December 2003 - cypherpunks-legacy

Re: netscape's response
by Jeff Weinstein 17 Dec '03

17 Dec '03

On Sep 20, 5:16pm, David_A Wagner wrote: > Subject: Re: netscape's response > In article <9509200139.ZM206@tofuhut> you write: > > On Sep 20, 12:29am, Christian Wettergren wrote: > > > One wild idea that I just got was to have servers and clients exchange > > > random numbers (not seeds of course), in a kind of chaining way. Since > > > most viewers connect to a number of servers, and all servers are > > > connected to by many clients, they would mix "randomness sources" with > > > each other, making it impossible to observe the local environment > > > only. And the random values would of course be encrypted under the > > > session key, making it impossible to "watch the wire". > > > > Wow, this is a great idea!! > > Are you quite sure this is a good idea? > > I'd be very scared of it. In particular, it opens up the chance for > adversaries to feed you specially chosen numbers to pollute your seeds. What I should have said is that its a very interesting idea. Given current perceptions of netscape, I should have made clear that I wouldn't do something like this without getting a lot more discussion and review of possible dangers and how to avoid them. I certainly can't fault anyone for wondering if we would just implement this without thinking it through, given recent events. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

RE: AN OPPORTUNITY NOT TO BE MISSED
by tcmay＠got.net 17 Dec '03

17 Dec '03

Date: Wed, 13 Sep 1995 19:25:24 -0700 To: cypherpunks(a)toad.com From: tcmay(a)got.net (Timothy C. May) Subject: Re: An opportunity not to be missed At 1:57 AM 9/14/95, Bill Stewart wrote: >Is Wavy Gravy running his "Nobody for President" campaign again this time? >After all, Nobody's going to balance the budget, and Nobody's going to >get the government out of your bedroom, and on the internet, Nobody can tell >if you're a dog or not :-) Or to update it for today: "Nobody(a)remailer.org for President." --Tim ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord ?"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"cracker"} = "<remailer(a)anon.efga.org> cpunk mix remix pgp hash ksub esub latent cut ek reord post"; $remailer{'redneck'} = '<config(a)anon.efga.org> newnym pgp'; $remailer{"bureau42"} = "<remailer(a)bureau42.ml.org> cpunk mix pgp ksub hash latent cut ek"; $remailer{"neva"} = "<remailer(a)neva.org> cpunk pgp pgponly hash cut ksub ?"; $remailer{"lcs"} = "<mix(a)anon.lcs.mit.edu> mix"; $remailer{"medusa"} = "<medusa(a)weasel.owl.de> mix middle" $remailer{"McCain"} = "<mccain(a)notatla.demon.co.uk> mix middle"; $remailer{"valdeez"} = "<valdeez(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"arrid"} = "<arrid(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"hera"} = "<goddesshera(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"htuttle"} = "<h_tuttle(a)rigel.cyberpass.net> cpunk pgp hash latent cut post ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix reno winsock) (weasel squirrel medusa) (cracker redneck) (nym lcs) (valdeez arrid hera) The remailer list here has been out of date for some time, but should be up to date now. I'm still working on updating the web page. Last update: Mon 8 Sep 97 6:48:45 PDT remailer email address history latency uptime ----------------------------------------------------------------------- nym config(a)nym.alias.net ####**+#-## 7:03 99.95% hera goddesshera(a)juno.com ----_.---.. 14:56:18 99.95% cyber alias(a)alias.cyberpass.net *+*****++**+ 11:30 99.93% squirrel mix(a)squirrel.owl.de ----------- 3:17:57 99.83% valdeez valdeez(a)juno.com -__.-*+*-.- 7:50:19 99.81% winsock winsock(a)rigel.cyberpass.net -----_..---* 10:10:24 99.81% bureau42 remailer(a)bureau42.ml.org ..--------- 3:33:37 99.31% arrid arrid(a)juno.com -- -------- 7:27:32 99.15% neva remailer(a)neva.org -+*#+*--* # 25:21 98.45% jam remailer(a)cypherpunks.ca + ++++++ 39:06 97.23% cracker remailer(a)anon.efga.org + +++ +++ 28:43 97.10% replay remailer(a)replay.com +**-++ +** 9:49 96.75% redneck config(a)anon.efga.org -*+* ++# 10:58 96.60% reno middleman(a)cyberpass.net ++..+ * -- 2:32:31 84.34% mix mixmaster(a)remail.obscura.com **+*++*+ 1:14:29 58.44% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Spam of c'punks list: cleaning it up now.
by John Gilmore 17 Dec '03

17 Dec '03

Somebody, apparently at ci.diamond-bar.ca.us, has been feeding the last month's worth of Cypherpunks postings back to the Cypherpunks list. You probably saw a few of them. They are still coming in to toad.com. When I got home this afternoon, the load average had hit 150 and most of them were copies of sendmail. This prevented most of the messages from getting out to you, happily. I've cleaned up the ones I found in the queues, and I'll start working next on getting the *valid* cypherpunks messages flowing again... John Gilmore

1 0

Re: MIME
by shields＠tembel.org 17 Dec '03

17 Dec '03

> >I think that it must be the content-type that is causing problems, > > Yes, I agree. Make it something like ASCII text But it's not text/plain. It's PGP'ed text/plain. The only way to indicate this in MIME is with a content-type. (Yes, they're working on a general way to encapsulate encryption.) Fine, I'll just leave mail to the list unsigned. -- Shields.

1 0

Re: Please send me SSL problems...
by herbs＠interlog.com 17 Dec '03

17 Dec '03

At 18:18 1995.09.20 -0400, Ian Goldberg wrote: >In article <199509201004.DAA23933(a)ammodump.mcom.com>, >Jeff Weinstein <jsw(a)netscape.com> wrote: >> >> I'd just like to let all cypherpunks know that I'm really interested in >>getting any feedback you might have about security problems with Netscape >>products. I'm particularly interested in bugs in the our implementation >>of SSL, and problems in the protocol that are not addressed in SSL 3.0. > >Well, if you'd release Netscape source, we could check its >implementation... :-) > > - Ian Mmm... sounds like they want some free consulting. :-) (BTW, Ian, you're at UofW? I thought your original 'discovery' email of three days ago had a berkeley.edu address on it... anyway, if you are a UofW'er, hello from a fellow Waterloo math/cs grad!) Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

1 0

CDT Policy Post 3.13 - New FBI Crypto Bill To Force Key Recovery
by Jonah Seiger 17 Dec '03

17 Dec '03

------------------------------------------------------------------------------ _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 3, Number 13 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 3, Number 13 September 8, 1997 CONTENTS: (1) New FBI Draft Crypto Bill Would Force Mandatory Key Recovery (2) Text of FBI Proposal (3) What You Can Do (4) How to Subscribe/Unsubscribe (5) About CDT, contacting us ** This document may be redistributed freely with this banner intact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ** This document looks best when viewed in COURIER font ** _____________________________________________________________________________ (1) NEW FBI DRAFT ENCRYPTION LEGISLATION WOULD IMPOSE MANDATORY KEY RECOVERY In its most audacious crypto proposal yet, the FBI is circulating on Capitol Hill legislation to impose full domestic controls on the manufacture and use of encryption. The FBI is seeking support for its proposal among two crucial House Committees preparing to consider encryption legislation this week. The text of the key section of the FBI draft is attached below. The FBI draft would take two extraordinary steps. It would prohibit the manufacture, sale, import or distribution within the United States of any encryption product unless it contains a feature that would create a spare key or some other trap door allowing "immediate" decryption of any user's messages or files without the user's knowledge. In addition, it would require all network service providers that offer encryption products or services to their customers to ensure that all messages using such encryption can be immediately decrypted without the knowledge of the customer. This would apply to telephone companies and to online service providers such as America Online and Prodigy. In the FBI draft, the "key recovery capability" could be activated by the purchaser or end user. But requiring that such a capability be installed in all domestic communications networks and encryption products would be the critical step in enabling a national surveillance infrastructure. The proposal requires the Attorney General to set standards for what are and are not acceptable encryption products. The proposal's requirement of "immediate" decryption would seem to seriously limit the options available to encryption manufacturers seeking approval of their products. While export of encryption products from the United States has long been restricted, there have never been controls on the manufacture, distribution, or use of encryption within the United States. Pending before the House Intelligence and National Security Committees is the Security and Freedom through Encryption Act (SAFE, HR 695), sponsored by Rep. Goodlatte (R-VA), which would lift current export controls on encryption technology. The Goodlatte bill has already been reported favorably by the House Judiciary and International Relations Committees. The House National Security Committee is scheduled to consider HR 695 on Tuesday, September 9. The House Intelligence Committee has scheduled its vote for September 11. Members of both committees are expected to consider the FBI draft as a substitute to the SAFE bill. This FBI proposal represents a major turn-around for the Clinton Administration, which has denied since its first year that it was seeking domestic controls on encryption. The FBI proposal is an attempted end run around the Constitution. By creating an avenue for immediate access to sensitive decryption keys without the knowledge of the user, the proposal denies users the notice that is a central element of the Fourth Amendment protection against unreasonable searches and seizures. Just this past April, the Supreme Court reaffirmed that the Fourth Amendment normally requires the government to advise the target of a search and seizure that the search is being conducted. Forcing U.S. citizens and companies to adopt so-called key recovery systems poses serious security risks, especially when the systems can be accessed without the knowledge of the users. A recent study by 11 cryptography and computer security experts concluded that such key recovery systems would be costly and ultimately insecure (see http://www.crypto.com/key_study) CDT executive director Jerry Berman said of the latest proposal, "This is not the first step towards the surveillance society. It *is* the surveillance society." ______________________________________________________________________________ (2) TEXT OF MANDATORY KEY RECOVERY SECTION OF FBI DRAFT LEGISLATION (From FBI "Technical Assistance Draft" Dated August 28, 1997) SEC. 105. PUBLIC ENCRYPTION PRODUCTS AND SERVICES (a) As of January 1, 1999, public network service providers offering encryption products or encryption services shall ensure that such products or services enable the immediate decryption of communications or electronic information encrypted by such products or services on the public network, upon receipt of a court order, warrant, or certification, pursuant to section 106, without the knowledge or cooperation of the person using such encryption products or services. (b) As of January 1, 1999, it shall be unlawful for any person to manufacture for sale or distribution within the U.S., distribute within the U.S., sell within the U.S., or import into the U.S. any product that can be used to encrypt communications or electronic information, unless that product - (1) includes features, such as key recovery, trusted third party compatibility or other means, that (A) permit immediate decryption upon receipt of decryption information by an authorized party without the knowledge or cooperation of the person using such encryption product; and (B) is either enabled at the time of manufacture, distribution, sale, or import, or may be enabled by the purchaser or end user; or (2) can be used only on systems or networks that include features, such as key recovery, trusted third party compatibility or other means, that permit immediate decryption by an authorized party without the knowledge or cooperation of the person using such encryption product. (c) (1) Within 180 days of the enactment of this Act, the Attorney General shall publish in the Federal Register functional criteria for complying with the decryption requirements set forth in this section. (2) Within 180 days of the enactment of this Act, the Attorney General shall promulgate procedures by which data network service providers and encryption product manufacturers, sellers, re-sellers, distributors, and importers may obtain advisory opinions as to whether a decryption method will meet the requirements of this section. (3) Nothing in this Act or any other law shall be construed as requiring the implementation of any particular decryption method in order to satisfy the requirements of paragraphs (a) or (b) of this section. ______________________________________________________________________________ (3) WHAT YOU CAN I DO TO HELP? Are you concerned about protecting privacy and security in the information age? Curious what your Member of Congress thinks about the issue? Adopt Your Legislator! Visit http://www.crypto.com/adopt for details You will recieve customized alerts with news you can use, inlcuding the latest information on internet-related issues, the views of your Representative and Senators, and contact information to help you ensure your voice is heard in the ongoing debate over the future of the Information Age. Visit http://www.cdt.org/crypto or http://www.crypto.com/ for detailed background information on the encryption policy reform debate, including the text of various legislative proposals, analysis, and other information. _____________________________________________________________________________ (4) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by more than 13,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts _____________________________________________________________________________ (5) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ---------------------------------------------------------------------------- End Policy Post 3.13 09/08/97 ----------------------------------------------------------------------------

1 0

I see the Wells Fargo Wagon it's a-comin down...
by Damaged Justice 17 Dec '03

17 Dec '03

EU official proposes global Internet charter Copyright © 1997 Nando.net Copyright © 1997 Reuter Information Service BRUSSELS, Belgium (September 8, 1997 11:21 a.m. EDT) - The top telecommunications official of the European Union called Monday for an international charter to regulate the Internet and other electronic networks. EU Commissioner Martin Bangemann, in a speech prepared for a telecommunications conference in Geneva, said the charter should deal with questions such as technical standards, illegal content, licenses, encryption and data privacy. "The current situation may lead to the adoption of isolated global rules with different countries signing up to different rules agreed under the auspices of different international organizations," the German commissioner said. "An international charter would provide a suitable answer." The text of the speech was distributed in Brussels. Bangemann said industry should lead the effort to draw up a charter, which would be based mostly on self-regulation and mutual recognition of national licenses. "Its role would not be to impose detailed rules, except in particular circumstances (child pornography, terrorist networks)," he said. The charter would recognize existing pacts negotiated within the World Trade Organization and World Intellectual Property Organization and draw on principles agreed by other bodies such as the Group of Seven top industrial countries, he said.

1 0

Re: USA Today on Fear of Credit Cards over Net
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- <snip> > How much do PC users trust: > > Automatic teller machines 77% > Banking by phone 62% > Banking by computer 57% > Using a credit card or calling > card at a public phone 57% > Writing a credit-card number on > a catalog order form 43% > Sending a credit-card number to > a commercial on-line service 34% > Giving a credit-card number > over the phone 31% > Sending a credit-card number > over the Internet 5% > > (margin of error = +/- 4.7%) <snip> Pity they didn't ask about, "Tossing a credit card slip/carbon in the garbage." Dumpster-diving is still an effective, lo-tech attack. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMGAxQW1lp8bpvW01AQEfmwP9GfEzhoBWuTNHvxZ7dMvMV7K/cypT0XmO kLqAAtPHyhS3PxmwNiT0G4tquU9QHw2cQ5Rj6IAqR7Fbuvtt1TW2Kora9RsXLp5L 75Zw63/wrsnI20qe+Pnf6FEG0IcjLg4vrezhAGYAC3zSdTpSW4cuqdzId6qeTlvM 4gg2Z9UGOrA= =ReYK -----END PGP SIGNATURE----- Regards, Jim Ray "Not everything that is faced can be changed, but nothing can be changed until it is faced." -- James Baldwin ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James Milton Ray <liberty(a)gate.net> ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

3 2

Re: EMP & Cars (fwd)
by Peter Trei 17 Dec '03

17 Dec '03

> From: Jim Choate <ravage(a)ssz.com> > Forwarded message: > > > Date: Fri, 5 Sep 1997 11:48:08 -0400 (EDT) > > From: Ray Arachelian <sunder(a)brainlink.com> > > Subject: EMP & Cars (fwd) > > > There has been quite an interest in EMP. > > > pulses to a near miss lightning strike. As far as vehicle disabling, There > > are claims that auto manufactures have built in a shut down frequency into > > the computers in certain vehicles. We wound a large coil on a carpet paper > > tube and put an oscillator on it and it would flood a vehicles electrical > > system to shut it down, but it was huge. > > Mind being a little more specific?... [...] > > The easiest way to learn about > > EMP is to find the International TESLA society web site and interpret the > > information there. > > Some of the best sources are ECM & EECM texts/sites. > > While it is a good source of technical info it does take a bull-shit > detector set to full to sift through all the other detritis the ITS wallows > in. Space aliens, hollow earth, over-unity power, etc. Ham radio operators have been dealing with this issue for years. There's a lot of (mostly anectodotal) stories of mobile operators keying up their rigs and having either their own or neighbouring cars misfiring or dieing. Shielded ignition cables seem to fix things (though they are actually bought to prevent ignition noise from getting into the radio, not the other way around). Ham operators can use *much* more powerful transmitters than CB or cell phones - my own transceiver puts out 50 watts, but some go a lot higher. It's fairly common for hams to 'test' a prospective car purchase by waving an HT over the engine while transmitting, to see if it has a problem. I suspect that it would be quite possible to build an EMP gun to kill most running cars, but it would also kill anyone with a pacemaker. I'm more worried about the current trend towards placing remotely controlled electronics in cars. Already, one US manufacturer offers as an option a satellite reciever which (among other things) can unlock the car remotely if you lock it in the car accidentally. I have no idea how much authentication is required for such a request, but I'm sure car theives are looking into it. To defend against this, I expect next years model will also allow the car to be turned off by remote control, or turn on a tracking device. The popular 'Lojak' car tracking system has similar civil liberties issues. I understand that the car owner has no control over it's activation, can't disable it, and there is no indication that it is in operation.Apparently all the "authorities" need to turn it on is the VIN. Peter Trei N1MNV

2 1