December 2003 - cypherpunks-legacy

[PGP-USERS] *** THE HAYSTACK REMAILER IS GONE ***
by Alec 17 Dec '03

17 Dec '03

>Date: Sun, 23 Mar 1997 15:09:25 -0500 (EST) >From: "Fred B. Ringel" <fredr(a)joshua.rivertown.net> >Reply-To: fredr(a)joshua.rivertown.net >To: pgp-users list <pgp-users(a)rivertown.net> >Subject: [PGP-USERS] *** THE HAYSTACK REMAILER IS GONE *** > >Hi all- > > Here's another one from this week (in addition to jpunix). They are >dropping like flies, unfortunately. > > Boy, this really, really stinks. > > Fred >========================================================================== > > *** IMPORTANT NEWS REGARDING HAYSTACK(a)HOLY.COW.NET *** > > The Bovine Remailer, also known as haystack(a)holy.cow.net, is > hereby CLOSED. Mail sent to that address will bounce; I don't > know on a technical basis what putting it in the middle of a > remailer chain will do. There are no other remailers or anon > services associated with cow.net. > > It has been a fun year, but the simple fact is that running > a remailer is a thankless, embittering, nasty job. For every > success story of alternate or persecuted viewpoints seeing > the light of day, there are another four or five cases of > legal threats, use of the remailer to spam people who have > already turned off access to their accounts from other sources, > and the extremely disturbing trend of posting newsgroups > with falsified From: Headers, intending to cause endless spam > bots to mail the forged address. No one carefully put in a > forged address to endanger or misrepresent another person, > but it was only a matter of time. > > Haystack was running on a Sun 3/280 at the cow.net loft. At > the peak, this machine was recieving over one thousand > e-mails a day, doing PGP calculations, and sending them out, > and the 30mhz processor wasn't up to the task. The final > straw was the use of the remailer to send out several > hundred "MAKE MONEY FAST"-style messages to a group of > folks who then rebelled or retaliated to the remailer itself; > everyone associated in this sucks. > > If you think this is a shame, then put up your own remailer; > no doubt you'll have a thicker skin that the admins of > haystack, and will somehow flourish under the increasingly > fascist and overbearing environment of the Internet, but > the games up here, for now. > > Yes, for now. We might return some time in the future, > should technical and financial issues be solved, but it seems > rather unlikely at this juncture. > > Once again, if you enjoyed using haystack, you might consider > fighting the good fight and putting up your own. A good, > solid increase in remailers might save the culture. It is > nearly a crime that so much perfectly powerful computer > hardware exists out there, hooked to the net, and a mere > dozen computers, in our case quite aged, were/are doing the > remailing work. > > So, well, like we said, it's been a blast. See you later. > Moo. > > - The Haystack Administration. > >/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ >Fred B. Ringel -- Rivertown.Net Internet Access >Systems Administrator -- http://www.rivertown.net >and General Fixer Upper -- Voice/Fax/Support: +1.914.478.2885 > Although in theory, there's no difference between > theory and practice, in practice, there is. > >

1 0

Digital Signature Mock Trial
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-PGP-Key: <http://www.shore.net/~sable/info/rltkey.htm> X-Sender: rodney(a)pop3.pn.com Date: Sun, 23 Mar 1997 17:13:25 -0500 To: dcsb(a)ai.mit.edu From: Rodney Thayer <rodney(a)sabletech.com> Subject: Digital Signature Mock Trial Mime-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Rodney Thayer <rodney(a)sabletech.com> >Date: Fri, 21 Mar 1997 18:37:16 -0500 >From: Dan Greenwood <dan(a)civics.com> > >Digital Signature Mock Trial >http://www.magnet.state.ma.us/itd/legal/mock1.htm > >The Commonwealth of Massachusetts Information Technology Division Legal >Department will sponsor a mock trial based on a dispute over a digitally >signed communication. This will be an online event, probably web-based. >There will also be a half-day "court room" mock trial to be held in >Boston in the spring. Anyone interested in helping to plan, or >participate in one or both of these mock trials should contact Dan >Greenwood at dgreenwood(a)state.ma.us. > >The purpose of this exercise will be to explore legal ramifications of >deploying digital signature technology as a business tool, including: >what grounds for a claim (consumer law, financial and banking law, >common law, other?); what issues arise relative to preserving certain >evidence for trial; the legal relationship between an "owner" >(subscriber) of a digital signature, a relying party and a certification >authority; what other evidentiary admissibility issues arise, how might >certain contract terms be interpreted (i.e.: what arguments might be >raised related to liability limitations, rights and duties under >contract); etc. The case >will be tried in a fictional jurisdiction and to fictional parties. > >The specific factual pattern (i.e.: who are the parties and what >happened to them) will be developed so as to highlight areas of legal >uncertainty and maximize the instructional value of this exercise. It is >expected that this exercise will assist the >Commonwealth of Massachusetts and other interested parties to more >efficiently manage liability and to better anticipate legal issues as we >look to deploy public key based network solutions. -------- Rodney Thayer <rodney(a)sabletech.com> PGP: BB1B6428 409129AC 076B9DE1 4C250DD8 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from the dcsb list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/

1 0

Re: "Dr. Roberts" and his advice to the list
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Timothy C. May wrote: > At 10:25 AM -0800 3/23/97, "Dr. Roberts" wrote: > >The remailer network itself may be treated as a black box. This means > >that if you suspect certain people are posting messages to a certain > >list you need only watch the timing of the suspect's posts to verify > >guesses. This makes an attack on the remailer network quite > >inexpensive because you need to monitor a relatively small number of > >people in your jurisdiction. > If a mix accumulates, say, 100 messages, and posts one of them to some > destination, no amount of "timing" analysis points to which of the 100 > incoming messages was the source...this is the essence of mixes/remailers. > (Modulo the usual assumptions about message size, encryption, etc.) I wouldn't be so certain about this. Consider the fact that the remailers can be initially studied through relatively _pure_ analysis, for starters. i.e. - a series of slow periods of remailer use where and entity can ensure that almost all of those 100 messages belong to them. Thus the remailer can be studied for non-random patterns that may be unknown even to the operator himself. Then consider the fact that many of the people using remailers have habits and patterns that can easily be studied and followed. i.e. - Time periods online, standard delay time used in posting commands, frequency and volume of their posts. You must also consider context and syntax analysis that point to the true author of anonymous posts, and the fact that, once known, their personal systems can be monitored to reveal the exact time and nature of their input into the remailers. Even knowledge of killfiles can eliminate some of the overhead for traffic analysis, eliminating some sources as being responsible for volume of anonymous email directed at certain subjects or authors. Many of the factors involved in traffic analysis can be obtained outside of the realm of actual input and output of the remailers themselves, thus narrowing the range of _unknown_ factors in that analysis. Certainly there has been much thought and consideration given to the remailer system, by people who allow for various methods of attack on and/or analysis of their system. However, the assumption of 100 _random_ messages can drop pretty fast when one takes into account the number of factors that may turn some of these messages into quantifiable and easily analyzed entities. Add to this the possibility of factors that are known to the attackers, but not to the defenders, and the margin of security drops even further. Care must be taken to realize that even if one is making efforts to conceal their email traffic, that the results of their efforts are also affected by the person who always posts between 4 and 6 pm, who always posts via the same remailer and who always uses a 2 hour delay command in his posts. One needs to remember, as well, that with the capabilities of autobots and switching mechanisms, that to flood a system or systems at certain critical times is an insignificant obstacle to inputing a large quantity of _know_ data into the frame of analysis. > > Would anybody like to post some references? What > >is required to have a rock solid remailer network? > > > >Dr. Roberts > > Why not do the research into these references yourself and then post them? This is an asinine statement. If you are interested in furthering the interests of privacy through encryption and remailers, why don't you aide someone asking for pointers to better information? Is this list reserved for those who already know it all? Can you say "statist?" Sure, you can. > As for what it would take to make a rock solid remailer network, go back > and read some of the many hundreds of articles many of us have written on > this subject, read Chaum's original 1981 CACM short article, and carefully > study DC-Nets. If all information was in those articles, then I suspect that the remailers would already be "rock solid." Rather than living in the past, as if all possibilities had already been discussed and decided, it might better serve some list members to take their hard-earned knowledge and apply it to today's situation, with new technologies, methodologies, routings, etc. Not only have these things changed, but the types and number of people who use them have also changed, thus changing the scope of possible approaches to traffic analysis. TruthMonger S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: A cypherpunk push-poll ? (Was Re: Dorothy and the four Horseman)
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:32 AM 3/23/97 -0500, Robert Hettinga wrote: >For instance, here's an example of a question that Dorothy and Winn >*should* have asked: > >"In your extensive use of the internet in your professional capacity as the >CIO of a Fortune 50 corporation, have you encountered the use of >cryptography in acts of genocide? > >Ecologic holocaust? > >Thermonuclear terrorism? > >The use of asteroid impact to destroy all life on earth as we know it?" Well, in my extensive use of computers back when I was a tool of the military-industrial complex, I did encounter the use of computer security techniques in planning for thermonuclear terrorism; it's difficult to find a better term for pointing tens of thousands of warheads at your enemies, while they have tens of thousands of them pointed at you, and both of you are plotting about what you think the other guys will do so you can do it to them first, or so you can do something else to them to block it. Ecological holocaust? Nuclear winter was disbelieved, though I did know a meteorologist whose doctoral thesis advisor was working on germ warfare dispersal modelling, and The Customer didn't think in terms of genocide, just "nuking them till they glow" and "making the rubble bounce" and "pre-emptive strikes". Me? I just kept the computers running while the physicists tried to model what this sort of behaviour would do to the Phone Company, and how to let the military get useful phone services pre-, trans-, and post-attack, though once in a while I'd help them with some data structures.. On the other hand, while we did have occasional lectures on astronomy from our Research folks, we were pretty well-behaved with asteroids. But today we know that Eurasia and Oceania have always been friends, and haven't figured out yet that Oceania and Eastasia have always been enemies, so the only nuclear terrorists we have to worry about are the ones who'll do sneaky things like hiding their bombs in bales of cocaine so nobody'll notice when they drive them across the border and up to the White House loading dock, and the Constitution explicitly doesn't say that it's illegal to wiretap foreigners, so we're pretty safe for now. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: "Dr. Roberts" and his advice to the list
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Timothy C. May wrote: > At 10:25 AM -0800 3/23/97, "Dr. Roberts" wrote: > >The remailer network itself may be treated as a black box. This means > >that if you suspect certain people are posting messages to a certain > >list you need only watch the timing of the suspect's posts to verify > >guesses. This makes an attack on the remailer network quite > >inexpensive because you need to monitor a relatively small number of > >people in your jurisdiction. > If a mix accumulates, say, 100 messages, and posts one of them to some > destination, no amount of "timing" analysis points to which of the 100 > incoming messages was the source...this is the essence of mixes/remailers. > (Modulo the usual assumptions about message size, encryption, etc.) I wouldn't be so certain about this. Consider the fact that the remailers can be initially studied through relatively _pure_ analysis, for starters. i.e. - a series of slow periods of remailer use where and entity can ensure that almost all of those 100 messages belong to them. Thus the remailer can be studied for non-random patterns that may be unknown even to the operator himself. Then consider the fact that many of the people using remailers have habits and patterns that can easily be studied and followed. i.e. - Time periods online, standard delay time used in posting commands, frequency and volume of their posts. You must also consider context and syntax analysis that point to the true author of anonymous posts, and the fact that, once known, their personal systems can be monitored to reveal the exact time and nature of their input into the remailers. Even knowledge of killfiles can eliminate some of the overhead for traffic analysis, eliminating some sources as being responsible for volume of anonymous email directed at certain subjects or authors. Many of the factors involved in traffic analysis can be obtained outside of the realm of actual input and output of the remailers themselves, thus narrowing the range of _unknown_ factors in that analysis. Certainly there has been much thought and consideration given to the remailer system, by people who allow for various methods of attack on and/or analysis of their system. However, the assumption of 100 _random_ messages can drop pretty fast when one takes into account the number of factors that may turn some of these messages into quantifiable and easily analyzed entities. Add to this the possibility of factors that are known to the attackers, but not to the defenders, and the margin of security drops even further. Care must be taken to realize that even if one is making efforts to conceal their email traffic, that the results of their efforts are also affected by the person who always posts between 4 and 6 pm, who always posts via the same remailer and who always uses a 2 hour delay command in his posts. One needs to remember, as well, that with the capabilities of autobots and switching mechanisms, that to flood a system or systems at certain critical times is an insignificant obstacle to inputing a large quantity of _know_ data into the frame of analysis. > > Would anybody like to post some references? What > >is required to have a rock solid remailer network? > > > >Dr. Roberts > > Why not do the research into these references yourself and then post them? This is an asinine statement. If you are interested in furthering the interests of privacy through encryption and remailers, why don't you aide someone asking for pointers to better information? Is this list reserved for those who already know it all? Can you say "statist?" Sure, you can. > As for what it would take to make a rock solid remailer network, go back > and read some of the many hundreds of articles many of us have written on > this subject, read Chaum's original 1981 CACM short article, and carefully > study DC-Nets. If all information was in those articles, then I suspect that the remailers would already be "rock solid." Rather than living in the past, as if all possibilities had already been discussed and decided, it might better serve some list members to take their hard-earned knowledge and apply it to today's situation, with new technologies, methodologies, routings, etc. Not only have these things changed, but the types and number of people who use them have also changed, thus changing the scope of possible approaches to traffic analysis. TruthMonger S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: [PGP-USERS] *** THE HAYSTACK REMAILER IS GONE ***
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

> >Subject: [PGP-USERS] *** THE HAYSTACK REMAILER IS GONE *** > >They are > >dropping like flies, unfortunately. > > use of the remailer to spam people who have > > already turned off access to their accounts from other sources, > > The final > > straw was the use of the remailer to send out several > > hundred "MAKE MONEY FAST"-style messages to a group of > > folks who then rebelled or retaliated to the remailer itself; Several months ago, someone (Toto, I believe) posted a thoughtful message suggesting that the burgeoning Internet would result in a huge influx of carpetbaggers of one sort or another, and that the established entities, such as lists and remailers, had best be making plans to deal with the changing frontier or suffer the consequences. Another person, whose name escapes me, as she rarely posts, replied that she thought the post would prove prophetic, much more so than people believed. I mention this mostly to point out that it has been only a short time since this prediction was made, and it is already coming to fruitation in more than a few areas. Survival is going to mean adjustment to the fast changing conditions of the growing Internet. Social and political issues are going to impact developments as much or more than technology, and any entity which cannot adapt in these areas will die off, like the dinosaurs. While I sympathize with the remailer operators for having to deal with spamming problems, spammers and assholes did not suddenly appear out of nowhere in the recent past. The quickening pace of changes in the future will no longer allow system operators and administrators to wait until problems become unmanageable before they make plans to deal with them. In addition to pure anonymous remailers, perhaps there is a need for variations, as well, which encompass varying forms of subscription or authentication. Perhaps limiting the number of posts from an address, raising that limit according to gained reputation capital. As far as anonymity being maintained, is it possible for the system files which log identity/address to be encrypted with a password that is not known to any human, but only to the system? i.e. - even with a court order, there is no way for the operator to provide the info. Lessening the legal hassles could spread the use of remailers, with many being resistant to abuse. Those to whom the anonymity is very important would not have any problem finding the remaining pure remailers. Most of the quick-buck crowd would probably not make the effort to find them, having assumed, from the spam resistant remailers, that they are not a valid option for them. If cypherpunks are serious about making remailers available to the public then we will need to make them both useable and functional for those who might be open to running them. This cannot be done by making them only useful for 'pure' use. If someone were to design a remailer that would only let whites use it, there would be a great hue and cry, but there would also be more remailers available, shortly thereafter. Then someone would design one that could only be used for minorities, etc. If you really want to spread the use of remailers, design them so that you can make a pile of money off of them, in a good way. Then get rich while you further their development and use. TruthMonger

1 0

Re: [PGP-USERS] *** THE HAYSTACK REMAILER IS GONE ***
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

> >Subject: [PGP-USERS] *** THE HAYSTACK REMAILER IS GONE *** > >They are > >dropping like flies, unfortunately. > > use of the remailer to spam people who have > > already turned off access to their accounts from other sources, > > The final > > straw was the use of the remailer to send out several > > hundred "MAKE MONEY FAST"-style messages to a group of > > folks who then rebelled or retaliated to the remailer itself; Several months ago, someone (Toto, I believe) posted a thoughtful message suggesting that the burgeoning Internet would result in a huge influx of carpetbaggers of one sort or another, and that the established entities, such as lists and remailers, had best be making plans to deal with the changing frontier or suffer the consequences. Another person, whose name escapes me, as she rarely posts, replied that she thought the post would prove prophetic, much more so than people believed. I mention this mostly to point out that it has been only a short time since this prediction was made, and it is already coming to fruitation in more than a few areas. Survival is going to mean adjustment to the fast changing conditions of the growing Internet. Social and political issues are going to impact developments as much or more than technology, and any entity which cannot adapt in these areas will die off, like the dinosaurs. While I sympathize with the remailer operators for having to deal with spamming problems, spammers and assholes did not suddenly appear out of nowhere in the recent past. The quickening pace of changes in the future will no longer allow system operators and administrators to wait until problems become unmanageable before they make plans to deal with them. In addition to pure anonymous remailers, perhaps there is a need for variations, as well, which encompass varying forms of subscription or authentication. Perhaps limiting the number of posts from an address, raising that limit according to gained reputation capital. As far as anonymity being maintained, is it possible for the system files which log identity/address to be encrypted with a password that is not known to any human, but only to the system? i.e. - even with a court order, there is no way for the operator to provide the info. Lessening the legal hassles could spread the use of remailers, with many being resistant to abuse. Those to whom the anonymity is very important would not have any problem finding the remaining pure remailers. Most of the quick-buck crowd would probably not make the effort to find them, having assumed, from the spam resistant remailers, that they are not a valid option for them. If cypherpunks are serious about making remailers available to the public then we will need to make them both useable and functional for those who might be open to running them. This cannot be done by making them only useful for 'pure' use. If someone were to design a remailer that would only let whites use it, there would be a great hue and cry, but there would also be more remailers available, shortly thereafter. Then someone would design one that could only be used for minorities, etc. If you really want to spread the use of remailers, design them so that you can make a pile of money off of them, in a good way. Then get rich while you further their development and use. TruthMonger

1 0

WebWorld 10-11
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

WebWorld 12-14
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

PGP as disinformation
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Sergey Goldgaber wrote: >This is only a practical problem related to PGP's lack of popularity. >The proposed solution will work in the long run, assuming PGP achieves >great popularity. Thus, education of the public concerning PGP and remailers >will help make this solution more effective. > Has this list not considered the very real possibility that PGP is itself a rogue program released by the intelligence apparatus to detour we cyberpunks? As I have been arguing, the obvious is often false. While certain statists on this list are arguing in vain that I lack expertise in cryptographic matters, the truth is apposite this. Ask not for whom Bell toils, Dr. Roberts -- --

2 1