December 2003 - cypherpunks-legacy

Stealth remailers
by Hal 17 Dec '03

17 Dec '03

One "quick and dirty" way to get the effect of a stealth remailer is to have all messages leave the remailer net via one or more politically strong hosts. For a long time now I have been having my remailer on alumni.caltech.edu, which I judge to be politically weak, forward mail to shell.portal.com, which seems stronger. When people see some anonymous mail they don't like, they look at where it comes from. They seldom think to blame other remailers in the chain (partially because they can't easily find out who they are). It is the final remailer which takes the heat. If that remailer were in a jurisdiction and/or political position that would allow it to withstand the various threats we anticipate, it would provide cover for the other remailers. And by using other remailers in a chain before going through this final remailer, users don't have to trust the final remailer with any significant secrets. Some time back I proposed a variation of this idea: "second tier" remailers, which always forward their outgoing messages through one or more "first tier" remailers, which work like the current ones and take the political heat as a result. Second tier remailers would be very safe to run and it would be rare that a sysop or supervisor would get a complaint about the remailer's activity. Hal

1 0

art encryption...
by Lile Elam 17 Dec '03

17 Dec '03

Well, it looks like I have to delve into this subject as I should really know what's available for signing art. Some poeple are concerned that art via the net is going to be ripped off, abused, and any other sort of horra you can think of *if* people share digital images of their works via the Internet (WWW, ftp, newsgroups, et all). So, I have been thinking that a way an artist can insure a viewer that the art they are viewing is really that of the artist, the artist can *sign* their art with their private key and others can check it with their public key. Now, the art would be factered into the key generated that others would check with the public key. So, a image file (gif, jpeg, tiff whatever) would be run through a encryption coding that would generate a signage based on the artist's image and their private key. The image would remain unchanged. Then viewers could run the same encyription coding on the image and apply the artist's public key to see if it really *is* their work.... I don't know if this is the best way to do something like this and I sure am not much of a programmer... :) But it would be interesting to find if you think this is possible. Any other ideas on work authenticy would be appreciated. The main goal here is to let people view the work and if they *really* want to make sure the artist posted it, they could check it with PGP... or the like. Hopefully, people could catch art abuse and let the artist know about it. I myself have my art on the net as "share art" and people can do what they like with the images as long as they don't use them commercially without contacting me first. Also if they really alter an image, to say it's been manipulated and the orig can be found at say art.net. I realize that some folks may abuse these images of paintings I have done but I feel that what I gain by sharing makes up for it all. Unfortunately, this isn't the case with other artists and alot of them are not ready for this concept of sharing and letting go. They become terrified that their works might be open to the terrors I have mentioned. I want to give these artists a method that will make them feel more comfortable about sharing digital images.... Such a method will also help shoot down the marketeering, blood sucking, types of slippery jerks I run into who try and scare artists from sharing on the net. One fellow had the nerve to scare two artists away from art.net with copywrite arguments and abuse issues and then in some crazy way, he convenced them to pay him $ to provide the same service with no security messures ither. Blows my mind that they went for it... sigh..... This type of undermining will not help artists and I want to fight back. This jerk also is probably scared of art.net because we are offering to help teach artists how to put their stuff up with html, are offering a free space for them to create and share in, and are asking them to teach others the same. We are wanting to help other sites come up on the net and do the same. We're totally non-profit. This jerk couldn't understand why I would barter a painting for a years worth of Internet connection for art.net. He asked, "What do you get out of it?". I just shook my head... Sigh... thanks for your help in advance and check out "Art on the Net" if you get the chance... (http://www.art.net) -lile Lile Elam founder and one of the webmasters of "Art on the Net" lile(a)art.net

2 1

H.E.A.T. SEEKING
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Bummer! WWOR, here in the New York area, pulled a fast one on me. They rescheduled Acapulco H.E.A.T. from 18:00 to 15:00 without so much as a "by-your-leave." But as Mr. May will tell you, I'm one of the list's perennial optimist. There are no problems, only opportunities. If you saw the show in question, my loss may be your gain. That's right, I asking you to post a "guest review" of this week's episode of Acapulco H.E.A.T. to the list. If we're lucky, we may end up with "dueling reviews." What was the bikini count? How many gun battles? What was blown up? How many computer/privacy/crypto plot devices were used? And most importantly, Fabio or no Fabio?; that is the question. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Stealth remailers
by Matthew Ghio 17 Dec '03

17 Dec '03

Hal <hfinney(a)shell.portal.com> wrote: > Some time back I proposed a variation of this idea: "second tier" > remailers, which always forward their outgoing messages through > one or more "first tier" remailers, which work like the current ones > and take the political heat as a result. Second tier remailers would > be very safe to run and it would be rare that a sysop or supervisor > would get a complaint about the remailer's activity. ftp cs.cmu.edu cd /afs/andrew.cmu.edu/usr12/mg5n/public/remailer get ghio.cp-remailer.tar.gz gunzip & untar Change the following line in the readheaders.c, in the block_addr function: if (match==1) address[0]=0; to if (match!=1) address[0]=0; Your blocked.addresses file is now a pass-addresses file. Put the email addresses of other remailers in the file. You now have a stealth remailer. Now, EVERYONE should go do this RIGHT NOW! No more excuses for not running remailers... :)

1 0

Re: H.E.A.T. SEEKING
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > SANDY SANDFORT > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . > >C'punks, > >Bummer! WWOR, here in the New York area, pulled a fast one on >me. They rescheduled Acapulco H.E.A.T. from 18:00 to 15:00 >without so much as a "by-your-leave." > >But as Mr. May will tell you, I'm one of the list's perennial >optimist. There are no problems, only opportunities. If you saw >the show in question, my loss may be your gain. That's right, I >asking you to post a "guest review" of this week's episode of >Acapulco H.E.A.T. to the list. If we're lucky, we may end up >with "dueling reviews." > Wheeeeeep! Wheeeeeeeep! HEAT ALERT! HEAT ALERT! Wheeeeeep! Wheeeeeeeep! :-) Happily, the local affiliate has left it at it's "regular" time (midnight!), so I'll be glad to help fill in the slack. I'll send the stuff to you, if you like/don't mind, so you can merge it with any others (or edit to taste :-). Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

Data Havens
by dfloyd＠runner.utsa.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I know this may be getting off track on this list, but it may be worthwhile. I was exploring the concept of a "data haven" which, to my knowledge, a place whose location is unknown to its users, but via anonymous remailers, files can be stored and retrived from it. I am going to look into writing a script or program that will allow people to store items using a passphrase or their PGP key, and retrive and delete the files on demand. Here are my problems though: 1: I am clueless about Perl, and not that great with C. 2: One must have to "hide" behind a VERY TRUSTABLE remailer, one that does not go down all the time, and one that accepts PGP encoded mail. 3: Would hiding behind one remailer or two be secure enough? There is a problem, unlike simple remailer chaining that people need to be able to E-mail the script. 4: A need for verifing that the mail got to the DH successfully since data errors do occur, and sometimes networks truncate mail packets. (Compuserve is notorius about this, so is Fidonet). 5: A way of making verifing that the user is who (s)he claims to be. (PGP, IDEA, or a passphrase) 6: Multiple security levels, so files cannot be retrived even if one's PGP key is compromised (user settable) 7: How will files be stored? Will folders and directories actually be made, or will they be all stored in one place with wierd names (to prevent name collisions) and one file be the index? Will there be user names or UID's? 8: There will need to be a way to tell if the DH is up or not. 9: How will PGP keys be stored and indexed? One would not want their files mailed in the clear. (How would I mail files if the user cannot use PGP? have a user settable password, and use crypt?) 10: How would people be able to trust a DH? Data Havens, by definition must be _very_ reliable, yet in a secure location to prevent unauthorized access of the files. What bothers me is DH's starting up and either croaking unexpectably or being places for Bad Guys (TM) to be able to snarf unsuspecting people's files. Perhaps a reputation based system? 11: How would a DH turn away files because the disk is full? 12: Would integrating DigiDollars with a DH be a good idea? (For secure storage of your files, we charge $1 DD per month per meg, and .01 DD per transaction.) What would the DH do with the files if they are not paid, or double-spending occurs? I will be working on a command set that one can use for sending and retriving files to and from the DH, as well as an authication system that can support PGP, DES (SunOS style), or crypt (yes, laughable security, but some people cannot use PGP at work). I think I will use perl for eventually writing this, but I know nothing about perl, so will have to print out a manual or two and do some work on my linux box... As per my previous posts, I am very clueless, but If I can get a decent data haven script working, it will be worth all the flames :-). Once the script is written, all one has to do is install the script, and ping a Penet type remailer, then post the anon remailer address, and Voila' a DH now exists. I apologize for the length of this post, but there are a lot of questions and problems in making a stable, usable data haven. - --- Finger dfloyd(a)lonestar.utsa.edu for PGP key, and please use it when mailing me. -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLntxFXDkimqwdwa5AQEE0gP+P+8sjma3rDkrxhZOBRam7/0v6lsUG0e9 fvtUsLHKAYaB8f6cCUUxwtpwhrI/9TPeh7QoQnEcHlhDO1kV46X9kA1n04hhJpXb Rx+BWSNaLHB3tynaXkN0lTIR/r6CGs+zKvc8BOJpLHSL7ajowmXs1C9Z8Lf4IW+G 8IwG9TR/iec= =9Vg8 -----END PGP SIGNATURE-----

2 2

On the crime bill and remailers
by hughes＠ah.com 17 Dec '03

17 Dec '03

Even the crime bill doesn't apply _ex post facto_, meaning anything newly illegal under the crime bill wasn't illegal before it. In particular, any discussion about remailers, discussion which has already happened and which might be construed as conspiracy for a newly illegal action, cannot now be subject to the terms of a new bill. Even more in particular, any discussion of remailers that has already happened is perfectly safe. And as for me, I don't plan on shutting up now. Eric

1 0

terrorist FORTRESS SLEUTH remailers & FORTRESS lists
by Gary Jeffers 17 Dec '03

17 Dec '03

THE FOLLOWING TEXT IS FOR INFORMATION ONLY & DOES NOT ADVOCATE BREAKING ANY LAWS. TERRORIST FORTRESS SLEUTH REMAILERS & FORTRESS LISTS Todd Masco makes a good point about sleuth remailers. For the last two issues of the CEB in chapter 7. Current problems in crypt, I have pointed out the need for them. I invented the name FORTRESS REMAILERS to describe them. I also invented the term FORTRESS MAILING LIST as well. We are in a time window now. In a few years at most, remailers & lists like Cypherpunks & newsgroups like Sci.crypt may be outlawed. We may then have two of our most important communications tools taken away from us in our development of electronic communications privacy tools. Some will infer from this that if they want secure Internet communications, then they had better start writing in a hurry. The State has not consolidated its power enough yet to take away these "privileges". When they do, these will seem like the good old careless days of privacy building & possibly even seem like an historic anomaly. Privacy Freedom Fighters of the future may feel very grateful to today's Cypherpunks for writing FORTRESS remailers, lists, & newsgroups so that may continue their work. ON THE MATTER OF SECURITY THRU OBSCURITY I think that the idea of security thru obscurity is much like having a strong crypt system that is handicapped by allowing only one password. The method is limited from becoming popular due to the fact that popularity would likely disclose the key & then make the system s dangerous & useless. Possibly, disastrous to all using it. Due to that reason, FORTRESS REMAILERS & FORTRESS LISTS & NEWSGROUPS would have to avoid security thru obscurity. It is hard to figure out how to do a FORTRESS remailer or list. Possibly, a WAN using radio communications as a starting point? SPECULATIVELY Yours, Gary Jeffers

3 2

(fwd) \"Will You Be a Terrorist?\" ( Moi? )
by blancw＠pylon.com 17 Dec '03

17 Dec '03

Other tidbits for thought: . Optimism It is easier to be optimistic about impending events & the gathering dark clouds on the horizon, when one is mentally prepared & is accoutered for dealing with a threatening circumstance. Things don't look nearly so overwhelming the greater your confidence that you know how to respond; when you are prepared to meet the challenge because you have the means to do so (or can get them) and the knowledge of how to apply these to advantage. . Violation It is so telling, that legal documents on crime will always state that violations are of "section 351, 844 (f) or (i), 1114, 1116, 1203, 1361, 1363, 1751, 2280, 2281, 2331, or 2339", or a violation of "this or any other Federal criminal law". They don't say that an act is an attempted violation of "reality" or "of the sanctity of the individual" or of "the principles of privacy" or "the values for which this Nation stands". The words and meanings are arranged to place the sanctity and inviolability of the State as beyond the right of the individual to contemplate. It places the prerogative for State functions as existing outside an individual's category of the thought: there is no way that one could imagine the requirements of independent existence as sovereign to the functions of the State, as there is no allowance for, there are no "provisions"made for, any power to act beyond what is outlined by "the Law". That wouldn't be so bad, if The Law was a reflection of the real world and True Intelligence. (Barring that, it's back to the trenches. Now the trenches of cyberspace.) Blanc

1 0

"FREE MONEY" spam via remailer
by Jef Poskanzer 17 Dec '03

17 Dec '03

Is this the first spam to go via an anonymous remailer? I bet penet is swamped right now, trying to process the tens of thousands of flames. Seems like Julf might want to implement a spam detector inside the remailer, preventing the stuff from getting posted from there in the first place. --- Jef

2 1