- cypherpunks-legacy - lists.cpunks.org

anonymous server compilation?
by ld231782＠longs.lance.colostate.edu 26 Jan '93

26 Jan '93

Hello. To my knowledge no public listing of known anonymous servers has been compiled. I'd like to start one. This could possibly turn into a FAQ if response is good. I will put in this newbie-type introductory information at the end of this document for review. Please help me improve this by sending constructive/informative feedback, esp. sections flagged with (?). This all is very weak right now but with your help it could become very thorough and valuable. pax.tpa.com.au -------------- The most sophisticated anonymous posting system to my knowledge. Uses public key encryption for traffic in both ways (to/from) the server. No anonymous remailing capabilities yet but dclunie(a)pax.tpa.com.au, the administrator, says he's considering it. Had a serious bug recently fixed that caused a reassignment of previously allocated anonymous addresses. Located in Australia. anon.post.g(a)pax.tpa.com.au for anonymous USENET posting where `g' is the group anon.info(a)pax.tpa.com.au for information anon.subscribe(a)pax.tpa.com.au to subscribe to the mailing list acs(a)n7kbt.rain.com ------------------ no info (?). given to me by dclunie(a)pax.tpa.com.au godiva.nectar.cs.cmu.ed ----------------------- operated by Karl_Kleinpaste(a)cs.cmu.edu. Mentioned by julf(a)penet.fi in an introductory information. This person has posted code to alt.sources that implements anonymous server capabilities. (?) anon.penet.fi ------------- operated by julf(a)penet.fi. Both anonymous posting and remailing capabilities. (?) hh(a)pmantis.berkeley.edu ----------------------- no info (?). given to me by tcmay(a)netcom.com Anonymity and Identity on the Internet ====================================== Generally, identity is amorphous and almost nonexistent on the Internet for a variety of reasons. One is the inherent fluidity of "cyberspace" where people emerge and submerge frequently, and absences are not readily noted in the "community". You currently do not really have any great assurance that the messages you get in mail and the messages you see on USENET are from the people they appear to be from, nor do others have of you. Be careful not to be led astray; gullibility is perhaps the greatest crime here, and skepticism the most useful virtue. Neither are there currently good assurances of privacy in your personal email, and cases where it has been compromised are not uncommon. New encryption technologies are slowly gaining acceptance and penetration into systems that make possible digital encryption and authentication that will make the systems more trustworthy. These can also protect your identity and privacy by offering anonymous posting and mailing capabilities. USENET USENET is a worldwide decentralized news distribution system, adhering to Internet standards described in RFC977 (?). MAIL The characters that you are reading are almost certainly encoded in ASCII, the American Standard Code for Information Interchange that maps alphabetic and symbolic characters onto numeric codes and vice versa. Virtually every computer system uses this code, and if not, has ways of converting to and from it. When you write a mail message, it is being sent in ASCII, and since the standard is virtually universal, there is no intrinsic privacy. Anyone with access to hardware involved in forwarding the message can theoretically read it. Internet mail standards, described in RFC (?), are still evolving rapidly and not entirely orderly. For example, standards for mail address `munging' or `parsing' tend to vary slightly between sites and frequently mean the difference between finding addresses and bouncing mail. New standards are calling for uniform introduction of "privacy enhanced mail" (PEM) which uses encryption technologies to ensure privacy. The current internet mailing protocol is slightly anachronistic in that it was created when the system was somewhat obscure and not widespread, with only a fraction of the traffic it now sees. Today about (?) of internet traffic is mail, comprising about (?) messages. (Source: (?)) A person's mailing address is far from an identification of an individual. First, anyone with access to the account, e.g. they know the password, either legitimately or otherwise, can send mail with that address in the From: line. Secondly, as part of current mailing protocol standards, forging the From: line is a fairly trivial operation for many hackers. Much less forgable is the status and path information prepended to messages by intermediate hosts. Note that bounced messages go to postmasters at a given site in their entirety. This means that if you address mail with an incorrect address it has a good chance of being seen by a human other than the recipient. Theoretically people at any site in the chain of sites that forwards a given mail message over the Internet (about a half-dozen (?) on average, depending on the distances) could potentially compromise the privacy of that message and read it. In practice, this appears to be rare or unheard of. Something more common is instances of immature and unscrupulous system operators reading private mail at a local site, such as a university. The requirements and screening for getting a system administration job (and access to *all* information on a system) vary widely between sites and are sometimes frighteningly lax. ANONYMOUS MAILING ----------------- Some people find it useful to send anonymous mail to others. Examples of this include (?). Here the distinction should be made between sort of "hit and run" mail, where the sender does not want to carry on any further communication, and anonymized mail, where the recipient can respond but has no idea of the sender or origination of a message. The servers listed above allow for the latter type of communication. The former type is now largely confined to hackers who find it convenient for scurrilous threats or whatever, but probably has legitimate uses as well (?). Another category is people who want to appear to have regular but not traceable appearances, i.e. the userid and site origination do not obviously flag their mail as anonymous. Unfortunately, no set of standards is in place to handle the procedures for anonymous posting. Typically the approach is to set up an "anonymous server" that, when activated by email to its address, responds by allocating and supplying an "anonymous ID" that is unique to the person requesting it (based on his email address). This will vary for the same person for different machine address email originations. To send anonymous mail, the user sends email directed to the server containing the final destination. The server "anonymizes" the message by stripping of identification information and forwards the message, which appears to originate from the anonymous server only from the corresponding anonymous user id.

2 1

NSA STRENGTH
by John.Nieder＠f33.n125.z1.FIDONET.ORG 26 Jan '93

26 Jan '93

from: john.nieder(a)f33.n125.z1.fidonet.org >> I am doubtful of the 40,000 figure even with contract employees. That's >> a small army. What the hell could keep that many people busy? (shudder) >NSA occupies two very large office buildings, including the longest >corridor in the world (a mile, if I recall correctly, but my copy of >"The Puzzle Palace" is not handy). I went and took a look, and can >confirm the parking lot is _huge_. As is the case with a good many other gov't. agencies, one can be sure that all the crew are not 9-to-5ers showing up at one office. >The 40,000 figure may or may not be accurate, as the NSA won't say. >Some say the employment is closer to 100,000. Certainly it is much >higher than that of the CIA. It has been a good many years since I traveled in the lower strata of these circles, but it was my information that the NSA, at least at that time, had a manpower pool "hugely greater than the CIA's." It is my understanding that the NSA budget is highly classified - unavailable even to most members of Congress. >Bear in mind that they are the nation's >primary SIGINT facility... I believe you'll find that the NSA also is involved in SATINT & ELINT as well. Never Say Anythings are busy little bees. >operating the various listening posts in >conjunction with military personnel (via Army Security Agency, Naval >Security Group, Air Forc, etc.). It is my belief from personal experience that the NSA requests & receives operational assistance from those innocuous agencies in positions to gather information of use to the NSA in the course of their routine duties. >As always, read James Bamford's "The Puzzle Palace," which gets >referred to a lot on this list. I've tried to read this famous tome a couple of times, but have been unable to hack its turgid prose. Someday. perhaps... > Public Key: waiting for the dust to settle. Excuse me, Tim? JN -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.1 mQCNAitWeuoAAAEEAN2DcLjYiri8Th9HlUFfCxSyxt/FZLjIX121kWoGax9hb8wM QRTtjeN+FKHdkdzD8zr7P+GbExF0X5DhZp02O1te6/2fuHDESHYUsymQpyDqoJpH wd7xZ/VraYhEX6eQzbbS4k5jbdQLzzIdgD8URzAMXYmTkvLrXhAm8ppE4nk3AAUR tDFKb2huIE5pZWRlciA8am9obi5uaWVkZXJAZjMzLm4xMjUuejEuZmlkb25ldC5v cmc+ =237u -----END PGP PUBLIC KEY BLOCK----- ... Who has the USSR's BIOWAR contageous snakebite virus? --- Blue Wave/Opus v2.12 [NR] -- John Nieder - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!33!John.Nieder INTERNET - John.Nieder(a)f33.n125.z1.FIDONET.ORG

1 0

Re: New Anonymous Remailer site avail.
by The Phantom 26 Jan '93

26 Jan '93

On Mon, 25 Jan 1993, Peter Honeyman wrote: > > After the forcing down of the penet site ... > > you mean pax, not penet, right? > > peter Yes -- sorry. Matt Thomlinson University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 528-5732 PGP 2.0 key availaible via email or finger phantom(a)hardy.u.washington.edu

1 0

Re: New Anonymous Remailer site avail.
by Peter Honeyman 26 Jan '93

26 Jan '93

> After the forcing down of the penet site ... you mean pax, not penet, right? peter

1 0

Re: anonymous server compilation?
by Peter Honeyman 26 Jan '93

26 Jan '93

> Unfortunately, the anonymous sytem at pax has been closed, as the local > network in Australia was considered unsuitable for this kind of thing, > partly due to the narrow bandwidth of the link to the US, and partly because > of the prevailing attitude at the US end that anonymous mail is generally > a bad thing. i thought the latter theory was debunked -- ? peter

1 0

Re: public servant privacy
by Peter Honeyman 26 Jan '93

26 Jan '93

i believe there is a special exception related to automobiles that makes them subject to search without a warrant when the driver is placed under arrest. but check with a lawyer. peter

1 0

Re: This list...
by Peter Honeyman 26 Jan '93

26 Jan '93

eavesdropping on the list would not reveal lurkers. peter

1 0

New Anonymous Remailer site avail.
by The Phantom 26 Jan '93

26 Jan '93

After the forcing down of the penet site, with the help of Hal Finney I've set up a remailer located at phantom(a)mead.u.washington.edu. Mail is not cc'ed or kept track of, unless I start getting complaints about abuse, which I will investigate. PGP public key available via finger at phantom(a)mead.u.washington.edu. I'm pretty sure if all of the encryption bugs are worked out, but I would much appreciate someone helping me out on this; If you do send a message through it and have problems, let me know. Aw, heck, here's the public key - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.1 mQCNAitcsHIAAAEEAPZ3Ex1rEwKLeANRoaRyTA72htDFGiGPmWkowByZyUtRkTRp Vs/WdhgoJ1VLz76Chyb63I+ejpekeJfOud98gMh2HtVoTjNGYAawpCKo15tFyzYn BFYVy0NjroyxwM6YnPCsYfYMpvyjEa5mfgrlyzvYBBeTDRD89vYoe7Eue0fDAAUR tDJBbm9ueW1vdXMgUmVtYWlsZXIgPHBoYW50b21AbWVhZC51Lndhc2hpbmd0b24u ZWR1PokAlQIFECtcqWpkhnxaNc7AOQEBZ+8EAIOOvsFf/niUrWw0BRvPhSEmtzrA kQJt3q7kPXutjj3IsJ1/oR8oGhv4iPQ5BmNvvd5dnsbbCqOurhaftVgzlSpyQcYi VryeNVvpdeX1+VTS7N+lAHVAlqnimoaEtUUIftDoDIjNNKRDi+nU4GbbL+1MqveC 1LKQMIi1WPjr6Wpw =1XNo -----END PGP PUBLIC KEY BLOCK----- Matt Matt Thomlinson University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 528-5732 PGP 2.0 key availaible via email or finger phantom(a)hardy.u.washington.edu

1 0

Re: anonymous server compilation?
by dclunie＠pax.tpa.com.au 26 Jan '93

26 Jan '93

> Hello. To my knowledge no public listing of known anonymous servers has > been compiled. > pax.tpa.com.au > -------------- Unfortunately, the anonymous sytem at pax has been closed, as the local network in Australia was considered unsuitable for this kind of thing, partly due to the narrow bandwidth of the link to the US, and partly because of the prevailing attitude at the US end that anonymous mail is generally a bad thing. david

1 0

Re: public servant privacy
by edgar＠spectrx.Saigon.COM 25 Jan '93

25 Jan '93

My friend Dave del Torto said recently: Tim May notes (appropriately) that: >>Strong crypto means even Ollie North can fully protect his >>records. Yes, but shouldn't he be _required_ to "open" his files if he is under criminal investigation just like a drug-dealer who's required to open the locked trunk of his car? Actually, the drug dealer is *not* required to open his locked car trunk. But he might as well, otherwise the police (with search warrent) will force it open, probably causing some damage which they will not pay to repair. There doesn't seem to be any practical way to "force open" a (strongly) encrypted message without the key. Failure to produce the key when ordered might be an excuse for firing a govt. employee, but it can't be the basis for a criminal prosecution (5th Amendment). "Murdering Thug" further commented: Well, there are really two conflicting issues here: 1) The Fifth Amendment - the right not to testify against yourself, hence the Miranda warning when you're arrested. You can claim that being forced to decrypt your hard disk by the cops violates your Fifth Amendment rights, and refuse to decrypt it. 2) Obstruction of Justice - by not handing over the key to your hard disk, you may be obstructing an investigation. By not decrypting your hard disk under court order, you maybe be held in contempt of court. Number 2 may work for law enforcement if they are investigation a third party and ask to see your hard disk in order to help their investigation. A good example is an Internet site that is being used as a telnet launch-pad by some hacker. If that site refuses to cooperate and keeps their files encrypted, the police/court may charge you with obstruction of justice or contempt of court. HOWEVER, if you feel that by decrypting these files, you would be providing testimony/evidence against yourself, you can plead the 5th, and tell them to go screw themselves. Pleading the 5th will fail if you are offered *immunity* from prosecution for anything you reveal (as Ollie North was, recall, for his testimony before Congress). If you still don't want to testify (to avoid providing damaging evidence against your friends, for example) your next line of defense is "I forget". Very hard for the prosecutor to prove beyond reasonable doubt that you really remember that secret key. -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Silicon Valley, Ca

1 0