December 2003 - cypherpunks-legacy

Remailer list needed
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Does anyone have a current listing of all the remailers? If so could you please send it to me as I would like to put it up on the auto-responder. Thanks, Sam ============================================================================== We love your adherence to democratic principles. - George Bush speaking to Ferdinand Marcos, June 1981 ============================================================================== skaplin(a)skypoint.com | "...vidi vici veni" - Overheard | outside a Roman brothel. PGP encrypted mail is accepted and | preferred. | Change is the only constant in the | Universe..."Four quarters, please." E-mail key(a)four11.com for PGP Key or | Finger skaplin(a)mirage.skypoint.com | Smile!! Big brother is watching. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: This message digitally signed to verify the identity of the sender iQEVAwUBLvfooMlnXxBRSgfNAQGLlQf/TzjZCzrZhMYWgs7XqGeV9+35XXmrjy+f jqVseykiY3n3iEVDALIJobRCPATS962N1k2EinVHea0dKt+F6NA4xsrGStFdoneT bVeoPwSgXGqghVyy88gRwiSHHFincIztHnV4A/r59B/Nz/4hawmYD0vo9SZeHhrv ruBhWSJH6Cw/4Xh+17PgreLfpLCILFF0EFmXiiXrZ5dSsQZJ2aOD5LqN0TTbdxyN uakm0WPao1WTCx2yT+SiLLex55lTzHrgfvP/gINwDbUA1TUl64OEYGsjxyl7gHWw mCQrLFX0XxvAunB223aTBYNiGDyhy9P8BCN3yf95yYkxoCzq4pre6w== =YR7W -----END PGP SIGNATURE-----

1 0

Why I do what I do.
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I had a very telling conversation with my wife today. I was working on some procmail stuff while she thought I should be doing something else. After about a ten minute diatribe, she said "I don't know why you spend all that time messing around with that crypto stuff. What point does it have?" I responded, "Do you remember when you were a little girl, and you told your best friend a secret?" She replied with a testy "YES." "All I'm trying to do is make sure our children will be able to do the same, because with all the developments lately this may not be possible." After about ten minutes of silence, I got a very soft "I understand." The reason I have brought this conversation up is to make a point. You can have the best technology around, but if people can't relate to the general concepts involved as it relates to them, the war is lost. Sam ============================================================================== Television is the first truly democratic culture - the first culture available to everybody and entirely governed by what the people want. The most terrifying thing is what people do want. - Clive Barnes, in "New York Times", 1969 ============================================================================== skaplin(a)skypoint.com | "...vidi vici veni" - Overheard | outside a Roman brothel. PGP encrypted mail is accepted and | preferred. | Change is the only constant in the | Universe..."Four quarters, please." E-mail key(a)four11.com for PGP Key or | Finger skaplin(a)mirage.skypoint.com | Smile!! Big brother is watching. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: This message digitally signed to verify the identity of the sender iQEVAwUBLvfouslnXxBRSgfNAQGMOgf9Er7usAgpi1H9PgTDQ6Sp6wvy3F9KL5Ly 8SxYO8wkIybIWcLTjuvC18MUQNe9dUTpLqSmjOsZqxIFvlkLna0HEwyO5d53Vta6 1yhLByTWoEiBuP2xfnSDWG19/uEivOGyZdlTjtJ0w6aquDlGepkGuWUFGEuhY0ee +45NjzSoCluQhn5elzA79bNvp4OkQMnbCdzk6ZXD6uO1w0iGXyEKRd8V9TXig5Ir 2QXbZDqayW2B6TJP7m+kyPgdJAOxJia3LLZe0icBW7Et9jdys0lolAIGfHHe9LLL dRMQnstSfxcvzDrhxEmZze/Jj9uP2S6WY3fKANO9IwwAugxrp92R8Q== =Iyk6 -----END PGP SIGNATURE-----

1 0

CFS for Linux
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- FYI: Forwarded message: > To: cypherpunks(a)toad.com > Subject: New version (1.2) of CFS now available > Date: Fri, 02 Dec 94 18:05:00 -0500 > From: Matt Blaze <mab(a)research.att.com> > > Source code for the latest version of CFS (release 1.2), the Cryptographic > File System, is now available upon request for research and experimental > use in the US and Canada. [...] > The software was developed under > SunOS and BSDI, and there are also unsupported user-contributed ports > available for AIX, HP/UX, Irix, Linux, Solaris and Ultrix. We really > can't promise to provide any technical support at all, beyond the > source code itself. We also maintain a mailing list for CFS users and > developers; subscription information is included with the source code. [...] > * Copyright (c) 1992, 1993, 1994 by AT&T. > * Permission to use, copy, and modify this software without fee > * is hereby granted, provided that this entire notice is included in > * all copies of any software which is or includes a copy or > * modification of this software and in all copies of the supporting > * documentation for such software. > * > * This software is subject to United States export controls. You may > * not export it, in whole or in part, or cause or allow such export, > * through act or omission, without prior authorization from the United > * States government and written permission from AT&T. In particular, > * you may not make any part of this software available for general or > * unrestricted distribution to others, nor may you disclose this software > * to persons other than citizens and permanent residents of the United > * States and Canada. > * > * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED > * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY > * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY > * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. > > If you would like a copy of the CFS source code, please send email to: > > cfs(a)research.att.com > > DO NOT REPLY DIRECTLY TO THE SENDER OF MESSAGE. You must include a > statement that you are in the US or Canada, are a citizen or legal > permanent resident of the US or Canada, and have read and understand > the license conditions stated above. Also include an email address in > a US or Canada-registered domain. The code will be sent to you via > email in a uuencoded compressed tarfile. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvfrsSoZzwIn1bdtAQHvcwGAn9qkYDbPDazGCM9Pg/8CDyTAgxm10Nj2 LB/Ek/NnzOTG8ywki0CEbF8B9ei2pxWH =bPdS -----END PGP SIGNATURE-----

1 0

Re: Remailer list needed
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- > Does anyone have a current listing of all the remailers? If so could you > please send it to me as I would like to put it up on the auto-responder. This seems to be the most popular question on c'punks lately. Raph posts his list periodically (weekly ?), but perhaps he should move it to every other day or daily. I think it would be worth posting more frequently here. I never tire of answering this one, though.... :) Anyway, the standard ways of accessing the latest list are: finger remailer-list(a)kiwi.cs.berkeley.edu http://www.cs.berkeley.edu/~raph/remailer-list.html I don't know of a way to get it automatically via mail. Since, short of Web access, Internet mail access is a necessary condition for using a remailer, I've been meaning to hack something together for Raph to handle this lowest- common-denominator means of access. So I think it would be great to see you set it up for autoreply, Sam, if you can hook it in to the source for regular updates. The list (from finger) as of just after I typed this follows: $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut post ek"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)replay.com> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek" ; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; $remailer{"q"} = "<q(a)c2.org> cpunk hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Wed 21 Dec 94 2:00:01 PST remailer email address history latency uptime - - ----------------------------------------------------------------------- usura usura(a)replay.com **++*+*****# 6:59 99.99% alumni hal(a)alumni.caltech.edu *****+*****# 4:05 99.99% nately remailer(a)nately.ucsd.edu ++++.+++++++ 1:08:49 99.99% penet anon(a)anon.penet.fi ***+*+****** 32:46 99.99% portal hfinney(a)shell.portal.com ***********# 2:13 99.99% c2 remail(a)c2.org +-+++++-++ + 39:26 99.99% ideath remailer(a)ideath.goldenbear.com *++**+****** 9:35 99.98% bsu-cs nowhere(a)bsu-cs.bsu.edu *++********# 4:43 99.97% mix mixmaster(a)nately.ucsd.edu +++*.++++++- 1:17:13 99.97% vox remail(a)vox.xs4all.nl ..-----...-+ 15:20:51 99.99% q q(a)c2.org *-+--++- 3:46:16 99.88% rahul homer(a)rahul.net **** ****--# 27:49 99.67% soda remailer(a)csua.berkeley.edu .......... 9:50:58 99.61% desert remail(a)desert.xs4all.nl -------.-. 16:26:44 99.99% xs4all remailer(a)xs4all.nl **+ +**** # 7:14 99.41% flame tomaz(a)flame.sinet.org *+-++**+* +* 8:51 98.09% jpunix remailer(a)jpunix.com +-++**+* +# 8:25 97.96% rebma remailer(a)rebma.mn.org --___..-.--+ 21:50:14 90.15% extropia remail(a)extropia.wimsey.com -+ 5:00:06 17.69% -L. Futplex McCarthy; PGP key by finger or server "The objective is for us to get those conversations whether they're by an alligator clip or ones and zeroes. Wherever they are, whatever they are, I need them." -FBI Dir. Freeh - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLvf9+Gf7YYibNzjpAQF+FwQAiqHC78uctkIG5vX+YF+H/EN8RodOLt6s EZjJW3BGbFitC20++3MfPJ2wUVFXLcNxUpXY1gEcbxMttNPaMayK4VrKNWFzZ7BT p1iKeb82Im+GYyL0EHvhtS8eDiyuPAyBSibQYjPppY/wfl5qW70FpxJ6hWc/4Avf twIJ5XYXFcU= =MO7e - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLvf/oSoZzwIn1bdtAQE+jwF/RcW6oTb23KEqrgDUfVeB0p6KMPGaL6hF 5/I3/BqjqvAY0FrsHkdPTTvI9LDNjyOc =YjJG -----END PGP SIGNATURE-----

2 1

Making sure a program gets to the receiver intact
by an169306＠anon.penet.fi 17 Dec '03

17 Dec '03

How can I insure a program, once put on FTP sites stays untampered with? I have done the following, but I still find holes: 1: PGP signed each file with a seperate .sig file. 2: Made a MD5 list, using 2-3 seperate programs (making sure they agree), PGP signing the list, and asking friends to sign the list, leaving seperate .sigs in the directory. 3: Encrypting a copy of the MD5 list with a passphrase (if all keys are fragged, then in front of trusted witnesses, I can decrypt the key, show them that the MD5 list is authentic.) 4: PKZIPPING it using my AV key. (Yes, I am aware that this is a joke, but since I am a registered user, why not use it?) (Side note, if one uses PKZIP, please register it. I have seen so many unregistered copies of this, that it makes my eyes water.) The holes: 1: Someone hacking the keyservers, substituting a key for all the people who signed, and modifing the archive to show that. 2: Someone breaking into my apt, sticking a keyboard monitor on, getting my passphrase and key. Most of this is theoritical, as it is hard to hack _all_ keyservers to nuke my PGP key, then hack AOL, compuserve, and other FTP sites to modify the binary, but I would like to make _sure_ this program gets into user's hands without getting modified. (Not for paranoia reasons, but just to see how well one can make a package resistant to tampering.) Pardon the anonymous ID, as my reputation with my REAL user id is not so great. (No, I am not Lance, but not that better off due to tons of dumb mistakes with my regular ID on this list.) ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

Re: GUI: PGP vs novices
by bshantz＠spry.com 17 Dec '03

17 Dec '03

Thomas Grant Edwards Writes: >PGP has made me more crypto aware, but at this point neither I nor most of >the crypto aware people I personally know feel there is a need to either >encrypt or sign messages on a regular basis. It is my own personal opinion that in order for crypto to truly become mainframe, the software manufacturers of internet connectivity packages must integrate crypto into the applications. Look at the past threads here on Cypherpunks..."How do I write a script to put PGP into ELM?" "PGP DLL modularity" etc. In order to bring crypto to the masses, we have got to convince people that it is necessary. We also must make it "second nature". It sure is nice to have a menu option or a toolbar button that will encrypt plaintext automatically. Key management and some of the "high tech" (I know, for us it's nothing, but for my dad who just bought a computer and doesn't understand the difference between click, double click, and drag, crypto is a really high tech thing just in itself.) things of crypto should not be directly handled by the user. (Optional of course. On a privacy level, the user should have full control. But give the user a break...if the software is secure..as such...so is the user's privacy.) You will notice that this message is not signed. That's because in order to sign it, I would need to save my message, hop out to a DOS box, PGP encrypt it, hop back to my mail program and insert the encrypted mail as a text file. That's enough to discourage the average user. This is pretty much what Tim May was talking about when he discussed why he doesn't sign his messages. It's not that he couldn't... it's just not practical for him. It's not really practical for me either, but I do it when I feel it's necessary. The only way to make crypto practical is to basicalloy hide the technical side from the user and make it easy. That's my two cents. >>>>>>>>>>>>>>>>>>>>>INTERNETWORKING THE DESKTOP<<<<<<<<<<<<<<<<<<<<<<< Brad Shantz bshantz(a)spry.com Senior Software Engineer SPRY Inc. Direct #: (206)-442-8251 316 Occidental Ave. S. Main #: (206)-447-0300 Suite 316 Fax #: (206)-447-9008 Seattle, WA 98104 WWW URL: http://WWW.SPRY.COM ---------------------------------------------------------------------- PGP Public Key at: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or email: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET bshantz >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

2 1

Re: c'punks top 5
by Rich Salz 17 Dec '03

17 Dec '03

> I was reading about socks last night, and it does seem to be very close > to what is needed for this. Somebody, I forget who, had a hospitality suite at a Usenix LISA conference. They have a commercial version of socks. I don't remember if it was bundled or an option. At any rate, kinda neat that someone is providing privacy tools rather then the other way round. /r$

1 0

Have 2.6.2 but cant gen 2048 bits
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

All, Following is the output from pgp2.6.2 and me trying to generate 2048 bit keys. What am i doing rong? ;pgp -kg Pretty Good Privacy(tm) 2.6.2 - Public-key encryption for the masses. (c) 1990-1994 Philip Zimmermann, Phil's Pretty Good Software. 11 Oct 94 Uses the RSAREF(tm) Toolkit, which is copyright RSA Data Security, Inc. Distributed by the Massachusetts Institute of Technology. Export of this software may be restricted by the U.S. government. Current time: 1994/12/22 07:47 GMT Pick your RSA key size: 1) 512 bits- Low commercial grade, fast but less secure 2) 768 bits- High commercial grade, medium speed, good security 3) 1024 bits- "Military" grade, slow, highest security Choose 1, 2, or 3, or enter desired number of bits: 2048 Generating an RSA key with a 1024-bit modulus. You need a user ID for your public key. The desired form for this user ID is your name, followed by your E-mail address enclosed in <angle brackets>, if you have an E-mail address. For example: John Q. Smith <12345.6789(a)compuserve.com> Enter a user ID for your public key: Thanks T

2 1

Kiwi cypherpunks
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

Lads (and lasses), I seem to be having a bit of troub communicating we the kiwis on this list directly, but no probs if I send to the list. Has there been and communication on this topic in the last 3 or so days??? We cant organise anything if we cant talk to each other! T

3 2

Re: GUI: PGP vs novices
by bshantz＠spry.com 17 Dec '03

17 Dec '03

Jeff Licquia writes: >>You will notice that this message is not signed. That's because in order to >>sign it, I would need to save my message, hop out to a DOS box, PGP encrypt >>it, hop back to my mail program and insert the encrypted mail as a text file. >>That's enough to discourage the average user. This is pretty much what Tim >>May was talking about when he discussed why he doesn't sign his messages. >>It's not that he couldn't... it's just not practical for him. It's not really >>practical for me either, but I do it when I feel it's necessary. >Just a small nit, but it appears that you're running something >Windows-compatible on your desk (the DOS box and all that). Are you aware >of the good Windows tools for PGP? The particular one I use (PGPClip by >Mike Meyer) uses the clipboard, and is very nice and simple. Exactly my point Jeff. Thank you for justifying what I said....**WINK**, **GRIN**. In order to even use PGPClip, it involves something OUTSIDE the mail application. (Although, it does sound intriguing to me.) Anyway, this is yet another example of the user needing to be fully conscious that they are signing or encrypting. It should be second nature. In order for it to become second nature, it MUST be included in the design of the mail package. (Or News reader, or FTP software, whatever.) Third party utilities make a piece of software harder to use. That's a given. Now, don't get me wrong, there are some nice thrid party vendor products out there. But, I have yet to see a crypto product that merges (cross platform) into a mail package smoothly. >Not a flame, or even a spark. Just wanting to make life easier for crypto >enthusiasts. Didn't see any sparks at all, Jeff. I am interested in PGPClip (at least to look at) does anyone have an FTP site pointer where I could find it? -- Brad >>>>>>>>>>>>>>>>>>>>>INTERNETWORKING THE DESKTOP<<<<<<<<<<<<<<<<<<<<<<< Brad Shantz bshantz(a)spry.com Senior Software Engineer SPRY Inc. Direct #: (206)-442-8251 316 Occidental Ave. S. Main #: (206)-447-0300 Suite 316 Fax #: (206)-447-9008 Seattle, WA 98104 WWW URL: http://WWW.SPRY.COM ---------------------------------------------------------------------- PGP Public Key at: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or email: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET bshantz >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

1 0