- cypherpunks-legacy - lists.cpunks.org

Need help with remailer scripts
by Robert Luscombe 28 Apr '93

28 Apr '93

Would someone be able to help me install the remailer scripts from the archives? I have no Unix experience and have *no* idea where to begin. I don't even know if root access is needed for these. Any help would be appreciated. --Robert Luscombe Internet: ral(a)telerama.pgh.pa.us Voice:412/488-0941 robert(a)well.sf.ca.us (Finger for PGP Pub Key)

1 0

Re: By popular request: A non-techy Clipper blurb
by Valerie Lambert 28 Apr '93

28 Apr '93

In article <9304260326.AA15408(a)binkley.MIT.EDU>, Derek Atkins <warlord(a)Athena.MIT.EDU> writes: >It's even worse than this. It's giving the government a sealed copy >of all your *PAST*, present, and future phone conversations and >messages... They can always record everything, and then use your key >at some later date to recover the messages... Point well taken. I only meant in regards to Clipped communications. Presumably they would have a harder time opening the "envelopes" of your past communications that used non-standard encryption. Sigh. Sound bites are SO shallow, I know. -- Valerie Lambert * valerie(a)biocad.com * 415/903-3923 * AT&T: phones with Big Brother Built Inside! Just say "NO" to the Clipper wiretap chip.

1 0

Re: A correction, and another motive for Clipper
by Arthur Abraham 28 Apr '93

28 Apr '93

Eli, Of course the guys with the STU phones will keep them, this is Type II security, which is of a lower level. The people who really need these phones are the civil servants in these departments: Agriculture Commerce Education Energy EPA HHS HUD Interior Justice Labor State Transportation Treasury Veterans Affairs ...that is, people in positions to missapropriate funds, or create overly generous contracts with their future employers. There is no good argument that these functionaries shouldn't be Clippered, except that nobody should be. ""National Security"" doesn't apply here. You also seem to be thinking with two cliches: 1. You can't fight city hall. 2. This is the way things have always been, this is the way they always will be. The guys who put this in motion certainly aren't thinking with 2), but they sure are hoping you're thinking with 1). Please expunge both of them from your mind and replace then with an appreciation of forces and masses: Judo. -a2.]

2 1

Re: REMAIL: email to usenet gateways
by Sy Verpunc 28 Apr '93

28 Apr '93

Hal recently posted instructions on how to post to usenet using the anonymous remailers. Here's a collection of email to usenet gateways I have, no doubt far from complete. group-name(a)ucbvax.berkeley.edu * group-name(a)cs.utexas.edu group-name(a)pws.bull.com group.name(a)news.demon.co.uk Actually, the latter is group-name(a)demon.co.uk, and it's intended for demon customers. I believe they don't police this too heavily (ie they could chop connections from non-demon sites) but if it's heavily overused or abused there's a chance it might disappear. These sites are *not* anonymous remailers, in case anyone thought that. They post under the name presented in your mail to it, and if you forge mail the demon one at least attaches an 'Originator:' line with the real site, and sends a copy to the postmaster. Generally, a service not to be abused. The only open NNTP server I know of at the moment is sol.ctr.columbia.edu, and it has user limits and time restrictions. Still, it's better than none. G

1 0

Re: REMAIL: email to usenet gateways
by Sy Verpunc 28 Apr '93

28 Apr '93

group-name(a)ucbvax.berkeley.edu * * I understand that the admin of ucbvax.berkeley.edu block posts from non berkeley sites, but I'm not positive about that! It was open for a couple of years but is now blocked. I checked a week ago. G

1 0

REMAIL: email to usenet gateways
by Karl Barrus 28 Apr '93

28 Apr '93

Hal recently posted instructions on how to post to usenet using the anonymous remailers. Here's a collection of email to usenet gateways I have, no doubt far from complete. group-name(a)ucbvax.berkeley.edu * group-name(a)cs.utexas.edu group-name(a)pws.bull.com group.name(a)news.demon.co.uk * I understand that the admin of ucbvax.berkeley.edu block posts from non berkeley sites, but I'm not positive about that! I seem to have lost (okay, I must have deleted it :-) a list of nntp servers; places you can telnet to port 119 and POST your message to usenet. Anybody have info about these? /-----------------------------------\ | Karl L. Barrus | | elee9sf(a)menudo.uh.edu | <- preferred address | barrus(a)tree.egr.uh.edu (NeXTMail) | \-----------------------------------/

2 1

Raving on...
by crunch＠netcom.com 27 Apr '93

27 Apr '93

Hmmm, getting some mixed responses from the group on the raves idea, below are my comments.... > I don't mean to rain on the parade, but young people (myself >included) go to Raves to get away from the problems and injustice >the clipper represents. Bringing in your personal PC to generate keys >isn't going to draw a crowd. MOST ravers don't have, don't know, and >by and large don't care about computers - let alone mass >communication and encryption schemes. What can the government do if >they don't care? It's the "music" scene. That might be partially true, and depends on the rave. Most raves I go to have all sorts of computer related demonstrations, and exibits. I've been getting very positive interest on the part of rave organizers. Brian says: >Hmm... the problem is I don't think a majority of the people at raves are >focused enough to concentrate on something as technical as that (I KNOW it >isn't technical to you and me, but the average raver doesn't even >know what the word encryption means). HOWEVER, raves ARE the ideal place >to hand out info about what's going on, something the raver can cling onto >to read and understand when he's not high on {vibes,music,drug,etc.}. Give >pointers to where to get more info or where to obtain PGP, and perhaps >most importantly, WHY THEY NEED IT. Within a certain amount of time, but >most likely sooner than any of us anticipate, there will be more people with >email access than without, so "taking the message to the streets" is becoming >less and less of a fanciful idea.... I agree that we should keep it non-technical, thats why I proposed that raves have tables set up where PGP copies can be given out, literature can be displayed for ravers to take home later... Then, there are those hard core cyberpunks that will take in EVERYTHING including lots of drugs. For those UK folks, Craig Larson from the USA will be working with sponsors to a totally awsome rave of an estimated 40,000 folks. Now THATS a good place to get the word out, spark intererest in encryption, etc. And on and on.. JD

1 0

Be afraid! (some Clipper details)
by uri＠watson.ibm.com 27 Apr '93

27 Apr '93

As Ms. Dorothy Denning explained, this is the intended "interface" between the Clipper and Law Enforcement (taken from her posting to "comp.risks"): 1. Family Key. F is embedded in every Clipper Chip, but like other chip keys, unknown to the people who use them. Only law enforcement will have a decoder box that allows the law enforcement field to be decrypted. Initially, there will be just one box, and it will be operated by the FBI. Read - FBI will have the Family Key (and thus will be able to get all the chip serial numbers, do traffic analysis etc). And later she "corrected" herself, adding: For the same reason as above, it is imperative that law enforcement be able to decode the law enforcement field in order to obtain E[K; U] and then decrypt this to get K. It is completely impractical to go the escrow agents for each conversation. Read - Law Enforcement (local, "global" - whatever) will have that Family Key as well, not only that "one box at FBI"... But it was obvious, wasn't it? 2) Unit Key. It is imperative that law enforcement get U. If they are tapping a line, there may be dozens of calls on that line per day.It would be totally impractical to have to go to the escrow agents to get the session key for each call. It would be impossible to do real-time decryption under that constraint. Read - a) Law Enforcement indeed will have your Unit key (and thus be able to decrypt whetever was sent through your chip, from the day one, till you throw your chip away). b) It's indeed physically possible thus for some corrupted Law Enforcement officials to "collect" the Unit Keys and to do all the bad things with them. c) Nobody seems to be concerned about it. 3) Question about agencies capable of decrypting all the future traffic of once-suspected individual: After a tap has been completed, government attorneys are required to notify the subjects of the electronic surveillance. At that point, the subjects are certainly free to purchase a new device with a new chip, or perhaps the vendors could simply replace the chip. Read - if they won't forget to notify you, that your phone was tapped, feel free to shell another $XXX bucks for a new chip/phone... Keep doing that until either they, or you get tired... 4) Question about whether there's time component in the cipher. Reasons for it - since wiretaps are authorized ONLY for certain time periods with both start and end dates specified, it should not be possible to be able to decrypt the traffic outside of this frame. I am unaware of any time component. Current wiretap laws protect against this. Evidence collected after the warrant has expired can be thrown out in court. In addition, it is illegal for the service provider to implement an intercept after a warrant has expired.With the new technologies,law enforcers will be incapable of executing a tap without the assistance of the service provider. Read - just as we assumed, once your key is compromised (ouch! I mean - disclosed :-), whatever "they" bothered to record, is now open... Well, of course it won't be legal, but then there are many things beyond the law (:-)... 5) Question about potential weakness, which may be lurking behind the "classified" stamp of the algorithm, known thus only to those "cleared" to know. The NSA has a long record of success with crypto, far better than any individual or organization in the public community. In addition, there are plans to bring in expert cryptographers to assess the algorithm. Read - she's ignorant of academia/industry crypto successes? (:-) That's all folks! [For now :-] Regards, Uri. ------------ <Disclaimer>

1 0

Re: Rave on...
by bbehlen＠soda.berkeley.edu 27 Apr '93

27 Apr '93

Hmm... the problem is I don't think a majority of the people at raves are focused enough to concentrate on something as technical as that (I KNOW it isn't technical to you and me, but the average raver doesn't even know what the word encryption means). HOWEVER, raves ARE the ideal place to hand out info about what's going on, something the raver can cling onto to read and understand when he's not high on {vibes,music,drug,etc.}. Give pointers to where to get more info or where to obtain PGP, and perhaps most importantly, WHY THEY NEED IT. Within a certain amount of time, but most likely sooner than any of us anticipate, there will be more people with email access than without, so "taking the message to the streets" is becoming less and less of a fanciful idea.... Brian

1 0

Re: A correction, and another motive for Clipper
by Arthur Abraham 27 Apr '93

27 Apr '93

27-Apr-93 Tim, Your suggestion has the validity of strong logic: it fits all the facts we know, leaves none out, and makes no external assumptions. In particular, while the rotten underbelly of society (terrorists, drug runners, producers of TV sitcoms) would have no compunctions about using further encryption within a Privacy Clipper wrapper, a government employee or contractor who did would be highly suspect, and -- knowing Big Uncle might be listening -- would be restrained from performing kick-back business as usual. Is this the technological fix to government corruption? Following this theory, I am sure we would all applaud legislation restraining the gov-guys from using non-Clipper crypto. The situation might come to resemble drug testing: legally mandated for individuals in "public saftey" positions, such as transportation workers and A-bomb builders, not required where not justified. The Attorney General is going to buy several thousand of these things, she already has the money -- and probably a signed contract with AT&T Greensboro -- and it's unlikely this can be stopped. What we can do is use it to our advantage. This may be maneuvered into a no-lose situation for us, as... either: a. The government taps itself, corruption is uncovered, and the national debt decreases. Society agrees that public officials don't deserve privacy, but citizens do. or: b. The government bureaucrats, seeing hard times coming, reject Privacy Clipping for themselves, and so everybody -- gov and citizens -- retains their privacy. (This is judo: use their weight against them.) Let me suggest this as a political position: Clipper Privacy for the Government, real privacy for Private citizens. -a2.

2 1