- cypherpunks-legacy - lists.cpunks.org

she's at it again :-)
by Karl Barrus 02 Mar '93

02 Mar '93

Cypherpunks, (My apologies if this is already widely known; I haven't seen any mention of it on this list) In the March 1993 IEEE Spectrum magazine on pp. 16-17, Dorothy Denning again floats her support for digital telephony bill in an article entitled "Wiretapping and cryptography". I quote her: "Although government regulation of cryptography may be somewhat cumbersome and subject to evasion, we should give it full consideration. Regulated encryption would undoubtedly provide far greater security and privacy than no encryption at all, the current state of affairs for most personal and corporate communications." Regulated encryption!? This topic was discussed quite thoroughly in sci.crypt in response to Tim May's post. And the topic is still kicking... The article is very interesting, containing many oxymorons: "On the contrary, implementation of an intercept capability together with appropriate security measures is more likely to lead to telecommunication systems that are "smarter," more secure, and of commercial interest to other countries." "while often labeled as "anti-privacy," wiretapping actually serves to protect the privacy of law-abiding citizens and the business interests of corporations" /-----------------------------------\ | Karl L. Barrus | | elee9sf(a)menudo.uh.edu | <- preferred address | barrus(a)tree.egr.uh.edu (NeXTMail) | \-----------------------------------/

1 0

Re: more ideas on anonymity
by pmetzger＠shearson.com 01 Mar '93

01 Mar '93

> From: Theodore Ts'o <tytso(a)athena.mit.edu> > > Date: Mon, 1 Mar 93 13:27:24 EST > From: pmetzger(a)shearson.com (Perry E. Metzger) > > Now, on the issue of slander, the notion of anonymity > is largely unimportant. If I had walked into the middle of the street and > ranted for an hour saying that GM trucks are unsafe, that would be largely > ignored, as most anonymous denunciations likely are. The issue is if a > non-anonymous individual or entity with credibility, like NBC, says > something that is false. > > I don't know about that. It is certainly true that non-anonymous > individual or entity with credibility, like NBC, can do the most amount > of damage when they slander someone. > > But what about someone who sends 20 different mail messages, each > through a different remailer path so they have different reply > addresses, all of them detailing some similar (but false) story about > how some GM truck went up in flames aftering being hit lightly by a Geo > Metro? Or suppose someone sends 20 messages (all different) about how > Perry Metzger stiffed him/her out of some amount of digital cash? I'd > suspect you could do some real damage that way. Not as much, perhaps, > as something like a faked demonstration tape broadcast on prime-time > evening news, but damange nevertheless. I doubt it. As people get more and more used to the capacity to do such things, its likely that such anonymous accounts will be more and more untrusted. Perry

1 0

UNSUBSCRIBE
by nihilis＠mindvox.phantom.com 01 Mar '93

01 Mar '93

UNSUBSCRIBE Love the list, just don't logon and 120 new posts is just too many, especially when I have to tell it apart from stuff straight to me... (maybe if I can get a 14400 dialup to telnet through) |:- nihilis(a)phantom.com -:| |:- Joel Boutros -:|

1 0

Re: anonymity + untraceable digital money = potential problems
by pmetzger＠shearson.com 01 Mar '93

01 Mar '93

> From: ALAN DORN HETZEL JR <dorn(a)indigo.mese.com> > > Dear Group, > > I believe that I see a potential serious problem with they onset of > truly unbreakable anonymous communication combined with untraceable > digital cash. > > The problem is that crimes such as blackmail and extortion would become > absolutely impossible to defend against. Kidnapping for ransome would > get a LOT easier. I see serious problems with allowing people to take drugs. They can get addicted to them. Lets ban medicines. I see serious problems with allowing people to own guns -- they might commit crimes with them. I see serious problems with allowing people to speak freely -- they might blaspheme, or tell lies. Mr Hetzel, I'm an anarchist. I have very little "faith" in human beings, which means I don't trust big complicated structures run on the assumption that human beings are inherently trustworthy -- like governments, for example. I prefer systems that decentralize power and make it possible for people to operate without the necessity to trust each other. Yes, digital cash makes kidnapping easier. So, for that matter, do telephones and cash itself -- had money never been invented, anonymous kidnapping would have never been possible. However, the alternative to permitting market structures to take care of problems in a competitive way is to allow central structures in which we are asked to trust in the benificence of government officials. I'm not the trusting type. If history has had any lesson, it is that governments degenerate and are taken over by evil men, over and over and over. The structures needed to stop digital cash, anonymous postings, and the like would be so draconian as to assure that should a dictator ever wish to sieze power the structures needed to do so would be waiting for him. I'd prefer a system in which he would have to build them from scratch, even if it means one or two people can be blackmailed once in a while. Utopia isn't possible. I'd prefer, therefore, to settle for the best we can do. > > I could send you an anonymous note threating to poison your dog, kill > your wife, burn down your house, whatever..., ... unless you pay me > $$$ in untraceable digital cash. What can you do? Today, I could send you an anonymous note threatening to poison your dog if you don't leave $5000 in the poorbox at the corner church. What can you do right now? Easy. Watch your dog. The police have a myriad of techniques at their disposal. Their jobs have never been easy, but they have to cope with anonymous messages and untraceable cash thefts right now. To eliminate the capacity to use digital cash means to require monitoring of all speech and ban most international traffic, to prohibit strong cryptography and require key registration. Even then I'm not convinced that it would work because people would still try to avoid these restrictions. All technologies are fraught with dangers. All of them. The knife you use to slice your bread can be used to kill your wife. Shall we dispense with knives? Shall we pretend that we can unlearn what we know? A bright 10 year old with a computer can produce a cypher machine. Shall we lobotomize all ten year olds and destroy all the computers? You CANT put some djinni back in the bottle after you've rubbed the first time. We can't stop people from knowing things. At least the well meaning fools who advocate gun control have the fact that good machine shops aren't in practically every home on their side -- telephones, modems and computers are becoming ubiquitous, however, and they are all capable of aiding and abbetting in the criminal techniques you mention. Welcome to the world. Perry Metzger

1 0

Re: CFP Costs Too Much!
by fen＠genmagic.genmagic.com 01 Mar '93

01 Mar '93

> In my opinion, $405 is way too much to pay for this conference. One note on the other side of the coin: Email announcements of the conference began in December of '92, including the complete pricing schedule: > Registration Fees are: > If mailed by: 7 February 8 March on site > Conference Fees: $300 $355 $405 > Tutorial Fees: $135 $165 $195 > Conference & Tutorial $435 $520 $600 Note that there was over a month's time to get registered at $300, and the price of registration is currently $355, *not* $405. Now I have to pay the $355 out of my own pocket (as Magic decided not to pay my way) and I understand the pain you feel with having to shell out such big bucks. But, for one reason or another, I believe that CFP has not done incredibly well financially, and they've got to cover their ass. One way to do that is by encouraging early registration, which smooths the planning process. So get your registration in now! > Registration is limited to 550 participants, so register early and save! > > By Mail: By Fax: > (with Check or Credit Card) (with Credit Card only) > CFP'93 Registration Send Registration Form > 2210 Sixth Street (510) 845-3946 > Berkeley, CA 94710 Available 24 hours > > By Phone: By E-Mail: > (with Credit Card only) (with Credit Card only) > (510) 845-1350 cfp93(a)well.sf.a.us > 10 am to 5 pm Pacific Time On the other hand, Glenn Tenney has done a remarkable job in keeping the price of Hackers down... Fen

1 0

Piercing anonymity and censorship
by ssandfort＠attmail.com 01 Mar '93

01 Mar '93

_________________________________________________________________ FROM THE VIRTUAL DESK OF SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Theodore Ts'o wrote: ". . . I don't like censorship in any form. But disclosing who sent a particular piece of anonymous mail is not the same as censorship." How about FORCING a third-party to make such a disclosure? It seems Ted would ask or force remailers to be the nets' policemen. If remailers are required to compromise the anonymity of their service, the "chilling" effect on speech IS censorship. ". . . there are people who believe . . . that libel and slander laws shouldn't exist. But it's not fair to call that a mainstream position. And it is unreasonable to assume that as an axiom." I never claimed that such a position was "mainstream" nor assumed it was an "axiom." I don't think I've seen ANY "ad populum" arguments (other than Ted's) on Cypherpunks, we tend to think for ourselves. ". . . *MOST PEOPLE* also don't believe that the right to privacy is absolute. It certainly isn't explicitly listed in the *U.S. CONSTITUTION"*. (Emphasis added.SS) Our desire for privacy is not the result of a *popularity contest* nor is it an argument from *authority*. Rather, it is derived from the logical requirements of freedom. "But in order to punish the perpetrators, it is first necessary to *identify* the perpetrators......" RE-READ my post, Ted. S a n d y ssandfort(a)attmail.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

A novel (?) return address idea
by jthomas＠mango.mitre.org 01 Mar '93

01 Mar '93

It seems clear now that the default behavior of the anon.penet.fi remailer (generating only one anonymous ID per user, and anonymizing all messages to other anon users with that ID) is inadequate. At the same time, Julf argues persuasively that users have come to expect that their replies to anonymous Usenet articles will be anonymized. The current na/an address workaround is okay, but I think we could do better. Here's my scheme: When a user first mails to or through a penet-style remailer, the remailer software will automatically allocate an ID for the sender's return address, as usual. _But_, it will keep this number secret, in an internal database. Let's consider this ID to be a binary number. The remailer appends to this ID number some "salt" bits (random bits, perhaps with some time-stamp info to guarantee that the same salt bits are never applied twice, if the RNG is weak). This collection of bits is then encrypted with a secret key only the remailer knows (note: this should _not_ be the secret half of a public/private key pair, for reasons that should become clear). The encrypted bit string is converted by a uuencode/armourtext process that produces characters that will be legal for an e-mail address. This is then used for a return address. When someone wants to reply to an anonymous message or post, the remailer decrypts the address, ignores the "salt" bits, looks up the anonymous ID in its database, and sends it on to the desired recipient. The advantage of this scheme is that no two messages will have the same return address, and no information about the sender can be gleaned from the return address; yet the remailer can allow replies to every message without keeping any more records than it does under the current version. A couple disadvantages could be running out of bits for the return address, and adding more encryption work for the remailer. You'd definitely have to own the machine, and implement some, er, different mailing software, since you'd have to accept mail for users with any random name whatsoever. And, of course, this method is only useful for penet-style remailers, not cypherpunk/mixnet remailers which should not remember anything about messages that pass through. What do you all think about this for a "Mark II" anon.penet.fi? Joe

2 1

anon.penet.fi confusion
by nowhere＠bsu-cs.bsu.edu 01 Mar '93

01 Mar '93

I thought that someone would bring it up, but since no one has, I guess I will. Isn't is very easy to accidentally type na1234 or an1234 when intending the other? It's just a matter of transposing two characters. This could result in a user signing a message that is sent with the anonymous ID or accidentally sending the actual address when thinking it was anonymous. Since a password can be assigned, the prior could be eliminated, but the latter is still possible. I commend Johan for his work and appreciate the new service, regardless of how it may sound. Chael Hall -- Chael Hall nowhere(a)bsu-cs.bsu.edu, 00CCHALL(a)BSUVC.BSU.EDU, CHALL(a)CLSV.Charon.BSU.Edu (317) 285-3648 after 5 pm EST

1 0

RE: CFP Costs Too Much!
by Pat Farrell 01 Mar '93

01 Mar '93

In Message Sun, 28 Feb 93 15:44:21 -0800, tcmay(a)netcom.com (Timothy C. May) writes: >.... I would also dearly like to attend CFP, but I also would dearly love to attend CFP again. I went to last year's session on a student subsidy and loved it. It changed the direction of my academic study. I don't understand where CFP's organizers are coming from. I applied for a student tuition subsidy for this year, and heard nothing. I submitted a request for a "birds-of-a-feather" session to talk about key registration, and got Dorothy Denning, TC May, and Mike Godwin to tentatively agree to participate. I've heard nothing. It is much too late to get cheap airfare to SF, so I'm not going. I'm a student. I can't afford the $2000 that attending CFP will cost, including airfare, hotel, meals, conference fee, etc. I admit to having a part time job, which supports my wife, daughter, mortgage, and pays tuition and buys books. It sure doesn't pay well enough to afford CFP93. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA PGP Public key availble via finger #include <standard.disclaimer>

1 0

Mail server for PGP sources
by dclunie＠pax.tpa.com.au 01 Mar '93

01 Mar '93

I gather some people have had trouble obtaining sources for PGP. I have accumulated those I can and they are available from my mail server. If you can get these somewhere closer then great, but if desperate feel free to get them from here (as long as the load doesn't get out of hand I will keep it going). The address is "mail-server(a)pax.tpa.com.au". Help is available by sending in the message body: send help end An index of PGP files is available by sending in the message body: index pgp end And results in something like the following ... Date Size Index: pgp ---------- ------ ---------------------------- 1992/12/25 216K security/pgp/macpgp2.0.sit.hqx 1992/12/25 160K security/pgp/msiguide.zip 1992/12/25 33K security/pgp/ngclon11.zip 1992/12/25 168K security/pgp/pgp-ng.zip 1992/09/13 184K security/pgp/pgp20.zip 1992/09/13 376K security/pgp/pgp20src.zip 1992/12/25 536K security/pgp/pgp21.tar.Z 1992/12/25 192K security/pgp/pgp21.zip 1992/12/25 656K security/pgp/pgp21ami.lha 1992/12/25 240K security/pgp/pgp21os2.zip 1992/12/25 440K security/pgp/pgp21src.zip 1992/12/25 224K security/pgp/pgp21_next.tar.Z 1992/12/25 256K security/pgp/pgp21_sparc.tar.Z 1992/09/13 464K security/pgp/unix_pgp20.tar.Z Probably pgp21.tar.Z or pgp21.zip are what you want for unix or pcdos respectively. If anyone has a more recent mac version I will put that up too. david

1 0