December 2003 - cypherpunks-legacy

WebWorld 21
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

WebWorld 22
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

Re: National Citizen-Unit
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In> Governor's Budget Includes Money to Set Up Gang-Tracking In> Network In> [...] In> [A]s part of the governor's anti-gang proposals, he's In> proposing to spend $625,000 worth of state and federal money In> to set up a gang-tracking computer database and network. In> Four agents of the Tennessee Bureau of Investigation will be In> assigned to do nothing but gather and maintain information In> about gangs in the state's four regions. <snip> In> Information on the database could include a picture, a In> description, the gang affiliation, criminal convictions, In> crimes that a person is suspected in, and possible In> nicknames. -=> Quoting In:bdolan@usit.net to Harka <=- In> The important thing to note is that - as I understand the In> description of the program - a person does not have to commit a In> crime to be included in the database. They just have to have In> contact with a person or group which is already in it. This has been going on in Germany for several years now under the name "Raster-Fahndung" (cross-reference-search). What it means is as you write it: even mere contacts to suspected "terrorists, gang-members, drug-dealers" etc. is enough, to get you flagged as "suspected supporter of [see above]". An example of how one could get into that was being presented by a german civil liberties group: Let's say, there is a non-permitted demonstration going on in City A of "anarchic chaots" (the german term for ultra-left-wing groups). The police installs street barriers around the city and screens the drivers licences in search of potential demonstrators. Bob drives up, shows his ID and happens to be believed by the police man to be somehow affiliated with the demonstration. They might search his car and will let him go after that, if nothing is found. However, his name will be put in a central database as "suspected supporter of unconstitutional groups". That is enough to target his entire family and close friends with possible surveillance etc., if the police (or actually the interior intelligence agency "for the protection of the constitution") chooses to. Bob will never know of that and although, he has nothing to do with the demonstrators, his name will be in such a database as a suspect. That example shows, that the law can be (mis)used to almost unlimited surveillance on pretty much everybody to the hearts extent of the "law-enforcement" agencies. And guess what? They will. Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! -> http://www.epic.org */ /* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMz83nTltEBIEF0MBAQGNnwf8CL7L2pEY1Qfnfh+5D5LWwTb/DXWAr6+C TJcsuBYA8MQ94tNhM7DDwBLlf60AKVgKJjh/BX6JEOWMrXLXewkDxNCj9PG1iDwV bPXmEsI8ovX8EZJrNjFAhF7pG83bwHzD+23xpamx+9fYq6T2hHpZse7XEavYNBqv 0+8vJiCxsvuLn9q8CWng+KgNYmCk9JXJUj+8jUvJJHgbXt+Bkvech4mfL7cW7nvN HPAMXalKWaWrcroJAnz/2bi2JlMovfVftU1u79CUrPi9rPMYJJAaD28VEfeCHd5T e9WfTnu6F3C67CEZ0TCR+toQxLM5RgNej3mv69OiVyntNnmaPD9GeQ== =1e2d -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

2 1

National Citizen-Unit #22
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

WebWorld 22

1 0

rot13 Encoder/Decoder
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

http://otto.cmr.fsu.edu/~davis_t/rot13.cgi

1 0

Privacy? Not in Canada!
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

From: ag434(a)freenet.hamilton.on.ca (David Buchanan) Newsgroups: alt.security.pgp,talk.politics.crypto Subject: Re: If you want privacy, don't come to Canada! Date: 30 Mar 1997 22:26:41 -0500 Organization: Hamilton-Wentworth FreeNet, Ontario, Canada. CRIMINALS WON'T BE THE ONLY TARGETS Criminals won't be the only targets if strong non-escrowed encryption is outlawed although criminals provide a convenient excuse for governments seeking to extend their power over their own citizens. Even in Canada, a nation which can hardly be described as a police state, there is good reason to fear the security and intelligence apparatus will be used by the government against its legitimate and law-abiding political opponents. Let me give you two examples. 1) BUREAUCRAT'S "LET'S GET HIM" MEMO Within the last couple of weeks, the Canadian public learned from news reports about a meno written by a top level federal bureaucrat in which he complained about the activities of a private citizen and suggested that his fellow government officials should "take a look at this guy." The private citizen was a law-abiding, former military officer whose freedom of information requests had exposed mismanagement and corruption in the government. This memo was particularly chilling because the recipients included officials of the tax department and the Canadian Security and Intelligence Service (CISIS) -- two agencies well suited to bringing pressure to bear on private citizens. Although the bureaucrat was caught in the act this time, it is quite disturbing that a senior civil servant believes such a memo to be normal and acceptable. 2) NEO-NAZI PLANTED IN OPPOSITION PARTY During the last Canadian federal election, the ruling Progressive Conservative Party (PCs) was losing voters to the Reform Party, a moderate, small "c" conservative party based in Western Canada. The PC's campaign strategy was to accuse Reform of being "extremists" or "racists." About the only evidence of this that the PCs were able to produce was the founder and leader of a small neo-nazi style group who had attempted to infiltrate the Reform Party with little success. Subsequently the public learned that the neo-nazi was actually a paid agent of the Canadian Security and Intelligence Service (CISIS), an agency ultimately controlled by the Progressive Conservative government. There have been the expected denials from CISIS but the most plausible interpretation of these events is that the Progressive Conservative government tried to sabotage the electoral chances of the Reform Party by planting a neo-nazi on its fringes. CISIS is one of the government agencies that definitely would have access to all of the material obtained from the proposed key escrow or key recovery type systems. WHY HONEST CITIZENS SHOULD BE WORRIED The increasing use of email and other data telecommunications will greatly expand the amount of private and personal information on private citizens that governments can collect, archive, and sift through whenever they need weapons to use against their legitimate political opponents. This information can be collected very cheaply and used in ways that are difficult for the government's victims to counter or even detect. For example, a simple telephone call to a cooperative bank official just before the a target attempts to renew a line of credit for his business. The only effective way to prevent this is with the wide availability and use of strong non-escrowed, non-key-recovery encryption. As for those trusting souls out there who still believe they have nothing to hide, ask yourself this question: Would you be willing to email carbon copies of all your email messages and online data transmissions to one of your political opponents? If secure encryption is banned, this is exactly what you will be doing and you had better be prepared to agree with everything the government does on every issue or take the consequences! DB --

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"wazoo"} = "<remailer(a)wazoo.com> cpunk mix pgp hash latent cut ek"; $remailer{"shaman"} = "<remailer(a)lycaeum.org> cpunk pgp hash latent cut ek"; $remailer{"hidden"} = "<remailer(a)hidden.net> cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 31 Mar 97 6:49:14 PST remailer email address history latency uptime ----------------------------------------------------------------------- hidden remailer(a)hidden.net **######.### 51:35 99.99% lucifer lucifer(a)dhp.com ++++++++++++ 36:24 99.98% cyber alias(a)alias.cyberpass.net *+**+++*+++* 38:16 99.91% weasel config(a)weasel.owl.de ++--++-++++ 2:21:10 99.89% replay remailer(a)replay.com **-**-+*-+-* 1:32:14 99.81% balls remailer(a)huge.cajones.com ###+*##* +## 2:27 99.73% squirrel mix(a)squirrel.owl.de ++--++-++++ 2:44:37 99.58% dustbin dustman(a)athensnet.com + ++ +-++ + 49:04 99.35% exon remailer(a)remailer.nl.com #*+# +##* ** 4:34 99.25% reno middleman(a)cyberpass.net +-++ +.-+- 50:50 98.87% winsock winsock(a)rigel.cyberpass.net -----+---- - 3:56:33 98.65% jam remailer(a)cypherpunks.ca * ** ** * 11:13 98.54% extropia remail(a)miron.vip.best.com ___.._.-.- 27:38:30 96.60% mix mixmaster(a)remail.obscura.com ___.+_.-* 33:58:31 94.45% shaman remailer(a)lycaeum.org ++-++-+ -+ 28:03 86.87% nym config(a)nym.alias.net ***#**-#-# 13:11 80.62% haystack haystack(a)holy.cow.net 52:19 -4.36% middle middleman(a)jpunix.com + 35:43 2.13% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Stego Question
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Stego Question: How many bodies does it take to spell, "I _told_ you I was crazy!"

1 0

Re: PRESS REPORT - IMPORTANT?????
by Ray Arachelian 17 Dec '03

17 Dec '03

Is this for real or a troll??? On Mon, 31 Mar 1997, Anonymous wrote: > *** London Times, 30/03/1997 *** > > >Factoring problem broken: > > > >One of the main systems used by computer privacy > >programs around the world such as those used on > >the internet to prevent third parties eavesdropping > >on credit card transactions has been proven insecure, > >The RSA algorithm, based on the difficulty of "factoring" > >large numbers appears to have a weakness, a press > >release by the IACR (International Association for cryptologic > >research) reads as follows: > > >"Leading researcher Ari Lenstra last night announced major > >progress had been made towards a solution to the factoring > >problem, a result obtained by Sergei Ripov, researcher at > >an obscure university in the former Soviet union, shows > >conclusively that there exists a solution to the problem > >that is of polynomial time complexity, although this solution > >has yet to be found this signals the beginning of the end for > >a number of cryptosystems based on this problem, please note > >a trivial solution to factoring also suggests a trivial solution > >to the ECDLP and therefore a number of other systems such as > >Diffie-Hellman and the El-Gamal group of cryptosystems should > >be considered insecure" > > > >We were unable to contact the IACR for futher information. > >The leading internet products company Netscape refused to > >comment saying only "We regularly review data security > >issues concerning all of our products". > > =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= For with those which eternal lie, with strange eons even death may die.

1 0

Re: [NTSEC] Re: Internet Explorer Bug #4 (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= For with those which eternal lie, with strange eons even death may die. ---------- Forwarded message ---------- Date: Sat, 29 Mar 1997 14:37:43 -0800 From: Chris Plunkett <chris.plunkett(a)opensys.com> To: pmarc(a)cmg.FCNBD.COM Cc: Romulo Moacyr Cholewa <rmcholewa(a)poboxes.com>, Windows NT BugTraq Mailing List <NTBUGTRAQ(a)rc.on.ca>, "ntsecurity(a)iss.net" <ntsecurity(a)iss.net>, hughtay(a)microsoft.com Subject: Re: [NTSEC] Re: Internet Explorer Bug #4 > > We are aware of this, but the report is misleading. The report states > > that both times the password sent from the client to the server is > > encrypted. It would take quite a while for even a Cray Supercomputer to > > decrypt the password, even if it was dedicated to that sole task. For > > the average network server (and a powerful one), it would take a few > > human lifetimes to decrypt them even if they were dedicated to that sole > > task. > > Arrggghhh! Nothing sets off my ignorance alert more quickly than somebody > who mentions a Cray in conjunction with attempts to brute force crypto > algorithms. I won't bother to explain all of the reasons why that is a > foolish thing to say. Instead I will share a little story about some folks I > know from about 3-4 years ago. (Greetings to any of these individuals who > may be lurking on NTSEC or NTBUGTRAQ.) > > Apparently they had some good reasons to go after the encryption algorithm > used by WordPerfect. After several ineffective implementations, a > WordPerfect engineer developed a DES based encryption algorithm. His claim > was that it would take a room full of Crays to break the algorithm. Hmmm... > sounds familiar. Needless to say, shortly after a successful attack on the > algorithm by those mentioned, there was a certain 486 with a YMP sticker > plastered to its front. > > Sure, brute force attacks can be expensive when an algorithm is implemented > correctly. However, I can't let it pass when these facts are expressed in > such a patronizing manner. > > --- > Paul M. Cardon - System Officer > Capital Markets Systems - First Chicago NBD Corporation > pmarc(a)cmg.fcnbd.com - (312) 732-7392 > I heard a story one time. It evolved around a college student in France doing some cyptography work in school, working nights as a backup operator at some large computer center. He didn't need a cray. A little knowledge and some creative programming, and a center full of computers (problably around the size of a Sparc 10). The story ended explaning how one of the encryption schemes that would tale a Cray week to break, was broken in one night, by a bunch of computers running backups. It might be hard to find a cray, but I know a guy, he works at this place where they got them 15 pentium pros. The average network server has another server for some other task on the same wire. ------------------------------------------------------------ Chris Plunkett System Technician Breakwater Technologies Inc. phone:(206)803-5000x112 Fax:(206)803-5001 http://www.breakwater.net mailto:chris@breakwater.net ------------------------------------------------------------

2 1