- cypherpunks-legacy - lists.cpunks.org

someone to "educate"
by clouds＠alpha.c2.org 17 Dec '03

17 Dec '03

This was, well, interesting. As a result of the recent loss of many remailers, I started looking for a local (to me) ISP that would offer me an anonymous account, and/or a shell account. Nobody would offer me a shell account except for these people, and here's what they had to say about an anonymous account... Received: by alpha.c2.org for clouds(a)alpha.c2.org From gjung(a)igateway.net Thu May 30 06:33:10 1996 The policy is set and I am not going to argue with you about it. I explained that we do not feel that anyone needs to be doing things that they do not want their name attached to on the Internet, and for that reason do not offer anonymous accounts. You have offered no reason to change the policy. I regret that we are unable to offer service to you. ---------- From: The Dreamer[SMTP:clouds@alpha.c2.org] Sent: Wednesday, May 29, 1996 5:32 PM To: gjung(a)igateway.net Subject: anonymity/corporate policy > Corporate policy dictates that we do not offer anonymous > accounts. It is corporate belief that there should be no > reason anyone needs anonymity on the net That's an, er, interesting policy. Although there are a great number of arguments for anonymity - and privacy - I won't try to persuade an obviously uninterested audience. (That's you.) I'd like to see the relevant corporate policies; are they available at www.igateway.net or elsewhere? Also, is there a more precise rationale behind the decision? I'd very much like to do business with you, but if you don't want my money, that's cool. d.

1 0

Re: Quickremail v1.0b
by loki＠infonex.com 17 Dec '03

17 Dec '03

At 3:36 PM 5/28/96, E. ALLEN SMITH wrote: >From: IN%"matts(a)pi.se" "Matts Kallioniemi" 28-MAY-1996 06:08:28.40 > >>Why would anyone set up a remailer at Lance's (or Sameer's) machine? >>They have remailers running already. If the thugs break root and obtain >>one remailer key from a machine, they probably get all the keys on that >>machine, compromising all the remailers in one single attack. Or am I >>missing something? Is there any benefit of multiple remailers on a machine >>where root is running his own remailer? > > Well, the advantages are: A. I get Lance's help more quickly in setting >up this one, so I can later go to other machines (preferably out of the >country) and set things up the same way there (getting Mixmaster from an >out-of-US source, of course); and B. supporting the efforts of Sameer, Lance, >et al by paying them some money. While multiple ISPs are certainly >preferable (to avoid one rubber-hose (e.g., law enforcement) breaking from >getting everything), your argument assumes that all the machines at a given >ISP are linked together such that if one is broken, the rest are - which >isn't very good from a security standpoint, so I'd hope it _isn't_ the case. > > Thanks, > -Allen In addition, it is more remailers which need to be shut down to bring the remailer system down. At this point I think we need to think of robustness against shutdowns in our threat models, in addition to the usual considerations of traffic analysis. With all the shutdowns, the most immediate need is for more remailers. -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: opinions on book "The Truth Machine"
by tcmay＠got.net 17 Dec '03

17 Dec '03

It sounds like a "make.money.fast.by.promoting.this.book" scam to me. At 3:32 AM 5/31/96, A.Back(a)exeter.ac.uk wrote: >Anyone read this book? Available on line: > > http://www.truthmachine.com/ > >The book is a possible future world scenario exploring the social >implications of another new potential technology, a 100% reliable >truth test. What would society do with such a device? > >The book explores the direction in which it is no longer possible to >speak untruthfully without detection. A different approach to AP to >ensuring honesty in politicians. .... Adam, I find it hard to believe you're caught up in this "Amway novel" nonsense. (I saw the ads for it in many newsgroups a few weeks ago.) A "machine which makes lying impossible"? Give me a break. (Sounds like a great scheme for factoring large numbers...you just pick a pair of factors at random and the "truth machine" says whether you're lying or not....Other problems with this "truth machine" are left as an exercise.) In any case, I decided to waste a few minutes skimming the opening parts of this "online media event novel" and discovered at the URL you cited: "Complete this brief survey and receive the first two and a half chapters of the book free! Upon submission, you will be given access to these chapters of The Truth Machine......" Utter bullshit. If the book was any good it would have a real publisher, not an opinion survey. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: [crypto] crypto-protocols for trading card games
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In my earlier message I said: > > Cards are not transferrable. In order to make cards transferrable > > the game company must be able to invalidate cards which have been > > traded to others. In other words if Alice wants to give a cards > > to Bob she must: <snip> Gary Howland said: > This is the double spending problem. > Me again: > > Since step 3 is so costly to implement, I think it is unlikely > > that a cryptography-based trading card game will have tradable > > cards. > Mr. Howland again: > Given that untraceability of cards is less of an issue than with > e-cash, why not have a central registry of the owners of the cards > (which would consist of the card hashes paired with the public key > fingerprint)? Admittedly this means the players must be on line, > but then we all know how difficult off line detection of double > spenders is. > And herein lies the problem with an implementation of trading card games. In order to detect "double spenders", the system must be on-line. However, I believe going on-line will drive the costs of running such a game out of the range of commercial feasibility. First of all, it requires that all players have Internet access. This reduces marketability. Secondly, it requires that both players make an Internet connection with the game company everytime they want to play a game. This will incur costs to the game company that it invariably will want to pass on to the players. Players, however, will be very resistant to a game that requires a subscription fee as well as costs for purchasing "cards". Especially, if becomes known that the only reason for the game requiring on-line access is to prevent "cheaters". It also raises the question of whether the game program could be "hacked" to avoid checking for authenticity of cards. I think that a more realistic solution to the "double spending" problem is to not allow the transfer of cards between players. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMa6cjPBB6nnGJuMRAQGr3wP+K+DXJVM0rX0F6FSqwfTE/YCJbfiJXC7g dAlwBA1URYA96h4su6xRThD2SbL0vJSLhvi3djQiTeshdqgmD8MTzlDsqTDLPp+f Sw0GN7OjHWlt8VO5UOK9686L7u2Ev49EdGqkaR2NOy5qNdj079v0JydRCg3qhvmT 7LqcXhRbH7g= =h3Eq -----END PGP SIGNATURE----- -- David F. Ogren ogren(a)concentric.net (alternate address: dfogren(a)msn.com) PGP Key ID: 0xC626E311 PGP Key Fingerprint: 24 23 CD 15 BF 8D D1 DE 81 71 84 C8 2C E0 4B 01 (public key available via server or by sending a message to ogren(a)concentric.net with a subject of GETPGPKEY)

1 0

Re: remailers, mail technology
by Bill Stewart 17 Dec '03

17 Dec '03

>>>Why would anyone set up a remailer at Lance's (or Sameer's) machine? >>>They have remailers running already. If the thugs break root and obtain >>>one remailer key from a machine, they probably get all the keys on that >>>machine, compromising all the remailers in one single attack. Or am I >>>missing something? Is there any benefit of multiple remailers on a machine >>>where root is running his own remailer? There are multiple threats that remailers have to face; multiple remailers on one machine are jointly vulnerable to some of them, but separately vulnerable to others. If there are keys stored in plaintext on a machine, then root-breakers can steal them (unless it's running a multi-level secure operating system that can prevent that, if physical security is maintained.) Thugs confiscating the hardware or trashing the OS obviously break all the remailers at once, though that's only denial of service and not compromise. Offline remailers using POP, UUCP, or other mail forwarding also don't risk compromise (if they only accept encrypted messages), because they don't keep keys or perform encryption on the ISP's server. For all of these cases, the remailer-positive ISP provides a certain amount of flak catching, but can also avoid much of it because _he_ isn't running the remailer - his customers are, and if the remailer gets abused, maybe they'll have to become ex-customers. That's especially effective for ISPs that support customers with their own DNS names - foobar.com is owned by someone other than Sameer, and if Sameer has to squash them, maybe they start getting hosted by Lance instead, or by AOL, or by YAISP.SF.CA.US. Telnet-only shell account providers probably get a little less deniability than dial-only IP+POP providers or especially dial-only IP-only providers. (On the other hand, the fact that Sameer's systems are telnet-only means that users can be spread around to other dial-IP providers, including all those 10-hour AOLers he just has to keep squashing :-), while if he had dial-up users the thugs might go for telephone records. ==== What kind of technical infrastructure would help run remailers in environments like this? I can think of three things - Encrypted IP sessions (either IPv6, if it ever gets deployed, or swIPe) - Encrypted POP and SMTP client/server interactions. - User-based encrypted communications (SSH? SSL?) relaying POP/SMTP. If we're going to get convenient wide deployment before the millenium brings IPv6, the approach will either need to run on shell(-like) accounts only, or else will need to piggyback on SSL. Either way, rather than get everyone to replace POP3 with CryptoPOP (they haven't even done IMAP), it'll probably take some kind of relay that sits on your desktop machine, speaking POP3-server on one side and CryptoPOP on the other. And you'd have to handle firewalls. Is there any way to get Netscape to implement something like pop3: and smtp: services for the client software (or do them as plug-ins)? Adding them to a server (i.e.. Apache-SSL) would allow SSL to do the crypto, and would mean you could use https: proxies to handle firewalls, since everybody's got to deal with them anyway. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

NRC Report, 3
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Chapter 3 Needs for Access to Encrypted Information http://pwp.usa.pipeline.com/~jya/nrc03.txt (88 kb)

1 0

Asendmail V0.5beta is available now.
by Ben Holiday 17 Dec '03

17 Dec '03

The beta release of asendmail is now available from: http://www.cyberpass.net/~ncognito/asendmail.tar.gz The compressed archive is about 13k. Included are the current proxys.conf and a sample fakes.conf file, along with pretty decent instructions for use with and without mix. I'll be out of town for the next 2 days, so I'll not be responding to email until monday. Adios.. Ben

1 0

Re: Something that just crossed my mind. Sorry.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:01 PM 5/31/96, Sandy Sandfort wrote: >At 10:35 PM 5/30/96 -0500, snow wrote: > >>It is my position (until proven wrong--please) that larger business DON'T >>want anonymity. They _want_ to be able to track purchases and use of their >>product for several reasons. > >Two quick answers: > >1) What big business wants and what it would be > willing to accept in order to make sales, are > two different things. While demographic data > are nice, an more robust economy full of big > spenders is better. To add to this point, "all XYZ is economics." (Crypto, security, customer preferences, etc.) A K-Mart or Radio Shack might place a value on any customer's spending preferences at, for instance, $0.035 per $100 spent. This is just a figure I'm inventing to make a point; market researchers within K-Mart or Radio Shack probably have better estimates. Thus, if customers give information away for "free," as many do, then a Radio Shack will naturally try to collect this information. Even better if they can get info about earning power, neighborhood, magazines subscribed to, etc. Some stores try to collect this information. In any case, few stores will turn down a sale because this $0.035 or even $0.10 "value" is denied to them. It's always about economics. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Optimism re NRC Cryptography Report
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 07:40 AM 5/31/96 -0700, Timothy C. May wrote: >This should be enough to ensure our victory. (Not that I think that even >fairly repressive legislation would've been enough to defeat us, but a new >breathing spell can only help.) Actually, I felt this upon reading the general recommendations, but then in reading the expansion of the recommendations, I could see a lot there for the continuance of the "status-quo" type of attitude. After talking about it with other people, my feeling is that the document might be all things to all people...? Pro-crypto will be happy with it and point to this para and that, "anti"-crypto (law enforcement type) could also be happy with it and point to that para and the other. The question then is, how will it be read/perceived by its audience (which I suspect is legislators.) Given the way the press is reporting, it is being received as a pro-crypto report, congress might pick up on it. Unfortunately, it might pick up on it with respect to publicity and posturing, and a fair amount of "the briefing" back door stuff will continue. Can't say though. _______________________ Regards, If it weren't for the last minute, nothing would ever get done. Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: Or is it Pat Robertson?
by StanSquncr 17 Dec '03

17 Dec '03

In a message dated 98-03-24 00:31:09 EST, whgiii(a)invweb.net writes: << >You see, add 14 + 1 + 9 + 9 + 1 and you get 34. >700 - 34 is, guess what - 666! >I guess that proves it! ;-) Hmmm Louis Farakan school of Number Theory >> Hmmm, didn't seem to bother you when the same theory was used against Bill Gates! Not surprized, the response came from, you guessed it cypher's, another paranoid "Know-nothing" - << -----BEGIN PGP SIGNATURE----- Version: 2.6.3a-sha1 Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNRdFpo9Co1n+aLhhAQFDpgP8CEFgqntvKfNWWXuPgo0M8pyvYMudl51p g/QyXmn2bs9WZ+3WYwDZlzvirKPa1LuDK85zUGGemMPbZQg2y7PSkyIi3F9kCqoC PLOnCW1ft2dbmiaRZxqbR6LcTU5Ti24XZoe70du0nz6M5vw8vPVW96ZCx0W9Vt2r DXkeg20YFYQ= =a5pE -----END PGP SIGNATURE----- >> Stan

2 1