- cypherpunks-legacy - lists.cpunks.org

Anonymity on the net
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

Alan Wexelblat writes: [Asks, why is anonymity/pseudonymity useful when posting?] > Case 1) technical postings of a research/white (in the sense of whitenet/ > blacknet) nature. Here anonymity would be a hindrance. I post in large > part to help my name be known in certain academic circles. In this case I > would tend to wonder at people who posted anonymously and would (as was > mentioned in this list) tend to discount their information. In research > circles, name value means a lot. An anonymous/pseudonymous poster may want to expose faulty reasoning or research methods on the part of a previous poster, where that poster is their boss, faculty advisor, department chair, [employee of] generous donor to a nonprofit org .. etc. This is also useful for revealing insider information of a sensitive or "whistleblowing" nature; see below. > Case 2) technical postings of a black nature. Here anonymity is a big help, > as you may have some question about the legality of what you are doing. But > the question I have is: why post at all? What gain is there from > publicizing this kind of information? Perhaps the gain is some assurance of > safety from retaliation from parties who might feel themselves wronged by > what you posted. In this case, anonymity wins. This is useful for posting security holes that CERT/vendors won't acknowledge or address; it seems generally useful when posting something that might get you (a) fired or (b) sued. Consider the (ongoing, I think) litigation against the person who posted negative comments about a stock to Prodigy. SLAPP (strategic lawsuit against public participants) actions aren't (to my limited knowledge) common in the online world, but aren't so uncommon in, say, logging-protest world. Even where a SLAPP suit isn't successful (in terms of a favorable verdict), they can be very burdensome to defendants. (The suit against the poster to Prodigy may or may not be a real SLAPP, but it's at least similar.) > Case 3) non-technical postings (social, talk). Again I wonder what is the > value of anonymity in this case. To have a social conversation is to build > a community of like-minded people and to contact people whom you want to > relate to in some way. Anonymity defeats this social building and relation > process. There are still several places where it's not 'politically correct' to be known as a reader of/poster to groups like soc.motss, alt.sex.bondage, or other "controversial" groups. People may still want the sense of community that they can get from participating, while wanting to avoid the enforcement of PC-ness, possibly at the end of a baseball bat. Famous/infamous people may also want to participate in the online world without being swamped by "fan mail" - I suspect it'd be virtually impossible for, say, William Gibson to post to Usenet without being overrun by zillions of letters. I believe that Steve Wozniak (post-Apple) attended college under an assumed name for similar reasons. > A counter-response to this might be to say that we want to put privacy in, > not anonymity. But again, I wonder about this. If I want my message to be > read only by a certain list of people, why am I posting to a newsgroup > instead of to a mailing list? Distributing "secret" information widely, in an encrypted form, can frustrate traffic analysis - if I suspect that X is doing something nefarious, I could look through sendmail logs (or whatever) to see who she's talking to, and create a list of suspects. However, if X posts her secrets to the net - in an encrypted format - and those secrets are dispersed to the world, I can't draw any conclusions about anyone who happens to receive that encrypted message in their alt.test newsfeed. There's also no chance that anything peculiar will be showing up in postmaster mailboxes because of bounced mail; it's also a much easier way to talk to 200 people at once. (Assuming that it's meaningful to talk about sharing a 'secret' with 200 people .. :) > There's no point in privatizing the substrate, since anyone can get a client > that will decrypt at the far end. > > In sum, I guess I'm somewhat baffled at why one would want to use anonymity > and/or privacy enhancement technology on one's news postings. Generally, to (a) say/do something controversial, and avoid retribution; (b) for an [in]famous person to say/do something mundane; or (c) to make anonymity/pseudonymity not seem so peculiar, so instances of (a) and (b) won't stick out like sore thumbs. -- Greg Broiles greg(a)goldenbear.com Baked, not fried.

3 2

Tech: Truth about Canon Copiers
by an4914＠anon.penet.fi 17 Dec '03

17 Dec '03

> > This is interesting. Since most of the change-making machines in > laundromats seem to use the side with the dead white guy, I wonder if it > would work to use this copy? > ----Dave REes (rees(a)cs.bu.edu) > >Nah, the changers just say "this side up" - the scanner may be looking at >the underside of the bill, or at both sides (more probable). > Or, they may not "scan" at all! Ever wonder why wrinkles, folds, and other mutilations wreck their ability to recognize your cash? I think many of them may be measuring paper thickness, folks. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

The Final Ultimatum
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

Cypherpunk leaders, state the truth, the whole truth, and nothing but the truth on the charges of routine, systematic, rampant, and conspirational pseudospoofing and deception of the media and your followers, publicly to all those you have affected in Cyberspace. Cypherpunk followers, demand publicly and privately of your leaders the truth, the whole truth, and nothing but the truth, and accept nothing less. Otherwise, watch the `movement' and your reputations dissolve before your eyes far beyond the present deterioration, to near total oblivion. You have 24 hours. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

Re: Pyrrhus Cracks RSA?
by cfrye＠ciis.mitre.org 17 Dec '03

17 Dec '03

>> = cfrye(a)ciis.mitre.org (Curtis D. Frye) > = boone(a)psc.edu (Jon Boone) >> Strong words that, IMHO, put way too much faith in the argument that a >> "restrictive" work environment inevitably crushes individualism and >> creativity. Any organization, .gov or !.gov, that: >> >> * recruits the best and the brightest and pays them well; > > Do you know how much NSA employees get paid? I'm wondering, because it > is certainly _not_ the case in the CIA. The "analysts" may make somewhere > between the $30K - $45K range, but that's hardly "good pay" for people > who are experts on that kind of analysis, especially when they have Ph.D.s. While I'm not intimately familiar with the workings of the NSA, I would guess that folks w/ Ph.D.'s and no/little work experience are probably brought in near the top end of that range, though the advanced degree would allow for quicker advancement to senior technical or management positions and correspondingly greater pay. Also, be sure to include the labor surplus, government benefits and job satisfaction as factors in considering salary adequacy. > >> * gives access to substantial computing/financial resources and academic >> knowledge; >> * fosters team-building, creativity, and competition *within the group*; >> * rewards achievement and provides status *within the group*; and >> * provides other movitivation, be it patriotism/pride/whatever, >> >> will produce more than its fair share of advances in a field. Given a >> concentrated environment and an advanced set of tools, it seems improbable >> that any group, regardless of organizational affiliation, could be >> outperformed *on an evolutionary basis* by a loose band of academicians and >> private researchers with irregular contact. >> >> Curtis D. Frye >> cfrye(a)ciis.mitre.org >> "If you think I speak for MITRE, I'll tell you how much they >> pay me and make you feel foolish." > > Please tell me how much MITRE pays you. Is your above description a > description of MITRE? MITRE pays me significantly less than what they would pay a Senior VP, which is about the level where I would feel comfortable stating that I "speak for" MITRE. As for the team-building observations I made above, they are made from a general management perspective and are open to debate, though that discussion might be a bit off-topic for cypherpunks if removed from the crypto framework. -- Best regards, Curtis D. Frye cfrye(a)ciis.mitre.org "If you think I speak for MITRE, I'll tell you how much they pay me and make you feel foolish."

1 0

NSA
by The PUNISHER - Judge 17 Dec '03

17 Dec '03

Hey all, I just wanted to let you know (as an ex-SEAL), the NSA (and to a limited extent CIA) have UNBELIEVEABLE resources! If anyone could crack RSA, DES, OPP...they could. Never underestimate the power of a "black" budget (or for that matter soup) The PUNISHER Judge; Jury; Executioner....All in a day's work Mob Boss: "500 of my men killed; there is a limit to revenge you know" Punisher: "I haven't reached mine yet"

1 0

Auto-Verifying of Sigs
by JEFF LICQUIA (CEI) 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thinking about this requiring/checking sigs thing, I thought of something... Really, the only "unknown" with signed messages is whether they are valid or not; it's pretty easy to distinguish the unsigned posts. Furthermore, it seems to be my observation with verifying digsigs (as I do in non-crypto groups I subscribe to) that the vast majority of sigs will turn up OK. It seems, therefore, that expending a lot of effort to change the current list to allow this would be wasteful considering the relatively few times that it would produce any useful information. May I propose a "better" way (you be the judge here): Proxy the job. Have a 'bot subscribe to the list (through whatever way), armed with a complete keyserver keyring. Its only function is to check all signed messages from the list. Unsigned messages, messages with sigs that checked OK, and messages signed with unknown keys would generate no response from the 'bot. A failed sig, however, would cause the 'bot to send a (digitally signed, optionally) message to the list to the effect of "This message here didn't check OK" (complete with disclaimers and warnings about trusting authorities blindly). This would be a totally automated way of checking sigs, and wouldn't involve any new code on the list's part. Those who didn't want the intruding messages could killfile the 'bot, and the rest of us wouldn't be bothered with redundant information on every post. What say ye all? I can tentatively volunteer my business account to do the work (have to talk to my boss about it first, as that account has to pay for volume and phone time). I'll play with some code in the meantime and see what I can come up with. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtz1EjER5KvPRd0NAQEx7gP+IlVoJG1YVXKmQViVCtabX1owrH2MHDBg MpKBq7T6NbPMTDUWLE7HNWTfw5BvZbSCC1uRRM2rKV6xHZPxU0buUsoDc5QLT10b xYbs9/j81dlTve7/fMToJjNJuls61289XaOIlfPN+sBIGX1TwrtDKek6To8GsdAN YmkUYUUFzL8= =3fF9 -----END PGP SIGNATURE-----

3 2

CORRECTION READ FIRST
by Christopher Garrett Goebel 17 Dec '03

17 Dec '03

Don't mail those case studies to genghis(a)blue.engin.umich.edu It was a dormant account my brother used to keep in touch with friends from work (when he worked there). He said he could forward mail to me from there... well, it looks like they've closed down that account. Sorry, send mail to goebelc1(a)studentg.msu.edu Thanks, Garrett

1 0

Pyrrhus Cracks RSA?
by Michael E. Marotta 17 Dec '03

17 Dec '03

CAN THE GOVERNMENT BUILD AN ATOMIC BOMB? by mercury(a)well.sf.ca.us <Michael E. Marotta> Long ago, Captain Kirk and his crew stumbled on a Nazi planet. A Federation dude found them earlier and decided to industrialize their society by the "most efficient" means possible. No one was surprised at this. In "Mirror, Mirror" Spock-2 predicts that the Evil Federation will collapse. This was also accepted without comment. Star Trek, perhaps more than any other mass media production, reflects the American psyche. Americans, of course, are humans. Human nature accepts dualities easily. On the one hand, people admire the conqueror. On the other, the historical evidence is never denied: empires always collapse. (Look at what remains: farming, writing, arithmetic, ships and chariots, clothing,... These are useful.) Not so long ago, Ayn Rand showed that evil only triumphs when good people work f+ it. When good people do nothing, evil fails. Cypherpunks know that centralized systems are inefficient, yet they fear the NSA. Cypherpunks know that government employees are slugabeds, yet they fear the NSA. Cypherpunks know that qinnovation and enterprise are the antithesis of socialism, yet they fear the NSA. They don't fear that the NSA will kick in their doors and shoot them in a cybernetic Kristallnacht or burn t(their homes the way the Romans and Mongols did to Carthage and Samarkand. (Waco comes to mind, here.) No, the Cypherpunk is afraid that the government has "powerful computers" capable of a "brute force attack" on their algorithms. It may be true. Having Archimedes in town only bought the Syracusans time, it didn't assure them victory. The US Govt drafted 90% of the physicists in the world, gave them virtually unlimited resources and in five years, it had atomic bombs. The American and Soviet governments proved that they could harness nineteenth century technology and shoot things into space. (According to Willey Ley what made their rockets possible was the pumps which came from fire trucks.) Ask "anyone" and they will tell you that World War Two brought us nuclear power, spaceships, radar, television, the transistor, the computer, canned food, and recycling. In fact, it brought none of these. They already existed. Absent the person with an idea, the Government would still be beating farmers with rods for not giving up their goats and grain. (The pharoah's toughs used sticks with sharp stones in them until bronze came along. Later, their bronze weapons were chopped up by people with iron. Why didn't the pharoah's priests discover bronze and iron?) Both William Friedman and the man he detested, Herbert O. Yardley, despaired in wartime for the lack of people with "cipher sense." An infinite number of clerks with typewriters could not break the simplest code. The government enlisted people who liked crossword puzzles, mathematicians, polyglots, anyone and everyone who played with symbols. It made no difference. There was no way to tell who had "cipher sense" and there was no way to TEACH it. Friedman was an obsessive-compulsive who worked himself into a neurotic frenzy, breaking the Purple Code. Turing delivered the "Bombe" that broke Enigma. You know the people who could break DES, RSA, PGP, etc. Shamir unpacked Diffie's knapsack. What is most probable, is that these ciphers will stand for some unforeseeable time until someone who may not be born yet comes along and breaks them all as an idle {exercise on her way to greatness in another field. But the NSA? No way, Jose. They might be nerds who hacked some code at 3 am. But you put them on a salary and benefits in a pyramid, then tell them not to talk about their work, and you thwart whatever creativity they had. The NSA can kill you. But t({they can never out-think you. qiM{iW{x

2 1

NYT: Virus; NeXT (unrelated)
by walter kehowski 17 Dec '03

17 Dec '03

Cypherpunks and Extropians: Two articles of interest in today's NYT: 1) [Front Page, lower right] A software vendor allegedly planted a virus in a customer's machine because he threatened to stop payment on the software he bought. The virus was programmed to shutdown the customer's computer. 2) [Front page, bottom, Business section] NeXT and Sun have announced a partnership. Apparently, Sun is to invest 10mil in NeXT for access to the source of their OOP environment. BTW, how much did Sun make last year? How much is 10mil by comparison? Walter A. Kehowski <wak(a)next0.math.pitt.edu>

1 0

ViaCrypt Details?
by Bruce C. Dovala 17 Dec '03

17 Dec '03

Hi, Does anyone have any details on ViaCrypt? Particularly availabilty, sources, user interface, compatibility with PGP, etc. Please post or write. Thanx, Bruce

1 0