December 2003 - cypherpunks-legacy

Re: Secure anonymouse server protocol: comments please
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 07:24 PM 9/2/96 +0000, paul(a)fatmans.demon.co.uk wrote: >The following is a very sketchy plan for a secure protocol for an >anonymous server which allows replies without storing a recipient >database in the clear. Several people have talked about this sort of thing recently, inluding William Geiger, Doug Floyd, and myself. Lutz Donnerhacke's Jenaer Anonymous Service <anon(a)as-node.jena.thur.de> actually implements it (send it mail saying "help".) Rather than using a human-selected userid, it uses the PGP keyid to make IDs like anon-1a2b3c4d(a)as-node.jena.thur.de. >This system has 1 huge fault, we can encrypt a uses ID with the >servers public key to see what his ID in the encrypted database is >and therefore identify him, maybe we need two seperate server public >keys, and when IDs come in encrypted with key1 (the one it releases) >it decrypts with secretkey1 then encrypts with publickey2 (the one it >keeps secret) If you encrypt the id using raw RSA and constant padding, this is a risk. If you encrypt it using PGP, which uses a random session key, it's not. If you encrypt it using raw RSA and pad the id with a random nonce, it's also no risk. In the latter two cases, the encrypted material is different every time, so you can't compare with previous messages. The Jenaer nymserver avoids this by using a remailer approach - you send an encrypted message with a Reply-To: header telling where to send the accumulated mail (which may, of course, be another nymserver), and it delivers it using mixmaster. This frees you to send your pickup requests by anonymous remailer as well. It's still not risk-free, since if Bad Guys crack the remailer or force the operator to operate it while they monitor it, they can see pickup requests, but it's far more difficult to do that than to just steal the box, and there's no database on the box that's useful to steal. Lutz does recommend chaining your Reply-To: to another nymserver, but it's already very secure. I don't remember if he gets fancy and requires the pickup requests to be signed by the key of the owner or not; the only difficulty with this is the syntax of PGP, which is "fixed in 3.0". Hal Finney has also suggested a system that, instead of delivering anonymous email to the recipient, sends a message saying "You have anonymous mail, receipt #123456. Send back this ticket to pick it up." and you can extend the syntax to handle automatic blocking requests and automatic deliver-everything requests. This is fairly easy to extend for anonymous mailboxes and datahaven code. I've wavered between the delete-on-retrieval model, which is fine for email and not very useful for samizdat, or the delete-after-some-time-period-or-request model, which is useful for both but makes it easy for users to turn you into the local pirate-warez-and-child-pornography server. If you extend the model and charge digicash for storage, it becomes a much cleaner solution. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: their is a new mailing list
by Ross Wright 17 Dec '03

17 Dec '03

> To: cypherpunks(a)toad.com > From: hack5(a)juno.com (patrick b cummings) > Date: Tue, 03 Sep 1996 16:14:40 EDT > their is a new mailing list for all you hackers just email your name or > handle and e-mail address and youll be subscribed > send information to hack5(a)juno.com > > Am I missing something here? Is this guy fucking crazy? =========== Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

2 1

No Subject
by nobody＠replay.com 17 Dec '03

17 Dec '03

patrick b cummings <hack5(a)juno.com> wrote: > their is a new mailing list for all you > hackers > just email your name or handle and e-mail address and youll be subscribed > send information to hack5(a)juno.com k00l d00de.... c'mon Varney, we know its you.

1 0

No Subject
by Ben＠explorateur.quaternet.fr 17 Dec '03

17 Dec '03

suscribe me

1 0

Re: Pseudocrypto detector is going wild
by winsock＠c2.net 17 Dec '03

17 Dec '03

Is it just me, or is the snake-oil frequency factor scaling up? We used to get this stuff quarterly, and now it's monthly, if not weekly! slither-squeek I think enquirer must be overloaded with ammo, and I am sure in the mood for it now. me

1 0

SecurID White Paper
by Peiter Z 17 Dec '03

17 Dec '03

SecurID Vulnerabilities White-Paper Due to increased recent interest that has been witnessed on the net about the SecurID token cards and potential vulnerabilities with their use, we offer a white paper on some of the vulnerabilities that we believe have been witnessed and/or speculated upon. This paper is being put forth into the public domain by Secure Networks Incorporated and is available at the following URL : ftp://ftp.secnet.com/pub/papers/securid.ps Topics dealt with in the paper include: . Race attacks based upon fixed length responses (still valid even with the current patch) . Denial of Service attacks based upon server patches . Server - Slave separation and replay attacks . Vulnerabilities in the communications with the ACE Server . A quick analysis of the communications with the ACE Server . Problems with out-of-band authentication We hope this paper provides insight, enlightenment, and is helpful to the security community in general. thanks and enjoy, Secure Networks Inc.

1 0

Re: What is the EFF doing exactly?
by jim bell 17 Dec '03

17 Dec '03

At 03:17 PM 9/3/96 -0700, Jon Lebkowsky wrote: >At 01:22 AM 9/3/96 -0700, James A. Donald wrote: >>At 12:53 PM 9/3/96 -0700, Stanton McCandlish wrote: >>> EFF in generally does not issue extremist position >>> statements, but is careful to examine the risks as well as the benefits, >>> and look for pro-liberty solutions to those risks. >> >>If the right to speak anonymously is an "extremist" position in the eyes >>of the EFF, then they are no friends of liberty. >> >>It is hardly an "extremist" position outside of such countries as Cuba, >>Iran, or China. >> >>It is the overwhelmingly mainstream position, not just among netizens, >>but when last heard, amongst supreme court judges and ordinary people >>in the street. > >Not necessarily. The character of the anonymous speech is decisive. If you >use anonymity to cloak harassment, for instance, the anonymity (which >removes accountability) is a problem. The accountability issue is real and >should be addressed, not evaded. "Addressed", maybe, but that doesn't necessarily mean, "solved." For many decades, people have been able to walk up to a pay telephone at 3:00 AM and make a harassing phone call to somebody, a "problem" which still exists and no solution is being implemented for. I think it's reasonable to come to the conclusion that there is no solution to the anonymity "problem" that isn't worse than the underlying anonymity. And, BTW, I don't consider a pro-anonymity position to be an extremist one. Jim Bell jimbell(a)pacifier.com

5 4

Re: Schelling Points, Rights, and Game Theory--My article
by ddfr＠best.com 17 Dec '03

17 Dec '03

Tim May mentioned my article on this subject. It is: "A Positive Account of Property Rights," Social Philosophy and Policy 11 No. 2 (Summer 1994) pp. 1-16. It can be found from the academic part of my web page: http://www.best.com/~ddfr/Academic/Academic.html David Friedman

1 0

EDyson CPF 95 item
by Stanton McCandlish 17 Dec '03

17 Dec '03

If anyone does did that up, please bounce one my way, so I can add it to the archives. Any other good stuff from that CFP would be of value too. Ditto for CFP96. I think the newest CFP transcripts we have are 94. -- <HTML><A HREF="http://www.eff.org/~mech/"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org/"> Electronic Frontier Foundation </A><P> Online Activist </HTML>

1 0

[NOISE^2] Re: Voting Monarchist?
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 3 Sep 96 at 16:06, David M. Rose wrote: > Dimitri, err, Dr. Vulis, or is that Dr. Nuri?, Well, is astonishlingly sounds the same... Makes me think of a rabbid Det<^h^h^h>Rotweiler. :) jfa

1 0