December 2003 - cypherpunks-legacy

Re: On the crime bill and remailers
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Someone out there asked: >On Sun, 18 Sep 1994, Robert Hettinga wrote: >> Hey. I get it. Solon. Lawyer. Nym. >I think it is too late in the day for me. When you have a minute, >please let me in on it so I too can "get it". Sorry. Operating with sparse data in "terse" mode again... Here's the verbose, shaky memory version. I think Solon (called after he died "the lawgiver") was a, well, tyrant, of Athens. Tyrants in ancient Greece tended to be dictatorial in the modern sense. They weren't born to the job. They stole it fair and square, so the job was theirs. (BTW, the job "Dictator" comes from Rome, where it was an ad hoc, special purpose office granted by the senate with unlimited power for a finite term, usually 2 years. The finite term was supposed to be a check against abuse. Ceasar liked the job so much he wanted to keep it for life, so they snuffed him. Didn't do them any good.) Anyway. According to legend, Solon wrote, by himself for the most part, the laws Athens operated under during the Periclean, "golden" age of its history. Can't remember whether he stepped down after he did it, but the laws he wrote, including most of the ones we call "democratic", stayed in place after he died. So. SOLONg has several puns in "his" name. One, Solon "the lawgiver", like "I speak law". Two, So Long, Solon, like, "so long laws". Since "his" first post was a legal one, he (I'll take the quotes off because the original Solon was male) must be a lawyer or a law student, or someone who is neither who wants to sound like they are. Basing the nym on Solon the lawgiver is a little pretentious, but, hey, what you expect for what turn out to be free legal counsel on cypherpunk issues, a focus-group-tested nym? In the meantime, we have someone at least claiming legal credentials willing to put an oar in here every once in a while. With our friend Vinny "The Pro" Bono, (rumored relation to an ex-mayor), that makes two anonymous lawyers on the list that I know of. That is good thing, I think. Time will tell of course, whether that really is the case... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

RC4 spaces...
by nobody＠kaiwan.com 17 Dec '03

17 Dec '03

Yoo Hoo, Did anyone notice the spaces at the end of most RC4 source code lines. Could they be .... 1 - Someone used a strange editor on the code. 2 - Someone deleted comments that were after the spaces. 3 - It is realy some crude Stego ID. Cheers,

1 0

news (fwd)
by Al Billings 17 Dec '03

17 Dec '03

This was forwarded by a friend of mine and a "witchhunt" list he is on at MIT. It seemed relevant given the government's current tactics. ---------- Forwarded message ---------- From: Sherrill Mulhern <smulhern(a)pasteur.fr> Subject: SRA CONFERENCE To: witchhunt(a)MIT.EDU Just thought that someone might be interested in checking out this conference. Last year it, at its first conference it advertized a number of big name MPD/SRA speakers including Roland Summit, Bennett Braun, Colin Ross, etc. Summit pulled out, however, I believe Braun and Ross attended and were joined by Catherine Gould (who wrote the check list of clinical indicators of satanic ritual abuse). "For Immediate Release:" Contact: Randy Skinner, Director National Criminal Justice Task Force (714) 262-7592/Fx(714) 252-0846 Cyber-porn Cover up-- Conference Unmasks Washington D.C. Computer Ring's Link to High Officials IRVINE, Calif -- Tasked with informing the nation about the prevalence of sexual crimes against children. The National Criminal Justice Task Force, a national multi-disciplinary group of judges, prosecutors, medical doctors and psychotherapists, is hosting the second national conference on Crimes Against Children, September 22-25 at Washington D.C.'s Ramada Renaissance Hotel. Slated for discussion is the first alleged cyber-porn ring -- the "Finders", a shadowy techno-cult allegedly specializing in electronic networks, disseminating child pornography and possibly smuggling children. According to Detective Sergeant Larry Lawson, of Florida, the mysterious group was discovered in Tallahassee in 1987 (? illegible) when police stopped a van driven by two adults, allegedly en-route to Mexico, carrying a cargo of six children, ages 3 to 6 years. Raiding a D.C. warehouse, D.C. Metro officers uncovered computers, detailed kindapping {sic} plans, child/animal blood-ritual photographs, and overseas orders for children. When a U.S. Customs/Washington Metro Police investigation was launched, the FBI's Counter-Intelligence Unit shut it down. Only under pressure from members of Congress-who just received information from associates of the National Criminal Justice Task Force - did the Justice Department renew the investigation. Uncovered recently is information that links corrupt federal officials to child-trafficking, as well as the use of influence to cover up their involvement with the Finders. For more information and press kit, contact Randy Skinner, director National Criminal Justice Task Force, (714) 262-7592/Fx (714) 252-0846

1 0

Re: Acapulco H.E.A.T. Auxilliary Review
by jonathan＠memex.com 17 Dec '03

17 Dec '03

In a post to cypherpunks, L. Todd Masco <cactus(a)bb.com> wrote: > In article <199409190629.AA24697(a)metronet.com>, David K. Merriman > <merriman(a)metronet.com> wrote: > >There *was* a brief flurry of goodguy/badguy underwater WWF > action, but considering that their alleged bottom time for > the dives was 25 minutes (any diver confirmation out there?), > > At 102 feet? ... it's just from a long-ago PADI training and a > couple of shallow dives following, but from what I remember: > > - the rule of thumb is that 30 feet of water get you an > atmosphere. So you're at 102 you're at just > under 4.5, so you're using air at the rate of > 4.5 times the rate you do on the surface. It's 1 atmosphere for every 33 feet, but either way, I don't see how you managed to get 4.5 * the rate. At around 3 atmospheres, you're using air at about 4 times the 1 atmosphere rate. > - My dives were usually 30-60 feet (say, half the pressure > the H.E.A.T. team dealt with), and I was able to stay > down for over an hour, with one tank. That means > that with two tanks they should have had at least > a similar limit, say an hour. On the other hand, > I wasn't wrestling... Exertion can pull you way > down. If they were giving a definite, solid time > limit, it's definitely bogus ("Let's see, five > minutes at 10 times air consumption while you > fight...") for air limitations. Hmmm. I believe that the diving depth-to-time tables (which I don't have in front of me. I'll get them out and double check later) give a time of around 25 minutes. It has nothing to do with how much air you have. The tables are used to avoid the bends and nitrogen narcosis.

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I have written and installed a remailer pinging script which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html Please let me know about any other remailers which I missed. I've only included remailers which can mail to arbitrary addresses, so I already know chop and twwells are missing. This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://kiwi.cs.berkeley.edu/pub/raph/premail-0.22.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 10-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"chaos"} = "<remailer(a)chaos.bsu.edu> cpunk hash ksub"; $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk oldpgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk oldpgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut post"; $remailer{"wien"} = "<remailer(a)ds1.wu-wien.ac.at> cpunk pgp hash nsub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric pgp. post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)xs4all.nl> cpunk pgp. hash latent cut post"; $remailer{"leri"} = "<remail(a)leri.edu> cpunk pgp hash"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp."; $remailer{"underdog"} = "<lmccarth(a)ducie.cs.umass.edu> cpunk hash latent cut post"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 19 Sep 94 6:00:01 PDT remailer email address history latency uptime ----------------------------------------------------------------------- wien remailer(a)ds1.wu-wien.ac.at ***-+**++*** 9:04 99.99% bsu-cs nowhere(a)bsu-cs.bsu.edu ***++*****+* 6:05 99.99% c2 remail(a)c2.org +****-**+*-* 1:02:35 99.99% ideath remailer(a)ideath.goldenbear.com +****++*-.+* 2:32:19 99.99% chaos remailer(a)chaos.bsu.edu *******#**#* 1:48 99.99% leri remail(a)leri.edu *****-**+*-* 56:05 99.99% alumni hal(a)alumni.caltech.edu -*********** 13:07 99.91% soda remailer(a)csua.berkeley.edu +++++++... 5:41:04 99.97% portal hfinney(a)shell.portal.com -*********** 13:01 99.87% extropia remail(a)extropia.wimsey.com ++-- -++++++ 1:22:57 99.73% underdog lmccarth(a)ducie.cs.umass.edu ***** 3:43 99.59% vox remail(a)vox.xs4all.nl ---.. --.- 11:04:20 99.50% rebma remailer(a)rebma.mn.org --*-----+- 6:19:39 99.77% penet anon(a)anon.penet.fi ************ 2:02:48 98.91% jpunix remailer(a)jpunix.com *** *-** #** 7:34 98.87% desert remail(a)desert.xs4all.nl ..--.- ---- 25:55:50 81.03% usura usura(a)xs4all.nl ***** **+* 8:54 79.30% Suggested path: c2;bsu-cs;wien For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. special Accepts only pgp encrypted messages. History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). If you've got a Web page, please feel free to include a link to this page. If you think your Web page is relevant to the subject of remailers, let me know and I'll link it in. Comments and suggestions welcome! Note to remailer operators: this script generates hourly ping messages. If you don't want that, let me know and I will take your mailer off the list, or increase the interval between pings. Raph Levien

1 0

FOUR TIMES AROUND THE WHEEL
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Today is my birthday. I've circled the Chinese zodiac four times--from Year of the Dog 1946, to Year of the Dog 1992. This has not been a good year. Write something nice to me. I need all the encouragement I can get. S a n d y "The Old Dog" S a n d f o r t ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

art encryption...
by John Young 17 Dec '03

17 Dec '03

Responding to msg by lile(a)art.net (Lile Elam) on Mon, 19 Sep 0:11 AM >So, I have been thinking that a way an artist can >insure a viewer that the art they are viewing is really >that of the artist, the artist can *sign* their art >with their private key and others can check it with >their public key. Now, the art would be factered into >the key generated that others would check with the >public key. > >So, a image file (gif, jpeg, tiff whatever) would be >run through a encryption coding that would generate a >signage based on the artist's image and their private >key. The image would remain unchanged. Then viewers >could run the same encyription coding on the image and >apply the artist's public key to see if it really *is* >their work.... As a parallel to your inquiry I offer: Thanks to help from this list my firm uses PGP to encrypt, sign and verify CAD architectural documents exchanged with consultants and clients. We also conceal ID in the documents by a simple steganographic method using combined PGP and CAD posted here a few weeks back, which is not revealed to the recipients, as a check on authorized use and distribution. Any suggested improvements would be welcome. John

1 0

Re: DC-Nets and sheep
by doug＠OpenMind.com 17 Dec '03

17 Dec '03

Rishab Aiyer Ghosh <rishab(a)dxm.ernet.in> writes: >Doug goes on to suggest that to be immune from the "sheep^H^H^H^H^Hpeople" >DC-Nets will have to have millions of members. But if anon remailers were used >by millions, than they'd be immune too. All crypto is vulnerable to mob action >until it's widespread. I think that there is an important difference between the case of anonymous remailers and DC-Nets. Even if millions of people were using anonymous remailers, it would still be the case that the remailer itself would provide a single, isolatable target for control. Although it might not be politically popular to force the remailer out of operation, the actual mechanics of doing so could be relatively simple. The strength of DC-Nets lies in their distributed nature. There is no single target for control which can be isolated from the rest. Even without millions of members, a DC-Net gains strength through cooperation... to effectively target it, all of the members of the net must be targeted in some sense. Whether the actual technology used is a DC-Net or something fairly different, the basic principle of replacing single targets with large cooperating groups seems to hold promise. Doug

1 0

A Scenario
by Anonymous User 17 Dec '03

17 Dec '03

Anonymous User scripsit >> >> Let's say I have a digital cellular phone. I also have Anonymous Remailers, >> PGP, and over 100 BBS numbers (structured for which day and which hour each >> would be used) so that I can contact and talk to my "Friend." >> Please tell me how the LEA's can find me and understand the transactions >> between us? >You don't give us enough information. >Are your attackers looking for known parties? >How secure is your cellular? Do you operate from a known or a guessable >location? Is your "Friend" known? Suspected? His location, guessable? >Known? >If your location were known it would be a simple matter to monitor >the area, say put a van just outside your site and wait for cellular >activity of a strength that suggests your presence. How likely would it >be that someone else is using a cellular phone in your presence? Given >this, it is probably not difficult to obtain the billing/ESN number for >your phone, and then obtain detailed traffic information about your >transmissions. Given that it is a simple matter to conduct a lower tech >attack, say tempest, and pick up the conversation as you compose it, end >running the encryption so to speak. You think in too shallow a fashion. >Security is about more than communications security. >Even if yours is perfect, how about your friends. A tempest attack on >his site while he is using Word for Windows is just as effective as one >on you. >Modify this tactic to use a phone which uses several different ESN's at >random or move your location often and at random. >> >> If I have several encryption programs, can I 'layer' each document [I PGP the >> file, the I DES the PGP file, then IDEA for the final layer. >Worthless given the above attack. >> Does the NSA have to crack it one layer at a time, or can they bombard it, >> crack the layers in whatever order the supercomputer finds? >Again, unimportant given the cheaper low tech solution. >> If I am missing something, please let me know what I have missed. >Been there, did that. >-uni- (Dark) In the above scenario, I would never use my voice over the digital cellular [and I would be always moving {nothing done at home}]...strictly PGP/E-Mail. Even IF the parties are known, can they make their case? [How can they prove X sent Y if using PGP and anonymous remailers?] Of course, if one of them cooperates, that's different. Can Tempest be used as I'm driving/on a city bus? How expensive is it to maintain a Tempest surveillance in this fashion? This is a positive of portable computers and portable communications..no one can pinpoint [even remotely] where I'll compose/collect my pgp/e-mail. I am assuming that I'm covering my tracks smartly, and the only thing they have is what they can grab over the air, which is PGP, and that gets sent to some BBS [which they don't know] for my friend to pick up. The ESNs and the Keep Moving are really helpful, thanks.

2 2

art encryption...
by John Young 17 Dec '03

17 Dec '03

My recent post on use of PGP in architectural documents is limited to those produced by an all-volunteer group that provides free services. This work is often controversial and needs privacy protection. My commercial work does not yet deserve such elegant dressing. If and when it does I will relish paying for PRZ's hard work through his market channels. John

1 0