December 2003 - cypherpunks-legacy

No Subject
by Mixmaster 17 Dec '03

17 Dec '03

[cons0005(a)algnet.algonquinc.on.ca wrote:] I was wondering if anyone knows of such a creature that I could send email to with an URL, and I would get a reply of that HTML file? example I email bot(a)somewhere.com with the Subject:http://www.hotmail.com and I will get an email of the HTML file at www.hotmail.com This would be handy because I don't have a broswer (2 meg RAM (I know)) and also for anonymity, cookies etc I couldn't be traced. ----- Actually you can do that really very easily. If you are interested in such Bot's. I really recommend you get O'Reilly's book: Web Client Programming, with Perl. It discusses to a large degree what your wanting to do. It has full source code as well, so you can take that and just fiddle with a bit until it suits your needs. Provided you or someone you know can program in Perl. I think one method you could do is to just use a majordomo server and tinker with it to suit the reception needs. Or you could on your own box, or a friends box. Make an account to the name you want, set up a resident program, with nohup or a simple cron job. Or do some script, that would serve equally as well. That could handle the reception facilities well enough. Then just use the modified bot to handle the HTML queries and sending and there you go. Although sending things back to the HTTP server in question might... interesting. If that place GET and POST methods for CGI scripts and dynamic pages, that raises some questions. Particularly, if the bot sends you the HTML doc that it requested, you view the page, yadda yadda yadda. It depends on how you want to work it and do it, you have to ask yourself. Do I want to send my request (whatever that maybe)from my machine? The request would go through. But it would be through your machine, and that would invalidate your anonymity. So thats a Bad Thing(tm) and out of the question. Or in cases like yours, the user might not have a browser. So that leaves it to us sending our request back to our automated little daemon and it does it for us. It would require just a little bit of handling and work to do the GET and POST methods for the CGI program your interacting with, but that would be minimal I think. I could be wrong however. In effect your using the bot as a kind of proxy for HTTP requests. If your really, REALLY desperate I might be able to quickly just put something together for you and post it here for you(or if another cypherpunk thats into Perl wants to do it, or if anyone else has any ideas). But you should be able to modify the code to suit whatever you want it to do. I've been experimenting with something similar, only on a slightly different note. If your patient, you can just subscribe to a majordomo "admin-help" list. Where the details of running such a thing are discussed by people that do. I'm sure one quite possibly exists somewhere. Then log on to a Bot mailing list and after hanging out on both for a while, asking a few questions perhaps you should be able to put something together I expect. Or as mgraffam(a)mhv.net suggests you could log into those machines and do it that way. Which gives me another idea, you could have the bot run lynx remotely and then pipe the output from that to the letter it would send you and visa versa. But that makes things more complicated as well too. I question the value of doing that as well, I think the overhead would be a bit much, as well as being a slight hassle. I think over all, the easiest thing to do would be to possibly follow mgraffam's suggestion and just do that. Those are my thoughts on things at least. I hope they help. I think the security possibilities of such a bot could be useful and could make a interesting discussion perhaps. There was one thread earlier that was discussing one such robot. From a government location, that was keeping tabs on crypto related sources. Crawling from link to link, from behind a firewall etc, etc, etc. If theres any more news relating to that thread, thats been uncovered I'd be interested in hearing more on it. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

FW: "... would cause us to look at this person as a threat"
by Trei, Peter 17 Dec '03

17 Dec '03

The earliest online citation I can find is in the May 1997 Newsletter of the Melbourne Seventh-day Adventist Church, at http://www.spacey.net/bwillard/News0597.html Considering it's content, I have no doubt that it is manufactured - it carefully written to offend millenialist Christians, such as the SDAs. I've written the page owner to see if I can find out more. Deja News shows this quote first in alt.war.civil.usa, on March 18 1998. Since then, it's been banging around various Christian and political groups. It also seems to be on the website http://www.sightings.com/political/renowords.htm, but I have not confirmed this, nor can I tell if this cites an earlier source. Peter Trei > -----Original Message----- > From: Tim May [SMTP:tcmay@got.net] > Sent: Tuesday, May 12, 1998 2:45 PM > To: cypherpunks(a)cyberpass.net > Subject: "... would cause us to look at this person as a threat" > > > > I just saw this on one of the newsgroups: > > > "A cultist is one who has a strong belief in the Bible and the Second > Coming of Christ; who frequently attends Bible studies; who has a high > level of financial giving to a Christian cause; who home schools for > their children; who has accumulated survival foods and has a strong > belief in the Second Amendment; and who distrusts big government. Any > of these may qualify [a person as a cultist] but certainly more than one > [of these] would cause us to look at this person as a threat, and his > family as being in a risk situation that qualified for government > interference." > -Attorney General Janet Reno, Interview on 60 Minutes, June 26, 1994 >

1 0

EPIC Analysis of E-Privacy Act
by David Banisar 17 Dec '03

17 Dec '03

==================================================================== EPIC Preliminary Analysis of E-PRIVACY Act May 12, 1998 Washington, DC Senators John Ashcroft (R-MO) and Patrick Leahy (D-VT) today introduced the "Encryption Protects the Rights of Individuals from Violation and Abuse in Cyberspace (E-PRIVACY) Act." The proposed legislation is the latest in a series of congressional measures designed to resolve the debate surrounding current U.S. encryption policy. Like the SAFE Act (H.R. 695) now pending in the House, the E-PRIVACY Act seeks to relax existing controls on the export of encryption products. Controls would be lifted for encryption products that are deemed to be "generally available" within the international market. Exporters would be given new procedural rights to obtain expedited determinations on the exportability of their products. The bill also contains several provisions that would preserve the right of Americans to use encryption techniques and that would enhance the privacy protections currently accorded to personal communications and stored data. Among its positive features, the bill: * Reiterates the right of Americans to use, develop, manufacture, sell, distribute, or import any encryption product, regardless of the algorithm selected, key length, or the existence of key recovery capabilities; * Prohibits government-compelled key escrow or key recovery; * Prohibits government agencies from creating any linkage between cryptographic methods used for authentication and those used for confidentiality; * Prohibits the federal government from purchasing key recovery encryption systems that are not interoperable with other commercial encryption products; and * Provides enhanced privacy protections for stored electronic data held by third parties, location information generated by wireless communications services, and transactional information obtained from pen registers and trap and trace devices; The bill contains two provisions that raise significant civil liberties and privacy concerns. The Criminalization Provision The bill would make the use of encryption to conceal "incriminating" communications or information during the commission of a crime a new and independent criminal offense. While well-intended, the provision could have several unintended consequences that would easily undermine the other desirable features of the bill. We believe it is a mistake to create criminal penalties for the use of a particular technique or device. Such a provision tends to draw attention away from the underlying criminal act and casts a shadow over a valuable technology that should not be criminalized. It may, for instance, be the case that a typewritten ransom note poses a more difficult challenge for forensic investigators than a handwritten note. But it would be a mistake to criminalize the use of a typewriter simply because it could make it more difficult to investigate crime in some circumstances. Additionally, a provision which criminalizes the use of encryption, even in furtherance of a crime, would give prosecutors wide latitude to investigate activity where the only indicia of criminal conduct may be the mere presence of encrypted data. In the digital age, where techniques to protect privacy and security will be widely deployed, we cannot afford to view encryption as the potential instrumentality of a crime, just as we would not today view the use of a typewriter with suspicion. Finally, the provision could also operate as a substantial disincentive to the widespread adoption of strong encryption techniques in the communications infrastructure. Given that the availability of strong encryption is one of the best ways to reduce the risk of crime and to promote public safety, the retention of this provision in the legislation will send a mixed message to users and businesses -- that we want people to be free to use encryption but will be suspicious when it is used. If the concern is that encryption techniques may be used to obstruct access to evidence relevant to criminal investigations, we submit that the better approach may be to rely on other provisions in the federal and state criminal codes (including sections relating to obstruction of justice or concealment) to address this problem if it arises. The "NET Center" The bill creates within the Department of Justice a National Electronic Technology Center (NET Center) to "serve as a center for . . . law enforcement authorities for information and assistance regarding decryption and other access requirements." The NET Center would have a broad mandate and could spawn a new domestic surveillance bureaucracy within the Department of Justice. Among other powers, the bill authorizes the NET Center to: * Examine encryption techniques and methods to facilitate the ability of law enforcement to gain efficient access to plaintext of communications and electronic information; * Conduct research to develop efficient methods, and improve the efficiency of existing methods, of accessing plaintext of communications and electronic information; * Investigate and research new and emerging techniques and technologies to facilitate access to communications and electronic information; and * Obtain information regarding the most current hardware, software, telecommunications, and other capabilities to understand how to access digitized information transmitted across networks. The mission of the NET Center is made more troubling by the bill's authorization of "assistance" from other federal agencies, including the detailing of personnel to the new entity. In light of the fact that existing federal expertise in the areas of electronic surveillance and decryption resides at the National Security Agency (NSA), the bill in effect authorizes unprecedented NSA involvement in domestic law enforcement activities. Such a result would be contrary to a half-century-old consensus that intelligence agencies must be strictly constrained from engaging in domestic "police functions." That consensus arose from the recognition that intelligence agencies created to operate abroad are ill-suited for domestic activities, where U.S. citizens enjoy constitutional protections against governmental intrusions. In 1975, Sen. Frank Church led a congressional investigation into the activities of NSA. He noted that Congress had a "particular obligation to examine the NSA, in light of its tremendous potential for abuse. ... The danger lies in the ability of NSA to turn its awesome technology against domestic communications." In 1987, Congress enacted the Computer Security Act, which sought to vest civilian computer security authority in the Commerce Department and to limit the domestic role of NSA. The House Report on the Computer Security Act cited congressional concern over a Reagan Administration directive that "gave NSA the authority to use its considerable foreign intelligence expertise within this country." The report noted that such authority was "particularly troubling" since NSA "has, on occasion, improperly targeted American citizens for surveillance." The NET Center proposal, if approved, would constitute a fundamental re-definition of the relationship between intelligence agencies and domestic law enforcement. Such an approach would ignore 50 years of experience and would pose a serious threat to the privacy and constitutional rights of Americans. EPIC looks forward to working with the legislation's sponsors and other interested parties to address these issues and develop a national encryption policy that will ensure the widespread availability of robust encryption products and the preservation of constitutional rights. Such a result will be critical for both our nation's continued leadership of the information industry and the protection of personal privacy in the next century.

1 0

Bitslice DES S-boxes
by mkwan＠preston.net 17 Dec '03

17 Dec '03

After 6 weeks of number crunching, I've finally produced a new set of bitslice DES S-boxes using non-standard logic gates. Numbers are as follows - S1 S2 S3 S4 S5 S6 S7 S8 Avg 56 50 53 39 56 53 51 50 51 Details at http://www.cs.mu.oz.au/~mkwan/bitslice There won't be any more improvements in the foreseeable future, since I've run out of ideas. Feel free to use this code in the RSA DES II challenge, but remember to give credit where it's due. mkwan

1 0

Re: Gary Lee Burnore is a Convicted Sex Offender in Raleigh, NC
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

wmcclatc(a)primenet.com (William J. McClatchie) > X-Comment: Aw, are you offended? > X-no-archive: yes > [anonymous makes illegal usage of information, as defined by the state he > got the info from, and then whines] And your legal basis for calling the posting of public information from a public website to usenet "illegal usage" is ??? Presumably if the state had wanted to keep the info secret, they wouldn't have made it public available. The only whining I've seen has been by Gary Burnore who complained that the state of North Carolina failed to keep his conviction as a sex offender a secret, and by various DataBasix sock puppets and groupies. Burnore did the crime, he was convicted, he registered as a sex offender with the state of NC, the information was made publicly available by the state, and people found out as they were intended to. Deal with it! Maybe you ought to learn a little about remailers before you make such ridiculous claims, McClatchie. If I'm the person you say "whined", then I'm *NOT* the same person who posted the information that Gary whined about. Sorry to burst Gary's bubble that all posts which poor little Gary Burnore doesn't like originate from his one mythical "Anon Asshole <tm>". In fact, the information is just as likely to have been posted anonymously by YOU as by me. > >It's people like you and Gary Burnore who threaten and harass people who > >say things you don't like that make anonymous remailers necessary. > > >And it is assholes like you who ABUSE remailers that make them go away. Let me get this straight... Someone threatens a remailer user with physical violence, I comment on it, and now I'm "abusing a remailer" just because you don't like what I have to say? Don't you think that's for the remailer operator to decide? Do you operate a remailer, McClatchie?

1 0

Chaffing & winnowing without overhead
by Jesús Cea Avión 17 Dec '03

17 Dec '03

You can have chaffing & winnowing without bandwidth overhead, but the resulting scheme hasn't the original "elegance" anymore. In particular, you don't send the plaintext on the clear. The new schema is useful to cypher a document using any standard signature library, exportable by definition. Very nice :), since you can use, at last, strong crypto :). a) When the connection starts, negociate an initial sequence number. The sequence number mustn't be reused. We assume a ordered delivery, like TCP. b) Calculate the signature for: [sequence]0 -> MAC0 and [sequence]1 -> MAC1 c) Compare both MACs and locate the first "different" bit, from high to low bit or viceversa. d) Send that bit from MAC0 if you want to send a "0" or from MAC1 if you want to send a "1". -- Jesus Cea Avion _/_/ _/_/_/ _/_/_/ jcea(a)argo.es http://www.argo.es/~jcea/ _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ _/_/_/_/_/ PGP Key Available at KeyServ _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibnitz

4 7

[rivest@theory.lcs.mit.edu: Chaffing question]
by Jim Thompson 17 Dec '03

17 Dec '03

With all of the discussion of C&W, and potential expansion, along with a sideband discussion of same, I decided to ask 'the man' himself. The '10K email file' used in the example came from the sideband discussion. Forwarded for your edification. ------- Start of forwarded message ------- Date: Tue, 12 May 1998 18:24:46 -0400 From: Ron Rivest <rivest(a)theory.lcs.mit.edu> Subject: Chaffing question Suppose you can start with a 10KB email file. Running a package (all-or-nothing) transform on it adds only a small amount to the length---say 128 bits total, or less (basically the length of a key in your favorite algorithm). You can break the result into 128 one-bit blocks and one 10KB block. MAC each block. Add 128 bits of chaff, intermingled with the first 128 blocks from above. The final result has 128+128+1 packets, and total length 10KB (the original email) + 257*64 bits (for the 257 64-bit MAC values) plus 128 bits (the chaff bits), and assuming that the sequence numbers are implicit rather than explicit, you get a total of around 12.3 KB. Cheers, Ron ------- End of forwarded message ------- -- Jim Thompson / Smallworks, Inc. / jim(a)smallworks.com 512 338 0619 phone / 512 338 0625 fax Real, cheap Hardware RNG: http://www.fringeware.com/nscd/

1 0

Abusive crossposting by anonymous remailer user (Was: Gary L. Burnore blah blah blah)
by eridani＠databasix.com 17 Dec '03

17 Dec '03

In article <199805130137.DAA03874(a)basement.replay.com>, nobody(a)REPLAY.COM (Anonymous) wrote: [who cares what he wrote] Where's the idiot who was ranting about kooks who crosspost threads everywhere and called -me- a Usenet abuser? Take a look at the references in this one: References: <199805101850.LAA00114(a)sirius.infonex.com> <3555FA78.7795(a)pageplanet.com> <199805121307.PAA21528(a)basement.replay.com> <6ja344$i2h(a)nntp02.primenet.com> <199805101850.LAA00114(a)sirius.infonex.com> posted to triangle.general only <3555FA78.7795(a)pageplanet.com> posted to triangle.general only <199805121307.PAA21528(a)basement.replay.com> posted to: alt.fan.gburnore,triangle.general,alt.vigilantes, alt.netcom.emeritus,alt.cypherpunks,news.admin.censorship, alt.privacy,alt.privacy.anon-server,misc.kids And there we have it, folks. The anonymous stalker who's spent the past year following Gary Burnore around Usenet found a post in triangle.general that mentioned him, added a propaganda-filled follow up to it, and posted it to 9 newsgroups--many of whom have repeatedly requested that this crap be kept out of said groups. Oh and lookee what else: it was mailed to cypherpunks(a)toad.com, presumably for archival on the cypherpunks mailing list, where it will be picked up by WWW search engines. Since those folks don't seem to mind having their archives used in personal grudge matches, I'll just start cc'ing my responses there as well. I'm sure, as champions of free speech, they can understand the necessity of making sure both sides of the story get equal time. -- Belinda

1 0

Re: Abusive crossposting by anonymous remailer user (Was: Gary Lee Burnore is a Convicted Sex Offender in Raleigh, NC)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

eridani(a)databasix.com (Belinda Bryan) wrote: > And there we have it, folks. The anonymous stalker who's spent the past > year following Gary Burnore around Usenet found a post in > triangle.general that mentioned him, added a propaganda-filled follow up > to it, and posted it to 9 newsgroups--many of whom have repeatedly > requested that this crap be kept out of said groups. "Anonymous stalker"? For merely posting a reply to a public post on Usenet? What state or country has a statute against that, and what makes you think the poster falls under its jurisdiction if it does exist? As for whether a certain post is "propaganda", that is for the reader to decide, especially when of the content is independently verifiable. The "propaganda" you refer to was apparently intended to refute the fallacious assertion that since Gary Lee Burnore's entry in the North Carolina official database of registered sex offenders had apparently been removed, then the underlying crime for which he was convicted and required to register somehow automagically never happened. To make such an assertion is to invite rebuttal. The thread you're whining about involved Steve Crisp <crisp(a)pageplanet.com> threatening an anonymous poster with "beating the living fuck out of you" if his/her identity could be determined, a second anonymous poster challenging the propriety of such a threat, and yet another DataBasix groupie, William McClatchie <wmcclatc(a)primenet.com>, calling the second anonymous poster a "remailer abuser" for daring to make such a challenge. So rather than denouncing the threat itself, you choose to call the person challenging it an "anonymous stalker"? If you feel no need to "hide" anything, please feel free to post your street address and home phone number. But I imagine that many people with small children would not want their names, from which their street address can be derived by someone with the resources available to you and Gary Burnore, to fall into the hands of a convicted child molester with a history of abusive retaliation. Being threatened with physical violence for making an unpopular post is one of the best arguments available as to why anonymity is necessary when people like Steve Crisp and convicted child molester Gary Lee Burnore are running around loose making those threats. > Oh and lookee what else: it was mailed to cypherpunks(a)toad.com, > presumably for archival on the cypherpunks mailing list, where it will > be picked up by WWW search engines. Since those folks don't seem to > mind having their archives used in personal grudge matches, I'll just > start cc'ing my responses there as well. I'm sure, as champions of free > speech, they can understand the necessity of making sure both sides of > the story get equal time. This, of course, comes from the same Belinda Bryan who impersonated a lawyer for DataBasix to demand the disclosure of (fortunately non-existant) user logs from the Huge Cajones remailer in a failed Scientology-esque attempt to embarass its users. And that attack, BTW, started because Gary Burnore was pissed that an anonymous whistle blower used a remailer to tip of his victim's mother to the molestation. As is typical of his style, Burnore denounced that legitimate use of anonymity as "harassment" and "abuse". It was also Burnore who chose to make PUBLIC what had previously been a private e-mail, thus inviting his critics to factually evaluate the claims. One of them apparently did so and discovered Gary Burnore's name and mug shot were published on an official PUBLIC website of registered sex offenders maintained by the state of North Carolina where Burnore moved after leaving San Francisco. Perhaps he should have learned a lesson from Gary Hart and not have taunted the wrong people to find evidence of his wrongdoing. Will the continual harangue against privacy and anonymity by Gary Lee Burnore, Belinda Bryan, Billy McClatchie, and other staffers and sock puppets of the DataBasix wrecking crew never end? BTW, Belinda, cross-posting your whining drivel in the fashion you're threatening negates your lame attempts to achieve deniability by using the infamous X-No-Archive header that has become the trademark of DataBasix' denizens. IOW, you won't be able to retroactively claim that an embarassing post from you was "forged" because it's not archived at an unbiased, third party site. Can you say "oops"?

1 0

Hidden US government
by bill payne 17 Dec '03

17 Dec '03

Guys There is a segment in the US government who do whatever they want. Like stinging Iran. The segment thinks that they are unaccountable. We want to change this. And get our money too! Wednesday 5/13/98 7:40 AM Lawyers and netizens Morales and my last Friday filing seen at http://www.jya.com/whp050898.htm is causing comments at http://www.jya.com/mf050998.htm and elsewhere. One of my neighbors, Bill Moe, is a retired AF officer and now an APD cop. Moe commented that no lawyer would ever write a document like the one we FILED. Morales is ready to go to the Supreme Court on this case for the reasons of Campos dismissing DIR NSA Minihan. Morales feels that this decision make no one in a federal agency accountable.. We will also probably have to appeal the dismissal of Morales too. Bad precedent. Now that we have copies of the docket sheets seen at http://www.jya.com/whp-10usca.htm we must study them. We will do this at noon today. Then we will begin the process of filing criminal complaint affidavits on Tenth circuit judges and judge Joseph Weis, of the Third circuit. Dolores K. Sloviter Chief Judge, Third Circuit 18614 U.S. Courthouse Philadelphia, PA 19106 215-597-1588 also EARNED a criminal complaint affidavit along with clerks Bradford Baldus and Toby Slawsky. Slawsky earned another for sending US Marshals Lester and Lopez to investigate me, with no letter of authorization, for inappropriate communications. The matter of Campos in camera ex parte meeting with NSA is also causing CONCERN. http://www.jya.com/whp043098.htm NM judge John Conway had an ex parte in camera meeting with Sandia/NSA high tech terrorist James Gosler in 1992 in my ADEA lawsuit. Conway then sealed all of my lawsuit court records and halted discovery. Then there was the matter in both my and Morales lawsuits of material showing up in the final district decisions which was not in pleadings. A district federal court spy gave us information that Sandia wrote the decision for, in Morales case, judge Galvan and my case, John Conway. These actions by judges and court clerks largely prompted Morales and my genocide and crypto incompetence lawsuit. We know that the federal courts and the legal system are LARGELY controlled by the US federal government. This is becoming more obvious to all by those who read http://www.jya.com/whp043098.htm. The US Hidden government is in reality a fascist government. FASCISM - a political and economic movement, strongly nationalistic, magnifying the rights of the state as opposed to those of the individual, in which industry, though remaining largely under private ownership, and all administrative political units, are controlled by a strong central government. Since Morales and I have both lost money as a result of actions of a fascist government, we struck at the heart of the US Hidden government [aka The Great Satan] with our genocide and crypto incompetence lawsuit. Representative Cynthia McKinney [CYMCK(a)mail.house.gov ] and Senator Grassley [chuck_grassley(a)grassley.senate.gov] are in possession of the Swiss Radio International audio tape telling the saga of Hans Buehlers arrest in Teheran in 1992 for espionage. Hopefully those who are concerned can share their concerns about possible consequences of NOT releasing our requested documents on Internet. And, too, encourage settlement of this NSA-caused American tragedy. http://caq.com/cryptogate http://www.aci.net/kalliste/speccoll.htm Morales and I continue to feel that we should settled this unfortunate matter before it gets WORSE. Later bill

1 0