December 2003 - cypherpunks-legacy

Re: blocking software & brock meeks
by Erik E. Fair 17 Dec '03

17 Dec '03

Vladimir, I agree with you in general, however, Brock and Declan have a point to make too: these companies need to differentiate themselves based on two things: 1. basic philosophy of filtering (why they filter what they filter). 2. diligence in keeping up their databases. Brock & Declan are right to expose the basic filtering philosophies of the different companies, so that those of us who may wish to avail ourselves their services know exactly what we're getting (or rather, not getting). In the end, the market will choose between the simple "no porn" philosophy (for whatever your definition is of that), and the "christian family values approved by the christian coalition" philosophy (with, one hopes, a whole lot of other points on the spectrum in the middle). However, the consumers cannot make this choice absent the information; Brock & Declan have done everyone a service by shining some light on this. What I'm surprised about is that these companies apparently aren't already trumpeting their philosophies of filtering themselves. The principle differentiator for this market is not the software - there really aren't that many ways to filter this stuff, and these companies ought to share their techniques in that area so that they can all be more effective and thus serve their customers better. The real differentiator is what's in their databases, which (one presumes) is driven by each of their philosophies of what is "harmful" to minors. One wonders if these companies might be embarassed to actually take a public position on this burning issue: just exactly what *is* "harmful" to minors? Personally, I fail to see how they can avoid it - it is the essence of their entire business. Erik Fair <fair(a)apple.com>

1 0

Re: anonymous remailers
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: Cypherpunks ## Date: 07/02/96 03:36 pm ## Subject: Re: anonymous mailing lists ] >Date: Sat, 29 Jun 1996 09:40:51 -0700 >From: Hal <hfinney(a)shell.portal.com> >Subject: Re: anonymous mailing lists >Wei Dai did some nice statistical analysis of this type of attack >sometime a year or two ago. Even with countermeasures such as you >suggest, if they are not perfect, so some information leaks correlating >incoming and outgoing messages, Wei showed that it was possible to >deduce the owners of the nyms surprisingly quickly. Yes, this makes sense. As I said before, this is related to the way timing attacks work. A little correlation that shouldn't be there, over many messages, turns out to be enough to unravel a lot of information. >The countermeasures do work - if you get and send exactly 50 pieces of >4K byte email every day, no matter what, then correlations don't exist >- but they are expensive to do perfectly. At the very least, this is susceptible to a flooding attack. At any rate, this is analogous to the fixed-delay solution to timing attacks. (Make all PK operations with long-term secret keys take the same amount of time.) Unfortunately, I can't see a solution to this that's analogous to blinding out the values in the timing attacks. >Hal Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMds0LUHx57Ag8goBAQHPeQP+JH4b7bJCLW3ttqQ+v0XzEcbCaeOg9LqR e+xuaLx2AjCx5N+V2q3xeJTAldfZZ5YFwCUq3KgpnBAbDvJ1my0hCGmKj+1uXQTp SFSciq5oItMo2kwncbez2RaN/0aqcDSOGnc4ddfO4Ur7H7k+aLOQuaAUvcvDpV1p C8up+1PSPW0= =60Zh -----END PGP SIGNATURE-----

1 0

Re: anonymous remailers
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks ## Date: 07/02/96 03:35 pm ## Subject: Re: anonymous mailing lists ] >Date: Fri, 28 Jun 1996 23:04:28 -0500 (CDT) >From: ichudov(a)algebra.com (Igor Chudov @ home) >Subject: Re: anonymous mailing lists >How about this attack: suppose I want to find out who hides behind >an alias MightyPig(a)alpha.c2.org and I have the ability to monitor >all internet traffic. Then I simply start mailbombing that address >and see whose account gets unusually high traffic volume. Yes. This is a simpler version. The advantage of the attack I was describing over this attack is that an attacker doesn't have to know how to send messages to the recipient--just where the stream of messages is originating. >A nice, albeit quite expensive, way of pretection from traffic analysis >is to create a mailing list (or a newsgroup) and forward all messages to >all users of that mailing list or newsgroup. Of course, since messages >are encrypted, only the recipients will be able to decrypt them. The flaw here is that only a small number of people will be willing to plow through any volume of messages at all, in order to occasionally get a single readable message. There are also some potential problems with giving the right recipient a cheap way to determine whether or not this message is for him, without giving anyone else a cheap way to determine this. (An application for ``Rabin for Paranoids,'' anyone?) >This way the list of suspects is all subscribers of that list or >newsgroup and there is no way to discriminate them. If this is a small enough group, that may still be a problem. And the bandwidth and processing requirements are probably enough to ensure that it's a small group. >Instead of having messages to be sent to all recipients all the time, >alpha.c2.org may be programmed so that it sends out every message not to >only one recipient X, but to X and 20 other randomly selected people. This makes the attack only a little harder. If the other 20 are selected randomly, then for a stream of many messages, only one recipient will correlate properly with sender volume and timing. If it's the same 20 every time for a given receiver, then the attacker will be able to narrow the recipient down to 20 people. At that point, he can use other techniques (wiretaps, black-bag jobs, TEMPEST attacks, etc.) to make his final determination. > - Igor. Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMds0OUHx57Ag8goBAQFE8QP/ZWBP32mg2xdkcUrloFwruW+4L1bgY+Uk CEGxngqarxQxTNAckF0vOzpbS5gtjrs6dlEOFIQGeEuF3UWxHeKUIoOejofBZ2vT Htp/FT4x2xkfTFlgVE6GLyjE7bxK8DqfwH3ACAtbR4l+YwKQDNoInfpeFw0HKD40 jC/R8M7l0Lk= =9uja -----END PGP SIGNATURE-----

1 0

Re: ecash thoughts
by jim bell 17 Dec '03

17 Dec '03

At 05:53 PM 7/3/96 -0400, Simon Spero wrote: >2) If ecash is used to create a new currency- i.e. the value of a unit of >the ecash is not tied to any single existing currency, what should the >value of one currency unit be set at? (let's call it a Turing) Low, maybe a tenth of an American cent. But probabilistic payment should be used to allow the minimum average payment to go way below this, perhaps to an unlimited extent. The reason is simple: The cost of providing net transactions, and electronic transactions in general, can be expected to drop exponentially, just like the cost of telecommunications and CPU power do. Any arbitrary limit to how low they can go will act somewhat akin to the minimum wage: It will deter development of any product or service whose perceived value is less than this arbitrary minimum. Jim Bell jimbell(a)pacifier.com

2 1

Announcing the release of premail 0.44
by Raph Levien 17 Dec '03

17 Dec '03

The long awaited release of premail 0.44 is now available. This release integrates PGP and anonymous e-mail functions into Unix versions of Netscape 3.0's built-in mailer. It also does a pretty good job with Pine 3.94 (transparent integration of plain PGP mail, decoding of MIME protected mail requires a single command). For those of you interested in experimenting with S/MIME, it contains some S/MIME functions, but does not yet fully comply with the standard. The main premail Web page is: http://www.c2.net/~raph/premail.html The premail documentation is at: http://www.c2.net/~raph/premail/ I appreciate any bug reports, suggestions, or comments. Raph

1 0

Re: Message pools _are_ in use today!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:27 PM 7/3/96, Andrew Loewenstern wrote: >Deranged Mutant writes: >> Uploading can be gotten around by using anonymous remailers >> and mail-to-news gateways... although someone can tell if you >> send mail to anonymous mailers. > >Not if you run your own remailer! Agreed. And if a remailer chain is long enough, the "someone can tell if you send mail to anonymous mailers" is meaningless. (In an ideally crypto-anarchic world, millions of messages are being sent to anonymous remailers, and it is worth nothing to know that Subject A sent a message to an anonymous remailer.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: What remains to be done.
by attila 17 Dec '03

17 Dec '03

Addressed to: Black Unicorn <unicorn(a)schloss.li> Cypherpunks <cypherpunks(a)toad.com> ** Reply to note from Black Unicorn <unicorn(a)schloss.li> 07/03/96 10:17pm -0400 good "white paper." modularity is the key. use of standardized encryption libraries permitting user selection of one or more formats. message pools would be great from satellite channels --how do you regulate (read this as "pay for") since someone must receive the messages to uplink? -otherwise you have the dropouts of USENET. user interface is the achilles heel for most programmers --the time is spent making the code 'work.' with the tools available which allow multi- platform development, the *functional* GUI should be done by someone who creates "artitstic" interfaces. I agree-- if encryption can be made so simple, and with a clean user interface, it will be used by joe sixpack (who rarely likes uncle, anyway --but for different reasons). once joe sixpack starts to use (probably dropping his private keys...), then it is too pervasive to stop --even if there are a few high level prosecutions. one of our greatest failings v/v encryption as a group (including coderpunks) is we are satisfied with our access to encrytion. PGP is a nusiance, and the instructions are not clear --so we experiment until we get the results: on the command line. our satisfaction makes us insular; we need to think in global terms --mass marketing of a free product which will hold appeal for everyone. encryption is no different than the students in China --no, they do have it, but how long can Father Deng (and his successors) hang on against technology and quest for knowledge? -- Fuck off, Uncle Sam. Cyberspace is where democracy lives!

2 1

Re: Wanted: NNTP posting access for remailers
by loki＠infonex.com 17 Dec '03

17 Dec '03

I would be willing to give you permission to use news.infonex.net. I will set it up for you tomorrow. -Lance At 5:46 PM 7/3/96, lcs Remailer Administrator wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >Would anyone out there be willing to give NNTP posting or transfer >privileges to anon.lcs.mit.edu? > >Because of recent spams through mail2news(a)anon.lcs.mit.edu, I may >loose my news posting privileges to the news server I have been using. >Though I try to resolve all complaints I receive, other complaints >have been sent to other postmasters in the domain, who don't seem to >want to hear about these problems. > >If you run a news server and would like to help people posting >anonymous messages, please consider allowing posts from >mail2news(a)anon.lcs.mit.edu. Ideally you would also be in a position >to receive mail at some of the relevant postmaster aliases in your >domain, and would not mind forwarding misdirected complaints to me so >that I can deal with them. Alternatively, if you are willing to give >me "IHAVE" priviliges, I can possibly set things up with an initial >"Path:" header that guarantees most complaints will go directly to me. > >Thanks, >- -mix-admin(a)anon.lcs.mit.edu > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 >Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface > >iQCVAwUBMdsT70TBtHVi58fRAQHQ0QP/U3Jn7sL9+k3aUr+qw4WdDxef/lIeu3xO >BwdO8zlNPavJgbxuunR81n011jGy80l7qnc+DpvtuEEQqszLMcMO/4zHw/VfVOY8 >08nxE8+IkF/FE66vJdnU7O3I1mIjtbF8ixcm9FOwqoehSLJB40tXy6wu6KV663TQ >fmy/Gz5XDe8= >=Gp4D >-----END PGP SIGNATURE----- ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: Message pools _are_ in use today!
by jim bell 17 Dec '03

17 Dec '03

At 05:25 PM 7/3/96 -0700, Timothy C. May wrote: >Someone mentioned the Ku-band dishes that are used by PageSat (or whatever >it is now called....). My DSS system, which is technically a Ku-band >receiver, has a digital i/o connector of some sort on the back, and it is >rumored that this will someday be available for PageSat-like uses. (I have >a feeling this may be years off, for admin reasons if not technical >reasons.) As I understand it, the DSS broadcast (unlike older C-band units) consists of a single digital stream which contains the highly compressed (MPEG?) data representing all channels. Being compressed, the data rate needed per channel varies with the scene and the rate it changes. Even if you add up a large number of these statistically-varying channels, you'll still get a fairly wide variation in the needed bit rate per second. The system must have a substantial amount of headroom to protect against occasional times when many channels need a lot of bits, headroom that is mostly not being used, most of the time. If this is correct, then most of this headroom should be available to piggybacked data traffic on a "space-available" basis. Probably tens of megabits per second. Jim Bell jimbell(a)pacifier.com

1 0

PGP
by kyleb＠juno.com 17 Dec '03

17 Dec '03

Hello, Does anyone have the latest version of PGP for Windows and/or DOS If so please reply directly, since I am not yet on C'Punks. Thanks, KyleB(a)juno.com

1 0