December 2003 - cypherpunks-legacy

Re: Mbone seminar 21st Nov 16:15UTC: FIREWALLS AS A NETWORK SECURITY
by Danny Cox 17 Dec '03

17 Dec '03

Piete, I read variuos bits about using the MBone for conferences etc including this one, and I'd like to be able to listen to them. Can you point me to any tools which I can use to access it and give me some pointers as to how to use them ? Thanks, Danny Cox

1 0

Re: "Junk E-Mail"
by James A. Donald 17 Dec '03

17 Dec '03

At 06:47 PM 11/19/95 -0500, Ray Cromwell wrote: > > Is anyone else getting lots of junk e-mail lately? Yes. When people spam usenet, they get hit by a large highly organized counter attack. When they spam people by email, no large counter attack -- we need a place were people go to share knowledge of email abuse. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: remailer abuse
by Corey Bridges 17 Dec '03

17 Dec '03

At 05:27 PM 11/19/95 -0800, Greg Broiles wrote: >... > If A wants to send >messages to B, but B doesn't want to receive them, should A be forced to >stop sending? My rambling $.02: I haven't thought all this through, but I have an emerging stance. Just this week I've started ploughing through the Cyphernomicon, and was smacked in the face with the eminently pragmatic Mr. May's statement that any law that cannot be enforced should not exist. Up until, say, this week, I'd always been in favor of Caller ID. I'd figured if anyone wants to call me, I have the right to know who it is. By default, I had adopted this position concerning email. Now, one day I will receive an anonymous email. Will I be offended? Maybe. Can I do anything about it? Not likely. Anonymous communication is only going to get easier. Current congressional prattling notwithstanding, the onus of responsibility will have to shift to the recipient. For example, I could configure my mail program to automatically throw away any incoming message with "anonymous" in the "From" header. (Or any message from *(a)pseudo.goldenbear.com, for that matter) If junk mail continues to bother people, it's only a matter of time until mail programs' filtering capabilities become much more sophisticated. (Of course, for all I know, there already ARE programs that do what I'm about to propose.) People can maintain a "do not accept from" list, containing every anonymous remailer they've ever heard about, or an "accept only from" list, containing just the people they wish to converse with. I think it's this second option that will become increasingly important. Sure it's your right to send me whatever the hell you like, just as it's my right to ignore you completely. Bringing this back to my hobby-horse of Caller ID, you end up with even greater protection than an unlisted number--let the whole world know my number--no one'll get through unless I already know him. And then in the brave unregulated future, if you make a new friend, you merely swipe his public-key business card through your PDA, which adds it to your "accept calls and emails from" list. And to take a stab at another pair of Greg's questions, if A is sending messages from his account on X's system to B, and B doesn't want to receive them, should B have the right to make X stop A? No. (Not that I think the law is going to realize that any time soon.) Should X have the right to stop A? Hell yes--it's his system. Let A find a more open-minded ISP if he doesn't like it. Corey Bridges Security Scribe Netscape Communications Corporation 415-528-2978

2 1

Paid Delivery (was Re: remailer abuse)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:21 AM 11/20/95, Corey Bridges wrote: >At 05:27 PM 11/19/95 -0800, Greg Broiles wrote: >>... >> If A wants to send >>messages to B, but B doesn't want to receive them, should A be forced to >>stop sending? > >My rambling $.02: > >I haven't thought all this through, but I have an emerging stance. Just this >week I've started ploughing through the Cyphernomicon, and was smacked in >the face with the eminently pragmatic Mr. May's statement that any law that >cannot be enforced should not exist. Thanks. It's always heartening to see that someone is affected positively by one's arguments. >Up until, say, this week, I'd always been in favor of Caller ID. I'd figured >if anyone wants to call me, I have the right to know who it is. By default, >I had adopted this position concerning email. Now, one day I will receive an >anonymous email. Will I be offended? Maybe. Can I do anything about it? Not >likely. Anonymous communication is only going to get easier. Current Yes, anonymous communication is getting easier, and the costs of trying to stop it are becoming impossibly high. It would essentially require a police state to stop, and even then it probably couldn't be stopped...for example, I could always set up a "Tim's Quoting Service," which passes on anonymous mail to a recipient with the "Hey, someone says this..." Could I be prosecuted? Not even in a police state. Just one of dozens of approaches to skirt such laws. However, anticipating your next point, this does not mean anonymous communication bandwidth will become infinite. Solutions are predictable. See below. >congressional prattling notwithstanding, the onus of responsibility will >have to shift to the recipient. For example, I could configure my mail >program to automatically throw away any incoming message with "anonymous" in >the "From" header. (Or any message from *(a)pseudo.goldenbear.com, for that >matter) > >If junk mail continues to bother people, it's only a matter of time until >mail programs' filtering capabilities become much more sophisticated. (Of >course, for all I know, there already ARE programs that do what I'm about to >propose.) People can maintain a "do not accept from" list, containing every >anonymous remailer they've ever heard about, or an "accept only from" list, Many of us do this all the time. The Macintosh (and Windows) mail program I currently use is "Eudora Pro," from Qualcomm. Extensive filtering options. Certainly it is possible to set up filters to put mail from "anonymous" into mailboxes, or the trash. And just as possible, though a bit more involved, to put mail from _desired_ sources into boxes, or have a priority flag raised, etc. What if one is "bombarded" by mail, thousands of messages a day, or many megabytes? There are two main options, besides meaningless clamoring for legislation against "junk mail": 1. Some services, like Prodigy, allow one to discard a message before reading it, with no charge. (Seeing the sender and message name only.) This does not solve the problem completely, but it certainly eliminates cost to the enduser. The service provider still has the mail, but at least his network connections are likely to not be much affected....still possible to bring the service to its knees, which brings up the second approach....: 2. Sender pays the costs of transmission. That is, if someone wishes to send 10 megabytes to a site, at least _he_ (or _she_) pays the freight. This is of course the way things now work with the U.S. postal system, with "Postage Due" no longer common: if the sender doesn't In the real world, nothing is really free, so the whole economics of the Internet has been deceiving for quite some time. The notion that one can "spam" for free, shipping megabytes to thousands of sites, has led to strange notions about the economics of the Net and, as a result, for calls for new laws about "unwanted e-mail," "spamming," etc. Of course, most users on the Net are now paying for connectivity one way or another. Even U.C. Berkeley, one of the pioneers in Unix and campus connections to the Net, has subcontracted out it's Net connections to Netcom, with students and faculty paying around $15 a month. A sign of the times. (There are also reasons why at least so far it has proven viable to _not_ charge for individual transmissions. Various kinds of subsidies.) Filtering is a solution for the reader not to have see stuff he doesn't want to see, but he or his ISP may still receive the stuff, even if it gets discarded, which is why the long term solution is likely to involve paid deliveries. (Needless to say, this is not currently part of the Net, and I'm not suggesting it will happen anytime soon, or because I happen to think it's a solution. Rather, what I'm saying is that it's a _technological_ and _market_ solution to the "problem" of spammage and "unwanted mail filling up our mailboxes." How it happens is unclear. But think of how markets generally evolve to deal with what would naively be seen as unsolvable crises or shortages. Long before we all are getting gigabytes of unwanted stuff every day, alternatives will develop. I am confident that paid delivery is one of the keys.) >And to take a stab at another pair of Greg's questions, if A is sending >messages from his account on X's system to B, and B doesn't want to receive >them, should B have the right to make X stop A? No. (Not that I think the >law is going to realize that any time soon.) Should X have the right to stop >A? Hell yes--it's his system. Let A find a more open-minded ISP if he >doesn't like it. Amen. Exactly. >Corey Bridges >Security Scribe >Netscape Communications Corporation ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Interesting. And now I'm even happier to have partly made a convert. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: WRITTEN CODE
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Sat, 18 Nov 1995 s1113645(a)tesla.cc.uottawa.ca wrote: > Curious, where is uncg.edu? Your French name doesn't make me think you're > in the States (as an .edu address might suggest, but then not necessarily > either). (univ of Calgary?) I think the University of Calgary is actually in the .ca domain. It's a Canadian address. Its just like your very own domain. Your machine tesla is on uottawa.ca. Your University of Ottawa address is not in .edu, but is in .ca. It's interesting though, that you brought up Calgary. Calgary, as I assume our Ottawa poster knows, was very busy over the last week. Grand Central station. All of the politico's seemed to transit the city. Reform Party Leader, Preston Manning, and Conservative Party Leader, Jean Charest, held duelling fund-raising dinners this last Wednesday in Calgary. And Canada's ambassador to the United States, the Prime Minister's nephew -- Raymond Chretien -- left Washington and spoke to the Calgary Chamber of Commerce about NAFTA on Friday. Chretien was particularly troubled by remarks from Senate Majority Leader Bob Dole, about wanting to re-open Chapter 19 in the NAFTA. Following his Chamber of Commerce address, Chretien was quoted as saying, "For us, Chapter 19 is the heart of NAFTA. And this dispute mechanism has been put in there to take into account the fact that we are a much smaller economy, a much smaller country. We have to rely on those tri-national panels to defend our interests." Chretien for now is chalking up the threatening comments to political posturing in the run-up to the presidential election next year, otherwise he said, "we will have a serious problem." Chretien also played down security concerns after a knife-wielding intruder broke into his uncle's (the Prime Minister's) home at 24 Sussex. Despite living in Washington, D.C., Chretien said he doesn't fear for his public safety. When he was asked about the lack of visible protection during his visit to Calgary, he said: "I'm just a humble public servant." Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

3 2

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33a.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp hash cut reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash latent ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp. hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)valhalla.phoenix.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut ek"; $remailer{"shinobi"} = "<remailer(a)shinobi.alias.net> cpunk mix pgp. hash latent cut ek reorder"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (robo syrinx c2) (flame hacktic replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. remailer email address history latency uptime ----------------------------------------------------------------------- ecafe cpunk(a)remail.ecafe.org --*+* *+* .- 3:47:29 99.20% robo robo(a)c2.org #** *##+ ## 1:57 99.04% hacktic remailer(a)utopia.hacktic.nl *** ***+* ** 9:23 98.98% spook remailer(a)valhalla.phoenix.net ++* ** +* ** 19:50 98.83% wmono wmono(a)valhalla.phoenix.net ++* ***+* * 12:53 98.69% rmadillo remailer(a)armadillo.com ++++++ ++ ++ 36:16 98.69% hroller hroller(a)c2.org ##+ ## :51 98.68% mix mixmaster(a)remail.obscura.com ----+-+ + - 1:13:12 98.54% flame remailer(a)flame.alias.net *** * +* * 17:08 98.26% replay remailer(a)replay.com ++* ** 7:26 98.05% portal hfinney(a)shell.portal.com * +* ## 3:56 97.99% vishnu mixmaster(a)vishnu.alias.net **+** + * 16:08 97.79% bsu-cs nowhere(a)bsu-cs.bsu.edu #** *#-+* # 3:17 97.03% ideath remailer(a)ideath.goldenbear.com ------- - - 6:03:13 95.95% penet anon(a)anon.penet.fi -----..- - 11:16:54 95.74% alumni hal(a)alumni.caltech.edu *+* + ++ # 5:01 95.02% ford remailer(a)bi-node.zerberus.de _ _-.-+ +++ 17:34:27 92.75% extropia remail(a)extropia.wimsey.com -..-- ----- 5:46:08 92.40% c2 remail(a)c2.org +++ + + + 53:15 91.60% rahul homer(a)rahul.net -**+*#++* * 8:22 97.99% syrinx syrinx(a)c2.org +- ++ 5:13:50 28.61% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: "Dear Newt" Letter...
by rwizard＠mindspring.com 17 Dec '03

17 Dec '03

At 04:38 PM 11/20/95 -0500, Robert Hettinga wrote: > >My, *this* looks interesting... > > >Cheers, >Bob Hettinga ... >Dear Mr. Speaker: > > We are writing to express serious concerns about the >Administration's efforts to continue to restrict the ability >of computer users at home and abroad to protect their personal >and private information over electronic networks through the >use of encryption technology. The Administration seems ... As a constituent and campaign volunteer of Mr. Newt, I think I will drop a hard copy of this off at his office along with a healthy dose of *my* views ! Thanks for posting it. rwizard(a)mindspring.com ================================================= "The Internet is already full - Go Away !" ================================================= -----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzChH30AAAEEAL4nhMMmeqVZXx2UYZgyZfjgm+oVkbLkVhgr7Z8rBPWd1FwX wv+vQlX7smRbYF+FymeUKlWiKl8hhkueo5iObyek5C32a5NP0snYQYJDfwn9UE6P hJGBpYcjiKU8XzUXfpfAC95FGkCqrLCp1kfDhLpqJChUK1GN8Va+auujevB9AAUT tCVSYW5keSBXaWxzb24gPHJ3aXphcmRAbWluZHNwcmluZy5jb20+ =KccN - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMKl1wVa+auujevB9AQGJJwQAs9Y13pi2Rq5vFKc9RRIfed7Qkx63RFpz J1AhkBLE+HEixfjhx3WEmg5hAloae8N2N7/gpPXs3i/TcOQ/XMXtd9L4SSlGieIJ FrJDF6aktnHoBetKMsaRIFtIC0rXYZCMLktYjTXICPDwZMKWnWy9M5vGYNApS2Rz DKcZp5UWIIA= =ZmFv -----END PGP SIGNATURE----- ----Begin Geek Code--- GAT d- s+:+ a+ C++++ UH++++L++++ P+ L++ E--- W+++ N+ K- w++++ O-- M-- V PS--- PE+++ Y++ PGP++ t+++ 5+++ X++ !R tv- b+ DI+++ D+ G-- e* h---- r+++ y++++ ---End Geek Code---

1 0

Re: Good Enough?
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 1:24 PM 11/14/95, Derek Atkins wrote: >Hi. > >First, I must warn you that generating keys on behalf of users is in >general a very bad thing to do. Instead, you might want to provide a >simple way for users to generate keys and get them certified. The >biggest problem is that there is not an easy way to get a good set of >random numbers on a server platform. On the other hand, users can get >a great deal of randomness on their own client machines. If they can >run netscape, then they can run PGP. .... I don't like to harp on this but you have stated the scenario so clearly, that I ask: If the user cannot trust you to generate keys for him, why should he trust the code that you provide to him? That code can have errors like the old Netscape code except planted on purpose so that the private key is guessable in 2^40 tries. There are two answers, I think. The code is public and the user hopes that any flaws will be publicized. The second is to use keyed information (not timing but character information) to provide the random seed. That is the idea behind my post a few weeks ago: "Using deterministic programs to select private RSA keys" Some may find that method less hazardous then trusting the culture of publishing flaws in code. I can forward that posting to anyone interested.

1 0

Re: Micropayments article?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:46 AM 11/20/95, Lucky Green wrote: >Would somone please send me a pointer to the micropayment article? http://theory.lcs.mit.edu/~rivest/ I am copying the list because, perhaps counterintuitively, it will save bandwidth and overall effort. The reasons are left as an exercise in game theory for the student. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Micropayments article?
by Lucky Green 17 Dec '03

17 Dec '03

Would somone please send me a pointer to the micropayment article? TIA,

1 0