December 2003 - cypherpunks-legacy

Re: SEVERE undercapacity, we need more remailers
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

It occurs to me that a certain number of companies have schemes that could easily be used to set up anonymous, transient mailing output ends on anonymous remailers. These are AOL (with its famed lack of true credit card verification) and free email services such as Juno. The idea would be to have a remailer address that took in mailings, then sent any that were to go other than to another remailer via a temporary account. Now, this would have the potential problem of decreasing remailer reputation among those in such companies; for AOL, it would also decrease the chance of anyone paying attention to the remailed messages (people deleting stuff from @aol.com automatically, etcetera). -Allen

1 0

Re: Senator Leahy, your public key please?
by Bill Stewart 17 Dec '03

17 Dec '03

Senator Leahy is the first member of Congress to publicize a PGP key. (There are already fake keys for Bill and Hillary Clinton and Al Gore.) A Washington-area Cypherpunk recently visited Senator Leahy's office and asked if he could verify that the PGP key posted to the net for Senator Leahy was correct*, so he could sign it; while it would be difficult to fake responses to the "PGP Public Key" entry on his web page, it could be done, and a fake key could be publicized in other ways. He was told that there's some Congressional silliness about the issue - what's the political implication of having someone sign your key? Postmaster(a)senate.gov is fine, but are there ethics questions if ACT UP, Big Oil or the Christian Coalition signs it, or if Newt Gingrich or your party's Majority Leader refuses to sign it - are those endorsements? Tim May pointed out that you don't _need_ anybody's permission to sign their key; just do it and send to the keyserver. Even if they don't like you. >What if, for example, Sen. Leahy _did_ end up in the web of trust for Aryan >Nation? Even if he never intended it, this could have some severe PR >repercussions. >An exciting new world we're entering. It's really hard to get handed a straight line like this and have to pass it up, but I'm _not_ going to create an Aryan Nations key, and I'm _not_ going to send it to keyserver(a)canopener.worms.mit.edu. Black Unicorn's experience at Senator Leahy's office implies there are too many clueless Congresscritters around who would recognize the political potential and make a Law to Do Something about it, just as Georgia recently made a law against making links to people's web sites without their permission. While the Republicans in Congress, having somehow found themselves on the side of Free Speech with Leahy against Clinton's administration, may be able to pass laws reducing the government's encryption-export and wiretapping efforts, a good scare like this could make it more difficult. Sigh. :-) I haven't Cc:d this to Leahy - Should I? Meanwhile, what should we do about PGP key signatures? PGP 3.x is still being developed, and keyservers can be updates as needed. While I agree that keyservers don't need to validate keys - that's a job for the web of trust, and the keyserver-admin could sign keys if he/she/it wanted to - it may make sense for the keyservers to only accept keys in messages signed by the key itself. (Just signing the key doesn't help much here; you need to sign the key-plus-signatures.) Does it make sense to include some similar capability in PGP itself? Leahy has at least signed his own key... # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: Instant Remailers
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

Someone said: > >It is possible for someone to operate an anonymous remailer anonymously. > >Just get a UNIX shell account under a fake name, pay with cash, and set up > >the remailing software. The identity of the operator of such a remailer > >would be difficult, if not impossible, to discover. Then someone else said: > (Doesn't Sameer's system offer such accounts? Couldn't there be dozens of > remailers based at c2.org? Of the 16 Type-1 remailers listed in one of > Raph's recent reports, only 2 were at c2.org.) This happened. Remember robo(a)c2.org? Whatever happened to it? (Anyone ever figure out who the real operator was?)

1 0

Re: The Crisis with Remailers
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"loki(a)infonex.com" 18-MAY-1996 20:02:12.04 >I was invited to the digicash API design meeting precisely to make sure it >could be used in remailers. It will not be using the current API. The >problem is that Mixmaster requires exact knowledge of the size of every >object in the message, to maintain constant message size. I could set aside >room for one, two, three coins, but there is no guarantee that the payment >will be made with only that many coins. The current API is going to be high >level. It will does not allow the program to know anything about the >internals of the payment. I need to be able to specify payment of amount X >using no more than N coins. As soon as I have that level of control, you >will see postage in Mixmaster. Good. I can see doing a limited postage now, actually, with relatively simple modifications - the postage goes to the initial remailer front end and to the remailer that sends out the message to something other than another remailer. -Allen

1 0

Re: Remailers & what they get out of it...
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"ravage(a)ssz.com" "Jim Choate" 18-MAY-1996 09:43:06.96 >As long as the remailer is run a 'grins & giggles' affair you are right. There is the increase in reputation capital in _some_ quarters possible through running a remailer. (On the other hand, in authoritarian quarters, it would tend to decrease one's reputation capital...) >To me the biggest problem with the crypto work right now is that not enough >professionals are involved. If more remailers and such were initiated as >a business there would be legal avenues to explore. Also, in this vain is >the apparent lack of support for commercial ventures by developers of such >apps as MixMaster (whose license explicity prohibits commercial use). It prohibits commercial use? That's silly. Is it a holdover from when the idea was to turn Mixmaster into a company? >And for the record, yes, we expect to charge real $$$ for access. Our >current plan is $10/month for each account. Money orders prefered. We have >at this point pondered e-cash methods but it doesn't seem popular enough >at this juncture. How would you be doing this? Only remailing from accounts that have paid up, or what? -Allen

1 0

Re: Is Chaum's System Traceable or Untraceable?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 18-MAY-1996 14:30:54.29 >I agree with Jim Bell on this completely. I don't know if Chaum has been >seduced by the Dark Side, or is looking to get digicash widely deployed by >"respectable" institutions, or is telling the truth (that his system >_never_ provided for real untraceability), but I know that Cypherpunks >should always strive for full untraceability. Given what I've picked up (including what institutions he's chosen to deal with, the behavior of these institutions - MTB's dropping of merchants disapproved of by Mrs. Grundy et al, and other information), I am willing to bet that the second is the priority. Once his patents run out, all bets are off... but it looks like he's wanting to get ecash accepted before then. Otherwise, everyone may be using various non-anonymous (or GAKed anonymous) methods like credit card encryption. Unless I'm reading the ecash protocols wrong, using the current version of the software some degree of payee anonymnity is possible. -Allen

1 0

Re: A cryptographic alternative to escrow agents (Matts' half coin)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"unicorn(a)schloss.li" "Black Unicorn" 18-MAY-1996 11:46:08.35 >The mint is the escrow agent. It still (obviously) needs to be trusted. The mint will need to be trustworthy anyway; otherwise, you can get a "final round" problem in which they print up lots of ecash and spend it before the value completely plummets, or they get lots of requests to cash existing ecash in. -Allen

1 0

Re: SEVERE undercapacity, we need more remailer servers FAST
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:07 AM 5/20/96, E. ALLEN SMITH wrote: > What countries are noticeable for being anti-Scientology? They would >appear to be good locations for special-purpose remailer ultimate-output ends. But any country that is "anti-Scientology" is likely to be repressive in various ways we would find inimical to our goals. Germany is a prime example: yes, they have placed restrictions on the CoS, but they have also ordered crackdowns on Internet sites. Whatever one may think of Scientology, or Catholicism, or Baalism, or whatever, crackdowns by the government ("anti-Scientology," "anti-Catholic," etc.) is not a good thing. (The issue of how believable the claims of CoS are is no more relevant than similarly outlandish claims that taking communion is eating the flesh of JC. And the issue of CoS seeking legal actions against those they claim are violating their copyrights is separable from their religious status. As I have said many times, "Newsweek" would likely take similar actions in similar circumstances.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: The Crisis with Remailers
by lcs Mixmaster Remailer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > not!!! I should have made this clear, but imho no matter how favorably > the public sees anonymity, I still believe there will be little > incentive to run remailers until there is some kind of ecash > scheme. I hope this is not true. Some of us simply believe it is important to help people with unpopular opinions speak without fear of harassment. I for one will continue to operate a free remailer even if the technology becomes available to charge for the service. I hope others will, too. Some people do care about things other than money. I hope the reason there aren't more remailers out there is simply that it is sort of a pain to set one up, rather than simply because nobody cares. > >People seem to forget that anyone can drop a letter into the mailbox with > >no return address. Did the Unabomber bring negative publicity to the > >postal service, causing people to demand that return addresses become a > >requirement? :-/ > > agreed, but the subject at hand was not whether anonymity is good or bad, > but whether there is some incentive to run remailers. Well, wanting there to be remailers is a good incentive to run one. Another good incentive is if you ever want to send a truly sensitive anonymous message. If you chain through your own remailer, then you can be absolutely sure that at least one remailer in your chain is not run by "bad guys." > I would be interested if any longtime remailer operators posted > statistics about the amount of mail going through their services. Usage statistics are publicly available from mixmaster remailers by sending mail with subject "remailer-stats". Whenever I've checked, the number of messages through the lcs mixmaster remailer has been around 300/day. This is neither a longtime remailer nor a particularly accurate statistic, but it should give you some idea. mix-admin(a)anon.lcs.mit.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZ//ZETBtHVi58fRAQHePQP+JQcCu/zDfhRB1BLOea+OSENfM6qRxj0h KlYtV5O+IgcmlfZ+vupbtds6IrL8GN5YAQ7kpLoSCIUPC3+r4X0ppJjqgETEYI23 cJoZU9tG3Csj+KNSRn7tDjXdPFcGooqemvhV5SERiQEkAYqzRBDCcd7VQTOGgls5 TTRHxUQ1F+c= =DOAo -----END PGP SIGNATURE-----

1 0

Re: Rumor: DSS Broken?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:05 PM 5/19/96 -0800, jim bell wrote: >At 08:33 AM 5/19/96 -0400, Robert Hettinga wrote: >>At 9:41 PM -0400 5/18/96, Bill Stewart wrote: >>> MD5 is at least weakened, maybe broken; there's an abstract by Hans >>>Dobbertin >>> that says something about generating collisions, and gives an example >>> (though the abstract doesn't say how general the method is.) >> >>That's what I get for not reading the DSS stuff when it came out. I'd heard >>lots about the MD5 stuff, but I didn't put the two together. >> >>It also looks like I'm behind in my reading. Time to buy another edition >>of Applied Cryptography... > >It should occur to all of us that if the NSA was actually doing the job we >are vastly over-paying them to do, it is THEY who should be finding, >exposing, and correcting these kinds of cryptography faults. Has anybody >ever heard any evidence that the NSA has ever acted in this sort of >responsible role? I was rather impressed by NSA's role in the creation of DES. The strengthened it against an attack which was not publicly known, and didn't, in the process, reveal the attack. (See AC2.) ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0