- cypherpunks-legacy - lists.cpunks.org

Re: [NOISE] The Doors
by Medea 17 Dec '03

17 Dec '03

Vipul wrote: > >The Doors was not only about freedom and love, but about crypto too! >Notice these lines from the song "Five to One" > >Old [cipher] gets old and young get stronger >May take a week baby, may take longer [to crack] >they've [clinton] got the guns and we've got the numbers >gonna win we will take 'em over, com'on. What?! I think you need to stop ingesting those controlled substances.... Medea ======================================== I wonder whatever happened to Jason....

1 0

Re: [NOISE] The Doors
by Jay Quinby 17 Dec '03

17 Dec '03

At 07:36 PM 9/3/96 +0000, you wrote: > >The Doors was not only about freedom and love, but about crypto too! >Notice these lines from the song "Five to One" > >Old [cipher] gets old and young get stronger >May take a week baby, may take longer [to crack] Actually, I think the line reads "They take our week, and make it longer." (There's a line a little later that goes "Trading your hours for a handful of dimes.") >they've [clinton] got the guns and we've got the numbers >gonna win we will take 'em over, com'on. Slightly left of topic, but it is a great song! :) Someone ought to compile a "Best of Crypto-references in pop culture" file. |--------------------------------------------------------------------------| |James R. Quinby, Atlanta, GA | PADI/153KHz-999MHz/HTML/EADBGE/Phl4:8-13 | |jquinby(a)fivepaces.com (work) | Own a 45 MPH couch potato: Adopt a | |jquinby(a)bellsouth.net (home) | greyhound today. Write for details. | |--------------------------------------------------------------------------| |Standard disclaimer: Opinions expressed are mine alone, not my employers. | |PGP Public Key fingerprint: 9ACC4C28478018E1372DC06A9452A477/MIT Keyserver| |--------------------------------------------------------------------------|

1 0

Re: What is the EFF doing exactly?
by Jon Lebkowsky 17 Dec '03

17 Dec '03

At 01:22 AM 9/3/96 -0700, James A. Donald wrote: >At 12:53 PM 9/3/96 -0700, Stanton McCandlish wrote: >> EFF in generally does not issue extremist position >> statements, but is careful to examine the risks as well as the benefits, >> and look for pro-liberty solutions to those risks. > >If the right to speak anonymously is an "extremist" position in the eyes >of the EFF, then they are no friends of liberty. > >It is hardly an "extremist" position outside of such countries as Cuba, >Iran, or China. > >It is the overwhelmingly mainstream position, not just among netizens, >but when last heard, amongst supreme court judges and ordinary people >in the street. Not necessarily. The character of the anonymous speech is decisive. If you use anonymity to cloak harassment, for instance, the anonymity (which removes accountability) is a problem. The accountability issue is real and should be addressed, not evaded. -- Jon Lebkowsky http://www.well.com/~jonl jonl(a)hotwired.com

1 0

Reputations
by tcmay＠got.net 17 Dec '03

17 Dec '03

Something closely related to anonymity issues is _reputation_. As I keep saying, there have been dozens of articles on this and similar topics. Mostly in the early days, when we were exploring such things (well, some of us has started exploring them some years earlier...). Regrettably, the archive system is not very functional, especially not for older articles (there are rumors that L. Todd Masco took down the archive site due to pressure from the "Wall Street Journal" over their copyrighted articles in the archives...those Web spiders find all such copyright violations!). Here's another fragment of my Cyphernomicon, making some points about positive reputations. Briefly, think of "restaurants" when thinking about reputations. If one arrives in a new city, most restaurants may have the same baseline reputation, e.g. "none." A few may be known by name, for their "reputation," either good ("You have to eat at Louie's--the laser chicken is incredible") or bad ("Blecch!). Positive reputations and negative reputations are self-explanatory. And the reputations of others may affect the reputations of restaurants ("John Gilmore says he likes the Burma Burger on Castro Street."). Bad recommendations may affect the "reputation capital" of John, for example. (We speak of "reputation capital" because it can in some sense be "spent.") And so on. Many of the debates about anonymity seem to ignore reputations, filters, kill files. It is almost as if the critics of anonymous speech are saying "If there is not accountability for restaurant recommendations, we'll all be buried in garbage food." This ignores the _emergent order_ or _evolutionary_ nature of actors in the restaurant and restaurant evaluator market. Free speech is often messy. 98% of everything I read or hear is crap, to do Sturgeon one better. But I use judgement to decide what to read, who to listen to, and what to mostly ignore. I use _reputation_ to choose restaurants, books, movies, speakers to listen to, etc. Sometimes I listen to anonymous speech, but mostly I don't. Pseudonyms take a while to gather a "positive reputation," and some never do. This is the way speech works. "Accountability" is a red herring. Anyway, here's the promised excerpt: 15.5.5. reputations are what keep CA systems from degenerating into flamefests - digital pseudonyms mean a trail is left, kill files can be used, and people will take care about what they say - and the systems will not be truly anonymous: some people will see the same other people, allowing the development of histories and continued interactions (recall that in cases where no future interaction is exected, rudeness and flaming creeps in) + "Rumormonger" at Apple (and elsewhere) always degenerates into flames and crudities, says Johann Strandberg - but this is what reputations will partly offset 15.5.6. "brilliant pennies" scam 15.5.7. "reputation float" is how money can be pulled out of the future value of a reputation 15.5.8. Reputation-based systems and repeat business + reputations matter...this is the main basis of our economic system - repeat business....people stop doing business with those they don't trust, or who mistreat them, or those who just don't seem to be reputable - and even in centrally-controlled systems, reputations matter (can't force people to undertake some relations) - credit ratings (even for pseudonyms) matter - escrow agents, bonding, etc. - criminal systems still rely on reputations and even on honor - ironically, it is often in cases where there are restrictions on choice that the advantages of reputations are lost, as when the government bans discrimination, limits choice, or insists on determining who can do business with who + Repeat business is the most important aspect - granularity of transactions, cash flow, game-theoretic analysis of advantages of "defecting" - anytime a transaction has a value that is very large (compared to expected future profits from transactions, or on absolute basis), watch out - ideally, a series of smaller transactions are more conducive to fair trading...for example, if one gets a bad meal at a restaurant, one avoids that restaurant in the future, rather than suing (even though one can claim to have been "damaged") - issues of contract as well We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Secure anonymouse server protocol: comments please
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 07:24 PM 9/2/96 +0000, paul(a)fatmans.demon.co.uk wrote: >The following is a very sketchy plan for a secure protocol for an >anonymous server which allows replies without storing a recipient >database in the clear. Several people have talked about this sort of thing recently, inluding William Geiger, Doug Floyd, and myself. Lutz Donnerhacke's Jenaer Anonymous Service <anon(a)as-node.jena.thur.de> actually implements it (send it mail saying "help".) Rather than using a human-selected userid, it uses the PGP keyid to make IDs like anon-1a2b3c4d(a)as-node.jena.thur.de. >This system has 1 huge fault, we can encrypt a uses ID with the >servers public key to see what his ID in the encrypted database is >and therefore identify him, maybe we need two seperate server public >keys, and when IDs come in encrypted with key1 (the one it releases) >it decrypts with secretkey1 then encrypts with publickey2 (the one it >keeps secret) If you encrypt the id using raw RSA and constant padding, this is a risk. If you encrypt it using PGP, which uses a random session key, it's not. If you encrypt it using raw RSA and pad the id with a random nonce, it's also no risk. In the latter two cases, the encrypted material is different every time, so you can't compare with previous messages. The Jenaer nymserver avoids this by using a remailer approach - you send an encrypted message with a Reply-To: header telling where to send the accumulated mail (which may, of course, be another nymserver), and it delivers it using mixmaster. This frees you to send your pickup requests by anonymous remailer as well. It's still not risk-free, since if Bad Guys crack the remailer or force the operator to operate it while they monitor it, they can see pickup requests, but it's far more difficult to do that than to just steal the box, and there's no database on the box that's useful to steal. Lutz does recommend chaining your Reply-To: to another nymserver, but it's already very secure. I don't remember if he gets fancy and requires the pickup requests to be signed by the key of the owner or not; the only difficulty with this is the syntax of PGP, which is "fixed in 3.0". Hal Finney has also suggested a system that, instead of delivering anonymous email to the recipient, sends a message saying "You have anonymous mail, receipt #123456. Send back this ticket to pick it up." and you can extend the syntax to handle automatic blocking requests and automatic deliver-everything requests. This is fairly easy to extend for anonymous mailboxes and datahaven code. I've wavered between the delete-on-retrieval model, which is fine for email and not very useful for samizdat, or the delete-after-some-time-period-or-request model, which is useful for both but makes it easy for users to turn you into the local pirate-warez-and-child-pornography server. If you extend the model and charge digicash for storage, it becomes a much cleaner solution. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: their is a new mailing list
by Ross Wright 17 Dec '03

17 Dec '03

> To: cypherpunks(a)toad.com > From: hack5(a)juno.com (patrick b cummings) > Date: Tue, 03 Sep 1996 16:14:40 EDT > their is a new mailing list for all you hackers just email your name or > handle and e-mail address and youll be subscribed > send information to hack5(a)juno.com > > Am I missing something here? Is this guy fucking crazy? =========== Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

2 1

No Subject
by nobody＠replay.com 17 Dec '03

17 Dec '03

patrick b cummings <hack5(a)juno.com> wrote: > their is a new mailing list for all you > hackers > just email your name or handle and e-mail address and youll be subscribed > send information to hack5(a)juno.com k00l d00de.... c'mon Varney, we know its you.

1 0

No Subject
by Ben＠explorateur.quaternet.fr 17 Dec '03

17 Dec '03

suscribe me

1 0

Re: Pseudocrypto detector is going wild
by winsock＠c2.net 17 Dec '03

17 Dec '03

Is it just me, or is the snake-oil frequency factor scaling up? We used to get this stuff quarterly, and now it's monthly, if not weekly! slither-squeek I think enquirer must be overloaded with ammo, and I am sure in the mood for it now. me

1 0

SecurID White Paper
by Peiter Z 17 Dec '03

17 Dec '03

SecurID Vulnerabilities White-Paper Due to increased recent interest that has been witnessed on the net about the SecurID token cards and potential vulnerabilities with their use, we offer a white paper on some of the vulnerabilities that we believe have been witnessed and/or speculated upon. This paper is being put forth into the public domain by Secure Networks Incorporated and is available at the following URL : ftp://ftp.secnet.com/pub/papers/securid.ps Topics dealt with in the paper include: . Race attacks based upon fixed length responses (still valid even with the current patch) . Denial of Service attacks based upon server patches . Server - Slave separation and replay attacks . Vulnerabilities in the communications with the ACE Server . A quick analysis of the communications with the ACE Server . Problems with out-of-band authentication We hope this paper provides insight, enlightenment, and is helpful to the security community in general. thanks and enjoy, Secure Networks Inc.

1 0