December 2003 - cypherpunks-legacy

re to hfinney
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

hal sez: : Perl does exist for ms-dos, and I think those scripts would probably work : OK there. They don't do anything exotic, just some byte reads and : writes. Maybe the random-number generation would need to be looked at; : as I said, that is the one weak part. But probably they would work OK. kool . could you please repost the scripts , i seem to have misplaced them. also , where can i get perl for dos , any idea ? tia .

3 2

Re: Compromising the first remailer
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 6:11 PM 02/03/95, rishab(a)dxm.ernet.in wrote: >Actually any remailer, with NSA-modified operating software, can correlate the >message it receives to the one it sends out, by keeping track of the message >past any decryption until it's posted out. With rational use of garbage and >chaining, all you do is stop the NSA from knowing your final destination from >the first remailer, but they _would_ know the identity of the second remailer >(assuming the first is compromised) and could try to attack the second, ad >nauseum. Of course this was always known to be the problem, to which chaining >and traffic analysis evasion are partial solutions. Yes, but as long as _one_ remailer in your chain is not compromised by the NSA, and if that one remailer has high enough traffic going through it and does the proper things with reordering and latency and such (a big "if", currently), you're still safe. That turns out to be the whole purpose of chaining, since it has been shown that it doesn't neccesarily make traffic analysis any harder. The purpose is to hope that at least one link on your chain is both honest and properly working. Yeah, if all the links on your chain are NSA-sponsored, your in trouble. Nothing that can be done about that.

1 0

Re: There is another NetCash
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 10:09 AM 2/4/95, Hal wrote: >Some payment system is probably better than none, but I hate to see >the name "cash" expropriated by these non-cash systems. Indeed. That was the point of the URL to Mr. Solinsky's excellent introduction to the subject. It is easy to see that the original NetCash isn't a digital cash system, with its clearing of a single-use serial number transmitted unencrypted in the clear, and with its "bank" settling the transaction through the telco 900-number system. Not having looked yet, I bet the "other" NetCash is probably not Chaumian-equivalent digital cash either, or we'd have heard more about it. It would be a pretty major accomplishment, especially if it doesn't violate Chaum's patents. As Eric has said here recently, we have to remember the difference between transaction clearing (which First Virtual, for example, does well, at least as a prima facie system) and transaction settlement (which FV does on the back of the Visa/MC network), which is what a true cash-settlement system would do in one stroke. Someday, and not now, I would like to take up the cudgel and jumpstart the old offline/online cash debate. I like offline cash because it doesn't require a bank intervention at every transaction, double-spending cash and "inside-job" private key theft notwithstanding... Ah, well. Someday. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Remailer Unreliability
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >> Well, *I* think it is a good idea. But how does remailer1 know that >>remailer2 is both a remailer and down? > >By attempting a connection to the SMTP port and using the alternate if >it fails? This depends on a significant change in remailer features - existing remailers don't do message delivery, they pass remailed messages off to the local MTA (e.g, sendmail, Smail, whatever) and let it take care of delivery. Expecting remailers to handle queueing and delivery adds lots of code and complexity. (It also may piss off sysadmins who aren't remailer operators. Bogus or not, some institutions frown on attempting mail delivery manually or with non-standard programs.) Also, it's difficult to say when delivery has failed. Not every failure (where failure = not delivered in a reasonable time) results in a bounce message; if the sending remailer can't determine success or failure immediately, it will have to keep a database of the last few (hundred, probably) primary/alternate address pairs, and then extract the failed message from the bounce message, then reprocess with the alternate address. Yuck. I think the easiest way to do this would be for remailers to have a list of "unavailable remailers", and to process the primary/alternate choice immediately upon receipt/resending - but if we have a good way to provide the remailers with availability information, we've probably found a good way to provide it to users, too. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLzKgyH3YhjZY3fMNAQHlkwP7Bj5D5PbC1H+x3XXqP3gdUTTL6eLMjt2d 6cmj/kr0nv88XwXkIttj7r4wSDRXSe8K4mpU4utNQ1l+RlArDzZLkiY/qleuRhGX yRplXo6eoNwSv24oBCIVwdu7r+gnlhVs4sU3tzkWD+deOQxVXffdPL0opZ1Cn8v6 qRmKmuOYFB8= =i/8j -----END PGP SIGNATURE-----

1 0

Re: VoicePGP cracked in 10 minutes?...
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > I heard a rumor hear in Ctl. Tx. that the VoicePGP project was cracked in the > > last couple of days in approx. 10 minutes. Anyone have any info on this other > > than one of those wild rumors that occur? > > Considering that VoicePGP hasn't even been released, this is > fascinating news. Perhaps the same team could work next on cracking > things that haven't even been invented yet. Cracking VoicePGP is easy, since it's still a bones version without the encryption installed yet - anybody who can figure out where to get the software should be able to do it. Might take more than 10 minutes to do that :-) However, the rumor mostly sounded like a pro-active version of the "NSA cracked PGP" version of the FBI Modem Tax on Religious Broadcasting put out by Madeline Murray O'Shergold.

1 0

Re: Is the remailer crisis over?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Well folks as of 11:30 on 1-30-94 there are 14 remailers with uptimes > greater than 99%. What's the consensus...Is the remailer crisis over? The "remailers are broken" crisis may be over, but until there are a lot of remailers in service, and 14 isn't a lot, with a lot of traffic on them, remailers won't be a very effective security tool. If the Bad Guys wanted to watch all 14 remailers, it'd probably not be hard to figure out which messages came from which senders, just because there aren't enough for real tracking. If the Bad Guys decided to confiscate 14 remailers, they could do it. If your machine got busted or sued for sending an anonymous message somebody didn't like, and you contended that you're a remailer and there was no way to prove it originated on your machine, "they" could respond that you're not one of the 14 well-known remailers and if you were "they" would have been watching you because they watch every machine that talks to the well-known remailers, and you're not one of them. As the folks in the nuclear-war planning business say, fewer than 100 of anything isn't reliable. Bill

1 0

AIR Mosaic Feedback Mail
by rchcnslt＠epix.net 17 Dec '03

17 Dec '03

Mail sent from AIR Mosaic (16-bit) version 3.07.04.02 howdy.. Cyperpuk, life and all that.. Lemme in on the cool poop! Rick R.

1 0

Re: re to hfinney
by Hal 17 Dec '03

17 Dec '03

From: anonymous-remailer(a)shell.portal.com > kool . could you please repost the scripts , i seem to have misplaced them. > also , where can i get perl for dos , any idea ? tia . Rather than re-post them, I put a copy of my message up for ftp at the cypherpunks ftp site. <URL: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/incoming/pgppad.scr >

1 0

Re: commercial authecation
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Keith Henson asked how to find the digital-time-stamp folks, Surety Technologies Inc., started by Stuart Haber and Scott Stornetta as a spinoff of Bellcore. They're now actively in business - there was an article in one of the trade rags that you can get their signature kit for PCs for something like $50 with tokens for 50 notarizations. Details on their web page. email: info(a)surety.com www: http://surety.com - with lots of little graphic icons :-( ftp: surety.com Bill

1 0

Wired Institutes PGP Usage For Subscriptions....
by werewolf＠io.org 17 Dec '03

17 Dec '03

Got this message in my mailbox a week after I posted the query of magazine subscriptions via encrypted cc #'s. I'll check it out tonight, as I want to order a subscription for a friend. ===========================================================================

2 1