- cypherpunks-legacy - lists.cpunks.org

Anonymous mail service up for alpha testing
by Sameer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've written a small anonymous mail service, and it's now available for testing. There's no security, and I'll be keeping logs, so don't think that it's secure, in any way. It's also running on a PPP link which isn't connected all the time, so it's rather flaky. (I'll set it up as a real service once I get a real link-- if anyone else wants to do it, they're welcome to use my code.) How to get an anonymous account: Send mail to admin(a)infinity.hip.berkeley.edu -- include in the message a login, a "Full Name", a choice of remailer, and an encrypted return address block encrypted with that remailer's public key. I'll set it up. How the anonymous account works: Someone will send mail to login(a)infinity.hip.berkeley.edu. Then the system looks up in a table which remailer is associated with that login. It then sends out mail to that remailer, starting with the contents of the encrypted return address block, then a "##" and then all of the message to login@infinity, with "Received" lines taken out. Thus once the message gets to the last remailer of the chain in the encrypted return block, the ## pasts the identifying information of the person mailing to login(a)infinity.hip in the header of the message. (It *should* do that...) If the person mailing to the infinity address would like anonymity he/she should use an anon-mailer on his/her end. The encrypted-return address you send me should look like: :: Encrypted: PGP - -----BEGIN PGP MESSAGE----- etc. Make sure you include that ::/Encrypted or the remailer which gets it won't know that it's PGP encrypted. Remember, this is just setup for testing. Don't use it for real applications. - -Sameer -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLU9jrni7eNFdXppdAQH/FwP/b9pllDYnW6L4x0y1dVnC6km9TQ9lTw2x U/ea87JnguYSHYRxOk6lZoBBx5ZH/A48OCHJztzWHaSP2Tq69Oro4FTrtRcpTjbf ti8L97x9+Xvx1A6/Vkw1nuS5MRJ8SoPUV4bDKFdf80Ykhik5bk8b0WOUew1uF6dq QJzyDsKDFQU= =2EIr -----END PGP SIGNATURE-----

3 2

A serious question of ethics
by nobody＠pmantis.berkeley.edu 17 Dec '03

17 Dec '03

Ok, I'm in a bit of a quandry. While surfing the net last week, I happened across an address addached to a machine that belongs the the federal reserve. No big deal. I telnetted there on a lark, and entered 'guest' for the account. It dropped me into a shell. It didn't ask for a password. Intrigued, I did a little looking around. Nothing special, a CDRom and about 80 accounts. But(!!), /etc/passwd was there and available and not using shadows. No, I didn't snatch a copy. Quandry(ies) 1) Should I alert someone there about the obvious (and, IMHO serious) seciruty hole? or 2) Should I ignore it? 3) Should I take advantage of it (well, maybe not) ---------- I don't like to see systems so open, no matter who they belong too, and the fact that the governments (whether you like them or not) has one this open REALLY bothers me. But, I also wonder what kind of trouble I could get into. Technically, I violated something just by being there as I didn't have permission, and the fact I accessed the passwd file makes it even worse. If I report it, I could be in deep shit. I could mail to them via a remailer (like penet.fi, so that they could answer for more information if needed). That is a little securer and Julf is out of jurisdiction of the FBI hunting me down. Yes, I'm a little paranoid, but Uncle Sam likes to make examples out of white-collar hackers, and for me it was pure and dumb luck (like a jury would believe a 22 year-old computer geek isn't trying to gain illegal access). Any suggestions? Please? I consider this to be serious (most may not).

3 2

Re: system logging
by nobody＠qwerty.org 17 Dec '03

17 Dec '03

PGP Slave, Could you please announce my full name, phone number, address, visa card number, a giff of my signature, height, weight and driver's licence number not only to the Cypherpunks mailing list but to many usenet groups as well, since you obviously feel I no longer wish to be known to the masses as Xenon, and I instead want them to start calling me and postal mailing me asking for copies of PGP. Thanks asshole. I thought the people on this list were concerned with privacy, but I was wrong. I mention Xenon in my personal .plan, but I ask people to let me keep the small amount of extra privacy I still retain. You wrote, "qwerty account or not, the public logs on netcom show more than enough info to trivially track people down." Trivial? And so you hack out the info that a message went from remailer A through qwerty and on to remailer B, at a certain time. You haven't tracked down anyone my friend. -Xenon

2 1

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Perry Metzger wrote, "Tapping Netcom's net connections would take more than $20 of effort. Up it to $50,000 and I'll happily take on your offer. However, I am going to need assurances that the money will actually be paid." This is exactly the point I was trying to make. I wanted the word "trivial" to be clarified by those who were being so vocal about dismissing a remailer on Netcom. You'll also need a good lawyer when Netcom finds your tap ;-). But I'm sure some skilled hacker will be able to tell me the site and I'll happily be out $20, in say, a couple days? No use hacking my password, as I keep no logs (for now). The reason it's only $20, is that I am indeed honestly interested in knowing something about my remailer's security, and I don't know enough internet/Unix to risk being a total sucker. -Xenon

2 1

Re: SASE Suggestion
by loki＠nately.UCSD.EDU 17 Dec '03

17 Dec '03

:Lance Cottrell writes: : :> I have been meditating on this problem of return :> addresses, and have a proposal. The remailers :> can not be allowed to choose the return path, :> as any corrupted remailer will corrupt the rest :> of the path. : Jim Miller writes: :As I understand it, the remailers don't "chose" the return path, Bob (the :sender of the original message) choses the return path when he creates the :SASE. All the remailers do is interpret the part of the SASE that becomes :readable to them after decrypting the SASE portion sent to them from the :previous hop. If all is working, what becomes readable is the address of :the next hop (closer to Bob) and some misc other stuff (postage, maybe, :and perhaps another encryption key). : :Am I not understanding something correctly? : :Jim_Miller@suite.com : One SASE scheme recently suggested involved sending a request for a SASE to a ramailer, stating the number of jumps required. It then sent it to another remailer, and so on. Each adding a layer, and eventually sending the results to the desired correspondent. I mentioned that if the first remailer was corrupted, that the whole chain was (it would only send to other corrupt remailers). ---------------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.3 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Sure, a vanilla user at netcom probably can't track the remailer logs, unless of course there are BUGS in SENDMAIL (gasp!) or SunOS or whatever. But remailers aren't just to keep random users from knowing who you are so you can post better anonymous letters to alt.sex.anonymous. At least some of us would like real privacy, and consider remailers a useful part of this, and this means that if you're using remailers to communicate with your sources for the newspaper article you're writing on the CIA's cocaine delivery shortfalls or the NSA/Trilateralist designs for the National Health Care ID Card or your mayor's child pornography habits, that nobody can track you or your sources down easily. That means that root(a)netcom.com can't do it using the root password, even if they want to comply with the subpoena, and the Secret Service can't do it after confiscating netcom's machines or wiretapping their phones. Non-encrypting remailers can never really get that good, but they can at least d part of the job, and encrypting remailer networks may get that good if there's enough traffic through the system. So meanwhile, are you giving root(a)netcom.com permission to try to identify the source of your mail and win the $20 for finding out whether you're really Xenon or you're really L.D.'s evil twin Skippy? (No idea if they'll try, or if they're even listening....) - Radon

1 0

anonymous mail bombers and what to do about them
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Don't feed the animals. Generally, when one person is mail-bombing another, either there has been a fair amount of provocation by at least one of the parties, and escalation of childishness isn't as useful as trying to resolve some of your differences, though it can offer a certain amount of basic 4-year-old ego satisfaction. If somebody's mail-bombing you, and they're root, and they're not doing it anonymously, you don't need to either; the worst revealing your identity will do at that point is encourage them to mail-bomb you. And your system administrator probably already knows who you are by now, assuming the bombing has been at a high rate. If the bomber is root on his home machine, and the bombs include bad words that aren't mere reflections of your words to him, you could always complain to the phone company that you're receiving obscene phone calls. I doubt the policies or laws about that specify whether the calls have to be made in spoken English.... If the bomber is root on his business machine, you can complain to his management, assuming you can locate them. Some managers get very bent out of shape about this and do random clueless things, others conservatively protect their company images, others ask what state and federal laws have been broken and tell you to stifle yourself if the answer is "none". If the bomber is root on his home PC at a university, arbitrary randomness can occur. On the other hand, if you're really L- D-, and the person who is mailbombing you is Perry Metzger, expending large amounts of childishness in his direction will not accomplish anything positive for either of you, and if both of you start sending N copies of each others' mail to each other, exponential growth will not help either of your systems. If you're not really L- D-, but the person who is mailbombing you is still Perry, try talking rationally to him; he can do that just fine if he thinks it's worthwhile. If you're really L- D-, and the person is or is not Perry, we can help. Post your full name, home address with precise latitude and longitude, and we'll be happy to deliver some advanced plutonium products you may find useful in resolving your problems. "Deuterium" (oh - wait - maybe I'm "Tritium" today?) (or was that "Lithium"?)

1 0

Re: digital signatures/copyright
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Brian Williams asks: > Could one make a case that the use of Digital signatures in > messages imply's copyright retention by the author? No - you can make a case that the author doesn't want his words to be forged or tampered with, and is using technology rather than law to enforce it. Doesn't affect the rest of the legal situation, though one could try to argue either that the author was or was not expecting copyright. -----BEGIN PGP SIGNATURE----- Version: 2.3z iQCVAgUBLU/2HdCcBnAsu2t1AQF15gP+IqS3o0gNeHng9BSqlk95KzmPwp3oo70p j2FVYHNOeUKgDSAAwvWr+p3/DOwTafSkJf4A5gW33NOKr0E9JZ4In349RAoueTku J94VMajT4i7yhOC8X41RPkVLlCltPDRo04SS8h5UFnEk/zFxiTkvXY9mpBcK3yUw vYY9pbmupSc= =KbXS -----END PGP SIGNATURE----- Bill

1 0

PGPTools Minor Bug
by remailer＠merde.dis.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There is a minor bug in PGPTOOLS.C which needs to be fixed. In pgp_extract_rsa, two lines need to be added. This variable was not being cleared. When the precision was later set to max, there was garbage left in the high-order bytes of the mpi. This caused the size of the MPI to be wrong, and the function would not decrypt 2.2 or earlier packets. It could also occasionally fail to decrypt a 2.3 packet. Sorry about that. Pr0duct Cypher /* Decrypts and extracts the key from an RSA-encrypted block */ /* Returns true if successful, false if not */ int pgp_extract_rsa(struct fifo *f,byte ideakey[16], struct pgp_pubkey *pk,struct pgp_seckey *sk) { struct mpi *p=safemalloc(sizeof(struct mpi)); struct mpi *c=safemalloc(sizeof(struct mpi)); unit *dp=safemalloc(sizeof(unitarr)); unit *dq=safemalloc(sizeof(unitarr)); unit *temp=safemalloc(sizeof(unitarr)); byte result; word16 checksum=0; byte *pp; byte type; word32 length; set_precision(MAX_UNIT_PRECISION); <--------- ADD mp_burn(p->value); <--------- ADD set_precision(bits2units(pk->n.bits+SLOP_BITS)); pgp_examine_packet(f,&type,&length); -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLU4ptsGoFIWXVYodAQG3GQQApg45mfrbfoUP4BhrtmvE+zRGdSp6zx9+ M7GDnJ+vpCVzQj6S7Z+y1RZ4FFAT6yX/63oeVvhW8FzNZ1s5xOZivbIZrhC6WPJU qZiuy/veXD7OrWpUJueucT5xPF/Nsjdx3w2DiAy2x7YtRycpzugMSpSdvJcCcOuK rGBkPV2eJDc= =+WVh -----END PGP SIGNATURE-----

1 0

LPC on ADSP2105
by Tim Newsham 17 Dec '03

17 Dec '03

I have recently finished my senior project on low-bandwidth coding of speech. I outline an implementation of Linear Predictive Coding (LPC) on the ADSP2105. I am making the paper and the source code freely available in hopes that it may interest and possibly help someone. In order to avoid having to mail out copies seperately to everyone who is interested I am putting the paper temporarily on: ftp.uu.net:/tmp/lpc-paper.tar.gz If you know of an archive for which this paper is suitable please let me know how to submit it there or submit it yourself and let me know. The archive is a tar'ed collection of files, to unpack: gzip -d lpc-paper.tar.gz tar xvfp lpc-paper.tar The contents of the archive are: Makefile README a4.sty lpc.ps lpc.tex lpc4b.asm notes.tex schematic schematic.ps source.tex and contain postscript and LaTeX formats of the document. Here is the abstract: \begin{abstract} An implemenation of Linear Predictive Coding, a low-bandwidth speech encoding scheme, built around the ADSP-2105 signal processing CPU is described. The hardware schematics and software source code listing are included. \end{abstract} Tim N. (ps. I am no longer subscribed to the cypherpunks list so if you wish to reply, send the reply directly to me)

1 0