December 2003 - cypherpunks-legacy

Re: Contempt charges
by Moltar Ramone 17 Dec '03

17 Dec '03

> Message-Id: <199604100152.DAA25396(a)spoof.bart.nl> > To: cypherpunks(a)toad.com > From: anonymous(a)nowhere.goucher.edu (Senator Exon) > Comments: Please report misuse of this automated remailing service to > <remailer-admin(a)remailer.nl.com> Oooh... forged headers... forged to indicate they're coming from _my_ school. I wonder who _this_ could be... perhaps someone who has expressed anger at me on the list? Perhaps just a random choice? Perhaps me? (Not me, that I'll tell you...) > Borrowing inspiration from May, a page from Scheier and some code from > Gutman... Techniques from Detweiller, and lousy law from Jim Bell (I _wonder_ who might have posted this... :-) ) > Hard disk space being cheap now, Bob creates several distinct disk > partitions and uses Peter Gutman's Secure File System, or equivalent, to > encrypt all of them. [ ... ] >Practically, Bob cannot be forced to reveal the pass phrases to any >alleged remaining secret data, since this might not exist. To further >encourage this belief Bob might associate innocous data with a first pass >phrase, mildly embarrasing data with a second, and so on, and then, after >revealing the first, gradually allow himself to be be coaxed into revealing >the second and disclose a third only after the rubber hoses came out. > >Since all of the partitions have similar content, no statistic should >reveal which is which. Bob might have a bit refresher routine >periodically nibble read and rewrite the whole disk so that no >electronic characteristic exists that reveals record age. Sure, this will effectively hide the data; so will a plain old encrypted partition... >No doubt, a judge might whimsically keep Bob in jail for a while, trying >to assure that he has revealed all of the pass phrases, but the judge >can never be certain, even when Bob has disclosed everything. This >situation creates doubt that Bob is in contempt, even when he is, and >makes a prison term relatively pointless, unless for revenge. But that's what a contempt charge is _for_: "You're not treating me with respect, so I'm going to punish you." It might be described as being for a particular reason (ie supressing evidence), but each of those reasons ultimately boils down to lack of respect. In addition, were I handing down (or prosecuting) the contempt charges, I'd claim that the statement (even if it was made in public) that the individual didn't know all the keys in the first place was a lie, and that, by repeating the lie, they were purjuring themself. I am not a lawyer; however, I suspect that neither was the anonymous poster. In fact, I think I have a pretty good idea of who it was: someone on the list who: (1) Has recently been claiming that contempt charges were worthless, and that people should start ISPs, and pool money for insurance. (2) Has (probably) used this technique (at least once) before to create the appearances of support for one of his/her ideas which really has no support. (3) Might _possibly_ be upset with me (due to the headers...) I can't think of _anyone_ who meets THAT description, now can I? ;-) Jon ---------- Jon Lasser (410)494-3072 - Obscenity is a crutch for jlasser(a)rwd.goucher.edu inarticulate motherfuckers. http://www.goucher.edu/~jlasser/ Finger for PGP key (1024/EC001E4D) - Fuck the CDA.

1 0

Re: So, what crypto legislation (if any) is necessary?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:27 PM 4/9/96 -0800, jim bell wrote: >At 07:08 PM 4/9/96 -0700, Bill Frantz wrote: >>At 3:21 PM 4/9/96 -0800, jim bell wrote: >>>And the rest of us are tired of seeing those non-responses! >> >>I wish to state that Jim Bell does not speak for me. > >Tell me, what is the most exciting, interesting, and imaginative usage of >"Yadda Yadda Yadda" that _you_ remember, Bill? This will be my last post on this subject. Since Jim Bell ALWAYS has to have the last word on any given subject, he will continue to try to read something into my statement that is not there. I can not get much clearer than: I have not authorized Jim Bell to speak for me. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: No matter where you go, there they are.
by mccoy＠communities.com 17 Dec '03

17 Dec '03

At 8:53 AM 4/10/96, Hal is rumored to have typed: > Peter - didn't they say that the checking station is also listening > to the satellites? That way they can tell that you are playing back > signals that you taped earlier because they won't match what the > satellites are broadcasting right now. There is going to be processing and network delay involved here (unless Denning et al have figured out some way to communicate faster than the speed of light), so drift between the what you report and what the checking station and repeaters are hearing _at that time_ is inevitable. This is the loophole which allows Peter's attack, a loophole which cannot be closed (because the spoofer can always claim to be on a slower link than she really is and there is nothing the verifiyer can do to prove otherwise.) If I want to pretend to be closer to the receiver than my true location I simulate a slow link which gives me enough time to record what the signals would be at the near location and then quickly resend them to give the appearance of the spoofed location. In fact, I think that this really all boils down to trying to use GPS as a non-interactive proof of location, and the information posted about the system does not address the obvious attacks on such systems which are known from research into ZNPs. > If their authenticated repeaters are used then you have to assume the > checking station has all the satellite signals and again the best you can > do is pretend to be a Mole Man. The authenticated repeaters may collect all signals, _but the receiving station does not get them all at once_ because it will take time for the signals to propogate from the repeater back to the station attempting to determine location. Having all of the signals does not help the checking station other than allowing it to share a set of sats with the person attempting to authenticate. It still does not And perhaps more importantly, do you really want anyone you connect to on the net to know your location to the nearest 10 meters? What is Dennings fascination with building Big Brother? jim

4 7

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub ek"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut"; $remailer{"shinobi"} = "<remailer(a)shinobi.alias.net> cpunk mix hash latent cut ek reord"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{"gondolin"} = "<mix(a)remail.gondolin.org> cpunk mix pgp hash latent cut ek reord"; $remailer{"tjava"} = "<remailer(a)tjava.com> cpunk mix pgp hash latent cut"; $remailer{"pamphlet"} = "<pamphlet(a)idiom.com> cpunk pgp hash latent cut ?"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'gondonym'} = '<alias(a)nym.gondolin.org> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"treehole"} = "<remailer(a)mockingbird.alias.net> cpunk pgp hash latent cut ek"; $remailer{"nemesis"} = "<remailer(a)meaning.com> cpunk pgp hash latent cut"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)gate.net> mix cpunk latent"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 robo alpha) (gondolin gondonym) (flame hacktic replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: The remailer list now includes information for the alpha nymserver. Last update: Mon 13 May 96 6:45:35 PDT remailer email address history latency uptime ----------------------------------------------------------------------- mix mixmaster(a)remail.obscura.com ++++++++++++ 4:10:52 100.00% alpha alias(a)alpha.c2.org +.+++++++++* 49:42 99.99% haystack haystack(a)holy.cow.net -*#*##+--++* 18:17 99.98% exon remailer(a)remailer.nl.com *******+***# 2:48 99.98% lead mix(a)zifi.genetics.utah.edu ++++++++++++ 37:55 99.97% amnesia amnesia(a)chardos.connix.com _. --+----++ 12:19:41 99.83% flame remailer(a)flame.alias.net ---+---+-+++ 2:44:17 99.81% c2 remail(a)c2.org +++++++++++* 46:01 99.75% alumni hal(a)alumni.caltech.edu #-### #*#### 7:16 99.69% vegas remailer(a)vegas.gateway.com ###**-***##* 1:07:26 99.64% ecafe cpunk(a)remail.ecafe.org ###*###+## # 7:38 99.60% portal hfinney(a)shell.portal.com #-## -# #### 5:07 99.57% shinobi remailer(a)shinobi.alias.net ***+**+* +** 37:06 99.26% penet anon(a)anon.penet.fi _ .____. 66:02:55 99.01% replay remailer(a)replay.com +********+* 5:20 98.53% treehole remailer(a)mockingbird.alias.net ---+++-+-- 2:07:49 86.55% extropia remail(a)miron.vip.best.com --.---- 8:00:07 48.50% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: Free demo disk of "distorted number" crypto
by Mark O. Aldrich 17 Dec '03

17 Dec '03

On Fri, 10 May 1996, William Ono wrote: > On Fri, 10 May 1996, Mark O. Aldrich wrote: > > > technical. They are also offering a technical write-up via fax-back at > > 301.588.2162. > > I just called that number, but got no answer after ten rings. Could you > please verify it? I just checked it. It's working. It answered with the "menu" after two rings. Anyone else try using this thing? ------------------------------------------------------------------------- | Liberty is truly dead |Mark Aldrich | | when the slaves are willing |GRCI INFOSEC Engineering | | to forge their own chains. |maldrich(a)grci.com | | STOP THE CDA NOW! |MAldrich(a)dockmaster.ncsc.mil | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

1 0

Report on Smart cards
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Financial Times, 13 May 1996 Smart cards poised to mark revolution in data protection The poor image of the technology as "Big Brother's little helper" may be altogether undeserved, says Alan Cane The smart card -- a piece of plastic the size of a credit card with a computer embedded in it -- offers numerous benefits, but will force a re-evaluation of attitudes to privacy and data protection, says Demos, the independent think-tank. Its report, one of the first to analyse policy issues raised by the rapid proliferation of smart cards in areas such as finance, health and public administration, warns that the benefits will only accrue when people are confident the technology will not become "Big Brother s little helper", as the authors put it. Helpfully, Demos suggests policies to sidestep what it sees as a "sterile confrontation" between civil libertarians and authoritarian government and business interests in promoting the benefits of smart cards. "We have argued that people will trust in these technologies when they can choose anonymity where they want it and have greater control over the use of personal information held about them," say the authors. What distinguishes the smart card from other information technologies and gives it its power is the capacity to concentrate and manipulate a huge amount of information in a tiny space. A reading device is necessary to view the information, but smart cards compute as well as store data. Software can be incorporated to encode the data, rendering it unreadable to anyone without the right key. What can smart cards be used for? Their main use now is as telephone cards for public pay-phones, but they have the potential to identify individuals, to act as an electronic wallet for cashless shopping, and to provide a secure and portable information store. Medical histories could be stored on a smart card, for example, ready for recall by a doctor. Visionaries talk of virtually unlimited amounts of information distributed through society in a variety of forms -- the credit card model has been adopted for convenience rather than because of limitations inherent in microcomputers. Badges, pins and jewelry could all become "smart" accessories in the future. However, this sort of crystalgazing raises questions. For example, what information should be stored on a smart device? Who should be able to read it? The Demos researchers are critical of suggestions by Michael Howard, Britain's home secretary, that a smart card could be used as a national identity card: a government-issued, multi-functional card, with the populace having little or no choice about which applications were available on the card -- and perhaps no say about the privacy system employed. Regulation of the privacy system -- encryption -- is important. It is comparatively easy to devise encryption methods which are almost impossible to break within a reasonable period. That worries governments fearful of being unable to unpick communications from terrorists and the like. The US has attempted to forbid the export of the more powerful US cryptography systems. The Demos researchers argue that such tactics are counter-productive. They favour a private "key escrow", a system where cryptography users deposit the key to their system with a trusted private registry, approved and regulated by governments. "Government law enforcement agencies would have to obtain a court order on the basis that they had strong reason to believe that an individual or company that had escrowed their keys ... was guilty of some crime". The report proposes a radical reform of data protection legislation through some 10 supplementary conditions. Data users, for example, would have to get express consent from individuals for the use to which they would want to put the data. Rules on disclosure to third parties would be tightened, so that data users would have to receive specific permission from a data protection registrar in order to gain access to specific information. It argues that individuals should be able to choose the card they want, and decide what information and applications will be loaded. "Where [Michael Howard's] card is an essentially authoritarian instrument, our proposal is for a more market-based instrument in which the role of government is to align the incentives within the market to ensure privacy, trust and individual access and control," says the report. - On the Cards, by Perri 6 and Ivan Briscoe. Demos, 9 Bridewell Place, London EC4V 6AP. UK9.95. -----

1 0

Re: Mandatory Voluntary Self-Ratings
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 03:45 AM 5/13/96 EDT, E. ALLEN SMITH wrote: > the conservatives won't let people just rate > "objectionable" material in order to keep it from them. They want it off the > net/world whether or not it's rated. In the course of channel surfing, I have once or twice come across the Christians ranting about pornography. They have both legitimate and illegimate complaints, but mainly they emphasize the legitimate complaint. PICS addresses this legitimate complaint. Should cut the volume down considerably, or else force them to drop the hypocrisy, if indeed they are hypocrites. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Civil liberties of employees (Re: FYB_oss)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:15 AM 5/13/96, E. ALLEN SMITH wrote: >From: IN%"tcmay(a)got.net" 13-MAY-1996 00:55:07.93 > >>Actually, one _does_ check one's Constitutional rights "at the door" (of an >>employer), and the confusion over this issue is pervasively destroying real >>Constitutional rights. > >>For instance, if I hire someone, I can require him or her to wear a >>uniform, to not wear blue jeans to work, to not smoke (or even to smoke, if >>this is what the job involves), to take off his or her clothes, to tap >>dance, to not say anything to my customers, and on and on. If the >>government required these behaviors, this would be a legitimate issue, but >>not if employers set these conditions as terms of continued employment. > > In general, I agree... but one important point to make is the contract. >If the contract says that you can require the employee to tap dance, then you >can require the employee to tap dance. If the contract _doesn't_ require the Sure, I agree that _contracts_ can make a difference. But note that contracts are not a requirement of employment: I can, for example, hire someone to rake my leaves. If he decides that manual labor violates his "civil rights," I can give him the boot. No muss, no fuss, no contracts. (But contracts are of course possible. Enforcement of the terms is another matter. By the way, I think enforcement of such contracts should be handled outside the normal legal system, and paid for by the parties using the system.) --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

PGPShell & Eudora
by Michael E. Carboy 17 Dec '03

17 Dec '03

While trying to solve a corrupted clearsig problem with Eudora 2.2 and PGPShell, I noticed comments in the c-punks archives on this same problem. I wanted to pass on that Aegis Research's PGPShell "Beta4" version solves the problem and does "preprocess" the message before signing so that Eudora won't wreck it. The shell can be downloaded at http://aegisrc.com. It is self-extracting and, if installed in your existing PGPShell directory will create a subdirectory named "Pretty~1" (no, I am not kidding) and then install the new .exe there. Regards, MEC Michael E. Carboy carboy(a)hooked.net carboy(a)carboy.com Key fingerprint = C9 E9 79 12 43 76 A2 DB 1A 72 FD 04 F2 03 6F 8A -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzDwxdIAAAEEAMmDaOXoZczvK4R7vH7ql+0sY/oHyqdtsjuOG8jbObnFjh2N jh3TAxyXGb83xmsm6Eb6muXf6oZJdTIzO7UuSwKh+afLg6un+LU7S/VTFTUf4QNq T1e2jZxcr33SFUxiKN7q83GkZhHyY1EeM/O8pGX+JhMANMv7gf9JSEYWhfvhAAUT tCVNaWNoYWVsIEUuIENhcmJveSA8Y2FyYm95QGhvb2tlZC5uZXQ+iQCVAwUQMPDG Lv9JSEYWhfvhAQF2VQQAqMj60pWt3+jZow8q/DFiM9Jw73rii2deJwfdju9vGWgU S6Se5TegVYlti8mWLF+mRSldEnRIKZs7mycW9YlVmfxa+uM2sTceoDIACkZy1MWF ULLeIzFDreR2YZLAVMQ4ToWTkRS2T+/jM8RQEMakPCYDIKBzCIuRQ7J+jmpR+Fs= =79nx -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Transitive trust and MLM
by eli+＠GS160.SP.CS.CMU.EDU 17 Dec '03

17 Dec '03

In article <+cmu.andrew.internet.cypherpunks+UlYwNe:00UfAM107VG@andrew.cmu.edu> EALLENSMITH(a)ocelot.Rutgers.EDU writes: > The different paths going through those different signatures will be >correlated/non-independent, yes.... but that isn't the problem unless you're >considering multiple paths (in a more complicated version). To determine key validity, you do have to consider all paths. If a single trusted path to the bad key exists, the attacker wins. > IIRC, there have been some sociological studies showing that _everyone_ >is linked through 6 or so people. Milgram's "small world" experiments used a much looser sort of "link" than we want here. It would be certainly interesting to know how large a difference this makes. > Now, there's the question of whether you _need_ to be linked to everyone - > [...] I see nothing wrong (and am in favor of) separation of the > elite from the masses. Gee, let me guess which group you're in... I'll go with "people I want to talk to" versus "people I don't want to talk to", thanks. It's true that you don't need to talk to everybody. The problem is that I might want to talk to people whom I don't know personally, but know by reputation, or by function ("DEA Rat Hotline" -- well, maybe not). -- . Eli Brandt usual disclaimers . . eli+(a)cs.cmu.edu PGP key on request . . violation of 18 U.S.C. 1462: "fuck".

3 2