December 2003 - cypherpunks-legacy

No Subject
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

<TITLE>ANFOS</TITLE> ANFOS ANFO is an acronym for Ammonium Nitrate - Fuel Oil Solution. An ANFO solves the only other major problem with ammonium nitrate: its tendency to pick up water vapor from the air. This results in the explosive failing to detonate when such an attempt is made. This is rectified by mixing 94% (by weight) ammonium nitrate with 6% fuel oil, or kerosene. The kerosene keeps the ammonium nitrate from absorbing moisture from the air. An ANFO also requires a large shockwave to set it off. <HR> From the Terror Handbook

1 0

communicator
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Tom -- Will netscape communicator be available for linux? It would be very very unfortunate if netscape dropped support for linux... thanks - Igor.

2 1

Re: Spam Update/Cyber Promo attacked (fwd)
by tzeruch＠ceddec.com 17 Dec '03

17 Dec '03

One simple question: where is the property right to a socket and mailbox. If Wallace has the right to fill my computer with unwanted data, then I have the same right toward his. If it is an act of free speech to send some commercial solicitation for something I would never want, it is hard not to maintain that an ARP packet isn't covered by the same theory, much less 1M+ responses of the same email. It costs me something to filter out spam, and will cost him something to filter out counterspam of whatever sort. The NSP may be in the no-man's land between the trenches, but they are providing the connection and can tell him to look elsewhere or charge a premium for the extra traffic. Any such property right will be symmetrical, so if I don't have the right to control what comes into my inbox, neither does anyone(a)spamway.com. Whether I like it or not, Anarchocapitalism is going to be the political system on the internet. Just like what is described in David Freedman's books about private protective services, a spammer will continue until he hits someone with a T3 and a good software agent that will happily fill out response forms at 6M/sec, or simply ask politely to be taken off the list several hundred times per second. At that point the lists of people who don't want to be spammed will be taken very seriously.

1 0

Re: War & InfoWar
by Lucky Green 17 Dec '03

17 Dec '03

At 09:15 PM 5/10/97 CST, TruthMonger wrote: > The government has prosecuted dozens of individuals for planning >to bomb the OK city Federal Building (including executed murderers). >It has long been listed as a target of choice for anti-government >paramilitarists. Can somebody confirm this? Cite? Thanks, -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

2 1

Re: The War is Underway (fwd)
by Lucky Green 17 Dec '03

17 Dec '03

At 04:10 PM 5/10/97 -0700, Kent Crispin wrote: >Hence the value of the "Crypto is Cool" approach. A valuable addition >would be crypto packages designed for high school kids. All my many >nieces and nephews are on the net... I usually don't reply to these kind of posts, but since you have mentioned this before and since you obviously still don't deem it appropriate to get yourself up to speed by reading the archives, your idea has been discussed and tried. People won't use crypto unless it is either transparent, meaning put there *for* them by the OS vendor/application developer or because the see a need for using it. The few fanatics that use crypto because "it is cool" are inconsequential when the objective is bringing crypto to the masses. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

3 2

Re: The War is Underway (fwd)
by Lucky Green 17 Dec '03

17 Dec '03

At 06:17 PM 5/10/97 -0400, Black Unicorn wrote: >Yes. One of the major stumbling blocks I have run into is a lack of code >which really is refined and reviewed enough to serve the purposes I need >it to serve. The reason for the lack of "refined and reviewed" code is simple. Writing such code is difficult and time consuming. Anybody on this list capable of writing it probably has a 10+ hours daytime job. It is often hard to donate the effort required into producing either a freeware system or a system that has a shaky business model at best. Yes, the original code for type I remailers was written in a few days. Their security is accordingly low, interfaces were almost non-existent. The type of software you seem to be interested in requires more than just a single individual dedicating a few evenings to it. It requires entire software development teams. That takes the development out of the realm of guerilla programming and into commercial efforts. As PGP, Inc. can attest, making money of strong crypto can be hard. That further limits the number of players willing to dedicate time to such an effort. >FC97 did a lot to make some more obscure things obvious, and >familiarize the players with each other, but the details are often hard to >come by. Many of the applications out there are painfully behind in >interface areas forcing developers to use complicated "toolkits" which >often lack the basics we need. Finding an analogy to easily explain even >the basics to a customer is very difficult unless the front end jibes with >the attempt. While I would have to agree that FC'97 was a very worthwhile event from the human networking perspective, I am confused by your claim that the "toolkits" lack the basics you need. I assume you are talking about routines in crypto libraries here. What routines do you need that aren't in the crypto libs available? I am not claiming that crypto libs have all the routines one might possibly need, but I would be surprised if they didn't have the routines you need. Perhaps it would help if you would explain what you are looking for. Furthermore, crypto libraries are not meant to address interface design. The interface design is up to the application developer. >> Perhaps it's time for some stego interfaces to remailers. Somehow I doubt they will be developed anytime soon. Only a very small fraction of remailer users wants to hide the fact that they are using remailers and not also hide the fact that they are using crypto at all. If you only want to hide remailer use, but not crypto use, a Pipe-net like system should suit you fine. >Most of what concerns me is the need to keep keylengths "obscenely large" >because what is obscene today may not be so obscene after 5 years of >chilled crypto development. I agree keylengths are an issue. An even larger issue are the properties of ciphers. We don't know that breaking RSA is as difficult as factoring. We just hope it is. And we definitely don't know that factoring can not be done in polynomial time. Not to mention that we don't even know if P != NP. >Given the success (or lack thereof) of my call to arms before, I'm not >sure I'll be anxious to repeat it soon. (The largest keylength of any >widely used cipher of which I am aware remains at 128. Not wanting to split hairs, but 3DES is 168 bits. But it is about twice as strong as DES, so the effective keylength does not exceed 128 bits. Still, there is good reason why so few of the many ciphers out there are actually being used for the high security applications. No cipher has been as thoroughly analyzed as DES. And while 3DES is often called slow (which is irrelevant unless you have to encrypt large amounts of data), it is generally considered secure. If you need better than 3DES, you want larger keylength while retaining the security of using a well analyzed cipher. I am not aware of any such cipher today. Perhaps that's why it is used so little. :-) > There still is no >effective PipeNet, no real mainstream "stealth crypto." No significant >work on detering traffic analysis or denial of service with the exception >of the below). I disagree. Just because Cypherpunks have not announced the releases of a finished product, tremendous progress has been made this year alone. And we have found new allies, such as the Onion Router team from Navy Research Lab and the CROWDS team from AT&T. Sure, their systems are far from perfect and require further development. Which is why several Cypherpunks, myself included, have been busy getting the teams up to speed, teaching them about attack methods, explaining to them why certain attacks they discounted as unlikely are actually easy to pull off, and generally advising these non-CP subscribers with very CP projects about modifications that must be made to the software before it will see widespread deployment. Understand that NRL has three scientists working on Onion Routers a significant part of their time. With full funding. This is the kind of commitment it takes to make the more advanced systems a reality. A volunteer effort is considerably less likely to be able to come up with the resources for the many projects that need design and implementation. Other Cypherpunks have been busy working on advanced systems, but this stuff takes time. Writing a crypto library is comparatively easy. If your DES code gives the right results for a given IV, the code works. Taking that DES code and some RSA code and turning it into an Onion Router is a whole different challenge. And any mistakes you make are far less obvious. [...] >An online bank is useless if it can be blocked by a few keystrokes. No offense, but Adam's "Eternity" system doesn't come close to Ross Anderson's original design. It is a fun weekend hack, but calling it the Eternity Service is a very unfortunate choice of words. It isn't any more Ross Anderson's Eternity Service than type I remailers are Chaumian mixes. >(But that's what secure INMARSAT phones are for too) And how do you feed the base station? I believe the solution to permanent servers is more likely to come from the IETF's mobile IP efforts (again a project that far exceeds what a few Cypherpunks can do) and from anonymous server designs such as recently proposed by the usual suspects and others who wish to remain anonymous. [...] >C'punks should wish to provide clandestine crypto services for the entire >population. Laws which may or may not pass in the United States should >bore c'punks, because they should realize that legislation is irrelevent >because the genie is already out of the bottle. Unfortunately, I don't >think the genie is all the way out of the bottle. Clandestine anything, almost by definition, will never reach the entire population, but only those that are willing to go out and seek it. [If it was openly available, it wouldn't be clandestine.] PGP became as popular as it did because it could be used with zero investment by any two parties, requiring only minimum connectivity. Truly secure net anonymizers will need, at least at the backbone level, multiple dedicated machines with fat 24/7 Internet connections in multiple jurisdictions. That's a significant investment. Such sites are not going to become a reality out of the goodness of somebody's heart. Even in the unlikely event that somebody has the time to write all the code for free. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

3 2

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"wazoo"} = "<remailer(a)wazoo.com> cpunk mix pgp hash latent cut ek"; $remailer{"shaman"} = "<remailer(a)lycaeum.org> cpunk pgp hash latent cut ek"; $remailer{"hidden"} = "<remailer(a)hidden.net> cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 12 May 97 6:48:02 PDT remailer email address history latency uptime ----------------------------------------------------------------------- nym config(a)nym.alias.net ++**#******* 1:25 99.99% balls remailer(a)huge.cajones.com ###*######## 1:12 99.98% weasel config(a)weasel.owl.de +++-+++++-+ 2:06:18 99.84% squirrel mix(a)squirrel.owl.de +++-+++++-+ 2:05:58 99.77% jam remailer(a)cypherpunks.ca * ********** 8:44 99.44% replay remailer(a)replay.com * -***** * 16:09 98.65% cyber alias(a)alias.cyberpass.net +**** * * *+ 19:10 97.86% dustbin dustman(a)athensnet.com .--.+-++- 2:35:37 93.78% winsock winsock(a)rigel.cyberpass.net ..-..----- 5:14:17 92.97% lucifer lucifer(a)dhp.com ++++++++++ 38:33 88.02% hidden remailer(a)hidden.net #__-+#### 2:32:43 76.02% reno middleman(a)cyberpass.net .+_.- +- 1:47:08 70.50% mix mixmaster(a)remail.obscura.com ---.- 7:31:14 28.09% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Applauding Violence (was: Re: Wine Politics Again! (fwd))
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Sun, 11 May 1997 04:07:36 +0200 (MET DST) > Subject: Re: Wine Politics Again! (fwd) > To: cypherpunks(a)toad.com > From: nobody(a)replay.com (Anonymous) > Organization: Replay and Company UnLimited > Reply-to: nobody(a)replay.com (Anonymous) Froomkin wrote: >> On Fri, 9 May 1997, Tim May wrote: >>Every day that passes, I'm more convinced that McVeigh did the right >>thing. Some innocents died, but, hey, war is hell. Broken eggs and all >>that. > It ill behooves participants in a democracy to either advocate or even > tolerate or even cluck sympathetically at mass murder for political ends. > This way lies Bosnia. > A. Michael Froomkin Agreed. I'm getting progressively more turned off by Tim's developing survivalist/confrontationist stance. I fear that journalists and other casual readers will mistake his positions for common 'cypherpunk' viewpoints. The type of armed, ingrained bitterness towards all aspects and manifestations of government he displays is hazardous to himself personally; I can envisage a simple traffic stop turning violent. Worse, he's demonizing his opponent. This is counter-productive. It's better to try to understand the actual underlying goals of your opponent - it gives you a much better chance at turning him into your ally, or avoiding a conflict if you cannot do that. If he can be neither turned nor avoided, the minimum action to change the status quo should be used. If Tim truly maintains that a 'war' is underway between people like him and the government, than he would be in no position to complain if Clinton's men treated his little hilltop retreat as an enemy outpost. For all his pride in it's defensibility, they could take it out in seconds if respect for due process, the Constitution, and a real concern for the lives of innocents did not stop them. The policies of the current gang in power are bad, and may well get worse. But terrorism is not yet an appropriate response, and I pray that it never will be. Peter Trei trei(a)Process.com

1 0

Unexportable crypto
by ET 17 Dec '03

17 Dec '03

A simple substitution cypher has a keyspace of 26! ~ 2**88 Isn't this too strong to export?

3 2

The Interlinked Cypherpunks Lists?
by Tim May 17 Dec '03

17 Dec '03

I've recently had some of my articles sent to "cypherpunks(a)cyberpass.net" bounce (more precisely: "<cypherpunks(a)cyberpass.net>... Deferred: Connection timed out with rigel.cyberpass.net. Warning: message still undelivered after 4 hours"). And I've received no Cypherpunks list traffic more recently dated than Saturday morning. (I'm subscribed to cypherpunks(a)cyberpass.net.) I surmise that something is wrong. So I've subscribed to one of the alternates, cypherpunks(a)algebra.com. Some thoughts: * Is it possible for the interlinked lists to send out announcements of list problems to subscriber of all such lists? (Each list owner could do a periodic "who cypherpunks" of the other lists, then use this list to send a message if a problem comes up. More sophisticated cross-processing could eliminate duplicates, etc.) * Alternatively, if one of the sites goes down, such as "cypherpunks(a)cyberpass.net" seems to have done, could the other sites automagically pick up the task of distributing articles until the site comes back up? * How feasible is it to have a single "virtual subscription address" which gets traffic from one of the various list sites? (To avoid having to subscribe to two or more lists and thus getting duplicates.) I'll resubmit a few of my recent articles to cypherpunks(a)algebra.com. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3