December 2003 - cypherpunks-legacy

Re: Rumor: DSS Broken?
by Tim Dierks 17 Dec '03

17 Dec '03

At 6:41 PM 5/18/96, Bill Stewart wrote: >>I was talking to someone who was talking to someone (have I said this is a >>rumor yet?) who was solicited for comment by a Very Famous Reporter about >>the fact that DSS, the Digital Signature Standard, promulgated by NIST, I >>believe, had been broken. > >MD5 is at least weakened, maybe broken; there's an abstract by Hans Dobbertin >that says something about generating collisions, and gives an example DSS uses SHA, which isn't affected by the Dobbertin finding. I believe that you would have to solve the discrete logarithm problem to break DSS; this would imply being able to break Diffie-Hellman and a number of other crypto algorithms. (However, I'm not certain that it's been shown that breaking DSS is equivalent to breaking discrete logarithms.) - Tim Tim Dierks - Software Haruspex - tim(a)dierks.org "That's the trouble with technology. It attracts people who have nothing to say." - Muffey Kibbey, mother [Wall Street Journal, May 10 1996]

1 0

RE: The Crisis with Remailers
by blanc 17 Dec '03

17 Dec '03

From: Bruce Baugh >hence my comments from here from time to time that the technological >problems of anonymity are not the true obstacle to widespread use. >there are deeper problems that cpunks skirt around but fail to grasp >because of numerous prejudices. While I hate to lend support to anyone as much a twit as Vulis is, he's got a point here. I don't think most cypherpunks realize how anonymity is perceived out in the net at large. ...................................................................... Bruce: Vulis is not the twit who wrote that paragraph. Vulis is not Vlad. Vulis: "Vlad" is not Vlad. You all need to go out to LD's web site and refresh your memory. .. Blanc

2 1

Instant Remailers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:38 AM 5/19/96, Mark M. wrote: >It is possible for someone to operate an anonymous remailer anonymously. >Just get a UNIX shell account under a fake name, pay with cash, and set up >the remailing software. The identity of the operator of such a remailer >would be difficult, if not impossible, to discover. I'm always surprised that this hasn't been happening; maybe it will when the new clients become available. (Doesn't Sameer's system offer such accounts? Couldn't there be dozens of remailers based at c2.org? Of the 16 Type-1 remailers listed in one of Raph's recent reports, only 2 were at c2.org.) Now, can a site which "offers" such accounts be held liable? If the site drops an account when presented with _appropriate_ legal papers (a court order, such as an injunction), and if it takes a "hands-off" policy with respect to what customers run in their accounts, then it ought to be safe from actual liability. (I am not a lawyer, but it seems that having no prior knowledge of acts committed, and complying with court orders, reduces the likelihood of successful suits to near zero. Note that Netcom did _not_ cancel the COS-related accounts, and so extended its legal hassles.) The advantage of "pliable" remailers (which go away when hit) is that: Cost of preparing case to stop a remailer >> cost of setting up a new remailer Thus, it might cost the Church of Scientology $10,000 in various fees to get "account42666(a)c2.org" to stop remailing, but only $20 (or even less) to create "account98410(a)c2.org." Ideally, such remailers should require no involvement at all by the account holder. Just a "start" command, by the account holder. (Not the site administrator, as this could be construed as involvement by him.) But an "instant remailer" (just add water) is needed. Recent questions here on the list about what it takes to run a remailer may mean some advice is needed. Running a remailer function should never be thought of as being the same as running a site. Most of the existing remailers are certainly not being run on machines _owned_ by those running the remailers. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: The Crisis with Remailers
by tcmay＠got.net 17 Dec '03

17 Dec '03

More on what is adding to the current crisis: * Fact: For _most_ people, there is no compelling (or even casual) need for remailers. (No, I'm not arguing against remailers. Just pointing out a basic economic fact, to be factored in.) * Fact: The value of having remailers goes up when certain kinds of activities (which do not yet exist in any significant form) become more available. * Fact: The danger to remailer operators goes up when these kinds of activities become more widespread. (Another way of putting these last two points is this: The more valuable a remailing function is, the more danger or liability a remailer faces.) * Fact: Most remailers are being operated in the United States, and by persons with only casual commitment to their continued operation. ("Casual" should not be construed in a derogatory way.) * Fact: There have been no definitive court rulings in the U.S. clarifying the role of remailers. (In fact, no court cases involving remailers at all, yet.) Until this is decided, remailer sites which appear to be the emanation point (the last link) for the posting of, say, copyrighted material, will find themselves ordered to cease and desist. (The Church of Scientology involvement is beside the point. Brad Templeton of Clarinet would likely do much the same thing if Clarinet-carried articles were being posted to Usenet through remailers. So would "Time," and so, probably, would "Wired." We always knew that _something_ like this would put remailers to a severe test.) Conclusions: - Remailers will continue to disappear as pressures are applied. Absent a basic court ruling that remailer operators are not responsible or liable for what is sent through their sites, they will fall under attack. Once one falls, and a new site is used, it will become the target. - Very few ordinary people use remailers. This will change as remailers continue to get easier to use, but clearly most people feel little need/threat. - Ironically, if some sort of more restrictive regime comes to the fore, and more people feel the need to use remailers (e.g., CDA is upheld and abortion information becomes illegal to send over the Net), then this will make the operators of remailers feel even more heat. Is there an "equilibrium" point in all this, a "market clearing" point at which remailers are badly enough needed, despite threats and pressures, so as to provide a market for them? An interesting question. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Cheap remailers
by John Schofield 17 Dec '03

17 Dec '03

There's been much talk on this list about the need for cheap remailers, and I wanted to announce (unofficially) one of the least expensive remailer setups I've seen. The code is written by Jim Cannell, with documentation by me. It's designed as a remailer for Fidonet-technology systems. Fidonet Anonymous ReMailer runs under standard DOS, and is quite easy to install and run. The average Fidonet sysop should be able to get it up and running in about 15 minutes. With Internet gateway software and a UUCP account, it works quite well as an Internet remailer. I'm running a beta-test version at remail(a)sprawl.ktb.net. Please feel free to use it. Help files are available, but are oriented towards Fidonet users. Still, you should be able to puzzle it out. It will only be up for a month longer, because I'm leaving the country for two months, but Jim should keep you posted after the public release on what Fidonet remailers are operating. Requirements for running a Fidonet Anonymous ReMailer: 286-clone or better, with a 2400bps modem or better. Fidonet Anonymous Remailer (free) telephone line (a dedicated line is good, but not necessary) Fidonet mail tosser (free or inexpensive shareware) Fidonet Mailer (free or inexpensive shareware) Most people probably won't be running Fidonet Anonymous Remailer with quite this inexpensive a setup. I'm running on a 486-50, two dedicated phone lines, and two 28.8k bps modems. If all I was running was the remailer, I certainly wouldn't need that much hardware. The remailer will be released with full source When It's Ready, and any Fidonet node (there are more than 20,000) will be able to run the software and act as a remailer. The UUCP feed is not necessary for Internet connectivity -- any Fidonet node can send and receive e-mail from the Internet through standard gateways. However, operating your own gateway makes it much more fast and reliable. I pay $20/month for my UUCP feed. Fidonet can't compete with the Internet in terms of features, activity, or much else -- but for dirt-cheap bare-bones networking, you can't beat it. John ______________________________________________________________________________ ac086(a)lafn.org john(a)ktb.net library(a)c2.org (They're all me.) PGP Public Key available by e-mailing PGPKEY(a)sprawl.ktb.net or by fingering library(a)c2.org. Check out the Digital Library at http://www.c2.org/~library/

1 0

DataHaven Backup and Offshore Email
by Vincent Cate 17 Dec '03

17 Dec '03

Offshore Information Services announces accounts for datahaven backup purposes. For $168/year you can have 10 MB of disk in a datahaven country to use for backup of important information. Also, we have POP email accounts for $168/year. For full details of our services check out: http://online.offshore.com.ai/services.html -- Vince

1 0

Re: Rumor: DSS Broken?
by Robert Hettinga 17 Dec '03

17 Dec '03

At 9:41 PM -0400 5/18/96, Bill Stewart wrote: > MD5 is at least weakened, maybe broken; there's an abstract by Hans Dobbertin > that says something about generating collisions, and gives an example > (though the abstract doesn't say how general the method is.) That's what I get for not reading the DSS stuff when it came out. I'd heard lots about the MD5 stuff, but I didn't put the two together. It also looks like I'm behind in my reading. Time to buy another edition of Applied Cryptography... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: crosspost re remailers
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 15:43 1996-05-18 -0700, Bill Frantz wrote: >At 7:07 AM 5/18/96 +0200, Benjamin Brochet wrote: >>WHO IS THE MODERATOR OF THIS LIST ? >> >>I've been victim of a spoofing from a german.... he suscribed me to 2200 >>mailing list... also I'd to be unsuscribed from your list ! >> > >There is no moderator. I am just a subscriber like yourself (except I >asked for it.) Did you get a welcome message which included information >like the following? If he was indeed subscribed to 2200 mailing lists, you can assume that he didn't read all the "welcome messages." For people who are stuck with old fashioned mail systems (no filters, no macro language) this is a serious problem. It would be rude to call the victims clueless and subscribe them to even more "clueless mailing lists." Matts

1 0

Re: SEVERE undercapacity, we need more remailer servers FAST
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 18:29 1996-05-15 -0400, Black Unicorn wrote: > >I would really like to see a remailer that is somehow blinded. > >I don't know enough about how mail paths are generatered, but is it >impossible to conceal the origin of remailer postings? IP spoofing would do this nicely.Since SMTP doesn't require any significant responses, you can send blind and fake your IP address. To do that you need root access on your mailer machine and an ISP that doesn't sniff and filter its network for spoofing attacks. See ftp://info.cert.org/pub/cert_advisories/CA-95:01.IP.spoofing for a good description of spoofing attacks and defenses. If you're not up to writing spoofing code into your (re-)mailer, then an easier solution is to send everything through anon.lcs.mit.edu after you have removed all headers that point at you. Matts

2 1

News from Burma
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ASIA 'Excommunication' An anglo-Burmese businessman friendly with pro-democracy leader Aung San Suu Kyi has been sentenced to thre years in jail for owning unauthorized telephones and fax machines. James Leander Nichols, also known as Leo Nicholas, was punished for having two fax machines and a telephone switchboard with nine lines in his home, a spokesman for Suu Kyi's political party said. In an effort to discourage contact between Burmese citizens and the outside world, Burma's military government requires people to get permission to own a fax machine, satellite dish, or sophisticated phone system. News Services The Atlanta Constitution/The Atlanta Journal Alec -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZ9ArCKJGkNBIH7lAQFrrAQAw7g/OeEU0IbK+4haxL4r7CWez9R1MqH6 W0Zq1l59XlRDkCCPj34HqrXGchg1Wnnw6LMK7B41JMRl68jvkVLmLnZ9FHwehZ9V R2WzRM+VzHwcpxQ4Fha1pwdq4Lm5naeS+3FiTQDcbTATT7hpBSiLOXhMNSlxFcBP G2KtNA2iZAM= =g8jc -----END PGP SIGNATURE-----

1 0