December 2003 - cypherpunks-legacy

Open Gates?
by kdf＠gigo.com 17 Dec '03

17 Dec '03

[Please respond via netmail, as I have only limited access to the list.] Does anyone have a _current_ list of open mail-to-news gates? As far as I can tell, the only one is: group.name(a)pubnews.demon.co.uk Thanks for any help. -- : Fidonet: John Erland 1:203/8055.12 .. speaking for only myself. : Internet: kdf(a)gigo.com

1 0

Re: Cookies anyone?
by Yanni 17 Dec '03

17 Dec '03

> Rather than bring down my system by experimenting, I thought I'd ask > the list, "What happens if I delete this file?" you loose any cool stuff that cool sites give you. we are using them (along with searchArgs) for a client to allow a "buddie" to follow you around the site....when you come back, the buddy tells you how long you have been gone, etc...a really cool fun harmless application of cookies that makes the user experience much more fun and personal... > and "What happens if > I delete (edit) the cookies?" if you don't keep the format, navigator will probably remove that line when it starts up. if you keep the format, and have edited the cookie, the site on the other end might not know what to do with the cookie when it gets it again...(depends on how good the error checking, etc is...) > This may have been discussed before, but until now I never checked > for cookies. either way, contrary to popular belief, cookies really aren't a security risk because they don't contain any information that you don't already know. if a site gives you a cookie with your password in it ( especially in clear text ), then they (the cgi programmers) are idiots and should be shot on the spot. regards, -jon Jon (no h) S. Stevens yanni(a)clearink.com ClearInk WebMagus http://www.clearink.com/ finger pgp(a)sparc.clearink.com for pgp pub key We are hiring! Check out... http://www.clearink.com/clearink/home/job.html

1 0

Re: anonymous mailing lists
by Hal 17 Dec '03

17 Dec '03

From: Jeffrey A Nimmo <janimmo(a)ionet.net> > On Fri, 28 Jun 1996 ichudov(a)algebra.com wrote: > > Then users of alpha.c2.org will have to install mail filters that > > automatically delete all incoming mail not intended to be read by them > > (they can't read such messages anyway). > > How exactly would this be done? Since messages from alpha.c2.org > are conventionally encrypted, they don't contain key id's. > > Wouldn't that require every recipient to store his/her passphrase > and call pgp for every message to see if it could be decrypted? This in > and of itself would be a more serious security breach, not to mention an > _enormous_ drain on site resources. Since the PGP is run on private computers, and only at mail-reading time, there should be no problem entering the conventional encryption passphrase and checking to see whether the messages decrypt. Actually PGP puts a pattern at the beginning of the encrypted portion, so successful decryption can be checked very quickly, without much of a computational load. Hal

2 1

Re: anonymous mailing lists
by Hal 17 Dec '03

17 Dec '03

From: ichudov(a)algebra.com (Igor Chudov @ home) > A nice, albeit quite expensive, way of pretection from traffic analysis > is to create a mailing list (or a newsgroup) and forward all messages to > all users of that mailing list or newsgroup. Of course, since messages > are encrypted, only the recipients will be able to decrypt them. This was discussed here several years ago, under the name "anonymous message pools". Myron Cuperman, the operator of the extropia remailer implemented one, although I don't know if it is still running (I haven't gotten any mail from it for years). It was basically just a mailing list specifically for this purpose, that you would use as your anonymous return address. Of course a problem is that there may not be enough people signed up to provide much privacy protection. Hal

1 0

Re: Alternic.net (was domain zapping)
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 09:03 AM 6/28/96 -0700, Bill Stewart wrote: > If you don't do it carefully, > you'll end up needing a bunch of Above-Top-Level nameservers that > serve the names of the tens of thousands of top-level domains. Five thousand top level domain names is quite manageable, no big problem provided that their servers are reasonably stable -- and if the unstable ones do not work well, big deal. A hundred thousand would be a problem. Assume a top level domain typically lasts forever, and a top level server typically lasts ten years. Assume two new top level domain names appear each day, and that it typically takes a several of months of reliable service to be added to the most generally accepted lists. This does not seem to constitute an intolerable burden to most domain name server administrators. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Message pools _are_ in use today!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:37 PM 6/29/96, Hal wrote: >From: ichudov(a)algebra.com (Igor Chudov @ home) >> A nice, albeit quite expensive, way of pretection from traffic analysis >> is to create a mailing list (or a newsgroup) and forward all messages to >> all users of that mailing list or newsgroup. Of course, since messages >> are encrypted, only the recipients will be able to decrypt them. > >This was discussed here several years ago, under the name "anonymous >message pools". Myron Cuperman, the operator of the extropia remailer >implemented one, although I don't know if it is still running (I >haven't gotten any mail from it for years). It was basically just a >mailing list specifically for this purpose, that you would use as your >anonymous return address. Of course a problem is that there may not be >enough people signed up to provide much privacy protection. The newsgroup "alt.anonymous.messages" has existed for a year or two, and serves to be working reasonably well as a message pool. Check it out. One will find numerous messages of the sort copied below. Having browsed some of the less common newsgroups (and trolled, in my my earlier days), I surmise that messages to nyms like "TheBear" are related to "support and recovery" sorts of topics. (I mention this because this is a compelling example of where anonymity is often sought; that people are using remailers and message pools to communicate is interesting. When Louis Freeh claims that remailers are only being used by hackers and Russian mafia arms exporters, this is a counterexample.) Here's just one such message, of several I saw this morning in "alt.anonymous.messages". (Note that anonymous message pool sorts of messages also appear directly from time to time in groups like "alt.abuse.recovery" and that ilk.) --begin copied message-- From: nobody(a)REPLAY.COM (Anonymous) Newsgroups: alt.anonymous.messages Subject: TheBear Date: 15 Jun 1996 14:26:12 +0200 Organization: Replay and Company UnLimited Lines: 14 Sender: replay(a)basement.replay.com Message-ID: <4pua54$gt6(a)basement.replay.com> NNTP-Posting-Host: basement.replay.com X-XS4ALL-Date: Sat, 15 Jun 1996 14:26:17 MET DST XComm: Replay may or may not approve of the content of this posting XComm: Report misuse of this automated service to <abuse(a)REPLAY.COM> -----BEGIN PGP MESSAGE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface hIwDrINEDTBBpVEBA/4sKOcgI33fdk6Pz5V27OIX0KiVfb4YDwgNLDpf6Wy0uvix 4oQ9p+vmtsZ32dPBoG4aF7bvh5ejqwZSpvuKOpgt1M8SKbA+Nma+EclMzQ3us3Ey OX5aFKo3TwB1Ck8tZPhpF8b/fI8gqz5v2FJhnon6NdktjFBVo3SBXya8AdlgUaYA AABsOTd6WOMH8PWnKHuP7PMCflH2p+halmCDsn9ytmoG6uzrINHH/B8c7aW6c7xw 9nXbB+99xLldhAqyg1M/oKi4pjfJ8cuSonDxMPTP8rr49XTCFaiOuQ7JUe3MEaop NIppnoBMrBvGRkKOgrYy =lYbJ -----END PGP MESSAGE----- --end copied message-- --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: anonymous mailing lists
by Hal 17 Dec '03

17 Dec '03

Wei Dai did some nice statistical analysis of this type of attack sometime a year or two ago. Even with countermeasures such as you suggest, if they are not perfect, so some information leaks correlating incoming and outgoing messages, Wei showed that it was possible to deduce the owners of the nyms surprisingly quickly. The countermeasures do work - if you get and send exactly 50 pieces of 4K byte email every day, no matter what, then correlations don't exist - but they are expensive to do perfectly. For now we have much worse weaknesses; none of the current return-address systems are really safe, other than posting encrypted mail to newsgroups (and even that may be a problem if they suspect who you are and are monitoring your computer link to see if you download certain messages). Hal

1 0

Re: crypto and bagpipes [NOISE]
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:55 PM 6/28/96 -0400, Declan B. McCullagh wrote: >Excerpts from internet.cypherpunks: 27-Jun-96 Re: crypto and bagpipes >[NO.. by "Perry E. Metzger"@pierm >> No one who has heard sustained bagpipe playing can deny the fact that >> bagpipes are indeed an instrument of war, with no legitimate place in >> peaceful everyday society. > >Hmm... Carnegie Mellon University is the only school in the country with >a bagpipe major, you know. You haven't lived until you've heard a >screeching 'pipe at 3 am in front of Hunt Library. I guess this explains the pro-censorship outlook of the students and staff there. Maybe someone should be investigating the evil effects of bagpipes on the mind. (The Freudian implications of bagpipe playing alone should get someone there to do something about it...) --- |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: crypto and bagpipes [NOISE]
by Michael Myers 17 Dec '03

17 Dec '03

At 12:37 PM 6/29/96 -0500, Adam Shostack wrote: >Damnit, Perry, the fact that you don't like them doesn't mean we >should outlaw them! :) > >Adam > >Perry E. Metzger wrote: >| vinnie moscaritolo writes: >| > >>>Mr Brooks, the piper, (...) >| > >>>claims he wasn't playing a musical >| > >>>instrument, but practising with a weapon! >| > >>> >| > >>>The imagination boggles if his claim is successful! >| >| No one who has heard sustained bagpipe playing can deny the fact that >| bagpipes are indeed an instrument of war, with no legitimate place in >| peaceful everyday society. >| >| Perry Of course...when bagpipes are outlawed... -- Michael Myers Vote Libertarian....you'll sleep better! Don't like abortion? Don't have one. Don't like guns? Don't buy one. | Don't like bagpipes? Don't play one! | blackavr(a)aa.net E-mail for PGPv2.6.2 public key \____________ http://www.aa.net/~blackavr/homepage.htm ________________/

1 0

Re: fbi botches intel "ecspionage" case
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:25 PM 6/29/96, Larry Detweiler wrote: >we already have a very good example where this has >backfired. I was watching Nightline on Tues night or >so in which there was info about how the FBI helped >get an informant into Intel in a *very* sensitive >position, where he was able to film the pentium chip >plans. he said he sold them, as I recall, >to iraq, syria, china, etc. I didn't see this particular "Nightline," so I can't be certain this is the same case I have been casually following for a couple of years. However, it sounds like the case of the guy who spent a year at Intel, stole some design tapes, went to work for AMD, offered them to AMD, had AMD refuse him and report his offer to Intel (the chip companies are very cooperative in these matters), and then proceeded on a bizarre course of offering the tapes to various foreign nations. A comedy of sorts, and his "damage" was essentially meaningless. I don't recall _anything_ about him being planted by the FBI within Intel, nor can I imagine any circumstances in which the FBI would try this. So maybe I'm thinking of a different story. >solve the problem. there was much lamentation over the >fact the criminal in question only got about 33 months >of prison time or something. > >the FBI emerged with great egg on their face. I would >say if anyone wants to ridicule them for getting into >covering "ecspionage" cases, this is a prime candidate >case. is this what they are aiming for? heh, heh. Well, the "33 months" sounds like the story I remember. Bear in mind that the tapes he took were essentially useless. A comedy, as I said. (He was down in Brazil, living with his parents, sending out press releases on how he had sold the tapes to Cuba and other such countries. He voluntarily returned to the U.S. to face charges, so it sure looks like he wanted to get caught....a psychological case more than a national security case.) >somehow we have missed a good public debate about >ecspionage in the country. there were a few NYT >editorials, but it is clearly being used as a very >major aspect of promoting the new post-cold-war spy >and intelligence strategy without almost any notice >by major analyists. Larry, you must not have been subscribed during the months when we debated this issue many times. There have also been numerous mentions of this since at least 1990, when I recall discussions of a change in mission for the NSA. >2. we have a tradition of separation of church and state in >this country, and also separation of the public government >and private industry. suddenly we have the FBI saying they >want to infiltrate companies to deal with economic espionage. >well, these companies have their own policy, and what do >they gain by having a government agency working inside them? >in the above case I note, it led to exactly the *opposite* >of what was intended: the theft of *highly*sensitive* plans >by an FBI mole. In the case I described, involving Intel and Pentium plans and a recent prison sentence, this was not the case. The FBI did not plant the thief. >if someone else can give more info on this case (apparently >a book is coming out about it or something) including the >guy's name, I'd appreciate it, I didn't take any notes so >this is a bit fuzzy. I'm sure an Alta Vista search would turn up this story. I don't plan to do it, though. I'm relatively certain the "Nightline" piece you cite is related to the case I've described. Whether "Nightline" got its wires crossed, or Larry did, is unknown to me. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1