December 2003 - cypherpunks-legacy

Premail PGP Keys
by Michael L. Acklin 17 Dec '03

17 Dec '03

Ralf, I hate to bother you, but I am setting up your premail program and tried the "premail -getkeys" but it never works. I tried to manually finger Matt's Pub Key area, but looks like he is down or has a different address. Is there somewhere else I can try to get the PGP Keys for the remailers, or does Matt have a different address? Any help would really be appreciated. Also does anyone have a patch for PINE 3.9X to get premail to work. I know I am kinda behind but just starting out and would really appreciate any help I can get. Again Thanks in Advance.... Mike Acklin ----------------------> hroller(a)metronet.com

1 0

Re: Abuse and Remailer Ethics
by John Young 17 Dec '03

17 Dec '03

On Tue, 17 Jan 1995 anonymous-remailer(a)xs4all.nl (Name withheld on request) said: >This comment is grossly unfair. Obviously Homer is going to a lot of effort to >operate his remailer in the best way possible. > >It's easy for others to be critical. "head on a plate" is a strong term to >use, given Homer made it clear he would not reveal the identity of an anonymous >user without a court order. Also, one wonders to what end remailers are being >put by people who are worried about being "sold out". > >It's always been a good policy to use a foreign mailer in a chain where >anonymity is critically important. That doesn't mean it's OK to make Homer the >whipping boy. I agree that it's a bit much to expect the remailer operator to heroically perform beyond what any of us would do in the same lonely spot under duress. Tim has written recently on another list that the USG grabs enemies in other domains when the national interests are at stake -- the 800-pounder can define any of its actions legal, or to hell with legal niceties as the Beast opts, the picky lawyers can sort it out later, or never. Does not Duncan and others have wisdom on this: Don't roll over out of ignorance and faint-heartedness, but do carefully protect your keister, with feet-on-ground planning, mercury-technology and out-wits. Watch for signs of sneak attack through the guy being squeezed next door, or by a cahoots-machine zipping psy-war toot-alarms to foster fearful quiescence. Some warning examples may be in the offing in the rising heat of dreaded horse-threats to civil society. If so, some will be arranged by provocateurs like past G-guy tricks. So it goes. So what. Nesta said, it's fun to lance swollen infected over-controlling heads.

1 0

Scientology and remailers.
by James A. Donald 17 Dec '03

17 Dec '03

Posting the truth about Scientology, in the face of harassment and threats by scientologists, is an excellent example of the legitimate use of remailers, as is alt.abuse.recovery, and talk.politics.china --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from James A. Donald the arbitrary power of the omnipotent state. jamesd(a)netcom.com http://www.catalog.com/jamesd/

1 0

Re: Abuse and Remailer Ethics
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

>This thread illustrates (at least if setup's like this are >worthy of a place in Raph's list) that penet.fi is the safest >way to go for the moment. I would just hate it to have my >head on the plate of a remailer operator who takes an interest >in subtile ethical discussion of whether to sell me out or not. If you chain it through 3 or 4 remailers with PGP, then pretty much all 3 or 4 of them have got to decide to sell you out. I trust Julf a lot, but I'm not sure I trust him four times as much as much as every other remailer operator. Or something like that. You can also probably use penet as a link on your larger chain, although I've never tried this to see how it works. And I would note that the "subtle ethical discussion" seemed to consist of the operator trying to figure out what he should do in the future about this sort of thing, and he never even seemed to consider turning over the name of the anon user. Although he did acknowledge that in the future he might, or might work with other operators to try and discover a True Name. *shrug*

3 2

Re: Does encrypted equal safe?
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 01:28 PM 1/17/95 -0800, Eric Hughes wrote: > ... Meaning is subjective. If I see encrypted text, am I to be held >responsible for having seen through an encryption for which I hold not >the key? Merely because someone knows a transformation into a >disapproved form does not mean that I do. ... Which is exactly why the encrypt on receipt or decrypt on delivery ideas won't work. You have to be provably ignorant of the data. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

3 2

Re: (none)
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

Mats Bergstrom wrote: >On Tue, 17 Jan 1995, Name withheld on request wrote: > >> wonders to what end remailers are being put by people who are worried >> about being "sold out". > >The fundamental principle here is that an e-mail message is just so >many bits of 1's and 0's. It can never, in it's own capacity, steal, >molest or kill. It is therefore not unethical to run a no-log 'fortress >remailer' and auto-delete ALL complaints, without exception. It might >not be feasible to do so if one wants to stay out of jail, but hope- >fully this will change with the rapid increase in country domains >and the soon-to-come digicash market. Discussions of programming to >make fortress remailers work and to make them easily exportable to >African Linux-boxes are interesting. So are discussions of expected >repercussions on society. Ethical discussions of what is abuse or not >are better left to the clergy. Here comes the clergy! :-) I'm sure that when your hypothetical remailer comes up and I decide to spam you with your own words (now I wouldn't do that, now would I? ;-), your sysadmin will be comforted by knowing that it's only ones and zeros filling his hard disk. He would be especially comforted if I spammed postmaster(a)wherever.you.are rather than your own account in a move to protect your own anonymity. Advocating a remailer such as you describe is only possible in a world where anonymity is considered the supreme good, a goal to achieve no matter how many other ethical rules we break. In the real world, however, there will always be problems with "acceptable use" and "abuse", along with the additional problems with establishing policy and so on.

3 2

Internet News: NNBC News Story moved to tonight (Tuesday) (fwd)
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 17 Jan 1995 14:23:11 -0500 From: Craig Peterson <craig(a)Mainstream.com> To: Multiple recipients of list <rkba-alert(a)gatekeeper.nra.org> Subject: INFO: NBC Nightly News Story moved to tonight (Tuesday) A story regarding the Internet, with some sort of mention of NRA.org, should be on the NBC Nightly News with Tom Brokaw tonight. Craig.

1 0

Re: Key backup (was: How do I know . ..)
by Dr. D.C. Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- 'Eric Hughes' was reported to have written: > You use your friends now because off-site storage facilities are not > yet available. The software for distributed remote backup has yet to > make this operation transparent. Even when such a system becomes available, I don't think that it will obviate the need for relatively secure on-site storage. Banks and safe deposit boxes haven't completely precluded the demand for safes at home. Many people don't trust banks. Fewer will completely trust cypherbanks and distributed.net.storage systems. > I suspect that most private keys in the future will be held in PCMCIA > cards (initially) and then their smaller replacements. Backing up a > private key to these allows use of a safe deposit box. Safe deposit boxes, by virtue of their accessibility to law enforcement, are subject to search and seizure under court order and are sealed in certain cases (probate). This makes them likely to be the first place to look when the Feds decide that we can't have keys anymore. Personally speaking, I'll take my chances with secure "on-site" storage, even if I choose a location other than my own home or business. > If it's still "passphrase-protected", an attacker would a) have to know > what to look for > For scalability, most people will use some standard method, whatever > it is. This limits the search space of an opponent. If barcoding is our example, what's to prevent it from being printed in a format selected by the user? Printing on a small paper/plastic label and affixng it (in whole or in parts) to other objects effectively disguises it as a UPC label. You would have to know which labels are a part of a keyring for them to have any significance. Even George Bush now knows that every commercial product has a UPC on it somewhere. Many stores add their own UPC sticker to merchandise for inventory control purposes. Break a keyring into 4 or 5 pieces (whatever it takes to make each piece comparable in size and appearance to the standard UPC label), stick them on selected objects, and let someone who knows what they're looking for try and reconstruct your keyring from the universe of combinations of UPC labels found around your home. With an unknown number of parts, this seems like a practically insurmountable problem. This becomes a stego problem as well as a key decryption problem. With barcoding as the standard, another person prints his key on a small unmarked card and hides it somewhere deemed to be secure by him. The UPC-label attack fails because his keyring isn't disguised as UPC product labels. How does the attacker know what to look for? True Paranoids could devise some sort of "invisible ink" method, requiring UV or heat exposure before the barcode becomes visible. Now your backup key looks like a blank sheet of paper. ;-) My point is that with a regular barcode-generation program and a laser printer, an infinite number of formats and combinations can be created by individual users to suit their needs. You can print an 8.5 x 11 sheet with the title "PGP secret keyring" and put it in a frame hung on the wall, or you can print a bunch of split key pseudo-UPC labels and put one on the back of the frame to disguise it as the manufacturer's product label. One method is secure and the other is not, but the specifics are left to the user because the method is sufficiently flexible to allow a number of formats. I contend that anyone capable of running PGP properly is also capable of using a barcode printing program without difficulty (check out the back of PC Magazine). All that would need to be written is a short routine to convert the encrypted keyring into a format suitable as input for a program of this nature. Heck, there's probably a PD barcode program out there already. My question to the respected elders of this list is "how or why is this type of key backup system insecure, if it is in fact insecure?" =D.C. Williams <dcwill(a)ee.unr.edu> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLx1VlyoZzwIn1bdtAQFT5QF+N2RGEpj37fT0iCUnPdnkaUWItbC+HHAj eFAyBU7fNOnHGwiriHnuEcYaZxBV6lst =l3PL -----END PGP SIGNATURE-----

3 2

Re: Another problem w/Data Havens...
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

At 4:43 PM 1/17/95, Paul J. Ste. Marie wrote: >At 03:29 AM 1/17/95 EST, bill.stewart(a)pleasantonca.ncr.com +1-510-484-6204 >wrote: >> ... That way, Dave's system really only has knowledge of the headers, >>plus one line at a time of incriminating data on the fly. ... > >I don't see exactly what that is buying Dave. The entire contents were >still transmitted to him, so the ability to see the entire file was still >present, which means he could have, had he chosen to do so, prevented the >file from residing on his system, and could have screened it. It's >essentially only the word of the haven op that shows he didn't examine the >entire file. That's the main reason why I like my idea of having a trusted encryptor. Nobody's suggested that the current timestamp operators would be in Deep Doo-Doo if they timestampped some piece of thoughtcrime; why should somebody who encrypts be any different? The service could even be advertised as a different form of timestamping (or notarizing). Not only do you get the file back signed, but you get it back encrypted and signed. > --Paul J. Ste. Marie > pstemari(a)well.sf.ca.us, pstemari(a)erinet.com b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music Finger ben(a)tux.music.asu.edu for PGP public key ID 0x875B059.

2 1

Re: Abuse and Remailer Ethics
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <Pine.SUN.3.91.950116205019.7181A-100000@math>, Homer Wilson Smith <homer(a)math.cornell.edu> wrote: > I am not presently on cypherpunks, so please include me in the >replies. It's a little (not a lot) rude to start a substantive conversation and not to listen in to the list for duration. Just my O. > Does a list owner have the right to demand blocking to his list, >with or without a vote of the list readers? I would say yes. And the power. They can filter them out at the level of the mailing address. Tell 'em to do their own work. Put it gently and politely, but if they're the list admin, they can easily filter out mail from specific addresses without bugging a busy remailer operator who is, after all, doing a service to the net much as the list admin is. "Scenario them rosily with a calculated ambiguity which they will be sure to understand." - - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLxv4hRNhgovrPB7dAQFBbwP/XCzg7Zyib0ZXPDPpv/0QKR+jKYCchJ+r bcIfM4g+rP1uxyuBj1ErLhvc18Dpu/zjp5u2ZR5F9L6OYEF6YrYrUhgq1hsTNc1U lHZsCNr8ZuOpfU/dLAeLvrZLNak39eVmoMnInSNO0q7dUoMnaKz8CjZAQvy+TK4A eqle4P9fmSM= =4z27 - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxw0MioZzwIn1bdtAQGx2AF/WUf23vWGlV6WXUfQ2BBYuEodnnUvN5GM hYLbdgZ7BO6NWpgbLSPQYCs2X4yWMqVW =m+km -----END PGP SIGNATURE-----

1 0