December 2003 - cypherpunks-legacy

Re: (Fwd) Gov't run anon servers
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Mar 04, 1996 15:11:43, 'tcmay(a)got.net (Timothy C. May)' wrote: > >At a Cypherpunks meeting a couple of years ago we spent some time >brainstorming this. It seemed plausible that a small outfit could make such >"remailer boxes" and sell them cheaply. (Hardware prices have plunged even >further.) > I had written on similar things over the past few months, on the "$20 Mixmaster" post. New hardware drives with replaceable media in the 100+ Mb range has developed. The Syquest 135 Mb drive, featured in the latest issue of _PC Mag_ can, with the parallel port version, reportedly boot. This means one can have the drive that weighs about two pounds and a $20 disk, place another OS on the disk, and have a very portable remailer system. I viewed the whole thing as more geared to the amateur market, whereby jr. high school students and the like could set up their own remailers, known only to a "small circle of friends." T.C. May's theory of the commercial "mom and pop" version is just as valid. One major way to "increase the noise level" is to greatly increase the number of remailer, especially small ones that may come and go based on little more than word of mouth advertising. Imagine two scenarios. In scenario one, the are two or three large xerox stores in a city. All advertise in the yellow pages and are known throughout the city as the place you go to have your xeroxing done. They all do a tremendous volumn of business. In scenario two, there are an enormous number of small stores with xerox machines, large numbers of home offices with the machines, and large numbers of people with word-of-mouth knowledge of friends with machines to use. What society is easier to crackdown on? --tallpaul PS: A week or two ago, someone posted a notice of anon remailers under Windows that was in alpha test and due in beta in about a month. Same thing. Same benefit.

1 0

FW: Communications Decency Act (hee-hee)
by blanc 17 Dec '03

17 Dec '03

Had to share this funny bit with y'all...... .. Blanc ---------- From: William Pickard[SMTP:bpickard@pickard-murphy.com] Sent: Sunday, March 03, 1996 6:07 PM To: Mark Anderson Subject: Communications Decency Act Scott Adams, the author of Dilbert, contributes this to the debate: Communications Decency Act -------------------------- The government of the United States has passed a law which makes it a crime to transmit indecent materials over the Internet. As a citizen of this great country I plan to fully comply with that law. >From now on, whenever I get the urge to use an offensive word in e-mail I will substitute the name of an offensive politician. I urge you to do the same. The beauty of this approach is that they can't easily ban these new naughty words without changing their own names. I know I could get in trouble for suggesting such a thing, but I don't give a flying Clinton what they think. And if they don't like it they can come over here and kiss my Gingrich. William Pickard bpickard(a)pickard-murphy.com Pickard & Murphy, Inc. Telephone (206) 323-5979 3213 East Alder Street FAX (206) 860-4877 Seattle, Washington 98122-6314

1 0

Re: Is there any work on entropy-lowering schemes?
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:46 PM 3/1/96 -0500, Mutant Rob <wlkngowl(a)unix.asb.com> wrote: >I'm wondering if anyone has done any work on schemes to lower the >entropy of a given stream. Why? Save you've got message M encrypted >with a good cipher, but you're worried that it can be detected because >even with stego, the entropy is a lot higher than normal 'random' data >flowing through a network. Peter Wayner's work on Mimic Functions does just this sort of thing. You can describe a grammar, feed it random bits, and generate output that has the right statistics and can be reversed to get the original bits. His paper was on cs.cornell.edu a few years ago; don't know where to find it now. AltaVista yields a reference to the paper in Cryptologia, and the Cyphernomicon has the following: - "They encode a secret message inside a harmless looking ASCII text file. This is one of the very few times the UNIX tools "lex" and "yacc" have been used in cryptography, as far as I know. Peter Wayner, "Mimic Functions", CRYPTOLOGIA Volume 16, Number 3, pp. 193-214, July 1992.[Michael Johnson, sci.crypt, 1994-09-05] (When I read the Cryptologia reference on my browser, I don't get the ligature in the middle of "Huffman coding"; YMMV. :-)

2 1

Re: Duress
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:38 AM 3/4/96 +1000, Greg Rose wrote: > At 2:49 PM 3/3/96 -0500, Dr. Dimitri Vulis wrote: > One of the private pilot magazines reported that a small plane operator > used the code (because his airplane was, in fact, being hijacked). When he > landed the airplane, it was surrounded by LEA, and in the ensuing gun > battle, everyone on the airplane died. The went on to say that the safety > of the passengers and airplane are the pilot's primary responsibility and > that pilots should consider this incident when deciding to use the code. > >Actually, that is an urban legend which grew out >of a real incident. What actually happened was >that they thought the private pilot couldn't >really have been hijacked, so when he landed *he* >was arrested for creating a public nuisance or >something. It wasn't till later, when they found >the shotgun-toting druggie, that they believed >him... > >Greg Travis was the pilot's name, I imagine >AltaVista might find his original posting. My posting, not Dr. Dimitri Vulis'. I certainly don't remember your version as the one I personally read. The magazine could have been wrong, but I don't think my memory of the article is far enough off for them to be the same incident BTW - I think the magazine was "Flying". Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: Truelly Random Numbers
by Bill Stewart 17 Dec '03

17 Dec '03

>At 10:11 AM 3/3/96 -0500, Gary Howland wrote: >>Surely the process of counting up until you get a prime means >>that the chances of getting certain primes are greater than >>others (eg. 17 is more likely than 19) ? At 11:07 AM 3/3/96 -0800, jamesd(a)echeque.com wrote: >In order to use this information, one would need to determine >the number of primes in the vicinity of a potential prime factor. >This costs more than actually checking for the factor, hence is >not useful. The discussion has been about probability of collisions, rather than usable exploits - they're still rare enough that it's a birthday-problem issue. While you're more likely to pick a specific prime with a large gap before it than one with a small gap before it, there are a lot more small gaps than large ones, assuming that primes are roughly uniformly distributed within any given range (which is roughly true) and that therefore the gaps are geometrically distributed. I worked an example for random 384-bit primes, which you'd use to generate 768-bit RSA keys. The density of primes is approximately 1/ln384 = 1/266 = 1/meanlength. The unweighted quartile gap lengths are 77, 186, and 372. The weighted quartiles for the gaps are 255, 447, and 720 ; these correspond to unweighted cdfs of 61%, 81%, and 93%. So, yes, it's a bit skewed (and enough that I'd rather not work the birthday problem math, which is far easier with uniforms :-) But it's probably not skewed enough to affect the number of primes required for a collision to occur by more than a factor of 100 or so, and collisions in RSA keys require collisions in both primes.

1 0

TER_ror
by jya＠pipeline.com 17 Dec '03

17 Dec '03

EcoMist, March 2, 1996: "What is terrorism? The use of terror is more widespread and effective than is generally recognised." A special essay that weighs military action, guerrilla warfare and terrorism. TER_ror ----- This issue also presents "in the mind of the terrorist," "a new plan for Ulster" and "Israel, Palestine and Hamas."

1 0

Re: Jump Start ecash With IPhone
by Declan B. McCullagh 17 Dec '03

17 Dec '03

When thinking about ecash-supported net.telephony, consider the attached message. -Declan ---------- Forwarded message begins here ---------- Message-ID: <wlDDHkW00YUvAyuyMw(a)andrew.cmu.edu> Date: Tue, 5 Mar 1996 21:14:08 -0500 (EST) From: "Declan B. McCullagh" <declan+(a)CMU.EDU> X-Andrew-Message-Size: 3344+0 To: Fight Censorship Mailing List <fight-censorship+(a)andrew.cmu.edu> Subject: Long distance companies demand FCC net-regulation If the religious right doesn't succeed in pushing FCC Net-regulation with the cyberporn excuse, the long-distance giants will succeed by whining about I-Phone. I am starting to think that FCC regulation of the Internet is almost inevitable. With net-phone projects like Free World Dialup being covered in the New York Times, it may just be a matter of time. -Declan ---------- Forwarded message begins here ---------- FCC PETITIONED TO STOP MISUSE OF THE INTERNET! WASHINGTON, March 4 /PRNewswire/ -- The America's Carriers Telecommunication Association (ACTA), a trade association of competitive, long distance carriers today petitioned the Federal Communications Commission (FCC) to stop companies from selling software and hardware products that enable use of the Internet to voice long distance services. A growing number of companies are selling software programs with ancillary hardware options that enable a computer to transmit voice conversations. This, in fact, creates the ability to "by-pass" local, long distance and international carriers and allows for calls to be made for virtually "no cost." For example, on-line service providers generally charge users around $10.00 for five hours of access and then around $3.00 for each additional hour. Five hours equals 300 minutes, divided by $10 is 3.3 cents per minute. The average residential long distance telephone call costs about 22 cents per minute or seven times as much. The Internet is a unique form of wire communications. The rapid growth of the Internet is stressing the capacities of the Internet itself. The Internet access points are growing at 50% per month with subscriber growth running close to 30% per month. Individuals are accessing the Internet for more and more business applications such as market research, news, and advertising with corporate web sites exploding, to say nothing about using the Internet for E- mail applications. ACTA submits that it is incumbent upon the FCC to exercise jurisdiction over the use of the Internet for unregulated interstate and international telecommunications services. Long distance and international carriers must be approved by the FCC to operate and must file tariffs before both the FCC and state public service commissions. All of these requirements are stipulated in the Communications Act of 1934 and the Telecommunications Act of 1996. Technology may once again be surpassing government's ability to control its proper use. However, the misuse of the Internet as away to "by-pass" the traditional means of obtaining long distance service could result in a significant reduction of the Internet's ability to transport its ever enlarging amount of data traffic. Therefore, ACTA has petitioned the FCC to define the type of permissible communications which may be effected over the Internet. America's Carriers Telecommunication Association was founded in 1985 by independent long distance companies to serve the needs of small businesses and to advance the goals of more effective competition. ACTA's membership today includes over 130 companies engaged in providing telecommunications services. CONTACT: Charles H. Helein, general counsel, 703-714-1301, or Jennifer Durst- Jarrell, executive director, 407-332-9382, both of America's Carriers Telecommunication Association

1 0

key security for anon remailers
by Bill Stewart 17 Dec '03

17 Dec '03

We've been discussing the security problems with leaving your PGP key around on anonymous remailers. Mixmaster and the ghio2 remailers have the key compiled in, but at least for ghio2 the string is sitting there unencrypted and unmasked in the binary, where somebody who can access the binary can run "strings" to steal it, without even the bother of decompiling :-) The primary alternative is to start up the remailer with the PGP passphrase in its environment, but doing that has its problems - the ghio2 remailer is made to run as a batch process called for each message, rather than a permanent listener, and if you did something like put the key into the sendmail daemon's environment, it'd probably be even easier to steal (e.g. anybody on the machine could do it by setting up their own mail-processor.) A minor hack that I do with my remailer is to keep two versions of the source - a vanilla one for distribution, and one with all my customized information that I actually compile and run. So how can you keep a persistent process that isn't part of the mail empire? One approach is to have a remailer daemon using sockets or named pipes that does the decryption and feeds mail to a remailer process (which _it_ calls) for delivery or has its own builtin remailing - you'd input the key to the daemon when you start it up, and wouldn't need to leave it in a file or environment, just in the executing process itself. Probably an hour's hack using PGP3.0, or you can grind up the current I/O routines for PGP 2.6.2 and ignore the fact that you void your RSAREF license that way. You'd have to get rid of some of the code that overwrites the passphrase and other sensitive data, though. Another approach is to have a separate box that's not on the network that the remailer runs on (obviously this is easier on a machine you've got at home or work rather than at an ISP...) You can take that old 8086 or 386, run a daemon to accept files on the serial port and return them to the mail system on the serial port. Uucp is probably secure enough. (Does PGP run on Minix, or on any of the old Xenix or Venix operating systems? It's probably easier to build workable communications daemons on one of them than on DOS, though there are DOS uucp and kermits that you could hack up. For a 386, Linux is the obvious choice.) Since the entire remailer would be running on the box, and you don't permit logins from the serial port, it's probably pretty secure, even against someone with root on the network-connected machine, assuming all your traffic is encrypted.

1 0

Re: Truelly Random Numbers
by eggplant＠inlink.com 17 Dec '03

17 Dec '03

>-----BEGIN PGP SIGNED MESSAGE----- > >Tim Fulbright wrote: >> >> Now I, a lurker for two months, am truelly confused! L. Deitweiler must be >> right. Surely one of you cyperpunk fellows could hack together a >>dongle with >> some kind of AD converter and buffer ram to gather a Truelly Random Bitstream >> off the environment every couple of milliseconds easier than this raindrop >> scheme or recording the fan, you're haviung me on!. Let's go back [..] > >The raindrop scheme was (politely) laughed off. As for the fan recording >scheme, it's a good make-do-with-what-you-already-have method, as opposed >to buying and/or building a card. > >A 'simple AD converter' isn't so simple. Especially if you want to be >sure you really have random noise and not something else that just looks >random. >- --- >[This message has been signed by an auto-signing service. A valid signature >means only that it has been received at the address corresponding to the >signature and forwarded.] > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 >Comment: Gratis auto-signing service > >iQBFAwUBMTz0nSoZzwIn1bdtAQGl6QF+P1V62qg+Mf5K+VN3q0Y1e6/A4EO4uLLr >WNxAbtE+OxQXFKnP7ajFUFBbnDLJxLmx >=4ysY >-----END PGP SIGNATURE----- Actually, I remember reading somewhere, a long time ago though, that the NSA had come up with an almost undoubtably random sequence by using random high altitude RF signals, scanning a certain frequency I guess. Then using it as the random number. Given the amount of RF transmisions world-wide and the addition of high-altitude interference, it should be completely random. Unless someone were to get their hands on you copy of it or happened to be hooked up to your reciever at the time of recording, there is no way they could figure it out. -- "... In Germany they first came for the Communists and I didn't speak up because I wasn't a Communist. Then they came for the Jews, and I didn't speak up because I wasn't a Jew. Then they came for the trade unionists, and I didn't speak up because I wasn't a trade unionist. Then they came for up because I wasn't a trade unionist. Then they came for Catholics, and I didn't speak up because I was a Protestant. Then they came for me-and by that time no one was left to speak up..." Pastor Martin Niemoller ++++++++++++ ************************************** * Matthew Murphy ------------ eggplant(a)inlink.com * ---------- * http://www.inlink.com/~eggplant * The Web page is under construciton at this time though.. * Please don't mind the mess.... * ************************************** ++++++++++++ finger eggplant(a)inlink.com for my PGP key.

1 0

St. Louis Cypherpunks
by eggplant＠inlink.com 17 Dec '03

17 Dec '03

I'm lookig for people who live in the St. Louis area who are interested in computers in general and the internet specificly. If you could drop me a line, I would be most appreciative. Thnx in advance.... -- "... In Germany they first came for the Communists and I didn't speak up because I wasn't a Communist. Then they came for the Jews, and I didn't speak up because I wasn't a Jew. Then they came for the trade unionists, and I didn't speak up because I wasn't a trade unionist. Then they came for up because I wasn't a trade unionist. Then they came for Catholics, and I didn't speak up because I was a Protestant. Then they came for me-and by that time no one was left to speak up..." Pastor Martin Niemoller ++++++++++++ ************************************** * Matthew Murphy ------------ eggplant(a)inlink.com * ---------- * http://www.inlink.com/~eggplant * The Web page is under construciton at this time though.. * Please don't mind the mess.... * ************************************** ++++++++++++ finger eggplant(a)inlink.com for my PGP key.

1 0