December 2003 - cypherpunks-legacy

Buying Digital Postage Stamps Anonymously
by tcmay＠got.net 17 Dec '03

17 Dec '03

This came up in today's Bay Area Cypherpunks meeting (a very good meeting, by the way). It also has come up in a couple of the messages here, with mention made that the stamp seller may know who is using his remailer because he has records of who he sold the stamps (= numbers) to. There are several standard solutions: 1. Two-way anonymous communication, and two-way anonymous e-cash. ("Wrappers" and all that stuff, stuff I don't here us talking about much lately...) 2. "Stamp mixes," wherein users exchange stamps bought earlier. (This still depends on trust that the seller will not have kept copies of the stamps for his own use, thus wiping out the value of one's new stamps, or that he won't keep records. Anonymity techniques in the mix could help with some of these problems.) 3. Cash purchase with message pool posting. This last one I'll spend a moment describing, as it is very easy to understand, and is robust against a lot of attacks. Alice wishes to buy 100 remailer stamps, each worth 20 cents. She places a $20 U.S. banknote and a diskette containing a public key in an ordinary paper envelope and mails it from a random mailbox to Bob. She also includes a simple phrase to make it easier for her to later find the stamps, such as "Rosebud." Bob creates the digital stamps, encrypts the list of them with the public key provided, puts the name "Rosebud" on the file, and places it on his Web page which is visited by many people daily, or, for more security, posts it to a Usenet group devoted to such things (such as alt.anonymous.messages). Alice retrieves the digital stamps by either visiting Bob's Web site, with some small amount of identity leakage possible, or reads the messages in alt.anonymous.messages (with even less chance of leakage). Or, Alice could use a Web proxy to more securely visit the site. The net result is that Alice has $20 worth of digital stamps, Bob has a $20 bill and will honor the stamps he issued, and Bob doesn't know who he sold them to. This is how easily it could be done. Digital cash is not needed, at this granularity ($20 bills sent through the mail), and simple trust works. (We talk a lot about "reputations," and this is a concrete example. Protocols that "force" Bob to honor a digital stamp, instead of relying on his willingness to honor his promises, are vastly harder to design and use than are such simple, micro-trust transactions.) Different remailers would have different stamps, different rates, etc., and a remailer script (for a "premail"-like app?) could take the remailer hops planned, pull a stamp off the list of unused stamps, and put the number in a remailer-like header field, such as: :: Digital-Stamp: 5he20o#xL3p01SA29s The receiving remailer would decrypt the message with its private key, check the digital stamp field (as above, or in a real header format, whatever), and see if the stamp is in its list of "issued, but unused" stamps. And so on, in the obvious way. Seems straightforward to do. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

anonymizer.cs.cmu.edu
by ghio＠netcom.com 17 Dec '03

17 Dec '03

I tried this site http://anonymizer.cs.cmu.edu:8080/prog/snoop.pl using Mosaic 2.7b2 and was told: Your computer is a X11;Linux 1.2.13 i486. Your Internet browser is NCSA Mosaic. You just visited the Anonymizer Home Page. With Arena it gave me: Your Internet browser is Arena/0.96s libwww/. Lynx came up with even less: Your computer is a Unix box. Your Internet browser is Lynx. I did manage to completely confuse it with: > myriad:~> telnet anonymizer.cs.cmu.edu 8080 > Trying 128.2.199.14... > Connected to LCON.PC.CS.CMU.EDU. > Escape character is '^]'. > GET /prog/snoop.pl > <HTML><HEAD> > <TITLE>I CAN SEE YOU</TITLE> > </HEAD> > > <BODY BGCOLOR="78789F" > text="#FFFFFF" > vlink="#dbdb70" > link="#FFFF00" > alink="#1010ff" > > > > <center> > <img alt="Anonymizer logo" src="ftp://anonymizer.cs.cmu.edu/pub/I19"> > </center> > > <HR> > > Many people surf the web under the illusion that their actions are > private and anonymous. Unfortunately, it isn't so. Every time > you visit a site, you leave a calling card that reveals where > you're coming from, what kind of computer you have, and other > details. Most sites keep logs of all your visits. In many cases, > this logging may constitute a violation of your privacy. > > > > Here's a sampling of the kind of information that a site can > collect on you (please wait a moment): > > > > > > <BLOCKQUOTE> > > > <img src="/let/a.gif"><img src="/let/j.gif"><img src="/let/u.gif"><img src="/let/r.gif"><img src="/let/i.gif"><img src="/let/s.gif"><img src="/let/o.gif"><img src="/let/n.gif"> > > Your name is probably ajurison, and you can be reached at ajurison(a)netcom20.netcom.com. > > > Your Internet browser is [unknown browser]. This time it actually took a stab at the user name, and got it completely wrong, although the hostname (netcom20.netcom.com) was correct. I suspect it used finger and took a wild guess. The rest of the information is obvious from the User-Agent header, though I find it unusual that the new Mosaic reports the cpu/os type: User-Agent: NCSA_Mosaic/2.7b2 (X11;Linux 1.2.13 i486) libwww/2.12 modified Mosaic 2.4 reports only: User-Agent: NCSA Mosaic for the X Window System/2.4 (L10N-2.4.0) libwww/2.12 modified Lynx reports: User-Agent: Lynx/2.2 libwww/2.14 The statement "Your computer is a Unix box." seems to be just a likely guess, but it could be wrong, because there is a version of lynx for MSDOS. What suprises me is not the information this got, but what it *DIDN'T* get. It never managed to figure out my username, despite the fact that netcom runs identd, and all three web browsers give it my username when they opened the FTP connection. It only reported the hostname in one instance, and seems to be ignoring the info from the ftp session. This "snoop" script isn't getting half the information it could!

1 0

Bignum support added to XLISP 2.1h
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

Many cypherpunks might enjoy programming in XLISP 2.1h because the freely available implementation of LISP now offers support for BIGNUMS. That means it is quite easy to write cryptographic algorithms that use very large numbers without adding extra support. The downside is that the language is interpretted and thus much slower than something like C. It should also be possible to write RSA in a very short XLISP program. I don't know if you can do 4 lines, but it should be quite short. -Peter

4 3

PRETTY GOOD PHONE PRIVACY, TOO
by James M. Cobb 17 Dec '03

17 Dec '03

Friends, 01 14 96 Edupage includes: PRETTY GOOD PHONE PRIVACY, TOO Now from the creator of PGP encryption software comes a new product for making your phone calls more private. Philip Zimmermann's PGPfone software scrambles phone calls made through a computer modem using a complex algorithm called Blowfish, which rearranges the digital version of your voice conversation and then decodes it at the other end. The result is an intelligible -- though not high-quality -- totally pri- vate conversation. The URL is: http://web.mit.edu/network/pgpfone (Popular Science Jan 96 p43) Cordially, Jim

1 0

DEC's MICROCASH
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, 01 14 96 Edupage includes: MICROCASH Digital Equipment filed a patent last August for a payment system called Millicent, which enables Web-site operators to charge as little as a tenth of a cent for each customer "hit." The system relies on middle-men --credit card companies or digital banks -- to handle the transactions, but its novelty lies in its cost-effective design geared toward tracking minuscule amounts of cash. To keep disk storage at a minimum, security measures providing privacy and a trail of signed re- ceipts are not included in the system, but proponents point out that would-be cyberthieves would have to crack a lot of trans- actions -- 10,000 at 0.1 cent each -- to make just $10. "There are easier ways to make 10 bucks," says Millicent's inventor. (Business Week 15 Jan 96 p90) Cordially, Jim

2 1

(fwd) Usenet, No Exit: A Theological Parable
by bruceab＠teleport.com 17 Dec '03

17 Dec '03

Path: nntp.teleport.com!psgrain!newsfeed.internetmci.com!in1.uu.net!CS.Arizona.EDU!news.Arizona.EDU!packrat.aml.arizona.edu!dsew From: dsew(a)packrat.aml.arizona.edu (David Sewell) Newsgroups: news.admin.net-abuse.misc,alt.culture.usenet,alt.usenet.kooks Subject: Usenet, No Exit: A Theological Parable Date: 15 Jan 1996 05:28:09 GMT Organization: Department of Geosciences, University of Arizona Lines: 116 Message-ID: <4dcol9$c4u(a)news.ccit.arizona.edu> NNTP-Posting-Host: packrat.aml.arizona.edu Summary: What if Boursy/Grubor/Slaton/Vulis went to Heaven... Keywords: satire spam abuse Xref: nntp.teleport.com news.admin.net-abuse.misc:35135 alt.culture.usenet:22509 alt.usenet.kooks:27121 Status: N USENET, NO EXIT A Theological Parable Once upon a time, Stephen Boursy, John Grubor, Jeff Slaton, and Dimitri Vulis were all travelling together on a bus--probably to "visit" someone, but the story doesn't say. While rounding a hairpin turn on a treacherous mountain road, the bus suddenly skidded, broke through the guardrail, and plunged two thousand feet, instantly killing everyone on board. Boursy, Grubor, Slaton, and Vulis awoke to find themselves floating on soft clouds before a massive pearly gate, where an old man with dazzling white robes and a long fleecy beard greeted them. "I am St. Peter," he said. "Tell me who you are and what you have done with your lives, to help me decide where you belong." The four eyed each other nervously. Finally Jeff Slaton stepped forward. "Saint Peter, I have aided millions of computer users by championing free enterprise and protecting the Internet from the forces of socialism and hypocritical elitism. I would be honored to offer my skills in the service of Heaven!" Next Boursy gathered courage. "I have fought evil outlaws who pretend to be other people in order to cancel their words!" Nearly elbowing him aside in his eagerness came Grubor: "St. Peter, I have valiantly rid the Internet of pushers of hard drugs, and defended the God-given American right of free speech!" Last of all Vulis came forward and flung out his chest as he said, "Like my mentor and countryman Solzhenitsyn, I have exposed the wiles of evil stukachi and the lying forger Pidor Vorobieff!" St. Peter scratched his head and sighed. "I'm afraid I'm not very up to date on computers, but Raphael surfs the Net. Please wait just a moment." Instantly there appeared a heroic archangel in shimmering armor. "What IS it, Peter?" he said. "I *finally* found a moment to install the ELF binaries on His Linux system..." St. Peter pointed to the four new arrivals, and began a whispered conference with the archangel. Finally St. Peter turned back to them, and with a wide smile said, "We have chosen accommodations for you; Raphael will show you to your quarters!" Everything faded; and when the four could focus their eyes again, they were with Raphael in a gleaming white room scented with incense and adorned with precious gems. A luxurious feather-bed stood against each wall, and next to each one a gleaming Pentium computer. "Here you are," said Raphael. "You've all got Windows 95 and Ethernet connections, plus full access to the Web." "What about Usenet?" asked Grubor, a mite suspiciously. Raphael smiled indulgently. "Would we offer an inferior product here? We who know the secrets of your hearts have designed for you a news network fit for eternity. Ten thousand newsgroups, no article cancellation, no charters, no FAQs, no vote-takers, no rules. As Augustine said, 'Love God, and post what thou wilt.'" "Do you carry heaven.admin.policy?" asked Boursy. "Yes, my child." "Heaven.is and heaven.is.too?" asked Grubor. "Of course." "You mean no cancelbots?" asked Slaton. "Goodness, no, the idea!" "Does heaven.culture.russian have a moderator?" asked Vulis. "Who but you, my dear Doctor?" "You've all got shell accounts on otherworld.org," Raphael continued. "Use trn to read news and Pnews to post. Of course our version of Pnews doesn't give you that silly scolding about how much money your post is going to cost the entire Net." The four rushed to their computers, and for some time nothing could be heard but the clacking of keys against the faint background of harp music. At length all were silent, until Slaton shouted, "Gather round, and let's see the fun!" As the others crowded about his terminal, he typed "trn", and tapped his fingers impatiently until a prompt appeared: ====== 4 unread articles in heaven.general -- read now? [+ynq] "Hmm, that's kind of odd..." Slaton murmured as he hit the + key. a Sanctified Spam 1 No more A P O L O G I E S, Suu--eeeee! b Doctor of Theology 2 Chris Lewis needs an angelic visitor! Stephen Boursy >Make that two angelic visitors! d Dr. Dimitri Vulis 1 First List of lying stukachi Seraphim (Mail) -- Select threads (date order) -- All [Z>] -- "WHAT??" the four cried, with one voice. "Where's the rest of the posts? Where's everybody else??!!" Raphael's eyes gleamed. "Who said anything about anyone else?" For the first time ever, Boursy had a clue. "Where... just where ARE we, anyway?" Raphael quickly strode to the door and turned as he passed through. "You know what Sartre said. L'Usenet, c'est les autres! Enjoy eternity!" And with that the door shut and the lock clicked with an authoritative "sneck!". And as the four rushed wild-eyed to their terminals to compose furious denunciations, eight eyes processed in horror the message that appeared there: Broadcast Message from root@otherworld (/dev/tty1) at 00:00 ... System going down in 2 minutes, back up in a few aeons --Chris Lewis, SysAdm *** *** THE END -- David Sewell * dsew(a)packrat.aml.arizona.edu | "Seekers for gold dig much Dep't of Geosciences, Univ. of Arizona | earth, and find little gold." WWW: http://packrat.aml.arizona.edu/~dsew/ | --Heraclitus bruceab(a)teleport.com - <*> - http://www.teleport.com/~bruceab/index.html List Manager, Christlib, where Christian & libertarian concerns hang out Science fiction readers: Preview S.M. Stirling's DRAKON and WORD OF NIGHT (the new Marid Audran novel by George Alec Effin ger) at my home page. New PGP key on Web key servers; old keys are toast.

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33a.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub ek"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash latent ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp. hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)valhalla.phoenix.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut"; $remailer{"shinobi"} = "<remailer(a)shinobi.alias.net> cpunk mix hash latent cut ek reord"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ek ksub"; $remailer{"gondolin"} = "<mix(a)remail.gondolin.org> cpunk mix pgp hash latent cut ek reord"; $remailer{"tjava"} = "<remailer(a)tjava.com> cpunk mix pgp hash latent cut"; $remailer{"pamphlet"} = "<pamphlet(a)idiom.com> cpunk pgp hash latent cut ?"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'gondonym'} = '<alias(a)nym.gondolin.org> alpha pgp'; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 robo hroller alpha) (gondolin gondonym) (flame hacktic replay) (alumni portal) (vishnu spook wmono) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: all of the "ek" tags have been verified correct. Apologies to those who were inconvenienced by incorrect "ek" tags in the past. Last update: Mon 15 Jan 96 6:48:07 PST remailer email address history latency uptime ----------------------------------------------------------------------- bsu-cs nowhere(a)bsu-cs.bsu.edu ++#+*##*---* 20:42 100.00% c2 remail(a)c2.org *-+********* 17:00 99.99% replay remailer(a)replay.com ***+******** 5:47 99.99% ecafe cpunk(a)remail.ecafe.org *########### 2:12:32 99.99% flame remailer(a)flame.alias.net ++++++++++++ 52:25 99.99% mix mixmaster(a)remail.obscura.com ----------- 2:12:08 99.96% ford remailer(a)bi-node.zerberus.de .--.-.-*++++ 4:17:19 99.95% pamphlet pamphlet(a)idiom.com ++++++++++++ 44:27 99.93% vishnu mixmaster(a)vishnu.alias.net ++*+******** 22:18 99.89% hacktic remailer(a)utopia.hacktic.nl ***+******** 8:14 99.88% alumni hal(a)alumni.caltech.edu +*+**--*+*** 12:30 99.88% portal hfinney(a)shell.portal.com #####*##*+++ 10:33 99.85% penet anon(a)anon.penet.fi ----------- 10:09:06 99.83% rmadillo remailer(a)armadillo.com ###### ##+#* 2:00 99.71% tjava remailer(a)tjava.com +########+# 59:00 99.54% spook remailer(a)valhalla.phoenix.net --.-* * - * 1:54:34 94.25% extropia remail(a)extropia.wimsey.com - -.----- 6:01:55 93.81% hroller hroller(a)c2.org #-#####-# # 3:50 90.56% rahul homer(a)rahul.net #####+** ### :57 99.49% shinobi remailer(a)shinobi.alias.net _____.- 25:51:28 85.47% wmono wmono(a)valhalla.phoenix.net * - 1:02:01 70.76% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: Respect for privacy != Re: exposure=deterence?
by jim bell 17 Dec '03

17 Dec '03

At 02:59 AM 1/14/96 -0800, Rich Graves wrote: >On Sat, 13 Jan 1996, jim bell wrote: > >> 1. Individual private citizens acting on their own deserve privacy and >> anonymity. >> 2. Government employees receiving paychecks based on tax dollars stolen >> from members of the public do not. > >Disregarding the high-falutin' diction, why not? > >Certainly, expose everything they do at work, but I don't see that >tracking someone down personally serves any purpose. Tell that to Simon Weisenthal, who (until his recentconversion to statism) was under the impression that tracking down people who did bad things for the government was not only acceptable, but in fact laudatory. >> 3. Individuals not harming others deserve privacy and anonymity. >> 4. Government employees threatening citizens with large fines and jail >> time, for doing what we consider right and good, do not. > >I strongly disagree, and the fact that it's a government is irrelevant. Since government is funded by stolen dollars, it ISN'T irrelevant. >Everybody deserves privacy: criminals, I agree, to the extent that an unconvicted person who happens to be a criminal is also an ordinary citizen. > government employees, I _Disagree_, especially after they've committed crimes for the government. > and people >you like as well. Of course, you have the right to investigate any person, >in keeping with the law. If "the law" is used to protect government-employed criminals, then the law is wrong and we should disregard that portion of it.

2 1

Membership of list
by George Banky 17 Dec '03

17 Dec '03

Please advise on how I can join. Reagards, e-mail: gpb(a)goofy.swin.edu.au

1 0

c'punks at RSA conference
by Travis Corcoran 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Message-Signature-Date: Mon Jan 15 11:09:09 1996 Sorry if I've missed any previous posts on this topic, but... are any subscribers to this list going to be at the RSA conference this week? If so, anyone interested in doing a PGP key-signing? Please reply via email; I'm certain to read it before travelling. - -- TJIC (Travis J.I. Corcoran) http://www.openmarket.com/personal/tjic/index.html Member EFF, GOAL, NRA. opinions (TJIC) != opinions (employer (TJIC)) "Buy a rifle, encrypt your data, and wait for the Revolution!" PGP encrypted mail preferred. Ask me about mail-secure.el for emacs. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed by mail-secure.el 1.006 using mailcrypt Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMPp8KIJYfGX+MQb5AQExzQP/dVyyr9uQcMCd7UlFMD4+TVDaFBlRM7wL MrpDarq9QlZ8vYZd0ECjC8MyxUE5Kl95yVYl1BySRPohwD6wUFFn6loemDSDdF6c gS6ku68I2+kZukHSY8MI45V5zqJ9dNWGTAgRH5eAlekRkWujUsZGwOtpW9mKCTUd RIRPyNs/9tE= =5+i5 -----END PGP SIGNATURE-----

1 0