December 2003 - cypherpunks-legacy

Re: Another problem w/Data Havens...
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Data havens that can split data to two or more locations in seperate >jurisdictions can effectively ignore attention from authorities not >related to the site management or site preformance. Encryption mandated >sites can also take this stance, while encryption is legal in any event. It just occurred to me when reading this another method for ensuring the "I can't tell what's in it" condition with a data haven operator. Why not use a secret sharing system where the contraband data is split into a number of pieces and sent to different havens? It could be argued that the individual pieces are not the same as the whole, and there is absolutely no way the operator could recover the original from a given piece (thus providing plausible deniability.) Using M by N secret sharing, with M < N, you build in some redundancy in case one of the havens gets shutdown. Ok, Eric, go ahead and blast your holes in this argument :) == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)scruznet.com -Isaac Asimov -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLxspxk1Diok8GKihAQG4FAQAjCaFOGC+N5zjQ3zVQstv75wxBp/d0js1 2a3ecWdD/S3Sv70l9Y2N4e4vja8Pps4eR1a7Gtzq/nWcHmZXRGRgCzaaHGCNibF5 RaIJUlGGpaKe/UaQ3XfZH2guRBSUCIi4To7QWf3CzpZoWkR4gmZhhB1AcZrd6Z34 WYqZUBwuISI= =68Mc -----END PGP SIGNATURE-----

4 3

Re: Abuse and Remailer Ethics
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 9:21 PM 01/16/95, Homer Wilson Smith wrote: [snip] > Does any single recipient have the right to demand that they be >blocked from all anon messages. I would say yes. > > How about demanding blocking anon messages only from some >senders? That is harder to implement. If you block the sender, you >block ALL his postings, not just to that party. So you would need to >block specific From: and To: combinations. This would not work with >chaining at all, even if we did share blocking information. So that >is out. > > Does a list owner have the right to demand blocking to his list, >with or without a vote of the list readers? I would say yes. > > What about a newsgroup? I would say it takes a vote. Are anon voites >allowed? Touchy question that was important at one time on >alt.r.scientology. I agree with all of that. Somewhat conditionally with what you say about newsgroups, because while it sounds nice, it would be hard to implement. I'm tempted to say that a newsgroup, by it's nature, doesn't have any mechanism for control/government, once created. And as such, doesn't have any way to "decide" not to accept anonymous posts, or posts from a specific user or remailer. So I'm tempted to say "tough luck" to newsgroups that don't like receiving anonymous posts. The alternative is for people interested to create a moderated newsgroup, where of course the moderator could refuse to allow anonymosu posts with or without the remailer operators cooperation. > Anyhow I would guess that the correct action here is to write the >offender and let him know a complaint has been registered against him. >I would also educate him as to why he was so easily traced and tell >him that if he wants to avoid such in the future to start chaining. Yes, I think that is an excellent course of action. > However if he is a determined abuser not prone to social >embarassment, then the sharing of blocking among remailer operators >might become a very good idea. I'm not so sure about that. It might become neccesary, but blocking remailer delivery to a particular address is a _much_ more desirable solution, in my opinion. If a particular person doesn't want to receive anonymous mail, fine. And it might be good to have a mechanism by which he could make those desires known to all remailers, so he doesn't have to do it individually. But if he does want to receive mail from the remailers, I think he's got to receive all mail from the remailers, and not count on the remailer operators to play Identity Detective and try to screen out people he doesn't like. Same with a listserv and the requests of the listserv operator. A newsgroup is, of course, more touchy, because there really _isn't_ a way for "the newsgroup" to decide not to accept anonymous posts. And I'm not really sure there should be. Part of the answer relies on how "independent" your remailer is. If you _were_ to take no action at all to people who complain about "abuse", would you get in trouble? (from school, company, service provider, country). If you would, then you've got to decide if you are willing to take the heat. And your probably not willing to take the heat for Cantor & Siegel to spam the net. So you've got to do what you've got to do. But, personally, if I ran a remailer on a machine that wasn't subject to political pressure (from school, service provider, whatever), I would never make any effort to cooperate with other operators to track down "offenders", and I'd never exclude any newsgroups from delivery. Because I wouldn't want to play censor and decide what "offense" is worth tracking down, and what isn't. And because even having the _capability_ to track down people is really dangerous, when you get pressure to track down someone you _don't_ want to track down. Much better to say "Can't be done, don't have logs, can't figure out who it was," then to have to admit "well, I've tracked down 5 people in the past month cause someone complained about them." Kind of ruins the point of anon remailers. Best would be to have tracking down be impossible, and it would be close to, if not entirely, impossible if the user took the proper precauations. But even if it's possible, it's probably best not to develop a mechanism to do it.

9 13

Re: 40bit Encryption : Adequate or sadly lacking ?
by kipp＠warp.mcom.com 17 Dec '03

17 Dec '03

In article <3fh5m0$7tg(a)hdxu03.telecom.ptt.nl>, you write: > In article <marca-1201952123120001(a)boulanger.mcom.com>, marca(a)mcom.com > says... > > > >There's no question that 40-bit is less than one would prefer. > >This is why we are/will be supporting 128-bit RC4, for example, > >in US-only products, honoring United States government export > >restrictions. > > Marc, isn't it possible (legally) to deliver products with a replaceble > encryption library (dll). Delivery with a 40-bit key DLL. The user has > the option to install a dll with a different keysize. Somewhat like > winsock... > > Yes, I've seen the article suggesting a foreign office. I think an open > interface would do gooed for the whole field. I.e. ftp, telnet, etc. as > well. Actually, it's probably worse than you think: There are govt's out there that won't let you import code that is "encryption ready". You must prove that your software is tamper proof before it can be imported, and tamper proofing means that you can't bolt on security. Also, I believe the export laws disallow "plug in" security in the US... The crypto legal world sucks.

4 3

Re: Another internet story: INFO: NBC Nightly News Tonight (fwd)
by mclow＠coyote.csusm.edu 17 Dec '03

17 Dec '03

>A story regarding the Internet, with some sort of mention of NRA.org, >should be on the NBC Nightly News with Tom Brokaw tonight. > It did not play out here on the left bank, probably because of the earthquake in Japan. Maybe tomorrow. -- Marshall

1 0

Remailer Abuse (fwd)
by Homer Wilson Smith 17 Dec '03

17 Dec '03

Here is the message I sent to both the complainant and the complainee. Homer Dear ..... , I have been contacted by someone complaining about a posting you made through my remailer. They want me to tell them who you are, which ain't going to happen, but at the same time I don't like getting complaints, you understand? Of course I can not tell you who complained any more than I can tell them who you are. But you know where you have been posting using my remailer, right? Now I have no idea if what you posted was really abusive or not, I did not see the posting or postings, and I know a lot of people complain about 'abuse' when really its just their closed minds being opened up. I was able to 'trace' you because you sent something through my remailer without using chaining. If you had chained I would never know who the posting came from. I was told who it went too and the time, and its right there in my system's syslogs coming from you. If you chain and use PGP, then I could not have traced you. So read the instructions on chaining and make sure you USE it. You will be a lot safer in the future from complaint attempts than if you don't use chaining. If you have questions on how to chain, ask on alt.privacy.anon-server or read the various helps at many of the remailers. I have reposted this letter to alt.privacy.anon-server without your name and sent a copy to the complainant. I expect not to hear anything more about you, ok? Homer Wilson Smith System Adminstrator of Remailer at homer(a)rahul.net

1 0

Does encrypted equal safe?
by marko＠millcomm.com 17 Dec '03

17 Dec '03

> At 10:08 PM 1/11/95 -0800, Eric Hughes wrote: Edited from response on the 'How do I know if its encrypted?' thread to get some points in the clear. >If you can't read it, it's not kiddie-porn *for you*, although it >might be for someone with the key. > So the fact that its not kiddie-porn *for me* makes it safe *for me* to be transporting or storing for others that know it is kiddie-porn? >Encryption fragments meaning subjectively. A magazine, for example, >has a fixed center of meaning for all who can read the language. A >magazine looks the same to all who look at it. An encrypted file >looks different to those who have the key from those who do not. > But why does the meaning of the data assume to change? If I take my stack of kiddie-porn and put it in a box with a big strong lock on it, in a way physically encrypting it, change the meaning of what I have? I now have a locked box that looks different from my original. >Encrypted data is fundamentally different from paper-and-ink data in >this way. The metaphor of "planting it on somebody" does not apply to >data that the "somebody" can't read. It is fundamentally a different process, but does that make it different from the locking the physical data in a box as above? > >[...] If you can't easily read it, you >can't be expected to have read it. The operator of a data service has >_zero_ motivation to cryptanalyze something. If they happen to apply >a viewer to the file (for whatever reason), they don't _want_ to see >what's inside. > It seems to me that what you are saying is that because the data is in a form that I can't understand, I'm safe from trouble. Now it seems to me that this is not all that different from changing the form or appearence of physical data and saying I'm not responsible for it. Now think of a remailer: If somebody gave me this box of stuff, stuff that I had no idea of what it was since it was *locked up*, to transport over to location X and I got busted half way there am I safe? Would the argument that I didn't know what it was hold up? I would tend to say no. If the answer was yes, which is what some current arrguments seem to indicate, what does that say about responsibility towards spamming or remailing illegal data? Can I say that even though someone is using me to spam or distribute kiddie porn, I have no reason to try and stop it since I don't know what they are doing? If I did take it upon myself to stop the abuse wouldn't I need to analyize the incomming data to stop it? Something I'm not supposed to do. A Data Haven: It is illegal to handle certain items in the physical world. I can get in some trouble if I have kiddie porn or drugs or what not in my possesion. This is true, for most things I would guess, even if I was just 'holding it for someone else.' After all, how do I prove that somebody else put illegal articles, encrypted or not, on my 'site' and it didn't atually come from me? Does 'holding it for someone else' type arguments work in net.world better than in the physical world? Once again, current arguments would say yes, it is different and I'm safe to hold onto illegal data since I don't know what it is. Lets see if I got this straight. In my own words, I'm just as responsible for the data I massage as the person I'm doing it for judging by real world parellels, encrypted or not. Now I would hope this is not the case, since being a remailer operator would mean that if somebody starts a spam using my site I would be just as responsible as the person that started it. Having kiddie porn on my DH would be illegal even if I had no idea it was present. This doesn't sound to good, since many of the uses of my services would be restricted if I wanted to stay 'safe.' After all if I wasn't as responsible for the spam and was safe from harm, or guilt, about what people used my site for I wouldn't care what went through my system, I'm not really supposed to care what people send me right? In fact I may even take pride that my system is being used so much. ;-) But this doesn't seem to be the case, nor in some regards would I hope them to be. Now I'm getting confused. There seems to be some contradictions in some of the above that need to be worked out, or at least explained to me. Some pretty serious legal problems seem to be lurking with in. It just doesn't seem as cut and dry to me as the argument that if I don't know what it is I don't have to worry about it. I'm sure others will have some comments to help me sort this out. -Mark ---------- Mark Oeltjenbruns marko(a)Millcomm.com N0CCQ SnipIt Research Finger for PGP key.

2 1

Re: Abuse Complaint out of homer@rahul.net
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Michael wrote, to Homer and the lists > I am going to have to agree with you on this. > A Sysadmin would have to see the messages or data that is > supposed to be harassing the complainant. What I say is harassment > may be different from what you say it is. There's different levels of harassment. For the kind that says 1) "Don't send me any of this junk mail any more", if the recipient wants to define junk mail to the remailer-operator, there's no ethical problem if the operator wants to block remailed mail to the recipient, though it's good form in non-remailer-chain environments for the operator to issue a bouncegram if possible. If the recipient has to pay per byte/message to receive mail, or the amount transmitted is really excessive, then this is certainly something an operator ought to do to avoid problems. (It's potentially bad form for a for-profit operator to cash digicash postage for delivering the messages if he doesn't, at least without a warning in his pricing policy advertisment.) If the operator doesn't want to block remail to an unwilling recipient, the ethical and legal questions become more interesting. The question of whether the "don't bug me" list gets published is also interesting. For the kind of harassment complaint that says 2) "Block all remail to me from this destination", there are implementation issues - can the remailer perform checks like this before doing the header-munging? Is there more security risk? Of course, with chaining, it's a lot less useful. For the kind of complaint that says 3) "Block all remail to this group of people", there's the question of whether the requester is authorized to request that for the entire group - newsgroups are an especially interesting problem. Julf's remailer blocks posting to some newsgroups, because the readers have done the usual net.poll and decided they'd like him to block it, since lots of the remail was spam. But especially with newsgroups, it's easy for the recipient to trash incoming articles from the remailers. Bill

1 0

Re: Abuse and Remailer Ethics
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> OK, I understood all this. I am afraid that if we implement a total > no tracing scenario, then remailers will come under heat from the world at > large and the governments. Maybe not. Rright now, Rahul (a good guy) is > implementing syslogs whether I want him to or not, and that isn't about to > change. Really I would have to be the owner of my own system in order to > do what you are suggesting. You can do a good job of anonymous remailing even on a system that keeps email logs, if the system is otherwise trustable. When mail comes in to your remailer, store it in a file (encrypted....). Periodically take the files of stored messages, shuffle them, and mail them out. It's about the same behavior as doing the same from your own box with eavesdroppers on your network, though the traffic levels are a bit different if each remailer operator on rahul.net gets identified separately instead of all the remailers getting lumped together. But if there are multiple remailers on Rahul's machine, and if the syslogs don't log internal mail, you could also forward some of the remailer traffic randomly through other remailer-operators there. Bill

1 0

Scientologys Attempts
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

I just had a view into the alt.religion.scientology and alt.clearing.technology newsgroups. There are some messages about a Scientology decision to shut down every internet traffic about Scientology. If the messages are true, Scientology sent rmgroup Control messages to remove the groups. The request to stop the remailers seems to come from the same people... Hadmut

3 2

Re: Another problem w/Data Havens...
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Michael wrote: > This entire discussion is completely unnecessary. There are ways > of removing operator liability without examining the submission at all. Liability is a legal issue, not a technical one. (Catchability is a technical issue.) The basic ways to remove liability are to either run your system where the local laws don't object to information storage, or to reduce the operator's involvement to levels that the local legal system will tolerate. The former case is easy, if you can rent computer space in a country with a non-meddling government and good net access (or an easily rentable government :-).) For those of us in the latter situation, the discussion's still useful... On Mon, 16 Jan 1995, Johnathan Corgan wrote: > > It just occurred to me when reading this another method for ensuring > > the "I can't tell what's in it" condition with a data haven operator. > > Why not use a secret sharing system where the contraband data is > > split into a number of pieces and sent to different havens? Good, but still has most of the same old risks. Alice asks Dave's Data Haven to store stuff, and later retrieves it. Dave doesn't want to be able to know what's in it. There are three main threat periods - at receipt of the data, during storage, and at retrieval. Secret sharing is great for the storage period, assuming the data havens are in different jurisdictions and the cops can't force the operator (Dave) to go retrieve all the pieces. However, at receipt of the data, it's all in one place, Dave's inbox. If Alice encrypted it safely, or secret-shared it herself, great! But if Alice is a narc trying to entrap Dave with plaintext ThoughtCrime, or Alice's key has been compromised, anything in Dave's inbox is still toast, even if anything that's been split and stored is safer than if it had been stored unsplit. So he either needs to split it fast, shortening the window, or find a way to blind his mail before processing it, or split it before reading it. Splitting before reading isn't impossible in a stream environment. Define a protocol that looks like SMTP, but opens up three outgoing streams as well as an incoming stream, and uses standard mail formats. While reading the headers from Alice (either the real contents or just the handshakes at the beginning), Dave's receiver thinks about them and sends some meaningful headers to Moe, Larry, and Curly. Once the message body starts, instead of storing the incoming bytes, Dave sends every other byte to Moe or Larry, and the xors to Curly.* If he wants to get fancy, he can even encrypt the data with a stream cypher as he goes along, giving half the key to each of them. That way, Dave's system really only has knowledge of the headers, plus one line at a time of incriminating data on the fly. And his partners can't give anything away either; they're just stooges. * If the connections to and storage by Moe and Larry are reliable enough, Curly doesn't really need to be involved, but the xor business lets you reconstruct everything from just two parts. Bill "Privacy is not a crime!"

7 8