December 2003 - cypherpunks-legacy

Feds & Ecash! Yikes!
by vvallopp＠eniac.seas.upenn.edu 17 Dec '03

17 Dec '03

Anyone have any enlightening info about this????? <forwards deleted> Path: netnews.upenn.edu!news.amherst.edu!news.mtholyoke.edu!world!mkj From: mkj(a)world.std.com Everybody knows that Al Gore is hot on this "National Information Infrastructure" thing. What many people may not fully appreciate -- or at least, what I'm just discovering myself -- is the sheer enormity of the disaster going on as we speak, under the banner of the "Information Infrastructure Task Force" (IITF). If you haven't already done so, I highly recommend an enlightening browse on the iitf.doc.gov site (ftp & gopher at standard ports, http at port 70). ^^^^^^^^^^^^ (NOTE: Individuals in fragile health should always consult a physician before exposing themselves to detailed information about their government's activities. Have you ever felt like an ant in the path of a steamroller? YOU WILL ...) Although I've barely scratched the surface, I've already run across a number of items which might be of interest to folks here. The DOE, for instance, reports that they are working on "Developing electronic cash systems that would maintain the privacy of individuals from merchants and banks, but would allow law enforcement to trace the flow of the electronic cash, given proper court orders." Other spectacularly dubious achievements include the report of the Privacy Working Group, which never once acknowledges any individual right to privacy, and in fact devotes most of their report to various ways to increase the "willingness" of the public to divulge personal data; and the draft report of the Intellectual Property Working Group, which with a straight face characterizes most current Internet activity as illegal, and then goes on to outlaw the rest of it, while blandly noting that the public will require "education" in these matters. Also, of course, there are any number of hints of NII projects involving various intelligence agencies. Enjoy. --- mkj ------------------------------+---------------------------------------------- Vinod Valloppillil | Even if you're one in a million, Telecom/MIS/Strategic MGMT | there's still a thousand more of you Engineering/Wharton | in China..... vvallopp(a)eniac.seas.upenn.edu | ------------------------------+---------------------------------------------- "It is often easier for our children to obtain a gun than it is to find a good school." -- Joycelyn Elders "Maybe that's because guns are sold at a profit, while schools are provided by the government." -- David Boaz

1 0

Cpunk list check
by merriman＠metronet.com 17 Dec '03

17 Dec '03

Haven't heard anything out of the list for a while, so just sending this out to see if the list is still up. Sorry. Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

H.E.A.T. BEAT
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H.E.A.T. seeking C'punks, "Code Name: Assassin" In this episode, we see the return of H.E.A.T. archnememis, Neil Strake. (For those who haven't seen Acapulco H.E.A.T., Strake is played by James Healing who does an extremely bad imitation of bad (French?) actor, Louis Jordan.) Anyway, forget the plot, it is even more Byzantine and illogical than usual. Suffice it to say that Strake shoots Mike--on Mike's birthday--in an attempts to kill him. Mike is in a coma through most of the show. The special cartridge has "Happy Birthday" written on it; the bullet is inscribed, "Mike." (Wow, talk about a bullet having your name on it.) This episode was unique in the number of flashbacks and fantasies it offers: (1) Mike goes into cardiac arrest on the operating table. Instead of having the currently popular NDE (near death experience; dark tunnel, white light, life review, etc.), Mike has a fantasy dream of fighting in a boxing match. (He gets knocked out.) (2) When the Team fingers Strake, Ashley has a flashback to the previous Strake episode, thus practicing the parsimony of recycling. (3) Later at Mike's bedside, Ashley has another flashback about the two of them. She then sweet talks him in his coma and tells him not to die. (4) After Ashley talks to him, Mike has another fantasy dream boxing match in which he KOs his opponent. (5) Finally, Strake goes to a disco for no apparent reason. There he first dances with a beautiful quadroon. He drops her for an Anglo-looking woman. During his dance with the Anglo, he fantasized that she is Ashley (he has an obsession with Ashley). The dance is meant to be erotic, but it's just silly, even when they virtually fornicate on the dance floor. Here are the crypto/techno elements: (1) The cartridge is a ".223 nitro express," which is made by only one man, a guy named Sabross. (2) Krissie uses the H.E.A.T. computers headquarters to "patch" into the surveillance camera system of the prison in which Strake is supposedly incarcerated. This takes her all of 10 seconds. (3) The person in prison is not Strake, but an imposter whose appearance has been altered by plastic surgery to look, sound and act just like Strake. (4) Strake plants a radio controlled bomb at Mike's "funeral" (don't ask), which the Team discovers in a sweep of the chapel. There were several good lines in this episode. In a face-to-face encounter between Ashley and Strake, he says something about how he sees the world and Ashley says, "Don't they call that schizophrenia?" To which he replies, "Only the people who get paid to put a name on it, then get paid even more to cure it. While Strake is putting his bomb together he opines, "I love the smell of C4 in the morning." During the funeral, Strake pulls out the radio detonator and says, "One flick of my finger and you're all taco meat." (Don't laugh, have you ever eaten a taco in Mexico?) There were tons of bikinis in the beech scenes (strangely, there were only beautiful women on the beach). The disco people looked hot, and there was no Fabio! Tune in next week--same H.E.A.T. channel, same H.E.A.T. time--for the further adventures of Acapulco H.E.A.T. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Nom de guerre public key
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm new at both remailing and PGP, but having read the Cyphernomicon (OK, skimmed it) and various other FAQs, I haven't seen this issue addressed: I've created a pseudonym and a PGP key pair for that pseudonym. Now, how do I secure signatures for my public key, given the fact that (a) to sign it, you should be sure that it really belongs to me, and (b) I have no intention of revealing who "me" actually is? You can't call me on the phone, or meet me face to face, or do any of those other standard practices for confirming the key before signing it. But I sure don't want to use an unsigned, untrusted public key, since I want to make and keep a reputation and I can't risk someone spoofing my public key. ======================================================================= Crim Tideson Privacy is its own justification. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ My public key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCPAy51e6kAAAEEAMLIkYRAJqKnrQL7Xxmu7hNycUU06YZuR2i3WVxN9Jc6vnoF i7gT6/u7zVI4gmZCTA6mF6SYEFeOiENHaz0wyBNe+8AOIgdaezUsPODMh7UC64k0 YVQTNOiPN9jQAnyCGjPrplSliWT4gHGC796whwJ8CFkwPdpQf6vOblMnt4MdABEB AAG0DENyaW0gVGlkZXNvbg== =pwyo - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLo3MxqvOblMnt4MdAQH0jwQAvzbd7b7KpcKdaeGzWUx8aav4WxWJWD9W qwYaVF/WNFFg89+m0K8TztTEcc9QVz3wYvKz1ojOx7IOJl10ZUBXbXrChaDYhbKJ YTU3QeOHN7o8VdzJ3o7z6lK9QqLZhhzQd4VgF9VxR++8LcBVS8AYaVWsfGLv7L2q W+4h4FIR0GE= =Vu2X -----END PGP SIGNATURE-----

6 9

Nom de guerre public key
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm new at both remailing and PGP, but having read the Cyphernomicon (OK, skimmed it) and various other FAQs, I haven't seen this issue addressed: I've created a pseudonym and a PGP key pair for that pseudonym. Now, how do I secure signatures for my public key, given the fact that (a) to sign it, you should be sure that it really belongs to me, and (b) I have no intention of revealing who "me" actually is? You can't call me on the phone, or meet me face to face, or do any of those other standard practices for confirming the key before signing it. But I sure don't want to use an unsigned, untrusted public key, since I want to make and keep a reputation and I can't risk someone spoofing my public key. ======================================================================= Crim Tideson Privacy is its own justification. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ My public key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCPAy51e6kAAAEEAMLIkYRAJqKnrQL7Xxmu7hNycUU06YZuR2i3WVxN9Jc6vnoF i7gT6/u7zVI4gmZCTA6mF6SYEFeOiENHaz0wyBNe+8AOIgdaezUsPODMh7UC64k0 YVQTNOiPN9jQAnyCGjPrplSliWT4gHGC796whwJ8CFkwPdpQf6vOblMnt4MdABEB AAG0DENyaW0gVGlkZXNvbg== =pwyo - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLo3MxqvOblMnt4MdAQH0jwQAvzbd7b7KpcKdaeGzWUx8aav4WxWJWD9W qwYaVF/WNFFg89+m0K8TztTEcc9QVz3wYvKz1ojOx7IOJl10ZUBXbXrChaDYhbKJ YTU3QeOHN7o8VdzJ3o7z6lK9QqLZhhzQd4VgF9VxR++8LcBVS8AYaVWsfGLv7L2q W+4h4FIR0GE= =Vu2X -----END PGP SIGNATURE-----

1 0

Cyphernomicon
by Black Unicorn 17 Dec '03

17 Dec '03

Could someone give me a current pointer to the Cyphernomicon? -uni- (Dark) -- 073BB885A786F666 nemo repente fuit turpissimus - potestas scientiae in usu est 6E6D4506F6EDBC17 quaere verum ad infinitum, loquitur sub rosa - wichtig!

2 1

archives
by iqg1550＠acf4.NYU.EDU 17 Dec '03

17 Dec '03

could someone please tell me where the CP list is archived -- if, in fact, it is -- as well as the dates covered by any such archive thank you very much ira

4 4

list test
by Gary Jeffers 17 Dec '03

17 Dec '03

testing to see if list ok.

1 0

Re: Technical Remailer Analysis.
by bogus＠no.return.address 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Louis Cypher Hal Writes: >Good point. There is a related attack which Chaum pointed out in his >1981 CACM paper: the attacker intercepts and keeps a copy of an incoming >message, then later re-sends it. This one will go to the same place and >by repeating this multiple times we can figure out where the original >message went. This raises a fundamental problem with current remailers. It is clear that next generation remailers will have to encrypt all messages sent between them, on top of any nested encryption of the message done by the originator. Timothy C. May Writes: >157.3. Some possible fixes: > > 157.3.1. remailers can recognize duplicates and agree not to >remail them, or to remail them off in different directions (adding their own >hop-wrappers) > > 157.3.2. digital postage helps a bit, as the attacker at >least has to spend money > > 157.3.3. (If the inner layers of a message each have some >digital money, or a "one-use" coupon, then an attacker who copies and resends >the whole message is effectively double-spending and this should be detected. >Most simply, the "use once" coupon will only allow one passage through the >remailer.) If the remailers also batched messages to a given destination, or padded outgoing messages before encrypting them, they would be far less susceptible to this kind of attack. Re-encrypting the message with padding (to some standard size) would prevent attackers from recognizing their own messages in a flood attack, except by noting destination (which could be a giveaway). Batching would do the same, but would also hide the number of messages trashed or locally delivered. Neither of these does much against the concerted "spam attack". I think in the end, remailers will need to run something like encrypted links, sending a constant volume of data between them, which would be random garbage when not a real message. This leaves open the denial of service attack of sending more data per hour then the link supports, therefore causing long queues at the remailers. Sigh, I really need to get down to a library and dig up the Chaum articles I hate to always reinvent the wheel. While waiting for good digital postage, a substitute could be used. If one added a "Msg-ID:" header similar to the Ghio remailer's "Cutmarks", which contained a large random number, this number could be stored at the remailer, and messages with the same ID simply send to /dev/null. This would be simple to do with remailer chaining scripts like "premail". Hal writes: >If I follow this, the attack is something like, every time Alice sends >a message Bob receives one. Observing this happening over a period of >time we conclude they are communicating. Could this be defeated by >sending dummy messages so that Alice sends exactly 10 messages every day? >Then the fact that Bob receives messages on some day can't very well >be associated with Alice. Since I assumed that a typical user sends one message per day, Alice may draw attention to herself through this mechanism. 10 messages is not enough, it would leave some correlation. Alice needs to send at least one message per tick (e.g. 48 in my example), in which case she shown 100% correlation with all recipients always. There is no way to know that she is sending to Bob, but I suspect she will be on a short list at the FBI unless everyone else is doing the same (which violates my assumptions). If everyone sent a message every tick, traffic analysis would be impossible. Matthew J Ghio writes: >This attack can be defeated if both Alice and Bob are running remailers. >Then their correspondence is hidden in the 100 messages a day of >remailer traffic. An observer can not tell wether the messages were for >Alice or Bob, or if they were for the remailer (assuming latency was >used) or if they were bit bucket messages. Alice could even forward her >personal messages to a bitbucket (after saving a copy for herself) to >further increase security. This is why everyone should be running a >remailer if they are concerned about their privacy. I do not think that the "everyone is a remailer" idea works. At the assumed one message per day, and an average message chain of 5 remailers, then only 5% of users can maintain remailers with a real traffic flow of 100 messages per day. Other than that, this idea is functionally similar to Hal's. Sending messages on to bit buckets is a nice idea. Assuming cutmarks, or standard message sizes, and reordering are used, this is indistinguishable from a remailer which just delivers the local mail, and also sends out periodic junk messages to various bit buckets. As I mentioned in my original message, this should be done anyway to ensure complete mixing of all messages within the web during any given tick. -Louis Cypher -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLo557qyHUAO76TvRAQFSJwQAmenSoAZAkOtGww9F/giy80AmJJk30I6D y5Fp0d8fgNy3MiCnG6onlvvJdBShgonvsbKRF0r94cYtYgtnczK/rqmhIDyc/UB2 a0V55YRdb84YwGpGPmrFepH8yXdueEgQvUq5Fs1FV9jNtSAK9kK2G1+QmSVdq/Uy pkRIf8iPbJA= =xZdv -----END PGP SIGNATURE-----

1 0

The benefits of commercialness
by sameer 17 Dec '03

17 Dec '03

As you can see, the remailer running with a profit motive (or at least a not-go-deeply-into-debt motive) is the most reliable. Last ping: Sun 2 Oct 94 17:00:01 PDT remailer email address history latency uptime ----------------------------------------------------------------------- c2 remail(a)c2.org **+-******** 13:29 99.99% wien remailer(a)ds1.wu-wien.ac.at ****#+**--#* 21:01 99.99% chaos remailer(a)chaos.bsu.edu ***####**+## 2:54 99.99% leri remail(a)leri.edu ****#**#**** 6:45 99.99% portal hfinney(a)shell.portal.com **##*#+***#* 3:59 99.99% ideath remailer(a)ideath.goldenbear.com +*****-*+- * 1:53:42 99.99% =), -- sameer Voice: 510-841-2014 Network Administrator Pager: 510-321-1014 Community ConneXion: The NEXUS-Berkeley Dialin: 510-549-1383 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0