December 2003 - cypherpunks-legacy

How to find out if the list is down? [ADMINISTRIVIA]
by Bill Stewart 17 Dec '03

17 Dec '03

>Subject: Is the list down? No (and the delay between your posting and my reply is just because I've been too busy to read it all.) In general, if the list isn't reaching you, it's occasionally because mail is stuck between toad.com and your machine, occasionally because the list is stuck, and occasionally because you've been dropped. If you send mail to majordomo(a)toad.com saying who cypherpunks it will send you a list of everyone on the list, possibly including you. (If it doesn't include you, then you know what's wrong.) If mail's working, it usually answers pretty fast. If mail's jammed, sometimes this kicks it off, and sometimes it stalls, just like a posting you sent to the entire 1200+ list members would (:-). And sometimes there's something more subtle going on, in which case you can send mail to cypherpunks-owner(a)toad.com and/or owner-cypherpunks(a)toad.com. Of course, it could be that nobody's posted anything to the list in the last 24 hours, which probably means that Hugh's implemented the Signal-to-Noise-Improver Bot and nothing made it past the filters..... # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Dispel Authority!

1 0

Re: Slander of Catholic Church
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:59 PM 6/11/96, attila wrote: > too strong, moroni --remember _our_ values; not those of a critic. > last night in FHE I covered the first mob in Jackson County where Bushop > Partridge turned the other cheek to make it easier after the first was > tarred by the mob. Thanks, Attila. I think Paul Penrod and the Archangel Moroni missed my main point. I was not singling out Mormonism for special criticism, just using it as an example of a "cult" or "religion" which is in many ways even more "outre" to many of us than Scientology is. Belief that a body rotting in the ground can be baptized into one's church is at least as odd as believing that Mankind is descended from the survivors of spaceships fleeing an evil overlord. My point, in using Catholicism as an example (interesting that only my brief lines on Mormon views were critiqued...Catholicism must indeed be nearly extinct on lists like ours), was that one's man's "criminal cult" is another man's "holy religion," and that the "net.war" declared by some on the Church of Scientology is little different than having a similar war against Catholics, Rosicrucians, Parsees, whatever. The Church of Scientology is no more a cult than is LDS or Catholicism....it is just much newer. Believing that clam consciousness suffuses our thoughts is no stranger than are the bizarre claims of most religions. Talk is of some belief systems being "cults" and others being "religions." When the Constitution speaks of "Congress shall make no law regarding the establishment of religion...," it is clear that this is not just for "recognized" and "established" religions. (Before the usual suspects jump in with quibbles, this does not mean that a religion may not be constrained in various ways. The laws against polygamy constrained the Mormons, the laws against certain drugs constrained certain Native American religions, etc. Constitutional law classes are the best forum to debate this.) I am no supporter of the CoS, nor of any religion. I find it hypocritical for folks bashing the "clams" and bombarding a.r.s with copyrighted CoS material to now be whining that the clams are "unfairly" using a.r.s. I also find it "unsurprising" that the CoS is taking steps to preserve what it thinks is its copyrighted, proprietary material. (I am not interested in debating the ins and outs of whether the NOTS material should or should not have been published, nor of whether some investigators went overboard in investigations of Grady Ward, etc. This stuff is boring ephemera to me, just another religious war.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Zimmerman/ViaCrypt?
by vin＠shore.net 17 Dec '03

17 Dec '03

Edgar Swank noted: >There was a big discussion recently on alt.security.pgp about PRZ and >ViaCrypt. Apparently Phil now wants to produce his own commercial >version of PGP and has "requested" ViaCrypt to sell back the >commercial rights under threat of a lawsuit if they don't. > >Phil disagrees with ViaCrypts new "business" version of PGP which >apparently encrypts all messages with an employer-supplied public key >in addition to any specified by the employee. ViaCrypt has their side >of the argument on their web page. <http://www.viacrypt.com/> PRZ is becoming a businessman. Nothing wrong about that -- business is what makes the cars shine and the toilets flush. To me, however, it seems self-servingly pious to seek to reclaim previously sold rights on the grounds that a corporate customer should not have the right to set up an escrow key for company communications. There's another debate due about whether an employee should have the right to also -- on company time, over company nets, etc. -- use e-mail with a private (non-escrowed) encryption to secure personnal communications. I, predicably, think the employee should have such a right -- as part of the permissible and acceptable "personal space" allowed an employee. (Just as he/she should be allowed to make unmonitored personal phone calls, and go to the bathroom when the urge strikes.) Today, this level of privilege is probably an artifact of white collar or professional employment; not an employee's or citizen's right, but rather a perk associated with the independence granted a valued employee who expects and demands it. >The basis of the possible lawsuit would be that ViaCrypt violated >their agreement not to put any "back door" into any product with the >PGP name. Whether the "business version feature" could be defined as a >"back door" would be the crux of the argument. That's an argument that should be laughed out of court. And off the Net even sooner. (Although Phil is so much of a hero to most of us, for his own productive efforts and for having endured the DoJ's squeeze, he probably got an outrageously tolerant hearing on alt.security.pgp.) Steve Reid <root(a)edmweb.com> added: >>IMHO Phil Zimmerman has good reason to object to the mutant version, >>if >>it's going to cause the PGP name to somehow endorse escrow. Balderdash! There is nothing corrupt or nasty about escrow, per se -- the issue is who gets access to the escow key and under what conditions. If the legitimate owner of the protected information totally controls the escrow key, there is no issue. In business communications, key escow is just another dimension in backup. >>If there really is a demand for escrow, maybe cypherpunks could create a >>One Time Pad escrow service. Different custom 'keys' could be produced, >>depending on who's asking for the data... <G> There is a demand for escrow. For a while, seven or eight years ago, I collected tales of all the weak commercial crypto system which were then being busted. One of the most striking things was the number -- four or five commercial products that I recall, Lotus 1,2,3 being the most prominent -- which were cracked by legitimate administrators desperate to retrieve something encypted by an employee who had lost his/her key. Suerte, _Vin Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

Re: Remailer Operator Liability? [NOISY RESPONSE]
by Bill Stewart 17 Dec '03

17 Dec '03

>> distributed to a minor who was using a nym. I think pressure on anonymous >> remailers is going to increase as various groups complain that the paw >> innocent widdle kiddies are "vulnerable to corruption"(or some bullshit like >> that) because their age can be hidden. Read the decision. The CDA _may_ be > >This is true. Yesterday evening I interviewed the director of >enforcement for a TLA here in DC. He expressed his concern about >anonymous remailers and anonymity online. (More on this later.) > >The word here in DC is "accountability." You can always attract government officials by offerering them other bureauspeakisms, like "plausible deniability" and "convenient leak mechanisms for 'reputable sources'". # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Dispel Authority!

1 0

Re: Does information want to be free?
by Bill Stewart 17 Dec '03

17 Dec '03

>>I confess I was amused by how he described those Internet anarchists >> who delighted in publicizing books that should in fact be restricted. > I am amused (though I am not taking sides) by the general lack of >attention or rhetoric that "crypto-anarchists"/"cypherpunks"/whatever, >otherwise privacy respecting people, usually espouse. Many of us do care about those privacy issues - computers are very good at combining information from multiple sources, and crypto is about the only technology that lets you change the balance of power away from computerized centralization to individual-controlled decentralization. On the other hand, the phrase "books that should in fact be restricted" is viewed by many of us to be a synonym for "the empty set"; "books about government leaders which should be restricted" is an even emptier set, whether they're true, bogus, or some of each. In general, a Cypherpunk(tm) approach to protecting private information is not to advocate laws against distributing it, but to build tools to let you protect it while giving it to people that you _do_ want to have it; perhaps to use individual contracts to protect the information, but also to build tools to support contractual agreements and identify leaks. In some cases, boycotting organizations that violate privacy is a good idea (and building alternatives can support boycotts); flaming them for rudeness is another approach :-), and helping organizations understand the privacy implications of what they're doing and helping them use privacy-preserving methods instead of hanging an SSN on everything is another good cypherpunks activity. On the other hand, building anonymous publishing systems so people can blow the whistle on their government officials is a good thing, even though it may be used by people rude enough to pry into people's private lives. Also, while publishing one politician's cancer experience may be rude, publishing a recent American president's growing senility should have been done more aggressively, as should publishing the moral failures of his Vice president.... # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Dispel Authority!

1 0

Re: Remailer Operator Liability?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 05:53 PM 6/15/96 +1000, Zed wrote: > >Unlikely. The use of anonymous remailers was given as a reason for why it >was impossible to effectively determine if indecent material was being >distributed to a minor who was using a nym. I think pressure on anonymous >remailers is going to increase as various groups complain that the paw >innocent widdle kiddies are "vulnerable to corruption"(or some bullshit like >that) because their age can be hidden. Read the decision. The CDA _may_ be >declared constitutional if there was an effective and reliable way of >preventing minors from accessing "indecent" material - which anonymous >remailers make harder to do. However, even if remailers didn't exist, kiddies could still be unknowingly reached via mailing lists (anyone know who came up with the term "email exploder" that the Court used instead of "mailing list"?), freenet accounts, un- age verified accounts opened anywhere on earth, or borrowed accounts. The decision mentioned some of this. DCF

4 3

UK users about to get clippered
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

If you live the UK, brace yourself for HMG's "Clipper" annoucement later this week. Look particularly carefully at the escrow agencies. - Remailereuters

2 1

Re: Remailer Operator Liability?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 05:53 PM 6/15/96 +1000, Zed wrote: >On another front, anonymous remailers were brought up in the latest hearing >of the Church of Scientology's court case against Dennis Erlich. Judge Whyte >expressed concern that trade secret status could be destroyed simply by >posting information through an anonymous remailer. Of course, trade secret status could also be destroyed by posting something straight without anonymity. And were one judgment proof one's exposure as the poster would be meaningless. Even a completely non-anonymous account may be hard to trace if you have a common name and the account is based somewhere far from home. If you open an account on a Dutch system using your (common) name, you might be hard to find. It's the ease of publication not the anonymity that makes the Net dangerous for trade secrets. DCF "If the most common given name on earth is Mohammed and the most common surname is Lee does that mean that the most common name is Mohammed Lee?"

1 0

Re: pretty good reputation
by Hal 17 Dec '03

17 Dec '03

Here are some references to the material on reputations I mentioned before. ftp://prospero.isi.edu/pub/papers/security/insurance-cccs94.ps * Charlie Lai, Gennady Medvinsky, and B. Clifford Neuman. Endorsements, Licensing, and Insurance for Distributed System Services, In Proceedings of 2nd the ACM Conference on Computer and Communication Security November 1994. This discusses some concepts related to extending trust relationships through a network. ftp://research.att.com/dist/mab/policymaker.ps "Decentralized Trust Management" by Matt Blaze et al This suggests a formal way of specifying trust relationships among keys. In effect you have little programs that get activated by certain keys, or by certain signatures. It is a very flexible methodology which could be adapted to many ways of specifying trust relationships. http://theory.lcs.mit.edu/~rivest/sdsi.ps (or .tex) "Simple Distributed Security Infrastructure" by Ron Rivest and Butler Lampson This is a key certificate structure which is somewhere between a hierarchical and a web of trust system, somewhat influenced by Blaze's ideas. It is pretty limited though in the kinds of trust delegation it allows. You can accept another person's signatures on specific keys but you can't mark him as a generally-accepted signer. However you can develop chains of signatures as in PGP and perhaps some extra mechanism could be used to decide when to trust them. Hal

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"treehole"} = "<remailer(a)mockingbird.alias.net> cpunk pgp hash latent cut ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)rigel.cyberpass.net> mix cpunk pgp hash latent"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 alpha) (flame replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: The remailer list now includes information for the alpha nymserver. Last update: Mon 17 Jun 96 6:46:17 PDT remailer email address history latency uptime ----------------------------------------------------------------------- replay remailer(a)replay.com ****+*+***+* 6:14 99.98% alumni hal(a)alumni.caltech.edu #######**#+# 2:57 99.97% ecafe cpunk(a)remail.ecafe.org *##.-#+--#+# 50:08 99.96% vegas remailer(a)vegas.gateway.com -** **+*#*+# 6:21 99.90% mix mixmaster(a)remail.obscura.com .-+++++++-+ 3:15:05 99.90% c2 remail(a)c2.org -++-++++-++ 1:07:45 99.89% flame remailer(a)flame.alias.net +++++++++++ 1:05:51 99.76% penet anon(a)anon.penet.fi _______._ 60:16:03 99.64% portal hfinney(a)shell.portal.com ##*### ##+# 2:46 99.49% nymrod nymrod(a)nym.jpunix.com +**#++*+* * 9:43 99.45% lead mix(a)zifi.genetics.utah.edu +-++++++++++ 45:49 99.29% exon remailer(a)remailer.nl.com *** *++***+* 5:07 99.23% haystack haystack(a)holy.cow.net *#* +--#*-*+ 23:51 99.18% amnesia amnesia(a)chardos.connix.com ------- --- 3:19:01 96.26% extropia remail(a)miron.vip.best.com ---.-- ---- 6:23:54 94.00% ncognito ncognito(a)rigel.cyberpass.net -....- .. 14:29:58 89.44% treehole remailer(a)mockingbird.alias.net +-++++++ 3:28:59 62.60% alpha alias(a)alpha.c2.org ++***+- 37:51 49.39% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0