December 2003 - cypherpunks-legacy

Re: Remailer ideas (Was: Re: Latency vs. Reordering)
by Jonathan Rochkind 17 Dec '03

17 Dec '03

> Yes, that could be done. Problem is that the NSA's remailer(s) would > immediately deliver messages to the destination. Get enough NSA > remailers, and the web wouldn't be trustable. Now, remailers in the > web can and should feel free to randomly forward mail to other > remailers, but it's the sender who should pick the minimum chain > length, and recursively encrypt their own envelopes. Very good point. Still, I wish there was a way for my local software to automatically make this chain based on some sort of knowledge of what remailers are currently up. Ideally, my local software could figure out all this info without manual intervention on my part; it would maintain it's own list of remailers, and keep track of when they go down. I'm not sure it's possible to set up a system like this, but it would be enormously helpful. One naive solution would be for remailers to have a "ping" function. I could send a remailer a "ping" message, and it would just bounce some acknowledgement back. More likely, my software could do this periodically, and keep track of which remailers are down, or non existent, and not use those. The problem here is that an eavesdropper could get knowledge of which remailers I am planning on using, which could help traffic analysis enormously. The "ping" function could support anon encryption block, so that I can ping a remailer through several other remailers anonymously. This is an improvement, but the traffic generated by lots of people periodically doing this is going to be enormous. As it is in any implementation of this sort. [If you wanted to, you could make the remailers "ping" now by yourslef, just have a message resent to yourself. But we can't all do this automatically often, simply because of the traffic it woudl generate. I think.] The next idea I had involves a usenet newsgroup. Bear in mind I don't really know how this sort of thing works, so tell me when I've said something nit-witted. Anyhow, there could be an alt.remailer.net newsgroup. All participating remailers would post an "i'm here" message on it periodically, say once every 24 hours. This message would include the remailers public key as well. My local software could scan this newsgroup. If a remailer hadn't posted a "i'm here" message in 30 hours or so, my local software wouldn't include it in any chains. If it's been several weeks, my local software will drop it from my database of remailer's altogether. If a "i'm here" from a previously unknown remailer is found, my software adds it to the database. Or, if I'm worried about abuse, I only add it to the database if it's public key is singed by someone I trust. Okay, now everyone try to rip this plan apart. :) I'm sure I haven't arrived at the idea solution, but there's got to be some way to create a remailer-net that will allow my local software to generate long remailer chains to remailers that are all still existent (now, if one of the remailers included in my 6 remailer chain goes down, it's a major pain to figure out which one it was, and why my mail never arrived there), all automatically. Until we can arrive at such a system, remailers are never going to be really useful to a large number of people; it's just too generate secure remaielr ^?chains that are trustable.

5 4

Ethics of Anonymous Remailers (Re: Needed for a computer ethics class)
by ghio＠kaiwan.com 17 Dec '03

17 Dec '03

> Date: Fri, 2 Sep 1994 11:09:40 -0600 > From: Patrick Juola <juola(a)suod.cs.colorado.edu> > To: cypherpunks(a)toad.com > Subject: Needed for a computer ethics class > > > Does anyone have a concise, citeable statement about why anonymous > remailers are a good thing? Some sort of position statment by > Julf would be ideal. Similarly, if anyone has something for the > *other* side of the coin, I'd love to see that. > > I'm in the process of writing a course on computer ethics for > the University of Colorado at Boulder and I think anonymous > remailers would be a good subject for an essay assignment, but > I need enough material (ideally, primary source material) to > lay the groundwork first. > > Patrick No, but it's something that I often get asked. I would be interested to hear examples of good things that people are using my anonymous remailer for.

1 0

L D Weller????
by Matt Hewn 17 Dec '03

17 Dec '03

>From alt.privacy: > From CompuServe's Libertarian Political Issues Forum > > Subject: #216752-Oceania? > From: Scott A. Kjar 70402,3124 > To: L D Weller 71011,1743 L D Weller sounds absurdly close to our net.loon... BTW, the article is on the apparent Oceania scam. -- Matt Hewn <matthewn(a)uiuc.edu> -- Information is not knowledge; knowledge is not wisdom; wisdom is not truth. Truth is absolute.

1 0

Re: Questions about Microsoft and Software Key Escrow
by Mike_Spreitzer.PARC＠xerox.com 17 Dec '03

17 Dec '03

I'm thinking here about software schemes; by "any public-key system" I mean any where the encryption is done by software.

1 0

Mother of All Clipper Systems?
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

The trends are ominous. Outside of this forum and my contacts and sources, I've also been corresponding today with Whit Diffie, Jim Bidzos, John Gilmore, and Eric Hughes. How fast could a system happen? Depends on the nature of the "emergency," how far along the code is (my guess: not in the next several months), and all sorts of legal issues. The upcoming conference, which I just excerpted, suggests that international key escrow is very far along. The National Health Care thing could mandate a national ID card (called something else, of course), and this could happen shortly after enabling legislation passes. Combined with growing waves of illegal immigrants.... Anyway, it may or may not all fit together. But if all does, we could be facing the "mother of all Clippers." (The clipper of all mothers?) Here's a well-written piece on national ID cards. I found it in the cpsr group (see, Jim, we *do* read other newsgroups). I've made a few notes and marks, especially in sections mentioning the uses and timing that could fit with a new crypto initiative, such as SKE. --Tim Newsgroups: comp.org.cpsr.talk From: emery(a)tc.fluke.COM (John Emery) Subject: Re: National ID and "slippery slope" Message-ID: <CtMA76.9Bq(a)tc.fluke.COM> Date: Wed, 27 Jul 1994 20:57:02 GMT ... >From the news reports I've seen lately, it does appear we are heading toward a national ID card for all citizens. For instance, PC WEEK had a front page article on May 9th, a couple months ago entitled, "Postal Service, IRS developing national identity cards; Clinton may give OK": "The Clinton administration is working on creating an identification card that every American will need to interact with any federal government agency. The card initiative came into the forefront at last month's CardTech/SecureTech Conference in Crystal City, Va..." "Sources close to the administration said President Clinton is also considering signing a pair of executive orders that would facilitate ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the connection of individuals' bank accounts and federal records to ^^^^^^^^^^^^^ a government identification card..." "At the conference, postal representative Chuck Chamberlain outlined how an individual's U.S. Card would be automatically connected with the Department of Health and Human Services, the U.S. Treasury, the IRS, the banking system, and a central database of digital signatures ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ for use in authenticating E-mail and other transactions." ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ (Tim: This would fit nicely with an SKE system, don't you think?) "While the U.S. Card is only a proposal, the Postal Service is prepared to put more than 100 million of the cards in citizens' pockets within months of administration approval, which could come at any time." ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ As long as one doesn't interact with the Postal Service (e.g. doesn't use mail), the IRS (doesn't earn taxable income), and doesn't have a bank account then it won't be a "must carry" card. However, this doesn't include very many people in America. Another source says "Digital Media reports that the Clinton administration is laying plans to create an encoded national identity card. Every citizen would be obliged to use the new "U.S. Card" in all dealings with any federal agency and in 'virtually every other legally binding electronic transaction made by U.S. citizens.'" "...To further increase electronic surveillance of citizens, Clinton has reportedly prepared two executive orders that would allow the IRS to monitor personal bank accounts and 'automatically collect taxes based on the results." ("Clinton readies national identity card," _Strategic Investment_, June 22, 1994, p. 2) The Seattle Times reported on July 13, 1994 that "The United States, in a response to its ability to control illegal immigration, may soon ask every American to carry a national identity card..." So the answer is yes, it is intended to be a national ID card. I find it hard to believe that every citizen will not have to carry one of these cards. For all practical purposes, given these proposals implemented, it would be quite inconvenient to leave home without it. This is something that we should all take seriously. -- John Emery emery(a)tc.fluke.COM -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Catch-22
by trollins＠debbie.telos.com 17 Dec '03

17 Dec '03

Well, Since E-mailing a few copys of my 3DEA-PGP.ZIP file and having said file posted on two FTP sites. "ftp.wimsey.bc.ca" and "ripem.msu.edu" It seems that the tax man sees $ in his eyes. I received a nice package with letter from... United States Department of State Bureau of Politico-Militart Affairs Office of Defence Trade Controls So, it came to their attention that I need to pony up $250 in order to "register" with said office. Problem is they want proof of my business in order to register. But, I don't have a business. What is it then. 1 - I have to register because I modify code and handed it out for free. 2 - I Don't have to register because I don't have a business. 3 - I have to register and form a business. Thanks, tom rollins <trollins(a)debbie.telos.com>

3 2

Signature Stripping a Bad Idea
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Reasons why attempts to automatically strip signatures a bad idea: * Breaks the assumpton that remailers are not reaching in and twiddling internals of a message. * Maybe a signature is _desired_ at some point. * Can lead to various problems, especially if implemented badly. We've had this debate before, and the consensus was that treating a remailed block as inviolate is a "win." Certainly anyone can announce this "feature" as a service, sort of a "Dummie's Remailer." Like censor services (that screen your mail), such things are easily imaginable, but should never become the norm, and should never be mandated. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: Catch-22
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>Since E-mailing a few copys of my 3DEA-PGP.ZIP file >and having said file posted on two FTP sites. >"ftp.wimsey.bc.ca" and "ripem.msu.edu" >It seems that the tax man sees $ in his eyes. >I received a nice package with letter from... > United States Department of State > Bureau of Politico-Militart Affairs > Office of Defence Trade Controls >So, it came to their attention that I need to pony up $250 >in order to "register" with said office. Problem is they >want proof of my business in order to register. But, I don't >have a business. What is it then. When bureacracies do silly things, the best recourse is to seek media attention.

1 0

L D WELLER
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, For what it's worth, CompuServe lists L D Weller (71011,1743) as being in American Fork, UT (between Salt Lake City and Provo). S a n d y

1 0

Re: Catch-22
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>You lucky guy. >I'd suggest talking with someone who _has_ had to report to one said >offices in the past and enlist their suggestions, perhaps Grady Ward. Thats what comes from putting your real address and name on stuff you give away.

1 0