December 2003 - cypherpunks-legacy

Re: A Chance Encounter with Brad Templeton, of ClariNet
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Adam Shostack writes, incorrectly (:-)) : > Brad is in the 'intellectual property' business. He makes his > money selling access to information. There is an entire parasitic > class that does nothing useful, but makes money from the idea of > copyright. (Most entertainment industries operate like this. [ Economic and political descriptions and predictions deleted. ] Brad's really in the information collection, sorting, and distribution business, which relies primarily on contractual agreements rather than copyright. The newswire services, like AP and Reuters, sell their news stories to newspapers, who print them on paper, and don't redistribute the raw feeds to other places mainly for contractual reasons; otherwise the AP and Reuters would sell them news service. Sure, copyright laws reduce the number of newspaper readers who cut the stories out and sell them to newspapers themselves, but those cutout stories are something far worse than copyright violations - they're Yesterday's News, and hence not worth much. In Brad's business, he buys the wire service reports and sells them to *his* customers, who also agree not to redistribute them without paying Brad and/or the wireservices their fees. Anybody who rips off one of his stories is either violating a contract with Brad, or perhaps with his/her network provider, assuming the network provider has done a proper job of contracting about such items. Unlike newspaper stories, however, stolen Clarinet stories are Five Minutes Ago's news, which may still be worth something. As far as the Marxist-drivel "middlemen are parasites" argument goes, in old-style physical stuff businesses, you had workers who really made stuff, bosses who decided what stuff to buy and bought the raw materials, money-lenders who loaned money to bosses (*with varying splits of the risk), distributors and salesmen who helped stuff-users and stuff-makers get together, and truckers who brought the stuff to the users. NONE of them are inherently parasitic, and markets find ways to avoid paying for parasites because they cost more money than the "services" they may provide - the main parasites in those businesses were the folks who got their cut by threatening to use violence against people who didn't pay them - like tax-collectors and Mafiosi and some of the union folks (not most of them, most years.) In the information business, many of the same people are around, in similar functions. You've got information-generating workers, bosses, venture capitalists, salesdroids, distributors, internet-providers, and the like. The differences are fuzzier - sorting through information to find *interesting* information is somewhat like generation and somewhat like distribution. I tend to agree with Adam's dislike of "intellectual property", since having a copy of a piece of information doesn't deprive the original holder of his/her copy, and if it's an invalid concept, than some use of intellectual property laws (and the government force threat behind them) can be parasitic and abusive - but on the other hand, the so-called "parasites" are usually the information-generating workers themselves or folks who've paid those workers money in return for the privilege of exploiting their work - so be careful who you insult! In the music industry, the reason modern artists have much less need for the producers and distributors and moneylenders isn't because all those people are unnecessary parasites - they were there because they were providing useful services for the artists and/or consumers. The change is because technology has altered the economics of production and distribution, and the services that they used to provide, which were critical at the time, are less useful now because we have other ways to get similar functions done at lower cost. Bill Stewart, Anarcho-Capitalist for Sale or Rent.....

2 1

Re: San Diego CYPHERPUNKS symposium (11/30) ID & Fingerprint
by adam.philipp＠ties.org 17 Dec '03

17 Dec '03

>How is the person who stands up identified? If the group is small (I expect >less than 10 people) then there is no problem with handing a fingerprint and >a fist full of ID to each person at the table, one at a time. This worked quite well last time, also considering that many of the attendees seem to be repeats there is hardly a need to go through the permutations with every person present. I'll be the one wearing the black motorcycle jacket with a painting of Georgia O'Keefe's "Red White and Blue Cow Skull" on the back. I'll also be holding drafts of a handbook on intellectual property consideration for crypto-system developers/users. Don't ask for it until the meeting, it isn't nearly finished. Adam Philipp -- PGP Key available on the keyservers. Encrypted E-mail welcome. Sub rosa: Confidential, secret, not for publication. -Black's Law Dictionary

1 0

Re: cyphertext-only remailers / cryptanlysis code ?
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > > One solution that I've thought about is only passing messages which are > > composed of cyphertext. Does this make any sense? > > This sounds useful, but I'm curious how you would enforce it. I would think > you'd need to do some nontrivial statistical analysis to be reasonably sure > you weren't allowing various binaries, uuencoded files, etc. with faked PGP > headers, without preventing people from using other encryption schemes. I'd > say this is the flip side of the challenge faced by governments trying to > outlaw transmissions using strong crypto. I realize I can't enforce this perfectly. My goal isn't to force people to use encryption, it's to cut down on my risk as a remailer operator. Basically, I'm going to make sure that there are headers, a pgp version number, and that there are no obvious problems with the text (ie. no whitespace, full length lines, etc.) Someone who really wanted to make trouble for me could still do it with my remailer, but I think that someone who wanted to mail death threats or post forbidden material would probably use another remailer as the final hop. Your letter has brought a fairly serious flaw in my plan, though: it's possible to simply ascii-armor a binary with PGP isn't it? A brief scan of the pgp docs hasn't revealed the command, so I can't tell what an ascii-armored binary looks like, but I'll be it's just like cyphertext. That means I'll probably have to read the ascii-armor if I want to do this. == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtK6HBEpP7+baaPtAQGyCQQAkYssaS1iZ6KMJ3m4AKNLGbIAX3E7Bopq k39a+weRm6hzznbMoCHao5wcZ9V89tvgAg8aABxQ3wB894y71s9sAYs8J5GnbrBE fCqdxMfPxp+XaWh6pQO9ggDnw04eS5bFS1TPr4MeQumjMdx4CmcQegjhp5VNLSVH qZ7M9Q5x+hg= =utlk -----END PGP SIGNATURE-----

1 0

Cell Phones Security - NOT!
by cwalton＠earthlink.net 17 Dec '03

17 Dec '03

At 10:34 PM 11-21-94 -0500, Mark Terka wrote: >As one who will be shopping for a cell phone in the next week, what should >I look for in terms of security? What features are available in phones on >the market....if any? Well, as one who owns an AOR 1000 radio frequency scanner that can receive any and all cell phone conversations, I would have to say you have no security unless you use some kind of voice encryption. In order to make you can feel warm and safe, the manufacture or importation of scanners with cell phone capability was outlawed by congress earlier this year, which means that I can still listen to your call with my existing scanner while you feel protected. I bought guns with high capacity magazines this year after they were banned also. I wish I had enough money to buy a good assault rifle before they're all over priced (they'll never be all gone, just over priced.) Conrad Walton cwalton(a)earthlink.net **************************************************************** "The most foolish mistake we could possibly make would be to allow the ... people to carry arms. -- Adolph Hitler, Edict of March 18, 1938

1 0

Re: Brad Templeton, ClariNet, and remailers
by Alex de Joode 17 Dec '03

17 Dec '03

In article <aaf7ed2a000210042b2a(a)[17.205.6.17]> you stated: : I might be the (ex-)remailer operator in question. I find Brad's lack of : knowledge about remailers quite surprising in light of almost 4 hours of : conversation devoted solely to this topic, by telephone, over the course of : a month. My remailers have been used several times, to redistribute ClariNet articles, apperantly ClariNet has an "snitch"-line where people can mail to to get an reward, some people have the courtisy to inform the remail-operator that they have done so. I have *never* received any request for information from ClariNet. (maybe because my 5-line disclaimer says it all: the account used was an anonymous-remailer: so if you donnot like that, start your own !!) Regz, -- Exit! Stage Left. Alex de Joode <usura(a)xs4all.nl>

2 1

Re: New remailer concept.
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > The answer of course is encryption, but that is a problem when > you are writing to your, well... , "crypto challenged" > friends. Also, two way encrypted messages to most discussion > lists is not possible (to my knowledge). I hacked up some simple stuff which lets you read and send mail from a remote unix account. It's not exactly what you want, but it's pretty easy to do. (This stuff is pretty trivial, so if that bothers you, don't read on.) This lets you get an account on a freenet like nyx which will respect your privacy, and use that address to communicate to the rest of the world. First of all, I used filter and a sh script called secsh which allows me to mail and execute arbitrary sh scripts on the remote account, provided that they bear a valid, authorized pgp signature. If incoming mail has a trigger word in the subject line, it gets piped into a script which checks the sig and runs it if the sig checks out. Here's secsh: #!/bin/sh PGP=/usr/local/bin/pgp # the location of pgp PGPPATH=wherever # the location of config.txt export PGPPATH # and pubring.pgp PATH=a copy of your path export PATH trap 'rm -f /tmp/ss$$; exit 1' 1 2 15 if ($PGP -f +batchmode < $1 > /tmp/ss$$ 2>/dev/null) then /bin/sh /tmp/ss$$ fi rm /tmp/ss$$ It's a good idea to point PGPPATH at a special pgp dir, because this will pass any script with a sig that validates with any key on your keyring. I use another script, mlscpt, which looks sort of like a dumb version of the mail command. It takes a destination address and a subject as input, and reads incoming mail from stdin. A sh script which extracts and mails the letter is emitted to stdout. Here's mlscpt: #!/bin/sh echo "#!/bin/sh sed -e '/BEGINCRM/d' -e '/ENDCRM/d' << \End_of_File | mail -s '$2' $1 BEGINCRM" cat echo "ENDCRM End_of_File" You can use another, trivial script, to call mlscpt, sign the result, and mail it off to the remote account. Mine uses a dummy key to encrypt the output, for no good reason: the secret key, which isn't protected with a passphrase, is on the remote account's key ring, so it unwraps automatically. Here trigger stands for the trigger word which causes the incoming mail to be fed into secsh: #!/bin/sh mlscpt "$1" "$2" | pgp -efs dummy | mail -s trigger account(a)domain.edu echo " " It's also trivial to cause incoming mail to be encrypted and forwarded to your home account, but I can't find mine and I'm too lazy to look up the PGP command args which are needed. I used to use something similar to mlscpt as a "return address" for the cp remailer system: I'd send people a script which would append a header to their letter and send it off to the first remailer on the chain. I quit using it because lots of sensible people were reluctant to run strange scripts which they had recieved from some anonymous guy through a remailer. == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtLJWBEpP7+baaPtAQFPlAQAwSFUFRbGaUOZUwiNBfoSCJGPbAkRHeM0 xqKWhBH13HTTH52AIiQWUdBtKN6nJEj7bAf3VQRuSgZ6lxfXEDRI5QrytZJLHzwx LMTiGbdMin264RtFREwn5RSEOkr8oAJqge7srdKyoD1Lu7X8C1Y+TxLPuUcSVWKA EMU5NDBNS3I= =s09x -----END PGP SIGNATURE-----

1 0

Re: (Fwd) news spoke
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

This is the infamous "CERT Monitoring Warning Meme". Essentially, it doesn't mean that your administrators *are* going to monitor you, it just means that you've been warned, so it's not illegal under ECPA to do it if they feel like, because you consented by using the system knowing it was one of the terms for use. Unfortunately, there's no very good way to implement "Authorized users will not be monitored but unauthorized users cracking in will be", which is the real intent of most people putting up the warning - any system which could implement that could have kept the crackers off in the first place.... Bill

1 0

DNA Computation paper on Web.
by L. Todd Masco 17 Dec '03

17 Dec '03

Adleman's paper can now be found at http://www.hks.net/~cactus/doc/science/molecule_comp.html All typos are mine, Todd Masco, cactus(a)hks.net. Please send any corrections to me. -- Todd, cactus(a)hks.net (I'll be mailing out the Perspectives part tomorrow to anybody who's asked. Since I'm less certain of the copyright issues on that part, I'm only going to send that to individuals rather than putting it up on the web).

1 0

Re: REMAILER PROPOSAL
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

>If the Spoon-E Issuer is an opponent, you have far worse problems >than mere identification. That is why I specified that the >Issuer would be a creature of the Electronic Mail Forwarders >Guild. The Issuer would be chosen by the remailer operators whom >it served. It is quite a stretch to assume that Guild members >would choose someone that untrustworthy. Given that level of >paranoia, it would be advisable to avoid the use of any remailer. >After all, it is theoretically possible the *every* remailer in a >chain--no matter how long--could be compromised. One might as >well find a "flaw" with all remailers by assuming an opponent who >could read minds. I don't think either threat is credible. > > > S a n d y > I disagree with you assessment of the situation. The "Electronic Mail Forwarders Guild" is not made of mind readers, they are capable of error. You assume that a operator would appear to be untrustworthy. I think that is a poor assumption. As an example, I have been talking to John Perry quite a bit lately, he has been of great help to me, his heart seems to be in the right place, he is certainly militant enough about remailer secutiry. I am not at all convinced that he has not been compromised (nothing personal John). It simply does not require that good an actor. If a TLA wished to infiltrate us, the traitor would seem very trustworthy, gung ho, and paranoid. I think that the odds of the "Electronic Mail Forwarders Guild" choosing a compromised Spoon-E Issuer is much greater than the odds that all members of some subset of my choosing have been compromised. The system you proposed is interesting, and worthy of discussion, but I will not actually use any system where I must put identifying information in each packet. There are ways of implementing postage which do not require this compromise. Blind signed tokens is one method. Having the user pay the first remailer, with remailers charging each other a reduced rate for forwarding is another. You make no mention of my scheme for making your system completely secure (I think). It should not be too difficult to implement, given the software you would already need for Spoon-Es. -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Home of "chain" the remailer chaining script. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

Guerilla Remailers
by anonymous-remailer＠xs4all.nl 17 Dec '03

17 Dec '03

> From: skaplin(a)skypoint.com (Samuel Kaplin) > Has anyone else given thought to "Guerrilla Remailers?" Basically someone > obtains an account on one of the freenets or similar free account, sets up > a remailer and lets it sit for a while. (Until telnet and/or phone logs > are overwritten) After this time frame the address of the remailer is > posted. The remailer then would be used until it is shut down by the Powers > that be. The account would be set up under a bogus name etc. This would I think such a scheme would be limited by how difficult it is to integrate the remailer software into the Freenet mail routines. Most Freenets (at least Toronto, Buffalo do) use a generic type of software, Freeport, developed by the Cleveland Freenet. I'd need other's comments as to how easy it is to configure the remailer software to integrate with the Freeport software that you get a working remailer. If that step is possible, then yes, it is certainly possible to set up a guerilla remailer. > make the remailer the ideal candidate for the last hop in a remailer chain. > (After all if they can't find Juanna DuBone or Jack Mehoff they can't apply Both Cleveland and Buffalo, at last check simply require you to send in a signed form (that you can capture when you log in) as to your age, address, etc. No photo ID (ie Drivers license etc) is required so a phoney account is relatively easy to set up.....I know...I had one on the Buffalo Freenet until certain anarchistic activities got it canned :>. However....here is another interesting point. I'm a Canadian, living across the border basically from Buffalo and Cleveland. Not only would the authorities be unable to do anything due to it being a phoney account, but being across the border would also place me beyond the pale of the U.S. authorities even if I actually was ever tracked down. All that would happen is the account would be shut down. Same for a U.S. resident utilizing the Toronto, Victoria or Ottawa Freenets. Overall, this is an interesting concept and I'd be willing to give it a shot. They key facet of it is whether we can configure the Freeport software with the remailer software.....or vice-versa.

2 1