December 2003 - cypherpunks-legacy

should we use same nym on multiple servers?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

With the additional nym servers coming on the scene comes the question of whether or not to "claim" our alpha.c2 nym on the other ones, too. E.g., if we are foobar(a)alpha.c2.org, should we also become foobar(a)nym.gondolin.org and foobar(a)nym.alias.net, too? That would let us have a very stable nym, and prevent confusion over who's "who" if someone else were to have the same id with another nym server. But, it makes it harder to keep our real ID secret. (E.g., an oversimplified scenario would be if an attacker sends a message to all three nyms, then watches three PGP conventionally encrypted messages arrive in our mailbox.) A "safer" way would be to have the other two nyms have a fake address, but then we couldn't receive mail with it. A trickier way would be to have the reply block point to alt.anonymous, but then we'd have to constantly be watching for a message "to" us. Another angle, though, is that the nym servers may be unstable, and multiple nyms would allow us to post, if out "favorite" is down. Anyways, I'm a beginner, and think that the most useful use of remailers is to ask dumb questions. :-)

3 3

Compelling Advantage of Public Key Systems
by tcmay＠got.net 17 Dec '03

17 Dec '03

This is a really, really basic point, but it seems to be lost by some of the folks talking about "virtual one-time pads," "power one-time pads," and "visual power agents one-time pads." To wit: public key systems drastically simplify the whole key exchange problem. Thus, I can send an encrypted message to any of you for whom I have a public key, or can easily get a public key for, and then only the holder of the private key can decrypt. (There are the usual wrinkles about whether the public key is really that of the person you think it is for, MITM, etc., but these are true of any system, and in practice present little problem.) Any schemes which use symmetric key systems, including one time pads, must of necessity involve prior arrangement to exchange keying materials. Nothing can get around this. The "revolution in cryptography" comes from this basic feature of public key cryptosystems. Period. I suggest we not waste our time on the "IPG" system. Whether it is secure or not is not the point. It's cumbersomeness and its $15 a month for some nominally random-looking bits (though known to IPG, so what's the point?) will kill it dead. Let those who use it be examples of evolution in action. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: should we use same nym on multiple servers?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:45 AM 2/20/96, Anonymous wrote: > With the additional nym servers coming on the scene comes the >question of whether or not to "claim" our alpha.c2 nym on the other >ones, too. E.g., if we are foobar(a)alpha.c2.org, should we also become >foobar(a)nym.gondolin.org and foobar(a)nym.alias.net, too? You know, shalmaneser(a)alpha.c2.org sent me a message demanding that he be given the name shalmaser(a)black.net on my system, for exactly this reason. I told him to fuck off. Now he's threatening to sue me. Do you folks think this is right? (More to the point, this example shows that whatever "anonymous" thinks about "claims" on nyms, it's pointless. Even if _some_ nyms are apparently persistent across nymservers, all it takes is the possibility of this not to be so for the fiction to collapse. The best way to prove that "shalmaneser(a)alpha.c2.org" is really the same True Name (or in alliance with) as "foobar(a)black.net" is to show that either can read the messages encrypted to the other.) --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Internet Privacy Guaranteed ad (POTP Jr.)
by Wink Junior 17 Dec '03

17 Dec '03

This culled from comp.security.firewalls. I've edited out the blathering ad copy and just left the "technical details". Sounds like POTP Jr. to me; I'm certainly not interested in the "buy our company" schtick. -- Wink Wichita Falls, Texas February 16, 1996 For immediate Release: Internet.Privacy.Guaranteed [Long blathering sales prose elided.] If You Break our System, You've Bought our Company! Internet.Privacy.Guaranteed, IPG, today announced a new product line that guarantees privacy for 2, or privacy networks of 20,000 or more people on Internet. We back up our Guarantee with the Corporate motto, 'If You Break our System, You Have Bought our Company.' IPG Guarantees Absolute Privacy on Internet. Using the trademark CRE transform, the IPG PCX Nvelopes system translates any intelligible digitized information into utterly random gibberish. Only one other user, or more in certain instances where there is a need to know, will have the Nvelopener required to transform the random gibberish back into intelligible digitized information. CRE Transforms, trademark IPG, are the only acknowledged unbreakable method of so transforming digitized information. There are no passwords, encryption keys, or anything like that to conjure up, remember, and perhaps forget. PCX Nvelopes usage is automatic, similar to PKZIP and PKUNZIP. Easy to install, use, add to, and administer. It is Unbreakable If an individual, or any group of individuals, break the IPG Privacy System, IPG will sell them the company for $1.00, and even give them the dollar to buy it with. If you think you can, just try and you find out that it is impossible. There may be rumors that someone has broken the system, but that is not possible, it will never happen. Don't Waste your time ! How dare IPG have the unmitigated gall? When you are certain, then you are certain, and IPG is certain! Others dare not make such a brazen boast because they cannot possibly back it up, but IPG most certainly can. Every informed expert of the technology will confirm, without reservation, that the IPG system is not breakable, as many already have! There, we have thrown down that gauntlet, dare you pick it up? CRE Transforms The system uses CRE transforms, metaphorically called Nvelopes, to translate any meaningful digitized information into absolutely random gibberish. In order to convert that random gibberish back into intelligible usable form, a Nvelopener is required, and only the rightful recipient(s) has the required Nvelopener. Nvelopes and Nvelopeners Every Nvelope and Nvelopener pair is absolutely and totally unique - they bear no resemblance whatsoever to any other Nvelope - Nvelopener pair in existence, anywhere ay anytime. Every time a user wants to transmit information to another user, they utilize a new unique Nvelope. No Passwords or Keys or the Like As an added bonus, there are NO MESSY, INTRUSIVE PASSWORDS or ENCRYPTION KEYS to conjure up, remember, fool around with, and perhaps forget. None of that sort of thing to bother with at all. Nothing to get in your way of using the system. Transforms Internet from Least Private to Most Private The System, called PCX Nvelopes, for Private Communications eXchange, transforms Internet from being the least private, utterly without any privacy at all, system for conducting communications, into the most private system possible, an elegant fast system that unequivocally insures privacy. Privacy Network PCX Nvelopes serves 2 individuals who want to communicate with each other in private, as it serves equally well a corporate organization, or any other organization, privacy network, of 9 or 90,000 or more people, who want to keep customer, trade secret, strategy and plans, financial, and other confidential information privy to those with the need to know. For both in house and external usage. Guaranteed Easy to Install, Use and Upgrade Potential users beset by a paranoia that the PCX Nvelopes system must be complex, difficult to configure, laborious to install, administratively burdensome, arduous to upgrade and add users, are in for a computer cultural shock. As you will find, PCX is the exact antithesis of all of those things. It is so simple to install, use, upgrade and add users to, that it will completely blow your mind away. There is nothing to do, installation and adding users are totally load and go operations - if you can operate a computer, you can install and use PCX Nvelopes within minutes, it is absolutely duck soup to any computer literate, even marginal ones. Prices Prices are $19.96, including shipping and handling, for a full blown 12 user Demonstration system, unconditional moneyback guarantee and may be applied to your first order - the Demo system can be used by 2 people, or all the way up to 12 users in a privacy network. For $39.95, two users can set up a two user privacy system with 500 Nvelopes. A fully operational integrated multi-user system costs approximately $140.00 per user, ready to load and go, with thousands, or millions of Nvelopes and Nvelopeners. IPG also offers full turnkey leases at $15.00 per user, per network, per month, which includes all software, upgrades, administration, and unlimited Nvelopes and Nvelopeners. As a reference to its unbreakability, we refer you to an article by Paul Leyland on Internet at: http://dcs.ex.ac.uk/~aba/otp.html For more information visit our Web Site at: http://www.netprivacy.com/ipg or E-Mail at ipgsales(a)cyberstation.net, or by phone at 817-691-1081 Trademarks & Copyrights Nvelopes, Nvelopeners, CPX and CRE Transforms are trademarks of Internet.Privacy.Guaranteed, IPG. Copyrighted 1995,1996 by: Internet.Privacy.Guaranteed. All rights reserved.

9 17

Re: Compelling Advantage of Public Key Systems
by Bruce Baugh 17 Dec '03

17 Dec '03

At 12:58 AM 2/20/96 -0800, tcmay(a)got.net (Timothy C. May) wrote: >To wit: public key systems drastically simplify the whole key exchange problem. Exactly. I was trying (not very successfully, I fear) to explain this point just this afternoon to an acquaintance who's developed a handy-to-use but not at all really secure encryption utility. Quite apart from the issue of key size, the public-key system means that I never have to have a secure channel to start communicating. If I've got a channel secure enough to send a clear password to you, I don't need the encryption for security reasons. (_Economic_ reasons may well be valid ones, in practice, but again, if a secure channel isn't routinely available, I say go for the tool that doesn't require it.) I find that it generally takes a few repetitions of this for it to sink in, but once it does, an "aha!" usually follows. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

1 0

Re: should we use same nym on multiple servers?
by Bruce Baugh 17 Dec '03

17 Dec '03

At 01:05 AM 2/20/96 -0800, tcmay(a)got.net (Timothy C. May) wrote: >You know, shalmaneser(a)alpha.c2.org sent me a message demanding that he be >given the name shalmaser(a)black.net on my system, for exactly this reason. >I told him to fuck off. >Now he's threatening to sue me. Do you folks think this is right? No fooling? Wow. That's astonishingly clueless on his part, I'd say. When I sign up with an Internet provider, I don't necessarily get the user name I want. When I joined Teleport, "bruce", "baugh", and "bbaugh" were all already taken. I presume by, in turn, someone with the first name of Bruce, someone with the last name of Baugh, and someone with a first initial of B and a last name of Baugh. (There are, oh, third or fourth cousins of mine in the area. These things happen.) When I transferred to Aracnet, "bruce" was free, so I grabbed it. If Bruce Boxleitner were to try to get an account there, that'd be his tough luck. Even more so with nyms, and even more more so with nyms that aren't real names. "Shalmaneser" is a name with antecedents, after all. If someone else beat the c2 guy to it at black.net, that's his tough luck. No provider, I think, is compelled to offer anyone the user name they might like to have, nor to hold one indefinitely on the off chance. Welcome to the real world, where more than one person can have the same idea. And, as you say... >about "claims" on nyms, it's pointless. Even if _some_ nyms are apparently >persistent across nymservers, all it takes is the possibility of this not >to be so for the fiction to collapse. The best way to prove that >"shalmaneser(a)alpha.c2.org" is really the same True Name (or in alliance >with) as "foobar(a)black.net" is to show that either can read the messages >encrypted to the other.) Right. It at least shows some level of cooperation, if not identity. And realistically, that's about as close as anyone is going to get. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

1 0

breakable session keys in Kerberos v4
by Nelson Minar 17 Dec '03

17 Dec '03

I'm a bit suprised this hasn't turned up yet on Cypherpunks. A couple of forwarded messages: first, an announcement made Fri Feb 16 by Gene Spafford at COAST about an exploitable flaw they've found in Kerberos, and then a comment on the www-security list that it is due to a bad random number generator. Same old story! The message (lifted from the COAST web site) -----BEGIN PGP SIGNED MESSAGE----- Personnel at the COAST Laboratory (Computer Operations, Audit, and Security Technology) at Purdue University have discovered a vulnerability in current versions of the Kerberos security system. Graduate students Steve Lodin and Bryn Dole, working with Professor Eugene Spafford, have discovered a method whereby someone without privileged access to most implementations of a Kerberos 4 server can nonetheless break secret session keys issued to users. This means that it is possible to gain unauthorized access to distributed services available to a user without knowing that user's password. This method has been demonstrated to work in under 1 minute, on average, using a typical workstation, and sometimes as quickly as 1/5 second. The Kerberos system was developed at MIT in the mid-1980s, and has been widely adopted for security in distributed systems worldwide. Kerberos is most often used on UNIX platforms by various vendors, and is often enhanced, sold and supported by 3rd-party vendors for use in academic, government, and commercial environments. The same researchers at COAST have also found a small, theoretical weakness in Kerberos version 5 that would allow similar access, given some additional information and considerable preliminary computation. Kerberos version 5 does not exhibit the same weakness as described above for Kerberos version 4. The researchers at COAST had intended to release the specific details of the problem to affected vendors and incident response teams during the week of February 19, prior to making a public announcement of their findings. However, as rumors have begun to circulate and several representatives of the news media have apparently received indication of the problem, we are releasing this preliminary announcement at this time. Government and industry sponsors of the COAST Laboratory were made aware of the preliminary details of these findings in January (full sponsors receive early notification of significant discoveries as a result of COAST research). Other affiliates of COAST as well as the world-wide network of FIRST computer incident response teams were made aware of the general nature of the findings during the week of February 5. The original plan at COAST was to release specific details only to FIRST (Forum of Incident Response and Security Teams) teams and to MIT prior to announcement by affected vendors of a fix for these weaknesses. The flaw in Kerberos version 4 is significant enough that disclosure of its details prior to a fix would allow someone with moderate programming skills to exploit it; there is currently no reason to believe that others know the details of the flaw and are exploiting it, so there is no immediate danger to the public that would warrant release of the details at this time. COAST personnel have been informed that MIT has already developed a fix for the flaw in version 4 Kerberos and is preparing it for release. Additionally, COAST researchers are cooperating with MIT personnel to identify what (if any) fixes are necessary for version 5 Kerberos. Users of either version of Kerberos should contact their vendors for details of any fixes that may be made available; vendors of products incorporating Kerberos should contact MIT directly for details of the problems and fixes. COAST is a research group of faculty and students dedicated to research into information security and computer crime investigation, and education in computer and network security. It is the largest such university-based group in the United States. Information on COAST may be found on the WWW at http://www.cs.purdue.edu/coast Information on FIRST teams may be found on the WWW at http://www.first.org Information on MIT's Kerberos may be found on the WWW at ftp://athena-dist.mit.edu/pub/kerberos/doc/KERBEROS.FAQ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Key @ ftp://ftp.cs.purdue.edu/pub/spaf/pers/pgpkey.asc iQCVAwUBMSZ42cpvK4P8DALVAQHg8QP/TRmqwP7vG32aaBjvbMof2iuVQ2bcWrg9 p55KN5wBfrBzxq5/NE+6lodkqq2w1ib8q/47uYT1S8iR+z2tnbvL64dxrtDEh4iY iEWjfpTMtQxLmZ1gA3Sxxn4A+6KwlXq5z4Lp2BROUXyeSR7HPAEeEQucRNWkzz8o IOMHuBAcBKo= =yWxe -----END PGP SIGNATURE----- (a comment I found in reply) ------- Start of forwarded message ------- From: jis(a)mit.edu (Jeffrey I. Schiller) Subject: Re: Kerberos Vulnerability Newsgroups: hks.lists.www-security Date: 19 Feb 1996 21:42:08 -0500 Organization: HKS, Inc. Path: hks.net!news-mail-gateway!owner-www-security Lines: 8 Sender: root(a)hks.net Message-ID: <ad4e9fc40602100421be(a)[18.162.1.1]> NNTP-Posting-Host: bb.hks.net There will be a fix distributed by MIT later this week. The problem is that the random number generator in V4 is worse then we thought! The fix is to retrofit the V5 generator (which is decent) into the V4 KDC. Note: Only the KDC needs to be updated, clients and servers are unaffected. -Jeff ------- End of forwarded message -------

1 0

Returned mail: Host unknown (Name server: ncr-sd.sdca.attgis.com.: host not found)
by Mail Delivery Subsystem 17 Dec '03

17 Dec '03

The original message was received at Tue, 20 Feb 1996 03:58:01 -0500 (EST) from ncrgw1@localhost ----- The following addresses have delivery notifications ----- sandiegoca.ncr.com!chris.claborne (unrecoverable error) ----- Transcript of session follows ----- 550 sandiegoca.ncr.com!chris.claborne... Host unknown (Name server: ncr-sd.sdca.attgis.com.: host not found) ----- Message header follows ----- Return-Path: cypherpunks(a)toad.com Received: from ncrgw1.UUCP (ncrgw1@localhost) by ncrhub5.attgis.com (8.7.3/8.7.3) with UUCP id DAA01682 for sandiegoca.ncr.com!chris.claborne; Tue, 20 Feb 1996 03:58:01 -0500 (EST) Received: by ncrgw1.ATTGIS.COM; 20 Feb 96 03:57:37 EST Received: from toad.com by relay3.UU.NET with SMTP id QQadsc06898; Tue, 20 Feb 1996 03:36:36 -0500 (EST) Received: by toad.com id AA24807; Tue, 20 Feb 96 00:12:26 PST Received: from cs.umass.edu (freya.cs.umass.edu) by toad.com id AA24801; Tue, 20 Feb 96 00:12:23 PST Received: from thor.cs.umass.edu by cs.umass.edu (5.65/Ultrix3.0-C) id AA21656; Tue, 20 Feb 1996 03:12:18 -0500 Received: (from lmccarth@localhost) by thor.cs.umass.edu (8.6.12/8.6.9) id DAA05762; Tue, 20 Feb 1996 03:12:18 -0500 From: lmccarth(a)cs.umass.edu Message-Id: <199602200812.DAA05762(a)thor.cs.umass.edu> Subject: Re: Internet Privacy Guaranteed ad (POTP Jr.) To: cypherpunks(a)toad.com (Cypherpunks Mailing List) Date: Tue, 20 Feb 1996 03:12:17 -0500 (EST) Cc: ipgsales(a)cyberstation.net (IPG Sales) Reply-To: cypherpunks(a)toad.com (Cypherpunks Mailing List) In-Reply-To: <Pine.BSD/.3.91.960219132531.301A-100000(a)citrine.cyberstation.net> from "IPG Sales" at Feb 19, 96 02:51:58 pm X-Mailer: ELM [version 2.4 PL25] Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-cypherpunks(a)toad.com Precedence: bulk ----- Message body suppressed -----

1 0

Returned mail: User unknown
by Mailer-Daemon＠wipinfo.soft.net 17 Dec '03

17 Dec '03

----- Transcript of session follows ----- 550 rajr... User unknown ----- Unsent message follows ----- Return-Path: <cypherpunks(a)toad.com> Received: by s.wipinfo.soft.net (4.1/SMI-4.1) id AA07898; Tue, 20 Feb 96 15:03:05 IST Received: from toad.com by relay3.UU.NET with SMTP id QQadse09618; Tue, 20 Feb 1996 04:11:46 -0500 (EST) Received: by toad.com id AA25259; Tue, 20 Feb 96 00:51:53 PST Received: from cs.umass.edu (freya.cs.umass.edu) by toad.com id AA25253; Tue, 20 Feb 96 00:51:48 PST Received: from thor.cs.umass.edu by cs.umass.edu (5.65/Ultrix3.0-C) id AA22177; Tue, 20 Feb 1996 03:51:45 -0500 Received: (from lmccarth@localhost) by thor.cs.umass.edu (8.6.12/8.6.9) id DAA02057; Tue, 20 Feb 1996 03:51:44 -0500 From: lmccarth(a)cs.umass.edu Message-Id: <199602200851.DAA02057(a)thor.cs.umass.edu> Subject: Re: Internet Privacy Guaranteed ad (POTP Jr.) To: cypherpunks(a)toad.com (Cypherpunks Mailing List) Date: Tue, 20 Feb 1996 03:51:44 -0500 (EST) Cc: ipgsales(a)cyberstation.net (IPG Sales) Reply-To: cypherpunks(a)toad.com (Cypherpunks Mailing List) In-Reply-To: <Pine.BSD/.3.91.960219132531.301A-100000(a)citrine.cyberstation.net> from "IPG Sales" at Feb 19, 96 02:51:58 pm X-Mailer: ELM [version 2.4 PL25] Mime-Version: 1.0 Content-Length: 3356 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-cypherpunks(a)toad.com Precedence: bulk I wrote: # Gee, why are we all so worried about key management ? It's just a load and # go installation at each of the user sites ! ;) ("That was sarcasm, son") IPG Sales writes: > That is precisely why PCX Nvelopes is such an extraordinary system. > That is the beauty of PCX Nvelopes, it lifts that burden from the > user, eliminates it entirely. You may have worried about key > management, but with our system, you will not have to do so in the > future. The system itself, manages all the OTPs, you do not have to do > anything but use the system. Key management is the problem with all existing > systems, but it is no problem at all with the PCX Nvelopes system, What protects each user's one time pads ("PCX Nvelopes", or whatever) ? Are they protected by an eight-character Unix account password ? (This would be harder for implementations on traditionally single-user platforms like the Macintosh and most of the Microsoft OSes, presumably.) Are they protected by a policy that says all users must lock away their IPG disks or CDs when not in use ? Also, how are they protected from the people who generate the one-time pads at IPG (and their friends and families) ? > as you > would see if you looked at the system, instead, of talking about something > when you have no idea at all of what it is about. As I said earlier, I read all your material and still had almost no idea at all about what it is. If you don't tell people about the system, it's extremely hard for them to do more than speculate. > The first set of keys > must be sent by a secure source, US mail, FED EX, or whatever, but > thereafter, all updates can be accomodated over Internet. Keys ? Wait a minute, #2 of the "Dozen Reasons why PCX Nvelopes is absolutely the finest Communication Security and Privacy system available", according to http://www.netprivacy.com/ipg/dozbest.html, is: "2. No Messy, Intrusive Passwords/Encryption Keys to get in your way and worry about, forget about those troublemakers" [...] > all hardware generation of OTP's are irregular, otherwise they are not > random. I'm not sure what you mean by "irregular" in this context. > Thus at times, a hardware source, such as ADC LOB system, can generate > nonrandom data, unless this is checked, it can destroyed the integrity of > your system. This doesn't quite jibe with my understanding of the typical use of a hardware RNG. From what I have read, one starts with an unpredictable bit source with some known bias, so that each original bit has somewhat less than one bit of real entropy. The bias is "corrected" by combining the original bits to get fewer bits with enough real entropy, and then repeating the process enough to get enough final bits of real entropy. Could you explain what the acronyms "ADC" and "LOB" mean here ? I just tried a web search for the two together, and all I got was a page of UFO acronyms, and some astronomical acronyms (LOB = Lick Observatory Bulletin). Schneier discusses hardware RNG at length in Applied Cryptography, but he doesn't mention either acronym. I might guess that LOB = Low Order Bits. -Lewis "You're always disappointed, nothing seems to keep you high -- drive your bargains, push your papers, win your medals, fuck your strangers; don't it leave you on the empty side ?" (Joni Mitchell, 1972)

1 0

Returned mail: User unknown
by Mailer-Daemon＠wipinfo.soft.net 17 Dec '03

17 Dec '03

----- Transcript of session follows ----- 550 rajr... User unknown ----- Unsent message follows ----- Return-Path: <cypherpunks(a)toad.com> Received: by s.wipinfo.soft.net (4.1/SMI-4.1) id AA09632; Tue, 20 Feb 96 15:42:56 IST Received: from toad.com by relay3.UU.NET with SMTP id QQadsh11578; Tue, 20 Feb 1996 04:51:09 -0500 (EST) Received: by toad.com id AA25879; Tue, 20 Feb 96 01:43:53 PST Received: from cs.umass.edu (freya.cs.umass.edu) by toad.com id AA25873; Tue, 20 Feb 96 01:43:48 PST Received: from thor.cs.umass.edu by cs.umass.edu (5.65/Ultrix3.0-C) id AA22591; Tue, 20 Feb 1996 04:43:46 -0500 Received: (from lmccarth@localhost) by thor.cs.umass.edu (8.6.12/8.6.9) id EAA06099 for cypherpunks(a)toad.com; Tue, 20 Feb 1996 04:43:46 -0500 From: lmccarth(a)cs.umass.edu Message-Id: <199602200943.EAA06099(a)thor.cs.umass.edu> Subject: Re: Remailers not heard from; info? To: cypherpunks(a)toad.com (Cypherpunks Mailing List) Date: Tue, 20 Feb 1996 04:43:45 -0500 (EST) Reply-To: cypherpunks(a)toad.com (Cypherpunks Mailing List) In-Reply-To: <2.2.32.19960219191757.006d763c(a)mail.aracnet.com> from "Bruce Baugh" at Feb 19, 96 11:17:57 am X-Mailer: ELM [version 2.4 PL25] Mime-Version: 1.0 Content-Length: 814 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-cypherpunks(a)toad.com Precedence: bulk Bruce Baugh writes: > And as long as I'm asking questions :-), I see that some remailers > (hfinney(a)shell.portal.com, hal(a)alumni.caltech.edu, homer(a)rahul.net) preserve > subject lines while others do not. Is this a readily settable option? If so, > I'd like to commend it to other remailer operators. If not, I'd be > interested in getting some sense of how difficult a hack it is. (Raph has authoritatively covered the space of deployed options already.) Writing code to keep or drop particular headers is trivial. Getting everyone who runs a remailer to deploy that code tends to be much harder. -Lewis "You're always disappointed, nothing seems to keep you high -- drive your bargains, push your papers, win your medals, fuck your strangers; don't it leave you on the empty side ?" (Joni Mitchell, 1972)

1 0