- cypherpunks-legacy - lists.cpunks.org

This list...
by pmetzger＠shearson.com 25 Jan '93

25 Jan '93

>From: peter honeyman <honey(a)put-in-bay.citi.umich.edu> >> The whole point of this list is to develop techniques to ensure privacy -- >> most of us understand that there isn't much right now. >but but but ... sendmail already offers an easy way to hide the membership >of a mailing list. why not use it? Prehaps that would be of value, but its best not to think of it as worth too much. After all, the bad guys can likely just subscribe to the list, and they could always just eavesdrop on the outgoing mail. Fixing this "hole" is o.k. so long as no one believes that it has actually added to security in any substantial way. Its best that no false sense of security be engendered. Everyone should know and understand that the structures as they exist are almost completely insecure. Perry

1 0

This list...
by Phiber Optik 25 Jan '93

25 Jan '93

I'm not one to overlook the obvious. Is it desireable that any Tom, Dick, or Harry can telnet to toad's SMTP port, and use the sendmail expand command to list everyone on this mailing list? I'm sure less net-savvy users on this list are unaware, and it should be said.

3 2

signature trades
by Marc Horowitz 25 Jan '93

25 Jan '93

I'm going to be in New York City on Wednesday, January 27. I'll be available in the evening if people want to get together somewhere and trade signatures face-to-face. I know some people on this list are in that area. Email me personally; I'll coordinate and send mail to everyone who expresses an interest. If you have a good idea for a place to meet, please make a suggestion, since I don't know all that many places to meet. Marc PGP key in case you want to encrypt: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.1 mQBNAirbf1kAAAEB/jCF0mjoZe7YYWpSxOJFlfr6F+39KvuL0k5DptL4A0C95Pqh dpkbGbD3kolxy469SyQiB6Xlx2V5zIvlrIy0uVEABRG0HE1hcmMgSG9yb3dpdHog PG1hcmNAbWl0LmVkdT6JAI0CBRArV5t3QvCl/Jcp1JsBAW75A79O9ZXpSCIAlk/V bVmdFJ2uXBpmJj1KdP8FInk+6zTwFSVjphtZ8WCGo0U8UPP509zeOpk9Pd+0FVv0 9j9vnJcFjCrXJq4rbxCimFpqpXZaMsF4AQ0ry6wi7MdhOZXrkTTEsKRo1MPhAQg6 yUFb95nKrl1Ub5STZ7OJAJUCBRArV5thVN1fojxmJGcBAZKzA/9gobjB0g2ECwhO wZweiGu0oivh2u++njPW5VgLtHgqLU4blTew1YdOgIe053pifdEblTBnXPri8vDs 0GBoPjXNlhPz/l/JZvhaPYnAPpJ2Q3sE8La4pcs1o5UTlKmOE8rtu8fIMB6Lz5gC v6jo0KhRQpcGepkJGEk8gdKzdmVY2okAVQIFECsztFcfWxp2jm/yjQEBDwoCAINK AcYmW1lm4F5T/pegjD+CZHyrlGDwDGRKOMMbLhBuZbxbBlQsFGO5bcviiJSMyLIE UUQcbDUC+uKU6zpIEhSJAJYCBRArKWOyr3CNl7EvuMEBAeaWBAICCWysNgLatvry zPnAxZICFQP4Qwm8JuP5x/uguyqDEnpnD6g+iZEV6NKsL8Z09XAec2/8KAg7yKYu it8oQe8/yMJH26Iv1BLCjXN6kgFkeCt3usezBH22/yBQ6vsU9KMIRCfx30XD9MpV jUle75y3B8IN0vEQVPGQSs7KBJKeowKJAJUCBRArFJoTpsOAT/N2gT0BAQrYA/0c BKMxFlvQMacpPR2/O7ZNlJhRoTp8q3mQNl5fW2+gY6uOEfR3Q5OmgR/HQOQmx01+ PmmqrCpeDYE4hNZN+KnHw8OQlTwe7RCtNisl+0HcSxweprbSJgVEUAWMCLwkg3bF 2NP9kXO+btZBFXtaF2FFHu7Sd11Ud4qllY6eix95TIkAdQIFECruHvx1Eb4Sc5bT twEBTXsC/i3l36A4j5OwBsTUBOcRCCZaGtwOMVR/Gf1LKkzbDQK4MMbKWeNCeDrr p9WMad2sPzgn3qb1xPxW2TJs7KPzaKY/44NJNRTaUedNTok1/g+JECl8kO5hlcxF 5GBIpasyc4kAlQIFECsMey1cv+w5Zs6JtwEB+VAD/ReV12oKmYPDGoYdmi18EZ6E bBF67LlQYVzeTAj1gX+QZOI8cqsHeiKTpY2UUSaTVtmXD8bzKW7RQrlK4eT5YPBS 9UF4czyhYh3ZVcVQzjDRLP29x0+yUX7o0l9VhMO9JMNaTlsfuwZoNY6gabHN7bMu JdyB9JC41CU82xw2zAGEiQBVAgUQKwx5YQeIzKyfnzi7AQH2cwH/cpWg2vHeJJL4 ZzFDg/+3ijvxjHDQCmvF9F2SjEX9IVAeBAy+AShkcD+adce0nLxdKCYBWYPb0xtZ iI3PFgDPa4kAlQIFECsKculuC7y+W0FWIQEBAU0D/0uhXjhGgHP0P3Bjq8onmN7H goLQHjZML0kzinLzGsa7tWJzNafEDnEsxZX1XrTeV6JEsf31T7EN09vSHtcJEjSy IyTHIWnXqgTnvoBmBQNSzEIDF1XVUdTa95SG8HU0os98exo64hutBCP8yVihe/1J PpGBtEMQWuh1UbAP1iWxiQBuAgUQKtxRRDh0K1zBsGrxAQE2UwLFF7GJeCwfBJg4 ILXqll0zRmLnBIx42RG5fJwHs5m/uZt8qp7qYXK0D6pqgtypFJavdfVGbC+A4Dhh Vw7WKjSQRuXrvhd5Yje+qal6aEpTOD+zDaOZxccTosmJAFUCBRAq24DnVQVm+k0M TuEBAflaAf9M33fLLs1VFZLjDAZWQzkFMl5toykd32uRQBW55REMIRWO1A+mQBmn IcOHC7RL9wdWwmKGkC0YxFGnCRRdSZi0iQBVAgUQKtuCsMyL5ayMtLlRAQF8nAH9 GVgelMbV7O1oUqop644DSoeoGHgWU2koqshXLta/55dx43Lw9o1PVY90Oap+oCVs Ys0xE5TlSQOc4GGJP/HtoQ== =37CN -----END PGP PUBLIC KEY BLOCK-----

1 0

e-mail...
by Phiber Optik 25 Jan '93

25 Jan '93

To the genius (Matthew Sean Pardo, mpaf1216(a)pelham.med.unc.edu) who thought he was being clever by sending what he thought was "anonymous" mail to me (by telnetting to port 25), you missed my point. There's no need for the EXPN command to be used remotely. I can only suggest that John Gilmore disable it at toad, though it probably doesn't matter anymore. If anonymity and privacy are as key as people are making them out to be on this list, I find it ironic that privacy is lacking on such a simple level.

1 0

Rational PC mail , was Re: PGP on BBS
by pfarrell＠cs.gmu.edu 25 Jan '93

25 Jan '93

Marc(a)mit.edu writes: > >What you are all talking about here is a solved problem. Many such >network protocols exist. SLIP is probably the best example. If you >use SLIP to connect to the BBS instead of a dumb terminal connection, >you get a real network link which supports multiple connections to >multiple destinations. And free SLIP implementations exist. The >author of one of the most popular is on this list, in fact. It is a solved problem. It doesn't even require SLIP. I spent lots of hours over the past year trying to get SLIP to work with the GMU computers. it is officially "not supported" With NUpop and Eudora, SLIP is optional. The NUpop docs say that SLIP slows down the transfer, and recommends simple ASCII async connection using a reliable modem (MNP or V42/V.42bis) >Of course, this requires that your "terminal" be somewhat intelligent, >but even a lowly 8088 PC running DOS can run SLIP. > >If you do this, all you need is a BBS which supports network services, >instead of the current menu-based sort of systems we have now. If you >want to encrypt, you do so locally. In fact, you'd probably do almost >everything locally. Using a computer as a computer is clearly the way to go. There are a number of low-cost or free Unix providers, I expect that they do, or can be talked into supporting POP. I expect that current terminal/menu based BBSes will disapear once folks realize how much better easier, faster, and all around better programs that use computers as computers work. Pat Pat Farrell, Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer

2 1

no subject (file transmission) (fwd)
by avalon＠coombs.anu.edu.au 25 Jan '93

25 Jan '93

CFP'93 The Third Conference on Computers, Freedom and Privacy 9-12 March 1993 San Francisco Airport Marriott Hotel, Burlingame, CA The CFP'93 will assemble experts, advocates and interested people from a broad spectrum of disciplines and backgrounds in a balanced public forum to address the impact of computer and telecommunications technologies on freedom and privacy in society. Participants will include people from the fields of computer science, law, business, research, information, library science, health, public policy, government, law enforcement, public advocacy and many others. Some of the topics in the wide-ranging CFP'93 program will include: ELECTRONIC DEMOCRACY - looking at how computers and networks are changing democratic institutions and processes. ELECTRONIC VOTING - addressing the security, reliability, practicality and legality of automated vote tallying systems and their increasing use. CENSORSHIP AND FREE SPEECH ON THE NET - discussing the problems of maintaining freedom of electronic speech across communities and cultures. PORTRAIT OF THE ARTIST ON THE NET - probing the problems and potential of new forms of artistic expression enabled by computers and networks. DIGITAL TELEPHONY AND CRYPTOGRAPHY - debating the ability of technology to protect the privacy of personal communications versus the needs of law enforcement and government agencies to tap in. HEALTH RECORDS AND CONFIDENTIALITY - examining the threats to the privacy of medical records as health care reform moves towards increasing automation. THE MANY FACES OF PRIVACY - evaluating the benefits and costs of the use of personal information by business and government. THE DIGITAL INDIVIDUAL - exploring the increasing capabilities of technology to track and profile us. GENDER ISSUES IN COMPUTING AND TELECOMMUNICATIONS - reviewing the issues surrounding gender and online interaction. THE HAND THAT WIELDS THE GAVEL - a moot court dealing with legal liability, responsibility, security and ethics of computer and network use. THE POWER, POLITICS AND PROMISE OF INTERNETWORKING - covering the development of networking infrastructures, domestically and worldwide. INTERNATIONAL DATA FLOW - analyzing the issues in the flow of information over the global matrix of computer networks and attempts to regulate it. The conference will also offer a number of in-depth tutorials on subjects including: * Information use in the private sector * Constitutional law and civil liberties * Investigating telecom fraud * Practical data inferencing * Privacy in the public and private workplace * Legal issues for sysops * Access to government information * Navigating the Internet INFORMATION For more information on the CFP'93 program and advance registration call, write or email to: CFP'93 INFORMATION 2210 SIXTH STREET BERKELEY, CA 94710 (510) 845-1350 cfp93(a)well.sf.ca.us A complete electronic version of the conference brochure with more detailed descriptions of the sessions, tutorials, and registration information is also available via anonymous ftp from sail.stanford.edu in the file: /pub/les/cfp-93 or from sunnyside.com in the file: /cfp93/cfp93-brochure or via email from listserv(a)sunnyside.com by sending email with this text: GET CFP93 CFP93-BROCHURE

1 0

Neuvo-Crypto
by Matt Willis 24 Jan '93

24 Jan '93

I'm researching fractals here at glorious Stetson University and it crossed my mind that there are possibilities in the combination of fractals with current encryption standards... for instance, using a piece of the mandelbrot set as a key or a Julia set with a standard center and radius, thereby reducing a key to a sort of x,y,z,F() coordinate... And if you and a friend established a standard equation... that would make it a sort of three-key system. On a simpler level, couldn't the RSA method be converted to use the Complex number system... (which is the base of fractal mathematics) Anyone follow? +-------Matt-Willis--------------------------------+ | Matt Willis ASTMWILL(a)STETSON.BITNET | elsewhere: | Matt Willis Head of the Underground | mwill(a)mindvox.phantom.com | Matt Willis Robotech PBM List | +-------Matt-Willis--------------------------------+ "Absolutely alone in awareness of the mechanism." -Agrippa by WG

1 0

Re: public privacy, NSA resources
by pfarrell＠cs.gmu.edu 24 Jan '93

24 Jan '93

A fellow cypherpunk lister says about the number of employees at NSA: >40,000? Is this for real? Does anyone know how this would compare to >FBI or CIA? Also, does anyone have a clue on the black budget? The >author seems to hint here that while it is not "readily discernible" it >might be inferrable. > The number of employees at the FBI is public info. I don't have it at hand. CIA employment used to be secret, and may still be. Of course you can buy a picture from SPOT and count the cars for an estimate. At both agencies, there are a significant number of contract employees, who are not on the employment rolls, but are efectively the same as government employees. They aren't counted in public info. I can't guess at the number of NSA folks. But I can relate an story.... I gave a paper at this year's National Computer Security Conference, in Baltimore. Like all conferences, it had a registration area, vendor's booths, etc. Following form, it had nice folks behind counters with signs over the top, with the usual: Prepaid A-F | Prepaid G-M | .... | Walkup | Press | ... sections. What surprized me was the row of counters labeled: NSA A-E | NSA F-H | ..... NSA W-Z There were as many NSA booths as all the rest combined. (ok, +- 10%) Another aside. The NCSC is essentially a front for the NSA. NCSC exists but has no more than two employees, one is the secretary to an NSA official. Pat Pat Farrell, Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer

3 2

NUpop is the answer was Re: PGP on BBS
by pfarrell＠cs.gmu.edu 24 Jan '93

24 Jan '93

I don't know if the sources are available, NorthWestern's NUpop is the key to making PGP acceptable to masses of not-very-computer-literate users. Ask archie for nupop103.zip NUpop is a PC (MS-DOS) program that uses the PC as a computer. It uses SMTP to send mail and receives mail via POP. It works on networks and thru dialup. It works with SLIP and more simply over a reliable ASCII connection. It is a great program. CUA, mouse, folders, auto sigs, etc. All it needs is to have a "encryption outgoing" flag in its "group" (alias) directory, and pump the message thru PGP in filter mode. On receipt, find the PGP headers, push thru the filter, and show the clear text. I haven't looked for either the PGP or NUpop sources, but I'd expect this to be a near trivial hack. It may even be already done. NUpop (and its Mac equivalent Eudora) are the right way to get users on the net. Using a PC as a VT100 to login to a full blown Unix system, using vi to edit mail, etc. is near criminal. NUpop makes it easy enuff for econ profs. (Seriously, I set up NUpop for an econ prof here last weekend. He loves it. He is definitely not a Unix wizard.) If NUpop source is not available, then we'll have to reverse engineer something similar. I've learned how NUpop does the communications, and it is straight-forward (also in the RFCs if you care to look) I thought about doing a Windows-only program, but wonder if we really have to support diehard DOS users on ATs and less. I've been meaning to ask about source availablity. I'll do so now, and probably have an answer tomorrow. Pat Farrell, Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer Write PKP. Offer money for a personal use license for RSA.

1 0

Re: PGP on BBS
by david.brooks＠cutting.hou.tx.us 24 Jan '93

24 Jan '93

Eric Hughes speaks: EH> The solution is cooperative processing systems, where both the host EH> and the terminal cooperate to perform some task. Unfortunately, there EH> is precious little software infrastructure to support such a EH> development. Terminal programs on PC's are still for the most part EH> acting as dumb terminals, with the notable exception of file transfer EH> protocols such as zmodem. EH> I believe that cooperative communication software will be necessary EH> for widespread use of cryptography--not just pleasant, but a EH> precondition to large scale deployment. You've hit the nail on the head here, Eric. If public key encryption is REALLY going to be for the masses, we are going to need something like this... But it seems I'm going to have to code the damned thing myself, eh? Anyone want to help? EH> Onward. Indeed! David david.brooks(a)cutting.hou.tx.us * Q-Blue v0.7 [NR] * ---- +---------------------------------------------------------------------+ | The Cutting Edge BBS (cutting.hou.tx.us) A PCBoard 14.5a system | | Houston, Texas, USA +1 713 466 1525 running uuPCB | +---------------------------------------------------------------------+

2 1