December 2003 - cypherpunks-legacy

Re: The Remailer Crisis
by david d `zoo' zuhn 17 Dec '03

17 Dec '03

// Are there options for several machines to share a connection? (I'm // sure there are....). Someone who already has a connection may be // willing to host additional machines, which could share some of the // charges. Around here (in the Twin Cities) one can get a dedicated connection for $100/month without any startup fees. And of course one can set up a local network and use the machine with the modem link as a router. Having one of these dedicated lines, I'd be happy to host remailer-boxes at my site. Ideally, they'll be small & only require a network cable and a power cord. I'm also willing to seriously consider initiating remailer-accounts on my machine. If you'd be interested in a remailer account, drop me a line. -- - david d `zoo' zuhn -| armadillo zoo software -- St. Paul, Minnesota -- zoo(a)armadillo.com --| unix generalist (and occasional specialist) ------------------------+ http://www.armadillo.com/ for more information pgp key upon request +----------------------------------------------------

1 0

Re:I have had ENOUGH of this government bullshit!!
by David Yaffe 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm Canadian, and I am really scared by what is going on in the States. If the US gooberment succeeds in banning/controlling crypto, how long will it be before it happens here. Does anyone know if the Canadi-humm gooberment is trying to do ban/control crypto? And to the person who wrote this I have one word: A-F*CKIN-Men! >Screw this. I have finally blown my stack over this bullshit governmental >crap. From this oint forward, I fully and completely make available, IN THE >U.S, the International version of PGP 2.63.ix. >If there are any cops, Feds, Spies, wops, spics, gigaboos, alternate >lifestyles, punks, crackers, crackheads, whatever other name calling terms, >I left out, want to stop me --- TRY!!!! This is bullshit people! We have >the inalieable right to full and total screcy, privacy, and personal >protection of whatever * W E * determine to be private information. The >government has gotten out of hand with this shit. If you are a member of the >F.B.I, C.I.A, S.S, N.S.A, X.Y.Z community and you don't like this action, >show up at my doorstep guns drawn. Cause you show up at MY door step, you'll >need them! That I promise! David. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBM9m01DoM1b3tdf0JAQGbTwP+O3SE9MjWYBGsSjhlk+9PhbNrKsstHgVH zG8kTfcAyAku5OEQt3bNGCbStsxiAGkYjhqT2G5i+cvdjSODMive5V2tquSjacz2 yn5GrEfGq4fUJbr1FuFN6xO+2xHSvjEVmMa5bHz8XOjDTP3NvGQUnhbcQC+YoLPi sa05zvnWd7Q= =axM8 -----END PGP SIGNATURE-----

1 0

Re: Remailer-on-a-CD
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

>>The "Linux mavens" followed by the "black box" stuff sparked an idea... > >>package. To make it as easy as possible, I'd use the UMSDOS filesystem so >>that Linux could be installed on a DOS machine without any reformatting >>repartitioning, or similar headaches. > >>distribution already has) and some boot options, you'd have an "instant >>remailer" software package, able to transform any 386SX/4MB RAM DOS macine >>or better into a Linux-based remailer site, complete with aliases, loggng > >>So, am I dreaming, or does this sound viable to y'all? > >OK, let's ponder the minimum hardware necessary, >possible minimal configuration (Intel/clone based): > >(1) Case. >(2) Power supply. >(3) Motherboard/CPU and 4mb RAM. >(4) Hard drive w/ controller. >(5) modem card. Add "standard serial port" here, for reasons I'll get into in a moment... >(5) No monitor, keyboard, floppy, or video card. > (a) would require some "umbilical cord" connection to initially > set up from another PC. > (b) need to operate on "umbilical", direct and uucp modes. The "umbilical cord" here could be a standard serial port; this could be used in several ways. In addition, Linux has the ability to do TCP/IP through the parallel ports (using a LapLink-style protocol), so that could possibly work as well. There are a few options here: Reuse the monitor, keyboard, etc. for each installation. Go ahead and throw in the floppy, and set up the Linux kernel on the floppy to use the serial port as the console instead of the monitor/keyboard. Connect your second PC using the PLIP (that's the parallel port IP stuff) protocol. On the second PC, one would run a program that wouls telnet to the first PC and run the install program, which would run via NFS on the PLIP line. >I am just thinking out loud here, but the hardware could be damn >cheap (sub $500). You can find old 386 boards with 4mb right on >the board (no SIMMs) for next to nothing (the decreasing popularity >of 30-pin SIMMs makes this a surplus store reality, as nobody >wants to bother to strip out the RAM chips anymore). As far as price, I've seen 386SX motherboards run for $99. At a going rate of $50 per MB of RAM, buying a used MFM disk and controller for, say, $40 (I had the option of buying a junk box full of stuff, including two 20MB drives and a 10MB, for $100), some cheap $10 everything-board, a $70 14.4 modem, and a power supply at $50 (here I may be way off), that adds up to... $470. Not a bad guess! And this assumes you pay new prices for the motherboard, RAM, multiport, modem, and power supply... Also, if you wanted to splurge, you could opt for a few more MB of RAM and a CD-ROM drive. With our recently pressed "Cypherpunk Toolkit" CD-ROMs :-) and a boot floppy, you wouldn't necessarily need to install anything at all; the Linux kernel could store site-specific info (entered the first time you booted up via a cute user-friendly interface) on the floppy and load it to a RAMdisk, mounting the CD-ROM for all the rest of the interesting stuff. On multipurpose systems (you only use the computer a few hours per day and run the remailer using some store-and-forward system the rest of the time), this wouldn't take up any hard disk space, and your remailer could conveniently disappear with a simple Ctrl-Alt-Del and the slam of a safe door. ("But officer, all I have on my hard drive is DOS and Windows. See for yourself! I don't even have PGP here...") You know, the more I think about this, the more ideas pop into my head. I'd better quit before I get dizzy... What if the site-specific stuff on the floppy were encrypted... or the kernel... ? Could we use Matt Blaze's CFS...? Store the site-specifics on a data haven for backup... with auto-download on bootup... notebook remailers in car trunks using RadioMail or POP3 that have no single physical location... dynamic remailer configuration (download your IP address and alias info, etc. from the Remailer Server)...? STOP THE WORLD, I WANT TO GET OFF!!! There; that's better. Maybe I'll play around this weekend and try building a minimal Linux distribution (on what hard disk space :-). Then again, maybe I won't, so don't be bashful to play around on your own!

1 0

Internet World Magazine
by jml＠wizard.synapse.net 17 Dec '03

17 Dec '03

This month's issue of Internet World Magazine deals primarily with internet security. I'm am not going to review everything in the mag but I'll list the table of content: Better Safe: Danger lurks on the Info Highway. You must take precaution to reduce your riks. By Dave Taylor and Rosalind Resnick Getting Cryptic: Phil Zimmermann's PGP gives you powerful encryption to keep your messages safe from prying eyes. Read all about it. By William Stalling. (Introductory article about PGP. Nothing we, here, don't already know) Securing the Enterprise: Connectiong your corporation to the Internet can be a security nightmare. Firewalls are the main line of defense. By Alton Hoover (An overview of Firewalls, application-layer gateways and token-based authentication schemes) Beyond the Firewall: The latest firewall technology not only detects intruders, but strikes back. By Winn Schwartau (Very interesting article. Here are some quotes to wet your appetite: Wouldn't it be nice if a computer system attacked from the Internet responded to the attack by striking back at the intruder? This is exactly what Sidewinder's implementation of type enforcement does.....It will detect the intrusion immediately....As soon as a violation occurs, a silent alarm is activated....sidewinder can be configured to react in any number of ways, once an attack has been detected...it can shut the intruder cold...(or)...it can invoke a mechanism that would record all the information from whence came the attack....By luring the attacker into a false sense of security, the hacker would continue trying to break in, unaware that every step was being recorded... Cashing In: As Internet commerce expands, a host of companies are vying to establish their system as the basis for cyberbanking and credit-card transactions. By Lisa Morgan Business Browser: New versions of Mosaic with built-in encryption promise to keep your transactions safe. By Richard W. Wiggins Unlawful Entry Crackers can feasts on your data if you fail to plug your leaky Unix system By Aaron Weiss (Five Ways to crack a Unix System) It's Alive: Although the furor has subsided, reports of Clipper's death are greatly exaggerated. The government's controversial eavesdropping effort lives on. By Steven Vaughan-Nichols Building Trust The chief executives of Trusted Information Systems -Steve Crocker and Steve Walker- talk about encryption, CyberCash, Clipper, and more. By Jeff Ubois. All in all a rather interesting mag. Check it out. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ wizard(a)alpha.c2.org Give me the liberty to know, to utter, and to argue freely according to conscience, above all liberties. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: The Remailer Crisis
by frissell＠panix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:14 AM 1/19/95 -0800, Timothy C. May wrote: >* I favor separating the "account that remails" from the "owner of the >site," as I have argued in vain in the past. (Example: a willing site >gives out or sells many accounts...each is legally separate, and each >must be legally challenged. My longer posts dealt with this.) I offer to pay for and operate a remailer account on any system that will have me. Do we have the software yet to run a remailer out of an account? >It's time to get cracking on this crisis. The Cable companies may come to our rescue. Even old fuddy-duddy Cablevision is going to be offering connections this year. If those connections are characterised merely as physical connections, that could offer legal protections. My contrib for now will be to draft an all purpose response letter to respond to civilian and official complaints concerning remailer abuse. DCF - -- You know, Private Idaho brings PGP signing within about 10 keystrokes in any Windows mailer. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLx6vUYVO4r4sgSPhAQFjzgP/ZVAonNBsZpMCg/tlWohvC7ratGTZWtCz /WXC+Z1PAKhigdz8VhWhkPXLj/jYba1LUMBI9giNP6T9TSxMw6jjzgvs44tw4LF4 X0pF/lv9OS7GKcPw//4FyB1FKgfwpJA+mHr8gqlLrxREXv3qpHfKRuu/ecg5urmS jwiSSKsjZhU= =Aoq4 -----END PGP SIGNATURE-----

6 6

Re: The Remailer Crisis
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >What are the cheapest "live connections" (24-hour a day connections) >available? Where I am, about $100 a month, plus whatever the local >phone company charges for a dedicated line. ISDN is an option, but it >looks to cost $400-800 to get started, plus a monthly charge (which I >don't recall, except that I "gulped" when I heard it). I am currently using ISDN from my home in San Jose. You're right in that the startup costs are the barrier--even a cheap single B channel (56K) terminal adapter for use with a serial port will run $300-$400 dollars. The telco charges are minimal in my area; $25 monthly for the line itself (115 Kbps async bandwidth). Connect charges are free for non peak usage, and $0.60/hour for peak usage time (0800 to 1700) Mon-Fri. This is the Pacific Bell "Residential" ISDN plan. For business lines, it goes up to $50 monthly with $0.60/hour 24 hours a day. In addition to this would apply any standard long distance charges that would apply to a particular call. This is an excellent setup for fast, cheap, INTERMITTENT connection to the Internet. My particular ISP is in Santa Cruz, with POPS in SC, SJ, and soon Monterey. An unlimited connect time PPP account runs $75 monthly. This actually gets me a three bit subnet so that I can put five IP boxes and an ISDN router on my ethernet at home. A remailer in this scenario would need to have their MX record point to their ISP, and process mail via POP (incoming) and SMTP (outgoing). It would be straightforward to implement a timed or demand dial scenario (say, every fifteen minutes) to accomplish this. While not the ideal (continuous internet connection with pure SMTP based mail transport), it would suffice for a moderately loaded remailer, I'd imagine. Of course, this involves the mail subsystem of your ISP, partially defeating the purpose of having ubiquitous anonymous remailer "instances" whose operation is outside the control of an ISP. Still, it would be a good start. == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)scruznet.com -Isaac Asimov -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLx7Y2E1Diok8GKihAQExmwP8DmWuHMunZoaA4Y8qh7jx56hqgs4p3Bgo DgHf2J4FoPwzVzXwSH0ep+1tKkHWNnDTXB7UVtuZjLF4uE4HtY72d0ANEfZ0AgPw 9peOBzZoukxpl6nMmHszUBWXxfP4DJW9AvbPdzOWFE1OAMIQLi6mpEyGE3Vouv61 WX+4gzx+4M0= =iP7S -----END PGP SIGNATURE-----

4 3

Re: The Remailer Crisis
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

> >> Jeff's response is exactly what I was hoping for! The "Cypherpunks >> distribution" version of Linux would be a great way to spread cheap >> remailer technology on cheap Linux boxes. Hell, I might even augment >> my Macs with one of these things! > >One thing I should've noted is that a Linux-based cheap remailer is >mostly useless without a "live connection" to the Net. That's why I >mentioned hanging these directly off The Little Garden's net (i.e., >putting the box in the same building as the physical net, to avoid >expensive connections). Not necessarily. Imagine, for example, a FidoNet or UUCP remailer. It might be nice for Internet users to have some kind of mail aliasing in the DNS for you, but it wouldn't be required by any means. I think it would be better to have lots of remailers with ugly addresses (like "jeff%jtj-l.uucp(a)cei.com", which is my address on my Linux box at home) than only a few with nice ones. (FidoNet has its own problems, such as paranoid BBSes that disallow encrypted traffic, but that's another matter.) These remailers wouldn't even need to be up 24 hours; you could run it at night, calling up on bootup and every hour thereafter or something. It's not perfect, to be sure, but what else is perfect? I don't know how hard it is to get in on the local FidoNet, but UUCP isn't too hard, and is a lot cheaper. When I was in college, my college gave me a feed for free. I'm not so familiar what providers charge. Of course, university accounts have their good and bad points; however, if you could persuade someone offsite with control over a domain name (for example, "remailer.net" :-) to give you a mail alias on their domain, this would take a bit more effort to track than your typical "remailer.uiuc.edu" type domain. This would make it less likely that the university would hear complaints, also, since most complainers would be more likely to complain to "postmaster(a)remailer.net" than "postmaster(a)uiuc.edu" if your machine was called "anon(a)anarchy.remailer.net" instead of "anon%anarchy.uucp(a)uiuc.edu" or "anon(a)anarchy.uiuc.edu". And this doesn't even get into the neato-cool new services you West Coasters get, like RadioMail... >What are the cheapest "live connections" (24-hour a day connections) >available? Where I am, about $100 a month, plus whatever the local >phone company charges for a dedicated line. ISDN is an option, but it >looks to cost $400-800 to get started, plus a monthly charge (which I >don't recall, except that I "gulped" when I heard it). Around here, it isn't even available unless you access through the CompuServe numbers or call long distance (read: $$$). That may be changing soon... >So, even an el cheapo 486-based Linux box, for perhaps $800 or so, >would need to solve the problem of a cheap, continuous connection to >the Net. (My supposition is that one approach is to share these >connections, hence my notion of hanging machines on other people's >nets.) No need for even a 486. If it takes an hour to process a remailer script, so much the better for the mix. You could call it a "required latency feature". :-) >Are there options for several machines to share a connection? (I'm >sure there are....). Someone who already has a connection may be >willing to host additional machines, which could share some of the >charges. Set up correctly, these "Remailer-In-A-Box" type machines could do several things to share a connection. They could, for example, all be connected with serial cables and use UUCP to get mail where it needs to go. I believe, in addition, that you can chain up to three deep with PLIP. This of course assumes that Ethernet isn't an option.

1 0

AT&T IVES chip
by xpat＠vm1.spcs.umn.edu 17 Dec '03

17 Dec '03

Interpretive Summary From PC Week: "Security Chip, interface aim to assist Electronic Commerce" AT&T IVES (Information Vending Encryption System) chip will encrypt data, video on demand, banking, etc. The IVES chip will be use in AT&T cable-TV-boxes this year. It is available to OEM's for Internet data security applications. IVES uses algorithms licensed from RSA. No mention of any dreaded built-in peephole. --------------------------------------------------------------------- P M Dierking |

2 1

Re: The Remailer Crisis
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 4:49 PM 01/19/95, Jeff Licquia wrote: >persuade someone offsite with control over a domain name (for example, >"remailer.net" :-) to give you a mail alias on their domain, this would take >a bit more effort to track than your typical "remailer.uiuc.edu" type >domain. This would make it less likely that the university would hear >complaints, also, since most complainers would be more likely to complain to >"postmaster(a)remailer.net" than "postmaster(a)uiuc.edu" if your machine was >called "anon(a)anarchy.remailer.net" instead of "anon%anarchy.uucp(a)uiuc.edu" >or "anon(a)anarchy.uiuc.edu". I was thinking of this same thing. I'm hopefully going to have a unix box on the net in my college dorm room soon, but I'm a bit hesitant to run a remailer on it. I'm a bit scared to ask whether it would be allowed, on the "it's better to get forgiveness then permission" line of thought. But I'd rather avoid the potential of having to get forgiveness either. If my site had a "machine.remailer.net" address, there would be many benefits. For one, I don't have to worry about some administrator coming accross a list of anon remailers (in a Time magazine scare-tactic article, eek!), and noticing that one of them appears to be operating from some student's dorm room, and secondly, as Jeff says, people who complain are just going to complain to admin(a)remailer.net. They aren't going to take the time to try to figure out that my IP address is really in oberlin.edu, and complain to postmaster(a)oberlin.edu. So administration@oberlin would never even realize I was running a remailer, and since they haven't yet made any indication that that would be against the rules, I would be in a good position. Maybe it's time for Eric to figure out what he's going to do with remailer.net.

3 2

Status of GUCAPI
by Insomnia Gallumbits 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm just about done with the first part of my crypto library, the internal generalized I/O, and largely done with the framework for the encoding rules. Since I haven't fully outlined what I'm doing here, I thought I'd mention the outline in the hopes of getting some real feedback and perhaps some random snipets of code. In essence, what I'm building is a crypto library that takes a very general approach with a few parameters controlling its behavior. The idea is to have something that anybody can drop into their mail agent and have an easy way of using crypto and interface with existing systems such as PGP. A major design goal is to be backwards compatable with PGP, but paramount is having a plug-and-play library that will be flexible enough to meet future crypto needs. One of the biggest problems today is that crypto libraries are chiselled out to deal with very specific cases -- the most general I know of if is RSAREF, which AFAIK only supports BER/DER for encoding and RSA and DES/CBC for encryption. I'll grow more clueful on that, and other crypto and key management issues, as I get to actually working on them. The things that I've parametrized in the design are: - Type of I/O. Right now, files (and fds) and a couple of memory configurations are supported. I've made it trivial to add new types of I/O as well, and there are flags to support to immediate zeroing of data once it is read into the internal structures. - Encoding of data. There are multiple ways to encode a bytestream and these methods can be nested. For example, PGP, MIME, and uuencode use their own formats. In this library, you can specify the type. I also want to eventually put logic in (where possible) to determine the type and will also use this to support various compression schemes. - Ciphers (this is the big one). Right now, as I've mentioned, things are very haphazard. What I want is a way to change one parameter from, for example, CRTYPE_IDEA to CRTYPE_DES and thus change the encryption scheme. - Key management. I know of two major ways of doing things right now, X.509/PEM certificates as pushed by RSADSI, and PGP web-of-trust. As far as I can tell, PEM-style certificates are just a degenerate case of PGP web-of-trust. - Random sources. People should be offered a pretty good source of random numbers, but should also be allowed to drop in their own sources. This is going to be relatively tough on platforms I don't know much about, IE Mac and PC, but I'm hoping for some help on this. I can also salvage some code from RIPEM for those. - Autoconfiguration to incoming messages. People should be able to open a file and have it work, even with schema added to the library after the original adaption to GUCAPI. There's some other stuff that I'm probably forgetting here, but that's the gist of it. The cipher code is going to be pretty simple: I'm getting a lot of code from various places on the net; the code exists, it just isn't put into a form that is easy to use. The most difficult is going to be a generalized scheme for key management: first off, I'm probably going to simply use PGP's web-of-trust as my model, assuming the X.509/PEM style certificates can be treated as degenerate cases of web of trust. I also intend to offer a GSSAPI interface to all of this, as seems appropriate when I get to it. This is so far all in C: I'm not a C++ convert yet and C is still the most portable of the languages about. Later, perhaps class libraries can be designed around the same code. Thoughts? Am I wasting my time, or is this a worthwhile pursuit? And should I find a better name than GUCAPI? -- Todd - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLx7wfCoZzwIn1bdtAQGIWAF9GgY29Qop9p1TEryO3oe/cFUyyBAJQtp7 yPGjEDyCvk/vtLHTAxhQoMTE98MMkPP1 =EoBl -----END PGP SIGNATURE-----

1 0