December 2003 - cypherpunks-legacy

Re: Modem Tax!--Write to FCC Commmissioner Craig Shergold
by nobody＠rahul.net 17 Dec '03

17 Dec '03

On Wed, 25 Jan 1995, Klaus! von "Aaack Pthoey" Future Prime wrote: > In a related note, opponents of this modem tax are encouraged to flash > their headlights at oncoming traffic. But, but... I heard that new members of BlackNet have to kill a driver who flashes their headlights at them, as part of an initiation rite. I know it's true: Klaus! told me so in private e-mail. Is there any verification of this? I'm frightened... CryptNet Franchise 0x6969

1 0

Re: CP archives?
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <m0rWvRj-0004JGC(a)s116.slcslip.indirect.com>, Ed Carp [khijol Sysadmin] <erc(a)s116.slcslip.indirect.com> wrote: >Can anyone tell me where the CP mailing list is archived? Thanks! In one form or another, it's all on ftp://hks.net/cypherpunks/{All,nntp/cypherpunks}. Unfortunately, it's quite a mess and is worth much unless A somewhat better alternate is NNTP:nntp.hks.net, by which the traffic since June is all available under hks.lists.cypherpunks. Getting a decent, web-searchable archive up is near the head of my 2nd tier queue. - - -- Todd Masco | "Let me get this straight. You're making a crypto toolkit, cactus(a)hks.net | and you're worried about it being _obscure_?" - Eric Hughes Cactus' Homepage - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLyZ+pRNhgovrPB7dAQGGaAP6A00aoyX0ZFmVj+Cn61/ls/RgkiGKFwLt APLjbmFmtf6+WrGMnMrEARhgKbAGlOYX7QxShQxyagR09LRBgwNev5zwS9HlWjQZ 0dIqFErdIExUL4DR4ptlznzVtfASbPnZAB1kZ76Pe28QHbutYjH7goVfuwk5SbzT DwkEgBAGAaU= =dxNq - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLya4CyoZzwIn1bdtAQGv7AF/UDQyzn/93X45o341yOCvZNsigZfmVu0b 0BwEHFhHghf4gqjVtLy9spqvLZ+cM4G8 =t6c0 -----END PGP SIGNATURE-----

1 0

Starting a remailer
by Mo Baxter 17 Dec '03

17 Dec '03

I need info on what's needed to operate a secure remailer out of an edu address. I'd appreciate anything on programs, installation, maintenance, problems, etc... Thanks, Mo "We're all in it together." --Harry Tuttle

1 0

Remailer
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Louis Cypher (alt.anonymous.messages) In this message I will analyze message reordering in remailers, and traffic analysis in remailer webs. Remailers which immediately resend incoming messages provide no security against an attacker who is able to watch all traffic to and from the remailer. Two proposals have been suggested to solve this problem, latency and reordering. In recent discussions, the consensus was that message reordering was superior to (and the actual intent of) latency. Reordering is not sufficient, a form of latency is required to make it effective. In this analysis, I assume that the reordering is accomplished by keeping a group of n messages at the remailer, and sending a random one whenever a new message comes. This is superior to simply waiting for n messages to arrive, then sending them all at once (I will show this later). The attack on the reordering remailer is simple. The attacker sends a stream of marked messages through the remailer. After the waiting messages have been flushed out, any incoming real message will be flushed out of the remailer before more arrive, allowing it to be uniquely identified coming and going. The defense against this is to only check the group and send excess messages after a time delay. This delay should be the typical time for n real messages to arrive. A mixing of approximately n messages is ensured by this process. If there is no attack, then the mixing is not quite as good as keeping a group of 2n messages. Here is the math on the reordering schemes: 1) Wait for n messages, then mix and send them all. The message is known to be one of those 10 (duh). 2) Keep a group of n messages. Send one of the n+1 when a new one arrives. The message could be any message ever sent after arrival. That is not useful. How many messages does it take before we are 90% sure that the message has been sent? prob that the message has not been sent after x messages is (n/n+1)^x Prob that it has been sent = 1 - (n/n+1)^x Messages till 90% prob: x=ln(.1)/ln(n/n+1) For n=10, x=24, which is much better then 10 for scheme 1. 3) Accumulate b messages, then send a of them (Scheme 2 is a=1, b=n) x = ln(.1)/(ln(a) - ln(b)) This gives the largest x for a=1. In my example of how to defend against the flood attack, a=n, b=2n x = 33 This is misleading, because it will introduce twice the delay as scheme 2. Given the same delay, a=n/2, b=n, one finds that x=16.6 That is better than batching, but not as good as scheme 2. The smaller x is worth it, because a reordering of at least some minimum number of messages is ensured. Some writer proposed changing n randomly to protect against this attack. Obviously that would not work. The attack will consist of many many more than n messages. The second issue for consideration is: Given a web of perfect remailers, how easy is it to identify corespondents? Tim has been asking this one for a while. I assume that there is sufficient traffic through all remailers that any message entering the web could be any message leaving the web. This can be achieved, even with light traffic, by sending fake messages through the web to bit buckets. While they do not improve the security of the web as a whole, they help ensure that no tracking of messages within the web is possible, forcing it to be treated as a black box. I assume that no correspondents are remailers themselves, and that all communications are random (random times with random people). This assumtion that all communications are uniformly distributed is terrible but.... This analysis only applies to indistinguishable messages. Each standard packet size can be thought of as having its own black box (a good argument for message splitting and having only one packet size). To simplify the problem, I am going to treat the web as though it were clock driven. Some number of messages enter and leave the web each "tick" with no messages staying in the web between ticks. This is a reasonable approximation, with the "tick" being the mean time of passage through the web. Define "f" as the fraction of remailer using population sending a message in a given tick. This is also the probability that any individual will send a message in a given tick. The probability of a given pair of corespondents in a given tick is f^2 The probability of a pair of corespondents occurring m times in n ticks is m p= 1 - Sum [(f^2)^i (1 - f^2)^(n-i) n! / (i! (n-i)!)] i=0 Lets put some numbers in there. If people send 1 message per day on average, and one tick is 30 min., then f=1/48. If you watch the web for a month you will see 1440 ticks. If the chance probability of your sending m messages to your co-conspirator is too small then you have been nabbed. The condition for that is: p << (1/population) The results for m=0 to 12 (using the above numbers) are: m = 0 p = 4.64811E-1 m = 1 p = 1.30173E-1 m = 2 p = 2.56257E-2 m = 3 p = 3.86587E-3 m = 4 p = 4.71498E-4 m = 5 p = 4.81967E-5 m = 6 p = 4.23687E-6 m = 7 p = 3.26538E-7 m = 8 p = 2.23961E-8 m = 9 p = 1.38336E-9 m = 10 p = 7.77044E-11 m = 11 p = 4.00273E-12 m = 12 p = 1.91774E-13 So, for a remailer using population of 10,000 you had better send less than 5 messages per month to your accomplice. This only gets worse the longer you keep it up. You can not send 4 per month, month after month. Louis Cypher -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLybfL6yHUAO76TvRAQFhEwP+OMBMyESk97mVPNJMsoECl0YiJY+xnOqs PHu3OT6j7igdu64NsAHxduwBLmArpgOFXEtrMBwXTkxzUZq6holJdQ+GPtQi787x WtXhV2KkipW6z67TMxzjdSN7cVluQiMpnNhTSOpGUDcM8no3JD8/Ti1ficwljVkH 5kNx6RWFEpI= =pRy3 -----END PGP SIGNATURE-----

5 4

Re: Magna Carta Analyzed
by Richard F. Dutcher 17 Dec '03

17 Dec '03

> From: rkmoore(a)iol.ie (Richard K. Moore) > Subject: Magna Carta Analyzed Nice analysis - I'll use it with thanx. > [ Simple, succinct...and packed full of lies. > [ > [ My only question is: why did the document have to > [ be so long? > [ > [ -rkm > [ As every priest, mountebank, con artist, lawyer and politician knows, lites go down easier with *lots* of arm waving. Otherwise, we might pay attention to the men behind the curtain. Rich Dutcher, San Francisco Greens P.O. Box 77005, San Francisco, California 94107 USA "That's libertarians for you - anarchists who want police protection from their slaves." Kim Stanley Robinson, "Green Mars" Greens, of course, only enslave plants - so weed-whackers work better than cops ...

1 0

Re: Remailer
by Wei Dai 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > From: Louis Cypher (alt.anonymous.messages) > > Define "f" as the fraction of remailer using population sending a > message in a given tick. This is also the probability that any > individual will send a message in a given tick. The probability of a > given pair of corespondents in a given tick is > f^2 > The probability of a pair of corespondents occurring m times in n > ticks is > m > p= 1 - Sum [(f^2)^i (1 - f^2)^(n-i) n! / (i! (n-i)!)] > i=0 Hmm... this sounds very similar to the results of my analysis which I posted yesterday (Subject: analysis of Chaum's MIX continued), which I think is slightly more general. > Lets put some numbers in there.... [deleted] > So, for a remailer using population of 10,000 you had better send less > than 5 messages per month to your accomplice. This only gets worse > the longer you keep it up. You can not send 4 per month, month after > month. Plugging these numbers into my formula, the "threshold of tracibility" comes out to be 4 messages. This is probably due to the fact that I used a normal approximation for the binomial probability (the p in the above formula). The general conclusion however is the same: unless most users send a lot of dummy mail to each other, a Chaum type mix will not provide very good untracibility. The other possible way to increase untracibility is to decrease the number of batches per unit time (i.e., increase average latency). This implies that with a Chaumian mix, there is an unavoidable tradeoff between untracibility, bandwidth (i.e., how much dummy mail has to be sent), and latency. Wei Dai -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLybywzl0sXKgdnV5AQF0+AP/e5sKTVt5plvGydmILm+cBF14q6IJttDJ U0Es21jMH0hYPreiRwfUXwMc+bLs/RfTdmGBr0KUPHow0khlzfGHjU8ZKOMknSI/ +qvqHlMRPDfvKnp244qsQUJ1UmLAezeNObO4OMbejWbRRGu+Dd1iEeBpgnFOh0bH 6grf4VupdpU= =+Um1 -----END PGP SIGNATURE-----

1 0

Re: Sex with the Gannett newspaper chain
by Michael Sattler 17 Dec '03

17 Dec '03

At 12:27 1/25/95, nobody(a)rahul.net wrote: >sorr(a)eznet.net wrote: >>I'm a reporter at the daily newspapers in Rochester, N.Y., researching a >> story on the recent spate of IP-spoof hack events.... > >Fuck Gannett. Thanks for the deeply intellectual addition to the discussion in progress. Perhaps you could send Steve Orr a message from a non-anon account explaining why you think his troll shows he's a clueless newbie, or, even better, forward some of the research material to him, so we don't wind up with another sensational, uninformative article. Oh well, I guess it's each to his ability... -----------------------------------------------------------------------+ Michael Sattler <msattler(a)jungle.com> San Francisco, California | Digital Jungle Consulting Services http://www.jungle.com/msattler/ | | And so these men of Indostan/ disputed long and loud/ each in his own | opinion/ exceeding stiff and strong/ though each was partly right/ and | all were in the wrong! - John Godfrey Saxe |

1 0

US News and World Report [Repost]
by Nathan Zook 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I just looked over an article in US News and World Report today. The cover was a badge with the words "Cyber Cops" on it. Guess which article I scanned. "Is Anything Safe in Cyberspace?" I think it came over okay. Quoted Chaum, mentioned the positive uses of remailers, had an extensive sections on privacy and on free speech. It was somewhat sympathetic to Clipper, didn't really take the protests seriously. Mentioned anonymous ecash. It also had a quote skewering the highway metiphore, "It's organic". This was all after the four horsemen were trotted out, in all their glory. If anyone looked at only the first six inches, it sounded like an attack on the net as a whole. I'ld give it a 4 on an objective scale, 7 compared to what we expect. Finger or request keyserver for PGP 2.6.2 (tm) key. PGP<->Mail/News installation incomplete. Factors for modulous are not proven primes. Key may be far weaker than expected. Encode at your own risk. Key ID: 14712B4D 1994/12/26 Nathan H. Zook <nzook(a)bga.com> Key fingerprint = 44 B3 D8 66 3D 55 1E 2E F8 92 22 A6 33 8C DE 24 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLyRiMHmgMs8UcStNAQE0jQf+PoZWpuN5y8mDfpvn7g1eiJs6uHI+7DqM lS63jgQs5zE4Nfk7yXCyhh9HY7qx8T2P4TvRUBGFGZk74+9ANg54GopBDLWYEwFM eNgheMg1w/iF6kyrEyPBLS3QaphfjDgknf6ohBv6qx/ZOJ7N10iWW06eu5O/H9Se YDk6RvUzz7niyknGG1kO3aTqTqQ3tSG21FRktV7gbUeayLCLdhQKD7bowZkClR6Z KJ2gVvu7dmNczpsMYleZjOD2p9rSsMKoL42rJykbJRwHunJhF8hgaUnq8P7frmea xJ8YlcrrI+rwY5mNb6ylNR/KLNvV+rd17IZjE/+3xaPEM+s04dy1Rw== =WAub -----END PGP SIGNATURE-----

1 0

RE:sorr
by KJC＠cityscape.co.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- sorr(a)eznet.net wrote: > To whomever: > I'm a reporter at the daily newspapers in Rochester, N.Y., researching a > story on the recent spate of IP-spoof hack events. Supposedly a toad.com > address was used by a person who broke into the San Diego supercomputer center > a month ago. What's toad.com? ....I'm simply trying to reconstruct.. someone wrote anonymously: > Fuck Gannett. L. Futplex McCarthy wrote: >This belongs in private email, assuming that isolated epithets are worth sharing with anyone outside your primal scream therapy group. Are you related to Detweiler, perchance ? etc,etc. Yep - A shame about being anonymous...because it was succinctly put - but explanations to Steve Orr unnecessary - surely? Nevertheless, I'm glad it was said, Keith Cross -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLycKfhZrmpTDhsYFAQHxpgQApvnrBVvnR6CzwF9t5dPYnsPu+laI3Q50 xNTdC3GInnBUXWscf9V/5mPETFUC8Pv+YG+umwHP1fxsnVG+yooRQvy7Vh4gyqvK zB64Jsc+HLLRiee1vnczZ0kaBZJn6ajCzmGpJ1Q5Pof+GD4OirO9pZAAeUz88tPv 2EIFOxuT8z0= =c7cc -----END PGP SIGNATURE-----

2 1

(Fwd) Information Superhighway - GAO Report
by Richard F. Dutcher 17 Dec '03

17 Dec '03

Old news, I'm sure, but certain to be cited in the legal & regulatory debates ... ------- Forwarded Message Follows ------- Date: Wed, 25 Jan 1995 11:49:42 EST Reply-to: gao-docs <gao-docs(a)MAILHOST.GAO.GOV> From: gao-docs <gao-docs(a)MAILHOST.GAO.GOV> Subject: Information Superhighway - GAO Report To: Multiple recipients of list PUBPOL-L <PUBPOL-L(a)UMINN1.BITNET> GAO Report - Information Superhighway The U.S. General Accounting Office, the Congressional watchdog agency, has recently released the following report: *** ASCII Full Text Access and Ordering Info Follows *** TITLE: Information Superhighway: An Overview of Technology Challenges RPTNO: AIMD-95-23 DOCUMENT DATE: 01/23/95 BACKGROUND: GAO reviewed the technical issues associated with protecting the information superhighway from unauthorized access. FINDINGS: GAO found that: (1) the information superhighway poses technical challenges concerning the security, privacy, and reliability of personal and proprietary information; (2) a large proportion of the information that will traverse the superhighway will be sensitive and a tempting target for hackers, foreign governments conducting political and military intelligence operations, domestic and foreign enterprises engaged in industrial espionage, or terrorist groups seeking to disrupt society or the economy; (3) significant effort will be needed to define, develop, test, and implement measures to prevent unauthorized access to the superhighway; (4) although the federal government could play a leading role in ensuring the superhighway's security, critics argue that individuals should be free to choose the technical means for meeting their security requirements; (5) a major challenge facing the development of the information superhighway will be creating a consensus between the federal government, computer and communications industry, business community, and civil liberties groups on how to ensure information security and privacy; (6) federal and private sectors have begun establishing uniform standards to ensure the superhighway's interoperability; and (7) questions remain about how to protect the superhighway from large network failures and encourage the telecommunications industry to develop a secure and reliable infrastructure. *************************************************************** This report is available both in print and electronically. *************************************************************** [junk deleted] ***************** ELECTRONIC ORDER INFORMATION **************** To access GAO reports as FULL TEXT ASCII electronic files from the Government Printing Office (GPO) BBS, follow these steps: 1) TELNET to <federal.bbs.gpo.gov> and designate "port 3001" or dial 202-512-1387 (Menu Selection #22 on FEDWORLD); (***NOTE*** Depending on how your system accesses the TELNET feature, you may need to TELNET to this address: <federal.bbs.gpo.gov 3001> ^^^^^ and hit return a few times after connecting. You should receive a greeting screen. If you receive a prompt for "PASSWORD", something is wrong. Either re-try or contact GPO at the phone number below.) 2) Log in or register on system (type: "NEW" if first time user); 3) From the Main Menu, select "File Library System - 6"; 4) Select "S - Select Library"; 5) Type: "GAO_RPTS"; 6) Select file name: Information Superhighway: AI95023.TXT ***************************************************************** Any questions on using the GPO system should be referred to GPO at 202-512-1530. Please do NOT use this e-mail address for questions about the GPO system or for ordering reports. GPO charges a fee to download each file. Exact costs are listed on the GPO system. NOTE: All Federal Depository Libraries are authorized to download files at no charge. FDL's must first be registered on the GPO system in order to be authorized free download access. **************************************************************** PRINTED COPY ORDER INFORMATION Printed copies via U.S. Mail are also available by calling 202-512-6000 (TDD number is 301-413-0006), sending a FAX to 301-258-4066, or by writing to: P.O. Box 6015, Gaithersburg, MD 20884-6015. Please include the report number and complete postal mailing information in your request. Telephone requests can be made 24 hours a day, seven days a week. During non-business hours, leave a voice mail message with complete information, including the report number and postal mailing information. Copies may also be picked up at the GAO headquarters at: 700 - 4th St., NW, Washington, DC. Sorry, we are NOT able to accept electronic orders for printed documents at this time. The first printed copy is FREE of charge. Additional copies are $2.00. **************************************************************** [more junk deleted] Please forward comments and suggestions to: <gao-docs(a)gao.gov> Thank you. *************************************************************** Rich Dutcher, San Francisco Greens P.O. Box 77005, San Francisco, California 94107 USA "That's libertarians for you - anarchists who want police protection from their slaves." Kim Stanley Robinson, "Green Mars" Greens, of course, only enslave plants - so weed-whackers work better than cops ...

1 0