December 2003 - cypherpunks-legacy

Re: Old Hat 2
by Anonymous 17 Dec '03

17 Dec '03

Here's what is likely going on right now, though its availability to LE is questionable: NSA probably maintains surveillance of all or nearly all encrypted remailers. They log and archive the content of all traffic. First arrivals of messages in the remailer "cloud" provide source identification in many cases, so a database is gradually built of all the originating email addresses and IP addresses that have ever sent messages to a remailer. The same is true for the messages exiting the cloud, although many of those go to public lists or newsgroups. Sometimes, perhaps even often, the remailer cloud is so little utilised that one-hop or even multi-hop chained remalings are easily identified as to source and final destination. All goes into the database. Spook-style stylometers develop profiles of the users. Over time, more and more of the unidentified profiles become linked to known users. All it takes is one slip, or one piece of bad luck of low traffic levels. Linkage is also done on a probabilistic basis, many-to-many. Little human intervention is used except to develop and tune the correlation mechanisms. Filters aimed at content that might help correlate messages with senders is more important to the spooks than Echelon Dictionary filters. The priorities in getting a handle on something like the remailer cloud are quite different than the priorities in scanning ordinary traffic for content. Ultimately, though, the regular content filters come into play, but in this ongoing exercise of cat and mouse, the bulk of the effort is directed at developing the combination of surveillance and intelligent processing that can provide the basis for identifying, at least to some knowable probability, the sources and destinations of given remailer messages. Source and destination correlation can benefit greatly from knowledge of conventional email correspondent relationships. Most nonprofessional-spook people who send encrypted remailed email to a non-public destination are also likely to correspond with that destination in the clear. Archival logging of traffic is like a time machine - even if one ceases conventional correspondence with another, any past traffic can reveal the correspondence relationship. Mathematical correlation, given a very large amount of raw data consisting of timestamped message events, can reveal quite a lot about likely correspondence relationships. Even given a remailer network full of chaff, with reordered message pools and such, just running correlations on the end point data - who sent and when, and who received and when - can develop likely correspondent pairs. Be assured that the manipulation of such data relies heavily on probablistic clustering supported by database mechanisms not seen much in business environments. Instead of having firm relationships within an order or two of magnitude of the terminal node population, I would want something that allows having very large numbers of fuzzy relationships numbering many orders of magnitude greater than the node population. Nodes A, B, C and D send and receive remailer traffic. Everything that A has ever sent is clearly related to A, but each item can and likely would also have a probabilistic relationship to B, C, and D. The probability assignments would be updated as later analysis and later data more clearly identify who may have received which messages. Content comes into play here, too. At any time it is possible to query the database for the likely correspondents of A, and the likely messages A may have sent to B, C, or D, and get a result ordered by confidence. Similarly, it is possible to query for the likely sender(s) and recipient(s) of a given message. Occasionally, data may be firmed up - meaning achieving higher confidence levels of the relationships - by access to someone's PC, by whatever means, by stylometry, by specific content of public messages, and by fortuitous traffic analysis successes owing to the paucity of remailer traffic. It's also certain that to provide realistic cases that can be fully revealed to measure the efficacy of the various algorithms and methods involved, spooks use the remailer network themselves. That's the only way they can be sure to have any traffic that can be fully analyzed as a yardstick for the guessing games played by their software. A few rules of thumb result from even cursory examination of the likely environment: 1. Do not send clear messages through the remailers except to public lists and newsgroups. Sending clear messages to private correspondents provides the watchers with rich style and content material linked to a correspondent. It is usually easy then to link it back to you, and a firm correspondent pair is then established in their database. 2. Do not switch between clear and encrypted, remailed communication with the same correspondent. If your correspondent relationships are mapped via clear, conventional mail, those mappings can be applied to your encrypted, remailed mail to greatly narrow down the possible recipients, and quite likely combine with traffic analysis to correlate your outgoing message with one arriving at your correspondent. If the only communications you have with your deep contacts is by encrypted, chained remailer, only fortuitous or statistical correlation analysis or access to your or your correspondent's host machines will tie the two of you together. 3. Do not send traffic to significant correspondents when traffic levels are likely to be low. Good luck at guessing this. Probably the best way to get a handle on traffic levels is to run a remailer yourself. 4. Send lots of chaff. Chain some messages through the remailer cloud every day. If you have time and the ability, write and release something that will allow large numbers of people to send lots of chaff. 5. Ultimately, the only way the remailers will provide what might be described as Pretty Good Security will be when we have software that maintains a regular or random rate of messages to and from the remailer cloud, a stream into which the meaningful messages can be inserted with no visible change in traffic. Until then, the best we can do is try to keep traffic levels up, and to send and receive frequently enough to frustrate end-to-end traffic analysis. 6. Don't send anything that can have grave consequences. 7. Take names. Always take names. Some day... FUDBusterMonger It Ain't FUD til I SAY it's FUD!

2 1

Re: bonjour
by dan_verton＠fcw.com 17 Dec '03

17 Dec '03

this is not my list and I want off as well. falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:19:07 AM Please respond to press-english-technical(a)lists.datafellows.com To: press-english-technical(a)lists.datafellows.com cc: (bcc: Dan Verton/FCW) Subject: Re: bonjour please remove my name from your email list. Thierry Roch wrote: > Ici tout va bien, merci. > > On esp ère qu'une version fiable pour windows sortira un jour > Salut > ________________________________________ > roch(a)liberation.fr > Tel : +33 (0) 1 42 76 17 68 - Fax: +33 (0) 1 42 76 02 24 > Informatique Libération http://www.liberation.fr

1 0

RE: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATESECURE VPN S...
by Ayoub, Mark (CAP, FLEET) 17 Dec '03

17 Dec '03

DO NOT HIT REPLY ALL, if you need to send an email send it to mailto:Marita.Nasman-Repo@DataFellows.com. Otherwise everybody on the mailing list receive your message. Mark Ayoub GECFS PC Support -----Original Message----- From: Mark Denny [mailto:mad@mm-croy.mottmac.com] Sent: Tuesday, December 01, 1998 11:28 AM To: press-english-technical(a)lists.datafellows.com Subject: RE: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATESECURE VPN S... ===== Original Message from PRESS-EN @ INTERNET {press-english-technical(a)lists.datafellows.com} at 1/12/98 16:21 >Same request. May I be removed from this list as well? > > > > >falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:20:14 AM > >Please respond to press-english-technical(a)lists.datafellows.com > >To: press-english-technical(a)lists.datafellows.com >cc: >bcc: Evan Schuman/MHS/CMPNotes >Subject: Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE > SECURE VPN S... > > > > >Please remove my name from your email list. > > >Opencity(a)aol.com wrote: > >> Hi Mimmi >> >> Okay...this can be distributed as of today? >> >> Thanks >> phil ===== Comments by MAD@MM-CROY (Mark Denny) at 1/12/98 16:27 Could you please stop sending me your emails. I think that some thing has gone wrong with your server. Thanks. Mark.

1 0

Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S...
by dan_verton＠fcw.com 17 Dec '03

17 Dec '03

please remove my name from the cc address when you send this... I'm on this thing as well eschuman(a)cmp.com on 12/01/98 11:21:21 AM Please respond to press-english-technical(a)lists.datafellows.com To: press-english-technical(a)lists.datafellows.com cc: (bcc: Dan Verton/FCW) Subject: Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S... Same request. May I be removed from this list as well? falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:20:14 AM Please respond to press-english-technical(a)lists.datafellows.com To: press-english-technical(a)lists.datafellows.com cc: bcc: Evan Schuman/MHS/CMPNotes Subject: Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S... Please remove my name from your email list. Opencity(a)aol.com wrote: > Hi Mimmi > > Okay...this can be distributed as of today? > > Thanks > phil

1 0

RE: bonjour
by Ayoub, Mark (CAP, FLEET) 17 Dec '03

17 Dec '03

DO NOT HIT REPLY ALL, if you need to send an email send it to mailto:Marita.Nasman-Repo@DataFellows.com. Otherwise everybody on the mailing list receive your message. Mark Ayoub GECFS PC Support -----Original Message----- From: SimpleNet Informatica LTDA [mailto:dalmo@simp.net] Sent: Tuesday, December 01, 1998 11:35 AM To: press-english-technical(a)lists.datafellows.com Subject: Re: bonjour Remove me too !!!!!!!!!!!!!! At 08:19 AM 12/1/98 -0800, you wrote: >please remove my name from your email list. > >Thierry Roch wrote: > >> Ici tout va bien, merci. >> >> On espère qu'une version fiable pour windows sortira un jour >> Salut >> ________________________________________ >> roch(a)liberation.fr >> Tel : +33 (0) 1 42 76 17 68 - Fax: +33 (0) 1 42 76 02 24 >> Informatique Libération http://www.liberation.fr > > >Content-Type: application/x-pkcs7-signature; name="smime.p7s" >Content-Disposition: attachment; filename="smime.p7s" >Content-Description: S/MIME Cryptographic Signature > >Attachment Converted: c:\internet\eudora\attach\smime10.p7s > +===================================================+ SimpleNet Informatica LTDA - mailto:simp@simp.net Tel/Fax : (+55-21)509-0944 http://www.simp.net/ Rio de Janeiro - Brazil 3com Partner - Cyclades Reseller - Wingate Reseller Attachmate Premium Partner Medallion - SCO Reseller +===================================================+ Visite o Rio de Janeiro : http://www.guiario.com.br Sinalizando o Brasil em : http://www.signbrazil.com

1 0

RE: bonjour
by Ayoub, Mark (CAP, FLEET) 17 Dec '03

17 Dec '03

DO NOT HIT REPLY ALL, if you need to send an email send it to mailto:Marita.Nasman-Repo@DataFellows.com. Otherwise everybody on the mailing list receive your message. Mark Ayoub GECFS PC Support -----Original Message----- From: "dan_verton"@fcw.com [mailto:"dan_verton"@fcw.com] Sent: Tuesday, December 01, 1998 11:39 AM To: press-english-technical(a)lists.datafellows.com Subject: Re: bonjour this is not my list and I want off as well. falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:19:07 AM Please respond to press-english-technical(a)lists.datafellows.com To: press-english-technical(a)lists.datafellows.com cc: (bcc: Dan Verton/FCW) Subject: Re: bonjour please remove my name from your email list. Thierry Roch wrote: > Ici tout va bien, merci. > > On esp

1 0

RE: bonjour
by Mark Denny 17 Dec '03

17 Dec '03

===== Original Message from PRESS-EN @ INTERNET {press-english-technical(a)lists.datafellows.com} at 1/12/98 16:38 >this is not my list and I want off as well. > > > > >falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:19:07 AM > >Please respond to press-english-technical(a)lists.datafellows.com > >To: press-english-technical(a)lists.datafellows.com >cc: (bcc: Dan Verton/FCW) >Subject: Re: bonjour > > > > >please remove my name from your email list. > >Thierry Roch wrote: > >> Ici tout va bien, merci. >> >> On esp >ère qu'une version fiable pour windows sortira un jour >> Salut >> ________________________________________ >> roch(a)liberation.fr >> Tel : +33 (0) 1 42 76 17 68 - Fax: +33 (0) 1 42 76 02 24 >> Informatique Libération http://www.liberation.fr ===== Comments by MAD@MM-CROY (Mark Denny) at 1/12/98 16:43 Please remove me. Mark. Mott MacDonald Limited, Registered in England No. 1243967 Registered office St. Anne House, 20-26 Wellesley road, Croydon CR9 2UL Tel: +44 (0) 181-774 2000 Fax: +44 (0) 181-681 5706 Email Mad(a)mm-croy.mottmac.com

1 0

somebody clue this person in please!
by Ken Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- i'm laughing too damned hard to do it myself. Regards, Ken Williams Packet Storm Security http://www.Genocide2600.com/~tattooman/ E.H.A.P. Head of Operations http://www.ehap.org/ ehap(a)ehap.org NC State CS Dept http://www.csc.ncsu.edu/ jkwilli2(a)unity.ncsu.edu PGP DSS/DH/RSA Keys http://www4.ncsu.edu/~jkwilli2/pgpkey/ _____________________________________________________________ Get Your Private, Free, Encrypted Email at http://www.nsa.gov - ---------- Forwarded message ---------- Received: from cc02mh.unity.ncsu.edu (cc02mh.unity.ncsu.edu [152.1.1.144]) by cc01mh.unity.ncsu.edu (8.8.7/8.8.7) with ESMTP id TAA00863 for <jkwilli2(a)cc01mh.unity.ncsu.edu>; Mon, 30 Nov 1998 19:04:29 -0500 (EST) From: ILovToHack(a)aol.com Received: from imo22.mx.aol.com (imo22.mx.aol.com [198.81.17.66]) by cc02mh.unity.ncsu.edu (8.8.7/8.8.7) with ESMTP id TAA05341 for <jkwilli2(a)unity.ncsu.edu>; Mon, 30 Nov 1998 19:04:39 -0500 (EST) Received: from ILovToHack(a)aol.com by imo22.mx.aol.com (IMOv16.10) id QVOZa08724 for <jkwilli2(a)unity.ncsu.edu>; Mon, 30 Nov 1998 19:01:47 +1900 (EST) Message-ID: <f7e063e.366331eb(a)aol.com> Date: Mon, 30 Nov 1998 19:01:47 EST To: jkwilli2(a)unity.ncsu.edu Mime-Version: 1.0 Subject: Re: more FUD! Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7bit X-Mailer: Casablanca - Windows sub 224 In a message dated 11/30/98 10:15:50 AM EST, jkwilli2(a)unity.ncsu.edu writes: > Get Your Private, Free, Encrypted Email at http://www.nsa.gov I looked around there site and couldnt find anything about geting a e-mail could you please be more specific. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use Charset: noconv iQEVAwUBNmM9eZDw1ZsNz1IXAQGp2ggAyiZR2yTdawgv5Dcrh4dOxpK1RCZD3+rL YgQEf9JlvhG43KpK5ZXJNwG46gLZ/G1utg1Ux3DfsotBgce8Y5xO1GdXm+SmSw3S fXlPSeeY93B+NQ5xaRHyLmMzV/YLMspNYKPZYuA+AI5XIWyL2fcWR8TcOpISWQ5r UQphc7KBhZfDIObJ5nJzkv8gIDHn4qvlBqhNcjukw3GvJ9Edm8vS/P3Jlm9wiuXW +kXWEVTX21xdBnG3iYdnQOyG69cmSQWKVN64Hetbi1tf0um2BJXQj82VOJtwbTp/ KFF650etU6OhrCnhV/Z/LYYNBYbG5r4/en2TbPyumIWd1DgujU8oNg== =ed5P -----END PGP SIGNATURE-----

1 0

student project suggestion; PGP trap and trace
by Anonymous 17 Dec '03

17 Dec '03

Given: if the adversary captures your PGP keyring, he will know your contacts. Your secure contacts. Therefore: it would be mighty nice if access to your keyring's address list required a passphrase (which perhaps was valid for several hours, it being a pain to retype a decent passphrase). You will note that the PGP plugins for Eudora allow any buffoon with access to your machine to discover who you talk to securely. --Laced aliens fried my pugs

1 0

Freedom & AnonymousIP network
by Austin Hill 17 Dec '03

17 Dec '03

This may be of interest to members of this list or people that you may all know. If you have any questions, or know of ISPs who support privacy on the Internet, please forward this to their attention. Thanks. -Austin --------------------------------------------------------------- Freedom Partnership Program: Value-Added Service For ISPs Zero-Knowledge Systems is currently in seeking ISPs to join as "Founding Members" in the Freedom Network. Freedom is revolutionary software that provides the first complete privacy solution to Internet users, including email, web-browsing, chat, telnet and Usenet. By allowing users to create and manage multiple authenticated identities and using full-strength cryptography, Internet users can also block SPAM and manage their person information. See http://www.zks.net for full details. Being a member of the Freedom Network will allow an ISP to differentiate itself from the competition while fighting for on-line privacy. The Freedom Partnership Program has been designed to be revenue generating and cost reducing for ISPs. Freedom software is provided free of charge to all ISPs. Internal beta-testing of the Freedom network will begin in mid-December, 1998 and the "Founding Members" of the Freedom Network should be prepared to begin working with our technical staff at that time. Beta testing should last 4-8 weeks. The Freedom server software runs on a Linux or Solaris operating system and needs to run on a dedicated machine. Server participants should be able to contribute a T-1 during the beta testing period. Members will also be entitled to proceeds from the revenue sharing program (after the beta testing period). The revenue sharing program is designed to provide ISPs with 110% - 130% of bandwidth costs. Participation has its advantages. Founding Member ISPs will receive "Preferred Member" status on our web-site and software. When users of the Freedom client do a search for an ISP by telephone area code, Founding Members will be the recommended ISP in a given geographical area. All Founding Members will be listed in relevant press releases made by Zero-Knowledge Systems. Founding Members will also be guaranteed to earn 10% on all click-thru sales (web-link program) for the next two years. Participating ISPs will also get "Prominent Placement" - have their company name/logo displayed on a high-traffic area of our web-site. Distinctive buttons and banners will be given to all founding members receive to put on their web-site. Initially, the Freedom Network will be comprised of 15 Founding Member ISPs which will be located around the world. We plan to have an ISP in each of the following areas: Canada(3) - east coast, central, west coast; U.S.A.(7) - northeast, northwest, southeast, southwest, west coast, silicon valley, Midwest; United Kingdom(1); Holland(1); Germany(1); Australia(1); and, the Caribbean(1). If you are interested in becoming a "Founding Member" or simply joining the Freedom Network or know of an ISP that would be interested, please contact Greg Adelstein, Director of Business Development, Zero-Knowledge Systems, greg(a)zks.net or 514-286-2636. -------------------------------------------------------- _________________________________________________________________________ Austin Hill Zero-Knowledge Systems Inc. President Montreal, Quebec Phone: 514.286.2636 Ext. 226 Fax: 514.286.2755 E-mail: austin(a)zks.net http://www.zks.net Zero Knowledge Systems Inc. - Nothing Personal PGP Fingerprints 2.6.3i = 3F 42 A2 0D AF 78 20 ED A2 BB AD BE 8B 40 5E 64 5.5.3i = 77 1E 62 21 B3 F0 EB C0 AA 6C 65 30 56 CA BA C4 94 26 EC 00 keys available at http://www.nai.com/products/security/public_keys/pub_key_default.asp _________________________________________________________________________

1 0