December 2003 - cypherpunks-legacy

Re: CERN Web Proxy
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >> CERN = http://www.cern.ch:911 > >Error 403 > >Forbidden - by rule > > >CERN httpd 3.0 This is what you get if you interpret the above as a URL...which makes sense since that was how it was posted. What it really is is the host name and port name to configure your Web browser so that all your HTTP traffic is funnelled through CERN first, and then relayed from there to the destination. I don't know how Mosaic supports this, but under Netscape for Windows, it is under Options | Preferences | Mail and Proxies | HTTP Proxy. While this doesn't provide complete anonymity, it does prevent your email address, site name, etc. from appearing in the log files of the HTTP server you are connecting to. I'm not sure why CERN has this running, but it is pretty usefull nonetheless. == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)aeinet.com -Isaac Asimov -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLywpCk1Diok8GKihAQHH+AQA4EG9IPrwZ76iLggvbyjaBRLiDETzTjyz ljz87cOeAZ/sXevexPRD3RDzkSzOGRfbsFHEEV6gNI1q+35saJYCCVMdxCZUggeO xIIkCg+lTC6vMjj4JLQ5nLH2yZX2na3DjeR5/vidaSw2oEEUM0n06e6XnXS19mZ9 /ggmzfYtt1U= =hxmC -----END PGP SIGNATURE-----

1 0

ESP -> ESM
by Matt Blaze 17 Dec '03

17 Dec '03

I've just been informed that there's a reasonably confusing name collision between my ESP and a working name for IPSP. Grumble. I'm easy. ESP is now called ESM (encrypting session manager). Everything else is the same. -matt

1 0

Data Bank Protocols
by norm＠netcom.com 17 Dec '03

17 Dec '03

See ftp://ftp.netcom.com/pub/Si/Silk/DataBank.txt for updated proposal for DataBank protocols. I have addressed, to a degree, points made by Eric, and corrected the blunders pointed out by jpp(a)markv.com. I am glad to e-mail this to anyone for whom ftp is awkward. Thanks all.

1 0

Re: Why encrypt intra-remailernet.
by Hal 17 Dec '03

17 Dec '03

Of course it was Chaum himself in his 1981 paper (which I think is available from the CP FTP site) who described the duplicate-message attack. I don't see that inter-remailing encryption helps much, because the attacker can still notice that whenever they inject message A, _something_ goes to Bob. The real solution, as Chaum pointed out, is that the remailer must reject duplicate messages, even when separated by days. Doing this without keeping a database of all messages ever sent is left as an exercise. Another aspect worth mentioning is that message splitting can make the kinds of statistical correlations that Wei Dai was looking at more of a danger. It's one thing if I send a message along with thousands of other people, and Bob gets a message along with everyone else. But if I send 10 messages and Bob gets 10 from that batch, that fact alone can help to link us up. So splitting my big message into 10 standard ones isn't that great if they're all sent at once. Ideally you'd want to dribble them out at some standard rate, a rate at which you always send a message whether you have something to send or not. But this may introduce unacceptable latency. Hal

1 0

Re: Remailer Specs
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

>In article <Pine.SUN.3.91.950128194321.1158A-100000(a)unix2.netaxs.com> >grendel(a)netaxs.com (Michael Handler) writes: >>On Sat, 28 Jan 1995, Rhys Kyraden wrote: >> >>> Since I have begun the project of writing the Remailer for the Mac, >>> I suddenly realized that I do not know exactly what is expected of it, and >>> therefore would like some pointers to the specs of a remailer (I have seen >>> references to padding and splitting but do not know what this is nor how to >>> implement it.) >> >> I've started work on a formal remailer standards document that >>describes just how a Cypherpunk Type I remailer should process messages, >>with full header descriptions, etc. After I've checked it against the >>behaviors of all the various Cypherpunk remailer packages (Ghio vs Eric >>Hollander vs Sameer vs Mixmaster in compatibility mode vs whatever else), >>I'll post it here for comments. > >Cypherpunk Type I? Ok, what are the other types? Should there be a >type specification like there is for RAID, or the Body Armor Threat >levels? > <SNIP> >---------------------------------------------------------| >| #include "std/disclaimer.h" Michael P. Brininstool | >| mikepb(a)freke.lerctr.org OR mikepb(a)netcom.com | >|--------------------------------------------------------- He spicifies type 1 to differentiate it from what I have been calling type 2,the message format used by mixmaster remailers. Essay on Mixmaster available on my WWW page. -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Check out my essay on the next generation remailer Mixmaster on the WWW page. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

Re: alt.religion.your.operating.system.sucks
by daleh＠ix.netcom.com 17 Dec '03

17 Dec '03

You wrote: >The only real barrier left to UNIX becoming the OS of choice is >commercial app support (things like word processors and etc. becoming >readily available and inexpensive). I don't mean to toss gasoline onto this fire, but...... Unix as we know has a vanishingly small probability of ever becoming 'mainstream'. There's a two-orders-of-magnitude gap between the installed base of Dos/Windows and that of Unix. That gap has grown, not marrowed over time. This is however no reflection on the obvious technical merits of Unix. Market dominance is based not on technical superiority, but rather on technical sufficiency. Once an OS acheives technical sufficiency any further technical improvements will have a diminishing marginal effect on that OS's market performance. Once the OS is technically sufficient, non-technical factors begin to dominate. The market failure of WinNT is a classic example of this. Its failure is unrelated to its technical merits (or lack thereof), but rather on econmic and social factors the even a company withe the marketing muscle of MicroSoft has not yet been able to overcome. (OS/2 is of course an example of an even more dismal, perhaps terminal, failure for many of the same reasons.) Dale H.

3 2

Re: alt.religion.your.operating.system.sucks
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Spif wrote: >UNIX? user hostile? where have you been lately? Well, maybe unix gets its reputation for being hostile because of things like * many commands don't work fully (find, for example) * a large portion choke on input that isn't "expected" * many more do extremely poor input checking, * the configuration files are bizarre * different version have command with different options (stty everything, ps -ef vs. ps -aux, etc.) * each version is slightly different (ever try porting a non-trivial program? Look at some available large software and examine the #ifdef #define #endif statements; look at the differences in system calls. Hell, look at the "config" program that comes with PERL - 80K of stuff to build a make file for the flavor of UNIX you are using!) * the commands don't combine well (often uuencode + sendmail == garbage) * many commands accept a slightly different regular expression syntax than the shell does * the commands aren't built with ease of use in mind. For example, to kill a process under unix requires that I know it's process id. How do I find that? Run another command... > ever hear of X windows? X-Windows is an extreme pain to get working. Sure, if you buy your unix workstation the manufacturer will pre-install it. Just try setting it up from scratch.

7 6

Re: alt.religion.your.operating.system.sucks
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Spif wrote: >so your point, basically, is that the public will settle for whatever it >can get, and get easiest and cheapest, when it comes to software and >operating systems in particular. It always puzzles me that people on the net spend so much time griping about Microsoft when the net tends towards libertarianism. I would think libertarians would welcome Microsoft's dominance, as a validation of the free market in action. I'm not saying you are libertarian, of course. "Dos/Windows + applications available for Dos/Windows" are obviously blowing out "unix + applications available for unix". Normal people don't give a damn if source code is available for "power tools" like PERL, sed, grep, wc, bc, strip, yacc, lex, puke, barf, etc. They want to cut and paste their spreadsheet charts into the word processor they use, and email it to coworkers. >certainly a growing market for internet-capable systems OS/2 is internet friendly, Windows 95 will be friendly, etc. Certainly unix will let you do more, but most people won't care about the value of the extras, as long as a web browser, news reader, and mail reader is available. Some people on this list swear they never have to drop to a command line with the cool tools they use with their SLIP accounts (except to change their password). If that's true, then any "advantage" unix has is washed away. How will the unix market grow (relative to other more popular OS's) if internet access tools run the same on Windows and OS/2 and Mac's as they do on unix?

3 2

"bad" government
by rkmoore＠iol.ie 17 Dec '03

17 Dec '03

>From: erc(a)s116.slcslip.indirect.com (Ed Carp [khijol Sysadmin]) >Governments as a whole are seen to be "bad" because they invariably undermine the right of the individual to make choices for themselves. Quite untrue. It's society which provides you with an environment in which you have choices. And its government which orders that society. It's because government has served you so well, that you have luxury to fantasize you don't need it. You're being duped. --- >The so-called "Third Wave" has nothing to do with government and everything to do with the empowerment of the individual. Some seem to not recognize that. The "Third Wave" -- if you take the PFF's Magna Carta definition (and Toffler is one of the authors) -- is a power grab by corporations to return the world economy to status of the USA economy in the 1880's. You so-called libertarians might like the theoretical, abstract formula of "unregulated capital", but if you'd put down your Friedman long enough to read history, you'd know that it was a disaster. Unregulated capitalism is incompatible with a civilized societiy. --- >This has always been the case throughout history - the forces of dark, of disinformation, have always attempted to keep true power from the hands of the people. So why are you on the wrong side? -rkm PS> If this list would like to see the full Magna Carta, or my analysis/review of it ("Electric Dreams" sent you a few clips), please let me know. --- Richard K. Moore - rkmoore(a)iol.ie - Wexford, Ireland - fax +353 53 23970

3 2

Smart Card architecture
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've been searching around the 'net looking for online references to the actual protocols and methods used in smart card user authentication, but have found very little. I understand from reading Schneier that there are several established protocols to demonstrate knowledge of some secret without leaking any information about this secret. Is this how these (smart card) systems work? The Nov. '94 issue of 'Communications of the ACM' has an article about using smart cards to store secure OS kernel and user configuration information (I imagine both Unix _and_ Windows :), which is fascinating to read, but doesn't delve into these technical details. It seems that the there are a myriad of rather innovative applications for these things. What is the state of this technology today? I understand there are working systems for use with credit transactions and telephone billing. Who are the major players in the marketplace, what types of standards have evolved to describe the interfaces they use, and what kind of Cypherpunk interest is there in these products? What kind of realistic attacks exist that would compromise the security offered by smart cards? Guess I'm just interested in some good pointers to information (online or written) that could give me a grasp on the technical details. Thanks, Johnathan Corgan == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)aeinet.com -Isaac Asimov -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLyyGmk1Diok8GKihAQE6MQP/dPRmR4X8p459WvgwTiiL+zO/oq1zyE2E KxD/1JEQ4e6MC7tGNiPktvXqFXtv5JgXxbPhWkUZTQjkEyMulDCv2h0hUGySdiHx Zq4lvCtCRRdb6r5O+tQJQpCbCW3NRsx3A6yJPK2YvH1lYRciDlMdWDQyGAGefuUN xO6jMEGnGEw= =9RjV -----END PGP SIGNATURE-----

2 1