December 2003 - cypherpunks-legacy

test
by Anonymous User 17 Dec '03

17 Dec '03

this is a test of the cypherpunk w3 anonymous remailer interface. author is N..... B...

1 0

anonymous remailer
by Fred Nix 17 Dec '03

17 Dec '03

Hey... How do I gain acess to the remailer? Thanks! Fred Nix

2 1

Re: More FUD from First Virtual
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"frissell(a)panix.com" "Duncan Frissell" 8-DEC-1995 16:15:52.58 At 02:52 PM 12/8/95 -0500, Jon Cooper wrote: > The US government can stop it. It is irrelevant what *should* stop >it, but it's extremely useful to note that the US government's political >climate of paranoia and FUD in general will certainly not allow truly >anonymous cash systems inside of our country in the forseeable future. But who's going to ask? If an anonymous payment system springs up outside the US, we can use it as a store of value if nothing else or for shopping overseas. Domestically, we can convert non-anonymous payment systems into semi-anonymous ones. What counts is difficulty of transaction and market demand not legal structure. Thus, about five minutes after the "temporary VISA card" travelers check substitutes are issued, I can start selling them for (discounted) cash to all comers. Likewise Ecash laundry servers letting anonymous people use non-anonymous Ecash. It remains to be seen how much customers value anonymity. There should be a niche market in any case. ---------------------- I would also add that what one is doing when trading digital cash is bartering for information. While the government has been successful in placing limits on point-based bartering systems such as recordkeeping and taxes, the lack of central books will make it quite hard to do so for digital cash. Trying to outlaw barter arrangements, when what is being bartered is an apparantly random string of numbers, is quite simply not going to work. -Allen

1 0

Re: The Elevator Problem
by Daniel Miskell 17 Dec '03

17 Dec '03

There is an easy way to develop a secret key in front any number of eves, be they experts or not, without the eves knowing what the key is. Even if they tap your phone/comm line, ect. There was an article in Discovery Magazine a couple of years ago, talking about how to use photons and their randomness as the perfect, uncrackable code. Use of the photons aside, there was a key generation method discussed, simple, yet secure enough to work out on a tapped phone. Let me root around. Regards, Munster. --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________

2 1

Re: Still more on the Digicash protocol
by daw＠lagos.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.3.89.9512081312.A23124-0100000(a)unicorn.com>, Rev. Mark Grant <mark(a)unicorn.com> wrote: > > Exactly.. once you have an active attack set up, it's trivial, but setting > that up is quite hard. > But before everyone pats themselves on the back, congratulating themselves on how hard an active attack is to set up, look at http://www.EnGarde.com/software/ipwatcher/ Yes, folks, a commercial program which mounts an active attack. (Check out the GUI! Click on the `Watch Mail' control! Activate the `Take over' button! Whee, mom, hacking is fun!) Active attacks may not be trivial, but they aren't exactly rocket science, either -- and they're for sale. - -- Dave `is capitalism the best thing since sliced bread, or what?' Wagner - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMqY/ioZzwIn1bdtAQEkGQF/WdJBqbP5HwTDxldi0UDCmP2RZAFz5p2q cPMSoOIgkFbaBS34k4LSFPKcvegw3tJk =Ptyf -----END PGP SIGNATURE-----

1 0

Whew!
by Ed Carp 17 Dec '03

17 Dec '03

I just finished leafing through Schneier's "Applied Cryptography", second edition. Lots of new stuff, good and very thorough coverage of protocols and implementations, including weaknesses and processes behind same. If an idiot like me can understand this stuff (and if you don't believe I'm an idiot, just ask Perry), anyone can. I highly recommend the book, it's an absolute bargain at $50 USD. Should be required reading for anyone before being allowed to post here. :)

1 0

Re: More FUD from First Virtual
by Ed Carp 17 Dec '03

17 Dec '03

> From: Adam Shostack <adam(a)homeport.org> > Subject: Re: More FUD from First Virtual > To: jimbell(a)pacifier.com (jim bell) > Date: Sat, 9 Dec 1995 16:51:58 -0500 (EST) > Cc: cypherpunks(a)toad.com > jim bell wrote: > > [Good points about cost of transactions deleted] > > | The answer, I think, it that there would be no problem finding people to > | take that risk in exchange for the return, ESPECIALLY if they have some > | input into the design (level of security) of the system. They might insist > | on 2048-bit RSA keys, instead of 1024-bit, for example. > > (I know its only an example, but...) > > Key length is not what is needed for better security; more > solid code and better interfaces are needed. (I might also argue for > hardware keys that are more difficult to steal..) Nonsense. The code is pretty solid, the interfaces aren't very difficult. What is needed is better human management of keys. Why brute-force, why look for weak keys, why bother calculating how much safer 2047-bit keys are rather than 1024-bit keys when someone can look on your HD and find your secret key, when they can open your desk drawer and find your pass phrase or password, when they can guess that you used your wife's maiden name as your password? Adam, I don't understand why you wrote nonsense in the first paragraph, then followed it up with textbook attacks such as: > Cryptosystems fail because of bad storage of keys, coding > mistakes, accidentally writing passphrases to disk during a swap, etc. > Moving to 2048 bit keys is no help if you lose the key to a > non-cryptanalytic attack. Moving to keys with a week or day lifetimes > might be better. Moving the systems which automatically issue key revocation certificates, and coupling that with a wide distribution system would be the perfect match to such a scheme. Of course, that means that PGP et. al. needs to be more tightly integrated into existing mail software.

2 1

Re: GAK and self-incrimination?
by Greg Broiles 17 Dec '03

17 Dec '03

Tim May writes: >Consider this hypo: I send an encrypted message to a partner in crime >containing plans for future crimes and descriptions of past crimes. I don't >GAK the message. The government prosecutes me under the Anti-Terrorism and >Child Protection Act of 1997. > >My defense? That GAKKing the message would be tantamount to incriminating >myself, which the Fifth Amendment protects me against. The Fifth protects you against *compelled* self-incrimination - in particular, the right to be free from the "cruel trilemma" of o conviction of a substantive crime, based on your (true) testimony o conviction of perjury, for lying when asked to incriminate yourself o contempt of court sanctions, for refusing to answer but your hypo doesn't seem to create that forbidden situation. In particular, you're free to simply not send the message at all. (this message, sent from my Windows box, isn't PGP signed. Doh. signatures will return when the Unix box is net-functional again.) -- "The anchored mind screwed into me by the psycho- Greg Broiles lubricious thrust of heaven is the one that thinks every temptation, every desire, every inhibition." greg(a)goldenbear.com -- Antonin Artaud gbroiles(a)darkwing.uoregon.edu

1 0

Re: Warning about Pegasus Mail and PGP (fwd)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 9 Dec 95 at 21:43, Jeff Hupp wrote: > On 9 Dec 95 at 18:29, Siberia wrote: > : Okay, here's how I understand things with PGP and Pegasus. > : You have two options with Pegasus depending on the set-up > : options you choose. You can either send upon completion of > : your out-going email, or you can have your mail queued > : until you press the send out-going mail button. The actual > : PGP process does not occur until you actually send the > : mail. So the answer would be: don't queue your mail. > That's not really a solution in the Windows environment, if > you have a swap file, you never know what gets written out > to it. The solution is run w/o a swap file or run an > encrypted file system. I run an encrypted file system. Oh, PLEASE! Do you HAVE to go and mix up two completely different issues? Aren't the nontechnical people trying to follow these things likely to be confused enough without your adding to that confusion? For every person who really understands the technical issues there are probably a thousand or ten thousand who are just trying to *use* the stuff without stepping into a deep hole. An OS swap file is one kind of hole. What Siberia is writing about is ANOTHER type of hole. If I wipe my swap file after each use of my machine and don't know that Pegasus is doing this, or think that because of what you wrote I'm no worse off, I've been done a serious disservice. > Pegasus will indeed save your key with your message in the > outgoing queue. This is a problem with the design of > pegasus, not with the design of the add on encryptor. How about saying something USEFUL, like yes or no to the question of whether sending WITHOUT queueing will make any difference? How about agreeing that if David Harris hopes to provide a useful interface to external "encryptors" he will have to do something about this? How about cc'ing David? Somebody else could as well point out that we're all full of crap because we don't use Amigas, and while he might have a point, it wouldn't be a very useful one. We Jurgar Din (that will have to suffice: I do not yet live in a free country) +"The battle, Sir, is not to the strong alone. It is to the+ +vigilant, the active, the brave. Besides, Sir, we have no + +election. If we were base enough to desire it, it is now + +too late to retire from the contest." -Patrick Henry 1775 + -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMMq8MUjw99YhtpnhAQHA2wIAo72mzD7yNYy2btraeMg92hkekW/ik/hR SILC97a/gTGtZJiHV0MLcGETgZL51kFPQ3pRx+BGZl5g8JdRAQ2ZpQ== =gOtF -----END PGP SIGNATURE-----

1 0

Re: Warning about Pegasus Mail and PGP (fwd)
by Jeff Hupp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 10 Dec 95 at 12:30, Anonymous wrote: : On 9 Dec 95 at 21:43, Jeff Hupp wrote: : : > On 9 Dec 95 at 18:29, Siberia wrote: : : > : Okay, here's how I understand things with PGP and Pegasus. : > : You have two options with Pegasus depending on the set-up : > : options you choose. You can either send upon completion of : > : your out-going email, or you can have your mail queued : > : until you press the send out-going mail button. The actual : > : PGP process does not occur until you actually send the : > : mail. So the answer would be: don't queue your mail. : : > That's not really a solution in the Windows environment, if : > you have a swap file, you never know what gets written out : > to it. The solution is run w/o a swap file or run an : > encrypted file system. I run an encrypted file system. : : Oh, PLEASE! Do you HAVE to go and mix up two completely : different issues? Aren't the nontechnical people trying to : follow these things likely to be confused enough without your : adding to that confusion? For every person who really : understands the technical issues there are probably a thousand : or ten thousand who are just trying to *use* the stuff without : stepping into a deep hole. : : An OS swap file is one kind of hole. What Siberia is writing : about is ANOTHER type of hole. If I wipe my swap file after : each use of my machine and don't know that Pegasus is doing : this, or think that because of what you wrote I'm no worse off, : I've been done a serious disservice.] So, I shouldn't take the opportunity to tell those non-technical people about the other "hole" they most likely have? After all this only effects Windows users and it is a problem with windows. Read what I wrote, I did not say the original post was in error about not queuing mail and saw no reason to repeat what appears to be a fact. And, if the non technical people don't know about the swap file problem, and just assume that if they don't queue mail they are no worse off then they have been don a serious disservice. BTY, did you check it out? Or just take what you saw as an opportunity to rant? : : > Pegasus will indeed save your key with your message in the : > outgoing queue. This is a problem with the design of : > pegasus, not with the design of the add on encryptor. : : How about saying something USEFUL, like yes or no to the : question of whether sending WITHOUT queueing will make any : difference? How about agreeing that if David Harris hopes to : provide a useful interface to external "encryptors" he will : have to do something about this? How about cc'ing David? : : Somebody else could as well point out that we're all full of : crap because we don't use Amigas, and while he might have a : point, it wouldn't be a very useful one. : Yes, it would have been a WONDERFUL opportunity to drop a O/S v. O/S troll on the list, notice I didn't. What I did do, was write up a problem description and mail it to David Harris. This based on the likelyhood that he doesn't read cypherpunks. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMMrgqTUjeCeeebC9AQG3gwf/VdD9J/KJ1Tau3/L8BLoZ1v6ACAc93zcP 4F1MDoeX7EMSjWqGFZvsh0ev9hgciXvId9lu7tfMqIXQdolHzjXiyPXaw3qEa1Id A80j+Z7OKB9RSz9LKHQqjrrqpANDbJ16LIztYW5r9YjMSntWX9OF7MzeZ0BJRYc4 d1oWnhHqnF6K9rX2XWDveXyQJgCnu2sZw6nNXi0V61OdhBc/QmPsjBp+u7aig+i8 vdC7EJh2znKsNqlQqiJmHnfTbGuoVZGQkc/71hpD2reLzcU7W/NQwM7rL4PFGyDg QA15LXcfKsp6p0JCdZc+bvUfpH5mQQFWm4kd6sY7knjO3fKuTc7jpg== =Li0A -----END PGP SIGNATURE----- -- JHupp(a)gensys.com |For PGP Public Key: http://gensys.com |finger jhupp(a)gensys.com A generation which ignores history has no past - and no future.

1 0