December 2003 - cypherpunks-legacy

IMPORTANT: Changes affecting anon.lcs.mit.edu privacy
by lcs Remailer Administrator 17 Dec '03

17 Dec '03

I'm looking into reconfiguring anon.lcs.mit.edu (a.k.a. nym.alias.net) in ways that will improve performance and reliability. This could involve several changes (either temporary during testing, or even permanent) that might affect the privacy of users. I hope these changes won't affect people who use anon.lcs.mit.edu and nym.alias.net according to the instructions, but given the sensitive nature of anonymous services, I want to alert people of these changes to avoid any surprises. * 'Received:' headers may suddenly appear. Currently, anon.lcs.mit.edu does not add 'Received:' headers to any mail it relays or delivers to nym.alias.net aliases. Since the anonymous remailers mix(a)anon.lcs.mit.edu and config/send(a)nym.alias.net already strip header information upon receiving messages, this shouldn't really affect people unless they are telnetting to the SMPT port and forging E-mail. Such forgeries are not condoned by the administrators, anyway, and have actually not been much of a problem. If, however, you were somehow relying on anon.lcs.mit.edu's sendmail for "light" anonymity, you should start using real remailers before it's too late. Though I don't really mind suppressing Received: headers, this looks somewhat difficult to do with MTA's other than sendmail, so if sendmail gets junked, we may end up with something that adds Received headers. * SMTP destination statistics may be kept. Recent versions of sendmail (and other MTA's) can keep statistics on delivery to remote machines, to prevent blocking multiple times when sending mail to unavailable remote hosts. The information kept appears to be the name of each remote machine to which mail has been sent, and the last time at which an attempt to send mail to that host was made. Such information would not be backed up, and could potentially be purged daily. I understand this may cause concern. I welcome any feedback or suggestions on how to deal with this, either in sendmail or also qmail (which I'm thinking of switching to). The worst case scenario seems to be the case where anon is seized or stolen and someone discovers that your machine received a piece of mail from it. No information will be available about whether or not you ever sent mail to anon.lcs.mit.edu. This seems acceptable because if someone really needed to prove you had received a piece of mail from nym.alias.net, that person could already do so by tapping your network and sending you a message through nym.alias.net. Despite these changes, anon.lcs.mit.edu does not currently and will never keep any message-by-message mail logs. Sendmail currently runs at log level 1, which the documentation describes as logging only "Serious system failures and potential security problems."

2 1

Re: PGPfone contact server
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

[From a discussion on pgp-fone(a)rivertown.net] >>> Is there any kind of server method people on this list use to meet up on >>>PGP fone??? >>IMHO... Because PGPfone's main goal is to provide security and maybe >>some anonymity, would it make [no?] sense to have a feature like this. I can think of a few useful variants on this kind of service 1) Incoming-Call-Notifier daemon - faster than email, smaller than pgpfone. (PGPfone may not have a problem with this, but Netscape CoolTalk has a watchdog daemon that hangs out waiting for calls. Don't know if it barks, but it's got to be smaller than NS+CT. Firewalls generally kill these, though... 2) Chat-line with switch to voice - an IRC channel would do fine, and be easy to set one up, for people who want to meet to play with the technology; for people who want to cut out to PGPfone from other IRC groups, you don't even need that, though distributing an IRC client with a "PGPfone" button might be a good marketing technique. Name the IRC channel "pgpfone"... CU-SeeMe uses this approach - reflectors are often busy or way slow, and the available public-access reflectors change pretty often, and it's much easier to find people or find interesting reflectors using the IRC channel than polling for busy-signals. CU-SeeMe supports conversations through reflectors as well as direct-connection, and doing a PGPfone-like DC mode might be fun as well. 3) Finding specific people who don't have predictable IP addresses - IRC can also do this, or email, but it wouldn't be hard to build a web form widget that lets you plug in your name/handle and scarfs up your current IP address or lets you enter it. A "specific person" could be an alias, of course. 4) A secure n-person conference bridge could be good also, though it's much more difficult to make something like that work, especially if you use a crypto mode that dislikes dropped packets. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, # so please Cc: me on replies. Thanks.)

2 1

RE: 40 bit DES [Was:Re: !! Point 'n Crypt]
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Walt Armour <walt(a)blarg.net> wrote: > If I encrypt a $10 million dollar proposal and then get 86'd in > a car accident I would like to go to my grave knowing that the > company could get the proposal back. .... Anyone who stores a $10m proposal on only one machine, without making backups on somebody else's machine, preferably out of the building, is asking for the Clue Fairy to send him disk drive gremlins and software from Bill Gates to scribble on his disk, and his company should probably consider 86ing him before he strikes again :-) Slightly more seriously, there are certainly corporate reasons to store backups of keys for important data, such as backup tapes and communications. GAK-style technology is the wrong level approach for communications - GAK-style access to keys is useless unless you've also backed up the data, so if your corporate officers need the data, give it to them encrypted with their own keys. Similarly, if you want backup access to keys used to encrypt files, back up the keyrings, maybe using a secret-sharer if you want to require multiple people to access the backup, or just have the backups of the files encrypted with the keys for the backup server. > BUT in regards to the general populace, I do not advocate any form of > key escrow/recovery. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, # so please Cc: me on replies. Thanks.)

1 0

RE: permanent invasion of privacy
by blanc 17 Dec '03

17 Dec '03

From: attila In his Society essay, Lykken writes, "I will testify in support of a parental licensure bill to be introduced at the next session of the Minnesota State Legislature. ........................................................... Someone needs to remind this Senator Lykken what happened in Romania, when the beleaguered citizen-units finally took their 'noble', social engineering leader Ceausescu, put him up against a wall and shot him. History could repeat itself. Ah well, but really the most that this proposed bill would accomplish would be a lot of discussion and a lot of attention being brought to the general awareness about where individuals stand relative to their *elected* government (in 4 years - out!). Can you imagine the usenet discussions . . .all over the world. You know, he could be doing everyone a favor by inciting fury in the savvy masses who would, in the process of complaining, educate the ignorant ones about the ethics of social engineering and the precautions against it, as well as about the character of people like this Senator. A problem can be an opportunity in disguise! .. Blanc

3 2

Parolees limited from using computers, Internet
by E. Allen Smith 17 Dec '03

17 Dec '03

Given exactly how big the Internet is for free speech, I'd call this government interference in speech from those with a viewpoint in opposition to its. I can see some restraints on speech in prison itself... but not on someone who is supposedly safe enough to be let out, even under supervision. (I would also point out that this ties into the action of drug laws to cause the disenfranchisement of felony drug offenders. I see no reason to suppose that felony drug offenders (as with any other crime that shouldn't be one) would be any less competent to vote than the average, everyday person (otherwise known as the average idiot)). -Allen > ______________________________________________________________________ > AT&T EasyCommerce Services > ZD Internet Magazine - Free For Wild Ass Net Pioneers > ______________________________________________________________________ > U.S. bans Internet use by some parolees > __________________________________________________________________________ > Copyright © 1996 Nando.net > Copyright © 1996 Agence France-Presse > WASHINGTON (Dec 16, 1996 4:54 p.m. EST) - The U.S. government > announced Monday it will impose restrictions on parolees' use of the > Internet, saying it was responding to "increased criminal use" of the > worldwide computer network. > The United States Parole Commission said it was acting in response to > the "surge of 'how-to' information available on the Internet and other > computer online services relating to such offenses as child > molestation, hate crimes and the illegal use of explosives." > The restrictions include requiring a parolee to get prior written > approval from the commission to use information services such as an > Internet service provider. [...] > Copyright © 1996 Nando.net

1 0

File vs. Communication Key Escrow
by Douglas Barnes 17 Dec '03

17 Dec '03

Jumping on the bandwagon a bit here... Walt makes a plausible business case for key escrow for software that encrypts static information for archival purposes. Has anyone been able to come up with a good business case for key escrow of communications keys? Note that if you're concerned about communications history, that this is really just a special case of static information that is archived. Note that all key escrow proposals to date have focused almost entirely on "escrow" of keys used in communication. The recent attempts to manufacture a business case for this by confusing these two very different situations is part of the tactics we have come to expect from the government when dealing with this issue. If anything good can be said about the badly written, vague and clearly unconstitutional new regulations from the Department of Commerce, it's that they're less mealy-mouthed and weasling than previous attempts to explicate the government position on cryptography. At 11:23 PM 12/16/96 -0800, stewarts(a)ix.netcom.com wrote: >Walt Armour <walt(a)blarg.net> wrote: >> If I encrypt a $10 million dollar proposal and then get 86'd in >> a car accident I would like to go to my grave knowing that the >> company could get the proposal back. .... > >Anyone who stores a $10m proposal on only one machine, >without making backups on somebody else's machine, preferably >out of the building, is asking for the Clue Fairy to send him >disk drive gremlins and software from Bill Gates to scribble on his disk, >and his company should probably consider 86ing him before he >strikes again :-) > >Slightly more seriously, there are certainly corporate reasons to >store backups of keys for important data, such as backup tapes >and communications. GAK-style technology is the wrong level approach >for communications - GAK-style access to keys is useless unless >you've also backed up the data, so if your corporate officers need >the data, give it to them encrypted with their own keys. >Similarly, if you want backup access to keys used to encrypt files, >back up the keyrings, maybe using a secret-sharer if you want to require >multiple people to access the backup, or just have the backups of >the files encrypted with the keys for the backup server. > >> BUT in regards to the general populace, I do not advocate any form of >> key escrow/recovery. > ># Thanks; Bill ># Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com ># You can get PGP outside the US at ftp.ox.ac.uk ># (If this is posted to cypherpunks, I'm currently lurking from fcpunx, ># so please Cc: me on replies. Thanks.) > >

1 0

RE: Encryption to the poors
by Internaut 17 Dec '03

17 Dec '03

When you send spam to a list like this, you're kinda asking for it, aren't you? ---------- From: Fuck@yourself.up[SMTP:Fuck@yourself.up] Sent: Monday, December 16, 1996 07.35 PM To: cypherpunks(a)toad.com Subject: Encryption to the poors >To: cypherpunks(a)toad.com >From: Fuck(a)yourself.up >Subject: Encryption to the poors > >Hey, i can doit to... >RareTrip >-------------------------------------->>CLIP<<--------------- >begin 644 greets.com >MZPJ\3"<!40)2`98#OB8!B_Z+#@@!BQ8"`;AW`5#\K3/"JXO0XOA_R+8/>XT/ >M1XQW]#?&_D'\#TT,O5EX4\U\2(T/1XQ_]#^%K7]5@X4(__&!A@&4%7LJ14C1 >MWN^D>Z/9Y!C\43_,RS"R5JI(@ERBOU?^"/4G"@'KL`)-Z+!_-``N``!V`%P` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M``````````````````````"_:KW4:+S3"[GUK,(a)^GMM)2PCU4;N[^!MY.WDX >M>3A'\7022H4*2[_!('<KN[XZ>1IT,KFI"+N\3WEOOTR;:NFS3PY'N^/S49B[ >MWCIY&GD.>0Y!)RX'*Q\M'VD@=U:[PQMY.W0FN;T$N[!/>6^_!\HG^S**B5R[ >M6""_#L83>1V_"/GQ^<C&47E@>1]Y'WD8>1AY;E^97\PZ!"P?*1<O%VD@=RN[ >MOCIY&B:W7ZT.,;O'('D8#E.XIR._(<@,N[@Z>1IY;7EM#-@Z&`1=D@X`LG<: >M``````````````````````````````````!7:0D<-V]S```````````````` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M````ZE>_5KA6N,<%>O![L,00@V#58Q(1I+[3#@`_\LDK`.A9@;#XZ,8!OOSR >G6$NDN+L`N[D`N;H`NKT`O;X`OK\`OPX?``"RX4-!_[[X_A\JY]<` >` >end >-------------------------------------->>CLIP<<--------------- >

2 1

Re: Hard to Tax Scenario
by reinhold＠world.std.com 17 Dec '03

17 Dec '03

Re: Hal Finney's exegesis on Robin Hanson's scenario of Ann, virtual MD >On the other hand, if tax evasion is nearly universally practiced, >perhaps there are strong cultural pressures against turning someone in. > On the contrary, in a world of anonymous payments and nyms, there is a significant value for connecting nyms and true names and, hence a thriving market in any information that might lead to a connection. Bounty hunters maintain an ongoing lifestyle analysis on every true person. Hot lists of people whose visible consumption and reported work don't jive circulate widely. Ann can't walk down the street in a new pair of shoes without 5 people sending in an mpeg to claim the micro-payment. And she lives in terror as she watches the offer price for info about her rise. By the way, as a covert MD with a receptionist cover, whom does she date? Arnold Reinhold

2 1

TIS_sue
by John Young 17 Dec '03

17 Dec '03

12-16-96: "TIS' Key Recovery Technology First To Enable General Purpose Export For Very Strong Encryption" In a development that may signal the beginning of the end of the long standing encryption export control controversy, TIS today announced that products using very strong cryptography with its RecoverKey technology have been approved for general purpose export control under new export regulations. "Encryption - BSA tries new lobbying tack" BSA intends to abandon its efforts to negotiate with the Clinton administration on encryption export rules and will instead lobby Congress for new legislation. The best hope lies with Rep. Bob Goodlatte who plans to reintroduce a House bill proposing the relaxation of controls at the next session next month. "U.S. Emissary on Cryptography to Keynote RSA Data Security Conference" "The RSA Conference is an opportunity for me to provide some insights on my mission which includes fostering a consensus on the development of an international key management infrastructure," said Ambassador Aaron. "Pretty Darn Private" PGP last week unveiled PGP Cookie Cutter, a browser plug-in that lets users selectively block Web "cookies." "Smart card-PC standard proposed" The eight documents of the joint specifications address three major areas: They provide an interface to card readers; establish a common programming interface and control mechanism; and maintain compatibility with existing devices, leveraging the ISO structure that has been set in place over the past decade. Information is available on the Web at www.smartcardsys.com. "Web Service Provider Attacked" A SYN-flood attack against WebCom knocked out more than 3,000 Web sites for 40 hours this weekend during the busiest shopping season of the year. ----- TIS_sue (19 kb)

5 6

Test only, sorry, NOISE, do not read
by Bob. R. Roberts 17 Dec '03

17 Dec '03

The following form contents were entered on 18th Dec 96 Date = 18 Dec 96 04:18:56 subject = Test only, sorry, NOISE, do not read resulturl = http://www.netmart.com/steppingstones/thanks.html uname = Bob. R. Roberts email = bob(a)jail.sg Address = 4625 E. Elm Drive Apartment or suite = 14 CITY = Chula Vista STATE/PROVINCE = Oklahoma country = USA zip = 01238 phone = 407-251-1701 work phone = 407-352-1702 FAX = 407-453-1703 ship to name = Mary M. Roberts ship to email = mary(a)aol.gov ship toAddress = 14207 Broadway NE ship to Apartment or suite = 600 ship to CITY = Janesville ship to STATE/PROVINCE = Texas ship to country = USA ship to zip = 95442 Book = My Dinosaur Adventure first name = Freddie middle name = Jurgen last name = Robertson nickname = Goober age = 6 hometown = Hickville gender = Boy dedication = grow up, punk book from = Gran & Grump Date Book = 12/4/95 Friend#1 = Muffy Friend#2 = Scooter Friend#3 = Slim Child's Birthday = 2/1/91 Baby's name = Grinder Baby's gender = Boy How did you hear? = E-Mail Invitation # = none Mastercard = on call = on credit card number = 251-4444-25713-591-3 credit card name = Richard Q. Nickson expiraion date = 8/22/98

2 1