December 2003 - cypherpunks-legacy

index.html
by Jim Choate 17 Dec '03

17 Dec '03

CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Main banner Visit Regal at Buick.com rule NATIONWIDE CRACKDOWN ON MAIL FRAUD BEGINS Mail fraud graphic October 1, 1997 Web posted at: 11:11 p.m. EDT (0311 GMT) WASHINGTON (CNN) -- Federal, state and local law enforcement agencies joined hands with more than 1,500 private sector volunteers Wednesday to launch a nationwide crackdown on mail fraud. "Project Mailbox," initiated by the Federal Trade Commission, U.S. Postal Inspection Service, the National Association of Attorneys General and the American Association of Retired People, targets con artists who use mass mail to defraud consumers. The FBI estimated several years ago that an estimated $40 billion a year is lost to mail and telemarketing scams that include a range of deceptive claims such as phony bills, bogus advance-fee card offers and false contest claims. One goal of the new effort is to get a more accurate and up-to-date estimate on the size and nature of this problem. To assist, AARP is asking members to turn over unsolicited and suspicious mail to law enforcement officials. The coalition is also launching a consumer education campaign. rule Related sites: Note: Pages will open in a new browser window * AARP * Federal Trade Commission * United States Postal Service External sites are not endorsed by CNN Interactive. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Message Boards Sound off on our message boards You said it... [INLINE] Visit Regal at Buick.com rule To the top © 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you.

1 0

Upgrade to first class - nearly every time you fly...
by 53199432＠hotmail.com 17 Dec '03

17 Dec '03

To respond to this message, DO NOT HIT REPLY! (nothing will happen) Rather, use the link at the end of the message. *********************************************************** <HTML><PRE>UPGRADES to first class (domestic and international), the latest 'Two-for Ones', analysis of the many frequent flyer perks, double and triple miles, comparisons of premium class amenities and unpublicized bank card perks - sound interesting? Read on!!! You deserve the best first and business class comfort the airlines have to offer and these days domestic and international airlines are offering the most easily attainable upgrades in air travel history, many of them either without charge or even a membership in their frequent flier programs! Every issue of The Front Row Advisor bimonthly newsletter compiles and packs no-nonsense, insider air travel tips, disclosing the little-known first class promotions for all passengers and lots more; all presented in a well-organized, concise yet thorough, easily readable format. Our current issue is up to 20 pages with over 70 articles dedicated to FIRST CLASS AIR TRAVEL ONLY, NO ADVERTISING!!! The Front Row Advisor is the only thorough industry resource of low cost and no cost upgrades blended with timely, unbiased reporting from worldwide sources covering all the airlines, not just a few. Like to read more? We'd like to send you a FREE "Sneak Preview" issue! *************** CLICK HERE TO REQUEST A FREE "SNEAK PREVIEW" *************** </PRE></HTML> end END

1 0

Re: "Show me an example of terrorists using the Internet or crypto"
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Alex Le Heux wrote: >On 2 Oct 1997 01:29:33 +0200, in list.cypherpunks you wrote: >>Cynthia Brown wrote: >>>On Wed, 1 Oct 1997, Alex Le Heux wrote: >>>> This sucks. >>> >>>I agree wholeheartedly. >> >>>IMNSHO the best way to fight crime is not with bigger guns than the >>>"bad guys", but with better social programs such as universal health >>>care, and improved day care so single parents can show their kids >>>what a productive lifestyle looks like. >> >>Of course you agree wholeheartedly, you are an exploiter. It is >>wrong. You should be ashamed of yourself. > >Can you explain who exactly exploits who here? How about our friend J.F. Avon? He has the misfortune to share citizenship with Ms. Brown. Thus, while he may be minding his own business, doing nobody any harm, and pursuing happiness, should he decline to spend thousands of hours of his life working to pay money into Ms. Brown's socialist schemes, armed men will come to his house, put him in a cage, and leave him there for years. That's not a very friendly way to treat a neighbor, is it? In the United States, many thousands of people correctly recognize this situation. Many thousands of people are gun owners. Many thousands of people are not only gun owners, but combat veterans. The logical outcome would be great violence directed towards the government. Yet, this has not happened (recently ;-). Why? Certainly if the sums at stake were involved between governments, there would be fodder for many wars. The only conclusion that can be drawn is that civilians, even armed civilians with combat experience, are so overwhelmingly peace loving that they will bend very far backwards to avoid trouble, even if it means thousands of hours of work. Can the same be said of career military or government people? >PS. What's the point in posting anonymous when you have this sig? > >>Editor in Chief >>Smile Magazine >>http://www.neoism.org/squares/smile_index.html >>http://www.neoism.org/squares/cantsin_10.html Tools which are not used are not improved. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDPgFZaWtjSmRH/5AQEQ8wf+PwFFagIxuwKkoR5rUAxnseSP8DzrRsrw tQD5gCZ0t1JTBdXUinhZzr2NsyKDtGoPcauDtrxqWyMdAem5ZCf2v6D8Cgm34n3Q bkmvSJbo2bSuD9ggzboENp6rhvsbJ7THf7I4eMHRIUrnPgnQbaWTOXKqBPtG5w+W qPrgHAb7s6oaB8aRqX0sPByWKqbd853RLjsy62Tl3oMc7hp70TAKwXCtXKQTUhL+ CeNBpNFvnN1nR1L3AqL5aji0/BaN+7foptPRDH3eZfUwLx547+1R+DdLKAb7u5tL RJaza5h0O3Zkg+ImlqR2cKe5awxwB6NNkm2oR1GD1p0f80+mGUHtcQ== =C9wS -----END PGP SIGNATURE-----

1 0

Re: Remailers and ecash (fwd)
by Anonymous 17 Dec '03

17 Dec '03

Jim Choate: >For the sender to chain from remailer to remailer to destination the >destination has to be in the header info somewhere. Now in the most secure >system each packet header will only contain the address of the next hop. When >the next site gets it the packet contents are de-crypted (otherwise reading >the chaining info is trivial) and the contents are uncovered to reveal another >packet with the next hop header and another encrypted block. And on and on >we go. > ><Question: Are there any remailer sets that impliment the encrypted nested > packet system?> Jim Choate has been amazingly clueless throughout this discussion, but this takes the cake. Does he really not know about encrypted nested chaining? My God! Of course remailers work this way, Jim. They've worked this way practically from the beginning. All remailers work this way. The mixmaster remailers are built around this idea, making each packet a constant size and adding dummy packets as new ones are stripped off, so outgoing messages look just like incoming ones. How can you be arguing about remailers when you know so little about how they work? ><speculation: an encrypted chain could be made stronger if the next > hop header depended on which key was used to decode it. > In other words, remailer A's key will produce one next hop > address while remailer B's key will send it elsewhere. This > is a subset of the different plaintext - same cyphertext > problem - a hard problem as I understand it. Find two > distinct texts that encrypt with different keys to the > same cyphertext> That won't help. There would be no point in doing this. I'd ask you to explain, but that would just prolong the agony.

1 0

Re: Stronghold
by Anonymous 17 Dec '03

17 Dec '03

C2Net was wrong to censor the cypherpunks list in the guise of moderation. It was wrong to send threatening letters to people who claimed its products were weak. The whole moderation/censorship experiment was a terrible mistake. The actions taken by C2Net were completely unjustified. At the same time, it is dishonest to say that its products have backdoors or are weak. There is no evidence whatsoever that this is the case. It may stretch the intellects of some cypherpunks beyond the breaking point to hold these two views about matters at the same time. In the black and white world where some cypherpunks live, a company which tries to prevent criticism is evil, hence it must be fraudulent as well. More mature list readers will recognize that a company or a person can be wrong in some actions while being right in other ways. The burden of proof in claiming that there is a weakness in someone's security product is on those making the claim. Compare the unfounded statements by Vulis with the carefully documented breaks of weak software by Ian Goldberg, David Wagner, John Kelsey, and Bruce Schneier. What if Goldberg and Wagner had claimed that Netscape's RNG seeding was weak, without providing any more evidence than that claim? What if Schneier et al had broken cellular phone encryption without backing it up? They would have been justifiably ignored. If anyone really does believe that C2Net's products have backdoors or weaknesses, why don't they present them? Either they want people to keep using C2Net's supposedly broken products, which reflects badly on them, or they want people to stop but they are unable to present any evidence of these purported weaknesses. When Vulis or anyone else claims Stronghold is broken, ask him why he is presenting his claims in a form which will cause people to keep using this "broken" software. Does he want people to have weak encryption? Is he in favor of backdoors? If not, he would surely present evidence of the weaknesses, if there is any. Make Vulis explain his motivations when he makes these claims.

6 7

new release of Crowds
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Authentication-Warning: akalice.research.att.com: majordomo set sender to owner-crowds-talk(a)research.att.com using -f Date: Thu, 2 Oct 1997 10:28:06 -0400 (EDT) From: Mike Reiter <reiter(a)research.att.com> To: crowds-talk(a)research.att.com Subject: new release of Crowds Sender: owner-crowds-talk(a)research.att.com Precedence: bulk Crowds 1.0.3 is now available. If you already agreed to our license on our web page, there's no need to do it again; just send email to crowds-support(a)research.att.com from the previous email address that you gave us, and we'll send 1.0.3 to you. The main change in 1.0.3 is a configuration file that eliminates the need for command-line arguments to anon.pl, and that also enables us to ship distributions ready to join our crowd (i.e., the registration step is eliminated). Hopefully this will make Crowds easier to use. - Mike --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

2 1

CDA protects against liability
by Anonymous 17 Dec '03

17 Dec '03

Another case where the CDA protected against liability. Remailer ops should look into this. http://www.wired.com/news/news/politics/story/7361.html: A San Francisco judge has ruled that a lawsuit that sought to force an Internet service provider to silence a Usenet participant is barred by the federal Communications Decency Act. At issue was a claim by San Francisco Satanists Michael and Lilith Aquino that San Diego-based ElectriCiti Inc. "breached its duty to the [plaintiffs] and to other Internet users" by failing to take action against an anonymous Usenet poster. The newsgroup participant allegedly harassed Michael Aquino, a former US Army lieutenant colonel and the leader of the Temple of Set, and his wife, Lilith. The claimed harassment took the form of messages referring to the Aquinos' involvement in a ritual child-abuse investigation in San Francisco in the 1980s. The couple was never charged with any wrongdoing. Superior Court judge David Garcia accepted ElectriCiti's contention that the lawsuit violated a little-discussed and still-in-force CDA provision that exempts ISPs from liability for content transmitted on their networks. The law states that "no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider." The decision is one of three such cases nationwide that have been thrown out because they attempted to hold ISPs responsible for subscribers' speech, said ElectriCiti's attorney, Roger Myers.

4 4

Possible Security Hole in Internet Explorer 4.0
by Martin Minow 17 Dec '03

17 Dec '03

>From a message in MacOSRumors <http://rumors.netexpress.net/> (I have not independently verified this) --- Begin quote --- Internet Explorer 4.0 ships with major security hole.... With the Microsoft Internet Explorer 4.0 for Windows release only hours old, users have already discovered a major security hole that smacks painfully of Big Brother: Most folks will remember the Netscape java bug that allowed you to snoop on what people where visiting. Well IE4.0 goes a bit further than this - Logging of your actions, even when you would otherwise be shielded by proxies is BUILT-IN. The channel definition format (.CDF) http://www.microsoft.com/standards/cdf-f.htm includes a LOGTARGET feature that allows a web site provider to make your browser deliver logs of your usage via an http post or put. Even hits from cache are logged. This is all not so good and getting worse. Not only is the information posted material, you wouldn't want to give to a provider, (considering) "http post/put" is normally spoofable anyway. Unanswered question for next time - or for folks with more time than me to follow up Can you put other sites in your channel definition and get logs of when they read your competitor's site (with this system)? Definitely not confidence-inspiring. It appears the Mac version is affected by this same problem, as well...and neither platform has any means of disabling this "feature" at present. --- [Internet Explorer 4.0 has not yet been released for the Macintosh platform.] Martin Minow minow(a)apple.com

1 0

Re: "Show me an example of terrorists using the Internet or crypto"
by alexlh＠xs4all.nl 17 Dec '03

17 Dec '03

On Wed, 1 Oct 1997, Matt Elliott wrote: [snip] > >You people just don't get it do you? A gun has one purpose: To kill. Just like > >any other tool, a gun, if it is available _will_ be used at some point. > > Yea, so what is your point. As long as it is lawfull killing that seems to > me to be the point to use a gun. For lawfull purposes. Criminals will > always be using guns anyway. If they take away guns people will just find > another just as forcefull method of defending them selves. I have a potato > gun that will put a 3 inch hole in just about any living creature. I'm > going to take it deer hunting this winter. It will be cool to say I shot a > dear with a potato and a can of hair spray (the propelant) I completely disagree. I bet you'd disagree too when the cops come to take you away for using illegal crypto. It would be totally lawful. But that's besides the point. Killing people is NOT a good thing. It never is. It might be unavoidable in a you-or-him situation, but that doesn't make it a good thing. Would you like to be shot? No? Not even if someone else claims he has a good reason to? I think this goes for most people. So the best that you can do it claim that _you_ think there's a good reason to kill someone. This is not a working theory for a community. Alex --- I dabble in techno-house and sometimes, I do that badass hip-hop thang... But the F U N K gets me every time!

1 0

Re: Secure phone
by John Deters 17 Dec '03

17 Dec '03

At 09:21 AM 10/2/97 -0700, you wrote: >At 11:13 PM 10/1/97 -0700, Lucky Green wrote: >> Bad idea. You don't want people to have to look up keys to use your device. >> Some people may not want to be listed in the phone book. Not to mention >> that a PKI adds an additional and unnecessary layer of complexity. Just use >> DH and have the parties each read half of a hash of the public >> exponentials. No keys to store, no keys to remember, no keys to compromise. > >Trouble is this exposes the system to the man-in-the-middle attack. Perhaps >you could take advantage of the real time nature of the system to prevent >man in the middle, by constructing a protocol such that man in the middle >will invariably time out during the connection setup, or produce an >audible lag problem in speech. The MITM attack is thwarted by Lucky's note: >> DH and have the parties each read half of a hash of the public ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >> exponentials. No keys to store, no keys to remember, no keys to compromise. ^^^^^^^^^^^^^ Each party reads off a series of digits displayed on their screen. Out loud. To each other. Over the secure phone. The MITM attacker can't duplicate the hash on both ends, because a hash of the public keys used to make the connection are different between the MITM's public key and the real public keys. Here's a secure conversation (assume for the moment that the addition below represents a strong hash): Alice <-------------------------------------> Bob PK=1234 PK=5678 1234+5678=6912 5678+1234=6912 Alice reads 69 over the phone, and Bob reads 12 back to her. Alice and Bob proceed to have a private conversation. Now, since Mallory has to create a PK, he cannot just duplicate Alice's 1234, because he'd also need the private key to decrypt the conversation. Likewise, he cannot duplicate Bob's 5678. He has to generate his own PKs in an attempt to fool Bob & Alice. Alice <-----> Mallory <-> Mallory <---------> Bob PK=1234 PK=1111 PK=2222 PK=5678 1234+1111=2345 5678+2222=7900 Alice reads "23" over the phone, and Bob reads "00" back. Since Alice's hash function said she should hear "45" back from Bob, and Bob's screen said he should have heard "79" from Alice, Alice and Bob decide to talk about the weather, and how pretty the trees are in certain cities. Mallory could try to thwart this by impersonating Bob's voice to Alice, saying "45", and Alice's voice to Bob, saying "79" (Mallory does, of course, know these numbers), but if Bob & Alice know each other, this probably won't work too well. Mallory would have to be able to cut into the conversation real-time, undetected. Now, of course, Mallory could hire Anna & Barry to pull the whole impersonation thing off, so that for the entire conversation Alice talks to Barry and Anna talks to Bob, each thinking that they're really talking to the other, but that's also fraught with risk. I'm sure they could pull it off on TV, though :-) So, it'd go full circle back to pass phrases again. "I hear the cherry trees are lovely in Washington D.C." "I wouldn't know, I've never visited Washington in the spring." "I agree, the weather is usually too wet." John -- J. Deters "Don't think of Windows programs as spaghetti code. Think of them as 'Long sticky pasta objects in OLE sauce'." +--------------------------------------------------------------------+ | NET: mailto:jad@dsddhc.com (work) mailto:jad@pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'36"N by 93^16'27"W Elev. ~=290m (work) | | For my public key, send mail with the exact subject line of: | | Subject: get pgp key | +--------------------------------------------------------------------+

7 22