December 2003 - cypherpunks-legacy

Re: cpunk-like meeting report
by Major Variola (ret) 15 Dec '03

15 Dec '03

At 09:57 PM 12/14/03 -0800, Morlock Elloi wrote: >> Be sure and check the archive before posting. It is still small. > >Cookies, "members only" archive access. Bad deal. Will not happen. Very few >consumers here. But look how many IP addresses he got from members checking it out!

1 0

self adjusting dummy traffic generation?
by Nomen Nescio 15 Dec '03

15 Dec '03

Would it be possible to have a self adjusting dummy traffic generator feature in remailers? Operator decides that he wants to process x number of incoming and y number of outgoing messages each time period t. Then the software adjusts the number of dummy messages to this value using some statistical calculations of past t2 hours. If incoming traffic increases then the amount of dummy messages are decreasing and so on. Does this feature exist today?

1 0

Re: cpunk-like meeting report
by Eugen Leitl 15 Dec '03

15 Dec '03

On Sun, Dec 14, 2003 at 06:36:12PM -0800, Tim May wrote: > No, we don't need a "cpunx-news" list. This is what Google and the > ability to see hundreds of various lists and sites is for. This is a bogus statement. As long as I can't use a single keyword to make Google's news alerts topical, and _full text_ a search engine is rather useless. > "News" lists tend strongly to be just dumping grounds for crap from > other lists. The point is that you don't have to subscribe to 20-odd email lists, which have about 5% relevance each. Life's too short for that. People are the best filters, and with a handful of sustained contributors the list becomes a valuable resource. > I failed the entrance exam for "Interesting People," which is fine, for > obvious reasons. Case in point: most of IP list traffic is garbage from a cypherpunk point of view. Let one list subscriber read it, and filter relevant bits to the newsticker. If it's a steaming pile of crap for Tim May it doesn't mean it's useless for everybody else. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

Idea: Simplified TEMPEST-shielded unit (speculative proposal)
by Thomas Shaddack 15 Dec '03

15 Dec '03

TEMPEST shielding is fairly esoteric (at least for non-EM-specialists) field. But potentially could be made easier by simplifying the problem. If we won't want to shield the user interface (eg. we want just a cryptographic processor), we may put the device into a solid metal case without holes, battery-powered, with the seams in the case covered with eg. adhesive copper tape. The input and output can be mediated by fibers, whose ports can be the only holes, fraction of millimeter in diameter, carefully shielded, in the otherwise seamless well-grounded box. There are potential cooling problems, as there are no ventilation holes in the enclosure; this can be alleviated by using one side of the box as a large passive cooler, eventually with an externally mounted fan with separate power supply. If magnetic shielding is required as well, the box could be made of permalloy or other material with similar magnetic properties. I am not sure how to shield a display. Maybe taking an LCD, bolting it on the shielded box, and cover it with a fine wire mesh and possibly metalized glass? Using LCD with high response time of the individual pixels also dramatically reduces the value of eventual optical emissions. I also have doubts about the keyboard. Several ideas that could help: We may use optical scanning of the key matrix, with the light fed into and read from the matrix by optical fibers, coming out from a well-shielded enclosure, similar to the I/O lines of the first example. We may use a "normal" keyboard, but modified to use reliably random scanning pattern; that won't reduce the EM emissions of the keyboard, but effectively encrypts them, dramatically reducing their intelligence value. It's then necessary to take precautions about the data cable between the keyboard itself and the computer, where the data go through in plaintext; it's possible to encrypt it, or to use a fiber. As really good shielding of complicated cases is difficult to achieve, the primary objective of this approach is to put everything into simple metallic boxes with as few and as small ports as possible, which should be comparatively easy to manufacture, replacing the special contacting of removable panels with disposable adhesive copper tape (the only reason to go inside is replacing batteries, and the tape together with other measures may serve as tamperproofing), and replacement of all potentially radiating external data connections with fiber optic. I should disclaim I have nothing that could vaguely resemble any deeper knowledge of high frequencies; therefore I lay out the idea here and wonder if anyone can see holes in it (and where they are).

3 2

Don't worry...it's just one of Saddam's doubles
by Tyler Durden 15 Dec '03

15 Dec '03

Spread the word. The adminstration got desparate. In a few weeks they'll announce this isn't the real Saddam, but that rounding up all of the clones is necessary progress in the fight to get the real Saddam. -TD _________________________________________________________________ Get holiday tips for festive fun. http://special.msn.com/network/happyholidays.armx

4 4

Wardial for Bush! 1-800-531-6789 -- call AGAIN AND AGAIN!
by Tim Meehan 15 Dec '03

15 Dec '03

>From: Wardialers For Bush <war4bush(a)somewhat.com> >Subject: [Wardialers for Bush] Set a record! Call 1-800-531-6789 AS OFTEN AS YOU CAN! > >Resident George W. Bush wants your support! > >Even though ****every nuisance call to this phone number costs him money****, he >wants you to call NOW, AGAIN AND AGAIN! > >1-800-531-6789 > >If you don't get through, call again! > >1-800-531-6789 > >Keep calling. Say you were told to call by Ken Mehlman! Ask for your free >prize! > >1-800-531-6789 > > >1-800-531-6789 > > >1-800-531-6789 > > >1-800-531-6789 > > >1-800-531-6789

1 0

Cypherpunks List Info
by cpunk＠lne.com 14 Dec '03

14 Dec '03

Cypherpunks Mailing List Information Last updated: Oct 13, 2003 This message is also available at http://www.lne.com/cpunk Instructions on unsubscribing from the list can be found below. 0. Introduction The Cypherpunks mailing list is a mailing list for discussing cryptography and its effect on society. It is not a moderated list (but see exceptions below) and the list operators are not responsible for the list content. Cypherpunks is a distributed mailing list. A subscriber can subscribe to one node of the list and thereby participate on the full list. Each node (called a "Cypherpunks Distributed Remailer", although they are not related to anonymous remailers) exchanges messages with the other nodes in addition to sending messages to its subscribers. A message posted to one node will be received by the list subscribers on the other nodes, and vice-versa. 1. Filtering The various CDRs follow different policies on filtering spam and to a lesser extent on modifying messages that go to/from their subscribers. Filtering is done, on nodes that do it, to reduce the huge amount of spam that the cypherpunks list is subjected to. There are three basic flavors of filtering CDRs: "raw", which send all messages to their subscribers. "cooked" CDRs try to eliminate the spam on that's on the regular list by automatically sending only messages that are from cypherpunks list subscribers (on any CDR) or people who are replying to list messages. Finally there are moderated lists, where a human moderator decides which messages from the raw list to pass on to subscribers. 2. Message Modification Message modification policy indicates what modifications, if any, beyond what is needed to operate the CDR are done (most CDRs add a tracking X-loop header on mail posted to their subscribers to prevent mail loops). Message modification usually happens on mail going in or out to each CDR's subscribers. CDRs should not modify mail that they pass from one CDR to the next, but some of them do, and others undo those modifications. 3. Privacy Privacy policy indicates if the list will allow anyone ("open"), or only list members, or no one ("private") , to retrieve the subscribers list. Note that if you post, being on a "private" list doesn't mean much, since your address is now out there. It's really only useful for keeping spammers from harvesting addresses from the list software. Digest mode indicates that the CDR supports digest mode, which is where the posts are batched up into a few large emails. Nodes that support only digest mode are noted. 4. Anonymous posting Cypherpunks encourages anonymous posting. You can use an anonymous remailer: http://www.andrebacard.com/remail.html http://anon.efga.org/Remailers http://www.gilc.org/speech/anonymous/remailer.html 5. Unsubscribing Unsubscribing from the cypherpunks list: Since the list is run from a number of different CDRs, you have to figure out which CDR you are subscribed to. If you don't remember and can't figure it out from the mail headers (hint: the top Received: line should tell you), the easiest way to unsubscribe is to send unsubscribe messages to all the CDRs listed below. How to figure out which CDR you are subscribed to: Get your mail client to show all the headers (Microsoft calls this "internet headers"). Look for the Sender or X-loop headers. The Sender will say something like "Sender: owner-cypherpunks(a)lne.com". The X-loop line will say something like "X-Loop: cypherpunks(a)lne.com". Both of these inticate that you are subscribed to the lne.com CDR. If you were subscribed to the algebra CDR, they would have algebra.com in them. Once you have figured out which CDR you're subscribed to, look in the table below to find that CDRs unsubscribe instructions. 6. Lunatics, spammers and nut-cases "I'm subscribed to a filtering CDR yet I still see lots of junk postings". At this writing there are a few sociopaths on the cypherpunks list who are abusing the lists openness by dumping reams of propaganda on the list. The distinction between a spammer and a subscriber is nearly always very clear, but the dictinction between a subscriber who is abusing the list by posting reams of propaganda and a subscriber who is making lots of controversial posts is not clear. Therefore, we tolerate the crap. Subscribers with a low crap tolerance should check out mail filters. Procmail is a good one, although it works on Unix and Unix-like systems only. Eudora also has a capacity for filtering mail, as do many other mail readers. An example procmail recipie is below, you will of course want to make your own decisions on which (ab)users to filter. # mailing lists: # filter all cypherpunks mail into its own cypherspool folder, discarding # mail from loons. All CDRs set their From: line to 'owner-cypherpunks'. # /dev/null is unix for the trash can. :0 * ^From.*owner-cypherpunks@.* { :0: * (^From:.*ravage@ssz\.com.*|\ ^From:.*jchoate@dev.tivoli.com.*|\ ^From:.*mattd@useoz.com|\ ^From:.*proffr11@bigpond.com|\ ^From:.*jei@cc.hut.fi) /dev/null :0: cypherspool } 7. List of current CDRs All commands are sent in the body of mail unless otherwise noted. --------------------------------------------------------------------------- Algebra: Operator: Subscription: "subscribe cypherpunks" to majordomo(a)algebra.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)algebra.com Help: "help cypherpunks" to majordomo(a)algebra.com Posting address: cypherpunks(a)algebra.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- CCC: Operator: drt(a)un.bewaff.net Subscription: "subscribe [password of your choice]" to cypherpunks-request(a)koeln.ccc.de Unsubscription: "unsubscribe <password>" to cypherpunks-request(a)koeln.ccc.de Help: "help" to to cypherpunks-request(a)koeln.ccc.de Web site: http://koeln.ccc.de/mailman/listinfo/cypherpunks Posting address: cypherpunks(a)koeln.ccc.de Filtering policy: This specific node drops messages bigger than 32k and every message with more than 17 recipients or just a line containing "subscribe" or "unsubscribe" in the subject. Digest mode: this node is digest-only NNTP: news://koeln.ccc.de/cbone.ml.cypherpunks Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Infonex: Subscription: "subscribe cypherpunks" to majordomo(a)infonex.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)infonex.com Help: "help cypherpunks" to majordomo(a)infonex.com Posting address: cypherpunks(a)infonex.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Lne: Subscription: "subscribe cypherpunks" to majordomo(a)lne.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)lne.com Help: "help cypherpunks" to majordomo(a)lne.com Posting address: cypherpunks(a)lne.com Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to lne CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. messages are demimed (MIME attachments removed) when posted through lne or received by lne CDR subscribers 2. leading "CDR:" in subject line removed 3. "Reply-to:" removed Privacy policy: private Info: http://www.lne.com/cpunk; "info cypherpunks" to majordomo(a)lne.com Archive: http://archives.abditum.com/cypherpunks/index.html (thanks to Steve Furlong and Len Sassaman) --------------------------------------------------------------------------- Minder: Subscription: "subscribe cypherpunks" to majordomo(a)minder.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)minder.net Help: "help" to majordomo(a)minder.net Posting address: cypherpunks(a)minder.net Filtering policy: raw Message Modification policy: no modification Privacy policy: private Info: send mail to cypherpunks-info(a)minder.net --------------------------------------------------------------------------- Openpgp: [openpgp seems to have dropped off the end of the world-- it doesn't return anything from sending help queries. Ericm, 8/7/01] Subscription: "subscribe cypherpunks" to listproc(a)openpgp.net Unsubscription: "unsubscribe cypherpunks" to listproc(a)openpgp.net Help: "help" to listproc(a)openpgp.net Posting address: cypherpunks(a)openpgp.net Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Sunder: Subscription: "subscribe" to sunder(a)sunder.net Unsubscription: "unsubscribe" to sunder(a)sunder.net Help: "help" to sunder(a)sunder.net Posting address: sunder(a)sunder.net Filtering policy: moderated Message Modification policy: ??? Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- Pro-ns: Subscription: "subscribe cypherpunks" to majordomo(a)pro-ns.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)pro-ns.net Help: "help cypherpunks" to majordomo(a)pro-ns.net Posting address: cypherpunks(a)pro-ns.net Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to local CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. leading "CDR:" in subject line removed 2. "Reply-to:" removed Privacy policy: private Info: http://www.pro-ns.net/cpunk

1 0

Re: PKI root signing ceremony, etc.
by Dave Howe 14 Dec '03

14 Dec '03

Rich Salz wrote: >> *shrug* it doesn't retroactively enforce the safety net - but that's >> ok, most MS products don't either :) > The whole point is to enhance common practice, not stay at the lowest > common denominator. If someone has *already* issued a certificate - and ignored the CA flag - is it part of the software's duty to somehow point this out to you? But regardless, as this only applies to imported keys you would never actually see it in Real Life (tm) >> Key management and auditing is pretty much external to the actual >> software regardless of which solution you use I would have thought. > You'd be wrong. :) I did just download and use XCA for a little bit. > It's practically impossible to audit. Every key in the database is > protected with the same password. um, this is a **CA** - you have *one* key in the database, your CA key. It is bad practice to generate the keys on the CA machine and transport them to the server they will be used on - instead, the Cert request should be generated on the end-use machine, and the *request* transported to the CA, signed, and the certificate returned. That way, the private key never leaves the machine it was generated for and used on, and is protected by its own password. > The system ask for the password > as soon as it starts up. If I leave the program running while > I leave my computer, I'm screwed. Then don't leave it running. If you got out of your car but left the engine running, and somebody stole the car, would you blame the design of the car? > The key-holder isn't asked to > confirm each signing -- there's no *ceremony* -- and they never > enter the password after the program starts. For any kind of root > these are all very bad. This is just fine for a root - the root acquires 'n' signing requests, opens the program, signs or rejects the requests as appropriate, then closes the program. It is not the duty of the CA to generate keys or enter certificate information - that is the requestor's problem, which he can do with the tools appropriate to his machine (openssl on almost anything, the built in keygen in IIS and several other webservers, and so forth. I am actually disappointed in XCA (compared to the earlier but awkward to set up OpenCA project) in that no browser-accessable request interface is provided. of course XCA is compatable with importing requests made from OpenCA, and exporting them back into an openCA "pickup" dir..... but really it would be nice to be compatable with the interface most key requestors are used to. > XCA is pretty nice for a Level-2 or small Level-1 CA. The template > management, etc., is pretty good. (Having them tied to the key > database, and having the keys be unlocked while making cert requests, > are both real bad ideas, however.) There is no mystical value in having to type a key lots of times. I was just pointing out what other options are out there (I would have pointed out EBCrypt as well, which appears better suited to your current ritual, but its website seems to have vanished)

1 0

RFIDs at tech summit
by J.A. Terranson 14 Dec '03

14 Dec '03

Bug devices track officials at summit By Audrey Hudson THE WASHINGTON TIMES Officials who attended a world Internet and technology summit in Switzerland last week were unknowingly bugged, said researchers who attended the forum. Badges assigned to attendees of the World Summit on the Information Society were affixed with radio-frequency identification chips (RFIDs), said Alberto Escudero-Pascual, Stephane Koch and George Danezis in a report issued after the conference ended Friday in Geneva. The badges were handed out to more than 50 prime ministers, presidents and other high-level officials from 174 countries, including the United States. The trio's report said they were able to obtain the official badges with fraudulent identification only to be stunned when they found RFID chips . a contentious issue among privacy advocates in the United States and Europe . embedded in the tags. Researchers questioned summit officials about the use of the chips and how long information would be stored but were not given answers. The three-day WSIS forum focused on Internet governance and access, security, intellectual-property rights and privacy. The United States and other countries defeated an attempt to place the Internet under supervision of the United Nations. RFID chips track a person's movement in "real time." U.S. groups have called for a voluntary moratorium on using the chips in consumer items until the technology and its effects on privacy and civil liberties are addressed. Mr. Escudero-Pascual is a researcher in computer security and privacy at the Royal Institute of Technology in Stockholm. Miss Koch is the president of Internet Society Geneva, and Mr. Danezis studies privacy-enhancing technologies and computer security at Cambridge University. "During the course of our investigation, we were able to register for the summit and obtain an official pass by just showing a fake plastic identity card and being photographed via a Web cam with no other document or registration number required to obtain the pass," the researchers said. The researchers chose names for the fake identification cards from a list printed on the summit's Web site of attendees. The hidden chips communicate information via radio frequency when close to sensors that can be placed anywhere "from vending machines to the entrance of a specific meeting room, allowing the remote identification and tracking of participants, or groups of participants, attending the event," the report said. The photograph of the person and other personal details are not stored on the chip but in a centralized database that monitors the movement. Researchers said they are concerned that database will be used for future events, including the next summit to be hosted by Tunisian authorities. "During the registration process, we requested information about the future use of the picture and other information that was taken, and the built-in functionalities of the seemingly innocent plastic badge. No public information or privacy policy was available upon our demands that could indicate the purpose, processing or retention periods for the data collected. The registration personnel were obviously not properly informed and trained," the report said. The lack of security procedures violates the Swiss Federal Law on Data Protection of June 1992, the European Union Data Protection Directive, and United Nations' guidelines concerning computerized personal-data files adopted by the General Assembly in 1990, the researchers said. "The big problem is that system also fails to guarantee the promised high levels of security while introducing the possibility of constant surveillance of the representatives of civil society, many of whom are critical of certain governments and regimes," the report said. "Sharing this data with any third party would be putting civil-society participants at risk, but this threat is made concrete in the context of WSIS by considering the potential impact of sharing the data collected with the Tunisian government in charge of organizing the event in 2005," it said. The organization Reporters Without Borders was banned from attending the summit and launched a pirate radio broadcast to protest the ban and detail press-freedom violations by some countries attending the meetings, including Tunisia. "Our organization defends freedom of expression on the Internet on a daily basis. Our voice should therefore be heard during this event, despite this outrageous ban," said Robert Menard, secretary general of Reporters Without Borders. Tunisia is among several countries Reporters Without Borders has accused of censoring the Internet, intercepting e-mails and jailing cyber-dissidents.

1 0

Re: Patriot Ants (was: Re: Zombie Patriots and other musings)
by Nostradumbass＠SAFe-mail.net 14 Dec '03

14 Dec '03

From: Thomas Shaddack <shaddack(a)ns.arachne.cz> > On Sat, 13 Dec 2003, John Kelsey wrote: > > > Of course, there's a more fundamental problem with surrendering to the lone > > warriors. Imagine that there's such a wave of pro-life terrorism that we > > finally agree to ban abortion. You're a fanatically committed pro-choice > > activist. What's your next move? > > Two moves possible. > > The violent, far less effective and possibly somehow counterproductive > one: attacking the ones who enforce the measurement, by letal or nonlethal > means, to act as deterrent. I think you should the word possibly when referring to effectiveness of outcomes. One can never knows until one tries. Every monment in history is unique and the effectiveness of the use of a particular strategy can never be ascertained beforehand. Mine is based on at least two inspirations... "How we burned in the prison camps later thinking: What would things have been like if every security operative, when he went out at night to make an arrest, had been uncertain whether he would return alive?" --Alexander Solzhenitzyn, Gulag Archipelago and Our government... teaches the whole people by its example. If the government becomes the lawbreaker, it breeds contempt for law; it invites every man to become a law unto himself; it invites anarchy. -- Louis D. Brandeis As Americans I'm sure we have been tutored by some of the best. Time to put into practice what we have learned. > > The nonviolent one: developing and deploying the technology necessary for > underground clinics to provide higher quality service, and for their > clients to find, order and pay for the services without being likely to > trace down by the Whateveriscurrentlythelaw Enforcement. Causing bad press > for them, keeping public awareness that alternatives to the law-compliance > exist. Learning from countries with similar bans in action, both from the > present and from history, how the alternatives developed there, and > building on this knowledge. > > Direct attack is not always the best route, however tempting. A house can > be brought down from the outside by a bomb, or from the inside by white > ants. The trouble with this method is that is generally requires a large percentage of the population to actively or passively support a position. This almost always occurs after a situation has become intolerable to the masses. I have no intention in placing my ability to enjoy what I consider my basic rights into the hands of a million Joe Sixpacks and await their enlightenment. "The only freedom which counts is the freedom to do what some other people think to be wrong. There is no point in demanding freedom to do that which all will applaud. All the so-called liberties or rights are things which have to be asserted against others who claim that if such things are to be allowed their own rights are infringed or their own liberties threatened. This is always true, even when we speak of the freedom to worship, of the right of free speech or association, or of public assembly. If we are to allow freedoms at all there will constantly be complaints that either the liberty itself or the way in which it is exercised is being abused, and, if it is a genuine freedom, these complaints will often be justified. There is no way of having a free society in which there is not abuse. Abuse is the very hallmark of liberty." -- Quintin H. Hailsham, The Dilemma of Democracy Get ready for a lot of abuse...

1 0