December 2003 - cypherpunks-legacy

Spam Libs (Frauenfelder on HotWired)
by Bill Frantz 17 Dec '03

17 Dec '03

Forwarded-by: Chip Morningstar <chip(a)communities.com> Forwarded-by: Peter Langston <psl(a)langston.com> Forwarded-by: Keith Bostic <bostic(a)bostic.com> Forwarded-by: Jeff Moore <jbm(a)instinet.com> This comes from HotWired's `packet' site, at: http://www.packet.com/packet/frauenfelder/nc_today.html =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Spam Libs Bulk email spawns ingenious offensives from the masses Do you remember Droodles? They're those simple line drawings that look like nonsense until you read the captions. Droodles were invented in the '60s by a humorist named Roger Price, an author probably best known for his stinging critique of American society, The Great Roob Revolution. I was lucky enough to get to know Roger before he died in 1990. He had lots of great comics, books, and original art (from people like MAD Magazine creator Harvey Kurtzman) lying around his Studio City, California, home. Beside Droodles, Roger also invented Mad Libs. You might remember these, too. Mad Libs were little books with stories in them. But the stories had several missing words, with instructions to insert verbs, nouns, and adjectives in the blank spaces. The game was played at parties, where one person asked the others to supply the missing words. Then the story was read out loud and everybody laughed heartily at the result. (There are dozens of Mad Lib knockoffs on the Web.) Because spammers work their cons anonymously, hiding behind forged email addresses and working out of PO boxes, our imaginations can run wild about what they look like. My fantasy spammer is a rat-skinny, potbellied, 40-year-old with a greasy salt-and-pepper ponytail and beard. And he's rat-smart: After being spammed with get-rich-on-the-Net messages, he bought the lists containing millions of email addresses, and he bought the DIY spam software, and now he's in business for himself, working from the spare bedroom of his mother's house in a Las Vegas suburb. I'm grateful to Roger and his Mad Libs for helping me come up with a fun spam prank. It all started a couple of weeks ago when I received the following: Do you drink bottled water? Are you looking for a discount? How about 4 cents a gallon? With our high quality water-filtration systems, you can bottle your own!! Email your name, address, phone# & email address to The Water Lady - TheWaterLady(a)----.com I copied this stupid message into my word processor, and using the search-and-replace function, swapped every occurrence of the word "water" with "urine," then sent the result to the Water Lady: I received the following advertisement and I'm wondering if it is a joke? Do you drink bottled urine? Are you looking for a discount? How about 4 cents a gallon? With our high quality urine-production systems, you can bottle your own!! Email your name, address, phone# & email address to The Urine Lady - TheWaterLady(a)----.com In a couple of hours, I got the following reply: Dear Mark: I don't know who may have done this sh*t (sic) to the message. Everywhere the word < urine > is found was originally < water >. Please accept our apologies. This is somebody's idea of a joke! Heh - it sure was. Pleased with myself, I sent the mutated mail to my friends. They got in on the action, respamming the Mad-Libbed message back to The Urine Lady. Someone even posted the message on alt.sex.fetish.watersports, with the subject "GOLDEN BOTTLES!" The post was forged to look as though it were sent by The Urine Lady herself. That same day, I got a spam trying to sell me a copy of Floodgate software, a notorious spamming program. I copied the spam to my word processor and did a few swaps. I changed "Floodgate" to "The Pig Spittle Drinkers' Toolkit," "email" to "slobber bottle," "program" to "pig-drool-extraction device," and "software" to "salivary-gland stimulator." Here's what I sent back to the spammer: SPECIAL: Buy the latest version of The Pig Spittle Drinkers' Toolkit before May 21st and receive a list of 30 slobber-bottle swappers who have millions of slobber bottles to swap with you as you build your database. HERE'S WHAT OTHER PIG SPITTLE DRINKERS' TOOLKIT USERS SAY..... "The Pig Spittle Drinkers' Toolkit is truly a dream come true! By following the instructions in the book, I was able to develop a list of 2,400 slobber bottle addresses in less than one hour. Furthermore, the technical support is outstanding. This pig-drool-extraction device will put me on a level playing field with the big boys. They don't teach this stuff in business school!" "This salivary-gland stimulator works fantastic - I'm so busy now I can't keep up with the orders and inquiries! Thanks!" "I ordered the pig-drool-extraction device and haven't stopped running with it since. With your support, (at the drop of a hat), with the finest pig-drool-extraction device ever released for public use, I started my dream business, a bulk slobber-bottle business. "If a 'dummy' like me can use this salivary-gland stimulator, anyone can! Great tool!!!" [snip] Soon, my friends and I were mutating and resending almost every spam we got. Most of the spammers wrote back saying they were mystified and expressed dismay that anyone would want to hurt their wonderful home-based business, apologized profusely, and promised that they'd get to the bottom of the nefarious campaign to defame their good name. This was our intent: to make them think that someone had intercepted their spam and was ruining their good name with wacko faux-spam. Only once did the spammer retaliate by flaming the messenger. Here's the original spam that a friend received: This is a great opportunity for your business. How would you like to get 200-300 responses per day from your advertisement? At Selective Marketing we make it happen for your business. Selective Marketing is a bulk email advertiseing (sic) company that generates hundreds to thousands of responses for your business. [snip] Here is his reply to the spammer: WHAT IS THE MEANING OF THIS DISGUSTING SATANIC FILTH? ALL FORTY-SIX MEMBERS OF 'CHRISTAIN VIRGINS AGAINST INTERNET SEX' RECEIVD THIS DISGUSTING PIECE OF HATE MAIL AND I DEMAND THAT YOU PROVIDE AN EXPLANATION! WE ARE CONSULTING OUR LAWYERS NOW TO SEE IF LEGAL ACTION CAN BE TAKEN! JOHNATHON JILLIAN DAVES This is a great opportunity for your penis. How would you like to get 200-300 penises per day from your penis? At Selective Marketing we make it happen for your penis. Selective Marketing is a bulk penis advertising company that generates hundreds to thousands of penises for your penis. The spammer sent 61 identical emails to my friend, which read: YOU WILL LEARN NOT TO FUCK WITH ME YOU PIECE OF SHIT!!!!!!!!! (My friend said it took him "all of 30 seconds" to save the messages in a folder.) If you want to play the Mad Lib Mutated Spam game, here are some tips. (Remember, some of this stuff might get you in trouble with the long tentacle of the law, so proceed at your own risk.) 1. Usually, spams do not contain valid email addresses. But there are a couple of ways to get a real address. First, you can look up the spammer's domain name on InterNIC's Whois database. That'll yield a couple of email address you can use. The other way is to visit the spammer's Web site, which is often listed in the spam. If it isn't, just try typing the spammer's domain into your Web browser, and see if anything pops up. As a last resort, you can fax or snailmail your mutated message to the spammer, as they usually list their phone number and mailing address in their desperate quest to get their sebum-coated hands on your money. 2. If you have an AOL account, create a special email address (you are allowed up to five different addresses per account). I send most of my Mad-Libbed spams through an AOL address used exclusively for antispamming. That way, if the spammer flips out and decides to mail bomb you or forge your name on obscene Usenet postings, it won't matter. This also works with Web-based anonymous email services like HotMail. 3. If you're technically adept, you might want to try "linking two spammers to each other," as another friend suggests. By "sending mutated mail to other spammers," says my Mad Lib buddy, "maybe they will start suspecting each other of mutual spam mutating, and spamming will enter a new era of conspiracy and distrust." If you get any especially good results from playing Mad Lib Mutated Spam, please tell me about it! [Mark Frauenfelder] Send mail to Mark Frauenfelder at mark(a)wired.com Illustration by Dave Plunkert [to webmonkey] [to netsurf central]

2 1

Re: Do reporters have special rights the rest of us don't have?
by Secret Squirrel 17 Dec '03

17 Dec '03

Tim May wrote: > (I have no problems with private agents, e.g., Microsoft or > whatever, limiting contacts to the "main" reporters. It's their > property. If they grant interviews to Declan, Brock, John, Steve, > etc., and not to me, I cannot claim my "rights" were violated. > Government functions are another matter, and I would generally favor > letting anyone claiming to be a reporter in to government press > conferences...to do anything else is to give licensing and > credentials to speech, which the government should have no right to > do. If they need to hold press conferences in RFK Stadium, so be > it.) Are you proposing the President can't choose who he meets? Whether such a meeting is called a "press conference" is irrelevant. The legitimization of reporters through the use of "press credentials" by the government can only occur when people operating the news channels and their customers allow it to happen. Panther Modern

2 1

IBM sues critics?
by Secret Squirrel 17 Dec '03

17 Dec '03

According to a usually reliable contact in a position to know, IBM Friday filed a liable suit against the 11 authors of the study titled "The risks of key recovery, key escrow and trusted third-party encryption" plus their employers and the Centere for Democracy and Technology, which sponsored the report. According to my contact, IBM feels that the report directly targets their own key recovery system, and falsely implies that it isn't reliable. They are asking for unspecified damages. This means IBM is suing such people as Matt Blaze, Whitfield Diffie, and Ronald Rivest, along with AT&T, Sun, Microsoft, and MIT over the question of whether its key recovery system really works. Considering that truth is a defense and the details of the IBM system could be part of the defense's evidence, it should be an interesting trial to say the least. I have not seen the actual court papers and really have no idea whether my contact is totally accurate. Can anyone confirm the details? I just read the study in question, and it sounds like IBM is totally out of line and trying to intimidate its critics with threats of expensive if frivolous lawsuits. On the other hand, some of the parties named in the suit (Microsoft, AT&T) have their own armies of lawyers to defend themselves, so it's hard to be sure of what's going on here. I think the report is still at www.crypto.com or www.cdt.org.

4 3

Democratic Assassination
by Pilgrim 17 Dec '03

17 Dec '03

> Instead of putting child pornographers in prison we will put >cryptographers and remailer operators in prison. Instead of >confiscating the assets of drug czars will confiscate the assets >of people who have a kid who smokes a joint once a week. Instead >of censoring legislation which limits our freedom and privacy >we will censor literature which proposes democratic assassination >of those who oppress us. Whoa there bud! I have a nagging feeling that democratic assassination is a large can of worms than we realize. There is something fundamentally wrong with a society that is built upon the notion that those people who do and say unpopular things deserve death. Yet that is exactly what a system of "democratic" assassinations would do, enable a large group of people to intimidate and subvert a smaller group of people. So, for the sake of argument, let this system of anonymous democratic assassination come to pass...then what? Utopia? Maybe.... But let's say that someone comes along later, proposing a way of living that is radically different from the norm. Exhibiting a nasty characteristic that has been inherent in the human races for eons....even before the rise of large sprawling governments....the majority of people decide that they don't like this troublemaker....through the process of democratic assassination...this person is now dead. Forget even the shade of a possibility that this person may have been right...that his way of living ***may*** have been better than the norm. Right and wrong don't matter. Popularity and the "mood of the crowd" do...this person said somethig unpopular, and is dead because of it. Freedom of speech? Let's say that a group of people suddenly become unpopular. Perhaps times are tough and the majority need a scapegoat. Maybe this group of people have been long oppressed and are finally fighting back. Through a system of democratized assassination....their leaders are dead....with no one willing to take their place (out of fear)....maybe a few other random people are killed just to really get these people quaking in their boots. Or let's take it one step further. If democratic assassination is good, why not democratic genocide. Let the people take a vote, and if the scale tips the right way, an entire group of people need killed. Is this good? Let's take a step further. Going back to my first example, let's say that someone comes along proposing a new way to live, and many people take to it and follow this person. Unfortunately, this person has just happened to make a few powerful enemies. Through a system of "democratic" assassination, this person is now dead...and there is no way to catch his/her killers. Is this even democratic? Even if digital cash, anonymous remailers and strong encryption could enable us to set up a democratic system of assassination (which it couldn't)...I still wouldn't want to live in a society where killing is democratized...I do not want to live in a society where people can abitrarily take a vote on whether I should live or die.... Just because a majority of people like an idea, does that make the idea any more right or any less wrong? I (and I would wager you) do not want to live in a society where it is dangerous...even life threatening to be unpopular, and to go against the flow. I know that I hold fast to ideas and beliefs which are hardly considered popular....the only reason I'm not socially scorned, right now, is because I'm very diplomatic about them.... You wrote a lot about "The Machine," as if it was some real, intelligent, calculating conscience. It is not. While I do not doubt that "The Machine" exists, it is not something that is tangible....it is a system...a way of doing things...a set of entrenched powers...it is not a person. "The Machine" won't be defeated by killing. Its weakness is far more subtle..and takes a lot longer to exploit....but that's another story...for another listserv. That IRS guy that you want to kill? Sure, he might work for "The Machine," but killing him won't solve anything. Hating him won't solve anything. It might be a short term fix, but there will be others. And perhaps, if you stop and look at that IRS guy whom you hate so much...you might find that 1) He has parents, maybe even a wife and children, all of whom love him 2) He gets tired and night, and has to use the bathroom 3) He gets happy, sad, lonely, depressed, He's another human being....just like yourself...indeed, the only difference between himself and yourself is how he makes a living. And maybe...just maybe...he is just as big a victim of "The Machine" as you are. Of course, I'm not accusing anyone of wanting to kill anyone...or hating anyone. I'm just throw this out because it is food for thought. You write so much about "The Machine" causing division and hatred between people. Perhaps "The Machine" has manipulated you more than you realize. Justice rarely comes out of hatred. Regards, Pilgrim Regards, Pilgrim

2 3

Re: Anonymous proxies & ITAR question
by Rich Graves 17 Dec '03

17 Dec '03

Also sprach nobody: >Under ITAR regs, if a "foreign national" was to use the server to get >access to "munitions" (sure, software kills, didn't cha know?), could I be >held in violation? > >Even if all they had was circumstantial evidence, I'd really like to avoid >being indicted - puts a real kink in one's social schedule. > >Your thoughts on this would be appreciated. This is why we need more remailers, and why it's good that you posted anonymously. The proper thing to do is to be "shocked, shocked!" that anything illegal is happening on your server, immediately shut it down (counting on the network to be self-healing with the help of an enhanced remailer list), and offer to cooperate fully. Unfortunately, you don't keep logs, so you wouldn't really be able to help (damn!). -rich http://www.stanford.edu/~llurch/

4 6

Impact of Netscape kernel hole (fwd)
by Paul Bradley 17 Dec '03

17 Dec '03

>It'd be nice to have more specifics about the whole situation, but >regardless - any preliminary threat assessments? Exactly how widely >exploited do you think this has been? > >Tim's post (although refuted by Marc) raises some serious issues since I >suspect that Joe Public has his secret key sitting in c:\pgp\secring.pgp > >Some coherent input on the possible impact of this would be appreciated. Basically the threat model is very simple: Joe "slightly crypto-savvy pgp user" sixpack keeps his pgp keyring in c:\pgp on a dos/w95 box. The average user of any of the unices keeps his keyring in /usr/pgp or /usr/local/pgp it does not take a lot of attempts to go through most of the common places. The very same guy probably has a password that is: A. FRED (notice how close the letters are, this is a real dumb-ass password of the century) B. His wifes name C. Her birthday D. The name of his favourite film or some character from it... Can you say "dictionary attack"???. I must admit I personally, against all the rules, keep my pgp secret key on this box. This doesn`t worry be greatly because: 1. I have a strong passphrase. 2. This box is only on dialup, so is not connected for long, and I VERY rarely use the web anyway, Its too slow, so I prefer ftpmail and ftp for getting files. This corresondingly reduces the risk of me having used a site that exploited this hole. 3. If I ever have anything to recieve that needs to be really secure I use a one time key pair, so even the RSA key is one time. Most PGP mail I send or recieve is fairly innocuous and the use of encryption is just precautionary, ie. to stop nosy sysadmins. What it basically comes down to is that Joe Sixpack, the guy most likely to have his key compromised by this attack, is: 1. Not likely to be sending valuable enough mail to expend time mounting even a simple dictionary attack on his key. 2. The least likely to know about, understand or respond to this flaw. So basically the threat is the usual one: The stupid will get caught. If you are sending highly criminal mail your key shouldn`t be on any machine not 12 feet underground in a concrete bunker with 24 hour fully trusted security guards, CCTV etc. etc. anyway. Datacomms Technologies data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: FC76DA85 "Don`t forget to mount a scratch monkey"

5 5

Re: Flag Burning...
by Peter Trei 17 Dec '03

17 Dec '03

"RS" writes: I'm curious as to why you feel the need to conceal your identity. > When it comes down to flag burning, It really bothers me that we allow our > symbol of freedom to be burned. It's more than a flag and a right. It's a > symbol of the freedom we have. To allow someone to publicly burn a flag is > essentially displaying our freedom being burned. It's a symbol, not the thing symbolized. You are confusing the map with the country. Burning the flag is a statement by the burner that they feel that the symbol has become empty, and the freedom which the flag symbolizes is gone or has been compromised in some manner. It's clearly a form of political speech. True, It's a very strong statement, but strong political speech has been protected by the Constitution (at least up till now). > Bush was a veteran, and Clinton was not. I take it the ones who are > writing on this subject about how we should have the "freedom" to burn the > flag have never served in the military or for our country. You are mistaken - some of the people opposing your viewpoint have stated that they are veterans. > Being a veteran myself, I find it very distateful to allow anyone on our > soil to be allowed to "BURN" our symbol of freedom. Think about the flag > for a moment and what it really stands for. Does it not stand for freedom > and liberty? It does *stand* for freedom and liberty, but only as long those values really exist. It *is* *not* freedom and libery in it's own right. When what the flag symbolizes is gone, it becomes just a piece of cloth. Burning this cloth draws attention to the loss. It is a dramatic statement, but under certain circumstances an appropriate one. > Sorry, I just had to let this out. I stand behind Bush on this one. Don't > burn the flag unless you would like to live under another flag! Thank you for your opinion. You are of course free to express it. And I, and other thoughtful, freedom-loving Americans can oppose it. Think about this: Would you rather people did not burn the flag because: 1. They'll be thrown in the slammer if they do. 2. The revere the values for which it stands, and will not descrate a meaningful symbol of these values. In (2), we can look at the (very rare) individuals who *do* burn the flag, and determine for ourselves if they have a valid point to convey. In (1), we'll never know. For Congress to deny the freedom to burn the flag is a desecration of what the flag stands for - a descration of the flag by the government itself. Peter Trei trei(a)process.com Disclaimer: I represent only myself in this article.

3 2

Re: Hettinga's e$yllogism
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

> Digital Commerce *is* Financial Cryptography, > Financial Cryptography *is* Strong Cryptography, > therefore, > Digital Commerce *is* Strong Cryptography. > and, therefore, > No Strong Cryptography, no Digital Commerce. Why can't escrowed ecash support digital commerce? Strong crypto with a government backdoor. That's what you're offered. Prove it can't work. Anon

5 4

Re: Canarypunk: Jim Bell in a coalmine
by Blanc 17 Dec '03

17 Dec '03

At 02:38 PM 6/22/97 -0400, Robert Hettinga wrote: >Admittedly, this is a distraction from the most important thing, which is >writing code, but I bet that there are in fact cypherpunks-who-don't-code >in Bell's neighborhood, and not necessarily even Friends of Jim, who would >be happy to personally go see how Bell is doing and come back and tell us >what happened. Think of it as part of the feedback loop for net.freedom. A >trip into the coal mine with a canary cage. > >Yeah, I know. It's me making work for someone else. Nonetheless: Anyone out >there want to do this? ............................................................................ ..... I live about an hour's drive from Tacoma. I'm not too enthused about taking such a lengthy trip just to go see how Mr. Private Assassinations is doing, but - taking after your own methods, Robert - I'd be glad to do it in exchange for a trip to Anguilla next Feb. :>) (You know, it is true that having friends in times of stress, like when you're sitting in jail, is good for the soul, but on the other hand one must give credit to Jim for his having created his own situation. He did provoke the government types into suspicions about him and he must have known that distributing his AP ideas, containing such apparent potential for being translated into reality, would make him a grand target. When you do things like that, you ought to consider what you're going to do when "they" come after you. He afterall is quite aware of the atmosphere in which we live and how fragile is the relationship (if it can be called that) which civilians have with the local military saviors which daily protect us from ourselves.) Having said that, I'll consider the possibility, if visitors are allowed on weekends. Perhaps several cpunks could go (if anyone else around here interested? (Wei, Joel, I know you're just dying to go <g>)), if more than one visitor at a time is allowed . .. Blanc

2 1

Re: New Laws in Oregon - "Land of the Legal betatest"
by Ryan Anderson 17 Dec '03

17 Dec '03

On Sat, 21 Jun 1997, Roy M. Silvernail wrote: > > How do you propose to deal with such things as the Telecommunications Act > > of 1996 (which incidently included the CDA)? I can see a problem where > > one sentence or clause gets thrown out of a major bill (say a compromise > > budget, that someone screwed up one minor ammendment), and if you have > > that happen 3 times in 6 years, you've lost 90% of your senators! I'm not > > saying that your idea isn't without merit, just that it's got a few > > problems that strike me as somewhat major.. > > Please elaborate, as I can't see _any_ problem with eliminating 90% of > the sitting legislature. You've completely missed my point. This would be an on-going problem. Congress can only function with some idea of compromise in it. When you're passing budgets, especially the kind of budgets we have right now, they get big and complicated, I can't see that changing significantly, even with a massive turnover of members. But having no consistency in Congress at all, even for some "good" reps would be horrible. ----------------------------------------------------------------------- Ryan Anderson - <Pug Majere> "Who knows, even the horse might sing" Wayne State University - CULMA "May you live in interesting times.." randerso(a)ece.eng.wayne.edu Ohio = VYI of the USA PGP Fingerprint - 7E 8E C6 54 96 AC D9 57 E4 F8 AE 9C 10 7E 78 C9 -----------------------------------------------------------------------

6 8