December 2003 - cypherpunks-legacy

Re: Sufferance remailers
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

Great idea, but IMHO going offshore is a bit difficult... it might be easier to arrange with a `useful idiot` to get an extra phone installed in their closet, which would then call forward to a local (and changeable) phone number, where the computer would be physically located. The computer itself would be transportable, and ideally everything would be enclosed in a self-contained unit with just two outlets...one for electricity, and one for the telephone connection. A further security step would be to trap the box such that if it were opened improperly, the disk drive would be physically destroyed. The local phone calls don't create toll records, nor will a tap or pin register, since the forwarding occurs in the phone co. central office. An important element would be to move the machine around, both physically and electronically, so that there was a moving target...and, if you were willing to accept the phone costs, you could set up offshore. Comments? Any flaws in this? Regards, Dave

4 3

No Subject
by Anonymous User 17 Dec '03

17 Dec '03

Hopefully, this will better moderated than the last clipper event at MIT, where a single disruptive audience member wouldn't keep his !@#$ mouth shut, and augered an NSA technical presentation into a forum for him to preach his political gospel. COMMUNICATIONS FORUM GOVERNMENT WIRETAPPING, ENCRYPTION AND THE CLIPPER CHIP DEBATE Thursday, September 29, 1994 4PM MIT MEDIA LAB Bartos Theatre, E15-070, 20 Ames Street, Cambridge, MA 02139 Dorothy Denning, Dept. of Computer Science, Georgetown University Robert Holleyman, Business Software Alliance James Kallstrom, Special Operations Division, FBI Ronald Rivest, Dept. of Electrical Engineering and Computer Science, MIT Moderator: Stephen Kent, Chief Scientist for Security Technology, BBN The federal government says it is necessary to update America's wiretapping capabilities to keep up with technological advances -- and that not doing so could mean losing the battle against organized crime and terrorism. Last year the Clinton Administration proposed the "Clipper Chip," a data encryption plan which would put the "keys" for decoding phone, fax and computer communications in the hands of the government. The much-publicized plan has met with strong opposition from privacy groups, business executives and computer professionals, and has also been challenged on technical grounds. At the center of the debate is the question of how to balance national and personal security concerns, on the one hand, with the right to privacy and the need to maintain the international competitiveness of businesses that use encoded communications, on the other. Recently, government officials have expressed a willingness to compromise on some features of the Clipper Chip, but the debate continues over what kind of encryption system should be implemented and what role industry should play in the development and use of a new system. This forum brings together representatives of the FBI, the computer software industry, and academic computer scientists who will share their views and concerns about the Clipper Chip and alternative systems of data encryption.

2 1

Re: First Virtual
by peter honeyman 17 Dec '03

17 Dec '03

> Does anybody know anything about a new company named "First Virtual"? I > know they got NSB from BellCore and a couple of other researchers. nsb will be giving an invited talk at the winter '95 usenix conference in new orleans. Speaker: Nathanial Borenstein Affiliation: First Virtual Abstract: Traditional approaches to introducing commerce to the Internet focus on using the Internet to facilitate the sale of goods and services. However, these approaches require either encryption or a closed system in order to safeguard payment. By restricting our focus to information commerce -- transactions not involving physical goods or service -- we can radically simplify the underlying commerce model, with extremely important consequences for the usability and democracy of the Internet's payment infrastructure. http://www.citi.umich.edu/u/honey/usenix.html has general info on the winter '95 usenix conference. peter

1 0

re: SUFFERANCE remailers
by nobody＠cass156.ucsd.edu 17 Dec '03

17 Dec '03

Samuel Kaplin writes: >How about locating it in a recalcitrant country e.g. North Korea, Libya, >Iraq, Iran. During the Gulf war scuttlebutt has it that Iraq used encrypted >communications on the Internet to keep its C3 functions up. (Command, >Control, Communications) If they can't get at the remailer its pretty hard >to shut it down. Breakdown writes: >Hm, aren't European remailers something "like" Fortress remailers? The >State surely doesn't require consent for anon.penet.fi or such and no one >in the US(well I hope no one) knows the physical location of it... And >you can post just about anything through that one :).... Hmm. Unfortunately I think we're missing the point here. Perhaps a redefinition of SUFFERANCE REMAILERS... A SUFFERANCE REMAILER is remailer which exists only so long as *any* government, organization, person(s) does not decide (for whatever reasons) to shut it down, outlaw it, etc. Firstly, a remailer which is not directly vunerable to the U.S.'s "gun argument" may still be vunerable to any other country's gun argument; information is power, and no State may be trusted to act in our best interest insofar as information and communication are concerned. Secondly, sing the *placement* of a remailer in a recalcitrant country as the only means of defense against U.S. legislation will pretty much insure that the remailer's general location will, sooner or later, become a military target; whereas the remailer's location makes it *indirectly* vunerable to the U.S.'s "gun argument," the very fact that it is accessible by U.S. citizens makes it *directly* vunerable to the U.S. military machine. (Again, this is using on placement as a means of defense against any U.S. legislation.) And this brings up point C... It would not only be necessary to legislate against remailers, but would be necessary to legislate against *access* to remailers. This is what I imagine would happen. Lastly, Dave Merriman writes: [snip] >into a sealed room with umpteen bajillion other identical links [snip} Umpteen is spelled with an 'h.' ;) >> SUFFERANCE REMAILERS >> >> Definition of SUFFERANCE REMAILER: A remailer that exists only so >>long as the U.S. Feds get around to outlawing it.; a sitting duck >>remailer. ; a remailer whose physical location may easily be found.; >>a remailer whose operator is vulnerable to the State's gun argument.; >>currently, the only kind of remailer there is. >> >> Definition of FORTRESS REMAILER: A remailer whose physical location >>cannot be found. ; a remailer that does not require the consent of >>the State. ; a Freedom remailer. Feeling a little Detweiler today.... _/_/_/ _/_/_/ _/ _/ _/_/_/ _/ _/ I detest what you write, _/ _/ _/ _/ _/ _/ _/_/ _/ but I would give my life _/_/_/ _/ _/ _/ _/ _/_/_/ _/ _/ _/ to make it possible for _/ _/ _/ _/ _/ _/ _/_/_/_/ _/ you to continue to write. _/_/_/ _/_/_/ _/_/_/ _/_/_/ _/ _/ _/_/_/ --Voltaire _/ (in a letter to M. le Riche)

1 0

Viacrypt PGP for Windows
by Adam Shostack 17 Dec '03

17 Dec '03

I just got (snail) mail from Viacrypt announcing 2.7 for windows. $124.98, now shipping. Includes a "dll for certain Key mgmt functions" a windows shll, and 2.7 for Dos for crypto functions. This flyer also announces a mid-October ship date for 2.7 for the macintosh. Supports Apple events and Applescript. Contains online documentation, and will encrypt/decrypt and sign the contents of the clipboard. Same price. Viacrypt is 602 944 0773, or viacrypt(a)acm.org. Adam

1 0

No Subject
by dps＠kafka.atinc.com 17 Dec '03

17 Dec '03

A few months ago, Matthew Blaze posted a note to sci.crypt announcing a filesystem encryption system. Does anyone have a pointer to it. Thanks. -- Doug Shapter dps(a)kafka.atinc.com finger dps(a)kryten.atinc.com for PGP public key

1 0

Re: FORTRESS REMAILERS
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

To my mind, remailer vulnerability starts with the Net addresses used to send to them and send from them. It seems to me that a fortress remailer must have solve two problems: 1) Getting a message to the remailer without knowing the remailer's Net address. 2) Sending a message from the remailer without revealing a Net address. Problem 1 can be easily solved by having users send messages to various new groups the remailer scans. The messages would be encrypted with the remailer's public key. The remailer continuously scans for new messages encrypted with its public key. When it finds one, it decrypts it and processes it. Problem 2 it the tricky part. How can the remailer inject a message back into the public Net without revealing its Net-location? If the remailer could sovle this problem, then why couldn't everybody use the same solution, eliminating the need for remailers? The one possibility is that the solusion requires something that most average users can't do or can't acquire economically (i.e. most everybody can grow their own food, but why bother). I haven't come up with any really good ideas here. Here are a couple thoughts: a) Using various hacker tricks to forge "From:" e-mail addresses. b) Use short-lived addresses. Set the remailer up some how so it can frequently acquire new e-mail addresses. Each address would only be used to forward a limited number of messages, and then it would be abandoned. Jim_Miller(a)suite.com

1 0

Little Brother will watch you!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Of some interest to the list. Rishab ------------------- Electric Dreams Weekly column for The Asian Age by Rishab Aiyer Ghosh #30, 26/September/1994: Lamplighters in cyberspace After diving into cyberspace for a while, people are often relieved to temporarily return to brickspace - which is what I call the 'real world'. On the other hand, it would be nice if the knowbots and electronic agents that will one day cater to all your information needs could do the same for your lights and thermostat. Maybe they could learn your personal lighting preferences for different hours of the day, and adapt to your activities and moods. Technology is a decorated excuse for laziness. When you have the information superhighway at your doorstep, why not invite it inside? Let software reach beyond the World Wide Web into the World Wide Lamplighter, let programs change more than your accounts or your photographs, and you've opened up a whole new area of information technology - appliance control. Gadgets have been controlled by computers long before the infobahn was even dreamt of. Large, cumbersome gadgets that manufacture jet engines or process iron to steel. But your bedside lamp still waits for you to turn it off. Appliance control devices basically help you turn your bedside lamp off for you - they control the resistance in a light dimmer, or the current to a motor that opens a door, or the thermostat of an air conditioner. Appliance control devices are themselves controlled by software. The software could come from anywhere - even an electronic network. Cyberspace meets refrigerators. Appliance controllers could be attached to everything. One for each lamp, power point, door, window shade and chair leg. All the controllers will be networked, so that they can talk to each other, to the set-top box on an interactive TV or to a notebook computer at the other end of the world. To intelligent agents, the digital butlers trained to learn your preferences as you work in the realm of information, talking to an appliance controller would be as natural as searching for a book in an electronic library. Feedback sensors associated with appliances could inform the agents how you like your pizza, or when to darken the room as you fall asleep, reading. They would also switch things of as you leave the room, saving you the trouble as well as the pangs of guilt. Of course it would be like living not with Big Brother, but dozens of little Lilliputian ones, watching, listening and working for you. To realize this dream, in 1988, Apple Computer co-founder Mike Markkula started Echelon, a company to promote and manufacture networked appliance controllers. Echelon's controller, the Neuron chip, is a little device that talks to the universe through radio. Echelon hopes that its product will become the standard and start appearing just everywhere, but for the moment the major market is industrial. Manufacturers long used to computers controlling devices that build cars and trains are beginning to place appliance controllers within them. A Motorola study suggests that the average home in the year 2000 will have a little under 250 controller chips, but currently homes have only 50 or so, mainly in VCRs, microwave ovens and other hi-tech devices. So until twenty- first century consumers are ready for synchronized lights that turn on as you enter the room, and are willing to trust the complex software that will drive large controller networks, cyberspace pioneers will just have to dream on. Blurring the boundaries between cyberspace and brickspace, between information and reality, appliance control devices and networks can greatly increase the efficiency of living. They can save energy, improve security, and make you feel quite pampered in a comfortable home. Unless, that is, your sulking apartment refuses to let you in. Rishab Aiyer Ghosh is a freelance technology consultant and writer. You can reach him through voice mail (+91 11 3760335) or e-mail (rishab(a)dxm.ernet.in) --====(C) Copyright 1994 Rishab Aiyer Ghosh. All rights reserved====-- This article may be redistributed in electronic form only, provided that the article and this notice remain intact. This article may not under any circumstances be redistributed in any non-electronic form, or redistributed in any form for compensation of any kind, without prior written permission from Rishab Aiyer Ghosh (rishab(a)dxm.ernet.in) --==================================================================--

1 0

Re: SUFFERANCE remailers
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

At 8:11 PM 9/27/94, Gary Jeffers wrote: > Anybody got any idea at all how to build a Fortress remailer? As I see it, the main things one must defend a single machine acting as a remailer against are physical accesibility, denial of service and violation through monitoring mail flow. The physical accesibility problem is tricky, but obviously has been done for other physical items.. Stick it somewhere secret. Of course you can't know how secret it is until someone tries to find it. Wireless communication, as others pointed out, are pretty nessessary for this. The other two problems are software, and have been discussed quite a bit here. The answers above aren't bery compelling, and I don't see much way around this. Groups with large amounts resources are typically good at finding things when they put thier minds to it. The solution here, and I think this has been talked about here, too, is to create redundant destributed remailers. Issues here are trust, protocol and availability. Trust could be developed through the web of trust method, encouraged by existing remailers using this protocol, but the key issue is being able to trust a message going over potentially insecure remailer nodes can be considered valid if delivered. That way if Julf ends up being a under-deep-cover NSA agent and this hypothetical remailer-web is infested with bad-guys, there is still nothing they can do except render a message undeliverable. I'm trying to come up with something good here, but am still working on it. The vision I have for remailers in a perfect world is that everyone runs one and bounces around message 'packets' (small parts of the message (all signed and encrypted multiple times, of course) according to specific instructions. In a less than perfect world, a smaller network running this method could be created. This takes the form of the originator dumping the message into the stream, and forwards them off to some other sites. The message would be split into small packets which are encrypted multiple times to multiple different sites into the stream. This would probably have to be done by software, as it would be a complex task to manually split, encrypt etc. any but the smallest message. The software would need to be kept up to date about all potential public keys to encrypt to, and need to pick a set at random from this info. It would also insert routing intstructions as needed. The next site checks to see if it can decrypt the packet it recieves. If it can, it does so and sends it forwards it somewhere else, and repeat. If not, it just sends it onward. This continues for n layers of encryption for each packet, with the final message in the form of x packets encrypted only once ending up at the proper destination, which reassembles the message. All remailers reorder packets and insert noise as apporpriate. Obvious problems are bandwidth, time delay and having a site the message was signed to go down. The last issue can be taken care of by having group keys for this purpose, so that a given layer of encryption can be decrypted by any one of n sites with key m. This adds the problem of someone collecting all the keys and being able to crack the whole thing, but I think this is surmoutable. Band width and time delay stem from the same problem, and obviously this system would never work on the internet as it stands. If this web were, say, 300 sites worldwide, then they could work conjunction with the pre- existing remailers now available. Also, if the network grew to the point where it was impracticle to bounce at random, intermediate steps could be added, such as 'send me to austalia' or 'send me to mafiaNet', which would then cut down the number of bounces before a layer of decription was achived. As far as availability, well, it doesn't exist. Comments? Is this dumb? Did I just duplicate someone elses idea?

1 0

Re: TIS, SKE, & CyberCash Inc.
by Carl Ellison 17 Dec '03

17 Dec '03

>From: wfgodot(a)iquest.com (Michael Pierson) >Date: Tue, 27 Sep 1994 19:05:54 -0600 > (E) shall preserve the functional ability of the government > to interpret, in a timely manner, electronic information > that has been obtained pursuant to an electronic surveillance > permitted by law; This really bothers me. If the government today has a functional ability to interpret in a timely fashion information it has obtained, that is purely an accident (that the communicating parties chose not to encrypt) and the pure accident is likely to remain (because they will continue so to choose). However, the government has been trying to establish an enforceable right to succeed at gathering intelligence by surveillance and it has never been granted that right and should never be. Giving it a right to tap deals with gov't actions (permitting tapping). Giving it a right to understand what it taps deals with citizen actions (prohibiting encryption). Citizens have always had a right to try to keep a secret from the gov't and on this one point, we should not yield one micron. There should be *no* move at all toward establishing a right of the gov't to understand what it taps. Sorry -- I realize I'm preaching to the choir -- but this is *the key issue* to me and I wanted to push it. - Carl

1 0