December 2003 - cypherpunks-legacy

RE: Cash
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>>On Fri, 18 Nov 1994 wcs(a)anchor.ho.att.com wrote: >> >>> Hasn't really provided it for quite a while, as long as there's an >>> infrastructure to track serial numbers (you've presumably noticed that >>> each bill a unique serial number, except for counterfeits and maybe >>> printing glitches.) >> >>And every bill that passes through my hands (of course not the ones I >>handle at work, I'm talking personal here...) gets the serial # >>overwriten in heavy black marker. >> >>Happy Hunting, -Chris. > >I went to a GSA auction and picked up 3 very nice U.S. Gubment surplus >paper shredders. They shred into very fine particulate that makes great >fire starting material for the fireplace. >I run everything with my name, address, etc., thru it so that *none* of >my trash is identifiable. >How's that for paranoid :> > How much would you want for one of them, assuming there's one for sale? Dave "Getting more paranoid by the minute, sometimes" Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)feenix.metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome, encouraged, and preferred. "Those who make peaceful revolution impossible will make violent revolution inevitable." John F. Kennedy

1 0

Secure EDI over Internet
by xpat＠vm1.spcs.umn.edu 17 Dec '03

17 Dec '03

Summarized from PC Week, Nov 28th, page 44: -begin- Premenos Corp now testing product to foster Electronic Data Interchange transactions over the Internet. Technology licensed from RSA Data Security Inc provide the security features, encryption, authentication, and guaranteed message delivery. Carl Redfield, VP of manufacturing for Cisco Systems Inc, was quoted as saying, "Security is the most important factor to us, as it is now, anyone could intercept messages off the Internet." Cisco is involved in testing the new product. The Premenos suite will be available first quarter 95. Pricing not set. These phone numbers were given for more info: Premenos (800) 426-3836 Cisco (800) 553-6387 -end- regards, -pd-

1 0

Re: How to disable telnet to port 25
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> The Al Capone of the Info Highway says: > > A while back, there was a discussion about how to fake a from > > address by telneting into port 25 in a site. Many people discussed > > the pro's and cons, but I wanted to know if anybody knows of a way > > to stop people from getting in there to send the message in the > > first place. > Sure. Turn off mail to your site. You don't have to go quite that far (almost, but not quite :-) You can do things like only accept your incoming mail via uucp, which has a whole different set of holes and limitations, but which is supported by a number of the major network suppliers. If you're on dialup access anyway, uucp is fine. If you've got a real IP feed, uucp-over-tcp has slightly more authentication than smtp, and can turn off anonymous access, but that basically means you're transferring your trust to your MX forwarder's security system, which presumably still speaks port 25. Bill

1 0

UN_nab (Re: an96489)
by John Young 17 Dec '03

17 Dec '03

Responding to msg by an96489(a)anon.penet.fi () on Tue, 29 Nov 1:8 AM >Due to the double-blind, any mail >replies to this message will be anonymized, and an >anonymous id will be allocated automatically. You have >been warned. Dear an96489, Penet.fi warning jams lob of UN_nab. Kiss twice wid nice nym-id.

1 0

We really _aren't_ paranoid :)
by Johnathan Corgan 17 Dec '03

17 Dec '03

Just in case anyone didn't catch this in the newsgroups: From: dcd(a)se.houston.geoquest.slb.com (Dan Day) Newsgroups: talk.politics.crypto,alt.privacy,alt.security.pgp Subject: Re: Mandatory Key Escrow: Goodnight! Date: 28 Nov 1994 19:02:31 GMT Organization: GeoQuest System, Inc. Houston Lines: 29 Message-ID: <3bd9g7$1fc(a)sndsu1.sinet.slb.com> In article <3b655b$rne(a)eis.calstate.edu> jomcgow(a)eis.calstate.edu (John S. McGow an) writes: > >It is frightening how the power to regulate "interstate commerce" has >been used as a justification for the constitutional authority of the >federal government to intercede in so many things. The good news is a few justices still seem to have their heads on straight: Item from AP: It seems that in urging the Supreme Court to reinstate a federal-level ban on firearms within 1000 feet of schools (the 1990 Gun-Free School Zones Act), the Clinton administration argues that the national economy is adversely affected by gun-related violence at schools. Therefor, the reasoning continues, Congress was authorized to institute the ban under (you guessed it) the Interstate Commerce clause of the Constitution. Said Solicitor General Drew S Day III, "This is not about just regulating guns. Congress is concerned with this impact on the national economy." Asked Justice Ruth Bader Ginsburg, "Is there any violent crime that doesn't affect interstate commerce under your rationale?" Ginsburg later asked Days to cite an example of a law which Congress would NOT have the authority to enact under the Interstate Commerce Clause. Interjected Justice Scalia, "Don't give away anything here. They might want to do it." -- ----------------------------------------------------------------------- Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)netcom.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan -----------------------------------------------------------------------

2 1

Privacy Digest - the future
by Gary Jeffers 17 Dec '03

17 Dec '03

THE FOLLOWING IS FOR INFORMATIONAL VALUE ONLY & IS DOES NOT ADVOCATE THE BREAKING OF ANY LAWS. Dear Cypherpunks, Well, I think enough damage control has been done with my original Privacy Digest post. Now to pick through the ashes & see if I can come up with anything of value. The ideas & services presented in the Privacy Digest advertisement e are still very good. I think that bright segments of the upper classes commonly do have access to these services. The trick would be to bring these services to the class masses. I think that it would have been hard to do this in the times before the great amount of electronic privacy software & infrastructure that have been built up. Now that we have the tech. investment, I think that International financial transactions could be privately done for the people. What we need mostly are lawyers & financial experts that are willing to deal with the middle classes & who are aware of & want to deal with Cypherpunk technology. That would probably mean two or more people. One would be the international law/money expert. The other would be the communications expert. Do we have a shortage of lawyers who want to live & work in tax haven vacation spots & get rich? If our Cypherpunk lawyers are afraid of wrecking their reputations with States, then maybe they could get "little" lawyers to do the front work for them. We seem to be up to our asses here in the U.S. with lawyers & I hear they are starting to have a hard time making careers. However, there is a huge market for lawyers financial experts that is unoccupied in the masses money privacy area. As to the Cypherpunk tech.s, I think that for a good salary, they could be convinced to go to a vacation spot & do what they really want to do anyway. They would, of course, own a portion of the Corporation so that a successful venture would mean a secure future. It really needs one model experiment to open it up. After that, other groups could model themselves on the first & we would wind up with a giant private economy. - a true free market! I would suggest that the team just start out with a couple of services. I would suggest check & money order cashing & funds trans- mitting service & possibly an e$ clearinghouse. Once these activities were successful, then other services could be added on. When this business starts making good money, then they could afford to pay Cypherpunk programmers for their work. They could also afford to pay remailers for stable services. This would, of course, snowball. More money means better privacy software & better privacy software means a safer & more committed private money business & thus more money for more & better privacy software & privacy infrastructure. So far, Cypherpunks & associates have been like "all dressed up & no place to go". That is, we have a lot of good software & systems & hardly anyone making good use of it. An offshore, money privacy business for the general public that wanted Cypherpunk tech. would have use for most of it & a demand for more of it. It is my view, that what is most needed now, is a model offshore private money services company which uses Cypherpunk tech. & actually makes money. With that as a nucleus, the TRULY private economy would skyrocket & the Cypherpunk dream would be realized. Yours Truly, Gary Jeffers

1 0

INTERFACING PGP WITH
by nobody＠nately.UCSD.EDU 17 Dec '03

17 Dec '03

|> If you don't have finger access, mail me privately, and I'll send |>the file to you. JA|If you don't mind, could I have a copy? finger is disabled here... If you can't use finger from your site, send mail to mg5n+finger(a)andrew.cmu.edu and put the address you want to finger in the message. He's the greatest, eh...

1 0

To: Pr0duct Cypher Re. PGPTools and Mixmaster
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I am using PGPTools to handle all the crypto functions in the second generation remailer that I have written. All the copies of PGPTools that I have found seem to be set up to compile on SUN workstations only. Mixmaster is both a remailer and a front end, and therefor must run on many different platforms. I have been able to compile PGPTools on Linux and FreeBSD, but PGPTools produces invalid RSA blocks. If you (or anyone else reading this) have ported PGPTools to other platforms could you send me the source and makefile, or point me to them. If not, could you help me do it, the source code is a tangle, and it will take me a long time to do on my own (I am a brute force programer, not a C wizard). Many thanks Lance Cottrell -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLtrWYVVkk3dax7hlAQElaQP9EZawmQ/sBXg4h7aUsrFAOK/W62m4Ie+r oS61kT7Lu6YqoC4lElwYomaU5ofyDaGDVdlph9J1a9rurqCXxYtLfAAuQFEAznSl 2LEEupWm36vM5TYr0GGXaq2Q1LN04Bsc7TI1Q7kkqa97U0ixvi8HfoRjchvqXW4F i4R0RK0xP48= =fYrB -----END PGP SIGNATURE----- -- Lance Cottrell <lcottrell(a)popmail.ucsd.edu> http://nately.ucsd.edu/~loki/ Home of the remailer chaining script "chain". PGP 2.6 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

PGP & Elm
by CyberDrunk 17 Dec '03

17 Dec '03

I've been a lurker here on this list, but I am currently trying to get PGP working with elm in a way that will be convenient for users who use PGP and won't mess with the ones who don't. To make this short, I haven't been able to find much documentation. Can anyone point me in the right direction? wendigo(a)mars.lib.iup.edu

1 0

Re: Transparent Email
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I think it's a bad idea to require signatures on the list, or even to penalize people who don't use them. People aren't signing their posts because it's too much of a hassle to do it from a dial up, netcom style, account, not because they're insufficiently committed to the cause. It seems to me that such a rule would stifle discussion and encourage people to store their keys on insecure accounts. The real solution is to try to build tools which will make it so easy to use crypto that there's simply no reason not to do it. And towards that end: I think Eric's point about separating key distribution from encryption finally sunk in. It's encouraging for me, because I think we're very close to being able to implement good transparent systems, at least if we put key distribution on the back shelf. I haven't totally thought it through, but it seems to me that it's almost a matter of assembling a few existing tools into a coherent system. I've just installed Raph Levien's premail as /usr/lib/sendmail on my system, and I'm happy to report that it's running well, despite the fact that my machine is a very puny linux box. This means that I can keep a list of addresses that ought to be encrypted in my ~/.premailrc file, and outgoing email to those destinations will be automatically encrypted and signed, no matter what mail software I happen to be using. This leaves the problem of passphrases for outgoing signatures and automatically decrypting incoming mail, but I think that cfs will let me kludge something together which will get around this. (My situation is a little unusual, because I'm running linux on a pc which is connected to the net via a static slip account. I don't think this would work well in other situations.) If, after I power on my machine, I mount an encrypted directory with cfs, and then connect my slip, I think I can get away with keeping my key unprotected with a passphrase as long as the keyring is stored in the encrypted directory. What's more, if my mail spool is stored in the encrypted directory as well, a filter which automatically decrypts incoming mail and deposits the plaintext in the spool would be feasible. A good filter would probably stick something in the text to let you know that it had come with a good signature. It would be sort of ugly, but I think it would work. I'm sort of new to cfs, though, and I'm sure how it would deal with multiple users (root, my main account, my cp account which recieves cypherpunk list traffic, etc.). But If it worked, I'd have a machine which: o talked to the rest of the email universe without difficulty, and which uses standard unix software o would automatically use crypto when sending mail to a list of email addresses, and which could automatically handle incoming crypto o would be reasonably secure when it was powered off == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtrgPREpP7+baaPtAQHTlQP/RYcJi9u5iU0AY4SV1MqNGxAuQDfYwL2G LcJC5sxYreFGkpwwpA87fRcLi7PreAtS6vFg5tsMXiUXaNS15v1mCDfxr54AwO7C P3yyHWUTGg1I8CRbDUYlZqksrF3Bqzxy0pDRQGzPEFwP7k8ER72XXeVtIVc8K/zM CBW+smDOY/w= =43eM -----END PGP SIGNATURE-----

4 5