December 2003 - cypherpunks-legacy

Re: "alt.cypherpunks" Newsgroup vs. Mailing List?
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

Although Tim is quite happy with Eudora's (or whatever it is) email handeling techniques, I would also prefer a way in which to use my Usenet tools on the cypherpunks list. BUT I think that making it a newgroup opens up the volume to a level far beyond what it is now. It will also result in a far larger level of "noise" due mostly to cross-posts. My plan is to gate cypherpunks to a local newsgroup (local to my machine only) and read it that way. Is it more work for me that way? - yes, but I'ld prefer to do the extra work required than loose what this group has as a mailing list. Now - if someone wants to start a seperate alt.cypherpunks group, but *NOT* gateway this list to it - be my guest. People can then vote with their feet which is the better "medium" or transport method. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

6 5

Mixmaster Licensing Offer Explained
by loki＠obscura.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Lance Cottrell <loki(a)obscura.com> Date: 17 September 1995 Subject: Mixmaster Licensing Offer Explained Permission is granted to distribute this document in any media for any purpose as long as the entire document is distributed with the attached digital signature intact, or the document is clearly marked as having been modified with the locations of deleted text indicated. Several rumors have surfaced following my announcement of Mixmaster's changing status. I want to nip these worries in the bud. After discussion with the party interested in commercially licensing Mixmaster we have decided to explain the whole situation publicly. The company offering to license Mixmaster is Phoenix DataNet, a Houston area ISP. John Perry, a person well known to this list and the remailer community in general, is a Senior Systems Administrator at Phoenix. On Thursday I received a call from John. Some others at Phoenix had just noticed a Mixmaster remailer he had been running on one of their machines. Phoenix has several large corporate customers who need secure transactions for some special applications. The core engine of Mixmaster is well suited to that purpose. They offered to license the code from me to use as the framework on which to build these other programs. In the process they will rewrite many basic functions in Mixmaster that need major overhaul (e.g., key management). We will incorporate those improvements back into Mixmaster. This should lead to porting Mixmaster to several other platforms, and to fixing most of my worst coding atrocities. I had never considered licensing Mixmaster, but I know John Perry both personally and by reputation. He has thoroughly assuaged my fears that Phoenix would try to weaken or restrict Mixmaster in any way. John will be leading this project on the Phoenix end. He asked that I delay the release of the next version of Mixmaster pending clarification of every one's intentions. Now that we have reached an understanding the planned release of Mixmaster version 2.0.2 will take place as soon as I can get it ready. There are no plans to sell Mixmaster clients or servers. They will continue to be released free with source code. I will still control the contents of all releases of Mixmaster. All future versions of Mixmaster will be backward compatible. There will be no "Legal Kludges" preventing old clients from working with new remailers, and new clients will be able to generate old message formats. Currently there are no plans to change the message format at all. -Lance Cottrell -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMFvVivPzr81BVjMVAQHzhgf/f9zM91/N0S/JljicjDpoGzQ6Pt4gZVy9 ar407vp6js7EJ7Kg2XHtni6FwowM066rbGrt8W/8ZoQJGBxgKkfSvhLpEL7E926M tn5QDEysVa1itzkvym2rQuNRIALfLOwzcYyLMdfjBtPMhRJkfwDthrrl9ocHkrSR WW1wPwBRj/t+LFl6ueXwN8ZYLJVmbIoLy7BcqbNzLWjqmB7jgN2toxVCRfM7qfkE DX1M/+hPddE6dT8ZgWdSt9dUvMQ7hu8BfHKCkcf0XWKmmeJ8jh+XDISvC7EFgIGT H5XjkLpA2Eg+qmYzKHDOQaQT9SfzSVs4Y9sTzMlbewBi3jna6Dz/Sw== =G2pZ -----END PGP SIGNATURE----- -- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

Re: CYPHERPUNK considered harmful
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

David Lambert <dcl(a)panix.com> writes: > > Peter Trei <trei(a)process.com> wrote: > > > Terms like 'cypherpunk' and 'cryptoanarchy' tend to pigeonhole us as > > nutcases for many people, and are a barrier to getting our ideas > > across. I'm not saying this pigeonholing is correct - in fact I despise > > people who judge a book by it's cover, but so many people DO make such > > snap judgements that we need to take this into account when talking to > > the general public. > > Two of the responses to the "An opportunity..." post unapologetically > admitted that they refused to read the text of the message due to the > presence of the word "cypherpunk" in the first sentence. > > Shows you what we're up against. > > BTW, I'm not for changing the name of the list, but I do see the logic > in a more establishment-friendly name to use when lobbying the public. There is likely some truth to the cypherpunk turning some people off before they listen, but also as has already been said 'cypherpunks' has it advantages too: catchy, gets the media imagination, and has an established reputation, and set of accomplishmensts. One thing I have been thinking would be nice would be a USENET newsgroup, as mailing lists are a step away from easy access which some people never make. It makes it less easy to browse and see what it's about, interacting with majordomo software might seem very intuitive to most members, but not all will be so comfortable signing up their mailbox (which they possibly pay for per K), and may indeed lack the expertise required to do the job. There are serveral archives of cpunks, but these don't tend to be as well known as newsgroups. More people might come across cypherpunks ideas, and the technology for remailers, disk encryptors, discussions of nym servers, steganorgraphy, IPSEC, etc if they were in a newsgroup, perhaps even within the comp, soc, or sci hierarchies. One thing I have discovered in myself is a reluctance to subscribe to too many mailing lists, as the volume, and management of the resulting traffic piped your way can be overwelming (yes I know there are various filters to split off traffic into separate mbox files). I think it is a shame that things like the nym server discussion which sounded very interesting to me got split off into a separate group, I'd just as soon see the discussion here, for reluctance to subscribe to yet more groups reasons, and because it sounded like it wasn't very high volume anyway. Same for the stego group discussions. If it's all in one place at least I can skim that for interesting things. Both of those discussions I think would contribute to the signal ratio here. But, Peter's stated aims sound useful, of promulgating cypherpunks technolgy, and ideas to as large an audience as possible. Definately a very important aim, and one that lots of people already devote some time and thought to. Might I suggest that a newsgroup would be a way to go? There are already a number of security, privacy, and crypto related groups, but they tend to have their own pattern of flow, you know penet.fi problems on alt.privacy.anon-server, alt.privacy (dunno not read much), alt.security.pgp pgp usage, David Sterlight fueled discussions, some ITAR stuff, talk.politics.crypto, crypto politics, comp.org.eff.talk, there must be a few others. Peter's FAQ like document was very nicely worded for avoidance of any connotations of conspiracy or 'punkery' which might put off the less adventurous souls, the more conservative. How about it? Reckon cypherpunks as a group has enough readers to hmm, push through a vote for group creation, if the majority thought it was a useful exercise. A group soley for what? cypherpunks technology, social impacts and education, a place where someone would go with security questions, and to learn about the future of personal and corporate security on the net. If a few people frequented it, with the sort of diligence that a number of people spend time contributing to the alt.security.pgp group, and a useful set of pointers, and FAQs posted frequently, it might become a useful resource. One URL which I haven't seen pushed all that much which impressed me a lot for a very comprehensive list of cypherpunks technology, what it is and where to get it was Tatu Ylonen's pages on crypto, and crypto apps: http://www.cs.hut.fi/ssh/crypto/ A resource that would look good with a support newsgroup for discussion of just such technology. I would have thought that if anyone was interested to set up such a group (Peter? - your initiative?), that you could tone down the 'cypherpunks' name if you felt it would further the cause of giving the newsgroup wider appeal. I mean perhaps you would mention 'cypherpunks', 'the mailing list', near the end of the FAQ as further resources, and a forum for active discussion, explaining the name first, so that people don't get put off, after they've got that far (read all through your FAQ), presumably they'll be less inclinded to let a label bother them. Adam

5 5

Re: [ASSENT NOISE] Re: C-punks, marketing for the masses
by banisar＠epic.org 17 Dec '03

17 Dec '03

> >The Cypherpunks group is not like that. Lacking any formalized leadership, >and--most importantly--lacking offices in D.C., we can't be asked to >perform like the usual trained seals who produce the soundbites that fit >into the stories too many reporters want. Again, a weakness and a strength. Hey! Bark Bark Bark Bark Dave (partially trained seal protesting that description) PS Sorry all for my last message that should have only gone to Bruce. I'm claiming jetlag. David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * ftp/gopher/wais cpsr.org Washington, DC 20003 * HTTP://epic.digicash.com/epic

1 0

Trained Seals and Beltway Insiders
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:23 PM 9/17/95, Dave Banisar wrote: >> >>The Cypherpunks group is not like that. Lacking any formalized leadership, >>and--most importantly--lacking offices in D.C., we can't be asked to >>perform like the usual trained seals who produce the soundbites that fit >>into the stories too many reporters want. Again, a weakness and a strength. > >Hey! Bark Bark Bark Bark > >Dave (partially trained seal protesting that description) Well, sorry for letting my rhetorical excesses come to the fore! On even days I think the work of the Washington lobbying/policy groups is very useful, even if not always done the way I would do it. (Having grown up just outside D.C., nothing would ever get me to live in that area again, though.) On odd days, I think of them as "Beltway insiders," with the same handful of "spokeswonks" handling all of the issues, dealing with all of the press conferences, attending the various D.C. events, and essentially being part of the System. I never did memorize what all those "estates" are, as in the Third and Fourth Estates. But I think the Washington crowd has several components: The Gubment (itself divided into several branches), the Press, the Contractors, and the Lobbyists. The "think tanks" which ring D.C. and other areas (Brookings, Cato, the new Progress and Freedom Foundation, the military advisory think tanks, and a dozen or more others) are an industry unto themselves. Add to these the various lobbying groups (NRA, AMA, tobacco, Right to Life, etc.). And throw in various national groups with D.C. offices. Quite a stew. They all play off each other, with the lobbying groups trained to "give good sound" to the reporters who want some quotable line about child porn, or Clipper, or whatever. Any conclusions for us? Maybe, but I won't touch them here. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

RE: Commercial Mixmaster
by syrinx＠c2.org (Syrinx Anonymous Remailer) 17 Dec '03

17 Dec '03

nelson(a)crynwr.com (Russell Nelson) wrote: > There *will* always be a free version of the client with source > code, but the proprietary improvements will probably not be merged > into the free version. Lance, and only Lance, as copyright holder, > has the publish the code under a different copyright. It's the same > thing that Phil Z. did with ViacryptPGP. It's not the same thing, though. PGP 2.6.2 and PGP 2.7 are compatible. You can compile 2.6.2 from the sources and have it interoperate with Viacrypt 2.7. The concern is not "commercialization", per se, but rather the use of "commercialization" as an excuse to build in "proprietary" features (Back doors?) for which no corresponding source code is involved. Since no one has made a good case for there even being a COMMERCIAL market for Mixmaster, could there be other motives? Without building an anonymous e-$ infrastructure first, there's no way to even charge for the use of a remailing service without sacrificing anonymity, even if people were willing to pay to have messages anonymously remailed. No, I'm not accusing Lance. But if he no longer has the time to support Mixmaster, then perhaps some other crypto-friendly group should take over the task and keep it an OPEN system, with source code available. In fact, even freezing Mixmaster as is would be preferable to "improvements" that people don't/can't trust. True, they *COULD* provide source code, but how many commerical products come with complete source code?

4 3

Anonymous WWW proxies
by Laurent Demailly 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm halfway in the coding of a simple anonymous WWW proxy, but before going any furter, I'd like to know: + If this has not been done before and is available ? (and where) + If there is any interest + Chaining would be a imo good idea (ie cli <-> anonproxy1 <-> anonproxy2 <-> ... <-> server) but how would you manage to tell your favorite web browser to add in its header something like Http-Proxy-List: anonproxy2, ... An alternative would be to have a database of avaibale (running) proxies and that the proxy itself randomly choose a next route ? + A way to solve previous pb and to add in encryption (but would it be fast enough for web browsing ?) would be that each user runs a local proxy (that could be optionnaly used by other folks) that would do pgp encryption/decryption, 'routing' selection,etc... Would ppl with mail remailers and/or W3 experience comment ? (or tell me the pointer toward the already solved, already implemented beast that would do the above) - -- Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|... Freedom Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAgUBMFtiGXk52/beodHxAQETVgP/avWKpD/AUiRPM0ljX0BH0e7q10KYEOdA Hu+/Bsr7PWANdfhefs/ASrJn/kiOIQwo+RGV1K3UKWu7IyYdHHrINZkp0OcFlIR5 8TIfW6/FqBaUwAzuCV0/acUhXW6ah7xpPkgiHJ04Nlu8BKh72QGawJLJDoT2JmIi o67LVdD5ajg= =/kSM -----END PGP SIGNATURE-----

4 6

Re: Mixmaster Licensing Offer Explained
by tcmay＠got.net 17 Dec '03

17 Dec '03

(I've trimmed the mailing lists I'm not on...) At 8:01 AM 9/17/95, Lance Cottrell wrote: > Permission is granted to distribute this document in any media for any >purpose as long as the entire document is distributed with the attached >digital signature intact, or the document is clearly marked as having been >modified with the locations of deleted text indicated. So sue me. :-} (That is, I'll treat this article in the normal way, trimming sections I'm not responding to and making note of elisions only where I think it important to.) ... >The company offering to license Mixmaster is Phoenix DataNet, a Houston >area ISP. John Perry, a person well known to this list and the remailer >community in general, is a Senior Systems Administrator at Phoenix. > >On Thursday I received a call from John. Some others at Phoenix had just >noticed a Mixmaster remailer he had been running on one of their machines. >Phoenix has several large corporate customers who need secure transactions >for some special applications. The core engine of Mixmaster is well suited >to that purpose. They offered to license the code from me to use as the >framework on which to build these other programs. In the process they will >rewrite many basic functions in Mixmaster that need major overhaul (e.g., >key management). We will incorporate those improvements back into >Mixmaster. This should lead to porting Mixmaster to several other >platforms, and to fixing most of my worst coding atrocities. First, I think it generally a Good Thing that remailer software gets commercialized and cleaned-up, or that at least commercial packages exist. (I'm not going to get into commercial vs. non-commercial and Microsoft vs. Gnu issues.) If Lance makes a bunch of money off this, more power to him. However, this commercialization raises some interesting issues. Others have dealt with various concerns about the code integrity, about features added, and even about TLA access. I'll address some liability and legal issues. * Will Phoenix DataNet be making the mix software available for purchase, or are they funding _internal development_? (That is, mixes for their corporate clients, which raises some interesting issues in and of itself, as discussed below.) * If Phoenix is planning to resell Mixmaster, or whatever they call it (as "Mixmaster" may remain a trademark of the appliance company which originated the name), what will be their liability for the various abuses which are likely to occur? None of the existing remailers/mixes has had "corporate" backing, and the "deep pockets" corporations are often presumed to have, so lawsuits have not gone after corporations. * On the other hand, if Phoenix is primarily aiming at internal use, for specified corporate customers, how will they stop others from using the service? If chaining is used, and absent any special "untraceable postage tokens" they might issue (as one way to control access), how will the Nth mix in a chain of M mixes "know" whether an incoming message can be remailed or not? (Schemes to sign the packets obviously flunk the anonymity test.) There are many other interesting issues which crop up when Giant Corporation begins to deploy and use remailers. What if, for example, the Justice Department claims that Phoenix and its customers are using remailers for price fixing and collusion? (Just to be clear on this, I personally have no problems with such collusion....but the Antitrust people see things differently.) (To be sure, telephones can and of course have been used to collude. Partly, wiretaps help here (until voice encryption happens...). But Justice has gone after airline reservation computer systems which they believe were used to "signal" price information. Imagine how overjoyed they'll be to see Phoenix DataNet deploy their system!) Again, don't confuse my arguing points here with any kind of advocacy of the Justice Department/Antitrust Division position. I'm only trying to think out what some of the legal issues will be that face the first U.S.-domiciled company to actually start selling remailers or to set up a remailer network for customers. Interesting times ahead. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: "Hackers"-- brief review and anecdote...
by blancw＠accessone.com 17 Dec '03

17 Dec '03

From: Ray Arachelian And that's where we, the cypherpunks come in, by advocating strong cryptographic protocols and tools, we can keep every machine safe from intrusion; it's not just Uncle Sam's evil minions that should have total privacy; normal citizens need privacy too - the spooks shouldn't be the only ones with it. :-) This message has been brought to you by the Cypherpunks. Use only Cypherpunks brand software ;-D ................................................ Cypherpunk crypto in every computer in every home. <g> .. Blanc

1 0

Intellectual Property and Crypto collision
by John Gilmore 17 Dec '03

17 Dec '03

> ELECTRONIC MEDIA PROTECTED UNDER COPYRIGHT LAW > A presidential task force has recommended that electronic transmission of > books, magazine articles and software should be classified as copies > subject to existing copyright laws. The task force also recommended that > it should be illegal to make or distribute products aimed at decoding > encrypted software without the consent of the copyright owner. Would this make it illegal to produce tools for decrypting key-escrowed software? :-) John

1 0