December 2003 - cypherpunks-legacy

US News on Policing Cyberspace
by John Young 17 Dec '03

17 Dec '03

US News of January 23 has a cover story on "policing cybersapce", another drumbeat about "the growing threats to your privacy and property in the information age." Not much new for this group except to enjoy another Spielberg gremlin of Jekyll and Hyde cryptography, fearful remailers, slippery digicash, stolen services and personal data, smuggling, terrorism, child pornography, Tennessee BBS, "cybercops" and such. Featuring the FBI's Kallstrom and Tafoya and FLETC and Financial Fraud Institute and Clipper and protective wiretaps, with supporting roles for Kevin Mitnick, Bruce Schneier, Mike Godwin, Marc Rotenberg, John Perry Barlow, Esther Dyson, Robert Corn-Revere. And, a cartoon on how to teach parents fear of the Net for their children. Cypherpunk is not sited, I think, or is it steganoed?.

1 0

Longer than 1048 bit keys
by Jaeson.M.Engle＠josaiah.sewanee.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm using MacPGP 2.6(ui) and noticed that the limit for a key size is the 1048 bit ("military grade" (right)). Is there anyway to circumvent this to make larger, harder-to-break-type keys? TIA, - -J -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLxr4xEiLvmPjc4XdAQFVZgP/UsykAUkO18IFddV+QTOkEK4wwipljb/F U1zkrh3IlUUHg82OVhS7tAtEn68d2NyNvbv5k+00CY+DYv9eSLgSbgTeMyyspFTf ZmQtjQZu0Qe6NVWOVMXAFzfUDhmAAytfssvMHqSEMyxaHdyNNFoK9csSg39VchfF s/VBsHv9sZ4= =JQbl -----END PGP SIGNATURE----- (-: aka: :-) (-: Jaeson M. Engle || jme(a)josaiah.sewanee.edu :-) (-: www server: http://josaiah.sewanee.edu/ :-) (-: It's January 29th! IT'S TIME!!! Ask me for details!:-) (-: Finger 'jme(a)josaiah.sewanee.edu' for my Public :-) (-: PGP block. :-)

1 0

Another internet story: INFO: NBC Nightly News Tonight (fwd)
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 16 Jan 1995 16:44:07 -0500 From: Craig Peterson <craig(a)Mainstream.com> To: Multiple recipients of list <rkba-alert(a)gatekeeper.nra.org> Subject: INFO: NBC Nightly News Tonight A story regarding the Internet, with some sort of mention of NRA.org, should be on the NBC Nightly News with Tom Brokaw tonight. Craig.

1 0

Announce: ChainMail 0.6b applescript for using anon remailers
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

I've written an applescript for using the cypherpunks-style anon remailers with Eudora for the macintosh. It will take a message in Eudora, and construct a chain with MacPGP for encryption, through remailers you've specified, and then deposit it back in Eudora for sending. There are still several features I'd like to add to it, but it's quite useable in it's present incarnation. You need a scriptable version of MacPGP, scriptable version of Eudora, and some sundry scripting additions which are listed (with URLs) in the docs. Send email if you'd like a copy, and I'll mail you a binhex'd copy. I don't want it on any archive sites yet, because it's not really done, or fully beta tested for bugs. (so let that be a warning to you, too.)

1 0

Abuse Complaint out of homer@rahul.net
by Homer Wilson Smith 17 Dec '03

17 Dec '03

Oh, Goody. I get to deal with my first abuse complaint for my remailer. Seems to me that letting others decide what is or is not abuse without at least being able to see the abuse myself would be wrong, that opens the door to just anyone claiming they were abused and my taking action against the alleged abuser. Clearly though if some admin of a system considers something an abuse, one can not just blow them off, we are all responsible for responsible use of the net. Even if this posting came through a chain, this admin is going to try to trace back the chain through the other remailers. So if I give him the remailer it came from, he is going to pester that remailer operator who won't appreciate it. I will soon be able to install blocking on the To: or From: lines. Blocking the From lines is hard, because usually abuse comes through other remailers, so I can't just block that. I can however block To: lines if the person is abusing one particular usenet newsgroup or end receiver. It would seem that if I am going to take action against someone with blocking of some sort, then I have at least a right to see the full posting that is claimed to be abusive. By the way, rahul.net keeps syslog files world readable which I find to be a security leak, as anyone (specifically the Church of Scientology) could find out who is in communication with me and start to harrass them too. Comments on ethics and diplomatic handling of this would be appreciated. Homer

2 1

Economist on EFF
by John Young 17 Dec '03

17 Dec '03

The Economist of January 14-20 washes EFF's dirty laundry. After recounting Berman's boot and EFF droop, the article concludes: "That leaves cyberspace's radical libertarians without a voice in Washington. They're probably delighted."

1 0

Abuse and Remailer Ethics
by Homer Wilson Smith 17 Dec '03

17 Dec '03

I am surprised there isn't a widely agreed upon codification of remailer operator ethics for handling abuse cases. Perhaps there is, and I would appreciate someone pointing me to it. I am not presently on cypherpunks, so please include me in the replies. Here is the situation. homer(a)rahul.net runs with header logging on, it contains, From: To:, Date: and Subject. rahul.net also keeps syslog files for a week, and makes them public to those on rahul.net. B writes me saying he is the 'admin of a listserv' and complains that someone is abusing his list with postings through my remailer. He wants the name and e-mail of the abuser to 'talk to him personally'. Clearly I should not give out the name of a remailer user (if I know it) unless ordered to by a court order. Thus his request is, on the surface of it, absurd. In this case the alleged abuser, A, did not chain his posting so my logs clearly show who it is. Clearly I am always going to know the To: of an abuse because the complaint comes to me from or about that address. If the abuser only uses one remailer, then I am clearly going to know the From: line also, as it is right there in the header logs or rahul.net syslog files (same thing.) If the abuser chains and a complaint comes to me, all I will know about the From: line is that it came from another remailer. However now that I know his name and e-mail, if I get another complaint about him, and he has wised up and started chaining, I could pass his name onto the prior remailer before mine, and that remailer could do the same, until it came back to the first remailer on the chain who could take action. This however would piss off a lot of remailer operators. But now what action is appropriate? Well giving A's name to B is out of the question without a court order, right? Blocking the To: line, namely the abused party, is extreme as that blocks others from posting to that list or group, unless the list or the group wishes to have no anon messages. In which case I probably might consider blocking the end recipient. Blocking the From: line, will stop all further postings from that person, which is fitting if indeed he is 'abusing' people, but he will merely start posting through other remailers, who will then have to go through the same procedure. Perhaps there is some justification then for remailer operators sharing blocked From: lines with each other, that might be a good idea. But who is to decide what is or is not abuse? Surely I can't let others tell me that they have been abused without even reading the message, I have seen it happen all to often that parties claim they are being abused when they are merely being exposed and rightly so. On the other hand, since I am responsible for my own little corner of the net, if something happens that I consider abuse, I certainly have a right to put an end to it if I can. Some questions: Does any single recipient have the right to demand that they be blocked from all anon messages. I would say yes. How about demanding blocking anon messages only from some senders? That is harder to implement. If you block the sender, you block ALL his postings, not just to that party. So you would need to block specific From: and To: combinations. This would not work with chaining at all, even if we did share blocking information. So that is out. Does a list owner have the right to demand blocking to his list, with or without a vote of the list readers? I would say yes. What about a newsgroup? I would say it takes a vote. Are anon voites allowed? Touchy question that was important at one time on alt.r.scientology. Anyhow I would guess that the correct action here is to write the offender and let him know a complaint has been registered against him. I would also educate him as to why he was so easily traced and tell him that if he wants to avoid such in the future to start chaining. However if he is a determined abuser not prone to social embarassment, then the sharing of blocking among remailer operators might become a very good idea. I don't know how you seasoned reops feel about abuse, jpunix went out of business for want of an effective way to deal with it. I think part of the answer is in close cooperation. This might help keep the abuse down, and raise the reputation of reops so that people begin to think of us as responsible service providers rather than anarcho terrorists. However I am very new to this field, so I may have my head stuck up my ass, and I would like to hear back from you on your ideas. Homer Wilson Smith homer(a)rahul.net

1 0

Re: Another problem w/Data Havens...
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Data havens that can split data to two or more locations in seperate >jurisdictions can effectively ignore attention from authorities not >related to the site management or site preformance. Encryption mandated >sites can also take this stance, while encryption is legal in any event. It just occurred to me when reading this another method for ensuring the "I can't tell what's in it" condition with a data haven operator. Why not use a secret sharing system where the contraband data is split into a number of pieces and sent to different havens? It could be argued that the individual pieces are not the same as the whole, and there is absolutely no way the operator could recover the original from a given piece (thus providing plausible deniability.) Using M by N secret sharing, with M < N, you build in some redundancy in case one of the havens gets shutdown. Ok, Eric, go ahead and blast your holes in this argument :) == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)scruznet.com -Isaac Asimov -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLxspxk1Diok8GKihAQG4FAQAjCaFOGC+N5zjQ3zVQstv75wxBp/d0js1 2a3ecWdD/S3Sv70l9Y2N4e4vja8Pps4eR1a7Gtzq/nWcHmZXRGRgCzaaHGCNibF5 RaIJUlGGpaKe/UaQ3XfZH2guRBSUCIi4To7QWf3CzpZoWkR4gmZhhB1AcZrd6Z34 WYqZUBwuISI= =68Mc -----END PGP SIGNATURE-----

4 3

Re: Abuse and Remailer Ethics
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 9:21 PM 01/16/95, Homer Wilson Smith wrote: [snip] > Does any single recipient have the right to demand that they be >blocked from all anon messages. I would say yes. > > How about demanding blocking anon messages only from some >senders? That is harder to implement. If you block the sender, you >block ALL his postings, not just to that party. So you would need to >block specific From: and To: combinations. This would not work with >chaining at all, even if we did share blocking information. So that >is out. > > Does a list owner have the right to demand blocking to his list, >with or without a vote of the list readers? I would say yes. > > What about a newsgroup? I would say it takes a vote. Are anon voites >allowed? Touchy question that was important at one time on >alt.r.scientology. I agree with all of that. Somewhat conditionally with what you say about newsgroups, because while it sounds nice, it would be hard to implement. I'm tempted to say that a newsgroup, by it's nature, doesn't have any mechanism for control/government, once created. And as such, doesn't have any way to "decide" not to accept anonymous posts, or posts from a specific user or remailer. So I'm tempted to say "tough luck" to newsgroups that don't like receiving anonymous posts. The alternative is for people interested to create a moderated newsgroup, where of course the moderator could refuse to allow anonymosu posts with or without the remailer operators cooperation. > Anyhow I would guess that the correct action here is to write the >offender and let him know a complaint has been registered against him. >I would also educate him as to why he was so easily traced and tell >him that if he wants to avoid such in the future to start chaining. Yes, I think that is an excellent course of action. > However if he is a determined abuser not prone to social >embarassment, then the sharing of blocking among remailer operators >might become a very good idea. I'm not so sure about that. It might become neccesary, but blocking remailer delivery to a particular address is a _much_ more desirable solution, in my opinion. If a particular person doesn't want to receive anonymous mail, fine. And it might be good to have a mechanism by which he could make those desires known to all remailers, so he doesn't have to do it individually. But if he does want to receive mail from the remailers, I think he's got to receive all mail from the remailers, and not count on the remailer operators to play Identity Detective and try to screen out people he doesn't like. Same with a listserv and the requests of the listserv operator. A newsgroup is, of course, more touchy, because there really _isn't_ a way for "the newsgroup" to decide not to accept anonymous posts. And I'm not really sure there should be. Part of the answer relies on how "independent" your remailer is. If you _were_ to take no action at all to people who complain about "abuse", would you get in trouble? (from school, company, service provider, country). If you would, then you've got to decide if you are willing to take the heat. And your probably not willing to take the heat for Cantor & Siegel to spam the net. So you've got to do what you've got to do. But, personally, if I ran a remailer on a machine that wasn't subject to political pressure (from school, service provider, whatever), I would never make any effort to cooperate with other operators to track down "offenders", and I'd never exclude any newsgroups from delivery. Because I wouldn't want to play censor and decide what "offense" is worth tracking down, and what isn't. And because even having the _capability_ to track down people is really dangerous, when you get pressure to track down someone you _don't_ want to track down. Much better to say "Can't be done, don't have logs, can't figure out who it was," then to have to admit "well, I've tracked down 5 people in the past month cause someone complained about them." Kind of ruins the point of anon remailers. Best would be to have tracking down be impossible, and it would be close to, if not entirely, impossible if the user took the proper precauations. But even if it's possible, it's probably best not to develop a mechanism to do it.

9 13

Re: 40bit Encryption : Adequate or sadly lacking ?
by kipp＠warp.mcom.com 17 Dec '03

17 Dec '03

In article <3fh5m0$7tg(a)hdxu03.telecom.ptt.nl>, you write: > In article <marca-1201952123120001(a)boulanger.mcom.com>, marca(a)mcom.com > says... > > > >There's no question that 40-bit is less than one would prefer. > >This is why we are/will be supporting 128-bit RC4, for example, > >in US-only products, honoring United States government export > >restrictions. > > Marc, isn't it possible (legally) to deliver products with a replaceble > encryption library (dll). Delivery with a 40-bit key DLL. The user has > the option to install a dll with a different keysize. Somewhat like > winsock... > > Yes, I've seen the article suggesting a foreign office. I think an open > interface would do gooed for the whole field. I.e. ftp, telnet, etc. as > well. Actually, it's probably worse than you think: There are govt's out there that won't let you import code that is "encryption ready". You must prove that your software is tamper proof before it can be imported, and tamper proofing means that you can't bolt on security. Also, I believe the export laws disallow "plug in" security in the US... The crypto legal world sucks.

4 3