December 2003 - cypherpunks-legacy

Re: The Crisis with Remailers
by tcmay＠got.net 17 Dec '03

17 Dec '03

More on what is adding to the current crisis: * Fact: For _most_ people, there is no compelling (or even casual) need for remailers. (No, I'm not arguing against remailers. Just pointing out a basic economic fact, to be factored in.) * Fact: The value of having remailers goes up when certain kinds of activities (which do not yet exist in any significant form) become more available. * Fact: The danger to remailer operators goes up when these kinds of activities become more widespread. (Another way of putting these last two points is this: The more valuable a remailing function is, the more danger or liability a remailer faces.) * Fact: Most remailers are being operated in the United States, and by persons with only casual commitment to their continued operation. ("Casual" should not be construed in a derogatory way.) * Fact: There have been no definitive court rulings in the U.S. clarifying the role of remailers. (In fact, no court cases involving remailers at all, yet.) Until this is decided, remailer sites which appear to be the emanation point (the last link) for the posting of, say, copyrighted material, will find themselves ordered to cease and desist. (The Church of Scientology involvement is beside the point. Brad Templeton of Clarinet would likely do much the same thing if Clarinet-carried articles were being posted to Usenet through remailers. So would "Time," and so, probably, would "Wired." We always knew that _something_ like this would put remailers to a severe test.) Conclusions: - Remailers will continue to disappear as pressures are applied. Absent a basic court ruling that remailer operators are not responsible or liable for what is sent through their sites, they will fall under attack. Once one falls, and a new site is used, it will become the target. - Very few ordinary people use remailers. This will change as remailers continue to get easier to use, but clearly most people feel little need/threat. - Ironically, if some sort of more restrictive regime comes to the fore, and more people feel the need to use remailers (e.g., CDA is upheld and abortion information becomes illegal to send over the Net), then this will make the operators of remailers feel even more heat. Is there an "equilibrium" point in all this, a "market clearing" point at which remailers are badly enough needed, despite threats and pressures, so as to provide a market for them? An interesting question. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Cheap remailers
by John Schofield 17 Dec '03

17 Dec '03

There's been much talk on this list about the need for cheap remailers, and I wanted to announce (unofficially) one of the least expensive remailer setups I've seen. The code is written by Jim Cannell, with documentation by me. It's designed as a remailer for Fidonet-technology systems. Fidonet Anonymous ReMailer runs under standard DOS, and is quite easy to install and run. The average Fidonet sysop should be able to get it up and running in about 15 minutes. With Internet gateway software and a UUCP account, it works quite well as an Internet remailer. I'm running a beta-test version at remail(a)sprawl.ktb.net. Please feel free to use it. Help files are available, but are oriented towards Fidonet users. Still, you should be able to puzzle it out. It will only be up for a month longer, because I'm leaving the country for two months, but Jim should keep you posted after the public release on what Fidonet remailers are operating. Requirements for running a Fidonet Anonymous ReMailer: 286-clone or better, with a 2400bps modem or better. Fidonet Anonymous Remailer (free) telephone line (a dedicated line is good, but not necessary) Fidonet mail tosser (free or inexpensive shareware) Fidonet Mailer (free or inexpensive shareware) Most people probably won't be running Fidonet Anonymous Remailer with quite this inexpensive a setup. I'm running on a 486-50, two dedicated phone lines, and two 28.8k bps modems. If all I was running was the remailer, I certainly wouldn't need that much hardware. The remailer will be released with full source When It's Ready, and any Fidonet node (there are more than 20,000) will be able to run the software and act as a remailer. The UUCP feed is not necessary for Internet connectivity -- any Fidonet node can send and receive e-mail from the Internet through standard gateways. However, operating your own gateway makes it much more fast and reliable. I pay $20/month for my UUCP feed. Fidonet can't compete with the Internet in terms of features, activity, or much else -- but for dirt-cheap bare-bones networking, you can't beat it. John ______________________________________________________________________________ ac086(a)lafn.org john(a)ktb.net library(a)c2.org (They're all me.) PGP Public Key available by e-mailing PGPKEY(a)sprawl.ktb.net or by fingering library(a)c2.org. Check out the Digital Library at http://www.c2.org/~library/

1 0

Re: The Crisis with Remailers
by loki＠infonex.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 9:00 AM 5/18/96, Dr. Dimitri Vulis wrote: >"Vladimir Z. Nuri" <vznuri(a)netcom.com> writes: >> 1. there is no economic incentive. > >So, add the code to mixmaster (and even the old style remailers) to >collect e-cash as it passes on the anonymous message. Then this will >be a good way to accumulate some e-cash, and a number of people will >try running remailers for this very purpose. Witness the recent >Usenet spam by someone advertizing a for-pay remailer. > I was invited to the digicash API design meeting precisely to make sure it could be used in remailers. It will not be using the current API. The problem is that Mixmaster requires exact knowledge of the size of every object in the message, to maintain constant message size. I could set aside room for one, two, three coins, but there is no guarantee that the payment will be made with only that many coins. The current API is going to be high level. It will does not allow the program to know anything about the internals of the payment. I need to be able to specify payment of amount X using no more than N coins. As soon as I have that level of control, you will see postage in Mixmaster. -Lance -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMZ40x/Pzr81BVjMVAQFdTQf/VtRl3MEm+YfIYxsJdEhnv9lsL26S00oG RTvJiVbzyriGmWBhQY14ITQjnPrNNnRYfrmxVT2nRAEpfC8a63TqD5BN2eeUOSWU g/eagI3mWqlQssjCpeOEq6pzBcvKCTu2nECfAWCVN87MA7thq4Xj3haFjv+NP2K6 i8Bq/JRz6oaq35Bz0lqskBemiUOLXJOUK93LXFpw3VlTces+vDMSCWXwtkhAOLLO yav12MbRJRt/heUotsl6wzp2tdEV4xlsciedUOfk8fQVDSvh31J2xyvaupepHosC UUCz3sc8f4icWXCtBkimLyzgp/pNg7E9rN//Ps8ZzQquKPcr/7GtAQ== =BC1f -----END PGP SIGNATURE----- ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

4 3

RE: The Crisis with Remailers
by blanc 17 Dec '03

17 Dec '03

From: Bruce Baugh >hence my comments from here from time to time that the technological >problems of anonymity are not the true obstacle to widespread use. >there are deeper problems that cpunks skirt around but fail to grasp >because of numerous prejudices. While I hate to lend support to anyone as much a twit as Vulis is, he's got a point here. I don't think most cypherpunks realize how anonymity is perceived out in the net at large. ...................................................................... Bruce: Vulis is not the twit who wrote that paragraph. Vulis is not Vlad. Vulis: "Vlad" is not Vlad. You all need to go out to LD's web site and refresh your memory. .. Blanc

2 1

DataHaven Backup and Offshore Email
by Vincent Cate 17 Dec '03

17 Dec '03

Offshore Information Services announces accounts for datahaven backup purposes. For $168/year you can have 10 MB of disk in a datahaven country to use for backup of important information. Also, we have POP email accounts for $168/year. For full details of our services check out: http://online.offshore.com.ai/services.html -- Vince

1 0

Re: Rumor: DSS Broken?
by Robert Hettinga 17 Dec '03

17 Dec '03

At 9:41 PM -0400 5/18/96, Bill Stewart wrote: > MD5 is at least weakened, maybe broken; there's an abstract by Hans Dobbertin > that says something about generating collisions, and gives an example > (though the abstract doesn't say how general the method is.) That's what I get for not reading the DSS stuff when it came out. I'd heard lots about the MD5 stuff, but I didn't put the two together. It also looks like I'm behind in my reading. Time to buy another edition of Applied Cryptography... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: crosspost re remailers
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 15:43 1996-05-18 -0700, Bill Frantz wrote: >At 7:07 AM 5/18/96 +0200, Benjamin Brochet wrote: >>WHO IS THE MODERATOR OF THIS LIST ? >> >>I've been victim of a spoofing from a german.... he suscribed me to 2200 >>mailing list... also I'd to be unsuscribed from your list ! >> > >There is no moderator. I am just a subscriber like yourself (except I >asked for it.) Did you get a welcome message which included information >like the following? If he was indeed subscribed to 2200 mailing lists, you can assume that he didn't read all the "welcome messages." For people who are stuck with old fashioned mail systems (no filters, no macro language) this is a serious problem. It would be rude to call the victims clueless and subscribe them to even more "clueless mailing lists." Matts

1 0

Re: The Crisis with Remailers
by Bruce Baugh 17 Dec '03

17 Dec '03

At 01:06 PM 5/18/96 -0700, Dimitri Vulis wrote: >hence my comments from here from time to time that the technological >problems of anonymity are not the true obstacle to widespread use. >there are deeper problems that cpunks skirt around but fail to grasp >because of numerous prejudices. While I hate to lend support to anyone as much a twit as Vulis is, he's got a point here. I don't think most cypherpunks realize how anonymity is perceived out in the net at large. Take news.groups, a fairly important group I happen to read regularly. With the exception of Rich Graves' presence, _all_ the uses I see there are for cowardly abuse in a way that lets the poster escape having to answer for his views. I'm not talking about presenting important information where wrong-headed authorities could engage in reprisals, either, but baseless accusations of theft, child abuse, and just plain torrents of obscenity. That's _all_ it's used for (again, with the exception of Rich). There's a problem here. It's one thing to say that the benefits of anonymity outweigh the problems. I'm inclined to that view myself. But it's much harder to defend that view in a forum where anonymity is used so commonly for problematic ends, and to offer anything in the way of constructive solutions. It would be pleasing to see more cypherpunks actively dealing with these problems out there in net.land. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

2 1

News from Burma
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ASIA 'Excommunication' An anglo-Burmese businessman friendly with pro-democracy leader Aung San Suu Kyi has been sentenced to thre years in jail for owning unauthorized telephones and fax machines. James Leander Nichols, also known as Leo Nicholas, was punished for having two fax machines and a telephone switchboard with nine lines in his home, a spokesman for Suu Kyi's political party said. In an effort to discourage contact between Burmese citizens and the outside world, Burma's military government requires people to get permission to own a fax machine, satellite dish, or sophisticated phone system. News Services The Atlanta Constitution/The Atlanta Journal Alec -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZ9ArCKJGkNBIH7lAQFrrAQAw7g/OeEU0IbK+4haxL4r7CWez9R1MqH6 W0Zq1l59XlRDkCCPj34HqrXGchg1Wnnw6LMK7B41JMRl68jvkVLmLnZ9FHwehZ9V R2WzRM+VzHwcpxQ4Fha1pwdq4Lm5naeS+3FiTQDcbTATT7hpBSiLOXhMNSlxFcBP G2KtNA2iZAM= =g8jc -----END PGP SIGNATURE-----

1 0

Re: Interactive Week exclusive - White House to launch "Clipper III"
by rodger＠interramp.com 17 Dec '03

17 Dec '03

On 5/18, Tim May wrote: >A question for Will Rodger: Is this "White Paper" ("The newest proposal is >contained in a 24-page White Paper, a draft of which hit Capitol Hill >earlier this week") related in any way to the one being prepared by Herb >Lin and a bunch of other folks? It was due out about this time, and the >topic seems similar. A bunch of us gave input to Herb and his panel at the >CFP in '95...if this is the same White Paper, looks like we might just as >well have saved our breath. Don't know. This did have full input from security agencies, however. >I read the stuff at the URL, and at first blush it looks to say nothing >about _domestic_ (within the U.S. and Canada) encryption. I'll be anxious >to see what the White Paper says about domestic encryption. > No restrictions domestically nor in Canada. Even so, these CAs and the policy body above it clearly give the govt. more of a role in controlling crypto. >However, as with other proposed crypto laws and "trial balloons," there are >several questions which arise: > >1. Will there be pressures put on the browser companies (Netscape, >Microsoft, etc.) and the e-mail companies (Qualcomm, Microsoft, Claris, >Lotus, etc.) to produce a "world version" that meets export standards with >a single shrink-wrapped package? > >(Recall that last fall some of the various companies stated as their goal >having a single package that could be shipped worldwide. Some of them >claimed having two versions, a domestic U.S. version and an international >version, was too onerous. I am skeptical of this, given that they have >multiple platforms to support, multiple operating systems, etc. But they >claim it is.) > >2. Interoperability. How will U.S. users exchange messages with >international users? Will a U.S. user have to register with the Authorities >to get the proper credentials, protocols, etc.? No indications they would. Idea is each authority could talk to the other and request escrowed keys or info. a la interpol. Of course, as today, there's no guarantee that agreements will always be in place, nor honored. > >3. With products like PGP, there are already international users (lots of >them). Thus, no "export laws" are involved. So, will I be able to >communicate with them using my existing PGP methods? Under the White Paper, yes. > >And if U.S. users can continue to interoperate with international users as >they are now doing, this puts the lie to claims about how key escrow will >be useful for law enforcement. Which makes it look a lot like the old proposal. > >4. And of course there is always the issue of _superencryption_. How a >GAKked program can detect that superencryption is being used has never been >adequately explained (to my satisfaction at least). Entropy measures won't >do it, and forbidding any encryption of messages already containing "BEGIN >PGP" will clearly just be a klugey bandaid. > >5. What about U.S.-based corporations with offshore offices? Is a company >supposed to replace its entire intranet corporate network with a GAKked >system if even a single user is outside the U.S.-Canada? If it's legal now, the paper suggests it should be legal in the future. > >6. What about U.S. persons travelling abroad? > >7. What about packets zinging around the world? Lots of complications if >GAK is insisted upon. And lots of new avenues for "packet laundering." > >8. The issue of why other countries would insist that their citizens GAK >their keys when U.S. citizens don't have to!! >("Yes, Herr Glomlutz, we are insisting that all Germans using Netscape 4.0 >must deposit their keys mit der Key Authority. No, we are not requiring our >own citizens to do this." I don't think this will fly too well.) > >I can't see how other countries will go along with this. The Paper is quite unclear on this, as well. Presumabyt other countries will have equally spiffy stuff they will require be escrowed for export under COCOM. ALl of this, of course, assumes cooperation from OECD, et al. > >And what about the usual problem of "rogue nations" like Iraq, Iran, North >Korea, Israel, and Liberia? Same as before. > >9. Many other issues. (They never answered the similar questions raised the >last time, so I doubt they will this time.) > > >Clipper III, if it turns out to be another worthless proposal which is >laughed out of Washington, will be no real threat. If Clipper III actually >outlaws or places limits on domestic use of crypto (as I think it must, >else it can be too easily circumvented completely), then it will be a >rallying cry which will likely see our membership increase still further, >the anti-Washington rhetoric escalate, and likely some new developments in >the war. Stay tuned.... Will Rodger Washington Bureau Chief Interactive Week.

1 0