December 2003 - cypherpunks-legacy

Re: Transparent Email
by John Young 17 Dec '03

17 Dec '03

Knumbskull Alert! On the transparent e-mail topic, I send the presumably anonymous mail headers below received here by way of The Pipeline provider. Would some kind soul verify that the headers do not disclose the true ID or true address or true path other true info that would identify the prayerfully anonymous sender? Every piece of mail coming here has such headers. Does everyone else get the same? FWIW, the mail system automagically lists the sender and the subject in a neat chart, and hides the header if commanded to do so, or reveals it to the prying mind. Thanks. John Young (signing until forbidden) PS: It's true that Pipeline was cracked last Saturday and the system shut down for a while "due to a security breach". The story in the WSJ about the "Internet Liberation Front" explained more than we clueless subscribers were allowed to know -- as the story said, corporations don't want us babes to know about our vulnerabilities, we might demand better service. ------------------- Jpunix Header: >From owner-cypherpunks(a)toad.com Mon Nov 28 20:14 EST 1994 Received: from relay2.UU.NET (relay2.UU.NET [192.48.96.7]) by pipeline.com (8.6.9/8.6.9) with ESMTP id UAA22639 for <jya(a)pipeline.com>; Mon, 28 Nov 1994 20:14:45 -0500 Received: from toad.com by relay2.UU.NET with SMTP id QQxsau18498; Mon, 28 Nov 1994 20:13:25 -0500 Received: by toad.com id AA12541; Mon, 28 Nov 94 17:08:09 PST Received: from jpunix.com by toad.com id AA12535; Mon, 28 Nov 94 17:07:57 PST Received: (from remailer@localhost) by jpunix.com (8.6.9/8.6.6) id TAA17362 for cypherpunks(a)toad.com; Mon, 28 Nov 1994 19:07:46 -0600 Date: Mon, 28 Nov 1994 19:07:46 -0600 Message-Id: <199411290107.TAA17362(a)jpunix.com> To: cypherpunks(a)toad.com Subject: RE: Cash From: nobody(a)jpunix.com (Anonymous) Comments: This message did not originate from the above address. It was automatically remailed by an anonymous mail service. Please report inappropriate use to <remail-adm(a)jpunix.com> NOTE: Mail to nobody is sent to /dev/null Finger remailer(a)jpunix.com for remailer help. Finger kserver(a)jpunix.com for PGP keyserver help. Sender: owner-cypherpunks(a)toad.com Precedence: bulk Content-Type: text Content-Length: 801 ------------------- Chaos.bsu Header (spooge): >From owner-cypherpunks(a)toad.com Mon Nov 28 10:09 EST 1994 Received: from relay2.UU.NET (relay2.UU.NET [192.48.96.7]) by pipeline.com (8.6.9/8.6.9) with ESMTP id KAA26339 for <jya(a)pipeline.com>; Mon, 28 Nov 1994 10:09:55 -0500 Received: from toad.com by relay2.UU.NET with SMTP id QQxrzg29356; Mon, 28 Nov 1994 10:03:33 -0500 Received: by toad.com id AA25960; Mon, 28 Nov 94 07:01:07 PST Received: from bsu-cs.bsu.edu by toad.com id AA25954; Mon, 28 Nov 94 07:01:03 PST Received: (from nowhere@localhost) by bsu-cs.bsu.edu (8.6.9/8.6.6) id KAA16037 for cypherpunks(a)toad.com; Mon, 28 Nov 1994 10:00:55 -0500 Date: Mon, 28 Nov 1994 10:00:55 -0500 Message-Id: <199411281500.KAA16037(a)bsu-cs.bsu.edu> From: Anonymous <nowhere(a)bsu-cs.bsu.edu> To: cypherpunks(a)toad.com X-Remailed-By: Anonymous <nowhere(a)bsu-cs.bsu.edu> X-Ttl: 2 X-Notice: This message was forwarded by a software- automated anonymous remailing service. Comment: The contents of this message are neither condoned by nor approved by Ball State University. Please report problems or complaints to nowhere(a)chaos.bsu.edu Sender: owner-cypherpunks(a)toad.com Precedence: bulk Content-Type: text Content-Length: 105 ------------------- Anon.penet.fi Header (Al Capone) >From owner-cypherpunks(a)toad.com Sun Nov 27 19:49 EST 1994 Received: from news.pipeline.com (news [198.80.32.5]) by pipeline.com (8.6.9/8.6.9) with ESMTP id TAA05980 for <jya(a)pipeline.com>; Sun, 27 Nov 1994 19:49:52 -0500 Received: from relay2.UU.NET (relay2.UU.NET [192.48.96.7]) by news.pipeline.com (8.6.9/8.6.9) with ESMTP id TAA14755 for <jya(a)pipeline.com>; Sun, 27 Nov 1994 19:30:25 -0500 Received: from toad.com by relay2.UU.NET with SMTP id QQxrwz27537; Sun, 27 Nov 1994 19:29:53 -0500 Received: by toad.com id AA16432; Sun, 27 Nov 94 16:27:21 PST Received: from anon.penet.fi by toad.com id AA16426; Sun, 27 Nov 94 16:27:16 PST Received: by anon.penet.fi (5.67/1.35) id AA03124; Mon, 28 Nov 94 01:12:06 +0200 Message-Id: <9411272312.AA03124(a)anon.penet.fi> To: cypherpunks(a)toad.com From: an41389(a)anon.penet.fi (The Al Capone of the Info Highway) X-Anonymously-To: cypherpunks(a)toad.com Organization: Anonymous contact service Reply-To: an41389(a)anon.penet.fi Date: Sun, 27 Nov 1994 23:12:05 UTC Subject: How to disable telnet to port 25 Sender: owner-cypherpunks(a)toad.com Precedence: bulk Content-Type: text Content-Length: 764 ------------------- Nately Header: >From owner-cypherpunks(a)toad.com Sat Nov 26 22:50 EST 1994 Received: from relay2.UU.NET (relay2.UU.NET [192.48.96.7]) by pipeline.com (8.6.9/8.6.9) with ESMTP id WAA12434 for <jya(a)pipeline.com>; Sat, 26 Nov 1994 22:50:31 -0500 Received: from toad.com by relay2.UU.NET with SMTP id QQxrtv11771; Sat, 26 Nov 1994 22:50:04 -0500 Received: by toad.com id AA02097; Sat, 26 Nov 94 19:47:48 PST Received: from ucsd.edu by toad.com id AA02091; Sat, 26 Nov 94 19:47:45 PST Received: from nately.UCSD.EDU by ucsd.edu; id TAA19011 sendmail 8.6.9/UCSD-2.2-sun via SMTP Sat, 26 Nov 1994 19:47:41 -0800 for <cypherpunks(a)toad.com> Received: by nately.UCSD.EDU (4.1/UCSDGENERIC.4) id AA12222 to cypherpunks(a)toad.com; Sat, 26 Nov 94 19:50:40 PST Date: Sat, 26 Nov 94 19:50:40 PST Message-Id: <9411270350.AA12222(a)nately.UCSD.EDU> To: cypherpunks(a)toad.com Subject: Need program pointers From: nobody(a)nately.UCSD.EDU (Anonymous) Comments: This message did not originate from the above address. It was automatically remailed by an anonymous mail service. Please report inappropriate use to <complaints(a)nately.ucsd.edu> Sender: owner-cypherpunks(a)toad.com Precedence: bulk Content-Type: text Content-Length: 978 From: IN%"storm(a)marlin.ssnet.com" 26-NOV-1994 21:38:47.14 To: IN%"cypherpunks(a)toad.com" CC: IN%"storm(a)marlin.ssnet.com" Subj: Need program pointers ------------------- Au.informix Header (Critias): >From owner-cypherpunks(a)toad.com Sat Nov 26 17:58 EST 1994 Received: from relay2.UU.NET (relay2.UU.NET [192.48.96.7]) by pipeline.com (8.6.9/8.6.9) with ESMTP id RAA29778 for <jya(a)pipeline.com>; Sat, 26 Nov 1994 17:58:07 -0500 Received: from toad.com by relay2.UU.NET with SMTP id QQxrtb28834; Sat, 26 Nov 1994 17:56:43 -0500 Received: by toad.com id AA28479; Sat, 26 Nov 94 14:52:50 PST Received: from gateway.informix.com by toad.com id AA28473; Sat, 26 Nov 94 14:52:39 PST Received: from informix.com (infmx.informix.com) by gateway.informix.com (4.1/SMI-4.1) id AA20299; Sat, 26 Nov 94 14:52:34 PST Received: from carbon.informix.com by informix.com (4.1/SMI-4.1) id AA06617; Sat, 26 Nov 94 14:52:33 PST Received: by carbon.informix.com (4.1/SMI-4.1) id AA00381; Sat, 26 Nov 94 14:53:23 PST Date: Sat, 26 Nov 94 14:53:23 PST From: Critias_the_conspirator(a)au.informix.com Message-Id: <9411262253.AA00381(a)carbon.informix.com> Subject: Privacy Digest Apparently-To: cypherpunks(a)toad.com Sender: owner-cypherpunks(a)toad.com Precedence: bulk Content-Type: text Content-Length: 2111 ------------------- Access Header (Uni): >From owner-cypherpunks(a)toad.com Sat Nov 26 15:40 EST 1994 Received: from relay2.UU.NET (relay2.UU.NET [192.48.96.7]) by pipeline.com (8.6.9/8.6.9) with ESMTP id PAA21937 for <jya(a)pipeline.com>; Sat, 26 Nov 1994 15:40:51 -0500 Received: from toad.com by relay2.UU.NET with SMTP id QQxrss22905; Sat, 26 Nov 1994 15:40:01 -0500 Received: by toad.com id AA24978; Sat, 26 Nov 94 12:17:51 PST Received: from access3.digex.net by toad.com id AA24972; Sat, 26 Nov 94 12:17:40 PST Received: by access3.digex.net id AA16948 (5.67b8/IDA-1.5 for cypherpunks(a)toad.com) Sat, 26 Nov 1994 15:17:29 -0500 Date: Sat, 26 Nov 1994 15:17:29 -0500 (EST) From: Black Unicorn <unicorn(a)access.digex.net> To: Gary Jeffers <CCGARY(a)MIZZOU1.missouri.edu> Cc: cypherpunks(a)toad.com Subject: Re: Privacy Digest - Blk Unicorn , Frissell, Sandfort In-Reply-To: <9411261934.AA23910(a)toad.com> Message-Id: <Pine.SUN.3.91.941126151628.16895A-100000(a)access3.digex.net> Mime-Version: 1.0 Sender: owner-cypherpunks(a)toad.com Precedence: bulk Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1332

1 0

Re: An Attempt to Hobble SAFE Crypto Bill
by Peter D. Junger 17 Dec '03

17 Dec '03

: http://www.wired.com/news/news/politics/story/5492.html : : : An Attempt to Hobble House Crypto Bill : : by Rebecca Vesely : : 9:08am 25.Jul.97.PDT A Republican opponent of a House : bill that would loosen controls on the use and export of : encryption is circulating an amendment that would : effectively cripple the legislation. : : The amendment, by Representative Benjamin Gilman : (R-New York), who chairs the International Relations : Committee, would make it unlawful to "manufacture, : distribute, sell, or import any product within the United : States that can be used to encrypt communications or : information if the product does not permit the real-time : decryption of such encrypted communications or : information." Besides the first amendment issues that I raised earlier, there are certain other problems with this amendment. Say it takes 2,000 years to decrypt a message, now that is what I would really call ``real time''. And there could also be a message that could be decrypted in ten seconds, but only by someone who has the key. Obviously this draft of an amendment is very rough, incomplete, mistranscribed, or some or all of the above. -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH EMAIL: junger(a)samsara.law.cwru.edu URL: http://samsara.law.cwru.edu NOTE: junger(a)pdj2-ra.f-remote.cwru.edu no longer exists

2 1

Re: "You aren't following the _rules_!"
by merriman＠metronet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jonathan Rochkind replied: >At 3:58 AM 11/29/94 Lucky Green wrote: >>I do not mean to belittle the work that has been done but unless the >>encryption is built into the mailer and using a remailer means clicking the >>"use X remailer(s)" button and the mailer better know which ones are >>working and do the PGP envelopes it won't happen. > >Have you used premail? It pretty much does all of that. >People still aren't using premail either because they can't figure out how >to install it (doubtful it's not hard to install) or because they don't >have a need for it that's great enough to justify the (minimal) time >neccesary to ftp it and install it or wait the (sometimes more painful) >time neccesary for the computer to encrypt and/or sign your outgoing >messages. This brings up a point that I - among others - have to flog every now and then: the *x-centric nature of most of the net. I have no doubt that premail works wonders - but I don't know of any version of it that would run on my MS-DOS box a Mac an Amiga etc. I use PC Eudora for email and have pinged on QualComm every so often to ask when the commercial version will allow/support external encryption programs. As some may have noticed over the weekend I also started trying to use the PGP Tools package to try and write a PGP.DLL. For various reasons (mostly me :-) it's going to be more difficult and take longer than I thought - but I am *not* going to give up on it. Until/unless there exists fairly easy-to-implement means of including crypto for applications programmers on a variety of platforms other than *x boxes progress in the click-a-button-to-encrypt area is going to be bloody slow. > >Because premail makes it incredibly easy to use PGP on a unix box. And for >that matter the Eudora/PGP applescritps make it incredibly easy to use PGP >on a mac. And there are some people working on an applescript that will >automate using remailers on a mac too. But ease of use appearantly isn't >enough; no matter how easy it gets to use it's still going to have some >cost to the user over not using it. Even if the cost is only having to wait >the 1.5 seconds it takes your machine to decrypt/encrypt a message. Unless >there's a use for it people won't be willing to spend that 1.5 seconds per >message. This kinda supports my previous observations: the necessity of adding external scripts and such to the Mac version of Eudora slows down the program's operation more than necessary. If there were a Mac resource (of whatever kind - I'm not Mac-fluent) that the nice folks over at QualComm could use to build crypto into the program to start with then they wouldn't have the excuse of "we can't because there's nothing to do it with at the source level". My ha-penny's worth.... Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtuEeMVrTvyYOzAZAQFwuwQAtGMZyS3vj1T88EgaLuKOqWARruGjWTxv V2+Lri/nPuBwm6Nkfu12MBHGXl9QlMsh58MuhvFfvA2qdgmuDBy0iHBaPq0C1L5v 1YnHiBHrYIfLkNchqapuMQSM6tbL+PJWGWikqYV2Nv7SR6Mtu+jCK8yt6biHZxIm qU9Yk4CJ0Kw= =+K/s -----END PGP SIGNATURE----- - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)feenix.metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome, encouraged, and preferred. "Those who make peaceful revolution impossible will make violent revolution inevitable." John F. Kennedy

1 0

Dr Dobb's Info Way
by John Young 17 Dec '03

17 Dec '03

Dr. Dobb's has a special Winter issue on the "Information Highway" which includes a good long article on the economics of the system, past, present and future, and another fine piece on e-mail security by Bruce Schneier. That's Winter 1994, Volume 19, Issue 14.

1 0

Stego paper
by Adam Shostack 17 Dec '03

17 Dec '03

There is a paper on stegonography "Minimum Protocols for the Insertion of Messages into Random or Pseudorandom Data" posted to sci.crypt.research. From: klockstone(a)cix.compulink.co.uk (Keith Lockstone) Message-ID: <3benes$pbh(a)net.auckland.ac.nz> Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: The Market for Crypto--A Curmudgeon's View
by JEFF LICQUIA (CEI) 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > From: eric(a)remailer.net (Eric Hughes) > Let me review the exact proposal. First, a recognizer is set up at > toad.com to distinguish between digitally signed and unsigned > messages. Second, some action on the message would be taken, which > would gradually increase in effect over time. The first action would > be to add a header to the end of the mail identifying it as unsigned. > A later action would be to delay the mail at the server for some > amount of time. A final action would be to delete or bounce messages > that weren't signed. Perhaps something a little more useful would be a little more palatable. I have a feeling that something like the above would sound gratuitous to many on the list. A better way would possibly be to have some value-added service offered by the list server which involves encryption or digital signatures. Here are a few ideas: 1. What if all messages on the list were themselves signed by "Cypherpunks List <cypherpunks(a)toad.com>"? (yeah, I'm reaching here; let my brain warm up...) 2. Encrypted submission to the list. This could be useful if used in tandem with remailers, perhaps... 3. Offer anonymization locally. Messages posted this way could appear as "cypherpunks-reader@somewhere" or something like that. When combined with remailers and encryption (like #2 above), this could mix things up with respect to anonymous mail. As another (possible) option, the remailers could be set to recognize cypherpunks(a)toad.com and send in such a way as to use this local anonymizing. 4. Auto-verify signed messages. Put a header at the top of signed messages such as: [Signature verified. ID: Joe Blow <jblow(a)uunet.net>] [Bad signature! ID: Joe Blow <jblow(a)uunet.net>] for tested signatures. This would either require a key registry (where you register your public key with the list server) or an interface to the key servers. This would of course imply quite a few changes to the list server code, as well as possibly non-trivial resources to do the processing, but hey, social imperatives don't have to answer to reality, now, do they? (At least they never seem to when the government is concerned. :-) Two variants: Strip the signatures after verifying them, and/or marking unsigned posts in a similar way. 5. Allow the option to encrypt list messages before sending. If we used #4 above, this could encrypt with the public keys; otherwise, it could use conventional encryption. This could be a great boon to readers whose sysadmins might take a dim view of them reading such an antisocial list. :-) Corollary: allow the option of sending the list, encrypted, through the remailers as well without requiring a pseudonymous remailer. I'm sure I could think of more lamebrained ideas given enough time and motivation. :-) > I do, however, agree with the other two premises of Tim's > hypothetical. I do think that crypto isn't being used by enough > people. I realize that the exact meaning of 'enough' is subjective, > so let me rephrase. I do think that crypto is being used by fewer > people than I want. I also believe that setting an example is a good > thing, because it signals an achievable task to those who are > considering doing it. I would agree, though I would suggest that holding out carrots (neat features you can take advantage of if you encrypt) would work better than punishments (your posts won't get through as fast if you don't sign your posts). Does that make me a Puller? > When I first proposed server actions last year, it was with the full > realization that I wouldn't be signing my own posts and would thereby > be subject to the delay (the first-proposed action). This post isn't > signed either. This post is. :-) I'm a believer that it serves as effective spoof insurance. But, then again, I've got a direct Ethernet link to the net on my Windows box at work and Linux at home, so it's easy for me. Also, I wasn't even a lurker at that time, so my suggestions may be old hat. If so, please bonk lightly! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtuijTER5KvPRd0NAQFfXAQAgDrbMlEJBXU2V9NIquHNQGonE/dwwH0I aEnykWh+8Bu3hCdqYgbv6zhe7gc+0itb/QuwHMpUn8MNHE6VhykFPl+i7c3HOibf 0yAqPVy10UNMuJY6LxqSxfrTKwV/sFcnRWDaJcboL3MvTFrwRqC3ItdaOeokKvx2 1Cgv1ioQqfc= =gzbV -----END PGP SIGNATURE-----

1 0

Jeff @ViaCrypt
by Joe Turner 17 Dec '03

17 Dec '03

Please excuse the bandwith. Earlier today I had a conversation with Jeff who claimed to be from ViaCrypt. I was in a hurry to attend a lunch/meeting and forgot to get his internet address. Could someone point me in the right direction? -- Joe N. Turner Telecheck International turner(a)telecheck.com 5251 Westheimer, PO BOX 4659, Houston, TX 77210-4659 compu$erv: 73301,1654 (800) 888-4922 * (713) 439-6597

1 0

whats all this nonsense
by Tom Bryce 17 Dec '03

17 Dec '03

I just signed onto this list. What the hell is all this nonsense that I hear about mandating PGP signed messages? I thought the whole grassroots crypto thing was about protecting privacy rights and individual liberty and all that. So what if someone wants to post a message to cypherpunks AND DOES NOT WANT ANYONE TO BE ABLE TO PROVE THEY WROTE THE MESSAGE. Whether because they fear legal prosecution, or some other social consequence down the line, or whatever. It's everyone's personal choice whether they want their name nailed down unmistakably to given messages of personal/political/WHATEVER nature. It seems heinously against the spirit of this list to mandate that pople append an unforgeable digital signature to everything they feel like saying to the list so that anyone, anywhere can prove that they said a particular thing at a partic time. If you have a problem with what someone said and want to verify its authenticity, why not just send them an email and ask them to sign the message personally? Tom

3 2

(re-tx) RE: Transparent Email (WAS disable telnet to port 25)
by p.v.mcmahon.rea0803＠oasis.icl.co.uk 17 Dec '03

17 Dec '03

I sent this yesterday, but it apparently didn't through. -- > > I don't have an answer to your question, but you did bring up something > > I've been meaning to ask about for some time and I never really got > > around to it; Are there any short-term plans to press for an RFC > > utilizing digital signatures? With the exponential increase of mail Existing standards track RFCs support PEM-based security of RFC-822 email (RFC 1421, RFC 1422, RFC 1423, and RFC 1424). Recent work on security of MIME has allowed for an alternative content protection and certification mechanism (i.e. PGP). See Internet Drafts draft-ietf-pem-sigenc-02.txt and draft-ietf-pem-mime-07.txt which respectively define the framework and the PEM-specific parts. > The best answer that I can come up with for this problem is to allow for > several webs of trust to function simultaneously. Perhaps we would have The intent of the MIME extensions is to enable either PGP or PEM to be used, although the standard for the former is I believe still pending. I am not aware of efforts to integrate the two certification mechanisms. > A web could be defined by a single top-level public key and a set of This is the function for the IPRA (as discussed in RFC 1422). > rules. Perhaps a text based program -- a sort of "meta-pgp" -- could > check chains of signatures to validate a key. This is what a PEM-conformant user agent does. > Suppose, for example, that I'm administering a web of trust. I set up > the web so that I can deputize notaries who can in turn sign user keys. The PEM WG used to call these organisational notaries, but they have been dropped from the standards. They are also referred to in related work as Local Registration Agents or Authorities - and are necessary for large organisations' use of certification services. > Lets further assume that all signatures are good for a year. A keyserver > would return a text file containing: (a) the user's key, concated with a > notary's key, concated with a header specifiying the date it was singed > by me. This sounds similar to the certification message in RFC 1424. There isn't a requirement for certificate retrieval as certificates are sent with the message or handled using (as yet unspecified) directory facilities - probably an extended DNS in the Internet environment. - pvm

1 0

Mac Encryption Components?
by acspring＠knoware.nl 17 Dec '03

17 Dec '03

Does anybody know if there is an encryption component registered with Apple? I was planning to write one, but I wanted to know if there was already a standard/spec I could code to. I e-mailed REGISTRY at AppleLink a coupla weeks ago, but they seem to be focussed just on registering new components; not fielding queries about what's already registered. -- Man! Woman! Child! All! are up against the WALL of SCIENCE! <acspring(a)knoware.nl> PGP Key print:4C 17 EC 47 A1 6D AF 67 F3 B4 26 24 FE B2 0F 5E

2 1