- cypherpunks-legacy - lists.cpunks.org

Re: Anonymous vs false IDs
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From: kovar(a)nda.com (David Kovar) > > There is a lot of effort being put into creating tools to mask identities. > I'm curious why people don't go a different route - creating a false > electronic identity? If you have control over your own system, it is easy > enough to create an account. Lacking that, there are a lot of companies > out there offering low cost accounts on Unix systems with full Internet > access. Why not get an account in a different name rather than using > anonymous remailers? If you use five different identities, why waste your money paying for five accounts, especially if some of them are used only infrequently? Why have a full UNIX account (like my account on PANIX, say) for an identity that won't need to do anything but send out a couple of email messages now and then? What if you create and kill off personas relatively frequently? Having everything centralized seems like the most logical way to go--don't forget, separate accounts would mean setting up separate .profile files, copying code from one place to another all the time, keeping duplicate copies of things, etc., etc. The exception would be when you have identities or "lives" that are truly separate, with little overlap, but even then I'd prefer having full access to all my files and robots in one place all the time. If I had an Internet connection on my own box at home, sure, it might be more convenient to segregate things in separate accounts, but most people don't have that luxury yet. --Dave.

6 5

Re: 700 Club Report on the Clipper Chip on Wednesday, October 20, 1993
by mlshew＠netcom.com 17 Dec '03

17 Dec '03

I have an error in my spelling. I spelled Jerry Berman's name wrongly as Jerry Berrman. Major apologies. And after mentioning him as just 'an eff guy' in the first message. <sigh> I'm sorry to have misspelled your name, Mr. Berman. *** Everyone, please do a search and replace of Berrman->Berman before distributing the document any further. ***

1 0

ANON: mail concerns
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hm.. there have been some concerns over anonymous mail recently... both Alan and Thomas have noted that it is easy to match up sender and destination for a remailer which processes each message as it arrives. Solution: cache all messages and process them later (once a day, once a week, etc.). For example, the remailer at elee9sf(a)menudo.uh.edu caches all incoming requests, and processes them (randomly) at midnight. I didn't even have to modify the remailer scripts to do this; rather, I wrote some extra ones. The process seems stable. The trickiest part is scheduling the remailing: I have to use the 'at' command since I can't have my own crontab. Also, Thomas mentioned what seems to be 'random remailing'. As I mentioned in a previous message ("ANON: anonymous mail"), forcing mail to progress through a network randomly also forces the final destination to be known to everybody, where before only one site knows the final destination. Also, instead of building the necessay headers to hop mail you may be able to use one of several scripts and programs available at soda.berkeley.edu Karl Barrus <klbarrus(a)owlnet.rice.edu> -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLNbQEoOA7OpLWtYzAQEe0QP+KaDWOyep8+wSfEMtUjBOj8OGJMrdSCkO jAfS3zW/uASpOfZ8zgaGBhl8kFPzF9ZyEJyKV/tydIHJdQUEI9K3FU0AE4vB2Fei xcGcM16dZlSSOW/E+CkRR/3UstlRwUuHCccFACTh5SIPIG3mSSVvNMEp7Cz+SIss j5Mkq9KqJc0= =tWzv -----END PGP SIGNATURE-----

2 1

anonymous remailing/posting software
by khijol!erc 17 Dec '03

17 Dec '03

Ah, yes. Once again, it's time to upgrade the APS software here at khijol. For those who don't know, I run an anonymous posting site which posts to only a select set of newsgroups (to prevent abuse). Now that the machine is sitting on the Internet, it's time to revamp the software, and I have thought that it might be easier to hack someone else's than to redo my own (which was one of those all-day hack sessions). Double blind remailing and unique ID services are essential, with the 'nice to have' services like automatic pinging of posts, checksum verifications of posts, automatic encryption/decryption of posts, etc. would be ideal. Any ideas on where I could obtain such software? Shell scripts are OK, C is better. Perl is not desirable unless I really have to. :( Thanks! -- Ed Carp, N7EKG erc(a)apple.com 510/659-9560 an38299(a)anon.penet.fi, anon-1157(a)twwells.com If you want magic, let go of your armor. Magic is so much stronger than steel! -- Richard Bach, "The Bridge Across Forever"

1 0

Health Security
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <9311261629.AA05385(a)gold.chem.hawaii.edu> you write: >> I realize that this is of marginal crypto import, but I need as much info >> as possible on Hospital Information Systems and security. Especially >> on CICS and AIX systems. Do any cryptographic protocols exist yet to >> protect huge interactive medical databases? >What specifically are you asking about? Are you talking about encrypted >password protection or encryption of part or all of the databases? The company I work for does a lot of work with HISS systems. We've been told to develop a system to display selected data from a HISS on PCs for use by hospital staff. (Possibly off the premises). We asked about security and encryption, and were told we could leave all the patient data in clear but to encrypt the file containing the names and the correspondence between those names and patient data. I don't think this is sufficient - I'm sure anyone getting the data could work out who it was about from all sorts of internal detail - but that's all the UK Health Service at least expects. We will, of course, be putting in a *considerable* deal more security than they mandate as minimum, because if patient data were to get out via one of our products, it would be no use saying 'but the NHS said that was all we needed to do' - not only would we be morally negligent, but it would do our company's public image no good at all. G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

Re: Comments on NSA (was: "Pyrrhus Cracks RSA?")
by an52436＠anon.penet.fi 17 Dec '03

17 Dec '03

Well, doesn't it make some sense given the utility of prime numbers in cryptography, that the NSA, or anyone else interested in breaking codes for that matter, would have simply dedicated a computer or two to the long-term project of determining all of the prime numbers under x bits long? Granted this would take a while, but the NSA has the time, the computers, and the other resources necessary to do this. Having all of these prime numbers would greatly reduce the effort necessary to crack PGP/RSA-type cryptosystems which rely on prime numbers. It would reduce the number of factors a brute-force attack would have to check dramatically. Or am I completely off-base? Mephisto ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

900 MHz Cordless question
by analyst＠netcom.com 17 Dec '03

17 Dec '03

Catching up on my reading the other day, I noticed an article in the Economist about Cincinnati Microwave's 900 Mhz cordless phone. It seems that Cylink makes the actual chip that is used in the phone to do the spread-spectrum communications. My questions to the readers of this list are: 1: Given that Cylink was one of the two original companies to manufacture Clipper hardware, what does this say about the protocols that are used in this spread-spectrum chip? Was it designed to be easy for law enforcement to crack? 2: Of the digital 900 Mhz telephones available, are any of the phones better from a security standpoint than any of the others? Are they all using different protocols or the same? Enquiring minds want to know! Thanks. --------------------------------------------------------------------------- -- Benjamin McLemore analyst(a)netcom.com 214/522.7640 fax

3 2

Banning any subscriber...
by Jim choate 17 Dec '03

17 Dec '03

I am new to the list as well as the local Austin CypherPunks group and have high hopes of contributing to the ongoing discussion of crypto. I have been playing w/ PGP since it first came available and crypto in general for quiite a few years. I was really attracted by the sence of community as well as the reputation of the CypherPunks. However, with the latest news that 'we' are going to start banning individuals because they have nothing to contribute is something I personaly cant support. If you want free speech then you have to give it. If you personaay want to filter your mail (equivalent to changing the channel) that is fine, but to a priori filter posts from a individual is cencorship (no letting you discuss your subject at all). I personaly do not support such authoritorian actions and will dis-associate myself from the CypherPunks and will advise others not to associate either. This type of action is un- called for and has no business on this type of communication network. I advise all subscribers to this list to NOT support any action by any individual or group to carry this idea into action. This is not what CypherPunks or freedom is about. "Those who give up essential liberty to obtain security deserve neither liberty or security." Benjamin Franklin

1 0

Filter to exclude Detweiler?
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

I've personally come to the conclusion that it's no longer useful to (a) attempt to communicate with Detweiler, or (b) pay attention to what he writes. I am, however, opposed to source-filtering him at philosophical and practical levels. I think his bad craziness is evident enough from his postings that anyone paying much attention will conclude he's disconnected from external reality; it shouldn't take more than a few messages for folks to reach this conclusion. (I admit with some chagrin that it took more than a few for me to do that.) I think that source filtering is at least a close kin to censorship, and I'd vote to steer clear of it. I also think that attempting to source-filter him may lead to some sort of "identity arms race", via remailers, anon-servers, and the like. Such an arms race would be distracting, annoying, and lead to further wasted time, effort, and energy on the part of people who ought to have better things to do. :) I encourage folks to look into improving technology which would allow for destination-filtering, e.g., kill-files and their ilk. (Next-generation killfiles - ones which attempt some sort of textual interpretation/classification beyond headers - implemented at the destination point have the added benefit that the filter target can't easily deduce from the list traffic what algorithm/pattern is being used, and thereby avoid it.) For what it's worth, I write the above in spite of the fact that I don't have a kill-file in the reader-agent that I read C-punks with, and I pay for every minute of transmission time used to receive C-punks, including Detweiler's lengthy messages. -- Greg Broiles greg(a)goldenbear.com Baked, not fried.

1 0

ANOTHER FAVORABLE ARTICLE
by Sandy 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, Strong encryption got another boost from the hard money crowd. The newsletter, /Strategic Investment/ featured an article called, "Escape to Cypherspace [sic]: The Information Revolution and the demise of the income tax." It was written by James Bennett who is the "Technology Editor of /Strategic Investment/ and is writing a book on nanotechnology for the M.I.T. Press. Here is the first paragraph: Readers of /Strategic Investment/ are already aware of the crucial role of the microchip in eroding the power of governments over their citizens. Recent developments herald an expansion of this role that promises to dwarf the effects seen to date. Just as atomic theory was seen as an arcane interest in 1939, so this development, known as public-key encryption, is now familiar only to a handful of academics. Yet in the coming decade, it may create consequences which change the life of everyone on the planet even more than the atomic bomb. Following this was some history and theory of public key. He had several nice paragraphs about PGP, the Clipper chip and the united front put up by "hackers and mainstream communications and computer companies" in opposing the Clipper. He explicitly mentions (and approves of) the threat offshore banks using encryption technology pose to taxing authorities. At one point he writes: This development [cypherspace commerce] will accelerate rapidly existing trends towards breakdown of large institutions and hierarchical structures. Governments will have much of their revenue base undercut--and any attempt to tighten the screws on taxpayers will just increase the escape to Cypherspace. But he later opines: Some observers of this trend predict a coming "crypto- anarchy" where governments fall apart entirely under the pressure of anonymous communication. This is not likely. Governments have shown an amazing adaptability over the millennia as they adjust to developments such as large-scale slavery, feudalism, gunpowder and industrialization. Quite a favorable article, over all. S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2