- cypherpunks-legacy - lists.cpunks.org

No Subject
by The Ministry of Silly Walks 02 Mar '93

02 Mar '93

UNSUBSCRIBE

1 0

Re: Future of anonymity (short-term vs. long-term)
by pmetzger＠shearson.com 02 Mar '93

02 Mar '93

> From: Theodore Ts'o <tytso(a)athena.mit.edu> > > From: Eric Hughes <hughes(a)soda.berkeley.edu> > > >There doesn't seem to be a lot of realism in these discussions, which is > >really bothering me. > > What you believe to be real and what I believe to be real may be > different. To claim that another is being unrealistic is to mask > what is foremost a difference in belief. > > What assumptions here do you disagree with? If you are explicit, > perhaps we can forge an agreement. > > Well, let's see.... the most recent assumption I disagreed with was the > claim that we could implement full-fledged postive reputation filters, > complete with the use of RSA, and deploy it on the Usenet in some sort > of time-frame less than ten years out --- and even that is doubtful. Oh, come ON. This is insane, Ted, and you know it. Project Athena didn't take ten years. RSAREF is out there -- someone could build a version of news that used public key for verifying moderation on newsgroups and control messages within a month if they felt like it -- and working part time, too. As for the rest, well, it shouldn't be too hard. For unmoderated lists, keep sets of users you want to read the messages of and verify signatures if forgery starts becoming a problem. Crude but it would work. > Look at how many sites are running B News, long after C news has been > out. Anonymous remailers are here *today*. Well, the folks running B News and C News will have to live without the public key extensions, and it will be their fault. The people with the public key extensions will have the benefits. Is it your argument that because some men are fools all must suffer, Ted? Lets say that tommorrow someone made available, for free, pills that cured all disease. Are we to say "no, thats bad, some idiots won't take them?" > Then there's assumption that anonymous ID's would automatically have no > weight --- they may have very little weight, but even today, they > probably have some weight. I could probably construct some sort of NSA > conspiracy theory, and have it posted so it looked like it came from 20 > different pseudonyms, and it probably would be believed by a lot of > people. Yeah, well, so what? Right now people post such things non-anonymously, or could forge such postings. People put out infinte supplies of garbage. I'd argue that the average church causes more damage than all the anonymous posters on Usenet ever could and those are perfectly legal. You aren't arguing for non-anonymity. You are arguing that free speech is bad. Well, fine. See if you can stop it, Ted -- the rest of us aren't playing along with that game. Given that you have no choice but to accept reality, why not quit bitching and just work on fixing the problem? The Extropians list works on a closed subscription system today, folks. Its crude -- no public keys involved, subscription checking done very ad hoc -- but it works. People ARE out there fixing these problems. If someone really thinks anonymity is going to be a problem, they can fix it, and it won't take ten years -- a couple of months of evenings would likely allow for overkill. > Fundamentally, however, there's the basic assumption that anarchy per se > is good; which is a basic philosophical belief which I just plain > disagree with. That isn't even an issue here, Ted. Anonymity exists whether we want it or not -- its like asking if gravity is a good idea. The anarchy issue is not part of this. Even you would have to recognise that its impossible even with a society as closed as the Soviet Union to stop anonymity, let alone in a society as free as ours. The choices are to live with it and find ways to cope or to try for draconian measures. One is practical -- the other is impractical and harmful in and of itself. Perry

2 1

Re: Piercing anonymitiy and censorship
by fen＠genmagic.genmagic.com 02 Mar '93

02 Mar '93

> Date: Mon, 1 Mar 93 10:45:32 PST > From: memexis!tribble(a)uunet.UU.NET (E. Dean Tribble) > > I would like to separate the issues of hollering anything at 4am in > residential areas from things like libel and slander. Disturbing > people with your volume independent of its content is like blasting > white noise at damaging volume levels. The remedies for it have > nothing to do with speech, they have to do with disturbing the peace; > your sound is crossing onto my property at intolerable levels. > > And again, I repeat..... with anonymous remailers, you no longer have a > way to enforce said grounds of disturbing the peace ---- unless you do > things like approach the finnish authorities and ask that penet be > disconnected from the network for disturbing the peace of various Usenet > groups..... > > - Ted Don't most news readers have "kill files" (sometimes known as "bozo filters")? I definately prefer decentralized solutions. Anyone mandating what I can and cannot read is slime (synonomous with censor), imo. I want to make that choice myself, thank you very nice. Fen

2 1

tapping
by raob＠mullian.ee.mu.OZ.AU 02 Mar '93

02 Mar '93

[forwarded from elsewhere] > > [From Data Communications, January 1993] > > INVENTION CUTS CABLING TIES > > An inventor working from a garden shed in the U.K. has come up with a device > that enables PCs and other LAN equipment to send and receive data through > the plastic outer jacket of copper LAN cabling-- without piercing the > cabling. Called the Watsonlinc Cable Coupling Transformer, the device > allows users to attach LAN equipment at any point in a network without going > through time-consuming and costly cable attachment procedures. The > Watsonlinc, which must be placed directly next to a cable's outer jacket, > uses a proprietary technique to reduce noise interference while picking up > and transmitting data signals. Watsonlinc-equipped network interface cards > (NICs) will appear in the next 12 months, according to inventor Mike Watson > (Walton-on-Thames, U.K.), who says the device's production cost of about $5 > per unit will not significantly increase NIC sticker prices. The Watsonlinc > works with both shielded and unshielded twisted-pair copper cabling, is > small enough to fit on laptop PC internal adapters, and is capable of > handling all common LAN speeds, Watson says. The internationally patented > invention works just as well with voice signals. Predictably, it already > has been licensed for use in telephone surveillance equipment. > > ------- End of Forwarded Message

1 0

Re: Piercing anonymitiy and censorship
by pmetzger＠shearson.com 02 Mar '93

02 Mar '93

> From: Theodore Ts'o <tytso(a)athena.mit.edu> > > Date: Mon, 1 Mar 93 10:45:32 PST > From: memexis!tribble(a)uunet.UU.NET (E. Dean Tribble) > > I would like to separate the issues of hollering anything at 4am in > residential areas from things like libel and slander. Disturbing > people with your volume independent of its content is like blasting > white noise at damaging volume levels. The remedies for it have > nothing to do with speech, they have to do with disturbing the peace; > your sound is crossing onto my property at intolerable levels. > > And again, I repeat..... with anonymous remailers, you no longer have a > way to enforce said grounds of disturbing the peace ---- unless you do > things like approach the finnish authorities and ask that penet be > disconnected from the network for disturbing the peace of various Usenet > groups..... Of course there are ways -- and they need not be so drastic. You could, for instance, simply prevent non-subscribers from posting to your list, and use public key to verify identities. This would allow you to swiftly stop abuse. I've already noted this twice. You've claimed this is impractical, but the tools to do this, AND WITHOUT PATENT PROBLEMS, already exist and would be cheap to implement. Perry

2 1

Re: Dining Crypto -- An Introduction
by Tiia Roth-Biester 02 Mar '93

02 Mar '93

(Jim McCoy) >There is no way you can get around taxation if you intend on using this >system in real life. Your system is much like that of a drug dealer, he >gets all this money, but has no where to spend it until it has been >laundered. So in other words the earnings of the international banks located "offshore" and lending $trillions in the "Eurodollar" (now world financial) markets have been taxed for the last 30 years? Their balance sheets don't reflect these taxes. The new technology will let everyone "expatriate" themselves either actually or virtually. If, today, I am traveling in the South of France and writing the Great American Novel, I have no French tax liability and am not violating work permit laws even though I am working and may be earning $millions. (If I am or have been an American within the previous 10 years I would have US tax liability of course.) On the nets I can do a host of jobs while wandering around the world. In most countries I would have no income tax liability. Taxing me (or net entities created by me) would be even more difficult in a practical sense. >They will get you at the banks or wherever you go to spend your >money. The "War on Drugs" has really caused this kind of banking service >to dry up, Digital cash will be able to buy lots of goodies (entertainment, communication, non-physical services, and physical services once the VR interface improves sufficiently). Dumped into an account that is otherwise unconnected to you it can be accessed via smart cards, debit cards, and ATMs from anywhere in the world. It is still not that difficult to obtain a bank account somewhere in the world in a nome de guerre. >The appetite of the taxation-beast will not diminish, and everyone will >just end up having higher taxes on the physical elements of daily life >that can't be stuffed on the wire. Sounds like this is going to be a >world of info-elite tax dodgers...the public will love you... Actually the poor evade more taxes (as a portion of income) than the rich these days. The appetite of the beast has not stopped the forex markets from tripling in size since 1986 (quite a bit untaxed). Legally, services sold "internationally" are not subject to tax and there is no entity capable of levying such a tax. The nets exist in an "international" realm. As time goes on the percentage of gross world product that is non physical is bound to grow (the non-physical bits have been growing steadily for years). Once future Madonnas determine that they can double their take home pay by renouncing their American citizenship (either actually or virtually) and selling their voices and images via the nets things will change. If the coercive sector has to increase the taxes again and again on an ever smaller portion of gross world product, it will starve to death. >The unbundling of the physical and non-physical aspects are nice, but how >many non-physical aspects of a service are there? If your VR interface is good enough most services can be delivered non physically. Nonphysical services include: writing (anything), entertainment, law, much of medicine, all of management, telecoms, advertising and marketing, all of financial services. Once automation develops much of manufacturing will be non physical as you purchase "custom" goods made on the spot from downloaded patterns. Authority can be a delicate thing. On November 9th 1989 you would have been shot crossing the Berlin Wall without permission on November 11th 1989 you could cross at will. Many of your supposed restraints only apply to US citizens in any case. British citizens living "overseas" have no UK tax liability and this is true of the citizens of most countries. Everyone is "overseas" on the nets. Even though US expatriates have continuing liabilities, 60% of them are tax nonfilers according to an IRS study of tax compliance. Shattering geographical bounds shatters legal ones as well even in this day and age. Duncan Frissell

2 1

Re: A novel (?) return address idea
by jthomas＠mango.mitre.org 02 Mar '93

02 Mar '93

From: gnu(a)toad.com (John Gilmore): >There seems to me to be a serious problem with the "novel return >address" idea. The information that ties together multiple >anonymous messages from the same person is out in the world, >encrypted by a single key in a conventional cipher. [attack methods deleted] >The idea also suffers from the dossier problem -- all the >information about return addresses will exist in a single place (at >the remailer site) where it's tempting for a government (or other >adversary of privacy) to try for it. >Keep thinking, folks! We aren't there yet... Quite true. I guess I never really made it clear that I don't believe this return address method is very secure, just better than the current version available through anon.penet.fi. Certainly it's no reason to abandon the work on SASE's for cypherpunk remailers. My idea was just to make it difficult to associate different messages from the same anon user, while keeping anon.penet.fi's current framework. Now all messages from the same user bear the same return address (e.g. an1234). If you reveal your identity in one anonymized message, all of your past messages can be easily linked with you. Under the new scheme, associating two messages from the same sender would require breaking the remailer's cipher. Yes, it's possible, but it's not trivial. It's also possible to limit the damage done when a single key is compromised. Change keys periodically (weekly? daily?) and include a few bits at the front of the return address that will let the remailer know which key to decrypt the rest with. The dossier problem is a real one, of course. If Julf or his machine is compromised, all the aliases could be revealed. But that's true now, as well. Joe

1 0

Re: anon.penet.fi hacking
by mjr＠netcom.com 02 Mar '93

02 Mar '93

>> Body-Termination-Regex: ^--$ > >Ok... Now.. Show me the regex that strips anything starting with '--', >such as '-----------------------------', except a PGP boundary line... > > Julf Ok... How about: Body-Termination-Regex: ^--$ Body-Termination-Exclude-Regex: ^-----BEGIN PGP [ A-Z]*-----$ Body-Termination-Exclude-Regex: ^-----END PGP [ A-Z]*-----$ Just EXPLICITLY exclude anything you don't want stripped... (Don't know if I got my regular expression just right, but I think you get the idea) At some point (maybe already) the average header collection will exceed the average message in size... Talk about overhead... :-) matthew rapaport Philosopher/Programmer At Large KD6KVH mjr(a)netcom.com 70371.255(a)compuserve.com

1 0

Re: A novel (?) return address idea
by jthomas＠mango.mitre.org 02 Mar '93

02 Mar '93

wcs(a)anchor.ho.att.com (Bill_Stewart(HOY002)1305) write: > > Joe Thomas's proposal for anonymous return addresses is > nice: Thanks :^). [Nice summary deleted] > If you used DES encryption, you could do 32 bits of UID and > 32 bits of salt, you can turn the 64 bits of cyphertext into > 13 printable characters using an obvious 5bit encoding; > a good choice for a mailer is to prepend an x > x<13_char_encoding> ( e.g. xabcdefghijklm ) and not > have any real UIDs starting with x, so your mail delivery > program can easily tell what to hand to the > remailer-reply process and what to deliver more > normally. Yeah, I was thinking around 5 bits per character, and you have to pattern-match something. Could be "an-" or "x" or whatever... > Aside from being nice round numbers, this lets you > support 4 billion users with 4 billion messages each, but > is this really the right balance? Seems about right to me. If there's demand for a different mix, you can always add that later (with a different prefix to clue the software into how to interpret). Meanwhile this version could be implemented quickly, and would offer a good deal of security. As to what to use for the salt... If you don't expect users to send more than one message per second (at least, if they do, they won't mind both of them having the same return address) you can just use a straight timestamp -- Unix gives you 32 bits worth for free (as sec. since 1 Jan 1970). This guarantees you won't have loops from a PRNG. The time won't ever be reset to a past value. [other stuff deleted] I don't really think we need to do any encryption of the ID to address database, since only the remailer software should be using it. And while adding more salt bits might be nice (random bits increase strength against known plaintext attacks -- a danger since you know the approximate time, and that your ID will be the same in each message you send), I don't see how hashing could be useful, since it is one-way by definition. The remailer needs to both create and resolve return addresses. Is the source for the anon.penet.fi remailer available? I might have a crack at implementing this... Joe

2 1

Textual Analysis
by tcmay＠netcom.com 02 Mar '93

02 Mar '93

"Tiia Roth-Biester" writes: >(Jim McCoy) > >>There is no way you can get around taxation if you intend on using this >>system in real life. Your system is much like that of a drug dealer, he >>gets all this money, but has no where to spend it until it has been >>laundered. > >So in other words the earnings of the international banks located "offshore" >and lending $trillions in the "Eurodollar" (now world financial) markets >have been taxed for the last 30 years? Their balance sheets don't reflect >these taxes. This reveals a minor and probably obvious weakness of pseudonyms--writing styles. As I was reading this post from apparent newcomer "Tiia Roth-Biester," and wondering at how a woman (I think Tiia is a woman's name) got interested in this list, I said to myself: "Wait a minute, this sounds exactly like Duncan Frissell!" Sure enough, Duncan wrote it. Imagine what can be done with word and phrase frequency analysis, with examination of punctuation styles (e.g., some people use _this_ for emphasis while others use *this*), and so on. Entropy measures, etc. Someday this may be important. -Tim -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

1 0