December 2003 - cypherpunks-legacy

Known data havens for pirates? Doubtful
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

I forget who wrote: > blame them. Copyrighted data on a server in a jurisdiction that > doesn't acknowledege the copyrights - a prime use for Data Havens > when they come of age. I suppose you _are_ aware that the US has threatened China with punitive duties on $100 BILLION dollars worth of trade, and that China has started holding some show trials (without shutting down its state-owned CD-piracy factories). It's not going to be easy to find a country more willing and able to ignore international copyright law (Berne Convention etc) than China; however, despite howls of protest even China is likely to knuckle down eventually. What may be likely is distributed piracy markets, such as described in Tim's BlackNet spoof. Read my earlier post on what Lance Rose thinks. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

6 5

Re: How do I know if its encrypted?
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I think we're pretty well agreed that Dave's DataHaven can't ensure that files are encrypted without looking inside them at some point. It's a dilemma: Dave wants to be sure he can't read something, but the only way he can be sure is by reading it. But suppose that Dave's good friend Ender Trent decides to set up a new service, Ender Trent's Trusted Encryption. It's a simple job: people send files to Ender and he returns them encrypted and signed. Now, all Dave needs do is check Ender's signature before accepting a file. At no point does Dave ever decrypt or attempt to decrypt such a file. Ender offers encryption in many different forms. In the simplest, Alice sends the file to Ender, Ender generates a random key, encrypts the file, and sends both back to Alice. Almost as simple, Ender uses the hash of the original file as the key. Presumably, Alice already knows the hash and so Ender doesn't send that back. Alice could supply a public PGP (or other asymmetrical algorithm) key with the file and Ender uses that. If Alice is a frequent customer and likes this method, she might register the key with Ender. Lastly, Alice might want to supply a symmetric key of her own. Because Ender wants to protect people like Dave, he can either print a warning that the key used for encryption might not be secure, or run a password-cracking algorithm on it, or both. Because of the extra effort and reduced security, Ender might not want to offer this, or charge an arm and a leg for it. And Dave might not be willing to accept such files, anyway. How is it better to have Ender do all this rather than Dave? Essentially, it splits the risk. Dave never sees the files, and therefore can't be responsible for their contents. Nor could he make sense out of them, even if he tried really, really hard. He could operate his data haven in all but the most repressive parts of the world. Ender's risk is slim to none. Were he to be held accountable for files he encrypts, public notaries would likewise have to be held accountable for everything they notarize. I don't see that as a problem. Dave might wish to offer an encryption service, as Ender might want to offer a data haven, but, if they're smart, they won't accept files that they themselves encrypted. Ender's encryption need not only be for data havens, of course. Nervous remailer operators might want proof of encryption. Escrow services will likely like Ender. And probably more. If there is a demand for a trusted encryption service, I'll create one after the second trumpet audition for the Oregon Symphony on the first of the month. That's the main reason I'm signing this--to hold myself to it. b& -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEUAwUBLxrj5a7gd9aHWwWVAQH2Hgf0CF+0CIMWiK7d52Gaa8fPpMQy+qAYOBj+ MxJPZJpwxLEzmdT8n+dWjz2+0uPbIXXYa8yEM86UeV9++BzNM7WkOr5tezUuUrYa aM+I4yWJEz/oUpURxi4tt1Jmxn4F0IGQENBweIw+lsgU/TyNweCerKoShLpP4zca iZr1HtkK/7KdEi/wmADtfI6aUHytRyMXYvwKhKiy23eAFyNtZgAz4i77p2Kw6iM6 aTGsQQVjda6AYcVlIcLAJN8v+pQV+RGKA4FGACsxEGHDCQvFd3/WvCD4pupPm80E 9QLhQ2zLIjAkSmkO9flndXq6TOcCtMd3f6u/oGCx1EHKUTdP8nbg =svFy -----END PGP SIGNATURE----- -- Ben.Goren(a)asu.edu, Arizona State University School of Music Finger ben(a)tux.music.asu.edu for PGP public key ID 0x875B059.

1 0

Re: REQUEST: Privacy/Free Speech URLs
by jml＠wizard.synapse.net 17 Dec '03

17 Dec '03

>On the request of a few law-related professors and other faculty, I'm >trying to put together a web page that brings together resources from all >over the net that are related to issues of free speech, privacy, libel, >censorship, etc. > >If you have a few URLS with materials related to the above, I'd >appreciate it if you could drop them in an emailee to me. Basically, any >URL that ends up pointing to issues of rights and rules on the net, and >possibly related software (such as PGP and the like). > >Thanks much :-) Check out Vince Cate's Cryptorebel/Cypherpunk Page at: ftp://furmint.nectar.cs.cmu.edu/security/README.html It has just about everything with links to other sites that have links to other sites that have links to.... it's a web thing. :-) *********************************************** jml(a)wizard.synapse.net PGP encrypted mail preferred. I might disagree totally with what you say but I'll defend your right to say it to the death. ***********************************************

1 0

US News on Policing Cyberspace
by John Young 17 Dec '03

17 Dec '03

US News of January 23 has a cover story on "policing cybersapce", another drumbeat about "the growing threats to your privacy and property in the information age." Not much new for this group except to enjoy another Spielberg gremlin of Jekyll and Hyde cryptography, fearful remailers, slippery digicash, stolen services and personal data, smuggling, terrorism, child pornography, Tennessee BBS, "cybercops" and such. Featuring the FBI's Kallstrom and Tafoya and FLETC and Financial Fraud Institute and Clipper and protective wiretaps, with supporting roles for Kevin Mitnick, Bruce Schneier, Mike Godwin, Marc Rotenberg, John Perry Barlow, Esther Dyson, Robert Corn-Revere. And, a cartoon on how to teach parents fear of the Net for their children. Cypherpunk is not sited, I think, or is it steganoed?.

1 0

Longer than 1048 bit keys
by Jaeson.M.Engle＠josaiah.sewanee.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm using MacPGP 2.6(ui) and noticed that the limit for a key size is the 1048 bit ("military grade" (right)). Is there anyway to circumvent this to make larger, harder-to-break-type keys? TIA, - -J -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLxr4xEiLvmPjc4XdAQFVZgP/UsykAUkO18IFddV+QTOkEK4wwipljb/F U1zkrh3IlUUHg82OVhS7tAtEn68d2NyNvbv5k+00CY+DYv9eSLgSbgTeMyyspFTf ZmQtjQZu0Qe6NVWOVMXAFzfUDhmAAytfssvMHqSEMyxaHdyNNFoK9csSg39VchfF s/VBsHv9sZ4= =JQbl -----END PGP SIGNATURE----- (-: aka: :-) (-: Jaeson M. Engle || jme(a)josaiah.sewanee.edu :-) (-: www server: http://josaiah.sewanee.edu/ :-) (-: It's January 29th! IT'S TIME!!! Ask me for details!:-) (-: Finger 'jme(a)josaiah.sewanee.edu' for my Public :-) (-: PGP block. :-)

1 0

Another internet story: INFO: NBC Nightly News Tonight (fwd)
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 16 Jan 1995 16:44:07 -0500 From: Craig Peterson <craig(a)Mainstream.com> To: Multiple recipients of list <rkba-alert(a)gatekeeper.nra.org> Subject: INFO: NBC Nightly News Tonight A story regarding the Internet, with some sort of mention of NRA.org, should be on the NBC Nightly News with Tom Brokaw tonight. Craig.

1 0

Announce: ChainMail 0.6b applescript for using anon remailers
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

I've written an applescript for using the cypherpunks-style anon remailers with Eudora for the macintosh. It will take a message in Eudora, and construct a chain with MacPGP for encryption, through remailers you've specified, and then deposit it back in Eudora for sending. There are still several features I'd like to add to it, but it's quite useable in it's present incarnation. You need a scriptable version of MacPGP, scriptable version of Eudora, and some sundry scripting additions which are listed (with URLs) in the docs. Send email if you'd like a copy, and I'll mail you a binhex'd copy. I don't want it on any archive sites yet, because it's not really done, or fully beta tested for bugs. (so let that be a warning to you, too.)

1 0

Abuse Complaint out of homer@rahul.net
by Homer Wilson Smith 17 Dec '03

17 Dec '03

Oh, Goody. I get to deal with my first abuse complaint for my remailer. Seems to me that letting others decide what is or is not abuse without at least being able to see the abuse myself would be wrong, that opens the door to just anyone claiming they were abused and my taking action against the alleged abuser. Clearly though if some admin of a system considers something an abuse, one can not just blow them off, we are all responsible for responsible use of the net. Even if this posting came through a chain, this admin is going to try to trace back the chain through the other remailers. So if I give him the remailer it came from, he is going to pester that remailer operator who won't appreciate it. I will soon be able to install blocking on the To: or From: lines. Blocking the From lines is hard, because usually abuse comes through other remailers, so I can't just block that. I can however block To: lines if the person is abusing one particular usenet newsgroup or end receiver. It would seem that if I am going to take action against someone with blocking of some sort, then I have at least a right to see the full posting that is claimed to be abusive. By the way, rahul.net keeps syslog files world readable which I find to be a security leak, as anyone (specifically the Church of Scientology) could find out who is in communication with me and start to harrass them too. Comments on ethics and diplomatic handling of this would be appreciated. Homer

2 1

Economist on EFF
by John Young 17 Dec '03

17 Dec '03

The Economist of January 14-20 washes EFF's dirty laundry. After recounting Berman's boot and EFF droop, the article concludes: "That leaves cyberspace's radical libertarians without a voice in Washington. They're probably delighted."

1 0

Abuse and Remailer Ethics
by Homer Wilson Smith 17 Dec '03

17 Dec '03

I am surprised there isn't a widely agreed upon codification of remailer operator ethics for handling abuse cases. Perhaps there is, and I would appreciate someone pointing me to it. I am not presently on cypherpunks, so please include me in the replies. Here is the situation. homer(a)rahul.net runs with header logging on, it contains, From: To:, Date: and Subject. rahul.net also keeps syslog files for a week, and makes them public to those on rahul.net. B writes me saying he is the 'admin of a listserv' and complains that someone is abusing his list with postings through my remailer. He wants the name and e-mail of the abuser to 'talk to him personally'. Clearly I should not give out the name of a remailer user (if I know it) unless ordered to by a court order. Thus his request is, on the surface of it, absurd. In this case the alleged abuser, A, did not chain his posting so my logs clearly show who it is. Clearly I am always going to know the To: of an abuse because the complaint comes to me from or about that address. If the abuser only uses one remailer, then I am clearly going to know the From: line also, as it is right there in the header logs or rahul.net syslog files (same thing.) If the abuser chains and a complaint comes to me, all I will know about the From: line is that it came from another remailer. However now that I know his name and e-mail, if I get another complaint about him, and he has wised up and started chaining, I could pass his name onto the prior remailer before mine, and that remailer could do the same, until it came back to the first remailer on the chain who could take action. This however would piss off a lot of remailer operators. But now what action is appropriate? Well giving A's name to B is out of the question without a court order, right? Blocking the To: line, namely the abused party, is extreme as that blocks others from posting to that list or group, unless the list or the group wishes to have no anon messages. In which case I probably might consider blocking the end recipient. Blocking the From: line, will stop all further postings from that person, which is fitting if indeed he is 'abusing' people, but he will merely start posting through other remailers, who will then have to go through the same procedure. Perhaps there is some justification then for remailer operators sharing blocked From: lines with each other, that might be a good idea. But who is to decide what is or is not abuse? Surely I can't let others tell me that they have been abused without even reading the message, I have seen it happen all to often that parties claim they are being abused when they are merely being exposed and rightly so. On the other hand, since I am responsible for my own little corner of the net, if something happens that I consider abuse, I certainly have a right to put an end to it if I can. Some questions: Does any single recipient have the right to demand that they be blocked from all anon messages. I would say yes. How about demanding blocking anon messages only from some senders? That is harder to implement. If you block the sender, you block ALL his postings, not just to that party. So you would need to block specific From: and To: combinations. This would not work with chaining at all, even if we did share blocking information. So that is out. Does a list owner have the right to demand blocking to his list, with or without a vote of the list readers? I would say yes. What about a newsgroup? I would say it takes a vote. Are anon voites allowed? Touchy question that was important at one time on alt.r.scientology. Anyhow I would guess that the correct action here is to write the offender and let him know a complaint has been registered against him. I would also educate him as to why he was so easily traced and tell him that if he wants to avoid such in the future to start chaining. However if he is a determined abuser not prone to social embarassment, then the sharing of blocking among remailer operators might become a very good idea. I don't know how you seasoned reops feel about abuse, jpunix went out of business for want of an effective way to deal with it. I think part of the answer is in close cooperation. This might help keep the abuse down, and raise the reputation of reops so that people begin to think of us as responsible service providers rather than anarcho terrorists. However I am very new to this field, so I may have my head stuck up my ass, and I would like to hear back from you on your ideas. Homer Wilson Smith homer(a)rahul.net

1 0