December 2003 - cypherpunks-legacy

Remailers Pose Risk
by John Young 17 Dec '03

17 Dec '03

Computerworld, February 12, 1996, Front page: Stealth E-mail poses corporate security risk By Gary H. Anthes Anonymous remailers on the Internet are emerging as a threat to national and corporate security, some experts warn. These remailers are Internet sites that strip the names and addresses from electronic-mail messages before passing them along anonymously to prople or newsgroups. For corporate information systems managers, stealth E-mail is especially troubling because it allows hackers to attack systems, steal trade secrets and broadcast them worldwide without leaving an audit trail for authorities to follow. "Anonymous remailers have a lot of nasty potential," said Stephen T. Kent, chief scientist for security technology at BBN Corp. in Cambridge, Mass. "They have the broadcast potential of the news media but without the possibility of recourse if something is unsubstantiated or defaming is published." Critics are calling for strict limits or an outright ban on remailer sites, but others insist they are a safeguard against electronic snooping by abusive governments and should be considered a political freedom. Anonymous remailers have been used in a variety of criminal acts, including distributing pornography and computer viruses, violating copyright laws and harassing people with nasty messages. One snowy day last month, for example, about 25% of the workforce at a defense contractor in Rockville, Md., went home after they received a bogus E-mail message dismissing them for the day. The message originated from an anonymous remailer that allowed the user to impersonate a senior company official. But there are more scary, less publicized uses of remailers, said Paul Strassmann, former director of defense information at the Pentagon. Stealth E-mail also is used extensively by Russian criminals, often former KGB agents. "This method of communication is a favorite for engaging the services of cyber-criminals and for authorizing payment for their acts through a third party." Strassmann said. Its Reputation Precedes It Perhaps the best-known remailer site is in Finland at anon.penet.fi. The Finnish server was used last year to publish confidential and copyrighted scriptures from the Church of Scientology. It also was used to reveal the secret source code used by RSA Data Security, Inc. in some of its encryption products. Last year, police raided the Finnish site and seized records and computer gear as part of an investigation of alleged copyright infringement. The administrator of anon.penet.fi offers this warning to new users: "I believe very firmly that it's not for me to dictate how other people ought to behave. But remember, anonymous postings are a privilege, and use them accordingly. Remember, this is a service that some people who use newsgroups such as alt.sexual.abuse.recovery need. Please don't do anything stupid that would force me to close down the service." One remailer advertises itself as a way to thwart attempts by intelligence agencies to trace illegal traffic, Strassmann said. It holds all incoming messages until five minutes after the hour, then remails them in random order. The messages are sent through five to 20 other remailers, with a stop in at least one of the several countries noted for lax law enforcement, he said. Yet other experts say the threat from remailers is greatly exaggerated. "We've had remailers around for a while, and society hasn't fallen," said Mike Godwin, staff counsel at the Electronic Frontier Foundation in San Francisco. "We've had anonymous communication in the U.S. for years, you can use a public telephone, send a letter without a return address or engage in a cash transaction." Last year, the U.S. Supreme Court struck down an Ohio law that required the authors of political posters and pamphlets to identify themselves. "In the case of political speach, you can't make people tell you who they are," said Patrick Sullivan, executive director of the Computer Ethics Institute in Washington. But Sullivan said the police raid on the Finnish remailer was prompted by the Church of Scientology's legitimate complaint about violations of copyright law. "I haven't heard many uses of remailers that haven't involved, at the very least, being disrespective and, at the most, trying to cause harm of some sort." he said. _________________________________________________________ Battle against remailers an unfair fight Think of anonymous remailers as enemies you can't fight face to face, says Paul Strassmann, former director of defense information at the Pentagon and now a lecturer at the U.S. Military Academy at West Point. "Anonymous remailers are here to stay," he said. "That means the old military paradigm of retaliation falls apart. The whole theory of warfare has been if someone attacks you, you can attack them. But when you are anonymous, there is no one to shoot at." Strassmann said society myst look for defenses in the health sciences, not among electronic technologies. "The history of public health teaches us that suppression of any disease must be preceded by a thorough understanding of its behavior, its method of transmission and how it creates its own ecology," he said. "As in the case of smallpox, yellow fever, flu epidemics, AIDS or malaria, it will take disasters before the public may accept that some forms of restrictions on the electronic freedom of speech and that privacy may be worthwhile." - Gary H. Anthes _________________________________________________________ Do's and don'ts Unethical or illegal uses of anonymous remailers: - To spread viruses or other malicious software - To harass or commit libel - To violate copyright laws - To encourage others to commit unethical or illegal behavior Legitimate uses of anonymous remailers: - For "whistle blowing" - For political speech - For encouraging frank but constructive exchanges of opinions _________________________________________________________ Article also contained chart on how to use anon.penet.fi, not included here. [Thanks to BC for transcribing]

1 0

Re: Assassination Politics(tm) was V-chips, CC, and Motorcycle Helmets
by frantz＠netcom.com 17 Dec '03

17 Dec '03

[I've changed the Subject: to more accurately reflect the contents] My purpose on this thread is to examine the limits of Jim Bell's idea of Assassination Politics. My ground rules are to assume that it is a natural outgrowth of the technologies of anonymous cash and anonymous remailers. As such arguments that it is immoral are only valid to the extent that they bare on individual's decisions to particpate in an assassination. I believe that we have general agreement that high government figures are not subject to sanction via assassination politics because they already enjoy Secret Service levels of protection. I also believe that Jim and I disagree about the significance of Salmon Rushdie. Jim thinks that the lack of anonymity in the Mullah's assassination bounty is repelling possible assassins. I disagree. A question worth asking is, How much does it cost the British government to protect Mr. Rushdie by keeping his location secret and providing other unspecified protection. If anyone knows the answer, it could help build an economic model of Assassination Politics. Jim Bell said: >Actually, I think the primary targets will be either the middle level >manager types, or the ones who have attracted a substantial amount of bad >publicity by "following orders." Lon Horiuchi (the sniper who shot Vicki >Weaver) for example, would be a excellent example of a person who'd try to >claim, "I was just following orders." Okay, maybe he was, but so was Adolph >Eichmann. I agree that Jim's idea of targeting certain specific individuals, such as the sniper above might work. >Once the tax collectors/enforcers were targeted, the rest of the government >wouldn't be able to operate, and would collapse. However if you tackle the whole tax system, you get into problems of scale. The IRS alone (according to their web page) has over 110,000 employees, and we havn't even mentioned the state and local employees. I don't think killing one or two will have a sigificant effect (that is occuring now). I will assume that you have to successfully kill about 10% to have enough effect to shut off the government's money supply. Attacks at this scale will be difficult because while people will have perfect anonymity in cyberspace, they won't enjoy it in physical space. Neighbors, survalence cameras, etc.; in fact all the technology that makes privacy so hard to achieve today will be available to catch the assassins. The police will also be more motivated to utilize the technology for this class of people than they would for drug dealers, pimps and other low lifes. These points will tend to raise the price of assassinations. Let us assume that we can buy assassinations for $50,000 per person. Times 11,000 people is $550 million dollars. That is quite a sum. I need to see an analysis which shows how to raise money on this scale. Bill

1 0

Re: Netscrape's Cookies
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 10:34 2/14/96, Alex Strasheim wrote: >> >>I'm curious if anyone knows which sites use/modify it. >> >AFAIK, the only site that uses it is *.netscape.com >> >> That is not quite true. There are other sites that use the cookies. (It is >> not very common though...) > >A good place to read about cookies is http://www.illuminatus.com/cookie; >I think there are pointers to cgi/perl stuff that manipulates them. > >Cookies are very helpful for database and commerce applications. I'm >using them for a crude online store, as a way to let the web server keep >track of who has what in their shopping basket. Cookies are a godsend for shopping baskets. Saving state without them is a major pain. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

RE: Cookie Crumbles
by Blake Coverett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >What are the chances that NSCP might add a feature that would >allow customers to say yes or no at login to tracking their >movements at any site visited, with a friendly notice that >tracking analysis was being done? The netscape browser could assert that tracking was not desired to it's heart's content, but that doesn't prevent the server from tracking any state it wants about you. (The typical non-cookie approach being to include a session identifier in all URLs) regards, - -Blake -----BEGIN PGP SIGNATURE----- Version: 2.6.3i iQCVAwUBMSOODrmr67p11D8rAQHg8wP/fdjXkJFGuFCyCFr7oyP+z5B6a4S4RNd7 3nkzLVIhil6fHW78CKohGmjVPwuwiz81FGRobfsAoQKgUW0zCMI4SmI9Parxk63A Ly5ckTVf+oDI6WWbyXg39xr7lMPKUqzfyzi3M7nDVXEPNZXLKH58+WJoR0eUsUyW 7AWwcEOducM= =DGYR -----END PGP SIGNATURE-----

1 0

Re: Using lasers to communicate
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

At 10:38 AM 2/14/96 -0500, you wrote: >This idea of sending data via laser beams across open spaces has some >very useful potential. ... >Eavesdropping and channel-blocking and physical-location-discovery are >related threats to which most traditional data channels are susceptible. >Any link which depends on a physical conduit (phone line, fiber, coax) >is relatively easy to interrupt and to trace to its end points. >RF links, even with frequency hopping, are subject to triangulation and >jamming. All these kinds of links can be eavesdropped. >Point-to-point conduitless laser signalling, as envisioned by "Bill" and >Tim in their quotes below, eliminates or reduces these threats Dust will cause diffraction of the beam (at a reduced intensity, of course). Near the source, a detector tuned narrowly to the wavelength of interest would probably succeed quickly. If you have a line of sight channel, there are many other ways to signal that will preserve some deniability. Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0

Re: AT&T Public Policy Research -- hiring for cypherpunks
by ethridge＠Onramp.NET 17 Dec '03

17 Dec '03

>Alan Olsen wrote: > >| > Addresses will not be easily 'transferable.' The IETF is >| >discussing a 'Best Current Practices' document that talks about >| >address portability. Basically, it can't happen, because the routers >| >only have so much memory, and the routers at the core of the internet >| >can't keep in memory how to reach every one; there needs to be >| >aggregation. The only feasible aggregation seems to be provider >| >based, ie, MCI, Alternet, and other large ISPs get blocks of >| >addresses. They give them to smaller companies, like got.net, which >| >gives them to customers. The result? The core routers have a few >| >more years. >| >| A good point. Having parts of subnet shifting around could be pretty painful >| from an admin point of view. > >Its not an admin's point of view thats worrisome. Whats worrisome is >that the routers at the core of the net only have so much memory, and >if the routing tables grow beyond that, we're all hosed, becuase the >core of the internet will start thrashing. So, in essense, you taking >your network address with you when you switch providers ('address >portability' causes costs that must be borne by the entire global >internet. Given that the world of telephony is moving towards Local Number Portability, isn't it inevitable that the internet will be expected to provide the equivalent functionality? In the world of telephones it's being mandated in the name of local loop competition, which presumably isn't a problem for the internet. But if someday i can move across the country and keep my telephone number, i'd expect the same of my internet address. That said, the issue of who manages the database is a significant one, but more political/economic issue than technical. allen

3 2

META: Filtering/Posting advice
by Leslie Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- "I have a concern..." Cypherunks First: Stipulated that any traffic has a 'right' to be on cypherpunks. However, cypherpunks is what we make it. Every time you post a message, consider the desirability of seeing a hundred or so messages just like it from every other readers' point of view. Content control begins at home. Second: I'll remind the reader that one can easily evaluate an individual's past contributions to cypherpunks by looking at the archives' "by author" listing. If you post to cypherpunks, I'd suggest that you go back and look at what you've posted in the past to get a feel for how other people on the list see you. Third: Filtering isn't just a game for the vocal: as noise begets noise, I'd encourage everybody to filter out people whose prose they simply can not stand. While this is an important aspect to creating a more readable list, I can't imagine anybody really caring who else has been "plonked": to me, in seems no more than a preadolescent "nyah nyah, I'm not listening..." I'm half- (only half-, as I'm a free-speech absolutist) tempted to write a tool that would automatically remove any person from cypherpunks who posts a "plonk" message. Until the total lack of security in majordomo is addressed, this is a game that anybody who can telnet to an smtp port can play. Fourth: Cypherpunks is fast becoming a ghetto. My first reaction (which I did not follow) to several crypto posts in the last few days has been to refer the posters to coderpunks. While there is some signal that will always remain uniquely suited to cypherpunks (Tim May's contributions, Strata's response to JPB, and Jim Bell's Assassination idea -- though not all of the messages he's sent since -- immediately come to mind), any signal that has another place to migrate will do so if the noise issue isn't addressed better. Words of wisdom from the past: This program posts news to thousands of machines throughout the entire civilized world. Your message will cost the net hundreds if not thousands of dollars to send everywhere. Please be sure you know what you are doing. Are you absolutely sure that you want to do this? [ny] IE, please... if you aren't adding *new* *signal* to the list, please refrain from posting. If you must flame a person, do it in private email. -- Todd - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMR/CnioZzwIn1bdtAQEG6gGAsw6qzFNpiRLGRW0n7qdHDIJ+Yf+XmBIC dnntiQ+UbXODeNLwsp4jVPSFVETAkCJj =GAYX -----END PGP SIGNATURE-----

4 3

(Fwd) UPDATE: DoJ Brief is Filed
by Deranged Mutant 17 Dec '03

17 Dec '03

Just received this... (apologies to crypto-only folx on the list) ------- Forwarded Message Follows ------- Date: Thu, 15 Feb 1996 14:26:38 -0800 (PST) To: protest(a)wired.com From: telstar(a)wired.com (--Todd Lappin-->) Subject: UPDATE: DoJ Brief is Filed At long last, the U.S. Department of Justice has filed a brief in Philadelpia, in an effort to persuade Judge Buckwalter NOT to issue a Temporary Restraining Order (TRO) that would block implementation and enforcement of the Communications Decency Act. As you'll see below, the DoJ, much like Cathleen Cleaver, seems all too eager to equate "indecency" with "pornography." Grrrrrr. Even worse, the DoJ brief apparently cites Marty Rimm's discredited study about the "pervasiveness" of online pornography as evidence of the urgent need to outlaw indecent material. (TIME Magazine used Rimm's study as the basis for it's sensationalistic "Cyberporn" cover story back in July. It was later revealed that Rimm was an undergradute at Carnegie Mellon University when he did the study, and that his research contained so many methodological flaws that it was all but worthless. TIME even printed a retraction of the story. For more information, visit http://www.hotwired.com/special/pornscare/) According to Ann Beeson, Staff Counsel for the ACLU, "We never thought DOJ would be dumb enough to cite to the Rimm study, so it wasn't mentioned in our initial brief! We expect the judge to rule on the TRO without further reply from us, so we'll have to wait until the next round (the preliminary injunction hearing) before getting in all the info debunking Rimm -- in any event, it is certain to be *very* embarassing for the government." Grrrrrrr. No word yet on when we can expect a decision from Judge Buckwalter, but the ACLU tells me they plan to issue a press release later today. If so, I'll immediately pass it along. In the meantime, here's a CNN update on the DoJ action from http://www.cnnfn.com/news/wires/9602/15/telecom.lawsuit/index.html Stay tuned! --Todd Lappin--> Section Editor WIRED Magazine ================================================================== Justice Department responds to telecom lawsuit February 15, 1996 Web posted at: 12:30 p.m. EST PHILADELPHIA, Pennsylvania (AP) -- The Justice Department filed its written response Wednesday to a lawsuit seeking to block the new computer "indecency" law, saying criminal prosecutions are needed to stop a huge increase in the availability of pornography. The government urged a federal judge not to issue a temporary restraining order against provisions that would make it a crime to send "indecent" and sexually explicit material to minors over computer networks. "Individuals undoubtedly have an important interest in being free of purposeful and direct intrusions on First Amendment freedoms," the brief said. "But the governmental interests at stake here in controlling access by minors in indecent sexually explicit materials is compelling." The American Civil Liberties Union and 19 other groups sought the temporary ban Feb. 8, the same day President Clinton signed into law the Telecommunications Act of 1996. U.S. District Judge Ronald L. Buckwalter said then that he wanted to see a written response from prosecutors before issuing a ruling. The law defines indecent as that which, "in context, depicts or describes, in terms patently offensive as measured by contemporary community standards, sexual or excretory activities or organs." Opponents say the standard is too broad and would criminalize information, even in private e-mail, that has educational, artistic and social value, simply because it relates to sex. The government said the indecency standard has been upheld as constitutional in previous cases, and argued that the law's purpose is to restrict access to widely available pornographic images and materials. Violators would face up to two years in prison and $250,000 in fines. A temporary restraining order should only be granted in extraordinary circumstances and if there are no other legal remedies available to plaintiffs. Meanwhile, the situation is dire, the government said. "In the end, plaintiffs cannot dispute that a large and growing amount of pornography is presently available on-line and easily accessible to children in the home, far exceeding anything available prior to the advent of on-line computer services," the government said. ### Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

PGP
by Sentient1 17 Dec '03

17 Dec '03

Esteemed GentlePersons, Could you settle a dispute? Is it, or Is it not, legal to take PGP source code and the like out of the country if it is written on paper? Thank You

4 3

Re: CDA Yes Votes; Collection
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Feb 09, 1996 05:56:13, 'Duncan Frissell <frissell(a)panix.com>' wrote: > >If you are deeply upset by the high-handed manner in which the legislature >has screwed around with your life, welcome to the club. Every bill they >pass and every regulation upsets someone just as badly as you are upset. >That is why some of us want less legislation and less regulation to minimize >just this sort of human suffering. Maybe next time those of you who are >into "proactive" government will think before you crush other people's lives. > >DCF > Isn't it the libertarian types on the list who are into mass killings of civilians with nukes and the "socialist statists" who tend to oppose it? How does this square with your view that it is people into "'proactive' government" who are "crush[ing] other people's lives?" It seems to me having your city nuked is a tad more likely to produce the crushing. Normally, I would not be the first to post this onto cypherpunks, but since *you* did I'm game for another seemingly off-topic discussion. --tallpaul

1 0