December 2003 - cypherpunks-legacy

Re: Remailers and ecash
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Lucky Green wrote: >On Sun, 28 Sep 1997, Anonymous wrote: >> >> Nonsense. Type 1 remailers offer a certain level of security. It is >> suitable for many applications. Type 1 remailers require a fairly >> determined attacker to thwart. They would certainly keep you safe >> from the IRS, but maybe not the NSA. >> >> Even if you were running a child kidnapping ring and failing to report >> the income, you would be pretty safe using Type 1 remailers. The NSA >> would never take the chance of revealing their capabilities just to >> save a few kids. > >I disagree. The entire Type 1 networks can be trivially analyzed. It >doesn't require an NSA for this. A single person that understands mixes >and a few hackers to compromise some of the upstream, downstream servers, >not even the remailers themselves, could do it. > >Type 1 remailers are fun toys. No more. Please pardon my ignorance, but could you elaborate on this attack? Assuming the user's machine is not compromised, in which case the game is over, whose machines are being broken into? Are you saying that The Enemy just watches the messages going in and out of a particular site and then watches the site where they suspect the messages are going? Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNC/lZ5aWtjSmRH/5AQFZqQf+IDR2uv2cB77x0DmEb83Zqq1+a63MjLr1 jUB8v/sQoCXRX0WfoEls5FBqu19/13AVk8y1UdNdXz6oFwEZ0hlBeLBt6jOhSQcq nl49H1sFsYOuQKTAMioaO8srlENVETK5kUb0PUPrah9jgj3j66zR3FdDQWUeur5C +DcpCkjfrv9BwQt8PJ4PYtnmsaHDTuI1ESI1qpE5U0UdKUx2i2FtP9HtwUamWSA7 ZviDOfqlliVIhe3HWmC1rcr2VizqWA++HetEEehmPNVt2AwpWvUiIn15fnhL1HW4 vnOJAcxRx/ThI/ON5L4Y0af8Q1YowkNIvqWLU8vEaNFfgC8sxV50pQ== =IAPf -----END PGP SIGNATURE-----

3 2

Re: Remailers and ecash
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Robert A. Costner wrote: >At first I thought some of the stuff Monty Cantsin was discussing was >interesting, but it has gotten out of hand. Isn't this the list for people who get out of hand? Maybe I'm in the wrong place. ;-) >I've asked the question before, Why would remailer operators want to >accept Ecash? I guess "to make money" is obvious. Remailer operators may also want to help get some kind of cypherpunk economy going. Right now the relationship between remailer operators and users is asymmetrical. They provide and we use. It would be better if the users could help out the remailer operators, too. And, if we can really get a profitable remailer market going, then it becomes much easier to get people to start remailers, for instance, in other countries. Given certain political developments, we probably want to get a lot of the remailer network established around the world. >After seeing the conflicting messages coming from Mr. Catsin (sic), I >to rephrase it, why does *Mr Catsin* (sic) want remailer operators to >use Ecash? Monty Cantsin wants the whole cypherpunk thing to happen. Aside from the benefits of getting the remailer network going, there is also great benefit to getting a small community using ecash regularly. Once that happens, we can start to find other services that community can use. From there ecash could become a pretty hot item. Once something like this starts to take off, it can take off very quickly, especially where money is involved. As for "conflicting messages" what you are probably seeing is different ideas and (maybe) a little learning. It's good. It's healthy. I'm trying to find a way to make stuff work. >The first answer I got was so that remailer reliability could >increase. The theory as I understood it was that remailers were run >like a hobby, not a business, so the money would be an incentive to >bring in professionalism. So I proposed, and documented, that the >minimum level to achieve this would be a $50K investment over a >year's time. Your proposal seems to be intended to show how this is impossible. Well, it's not impossible. You and many other people have already sunk the costs. Accepting money is just one more little step forward. If you are arguing that the day after you accept money you won't make a profit, that's probably true. But, since you're volunteering anyway, what's the big deal? If you are arguing that there's no way anybody can ever make a profit, then you are talking about something which is simply unknown. We will probably have to do other things to get the remailer network really going. And we will do them. >Making remailers more difficult to use by adding Ecash is not going >to increase traffic significantly. Remailers that accept ecash can also accept free mail, although it might be a good idea to offer premium service to the paying customers. >>I recommend that people start pricing at a quarter per message per hop > >In my opinion, and I've been known to be wrong, this is a seriously >messed up comment. No, it's a professional comment. Amateurs always underprice themselves. Then, they discover they can't make money at their low prices and go under. Try to price it as high as you can, make some money, and grow wealthy. If you get a lot of resistance, you lower the price. This works. >A quarter per message is too much, much less a quarter per hop. A >price of 1/100 of a penny per message is closer to a proper >valuation. Let's say you have ten hops in your chain. That costs one tenth of a cent. Are you seriously claiming that many people wouldn't pay more than one tenth of a cent to avoid being harrassed, persecuted, or prosecuted? To say that a remailer is just like e-mail and should be priced the same is like saying a bank is just a warehouse for money. What remailer operators are selling is trust, privacy, and security. We the users trust them to conceal our traffic flows and our identities. Sometimes this will save our lives. That's worth a lot more than one tenth of a cent, isn't it? What is more, markets where trust is involved tend to very good for the people who are already established. You are not going to save a dime and risk your life or fortune. >But the problem here is in the pricing model. It should not be >transactional unless to encourage the very casual user. A pricing >model should be flat rate. This has already been covered. 1. A flat rate which results in associating all messages with one account is unacceptable, even if the account itself is anonymous. 2. This implies that some sort of blinded credential will be used. 3. Ecash is already a blinded credential and the software is already written, and it is probably easier to use than a blinded credential anyway. At best, the transaction costs of ecash and some other blinded credential are the same. The only reason fixed rate deals are good is because it lowers the transaction cost. This will not work with remailers because it defeats their purpose. Unit pricing is always preferable when transaction costs are free because the lighter users of the service don't end up paying for the heavy users. >The point I have never gotten past is how you expect a payment system >to change the level of service? Trade is a good thing. "If you will do this thing, I will do this other thing for you." All sorts of things result from this. If remailer operators were making some money, maybe not even a lot, it would certainly make them a little more interested in finding ways to get people using remailers. Many of these ways we haven't been thought of yet. >The next point I'm still shaking my head over is what about remailer >services is not up to your standards? It may be that the remailer network is better than I thought. You claim no messages are lost, but I have yet to confirm that this is the case. Nobody else seems to know what the remailer statistics mean. Alex de Joode and you both say that the latencies result from message reordering. This also remains to be confirmed. But, even if the existing network of remailers were perfect in every way, we could still have more of them. I would like to have hundreds of remailers to route my traffic through and that will not happen through a volunteer effort. >If anything, people would pay to add latency, not to take latency >away. Now you're getting it! Yes, people will pay for service and special features, even special features that Monty Cantsin might not pay for. (Until properly educated, that is.) > >Remailers are used by a small highly specialized market of perhaps > >a few hundred people. > >They encompass millions of users. Millions of users who want a >remailer, but will not tolerate the level of entry required for a >Type-I or Mixmaster remailer. Until client software can be improved >and made as easy to use as an integrated spelling checker, the >"advanced" remailers will have no true market share. (Oh, I forgot. >Most of the world uses email clients without integrated spell >checkers.) It is such a mistake to worry about the mass market right now. Do you have $10 million to mount a nationwide advertising campaign? That means we start with a small specialized group of perceptive people and get things rollling. It may even be the case that the product never hits the mass market. But, if it is useful to a few million select people, it will still work. We talk a lot about "Joe Sixpack" on this list, but he's probably a waste of time. It's just too expensive to educate people who aren't interested. What should we do in this situation?: >Cypherpunk: Hey, Joe, how are you doing? > >J. Sixpack: Well, me and my whole family were finally accepted to the >Federal New Millenia Program and we're going down to the induction >center tomorrow! > >Cypherpunk: Gee, I heard on the cypherpunks list that they just kill >everybody. Are you sure you really want to do that? > >J. Sixpack: Oh, you conspiracy theorists! It's not that way at all. >They have shuffleboard, jacuzzis, golf... I saw the brochure! And >they say you only have to work three hours a day and you get full >medical coverage. It's so great that most people never even come >back for a visit! I say we let him go. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNC/g0ZaWtjSmRH/5AQFO6gf/Q9BKD1H10bAb3uZSLAQ5z7J1DdJ/g9EE JSM4sJABPDEKSTxKynOvVYYESv4jScc3vHzaP9nMvuC0g4LlRswykqFiugkKqzIQ kRT2jwsOdYsbAV0hW7l8/NY3Kmsj8pbUOnG8bMyG5g/k10zAYH4S1BciIPfFRcbt 6/LQc5qaYfooP7fB7MrAhd3m0iFONHwPpBWpiiQ/x+PY9or/4iU/QpL+jEde/Viz +F9la8ovcDRMmcrq3RAyLzzeueCO0FMuSyckaz8wZ+H9hwE2J2uenhwVPINqAv0u 5OPYvM9hsouxffVM8mBj4ivxiAJhn45QcT7Q5qJ+SJTgGpVADElEzA== =WSbZ -----END PGP SIGNATURE-----

1 0

Crypto Legality Question
by Jim Burnes 17 Dec '03

17 Dec '03

I have a theoretical situation which some person or lawyer might know the answer to. (not that lawyers are not people...oh never mind). Anyway.. ACME corporation, a mostly Canadian outfit with a major subsidiary in the US, wants to roll out corporate wide crypto. Most of their network operations are in the US except one of their offices in Ireland. Question (1): Can they buy a strong crypto package in the US and physically roll it out to both Canada and Ireland. Question (2): If Canada is OK, but Ireland is out of the question, can Irish employees simply procure a compatible strong crypto package from, say, Finland? This assumes that the message traffic from the Irish office to the US is not covered by commerce dept regs, just the export of software. Since software isnt being exported, is everything legal? Thanks, Jim Burnes Jim Burnes Engineer, Western Security, SSDS Inc jim.burnes(a)ssds.com ---- When the world is running down Make the best of what's still around - Sting

4 3

CypherSaber msg [was: Re: [NTSEC] pgp 5.0 back door]
by lcs Mixmaster Remailer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Clarification on my previous postscript: I left the following a message for CypherSaber CipherKnights with password "WriteYourCongressman" starting thus: > e91a 46d8 fba9 aaf5 927f 7a3f 1ded 8757 a741 4bb6 5568 3a5a f118 dc2b 11de If you had trouble decrypting it, it's because those are words with the most significant byte on the right. I hate endianness. Here it is in bytes: 1a e9 d8 46 a9 fb f5 aa 7f 92 3f 7a ed 1d 57 87 41 a7 b6 4b 68 55 5a 3a 18 f1 2b dc de 11 b3 eb 73 e8 a1 ff 20 d5 ea 09 b6 52 c3 65 2a a4 14 3d fa be 3e 0f 09 ff 9a e0 26 ad 77 f8 84 aa 22 47 c3 8a 0a 77 ad 0a a0 48 1e bf 51 9c 1e 2b 4f a5 7e 8a 14 3e d1 b0 84 3a 52 88 db f9 ce d7 b5 73 66 40 16 d5 77 4d 95 03 e2 37 9c b7 cd 9a 07 61 ff ec bc 72 85 e9 de 0e f0 fc bd ea 03 b9 17 92 fc a0 5d b9 d7 5a 31 34 73 ba 98 0d 0b 36 f2 ce 63 f8 54 ed a4 8a a9 b0 d1 6e bb a2 49 84 6f 34 7f 1a 31 f4 cf b8 e3 95 72 b3 f5 b0 a9 c8 e1 5a 2f 62 9f d5 90 c9 6d fd 11 36 1e bc 42 d8 c7 82 12 c1 d8 27 1e 8b d8 f3 69 f7 0c a1 f7 d4 60 63 a4 de cf f6 b3 fe c6 e8 2b c7 4a 7b dc 03 c4 Sorry for the confusion, if any. Salvo Salasio -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNDAAv9eed+DWkqwBAQHZEgQAgO8VQ3+HmtF6U3gZrP8fpAm1Tkmw/FIX KTA9WtfhqUEQN0tugyT5GvXfabw/ppiShYhDB4lEnJ4Tq2n/ul7Czkgnz6zkJeSy o3YaMwmqhnP9sHGr+8ehe9FY9763bsQ8kUQMmEntwJg1SiqSMY4FU9Tc2BnueDuo ildjarcF6UQ= =sU6y -----END PGP SIGNATURE-----

1 0

RE: sounds just like the snitch you are [was]RE: engineering infowar disasters
by Phillip Hallam-Baker 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.30a on or about 970927:2154 Phillip Hallam-Baker <hallam(a)ai.mit.edu> left his excrement: +I suspect I'm not the only person on the list who is responsible for a +service that is a regular hacker target. If I catch someone I really +don't care what the motive for the attack was. I'm going to look to +make that person serve jail time. I do not advocate infowar disasters or any such, but: there is _nothing_ lower than a snitch; you just qualified. a snitch is without honour, lower than the thief; lower than the law. may you enjoy your visit... when do you go home to England or whatever sewer you crawled from? I never promised any sabateur that I would keep any secret of theirs. I have worked with law enforcement and the security services for many years. If I catch someone damaging my property or property I am responsible for I call the authorities. If someone is breaking into a bank and someone recognises the theif thats not a snitch, thats a hero. I believe that people who do bad things should go to prison. It isn't my fault that this description includes many of the people you send to congress. I never voted for any of them. Nor to judge from your spelling did you. I completely reject your pseudononymous attempt to posit that there is a 'them and us' and that I somehow have a responsibility towards anarchist thugs. When you grow up a bit you will learn that the real world is not like your high school. People depend on infrastructure. Lives depend on it. If people screw it up someone is likely to be killed. Freeh will have a party. Indeed its the sort of thing Nixon might have done on purpose to take advantage of the backlash. Phill

2 1

None
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ian Goldberg wrote: >Done. <ecash-remailer(a)cypherpunks.ca> accepts messages of the form:... Congratulations to Ian Goldberg! It is wonderful to have an ecash accepting remailer up and running. I would encourage those who have ecash accounts to try out the ecash remailer and show Ian we appreciate his running such a reliable system. (Also, it's fun!) Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDB2wZaWtjSmRH/5AQEpYgf+IKZdTiOnD4mDE62QBnusq+W4eV/HNmJA eRUQYAuU0PjzUM4kYcDsVLCLlhtn+qgWWtnXNvhLBkgC3uRbTChp8CDEhNn/Zn+o ZW6DTrZpx5O3NFDUQPm68JdjDD20gGGaHBlp2eB4kAItQQDaFp6AQ+Hi+Udky2Ss X0R5ladf9VO2lZ4xmkEh5H8bpXT+N6El6yiea7ED5CKUt5MiKtwGqhXSklHvLTi3 wPhY9zM0UCiTOlTZIhpnq4YD9UQkmo8wugfeiRp0lJZEKSCRBhc2C6daPpuM0CJ3 QBfRjDIfeyd+kp9eNNJKxH2Joo6dQdAydPQhaMbJmhuy4vJT4yBr1w== =Pej+ -----END PGP SIGNATURE-----

1 0

Re: Remailers and ecash
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Lucky Green wrote: >There are a number of technical reasons why you really don't want to >call the standard commandline Ecash client from a script to >add/retrieve Ecash from Mixmaster remailer packets. The biggest >problem being that you can fit only a few coins into the packet >header as specified. There is no feature in the standard Ecash client >that allows coin level control. DigiCash firmly resited and continues >to resist adding it. A $0.25 payment could be paid as three coins or >as 25 coins. The user has no control over this. For this and a number >of other reasons, DigiCash's software is unsuitable for the task. I've thought about this and I don't believe that it is a brick wall. If the mixmaster remailers charged the smallest coin Mark Twain Bank issues, then you would always get one coin and it would fit into the packet. I'm guessing this is a penny. While this is not the ideal method for deciding pricing, it would certainly work. Even for larger amounts, there's probably a way to trick the Digicash software into giving you the coins you want. Let's say you are trying to generate a pile of certificates in a certain amount that have less than a certain size. If you keep withdrawing the money and redepositing it, you can keep the certificates which are the right size and throw back the ones that aren't. (You might have to find a way to shake things up by depositing and withdrawing various amounts.) There's probably a better way to do this. For instance, we might observe that every time ten dollars were withdrawn from the bank and a certificate was generated for 25 cents, it only used three coins. So, we withdraw ten dollars, issue a 25 cent certificate, put back the remaining amount, withdraw ten dollars, get another 25 cent certificate, etc. This is easily automated, of course. Question: Where is the coin issuing decision made? I assume that it is made in the client software. This, of course, is not under the control of Digicash or Mark Twain bank. Conclusion: Mixmaster remailers can probably use ecash with just a little more work. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDAGpJaWtjSmRH/5AQFSAwf/S5Y13DqoVvkjsmt6AM0IvqOvbNFmFOdf mAeQHGuLXmVQyR+YhWrP5aDb/CVyz/JXpVVH5oKSmxr6p9ocqC4Nvl9lzMS/22Pq GNwxfZopTYZJhwdoeA/zo9uQ8A4rHOueFiZ8GRr7oDa+/sA70H6FBbMzIig/UxsB hi9+cBFGx4VFIWJemcPiU+vL9lWfbTV997IrTrlJKRISjA4VuNqHuoNNbHnUa+J+ /O4aPBgEu4m1SW+FGAQuZoBlbQc7TkstdgpAEF5fGWXJL9SEVmhpkL2hcdOPP5Fl mZ8GuynaMwzGf/UeOVHTUPEPDAjfaqdwbCzStuTzR1QeN13l1Xa2HQ== =g3FG -----END PGP SIGNATURE-----

2 1

Re: Remailers and ecash
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Alex de Joode wrote: >: Then Mr. Cantsin seemed to go back to the all you need are some >: spare parts theory of remailer operation. Enormous profits of $200 >: per month, or even $5,000 per year. Well, Cracker handles close to >: 25% of worldwide remailer traffic of it's kind[1]. And it's not >: much. I would say this is due mainly to the user interface. >: Making remailers more difficult to use by adding Ecash is not going >: to increase traffic significantly. > >Basicly most of those 3400 message cracker handles daily are cover >trafic,... How do you know this? If the remailer network works properly, you should not have any knowledge of this at all. >...a big chunk of the rest is from people "playing" around with >the remailer, then there are those few that needs some form of >anonimity so they can inform a mailinglist/postmaster/complaints >department, and then maybe once a week or so there is that message >that would be paid for if remailers were for pay. This is like saying we should only encrypt messages which are really secret. You should encrypt all of your messages - then nobody can tell when you have a secret. If you are arguing that nobody wants their security, I hope you are on the wrong list. Many of us have gone to great effort to get some security and to create tools for other people's security. It is hard to believe that it's worth a few nickels and dimes to us to expose our traffic to Big Brother or anybody else. >So in short, if remailers were to be paid for, traffic would halt. Only if implemented in a foolish way. Look, there's no need to say "my remailer is now a cash only remailer no others need apply". You can say, "people who pay cash get better service." Or even, "people who pay cash have a higher probability of getting better service." While I can't speak for the other remailer users, I certainly have no problem shoving a little money towards the remailers. Like many who read this list, I am not poor. I would like to be able to help defray the expense of my traffic. Hopefully other cypherpunks with jobs will feel the same way. The important thing is to get things rolling. Are the remailer operators going to get rich overnight? Maybe not. But we can definitely get some market activity going and start generating some real remailer traffic. Let me now note that this dialogue has been somewhat surreal. Am I really begging the cypherpunks to use ecash? It's a good idea to get ecash in now because it will be harder to incorporate payment methods later when there is more infrastructure to change. (Look at the mixmaster problem. It can't (according to Lucky) be used for ecash without modification.) However, it appears that part of the problem with the remailers is that nobody uses them. We should be making a concerted effort to do so, and not just for cpunk traffic. We should use them for everything. It won't take that many people to reduce the message delays substantially. It will also advertise the remailer network to our friends who may not yet be cypherpunks. The tools exist to do this. It is somewhat ironic that we complain that Joe Sixpack won't use tools that we will not (or even cannot) use ourselves. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNC/9MZaWtjSmRH/5AQGsgQf+N+EebBi8gSgAt9u7KlIjhRCj9KfWym1H VQjxEkJ8Q+8n/TE2PSc90RRm2OKFtUayuGtVRtGakkvL3t009r8JLWAe3YLmbGNB EkuvuvHT56/zkbcA6r9NeW5V7NsuYOsLHp34loaK76EURQJv6YhsFfvhzelg6kID VCk+PlKQnaKAj2i3irGNwPJmM4iDB5K/0/GwjVRuULGVYF1xxIrJ45823F/FwjHA ERxu8qZV0lmK3GaTYAKd5GNY1O7w/UWQ0xzBvXa+xEjssqbXqRE7mnG6hwVxyU8T JZYFLjYeHkxDIJvA5+syNDzV/+iOklTp9FMd0ODT7TWxfBQtKzamCw== =RQr+ -----END PGP SIGNATURE-----

1 0

Re: Remailers and ecash
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Robert A. Costner wrote: >The only thing I have heard you mention is latency, which is a >feature programmed into the remailers. If anything, people would pay >to add latency, not to take latency away. And another point: Nobody wants to add latency. (There may be a few applications, but they are rare.) What people want is security and one way to get it (sometimes) is by adding latency to their messages. Ideally, you would send a message and it would arrive at its destination in milliseconds with complete security. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNC/2ppaWtjSmRH/5AQGFvwf9Gt0lk4arO8YxSJmShOLkl0tzlG9Xwel2 LODIapK7/LeiHZ8sFMDBSnFqWf9B6gdiTODRapW7EaUsQIn2B6yBYvP9voO31K31 gPqScyravExP8ctubqPzB0tRdmWM1fcUGFhH0aI4pZpFiCjt1g3R5x88PhJ4HV3Z a8J+Yq9gzKKm0X3qD9i9VcnPLRjJbLAmta1Vk6j/xm3bHlUHJbgynAyciblPVyCk pB6YdxHgwNT2e+i2RkRYEvBm3poiHEmaRh4hwHt14SgqT6mmC+VGjkA+j+52woyL NauD48mnEclO+Y973C+uOHfo7FBRmL/JFKiMh087SFjKv78fSu9BPg== =xzIZ -----END PGP SIGNATURE-----

2 1

T1 insecurity (was Re: Remailers and ecash)
by Antonomasia 17 Dec '03

17 Dec '03

shamrock(a)cypherpunks.to: > Once you have all the mail going in and out, you make use of the simple > fact that Type 1 messages must shrink with each hop. See the classic > essay "Mixmaster & Remailer Attacks" at > http://www.obscura.com/~loki/remailer/remailer-essay.html This describes a pure Type 1 without a remix feature. This idea due to Andy Dustman allows Type 1 and 2 remailers on the same host to cooperate, hiding the message size and type. Another fault of pure Type 1 blocks when reused is that they are easily recognisable as the same stage of the same block on different occasions. You can do sneaky things with cutmarks, but it doesn't buy you much. You can point your reply blocks to a message pool, so avoiding the worst effects of Type 1. You still (even with mixmaster) have the timing issues involved with addresses that communicate regularly. > If you run a Type 1 remailer, do your users a favor: shut it down and > replace it with a Type 2. Say this when there's a good way to receive anonymous email. The sooner the better. Meanwhile all Type 1 remailers should remix. And as far as fitting ecash into headers is concerned: Ulf and I think that you could cannibalize the 2nd header to contain the cash. (We were talking about hashcash in fact.) You'd need to avoid sending cash to remailers that wouldn't read it, and you'd reduce the maximum number of hops permissible. I was meaning to add hashcash to these remailers. Lucky's persuaded me not to do it to t1. -- ############################################################## # Antonomasia ant(a)notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # ##############################################################

1 0