December 2003 - cypherpunks-legacy

Re: your mail
by Jonathon Fletcher 17 Dec '03

17 Dec '03

On Sat, 7 Jan 1995, Jonathon Fletcher wrote: > who cypherpunks > end I know, I know. I'm sorry. I'll send it to the right place next time. Small slip of the qwertys -Jon -- Jonathon Fletcher, jonathon(a)japan.sbi.com

1 0

Killfiles 101
by Carol Anne Braddock 17 Dec '03

17 Dec '03

1. The best and only way you can be sure you're killing a file is to turn your machine off. Only then can you be sure it is dead. 2. If you must resort to using killfiles, (great marketer trick, make you use it again and again, and again, like a gun) kill "classes" of files, as opposed to individuals, you'll get better kill ratio. A good example is anon or wizvax users. 3. Note: Killfiles are a censor's best friend! And you'll become what you swore you wouldn't. does your signature tell the truth nesta? Can't know everything with a killfile! Eventually you'll kill the file that'd get you sex. Signature withdrawn at the request (pretty rightfully so) of my dear friends on the Cypherpunk List Coming Soon: The Internet Debut of CENSORED.COM

2 1

Dear Zimmy,
by Carol Anne Braddock 17 Dec '03

17 Dec '03

They still miss the point, I think. They haven't figured out how to teach others. They can do it in ten newsgroups. They whine and snivel like two year old brats. They just can't for the life of them grab the original letter. They can't go teach their top-ten newsgroups. They can't figure out how to come back here and rant how they did it and I didn't (lose my account over it) They rapidly forget crypto loses it's power against a bullet. Eventually they'll come with guns again and take the machines away. There were 10,000 newsgroups I only went to 10. The best kill file is a turned off machine. I touched my first fortran card 22 years ago. There's a lot of difference between showing up the 12th, and showing up in say 12 newsgroups. Sorry Zimmy, It don't look good for the home team. Love Always, Carol Anne Signature back on the drawing board Coming Soon: The Internet Debut of CENSORED.COM

1 0

A day in the life of the Cypherpunk list
by Carol Anne Braddock 17 Dec '03

17 Dec '03

Dear Bruce, When you see the actual postings on the last 24 hours, they are all running to the newsgroup to use killfiles. Isn't it ostriches that do that kinda thing? They've been caught napping. The Webbittown Post Office could use all the remail people. Every last one of them And meanwhile, still stuck in the pine composer, lies the original response. Good copy, definitely good copy. Love Always, Carol Anne Signature withdrawn at the request (pretty rightfully so) of my dear friends on the Cypherpunk List Coming Soon: The Internet Debut of CENSORED.COM

1 0

NYT on Survivalists
by John Young 17 Dec '03

17 Dec '03

Philip Weiss writes in tomorrow's Magazine a very long (52K) cover story on Idaho survivalists Bo Gritz, Randy Weaver and the burgeoning anti-government population. The longest story I've seen in there in years. Mentions societal threats of cashless economy, tax nix, and more c'punk tonics. Is The Times getting antsy, seeding a L&O crackdown? Or huffing luridities? See for yerself by sending blank message with subject: SUR_huf

1 0

carrol(
by m00012＠KANGA.STCLOUD.MSUS.EDU 17 Dec '03

17 Dec '03

What is wrong with this person? ban her if you can, that's my opnion.

4 3

Data Haven problems
by dfloyd＠io.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- While programming my data haven code, I am wondering how to guard against spamming the data haven parser. It is trivial to mount a denial of service attack by repeatedly mailing large files. which will fill up the quota or filesystem of the data haven host, and if you have mail on a root partition, will cause hangs or crashes. Any ideas on how to guard against mailbombs, and to confirm to the sender that their files are stored successfully? Perhaps do a mailing with a test command that validates the existance of the file, and sends a reply back wether the file is okay or not, or would this result in a possible security hole? As to the code, this will have to be my second rewrite as I am going to do it in perl code, rather than C... last rewrite was from a daemon to a program activated by a .forward file. Lastly, instead of postage (like a remailer would get), how hard would it be to implement "rent" where if the "rent" is not paid, and a grace period has elapsed the file would be trashed. All this while preserving the anonymity of the sender and the data haven site. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLw7KpFLUeLjqSiixAQHs4wf+Mf4CVx77nXjUXug/3q1hINhCyWgWmal7 vY1WeCDXM+qrrdxUgqzIhYRYpCPKChMjeozFltn9T0CcH/YdaD5hx3dB5A0YUPWZ SpF5oCL3iZzf2veA8BBJEIrFdmts/nFUzWaqMx4+2IcufYb+0kVw/AKi2M5B0ZiT UoOFFIsySR9hIMMIfHlkGqrnoO8LhlViRBx4u1O0bb0GYAyc+Nv6HvDJOSWuVe9C g5B4GMLuW1t9e5Qw3W0Qy1VRIC4QbOrd0zbjDrQ38GUemOjALuZ2h4+tr3bR93KU ZthueqsIzGKlr90PU6AVVZd128mDHLofJO4I4IoOgSPV7XIK4tufyA== =KZk0 -----END PGP SIGNATURE-----

4 3

Experiments and Toys vs. the Real Thing
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

The debate about data havens and what they ought to really be, what they ought to really accept, etc., is similar to debates about what digital money ought to be, how remailers ought to operate, etc. It's useful to categorize projects as "experimental" (or "toy," with no negative connotations implied) or "commercial" (or "real," I suppose): * EXPERIMENTAL, or TOY: Early efforts, meant to help illuminate the issues, uncover problems, gain knowledge, educate people, etc. * COMMERCIAL, or REAL: More robust, well-established. Usually "for pay," and expected to be maintained, available, professionally operated. Now there's a fuzzy distinction between these, a continuum, really. For example, PGP began life (esp. as v. 1.0) as an amateur or experimental thing, with a few hacker experimentalists playing with it. Version 2.x has been usable as a commercial tools, every bit as good as "MailSafe," the ostensibly commerical RSADSI tool. The user community has added enough capability and hooks to clearly put PGP in the COMMERCIAL category: robust, supported, etc. Remailers are _almost_ in the second category, especially when taken as an ecological whole. (That is, any single remailer may be flaky--though many aren't--but the pinging and reputation tools that support the ecology make the ensemble more robust and usable.) Many of us believe that "digital postage" paid remailing will be the final step needed to move remailers into the commercial/real category. Until thien, they're not businesses--they're hobbies and experiments. (Which is fine, as one of the main reasons for Cypherpunks was to take the academic papers presented at Crypto conferences and reify them in working code, as experiments.) Digital cash is more clearly still at the experimental level, as are anonymous markets (like BlackNet), data havens, and so forth. Why do I mention these points? Because there's a danger in "premature professionalization." And a danger in criticizing experimental or toy efforts for not being "pure enough." The recent claims that nascent "data havens" _must_ support all files, including hard-core porn, weapons secrets, etc. seems to be an example of this. I'm not for censorship, just concerned that the data haven _experiments_ are not secure enough, not robust enough, to actually carry high-visibility files. For example, data havens will clearly someday be used to carry defense secrets, troop movements, weapons manufacturing details, etc. But I would not want to carry them on my "experimental data haven," for obvious reasons. Even if I only carried "non-American" secrets, such as reports on Russian troop manouvers around Grozny, I could expect visits from American officials (to stop me, to plant data they want planted, etc.). (And let's not forget "snatch teams" that grab foreign nationals suspected of crimes...Israel, Iraw, Iran, and the U.S. have grabbed people in other countries. And more common is simple execution. If a Swedish data haven carried files related to U.S. operations, and the data haven location was known--part of what I mean by saying the enabling technologies do not yet exist--then various measures would be applied. Diplomatic, equipment sabotoage, even killing the operators. I'm not being Ludlumesque here...clearly such "threats to national security" would be seen as justifying various reactions. Especially to send a message to other potential operators.) Those advocating a "purist" (= professional/real) approach to data havens, seen recently in the calls for data havens to never screen files or accesses, should bear in mind that "data haven technology" is lacking. Remailer chains leading in and out of data havens are still non-robust, subject to attacks and compromises. And of course, digital cash is still being thrashed out. An experimental data haven that allowed unscreened access or depositing of information would also become a a magnet for kooks, for those wishing to sabotage such havens, etc. If truly serious information was found on the haven, huge efforts would be mounted to find the source, get the site shut down, etc. Current remailer technology is just not up to the challenge. (I'm not saying it won't someday be, just not now.) Criticizing experimental data havens for "not going all the way" seems to me to be wrong-headed. First, there's the usual issue of who bears the risk, with those not at risk urging others to put themselves and their sites are risk by being "pure." Second, and more important, the enabling technologies for data havens are just not yet themselves available and robust. A data haven that carries "Four Horseman of the Infocalypse" material will come under strong attack, legal, cryptographic, and physical. There's a place for experimental or toy implementations, e.g., data havens that operate in some limited domain. This allows the issues to get explored before full-scale attacks are mounted. Think of it as a training exercise, a drill, or an immunization. --Tim May, who thinks the first real data havens will come under intense attack and so had better be secure from the start -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

2 1

cel fraud
by an172607＠anon.penet.fi 17 Dec '03

17 Dec '03

Fighting Cellular Fraud, New York To Washington BEDMINSTER, NEW JERSEY, U.S.A., 1995 JAN 6 (NB) -- Bell Atlantic Mobile (BAM, parent NYSE:BEL) and NYNEX Mobile Communications (parent NYSE:NYN), two large US cellular phone carriers, are about to block automatic "roaming" service in New York City and surrounding areas. Starting January 9, BAM customers who place calls in the city will need to enter a personal identification number (PIN) issued by BAM in order to complete the call. The new policy is an antifraud measure to combat criminals who steal cellular service, BAM said. The PIN system was developed by NYNEX and is in use inside the City now, NYNEX sources said. Both firms emphasized that the new policy is no magic wand to do away with cellular fraud. However, as a BAM spokesperson told Newsbytes, the combination of restricted roaming and PIN numbers will "raise the bar again" where cellular fraud is concerned. Under the new system, the two cellular carriers will restrict calls in the greater NYC area by roaming customers from a "Fraud Protection Zone" that includes Washington, D.C.; Baltimore; Pittsburgh; and greater Philadelphia, including Delaware and southern New Jersey. BAM adopted the new measures because of increasing problems with cloning, in which a criminal picks off a cellular customer's automated phone IDs during a legitimate call and uses them to make a "clone phone." The cloned phone can be used to make calls for which the legitimate customers, not the cloners, are billed. AT&T's Steve Fleischer, speaking to Newsbytes, said such cloning operations have become such a successful criminal industry that some criminals sell the phones with 30-day guarantees. "If a number is cut off, you can bring it back to the cellular bandits and have it reprogrammed for no additional charge," he explained. "It costs the carriers around $1 million a day." He paused, then added: "It just shows how big a demand there is for wireless communications." Under the new policy, customers from inside the protected zone who want to use their phones at standard "roaming" rates in New York City must first contact BAM by dialing 211 from their cellular phone. After they provide proper identification and select a PIN code, the company deactivates the fraud zone lock-out. NYNEX spokesperson Kim Ancin told Newsbytes that customers with PIN numbers place calls as much usual by dialing the destination number and pressing the Send button. However, on protected phones, the customer then punches in the PIN number and presses Send again. Ancin explained that the PIN number goes out on a frequency different from the initial send. Cellular bandits use special equipment to pick up a legitimate phone's mobile identification number (MIN) and electronic serial number (ESN), which until now have been enough to clone a phone. However, she said, adding a PIN number on a second frequency makes cloning much more difficult. BAM said it would not activate the fraud protection lock-out in northern New Jersey, where calls to New York City are local calls. However, since customers who travel frequently into the city are at risk from cloning, the firm strongly recommended that northern New Jersey customers sign up for a PIN. Eventually, the firm said, all new customers will be required to select PINs. BAM said if a bandit does succeed in cloning a PIN-equipped phone, a customer can simply change the PIN number. Customers without PIN numbers must bring their phones back to a carrier or dealer to install a new phone number, notify business associates and friends of the number change, and modify business cards and stationery. There is no extra charge for PIN numbers, which are implemented by software at the carrier's switch, BAM's Fleischer told Newsbytes. The feature will not affect commonly used cellular services like voice mail or call waiting. Calls to 911, 611 and 411 will not require a PIN. (Craig Menefee/19950106/Press Contact: Steve Fleischer, 908-306-7539 or Brian Wood, 908-306-7508, both of BAM; Kim Ancin, 914-365-7573, or Jim Gerace, 914- 365-7712, both of NYNEX) ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

4 3

Re: TEMPEST Questions...
by peb＠netcom.com 17 Dec '03

17 Dec '03

Grady Ward wrote an article on implementing something like TEMPEST ("something like" means that it was not derived from classified documents). I can't seem to find my copy of his text and it doesn't appear anymore at netcom:/ftp/pub/gr/grady...Anyyone have a pointer to this? This article is definitely the most practical and comprehensive that I've seen on this subject. Paul E. Baclace peb(a)netcom.com peb(a)eng.sun.com

1 0