December 2003 - cypherpunks-legacy

Re: Whitehouse "dissident" web site monitoring?
by Rich Salz 17 Dec '03

17 Dec '03

>Seriously folks I'm very pissed about the abuse of log file information. The What abuse? Is there an expectation of privacy in Web-world, such that all users can honestly expect that a site is compelled to keep its "visitor log" private? Surely not.

4 3

Re: An opportunity not to be missed
by Frank Stuart 17 Dec '03

17 Dec '03

>It has occurred to me with the approach of the presidential campaign >in the US (and its attendant press frenzy), that there is an an >unprecedentedly vast opportunity to bring certain items on the >cypherpunk platform into the public spotlight. [...] > Candidate Posturing Required Spin > ----------------------------------------------------------------- > Pro-business, tough on crime anonymous crime tip e-mail > a la Fed whistleblower stuff, > and the SPA [...] Now that you mention it, it seems to me that completely anonymous tipsters with the ability to receive ecash rewards would likely be a bigger boon to law enforcement types than would easily tappable communications lines. Is anyone in a position to set up a cypherpunks CrimeStoppers mailbox (for use through the remailers)? You could set up a web-page with instructions and a list of crimes for which there are rewards. Perhaps some civic organiztions would be willing to donate money for tips leading to arrests and convictions of any crimes. Even if it doesn't catch any bad guys, it'd be great PR for strong crypto, anonymity, ecash and whoever runs it. | (Douglas) Hofstadter's Law: Frank Stuart | It always takes longer than you expect, even fstuart(a)vetmed.auburn.edu | when you take into account Hofstadter's Law.

1 0

Re: Software vs Money Laundering
by madden＠mpi-sb.mpg.de 17 Dec '03

17 Dec '03

Duncan Frissell's email (Sep 13 17:52:55), in reply to John Young, gives some problems regarding an AI screening program for detecting illicit electronic money transfers: > Not the least of which [problems] is that money launderers can use "AI > Software" to generate a stream of real and dummy money transfers that > emulates "normal" money transfers. Not to mention the fact that > monopoly money transfer networks that can be surveilled by the Feds > (FEDWIRE and SWIFT) are not long for this world. They will be > replaced by encrypted, open, net-based systems. There are also more basic problems. An essential initial stage in the development of such AI programs, a kind of expert system, is the analysis of the behaviour of the human "experts". In this case the experts being the willy money launderers. The program can then, aledgedly, spot all those trademark traits of the money launderer and nab him/her. Trouble is, the program therefore represents a kind of blue-print of what the aspiring money launder should *not* to do when making illicit electronic money transfers. Any "expert system" that operates by recognizing, and acting upon, human behaviour (regardless of whether or not that be on the net) can be foiled by altering, or disguising, that behaviour (the "dummy money transfers" mentioned by DCF would be one way of duping the system). Of course, the officials at law will claim rousing successes and cite numerous convictions -- but as with the drug trade, that will only be the tip of the ice-berg with no real clues as to the size of the base. The tip of the ice-berg will simply be what the AI program has succeeded in formally "capturing". Pete ================================================================= Dr Peter Madden, Email: madden(a)mpi-sb.mpg.de Max-Planck-Institut fuer Informatik, Phone: (49) (681) 302-5434 Im Stadtwald, W-66123 Saarbruecken, Germany. Fax: (49) (681) 302-5401

1 0

DD, pedaphiles, and Terrorists, oh my
by Pat Farrell 17 Dec '03

17 Dec '03

Today's Washington Post (9/14) has a front page article on a bust of 12 computer using pedaphiles. NBC news is saying that Janet Reno will have a news conference later this morning. Tomorrow near NIS&T, the workshop on the Federal Key Escrow Standards will be held. Coincidence? Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

3 2

WAS_tem
by John Young 17 Dec '03

17 Dec '03

9-14-95. NYPaper. "Use of Computer Network For Child Sex Sets Off Raids." The Justice Department today announced a dozen arrests in a two year investigation into the use of America Online, the country's largest computer network, to distribute child pornography and to lure minors into sex. The culmination of the inquiry by the Federal Bureau of Investigation comes at a time when the agency has needed some favorable attention to offset a string of incidents that have cast it in a negative light. "Scientologists Lose a Battle on the Internet." Upholding free speech on the Internet, a Federal judge has ordered the Church of Scientology to return computers and files seized here last month from two men who used a computer bulletin board to disseminate information critical of the church. The equipment belongs to Factnet, an anti-Scientology bulletin board run by two Boulder men, Lawrence Wollersheim and Robert Penny. 2x: WAS_tem (16 kb)

1 0

Re: Scientology tries to break PGP - and
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- re: >[snip] >> When the safety is finally removed from the gun at your head (sorry for >> the drama) you hand over your alternate secret key. If decrypted with the >> "alternate" or "fake" secret key, the encrypted file is wiped until it >> reaches a marker; the remainder of the file is displayed. If you use your >> "primary" or "real key", the extraneous text is simply stripped. Instead of stripping, how about adding an offset to the start and end of the ciphertext to each encoded idea key. This way, I can send text A to key A, text B to key B, C to C and so on. As long as the recipient and I have agreed in advance on which key to use to exchange the real message, who can say otherwise? If code words are used in all the messages to refer to any illegal acts, ("ship me 30 kilos of smack" might be a tad incriminating) how can anything be proved even if the recipient is compelled to divulge their key? An added advantage to this scheme is that if properly used it should help throw a monkey wrench into traffic analysis by the nosy. If I regularly exchange encrypted messages with several different recipients, I can enclose a seperate plaintext for each, make one massive combined cyphertext and send it to all of them. The ones I have no instructions or trade secrets for today will each receive "Ignore this message," followed by a randomly selected random number of fortunes or other random data (so each message to be ignored will have different length different plaintext to further thwart analysis). This may be combined with stealth PGP headers to make it difficult for LEAs to determine all recipients for the purpose of getting a subpeona for their keys. Joseph Block <jpb(a)miamisci.org> "We can't be so fixated on our desire to preserve the rights of ordinary Americans ..." -- Bill Clinton (USA TODAY, 11 March 1993, page 2A) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMFek8mGnwFiC3O2NAQGx0QgArERNVabtUY3MMDaDfjFn+Jg4ZGQcV4oD 47qJDFqW4riQ6LtQW3YiptkVl/jGJcwzEyRTAb4v6mYeIXwaQi4Or0C041ADLGMo RzB/tIIQSsF+oQYEI/lHL1t8jYi4737oU2BJrUJvgahsNS0V7TBTEtGhdDWFDjk9 bd74f//lJCmnvq/gqV02KqB0zL1YGAXoXLzzhZEMk3T2cxm9n5oRZX82zT4tCV0Q Cw1jW7ZT+Bsaa099RJ7HvLQI4fqMeI7+NoBwhhtpZ/Iy8OWmEhaOz4Z50cZcbxf1 Ol6xMKXdHBVqK41cm7lyoH7Tpt7Zw1bSq4svONm6v2urwn9R9JHn+Q== =8BlI -----END PGP SIGNATURE-----

1 0

Crimestoppers anon tip mailbox
by David C. Lambert 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Frank Stuart <fstuart(a)vetmed.auburn.edu> writes: > Now that you mention it, it seems to me that completely anonymous tipsters > with the ability to receive ecash rewards would likely be a bigger boon to > law enforcement types than would easily tappable communications lines. > Is anyone in a position to set up a cypherpunks CrimeStoppers mailbox (for > use through the remailers)? I might be. > You could set up a web-page with instructions > and a list of crimes for which there are rewards. Perhaps some civic > organizations would be willing to donate money for tips leading to arrests > and convictions of any crimes. Excellent idea. Then it could be brought to the attention of a candidate or two that have net.crime on their agendas. > Even if it doesn't catch any bad guys, it'd be > great PR for strong crypto, anonymity, ecash and whoever runs it. ^^^^^^^^^^^^^^^ Well, I don't know about the last part - it seems to me that opinions would be mixed. The only thing that I'm not sure of is the use of ecash - mostly because I haven't really been keeping track of the state of the art. Could some people who are better informed on the subject discuss whether this is a feasible way to use it? I wasn't actually thinking of rewards, mostly because you'd have to arrange some sort of reply block from the anonymous tip mailbox. Most people (even remailer users) don't know how or don't wish to use these, so I don't know if that part would really fly. David C. Lambert dcl(a)panix.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFg8D6pplsfgM88VAQG6lQP+OpKrDF73T8zupGfco0VREUa98wLYR7VX Jw2OyUHYML28VQNxwikZNTwBObotEihVo6uH9xRKzhBnpzqol1D/ZAj+1z24x2EK byqhSp4PJEiKmzqW0chWCeIhX6ND45E2vSweBB6/OPotlZw9C7ZfnM+i0cfII3gb Np+Dec/mLHU= =M+KT -----END PGP SIGNATURE-----

1 0

Re: Mixmaster posting poll
by Rich Salz 17 Dec '03

17 Dec '03

> I think that I am not being clear enough about what I want to do. Ah, now I understand -- thanks for the clarification. Let me waste a bit of time on some general news/mail issues. The two formats are very similar, but not identical. This is generally a good thing. For example, it's easy to write a single user interface that handles both. (Many people like having killfiles on their email, for example.) However, when you start to gateway between the two, the differences become more important. For example, suppose an article has To, Newsgroups, and Cc headers. What should happen? Some news user-agents (used to?) email as well as post when given a news article with those headers. And what happens when an article is then gatewayed back out to email, and care isn't taken to strip those headers off? (Rhetorical question; I don't know.) I think this is of particular concern to this community. Imagine a mail->news remailer that gatewayed messages by connection to UUNET's accept-from-anyone server and posted them to alt.blacknet. Interested parties might then get a full feed and locally gateway alt.blacknet into a mailing list. So this kind of multi-time gatewaying, if not common now, could (and should?) be soon. I guess that's a long way of saying "be careful." :) The advantage of using "news.group(a)gateway.host" is that it might avoid these confusions since the Newsgroup header appears out-of-band. However setting up gateways like this is often harder, requiring special prefixes (viz., usenet.news.group(a)gate.host is/was common) hundreds (thousands) of aliases, or the ability to set up special mailer config (typically sendmail.cf on the internet these days) that recognize only the top-level hierarchies (of which there are hundreds, changing weekly). There is also the problem of making sure that the mail newsgroup list is kept in sync with the local host's newsgroup list. An even bigger problem is that cross-postings are essentially impossible (you get multiple copies); this can be annoying if you want to cross-post to a group that the gateway host doesn't receive. A workable trick is to post to control,alt.blacknet -- everyone "gets" control but only those that care will see the article where it should really go. If you use something like mail2news(a)gate.host, then the newsgroups are in the Newsgroups header. You have to be careful about To and Cc but you don't have the problems mentioned above. I think the header problem is more likely fixed/fixable, and therefore suggest the second syntax. If you do local gatewaying, you should really send your article into rnews and not inews. Inews will mess with headers, which is okay for users or scripts that know they can be sloppy. But not okay for gateways which don't want .signature files appended, too-much-quoted-text counted, etc. Feeding into rnews is not difficult -- you need merely ensure that your message has these six headers: Message-ID Newsgroups From Date Subject Path. The other advantage of feeding into rnews is that rnews always spools if the news processor is unavailable, while inews doesn't. Another option is to provide a program that can connect to a specified host and inject the gatewayed article directly using the NNTP protocol. This is not hard; INN includes a program (feedone.c) that does it in about 200 commented source lines. INN is available from many places, including ftp://ftp.uu.net/networking/news/nntp/inn/inn1.4sec2.tar.Z and my news/mail gateway software (newsgate) is available by sending me email. Hope this helps. /r$ > > At 8:35 AM 9/13/95, Rich Salz wrote: > >> If the form alt.usenet.group(a)remailer.com was used, wouldn't the > >> system running the remailer have to have an alias defined for each and > >> every newsgroup that it plans on handling? > > > >No. Sites running sendmail, for example, could set up rules that > >just knew the top-level hierarchies and fed those into a special > >"mailer" that gatewayed them. > > > >My opinion is that making any names well-known is a bad idea, and > >that attaching special semantics to "mail2news@xxx" is a real bad > >idea. Instead, just send the message to the specified recipient > >and let do whatever magic needs to be done. > > > >If mixmaster wants to function as a mail/news gateway, it should > >do something special when it sees the Newsgroups header -- process > >the message and feed it into rnews, presumably. > > > >I guess, but not yet having read the code do not know, that this is > >cleaner and more easily extensible (or removable). > > /r$ > > ---------------------------------------------------------- > Lance Cottrell loki(a)obscura.com > PGP 2.6 key available by finger or server. > Mixmaster, the next generation remailer, is now available! > http://obscura.com/~loki/Welcome.html or FTP to obscura.com > > "Love is a snowmobile racing across the tundra. Suddenly > it flips over, pinning you underneath. At night the ice > weasels come." > --Nietzsche > ---------------------------------------------------------- > > >

1 0

Re: WAS_tem
by Rev. Ben 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > The New York Times, September 14, 1995, pp. A1, B14. > > Use of Computer Network For Child Sex Sets Off Raids [snip] > Lawmakers have debated whether to restrict the use of > computer networks. Today, a bill making it illegal to use > computers to produce child pornography was introduced by > Senator Orrin G. Hatch, the Utah Republican who heads the > Judiciary Committee. > > The bill would expand the definition of child pornography > to include any photograph, film, videotape or computer > image produced by any means, including electronically by > computer, if it depicts or appears to depict a minor > engaging in sexually explicit conduct. If I'm reading this correctly, if I Photoshop a kids face onto the body of the latest Playboy centerfold, I'm in violation of this proposed law? Ben ____ Ben Samman..............................................samman(a)cs.yale.edu I have learned silence from the talkative, toleration from the intolerant, and kindness from the unkind; yet, strange, I am ungrateful to those teachers.-- K. Gibran. SUPPORT THE PHIL ZIMMERMANN LEGAL DEFENSE FUND! For information Email: zldf(a)clark.net http://www.netresponse.com/zldf PGP encrypted mail welcomed--finger samman(a)cs.yale.edu for public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed with Bryce's Auto-PGP v1.0beta3 iQB1AwUBMFg+8L5ALmeTVXAJAQEJswL+KijGeD+NIxOEdGkusWl/l8kLpigd73r1 JxoOeo1Sv9jc8JEv89SQDt2xY5i9WhquARph/+N2d7m2FR1DvRnLlHtuvjsV7hjS mOwurpzx6wHfmJnivojJUqwfTrqxT5gG =bUJU -----END PGP SIGNATURE-----

1 0

Re: Scientology tries to break PGP - and
by trollins＠hns.com 17 Dec '03

17 Dec '03

This area of court ordered key disclosure is troubling. I assume that failure to do so would be punished by "contempt of court" much like a reporter that refuses to reveal his information sources. (Jail or Fine until the person complies with the order). If you have PGP encrypted messages on your disk which are encrypted to other people. Is this a libality ? Normally, you have no way to decrypt this data. After looking at a PGP 'Hack' which allows the message to be encrypted with a session key different from the session key encrypted in the RSA header using someones public key. Your data could thus be encrypted in a PGP message to someone without using the session key specified in that RSA header. This someone else may or may not exist. You may have created a key pair and discarded the secret key. It would then seem that you could be found in "Contempt of Court" because you could not come forward with a private key belonging to someone other than yourself. -tom

1 0