- cypherpunks-legacy - lists.cpunks.org

Send Me The Stuff
by Master-X 17 Dec '03

17 Dec '03

Please e-mail me with the stuff.

1 0

Re: The Remailer Crisis
by Jaeson.M.Engle＠josaiah.sewanee.edu 17 Dec '03

17 Dec '03

>But is your Mac on the Internet on a more or less continuous basis? A >remailer that only works when the owner happens to log on to collect >his mail is not terribly useful (though not useless, as others have >also noted....just a "very unpredictable lag time" remailer, sort of >the "surface mail" of e-mail). Yes, my machine has a 56k direct line in, 24 hrs. a day, 7 days a week (during school months!;-)) The server you just mailed to is on this machine. >It happens that the Net is mainly built up of Unix boxes, hence the >focus here on Unix. OS/2, Windows, and Mac boxes will be used >increasinly for constant connection applications, so the idea has >merit, long term. I understand this, and am trying my best to cope. I am currently in the process of developing a name server for the Mac, because the Mac has alot against it when it comes to being a real eintity on the 'Net. >(Another nit: the Mac, which is what I also use, currently lacks >preemptive multitasking. Thus, if one's Mac is playing a multimedia >CD-ROM when new mail comes in, it likely won't get remailed until the >first app quits or is manually switched out. (Yeah, a few things like >print drivers can run in background, and maybe the new TIA emulators >can trick the OS into processing SLIP or PPP mail in the background, >but who knows?) The consensus is that the Mac is powerful, but it >ain't cut out yet to be a Unix box.) I agree that the Mac lacks some of the more powerful Unix features, namely preemtive multitasking, but I also believe that, at least with the newer Macs, CPU time-sharing is more efficient than it used to be. Know of Chuck Shotton's MacHTTP WWW server for the Mac? An excelent piece of software that gives literally on demand, and at least with my copy, it is always in the background. Really about the only thing that cuts out CPU timesharing is multimedia, mostly 3D grahpis games and highly intense graphics software, neither of which I use (much!;-)) >The language is a lesser deal. Remember that Eric Hughes knocked out >the first remailer in Perl in a few days, and MacPerl exists for the >Mac. Going to Pascal would probably be more trouble than it's worth. I thought that it was in Perl. I have tried pulling Unix Perl scripts and running them under MacPerl, but it doesn't quite do it. In fact, it usually doesn't do anything but spew errors back at you. >But the most important feature to have is a solid, reliable connection >to the Net. A computer that gets taken to classes, is not connected to >the Net, etc., is not very useful as a remailer. As I noted, I have a constant 56k line in/ out. And mine never moves... it's a bit large... mine is a Quadra 660av (ugh). >(The key is not that a remailer can sometimes remail, but that it can >be counted on to be part of chain without the mail getting "dropped on >the floor.") > >--Tim May As far as I can tell, and maybe you have other knowedge on this, my situation should work, assuming I can run the software. What do you think? Should the remailer Perl script run under MacPerl? aka: (-: Jaeson M. Engle || jme(a)josaiah.sewanee.edu :-) (-: www server: http://josaiah.sewanee.edu/ :-) (-: It's February 3rd! IT'S TIME!!! Ask me for details!:-) (-: Finger 'jme(a)josaiah.sewanee.edu' for my Public :-) PGP block.

3 2

Re: Why emoney? Why not a web of debt?
by Anonymous 17 Dec '03

17 Dec '03

> Date: Fri, 20 Jan 1995 19:36:34 -0500 > From: jrochkin(a)cs.oberlin.edu (Jonathan Rochkind) > > Certainly, that's what money is after all. Pretty much. But how are you > going to transfer these IOUs electronically in a way that is relatively > fraud-proof? [...] By only trading with trusted partners. Read on... > And of course, if you want to use these certificates of value anonymously, > which is what is required to pay for an anon remailer, there are some > slightly more stringent requirements. The right kind of ecash protocol can > still handle it. But Carol probably shouldn't be paying for a remailer in > CarolBucks (or CarolIOUs, whatever), at least not unless Carol is such a > big spender that CarolBucks are in wide circulation and used by lots of > people other then Carol. Which I guess is possible in your system. If the remailer operator trusts Carol, then Carol and the Op can exchange Op-IOU's for money, or Carol-IOU's for Op-IOU's. (This is the base case of the induction for you math geeks.) Carol can use the Op-IOU's directly with the Op or 'sell' them to people who want to do business with the Op. If the remailer operator doesn't trust Carol, but there is a chain of trust from Carol to the remailer operator, then Carol can get IOUs from someone which the remailer operator does trust. Call them Jo-IOUs. To do this Carol asks Pat who asks ... who asks Jo for an IOU worth $32. Carol gives Pat a Carol-IOU worth $32(+transaction fee is Pat is a greedy sole) in exchange for which Pat gives Carol the Jo-IOU worth $32 (which Carol got from Pat (which Pat got from some place only Pat knows for sure)). IOU swaps will probably be done under the cover of encryption. Swaps can also be done with a nice ecash system like Chaum and Brandt(sp?) have proposed. But I am not sure it is required. Anonymity can come also from the chain of IOU swaps, in the same way remailers produce anonymity -- each person neglects to tell any others for whom they carry out IOU swaps. Sure Pat knows Carol wants a Jo IOU, but Pat doesn't know why. Jo could figure out that Jo's IOU went out to W.Smith, and came back from V.Jones but can't make any conclusion about weather W. and V. are trading partners or not. It would take a conspiracy of each person along the swap path to expose the real trade. Alternatively the buyer or seller can out the transaction. (But suppose they only know each other via some anonymous email pool...) And privacy (from other than your trading partners) comes from using encryption during each IOU swap. But if you don't trust your trading partners enough to keep quiet about who you are, by all means use an untraceable ecash system. (There are other advantages to using blind signatures anyway.) > A pseudo-anarchist non-state-supported debt system would work fine, but you > still need a mechanism to transfer your certificates of value, whether they Well... TackyTokens, and a little bit (ha!) of client code (start with Sameer's?) ought to do the trick. (So perhaps the original message's subject ought to have been "Why Ebanks? Why not a web of debt-trust?" since it is the central bank I am avoiding here. Not tacky tokens.) But it isn't really necesary. Read on... > [...] There are advantages and disadvantages to that > sort of thing, and it might be something interesting to think about, but One problem with getting an ecash system off the ground is making the tokens worth moeny. The advantage of a distributed web-of- debt/trust model is that I only need to trade IOUs for US$ with a few trusted friends. I don't need to go to any kind of central bank. No central bank means no central point to be attacked with guns, hacks, or taxes. No central bank means no credit card numbers, money orders, or green backs mailed away to strangers. Another cool thing, and the reason you don't need Chaumian digital cash, is that the only people you can steal from (or who can steal from you) are your trusted friends! If I pass a bogus token in exchange for a real IOU, then I just ripped off my friend. The only place two non-friends interface is at the final buyer-seller interface. If the seller refuses to honor the token, the buyer can ask the friend who gave it to them for a refund, who can ask for a refund from ... until the token gets back to the thief. The thief can either steal from their friend by refusing the refund, or infact honor the bogus token, and eat the loss (if any). One bad thing is anyone can deny service to people by passing bogus tokens, and then refunding them. Lukily the friends of the blocker will notice that when getting tokens through that person, the number of refunds is higher than average. In that case, the blocker can be removed from lists of their friends, and cut out of the economy. Denial of service can be prevented another way too -- but it does require Chaumian blind signatures. Instead of trading a Carol-IOU for any old Jo-IOU, Carol might demand a Jo-IOU which is a signature on a particular (blinded) secret number. Just as if Carol were doing a TackyToken protocol exchange directly with Jo. If Carol gets a thing from Pat which isn't signed by Jo, Carol complains to Pat. If Carol gets a thing which un-blinded isn't a signature by Jo of Carol's secret number, Carol again complains to Pat. Symbolically: instead of a <-> b, then b <-> c, then ... y <-> z; do a -> via b -> via c ... via y -> z signs -> via y ... via b -> to a. The disadvantage is that Pr0duct Cypher's Tacky Token code would need to be hacked a bit more. And then there is the nasty old issue of algorithm patents. Noyb

1 0

Re: The Remailer Crisis
by usura＠vox.xs4all.nl 17 Dec '03

17 Dec '03

jalicqui(a)prairienet.org (Jeff Licquia) writes: : Would it be better if you didn't have to dedicate your box to Linux, but : just ran it every so often when you weren't playing with Codewright? If you : had some store-and-forward mail system (like UUCP or Fido), you wouldn't : need to say goodbye to DOS/Windows. Patrick Oonk <kafka(a)xs4all.nl> has written a remailer for Waffle, (wich is an UUCP system), I use that for vox.xs4ll.nl . Is works under DOS. Regards, Alex de Joode usura(a)replay.com http://xs4all.nl/~usura

2 1

jpunix.com and MX'ing
by John A. Perry 17 Dec '03

17 Dec '03

PGP message

1 0

Supreme Court on Anonymous Bills
by Nathan Zook 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- $.02 (fiat) on Talley v California (recently posted here) It is important to note that this court is expected to significantly reverse some of the landmark cases from the Warren era. We should, therefore, to look to the dissent at least as much as to the court. There can be little question that any attacks on remailers and civilian strong crypto will face challenges on the basis of Free Speech and Equal Protection. The question is: can the state show compelling interest? I believe that it can. Anonymous agents, by their very nature, are immune from state restraint. Since our entire legal system centers around state restraint, I believe that Free Speech and Equal Protection will fall to the four horsemen. When we consider the decision, we note that one of the main reasons for voiding the ordinance on its face was that there were other remedies to the problems that the ordinance claimed to address. No such other remedies will exist in our case, that being part of the point of our systems. Considering the dissent, we see even more room, with the question of Equal Protection might not be extended on the basis that only electronic communications were hampered. There is the general question of political speech. Unfortunately, there is little anonymous _US_ political speech. Furthermore, sedition is a crime, and if the Founding Fathers printed the same things against our government that they did against England (they could do more), they would face a number of criminal charges. I believe, therefore, that both the court and the dissent bode poorly for anonymous encrypted mail. But these are not the only arguments we have. We have the questions of Enforcablity, Distinguishability, Privacy, and the Right to Bear Arms. One may argue with some force that it may be impossible to determine if a person is sending and receiving information (and requests for information) directly, or if they are acting as an anonymizing agent. One may argue with great force this difficulty, combined with the nature of the InterNet, would make general enforcement impossible--leading to the same type of failure as the Prohibition. One may argue forcably that the tools necessary to allow anymous encrypted traffic are the tools necessary to preserve the barest elements of privacy. Finally, since strong crypto has been ITAR limited, one may argue that the tools required are militia-type weapons, and as such, protected Arms. Finger or request keyserver for PGP 2.6.2 (tm) key. PGP<->Mail/News installation incomplete. Factors for modulous are not proven primes. Key may be far weaker than expected. Encode at your own risk. Key ID: 14712B4D 1994/12/26 Nathan H. Zook <nzook(a)bga.com> Key fingerprint = 44 B3 D8 66 3D 55 1E 2E F8 92 22 A6 33 8C DE 24 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLyFKXnmgMs8UcStNAQFU+Af/SwmEoH2g/jZ1CtIRWevWkDQRl6Nnz1xe j8yyMtvrz86cshfD6hBYjCZ+wcihmCXM7NxuHdrbaXihTuCRspJdTheD9xUAr4sk qhqXlj4PqRVThg5FioD5/miuyLO6osJ02DfckpaWk0uJf6OBC9BIiOCzXnDVFaIh dXNfEq4pjkJPFxSR2UU7ru4EUrAKRT5keV2cZ8QjMeeQ5YksveTIO6GeStzJjAJr GQKSzdGF0qoauKsexHvaMDlbARhUEPx7vqufRWUsejkwDW73STZFBoFabcLpaJRs 9KwsSzdYFWlxtDlCpUIRFRAuxRlKCedOpEKRIYfIZy2bWSqqDbCz5A== =sxi2 -----END PGP SIGNATURE-----

2 1

Remailer in a Box transcript
by sameer 17 Dec '03

17 Dec '03

The remailer created with the following transcript was created for test purposes only. It is not to be used as a remailer. infinity:infinity/rtest 3:02pm [10] > /usr/local/lib/boxed-remailer/install_remail Installation version 1.1 Making remail dir Preparing forward file You have the option of running a hidden remailer. If you are running a hidden remailer mail to your remailer gets auto-forwarded to another remailer where it is processed. That way your remailer is less likely to come under attack because no one gets anonymous mail directly from your remailer. Would you like to run a 'hidden' remailer? [N]/y n Your personal address would be a good thing to put in Complaints-To: What should be put in the Complaints-To: header? Remailer Operator <sameer(a)c2.org> Sending anon mail to self in a self-test Remailer test complete Would you like to subscribe to the remailer-operators(a)c2.org list? [Y]/n n Ok.. done creating the anonymous remailer Your old .forward file (if it existed) is now in .forward.0 Run "remailer_remove" (It will be installed in /home/infinity/rtest/bin) To erase the remailer and restore your old .forward file Installing remailer_remove in /home/infinity/rtest/bin Now you have to create a PGP key for the remailer Make sure you choose a key appropriate to a remailer "Anon Remailer <rtest(a)c2.org>" would make a good keyid. Please choose a key length of less than 1024 bits. Otherwise the remailer will produce too much load on the system. Hit return: Pretty Good Privacy(tm) 2.6.2 - Public-key encryption for the masses. (c) 1990-1994 Philip Zimmermann, Phil's Pretty Good Software. 11 Oct 94 Uses the RSAREF(tm) Toolkit, which is copyright RSA Data Security, Inc. Distributed by the Massachusetts Institute of Technology. Export of this software may be restricted by the U.S. government. Current time: 1995/01/21 23:03 GMT Pick your RSA key size: 1) 512 bits- Low commercial grade, fast but less secure 2) 768 bits- High commercial grade, medium speed, good security 3) 1024 bits- "Military" grade, slow, highest security Choose 1, 2, or 3, or enter desired number of bits: 1 Generating an RSA key with a 512-bit modulus. You need a user ID for your public key. The desired form for this user ID is your name, followed by your E-mail address enclosed in <angle brackets>, if you have an E-mail address. For example: John Q. Smith <12345.6789(a)compuserve.com> Enter a user ID for your public key: Anon Remailer <rtest(a)c2.org> You need a pass phrase to protect your RSA secret key. Your pass phrase can be any sentence or phrase and may have many words, spaces, punctuation, or any other printable characters. Enter pass phrase: Enter same pass phrase again: Note that key generation is a lengthy process. We need to generate 464 random bits. This is done by measuring the time intervals between your keystrokes. Please enter some random text on your keyboard until you hear the beep: 0 * -Enough, thank you. ...**** .**** Key generation completed. What did you name your remailer? Anon Remailer <rtest(a)c2.org> What was the passphrase you chose? key Running a self-test of PGP Ran self-test of PGP ************************************************** ************************************************** VERY IMPORTANT DO NOT ANSWER THIS QUESTION LIGHTLY ************************************************** ************************************************** Would you like to send the key that you generated for the anonymous remailer sent to the remailer operators list? This means that your remailer will be publically announced to the world. Make sure that the UserID you chose is of a form reasonable for a remailer, such as "Joe's Remailer <joe(a)c2.org>", or things could be a bit messy. Do not answer this question lightly. Would you like to send your key to the list? [N]/y n infinity:infinity/rtest 3:03pm [11] >

1 0

Re: jpunix.com and MX'ing
by John A. Perry 17 Dec '03

17 Dec '03

PGP message

9 12

Perry E. Metzger: I would suggest...
by Perry E. Metzger 17 Dec '03

17 Dec '03

------- Forwarded Message Date: Mon, 23 Jan 95 10:54:16 EST From: perry(a)imsi.com (Perry E. Metzger) Message-Id: <9501231554.AA28483(a)webster.imsi.com> To: bugtraq(a)fc.net Subject: I would suggest... I would suggest that people interested in the threat described in this morning's times find a copy for themselves of Steve Bellovin's classic paper "Security Problems in the TCP/IP Protocol Suite." It is available from ftp://research.att.com/dist/internet_security/ipext.ps.Z People may also want to examine ftp://research.att.com/dist/internet_security/117.ps.Z Perry ------- End of Forwarded Message

1 0

Freenet Remailers (Again)
by werewolf＠io.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I keep periodically asking this question, but has any progress been made on making the remailer software compatible with the remailer software found on Freenets? The question is even more pertinent now that we seem to be having a problem maintaining a satisfactory number of remailers operational and reliable. Is there any consensus as to whether it can be done or not? I'd give it a shot using my Cleveland account to see how workable it is (ie, how long it takes for the Freenet operators to shut it down :>). -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLyGQcHBFBj7pSNyhAQGC2wf/ZwzouQWeUXCok0DgfxRUViBQdNsQhKAE sb0ODG5EubBCDFjIr9KacMyv6++OiqlOZfhNH9X+PCKOa21zJ5AjvNazfpETZnrw zRHgQscOlbdG+lLb/DMZSwIt7cKMaRgY2fp26W3nd20ORiWFtzMpXrSVKj5p/RkZ c4ygPUGu6yGUDSltl1HMnZW4yjkU9yOBiGY39xubmF/4idmNcZFFj7rpGEpQMncd 3VNyeCz7+yDhRvcSXP8Qazv38R79d3FTgMTOJ82gcXUSfoSCrvQHQvFkLOcS/xGv pmYX+wSqDvLfT+jKdq3t3D4jwVa0FLBN+dMhpIsrUu4xLDLONnYHWA== =Pg+A -----END PGP SIGNATURE-----

1 0