December 2003 - cypherpunks-legacy

Re: effective GACK fighting (fwd)
by Blanc 17 Dec '03

17 Dec '03

Jim Choate wrote: >But, why do we need a lawyer? We have the right to represent ourselves, why >let somebody who has a intimate stake in the status quo represent us? Well, first of all I was being facetious, because of how people are always saying we need Leadership (tm) and need to elect another President in order to have a more Perfect Union. But I said we need a "good" lawyer - a libertarian lawyer - because I expect that it would take someone who had studied the legal system and made it their project to be well-educated and articulate on these matters, to be able to successfully represent the Consitutional values which we subscribe to. Maybe not. I myself don't think I could do it, although I would lend all kinds of backend support to whoever would, and frankly I don't think I would select you, either, Jim, because I don't think your arguments would be effective. I would be thrilled if someone like Tocqueville existed. He would get my vote. >Has there ever been a law suite brought against the Supreme Court or >Congress claiming their actions were unconstitutional? The amendment >relating to taxation for a start, repeal individual taxation and return to >the system originaly intended by the founding fathers. I don't know. But this is the sort of issue I was thinking of. >Also, let's start something relating to the 2nd. We should also move to [. . . ] Okay, you first. heh. You're being quite free with your recommendations. Remember, right now we're just a bunch of people sitting around their computers talking. Don't count your chickens before they hatch.

1 0

Re: democracy?! (Re: Terrorism is a NON-THREAT (fwd)
by Secret Squirrel 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Adam Back wrote: >[Ed Note: Jim Choate wrote:] >> At the height of the range wars there were only 9 murders >> associated with the conflict, not hundreds as the popular >> entertainment media and spin-doctor culture would have you >> believe. Get your fucking facts straight. > >I know, that was my point; recall that I said the murder rate was >low. The point was there were way less laws, and few were telling >their neighbours what they could think. It's not hard to believe that this was the case in some places and in some times, but a term like the "Wild West" covers a lot of time and territory. For example, in San Francisco in the early 1860s there was a very high murder rate, something like 1000 people were killed in one year and nobody was convicted. (Forgive minor factual errors as I haven't studied this in awhile.) I have also read reports of substantial violence in the mining communities of Nevada and California with minimal enforcement action taken. It seems likely to me that the low murder rate claim has some exceptions, even if we ignore the mutual atrocities between various native groups, Americans, and Mexicans. I would also like to see how pervasive the temperance movement was in the Wild West. By the late nineteenth century my impression is that it was going strong in the Wild West although it possibly hadn't grasped the levers of power yet. >> Face off's at high-noon simply didn't happen and poeple didn't run >> around having gun fights all the time. > >Right! I'm pretty sure there were gunfights, but that they happened a lot more quickly and a lot less formally than we see on TV. But, I could believe that overall they happened infrequently. Anybody have a reference? I am told that knife fighting was a lot more common than is widely known. A lot of poor runaways showed up to work in various mining towns and they were unable to afford expensive toys like guns. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFu5n5aWtjSmRH/5AQGsoQf7BfsZArO2JaJEGVAw9IzRGEQeykgrkFzc JXmCkT32PmZOA0uhMxPW9cC7ehmijwhr7HOVOKO7j4BlxqXemD4oV5M9/EwQfqzU rFgJJ/GIW5LF7h+HCI8gjsoS0VJtbpDs/d2zsuCOvwM4yXkQ330jwaAfk/iErgYs 3thfm7ZAgYcLJPeeCDc541b+eKAtxvbHoOCp3UTqM3EBws0NpDlD9+A3ZzT1a87e UAUsvesecZyz3e1ZHlqw4L08eHdmaMxtkHE3bDrnfJQA4Ij4HPa1ayMMlJmC1XhR U7PEl8CWC9dSLN2Z6pUpC0pIp3A6zqhISPxDW8nGpUipKwhojicXfQ== =lL5j -----END PGP SIGNATURE-----

1 0

Re: cute
by Mixmaster 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > There was a discussion a little while ago suggesting that toad.com had > been compromised by people who were sowing dissension by partially > distributing certain messages. Had toad signed all of its messages, > it would be possible to obtain evidence supporting this hypothesis > without relying entirely on the word of people we may not know. How do signed messages deal with the incompleat distribushun problem? If legit signed messages are not sent to half the list, what does the sig gain us? > Had somebody compromised toad, they would still have to correctly sign > messages. But, depending on the compromise, this could be possible. > > This would also prevent an attack where somebody forges mail from a > > cypherpunks list machine to flush out identities. If the attacker > > sends a unique message to every person, he or she will be able to > > break an identity if the message is replied to on the list. Thats why its a good ideal to missquote peaple. And to only reply from the account you read on. And to use remalers. Monty Cantspell Editor in Chief Groan Magazine http://www.neoism.org/squares/groan_index.html http://www.neoism.org/squares/cantspell_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFu/fZaWtjSmRH/5AQGSdAf8DdZj05c4/WS/V9YF/o1lZ9W7/5vGlTDf mvU8nFPNT4TB9eha7UW/Ub2xaUI4TneBrWrIwXTeEqo1slUbzmShneeUoUlKMEho +PlrA8NjQhh/QRwMXsVUp4vtoV3oDUbCTRLE8PWIikC7Rpo92UocujfFhsey3Ewu /SCA/TrkjVO8efeR4H6GOBnVWd/+4YigLPtZhP6QzlKjf3Soq5OJNfVlHA3ci+3a UgbM+IQ/OTTkXMVbya60veWrN6/Njo/66D0EyUuHB5/bUHkFIjnWaz1DSG8g0vJq XfFNOusz9Dkrhz0gearv/fbRb93GxXRejTK/Jo9sMJta8pWAm4d1Yg== =5Loi -----END PGP SIGNATURE-----

1 0

Japan's Constitution and GAK
by Adam Shostack 17 Dec '03

17 Dec '03

Does someone have access to a verificable copy of Japan's Constitution? Someone pointed me to one on the web, which would seem to make difficult implemmenting international GAK systems. http://www.leftjustified.com/leftjust/lib/sc/ht/wtp/japan.html Article 21. Freedom of assembly and association as well as speech, press and all other forms of expression are guaranteed. No censorship shall be maintained, nor shall the secrecy of any means of communication be violated. -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

new PGP key
by J. Lasser 17 Dec '03

17 Dec '03

Due to a hard drive crash near the beginning of last month and an inane lack of backups, I lost my old PGP keys (2047/0xDED5B791 and 1024/0xEC001E4D). I've generated a new key, enclosed below. Key info is as follows: Type Bits KeyID Created Expires Algorithm Use sec+ 2047 0x4CDD6451 1997-10-12 ---------- RSA Sign & Encrypt f16 Fingerprint16 = D8 5A 85 06 93 6C 86 E8 79 3A 07 AA 15 6E 3A BD I will personally verify this information at the physical DC Cypherpunk meeting tomorrow (well, today, actually), as well as hand out copies of the fingerprint. The key is also available at my web page, at either http://students.goucher.edu/jlasser/interests/pgpkey.html or http://gwyn.tux.org/~lasser/interests/pgpkey.html Yes, I keep backups now ;-) Type bits/keyID Date User ID pub 2047/4CDD6451 1997/10/12 Jon Lasser <jon(a)lasser.org> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzRBY9QAAAEH/2q2YaKg6zOpzWNHyPuO2cdEAIAIhsmOPjOp61bnrU9LAyKK gNJn2+Tn9PTfbnq0S8HupLTvgUsSuv0P0d1SzgDV0LtgUy9CYrtwkcExvK6UO103 RksrpAP0+wbaAWjp2Qogn2ZJskn8wayl1J9cHX4VfFQNUxQyqBqV8HUK5W+R4N91 76bWX0QrX+yQm0wCW8PT6xTe5L23N7lfUsDawOxsjIxHom3dg2lr1zQ1Pu/4wrw7 Mcoj1Wy+kxOxpZaMPF8ylyu953LKaPPJw5yQpjtzKBdi/ZxFI86rB7K2nra1NxGi c8Yq+Jy+LzGwI0RF330zI2/wpvqsoSqcnUzdZFEABRG0G0pvbiBMYXNzZXIgPGpv bkBsYXNzZXIub3JnPokAlQMFEDRCtOcalOfjf5iOyQEBBTID/iqETsBM1EZaOJlr nbkSYEcfrnM29Uo2fgbD7mQlrgOb/jNScvh7LaHdU7yZMaYmszCrC29S06RZYSOf HUCN62yVVZyFlWECvqcjspTzi0tdmhhpjHLAdW3/odmEbW6fsWhTauPCo1pp4IXq lyo9so9iAtjGSDB6QfFhf4htAcuWiQCVAwUQNEGY2xN3Wx8QwqUtAQHLxgP6AnOj ZWIMYazhH2pYemXrHmmyMTtM+CqW+YFCgD4ioDnwZqsghaNF8d7klJ7zL2GNK9XX o2PbBowsrZJ8Nt4tAMdC++giYLqW4UCb0BO1oLnKO/khbcPR0J3F0nBfIejbc82U aM72raafmZjpqCspjD5hBMRSaoS0xZaTe+sCJzOJARUDBRA0QZiLXprN4cSo7vEB AUmoB/0YspOyZ0u+0XbQsMsM4GPVlPWib0WiVeWpF2sBmzzCET7JIM5LcmqU71GG sGa1j/1Xc4rXMflzdPTCm2l+oRiQIOAfhW6daLR13DXYLPnyZl6dpy2SvRA5gdpj vztoLc4WafmEs5T0+cLkD6WqJ2fUBFH30UO8kJgIm7dGucFE73pdQJ75Ss+AmeM7 9Hu0lKKtTnaLnxLktuiJb6/xyzmAReW+dT1BJg0iKn0J2qJD5ZvPm1KRsBINgSO+ mmxtjo8IgCX71KLcWy/JtdD3Dizm1sXjg+wBD81WLhuQzhbbA8yNvhjQOnHqSfpC hq4ixqQUA7WQXicq21hy+xQW4eHciQEVAwUQNEFj1aEqnJ1M3WRRAQFdtAf/RRdT nUmU/hCY+lnA5V5O0zEQa9kX3/WWQ5f8asVEjij2NqZcBxnthwDxF0kFcq89TmjS oOg+FGJv7r23H7rloIHcLowFq3Eg0+enR/RqOv32N3KxJCC2OIu2FuXs2bBKs64+ kqHqs6+SL0hTuWGAn9y+7VuXE+Qy1F/rUQ/Rj3w2ZKQKS9x/c8Nukor3yGAfgvce pr20K5AgMSGjZXO4GttyTkw4SSRL+OdT3cZ+b0JLwe2R4AU5lb3oVXpjkD1eMcCJ isTGMGc9kMBCDMarCbhr1tvJlAAp7I7A5GQgUI77r5y8OjEVOoOxTjiTmXDvUdp9 KTjzW/PqE9xzo0sLWA== =xg8Z -----END PGP PUBLIC KEY BLOCK----- -- Jon Lasser (410)383-7962 jon(a)lasser.org http://wauug.erols.com/~lasser/ New PGP key coming soon "Flap your ears, Dumbo! The feather was only a trick!"

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

## In-reply-to: <199711020051.QAA23884(a)sirius.infonex.com> (message from Mix on Sat, 1 Nov 1997 16:51:19 -0800 (PST)) Subject: Re: cute. -----BEGIN PGP SIGNED MESSAGE----- Monty says > What would be really nice is if the mailing list machines time stamped > messages. That would be nice. I wonder, could one of our list hosts add a script to sign outgoing majordomo traffic? Here's a script to do it: - --------------------8<-------------------- #!/usr/local/bin/perl $userID="cypherpunks\(a)algebra.com"; $pgp="/usr/local/bin/pgp"; $tmp="/tmp/.sig$$"; undef($/); $post = <STDIN>; ($headers,@body) = split(/\n\n/,$post);$body = join("\n\n",@body); open(PIPE,"|$pgp -satf +batchmode +verbose=0 -u $userID > $tmp"); print PIPE $body; close(PIPE); open(SIGNED,"<$tmp");$signed=<SIGNED>;close(SIGNED); print "$headers\n\n$signed"; unlink($tmp); - --------------------8<-------------------- It handles one mail only. If you want to run it on a mail folder, use formail. > This would also prevent an attack where somebody forges mail from a > cypherpunks list machine to flush out identities. If the attacker > sends a unique message to every person, he or she will be able to > break an identity if the message is replied to on the list. You could do something similar with independent parties posting hashes of messages in the feed they got to the list, or to subscribers to the service. The list bot signing is more convenient to check though with existing software. Also, unfortunately, most MUA pgp software doesn't check nested signatures, so a signature from the list would break ability to auto check signatures from posters. Here's another script to check the list added signature on receipt: - --------------------8<-------------------- #!/usr/local/bin/perl $userID="cypherpunks\(a)algebra.com"; $pgp="/usr/local/bin/pgp"; $tmp="/tmp/.sig$$";$in="/tmp/.in$$";$msg="/tmp/.msg$$"; undef($/); $post = <STDIN>; ($headers,@body) = split(/\n\n/,$post);$body = join("\n\n",@body); open(BODY,">$in");print BODY $body;close(BODY); $res = system("$pgp -f +batchmode +verbose=0 -u $userID < $in > $tmp 2> $msg"); open(SIGNED,"<$tmp");$signed=<SIGNED>;close(SIGNED); open(ERR,"<$msg");$err=<ERR>;close(ERR); if ($res==0) { ($who) = ($err =~ m/Good signature from user "(.*)"\./); if ($who !~ m/$userID/) { $res=1; } } $headers =~ s/\[FORGERY\]//g; if ($res) { $headers =~ s/(Subject: )([^\n]*)/\1\[FORGERY\] \2/g; } print "$headers\n"; print "X-Signature: ", $res ? "forgery" : "ok $who", "\n"; print "\n\n$signed\n"; unlink($tmp,$in,$msg); - --------------------8<-------------------- > I'm not sure a timestamp matters that much for "authenticating" your > key. After all, you don't own "Amad3us", you own key 0x4D162BBE1. Yes. Except for minor nit: 0x4D162BBE1 is susceptible to a 0xdeadbeef attack, anyone can generate another key with that keyID. Even the fingerprint is spoofable. But the combination is truly hard to spoof, and this I do own: 0xa11a8a18bf6dbe8362926e9458a3616d/0x4d162bbe1 (fingerprint/keyID). Amad3us (0xa11a8a18bf6dbe8362926e9458a3616d/0x4d162bbe1) -----BEGIN PGP SIGNATURE----- iQCVAwUBNFwjxvKMuKFNFivhAQGYnAQA33Ss68TKF+QfDGweQZ7TAkbmlOeqPC/J iBoV5zA+skqdgs+PD2afLAhQn5otm7xbx7rBEnBgMOYff9GyKB6Bfs/po7juwqs5 dACGPZhc5kNf4f18V04jv5sr6PWLWdwsoVegshVsiHmQgWtG9UlnZ0wKe2ORKzxf sQkJsIe3/jA= =naXX -----END PGP SIGNATURE-----

1 0

Privacy Software
by nobody＠neva.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- nobody(a)replay.com (Anonymous) wrote: >After seeing the intents of PGP Inc. with the release of their new >PGP that breaks the old free versions, I have all but written them >off as anything but the Enemy, and am waiting for a public reply on >the list by Tim May to make it official. Personally, I don't think it is that useful to draw up enemy lists. It is clear PGP, Inc. cannot be relied upon to achieve our goals for us. I think a lot of people half expected something like this out of them, anyway. All that left wing politics and weird anti-business stuff from the PGP crowd did not augur well. >But now what? Please someone answer my questions about PGP - it >appears that the 5.x versions are not compatible with the 2.x >versions which came previous. Is this so? Also, the direction they >seem to be heading is in providing more and more non-free GAKked >product. But aren't the 2.x and 5.x versions freeware? If so, can't >others - a group of individuals - take that source code and build off >of that? The PGP source code is not the worst I've ever seen, but it's kind of odd. We should consider a rewrite, which gives us the added benefit that it will be completely unencumbered. It also gives us the opportunity to write it in a language other than C, one which truly supports encapsulation. C code is hard to verify with great confidence because it is possible to obfuscate it and introduce security holes. This means that C requires one to trust the authors to a greater extent than is desirable. It would also be neat if the code were written outside the United States and were put into the public domain. If a company snaps it up and bases a product on it - great! The more people using the code the better. The whole issue of compatibility is an interesting one. Would it be a good idea to have a cryptographic system which was completely incompatible with PGP, given the Big Brother risk? Something I've never liked about PGP is their approach to encrypting to multiple keys. For one thing, the PGP crowd seems overly conservative with bit expenditure, which is silly because bits are cheap. This means that creating entirely separate messages is completely economical. It also introduces security risk. Let's say one of the three public keys used to encrypt a message has been compromised. Let's say the other two parties live in places where they aren't supposed to be exposed to bad ideas. Once one key is compromised, the other recipients are compromised in receiving a forbidden message. On the other hand, if they were separately encrypted, the link between the three messages is not obvious. And, even if the messages *are* linked, it's still not obvious that the other recipients didn't get something else. It provides a lot of deniability. So, perhaps a protocol which does not support anything more than one encryption key per message would be a good idea. Something else that bothers me about PGP is compression. It strikes me as bad design to build this into an encryption program. Zimmermann has suggested that this increases security. I doubt this. Modern algorithms like IDEA (please correct me if I am wrong) have the property that if you get one bit, you've got them all. And, I wonder if compression doesn't actually weaken security? Let's say I forward a known message with some commentary. Since the compression tables will be known, it seems like the increased size of the message could provide some interesting information about the preceding commentary. All by itself, this probably doesn't matter, but combined with other information it might result in a breach. In any event, that which is ambiguous should be eliminated. It would also be nice if the messages were padded to predetermined sizes, say 10K, 20K, 40K, etc. (Once compression is eliminated this is less of an issue.) Anyway, if Adam Back wanted to undertake it, a nice project would be design a good cypherpunk communications protocol. Simple, clean, and secure. It seems to me that issues like wiping the stack as every function returns, the formats of key rings, and security measures on the users computer should not be in a communications standard. Some other features: maybe a hashcash field which makes it possible to quickly weed out junk. The challenge string could be related to the key. Also, it would be neat if the system were designed with steganography in mind. How about a one time pad mode? One time pads are more practical than widely believed. Many things we talk about we *do* want to keep quiet for the rest of our natural lives. Our present tool set and practices do not do this reliably. (But, I could be persuaded that one time pad mode is actually something which should tunnel inside the cypherpunks communication protocol. Might as well keep everything clean and orthogonal.) >Piss on these assholes and their licensing fees. There's nothing wrong with paying people for their work! It's even desirable if you want tools to be available. >It was inevitable, anyway. They are a corporation after all, and the >corporations are not on "our" sides. > >I can see a scenario where government is impotent and destroyed >within 10 years. What will remain and will be harder to eradicate are >the corporations. I don't think we should rely on corporate software >whenever possible, because it always comes with an ulterior motive. I am of two minds on this question. Free software is pretty darned neat. It's extremely easy to deal with and it's nifty that you can write and release something and tens of thousands of people end up using it. If the code is simply placed in the public domain, then anybody can use it for any purpose they like. This has appeal. On the other hand, corporations can be a good way to get things done, too. It is possible that the PGP approach of giving away software was ultimately a mistake because now people don't expect to have to pay for their code. Elimination of a crypto market might be a bad thing. It's clear that going the corporate route has to be handled with some care. Given the political implications, investors have certain risks. Also, many people seem to switch into a different mode as soon as they have a company. Anything which they perceive as increasing their profits becomes good. PGP, Inc. has gone this way, we've seen First Virtual do some unsavory things, and even good old C2 has made a few people uncomfortable. It doesn't have to be this way, of course. Look at Comsec Partners. We don't see any "conversation recovery", lying press releases, or any other nonsense from them, just a beautiful product. The key probably has to do with understanding clearly what it is you want to do. If you know you want to promote privacy and free speech and are willing to volunteer a substantial amount of your time to do so, then foregoing some blood money or maintaining your integrity is a lot easier to do. What I like about selling software is that you could actually make good living by doing the right thing. And, after all, if you've spent six months writing something, why shouldn't the users kick in a little money instead of freeloading? I would like to see more crypto users in the habit of paying for tools and in the habit starting security companies. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNFwdNpaWtjSmRH/5AQEBZAf+IKyhaAdUWVAYWidPAOu/qw/qiGAYB6go hxix3lOpj3RHDj87OlzzPIpY7aSbvvPOq6PkOCIecpjsO/e2F4vkXlWMtwONJ7gV azGEC//voYyvC55diSHfqUg0zOY/8Ddsy460uIDX4jWJUkJzPMRSRIfvsmo/Lpf+ HFJcIcze/w8bD2k9gelBthbIgZOpCjplY68MyPNurCcVbpKlIw/RmyX6WI4hAkYk UoRlFh4SeAmNWla4t0l3NGkpdxfVJ8tIAl6uNvV3enjjfctgm/5KRr8n7lcjLvOT jKUJn0DDFD2pdZ66Unp3xeKpOMxLZ4Bqf704piaCSmj4Erul7x1Gmg== =USz8 -----END PGP SIGNATURE-----

2 1

ANNOUNCE: pgp5-pine 0.1
by Jeremey Barrett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is to announce version 0.1 of pgp5-pine, a set of shell (sh) scripts for integrating pgp 5.x for unix into the pine mail reader. The scripts operate via pine's facility for filters, both incoming and outgoing. You can encrypt, decrypt, sign, and verify messages with some ease. The send filter will automagically retrieve keys from a keyserver if told to do so, and leans toward paranoia when it cannot encrypt a message. This is the first released version, there is always the possibility of bugs and/or behaviors you don't agree with. Note that these scripts do _not_ handle PGP/MIME, as pine does not pass the MIME structure of messages to filters. For more information, see https://www.cypherpunks.to/ Disclaimer: I am not responsible for the choice of colors on the cypherpunks.to web site, or any damage to anything yours from using this code. Please direct all bug reports, requests, or other inquiries to jeremey(a)cypherpunks.to Regards, Jeremey. - -- Jeremey Barrett jeremey(a)cypherpunks.to -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use Charset: noconv iQA/AwUBNFxJmILSRssP+J/GEQKHEwCg8v+wYCumDIpYhow4+vh/bVfYploAoOkh XWe+IJGVTEj9dAFECSGuD259 =CmDv -----END PGP SIGNATURE-----

1 0

Definition: Spin Doctoring
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Definition: Spin Doctoring You are standing naked in the gas chamber with a thousand of your fellow ethnic outlaws when the voice of Herr Himmler blares out from the speakers, "I have decided to spare your lives." The loud cheers of yourself and your grateful ethnological comrades are cut short by the sound of a deadly gas being released from the ceiling vents. A different voice comes over the speaker, saying, "What Herr Himmler _meant_ to say, was" Sick humor? Moi?

1 0

InfoWar Feedback Form #AB7-09-C3F87-%&((&%$%*
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I, the undersigned undertoad, herby express my evaluation of the TruthMonger multi-user persona, based on my understanding of the contents of Epilogue 8 of 'InfoWar'. TruthMonger should: 1. Run for President of the United States of America. [ ] ~ Y/N 2. Seek medical help immediately. [ ] ~ Y/N PLP Signature: Thanking you for your input, A Concerned Illegal Immigrant

2 1