December 2003 - cypherpunks-legacy

Secure EDI over Internet
by xpat＠vm1.spcs.umn.edu 17 Dec '03

17 Dec '03

Summarized from PC Week, Nov 28th, page 44: -begin- Premenos Corp now testing product to foster Electronic Data Interchange transactions over the Internet. Technology licensed from RSA Data Security Inc provide the security features, encryption, authentication, and guaranteed message delivery. Carl Redfield, VP of manufacturing for Cisco Systems Inc, was quoted as saying, "Security is the most important factor to us, as it is now, anyone could intercept messages off the Internet." Cisco is involved in testing the new product. The Premenos suite will be available first quarter 95. Pricing not set. These phone numbers were given for more info: Premenos (800) 426-3836 Cisco (800) 553-6387 -end- regards, -pd-

1 0

Re: How to disable telnet to port 25
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> The Al Capone of the Info Highway says: > > A while back, there was a discussion about how to fake a from > > address by telneting into port 25 in a site. Many people discussed > > the pro's and cons, but I wanted to know if anybody knows of a way > > to stop people from getting in there to send the message in the > > first place. > Sure. Turn off mail to your site. You don't have to go quite that far (almost, but not quite :-) You can do things like only accept your incoming mail via uucp, which has a whole different set of holes and limitations, but which is supported by a number of the major network suppliers. If you're on dialup access anyway, uucp is fine. If you've got a real IP feed, uucp-over-tcp has slightly more authentication than smtp, and can turn off anonymous access, but that basically means you're transferring your trust to your MX forwarder's security system, which presumably still speaks port 25. Bill

1 0

UN_nab (Re: an96489)
by John Young 17 Dec '03

17 Dec '03

Responding to msg by an96489(a)anon.penet.fi () on Tue, 29 Nov 1:8 AM >Due to the double-blind, any mail >replies to this message will be anonymized, and an >anonymous id will be allocated automatically. You have >been warned. Dear an96489, Penet.fi warning jams lob of UN_nab. Kiss twice wid nice nym-id.

1 0

Re: School Admins
by Ferguson 17 Dec '03

17 Dec '03

(My apologies for losing the article to which this is relevant) This is in regards to compiling PGP, and distributing it to those of us who are on restricted systems. My provider, the state government does not allow me (or anyone else) to use cc. The platform is DEC Alpha OSF/1, and if anyone has access to a compiler and would be willing to put the binaries for PGP(preferably 2.6.2, but I'll take what I can get :) and/or gcc up for ftp somewhere, I would be very grateful. Brad

2 1

Privacy Digest - the future
by Gary Jeffers 17 Dec '03

17 Dec '03

THE FOLLOWING IS FOR INFORMATIONAL VALUE ONLY & IS DOES NOT ADVOCATE THE BREAKING OF ANY LAWS. Dear Cypherpunks, Well, I think enough damage control has been done with my original Privacy Digest post. Now to pick through the ashes & see if I can come up with anything of value. The ideas & services presented in the Privacy Digest advertisement e are still very good. I think that bright segments of the upper classes commonly do have access to these services. The trick would be to bring these services to the class masses. I think that it would have been hard to do this in the times before the great amount of electronic privacy software & infrastructure that have been built up. Now that we have the tech. investment, I think that International financial transactions could be privately done for the people. What we need mostly are lawyers & financial experts that are willing to deal with the middle classes & who are aware of & want to deal with Cypherpunk technology. That would probably mean two or more people. One would be the international law/money expert. The other would be the communications expert. Do we have a shortage of lawyers who want to live & work in tax haven vacation spots & get rich? If our Cypherpunk lawyers are afraid of wrecking their reputations with States, then maybe they could get "little" lawyers to do the front work for them. We seem to be up to our asses here in the U.S. with lawyers & I hear they are starting to have a hard time making careers. However, there is a huge market for lawyers financial experts that is unoccupied in the masses money privacy area. As to the Cypherpunk tech.s, I think that for a good salary, they could be convinced to go to a vacation spot & do what they really want to do anyway. They would, of course, own a portion of the Corporation so that a successful venture would mean a secure future. It really needs one model experiment to open it up. After that, other groups could model themselves on the first & we would wind up with a giant private economy. - a true free market! I would suggest that the team just start out with a couple of services. I would suggest check & money order cashing & funds trans- mitting service & possibly an e$ clearinghouse. Once these activities were successful, then other services could be added on. When this business starts making good money, then they could afford to pay Cypherpunk programmers for their work. They could also afford to pay remailers for stable services. This would, of course, snowball. More money means better privacy software & better privacy software means a safer & more committed private money business & thus more money for more & better privacy software & privacy infrastructure. So far, Cypherpunks & associates have been like "all dressed up & no place to go". That is, we have a lot of good software & systems & hardly anyone making good use of it. An offshore, money privacy business for the general public that wanted Cypherpunk tech. would have use for most of it & a demand for more of it. It is my view, that what is most needed now, is a model offshore private money services company which uses Cypherpunk tech. & actually makes money. With that as a nucleus, the TRULY private economy would skyrocket & the Cypherpunk dream would be realized. Yours Truly, Gary Jeffers

1 0

INTERFACING PGP WITH
by nobody＠nately.UCSD.EDU 17 Dec '03

17 Dec '03

|> If you don't have finger access, mail me privately, and I'll send |>the file to you. JA|If you don't mind, could I have a copy? finger is disabled here... If you can't use finger from your site, send mail to mg5n+finger(a)andrew.cmu.edu and put the address you want to finger in the message. He's the greatest, eh...

1 0

Re: Need program pointers
by cwedgwood＠cybernet.co.nz 17 Dec '03

17 Dec '03

storm(a)marlin.ssnet.com wrote: _______________________________________________________________________ I presently use Xtree Gold. It has a DoD and 6 pass Wash Disk feature for writing over usused areas of a disk/drive. So far I have been unsucessfull at recovering any data after Wash Disk with Norton Utilities or PC Tools. If there is a weakness in Wash Disk I'd like to hear about it. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Actually XtreeGold doesn't wipe disks very well. It simply creates a file in (in root) as big as there is free space on the disk. This is fine provided the file have rubbish in it - but with XTG its all blank.... wash you disks then do and undelete from root and you will find a (usually large) file. Look at it - its all blank.... Because the data is all blank (zeros) an anomalie search would produce probably ALL of the data that was there originally..... I have a program (written by me) that writes pseudo-random mess to the disk for a specified number of times. I am also working on another program which clears any data that remians in the last clusters of a file (i.e. past the EOF point). DOS 7 will do this automoatically I'm told (haven't lood and the beta is too messy to bother with). Chris P.S. Sorry for extra spaces in the quoting... my comm prrogram is somewhat broken....

4 3

To: Pr0duct Cypher Re. PGPTools and Mixmaster
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I am using PGPTools to handle all the crypto functions in the second generation remailer that I have written. All the copies of PGPTools that I have found seem to be set up to compile on SUN workstations only. Mixmaster is both a remailer and a front end, and therefor must run on many different platforms. I have been able to compile PGPTools on Linux and FreeBSD, but PGPTools produces invalid RSA blocks. If you (or anyone else reading this) have ported PGPTools to other platforms could you send me the source and makefile, or point me to them. If not, could you help me do it, the source code is a tangle, and it will take me a long time to do on my own (I am a brute force programer, not a C wizard). Many thanks Lance Cottrell -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLtrWYVVkk3dax7hlAQElaQP9EZawmQ/sBXg4h7aUsrFAOK/W62m4Ie+r oS61kT7Lu6YqoC4lElwYomaU5ofyDaGDVdlph9J1a9rurqCXxYtLfAAuQFEAznSl 2LEEupWm36vM5TYr0GGXaq2Q1LN04Bsc7TI1Q7kkqa97U0ixvi8HfoRjchvqXW4F i4R0RK0xP48= =fYrB -----END PGP SIGNATURE----- -- Lance Cottrell <lcottrell(a)popmail.ucsd.edu> http://nately.ucsd.edu/~loki/ Home of the remailer chaining script "chain". PGP 2.6 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

Re: "You aren't following the _rules_!"
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim wrote: >I have little means of solving the Netcom-Macintosh-elm-Eudora issues, >and I don't see others solving them especially cleanly or usably, so I >expect that the "sign your messages or else" dictum would have a >predictable result, for me. I don't want to restart the "If the output wont work on a stack of Hollister cards the system sucks" thread, but Tim is here, as he is most of the time, right. After two years, we still have not made it much simpler to integrate PGP/whatever into a mixed OS environment. >And isn't it up to the _readers_ to decide if they don't want to read >my messages because they think I'm not being diligent enought, or >because my messages appear to be forged? Few readers on this list would think that Tim is not dilligent enough. A forged message would not be able to fool us for long. The problems is that is no simple way to integrate PGP with the many newsreaders, mailers, etc., that are being used on the net. This is unlikely to change until there is a new, acceptable, RFC for mail that implements digital signatures and encyption (if desired) without user intervention. >Isn't end-user choice the core of the Cypherpunk ethos? Yes, choice is what Cypherpunks are (I hope) about. Choice through crypto. Unless crypto spreads we will face ever reduced choice. Crypto will not spread unless there is a demand. Most people, including one of (the?) leading thinker(s) of the group on the net that most supports cryptography believe that the added security and privacy that cryptography provides are not worth typing a few commands or clicking a few buttons. I myself rarely, if ever, sign my post. If WE don't even use crypto ourselves, who do you think else uses it and who do you think will therfore care if the government chooses to outlaw it? We don't have a motivation to use crypto. We all realize that there is really no need to encrypt/sign the vast majority of the stuff we are sending. There may be the occasional message that we will encrypt and we are well aware that we encrypt that message for the very reasons that the powers-that-be want to see encryption outlawed. There are no better tools for integration of crypto today, because there has been no need. The few times you actually need crypto you can punch the commands "by hand". I do not mean to belittle the work that has been done, but unless the encryption is built into the mailer and using a remailer means clicking the "use X remailer(s)" button, and the mailer better know which ones are working and do the PGP envelopes, it won't happen. Hell, I have been on this list for two years and today I decided against posting that updater everyone was begging for to USENET because I didn't want to spend the 15 minutes it would take me to look up the address of a mail-to-usenet gateway, find out which remailers are working, binhex the thing, and past it into the remailer interface. Yes, I know the 3 or 4 URL's it would take to do all that. Suppose the world will have to wait until that computer makers's FTP site is up again. <No, I don't see anything wrong with posting software that is available via FTP to USENET. Flames -> /dev/null> We are stuck: No need -> no development of tools -> no spreading of crypto beyond the "hard core" -> no public resitance when crypto becomes illegal. So how can we prevent crypto from becomming illegal? Just follow the above chain backwards. Create a need. Create mailing lists that require signed messages. Create ftpsites that require signed uploads or whatever. Require the use of crypto. Not to partake in some involuntary interaction with the government (that will happen without out help), but for some voluntary interactions between people on the net. Sending mail to cypherpunks is such a voluntary interaction. Requiring it here just might result in better tools in the long run. Just an idea, if it sounds like garbage, forget about it. - -Lucky, who wouldn't think of signing this post and only does it to show that requiring it for posting just might get people to do it. -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLtrswASQkem38rwFAQFZ0AQAixcrK7wNFJzisuA3v8FefURUt05NYj23 AyJw9TVoyWuo4gdDiao1/3dC43ZIgVSvTTGXKZ8cy5a4YcFyMLMEKumNfyn7FM/l PLzcOYXfCWp2/KlfY4cQs4nlUEDvheiTmgXE+2VRle00WHwL+ctm/Tx1i/mxD3BS 7Zo79IIOQyg= =ZSOT -----END PGP SIGNATURE-----

10 13

A possible solution
by Aron Freed 17 Dec '03

17 Dec '03

I was sitting down and thinking about the problem of responsibily of using non-escrowed public key cryptography. Well here is a possible answer. Law enforcement agents have several different methods of finding out about crimes that might happen. And this means they wouldn't be allowed to tap phone lines or use key-escrowed systems like Clipper. Then people who do use non-escrowed public key cryptography for illegal actions would have problems. If they are caught by other means such as tips from anonymous sources and are then caught doing something illegal and they are also using non-escrowed public key cryptography to commit these illegal acts, then the fines and jail time should be increased. This reasoning is based on the fact that we need to be more responsible with technology. Therefore, the government would allow us to go on about our business using non-escrowed key systems, but if misused by the public there would be harsher punishments to the misusing individual. There are plenty of informants out there who can help the law enforcement agencies. We use public key crypt such as PGP. They won't be able to read it, but if there is misuse and the peron is convicted of a crime and is using PGP or some other non-escrowed system to commit the crimes he was convicted of, it's more trouble for him. TO me this is the best solution and it's the only thing I would allow. The government cannot be allowed to tap our phone lines the way they would like to using CLipper or SKE or some other type of system. We need to keep our rights but we need to still make it known that PGP is not meant for corruption and illegal use. IT's meant for private conversation in it due time. I need feedback desperately on this idea. I am incorporating this idea into a two page paper called Dealing with Technology in the Future. I want this to be part of the solution. But I would like to know what others feel about this idea. Aaron 513-276-3817 voice s009amf(a)discover.wright.edu Big Government Sucks!!!

7 9