December 2003 - cypherpunks-legacy

RE: Remailers
by Philippe Nave 17 Dec '03

17 Dec '03

> > Philippe Nave writes: > > > I think the single most important thing we could do for remailer operators > > would be to figure out how to make the remailers *truly* *anonymous*. That > > is, we need a net.hack of some sort that allows remailers to send their > > messages in a way that leaves no trace whatsoever of the original poster > > *and* leaves no trace of the remailer itself. > > Er, if we knew how to do that, we wouldn't need remailers. :) > Touche! This is, of course, correct. In an ideal scenario, everyone would be able to personally establish anonymity for their own communications and the concept of 'anonymous remailers' would be moot. In the meantime, I suggest that it would be worth quite a bit of effort on the part of a few wizards to get a 'truly' anonymous remailer up and running for the benefit of the masses. I keep seeing messages to the effect of 'sorry, you can't get there from here', but that just tells me that the problem is non-trivial. [Note that I'm not pooh-poohing the considered opinions of people who know quite a bit more about email and the Net than myself; I simply remain stubbornly optimistic about the capabilities of a large group of skilled Internauts.] Also, don't misconstrue my ravings to be an indictment of remailers as they exist today - I see that many valuable lessons are being learned about interoperability, reliability, and real-world exposure to problem situations. Even our beloved LD has helped in that regard, bless his pointed head, by showing us what a single deranged loon can do to a network of remailers. I simply maintain that now is a good time to reopen the study of 'true' anonymity so that further remailer developments are added to a strong foundation. ObEcash: Peons like me who are not capable of the bizarre hacks required for 'true' anonymity would most likely embrace ecash payment systems for remailing service with enthusiasm. Having demonstrated my ignorance of low-level email transport techniques, I now retire to the shadows again........ :) Philippe

1 0

Re: DES Vulnerable, Why?
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

[Tim said, roughly, that public actions to replace DES have not revealed anything about what the NSA & Co. know about DES's weaknesses.] Which I guess is part of what I was driving at. The other part of what I was driving at: DES is becoming crackable by pure brute force. Doesn't 3-DES solve that problem for a few orders of magnatude? If 3-DES is so simple a variation on DES, then what is wrong with DES that 3-DES doesn't solve? (Yes, it is slower in SW than IDEA--I am talking security for the moment.) -kb, the Kent who is leery of the new-fangled when the old seems so easy to fix -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 39:30 hours of TV viewing so far in 1994!

1 0

(fwd) Re: BATF raid in North Carolina
by Jim choate 17 Dec '03

17 Dec '03

Newsgroups: rec.models.rockets Path: bga.com!news.sprintlink.net!uunet!psinntp!psinntp!news From: ralphpepper(a)lesueloc.com Subject: Re: BATF raid in North Carolina Content-Type: TEXT/PLAIN; charset=US-ASCII Message-ID: <1994Jul27.031907.6182(a)nntpxfer.psi.com> Sender: news(a)nntpxfer.psi.com Organization: Performance Systems Int'l X-Newsreader: NEWTNews & Chameleon -- TCP/IP for MS Windows from NetManage References: <J+7xDKE.countdownhob(a)delphi.com> Mime-Version: 1.0 Date: Wed, 27 Jul 1994 05:49:26 GMT Lines: 61 Re: > Rebecca Rohan <rrohan(a)eskimo.com> writes: > > >Yo, those of you in rec.models.rockets who are whining about the > >crosspost --- you are one action/adventure movie away from the same > >treatment or worse. > > Rebecca, > > I, for one, appreciate the information you're providing. Too many average > citizens have no idea what's going on with federal agencies. Unconstitutional > power grabs are getting bigger and more frequent all the time. If it isn't > stopped soon, we will be stopped dead in our > tracks as a free nation. > > COUNTDOWN HOBBIES > 3 P.T. Barnum Square > Bethel, CT 06801-1838 > 203-790-9010 > Kevin Nolan > NAR 16148; TRA 0943 > CTRA/NARCONN > I currently don't have any HPR motors, reloads or any such thing. I left them behind when I moved to Georgia (not knowing the legal climate down here). So I feel (relatively) safe putting forth my two cents worth as to what I would do. First, I would be rigidly legal in every respect. In fact, after hearing about them worrying about casing residue I would make sure I didn't even have so much as a spent D12-0 casing. Anything I needed would be bought enroute to any launch meet, or at the meet itself. Second, I would endeavor to be as 'safe' and 'peaceful' as possible. There would be no 'terminator 2' talk out of me. Third, if I did get attacked, everything would be 'yessir' and 'nossir'. Then, I would quietly go down to the federal courthouse and file a RICO Act lawsuit. RICO Act stands for Racketeer Influenced and Corrupt Organizations Act. This is what is commonly referred to as being charged with 'racketeering'. RICO allows individuals (as well as governments) to file against persons or organizations that commit three major offenses against one person or a major offense against three or more persons. One unique feature that makes it exceedingly lucrative for lawyers to take on contingency is that the awarded amount is TRIPLE the sum of all court costs, out-of-pocket costs, compensatory, and punitive damages. Certain agencies may be immune but not all of them. Also, you could argue that immunity only applies to their lawfully empowered duties and when they exceed that authority, that they are acting outside of government protection and become private citizens commiting acts against other private citizens. There was a church in California in 1979 that began moving to do something like that against the state Attorney General (Dukemajian at the time). The state was trying to take over all of that church's operations (under a law protecting charitable trusts - like United Way) Ex-Parte on the claim from six ex-members that money was being absconded with. California tried to impose their own people into that church's ruling hierarchy & even declared in open court that all churches in California thereafter belonged to the state. The threatened suit plus the outrageously gross misapplication of the law spooked the California legislature into repealing that law completely over the violent protestations of Attorney General Dukemajian. I believe there was a book about this called "Against the Gates of Hell" or something by somebody named Rader.

1 0

Re: (fwd) Possible compromise of anon.penet.fi
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> From: barnett(a)convex.com (Paul Barnett) > Newsgroups: alt.privacy .... > Someone has been collecting email addresses, apparently from postings > to Usenet, and forging them to anonymous postings through > anon.penet.fi to alt.test. ...... > My condolences to those people that have been caught in this net. > This is one of the most despicable forms of net.terrorism that I have > encountered. It's an interesting weakness, and at least as serious as the naXXXXX / anXXXXX problem that reveals your identity if you send email to another anonym. The one anonym I've used on anon.penet.fi is already known to at least one other person (to whom I'd sent mail about the fact that they'd included their .signature in an anonymous article :-) I disagree with the "despicable" opinion, though it's certainly a serious problem and it would certainly have been nicer if the cracker had done only a limited number as a demonstration (maybe this counts; I don't know.) BUt if our tools have technical weaknesses, it's *much* nicer to find out from a non-police-agency cracker than to learn about it when they start knocking on your door. It sounds like there's a need to separate the email and news-posting parts of the anon.penet.fi software, or go to stronger anon-reply methods like the one on the newer cypherpunks remailers. Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

2 1

IMPORTANT: FTP DIRECTORY MOVE
by sysadm＠netcom.com 17 Dec '03

17 Dec '03

Over the next four weeks, NETCOM will be re-organizing our anonymous ftp directory structure. In order to cut down on the number of directory entries in pub directory, we will be using a new naming scheme based on the first two letters of your ftp directory name. Thus, in the past, if your ftp directory was named: /ftp/pub/netcom it will be changed to: /ftp/pub/ne/netcom Existing symbolic links will also be moved. If you have a symlink: NETCOM -> netcom in the directory /ftp/pub, it will be changed to: NETCOM -> ../ne/netcom in the directory /ftp/pub/NE. The only directories that will exist in the toplevel pub directory are the directory entries for the two-letter combinations, which will be created as needed. All new ftp directories will also be created according to the new naming scheme. We realize that it will take some time for our customers to prepare for this transition. The actual directories will be moved over between 12:30 and 4:30AM PST Thursday morning. Symbolic links will be made from existing directories (and existing symlinks) to point to the new directory entries, so it should initially be transparent to most customers. You will then be able to start advertising the new directory name, although the old one will still work. These symbolic links will then be removed on December 26th. Any scripts, publications, HTTP references, and so on will need to be modified to point to the new directory location. If you have any questions or comments, please contact sysadm(a)netcom.com. We hope to make this switchover as smooth as possible for everyone! Bruce ___________________________________________________________________________ Systems Analyst / Systems Administration sysadm(a)netcom.com Systems Support Staff NETCOM On-line Communication Services

1 0

Hows THIS For Some Human Interest!
by anonymous-remailer＠xs4all.nl 17 Dec '03

17 Dec '03

Its funny, but this girl I'm seeing will be getting some Internet training in the near future for the gov't job she holds. And in the course of talking about that this evening with her, I briefly chatted with her about cryptography privacy and PGP. But when we talked abit more on this subject, she revealed something I found to be pretty interesting. It turns out that her old man was an MI6 operative during WWII. That certainly caused me to raise my eyebrows a bit. He evidently was one of MI6's operatives in Iraq and did some pretty lethal shit. Apparently he was involved in some economic warfare (whatever the hell that means) aginast Axis interests in the area.She told me he still clams up REAL good about his wartime experiences and it takes quite abit of coaxing to get anything out of him. It sounds like his security clearance was pretty reasonable.....likely in the secret/top secret category. As somebody whose closest contact with an operative of an intelligence service has been the cover of a Len Deighton novel, I found this awful intriguing. MI6, from what I understand is one of the oldest and longest running agencies around. I think they started up (offically) in 1910, although Whitehall likely had some spooks earlier than that, given Britain's colonial exposure. And indeed, MI6 is one of the best. Maybe even THE best? Still, you can be damn sure I'm going to remain friends with this lady for some time. What her father has to tell is probably pretty enlightening, to say the least.

1 0

(Fwd) Re: NSA seems to be lobbying against bank use of triple-DES
by John Young 17 Dec '03

17 Dec '03

Forwarding Cyberia-L mail by: dcain(a)pioneer.uspto.gov (David Cain) on Wed, 23 Nov 7:8 AM ------------------- John Thomas writes: > It's clear that NSA is opposed to triple-DES because it cannot break it. > I'm not supprised the banks are going ahead even if triple-DES cannot be > exported; it will be trivial to develop the hardware overseas, since all > the algorithms are public. Although NSA will neither confirm nor deny <grin> one of the fundamental principles of cryptography is that any encryption system which cannot be broken is also inefficient - like the one-time-pad. NSA may be concerned with allocation of CRAY resources, but I doubt they are concerned about the viability of breaking triple-DES. One of the most important concepts of cryptography is that false security is worse than poor security, for if you are aware of a system's vulnerability, you can guard the weak points. NSA's point that layering encryptions not only doesn't strengthen the security, but may create patterning that is more susceptible to differential analysis than a single DES pass, is an important one. More is frequently less in crypto. Now, I have no more insight into NSA motivations than the next shmoe, but the objections they raise are legitimate from a security standpoint. As for independent creation in Europe, there is a component to "real" hardware DES which is classified. dc Primary Examiner USPTO Cryptography David Cain * Speaking for no one * Escape to find the shining light dcain(a)uspto.gov * Borne within evolving sight dcain(a)osf1.gmu.edu *

2 1

Re: Remailer FAQ?
by dmandl＠bear.com 17 Dec '03

17 Dec '03

Tim's cypherpunks FAQ ("The Cyphernomicon") covers remailers pretty thoroughly. As for actual code, there's code for several different types of remailers at ftp(a)csua.berkeley.edu. The code for Raph Levien's "premail" is also available at that site. --Dave. > Anyone know of a Frequently Asked Questions on remailers? Where is it available? > Thanks, > -R > > --------------------------------------------------------------------------------- > Reuben Halper I'm not growing up, I'm just burnin' out." > Montclair High - Green Day - > Montclair, NJ > E-mail: fhalper(a)pilot.njin.net PGP 2.6ui Public Key > available upon request > ---------------------------------------------------------------------------------

1 0

(Fwd) news spoke
by John Young 17 Dec '03

17 Dec '03

Forwarding Design-L mail by: <carr0023(a)GOLD.TC.UMN.EDU> () on Nov 23 ------------------- This message revealed itself yesterday on my shell account. This could be some arbitrary law going down in the present, even worse than the McCarthy era witchunt. So much silence, even for academic concerns, and system administrators decide whom to prosecute for relevance. _________________________________________________________________ ___________ UNIX(r) System V Release 4.0 (gold.tc.umn.edu) This system is for the use of authorized account holders only. Individuals using this computer system without authority, or in excess of their authority, are subject to having all of their activities on this system monitored and recorded by system personnel. In the course of monitoring individuals improperly using this system, or in the course of routine system maintenance, the activities of authorized account holders may also be monitored. Anyone using this system expressly consents to such monitoring and is advised that if such monitoring reveals possible evidence of criminal activity, system personnel may provide the evidence gathered to law enforcement officials.

2 1

Re: REMAILER PROPOSAL
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Lance Cottrell wrote: ... The "Electronic Mail Forwarders Guild" is ... capable of error. You assume that [the Issuer] would appear to be untrustworthy.... If a TLA wished to infiltrate us, the traitor would seem very trustworthy, gung ho, and paranoid. Life has risks; the trick is to minimize them. Yes, the Issuer could be a weak link. This only means that the Guild has to be careful whom it chooses, which security protocols it mandates and what oversight it exercises. I have suggested that the job of Issuer could be rotated. This would help. Another step that might be taken is to separate the job of Issuer from that of Database Manager. In other words, the Issuer would take in payment and provide a list of valid Spoon-Es to the DB Manager, who in turn would cancel the Spoon-Es as they were used. Under the threat posited by Lance, such a step would make it necessary for the Issuer, the DB Manager and the first remailer to collude for their to be a problem. If your paranoia can swallow that much collusion, than the job of Issuer could be further Balkanized into three or more jobs. Beyond these solutions, Lance has proposed a couple of other ways to reduce the risk he has identified. All in all, I think my crude-but-effective suggestion is still the best proposal extant for a pay-to-play remailer system. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0