December 2003 - cypherpunks-legacy

H.E.A.T. SEEKING
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Bummer! WWOR, here in the New York area, pulled a fast one on me. They rescheduled Acapulco H.E.A.T. from 18:00 to 15:00 without so much as a "by-your-leave." But as Mr. May will tell you, I'm one of the list's perennial optimist. There are no problems, only opportunities. If you saw the show in question, my loss may be your gain. That's right, I asking you to post a "guest review" of this week's episode of Acapulco H.E.A.T. to the list. If we're lucky, we may end up with "dueling reviews." What was the bikini count? How many gun battles? What was blown up? How many computer/privacy/crypto plot devices were used? And most importantly, Fabio or no Fabio?; that is the question. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Stealth remailers
by Matthew Ghio 17 Dec '03

17 Dec '03

Hal <hfinney(a)shell.portal.com> wrote: > Some time back I proposed a variation of this idea: "second tier" > remailers, which always forward their outgoing messages through > one or more "first tier" remailers, which work like the current ones > and take the political heat as a result. Second tier remailers would > be very safe to run and it would be rare that a sysop or supervisor > would get a complaint about the remailer's activity. ftp cs.cmu.edu cd /afs/andrew.cmu.edu/usr12/mg5n/public/remailer get ghio.cp-remailer.tar.gz gunzip & untar Change the following line in the readheaders.c, in the block_addr function: if (match==1) address[0]=0; to if (match!=1) address[0]=0; Your blocked.addresses file is now a pass-addresses file. Put the email addresses of other remailers in the file. You now have a stealth remailer. Now, EVERYONE should go do this RIGHT NOW! No more excuses for not running remailers... :)

1 0

Re: H.E.A.T. SEEKING
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > SANDY SANDFORT > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . > >C'punks, > >Bummer! WWOR, here in the New York area, pulled a fast one on >me. They rescheduled Acapulco H.E.A.T. from 18:00 to 15:00 >without so much as a "by-your-leave." > >But as Mr. May will tell you, I'm one of the list's perennial >optimist. There are no problems, only opportunities. If you saw >the show in question, my loss may be your gain. That's right, I >asking you to post a "guest review" of this week's episode of >Acapulco H.E.A.T. to the list. If we're lucky, we may end up >with "dueling reviews." > Wheeeeeep! Wheeeeeeeep! HEAT ALERT! HEAT ALERT! Wheeeeeep! Wheeeeeeeep! :-) Happily, the local affiliate has left it at it's "regular" time (midnight!), so I'll be glad to help fill in the slack. I'll send the stuff to you, if you like/don't mind, so you can merge it with any others (or edit to taste :-). Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

Data Havens
by dfloyd＠runner.utsa.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I know this may be getting off track on this list, but it may be worthwhile. I was exploring the concept of a "data haven" which, to my knowledge, a place whose location is unknown to its users, but via anonymous remailers, files can be stored and retrived from it. I am going to look into writing a script or program that will allow people to store items using a passphrase or their PGP key, and retrive and delete the files on demand. Here are my problems though: 1: I am clueless about Perl, and not that great with C. 2: One must have to "hide" behind a VERY TRUSTABLE remailer, one that does not go down all the time, and one that accepts PGP encoded mail. 3: Would hiding behind one remailer or two be secure enough? There is a problem, unlike simple remailer chaining that people need to be able to E-mail the script. 4: A need for verifing that the mail got to the DH successfully since data errors do occur, and sometimes networks truncate mail packets. (Compuserve is notorius about this, so is Fidonet). 5: A way of making verifing that the user is who (s)he claims to be. (PGP, IDEA, or a passphrase) 6: Multiple security levels, so files cannot be retrived even if one's PGP key is compromised (user settable) 7: How will files be stored? Will folders and directories actually be made, or will they be all stored in one place with wierd names (to prevent name collisions) and one file be the index? Will there be user names or UID's? 8: There will need to be a way to tell if the DH is up or not. 9: How will PGP keys be stored and indexed? One would not want their files mailed in the clear. (How would I mail files if the user cannot use PGP? have a user settable password, and use crypt?) 10: How would people be able to trust a DH? Data Havens, by definition must be _very_ reliable, yet in a secure location to prevent unauthorized access of the files. What bothers me is DH's starting up and either croaking unexpectably or being places for Bad Guys (TM) to be able to snarf unsuspecting people's files. Perhaps a reputation based system? 11: How would a DH turn away files because the disk is full? 12: Would integrating DigiDollars with a DH be a good idea? (For secure storage of your files, we charge $1 DD per month per meg, and .01 DD per transaction.) What would the DH do with the files if they are not paid, or double-spending occurs? I will be working on a command set that one can use for sending and retriving files to and from the DH, as well as an authication system that can support PGP, DES (SunOS style), or crypt (yes, laughable security, but some people cannot use PGP at work). I think I will use perl for eventually writing this, but I know nothing about perl, so will have to print out a manual or two and do some work on my linux box... As per my previous posts, I am very clueless, but If I can get a decent data haven script working, it will be worth all the flames :-). Once the script is written, all one has to do is install the script, and ping a Penet type remailer, then post the anon remailer address, and Voila' a DH now exists. I apologize for the length of this post, but there are a lot of questions and problems in making a stable, usable data haven. - --- Finger dfloyd(a)lonestar.utsa.edu for PGP key, and please use it when mailing me. -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLntxFXDkimqwdwa5AQEE0gP+P+8sjma3rDkrxhZOBRam7/0v6lsUG0e9 fvtUsLHKAYaB8f6cCUUxwtpwhrI/9TPeh7QoQnEcHlhDO1kV46X9kA1n04hhJpXb Rx+BWSNaLHB3tynaXkN0lTIR/r6CGs+zKvc8BOJpLHSL7ajowmXs1C9Z8Lf4IW+G 8IwG9TR/iec= =9Vg8 -----END PGP SIGNATURE-----

2 2

On the crime bill and remailers
by hughes＠ah.com 17 Dec '03

17 Dec '03

Even the crime bill doesn't apply _ex post facto_, meaning anything newly illegal under the crime bill wasn't illegal before it. In particular, any discussion about remailers, discussion which has already happened and which might be construed as conspiracy for a newly illegal action, cannot now be subject to the terms of a new bill. Even more in particular, any discussion of remailers that has already happened is perfectly safe. And as for me, I don't plan on shutting up now. Eric

1 0

terrorist FORTRESS SLEUTH remailers & FORTRESS lists
by Gary Jeffers 17 Dec '03

17 Dec '03

THE FOLLOWING TEXT IS FOR INFORMATION ONLY & DOES NOT ADVOCATE BREAKING ANY LAWS. TERRORIST FORTRESS SLEUTH REMAILERS & FORTRESS LISTS Todd Masco makes a good point about sleuth remailers. For the last two issues of the CEB in chapter 7. Current problems in crypt, I have pointed out the need for them. I invented the name FORTRESS REMAILERS to describe them. I also invented the term FORTRESS MAILING LIST as well. We are in a time window now. In a few years at most, remailers & lists like Cypherpunks & newsgroups like Sci.crypt may be outlawed. We may then have two of our most important communications tools taken away from us in our development of electronic communications privacy tools. Some will infer from this that if they want secure Internet communications, then they had better start writing in a hurry. The State has not consolidated its power enough yet to take away these "privileges". When they do, these will seem like the good old careless days of privacy building & possibly even seem like an historic anomaly. Privacy Freedom Fighters of the future may feel very grateful to today's Cypherpunks for writing FORTRESS remailers, lists, & newsgroups so that may continue their work. ON THE MATTER OF SECURITY THRU OBSCURITY I think that the idea of security thru obscurity is much like having a strong crypt system that is handicapped by allowing only one password. The method is limited from becoming popular due to the fact that popularity would likely disclose the key & then make the system s dangerous & useless. Possibly, disastrous to all using it. Due to that reason, FORTRESS REMAILERS & FORTRESS LISTS & NEWSGROUPS would have to avoid security thru obscurity. It is hard to figure out how to do a FORTRESS remailer or list. Possibly, a WAN using radio communications as a starting point? SPECULATIVELY Yours, Gary Jeffers

3 2

(fwd) \"Will You Be a Terrorist?\" ( Moi? )
by blancw＠pylon.com 17 Dec '03

17 Dec '03

Other tidbits for thought: . Optimism It is easier to be optimistic about impending events & the gathering dark clouds on the horizon, when one is mentally prepared & is accoutered for dealing with a threatening circumstance. Things don't look nearly so overwhelming the greater your confidence that you know how to respond; when you are prepared to meet the challenge because you have the means to do so (or can get them) and the knowledge of how to apply these to advantage. . Violation It is so telling, that legal documents on crime will always state that violations are of "section 351, 844 (f) or (i), 1114, 1116, 1203, 1361, 1363, 1751, 2280, 2281, 2331, or 2339", or a violation of "this or any other Federal criminal law". They don't say that an act is an attempted violation of "reality" or "of the sanctity of the individual" or of "the principles of privacy" or "the values for which this Nation stands". The words and meanings are arranged to place the sanctity and inviolability of the State as beyond the right of the individual to contemplate. It places the prerogative for State functions as existing outside an individual's category of the thought: there is no way that one could imagine the requirements of independent existence as sovereign to the functions of the State, as there is no allowance for, there are no "provisions"made for, any power to act beyond what is outlined by "the Law". That wouldn't be so bad, if The Law was a reflection of the real world and True Intelligence. (Barring that, it's back to the trenches. Now the trenches of cyberspace.) Blanc

1 0

"FREE MONEY" spam via remailer
by Jef Poskanzer 17 Dec '03

17 Dec '03

Is this the first spam to go via an anonymous remailer? I bet penet is swamped right now, trying to process the tens of thousands of flames. Seems like Julf might want to implement a spam detector inside the remailer, preventing the stuff from getting posted from there in the first place. --- Jef

2 1

Re: (fwd) "Will You Be a Terrorist?"
by jonathan＠memex.com 17 Dec '03

17 Dec '03

In a post to <cypherpunks(a)toad.com>, cactus(a)bb.com (L. Todd Masco) wrote: > Now, this won't give protection from traffic analysis; In was > suggestion, I was really blurring two seperate lines of thought > (I'm interested in PGPified mailing list software for content-hiding > reasons; I'm trying to set up a "distributed business" that I'd > like to keep secure). Also, though, I'm not sure I want to count > on anonymous remailers being available. If people want to > effectively "chain" them, that's fine. I don't see how using PGPified mailing lists help at all (with the assumtion that anyone can subscribe). I mean, anyone can simply subscribe to the list and then read all of the traffic. What's the point? Anyways... I *can*, however, see the use of using PGP encryption for mailing list submissions, expecially combined with an aliasing feature. (i.e. the mailing list has a key pair, and people send mail to it). Possibly even accepting something like the cypherpunk remailer format (i.e.: :: anon-post-from: bob etc... ). This, however, *might* be going to far for some people's comfort, because it would allow *COMPLETELY* untraceable posts (depending on the security of the site, but that's another issue). You can do other remailer-type traffic analysis defeaters like sending out the posts in random order at fixed intervals, etc. > - What I want (for other purposes) is a mailing list that has > its own public key; Material is encrypted to it, it decrypts it, > and then the material is encrypted with each recipient's public > key (I'm assuming a PGP base here). Probably simply to do, > but has anybody done it? No pretense of protection from > traffic analysis here: just to keep prying 3rd parties' eyes > off it. See above. Also, a couple problems with encrypting it to each person on the list is that it takes: #1 Space for all of the keys #2 Time to encrypt EACH message to each person Both of which quickly become a problem on high-volume lists such as cypherpunks. Also, it requires that EVERYONE use PGP if they want to read the list. This, I believe, is an unacceptable requirement. --- jonathan(a)memex.com PGP 2.6 key available. Fingerprint: (Jonathan Adams) 40 27 43 E0 5C 20 66 0E EE 8C 10 9F EC 40 78 6A (revoked!) A5 77 E9 28 88 DD B7 D4 9C 8C F9 D5 D8 3F 45 BE (new! 1024 bit)

2 1

More about Cypherpunks in *Expanded* Markoff Article!
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

[I've been gone all day and just got home. I didn't see anybody else writing about the extra mentions of Cypherpunks, compared to the "NYT" article mentioned earlier, so here it is.] Yes, folks, there's more on Cypherpunks in the Markoff article than what the "New York Times" printed. "All the news that fits, we print" applies as well to their column inches quota, apparently. I discovered that my local paper, the "San Jose Mercury News," carried several more paragraphs that Markoff wrote. No joke, no satire here from Klaus! The extra paragraphs are below: "...Such software permits computer users to send messages so that they are routed anonymously [this is where NYT ended the piece] "leaving little or no evidence for tracing the message back to the original sender." [included in SJMN piece] "Although motives for the disclosure of the formula remain unclear, there has been a bitter controversy between computer users on the Cypherpunks mailing list and executives at RSA Data Security..... "Members of the Cypherpunks groups have contended that the RSA Data Security patents constitute a monopoly that is hindering the widespread use of data encryption software. "Some members of the Cypherpunks have said they plan to take apart the RC4 formula to create their own version, which would not be controlled by RSA Data Security." [this is where the SJMN ended it....I'm not sure if the Vallejo Valley Times-Picayune carried more] Quite a bit more on the Cypherpunks role, I'd say. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tcmay

2 1