December 2003 - cypherpunks-legacy

Announce: ChainMail 0.6b applescript for using anon remailers
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

I've written an applescript for using the cypherpunks-style anon remailers with Eudora for the macintosh. It will take a message in Eudora, and construct a chain with MacPGP for encryption, through remailers you've specified, and then deposit it back in Eudora for sending. There are still several features I'd like to add to it, but it's quite useable in it's present incarnation. You need a scriptable version of MacPGP, scriptable version of Eudora, and some sundry scripting additions which are listed (with URLs) in the docs. Send email if you'd like a copy, and I'll mail you a binhex'd copy. I don't want it on any archive sites yet, because it's not really done, or fully beta tested for bugs. (so let that be a warning to you, too.)

1 0

request for factorising code
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have had a look at the exported version of Netscape's WWW browser which has support for secure transfer of info, and it says it uses RSA keys limited to 40 (not sure whether this is decimal digits or bits). This is the broken version for export, I am not sure what the non-crippled version uses. I would like to have a go at factorising a number of 40 digits to get a feel for how secure this system is. I suspect not very secure even 40 digits is pretty pitiful for an RSA key size 40 bits would be a joke. I would like to get a feel for how long it takes to factorise a 40 digit number. Does anyone have source code for factorising large numbers. I have code to generate the RSA key pairs and modulus, what I am looking for is code to factorise a number using one of the better algorithms (quadratic sieve, etc.). Adam -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAiwUXUEAAAEEAJnWEHE3juLAyMnEt3hrID3t8tblJvJPfoPz4Plg+2a5y4HA TonXBomkhm8hrRu1umruUUaeW1mxIbpvP413a2JyU7pdyfyoFVpWW5iT9pXYOgSW 65d+5GWe4g4PLrSbJZPBFIezd8xddnx5+5hbRk1K6UpfReQuOynIuJ1VakpnAAUT tB9BZGFtIEJhY2sgPEEuQmFja0BleGV0ZXIuYWMudWs+ =pRe7 -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUALxrGhSnIuJ1VakpnAQHzbAP/Q00RZan2rdMrIYzM3Dp4+620DFGoe0zi bRMvLUlKUuPPfdc5PYh/l7cxXwnj6/ARP6QUCyxlHwS/vKxHNJyhIcgna2yIBQGA NtCKZjZNdEYII9/taC4BXc7nTIvJKuz0EgXVSJwbUXgBjuMFA/ZGOrKr1SFcyLbP qMER2rgg5VM= =AJwi -----END PGP SIGNATURE-----

4 3

Economist on EFF
by John Young 17 Dec '03

17 Dec '03

The Economist of January 14-20 washes EFF's dirty laundry. After recounting Berman's boot and EFF droop, the article concludes: "That leaves cyberspace's radical libertarians without a voice in Washington. They're probably delighted."

1 0

Abuse and Remailer Ethics
by Homer Wilson Smith 17 Dec '03

17 Dec '03

I am surprised there isn't a widely agreed upon codification of remailer operator ethics for handling abuse cases. Perhaps there is, and I would appreciate someone pointing me to it. I am not presently on cypherpunks, so please include me in the replies. Here is the situation. homer(a)rahul.net runs with header logging on, it contains, From: To:, Date: and Subject. rahul.net also keeps syslog files for a week, and makes them public to those on rahul.net. B writes me saying he is the 'admin of a listserv' and complains that someone is abusing his list with postings through my remailer. He wants the name and e-mail of the abuser to 'talk to him personally'. Clearly I should not give out the name of a remailer user (if I know it) unless ordered to by a court order. Thus his request is, on the surface of it, absurd. In this case the alleged abuser, A, did not chain his posting so my logs clearly show who it is. Clearly I am always going to know the To: of an abuse because the complaint comes to me from or about that address. If the abuser only uses one remailer, then I am clearly going to know the From: line also, as it is right there in the header logs or rahul.net syslog files (same thing.) If the abuser chains and a complaint comes to me, all I will know about the From: line is that it came from another remailer. However now that I know his name and e-mail, if I get another complaint about him, and he has wised up and started chaining, I could pass his name onto the prior remailer before mine, and that remailer could do the same, until it came back to the first remailer on the chain who could take action. This however would piss off a lot of remailer operators. But now what action is appropriate? Well giving A's name to B is out of the question without a court order, right? Blocking the To: line, namely the abused party, is extreme as that blocks others from posting to that list or group, unless the list or the group wishes to have no anon messages. In which case I probably might consider blocking the end recipient. Blocking the From: line, will stop all further postings from that person, which is fitting if indeed he is 'abusing' people, but he will merely start posting through other remailers, who will then have to go through the same procedure. Perhaps there is some justification then for remailer operators sharing blocked From: lines with each other, that might be a good idea. But who is to decide what is or is not abuse? Surely I can't let others tell me that they have been abused without even reading the message, I have seen it happen all to often that parties claim they are being abused when they are merely being exposed and rightly so. On the other hand, since I am responsible for my own little corner of the net, if something happens that I consider abuse, I certainly have a right to put an end to it if I can. Some questions: Does any single recipient have the right to demand that they be blocked from all anon messages. I would say yes. How about demanding blocking anon messages only from some senders? That is harder to implement. If you block the sender, you block ALL his postings, not just to that party. So you would need to block specific From: and To: combinations. This would not work with chaining at all, even if we did share blocking information. So that is out. Does a list owner have the right to demand blocking to his list, with or without a vote of the list readers? I would say yes. What about a newsgroup? I would say it takes a vote. Are anon voites allowed? Touchy question that was important at one time on alt.r.scientology. Anyhow I would guess that the correct action here is to write the offender and let him know a complaint has been registered against him. I would also educate him as to why he was so easily traced and tell him that if he wants to avoid such in the future to start chaining. However if he is a determined abuser not prone to social embarassment, then the sharing of blocking among remailer operators might become a very good idea. I don't know how you seasoned reops feel about abuse, jpunix went out of business for want of an effective way to deal with it. I think part of the answer is in close cooperation. This might help keep the abuse down, and raise the reputation of reops so that people begin to think of us as responsible service providers rather than anarcho terrorists. However I am very new to this field, so I may have my head stuck up my ass, and I would like to hear back from you on your ideas. Homer Wilson Smith homer(a)rahul.net

1 0

Re: Another internet story: INFO: NBC Nightly News Tonight (fwd)
by mclow＠coyote.csusm.edu 17 Dec '03

17 Dec '03

>A story regarding the Internet, with some sort of mention of NRA.org, >should be on the NBC Nightly News with Tom Brokaw tonight. > It did not play out here on the left bank, probably because of the earthquake in Japan. Maybe tomorrow. -- Marshall

1 0

Abuse Complaint out of homer@rahul.net
by Homer Wilson Smith 17 Dec '03

17 Dec '03

Oh, Goody. I get to deal with my first abuse complaint for my remailer. Seems to me that letting others decide what is or is not abuse without at least being able to see the abuse myself would be wrong, that opens the door to just anyone claiming they were abused and my taking action against the alleged abuser. Clearly though if some admin of a system considers something an abuse, one can not just blow them off, we are all responsible for responsible use of the net. Even if this posting came through a chain, this admin is going to try to trace back the chain through the other remailers. So if I give him the remailer it came from, he is going to pester that remailer operator who won't appreciate it. I will soon be able to install blocking on the To: or From: lines. Blocking the From lines is hard, because usually abuse comes through other remailers, so I can't just block that. I can however block To: lines if the person is abusing one particular usenet newsgroup or end receiver. It would seem that if I am going to take action against someone with blocking of some sort, then I have at least a right to see the full posting that is claimed to be abusive. By the way, rahul.net keeps syslog files world readable which I find to be a security leak, as anyone (specifically the Church of Scientology) could find out who is in communication with me and start to harrass them too. Comments on ethics and diplomatic handling of this would be appreciated. Homer

2 1

Remailer Abuse (fwd)
by Homer Wilson Smith 17 Dec '03

17 Dec '03

Here is the message I sent to both the complainant and the complainee. Homer Dear ..... , I have been contacted by someone complaining about a posting you made through my remailer. They want me to tell them who you are, which ain't going to happen, but at the same time I don't like getting complaints, you understand? Of course I can not tell you who complained any more than I can tell them who you are. But you know where you have been posting using my remailer, right? Now I have no idea if what you posted was really abusive or not, I did not see the posting or postings, and I know a lot of people complain about 'abuse' when really its just their closed minds being opened up. I was able to 'trace' you because you sent something through my remailer without using chaining. If you had chained I would never know who the posting came from. I was told who it went too and the time, and its right there in my system's syslogs coming from you. If you chain and use PGP, then I could not have traced you. So read the instructions on chaining and make sure you USE it. You will be a lot safer in the future from complaint attempts than if you don't use chaining. If you have questions on how to chain, ask on alt.privacy.anon-server or read the various helps at many of the remailers. I have reposted this letter to alt.privacy.anon-server without your name and sent a copy to the complainant. I expect not to hear anything more about you, ok? Homer Wilson Smith System Adminstrator of Remailer at homer(a)rahul.net

1 0

Re: Abuse Complaint out of homer@rahul.net
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Michael wrote, to Homer and the lists > I am going to have to agree with you on this. > A Sysadmin would have to see the messages or data that is > supposed to be harassing the complainant. What I say is harassment > may be different from what you say it is. There's different levels of harassment. For the kind that says 1) "Don't send me any of this junk mail any more", if the recipient wants to define junk mail to the remailer-operator, there's no ethical problem if the operator wants to block remailed mail to the recipient, though it's good form in non-remailer-chain environments for the operator to issue a bouncegram if possible. If the recipient has to pay per byte/message to receive mail, or the amount transmitted is really excessive, then this is certainly something an operator ought to do to avoid problems. (It's potentially bad form for a for-profit operator to cash digicash postage for delivering the messages if he doesn't, at least without a warning in his pricing policy advertisment.) If the operator doesn't want to block remail to an unwilling recipient, the ethical and legal questions become more interesting. The question of whether the "don't bug me" list gets published is also interesting. For the kind of harassment complaint that says 2) "Block all remail to me from this destination", there are implementation issues - can the remailer perform checks like this before doing the header-munging? Is there more security risk? Of course, with chaining, it's a lot less useful. For the kind of complaint that says 3) "Block all remail to this group of people", there's the question of whether the requester is authorized to request that for the entire group - newsgroups are an especially interesting problem. Julf's remailer blocks posting to some newsgroups, because the readers have done the usual net.poll and decided they'd like him to block it, since lots of the remail was spam. But especially with newsgroups, it's easy for the recipient to trash incoming articles from the remailers. Bill

1 0

Re: Abuse and Remailer Ethics
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> OK, I understood all this. I am afraid that if we implement a total > no tracing scenario, then remailers will come under heat from the world at > large and the governments. Maybe not. Rright now, Rahul (a good guy) is > implementing syslogs whether I want him to or not, and that isn't about to > change. Really I would have to be the owner of my own system in order to > do what you are suggesting. You can do a good job of anonymous remailing even on a system that keeps email logs, if the system is otherwise trustable. When mail comes in to your remailer, store it in a file (encrypted....). Periodically take the files of stored messages, shuffle them, and mail them out. It's about the same behavior as doing the same from your own box with eavesdroppers on your network, though the traffic levels are a bit different if each remailer operator on rahul.net gets identified separately instead of all the remailers getting lumped together. But if there are multiple remailers on Rahul's machine, and if the syslogs don't log internal mail, you could also forward some of the remailer traffic randomly through other remailer-operators there. Bill

1 0

Re: Jude Milhon in WIRED
by ddt＠lsd.com 17 Dec '03

17 Dec '03

Anyone with any dang sense left at all knows that St. Jude is the secret CypherGoddess behind this whole eff-in' thing, besides being the Patron Saint of Hopeless Causes... ;) dave _________________________________________________________________________ "There are three sides to every issue: my side, your side and the side of the truth." -Babatunde Olatunji

1 0