- cypherpunks-legacy - lists.cpunks.org

Re: "Show me an example of terrorists using the Internet or crypto"
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Alex Le Heux wrote: >On 2 Oct 1997 01:29:33 +0200, in list.cypherpunks you wrote: >>Cynthia Brown wrote: >>>On Wed, 1 Oct 1997, Alex Le Heux wrote: >>>> This sucks. >>> >>>I agree wholeheartedly. >> >>>IMNSHO the best way to fight crime is not with bigger guns than the >>>"bad guys", but with better social programs such as universal health >>>care, and improved day care so single parents can show their kids >>>what a productive lifestyle looks like. >> >>Of course you agree wholeheartedly, you are an exploiter. It is >>wrong. You should be ashamed of yourself. > >Can you explain who exactly exploits who here? How about our friend J.F. Avon? He has the misfortune to share citizenship with Ms. Brown. Thus, while he may be minding his own business, doing nobody any harm, and pursuing happiness, should he decline to spend thousands of hours of his life working to pay money into Ms. Brown's socialist schemes, armed men will come to his house, put him in a cage, and leave him there for years. That's not a very friendly way to treat a neighbor, is it? In the United States, many thousands of people correctly recognize this situation. Many thousands of people are gun owners. Many thousands of people are not only gun owners, but combat veterans. The logical outcome would be great violence directed towards the government. Yet, this has not happened (recently ;-). Why? Certainly if the sums at stake were involved between governments, there would be fodder for many wars. The only conclusion that can be drawn is that civilians, even armed civilians with combat experience, are so overwhelmingly peace loving that they will bend very far backwards to avoid trouble, even if it means thousands of hours of work. Can the same be said of career military or government people? >PS. What's the point in posting anonymous when you have this sig? > >>Editor in Chief >>Smile Magazine >>http://www.neoism.org/squares/smile_index.html >>http://www.neoism.org/squares/cantsin_10.html Tools which are not used are not improved. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDPgFZaWtjSmRH/5AQEQ8wf+PwFFagIxuwKkoR5rUAxnseSP8DzrRsrw tQD5gCZ0t1JTBdXUinhZzr2NsyKDtGoPcauDtrxqWyMdAem5ZCf2v6D8Cgm34n3Q bkmvSJbo2bSuD9ggzboENp6rhvsbJ7THf7I4eMHRIUrnPgnQbaWTOXKqBPtG5w+W qPrgHAb7s6oaB8aRqX0sPByWKqbd853RLjsy62Tl3oMc7hp70TAKwXCtXKQTUhL+ CeNBpNFvnN1nR1L3AqL5aji0/BaN+7foptPRDH3eZfUwLx547+1R+DdLKAb7u5tL RJaza5h0O3Zkg+ImlqR2cKe5awxwB6NNkm2oR1GD1p0f80+mGUHtcQ== =C9wS -----END PGP SIGNATURE-----

1 0

Re: Remailers and ecash (fwd)
by Anonymous 17 Dec '03

17 Dec '03

Jim Choate: >For the sender to chain from remailer to remailer to destination the >destination has to be in the header info somewhere. Now in the most secure >system each packet header will only contain the address of the next hop. When >the next site gets it the packet contents are de-crypted (otherwise reading >the chaining info is trivial) and the contents are uncovered to reveal another >packet with the next hop header and another encrypted block. And on and on >we go. > ><Question: Are there any remailer sets that impliment the encrypted nested > packet system?> Jim Choate has been amazingly clueless throughout this discussion, but this takes the cake. Does he really not know about encrypted nested chaining? My God! Of course remailers work this way, Jim. They've worked this way practically from the beginning. All remailers work this way. The mixmaster remailers are built around this idea, making each packet a constant size and adding dummy packets as new ones are stripped off, so outgoing messages look just like incoming ones. How can you be arguing about remailers when you know so little about how they work? ><speculation: an encrypted chain could be made stronger if the next > hop header depended on which key was used to decode it. > In other words, remailer A's key will produce one next hop > address while remailer B's key will send it elsewhere. This > is a subset of the different plaintext - same cyphertext > problem - a hard problem as I understand it. Find two > distinct texts that encrypt with different keys to the > same cyphertext> That won't help. There would be no point in doing this. I'd ask you to explain, but that would just prolong the agony.

1 0

Re: Stronghold
by Anonymous 17 Dec '03

17 Dec '03

C2Net was wrong to censor the cypherpunks list in the guise of moderation. It was wrong to send threatening letters to people who claimed its products were weak. The whole moderation/censorship experiment was a terrible mistake. The actions taken by C2Net were completely unjustified. At the same time, it is dishonest to say that its products have backdoors or are weak. There is no evidence whatsoever that this is the case. It may stretch the intellects of some cypherpunks beyond the breaking point to hold these two views about matters at the same time. In the black and white world where some cypherpunks live, a company which tries to prevent criticism is evil, hence it must be fraudulent as well. More mature list readers will recognize that a company or a person can be wrong in some actions while being right in other ways. The burden of proof in claiming that there is a weakness in someone's security product is on those making the claim. Compare the unfounded statements by Vulis with the carefully documented breaks of weak software by Ian Goldberg, David Wagner, John Kelsey, and Bruce Schneier. What if Goldberg and Wagner had claimed that Netscape's RNG seeding was weak, without providing any more evidence than that claim? What if Schneier et al had broken cellular phone encryption without backing it up? They would have been justifiably ignored. If anyone really does believe that C2Net's products have backdoors or weaknesses, why don't they present them? Either they want people to keep using C2Net's supposedly broken products, which reflects badly on them, or they want people to stop but they are unable to present any evidence of these purported weaknesses. When Vulis or anyone else claims Stronghold is broken, ask him why he is presenting his claims in a form which will cause people to keep using this "broken" software. Does he want people to have weak encryption? Is he in favor of backdoors? If not, he would surely present evidence of the weaknesses, if there is any. Make Vulis explain his motivations when he makes these claims.

6 7

new release of Crowds
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Authentication-Warning: akalice.research.att.com: majordomo set sender to owner-crowds-talk(a)research.att.com using -f Date: Thu, 2 Oct 1997 10:28:06 -0400 (EDT) From: Mike Reiter <reiter(a)research.att.com> To: crowds-talk(a)research.att.com Subject: new release of Crowds Sender: owner-crowds-talk(a)research.att.com Precedence: bulk Crowds 1.0.3 is now available. If you already agreed to our license on our web page, there's no need to do it again; just send email to crowds-support(a)research.att.com from the previous email address that you gave us, and we'll send 1.0.3 to you. The main change in 1.0.3 is a configuration file that eliminates the need for command-line arguments to anon.pl, and that also enables us to ship distributions ready to join our crowd (i.e., the registration step is eliminated). Hopefully this will make Crowds easier to use. - Mike --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

2 1

CDA protects against liability
by Anonymous 17 Dec '03

17 Dec '03

Another case where the CDA protected against liability. Remailer ops should look into this. http://www.wired.com/news/news/politics/story/7361.html: A San Francisco judge has ruled that a lawsuit that sought to force an Internet service provider to silence a Usenet participant is barred by the federal Communications Decency Act. At issue was a claim by San Francisco Satanists Michael and Lilith Aquino that San Diego-based ElectriCiti Inc. "breached its duty to the [plaintiffs] and to other Internet users" by failing to take action against an anonymous Usenet poster. The newsgroup participant allegedly harassed Michael Aquino, a former US Army lieutenant colonel and the leader of the Temple of Set, and his wife, Lilith. The claimed harassment took the form of messages referring to the Aquinos' involvement in a ritual child-abuse investigation in San Francisco in the 1980s. The couple was never charged with any wrongdoing. Superior Court judge David Garcia accepted ElectriCiti's contention that the lawsuit violated a little-discussed and still-in-force CDA provision that exempts ISPs from liability for content transmitted on their networks. The law states that "no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider." The decision is one of three such cases nationwide that have been thrown out because they attempted to hold ISPs responsible for subscribers' speech, said ElectriCiti's attorney, Roger Myers.

4 4

Possible Security Hole in Internet Explorer 4.0
by Martin Minow 17 Dec '03

17 Dec '03

>From a message in MacOSRumors <http://rumors.netexpress.net/> (I have not independently verified this) --- Begin quote --- Internet Explorer 4.0 ships with major security hole.... With the Microsoft Internet Explorer 4.0 for Windows release only hours old, users have already discovered a major security hole that smacks painfully of Big Brother: Most folks will remember the Netscape java bug that allowed you to snoop on what people where visiting. Well IE4.0 goes a bit further than this - Logging of your actions, even when you would otherwise be shielded by proxies is BUILT-IN. The channel definition format (.CDF) http://www.microsoft.com/standards/cdf-f.htm includes a LOGTARGET feature that allows a web site provider to make your browser deliver logs of your usage via an http post or put. Even hits from cache are logged. This is all not so good and getting worse. Not only is the information posted material, you wouldn't want to give to a provider, (considering) "http post/put" is normally spoofable anyway. Unanswered question for next time - or for folks with more time than me to follow up Can you put other sites in your channel definition and get logs of when they read your competitor's site (with this system)? Definitely not confidence-inspiring. It appears the Mac version is affected by this same problem, as well...and neither platform has any means of disabling this "feature" at present. --- [Internet Explorer 4.0 has not yet been released for the Macintosh platform.] Martin Minow minow(a)apple.com

1 0

Re: "Show me an example of terrorists using the Internet or crypto"
by alexlh＠xs4all.nl 17 Dec '03

17 Dec '03

On Wed, 1 Oct 1997, Matt Elliott wrote: [snip] > >You people just don't get it do you? A gun has one purpose: To kill. Just like > >any other tool, a gun, if it is available _will_ be used at some point. > > Yea, so what is your point. As long as it is lawfull killing that seems to > me to be the point to use a gun. For lawfull purposes. Criminals will > always be using guns anyway. If they take away guns people will just find > another just as forcefull method of defending them selves. I have a potato > gun that will put a 3 inch hole in just about any living creature. I'm > going to take it deer hunting this winter. It will be cool to say I shot a > dear with a potato and a can of hair spray (the propelant) I completely disagree. I bet you'd disagree too when the cops come to take you away for using illegal crypto. It would be totally lawful. But that's besides the point. Killing people is NOT a good thing. It never is. It might be unavoidable in a you-or-him situation, but that doesn't make it a good thing. Would you like to be shot? No? Not even if someone else claims he has a good reason to? I think this goes for most people. So the best that you can do it claim that _you_ think there's a good reason to kill someone. This is not a working theory for a community. Alex --- I dabble in techno-house and sometimes, I do that badass hip-hop thang... But the F U N K gets me every time!

1 0

Re: Secure phone
by John Deters 17 Dec '03

17 Dec '03

At 09:21 AM 10/2/97 -0700, you wrote: >At 11:13 PM 10/1/97 -0700, Lucky Green wrote: >> Bad idea. You don't want people to have to look up keys to use your device. >> Some people may not want to be listed in the phone book. Not to mention >> that a PKI adds an additional and unnecessary layer of complexity. Just use >> DH and have the parties each read half of a hash of the public >> exponentials. No keys to store, no keys to remember, no keys to compromise. > >Trouble is this exposes the system to the man-in-the-middle attack. Perhaps >you could take advantage of the real time nature of the system to prevent >man in the middle, by constructing a protocol such that man in the middle >will invariably time out during the connection setup, or produce an >audible lag problem in speech. The MITM attack is thwarted by Lucky's note: >> DH and have the parties each read half of a hash of the public ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >> exponentials. No keys to store, no keys to remember, no keys to compromise. ^^^^^^^^^^^^^ Each party reads off a series of digits displayed on their screen. Out loud. To each other. Over the secure phone. The MITM attacker can't duplicate the hash on both ends, because a hash of the public keys used to make the connection are different between the MITM's public key and the real public keys. Here's a secure conversation (assume for the moment that the addition below represents a strong hash): Alice <-------------------------------------> Bob PK=1234 PK=5678 1234+5678=6912 5678+1234=6912 Alice reads 69 over the phone, and Bob reads 12 back to her. Alice and Bob proceed to have a private conversation. Now, since Mallory has to create a PK, he cannot just duplicate Alice's 1234, because he'd also need the private key to decrypt the conversation. Likewise, he cannot duplicate Bob's 5678. He has to generate his own PKs in an attempt to fool Bob & Alice. Alice <-----> Mallory <-> Mallory <---------> Bob PK=1234 PK=1111 PK=2222 PK=5678 1234+1111=2345 5678+2222=7900 Alice reads "23" over the phone, and Bob reads "00" back. Since Alice's hash function said she should hear "45" back from Bob, and Bob's screen said he should have heard "79" from Alice, Alice and Bob decide to talk about the weather, and how pretty the trees are in certain cities. Mallory could try to thwart this by impersonating Bob's voice to Alice, saying "45", and Alice's voice to Bob, saying "79" (Mallory does, of course, know these numbers), but if Bob & Alice know each other, this probably won't work too well. Mallory would have to be able to cut into the conversation real-time, undetected. Now, of course, Mallory could hire Anna & Barry to pull the whole impersonation thing off, so that for the entire conversation Alice talks to Barry and Anna talks to Bob, each thinking that they're really talking to the other, but that's also fraught with risk. I'm sure they could pull it off on TV, though :-) So, it'd go full circle back to pass phrases again. "I hear the cherry trees are lovely in Washington D.C." "I wouldn't know, I've never visited Washington in the spring." "I agree, the weather is usually too wet." John -- J. Deters "Don't think of Windows programs as spaghetti code. Think of them as 'Long sticky pasta objects in OLE sauce'." +--------------------------------------------------------------------+ | NET: mailto:jad@dsddhc.com (work) mailto:jad@pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'36"N by 93^16'27"W Elev. ~=290m (work) | | For my public key, send mail with the exact subject line of: | | Subject: get pgp key | +--------------------------------------------------------------------+

7 22

Remailers and ecash
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- An anonymous brother wrote: >Given: We want more (reliable) remailers > But someone has to pay for them > >Conjecture: New remailers can be financed by charging the users a fee per > message to use the remailers. > > If a remailer charges a fee, the number of users will be reduced to > those who are willing to pay the fee. > > When the number of users is reduced, the potential for traffic analysis > is increased, which reduces the value of the remailer. > > If the value of the remailer is reduced, it will not be worth the cost > to many users, and those users will seek a less expensive, higher > traffic remailer. > > Thus, the commercial remailer is forced to lower its prices until it is > unprofitable. > >Conclusion: Pay-per-message commecial remailers are not economically viable. You know how the remailer operators do all their work now for free because they believe in it? And how all this software has been written and given away because people believe in it? Maybe some other people will help pay for the maintenance of the remailers because they believe it is the right thing to do. Especially since it need not be forever. And, I have to believe that out of the millions of well heeled Internet users, there are enough privacy oriented people to pay for a small remailer network, at the very least. We just have to get the ball rolling, that's all. > - Pay a flat fee per month for remailer access This is isormorphic to using ecash if you want to keep the messages of each user disassociated from each other. > - Everyone a remailer. Remailers only accept messages from other > remailers. To use remailers you must run a remailer. I don't grow my own wheat, grind it up, and then make my own bread. I also prefer not to run a remailer. > - Pay for access to an anonymous message pool Interesting! > - Sell cpu cycles in exchange for remailer access If we use ecash, you can sell anything in exchange for remailer access. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDP8VpaWtjSmRH/5AQEMNgf9FY0zq4+p1R6F4GPIvLCqQQsXJ9TeeNSX v8sH99yUpYm+FmJuxwoGzel0Q0VRaR6NakuTx/Q1tKzSA4H2cnslEixyft9c0CsE 5dWEXe7694x/el4xXJcoX3+XNrKjo8qAERe9jcttPUtEgwT+2+JnfcMOudX7UZd6 LL8OvpD9CJrwQuJIeaNgbftwuVukuLkCRWJ1wrsJAs37Y9w9GqA+RTlqNXbElyi6 ryC17sysWOaFVryjLEHYXL9r60Ct9ZHp1hQoP0O1yCyKa5BMrTsVfXWOXuU/qSDe w0cfkcZ6lI8EmZObcOLr3sRdblq7nojoBctypSkILwEtEqgbpW0HXg== =TgmT -----END PGP SIGNATURE-----

2 1

Re: "Show me an example of terrorists using the Internet or crypto"
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My brother VerityMonger wrote: >Fascism hadn't died, it has just gone underground and crept into >every facet of life through the corporate and government power >mongers. The government and the mass media are working the citizens >like dumb fish on a hook, who are still trying to swallow the >worm. There is a New World Order on the way, and it isn't going to be >any prettier than the last time it was tried. No doubt VerityMonger knows this, but many others may not: "New World Order" was a phrase originally coined by Josef Goebbels. Interestingly, the term "European Community" arose out of German industrial discussion groups in ~1944 who were trying to find a way to salvage the German position at the time. One idea was to make peace and attempt to establish a "European Community". Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDP5BJaWtjSmRH/5AQFnGwf9HBs0DDAjhc0PPHjnKsGQ1JRaB797fIaO Cbz+QvUs/OzClpSrPQAighJ5DlE3yNWseBxCaYDQ/dOxhpB/vnFI509FRBqgDgOp qaYqaQVdWjeirrAlWFpeMV9yjKlk09fTe3ospvenDFkNvrJedTeP73t8bCceq/Iz +I2dWn3/eCmm0+Xlblm/ljETBXCh6i4WpfnRuA0htJQQJwctPjopuxOo3vpde4JH //clHjOckrkqo/H4+D1iX7BeAJOYUnToGO4r/w1vvGEWEZG4pGfB9MNZ74P71JFs 3lmCXJ2p+D55fmhjmHrNQFfi+oFmbnt0u/yuxlI2O0Qr/obwje7oIA== =6SBY -----END PGP SIGNATURE-----

1 0