August 2003 - cypherpunks-legacy

RSA Seeks to Fix RFID Worries (fwd)
by Jim Choate 25 Aug '03

25 Aug '03

http://www.eweek.com/article2/0,3959,1229502,00.asp -- -- ravage(a)ssz.com jchoate(a)open-forge.com www.ssz.com www.open-forge.com

1 0

Cypherpunks List Info
by cpunk＠lne.com 24 Aug '03

24 Aug '03

Cypherpunks Mailing List Information Last updated: Sep 12, 2002 This message is also available at http://www.lne.com/cpunk Instructions on unsubscribing from the list can be found below. 0. Introduction The Cypherpunks mailing list is a mailing list for discussing cryptography and its effect on society. It is not a moderated list (but see exceptions below) and the list operators are not responsible for the list content. Cypherpunks is a distributed mailing list. A subscriber can subscribe to one node of the list and thereby participate on the full list. Each node (called a "Cypherpunks Distributed Remailer", although they are not related to anonymous remailers) exchanges messages with the other nodes in addition to sending messages to its subscribers. A message posted to one node will be received by the list subscribers on the other nodes, and vice-versa. 1. Filtering The various CDRs follow different policies on filtering spam and to a lesser extent on modifying messages that go to/from their subscribers. Filtering is done, on nodes that do it, to reduce the huge amount of spam that the cypherpunks list is subjected to. There are three basic flavors of filtering CDRs: "raw", which send all messages to their subscribers. "cooked" CDRs try to eliminate the spam on that's on the regular list by automatically sending only messages that are from cypherpunks list subscribers (on any CDR) or people who are replying to list messages. Finally there are moderated lists, where a human moderator decides which messages from the raw list to pass on to subscribers. 2. Message Modification Message modification policy indicates what modifications, if any, beyond what is needed to operate the CDR are done (most CDRs add a tracking X-loop header on mail posted to their subscribers to prevent mail loops). Message modification usually happens on mail going in or out to each CDR's subscribers. CDRs should not modify mail that they pass from one CDR to the next, but some of them do, and others undo those modifications. 3. Privacy Privacy policy indicates if the list will allow anyone ("open"), or only list members, or no one ("private") , to retrieve the subscribers list. Note that if you post, being on a "private" list doesn't mean much, since your address is now out there. It's really only useful for keeping spammers from harvesting addresses from the list software. Digest mode indicates that the CDR supports digest mode, which is where the posts are batched up into a few large emails. Nodes that support only digest mode are noted. 4. Anonymous posting Cypherpunks encourages anonymous posting. You can use an anonymous remailer: http://www.andrebacard.com/remail.html http://anon.efga.org/Remailers http://www.gilc.org/speech/anonymous/remailer.html or you can send posts to the list via cpunks_anon(a)einstein.ssz.com and your mail's headers will be stripped before posting. Note that this doesn't provide complete anonymity since the receiving site will still have log file entries showing the source of the mail (or you have to trust that they delete them). You also will be 'sharing' a reputation with the other entities that post through this alias, and some of them are spammers, so some subscribers will have this alias filtered. 5. Unsubscribing Unsubscribing from the cypherpunks list: Since the list is run from a number of different CDRs, you have to figure out which CDR you are subscribed to. If you don't remember and can't figure it out from the mail headers (hint: the top Received: line should tell you), the easiest way to unsubscribe is to send unsubscribe messages to all the CDRs listed below. How to figure out which CDR you are subscribed to: Get your mail client to show all the headers (Microsoft calls this "internet headers"). Look for the Sender or X-loop headers. The Sender will say something like "Sender: owner-cypherpunks(a)lne.com". The X-loop line will say something like "X-Loop: cypherpunks(a)lne.com". Both of these inticate that you are subscribed to the lne.com CDR. If you were subscribed to the algebra CDR, they would have algebra.com in them. Once you have figured out which CDR you're subscribed to, look in the table below to find that CDRs unsubscribe instructions. 6. Lunatics, spammers and nut-cases "I'm subscribed to a filtering CDR yet I still see lots of junk postings". At this writing there are a few sociopaths on the cypherpunks list who are abusing the lists openness by dumping reams of propaganda on the list. The distinction between a spammer and a subscriber is nearly always very clear, but the dictinction between a subscriber who is abusing the list by posting reams of propaganda and a subscriber who is making lots of controversial posts is not clear. Therefore, we tolerate the crap. Subscribers with a low crap tolerance should check out mail filters. Procmail is a good one, although it works on Unix and Unix-like systems only. Eudora also has a capacity for filtering mail, as do many other mail readers. An example procmail recipie is below, you will of course want to make your own decisions on which (ab)users to filter. # mailing lists: # filter all cypherpunks mail into its own cypherspool folder, discarding # mail from loons. All CDRs set their From: line to 'owner-cypherpunks'. # /dev/null is unix for the trash can. :0 * ^From.*owner-cypherpunks@.* { :0: * (^From:.*ravage@ssz\.com.*|\ ^From:.*jchoate@dev.tivoli.com.*|\ ^From:.*mattd@useoz.com|\ ^From:.*proffr11@bigpond.com|\ ^From:.*jei@cc.hut.fi) /dev/null :0: cypherspool } 7. List of current CDRs All commands are sent in the body of mail unless otherwise noted. --------------------------------------------------------------------------- Algebra: Operator: Subscription: "subscribe cypherpunks" to majordomo(a)algebra.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)algebra.com Help: "help cypherpunks" to majordomo(a)algebra.com Posting address: cypherpunks(a)algebra.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- CCC: Operator: drt(a)un.bewaff.net Subscription: "subscribe [password of your choice]" to cypherpunks-request(a)koeln.ccc.de Unsubscription: "unsubscribe <password>" to cypherpunks-request(a)koeln.ccc.de Help: "help" to to cypherpunks-request(a)koeln.ccc.de Web site: http://koeln.ccc.de/mailman/listinfo/cypherpunks Posting address: cypherpunks(a)koeln.ccc.de Filtering policy: This specific node drops messages bigger than 32k and every message with more than 17 recipients or just a line containing "subscribe" or "unsubscribe" in the subject. Digest mode: this node is digest-only NNTP: news://koeln.ccc.de/cbone.ml.cypherpunks Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Infonex: Subscription: "subscribe cypherpunks" to majordomo(a)infonex.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)infonex.com Help: "help cypherpunks" to majordomo(a)infonex.com Posting address: cypherpunks(a)infonex.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Lne: Subscription: "subscribe cypherpunks" to majordomo(a)lne.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)lne.com Help: "help cypherpunks" to majordomo(a)lne.com Posting address: cypherpunks(a)lne.com Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to lne CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. messages are demimed (MIME attachments removed) when posted through lne or received by lne CDR subscribers 2. leading "CDR:" in subject line removed 3. "Reply-to:" removed Privacy policy: private Info: http://www.lne.com/cpunk; "info cypherpunks" to majordomo(a)lne.com Archive: http://archives.abditum.com/cypherpunks/index.html (thanks to Steve Furlong and Len Sassaman) --------------------------------------------------------------------------- Minder: Subscription: "subscribe cypherpunks" to majordomo(a)minder.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)minder.net Help: "help" to majordomo(a)minder.net Posting address: cypherpunks(a)minder.net Filtering policy: raw Message Modification policy: no modification Privacy policy: private Info: send mail to cypherpunks-info(a)minder.net --------------------------------------------------------------------------- Openpgp: [openpgp seems to have dropped off the end of the world-- it doesn't return anything from sending help queries. Ericm, 8/7/01] Subscription: "subscribe cypherpunks" to listproc(a)openpgp.net Unsubscription: "unsubscribe cypherpunks" to listproc(a)openpgp.net Help: "help" to listproc(a)openpgp.net Posting address: cypherpunks(a)openpgp.net Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Ssz: Subscription: "subscribe cypherpunks" to majordomo(a)ssz.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)ssz.com Help: "help cypherpunks" to majordomo(a)ssz.com Posting address: cypherpunks(a)ssz.com Filtering policy: raw Message Modification policy: Subject line prepended with "CDR:" Reply-to cypherpunks(a)ssz.com added. Privacy policy: open Info: http://www.ssz.com/cdr/ --------------------------------------------------------------------------- Sunder: Subscription: "subscribe" to sunder(a)sunder.net Unsubscription: "unsubscribe" to sunder(a)sunder.net Help: "help" to sunder(a)sunder.net Posting address: sunder(a)sunder.net Filtering policy: moderated Message Modification policy: ??? Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- Pro-ns: Subscription: "subscribe cypherpunks" to majordomo(a)pro-ns.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)pro-ns.net Help: "help cypherpunks" to majordomo(a)pro-ns.net Posting address: cypherpunks(a)pro-ns.net Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to local CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. leading "CDR:" in subject line removed 2. "Reply-to:" removed Privacy policy: private Info: http://www.pro-ns.net/cpunk

1 0

'Lincoln's Constitution': Desperate Times, Desperate Measures
by R. A. Hettinga 23 Aug '03

23 Aug '03

The usual statist apologia for statist apologia... Cheers, RAH ------- <http://nytimes.com/2003/08/24/books/review/24POSNERT.html?pagewanted=print&…> The New York Times August 24, 2003 'Lincoln's Constitution': Desperate Times, Desperate Measures By RICHARD A. POSNER LINCOLN'S CONSTITUTION By Daniel Farber. 240 pp. Chicago: The University of Chicago Press. $27.50. Since Sept. 11, 2001, the United States has been at war. It is a war unlike our previous wars, but it is a war nevertheless. War places law under pressure, and so it is timely to consider the pressure exerted on law by our previous wars, a pressure that was greatest during the Civil War. Hence ''Lincoln's Constitution,'' by Daniel Farber, a professor of law at the University of California, Berkeley, and the University of Minnesota. Farber addresses two topics. The first is the relation between the federal government and the states. Farber asks whether secession was lawful and, if not, what means were lawful to combat it. The second topic is the curtailment of civil liberties, and other constitutionally highhanded actions by Lincoln. Here the question is whether Lincoln upset the balance between the executive and the legislative and judicial branches of the federal government. Farber makes a workmanlike lawyer's case for the constitutionality of most of Lincoln's controversial measures, yet in doing so seems somehow to miss the point. In defense of suspending habeas corpus, a power that the Constitution seems pretty clearly to reserve for Congress (though Farber disagrees), Lincoln asked rhetorically and, as it seems to me, unanswerably, ''Are all the laws, but one, to go unexecuted, and the government itself go to pieces, lest that one be violated?'' In the weeks following Lincoln's inauguration, and indeed for the first two years of the war (until the almost simultaneous Union victories at Gettysburg and Vicksburg), the outcome of the Civil War was in doubt. Suspending habeas corpus may have been one of the measures that kept the Union going during this very dangerous period. The suspension not only enabled thousands of rebels and subversives to be detained without access to judges, many of whom were sympathetic to the Southern cause, but also showed Lincoln to be resolute, indeed ruthless, in the prosecution of the war. Resoluteness in times of great danger is essential to staving off defeatism; it goes some distance in explaining why Britain withstood the Nazi onslaught in 1940 and France did not. Farber is a law professor, not a historian. His method is that of close study of the constitutional text, the original understanding of the text's meaning and the Supreme Court's decisions interpreting and applying the text. The discussion is lucid and often ingenious, and the research, so far as I can judge, meticulous. But there is something rather odd about the enterprise, given that Farber is one of the relatively small band of law professors who explicitly defend pragmatism as the right way for judges and lawyers to think about law, especially American constitutional law. ''Pragmatism'' for these purposes may be defined as an overriding concern for the practical consequences, long-term as well as short-term, of constitutional principles -- as distinct from a more lawyerly insistence that such principles be ''logically'' derivable from orthodox legal materials, like the constitutional text, its understanding by the text's authors or ratifiers and previous judicial decisions from which rules applicable to new cases can be deduced. The pragmatic approach is forward-looking, asking what the decision in a case will do for us, the living. The orthodox lawyer's approach is backward-looking, asking what outcome would have the longer or better legal pedigree -- that is, would correspond more closely to some authoritative enactment or pronouncement in the past. The greater the practical consequences of a legal principle or decision, the more attractive the pragmatic approach is. That makes it a natural approach to take to constitutional law. Not only does the Constitution deal with matters of great practical significance, but it is very hard to amend, which magnifies the consequences of judicial decisions construing it. The most critical episode in the history of the United States was the Civil War. Never was the need for adjusting the law to pragmatic realities greater. Farber is not oblivious of this issue -- how could he be? -- yet it barely figures in his analysis, which is preoccupied with esoteric questions like ''the precise locus of American sovereignty.'' He makes the interesting point that the Supreme Court's recent states' rights decisions echo some of the arguments made by Jefferson Davis in support of secession, but he comments unpragmatically that ''the fact that these arguments can be deployed even today and can win the assent of . . . justices proves their durability and continuing allure.'' Pragmatists doubt that abstract arguments are what move Supreme Court justices; those arguments are, rather, the rhetorical decor of decisions reached on other, more practical grounds. Those who think it would have been disastrous had the secession succeeded will be inclined to believe that Lincoln was right to suspend habeas corpus. Was he legally right? That is a different question. One answer is that whatever measures are necessary to save the nation from suicide are, if not compelled, at least permitted by the Constitution, whatever the text, history or precedents might seem to imply. There are no limits to lawyers' ingenuity, and Farber is able to generate plausible arguments for the constitutionality of most of Lincoln's acts. With a little more effort he could defend all of them as lawful. For example, Farber endorses a particularly facile ''legal'' justification for Lincoln's suspension of habeas corpus: that since the president can use deadly force against rebels, he should be allowed to detain them indefinitely. But habeas corpus enables a court to determine whether a detained person is a rebel. That is why we try criminals rather than lynch them. (Moreover, Farber slides too easily from the question of whether Lincoln was authorized to suspend habeas corpus to whether he was authorized to flout Chief Justice Roger Taney's order granting habeas corpus, as he did. Officials are obliged to obey judicial orders even when erroneous.) There is a pragmatic argument against this approach, an argument for saying that Lincoln was right to do what he did -- in fact had no choice -- but that what he did violated the Constitution. In this view, it would have been a kind of treason had Lincoln been scrupulous in observing the limitations that the Constitution placed on his authority. There is value in distinguishing what is right from what is legal in order to avoid creating precedents that subsequent presidents might invoke in less exigent circumstances. One wouldn't want presidential suspensions of habeas corpus to become a habit. Article 48 of the Weimar Constitution allowed the president of the German Republic to suspend the Constitution in situations of emergency. The presidents invoked the power frequently, creating precedents for Hitler to employ when he took power in 1933. That is a pragmatic argument for limiting the pragmatic interpretation of our Constitution. Nonetheless, when the pressure of the practical is as enormous as it was in the Civil War, the marking off of nice legal distinctions has almost a frivolous air. Farber argues that Lincoln acted unconstitutionally when at the outset of the Civil War he used government money to pay people to recruit soldiers for the Union Army, because there was no Congressional appropriation for this purpose, and when he invited volunteers to join the Regular Army, because the raising of armies is a Congressional prerogative. It is one thing to say that the Constitution reserves the ominous power to suspend habeas corpus for Congress, and another to say that the Constitution is to be interpreted so literally that a president must use subterfuge to raise armies during a national emergency. That is the kind of literalism that would forbid the creation of the Air Force as a separate branch of the armed forces because the Constitution authorizes Congress to create and regulate only land and nava! l forces. It is curious to find a pragmatist like Farber sympathetic to such casuistry. But I do not want to end on a critical note. Farber has written a timely and important book, which should provoke fruitful discussion of enduring issues of civil liberties and judicial philosophy. Richard A. Posner's most recent book is ''Law, Pragmatism, and Democracy.'' He is a judge on the United States Court of Appeals for the Seventh Circuit. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: paradoxes of randomness
by Sarad AV 23 Aug '03

23 Aug '03

hi, Okay- I need 5 bits to represent 32 coins.I count as coin 0,coin 1,... coin 31. If it is a perfectly random fair coin throwing experiment,then 50 percent of them will be heads. So I know that 16 of them will be heads. What we do is i simply place all the 32 coins on the table in a row or column. I look at the first coin and determine if it is a head or a tail. I repeat the same proccess till i count 16 heads. If I count 15 heads at coin 31, then I cant reduce the entropy. How ever, if i count 16 heads at coin 30,then I dont have to check that coin 31,I already know its a tail,so I have less than 5 bits of entropy. So if it is a perfectly random experiment,I wouldn't get 16 heads before i look at coin 31,which is the last coin and thats what you said-isn't it? So how did chaitin get to compress the information from k instances of the turing machine in http://www.cs.umaine.edu/~chaitin/summer.html under the sub-section redundant? he says- "Is this K bits of mathematical information? K instances of the halting problem will give us K bits of Turing's number. Are these K bits independent pieces of information? Well, the answer is no, they never are. Why not? Because you don't really need to know K yes/no answers, it's not really K full bits of information. There's a lot less information. It can be compressed. Why? " If the input programs are truely random-there is no redundancy and thats a contradiction to the claim in the paper. Thanks. Regards Sarath. >It's simple, if I am correct. The redundancy simply > makes you care > less about the specific instance you are looking at. > > > To represent 32 coins-i need 5 bits of > information. > > Since the experiment is truely random-i know half > of > > them will be heads,so in this case using 5 bits of > > information,i can determine all the coins that are > > heads and that are tails. > > Same deal, unless you are counting pairs, in which > case you cannot > distinguish between the members of a pair. You need > an extra bit to > tell a head from a tail. > > > So-the question is what is the minimum number of > bits > > or entropy required to determine which all coins > are > > heads and which all coins are tails,is it 5 bits > or 6 > > bits of information? > > With 5 bits, you can count to 31, so you need 6. > > Just my two tails. > __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

6 14

RE: JAP back doored
by Vincent Penquerc'h 23 Aug '03

23 Aug '03

> JAP was back doored by court order. It was a forced upgrade (after a > service interruption) to monitor "one site" that continues to be Still useful to protect against third party eavesdroppers, I guess. Short of onion routing, are there any other services like that around, apart from the likes of anonymizer.com ? I've been using JAP for some time, but mainly to hide my IP from visited sites. Guess I'll keep on using it. I'm on Win32 BTW, as headers indicate. I'm at work, too paranoid to access Internet from my own Unix box ;) -- Vincent Penquerc'h

3 2

A little more about CDROMs
by Thomas Shaddack 22 Aug '03

22 Aug '03

http://www.wired.com/news/medtech/0,1286,60138,00.html Summary: Coating a CD by a reagent, then exposing it to a sample that changes its color, then counting read errors on the CD. Maybe could be a nice application for the lowest-level laser signal access I proposed earlier. (It apparently really could have some unexpected applications beyond CD copying, Tim.)

1 0

Re: Popular Net anonymity service back-doored (fwd)
by Thomas Shaddack 22 Aug '03

22 Aug '03

Yet more info. Let's not overreact before we get complete dataset. ---------- Forwarded message ---------- Date: Fri, 22 Aug 2003 09:34:27 +0200 Subject: Re: Popular Net anonymity service back-doored From: nordi <nordi(a)addcom.de> To: bugtraq(a)securityfocus.com, full-disclosure(a)lists.netsys.com On Thursday, 21. August 2003 14:05, Thomas C. Greene wrote: > It's not secure, and claiming that it is taints anything else they may be > doing on behalf of users. They're *still* saying it's impossible for anyone > to intercept users' traffic or identify them. Actually, this is absolutely not what they are saying. When you visit the website of the JAP project http://anon.inf.tu-dresden.de/ it says in big, red letters: "Aus aktuellem Anlass weisen wir noch einmal ausdr|cklich daraufhin, dass sich die JAP Software in Entwicklung befindet und noch nicht maximale Sicherheit bietet. (siehe unten ... )" In English this means something like "Due to recent events we explicitly inform you of the fact that the JAP software is still being developed and does not yet provide maximum security. (see below ...)" As I said: big, red letters at the top of their main page. And when you click that "see below" link it says there "Attention! [...] This version does NOT yet implement the security features described above and desired by us. But it does alread protect you against atackers that control the net only locally at one place such as [...] the owner of a mix." So by the time you download that software you should have already read _two_ statements telling you that JAP is not as secure as it could be. It also tells you that in the current configuration, the JAP people can see all your traffic if they want to: Note that it says it will protect you against "the owner of _A_ mix". But if you take the Dresden-Dresden cascade, the JAP people obviously control _all_ of them. And the above statement already implies that in this case, JAP cannot protect you. If you still want to use JAP, http://www.heise.de/newsticker/data/uma-20.08.03-000/ (in German) tells you how to do it securely: simply use just a single mix that is not controlled by the JAP project and you'll be fine. The court order is only valid for the JAP people, so everybody else in Germany (and elsewhere of course) can offer a non-backdoored mix which will make the cascade secure. This actually means that all cascades but the Dresden-Dresden one are secure. MfG nordi -- Denn der Menschheit drohen Kriege, gegen welche die vergangenen wie armselige Versuche sind, und sie werden kommen ohne jeden Zweifel, wenn denen, die sie in aller Vffentlichkeit vorbereiten, nicht die Hdnde zerschlagen werden. Bertolt Brecht, 1952

2 1

SIGINT thesis
by Major Variola (ret) 22 Aug '03

22 Aug '03

This from cryptography mailing list (URL corrected from orig): Some people on this list may be interested in http://www.staff.ncl.ac.uk/d.f.j.wood/thesis_index.htm (Note: I haven't read more than Chapter 1.)

1 0

Re: Popular Net anonymity service back-doored (fwd)
by Thomas Shaddack 22 Aug '03

22 Aug '03

More informations. ---------- Forwarded message ---------- Date: Thu, 21 Aug 2003 20:38:46 +0200 Subject: Re: Popular Net anonymity service back-doored From: Florian Weimer <fw(a)deneb.enyo.de> To: bugtraq(a)securityfocus.com, full-disclosure(a)lists.netsys.com Cc: Thomas C. Greene <thomas.greene(a)theregister.co.uk> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 "Thomas C. Greene " <thomas.greene(a)theregister.co.uk> writes: > traffic might be going straight to Big Brother, right? Wrong. After taking > the service down for a few days with the explanation that the interruption > was "due to a hardware failure", the operators then required users to install > an "upgraded version" (ie. a back-doored version) of the app to continue > using the service. This is technically incorrect. As far as I know, the client update is completely unrelated. The logging functionality has been implemented in the mixes themselves, otherwise you would be able to circumvent it by using a different client. The CVS commit occured on 2003-06-27. Logging is implemented this way: if the last mix in the cascade (which sees the request in the clear) detects a suspicious request, it is logged together with an ID. The ID is transmitted (through the cascade) to the first mix, which logs the ID and the IP address. Combining the two log files, it is possible to collapse the cascade and backtrack the requests. This exploits that TU Dresden operates both the first and last mix in the Dresden--Dresden cascade (which is the only that works reliably, AFAIK). An employee of TU Dresden described this scheme in an interview with Heise Online, a German online news site, back in October 2001. He announced an implementation within the next six months, but I don't know at the moment if he was speaking for the JAP project as a whole, or if he was just expressing his own ideas. According to the news sources I have read, the court requested surveillance based on the target IP address. However, the source code does not contain code to monitor specific (target) IP addresses, but an elaborate URL screening facility, based on regular expressions. Just by specifying ".*", it should be possible to log all requests (and the corresponding IP addresses). I don't know why the source code doesn't implement the surveillance based on IP addresses, as the court allegedly requested. > "What was the alternative? Shutting down the service? The security > apparatchiks would have appreciated that - anonymity in the Internet > and especially AN.ON are a thorn in their side anyway." Note that this kind of target-based monitoring would be much harder on the plain Internet unless the remote site is willing to cooperate. A broken anonymizer makes this type of surveillance quite easy. > But that's not the point. Disclosure is the point. The JAP Web site still > claims that anonymity is sacrosanct: "No one, not anyone from outside, not > any of the other users, not even the provider of the intermediary service can > determine which connection belongs to which user." The official declaration ("Selbstverpflichtung") of the mixes, which promises that neither logging will be enabled nor backdoors will be implemented, hasn't been updated either. However, perhaps the JAP team at TU Dresden hadn't much choice. I haven't seen the court order, but I could imagine that they weren't allowed to inform the users because it would have harmed the criminal investigation. Following the order while fighting it within the legal system is perhaps a wiser choice than just resisting it (and thus breaking the law yourself). But I agree that it takes them awfully long to update their web site, now that some information is public. Finally, they could have avoided all the hassle if they hadn't published the source code. Why did they publish? I don't believe it's an accident. For BUGTRAQ readers: Symantec strips message headers. The original To: and Cc: are:

2 1

Re: Is it time to kill the JAP backdoor cretins and their families?
by An Metet 22 Aug '03

22 Aug '03

>It would be easy for me to say that all of the operators connected with JPE Maybe this is the place to post their names, for posterity.

1 0