December 2003 - cypherpunks-legacy

FBI, DoJ deny invesitgation of CompuServe
by rodger＠interramp.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- on 5-8, Joseph Reagle posted: > COLUMBUS, Ohio, May 8 (UPI) -- The FBI, acting on a complaint from a >Christian morals watchdog group, Wednesday sought to determine whether >CompuServe Inc. has violated a new law against indecency. > FBI agents said they were attempting to determine whether >CompuServe's Entertainment Drive, which contains some adult material, >violates the Communications Decency Act. The law prohibits offering >pornography to on-line users, especially minors. > Reuters, however, just moved a story saying the FBI and Dept. of Justice denied there was *any* investigation ongoing. The agencies were responding to the original stroy which ran in the Columbus Dispatch, Such denials are *extremely* rare; agenices almost always refuse to confirm or deny investigations. Those of you with access to AOL can check the story out in technology news. Will Rodger -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMZEUDEcByjT5n+LZAQFt0gf+MnIkM51VD9wlVwNG6KFTZGeYsJMFVViZ 5uRA6na7R9jNSL9u4zxJjYJxPkEDUO64z87ZV2tODXTOJdFfencOycCsy+oDR0da 1fObsFCqZN1Rh2ZNspgG4TpTLZVUn/naiZoA4jyFlRyXV8qa19Zwro5S0a9JfHj9 xofxhBwCb/Sdw4kKDRgqfnehrKVlIRaQw3kR9TetF+Olm2czF2iIoeQTlwUR7y10 SY+vqxApyACLTkwfPP/Y/H/uwMFTQbcMPCbI7yoK/AnPRywC0pV//b6JkSaMvcm3 ZhdyiUkpY6gRr0MAB4fwe2ho/zRLXj7bEQ2pSQJcRSpm2Tl+Zq4U9w== =ffRy -----END PGP SIGNATURE-----

1 0

Re: Remailer in a box
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Questions. How much memory does the Mixmaster remailer take up? What accesses/permissions/etcetera on a machine do I need to have in order to have it running on an account? Has anyone set up one such that it will only remail from & to a set of addresses (e.g., other remailers)? I, for instance, wouldn't be willing to deal with the hassles involved with running a remailer that was either what the end user would see (thus getting potentially deluged with help questions) or the end mailer (thus getting potentially in problems if someone abuses the remailer)... but I (and others) might if it was set up just for chaining. (Yes, I know I'd need a UNIX account... I'm looking into that.) Speaking of UNIX, does anyone have any existing programs to automatically mail out at random intervals a looping or /dev/null directed message through the remailers, in order to increase security against traffic analysis? Thanks, -Allen

1 0

"Architectural considerations for cryptanalytic hardware" paper on the web
by Ian Goldberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- For anyone who was interested in Dave's and my hardware project (Architectural considerations for cryptanalytic hardware), it's done (thank goodness). You're free to check it out at http://www.cs.berkeley.edu/~iang/isaac/hardware/ in either HTML or PostScript. Thanks to cypherpunks Eric Hughes and Bruce Koball, and to Altera people Clive McCarthy and Stephen Smith. - Ian "...pray for an 'A' for us..." -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZE64UZRiTErSPb1AQHczwP+IF47Zg4VpecVFj+ei0AAr2h9ZVTV01nb lsUXAwWpKla2LJ+sJGrSQmpu0Sd/wkIIGeTWnbCLiR+d4pdbKN2nwfHp6evjzEnw luWWeuCFq51L0AViBGyu2r11IiAPGGIXWclb8dqqjL1YLtnJ/CCXXRbSGbJ7YdqO 6GBAMv13IgA= =5IGV -----END PGP SIGNATURE-----

1 0

[off-topic] *.alias.net disappeared?
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm sorry for posting this to the list, but I've no other apparent way of getting in touch with these parties. The alias.alias.net and nym.alias.net servers have disappeared; in fact, nothing in *.alias.net is still in any DNS that I can find. Have these sites disappeared, or am I just in a very bad corner of the 'net? dave -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMZFB9TVTwUKWHSsJAQHfigf9F52pD+b+bUzK9GYVh4LgP988wG1e7VIp rF9ouG2AOw+ipLQliv/cbgS9DiOg3/8IIvIZnfhZo8M1oFJ0LaaOh3BH0rsMh0RP elkFtoAaGojcP04x/LvRm/S+NaZRfK+iIoFRxiI50rCYgXcQR9OmqwdtQ9I92k7L jlASFwAWAJqdE6uhGxgMOAoPcLP5R+qBB83BsJguAnMBGmrPco8zfMtaRFhdjn74 xS8DXSjfqktPGZRnyqH/mddV1P2dLpPFEMS+V79ZrcARQ9IEQzb0zWSx5ET+wza+ x8cnRhBUhkybmLM+H54YSEDlv0asWWJNBUev1sb64PV3VMMhyJAwjg== =kZSL -----END PGP SIGNATURE----- --- David Smith, Box 324, Cape Girardeau MO USA 63702 http://www.prairienet.org/~dsmith des(a)juno.com Reality is only for those lacking in true imagination

1 0

DigiCash agreement with Deutsche Bank
by minow＠apple.com 17 Dec '03

17 Dec '03

According to an article in a Swedish newspaper, Svenska Dagbladet (http://www.svd.se/svd/ettan/ettan.html) DigiCash has closed an agreement with Germany's largest bank, Deutsche Bank, that will permit commerce on the Internet using digital cash. The system will be tested first internally within Deutsche Bank to check the security of the system, followed by a limited rollout this autumn, with major distribution expected early next year. A customer of the bank can "click on the DigiCash icon and confirm the amount of German Marks required. The digital money is automatically downloaded to the customer's computer and stored on disk in various amounts." To purchase something from a homepage, the customer's computer sends "digital cash" to the seller. The seller confirms via the bank within two seconds that payment was made. Translated (quickly) and summarized by Martin Minow minow(a)apple.com

1 0

Java Hole: Web Graffiti & Covert Channels
by Chad Owen Yoshikawa 17 Dec '03

17 Dec '03

-------------------------------------------------------- Web Graffiti & High Bandwidth Covert Channels Using Java -------------------------------------------------------- While developing a chat server using Java as a frontend, we've been exploiting what we think is a new Java security hole in Java-enabled browsers such as Netscape. The hole allows for opening sockets to arbitrary ports on web servers that serve Trojan-horse applets. We've also used a known security hole (covert channels) first mentioned in work by the SIP group at Princeton to create what we call 'Web Graffiti' - the dynamic insertion of text, graphics, applets, into HTML pages. Both of these attacks are three-party attacks and require Trojan- horse applets. For a draft of a paper that is work in progress, point your browser to: http://whenever.CS.Berkeley.EDU/graffiti/ Chad Yoshikawa Brent Chun chad(a)cs.berkeley.edu bnc(a)cs.berkeley.edu

1 0

re: Dempster-Shafer...(re: Transitive
by watson＠tds.com 17 Dec '03

17 Dec '03

tcmay's approach is elegant, and it's refreshing to find a practical use for AI approaches. I think it needs one more step, though. If we learn to quantify our trust in a key, we still need to know what the threshold should be for a given application. Maybe I can get by with a 0.05 Bel for posting to cypherpunks, but maybe I want a 0.95 for a monetary transaction. Seems to need a comprehensive risk management approach,

1 0

Re: Senator Leahy's Public Key
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:16 AM 5/9/96, Eric Eden wrote: >What if you needed to set up a key server for a mass base of customers... >Obviously, authenticating them via e-mail would be difficult, verifying >them in person would be harder. Would there be any reasonable way to "Verifying them in person" would, in fact, be essentially impossible. Few sources of documentation mean much, in fact. Consider that I joined Intel in 1974 and was never once asked for any form of identification...I just showed up for work under my assumed name, Tim May, and no one was the wiser. Ask yourself this: Have you _ever_ really "verified" the identity of your girlfriend, your friends, your co-workers? (I mean this not to pose an existential riddle of no real significance, but to remind people how seldom we ever actually try to verify that people are "really" who they say they are.) ... >pretend that the labor is not the deciding factor. What would be the >best way to verify the customers keys if you couldn't visit each >customer in person? Representatives from my ISP, got.net, have attended some of my parties...and they _still_ don't know that I am _actually_ Irving J. Schlublutz, temporarily masquerading as "Tim May."\ >For example, would a photo copy of a drivers license be enough? For which purposes? DLs are notoriously easy to forge. I think $25 is the going price. (And DLs which would fool people like us are probably doable on any H-P color inkjet printer.) My point in all this being that "proofs of identity" aren't all they're cracked up to be. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: [off-topic] *.alias.net disappeared?
by loki＠infonex.com 17 Dec '03

17 Dec '03

John Perry (perry(a)jpunix.com) was running the alias.net services. Because of work commitments, he was not able to continue to run alias.net -Lance At 6:53 PM 5/8/96, David E. Smith wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >I'm sorry for posting this to the list, but I've >no other apparent way of getting in touch with >these parties. > >The alias.alias.net and nym.alias.net servers >have disappeared; in fact, nothing in *.alias.net >is still in any DNS that I can find. > >Have these sites disappeared, or am I just in >a very bad corner of the 'net? > >dave > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 > >iQEVAwUBMZFB9TVTwUKWHSsJAQHfigf9F52pD+b+bUzK9GYVh4LgP988wG1e7VIp >rF9ouG2AOw+ipLQliv/cbgS9DiOg3/8IIvIZnfhZo8M1oFJ0LaaOh3BH0rsMh0RP >elkFtoAaGojcP04x/LvRm/S+NaZRfK+iIoFRxiI50rCYgXcQR9OmqwdtQ9I92k7L >jlASFwAWAJqdE6uhGxgMOAoPcLP5R+qBB83BsJguAnMBGmrPco8zfMtaRFhdjn74 >xS8DXSjfqktPGZRnyqH/mddV1P2dLpPFEMS+V79ZrcARQ9IEQzb0zWSx5ET+wza+ >x8cnRhBUhkybmLM+H54YSEDlv0asWWJNBUev1sb64PV3VMMhyJAwjg== >=kZSL >-----END PGP SIGNATURE----- >--- David Smith, Box 324, Cape Girardeau MO USA 63702 >http://www.prairienet.org/~dsmith des(a)juno.com >Reality is only for those lacking in true imagination ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

2 1

Re: Transitive trust and MLM
by loki＠infonex.com 17 Dec '03

17 Dec '03

At 11:32 AM 5/8/96, Raph Levien wrote: <SNIP> > One encouraging consequence of this model is that densely connected >subgraphs can result in highly trusted keys even if p itself is quite >small. In a clique of size k, the trust is (very) roughly 1-(1-p)^k. For >example, if p is a mere 50%, then in a clique of size 10, each key in >the clique is trusted with a probability of 99.9%. > This computation is (I think) known as the network reachability >problem, and is probably quite hard to evaluate. In practice, you'd >probably want to compute upper and lower bounds instead, > > Let's see if we can come up with a model that preserves this property >of giving high trust values to densely connected keys, yet is also >highly resistant to (some plausible model) of attacks against the Web of >trust. > >Raph I like this. The most obvious attack on key signatures is to cross sign a huge number of bogus keys, is of no benefit. As the density of this bugus-clique increases, it comes closer and closer to acting as a single entity for trust calculations. Then your trust calculation for any key in the clique is simply your trust of the real key which signed all the bogus ones. It should be no time at all before most reputable key signers cut all links to that key. Another nice property of this calculation of probability is that it automatically drops off exponentially with the number of links (at least along any one chain). We need to think about how much we want multiplicity of paths to bolster our trust. Here is the scenario I want to avoid: Mallet creates a large number of keys: A, B, C[...]. C is a large set of keys. A is the Key Mallet uses publicly. It has a few signatures. B is the key Mallet uses to sign keys who's trust he wants to boost. In addition to signing B with A, Mallet also signes all the C[i] with A, and signs B with all the C[i]. This multiplicity of paths should not boost the trust in any key which is reached through this complex. In general it may be difficult to decipher which paths you want to follow in multiply (and cyclically) connected paths. I suppose one approach to this would be to pick various ways of calculating trust, and see if anyone can come up examples to attacks to exploit them. -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0