December 2003 - cypherpunks-legacy

Re: NOISE: advice on applications
by Peter Trei 17 Dec '03

17 Dec '03

> > > I've just recently set up a PPP account, mainly so I could > run Netscape. I'm thinking of adding PC Eudora for mail. > Any advice on a good newsreader and any other applications > it would be handy to have? > Thanks. > AR While I have yet to find the Perfect PC Mail Client, I have to say that I find Pegasus far superior to Eudora. The free version of Pegasus includes mail filtering capabilities, essential if you expect to receive mailing lists (such as cypherpunks). Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

1 0

CALLER ID AVOIDANCE
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, While reading the July issue of Soldier of Fortune, I ran across an ad for yet another telephone anonymity service. It reads: CALL 1-900-CUT TRAX Secure your most sensitive calls from all forms of caller I.D. and return-call technologies? Now make calls from your own telephone safely and anonymously. No need to find a public phone to be discreet. Trackers never see your number...only ours! And their number will not appear on your phone bill. Call any number in the continental US... Just $3.95 a minute for safe secure conversations! Call 1-900-CUT-TRAX (1-900-288-8729) Beacon Telesystems 914-423-3329 Not necessarily as secure as they would have you believe, but it does demonstrate there is a market for anonymity, I guess. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 4

Re: Three strikes you're out! for politicians... yeah we wish!
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:52 PM 7/22/95 -0400, Rich Salz wrote: >Better yet do it the way Comedy Central wanted to: > Three strikes your out and term limits. You can run for re-election > but if you lose you get shot. >

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.taylored.com This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp. hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"crown"} = "<mixmaster(a)kether.alias.net> cpunk pgp hash latent cut mix ek reord"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)spook.alias.net> cpunk mix pgp hash latent cut ek"; $remailer{"gondolin"} = "<mixmaster(a)gondolin.org> cpunk mix hash latent cut ek ksub reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. 21 Apr 1995: The new version of premail (0.33) is out, with direct posting, perl5 and better MH support, and numerous bug fixes. Last ping: Mon 24 Jul 95 6:07:21 PDT remailer email address history latency uptime ----------------------------------------------------------------------- hacktic remailer(a)utopia.hacktic.nl *+********** 12:38 99.99% spook remailer(a)spook.alias.net *--********* 25:21 99.99% flame remailer(a)flame.alias.net +-++++++++++ 57:34 99.99% replay remailer(a)replay.com *+****++***+ 13:12 99.99% rmadillo remailer(a)armadillo.com +++++++++++ 49:13 99.99% crown mixmaster(a)kether.alias.net --+-+++-+--+ 1:25:56 99.98% bsu-cs nowhere(a)bsu-cs.bsu.edu ###*-#*#**** 13:47 99.98% portal hfinney(a)shell.portal.com #######***** 4:03 99.96% vishnu mixmaster(a)vishnu.alias.net ++*******+** 13:36 99.73% gondolin mixmaster(a)gondolin.org +*----*----- 1:45:44 99.73% vox remail(a)vox.xs4all.nl .------.-- 15:58:51 99.99% ideath remailer(a)ideath.goldenbear.com ........-. 14:21:20 99.32% ford remailer(a)bi-node.zerberus.de #-#+#++-**-* 39:46 99.26% extropia remail(a)extropia.wimsey.com _ --. -..-- 13:25:43 99.20% hroller hroller(a)c2.org +*-++#+#*--* 1:13:04 99.05% syrinx syrinx(a)c2.org +-------- -- 3:28:31 99.01% penet anon(a)anon.penet.fi --+++------ 8:45:41 98.69% alumni hal(a)alumni.caltech.edu #*#** ***** 4:36 97.24% rahul homer(a)rahul.net *##+-##***++ 10:07 99.98% rebma remailer(a)rebma.mn.org +--+-.-+_.- 21:34:08 86.95% c2 remail(a)c2.org ++-+++- -- 2:41:11 85.54% mix mixmaster(a)remail.obscura.com ---+ 3:12:31 77.55% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Now You Can Own a 'Munitions Tshirt'
by dhenson＠itsnet.com 17 Dec '03

17 Dec '03

Now you can wear a TSHIRT that has been classified as a MUNITION by the US Goverment. That's right! The US International Traffic in Arms Regulations (ITAR) makes exporting cyrptographic materials illegal. ITAR further defines export as providing cryptographic information to a non-US/Canadian citizen even if you are inside the US at the time. Providing information is further defined as telling or showing information to a non-US/Canadian citizen. The Munitions Tshirt has a Perl implementation of the RSA algorithm (the one used by PGP) printed on the front along with a bar-code of the same algorithm. What all the above means is that if you wear the Munitions Tshirt where a non-US/Canadian citizen can see it, even if it is inside the US, you have just exported cryptographic material (which is already freely available outside the US) and have become a criminal in the eyes of the US Government. Now you too can become an international arms dealer for the price of a tshirt (US$15.95 - US$19.95, depending on size) and the guts to wear it. If you are a non-US/Canadian citizen, you can still own a Munitons Tshirt by ordering the tshirt from a source that is outside the US. The email response to a request for info (see next paragraph) includes full instructions for ordering the tshirt no matter where you live. For more information on how to own this classic example of civil disobedience, just send email to dhenson(a)itsnet.com with the subject of 'SHIRT'. (You don't have to be a US/Canadian citizen to request the info.) Or, if you have WWW access, just point your Web browser to: http://colossus.net/wepinsto/wshome.html By the way, 25% of the profits from the sale of the tshirt (in the US/Canada) goes to the PHIL ZIMMERMANN LEGAL DEFENSE FUND to help defend the author of PGP from harassment and possible prosecution by the Fedgoons. And if you get arrested for wearing the Munitions Tshirt, we'll refund your purchase price. :-) Get your Munitions Tshirt now. Who knows how long they'll stay in production! Don Henson, Managing Director (PGP Key ID = 0X03002DC9) West El Paso Information Network (WEPIN) Check out The WEPIN Store at URL: http://colossus.net/wepinsto/wshome.html

1 0

Re: Exporting from Canada (was Re: Let's try breaking an SSL RC4 key)
by M. Plumb 17 Dec '03

17 Dec '03

Sorry for taking so long to respond to this. I have been checking out the Canadian rules for exporting crypto. Basically (according to "A Guide to Canada's Export Controls", published by the Department of Foreign Affairs and International Trade) public domain software can be exported from Canada -- one might need to file a form with Canadian Customs for each export, but the export it self is legal. (Public domain is defined as technology that has been made available without restrictions upon it's further dissemination. Copyright restrictions do not remove technology from the public domain. So, I'm not quite sure if PGP falls within that definition.) However, goods of U.S. origin are export restricted, unless said goods are further processed outside the U.S. so as to result in a substantial change in value, so some of the PGP development would need to be done in Canada. -- -marc

4 4

Re: An idea about Java and remailer clients and servers...
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Phil Fraering writes: > Does it have to be the case, then, that we even have separate client > and server versions? If a new program is going to be written in > Java, can't it have the functionality of both client and server? > > Why not "charge" for the ability to send an anonymous message with > the duty to have for a short time (maybe an hour or two) running > on your machine a node in a remailer network? Futplex writes: > It would be interesting to see how the market would react to this. > There might be quite a bit of reluctance to take on the liability > of a remailer operator just to send an anonymous message (maybe > that's a good thing ;) Running a remailer is forbidden by many ISP usage agreements. Many of the potential users of a remailer may not be able to 'pony-up' a few hours of remailer operation lest they loose their account. I thought the idea was to get more people using the remailers, not fewer (perhaps just fewer abusers)... Also, users must be aware of a remailer (and have its public key) to use it. I suppose you could temporarily add the user to a web page which clients checked for a list of current remailers. However, there are issues of reputations of long-running remailers, etc... andrew

1 0

PKA_boo
by John Young 17 Dec '03

17 Dec '03

7-24-95. NYPaper: [Denise Caruso's column] "New Microsoft network will offer a wealth of privacy." It seems unthinkable that anything has been left unsaid about the Microsoft Network. And even less has been said about MSN's design, which Microsoft has said complies with the new data-privacy rules that the European Union is expected to adopt in September. The new European policy would set out clear guidelines about the way in which companies -- in this case, Microsoft and its independent content providers -- can collect and use the personal data about their European customers that the companies gather electronically. Microsoft has said it plans to extend the same privacy provisions to its American customers. The European provisions are a striking departure from current practices in the United States, where few restrictions protect consumers from marketeers, who collect and sell consumers' personal information. PEK_boo

1 0

MSN privacy
by Tom Bizzell 17 Dec '03

17 Dec '03

Here is some info that was circulating around our office today. > *** Forwarding note from KKASTRP --RHQVM12 07/10/95 10:43 *** > To: KURT --RHQVM02 Anderson, K. K. LLANDER --RHQVM17 Anderson, L.L. > > Karen R. Kastrup 8/826-4664 9/(914)766-4664 > Manager, Services Accounting > Somers 4, 3J36 > Subject: Windows 95 > > *** Forwarding note from KASTRUP --ISSCVM 07/10/95 10:31 *** > To: KKASTRP --RHQVM12 > > *** Resending note of 07/10/95 09:43 > STAN KASTRUP > ISSC - INFORMATION STRATEGY & MANAGEMENT > 8/351-3229 9/(914) 288-3229 > SUBJECT: Windows 95 > Amazing! (I chopped off about 10 "forwards.") > ------- Forwarded Message > > > From: Carlos Shaw IBMMAIL:USIB2T2D cshaw(a)vnet.ibm.com > > *************************************************************** > > Subject: news on Windows95 > > ---------------------------------------------------------------------- > > Newsgroups: comp.risks > > From: cnorloff(a)tecnet1.jcte.jcs.mil > > > > Date: Wed, 17 May 95 13:44:40 EDT > > > > Microsoft officials confirm that beta versions of Windows 95 include a > > small viral routine called Registration Wizard. It interrogates every > > system on a network gathering intelligence on what software is being run > > on which machine. It then creates a complete listing of both Microsoft's > > and competitors' products by machine, which it reports to Microsoft when > > customers sign up for Microsoft's Network Services, due for launch later > > this year. > > > > "In Short" column, page 88, _Information Week_ magazine, May 22, 1995 > > > > The implications of this action, and the attitude of Microsoft to plan > > such action, beggars the imagination. > > > > An update on this. A friend of mine got hold of the beta test CD > > of Win95, and set up a packet sniffer between his serial port and the > > modem. When you try out the free demo time on The Microsoft Network, it > > transmits your entire directory structure in background. > > This means that they have a list of every directory (and, potentially > > every file) on your machine. It would not be difficult to have something > > like a FileRequest from your system to theirs, without you knowing about > > it. This way they could get ahold of any juicy routines you've written > > yourself and claim them as their own if you don't have them copyrighted. > > > > Needless to say, I'm rather annoyed about this. > > So spread the word as far and wide as possible: Steer clear of Windows > 95. > > There's nothing to say that this "feature" will be removed in the final > > release. > > > > David > > > > Carlos Shaw | nodeid/userid: stlvm6(cshaw) > > IBM - STL (J95/E443) | (408) 463-4995; (tie) 8-543-4995 > > 555 Bailey Ave | fax (408) 463-4763; (tie) 8-543- > > San Jose, CA 95141 | CompuServe id: 73203,1424 > > Subj: news on Windows95 > > > >ÿÿ > > >-------- End of Forwarded Message > > ------------------------------------- E-mail: dough(a)syntec.com (Doug Hadley) Date: 07/24/95 Time: 10:54:04 -------------------------------------

2 1

Re: S/MIME and the Future of Netscape
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 12:54 PM 7/23/95, Bob Snyder wrote: >tcmay(a)sensemedia.net said: >> With regard to SSL and Netscape not being open to outside developers, >> several leading e-mail outfits, including Qualcomm, Netscape, >> Frontier, etc., are working on an interoperable secure e-mail >> standard called "Secure/MIME," or "S/MIME." > >Do you have sources for this information? MOSS is out there at least as a >Internet Draft, and possibly further along, and Steve Dorner of Qualcomm, the >original author of Eudora, is pretty active in the MIME community and I doubt >he would support a second MIME type to do the same thing... Some of you have expressed skepticism about the mention of "S/MIME." The longterm significance of S/MIME is debatable, of course. But here's the press release I got from Jim Bidzos: Date: Wed, 19 Jul 95 10:34:04 PDT From: jim(a)RSA.COM (Jim Bidzos) To: tcmay(a)sensemedia.net Subject: Integrating RSA into Netscape (Netnews and Mail) FYI... RSA News Release For information, contact: Patrick Corman or Lisa Croel Corman/Croel Marketing & Communications (415) 326-9648 or (415) 326-0487 Corman(a)cerf.net or Lcroel(a)mediacity.com Major Networking and Messaging Vendors Endorse Open Specification for Secure E-Mail S/MIME Based on RSA Public-Key Encryption Technology Redwood Shores, CA -- July 24, 1995 -- Several major networking and messaging vendors, in conjunction with leading cryptography developer RSA Data Security today announced their endorsement of a specification for interoperable e-mail security, to be known as "S/MIME", short for "Secure/Multipurpose Internet Mail Extensions". Several of the vendors announced plans to release S/MIME-compliant products next quarter. The S/MIME specification is based on the popular Internet MIME standard (RFC 1521), which provides a general structure for the content type of Internet mail messages and allows extensions for new content type applications... like security. S/MIME will allow vendors to independently develop interoperable RSA-based security for their e-mail platforms, so that an S/MIME message composed and encrypted on one vendor's application can be successfully received and decrypted on a different one. Major vendors who today announced support for the S/MIME secure interoperable e-mail plan include Microsoft, Lotus, Banyan, ConnectSoft, QUALCOMM, Frontier Technologies, Network Computing Devices, FTP Software, VeriSign, Wollongong, SecureWare and RSA. Sophisticated encryption and authentication technology has been viewed as the crucial enabling technology for electronic commerce over the World Wide Web -- but encryption has been slow to come to e-mail, with most packages offering no security whatsoever. "Commercial e-mail packages don't offer encryption because, up until now, there have been few open security specifications," said Jim Bidzos, RSA President. "Internet Privacy-Enhanced Mail (PEM) is excellent for text-based messages. MIME represents the next generation, and has been widely adopted because of its ability to handle nearly any content type. The new S/MIME allows you to secure this rich content." Today's flurry of official endorsements from industry bodes well for the S/MIME plan. "We fully expect S/MIME to be the defacto standard for vendor-independent e-mail encryption. Solid encryption is something that our customers have been asking us for, but up until now, we didn't have a viable option. S/MIME gives them everything they want: RSA encryption, digital signatures, and the ability to mix different vendors' e-mail systems without losing that security," said Bob Dickinson, ConnectSoft Vice President and General Manager Consumer Online Products & Services Division. "Frontier Technologies believes that in the future most companies will routinely encrypt electronic mail messages sent over the public Internet," said Dr. Prakash Ambegaonkar, Frontier Technologies' president. "This will only happen once there is a well-understood standard for secure e-mail that is easy to implement. Frontier has several years experience in developing secure e-mail solutions. In order to speed the adoption of the S/MIME specification, Frontier Technologies intends not only to be one of the first vendors to support S/MIME in its networking software, but to also make our initial implementation of the S/MIME protocol freely available for other vendors to use as a reference." "The freedom to have a private conversation is fundamental to personal communication that is the essence of electronic mail," said John Noerenberg, Director of Engineering for QUEST products at QUALCOMM. "Wide-spread acceptance of specs like S/MIME make it possible for individuals and organizations alike to conduct their business over the net secure in the knowledge that their private business is, in fact, private." "FTP Software is glad to endorse the S/MIME blueprint for secure electronic communication," said John O'Hara, director of development for FTP Software. "Whether communicating with customers, business partners or remote offices, companies need to ensure that confidential information stays confidential. This was difficult in the past, since organizations are connected through diverse messaging systems from competing vendors. S/MIME eliminates those barriers by facilitating implementations across multiple vendor products." "Network Computing Devices is commited to answering market demand for network information access software providing an even higher level of protection and interoperability over LANs and across the Internet," said Mike Harrigan, co-founder and vice president of NCD. "S/MIME will further enhance our customers' ability to utilize our e-mail solution, Z-Mail, and Internet navigation software tool, Mariner, in such a secure networked environment. For this reason we fully intend to support the specification provided by S/MIME within the next quarter." This wll be an exciting catalyst for the rapid deployment of secure, interoperable e-mail from most of the industry leaders," said Web Augustine, VeriSign vice president of marketing & business development. "VeriSign is committed to making our Digital ID services available to all companies that implement S/MIME and desire to work with a trusted third-party to certify public keys for their end-users." S/MIME is based on the intervendor PKCS (Public Key Cryptography Standards) which were established by a consortium of RSA, Microsoft, Lotus, Apple, Novell, Digital, Sun and the Massachusetts Institute of Technology in 1991. PKCS is the most widely implemented suite of commercial cryptographic standards in the United States. The common PKCS specifications allow developers to independently develop secure applications that will interoperate with other PKCS-secured applications. Developers interested in S/MIME can get more information at RSA's web site, at http://www.rsa.com, in the "What's New" section. RSA Data Security is the world's "brand name" for cryptography, with over 10 million copies of RSA encryption and authentication technologies installed and in use worldwide. RSA technologies are part of existing and proposed standards for the Internet and World Wide Web, CCITT, ISO, ANSI, IEEE, and business, financial and electronic commerce networks around the globe. The Company develops and markets platform-independent developer's kits, end-user products, and provides comprehensive cryptographic consulting services. Founded in 1982 by the inventors of the RSA Public Key Cryptosystem, the company is headquartered in Redwood City, California. S/MIME Vendor Contacts: Connectsoft Tamese Robinson 206/450-9965 Frontier Dennis Freeman 414/241-4555 FTP Software Jill Dudka 508/659-6458 Qualcomm John Noerenberg 619/597-5103 Microsoft Tom Johnston 206/936-3233 Lotus Kevin Kosh 617/860-5632 Wollongong Bob Brodie 415/962-7203 Banyan Jay Seaton 508/898-1000 NCD Mike Harrigan 415/694-0663 SecureWare David Luther 404315-6295 VeriSign Web Augustine 415/508-1151 ### RSA Public Key Cryptosystem and PKCS are trademarks of RSA Data Security, Inc. All other product or company names are trademarks of their respective corporations.

1 0