December 2003 - cypherpunks-legacy

Undeliverable Message
by MAILER-DAEMON＠mqg-smtp3.usmc.mil 17 Dec '03

17 Dec '03

To: <cypherpunks(a)toad.com> Cc: Subject: Re: Cypherpunk Mailboxes? Message not delivered to recipients below. Press F1 for help with VNM error codes. VNM3043: BANYAN SERVER@MAG26@2DMAW NEW RIVER VNM3043 -- MAILBOX IS FULL The message cannot be delivered because the recipient's mailbox contains the maximum number of messages, as set by the system administrator. The recipient must delete some messages before any other messages can be delivered. The maximum message limit for a user's mailbox is 10,000. The default message limit is 1000 messages. Administrators can set message limits using the Mailbox Settings function available in the Manage User menu (MUSER). When a user's mailbox reaches the limit, the user must delete some of the messages before the mailbox can accept any more incoming messages. UNDEFINED-----BEGIN PGP SIGNED MESSAGE----- On Mon, 2 Sep 1996, William H. Geiger III wrote: > Hi, > > I have a thought for addressing the anon. problem. > > We could create a network of anonymous remailers with mailboxes. All > messages in the mailboxes are stored encrypted. No information about the > users are keep. Users would be be given x K of mailbox space. > > We could use PGP keys for encrypting the messages. Each user would have his > own key pair for his anonymous mailbox. Any plain text messages received to > the server would be encrypted on recept. > > Let the government's subpoena away. :) > > "Sorry we don't have user addresses, no I can't decrypt those messages > Senator." <BEG> > > What do you think? The only problem is there has to be someway for users to retrieve their mail. The current nym server approach is to use an encrypted reply block to send a user new mail. This way the nym server doesn't know who the user is. If users have to actively retrieve their mail, then the feds could install a packet sniffer on the remailers net link to find out the real email address of an anonymous user. - -- Mark PGP encrypted mail prefered. Key fingerprint = d61734f2800486ae6f79bfeb70f95348 http://www.voicenet.com/~markm/ -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMiscESzIPc7jvyFpAQGQ8ggAoHoGwwLI/8WI3XEBvA/Yo/lOPu1bQGYZ +m/jYzZjlF/YcS54J+H+L+xRo9WcOJkm7LLetTRZM3N/vG71M01vLcoOnfciRjFz AhLj2V5DGEcyQE0GMBXOxgxKvnzMVkFJh6ZWFalIM0DedncdX541W3j+almPb7Yr YyT+On5mqbPd0U5rJgv2CfE5CFlAE7XyO0KteH5aONK3f6TxzGH4cGG8wSZaBiu4 jP55nTl8VdtMH7MBDqOFkAH7IOboDZzjDglbuFHFk/nhtKfYIzg4c/ck5VCZ1vs8 xIqaPIMzpQF/smfKS2upyhZB1fb3G101lUJmjoVkEATQhwMzLBhY1Q== =QbyB -----END PGP SIGNATURE-----

1 0

Re: FWD: Another try to kill democracy
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On Sep 02, 1996 21:53:42, 'SPG <spg(a)dds.nl>' wrote: >As student history I can name several people also labelled 'terrorist' before >by a government, who were not. 'Terrorist' is the name opressive and >undemocratic Junta's use for their opposition. --------- >From the US journal "Foreign Affairs," Sep/Oct, 1996: Postmodern Terrorism Since 1900, terrorists' motivation, strategy, and weapons have changed to some extent. The anarchists and the left-wing terrorist groups that succeeded them, down through the Red Armies that operated in Germany, Italy, and Japan in the 1970s, have vanished; if anything, the initiative has passed to the extreme right. Governments and media in other countries do not wish to offend terrorists by calling them terrorists. The French and British press would not dream of referring to their countries' native terrorists by any other name but call terrorists in other nations militants, activists, national liberation fighters, or even "gun persons." ---------- For the full 30kb essay see: http://jya.com/pothot.txt

1 0

Re: FLT 800: From the Rumor Mill...But It Makes Sense.. (fwd)
by James A. Donald 17 Dec '03

17 Dec '03

At 09:04 PM 9/1/96 -0400, Alan Horowitz wrote: > The Aegis ship in the Gulf wzs not in an exercise. It was in a war zone. > > If my memory serves, the Iranian jetliner had its squawker turned off, or > broken. Your memory does not serve: The computers record of the events was: Computer tells crew: Civilian jetliner on radar. Crew expecting an attack by jetfighters, tell computer to shoot it down. Computer does not put up a bunch of dialogs saying: "Hey, I think this is a CIVILIAN airliner, did you get that CIVILIAN airliner, are you quite sure you want it shot down? Instead it just shoots it down. Human error by the American military. Possibly poor user interface on the computer. Possibly indifference to civilian lives by the American military. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Pseudocrypto detector is going wild (was: Re: ALPHACIPHER - An unbreakable encryption program.)
by Bill Stewart 17 Dec '03

17 Dec '03

C Matthew Curtin <cmcurtin(a)research.megasoft.com> posted a reference to ALPHACIPHER, which appears to be Yet Another Snake Oil System. It's got good intentions - it uses (ahem) "one-time pads", and tries to build a convenient user interface for low-volume work. Of course, it apparently doesn't quite get it: > ALPHACIPHER uses key sets generated by a > proprietary random key set generator > to insure the production of unique, high-quality keys. The key set generation is inherently part of the encryption process; since it's proprietary, it's not possible to test the quality of the random numbers, but they must be assumed to be low-quality crackable stuff unless the author is willing to reveal the algorithm and demonstrate otherwise. The program is written in DOS, and produces its output as UPPERCASE LETTERS to avoid being caught by eavesdropping scanners that might detect other patterns. Not unreasonable, I guess. The author, Wolfgang Hammersmith, also wrote The New ADFGVX, a cypher that can be done by hand (if necessary), which he does acknowledge is breakable, but comments that for short messages, there may not be enough information to break it. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: strengthening remailer protocols
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:25 PM 9/2/96, John Anonymous MacDonald wrote: >I don't really see the use of this complicated scheme. The main >problem seems to be that if M floods remailer R with messages to B, >and A sends a message to C through R, then it will be clear to M that >A's message was destined for C. > >Rather than divert messages, then, I propose that for each input >message there is a 10% chance that a piece of cover traffic is >generated. Thus, if M sends 50 messages through R and sees 6 outgoing >messages going to remailers C, D, and D, he will now know which >messages correspond to the message that A send through. This type of attack is why "reply-block" schemes are fundamentally flawed. Any such scheme gives an attacker (a traffic analyst) a wedge with which to deduce mappings. It is a kind of "chosen plaintext" attack (loosely speaking). Or a "forcing attack." Maybe a "flooding attack" is as good a name as any. One floods the reply block and simply watches where the water goes. (If there were more academics in the crypto community looking at digital mix issues, there would likely be clever names for the various attacks.) Several folks on this list, including (from memory), Scott Collins, Wei Dai, Hal Finney, myself, and others, have noted this weakness over the years. Note that merely fiddling around with probabilities of transmission, such as described above, will not be enough. This just adds a layer of noise, which will disappear under a correlation analysis. (For newcomers, there are interesting parallels between statistical analysis of ciphers and similar analysis of remailer networks. And lots of statistical tools can be used to deduce likely mappings based on source/sink correlations, digram analysis, etc. Making a remailer network robust against such analyses will take a whole more basic thinking. Merely increasing message volume is not enough. Nor is increasing latency enough. Generally speaking, of course.) Instead of reply blocks, I think use of message pools (a la BlackNet) is a more robust reply method, as it uses "widely-distributed messages" (a la Usenet newsgroups) to get around the source/sink correlation issue. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4

Re: Free Speech and List Topics
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> More disturbing to me recently has been the steady increase in subscribers > to this list who don't seem to value free speech very highly, who write of > their own nation's censorship as valiant efforts to protect citizen-units > from foreign devils, and, even more shockingly, from supposed defenders of > electronic freedom who are now talking about the need for limits on > anonymity. I too have noticed this, but we must remember that although we are the people who see the tyranny of censorship etc. all to clearly we are in a very small minority, the majority of people do not support censorship because they have made a reasoned judgement, the either support it because they are too lazy to do anytthing, too shit scared of the government if they do, or they just do not take the time to understand the issues and so support the common view, there is also the case that many people "go with the majority", because they do not want to appear different, and the media has so demonized free speech and liberty advocated that to associate yourself with them now is equivalent to telling people you are a rampant sexually deprived paedophile in an anorak. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az4= =riHc -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: DON'T Nuke Singapore Back into the Stone Age
by Hallam-Baker 17 Dec '03

17 Dec '03

Timothy C. May wrote: > The point is to make clear to them that the Usenet and similar Web sites > are global in nature, not subject to censorship without a very high local > cost. If discussions of Lee Kwan Yew's dynasty are considered illegal, then > Singaporans will have to choose not to carry the various newsgroups into > which *I* post such messages! If the govt. of Singapore wish to keep their people in ignorance of their corruption it is going to be harder than banning a few newsgroups. I would expect the opposition to be scanning USEnet and like fora for email addresses ending with .sg and spamming appropriately. The irony of censorship is that its rarely effective and almost always superfluous. The people of singapore are aware that their government is corrupt. They vote it back in because they expect the alternative to be at least as corrupt. Its much like the US where there is a choice between the rightwing authoritarian Republican Party and the authoritarian, rightwing Democrats. > (This was done by many of us during the Karla Homulka and Teale trial in > Canada a couple of years ago: Canada imposed press restrictions on > discussion of the trial and the grisly evidence...and then was chagrinned > to find that the global Net did not adhere to their notions of what should > and could be discussed. They even seized copies of "Wired" at the border, > very much akin to Singapore's stone age policies.) There is a big difference between the Canada situation and the Singapore situation. In Canada the restrictions are temporary and stem from making the right to a fair trial a higher priority than the right to free speech. It is a conflict of two competing individual liberties. No observer of the OJ Simpson trial could state that the media coverage did not affect the outcome. The arguments that Mill advances for freedom of speech in On Liberty do not apply in the context of a temporary judicial injunction, they are utilitarian (suprise) and applying his general principle of "interests" would favour the temporary restriction. The situation in Sigapore is simply a corrupt government trying to supress legitimate democratic discussion. The intention is not to protect an individuals right to a fair trial, the intention is to restrict argument permanently. It is important that in an international forum people don't start imagining that their local customs are universally accepted as superior. The difference between Canadian and US law is a minor one and relates to different interpretations of a common principle. There is a vast gulf between the Singapore position and that of either the US or Canada. This is not simply a difference of local interpretation. Phill

1 0

Re: Free Speech and List Topics
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 2-SEP-1996 05:36:20.36 >No self-respecting Cypherpunk thinks the Antitrust Act and related acts are >worthy of enforcement. >(Think of how the technology we support will tend to allow new avenues for >price collusion, interlocking directorates, new forms of business combines, >unreadable secure communications with foreign competitors, and so on, all >things the Antitrust regulators are already growing worried about.) There's a difference between thinking something shouldn't be enforced (e.g., drug laws for adults) and thinking that other things - such as privacy and free speech - are more important than fully effective enforcement of something (anti-terrorism measures, AntiTrust Act, etcetera). I don't think that transparent houses, as Perry put it, should be required to prevent murders - but I don't approve of murders either. It's a problem with means, not ends. -Allen

1 0

Secure anonymouse server protocol: comments please
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

The following is a very sketchy plan for a secure protocol for an anonymous server which allows replies without storing a recipient database in the clear. To send a message: The sender first exchanges keys with the sever (public key cryptography assumed), the server now has the users key and the user the servers. The user sends the server: The recipient for the message the message itself a password previously agreed The users ID on the server The server decrypts to get the above back in plaintext, then it encrypts the ID & the users address with a random session key and stores it in the database. notice nothing is stored in the clear the server now encrypts the session key with the senders public key, and fowards it to the sender of the original message. now finally the server sends the message onto the intended recipient in plaintext (who must also have exchanged keys with the server) along with the ID of the sender encrypted with the servers public key. the recipient responds with his reply, and the ID of the sender still encrypted in the servers Public key The server stores this When the user (the original sender) wants to pick up his mail after a couple of days he sends the server his ID encrypted with the servers public key, the server compares this with all of the encrypted IDs in the database and when it finds a match it fowards the corresponding mail to the original sender of the first message. Thats all folks. This system has 1 huge fault, we can encrypt a uses ID with the servers public key to see what his ID in the encrypted database is and therefore identify him, maybe we need two seperate server public keys, and when IDs come in encrypted with key1 (the one it releases) it decrypts with secretkey1 then encrypts with publickey2 (the one it keeps secret) or maybe we can just hash and sign the IDs in the database? as I said it`s very sketchy, I made most of this up as I wrote it so if you must tear it to pieces please do so constructively, it could be the route to a secure system.... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az4= =riHc -----END PGP PUBLIC KEY BLOCK-----

1 0

(no subject)
by Fran Frisina 17 Dec '03

17 Dec '03

desubscribe

1 0