December 2003 - cypherpunks-legacy

Re: Microsoft TrueName (tm) (fwd)
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >From: Censored Girls Anonymous <carolb(a)barton.spring.com> >To: cypherpunks(a)toad.com >Subject: Re: Microsoft TrueName (tm) >Praise Bob! The Rev. Ivan Stang's been preaching that for years! >Long live the Slackmaster! I wondered why one of the few registered hosts for Microsoft were called "Bob" - now it makes sense. (But they've got a good sized chunk of netblks registered...) - -NetSurfer #include <standard.disclaimer> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> == = = |James D. Wilson |V.PGP 2.7: 512/E12FCD 1994/03/17 > " " o " |P. O. Box 15432 | finger for full PGP key > " " / \ " |Honolulu, HI 96830 |====================================> \" "/ G \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxVXWioZzwIn1bdtAQFrygF+LKX95qYx46I4dr7TL5WBZd3brfu8VqcE BDR+o9c/Vqu1XTGTNiS2Ij4JCEm/R4Dw =CMgM -----END PGP SIGNATURE-----

1 0

Why use plastic for remailers and DH?
by Angus Patterson 17 Dec '03

17 Dec '03

This point may have been raised before, but anyway, unless you're using a swiss-bank issued credit card for a numbered account (if that's at all possible), or a bogus name on the card, why would anybody want to use something as completely traceable as a credit card to pay for a remailer or a data haven?

3 2

Re: Storm Signals
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Sam Kaplin writes: > Todd Masco writes: > > 1: Somebody's roommate (a Green Beret) has been called back into > > 6 months of active service. He was not told where he'd be. > > Perhaps Bosnia? I doubt it. The only sort of Bosnian engagement that might make sense would involve a fairly conspicuous effort with a large number of troops. I can't see what a few thousand Green Berets could accomplish there. Frankly, I'm quite puzzled by these signs. I can't think of any country that seems due for a quick invasion by the USG, but the increase in granularity of the GPS information suggests an operation of greater magnitude than just a strike against terrorists, drug cartels etc. Is it time for Bay of Pigs II already ? ;) -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLxOY7Gf7YYibNzjpAQF7nwP+KUk7o1bpM76wmGrzv+KZIgi8kby1XHIj 4FzXLLZGLC8bVGGniv1NkLR76XH6HeLfWpaJu4LeCCBE6RbsgUD+bqEQeTdijpVg OJzOWM/Rt6/vTJT+/yiVpFBbPDgG1sXvy4SlQX0wSATNzjbdNHxoorory1fOmjRi 6RF2tHYFbTM= =Yk81 - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxOZ9ioZzwIn1bdtAQFF/QGAiqkCeSwdxCMlF0AeO6jOJkaxKQ4EAe68 +AYM/slciv3rbqrkw6nRf19LM7AmXBsG =lDeV -----END PGP SIGNATURE-----

9 9

Re: Getting on the list
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 06:57 PM 1/11/95 EST, Paul J. Ste. Marie wrote: (something I didn't mean to send out to cypherpunks) Sorry. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

How do I know if its encrypted?
by marko＠millcomm.com 17 Dec '03

17 Dec '03

I keep seeing the idea that to keep out of trouble remailers and Data Havens should require that data be encrypted before it is accecpted. My question is how do I know it is encrypted? If I say that anyone sending me data to be massaged by my system must first encrypt it, how do I know they are in fact complying with that request? After all this is the area for the paranoid's to hang out in. I see some possible options. Most don't seem to workable. I could ... (1) Look at the incomming data, which of course would be impractical and defeat the whole idea. (2) Force them to pgp it, but that could be defeated by having enough of a pgp sig. that my system is fooled. Not to mention they must use *MY* idea of what good encryption is. After all I could say you must use my encryption software that has a backdoor I know of, i.e. clipper, or that costs money and can only be bought from me. This last point would be one way of making sure you made some money, but does seem impractial. (3) Peform a histogram analysis on it, if it doesn't pass a certain threshold reject the whole thing. Although cute, I don't like this one. (4) Encrypt it with my own key and decrypt it before squirting it back out. This doesn't seem to gain me anything though since it could be said that I still have the ability to look at the data. (5) Only acecpt data from a remailer or other service that would be guranteed to be encrypted. This seems like it would lead to a 'good ole boy' network that could exclude service providers it doesn't like. etc. etc. Whos to say that the data isn't encrypted? I could be hidding a real message in that eagale spread of a porn picture. 'Simple, don't allow porn but only accecpted images.' Well that certainly sounds like a can of worms waiting to squirm around your toes. Is the question of what is encrypted data similar to what material is porn or some other 'evil' data? Am I missing something in this simple requirment of only dealing with encrypted data? Or am I simply blowing something way out of proportion? -Mark ---------- Mark Oeltjenbruns marko(a)Millcomm.com N0CCQ SnipIt Research Finger for PGP key. 'My other key is 2048 bits.'

5 4

Re: How do I know if its encrypted?
by daleh＠ix.netcom.com 17 Dec '03

17 Dec '03

You wrote: > > My question is how do I know it is encrypted? > >Calculate an entropy measure of some sort. Entropy is a measure of >disributional skew. Maximum entropy means minimum skew. > >For human-readable text of any sort, the monogram entropy, i.e. the >entropy of individual characters, will _always_ be detectably less >than maximal. Encrypted text will always be near maximal. The two >are easy to distinguish. ASCII-armored encrypted text will always be >right at 6 bits per byte. > >For speed of implementation, you don't need even to look at much text. >You can get a statistically significant measure quite quickly from the >first couple of kilobytes. > >And since you're only really worried about detecting non-randomness, >you don't even need to calculate the exact entropy but rather an >approximation of it. This approximation can be done with entirely >fixed point arithmetic, if you're a bit clever about it. > >A practical system would cut out a notch at 6/8 for ASCII armor, which >would make approximation techniques a bit tricky. More practical is >just to detect ASCII armor with a regular expression recognizer and >de-armor it before the entropy check. > >Eric > > Won't work! You can always embed an encrypted message in what 'looks' like plaintext. A trivial example: Encrypt a message with a caesar cypher, then build a story where the first char of each word maps to each subsequent char from the encrypted text. At the cost of expanding the size of the message by a factor of 5 to 10 you've hidden the encrypted message in what looks like a letter to your mother (or a news story in the NY Times, etc.) This is old technique. Dale H.

3 2

Re: How do I know if its encrypted?
by daleh＠ix.netcom.com 17 Dec '03

17 Dec '03

You wrote: > >The context this was being discussed in, was trying to make _plaintext_ >look like _ciphertext_. The operator of a data haven or remailer might >hypothetically want to ensure that all text he dealt with was encrypted. >So your method wouldn't do anything in that area. The discussion was one of whether you could distinguish plaintext from cyphertext by doing a statitical analysis of the datastream, i.e. can you tell one from the other without actually reading each message. The answer is no. Dale H.

1 0

Finally got on
by John Draper 17 Dec '03

17 Dec '03

I finally got on... I actually didn't get that swamped, but certainly I couldn't be expected to know that cypherpunks-request was defunkt. Oh well. Now that I'm on, I was wondering if anyone would let me know the status of Phil Zimmerman's case, and where I can xtract any info. I've heard reports that the Govt. was planning to press charges. Just getting back on here again, I'm not in the know of these things, but can now handle large amounts of mail. I'm also interested in knowing how I can help in Phil's defence case. Where do people mail checks to Phil's defence fund? Anyway, glad to be back up here again.... And a big fat HAPPY NEW YEAR to all of you Cypherpunk folks!! And Oh Yea!! Hi Brad, glad to make your acquaintence... Yup! The WELL was sure hosed today.... I'm just now getting mail thats backed up now for the 4 days I've been without power. There is ONE disadvantage of living out in the country.... Power can be a tad flakey. We've just got our power turned on today.... Yay!!! When I returned from MacWorld, things were really dark up here. :-) Cheers C. Crunch PS = Scuse the formatting, I STILL cannot get Microphone to not automatically word wrap.

2 1

Re: How do I know if its encrypted?
by daleh＠ix.netcom.com 17 Dec '03

17 Dec '03

You wrote: >So people can write special software that gets their message rejected >by an entropy filter. This is a disadvantage? It looks like an >irrelevancy to me. > It's an artificial example, but one that points out that merely doing a frequency analysis on the datastream isn't enough to guantee the correct answer. Reliable remailer software will have to worry about false postives as well as false negatives; especially if it's a fee-for-service operation. This might also be a nice feature if you're trying to dodge an NSA filter. >Seems to me that a quite reasonable condition of use of a remailer is >that what is passed isn't human readable. > Of course the implicit assumption in that statement is that encrypted traffic hasn't been outlawed or regulated, or that the sender doesn't want to 'appear' to be sending encrypted traffic.

1 0

RE: How do I know if its encrypted?
by m00012＠KANGA.STCLOUD.MSUS.EDU 17 Dec '03

17 Dec '03

Check the entropy?

1 0