December 2003 - cypherpunks-legacy

REMAILER PROPOSAL
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, I put together the following proposal to demonstrate a quick and dirty way to implement a pay-to-play remailer system. I don't care much about the details. Change any of them you feel like. My main concern is the basic pre-paid postage system concept. If those of you who are--or plan to be--remailer operators like it, it's yours. No charge. If you don't like it, well, I guess it's back to the old drawing board. S a n d y P.S. I love the name Spoon-E; everyone else will probably hate it. Consider it one of those details that you should feel free to change. * * * THE ELECTRONIC MAIL FORWARDERS GUILD A Proposal In this Proposal, I briefly discuss the elements a mail forwarders guild might include. My main purpose, however, is to outline a low-tech, anonymous postage system that such a guild could deploy today. My proposed system is intended to serve only as a bridge until a more sophisticated, digital postage/money system is available on the Net. MISSION STATEMENT--The purpose of the Electronic Mail Forwarders Guild (EMFG) would be to: 1. Encourage the proliferation and use of privacy oriented electronic mail forwarding sites, 2. Encourage the adoption of privacy oriented electronic mail forwarding standards and protocols, 3. Create and deploy new products and services on existing electronic mail forwarding sites, 4. To provide mutual aid and assistance with regard to technical, legal and other problems, 5. Establish and maintain an anonymous electronic postage system acceptable by all EMFG members. ANONYMOUS ELECTRONIC POSTAGE SYSTEM POSTAGE RATES--The first questions the EMFG will have to decide concern how much the members wished to charge for their services. Such questions would include: Should each forwarding hop cost the same, or should first and/or last hops receive a premium? Should message lengths be limited? Should longer messages cost more than short ones? Should each kilobyte cost the same, or should each successive kilobytes cost less--or more? Will the EMFG support any free forwarding? What net postage-per-service should EMFG member receive? POSTAGE "STAMP" NAME--The basic unit of postage should be given a "brand name." Using a name instead of an amount, permits bulk discounts and allows price adjustments as circumstances warrant. I favor, "Spooner Electronic Postage Unit" or "Spoon-E" for short (pronounced, "spoonie"). Thus, no matter what a Spoon-E costs, it would always take one Spoon-E to go through one forwarder or whatever. SPOON-E STRUCTURE--Spoon-Es are random 12-digit numbers generated by the clients. POSTAGE ISSUER--The EMFG will need someone to issue Spoon-Es. The EMFG could elect any of the following options: Rotate the uncompensated job among its members, Have member bid for the job in exchange for fixed fee or a percentage cut of each Spoon-E issued, Hire a third-party to issue Spoon-Es in exchange for a fixed fee or a cut. PAYMENT AND ISSUANCE MECHANISM--There are various levels of anonymity available to clients. The choice will depend upon the client's degree of paranoia. They all, however, are processed following these steps: 1. Clients randomly generate a series of 12-digit numbers. 2. These random numbers, plus an extra random 12-digit ID number, are encrypted using the Issuer's public key. 3. This encrypted message and payment are sent to the Issuer. 4. After payment has been accepted, the Issuer puts the clients' random numbers into an "Outstanding Spoon-E" database, and lists the corresponding ID numbers on a "Just Issued Spoon-Es" bulletin board. 5. Clients may access the bulletin board to check when their Spoon-Es have been validated for use. The level of anonymity is determined by the clients' method of payment and transmission. Payment via money order is the most anonymous; personal check, the least. (Cash is even more anonymous, but with its own obvious risk.) The least anonymous method of transmitting the client's 12-digit numbers is via direct e-mail. The most anonymous is via an s-mailed floppy. E-mail through a forwarder is somewhere in between. USE OF POSTAGE--The following steps would be performed in order to forward messages through a series of EMFG sites: 1. Clients consult the Issuer bulletin board to verify that their Spoon-Es are valid. 2. Clients write their messages and include the appropriate number of Spoon-Es within each nested and encrypted "envelope" for each forwarding hop they intend to use. 3. Upon receipt, each forwarder strips out the Spoon-Es for that hop. The message is added to a mix file of other messages until a threshold number is reached. 4. When the threshold is reached, the forwarder contacts the Issuer and verifies the validity of the Spoon-Es. Valid Spoon-Es are removed from the "Outstanding Spoon-E" database and the corresponding messages are forwarded out of mix file in random order. The forwarder's account is credited with the appropriate payment. Messages with invalid or missing Spoon-Es go to the bit or into the free service channel if there is one. 5. Step "4" is repeated through each forwarder until the message is delivered to its ultimate destination. The various mix files help defeat traffic analysis and permit the Spoon-Es to be verified before the forwarding service is performed. CONCLUSIONS The existence of a for-profit (or at least self-funding), privacy enhanced, electronic mail forwarding system does not need to await the development of on-line digital money schemes. It can be deployed today, using readily available, low-tech methods. Such a system benefits from economies of scale, and thus argues in favor of the creation of a group of mail forwarders such as the EMFG. Sandy Sandfort 20 November 1994 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

1st Draft Mixmaster chaining instructions
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here is the first draft of the instructions for using Mixmaster to build remailer messages. I am posting it to give a flavor of what the program does, and to request comments, both on the features and on the clarity of the help file itself. Instructions for using Mixmaster to create type 2 remailer messages. I assume that you have either compiled Mixmaster, or that you have acquired a precompiled copy. While you do not need PGP to use Mixmaster, it is useful for key management, and is required if you desire security of the content of the message you are sending (which will be visible to the last remailer). Theory and purpose of remailers: The purpose of anonymous remailers (hereafter simply remailers), is to provide protection against traffic analysis. Traffic analysis is the study of who you are communicating with, when, and how often. This reveals more than you might expect about your activities. It will indicate who your friends and colleagues are (and they can be told apart by looking at the times you contact them). What your interests are, from which catalog companies you contact, and which ftp and WWW sites you visit. Traffic analysis can even reveal business secrets, e.g. your frequent contact with a rival could give hints of an impending merger. Remailers protect your email from traffic analysis. The original remailers did this by removing all headers, except the subject line, from any message you sent to them and then forwarding them a destination of your choice. The recipient of such a message would not know who had sent it. The addition of encryption to this scheme gave significant protection from attackers who simply look at passing messages for to and from fields. Passing a message through several remailers in a row is much better, but still vulnerable to an attacker who can watch messages go into and out of each remailer. Two more elements are required: messages must be reordered within the remailer before being forwarded (this is being done by a few of the old style remailers), and all messages must be indistinguishable. This last is the primary improvement with the type 2 remailer, Mixmaster. Using type 2 remailers: The trend towards ever more complicated remailer message formats has been clear for some time. Several programs have been written to automatically build messages which will be remailed by several remailers. This process is called chaining. With type 2 remailers it is no longer possible to create these messages by hand. Mixmaster takes a message you wish to send, a list of remailers to chain it through, and a final destination, and builds the packet which the remailers will use. For simplicity I will first describe the interactive use of Mixmaster, then I will discuss how it can be controlled through command line arguments. Interactive use of Mixmaster: If you run Mixmaster with no arguments, you will be prompted for all the required information. First you will be asked to specify the final destination of the message. This is the full email address where you want your message delivered. Remember that the message is being sent by the last remailer in the chain, so you must specify the full internet address (e.g. name(a)machine.place.com) you may not use local mail aliases. You may enter multiple recipients on separate lines. Hit return on a blank line to stop entering destinations. You must have at least one. Next you will be asked to enter any headers you want to have inserted before the message. These are those lines at the beginning of email messages, like From: fred(a)bedrock.univ.edu, or Subject: Party invitation. If you want your message to have a subject when it is delivered, you must enter a line Subject: your subject here. Note that Subject must be capitalized, with the : and space as shown. A subject header can be added by using the -s command line argument. When you are done entering headers, hit return (it is OK to have zero headers). You will now be presented with a list of remailers through which you can chain your messages. The order in which you choose them is the order in which they will be traversed by your message. You may choose up to 20 of them, but remember that the reliability and speed of the chain diminish as the number of remailers in the chain increases. Four is a reasonable number of remailers to use. It is fine to use a given remailer more than once in your chain. Press return on a blank line to stop entering remailers. Finally you will be asked what file you want to send. This must be an ASCII file. You may either enter the name of an existing file, or you may choose to enter the message directly by typing "stdin" as the file name. This is intended for use by scripts. There are no editing capabilities when using stdin. Enter the end of file character (EOF is ^D) when you are done entering the file. Mixmaster will now build the type 2 remailer packet, and send it to the first remailer in the chain. Command line arguments to Mixmaster: Mixmaster [-c] [in.filename] [-f] [-s "subject"] [-o "outfile"] [-to a(a)b.com] [-l 3 2 6 ...] -c this indicates that chaining rather than remailer functions are desired. It is a NOP since chaining is the default operation. "filename" if a filename is given, then this will be used as the input file. As in the interactive mode, you may choose "stdin". No filename will be prompted for. -f filter mode. All prompts suppressed, but input still accepted as described in the interactive section. The remailer list must be specified on the command line. -s "subject" Adds a subject line to the message. The user should NOT include Subject: in this string. Mixmaster will not prompt for other headers if -s is used. -o "outfile" Specify an output file rather than sending the message to the first remailer automatically. If outfile is "stdout", then the remailer packet will be printed to stdout. -to foo(a)bar.org specifies the final destination of the message. Only one destination can be specified. Mixmaster will not prompt for other destinations if -to is used. -l 4 3 5 ... Specifies the list of remailers to chain through. This must be the last argument on the command line. A maximum of 20 remailers may be specified. Mixmaster will not prompt for other remailers if -l is used. - -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Home of "chain" the remailer chaining script. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLs/ymFVkk3dax7hlAQFKqgP9Enq5xOZm2Dm1WudNeRjssV/VeJ7YLr0V 2n5ZaRnMaPqHe5efeMY3N7Ry1YoqGaQdYfD7Ar9koDUFPA0Lizh9QtDSLdeG8IVv RWcz7CxWjtt02yc1/PLY3TO9b3VRb0zSFzcwu0QBI17ZVK+rF6cT/SEuZFAjgW9D CJ5rWJH25Vk= =i4cN -----END PGP SIGNATURE-----

2 1

Re: usenet-to-mail
by merriman＠metronet.com 17 Dec '03

17 Dec '03

> >I'm better off if I keep taking classes, anyway. Don't know about the >rest of the folks on this list, but I don't feel like what I know about >computers today will carry me through retirement. > Hmmmmph. If you're gonna stay in school until you know enough about computers to carry you through retirement, you're gonna be there a *long* time. Best you can hope for is to be current when you get out, and keep up with it (or at least, not lose _too_ much ground each year as things evolve_. Dave Merriman - who remembers stuff like "64K? *64K*?! I don't know what I'd _do_ with 64K!" and when only the filthy rich had hard drives. - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome and encouraged. War is Peace. Freedom is Slavery. Ignorance is Strength. No?

1 0

Back in the mists of time.....
by merriman＠metronet.com 17 Dec '03

17 Dec '03

Having turned 40 earlier this month (jeez - if I'd known I was gonna live this long, I'd have taken care of myself :-), I'm apparently feeling the effects of Reagan's Disease. Could someone kindly refresh my memory as to when the Gummit decided it was okay to: * seize alleged drug money and not have to give it back unless the person could prove it was 'honest' money; * make banks and others tell them when someone moved more than $10,000; * take away our gold & silver coins for nickeled copper slugs (Kennedy-era, I believe; I seem to recall the tv coverage); * take us off the gold standard (Nixon?); Email preferred, so I don't waste any (more) bandwidth..... Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome and encouraged. War is Peace. Freedom is Slavery. Ignorance is Strength. No?

1 0

e$ spam: New First Virtual mailing list
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>From: nsb(a)nsb.fv.com >Date: Sun, 20 Nov 1994 21:47:20 -0500 (EST) >Original-From: Nathaniel Borenstein <nsb(a)nsb.fv.com> >To: www-buyinfo(a)allegra.att.com, com-priv(a)psi.com, edi-new(a)tegsun.Harvard.EDU >Subject: New First Virtual mailing list >X-UIDL: 785388160.006 > >We have set up a new mailing list, fv-users, for public discussions >about First Virtual's payment system and associated products and >technologies. To subscribe send mail to fv-users-request(a)fv.com, with >the single word "subscribe" in the subject. > >For any of you who haven't heard about First Virtual yet, we're a >fully-operational system that lets anyone on the Internet buy or sell >information using real money, without requiring any special software or >encryption. For more information, send mail to info(a)fv.com or spider >over to http://www.fv.com. > >-- Nathaniel Borenstein > Chief Scientist, First Virtual Holdings Incorporated > > ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Re: I Like ASCII, not MIME and Other Fancy Crap
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 4:58 PM 11/20/94 -1000, NetSurfer wrote: >Attachment converted: Amanda Logo Sig.GIF (GIFf/JVWR) (00003952) It was funny(?) the first time. Stop it. You're annoying people. Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Erratic Primitives of Shifting Parameters
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Apparently the Army War College has some choice views on the citizenry. Caveat: This item apeared in talk.politics.guns, from a self-described Idaho Minuteman. If these things offend you, read no further. Erratic Primitives of Shifting Parameters need encryption, too. --Tim > Xref: netcom.com talk.politics.guns:166397 > From: Terry.Liberty-Parker(a)libertybbs.ima.infomail.com (Terry Liberty-Parker) > Date: 18 Nov 94 12:20:07 > Newsgroups: talk.politics.guns > Subject: Govt's New Enemy > Message-ID: <294_9411181451(a)ima.infomail.com> > -=> Note: > Forwarded (from: AEN_NEWS) by Terry Liberty-Parker using timEd. > Originally from PHIL HURLEY (176:200/36.0) to all. > Original dated: Nov 18 '94, 11:24 > > * Original to ALL of 1:3624/7, on <Nov 10 23:28> > * Forwarded on <Nov 17 09:23> by Terry Buyers of 1:3624/7 > > The New Enemy > > "Parameters", the journal of the Army War College, has > published an article by a Maj. Ralph Peters which identifies > the next "enemy" of the "Politicized" Bill/Hillary Clinton > military as U.S. Patriots, defined as the "Warrior Class". > Patriots are described as "Erratic Primitives of Shifting > Allegiances, Habitated to Violence with no stake in Civil Order". > > > /////// Minuteman of Idaho \\\\\\\ > Grapevine BBS (208) 884-1226 > > > --- > # Synchronet # GRAPEVINE BBS * BOISE, IDAHO * (208) 884-1226 > SEEN-BY: 231/110 382/91 502 804 3624/7 6800/15 > > ___ GoldED 2.41 > - Origin: Texas Patriot (PRN 176:200/36) Dallas TX (214)495-6699 (176:200/36)

1 0

MIT/RSA license documents available
by gnu 17 Dec '03

17 Dec '03

More information has come out in the court case(s) between RSA and Cylink. In particular, the license between MIT and RSA, which gives RSA the exclusive rights to license the RSA patent, and its various amendments over the years, are all available from the US District Court for the Northern District of Calif. For some reason, this court is in Oakland rather than in SF where other cases in the Northern District are held. The judge is Claudia Wilken and it's case #94-2332-CW. The license and amendments are in the Attachments to document #15 ("Declaration of Robert B. Foughner...") and are all stamped "RSA DATA SECURITY CONFIDENTIAL" just for fun. In document #20, D. James Bidzos declares, under penalty of perjury, "On or about August 4, 1994, I received a telephone call from a customer of PKP. In this conversation, he told me that he had reviewed a copy of Cylink's complaint against RSA on an Internet Bulletin Board. Since then, I have myself reviewed Cylink's complaint against RSA on the Internet, as well as copies of RSA's motions to dismiss and to stay the arbitration. "When I entered the Agreement of Intent with Cylink in April of 1990 on behalf of RSA, I understood that all disputes respecting the patent licensing business we had established in PKP would be arbitrated. I entered this arbitration agreement, in part, to ensure the disputes between RSA and Cylink over the MIT patents would remain private, since the two companies were jointly licensing those patents to third parties. Since Cylink went outside the arbitration agreement and filed this lawsuit in federal court, I have received at least 25 communications (by telephone call, E-mail message, letter, fax, or face to face discussion) about the dispute. I have been asked repeatedly how PKP could license a patent when one of PKP's partners believes the patent is invalid. "This public federal court action filed by Cylink to invalidate the MIT patent has been very damaging to both RSA and the PKP partnership as a whole. I do not believe that I can clear my company RSA's good name, or that of PKP unless Cylink's broad and insistent demands for a license to use the MIT patent are also litigated in public." So, even Jim seems to think that spreading this information is a good idea. If somebody (the Information Liberation Front?) wants to scan this stuff in, I'll be glad to provide a Web/FTP site where people can get it. John

2 1

Europe and the global information society
by Rolf Michelsen 17 Dec '03

17 Dec '03

Some months ago there was a brief discussion on crypto and privacy issues outside the US. I've just discovered that the Bangemann report on the European information society is available on-line. Perhaps others are interested as well. Anyway, the URL is http://www.echo.lu/eudocs/en/report.html. -- Rolf ---------------------------------------------------------------------- Rolf Michelsen "Standards are wonderful-- Email: rolf.michelsen(a)delab.sintef.no everyone should have one" Phone: +47 73 59 87 33 WWW : http://www.delab.sintef.no/~rolfm ----------------------------------------------------------------------

1 0

900 privacy ad op
by jkh＠story.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- 9 0 0 - P R I V A C Y A D O P P O R T U N I T Y --------------------------------------------------- Cypherpunks: Agree to buy advertising for my 900-number privacy information service, and make money from your exclusive territory. The actual number can't be 1-900-PRIVACY. That'd be too cool. We are checking the availability of appropriate names. Maybe SECRETS, CONFIDE, or some other 7-letter word will be open. Some have suggested that a 900 number dispense digital money, but critics complained about cost and lack of privacy. The call information is recorded by the phone company for billing, a separate 900# service bureau processes up to thousands of simultaneous calls. They take their cut so value is lost. The use of blind signatures, to insure privacy, will require that each end-user have a trusted computer. Computers will also be needed for encrypted remailers to thwart tracing. Despite convenient telco billing, the Internet (or equivalent) wins. I don't see any reason why cypherpunks can't use a 900 number in the traditional way -- to sell information via audiotext. We could tell people how to fight new threats to their privacy. And make money for other projects, like this month's rent, as we do it. "Dial An Insult" is a 900 number advertised with the slogan "Be Amused While Being Abused," illustrated by a silhouetted dominatrix with her mouth open. After the national ads are paid, the net profit on the 10,000 calls EACH DAY is $8,000. The doctor who runs this vital audiotext service has a full time medical practice. The service bureau handles an average of 416 calls each hour automatically. Yet the chances are slim you've even heard of it, unless you're a "be your own boss" seminar junkie or you watch late night infomercials. My own research at the library shows many 900 services beyond the "Psychic Friends" and "talk to a real girl" lines. Community papers give classified date ads away, but to contact someone you have to call their 900 number. Big city papers, radio, and TV networks are running opinion polls and celebrity messages. That's why they don't slam them very hard -- they're making money with 'em. Technical support is available from software companies like Button Ware on 900 numbers. The Pope records messages with proceeds going to the Catholic Church. The Better Business Bureau runs 900 lines for reports in some states. Millions call time-sensitive 900 weather information lines at $0.95/min., despite free sources. Unfortunately, government agencies are getting smart and using 900 numbers. A former expense is becoming a new source of funding. Our friends at the IRS answered only 21% of calls made last year. An enterprising individual runs a tax tip 900 number with the same information put out by the IRS to exploit the situation. The content of my service will be, as stated above, how to defend your privacy against new threats. "Cypherpunks write scripts." I'm willing to sign joint-venture contracts with authors for parts of my nationwide percentage. But there are many restrictions. Send e- mail to jkh(a)story.com for the Bozo no-nos. This service will cover 1-New Threats and Tactics, 2-Lifestyle Risks, 3-Physical Security, 4-Data Security, and 5-Communications Security. You'll notice I avoid the words "financial," "credit," "cash," and "money" -- those restrictions I mentioned (MCI is gun shy about past ripoffs). But don't worry, I'll sneak that information across somehow. Lon Weber, an active Arizona Libertarian, e-mail: freedom4(a)aol.com, managed to buy a few 900 numbers, and was looking for ideas. I had this idea for a privacy 900 line and was looking for someone to fund it. Natural partners, eh? To pay for advertising, I proposed the following arrangement, and Lon agreed: Advertisers can request exclusive territories, by state. After the telco and service bureau take their cut for a call (will send breakdown of charges if you are interested), divide the money as follows: 1/3 to Lon, 1/3 to the scriptwriters, and 1/3 to the advertiser. Calls made in a state will be credited to that advertiser. The price of this service will be $1.95 per minute, maximum 12 minutes. A $1.95-per-minute call will have just over $1.00 per minute available to split the next month, and a reserve held against chargebacks will be released by MCI later. The industry average call duration is 4 minutes, your mileage may vary. The maximum charge allowed by MCI is $5/minute or $25 total. One call per hour statewide, times 4 minutes at $1.00 available, times 24 hours each day, times 30 days gives a ballpark $2,880. Divide by 3 and your cut as an advertiser is $960 for the month. Divide the 416 nationwide calls per hour to "Dial An Insult" by 50 states and you get over 8 calls per hour per state. Instead of $960, at that volume, your cut would be $7,680. That wouldn't be a bad return for paying $200-$300 to a media broker for statewide community newspaper ads. And nobody will stop you from getting more ambitious with radio, cable shows, etc. We don't expect you to send us money, but we must insist on evidence that you are really advertising to some minimal standard. That's only fair to someone else who may want your territory. The FCC and other TLA's require certain disclosures on the advertising. Lon is looking for other 900 service ideas, too. Feel free to send him e-mail at freedom4(a)aol.com. Interested? RSVP: Kent - jkh(a)story.com -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLs9Xvg4ciVn87Ra9AQEWBQP/QJn51pP/Hyhi1Vu6fBFH54qc/R3pNf+H nrZGDEVgR/XaeDUgMCmCOTCiwX58Cs9doqWyfQta2nenrSZf8WkXtpLK34xeXgoj nrSNaaLWN3otdRYV3pOBItkjd9bi2314dfw4/4lMir/O5cis1glEzneUr9gi8cBw 8rUIkKx3UDw= =rdYW -----END PGP SIGNATURE-----

2 1