/95, Mark Chen wrote: >> From: frissell(a)panix.com (Duncan Frissell) >> >> I offer to pay for and operate a remailer account on any system that will >> have me. >> >> best.com, based in Mt. View, CA. Mail to postmaster(a)best.com, or try >> the other standard extensions. > >As it happens, I just signed up for a SLIP account at Best. I'm using >their standard dial-up service, but they also offer a dedicated 28.8 >connection for $450 setup and $60/mo. You know, these fees everybody keeps quoting sound remarkably like the cost of a modem, the installation of a new phone line, plus a reasonable amount of profit. So why don't a bunch of you, say in the Bay Area, get together to get a small subnet, each buy your own pair of modems, pay for the added phone line, and install the whole shootin' match in Tim's house? >Mark Chen b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music Finger ben(a)tux.music.asu.edu for PGP public key ID 0x875B059.

1 0

Remailer In a Box available for beta testing
by sameer 17 Dec '03

17 Dec '03

I finally got annoyed with Tim clamoring for a Remailer in a Box, so I set it up just now... I just wrote it so there may be some problems I haven't gotten rid of yet. If you want to run a remailer on c2.org: 1) Sign up for a shell account on http://www.c2.org/services/signup.html 2) Log into your account (via dialup [510-549-1383] or telnet [c2.org] once it has been created. (within a day.. I'll automate account creation so it gets made within an hour soon, but right now I am doing it manually.) 3) If you wish, you can setup a .forward file to point to mailfilters or to another account. 4) Run the program /usr/local/lib/boxed-remailer/install_remail. The remailer will be installed, and non-remailed mail will be acted upon according to how the account was setup before you ran the program. 5) Answer the questions, they should be pretty simple. Once an account is created there is a one week free grace period. If you'd like to continue the account you can pay for it. If you have problems and suggestions, make sure you mail me, and I'll fix it. This is still in beta testing, so if you have problems I won't disable the account waiting for payment until the problems are fixed. $10 for one month, $27 for 3 months, $45 for 6 months. -- sameer Voice: 510-841-2014 Network Administrator Pager: 510-321-1014 Community ConneXion: The NEXUS-Berkeley Dialin: 510-549-1383 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 2

Re: Netscape, RC4, key exchange?
by kipp＠warp.mcom.com 17 Dec '03

17 Dec '03

In article <19875.9501201052(a)exe.dcs.exeter.ac.uk>, you write: > -----BEGIN PGP SIGNED MESSAGE----- > > grendel(a)netaxs.com wrote: > > aba(a)atlas.ex.ac.uk wrote: > > > I have code to generate the RSA key pairs and modulus, what I am > > > looking for is code to factorise a number using one of the better > > > algorithms (quadratic sieve, etc.). > > > > It's been established that the encryption in Netscape is 40 bit > >RC4, not 40 bit RSA, [...] > > Ok, so Netscape (the exported version only?) uses 40bit RC4 for > encryption, but what about key exchange? RC4 is a stream cypher so > both the receiver and sender need to know the key. Does anybody know > what method Netscape uses to exchange keys DH, RSA, other? and what > key sizes? If you read the spec (http://www.mcom.com/info/SSL.html) you will see that SSL uses RSA public key encryption for key exchange. However, the protocol is slightly more general than that, so if there is a different public key algorithm it is possible for SSL to support it. --------------------------------------------------------------------- Kipp E.B. Hickman Netscape Communications Corp. kipp(a)netscape.com http://home.mcom.com/people/kipp/index.html

1 0

Re: IRS to keep unreviewable secret dossiers on US citizens
by xpat＠vm1.spcs.umn.edu 17 Dec '03

17 Dec '03

perry(a)imsi.com says: >xpat(a)vm1.spcs.umn.edu says: >> Excerpts from : St Paul Pioneer Press, Jan 29, 1995 >> >> Here's the kicker: "Although agency officials concede that some of >> the data collected will be inaccurate, taxpayers will not be allowed >> to review or correct it" ^^^^^^^^^^^^^^^^^^^ >> ^^^^^^^^^^^^^^^^^^^^^^^ >The privacy act and FOIA make that more or less illegal -- if they are >keeping information on you, with certain law enforcement related >exceptions they have to let you see it. I should add that later in the article it suggests the scenario of select information from the database being used in an audit, and you would be able to contest the specific information they use against you, but you would not be able to view any of the raw data. ^^^^^^^^^ It sounds like this amounts to "we don't have the info until we use it against you". -------------------------------------------------------------------- P M Dierking |

1 0

RE: IRS "DataBase"
by Blanc Weber 17 Dec '03

17 Dec '03

A funny - I just saw this in some email: "If guns are outlawed, how will liberals collect taxes?" --- A. Nonymous (Sorry, I didn't mean to bring up an crypto-unrelated political party/tax discussion. This is *strictly* a matter for Logic and Anarchy.) .. Blanc

1 0

Place for WWW info/ stuff
by Jaeson.M.Engle＠josaiah.sewanee.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have a server (WWW and ftp) that I would like to use for anything anyone needs a place for. Drop me a line, or visit what's on my server (see below). The part of the server that I will be putting cypherpunk related material is password controled, and cannot be accessed unless you have am account and password (assuming of course someone else doesn't break in and figure someone's out that is... but I don't see how they could.) This is just FYI for all and anyone! Cheers, - -J -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLyAj5UiLvmPjc4XdAQEJsAP+Pd7A/I01zZUaXUi7vhIbk3XHijrgAhjZ 1ZqIVuiOIfddnS8w+hJ1bKrxZFoY9YRzNLx0rliBckEn+HVYOl4+qQQjZ3TqjhDw FULRRD6DGS85ZLZ/rwKrlyrSPY6YywgzgyzlZcUa/UtQ9Ll66NA4R6c7VWQB+4K7 qBuOUaOWvV0= =XXIw -----END PGP SIGNATURE----- aka: (-: Jaeson M. Engle || jme(a)josaiah.sewanee.edu :-) (-: www server: http://josaiah.sewanee.edu/ :-) (-: It's January 29th! IT'S TIME!!! Ask me for details!:-) (-: Finger 'jme(a)josaiah.sewanee.edu' for my Public :-) PGP block.

1 0

Little ebanks -- a modest proposal.
by davidm＠iconz.co.nz 17 Dec '03

17 Dec '03

[Executive Summary -- The author proposes a system of stamps for remailers as a way of starting up an ecash system. The stamps would be sold to the public as stamps, but be convertible by remailer operators into real money.] Hal, Many thanks for your comments. I'll try to make this less legalistically impenetrable. Despite the difficulties, I think anon corps are possible - and legal. What I was trying to stress is that they are expensive and inefficient: so you have to be really sure you want anonymity if you are going to use one. The hurdles to ecash seem more formidable. The problem with moving off shore and ignoring the SEC, for instance, is that your scheme loses some credibility. Since the value of ecash is (in the short term, at least) going to be based on the possibility of converting it into real cash (just as the value of real cash is based on the possibility of converting it into real things), a structure that operates outside the law makes that value doubtful. A large-scale rollout of ecash for the average Netscape user (and the people that service them) is going to need all the legitimacy it can muster. Perhaps, though, we can start small, and allow the forces of nature (greed, envy and, with a bit of luck, sloth) to take their course and scale a small scheme into a thriving e-economy. What I have in mind is a service that provides estamps (you knew there had to be an 'e' in there somewhere, didn't you) for use with remailers. Jo Anonymous buys stamps, sticks them on her messages, and the anon-remailers collect them. The remailer ops then get to cash the stamps in for actual money, so they can pay their ISPs and lawyers. At the heart of the scheme is a genuine (micro) ebank [a uebank?]. But, to avoid problems with offering securities to the public (and the SEC hassles etc), the ebank only sells estamps (little bits of ecash) to estamp- vendors. The estamp-vendors sell the stamps (with a mark-up?) to the public. [Perhaps using this new Netscape/Mastercard tie-in.] Because the estamp- vendors are only selling stamps (you can tell by the beautiful stamp-like gif-icons the vendor's Web page uses...) the SEC doesn't become involved. [I'm relying on the fact that the numbers involved are really small, and that the estamps *are* being sold for the purposes of postage. Perhaps the ebank and the vendor should be based off shore...] This scheme breaks the credibility issue into two -- a large number of people (anonymous remailer users) have to be convinced of something relatively trivial (that the remialer will accept the stamps); a small number of people (anonymous remailer operators) have to be convinced of something relatively important (that the stamps are exchangeable for cash). If the remailer operators are sufficiently involved in the scheme, this should work. One type of scalability comes when EITHER A. Someone sets up as a Data Haven token vendor (the tokens being bought from the ebank as slightly larger bits of ecash), and data haven operators start to accept the Tokens, in the knowledge they can swap them for real money; OR B. Data Haven operators start to accept estamps for their services, because they can swap them for cash; OR both. [The first scenario obviously disguises the appearance of ecash as a medium of exchange for a bit longer.] Another type of scalability comes when other people start uebanks, which then issue their own estamps/tokens/ecash to estamp/token vendors. If the new uebanks are as (provably) secure as the original(s), the uebanks could agree to clear each others' ecash and settle up at the end of the day (or some global equivalent - eg 12am GMT) using some kind of netting system. As long as everyone played nice at the beginning (all the remailer operators declared their estamp income etc ;-) the uebanks could go legit: and by backing their submissions to regulators with a proven record of service (no need to stress that the remailers were *anonymous*), by wearing Al Gore t-shirts and garbling about the I-way and electronic town halls, and by not letting Tim May and his contract killers near the place, it might just work. On the other hand, if the system is working well enough, there may be no need to go legit. (Although if I was an ebank operator I would be wary about entering into netting arrangements with an ebank the SEC etc could close down). [But is netting needed with online clearing? Perhaps this would only be useful across currencies...] With the ebanks in appropriate jurisdictions, operating in grey rather than obviously black areas (it is not so much that this stuff is being offered to the public as that the public is going out to *find* this stuff), with a proven track record in ponying up the cash, and with the approval of really cool people who get on the cover of Wired, Robin Public may not *need* any more assurance to par- ticipate in the e-economy. What R.P. *will* need is products. Most of the attempts at net-commerce I've seen concentrate on offering things that can be delivered to people, either physically (so that the Compuserve Electronic Mall is basically a mail order catalogue) or electronically (hence the rather sketchy descriptions of anonymous markets, usually falling back on the idea that, because this is the Information Age, consulting is the root of all value...), to be consumed now (this tin of coffee, that movie-on-demand, the other set of nanotech plans). But of course a lot of people (not, unfortunately, myself :-) have significant amounts of property that they do not consume right away. The possibility of anonymous investment (through eg anon corps) offers huge scope for the development of the e-economy. [I'll mention one statistic -- according to tax haven experts (Ginsberg, Spitz), in 1989 50% of all money processed internationally goes through tax havens.] After all, a capitalist economy (even an anarcho-capitalist economy) is built by capitalists, not wage slaves. More later (unless you plead real hard...) Cheers, David

1 0

Re: The Remailer Crisis
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Tim urges recently that we need to do something about the "remailer crisis." I remember Sameer once mentioning that he could set up remailer-in-a-box accounts for possibly anonymous 'sponsors' who'd be the legal owners therefore indemnifying Sameer (the tolerant sysadmin) of responsibility. I know he allows 'remail-to-yourself' blind-server accounts for $10 / meg or something. That's probably a bit expensive for a sponsor of a public remailer (any stats on average remailer traffic?). I never did here any more from sameer or anyone else about remailers-in-boxed-accounts. I for one would be willing to 'sponsor' a remailer account on any system with a small fee - I can't run my own as my private site looks at the world through PPP. I suggest that 'sponsored' remailers are a better way of making remailers economically viable for people like Sameer, who are the real, if not nominal, administrators. Though I hardly use remailers, those who do would probably make better (and more easily executed) use of their money if they sponsor remailer accounts on Cypherpunk ISPs like c2, rather than pay a (truenamed, legally vulnerable) operator for any single remailer. Sameer's blind-server code can come in use to make any link between the sponsor and her sponsored account very hard to detect. The advantages of sponsoring remailer-site operators to create remailing accounts, rather than pay an individual remailer operator, are many: 1. innocent until proven guilty - presumably sponsors do use remailers a lot; but not necessarily. So the payment transaction can be via truename, rather than via some complicated anonymous means, and still leave the sponsor unimplicated 2. legal - an operator of a single remailer is vulnerable - technically, if not root, and legally otherwise. an administrator of a Cypherpunk ISP is not, and does not have the legal right to monitor a customer's traffic, and with blind-servers even detailed logging don't lead back to the owner of an account, the sponsor, from any _specific_ remailer (though a pool of sponsors exist for a pool of remailer account) 3. technical - it's not possible to ban a single remailer, as they may be _many_ on a site. If the site is much more than just remailers, it's not really possible to ban the entire site. 4. traffic analysis - more remailers addresses will make traffic analysis harder, and chaining more fun - you could chain through multiple accounts on a single site with little loss in reliability (though you'll still want to go through more sites) 5. remailer explosion - more reliable remailers (due to the '-in-a-box', more users, wider distribution Comments? ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

Netherlands crypto ban?
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

What's the update on the move to ban private crypto in Holland? Last I remember there were trial balloons, but nothing happened. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: IRS to keep unreviewable secret dossiers on US citizens
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 12:44 PM 1/20/95 CST, xpat(a)vm1.spcs.umn.edu wrote: >Excerpts from : St Paul Pioneer Press, Jan 29, 1995 > >"IRS plans to collect more data on individuals to nab tax cheats" [...] Here's the text from the recent EPIC annoucement on this--it covers the exemption the IRS is claiming from the FOIA in a bit more detail (sorry if people have already seen this): ======================================================================= [6] IRS Initiates Massive New Database ======================================================================= On December 20, the Internal Revenue Service announced in the Federal Register that it was planning a new database to monitor compliance of taxpayers in a project entitled Compliance 2000. The database would contain information on all individuals in the U.S. who conduct certain financial transactions and would be segmented by different criteria: Any individual who has business and/or financial activities. These may be grouped by industry, occupation, or financial transactions, included in commercial databases, or in information provided by state and local licensing agencies. The new database will combine private and public sector databases in a single searchable entity. A number of federal financial databases from the IRS will be enhanced with state, local and commercial sources. The Federal Register notice describes the non-tax databases: Examples of other information would include data from commercial databases, any state's Department of Motor Vehicles (DMV), credit bureaus, state and local real estate records, commercial publications, newspapers, airplane and pilot information, U.S. Coast Guard vessel registration information, any state's Department of Natural Resources information, as well as other state and local records. In addition, Federal government databases may also be accessed, such as, federal employment files, federal licensing data, etc. Finally, even though the proposed system would use frequently inaccurate "commercial databases" such as direct marketing records, taxpayers would not be able to review their records to ensure that they are accurate and up to date: "This system is exempt from the access and contest provisions of the Privacy Act." EPIC is filing comments asking the IRS to reconsider its use of commercial databases and to ensure that there are greater safeguards on the collection and use of personal information. A copy of the Federal Register notice is available at cpsr.org /cpsr/privacy/epic/IRS_compliance_2000_notice_txt Comments on the proposed system must be received by January 19, 1995, and sent to Office of Disclosure, Internal Revenue Service, 1111 Conn. Ave, NW, Washington, DC 20224. EPIC's Comments are available at cpsr.org /cpsr/privacy/epic/epic_irs_compliance_2000_comments.txt --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

2 1