- cypherpunks-legacy - lists.cpunks.org

RE: [Asrg] Re: [Politech] Congress finally poised to vote on anti -spam bill [sp]
by Bill Stewart 25 Nov '03

25 Nov '03

At 04:20 PM 11/21/2003 -0800, Hallam-Baker, Phillip wrote: >We need to consider the technical workings of the do-not-spam list and the >requirements that we would like the FTC to meet. ... [reasonable goals] ... [hashed-form lists instead of plaintext]... >5) Allow domain name owners to list their domains. >6) Provide for authentication of listing requests Especially for domains, it's important to do some validation, though in the absence of widely-deployed DNSSEC, it's hard to do automatically. Perhaps 3-way-handshake email to postmaster(a)example.com or the whois administrative contact address. (This also has the side-effect of requiring people to actually use their postmaster addresses, at least for fifteen minutes or so :-) And while hashing has the obvious risk of dictionary attacks, it'll at least cut back on some of the abuses, especially if the list is dynamic and the spamware vendors who do the dictionary attacks want to charge lots of money for it. Also, the scale's a lot more annoying searching a million obvious names on each of 20 million domains with a hash that takes a second per hit, though Moore's Law will obviously erode the hash time. Obviously spammers will target popular mail systems first. However, there are two special email address forms that complicate this a bit - tagged addresses - username+tag(a)example.com There are several different syntaxes for this - plusses, dashes, etc., and either you just ignore the problem (let the user register however many tagged addresses they want), or else you special-case the rules so that bulk-emailers who want to send mail to a plus-tagged address also must check the untagged version. - per-user subdomains - anything(a)username.example.com Technically this is no different than any other per-domain blocking, but administratively it's different, because there's no whois record and there might not be a postmaster address. There's a scalability problem that has to be solved, which is how to prevent a DOS-by-signing-up-too-many-addresses attack. An example would be a Turing test image on a web page (which has the downside of preventing automated signups, as well as annoying blind people), or else requiring a hashcash puzzle that takes ten times as long as the list's hash function.

1 0

Re: e voting (receipts, votebuying, brinworld)
by Freematt357＠aol.com 25 Nov '03

25 Nov '03

In a message dated 11/24/2003 11:12:38 PM Eastern Standard Time, timcmay(a)got.net writes: > I expect there may be some good solutions to this issue, but I haven't > yet seen them discussed here or on other fora I run across. Like what? Regards, Matt-

2 1

Re: Freedomphone
by Bill Frantz 24 Nov '03

24 Nov '03

At 4:40 PM -0800 11/20/03, Ralf-P. Weinmann wrote: >Hmm.. Does this mean the users have to read of SHA-256 hash values to each >other after the connection has been established? Oh. Right. It says "Readout >hash based key authentication" on the left hand side of the spec. You probably don't have to read all 256 bits. One way this had been handled (in the Starium (sp?) phone), is to display a number derived from the hash. One person reads the first half of the number, and the other person reads the second half. If both halves verify, there is no man-in-the-middle. The length of the number determines the security, but since it is derived from the Diffie-Hellman exchange, neither side can control its value. Probably 6 digits is enough. >... There should be a means to cache credentials after an initial >trust relationship between communicating parties has been established. Cache entries would be a way for someone who obtains the phone to be able to trace your contacts. (So would a in-phone address book.) Automatic authentication also might make it easier to spoof the phone's owner. Cheers - Bill ------------------------------------------------------------------------- Bill Frantz | "There's nothing so clear as a | Periwinkle (408)356-8506 | vague idea you haven't written | 16345 Englewood Ave www.pwpconsult.com | down yet." -- Dean Tribble | Los Gatos, CA 95032

2 1

e voting
by Major Variola (ret.) 24 Nov '03

24 Nov '03

Secretary of State Kevin Shelley is expected to announce today that as of 2006, all electronic voting machines in California must be able to produce a paper printout that voters can check to make sure their votes are properly recorded. http://www.latimes.com/news/local/la-me-shelley21nov21,1,847438.story?coll=…

6 7

RE: e voting
by Trei, Peter 24 Nov '03

24 Nov '03

cubic-dog [mailto:dog3@eruditium.org] wrote: >On Fri, 21 Nov 2003, Major Variola (ret.) wrote: >> Secretary of State Kevin Shelley is expected to announce today that as >> of 2006, all electronic voting machines in California must be able to >> produce a paper printout that voters can check to make sure their votes >> are properly recorded. >Great! >Now when I sell my vote, I can produce this reciept for payment! >What a perfect system! >Umm, weren't voter "receipts" outlawed some time back >because of this exact issue? Thats not how it works. The idea is that you make your choices on the machine, and when you lock them in, two things happen: They are electronically recorded in the device for the normal count, and also, a paper receipt is printed. The voter checks the receipt to see if it accurately records his choices, and then is required to put it in a ballot box retained at the polling site. If there's a need for a recount, the paper receipts can be checked. I imagine a well designed system might show the paper receipt through a window, but not let it be handled, to prevent serial fraud. Peter Trei

1 0

AT&T Patents Trusted Intermediaries, Sues PayPal
by R. A. Hettinga 24 Nov '03

24 Nov '03

"PayPal and eBay have infringed AT&T's U.S. patent that covers transactions in which a trusted intermediary securely processes payments over a communications system such as the Internet." I wonder what American Express, VISA (and Plus), MasterCard (and Cirrus), Diner's Club, NASDAQ, Autex, Telerate, and even Quotron -- not to mention CRESTCo, DTC, and SWIFT -- would have had to say about *that*? *This* should be fun... :-) Cheers, RAH ------ <http://www.bizreport.com/print.php?art_id=5593&PHPSESSID=7b0afc16afe9e13683…> ? Anglo-American history Thursday, November 20, 2003 AT&T Files Patent Infringement Suit Against PayPal, Inc., and eBay, Inc. AT&T Corp. today filed a patent infringement suit against PayPal, Inc. and eBay, Inc., in federal district court in Delaware. AT&T alleges that, through the use of their online payment systems, PayPal and eBay have infringed AT&T's U.S. patent that covers transactions in which a trusted intermediary securely processes payments over a communications system such as the Internet. The use of a trusted intermediary ensures that one party will not have to disclose sensitive information, such as a credit card number or bank account number, to the other party to the transaction. AT&T's lawsuit seeks compensation for PayPal's and eBay's unauthorized use of the patented technology. More than a year ago AT&T notified both PayPal and eBay that they were using technology covered by AT&T's patent in the PayPal and BillPoint payment systems. AT&T offered to license the patented technology to each of the companies. AT&T has attempted to reach an amicable agreement regarding this matter with eBay and PayPal. AT&T has invested hundreds of millions of dollars every year in research and development, and the company seeks to protect its inventions by licensing its patents to those who use its intellectual property. Because the two companies have refused to pay for a license to use the patented technology, AT&T has been forced to bring the matter to the court. AT&T's patent was originally filed with the U.S. Patent and Trademark Office in 1991. In July of 1994, the Patent and Trademark Office granted AT&T U.S. Patent No. 5,329,589 for its invention. About AT&T AT&T (www.att.com) is among the premier voice and data communications companies in the world, serving businesses, consumers, and government. The company runs one of the most sophisticated communications networks in the United States, backed by the research and development capabilities of AT&T Labs. A leading supplier of data, Internet and managed services for the public and private sectors, AT&T offers outsourcing and consulting to large businesses and government. The company is a market leader in local, long distance and Internet services, as well as transaction-based services like prepaid cards, collect calling and directory assistance. With approximately $37 billion of revenue, AT&T has about 40 million residential customers and 4 million business customers, who depend on AT&T for high-quality communications. AT&T has garnered several awards for outstanding performance and customer service. The foregoing contains "forward-looking statements" which are based on management's beliefs as well as on a number of assumptions concerning future events made by and information currently available to management. Readers are cautioned not to put undue reliance on such forward-looking statements, which are not a guarantee of performance and are subject to a number of uncertainties and other factors, many of which are outside AT&T's control, that could cause actual results to differ materially from such statements. For a more detailed description of the factors that could cause such a difference, please see AT&T's filings with the Securities and Exchange Commission. AT&T disclaims any intention or obligation to update or revise any forward-looking statements, whether as a result of new information, future events or otherwise. This information is presented solely to provide additional information to further understand the results of AT&T. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

2 1

Cypherpunks List Info
by cpunk＠lne.com 23 Nov '03

23 Nov '03

Cypherpunks Mailing List Information Last updated: Oct 13, 2003 This message is also available at http://www.lne.com/cpunk Instructions on unsubscribing from the list can be found below. 0. Introduction The Cypherpunks mailing list is a mailing list for discussing cryptography and its effect on society. It is not a moderated list (but see exceptions below) and the list operators are not responsible for the list content. Cypherpunks is a distributed mailing list. A subscriber can subscribe to one node of the list and thereby participate on the full list. Each node (called a "Cypherpunks Distributed Remailer", although they are not related to anonymous remailers) exchanges messages with the other nodes in addition to sending messages to its subscribers. A message posted to one node will be received by the list subscribers on the other nodes, and vice-versa. 1. Filtering The various CDRs follow different policies on filtering spam and to a lesser extent on modifying messages that go to/from their subscribers. Filtering is done, on nodes that do it, to reduce the huge amount of spam that the cypherpunks list is subjected to. There are three basic flavors of filtering CDRs: "raw", which send all messages to their subscribers. "cooked" CDRs try to eliminate the spam on that's on the regular list by automatically sending only messages that are from cypherpunks list subscribers (on any CDR) or people who are replying to list messages. Finally there are moderated lists, where a human moderator decides which messages from the raw list to pass on to subscribers. 2. Message Modification Message modification policy indicates what modifications, if any, beyond what is needed to operate the CDR are done (most CDRs add a tracking X-loop header on mail posted to their subscribers to prevent mail loops). Message modification usually happens on mail going in or out to each CDR's subscribers. CDRs should not modify mail that they pass from one CDR to the next, but some of them do, and others undo those modifications. 3. Privacy Privacy policy indicates if the list will allow anyone ("open"), or only list members, or no one ("private") , to retrieve the subscribers list. Note that if you post, being on a "private" list doesn't mean much, since your address is now out there. It's really only useful for keeping spammers from harvesting addresses from the list software. Digest mode indicates that the CDR supports digest mode, which is where the posts are batched up into a few large emails. Nodes that support only digest mode are noted. 4. Anonymous posting Cypherpunks encourages anonymous posting. You can use an anonymous remailer: http://www.andrebacard.com/remail.html http://anon.efga.org/Remailers http://www.gilc.org/speech/anonymous/remailer.html 5. Unsubscribing Unsubscribing from the cypherpunks list: Since the list is run from a number of different CDRs, you have to figure out which CDR you are subscribed to. If you don't remember and can't figure it out from the mail headers (hint: the top Received: line should tell you), the easiest way to unsubscribe is to send unsubscribe messages to all the CDRs listed below. How to figure out which CDR you are subscribed to: Get your mail client to show all the headers (Microsoft calls this "internet headers"). Look for the Sender or X-loop headers. The Sender will say something like "Sender: owner-cypherpunks(a)lne.com". The X-loop line will say something like "X-Loop: cypherpunks(a)lne.com". Both of these inticate that you are subscribed to the lne.com CDR. If you were subscribed to the algebra CDR, they would have algebra.com in them. Once you have figured out which CDR you're subscribed to, look in the table below to find that CDRs unsubscribe instructions. 6. Lunatics, spammers and nut-cases "I'm subscribed to a filtering CDR yet I still see lots of junk postings". At this writing there are a few sociopaths on the cypherpunks list who are abusing the lists openness by dumping reams of propaganda on the list. The distinction between a spammer and a subscriber is nearly always very clear, but the dictinction between a subscriber who is abusing the list by posting reams of propaganda and a subscriber who is making lots of controversial posts is not clear. Therefore, we tolerate the crap. Subscribers with a low crap tolerance should check out mail filters. Procmail is a good one, although it works on Unix and Unix-like systems only. Eudora also has a capacity for filtering mail, as do many other mail readers. An example procmail recipie is below, you will of course want to make your own decisions on which (ab)users to filter. # mailing lists: # filter all cypherpunks mail into its own cypherspool folder, discarding # mail from loons. All CDRs set their From: line to 'owner-cypherpunks'. # /dev/null is unix for the trash can. :0 * ^From.*owner-cypherpunks@.* { :0: * (^From:.*ravage@ssz\.com.*|\ ^From:.*jchoate@dev.tivoli.com.*|\ ^From:.*mattd@useoz.com|\ ^From:.*proffr11@bigpond.com|\ ^From:.*jei@cc.hut.fi) /dev/null :0: cypherspool } 7. List of current CDRs All commands are sent in the body of mail unless otherwise noted. --------------------------------------------------------------------------- Algebra: Operator: Subscription: "subscribe cypherpunks" to majordomo(a)algebra.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)algebra.com Help: "help cypherpunks" to majordomo(a)algebra.com Posting address: cypherpunks(a)algebra.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- CCC: Operator: drt(a)un.bewaff.net Subscription: "subscribe [password of your choice]" to cypherpunks-request(a)koeln.ccc.de Unsubscription: "unsubscribe <password>" to cypherpunks-request(a)koeln.ccc.de Help: "help" to to cypherpunks-request(a)koeln.ccc.de Web site: http://koeln.ccc.de/mailman/listinfo/cypherpunks Posting address: cypherpunks(a)koeln.ccc.de Filtering policy: This specific node drops messages bigger than 32k and every message with more than 17 recipients or just a line containing "subscribe" or "unsubscribe" in the subject. Digest mode: this node is digest-only NNTP: news://koeln.ccc.de/cbone.ml.cypherpunks Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Infonex: Subscription: "subscribe cypherpunks" to majordomo(a)infonex.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)infonex.com Help: "help cypherpunks" to majordomo(a)infonex.com Posting address: cypherpunks(a)infonex.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Lne: Subscription: "subscribe cypherpunks" to majordomo(a)lne.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)lne.com Help: "help cypherpunks" to majordomo(a)lne.com Posting address: cypherpunks(a)lne.com Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to lne CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. messages are demimed (MIME attachments removed) when posted through lne or received by lne CDR subscribers 2. leading "CDR:" in subject line removed 3. "Reply-to:" removed Privacy policy: private Info: http://www.lne.com/cpunk; "info cypherpunks" to majordomo(a)lne.com Archive: http://archives.abditum.com/cypherpunks/index.html (thanks to Steve Furlong and Len Sassaman) --------------------------------------------------------------------------- Minder: Subscription: "subscribe cypherpunks" to majordomo(a)minder.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)minder.net Help: "help" to majordomo(a)minder.net Posting address: cypherpunks(a)minder.net Filtering policy: raw Message Modification policy: no modification Privacy policy: private Info: send mail to cypherpunks-info(a)minder.net --------------------------------------------------------------------------- Openpgp: [openpgp seems to have dropped off the end of the world-- it doesn't return anything from sending help queries. Ericm, 8/7/01] Subscription: "subscribe cypherpunks" to listproc(a)openpgp.net Unsubscription: "unsubscribe cypherpunks" to listproc(a)openpgp.net Help: "help" to listproc(a)openpgp.net Posting address: cypherpunks(a)openpgp.net Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Sunder: Subscription: "subscribe" to sunder(a)sunder.net Unsubscription: "unsubscribe" to sunder(a)sunder.net Help: "help" to sunder(a)sunder.net Posting address: sunder(a)sunder.net Filtering policy: moderated Message Modification policy: ??? Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- Pro-ns: Subscription: "subscribe cypherpunks" to majordomo(a)pro-ns.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)pro-ns.net Help: "help cypherpunks" to majordomo(a)pro-ns.net Posting address: cypherpunks(a)pro-ns.net Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to local CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. leading "CDR:" in subject line removed 2. "Reply-to:" removed Privacy policy: private Info: http://www.pro-ns.net/cpunk

1 0

Re: Toronto man charged with wardriving, possession of child pornography
by Major Variola (ret) 23 Nov '03

23 Nov '03

At 02:32 PM 11/22/03 -0500, Tim Meehan wrote: >On Wednesday November 19th, 2003 at approximately 5:03am, Sgt. Don Woods (7167) >of 11 Division observed the accused driving his car the wrong way on a one way >street in a residential subdivision in Toronto. The accused was investigated and >observed to be naked from the waist down. He had a laptop computer on the >passenger seat and on the screen was a young girl performing a sex act on an >older man. >The laptop had a wireless adapter card (known as a WI-FI card) allowing the >accused to access the Internet through any insecure wireless Internet signal. Interesting cultural differences. In some locales (eg New Hampshire) wardriving is legal, much like walking on land that isn't posted. Driving while naked is not, AFAIK, an offense under the CA DMV laws, although driving the wrong direction is. And in other locales (various US states) young girls (eg 14) having sex with older men is legal if they have a state license, and consensual filming and publishing of that would be legal. Only driving the wrong way harms others, ie is truly a crime, assuming that sexual activities are consensual. And of course mere *bits* don't hurt anyone. In some locales (eg under islamic law) mere images of humans are illegal. BTW, isn't it a bit chilly in Ontario to be driving half-dressed? Must have had the heater on. ----- The Taliban: A Faith-Based Organization

1 0

Toronto man charged with wardriving, possession of child pornography
by Tim Meehan 22 Nov '03

22 Nov '03

http://www.torontopolice.on.ca/newsreleases/release.php?id=4732 November 21, 2003 - 01:20 pm CHILD PORNOGRAPHY ARREST USING STOLEN INTERNET SIGNAL Corporate Communications 416-808-7100 On Wednesday November 19th, 2003 at approximately 5:03am, Sgt. Don Woods (7167) of 11 Division observed the accused driving his car the wrong way on a one way street in a residential subdivision in Toronto. The accused was investigated and observed to be naked from the waist down. He had a laptop computer on the passenger seat and on the screen was a young girl performing a sex act on an older man. The laptop had a wireless adapter card (known as a WI-FI card) allowing the accused to access the Internet through any insecure wireless Internet signal. (known as War Driving) The accused was taken to 11 Division and members of the Child Exploitation Section of the Sex Crimes Unit were called in. A lengthy investigation revealed that the accused also had been downloading child pornography using KaZaa, a peer to peer file sharing program and had been posing as a younger man in chatrooms to meet young girls. With the assistance of the O.P.P.s Project P, a search warrant was executed at the residence of the accused in Delhi, Ontario. 10 Computers and hundreds of compact discs containing hundreds of thousands of images and movies of child pornography were recovered. Accused : Walter NOWAKOWSKI 36 years Delhi, Ontario Charged : Possession of Child Pornography (2 Counts) Accessing Child Pornography Distribute Child Pornography Theft of Telecommunications Make Child Pornography The accused is in custody and will appear in courtroom #101 at Old City Hall, on Monday November 24th, 2003, at 10:00 a.m. for a bail hearing.. The public is reminded that if they are operating a wireless network at their home or business, their system needs to be secured against such actions. Sgt. Jim Muscat for Detective Sergeant Paul Gillespie and Staff Inspector Bruce Smollet

1 0

Idea: GPG signatures within HTML
by Thomas Shaddack 22 Nov '03

22 Nov '03

Sometimes a problem appears with publishing information on the Web, when the authenticity of document, especially a widely-distributed one, has to be checked. I am not aware about any mechanism available presently. A trick with HTML (or SGML in general) tag and a comment, a browser plugin (or manual operation over saved source), and a GPG signature over part of the HTML file should do the job, with maintaining full backward compatibility and no problems for the users not using this scheme. It should be possible to make this HTML construction: <HTML> <BODY> blah blah blah blah blah unsigned irrelevant part of the document, eg. headers and sidebars which change with the site design <SIGNED SCHEME="GPG"> comments are used to hide the signature from the user in standard browsers. The scheme is designed to allow signing only parts of documents, so they could be published in fast-changing environments like blogs or on dynamically generated pages, and to have many different signed parts on one page. It should also allow manual checking of the signature, eg. by curl http://url | gpg --verify Feel free to use the idea if it is good. Opinions, comments?

2 2