December 2003 - cypherpunks-legacy

Wanted: NNTP posting access for remailers
by lcs Remailer Administrator 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Would anyone out there be willing to give NNTP posting or transfer privileges to anon.lcs.mit.edu? Because of recent spams through mail2news(a)anon.lcs.mit.edu, I may loose my news posting privileges to the news server I have been using. Though I try to resolve all complaints I receive, other complaints have been sent to other postmasters in the domain, who don't seem to want to hear about these problems. If you run a news server and would like to help people posting anonymous messages, please consider allowing posts from mail2news(a)anon.lcs.mit.edu. Ideally you would also be in a position to receive mail at some of the relevant postmaster aliases in your domain, and would not mind forwarding misdirected complaints to me so that I can deal with them. Alternatively, if you are willing to give me "IHAVE" priviliges, I can possibly set things up with an initial "Path:" header that guarantees most complaints will go directly to me. Thanks, - -mix-admin(a)anon.lcs.mit.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAwUBMdsT70TBtHVi58fRAQHQ0QP/U3Jn7sL9+k3aUr+qw4WdDxef/lIeu3xO BwdO8zlNPavJgbxuunR81n011jGy80l7qnc+DpvtuEEQqszLMcMO/4zHw/VfVOY8 08nxE8+IkF/FE66vJdnU7O3I1mIjtbF8ixcm9FOwqoehSLJB40tXy6wu6KV663TQ fmy/Gz5XDe8= =Gp4D -----END PGP SIGNATURE-----

1 0

WSJ: Cable Ruling may Portend Internet Regulation
by attila 17 Dec '03

17 Dec '03

WSJ 01 Jul 96 Cable Ruling May Portend Internet Content Restrictions What looks at first glance like a Supreme Court victory for free expression in cable television could turn out to be a First Amendment quagmire encouraging restrictions on the Internet. That's the view some constitutional experts are taking of a high court ruling Friday that struck down parts of a 1992 law designed to curb "indecent" programming on cable channels leased to local groups or set aside for the public. "It's a sweeping victory for legitimate First Amendment expression," declared Michael Greenberger, one of the attorneys who represented public-access cable producers who challenged the law. Conservative advocates on the other side of the case also claimed victory because one part of the law was preserved. "American families fighting to shelter young children from cable-television pornography won a major battle today as the Supreme Court upheld the right of private cable operators to screen pornographic programs," said Cathy Cleaver, director of legal studies at the Family Research Council. But some liberals were less sanguine. The ruling "tastes sweet at first," said Prof. Laurence Tribe of Harvard Law School, "but it turns out to be a sugar-coated poison pill for the First Amendment." He argued that the reasoning in the court's main opinion, written by Justice Stephen Breyer, was highly cautious and pragmatic rather than sweeping. This approach could be used to permit aggressive regulation of the Internet if the government can show that the global computer network gives children access to indecent material, meaning material that depicts sexual activities or organs in a "patently offensive" way. The Supreme Court produced six opinions but not one that commanded a majority; the vote counts were 6-3 and 5-4 to strike down two of the cable restrictions at issue, and 7-2 to uphold a third. In a separate case last month, a special federal court in Philadelphia invalidated key parts of a 1996 law aimed at curbing indecent material on the Internet. The Clinton administration last week said it would appeal that ruling to the Supreme Court. The Philadelphia court relied on ringing First Amendment rhetoric to decry government interference with the Internet. Justice Breyer's opinion on Friday was strikingly different in tone and method. He took great pains to underscore the seriousness of the government's concern about exposing children to adult programming and explicitly rejected the sort of categorical legal analysis that looks with great skepticism at any restriction on the content of programming. The trio of provisions at issue in the case were pushed by Republican Sen. Jesse Helms of North Carolina as last-minute amendments to a broader 1992 cable-regulation bill. They authorized cable-system operators to prohibit indecent programming on leased channels and public access stations reserved for educational and governmental use. If an operator chose to allow indecent programming on leased channels, the Helms amendments required the operator to "segregate" such programming from other offerings, block it and provide it only to customers who requested it in writing. Supporters of the legislation said they were targeting leased-access programs in New York and elsewhere that feature hard-core pornography. The Supreme Court case arose from lawsuits filed by community-access programmers who argued that the law would ban legitimate shows on sex education, abortion and other topics that could be defined as indecent. (In the legal lexicon, indecent material receives some First Amendment protection, whereas "obscene" material, defined as that which lacks any social or artistic value, doesn't.) In Friday's ruling, the high court by a 7-2 vote upheld a provision that encourages -- but doesn't require -- cable operators to prohibit indecent programming on leased access channels. There is plenty of evidence on those channels of pornographic material that lacks social merit and should be kept away from children, Justice Breyer said. The provision isn't overly broad, he added. Adults seeking racy shows can look to the larger commercial cable channels, where they are plentiful. By a 6-3 vote, however, the court struck down the provision that requires operators who choose to allow indecent programming to block it for all but those viewers who request it in writing. Justice Breyer questioned the need to force customers to disclose their viewing appetites, and he asserted that other, less intrusive means exist to tailor dissemination of adult material if it is to be provided. As examples, he pointed to a recently enacted requirement that commercial cable operators "scramble" or block stations dedicated to sexual material and another that obliges television manufacturers to install "V-chips" in televisions that can automatically identify and block sexual or violent programming. (The high court didn't rule formally on the constitutionality of these devices.) Finally, by a 5-4 margin, the court struck down a measure that encourages cable operators to ban indecent material on public-access stations. There isn't much, if any, indecency on these channels, but the law threatens to cause censorship of controversial shows on health, politics and art, Justice Breyer said. Daniel Brenner, a lawyer with the National Cable Television association, said the group was pleased overall with the ruling because it left operators "with the ability to protect our customers as to leased access. We wish it had done the same for public access." The Federal Communications Commission, which had defended the Helms amendments, managed to find something to celebrate as well. The decision "reaffirms that the Supreme Court believes that caring about what kids see on television is a compelling government interest, and there are constitutionally permissible ways for government to act to protect kids," said FCC Chairman Reed Hundt. He added that the ruling "is also significant because it confirms that the government's definition of "indecency" is not unconstitutionally vague." Only Justices John Paul Stevens and David Souter joined the Breyer opinion in full. Justice Sandra Day O'Connor dissented in part. Justices Anthony Kennedy and Ruth Bader Ginsburg would have struck down all of the challenged law. The court's most conservative wing -- Chief Justice William Rehnquist and Justices Antonin Scalia and Clarence Thomas -- would have upheld the entire law. Contractors' Speech In a pair of other First Amendment cases, the high court ruled 7-2 that independent government contractors can't be fired for expressing their views on public issues or for supporting the wrong candidate. In cases from Illinois and Kansas, the court said that contractors have roughly the same free-speech rights as public employees. Justice Scalia, joined by Justice Thomas, dissented from both decisions. "Favoritism," he wrote, "happens all the time in political life, and no one has ever thought that it violated -- of all things -- the First Amendment to the Constitution of the United States." (Wabaunsee County, Kansas vs. Umbehr, O'Hare Truck Service Inc. vs. City of Northlake, Ill.) -- Fuck off, Uncle Sam. Cyberspace is where democracy lives!

1 0

Re: CWD -- Jacking in from the "Keys to the Kingdom" Port
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 05.30 PM 7/3/96 -0700, Alan Olsen wrote: >At 06:58 PM 7/3/96 -0400, Mark M. wrote: >>If the child is creative enough, he will be able to boot DOS from a bootdisk >>and remove the line from config.sys that starts up the filtering software. >Or just remark it out and reboot. Or does the filtering software make it so >they cannot use an editor as well...? > >Sounds like a pretty easy thing to bypass given a small amount of clues. >(Makes me wonder how the usually clueless parents are going to block access >to their kids who usually understand the technology better than they do.) It would not have stopped me. =============================================================================== David Rosoff (nihongo o sukoshi dekiru) ----------------> drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu 0xD37692F9 Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 Do you know who's reading your email? ---> http://www.arc.unm.edu/~drosoff/pgp/ Anonymous ok, PGP ok. If it's not PGP-signed, you know that I didn't write it. === === === === === === === === === === === === === === === === === === === === "Truth is stranger than fiction, especially when truth is being defined by the O.J. Simpson Defense Team." -Dave Barry -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMdsleRguzHDTdpL5AQGYYQQAirqoel38eJrNBo17WKYlKZ5SYT8n+4dM Uil2vBHosxIOdGo8vmarHoxVALF7L31wXbFJ6pdv7p/qHAMvzDW3RetJQhDAc42P lZY0qMnRonoA6tKQbTcx8zkoRevGBEzTjxkVUyfRDHJCez7U42Mlvif728Faj4Dg 9ceqFYutAjU= =/cfm -----END PGP SIGNATURE-----

1 0

What remains to be done.
by Black Unicorn 17 Dec '03

17 Dec '03

Because I am not myself much of a programer, and because I have to find excuses to feel useful, I thought I would annoy everyone with my ideas about where c'punks might want to direct their efforts at encryption development. Of course any suggestion at direction tends to require a disclosure of the assumptions one is working from. The following are mine: 1. The most interesting crypto uses and implementations seem to come from grassroots programers, not large organizations. Remailers, PGP, Curve Encrypt, Private Idaho, mixmaster, premail, and magic money all were the results of "grassroots" efforts. None of these have been produced from massive corporate R and D programs, and most have been the result of predominately a single programmer's efforts. 2. The most useful crypto applications out there have tended to survive by using crypto that looks forward, not to the past, or the present. This is generally manifest in the inclusion or easy use of multiple methods. Zimmerman's selection of IDEA over DES, PGP's multiple key sizes, Curve Encrypt's 3DES/IDEA option, are all examples of an effort to design systems which will be useful tommorow, not just today. PGPlib seems to pick up this trend where PGP 2.x went awry. 3. In so far as proliferation is important, the impact of crypto applications and implementations is directly tied to ease of use. If PGP has failings, one must be that it can be immensely intimidating to the novice. 4. Increasingly cryptography is defying attempts at conventional regulation. 5. #4 will eventually spur sovereigns to rather drastic methods to defy #4. 6. Secure Communications, and transparent crypto are a Good Thing. Assuming the above, I think it is apparent that crypto development should be focused on a few general points and a few key areas. As to general points, I think the clear concentrations include: A. Increasing the ease of use. Perhaps I should have put this as #1, because really among those things which I suggest in this post, I think this is of primary importance. It cannot be stressed enough that encryption must be transparent, easy to use, but at the same time make its presence just apparent enough to encourage its use, and to make users note its absence. Crypto will have its most significant impact, its most liberating results, and be self assuring only to the extent that it is not a novelty, but an assumption. Please, authors, coderpunks, make crypto easy to use, but flexible enough so that adept and expert users can modify functional aspects. (Key generation, key size, exponent size, algorithm selection, level of verbosity and suchlike should find their way into an expert menu somewhere). B. Multiple encryption method support/larger key sizes. While I may be more paranoid than some, or even most, I think it is crucial to provide for the possibility that strong encryption may one day face a total ban in more countries. To avoid the chilling effect that this would certainly have on development, it is of key importance to permit applications and implementations to nexus with several methods, and to allow what may today seem like extrodinarily large key sizes. (256 bits would not be unreasonable in my view, particularly so where the user was given the option of selecting a ~128 or so bit method like IDEA or 3DES at their option (consistent with A. above). C. Anonymous communication. I'm not sure this needs much explanation. D. True stego. Today it is a simple matter to identify encrypted traffic. This is the key flaw in what I will call (at risk of sounding like a white paper) the NEI (National Encryption Infrastructure). It subjects users to very effective and easy to implement traffic analysis. While I understand the temptation to use checksum like methods to speed the key checking process, at some point I am of the view that this convenience will come back to haunt crypto. Given these areas, what specific applications might be the best to look into for the grassroots crypto advocate/coder? A. Methods to run secure websites on insecure servers. A thread on 'punks last month, I am of the view that local decryption of web pages is essential to the development of coercion free web pages. Estlablishing a truely secure web page today requires the server to be extra-terratorial, in a secure physical location, and requires such lengths to defeat traffic analysis (which lengths must be applied to the actual network logistics, rather than the software logistics) so as to be impractical to all but institutional resources. The best effort I have seen is in European Union Bank (www.eub.com) or (www.eub.net) [neither of which I recommend you use for deposits] and it still falls quite short. A software solution which permits local decryption makes traffic analysis less useful, presents the opportunity to use front end and disposable www pages on domestic ISPs while imposing no liability on the ISP itself, and opens several more effective traffic analysis deterants. Ideally, both web proxies (for servers as well as clients) and local decryption will be written allowing both server and user a degree of double blind operation as well as easy disposability of front ends. A Netscape plugin for local decryption of web pages and proxy forwarding of WWW form submissions to the server is a MUST. Is anyone considering work on these? B. More effective message pools. Really this is the only practical and most effective method to defeat traffic analysis of e-mail communications. Why do you think it is that informants always communicate with the FBI in the classified ads? This has been discussed again and again, yet I am aware of no serious effort to construct an effective server or client to implement it more effectively than USENET (which seems to be hopelessly slow and prone to drop postings regularly) I am encouraged by the new mixmaster model, but I have yet to read the entire abstract carefully. If the goal is, as I believe it should be, to make encryption accessible and understood by, if not everyman and joe sixpack, joe digitalsixpack, then it strikes me that the focus should be on WWW browsers and servers, (Netscape like material), popular mailing programs (Eudora), and the building blocks of the network, the point of origin, and the point of final destination. Point to point, grassroots plug ins to existing de facto standards, and ease of use, ease of use, ease of use. cypherpunks write code. Call me "half a cypherpunk" -- I hate lightning. (unicorn(a)schloss.li)

2 2

Re: Lack of PGP signatures
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:45 PM 7/3/96 -0400, David Lesher wrote: >> I am wondering why there is not a signing option that ignores all >> non-printing characters. Might fix some of these problems... (Can anyone >> think of a reason this would be a "Bad Thing(tm)"?) > >Moving spaces could change meaning on a legal doc. > >A nonsense example is the alt.folklore.urbane "cow orker" tag... I was thinking of carriage return/line feed combinations... Spaces are obvious and print. I was thinking of non-printing characters that are non-obivious when inserted. --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

Re: The Net and Terrorism
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:35 PM 7/3/96, Vladimir Z. Nuri wrote: >TCM breaks a longstanding personal policy of never replying >to my posts directly. (well, thanks.) realize that my >speculation on his position is largely associated with the >vacuum of his continually refusing to discuss key points of his >essays. Check your mail logs, Larry, as I've replied to a couple of your posts in the last several months. True, I delete most of your posts after glancing at them briefly, but I do this with a lot of posts and posters. >imagine that all the palestinians had good paying jobs, for example. >how many of them would be into rock-throwing and terrorism? of course their >own attitudes make such a thing very difficult. they may not have any >skills or reject a job even if offered one. I'm not saying such a thing >is easy. the fact that it is so elusive is proof of how difficult such >a thing is. Your point being? After all, nothing we can do will give the Palestinians such jobs...visit the Middle East and see the quagmire. Too many points to make here, and I don't plan to debate utopian ideologies about making the world a land of milk and honey. (I will tell you that there are relatively few "good paying jobs" anywhere in the Arab world--look at the poverty of Egypt, Yemen, Sudan, Morocco, and so on. Note that these countries are not directly involved in the Israeli-Palestinian dispute, and yet not a single one of these countries has so much as a primitive electronics production facility, let alone true high tech facilities such as Israel has. You may want to wave a magic wand and say "Yeah, but what if they did have such jobs?," but this is pure fantasy, and not something I plan to waste time debunking.) >I do NOT believe that living in the world is a zero-sum game as you >seem to suggest. your use of the term is very compelling. do you >believe human life is always at the expense of other human life? I made no such claims about the world being a zero-sum game. (I made references to game theory, and used the term "game-theoretic," but this is not at all the same thing as asserting anything about zero sum games! I never mentioned zero sum games, positive sum games, or anything at all about sums. You are carelessly setting up straw men and then knocking them down.) No real point in wading through the rest of your ramblings. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Net and Terrorism.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:14 AM 7/4/96, snow wrote: > Military troops can best be protected by 3 seperate methods: > 2) When they _are_ exposed, let them fight the fuck back. Rules of > engagment are simple. When fired on, shoot to kill. If the shot > comes from a building, take out the building. If from a crowd, ^^^^^^^^^^^^^^^^^^^^^^ "Colonel, the mission was accomplished. Apparently the sniper was firing from the 34th floor, so we simply took out the building. There was minor collateral damage, of course." Such overreaction to terrorist events is often precisely what a terrorist wants, as I've explained a couple of times. >> You are essentially making my point, that the biggest danger of the current >> responses to terrorism is that nations will turn to national terrorism and >> police state tactics. > > I missed that in your original post. Well, go back and look for it. The clear point of my post was that the U.S. should not adopt police state measures so as to reduce terrorism. >> >A third option is quite simply to buy as much of it as possible. >> No, wouldn't work. As with the "War on (Some) Drugs," all this does is >> raise the price a bit, actually making it a more tempting market for many >> to get into. > > If the US were to offer Russia $3 billion (or whatever) >in a one time take it or leave it for their entire chemical weapon stock, >it might get the soviet shit off the market. The nuclear stuff is a little >easier to store (I think) and it would be a harder sell. As with "buying out" the coca crop in Peru, the poppy crop in Turkey, the marijuana crop in the dozens of countries, etc., their motto is, obviously enough, "we'll make more." Again, the Sarin attack in Tokyo had nothing to do with former U.S.S.R. CBW weapons. Chemical and biological agents are cheap to make, especially in the quanties needed to kill only a few thousand people, and in the non-battlefield delivery environment. > I agree tho' that it isn't possible to buy out the market. Then why do you float ideas such as buying out the Soviet arsenal if you think it isn't possible? --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: blocking software & brock meeks
by Erik E. Fair 17 Dec '03

17 Dec '03

Vladimir, I agree with you in general, however, Brock and Declan have a point to make too: these companies need to differentiate themselves based on two things: 1. basic philosophy of filtering (why they filter what they filter). 2. diligence in keeping up their databases. Brock & Declan are right to expose the basic filtering philosophies of the different companies, so that those of us who may wish to avail ourselves their services know exactly what we're getting (or rather, not getting). In the end, the market will choose between the simple "no porn" philosophy (for whatever your definition is of that), and the "christian family values approved by the christian coalition" philosophy (with, one hopes, a whole lot of other points on the spectrum in the middle). However, the consumers cannot make this choice absent the information; Brock & Declan have done everyone a service by shining some light on this. What I'm surprised about is that these companies apparently aren't already trumpeting their philosophies of filtering themselves. The principle differentiator for this market is not the software - there really aren't that many ways to filter this stuff, and these companies ought to share their techniques in that area so that they can all be more effective and thus serve their customers better. The real differentiator is what's in their databases, which (one presumes) is driven by each of their philosophies of what is "harmful" to minors. One wonders if these companies might be embarassed to actually take a public position on this burning issue: just exactly what *is* "harmful" to minors? Personally, I fail to see how they can avoid it - it is the essence of their entire business. Erik Fair <fair(a)apple.com>

1 0

Re: anonymous remailers
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: Cypherpunks ## Date: 07/02/96 03:36 pm ## Subject: Re: anonymous mailing lists ] >Date: Sat, 29 Jun 1996 09:40:51 -0700 >From: Hal <hfinney(a)shell.portal.com> >Subject: Re: anonymous mailing lists >Wei Dai did some nice statistical analysis of this type of attack >sometime a year or two ago. Even with countermeasures such as you >suggest, if they are not perfect, so some information leaks correlating >incoming and outgoing messages, Wei showed that it was possible to >deduce the owners of the nyms surprisingly quickly. Yes, this makes sense. As I said before, this is related to the way timing attacks work. A little correlation that shouldn't be there, over many messages, turns out to be enough to unravel a lot of information. >The countermeasures do work - if you get and send exactly 50 pieces of >4K byte email every day, no matter what, then correlations don't exist >- but they are expensive to do perfectly. At the very least, this is susceptible to a flooding attack. At any rate, this is analogous to the fixed-delay solution to timing attacks. (Make all PK operations with long-term secret keys take the same amount of time.) Unfortunately, I can't see a solution to this that's analogous to blinding out the values in the timing attacks. >Hal Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMds0LUHx57Ag8goBAQHPeQP+JH4b7bJCLW3ttqQ+v0XzEcbCaeOg9LqR e+xuaLx2AjCx5N+V2q3xeJTAldfZZ5YFwCUq3KgpnBAbDvJ1my0hCGmKj+1uXQTp SFSciq5oItMo2kwncbez2RaN/0aqcDSOGnc4ddfO4Ur7H7k+aLOQuaAUvcvDpV1p C8up+1PSPW0= =60Zh -----END PGP SIGNATURE-----

1 0

Re: anonymous remailers
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks ## Date: 07/02/96 03:35 pm ## Subject: Re: anonymous mailing lists ] >Date: Fri, 28 Jun 1996 23:04:28 -0500 (CDT) >From: ichudov(a)algebra.com (Igor Chudov @ home) >Subject: Re: anonymous mailing lists >How about this attack: suppose I want to find out who hides behind >an alias MightyPig(a)alpha.c2.org and I have the ability to monitor >all internet traffic. Then I simply start mailbombing that address >and see whose account gets unusually high traffic volume. Yes. This is a simpler version. The advantage of the attack I was describing over this attack is that an attacker doesn't have to know how to send messages to the recipient--just where the stream of messages is originating. >A nice, albeit quite expensive, way of pretection from traffic analysis >is to create a mailing list (or a newsgroup) and forward all messages to >all users of that mailing list or newsgroup. Of course, since messages >are encrypted, only the recipients will be able to decrypt them. The flaw here is that only a small number of people will be willing to plow through any volume of messages at all, in order to occasionally get a single readable message. There are also some potential problems with giving the right recipient a cheap way to determine whether or not this message is for him, without giving anyone else a cheap way to determine this. (An application for ``Rabin for Paranoids,'' anyone?) >This way the list of suspects is all subscribers of that list or >newsgroup and there is no way to discriminate them. If this is a small enough group, that may still be a problem. And the bandwidth and processing requirements are probably enough to ensure that it's a small group. >Instead of having messages to be sent to all recipients all the time, >alpha.c2.org may be programmed so that it sends out every message not to >only one recipient X, but to X and 20 other randomly selected people. This makes the attack only a little harder. If the other 20 are selected randomly, then for a stream of many messages, only one recipient will correlate properly with sender volume and timing. If it's the same 20 every time for a given receiver, then the attacker will be able to narrow the recipient down to 20 people. At that point, he can use other techniques (wiretaps, black-bag jobs, TEMPEST attacks, etc.) to make his final determination. > - Igor. Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMds0OUHx57Ag8goBAQFE8QP/ZWBP32mg2xdkcUrloFwruW+4L1bgY+Uk CEGxngqarxQxTNAckF0vOzpbS5gtjrs6dlEOFIQGeEuF3UWxHeKUIoOejofBZ2vT Htp/FT4x2xkfTFlgVE6GLyjE7bxK8DqfwH3ACAtbR4l+YwKQDNoInfpeFw0HKD40 jC/R8M7l0Lk= =9uja -----END PGP SIGNATURE-----

1 0