December 2003 - cypherpunks-legacy

Re: OPINION: moderation and anonymity
by Igor Chudov ＠ home 17 Dec '03

17 Dec '03

Jay Denebeim (denebeim(a)deepthot.cary.nc.us) wrote * Igor Chudov @ home <ichudov(a)algebra.com> wrote: * * >3. It is a common misconception to think that since anonymity means no * >accountability, it will lead to abuses. Even though such an argument may * >be made in general (it is subject to a significant disagreement), it * >does not apply in the least to moderated groups. Since moderators are, * >generally, responsible for the content of the messages that they allow, * >the final responsibility and control is in their hands. If a certain * >anonymous posting does not satisfy the newsgroup charter, moderators can * >always reject it. I would like to thank Jay for his thorough and thoughtful comments. I agree with many of his point, and leave only those that I disagree on. * You can have both accountability and anonymity. From a newsgroup * moderator's perspective it's not necessary to know the account of the * person, only a way to uniquely identify the individual. There is * cryptography available for every machine that can provide these unique * signatures without requiring a valid from address. You are correct, there are tools allowing individuals to sign their articles and verify electronic signatures. My moderation bot STUMP even has built in support for PGP signature verification. Some of its features are directly indended to be helpful for anonymous users who want to not only post to newsgroups, but also maintain their reputations. As you know, I think that anonymous users can be great contributors to moderated newsgroups. I am not sure that this article is the place to go into a lot of detail about these features, but I can summarize them for those who are interested. However, there is a big and sticky question of what identity really is. For example, I can establish several PGP keys and post anonymously using all of them in turns. What would be my identity? And if I use one of the keys to post off-topic articles and you "punish" that key not knowing that the same physical person uses several others, what's the point of such "punishment"? That is not to say that using PGP signatures in moderated groups is bad: it is great, especially since anonymous users who use PGP to sign their articles can be safely put to the preapproved list of robomoderator bots. The problem is that while we have IDENTIFICATION, there is little we can to do enforce ACCOUNTABILITY. * However, the current newsgroups where this issue has been raised are * all robo-moderated purely for spam elimination. That means that there * must be some way to identify posters so they can be mechanically * blocked if necessary. Cryptography and/or valid e-mail addresses * (whether those addresses actually show up in posts or not) are * necessary for the filtering function to be totally bullet-proof. I disagree with this point. First of all, forging email messages to look like they come from non-anonymous addresses is very easy (just telnet to port 25 and type 3 magic lines). Second, a person can secretly have multiple keys. If someone is determined to bypass a robomoderation bot that does not require EVERY preapproved poster to positively identify herself, they will get through. By the way, I believe that most forgeries in moderated groups are results of personal problems of posters AND moderators, and moderators need to honestly take care of the underlying problems. It is very hard if not impossible to deal with determined and knowledgeable forgers. I would much rather ensure that they get equal access to the group than try to fight them by technical means. * Actually, the cryptographic signature posts are the only 100% reliable * ones, although all newsgroups I'm aware of only accept the forgable * from: lines currently, the spammers have not figured out how to get This is 99% correct, but not 100% correct. Newsgroups that are moderated by STUMP will NOT ACCEPT forged From: lines pointing to posters who have requested special cryptographic protection. All articles purporting to be from such persons pass mandatory check of a PGP signatures. * past robomodded groups yet, and if they do forge addresses, they are * breaking the law currently (fraud), so I don't know that this will * ever become an issue. * * Now, there are some other, even less reliable, methods of * robo-moderating. The 'clue test', which requires a password on your * first post that is listed in a FAQ is one that I think would work * quite well today. It does have a problem in that if the spammers ever Yes. It is an absolutely great method for newsgroup that do not want to bother themselves with the costs of having a human moderator, while at the same time eliminating spam and multiposted "flame" threads. We now have two bots, one of which is yours, that allow to quickly set up such automoderated groups. People who are determined to post off-topic articles to such groups have very many ways of getting past the robomoderator bot. That is usually OK since it is not the regulars who are the problem. - Igor.

1 0

junk mail analysis, part 2
by Wei Dai 17 Dec '03

17 Dec '03

Last time I gave the equilibrium for the junk mail game. Now I will look at a modified game that allows the sender to include an ecash deposit with his email. (Note that there is a slight change of notation from the game tree given last time.) A: Send mail? / \ no / \ yes / \ (0,0) A: Decide deposit d | | | B: Read mail? / \ no / \ yes / \ (-d,d) B: Accept offer? / \ no / \ yes / \ (-d,d-c) (s,r-c) Solution We again apply the method of backward induction. In the last stage B accepts if r >= d. Therefore in the next to last stage, B knows that if he reads, his expected payoff is P(r<d)*(d-c) + P(r>=d)*E(r-c|r>=d). However, in equilibrium it is not possible that P(r<d) > 0 since A is always better off by offering a deposit of 0 instead of any deposit greater than r. Therefore B reads if E(r|r>=d)-c >= d. Now we come to A's deposit decision. A knowns that if he offers any d such that r >= d and E(r|r>=d)-c >= d, B will read and accept. A is indifferent between any such d, so he might as well offer the smallest such d if it exists. If it doesn't exist, A offers d=0. Finally A again always sends regardless of the parameters, since A can get a payoff of at least 0 by sending, and may do better if there is a small probability of B making a mistake. Conclusions We saw that if there exists a d such that r >= d and E(r|r>=d)-c >= d, A offers the least such d, and B reads and accepts. Otherwise A offers d=0, and B does not read. Interestingly, if E(r) > c, d=0 satisfies r >= d and E(r|r>=d)-c >= d, so we reach the same outcome as before. However, if E(r) < c, the outcome of the new game represents a Pareto-improvement since for realistic distributions of (s,r) it seems likely that for all sufficiently large r there exist d such that r >= d and E(r|r>=d)-c >= d, and for these values of r both the sender and the receiver do better than they did in the previous model. Let's call the smallest such r t. Unfortunately the outcome is still not Pareto-optimal if t > c. This conclusion opens the question of whether a better solution exists. One possibility is the following (called the pre-payment solution). A: Send mail? / \ no / \ yes / \ (0,0) A: Decide pre-payment p | | | B: Read mail? / \ no / \ yes / \ (-p,p) B: Accept offer? / \ no / \ yes / \ (-p,p-c) (s-p,r+p-c) If there is enough interest, I'll follow up with a comparison between the pre-payment solution and the deposit solution.

1 0

Zero-knowledge interactive proofs
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Tim Maytag, a product of anal birth, appeared with a coathanger through his head. /_/\/\ \_\ / /_/ \ \_\/\ \ \_\/

2 1

Microsoft ammunition (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 27 Mar 1997 16:11:50 -0600 > From: Toto <toto(a)sk.sympatico.ca> > Subject: Microsoft ammunition > But, if you're tired of the repetition, here's a > reason you should sit through another sermon: > RandomNoise's Coda. Coda lets you design entire > Web pages in Java rather than use a mixture of > HTML content, tags, and Java applets. > > A Java-based Web page removes the distinction > between application and data. It presents data > just as an HTML page would, but every element on > the screen has the potential to be an interactive > part of a sophisticated application. Mix this with the distributed processing model of Plan 9 and you may just have tomorrows computer environment. Jim Choate CyberTects ravage(a)ssz.com

1 0

Re: remailer spam throttle
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Hal Finney <hal(a)rain.org> writes: > For example, one idea is to have a list of people who are willing to > receive anonymous mail without questions. It could be that the remailer > is set up to ask before sending mail normally, but to people on such a > list it doesn't have to ask, it just sends it, because they have given > permission. > > Some people have objected to this proposal because the existence of the > list might give a hint about which people send mail through the remailers. > Even though the list is of people willing to *receive* anonymous mail, > it could well be that there is a strong correlation with people who want > to send such mail. Instead of keeping this list in cleartext, one could keep 1-way hashes of the addresses. Thus a remailer (or anyone) can check whether a given address is on the list, but they can't just go through the list and "investigate" the addresses on it. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

5 9

Re: Analysis of proposed UK ban on use of non-escrowed crypto.
by Hallam-Baker 17 Dec '03

17 Dec '03

Kent Crispin wrote: > Thus, in PGPs case at least, if you want escrowed encryption, then > you must escrow the signature key. Hence the DSA which is a signature algorithm that does not do encryption. I think the use of the same key for both is a bad idea BUT note that if you have a secure signature scheme you don't need an encryption key at all. Simply generate yourself a fresh set of public key parameters for each communication in the manner of IPSEC. The hard problem of setting up security is knowing the identity of the other party. All else pales into insignificance in comparison. Consider the following scenario. SMTP is adjusted so that it has a DH key exchange crypto option. A typical conversation becomes:- EHELO You-got-crypto-mate? 269 Yeah I have crypto XCHAL RSA 248af23876acdef 270 [key-id] [DHparameters e, n, e^x mod n] [sig-of-challenge+DH-params] XENCRYPT [IV] [e^y mod n] [Conversation continues encrypted under key e^y^x mod n AND keybits padding out messages as appropriate.] Now this type of scheme could be implemented without a certificate infrastructure and severly increase the difficulty of snooping. In that case the message would be sent even though [sig-of-challenge+DH-params] was absent. But with a CA infrastructure you could make sure that you hads contacted the correct machine, one authorised to accept mail for fred(a)ibm.com] all you need is a means of hacking the following assertion into X509v3: "Is authorized user of DNS namespace identifier matching" Add in a date and the protocol could be made very reilient and entirely transparent. Now that mail is moving away from godamn awfull crap like sendmail towards engineered systems like notes or exchange adding in protocol extensions becomes easier. If the mail sending agent knows that mail to a particular host should be sent encrypted the system can be made much more transparent than PGP or S/MIME. Like the punters might be able to use it without getting screwed too often. I think email security has often been the perfect being the enemy of the good. One huge problem has been braindamaged ideas about routing email through store and forward mailers rather than connecting to the real destination to start with. Phill

1 0

Re: OECD: No GAK
by John Young 17 Dec '03

17 Dec '03

>Is this in reference to the various GAK initiatives by the administration >or are they finally pushing for forced restrictions on domestic crypto? Has >anyone seen these drafts? I assume that the draft KRAP legislation at CDT Peter Junger cited here is what Markoff refers to: http://www.cdt.org/crypto/970312_admin.html Anyone know of other KR/TTF drafts in the US, UK, FR, JP, AU or elsewhere among the 29 signators of Wassenaar? The Wassenaariors have a wider ambition than the OECDistes.

1 0

Bay Area Anarchist Book Fair, Saturday 3/29
by Bill Stewart 17 Dec '03

17 Dec '03

10am-6pm, S.F. County Fair Building, Golden Gate Park, 9th Ave at Lincoln Way. Free. +1-415-431-8355 Bound Together Books is organizing it, as usual. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

The Upside of Higher Source's Actions
by Toto 17 Dec '03

17 Dec '03

There's 39 new job openings in San Diego. (Astral travellers only, need apply.) -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

No Subject
by Mix 17 Dec '03

17 Dec '03

Timothy C[reep] May's family tree goes straight up. All of his ancestors were siblings, to dumb to recognize each other in the dark. /\ o-/\ Timothy C[reep] May ///\|/\\\ / /|\ \

2 1