- cypherpunks-legacy - lists.cpunks.org

Re: Pasting in From:
by Charlie Comsec 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- "Robert A. Costner" <pooh(a)efga.org> wrote: > >But you don't need a special anonymity server to do that; > >a keyserver plus either a personna certificate or some archiving mechanism is enough. > >The certificate shows that you're the first+only person at that > >certificate issuer to use the name you've chosen; the archive > >shows that the first poster using the name <nym> used PGP Key <key>. > >I have a PGP key I use for signing pseudonyms which performs > >the personna certificate function - I'll verify uniqueness > >of keys that I've signed. > > I was thinking of remailers sending out anon messages with a distinct from > line that has zero connection (in the nym database) to any email address. > Is this possible? To establish a nym only through one way communication? I can think of a couple of ways this could be implemented. You could either allow the user to select an e-mail address to use, then do an nslookup to verify that the domain does not exist, or else choose a domain that's actually nothing but a bit bucket. The cleanest implementation might be to create a "bitbucket.efga.org", alias all incoming mail (except for perhaps "postmaster") to /dev/null, then assign non-replyable 'nyms off of that. That would eliminate the need for managing reply blocks and confirmation cookies. This is much more preferable to these people you see who post with a From: address of "nobody(a)nowhere.com", probably not realizing that nowhere.com is actually a real domain. But implementing such a server is still a lot more work than simply allowing From: headers to be pasted and allowing source blocking for anyone who is worried about being the victim of abuse of such a scheme. - --- Finger <comsec(a)nym.alias.net> for PGP public key (Key ID=19BE8B0D) -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBNIRgZwbp0h8ZvosNAQGC7gf+PRUB+6Zuxns3E+BWZoM3kkzn4MD9vcip 1MvQRFRvTTdvGM4vFySYcZByv7SQJdIiVZItyzMe4qMz+Ft/xpbWUYmz3mOpws9H RW3sbsFywNzp4pCxolKhMJ8QTQI/tHb3CHT6thHkbgjpzr4bJlL6trLKn+btY2d/ MdNq61oPCTq4YYdj9kC8WebngjfJZOvcvQhX1OLtUaagrpL8DiGxivGSz/Rdl6ZC Yr8m8m0V/l6WA4HG3ZKTDoBz6OBxI7VROZRZdJkCRHKgScQP9/4+UYnSbew1rAhE apoUG3Ds7kiIUoZ9gLz01sYvRRaWelIjIZLp+RfnMPvtwXexP2uA8Q== =+uAL -----END PGP SIGNATURE-----

2 1

anon remailer
by David Honig 17 Dec '03

17 Dec '03

This guy has the IQ of a turnip... relevant to anon remailers & society thread... Tuesday December 2 12:07 PM EST Hate e-mail case to be retried SANTA ANA, Calif., Dec. 2 (UPI) _ Saying the case has national importance, federal prosecutors will retry a 20-year-old man accused of sending threatening electronic mail to Asian students at UC Irvine. Prosecutors announced their decision while opposing a bail request for Richard Machado of Los Angeles, the first person in the United States to be tried on charges of committing a hate crime over the Internet. His first trial on those charges ended with a deadlocked jury in November. Jurors voted 9 to 3 to acquit the former UC Irvine student. Assistant U.S. Attorney Michael Genaco told Judge Alicemarie H. Stotler that it is important that the case be resolved because other similar cases are certain to occur. Stotler denied bail for Machado, noting that he fled to Mexico when he was first charged. Machado's retrial is scheduled to begin Jan. 27. _- David Honig honig(a)alum.mit.edu --------------------------------------------------- If we can prevent the government from wasting the labours of the people under the pretense of caring for them, they will be happy. -TJ

2 3

A Netly Thanksgiving (guess I should have posted this earlier)
by Declan McCullagh 17 Dec '03

17 Dec '03

=========== http://cgi.pathfinder.com/netly/opinion/0,1042,1602,00.html The Netly News (http://netlynews.com/) November 28, 1997 A Netly News Thanksgiving by Declan McCullagh (declan(a)well.com) Here at the Netly News, we have a feast of things for which we're thankful during this holiday season: Ricochet radio modems. MacOS 8. A Supreme Court that supports free speech online. DVD. Cable companies offering 400 Kbit/sec Net-connections. But we're also grateful to the personalities who made this year an unforgettable one: Heaven's Gate: A special Netly thanks to these suicide cultists for providing us with seemingly unlimited article fodder. From the blinking red alert headline of their celestial home page to the computer-generated painting of a resident of the kingdom of heaven, their web site was a treasure trove for journalists. Buried in the invisible space at the bottom of the home page were hundreds of hidden words: UFO, space alien, extraterrestrial, misinformation, second coming, end times, alien abductions, Yoda, Yoga. Wonderful stuff. Louis Freeh: The butt of a thousand jokes on the Net ("Freedom isn't Freeh"), the FBI director emerged this year as the arch-enemy of strong encryption. We had worried that Deputy Attorney General Jamie Gorelick's departure might mean fewer good stories from the Justice Department. But Freeh came to the rescue, saying publicly that Americans should not be allowed to buy encryption products without a backdoor for law enforcement. [...]

1 0

No Subject
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Timmy C[...] May is a slant-eyed, rice-gibbling jap in a redneck disguise. ---._.--- / | \ / * \ ( @@ ) / _/-||-\_ \ / '/ || \` \ / / () \ \ / /| |\ \ / / | | \ \ / / / o o \ \ \ / / ( ) \ \ <_ ' `--`___'`___'--' ` _> / '~~--- / = \ ---~~` \ ,,,/ / ( v ) \ \,,, \ / / @|-' '-|@ \ \ / \__/ ////// \__/ Dave Smith bends over for Gary Burnore, Paul Pomes, and the rest of the Databasix gang. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1

Censorware Summit 2.0, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

[For details on some of the proposals presented, read the full article. --Declan] ============ http://cgi.pathfinder.com/netly/opinion/0,1042,1608,00.html The Netly News Network (http://netlynews.com/) December 2, 1997 Censorware Summit 2.0 by Declan McCullagh (declan(a)well.com) If there's one political controversy that promises never to die, it's sex and the Net. There seems to be something about the combination of children and cyberporn that makes otherwise levelheaded adults more than a little worried -- and even a little irrational. Enter the politicans, always happy to pacify parents with soothing rhetoric. Vice President Al Gore is scheduled to speak this morning at a two-day summit dedicated to protecting kids online. Of course, the Communications Decency Act's backers had claimed that that particularly nasty law (which the Supreme Court found to be unconstitutional) did just that. They were joined by the White House, which two years ago said "the President firmly supports the Communications Decency Act" to "regulate the exposure of children to computer pornography." This time, however, the White House would like to avoid the same embarrassing mistakes -- and, perhaps more importantly, would like to avoid pissing off high tech firms that could be hefty campaign contributors to Al Gore 2000. Instead of endorsing new federal legislation, the Clinton administration says it'll oppose it as long as industry regulates itself. And, of course, if firms play ball, their CEOs get to share the limelight with the veep [...]

5 5

Re: Pasting in From:
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

gburnore+NOspam(a)netcom.com (Gary L. Burnore) > :If Gary Burnore is so concerned about "forgery", maybe he ought to > :start using that PGP key he keeps advertising in his .sig to > :actually sign his posts. Unless he does, he's still vulnerable to > :forgery from his fellow Netcom users who are still allowed to insert > :arbitrary From: lines in their Usenet posts. Actually, forging a > :post with Gary Burnore's name and address in the From: line can be > :much more convincingly (no disclaimers) done from a throwaway > :Netcruiser account, and with less effort than learning the proper > :protocol to do it through a remailer. > > > Please specify how PGP signing the inside of a post will stop UCE-Baiting. PGP signing a post is a lot like the new anti-counterfeiting measures in US currency, only a lot more effective. But if some bozo decides to start printing up three dollar bills with a portrait of Mickey Mouse, and others are foolish enough to accept them, what are you going to do? It's hard to protect people from their own stupidity. I'd contend that a $3 bill isn't even a counterfeit or forgery, since there is not genuine equivalent which it seeks to fraudulently duplicate. Maybe it's time that the brain-dead software that mindlessly harvests e-mail addresses from the net was shut down. That sounds like the real problem. > :Munging of addresses is better left to the discretion of the poster. > :Let those who perceive a need for this "capability" use it. At > :least one of the mail2news gateways implements that as an option for > :those desiring it. I'm in favor of leaving that choice with the > :poster. > > Please specify how PGP signing the inside of a post will stop UCE-Baiting. I'm not sure what comment you intended to make about that paragraph, since it appears that you inadvertantly pasted in your comment from the last paragraph again. The text you're supposedly commenting on nowhere mentions PGP. > :Mr. Burnore made a similar "forgery" complaint here several months > :ago and was advised to PGP sign his posts and request source-level > :blocking if he perceived forgery to be a problem. He has evidently > :not taken the trouble to implement the first suggestion and, > :assuming he took the second suggestion, he's posted no evidence to > :suggest that it's not been effective. > > The second has been effective. I've not denied that. Since you've already found a solution to the problem that works, there seems to be no need to do anything more drastic to solve it. > I can see however, that > allowing anon posts with someone elses' address in the from line is a great > tool for UCE-Baiting. I fail to see any other reason for it in an anonymous > post. What other reason would there be for putting a REAL email address in > the from line of an ANONYMOUS post? For one thing, to identify posts as originating from one's pseudonym, which *MIGHT* be a "real" e-mail address. Most times I've seen it used, though, it has been used to place identifying information in the From: field which many newsreaders use to identify posts so that they are recognizeable by the reader. > Again, it's nothing to do with the CONTENT. It has more to do with the ability > to post to an mlm group with someone elses' email address. Oh, and btw, if a > NETCOM customer is caught doing this, his/her account is terminated. The key word there is "caught", and then you'd have to convince Netcom to actually do something about it. It is my understanding that spammers routinely utilize Netcom's OPEN SMTP SERVERS to send out their spam, using whatever From: field they wish, and Netcom doesn't seem to care. Anyone using those same servers to send mail to a mail2news gateway could forge someone's name and e-mail address to a Usenet post, couldn't they? Also, even if a complaint to Netcom got an individual account shut down, that wouldn't stop some other Netcom user from doing the same thing, nor would it stop the first Netcom user from opening another account under a phony name and repeating the process, or even doing it from a non-Netcom account. So if my e-mail address were being forged via Netcom, would they be able to source-block it as the remailers currently can do? If not, doesn't your own ISP have a bigger abuse potential than the remailer net? > AGAIN IT'S NOT FORGERY THAT'S A PROBLEM. IT'S UCE BAITING. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ There's no need to shout. Perhaps you've forgotten two earlier posts you made to this NG in the past couple of weeks in which you said: -> Subject: Re: Controlling the From: line in PIdaho -> -> Hopefully replay has corrected this as others have suggested so that the above -> CAN'T be done. It's a simple way to forge someone else's name. Early last ^^^^^ -> year comes to mind. -> -> [...] -> -> Posting anonymously is a valid thing to do, posting with someone else's name -> in the From line is simply forgery. Try sending your message from a hotmail ^^^^^^^ -> address or other site where you can just make up a name if you want this sort -> of thing. And in another post: -> Subject: Re: 'from' other than anonymous -> -> [...] -> -> Again, a forged from line (Forged as in someone's _REAL_ email address shows ^^^^^^ ^^^^^^ -> up) is a BAD THING. You claimed to be concerned about FORGERY back then, now you're saying "IT'S NOT FORGERY THAT'S A PROBLEM". Which is the case? > AGAIN. Please specify how PGP signing a post will stop UCE Baiting based soley > on the from line. But you were given two solutions, so if one of them works, then you don't need the other one. --

1 0

Announcing availability of Crowds 1.1.1 for Win95, WinNT, Unix
by Aviel Rubin 17 Dec '03

17 Dec '03

Crowds: A system for anonymous web transactions Top 10 reasons why you might be interested in Crowds 10. The price - crowds is free 9. Easy to install - download the code, untar, and run. Then, simply point your browser proxy settings to it and you can browse anonymously 8. Public service - by running the crowds code, you provide others with anonymity, even if you don't use it all the time. 7. Big brother is on the net - this helps you hide 6. It's nobody's business what you are browsing 5. For this to work, there needs to be a large user community 4. Portable - now works on Windows95, WindowsNT, and all versions of Unix we tried 3. Win Crowds T-shirts and coffee mugs - details to come 2. Take a stand for privacy 1. Don't be the last person on the Internet to obtain privacy More information, including full source code is avilable at http://www.research.att.com/projects/crowds. - Mike Reiter - Avi Rubin ********************************************************************* Aviel D. Rubin rubin(a)research.att.com Secure Systems Research Dept. Adjunct Professor at NYU AT&T Labs - Research 180 Park Avenue http://www.research.att.com/~rubin/ Florham Park, NJ 07932-0971 Voice: +1 973 360-8356 USA FAX: +1 973 360-8809 --> Check out http://www.clark.net/pub/mjr/websec/ for a new book on web security (The Web Security Sourcebook). *********************************************************************

1 0

Re: Pasting in From:
by Charlie Comsec 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- stewarts(a)ix.netcom.com (Bill Stewart) wrote: > At 12:14 AM 12/01/1997 -0500, Robert A. Costner wrote: > >Best I can tell, the only reasonable good purpose for this is to create a > >persistent nym identity without a reply to capability. > > Actually, setting the reply to point to your nymserver address > is the one legitimate use I can see for it, though that > capability probably should be provided by the nymserver. > The reason for chaining through remailers is to gain anonymity. I can think of a couple of scenarios in which pasting in a From: header pointing to a 'nym might be advantageous: 1.) Posts when the nymserver is down, or; 2.) Posts from an insecure location where installation of one's secret keyring is not desirable. (The "newnym" servers require that send requests be PGP-signed with the nym's secret key.) - --- Finger <comsec(a)nym.alias.net> for PGP public key (Key ID=19BE8B0D) -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBNIRnYwbp0h8ZvosNAQE6Xwf/SJQbKnIhFSP2nXd7dBQauf5ygoIrGqOt 6vFW644xxELC37iwW5tWI7Cr0N1Ipk9Py1UDzHSNYEeUGqUxgWGQ8BZhoNRg9i2t pqTr/YIRTjVxPETidpnKhyUgL6lz3bESpdiQLAKm1VwdWV3OhtNTlzL/Wu1hO33W +IxisotkksQ+OsCrfdkBRu6FarS90LGWa7Zqo3xNHZs599P/tVMrc2BYq7znXcZX gG4YwUhL2qWZJDhiWpTVWb/OH0Cq1UCnc/7AgMBjbQFt0ZCHghJXxc4DfmUG9L6J MHmpv82j7th8roMjM3FRGUzaqJxVBSoBKZPyBuRaLMgiaaupWku5EQ== =ZqJJ -----END PGP SIGNATURE-----

1 0

Transforming Defense
by John Young 17 Dec '03

17 Dec '03

The National Defense Panel presented yesterday to the Secretary of Defense its 95-page report on the future of US defense: "Transforming Defense: National Security in the 21st Century." It's available in PDF format at: http://www.dtic.mil/ndp/FullDoc.pdf (386K) The report proposes an impressive 30-year overhaul for the military, with a recommendation that the two-major-wars strategy be replaced with that of preparing for one major war and a host of more limited defenses overseas and at home to combat enemies who will not challenge superior conventional armaments but will utilize "asymmetrical" NBC weapons, terrorism, information warfare. We've converted the Executive Summary to HTML: http://jya.com/ndp-pr.htm And a section on "Homeland Defense" which proposes a role for military forces to "protect against all enemies foreign and domestic" by providing intelligence, training, equipment and other aid to justice and law enforcement. http://jya.com/home-def.htm As noted in the NYT today, the report asks for a shakeup in intelligence, with renewed emphasis on training human spies to compensate for what technology cannot do. Along that line, the NYT also reports today on a huge Libyan deeply-buried pipeline system under construction which is suspected of being a distribution system for troops and equipment as well as CB weapons, placed underground to escape satellite spies. The report is based on descriptions of engineers and corporations working on the project. One feature of the NDP report, as well as other closed defense panel meetings, is the need for weapons to attack underground structures -- like those vast catcombs in Lybia and North Korea, and the US for that matter -- Cheyenne Mountain is still being re-hardened regularly, and its electronics re-Tempested, not that the local skinheads will not find a way to hack the bunker as trusted EEs and sys admins.

1 0

Network Associates Announcement!!!
by Network Associates, Inc. 17 Dec '03

17 Dec '03

~ NETWORK ASSOCIATES ANNOUNCEMENT ------------------------------- Network Associates, Inc., is proud to announce that we have named TruthMonger<toto(a)sk.sympatico.ca> our Chief Director of Security, adding his (or her) immense reputation capital to our already respected corporate image. No communications purporting to be from Network Associates, Inc., should be considered valid unless signed by the key provided below. TruthMonger is also authorized to accept payment, in cash only, of any money due to Network Associates, Inc., and all of our subsiduaries, at the following address: NETA c/o TruthMonger Box 281, Bienfait, Saskatchewan CANADA S0C 0M0 Network Associates, Inc., plans to use TruthMonger's extensive key-forging experience to help make digital signatures basically meaningless, in order to help lessen the potential legal and/or criminal repercussions of any future Key Escrow legislation. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGP for Business Security 5.5 Comment: "I Broke PGP!" mQGiBDSEmSYRBADgXaNjJkY7NmVjhXJGg0+8Sua4oYJ+tkG959T1lYFsCLVity0V fRH6ygoHaRe/YiXxqQnbXyt3Fo6oF8MdXDWLMTkpR1NZn5kIcUnDrGv6G3Y+bW8j fHy79JjX17OPPJS5FLIaATubngiRNJMwpn34cQIM812iDgUfrdxiFUQSwQCg/6ju lTyy+oFaxBTTUsBlYbkhDpUD/2PxF1JN53oHiCZb62PXoVE/QfN7i+ABpR0PW5jC TiaQwh7jEbVctYnzhSPjccUJSQ+XEwTbjrCS4xYftoIlkRsVSzbFcRIbelDP7kQw GM2UExhsHVNhpsq+benT7LfcFnACYYu6GjMIY+v3CfJYidJ94DN3E5D60Q+UEz/M sTEUBAC8h94Xk1l8IsItOPNbj8k0o7yfll8cqKHbe1CpSUBS6nZ0kwBq5WONkptx O4zBOsxlf/WnVo6C5ojgB2TeFWZoXj98X7S4QaVvHM3YFJuIHLw8gcS3HHahLphh bKGlffWF3FfQCJr2Rd6fk2SeZp2TZoCqLKt8UMwxbGjQa39dD7QvTmV0d29yayBB c3NvY2lhdGVzLCBJbmMuIDx0b3RvQHNrLnN5bXBhdGljby5jYT6JAGMEEBECACMF AjSEmSYXCgARh4SIT1mMRHX7HCWvKiZqcerSJDgECwMBAgAKCRA314vi4fVSmhyZ AJ9M8SPYgr4apBO0PAJwjg2bQDcvrACdF2vW+SsVL4r3EMP2vlHfZ0fSinKJAKAE EAEBAAoFAjSEmqUDBQF4AAoJEJ8TeU28wEKx7rED/2dajEBpvE/KtSUW9CbSPKyr 3rzULey4iBHOcrPqSgD7z6iXAs16O6sBWclrr30IJ/IdJ5kaTsNXjcmny2GpMUSq 1jbf3quenBIN6zkZLx08ZRPyHjdlmS7/PSOkvI7gKe3NLRjJ9QImytY1uLoAIHjO iFXLyTq2kGW/fMK85g4QuQQNBDSEmSsQEAD5GKB+WgZhekOQldwFbIeG7GHszUUf Dtjgo3nGydx6C6zkP+NGlLYwSlPXfAIWSIC1FeUpmamfB3TT/+OhxZYgTphluNgN 7hBdq7YXHFHYUMoiV0MpvpXoVis4eFwL2/hMTdXjqkbM+84X6CqdFGHjhKlP0YOE qHm274+nQ0YIxswdd1ckOErixPDojhNnl06SE2H22+slDhf99pj3yHx5sHIdOHX7 9sFzxIMRJitDYMPj6NYK/aEoJguuqa6zZQ+iAFMBoHzWq6MSHvoPKs4fdIRPyvMX 86RA6dfSd7ZCLQI2wSbLaF6dfJgJCo1+Le3kXXn11JJPmxiO/CqnS3wy9kJXtwh/ CBdyorrWqULzBej5UxE5T7bxbrlLOCDaAadWoxTpj0BV89AHxstDqZSt90xkhkn4 DIO9ZekX1KHTUPj1WV/cdlJPPT2N286Z4VeSWc39uK50T8X8dryDxUcwYc58yWb/ Ffm7/ZFexwGq01uejaClcjrUGvC/RgBYK+X0iP1YTknbzSC0neSRBzZrM2w4DUUd D3yIsxx8Wy2O9vPJI8BD8KVbGI2Ou1WMuF040zT9fBdXQ6MdGGzeMyEstSr/POGx KUAYEY18hKcKctaGxAMZyAcpesqVDNmWn6vQClCbAkbTCD1mpF1Bn5x8vYlLIhkm uquiXsNV6z3WFwACAg/+McnUlkw0KkNcBxN0w/mvo7/2QcEWXyfXiqpIcGj/DytA l0nh77hd+RPPqqXQHgkp56hPpp7nK8gAZnkxJcycOYMbPIgKvAGi9gQO7bd2oth7 TWUlfimTIYPrscLJNn/HQ5nA8mU28Ajq/Zlq/0XhpsQiRH5Ygr2IW1tldrrgiOho pYHsdPOkxZaPIHFKIqt6l/GtBnPA6+KYul53pfBt4DTPSk02RYsD9u/pqoJ/oEYW BrO/FzsKXzpIJxWCNvVm8GlakEw2isZ9zT4H5KRqhRLc9+SyeupF5ztosZKNs0dn nGaWVrCjx28G86xVnONi6fntGzL57Pb5JRvyrAbFDEXfL9rUrgLFx78LY4fSavP8 caB3IkQomuXZezQGusy4LMhna0ZYNioHyFzZU2DYU0EcuG8qrz+sKEIaYIpCiBPq IohclEgsA9ygaPjefiTpCEb07gGGD0rh6aRYpaQGCd8sSWIqm8IWql+ePkqwVWR8 WHyZWH6STvUQsZCE1GhJQqyai4i6KnVNrYzYF2UinP7d5AYUsaRGypdHsFDx9Yhg YC5OFsR0BXnz9bm3tn3SSoVDp7b9Xo9V3FpiQ+9ZgjXD2eEbWumv/upoVu2ekbiK CM4Dt3OoBPQBpkFan5FqCSY7255yCPU9YzQ7mmEpFWvfbSNR/Cls+ZT2GR7T1nOJ AEYEGBECAAYFAjSEmSsACgkQN9eL4uH1UpoCiACgnAXXUm5yyak30HJL1FeYdh0B xekAnA/VnnGkzVY1kQRQNpWQXdHdpL5F =3BX/ -----END PGP PUBLIC KEY BLOCK-----

1 0