December 2003 - cypherpunks-legacy

Selling our spin. was: Cypherpunks Press release
by Pat Farrell 17 Dec '03

17 Dec '03

Kevin L Prigge <klp(a)gold.tc.umn.edu> writes: > Does anyone know exactly how the press contact thing works? My impression > is that a reporter/journalist stumbles on to someone who knows something > about a particular area, and is willing to be interviewed. Then the next > time a story comes along that deals even slightly with that subject, the > reporter will tend to contact that person. I think the "exact" process varies with the journalist. But you have it generally correct. The press runs on reputations. When a writer gets a story, they look for "reliable sources" to contact. Reputations are based on a lot of things, including knowledge, speaking ability, looks and the ability to emit a sound-bite that is interesting. it is a strange process. I mean, I even got on CNN during the Morris worm. Tim is right, there is no "we" here. We can't have an official spokesperson, we don't agree on much. But we can work from the ground up. There are a number of serious cryptographers on the list, or at least friendly to the list when the S/N ratio makes sense. With a little work, we should be able to find a fairly long list of media contacts. We can even make it media friendly. >From people I've personally seen recently, we could have Doug Humphrey of Digex (nice to have a security-related company President) Bob Stratton of UU.Net (corporate security wiz) Carl Ellison of TIS (usually on c'punks light and at all DCcp meetings) probably others at TIS such as Ken Mendelsen or Steve Walker For the political side, the folks at EFF, CDT, EIPC, etc. And there are others that could be good contacts, such as William H Murray of Delloite and Touche, Matt Blaze of [Bellcore|BellLabs] It might take a while to get permission for referal, but I expect that most security consultants would consider being quoted in mainstream press to be good advertizing. If we make it easy, anyone would be willing to take advantage of the resource. We should also inclue a representative sample of folks who disagree with us. Any real list should include Dorothy Denning and other supporters. We can simply stack the deck. We can make sure that the mainline journalists know where to look, and make sure that CDT, EFF, ACLU, and EPIC have references that are ready when they are asked for referals. Assuming my web server recovers from the mention in comp.risks, I'm more than willing to accept suggestions and have a "security spokes-folks" page. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

Re: Big Brother is watching you watch Farenheit 451
by Peter Trei 17 Dec '03

17 Dec '03

Bill Stewart <stewarts(a)ix.netcom.com> wrote: > At 08:47 AM 9/4/97 -0400, Brian B. Riley wrote: > >in the process of rereading "Fahrenheit 451" - the recent printing of > >this in paperback features a Marquis that says somethig like "Now, more > >relevant than ever" - as much as I hate having someone else tell me what > >to think ... they certainly seem to be right. It has been over twenty > > BTW, the last copy of F451 I saw really irked me - the cover had > explanatory notes like "Fahrenheit 451, the temperature that books burn!" > and stuff about firemen whose job is setting fires. > Are today's kids dumbing down, or less literate, or is it just enough > longer since the book was written that publishers need to try harder to > get people to read it? Any day, I expect to hear that The State has mandated that all first editions of F451 be confiscated and landfilled. Why? Whatever the true motives, the one they will cite is "public safety": the first (hardback) edition is bound in asbestos. trei(a)process.com

1 0

Re: netscape's response
by Jeff Weinstein 17 Dec '03

17 Dec '03

On Sep 20, 5:16pm, David_A Wagner wrote: > Subject: Re: netscape's response > In article <9509200139.ZM206@tofuhut> you write: > > On Sep 20, 12:29am, Christian Wettergren wrote: > > > One wild idea that I just got was to have servers and clients exchange > > > random numbers (not seeds of course), in a kind of chaining way. Since > > > most viewers connect to a number of servers, and all servers are > > > connected to by many clients, they would mix "randomness sources" with > > > each other, making it impossible to observe the local environment > > > only. And the random values would of course be encrypted under the > > > session key, making it impossible to "watch the wire". > > > > Wow, this is a great idea!! > > Are you quite sure this is a good idea? > > I'd be very scared of it. In particular, it opens up the chance for > adversaries to feed you specially chosen numbers to pollute your seeds. What I should have said is that its a very interesting idea. Given current perceptions of netscape, I should have made clear that I wouldn't do something like this without getting a lot more discussion and review of possible dangers and how to avoid them. I certainly can't fault anyone for wondering if we would just implement this without thinking it through, given recent events. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

RE: AN OPPORTUNITY NOT TO BE MISSED
by tcmay＠got.net 17 Dec '03

17 Dec '03

Date: Wed, 13 Sep 1995 19:25:24 -0700 To: cypherpunks(a)toad.com From: tcmay(a)got.net (Timothy C. May) Subject: Re: An opportunity not to be missed At 1:57 AM 9/14/95, Bill Stewart wrote: >Is Wavy Gravy running his "Nobody for President" campaign again this time? >After all, Nobody's going to balance the budget, and Nobody's going to >get the government out of your bedroom, and on the internet, Nobody can tell >if you're a dog or not :-) Or to update it for today: "Nobody(a)remailer.org for President." --Tim ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord ?"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"cracker"} = "<remailer(a)anon.efga.org> cpunk mix remix pgp hash ksub esub latent cut ek reord post"; $remailer{'redneck'} = '<config(a)anon.efga.org> newnym pgp'; $remailer{"bureau42"} = "<remailer(a)bureau42.ml.org> cpunk mix pgp ksub hash latent cut ek"; $remailer{"neva"} = "<remailer(a)neva.org> cpunk pgp pgponly hash cut ksub ?"; $remailer{"lcs"} = "<mix(a)anon.lcs.mit.edu> mix"; $remailer{"medusa"} = "<medusa(a)weasel.owl.de> mix middle" $remailer{"McCain"} = "<mccain(a)notatla.demon.co.uk> mix middle"; $remailer{"valdeez"} = "<valdeez(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"arrid"} = "<arrid(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"hera"} = "<goddesshera(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"htuttle"} = "<h_tuttle(a)rigel.cyberpass.net> cpunk pgp hash latent cut post ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix reno winsock) (weasel squirrel medusa) (cracker redneck) (nym lcs) (valdeez arrid hera) The remailer list here has been out of date for some time, but should be up to date now. I'm still working on updating the web page. Last update: Mon 8 Sep 97 6:48:45 PDT remailer email address history latency uptime ----------------------------------------------------------------------- nym config(a)nym.alias.net ####**+#-## 7:03 99.95% hera goddesshera(a)juno.com ----_.---.. 14:56:18 99.95% cyber alias(a)alias.cyberpass.net *+*****++**+ 11:30 99.93% squirrel mix(a)squirrel.owl.de ----------- 3:17:57 99.83% valdeez valdeez(a)juno.com -__.-*+*-.- 7:50:19 99.81% winsock winsock(a)rigel.cyberpass.net -----_..---* 10:10:24 99.81% bureau42 remailer(a)bureau42.ml.org ..--------- 3:33:37 99.31% arrid arrid(a)juno.com -- -------- 7:27:32 99.15% neva remailer(a)neva.org -+*#+*--* # 25:21 98.45% jam remailer(a)cypherpunks.ca + ++++++ 39:06 97.23% cracker remailer(a)anon.efga.org + +++ +++ 28:43 97.10% replay remailer(a)replay.com +**-++ +** 9:49 96.75% redneck config(a)anon.efga.org -*+* ++# 10:58 96.60% reno middleman(a)cyberpass.net ++..+ * -- 2:32:31 84.34% mix mixmaster(a)remail.obscura.com **+*++*+ 1:14:29 58.44% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Spam of c'punks list: cleaning it up now.
by John Gilmore 17 Dec '03

17 Dec '03

Somebody, apparently at ci.diamond-bar.ca.us, has been feeding the last month's worth of Cypherpunks postings back to the Cypherpunks list. You probably saw a few of them. They are still coming in to toad.com. When I got home this afternoon, the load average had hit 150 and most of them were copies of sendmail. This prevented most of the messages from getting out to you, happily. I've cleaned up the ones I found in the queues, and I'll start working next on getting the *valid* cypherpunks messages flowing again... John Gilmore

1 0

Re: EMP & Cars (fwd)
by Peter Trei 17 Dec '03

17 Dec '03

> From: Jim Choate <ravage(a)ssz.com> > Forwarded message: > > > Date: Fri, 5 Sep 1997 11:48:08 -0400 (EDT) > > From: Ray Arachelian <sunder(a)brainlink.com> > > Subject: EMP & Cars (fwd) > > > There has been quite an interest in EMP. > > > pulses to a near miss lightning strike. As far as vehicle disabling, There > > are claims that auto manufactures have built in a shut down frequency into > > the computers in certain vehicles. We wound a large coil on a carpet paper > > tube and put an oscillator on it and it would flood a vehicles electrical > > system to shut it down, but it was huge. > > Mind being a little more specific?... [...] > > The easiest way to learn about > > EMP is to find the International TESLA society web site and interpret the > > information there. > > Some of the best sources are ECM & EECM texts/sites. > > While it is a good source of technical info it does take a bull-shit > detector set to full to sift through all the other detritis the ITS wallows > in. Space aliens, hollow earth, over-unity power, etc. Ham radio operators have been dealing with this issue for years. There's a lot of (mostly anectodotal) stories of mobile operators keying up their rigs and having either their own or neighbouring cars misfiring or dieing. Shielded ignition cables seem to fix things (though they are actually bought to prevent ignition noise from getting into the radio, not the other way around). Ham operators can use *much* more powerful transmitters than CB or cell phones - my own transceiver puts out 50 watts, but some go a lot higher. It's fairly common for hams to 'test' a prospective car purchase by waving an HT over the engine while transmitting, to see if it has a problem. I suspect that it would be quite possible to build an EMP gun to kill most running cars, but it would also kill anyone with a pacemaker. I'm more worried about the current trend towards placing remotely controlled electronics in cars. Already, one US manufacturer offers as an option a satellite reciever which (among other things) can unlock the car remotely if you lock it in the car accidentally. I have no idea how much authentication is required for such a request, but I'm sure car theives are looking into it. To defend against this, I expect next years model will also allow the car to be turned off by remote control, or turn on a tracking device. The popular 'Lojak' car tracking system has similar civil liberties issues. I understand that the car owner has no control over it's activation, can't disable it, and there is no indication that it is in operation.Apparently all the "authorities" need to turn it on is the VIN. Peter Trei N1MNV

2 1

Re: Project: a standard cell random number generator
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:50 PM 9/20/95, John Gilmore wrote: >Software-generated random numbers are likely to be of poor quality. >There just isn't that much true randomness visible to computers. >Several ways to build good hardware random number generators are >known. But before hardware random number generators can be >incorporated into common desktop computers, someone will have to put >them into a small fraction of a chip. Essentially, to have good market penetration, this means building a small hardware random number generator into the Pentium, and a few other popular processors. Building it into a separate chip is ineffective, as chip counts are going down on motherboards. (Some may quibble, but clearly about 60-80% of the market is now x86-based, with motherboards supplied by a limited number of companies, and with "chipsets" like the Triton.) What would it take to convince Intel, then, to devote resources to put a HRNG module on, say, future versions of the Pentium, Pentium Pro (P6), etc.? A lot, I'd say. First, Intel will ask what products would gain from _some_ hardware platforms having HRNG when the majority will not. (This is important, because it means that as long as there are vast numbers of 486-, Pentium-, SPARC-, MIPS-, 68K-, and PPC-based systems out there that DON'T have hardware random number generators, then Netscape and other suppliers of software CANNOT COUNT ON THE HRNG. This is an important point: a hardware RNG standard will take many years to percolate into the installed base and reach a level of penetration where even 30% of all machines are equipped with HRNG modules. In the meantime, Netscape and everyone else has to come up with solutions which fit the existing and nearterm-available machines. Second, how much extra will customers pay? Even if the area of the HRNG is less than 1% of the total, design resources are consumed and potential reliability and liablility issues arise. (Liability is problematic precisely because the HRNG is nondeterministic, and some chips are likely to be "more random" (which is "good") than others which are "less random" (which is "bad"). Imagine a customer having a chip which he finds out produces very little entropy, for technical/manufacturing reasons. >You probably can't build a hardware random number generator out of >existing "gate array" gates or "standard cell" cells, because all the >existing gates and cells are designed to behave completely >predictably! It will take designing a new circuit structure. You probably can, actually. CMOS and BiCMOS have all sorts of structures in which threshold voltages can be measured. DRAM arrays have various seemingly-random (*) discharge characteristics. Zener diodes can be built in any of these technologies. At small enough structural levels, such as we are now seeing at the .35 micron level and below, noise is omnipresent, and is dealt with in various ways. Thus, using the noise is not so difficult. (* The various charge/discharge characteristics are actually not random, of course, and are reproducible. But with care they can be used to increase the entropy of other soources. Care must be taken.) >Do we know any solid state physics / circuit design experts who think >this might be a fun thing to do? I bet you could get a paper out of >it. And probably improve the world a few years later, when companies >used your paper to close another hole in their computer security. I'm skeptical for the reasons given above. Even starting today, far too long to get enough out there. (Far-future thinkers will say, "Then let's start now," but it still is not true that companies like Netscape or Verisign will use such an invention to close another hole...they could only close the hole for the customers who had the HRNG-equipped machines, and this is not likely to be enough for quite some time. As John knows, but others may not, I worked on random noise effects in devices at Intel. A co-worker (now President of IC Works, Ilbok Lee) and I developed a hardware random number generator based on very low level radiation sources, using an effect I discovered. We tried to get a patent on it, in 1978, but there was no interest by Intel. Personally, I think that "software + user actions + environment stuff" can generate vast amounts of usable entropy, especially if a user lets it accumulate immediately prior to generating crypto material. * Software -- the standard cryptographic hash functions to "mix" bits even further. * User Actions -- mouse movements, keyboard timing, microphone noise, etc. * Environmental Stuff -- measurement of disk access timings, in milliseconds, amount of free blocks, Ethernet packet stuff, etc. (This may or may not be good for more than a few bits per second, but can be accumulated for several minutes or hours.) Any of these has various weaknesses and points of attack. But let's face it, would Golberg and Wagner have been able to crack Netscape if the PRNG had used some mouse swirling, some random keyboard pounding, some disk access measurements, and had then hashed this with a noninvertible hash function? I think not. This approach has the benefit of working almost immediately, without special dongles on the back of machines or of convincing Intel and Motorola to add special functions (which would take years to effectively penetrate the market). --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Prayer to A.M. Turing
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Adam Back wrote: >Monty Cantain writes: >> Oh Lord Turing, God of Messages and Pathways, please reduce the >> latency time of the remailer network! Please accept this humble >> offering: 10110AlanMathisonTuring8ef2b1912670b51 > >Your email to Lord Turing may bounce, your hashcash postage doesn't >collide: > >% ashcash AlanMathisonTuring 10110AlanMathisonTuring8ef2b1912670b51 >collision: 0 bits >% Add an "f". AMT

2 1

Re: MIME
by shields＠tembel.org 17 Dec '03

17 Dec '03

> >I think that it must be the content-type that is causing problems, > > Yes, I agree. Make it something like ASCII text But it's not text/plain. It's PGP'ed text/plain. The only way to indicate this in MIME is with a content-type. (Yes, they're working on a general way to encapsulate encryption.) Fine, I'll just leave mail to the list unsigned. -- Shields.

1 0