- cypherpunks-legacy - lists.cpunks.org

NANDO: Backup Program
by E. Allen Smith 17 Dec '03

17 Dec '03

Unfortunately, they're only using DES - probably because they do serve international customers. > _________________________________________________________________ > The Peanut Roaster > _________________________________________________________________ > HIAWATHA BRAY: ON-LINE BACKUP SAVES THE DAY > __________________________________________________________________________ > Copyright &copy 1996 Nando.net > Copyright &copy 1996 The Boston Globe [...] > (Sep 6, 1996 01:17 a.m. EDT) -- It's written in almost every computer > instruction manual and technical guide. It's encouraged, sometimes > even mandated, by MIS lords. Yet it's almost universally ignored. [...] > Fortunately, just before the drive when south I had taken up an offer > from a company called Connected Corp., of Framingham, Mass., which > markets an appealing product called DataSafe. [...] > DataSafe is an on-line data backup system. You load the DataSafe > software onto your computer then connect via the Internet to > Connected's data center. The system asks for a credit card number and > a password of your choosing. Once done, DataSafe searches your hard > drive, identifies every data file, and uploads them to the DataSafe > computer. The system doesn't back up your applications, such as your > copy of WordPerfect; just the data files you've created with the > software. DataSafe stashes your stuff in two separate computers to > ensure nothing is lost. [...] > But a dead hard disk works wonders on one's powers of concentration. > With all my original data gone, it was time to find out whether this > DataSafe really worked. I reinstalled the DataSafe software onto my > new hard drive, made the connection with Connected, and waited to > receive my files. No dice. I'd forgotten the password. And Connected > refused to give it to me or provide me with a new one. That's because > the backed-up data is encrypted, and the password is the key. Even the > folks at Connected can't crack the encryption without your password. > They designed the system that way to reassure customers that nobody > can tamper with the data stored there. [...] > But many, perhaps most, people can't afford to lose a fragment of > data. For them, on-line data backup systems like DataSafe may be the > answer. The company charges $14.95 a month to store 50 megabytes of > data. The software can be set to automatically back up all new and > modified files every day whenever you choose. [...] > Businesses can use the system as an inexpensive data network. Just > create an account, then give the password to everybody in your > company. Now you can store commonly-used files on the backup server, > where they can be downloaded by anyone who needs them. > Connected isn't the only company that has figured this out. MCI Corp. > is selling an Internet-based data backup service. So is McAfee > Associates, the maker of anti-virus software. Many people will > hesitate to store their computer files with a stranger, encryption or > no encryption. But if that makes you uneasy, imagine how you'd feel if > your hard disk crashed. Unless you're a columnist, it could be a > disaster. > (Hiawatha Bray is a member of the Globe staff. You can send him > electronic mail at Bray(a)globe.com.) [...] > Copyright &copy 1996 Nando.net

1 0

"Remailers can't afford to be choosy"
by tcmay＠got.net 17 Dec '03

17 Dec '03

I've picked the provocative title "Remailers can't afford to be choosy" so as to make an important point about remailers. First, a few responses to Rabid Wombat: At 3:26 AM 9/13/96, Rabid Wombat wrote: >Hormel, isn't it? Anyway, my point is that the law should not be involved >in it, but that it is going to be sucked in whether we like it or not if >social pressure is ineffective. What is, and is not "spam" has been Social pressure rarely works, of course. Canker and Sleazewell used the negative publicity about their spamming to sell more books. And the law rarely works, either. What _does_ work, throughout history, is technology. Locks on doors work where all the social pressure and all the legal measures fail. The SPAM situation has various parallels (and differences, of course). The point being argued in this latest thread, that "inappropriate" responses to a "mail me" button on a Web page have these parallels: * a contest operator announces a drawing based on forms filled out and deposited in a box, but neglects to check against multiple entries. One person "games against" the rules and submits 25,000 entries. The contest operator claims that this is fraud, or "contest SPAM," to coin a phrase. He splutters, "It's not fair! I assumed only one entry per person, even though I took no steps to ensure this. I want a law!" (Astute readers will recognize this situation from an early Heinlein novel.) * a radio station invites listeners to call in, then complains that one person is "calling too much." (A common situation with talk radio, and one best handled by screening callers. Even so, some of the same callers get through by using various disguised voices, etc. As with the contest situation, a problem best solved by the party involved, not the legal system.) * in general, any of several "over use of free or public resources." The bum who sits in a park, the kid who hangs out at the mall for several hours a day, the family who park themselves on the best fishing spot every weekend, etc. Again, these are not situations where I think either "social pressure" or "the law" works very well. Better solutions are to find ways to meter scarce resources. ... >We're therefore stuck - as a community, we cannot stop what many people >consider to be undesirable, as we cannot even define it, and the unwashed >masses will set governance upon us for our "own good." No, it is not hopeless. "Congestion pricing" is the operative phrase. Web sites that are too crowded can add capacity and increase advertising rates, or can charge admission, or the like. Remailers can (and will, sooner rather than later) charge "digital postage" for the service they are performing. (If nobody will pay, and the remailer network fizzles out, then clearly there was not an overall market, was there? I doubt that this is so, though at this early stage there is a lot of experimentation, subsidized sites, etc. Not an argument for laws, though.) >The ability to be anonymous on the 'net is generally a good >thing. It has allowed people access to information that might have >otherwise been denied them. It is an important freedom, and one that is >already in danger of being taken away through legislation (Georgia on my >mind ...). Abuse of this freedom by someone for purely commercial >purposes is certainly not going to help matters. _Lots_ of uses of remailers are "not going to help matters." So? Use of remailers to post the Homulka-Teale stuff was not well-received, use of remailers to post child porn is not well-received, use of remailers to bypass national security laws is not well-received. So? Remailer operators really, really, really have to get out of the business of looking at "what customers are using the remailers for" and then deciding to block senders, recipients, etc. based on what they see. I don't mean to minimize their concerns about illegal material being sent, about spamming, about insults and libelous stuff, etc., but it's important for all remailers to carefully think back to Chaumian mixes and what they mean. For one thing, there is no screening, no approval of content, etc. There might be digital postage, of course. And chaining, preferably. And encryption all the way through. Reread Chaum's original 1981 paper, the inspiration for our earliest thoughts about remailers. "Remailers can't afford to be choosy" >Note the earlier comment about someone being unhappy about their >"remailer-baby" being used for such a purpose - someone running a >remailer is generally doing so as a service, and is generally not >compensated for the equipment, time, energy, and aggravation. A lot of >remailers have shut down recently. Is this helping the cause of privacy >and free speech? Yes, actually. The shut-down of nonanonymous remailers is a good thing, ultimately. And the lessons of what happens when remailers become too well known (and hence nice fat targets for spammers, denial of service attackers, Churches, etc.) is also clear. By the way, today's remailers appear to be primarily _experiments_ or _casual services_, not altruistic services for some nebulous idea of "free speech." (Besides, if it's illegal for "spammers" to use remailers, so much for "free speech.") Digital postage is the ideal way to reduce the amount of "spam" flowing through a remailer site. The issue of "unwanted mail" is a more complicated issue, given our current "free to deliver" set up, and not one which directly involves the issue of remailers (except insofar as making it harder to track spammers down, but this is just the standard case with all crimes/etc. committed with remailers, and is a separable issue). >providor of web content as a courtesy to their readers. Why does it fall >to them to provide a completely off-topic forum for someone else's views? >How are they any different from members of a public mailing list? Must >the members of c'punks and toad.com accept all unpaid advertising in the >name of free speech? Absent rules or arrangements by the owners of the toad.com site, there is no legal recourse. And given the international nature of lists on the Internet, exactly which country's laws would be the operative ones? Would Poland request the extradition of a Brazilian who "spammed" via the Cypherpunks list, currently operating out of California? The mind boggles. Look to technoological/economic solutions as a first resort, not a last resort. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Fed appellate judge remarks re anonymity, free speech on the net
by Greg Broiles 17 Dec '03

17 Dec '03

At 09:24 PM 9/12/96 -0700, zachb(a)netcom.com wrote: >> (Also in today's news, the 9th Circuit upheld a CA statute forbidding sales >> of material considered "harmful to minors" from vending machines.) > >Even if this statute is meant only to apply to cigarette machines, which >would seem to be the case given all of the anti-cig stuff going on now, >what good will it do? Whoops. Sorry. Wrong context. What I should have said was "the 9th Circuit upheld a CA statute forbidding sales of *printed* material considered 'harmful to minors' from unsupervised vending machines". The publication(s) at issue are those newsprint swingers' magazines (e.g., "me and my friend want to screw you and your friend. here is a picture of us naked."). (doh!) -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

2 1

Re: Nonsense, absolute nonsense... [Fwd: HipCrime and Spam]
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 12 Sep 96 at 20:03, Rabid Wombat replied to a spammer with an Attila the Hun (looter and plunderer) mentality: > > > However, since others may think like you, I guess I'll have to > > > add a line above my link stating that email not related to the > > > purpose of my site will be happily proof-read at the rate of > > > $200 per hour, The looter speaking here: > > How can you hope to > > enforce it? It's a joke, right? :) Maybe not, since it's on your > > sig-line. that is one of their way of seing life: as long as you have the physical means to perform an action and that nobody else can stop you, you can do it. > > A website is > > an open invitation to comment and e-mail. Again, he doesn't ask himself why the page, put into existence (most of the time by the good will of the creator and owner of the account, paying out of his own pocket from his own work) does not bear the mention: "we invite spam" > > Better password your > > site if you want to solve this problem. "Civilisation, is the transition from a public society to a society of privacy" (approximate quote from Ayn Rand). We have laws that hope to accomplish that, i.e. trying to set men free from other mens. Passwording is like putting a lock on a door: to prevent intrusion from peoples that have different values. Note that the trespassing is *always* done in favor of the looters at the expense of the producers. > > Then no-one can visit it, > > and no-one can send out a spider to get your e-mail address. > > That's what I do, send out a robot to bring back e-mail addresses. > > Of course I only send to makers of software, and my product > > applys to their world. I'm glad the tresspasser limits the field of his victims. > Comment is one thing. Mass junk mail is another. I'd view "comment" > as expressing an opinion. If I put an "email to:" tag on a web site, > I'm inviting "comment" on the information I've placed in public view > - there's reasonable expectation that the "comment" will be > pertinent, even if it is only "Your automated gif sucks." This isn't > quite the same as inviting completely irrelevent junk mail, and I > still fail to see how you make this leap of logic. He does it very simply: by blanking out the nature of his acts. Only, there is no logic in this act, only feelings. > You are on a public mailing list, aren't you? You have some degree > of expectation as to the pertinence of topics discussed on said > list, don't you? Even if it is c'punks? The same holds true for > newsgroups. The vast majority of 'net users dislike off-topic > discussion; they subscribe to mailing lists and newsgroups to > discuss topics of relevence and mutual interest. > It is highly > self-centered of you to assume the "right" to waste their time with > unwanted and completely off-topic communication. No, it is not self-centered at all, it is only done on the impulsion of the moment. If he were smart, he would realize that reputation takes years to build and seconds to destroy. > > If you don't want spam in your mail box: > > > > 1. Don't have a website or don't put your e-mail address on your > > website If you don't want to get mugged, don't walk in the street; if you don't want to get killed by a mugger, chase him and offer him you wallet, then kill yourself. I grew in an extended family where there was always money and wallets on the kitchen table. But no matter how broke one of us were, if it did not belong to him, he did not take it. It is, of course, out of respect for life (and it's economic extension, the right to property) > > 2. Don't post to newsgroups Don't exists... ( because to him, the use of force is legitimate and there is no such right as the right to live, as long as he's got stronger arms than yours) > > 3. Don't post to mailing lists Ditto > > 4. If you post do so anonymously Act covertly, Live in fear. > When you exercise your "right" to free speech to the extent that you > piss off a large segment of society, society will react by reducing > its measure of freedom of speech. I won't start a discussion here. I will simply state that words have a definite meaning and that by twisting them (I suppose innocently in your case), you give them a moral sanction. jfa Jean-Francois Avon, Montreal QC Canada "One of theses centuries, the brutes, private or public, who believe that they can rule their betters by force, will learn the lesson of what happens when brute force encounters mind and force." - Ragnar Danneskjold PGP key at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891

1 0

Re: Security technical list
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

You're soaking in it. Ryan ---------- Previous Message ---------- To: cypherpunks cc: From: macgyver @ colphi.edu.ar ("MacGyver") @ smtp Date: 09/06/96 09:12:20 AM Subject: Security technical list [pgp sign clear] Anybody could help me to find a mail list of security,crypto,etc?? Regards

1 0

No Subject
by HipCrime 17 Dec '03

17 Dec '03

Here's a collection of your various threats: > I suspect you may soon be hearing from far worse than I ... > Some punks take their colors seriously. > Congradulations. I had at first thought you were a simple fool. > Now I'm certain you're an idiot. > Sounds to me like every remailer can legally be altered to send a > small message to hipcrime every time it processes any messages. > if anyone's got a T3 handy, you could always take the direct approach. In making these threats, you've mistaken me for someone who cares. Someone who cares what you send to my box. I'm actually, and in fact, homeless in real life. Yes, both an "idiot" and a "simple fool": your compliments in my book. My only equipment is access to friends' computers, and a free dialup that the big-hearted SysOp at V-Site gives me. (By the way, you've been merciless to him). In view of this fact: Do you think that even 1,000,000 messages into my stupid electronic mailbox would matter? Some nights my worries are of a place to sleep, not how many messages will accumulate during my slumber. CypherPunks live so far from real-life, that it's impossible for them to communicate rationally. Never having any danger in their lives, they want to avoid encountering any in "cyberspace". They are trying to craft that new world according to their intellectual guidelines. Trying to make sure real-world annoyances have been removed. This is what HipCrime's real offense was: providing a piece of unexpected (ok,ok "unwanted", if you prefer) stimulus. Only a single one. A tiny-little URL, but sent without warning, anonymously, and pointing to a strange site. Since I've UNSUBSCRIBED from your CypherWimps mailing list, and still receive your messages (two copies, the one you send me, and the one you send the list), my only conclusion is that Email is your only social discourse. Take notice that after this, all future messages from y'all will feel the power of the DELETE button (unread and barely noticed). Think of how easy it is to move around in "cyberspace". Do this math: 1,000,000 messages = 1 new domain + 1 new mailbox. In this argument you win, junk Email is SPAM ... but junk SnailMail is THIN SLICES CUT FROM OUR PRECIOUS FORESTS. -- HTTP://www.HIPCRIME.com

1 0

really undetectable crypto
by jim＠suite.suite.com 17 Dec '03

17 Dec '03

Most everybody on the list is familiar with the technique of hiding encrypted messages in the LSBs of image files. Personally, I would not use such a technique because don't I believe it's really undetectable. I assume, without proof, that the LSBs of images files have statistical properties that are sufficiently different from encrypted data that a clever person could determine whether or not an image file contained an imbedded encrypted message. Fortunately, there are other steganographic techniques that, I believe, are undetectable. The trick is to hide your encrypted bits in other encrypted bits. trick #1) Let's say you want to send a short encrypted message via a communications channel that only allows cleartext messages with optional MD5 message hashes. You can construct cleartext messages, via trial-and-error, such that the first 4 or 8 bits (or more, if you have the time) of the MD5 hash match the first 4 or 8 bits of your encrypted message. You can pre-compute all the required cleartext messages in advance, and then send them one after another. The recipient of the cleartext messages can reconstruct the encrypted message by gathering together the first 4 or 8 bits of each MD5 hash. Since the bits in an MD5 message hash are presumably cryptographically random, there should be no way to tell if some of the bits combine to make an encrypted message. trick #2) Let's say you are allowed to use 40 bit encryption, but nothing stronger. As in trick #1, you can pre-compute plaintext messages such that the first 4 or 8 of the bits in the output of the government-approved 40 bit encrypted data match the first 4 or 8 bits of your hidden encrypted message. trick #n) see above. Any communications channel that allows you to send *any* bits that are cyptographically random can be used to send arbitrary encrypted messages. Jim_Miller(a)suite.com P.S. The pre-computed plaintext messages don't have to be garbage messages. You can probably make an innocent-looking message produce the desired bits by adding extra whitespace or typos.

1 0

Re: Fed appellate judge remarks re anonymity, free speech on the net
by jim bell 17 Dec '03

17 Dec '03

At 05:40 PM 9/12/96 -0700, Greg Broiles wrote: > >The Daily Journal, a LA/SF legal newspaper had an article today (9/12) about >a lunchtime address given by Ninth Circuit Judge Alex Kozinski last Monday >at an Internet Law Symposium in Seattle. > >The article quotes Kozinski as saying "I have a severe problem with >anonymous E-mailers . . . You don't have a right to walk up to somebody's >door and knock with a bag over your head." The article says Kozinski likened >anonymous E-mail to menacing someone. I wish somebody would go up to these guys and point out that since the Internet is, more or less, a huge, worldwide, VOLUNTARY association of people, _we_ don't think these judges have any sort of "right" to regulate its content. Furthermore, it isn't clear that the proper regulators of the Internet shouldn't be an entirely different set of people selected by Internet users, RATHER than the same old government system that's managed to screw up the rest of the world so far. And if you're looking for "menacing," I'd say that describes the government's behavior towards the Internet over the last year or two. >Kozinski also suggested that computer-generated or morphed images of >children involved in sexual acts may not be protected under the Constitution >because of ongoing trauma to the child, Which child? Does he understand what "computer-generated" means? >while computer-generated or morphed images of adults would be protected. What about the "ongoing trauma" to the adults? I smell hypocrisy. >The article says that Kozinski was skeptical that he or other federal judges >necessarily agreed with the 3rd Circuit's ruling in _ACLU v. Reno_ (finding >the CDA unconstitutional). > >Kozinski is considered relatively conservative and relatively libertarian, >as 9th Circuit judges go. Which means that he'll last just a little longer "when the cyber-revolution comes." Jim Bell jimbell(a)pacifier.com

2 1

Re: [Long] A history of Netscape/MSIE problems
by Tom Weinstein 17 Dec '03

17 Dec '03

Hallam-Baker wrote: > > There was a long list of security holes in SSL, PCT plugged a good > number of them and SSL v3 plugged a few. This statement surprises me. It appears to mean that you think PCT has fewer holes than SSL 3.0. If you know of any holes in SSL 3.0, I'd be very interested in hearing about them. -- You should only break rules of style if you can | Tom Weinstein coherently explain what you gain by so doing. | tomw(a)netscape.com

2 1

56 kbps modems
by Asgaard 17 Dec '03

17 Dec '03

>U.S. Robotics and Rockwell International are planning new modems with >speeds up to 56 kbps a second, almost double the speed of the fastest >rate now available. The new devices should be available by the end of >the year, although their top speed initially may be less than 56 kbps. >(Wall Street Journal 12 Sep 96 B11) People who seemed to know used to say that 'the Shannon limit' set an absolute upper limit around 40 kbps. Has Shannon been proven wrong, or what? Asgaard

2 1