December 2003 - cypherpunks-legacy

Remailer Abuse Solutions
by ph＠netcom.com 17 Dec '03

17 Dec '03

What do you do if you are operating a remailer and somebody complains they are getting spammed? That's easy, you keep a list of people that you don't send mail to. What's hard is if that person wants to receive other anonymous mail. The solution is easy: charge e-cash to send mail to certain addresses and send the money to the owner of the account. Never put an address on a kill list, just raise the price of sending mail to it. This generates lots of positive publicity for your remailer. People will beg to be spammed! And, since the remailer operator handles the financial parts of the deal, the technically naive "victim" does not have to have specialized knowledge or even an e-cash account. This also eliminates the spam problem generally. If you are plagued by spam, create a list of names you will accept mail from. When a message comes in that is not on the list, return a message directing them to send you the mail through a paying remailer. This solves a problem for famous people, too. They get lots of mail but they don't have time to read it all. How to sort it? Raise the price of sending a message. (I heard that Arnold Schwarzeneggar was once paid $1 million just to read a script and look at the set of a movie with no obligation to act in it.) Okay, now lets go to mailing lists. We like to read anonymous mail on this list, but we don't like getting spammed. It's hard to filter anonymous mail for obvious reasons. The solution: don't accept anonymous mail. Only people on the "approved" list would be allowed to post. People who wish to post anonymously could then send mail through the paying remailer to people on the "approved" list and request that their message be relayed. Most people on the list would be happy to accept a dollar or two to provide this service. This would eliminate inappropriate mail while allowing anybody to post. For that matter, postings to the list itself could be priced at, say, a dollar to cut down on the noise levels. Payments, and addresses which complicate payment, make it harder to rely on the remailer network. When you send a message through a few remailers and make a faux pax on the last one, you won't know what happened. Did one of the remailers go down? Did you make a mistake? I think I know a solution to this one, too. If somebody wants to get error messages, they include a random 128 bit number with their message. This is a different number for each remailer in the chain. When an error occurs, the remailer distributes an error message with the number attached. Error message distribution is pretty easy. The remailer operator could publish a web page with the errors. Or, the messages could be bundled and made available through anonymous ftp, or mailed to an error message mailing list, or posted to a newsgroup. Peter Hendrickson ph(a)netcom.com

1 0

Federal Reserve Bank is ILLEGAL?
by Doug Renner 17 Dec '03

17 Dec '03

http://feustel.mixi.net/GOV/DEPTS/fedres.html Most list members would be very interested in the above link.

4 6

Re: WebTV a "munition"
by Sean Roach 17 Dec '03

17 Dec '03

At 11:56 AM 11/11/96 -0800, Pablo Calamera wrote: ... >The WebTV Network is currently using a 128 bit encryption system that >gives our U.S. subscribers the most sophisticated security protection of >any online service today. It is our intent to offer our customers the most >secure environment for transactions and transmission with their WebTV >Network service. Our units, sold by Sony and Philips, include a sticker >that states that the product is not to be exported outside of the United >States. > >However, the government restriction does not prevent us from exporting our >product outside of the United States. WebTV Networks has always intended to >announce its expansion plans in early 1997, providing global communication >using either 40 bits, now authorized by the government, or 56 bits which >Bill Clinton recently endorsed. ... This may prove my ignorance, but I thought that the WebTV systems were going to use a propiatory service. I am assuming that this is true in this post. If the WebTV product is using a propietory ISP for its operation, I assume that WebTV sets sold outside of the United States will not be dialing up the same phone number. As the chip could easily communicate with the ISP, and the ISP communicate, perhaps through standard credit validation systems, with the merchants, why does the international version even need U.S. developed encryption. The international version could most likely be fitted with the locally available strong encryption. Since the WebTV ISP will probably have a virtually private wide area network, the "foreign" encryption could be replaced with a more standard type inside of the U.S., at the main offices. Why give the U.S. government the ability to look at the transaction information of non-U.S. citizens, off of U.S. soil. If, however, the WebTV system does not have the ability to maintain contact with its over-seas offices, this could be unfeasable. Granted, this idea would mean that some computer would have access to all of the relevant data,for the purpose of "trading" crypto, but I would rather put my trust in a company, which I could easily quit dealing with, than the U.S. government, which might easily institute an international sales tax system. Can PGP be compiled to an EEPROM? If so, PGP is well distributed and might easily be accepted for online transactions, also, Mr. Zimmerman might be willing to agree to a bulk liscense sale for the implemention of this idea. Just make sure that the chip is loaded outside of U.S. borders.

1 0

Re: two bogus messages to this list
by Sean Roach 17 Dec '03

17 Dec '03

At 11:08 PM 11/11/96 -0500, Ted Garret wrote: ... >Microsloth has, at the heart of it's system, a call which traps ALL >KEYSTROKES and EVENTS. This call exists from Win32s on, and can be >placed inside of a DLL which most users would have no idea was loaded. >Even under NT, this DLL can be made to remain resident and trapping >Keystrokes, events, and window contents. > >Does this just BEG to be exploited? ... I use Windows 3.11. Look at the Recorder in it. Its designed to create Macros. It can be set up, by anyone, to capture passwords in Eudora. I've tried it in a controled environment (my own machine), it works. The only defense is if the person were to have h[is,er] password left in Eudora, which is a serious mistake, or if that person Alt,Tabs through all of the resident programs to make sure it wasn't running. Half of the people I've told this to didn't even know that you could switch between windows programs, (one didn't even know that more than one windows program could be active at the same time). In an open lab environment, where the machines are left on, and the common user can't navigate outside of windows, and then only with the mouse, this would be a serious threat to privacy.

1 0

Re: Secrecy: My life as a nym. (Was: nym blown?)
by Sean Roach 17 Dec '03

17 Dec '03

At 08:26 AM 11/11/96 -0800, Hal Finney wrote: ... >I have two kids entering their teens, and I'm sure other list members are >parents as well. What can we do for our children to help them enter their >adult lives with better chances to retain privacy? Unicorn mentions keeping >them absent from school on picture day, although I'm not sure how much this >helps. I suppose it makes it harder for an investigator to find out what >they look(ed) like. Then when they get old enough to drive you have a new >problem avoiding the photo (and thumbprint) on the license. ... As far as the drivers linscense goes, there are religions that do not allow its members to be photographed, and the government honers this,(at least the Tag Offices do). I don't know the name of the religion but I believe it is a Christian one. Convert once every four years to get your drivers liscense, and convert back within the week. No photograph on that little piece of plastic. P.S. In Oklahoma, there is no thumbprint on the current liscense. P.P.S You can always send your child to school with a note saying that you do not want your child in the class picture, I know of someone who did that, (on a side-note, we always wondered why.)

3 2

A really short one time pad.
by Sean Roach 17 Dec '03

17 Dec '03

Actually, here are ten. 2^.5 3^.5 2^(1/3) 5^.5 5^(1/3) 7^.5 11^.5 13^.5 17^.5 Pi For that patter the nth root of any prime number. A lifetime of "pads" could be distributed in one trip. Of course this still means that you have to make the trip, and write down all of the above with a referring codeword or number. Cheap, I know. Wonder if this type of "one time pad" is as foolproof as truly randomly generated ones.

3 2

Re: Small question about the list
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>I would be realy happy if someone could tell me the adress to remove my name >from the distribution list. >Could anyone send me the procedure on how to remove my name of the list ? The two usual ways to do this on the internet are 1) Use the same address you used to join the list (you _did_ save it?) 2) somethinglist(a)somewhere.com is administered by somethinglist-request(a)somewhere.com (though this is often a frontend for some mailbot like majordomo or listserv @somewhere.com , and may just send you instructions for finding the real mailbot.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk

1 0

Code of Practice for the Internet
by Benjamin Grosman 17 Dec '03

17 Dec '03

Dear All, Found something I thought you all might find interesting..... www.intiaa.asn.au/codeintro.htm A body in Australia is attempting to introduce a "Code of Practice" in Australia Yours Sincerely, Benjamin Grosman

1 0

Re: Taxation Thought Experiment
by azur＠netcom.com 17 Dec '03

17 Dec '03

>The crypto-relevance is via crypto anarchy: we need to undermine the tax >system enough that _everyone_, not just us, loses faith in it. (There could >be a "straw that broke the camel's back" effect, if people lose confidence >in the system. Even if most people are _not_ using anonymous digital cash >to hide income, if _enough_ are (and this "enough" could be a visible >minority, visible through recounts of their deeds), then confidence could >be lost. As in Italy and other such places, where compliance rates on taxes >are very low.) > >--Tim May > I've posed similar questions to friends and aquaintences. The working-class stiffs (who can't easily hide from the IRS) feel taxes are an unwelcome but necessary burden in order to provide the blanket of government protection they feel exists. They resent and oppose widespread tax fraud. Self-employed tend to be more open to 'alternative' income structuring. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Steve Schear | Internet: azur(a)netcom.com Lamarr Labs | Voice: 1-702-658-2654 7075 West Gowan Road | Fax: 1-702-658-2673 Suite 2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Internet and Wireless Development Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne, Libertarian, for President. http://www.harrybrowne96.org

1 0

Re: Secrecy: My life as a nym. (Was: nym blown?)
by Sean Roach 17 Dec '03

17 Dec '03

At 10:14 PM 11/11/96 -0600, Igor Chudov wrote: >This is an interesting topic. I apologize if my questions are too trivial, >but here they are: > > 1) Can a person without an SSN have a credit record? Some > may say that a credit record is a bad thing to have, > but I am still interested in a possibility. > 2) Will private lenders (such as credit card issuers or > mortgage companies) agree to extend credit to a person > without an SSN or to someone who refuses to give out his SSN? > 3) Will the state issue a driver's license to someone who does not > have/does not wish to give out their SSN? > 4) Will states' police (where applicable) approve purchases of > firearms if purchasers do not state their ssn (misstating it > may be a crime) on an application? > 5) Employers are required to pay certain taxes and therefore > they, in my understanding, need to know their employees SSNs. > How can people get around that (unless they do not need to work)? > 6) Can someone without an SSN obtain various kinds of insurance? > >It is my understanding that the law does not regulate use of social >security numbers between private parties. Businesses are free to refuse >to do business with someone who does not present them an SSN. In real >life, how inconvenient is life of a privacy-concerned individual? > >Say, John Anonymous is a young 15 years old who anticipates to become an >engineer and have a middle class life. He wants to get married, have >children, drive a car, obtain insurance, work at some big company, >travel around the world, invest in mutual funds or buy stocks, and so >on. Reliance on government help is not important to him, so he would not >apply for an SSN solely to get Social Security, welfare and such. > >His parents are cypherpunks and did not obtain an SSN for John. How much >effort would it cost him to live a life outlined above? He couldn't, at least not in Oklahoma. In Oklahoma, students in public schools are now required to have SSN's. This may not apply to private schools, but I imagine that it does, at least to some degree. Having a high school education is certainly necessary to gain the Masters necessary to be an engineer. However, getting a drivers liscense should be easy. My sisters drivers liscense number is one that was randomly generated, all because she did not know her SSN off of the top of her head. My drivers liscense number is the same as my SSN, all because I know my state mandated serial number. For all practical purposes, I am Roach, Sean 447-xx-xxxx. Note, 447 refers to the state of my birth. My sisters record is at least a little more convoluted.

2 1