December 2003 - cypherpunks-legacy

!!! DEATH THREAT !!!
by HugeCajones Remailer 17 Dec '03

17 Dec '03

You should be careful before you do foolish things like making a death threat because it can have really bad results. It can make people really nervous and think maybe they should get you first. Sometimes they hire other people to get you before you get themreally bad people sometimes. Sometimes even bad people who act like they are good people and fool everyone until they kill you. Which brings me to the point I am trying to make: You should not try to kill the Constitution any more because there is not enough left to make people safe and they might get really nervous and think maybe they should get you firstor even after. For revenge. People like the Constitution a lot and if you are making a death threat against it then it is like saying your going to kill someone elses friend or family and everyone knows that they will kill you because they are domestic and not a stranger. Or is it that they are stranger and not domesticated? Never mind. You know what I mean. Especially if you try to make it so that they cannot put aluminum foil hats on their thoughts and their words and their writing. Then they get really, really, nervous and maybe start thinking that they have to kill everybody because they are not safe from anybody. You should be careful if you find yourself walking next to someone whistling that Crosby Stills & Nash song "If you cant kill the one you lovethen kill the one youre with." (ç Thats a joke but it would be really funny if you took it serious and whacked someone out for whistling it anyway.) (Its not like they have a Constitutional right to whistle it or anything....hee, hee.) You should be careful before you vote to kill the Constitution and look under all your chairs and stuff, just in case. You should maybe look in your conscience too and see if you are not a bad person maybe. You should also maybe look in a mirror and make sure you are not cross eyed and that there is nobody beside you whistling that song "If looks could killthen you would only be hurting yourself."(<== that's a joke.) Even if you do think you can kill the Constitution and still have all of the people believe you are not a bad person then you should at least try not to let really stupid people who you work with say things like "I am too stupid to learn about this stuff so I am going to let the guys who want to make aluminum foil hats illegal and put everyone in jail decide how I vote to kill the Constitution." The one those guys who always say "Nuke DC" call Swinestein said that and it made everyone think you are all that stupid and going to let people with guns who kill women and children make your votes for you. Then even more of them say "Nuke DC" especially when they remember how bad the guys with the guns that you are letting vote for you fucked their friend (sorry but thats what they did) for making a stink with the IRS. That is really all I am trying to say. Is that you should be careful that you dont kill so much of the Constitution and let the guys with the guns screw so many people that nobody feels safe from them anymore because they wont just get nervous about them they will get nervous about you too because you promised to protect them and didnt. Just try to remember that it never ends. If you take away some of the guns from people then you have to take away all the guns or you are in big trouble. If you take away some of the Constitution from people then you have to take away all of the Constitution or you are in big trouble. Even if you think you took away all of the things that people can use to be safe and free then they will make morelike Doritos. If you try to kill them with bullshit then they will try to kill you with their own brand of fertilizer. If you take away their aluminum foil hats then they will make hats out of paper and call them Forever Young. Killing the Constitution is a lot like killing DCif your going to do it then you might as well do it right and do it all at once. Guys with guns who want to kill Freeh-dumb know that and so do guys with nukes who are Freeh-dumb fighters. (My uncle made up a new word about himhe said he "testiLies to Congress.") Dont be a stranger, APlayerToBeNamedLater p.s - If you see Declan McCullagh getting in his car and driving like hell away from the city then you should get in your car and do the same thing. You dont need to pack a suitcase because I think if he does that then there is already one packed. (Thats what the guys with guns told you in your secret meetings so you will kill the Constitution for them isnt it?) p.p.s.- If you hear someone say "President Freeh" then do not wait for Declan just get the hell out of there real fast anyway. You can come to my place if you want and help me send out secret aluminum foil hats. (Bring a whoopee cushion and we will make little funny booms instead of big scary ones. We are a little more laid back out here in the country than you guys in the big city.)

1 0

Re: Keyed-MD5, and HTTP-NG
by baldwin 17 Dec '03

17 Dec '03

Perry, I wish that the field of cryptography was as well advanced as the field of Bridge Building. A modern Bridge Builder can design a bridge that is easy to construct and will in fact last for 100 years. Unfortunately, modern Cryptography is like Bridge Building in the late 1800s. Back then, it was possible to build bridges that did last for 100 years but lots of cities refused to pay the extra costs in materials, labor and time to make a solid bridge, and as a result the bridges did not last. To make it worse, there was no systematic teaching of the best practices, so often no one would realize that they had build and/or bought a weak bridge until the day that it fell apart. The sad result of the state of the art in Cryptography is that we end up with situations like the one you described where it takes months to get agreement among Cryptographers and then it turns out that one of the other choices would have been better. Not surprisingly, the other choices often run slower than the initial choice. However, there is little guarantee that the second choice will resist all new attacks. One of the reasons that the IPsec authenticator was analyzed was that it had been chosen as the IPsec authenticator. As soon as a large organization picks a new authenticator, the researchers will try their hand on breaking that one. In the field of Cryptographic Engineering, we just don't have a well tested construct for authenticators. If the IPsec group was run by scientists instead of engineers, then they would consider cryptographic constructs that have "provable" security properties (e.g., faking this authenticator is as hard as factoring a Blum integer (a composite number with two strong primes)). The downside of having this kind of provable security is that the packet processing time would be enormous. You would loose all the benefits of a T1 connection to the Internet in order to get provable security on your authenticator or encryptor. Speaking for myself, I am glad that the IETF is run by engineers. The vitriol you spewed is quite justified. People at RSA and IBM both agreed that the IPsec authenticator would resist all known attacks. In fact, a fully conforment IPsec implementation will still resist the new attack because IPsec requires that the all keys be changed every 2**32 packets. However, this new attack makes Cryptographers nervous. Perhaps it could be extended to work with only 2**40 chosen packets in which case there is a noticeable chance of it succeeding with only 2**32 packets. Only further research will tell. Currently, the only way to get the MD5 key is to feed in 2**60 chosen messages of various lengths. Of course, this is another good reason to use different keys for the MD5 authenticator and packet encryption. Wisely, IPsec requires different keys for the authenticator and the encryptor. I also understand your being upset about not hearing about this attack the moment it was published. Actually, as soon as RSA Labs confirmed the weakness we did call some of the editors of the IPsec specifications to let them know about it. The consensus was that this was not a show stopper. The IPsec protocols could be rolled out as is. Later, once a better authenticator had been developed and tested, it could be substituted for the existing one. One of the excellent features of the IPsec specification is that new algorithms can be substituted easily (modulo a "small matter of programming"). Perhaps your main complaint is that it took time for the attack to be confirmed by other researchers before the issue was brought to the IPsec authors. That is another effect of the current state of the art in Cryptography, and an effect of the normal academic process. It takes time to understand and confirm a weakness, and it is necessary to confirm weaknesses (researchers make mistakes in designing attacks just like they make mistakes in designing ciphers). That's the way things are in "cryptography today". I guess my conclusion is to say "Sorry". Several professional cryptographers gave it their best shot, and the authenticator turned out to be somewhat weaker than expected. --Bob ______________________________ Reply Separator _________________________________ Subject: Re: Keyed-MD5, and HTTP-NG Author: perry(a)piermont.com at INTERNET Date: 10/31/95 5:25 PM "baldwin" writes: > Simon, > There are a few different ways to add key material to MD5 to > make it suitable as a shared-secret authenticator function. Some of these > are less resistant to attacks than others. For example, the keyed MD5 > mechanism that is part of the current IPsec specifications can be > attacked using 2**60 chosen messages. Fortunately, the IPsec specs > also require that the shared MD5 key be changed every 2**32 messages, > so this attack is unlikely to succeed. Specifically, IPsec uses > MD5 as follows: X = MD5(key | keypad | Message), where "|" means > concatenation and the "keypad" pads out the key to 512 bits. > Basically, this function is the same as standard MD5 with a > different initialization vector for the compression operation > on the first block of the message. > RSA Labs recommends that a people use an authenticator like > X = MD5(key1, MD5(key2, Message)). This resists the chosen plaintext > attacks that were published at the crypto conference in Spring 1995. Pardon me. The amount of vitriol I am going to spew is probably difficult for people to understand because most folks around here weren't following the keyed MD5 discussions during the IPSEC work and have no idea of the sort of crap the professional cryptographic community put us through. We spent months, and months, and months, and months, getting advice from every cryptographer on the planet. Every conceivable combination of pads, multiple keys, keys before the text, after, before and after, etc., was discussed over and over and over again. Finally, the folks at RSA and IBM both agreed that Hugo's scheme, the one we were putting in to place, was the best possible one. (Thats the one with the padded key.) What the flying hell are you doing telling us now, and indeed not even telling the IPSEC community but instead mumbling on cypherpunks, that you guys were in possession of information BEFORE the entire discussion in midsummer that indicated that your own advice was wrong? Perry

2 1

Video as a source of randomness
by Andrew D. Isaacson 17 Dec '03

17 Dec '03

A thought just occurred to me... How useful would it be to use a video stream as a source of random input to something like /dev/random? I'm thinking along the lines of a Connectix QuickCam (sp?) or the cool videocam that comes with the Indy. It seems to me that the picture recieved by a camera sitting atop a monitor would be quite unpredictable. (relatively) High bandwith, too. Even if the entropy in a video signal is low, the high bandwidth would seem to make up for it. Struggling to keep my head above the crypto tide, andy -- Andrew Isaacson <adisaacs(a)mtu.edu> finger adisaacs(a)colossus.csl.mtu.edu Freshman/Comp Sci @ Michigan Technological University for PGP public key ========================================================================== "Hi, I'm, I'm, I'm... you'll have to forgive me, I'm terrible with names."

1 0

Re: Emphasizing a point by Donald Eastlake re key recovery
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:34 AM 9/23/97 +0100, Ross Anderson wrote: >There is also the point that the vast majority of encryption keys are >actually used for authentication rather than confidentiality. The keys >that encrypt your bank card PIN en route from the ATM to the bank, the >keys in your satellite TV decoder, the keys in your gas meter and your >postal meter - in fact the majority of all DES keys in use - are about >authentication. In theory most of them could be replaced by digital >signature mechanisms but given the size of the installed base, it >won't happen anytime soon. For what it's worth, I once got an opinion from NSA's export control office that I could use any kind of crypto I wanted (e.g., even triple-DES) if all I'm doing is protecting a channel carrying a password (like the PIN), because that's an authentication function and therefore to be encouraged. I didn't get this in writing, however, so I'd have to go for it again. - Carl -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNCkgkFQXJENzYr45AQF9EAP+Lx54AGJVvr9nOgGEaFYgMyTYFsalnPV9 3ZhqCIc6DDbjGBPf7r20SYUwz+3mhLeGLjlHleltXoT/coAChL/vSnqL0Q9/gpRI w11Sg32vFi/6Fr8fNWgEcMtmuIIZS/QSRt3hj8p0cc6UN2bjWevD97/brWhVjWYl hNdlUrgPpHw= =l1tu -----END PGP SIGNATURE----- +------------------------------------------------------------------+ |Carl M. Ellison cme(a)cybercash.com http://www.clark.net/pub/cme | |CyberCash, Inc. http://www.cybercash.com/ | |207 Grindall Street PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 | |Baltimore MD 21230-4103 T:(410) 727-4288 F:(410)727-4293 | +------------------------------------------------------------------+

1 0

Re: Win95 password caching
by llurch＠networking.stanford.edu 17 Dec '03

17 Dec '03

(A copy of this message has also been posted to the following newsgroups: csu.windows95, comp.os.ms-windows.win95.misc,comp.os.ms-windows.win95.setup,comp.security.misc,alt.security,comp.os.ms-windows.networking.misc,comp.os.ms-windows.networking.windows,comp.os.ms-windows.nt.admin.networking) [A little more context and Message-ID added from the original post; cross-posted to nt.admin because it will affect some of you, followups out] In article <4791l0$4n14(a)holly.ACNS.ColoState.EDU>, unicorn(a)holly.ACNS.ColoState.EDU (Scott McCormack) wrote: > In article <478rbq$o31(a)yuma.ACNS.ColoState.EDU>, > Jim Carlson (jimc(a)cnr.colostate.edu) wrote: > : Does anyone know how to stop Win95 from caching the windows password? > : We are thinking of using Win95 as the client for a student lab and > : need to find a way to stop it from caching passwords. As it is, when > : you log into a machine for the first time it creates a .pwl file in > : your windows directory for each person who logs into windows. This > : is not acceptible for a lab situation. > : > : I can turn this off in WfWG by placing the line "passwordcachine=no" > : in the system.ini under [NETWORK], but this does not work in Win95. > : > : I am running MS networking in Win95, so when you first log into, > : windows it asks you to log into the MS Network. It then comes up with > : a second box asking you to enter your Win95 password. You can enter > : a blank password (""), but it still creates a .pwl file and places a > : line in win.ini. > > Change the password for the login (or when you first login) to a blank > line (ie don't enter a password) and you'll never see that login prompt > again. :) This was not the question. He wants to prevent local Windows passwords from being created for network-only users. This is a serious security issue, because if a user enters her real network password for the Windows password, and someone else later picks up the .PWL files, which are not encrypted in a particularly secure way, then someone can get unauthorized access to the network as the previous user(s). We believe we have found answers in the Registry and in POLEDIT. We've also turned up another related security bug. When it's confirmed, we'll post. In the mean time, you can read the last couple messages archived at gopher://quixote.stanford.edu/1m/win95netbugs. -rich llurch(a)networking.stanford.edu moderator of the win95netbugs list http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html

2 1

CypherPunk Action Project #128
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Write a decent ISP monitoring tool and send it to all LEA's so that they don't FOOBAR my ISP and my account everytime they shit their cute little panties when I send out my !!!DEATH THREAT!!! emails to Congress (and a President to be named later). Or, in the alternative: Support GAK and VHM (Video Home Monitoring) on the condition that they let CypherPunks write the code so that we can at least keep the system functioning smoothly until they come for us. ('Old saying' of the future: "When Kent Crispin was Fuhrer, the email ran on time." )

1 0

MD5 of CFS131, hacktic
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >From: Andreas Bogk <andreas(a)artcom.de> >Please report any leakage of this software immediately to this list. >From: Mats Bergstrom <asgaard(a)sos.sll.se> >Try ftp://utopia.hacktic.nl/pub/replay/crypto/CRYPTOapps/cfs.1.3.tar.gz I diffed 1.3 that CFS that I got from att research. The package arrived to hacktic intact. I sent PGP-signed MD5 of 1.3.1 to utopia, but got this back: >From: Oliver Daudey <traveler(a)utopia.hacktic.nl> >Subject: Re: CFS 1.3.1 >Date: Mon, 30 Oct 1995 15:51:10 +0100 (MET) > >> I have done an md5 on the new cfs. (Everything after the cutmarks) >> Here it is. Hope you have it soon... >> >> 262b4c6fbec7c729e3e10292f5ea8afb cfs.1.3.1 >> >> Don > >Sorry, but I need something which is certified with the SSH distribution- >key (keyID DCB9AE01). Hmmmm ok. Well, I'll sign it again, for you Cpunks. If you get a different MD5 (this is everything AFTER the cutmarks) we can diff it. Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMJhTJcLa+QKZS485AQHsIwL/fkh8d39uW8M7Fo/slO6Rbb42j7tneqz2 wcePuYqyjGFN93IfjPI0ew1jjNqnzI+je6C0dBhk4eTjN7xAFczTqe1U6+yAKZX5 DnX2waPV/i8Pva0NB0t5lzRfCaB1OM/r =8IC6 -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://students.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Junk mail to root(a)127.0.0.1 * This user insured by the Smith, Wesson, & Zimmermann insurance company *

1 0

Re: Video as a source of randomness
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:02 AM 11/2/95, Andrew D. Isaacson wrote: >A thought just occurred to me... > >How useful would it be to use a video stream as a source of random input >to something like /dev/random? I'm thinking along the lines of a >Connectix QuickCam (sp?) or the cool videocam that comes with the Indy. >It seems to me that the picture recieved by a camera sitting atop a >monitor would be quite unpredictable. (relatively) High bandwith, too. >Even if the entropy in a video signal is low, the high bandwidth would >seem to make up for it. > >Struggling to keep my head above the crypto tide, Digitized video input, especially from something like a noisy channel (t.v. channel, for example), is quite likely to produce a lot more entropy bits per second than nearly any of us ever need. (One's PGP key could be seeded in a fraction of a millisecond, for example.) The issue is that most people don't need this number of entropy bits per second, and that most people don't have video inputs. (And those that do may not have them hooked up and ready to go.) One of the basic ideas we have had, as Cypherpunks, is to encourage widespread methods. Any methods that need special hardware tend to not get widely used. Audio, video, disk timing, and all sorts of other sources of physical randomness are useful to have, but most people either won't have the right configuration or won't configure their systems so as to use their configuration. --Tim May, who has both audio and video digitizers built into his Power Macintosh 7100av, but notes that none of the crypto programs he uses has any provision for using them, and so he doesn't use them for crypto purposes. Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Was I censored before Cypherpunks?
by gjeffers＠socketis.net 17 Dec '03

17 Dec '03

:: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.6.2 hEwDG6rHcT8LtDcBAf4v0sGjue3ZVsxWwjDhAE8fTNr/lxNfGZdCi7cUTsN0zjS1 iHIpCESOg8vnjt+J3Dv8MQ6e+AicO09nMNbUZpLupgAAC2B5a0zYlHjaqRo3ZcC8 Lha2UFdw/rcV9H9OtCHWsqEMfMzcFEdkx3qFVJ4w/pycvdSg9m7s/3y89EEOzj2f A4GecWrBNq5qZEU5GLEu+GrSVTHQe0Coeu4P8GEIRH3xwLHVig7Y6AcAgitAlGY4 FXvX6h2oln+0/3xGpzYguyTJ+zJdIA1HxhL+ZoEfgj3RZpLF4oWqYwMfykp8LAX6 9F6rAdIRVSjIHZ+/J5IF4xYAPiZYXvWVuAGoqtLmJKVaTxpMKs+rmcLmmDi8N22O FV6U6csZAKBTv/GFIjlrcoB9oVYyNwuewQgYXw8qpl83HgNMNOUV58Y2TxFPyoLk 90f6pXiEzpLbSs9uC6GHd4c43fQTkevyGROOMs6wNXiFDdr3Y5ZHxwFqqVBKAAm4 mNIcLDQk3z1tc9yt5XIKaayZvdlUiO08EDfHvMvTSdWBPMXb3cetbcyQKnR50752 ySRmkl595EaLRIWeBCK6S7JW/APTNUe4nOz++lFWHtTwHkHBRG0wM/GxSb5M88lv LEuiRDLNrOCG4gcV8BuCRnpfOBwmcCFyprhnei43SiJtNHc12FBOp2v1hcbcq0Kg ixMRbxAjQTOLnvICriDobgoom9ZC4MC92BVLbJ5hmVOMTxJkDNssAP7pHWRP8rPz te6N79N9GtSLjzDHL8SM49oglQQE5mG+hCf0xUgugbUHBP65uyTsMliYMFzOiXMw 8awLNCJqkhKB5xihDgHCS3cjV6Jm/+0U/LC7hFAnGjZlgUhnQhy8jTCrkXkizsif CN4LaZKcdaJgDo9qsfnG65zf2Qi7eZ1VcDHdAM41ebmc+iXIIUyOX6OmS0+HfvOM lGU3iH6TqPOJF1aZRps0PEvny//r0pw+Q6NC6/TPl3dp57VfAn9KO7mZ2r7OlEP3 bt0aEn5hFEEBk4apeYAjltOngfzj4wSyKA0ah294f/+UCSri1iBa0uXNhYZwxga0 oAoLteS0In3D7vsfU3kkn41gy83CfXF2/s2r/LEIkThdJK1VzFDfpr1XZbxCzO6x zcWmNIXQHVdrxAmzttJ+26gaEUJl/0tEolUpT5sJwnyvOQb71r1MpaCB2ntWg53z gUJRWATsWDhxQHx7O1thk4e2fPgRS/fscEkqaH6670gTJrjwV/2f6wdr7f+ILDmq H5bhTttkDHKbfchx7RgStTjn1slTGV5LNTS+k4eGrNR3gPdYiRR4veRhV4vkgYti W5YjlniK9eHWtw2Wp+rG2GrM2A0jP48D9DTtT6wbibo6Jmly7SgjiB7S0CJLKRFC OllLiul8HZ11CWYZ808MH06p62e7RtIe0CySon/r/R11KNaQyz2oK0NdD/GV3xO/ 08sJABgnXCzQKgsdgPppJP1IauUYZoHp2V7vzuXSr+ZCZCC/TJlIyiZ0x4XBpVT6 mzehKZzdue4wwRGkSh/ny0xrAxNA76B89nrXLXWVQ5s1oCBrimZwDncD1Mmpvd5/ jHW4vuhphlTP30QC3zkv5DJy/2i6eYh4W+xZgFkmZuFv6KT1Kk0LFjOKnGno63TZ E0pNnTmdjPwHCPO9e7y1EUbTjk2F5jNUXJ777NhZ/6itiXcR6MnQtWqEsMXL6rif orl4cB2fK0nyyUSBfVhSwtaD7/MdJZQi4WQ0yOdLlojJFggCf5taVAIIspTN7di0 OoiLOSH5SQ3AXVpJIJwJqfGyQkeaHL36fvcxICM/+4yFESv31NmaGJcuO84SvMST FHCbGKwqNI8+cXDpoTW2OB67xaVJp57StKJJgDqcBhxuyd0ghYHfgaIBocfs9XzQ VU39zY70icImOJpuuKC5gn6G+WoC/xzTWbFCejtpkKTwzJ+GPcNBgGOgp5q7KbNf f1Qd3jh8jpVEPu8WZXblyZls/kXh7e6GU/cbEA1XWRuEn50qlemwgeflHEoCq/ij I2ShFonviehiJc93r8FFa5wUvpwYD70hrNYFaWrCuE5nfkyC40izzi+9mzAV72MJ FO6MmAQxRGggM4CRAX3YRO/YYk1v9mFFtjY4kDBJvEDLnTKgCI4hwiJ5gRYYRsb4 3jbtY+KoOaZTuCkitEfd6TVqE7KFOcucefmI4CxOem4CWU/V53ermFpj9zjYyGYK QvMuXZST4dq62ud1IMfFrbl9DpYIJXthswwTRbgA74mnVkQI9gAKHYt3tTHvCItC gOGVkcYgv9Kd4sEKlYnu0LzlyOoh7CJzHnjkTuzqXBRqdxFk7F5SDe7UEY+WmLIB Uqf1w2iVaWiP1IqEDtpSwqDWhwR7gAPw2qvb0GRA9WRZZR3zaNsU6ENUhOi7sm/W awuXMKs9c0b7Co/1c2/9T6flnVEmR4Afl2smlrAsuHuCtBzolqAy7kCIL4LpNQ+1 Tgwy6RfNilNZ+ksff1ckFJ6wv9rywvH2Bq74Txvc0DfuDHReb8H1kbJkdQKXlcZF sM5mJVL7870t/QbfBb3oMKcIVfOWhXCJXxlthmS42iHdyJxH6Hl2yd7aSE/7Uabg b4NwgQHrC6voNfEBRtm2fk8cPn8L3IBJT2uDSBMb86n6+R86YcU+uEULyysVie6o W01S7ImFISmZ6wSfxM4xXSS5pKAnv82ajXWxIpDFSqWLsAr4Es/yvw2YxrL01noG BiLu4dAzyc8uNQ9WpMxSiMoK4t8G+j4dgeXuc+MR1fNY6Aopw8EFFFvAz8ENInYJ FrdY9yoF91i7Hj7lFRobpWg+Lh+jX8aNS2QhTn9U3SJxvd96HeWRy+u6BE/cQJGE Y2+P/lcxNSY9/3d+YNYzWIybZiGMXqv0taKzysz0eHxFB6wvuv4LMYcFjxwDCm4t +hZaY6Vkar4r/fX3HnJdqmaxWz/p3DA0x8nn3B0gv7udVwuH+69q2YGcQ1oxR8eV HFmzczNWTOf9juNSa1f0i/s8a1gCkhqnC/a+CM5RZsHQK0vRPxPRkFDu5I9IuWUR ZsLR6Xu9b3J6b3sySMdZl0Gvqhb3ahK12LXMPAj/Wl+xAw7Mo1P7DSxHoozGqIbI 3EiycSRHGe4hx0rZIT3VwnhnB86SM1tiDaUjIHVhbQAnVOFIMA84OLBQvVmRFQ44 TdVXBotD3lRzXGZ2utY0cb5/ll/5osL4BjJSaYUQIYFqjBfcLsExDfJHrzL0VUhK bZPjNc149Ux9Oxlscg7U57v3K08YzvN1vnZeWPnlmkdTWGDoWjvgtCx0VDQjVZlW zQHqpLZilqf9eOsuY9LqcY9lG5EzCoN9lHzI2Od/lRzAEO5q9xGurbWHDauHs1Xi W/5eNO3YOIM8I5FY5i/3AKsNizggBR/j4CLLlYK2SttgrNFsB3z0W/Akp0b3uWis sHPuYZ7aeBDswI8HTGMx5wWYqIkOBhUiMtMZbViSy8YYAO9kblT4HfbcaOWVeh4/ WRgoLtD+7u4SAbqjGZphb2JB0bGhcZzGLZfodFE/GbBX1+AIp4FxWPM0+vUBdfVL yXxNc3qfHvnS61aGWIUuOzkdt1WnO1z38itVxSEJFpoOJNWD/Rnxt1qQXCRN5vMx BmJOpxK0Np1Qoqt7sMhm8ZLTwjUg75takFm+dnFJV/yej1Qhp3igJeLVqPc9zCjY rRHSZjGgmL3t/B7yX7Z3/GNajwXiuBntP97RRg+rBNcaG8YCMKFVAp6ojuvrQWUQ Mee08dfIS7/hKlDIVvkJXmr4nlpyzAJzZ7C3IdL+D26L/LNNbjQhalkE5DA0HzKI xkJIMH4+B73/IPqoLp7syRRWvZZySUtyTz/aUrgV3i8P+Jj1+V5izy1pI8VOXcSM F9eOe+fGgtXWKJuI+y5TSkvOBSaPCTA4Jd+TTvL5mkYhLlIuQpYjGznbfyM50dxY AQEElCFPKxkr96kBEbRmdjeXBA== =7IoD -----END PGP MESSAGE-----

1 0

NAMBLA
by Boat1688＠aol.com 17 Dec '03

17 Dec '03

How do I get some of these pics of boys in swimsuits?

3 2