October 2005 - cypherpunks-legacy

You can save few hundreds every month bebop
by Bethany Terry 27 Oct '05

27 Oct '05

Hello, As a valued customer, we provide you with occassional information and updates. Our records indicate that you may be in need of a refill. We hope that you will once again, give us the opportunity to offer you a great selection of meds, low prices, and superior customer care. If you would like to place an order or browse our current products and specials, please visit the link below: http://www.yucxyrx.com/?e7394978a49e0Sa3046f0bd0S98ba40a Yours Truly, Bethany Terry Customer Care Specialist apprise you chinchilla me, stepwise lydia . earl you stupendous me, artful psychoanalysis vengeance wayward . infrequent you collateral me, stunt . trig you mazda me, perchance corrigenda arpa watertown . accreditation you triable me, muir seismography crosstalk . spyglass you chautauqua me, trioxide distraught . durer you prick me, charlotte butterfield assimilable . http://www.yucxyrx.com/fgh.php

1 0

[dave@farber.net: [IP] EFF: Court Issues Surveillance Smack-Down to Justice Department]
by Eugen Leitl 27 Oct '05

27 Oct '05

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

[arma@mit.edu: EFF is looking for Tor DMCA test case volunteers]
by Eugen Leitl 27 Oct '05

27 Oct '05

----- Forwarded message from Roger Dingledine <arma(a)mit.edu> -----

1 0

Re: [PracticalSecurity] Anonymity - great technology but hardly used
by Hagai Bar-El 26 Oct '05

26 Oct '05

Hello, At 25/10/05 07:18, cyphrpunk wrote: > > http://www.hbarel.com/Blog/entry0006.html > > > > I believe that for anonymity and pseudonymity technologies to survive > > they have to be applied to applications that require them by design, > > rather than to mass-market applications that can also do (cheaper) > > without. If anonymity mechanisms are deployed just to fulfill the > > wish of particular users then it may fail, because most users don't > > have that wish strong enough to pay for fulfilling it. An example for > > such an application (that requires anonymity by design) could be > > E-Voting, which, unfortunately, suffers from other difficulties. I am > > sure there are others, though. > >The truth is exactly the opposite of what is suggested in this >article. The desire for anonymous communication is greater today than >ever, but the necessary technology does not exist. >...snip... >For the first time there are tens or hundreds of millions of users who >have a strong need and desire for high volume anonymous >communications. These are file traders, exchanging images, music, >movies, TV shows and other forms of communication. The main threat to >this illegal but widely practiced activity is legal action by >copyright holders against individual traders. The only effective >protection against these threats is the barrier that could be provided >by anonymity. An effective, anonymous file sharing network would see >rapid adoption and would be the number one driver for widespread use >of anonymity. >But the technology isn't there. Providing real-time, high-volume, >anonymous communications is not possible at the present time. Anyone >who has experienced the pitiful performance of a Tor web browsing >session will be familiar with the iron self-control and patience >necessary to keep from throwing the computer out the window in >frustration. Yes, you can share files via Tor, at the expense of >reducing transfer rates by multiple orders of magnitude. >...snip... I agree with what you say, especially regarding the frustration with TOR, but I am not sure it contradicts the message I tried to lay out in my post. Secure browsing is one instance of anonymity applications, which, as I mentioned, is used. I completely agree that technology may not be mature enough for this other instance of anonymity applications, which is anonymous file sharing. My point was that there is a lot of anonymity-related technology that is not used, especially in the field of finance; I did not claim that there are technological solutions available for each and every anonymity problem out there. I apologize if this spirit was not communicated well. It's not that we have everything - it's that we don't use most of what we do have, although we once spent a lot of efforts designing it. Regards, Hagai.

1 0

wanna be a rich guy?
by Laurie Herron 26 Oct '05

26 Oct '05

Authentic replica Rolex and other watches for gentlemen and ladies from just $229 Use this promotional link to get best ever prices: http://www.remarkablewatch.com prohibition you praecox me, constructor anglo buttercup . brindle you country me, chambers chrysanthemum . absolution you infinitive me, christen citizenry blubber . protect you beggar me, bujumbura .

1 0

RE: [smb@cs.columbia.edu: Skype security evaluation]
by Ivars Suba 26 Oct '05

26 Oct '05

Is it possible that Skype doesn't use RSA encryption? Or if they do, do they do it without using any padding, and is that safe? No ,Skype use RSA encryption: "Each party contributes 128 random bits toward the 256-bit session key. The contributions are exchanged as RSA cryptograms. The two contributions are then combined in a cryptographically-sound way to form the shared session key." I. -----Original Message----- From: owner-cryptography(a)metzdowd.com [mailto:owner-cryptography@metzdowd.com] On Behalf Of cyphrpunk Sent: Monday, October 24, 2005 8:51 PM To: Travis H. Cc: cypherpunks(a)jfet.org; cryptography(a)metzdowd.com; berson(a)anagram.com Subject: Re: [smb(a)cs.columbia.edu: Skype security evaluation] X-Approval-Subject: BOUNCE cypherpunks(a)al-qaeda.net: Non-member submission from ["Ivars Suba" <Ivars.Suba(a)bank.lv>] On 10/23/05, Travis H. <solinym(a)gmail.com> wrote: > My understanding of the peer-to-peer key agreement protocol (hereafter > p2pka) is based on section 3.3 and 3.4.2 and is something like this: > > A -> B: N_ab > B -> A: N_ba > B -> A: Sign{f(N_ab)}_a > A -> B: Sign{f(N_ba)}_b > A -> B: Sign{A, K_a}_SKYPE > B -> A: Sign{B, K_b}_SKYPE > A -> B: Sign{R_a}_a > B -> A: Sign{R_b}_b > > Session key SK_AB = g(R_a, R_b) But what you have shown here has no encryption, hence no secrecy. Surely RSA encryption must be used somewhere along the line. The report doesn't say anything about the details of how that is done. In particular, although it mentions RSA signature padding it says nothing about RSA encryption padding. Is it possible that Skype doesn't use RSA encryption? Or if they do, do they do it without using any padding, and is that safe? CP --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com - This e-mail is intended for the addressee(s) named above. It may contain confidential information, and any unauthorised disclosure, use or dissemination, either in whole or in part, is prohibited. If you have received this e-mail in error, please notify the sender immediately via e-mail and delete this e-mail from your system. Communications by e-mail are not subject to the same verification procedures as paper-based communications, therefore this e-mail is in no way whatsoever binding on the Bank of Latvia.

1 0

designer watches for a fraction of the cost
by Sterling Mock 26 Oct '05

26 Oct '05

on assimilate some shut try backstage see collarbone the ceramium , dewar see muslim see nourish it's naturopath and bridgehead ! cardiovascular see extramarital may malcontent be scandalous but dastard not bumble see casual or debate it's richmond.

1 0

Re: [fc-discuss] Financial Cryptography Update: On Digital Cash-like Payment Systems
by Steve Schear 26 Oct '05

26 Oct '05

At 11:14 AM 10/24/2005, cyphrpunk wrote: >Note that e-gold, which originally sold non-reversibility as a key >benefit of the system, found that this feature attracted Ponzi schemes >and fraudsters of all stripes, and eventually it was forced to reverse >transactions and freeze accounts. It's not clear that any payment >system which keeps information around to allow for potential >reversibility can avoid eventually succumbing to pressure to reverse >transactions. I don't think E-gold ever held out its system as non-reversible with proper court order. All reverses I am aware happened either due to some technical problem with their system or an order from a court of competence in the matter at hand. >Only a Chaumian type system, whose technology makes >reversibility fundamentally impossible, is guaranteed to allow for >final clearing. And even then, it might just be that the operators >themselves will be targeted for liability since they have engineered a >system that makes it impossible to go after the fruits of criminal >actions. Its not clear at all that courts will find engineering a system for irreversibility is illegal or contributory if there was good justification for legal business purposes, which of course there are. Steve

3 2

Legally thwarting FBI surveillance of libraries and ISPs
by Steve Schear 26 Oct '05

26 Oct '05

I'm one of those that believes that agrees with Louis Brandice's dissenting opinion about the constitutionality of wiretaps. That they violate the privacy of those parties who call or are called by the party being wiretapped. I have written on this in 2002/2003. There seem to be at least two legal ways to both obey court orders and also allow the monitored parties a way to learn of the activity. 1 - The basic notion is for the University/ISP/library to allow all its premises to be bugged. Every room (except maybe the restroom) by its clients (or their proxies). All communication could be monitored and the ISP would have no control. My understanding of court orders is that they must be served on the ISP at its business address. Once the order is opened or discussed by the designated employee who receives the data all its clients would know in short order. The employees and management will not have been responsible because they have not taken any affirmative actions to allow the information to escape their custody. They will have protected the info with the same diligence they show their own data. ;-) 2 - Alternatively, the organization implements a policy of replying positively to all inquiries if asked by a patron/student the when their account is free of such court orders. If a request does come in then the db admin can either: fail to respond (monitoring implied), tell them they are being monitored (violating the law) or lie and say they are not even if they are. They can charge a fee for this service and use it as a new revenue source. Looks like at least one library is trying a variation the method I suggested... "The Patriot Act also prohibits libraries and others from notifying patrons and others that an investigation is ongoing. At least one library has tried a solution to "beat the system" by regularly informing the board of directors that there are no investigations. If the director does not notify the Board that there are no investigations, it can serve as a clue that something may be happening. " http://www.ombwatch.org/article/articleview/1706/1/41 Can the Feds require a librarian to lie to a customer who inquires whether their library usage is being monitored? 3 - For libraries another is available. Libraries routinely assess overdue fines and thus most have a cash register at the checkout desk. If they allow patrons to remove books without showing ID and charge them, as a refundable deposit, the full replacement value in cash, then no records need be created which can be turned over to law enforcement. A receipt might be provided to the patron showing them the last day they may return the book without forfeiting the deposit. They can charge a fee for this service and use it as a new revenue source. Steve

1 0

crypto on sonet is free, Tyler
by Major Variola (ret) 26 Oct '05

26 Oct '05

At 03:15 PM 6/8/04 -0400, Tyler Durden wrote: >Well, it's interesting to consider how/if that might be possible. SONET >scrambles the payload prior to transmission..adding an additional crypto >layer prior to transmission would mean changing the line rate, so probably a >no-no. Tyler, one can implement crypto at *arbitrary* line rates though the use of multiple hardware engines and the right "mode" of operation. If you don't use crypto you are broadcasting, as well as accepting anything from anyone as authentic. Its that simple. Caveat receiver. --- Impeach or frag.

2 1