- cypherpunks-legacy - lists.cpunks.org

Re: Compuserve *hasn't* banned newsgroups
by Duncan Frissell 17 Dec '03

17 Dec '03

At 05:30 PM 1/3/96 +0100, Anonymous wrote: > If you do this, you'll find out very quickly just how empty (or at >least how slippery) slogans like "the Internet routes around censorship" >are: if your efforts pay off and you steer even a fraction of CIS's >traffic toward the remaining open newsservers, they'll close faster than >you can say "alt." So before you do it, think about how the net will route >around sysops closing their servers off from the net. > >Hieronymous You mean that the thirty-some odd open news servers listed on http://dana.ucc.nau.edu/~jwa/open-sites.html might get swamped. Then the CIS refugees will be forced to pay Sameer the massive $12.50 (?) a month for a net-access-only account and read off of c2.org's server. (Or any of the thousands of sites worldwide one can open a shell account on.) DCF

4 3

Re: Crypto Exports, Europe, and Conspiracy Theories
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:58 PM 1/25/96 -0500, Michael Froomkin wrote: >It's called "strict liability" -- you are liable when you didn't know. >The economic justification is that you were in the best position to avoid >the harm (either by doing some checking, or, in this case (they, not I, >would say) not offering the service at all. Vague memories of Law School... Doesn't strict liability apply to "inherently dangerous activities." Like using explosives to demolish buildings or something. Is carrying message traffic an inherently dangerous activity? Any strict liability situations today not involving inherently dangerous activity? I suppose having disposed of waste in a "Superfund Site" leads to automatic liability but does not necessarily involve an inherently dangerous activity. Is this a "strict liability" situation? I'm trying to think of other sorts of examples. DCF "If we're so poor these days, why do we have more of everything?"

1 0

Re: PGP in Eudora and other mail programs
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 25, 1996 11:54:46, 'tcmay(a)got.net (Timothy C. May)' wrote: > >(I understand from this list that Eudora for Windows is now doing this much >more automatically, that someone has a PGP-in-Eudora package. I don't think >it was from Qualcomm, but I could be wrong. As a Macintosh version user, >I'm hoping this comes to the Mac version as well.) > [REPOSTED FROM ALT.PRIVACY.ANON-SERVER] > >John Doe is a Windows program that makes creating and >operating a Nymserver account a *lot* easier > >A Nymserver allows you to: > >* Create an address of the form your-choice(a)alpha.c2.org >* Cannot easily be traced back to you >* Your Internet Service provider cannot snoop on you >* Can post to Usenet and Mailing Lists >* Your correspondents do not need to do anything special >* Can receive replies addressed to your pseudonym > >These facilities have been available for some time but >John Doe simplifies operation. > >This is a "try before you buy" version expiring 30 days >after installation. The registered version is only 15 >pounds (UK) that's about $25 (US) > >More information and a download are available on: > >http://www.compulink.co.uk/~net-services/jd.htm > >Steve Harris - Net Services > I then posted to alt.privacy.anon-server the following preliminary review: I downloaded a trial version of John-Doe and have been playing with it for a day. Herewith my initial impressions of it: Downloading it from the source: as described. easy. Performing basic installation on my hard disk: essentially automated. should not trouble or even hassle anyone with even a marginal knowledge of Windows. Performing installation as WinsockApp in my Pipeline e-mail software: moderately easy to impossible. Pipeline uses an odd e-mail system that automatically fills an empty SUBJECT field with the phrase "[NO SUBJECT]" that jams everything and caused every test message I sent to bounce back to me. However, I then downloaded a copy of Eudora Light to use with John-Doe. This seems to be working. I really hated the need to do this and the extra hassle but it is not a specific bug in John-Doe. (On the other hand Steve, since installation programs are constantly being improved even to deal with other company's brain-damaged software ... Hint, hint, hint...) Does it work as Steve says: as far as I can tell, yes. Overall impressions (very preliminary): John-Doe is a classical example of how elite technology pulls mass technology in its wake. PZ developed PGP and got it widely out, even if the command line structure kept most people from learning it. Then other people (penet not included here) developed Mixmaster etc. tech that worked well but was so complex that only an estimated 500 people worldwide could use it. Then other people developed front ends for PGP etc., like PGPSH and Private Idaho. Finally, people like Steve develop real front ends for the complex tech that puts the ability to use the previously elite tech in the hands of people who want the earlier complexity to disappear. I suspect that John-Doe will go through the normal new-product cycle -- discovery of bugs, slight improvements, and then better integration of user needs. Ultimately, as the product matures, I think that Steve's John Doe will be seen as a revolutionary development in privacy equal to (in a far less technical but more end-user way) PZ's original PGP. -- tallpaul "To understand the probable outcome of the Libertarian vision, see any cyberpunk B movie wherein thousands of diseased, desparate and starving families sit around on ratty old couches on the streets watching television while rich megalomaniacs appropriate their body parts for their personal physical immortality." R. U. Sirius _The Real Cyberpunk Fakebook_

1 0

Re: PGP in Eudora and other mail programs
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 11:54 1/25/96, Timothy C. May wrote: >(I understand from this list that Eudora for Windows is now doing this much >more automatically, that someone has a PGP-in-Eudora package. I don't think >it was from Qualcomm, but I could be wrong. As a Macintosh version user, >I'm hoping this comes to the Mac version as well.) There exist two Eudora/PGP packets. The MacPGP Kit and MacPGP Control. I'd use MacPGP Control. Just do a search for it. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Eureka! Fri Feb 13 '98
by eureka＠eureka.abc-web.com 17 Dec '03

17 Dec '03

Welcome to Friday's issue of Eureka! KARA'S ADULT PLAYGROUND With 15 live sex shows, 1,300 Hardcore XXX videos, 1,000s of Hardcore and Softcore Pix, the VaVoom monthly magazine, Kara's exclusive monthly centrefolds, adult games, erotic stories and even casino and sports betting, you won't be going out for weeks particularly now that you can get a FREE trial - your eyes will be popping out of your head! Hahaha! Kara's Playground ...... http://www.rjbtelcom.com/eplay.html James And Victoria's Erotic Site http://www.jamesandvictoria.com/ads/ads.cgi?advert=eureka Our free site has hundreds of photos, thousands of erotic stories, personal ads and several chat rooms. UPSKIRTS AND PANTYHOSE LINKS Quick, go to the bottom of this page and check out the links marked contributors pics. Here you will find a group of odd images sent in by people out on the internet. Pantyhose and underwear shots. Watch out for steamy wet patches in there! Upskirts .................. http://serve.com/teenet/idx2.htm EVERY MAN'S DREAM Sometimes we have to go all the way to Denmark to deliver great porn to you. This website is simple but boy does it deliver! Tons of great free pussy pix! Chicks before they had breast implants, blondes, brunettes. Two galleries. Go there right now. 200 hundred images of pure sweet pussy! Every Man's Dream ....... http://hjem.get2net.dk/dream/1.htm DIRTY DIANA My kind of dirty. A georgeous young black haired beauty who shows her tits and ass to all of us. Wait! She even has a few free video clips. Check out the hot tub pussy rubbing! Dirty Diana ..................... http://www.dirtydiana.com/ FREEPICS Cruise way down the page to the area called, Girls that put things way up their Cunts! Check out the aluminium baseball bat shoved up this girls pussy. I guess strikes one your in! Freepics ............. http://38.15.25.227/freepics/main.htm READ THIS!! WIN $25,000 and a Fantasy Date - Click Here Now! $25,000! ---> http://208.195.150.31/us/us_main.cgi/us_5267/A HOORAY! THE ADULT SEARCH ENGINE Now you can search for the sex sites you are looking for and fast! This new search engine is setting the standard others will follow. It offers pop-up search and detailed listings! Hooray! -----------------> http://eureka.abc-web.com/hooray/ FREE STREAMING VIDEO Please note that most of these feeds require a Netscape bro- wser in order to successfully view them. Unfortunately Micr- osoft's browser does not have all the features of Netscape's yet. However, many of the feeds use the RealPlayer and will work in most browsers. If you do not have Netscape and want a free copy click here --> http://www.netscape.com/download/ 30 RealVid ---> http://www.sexhost.net/rabbit/video-111.html CHAT WITH OTHER READERS Hey, if you haven't checked out the Eureka! Chat sites yet, you're missing out on some great stuff. Every day you'll find hundreds of other readers just like you looking to chat have fun and maybe a little 'cyber'. We know you'll love it! Adult/Sex Chat -----------------> http://137.39.63.229/chat/ General/Fun Chat -------> http://137.39.63.229/chat/funchat/ HOT LIVE PHONE SEX TO MAKE YOU CUM! LD Call only! - Live Hot Girls!!!!----------->1-664-410-3912 LIVE: 1-on-1, 2-on-1, Group, Dateline-------->1-800-644-8779 FREE: Live 1-on-1 (international call only)--->011-678-77416 NEW! CENTERFOLD PIC OF THE DAY Exclusive! We proudly present unpublished Pictures of your favorite Centerfolds. Featured This Week: Dec 80-PMOY Terri Welles, Dec 89-Petra Verkaik, Sept 93-Carrie Westcott, Kerri Kendall, Rebecca Ferratti, Lydia Schone and many more too! ---------------------------> http://www.gatefold.com/eureka/ AMATEUR SITE OF THE DAY Trina: She bills herself as "America's Favorite Flasher", very bold words which she backs up with a bevy of nasty pictures. She originally wanted to keep her identity secret so she used to wear a mask, but now we can all find out who the real beauty is behind the mask. Visit her site and decide for yourself if the title fits! ---------------------------> http://amateurindex.com/eureka/ EROTIC STORY SITE OF THE DAY Amateur Women Stories: AmateurWomen.com brings you totally hot true sex stories and real pics of hot amatuer models. See and read what these hot honeys do in private! .......... ............................... http://www.amateurwomen.com/ DAILY CARTOON ----------> http://www.erosinorbit.com/eureka/ ADULT STAR PIC OF THE DAY Woah, our Adult Star pics are getting hotter and hotter, so make sure you stop by and check out today's - definitely not to be missed! --------> http://www.xxxadultstars.com/eureka/ OTHER EUREKAS! GAY EUREKA! ----------> http://eureka.abc-web.com/gayeureka/ DEUTSCH ------> http://eureka.abc-web.com/eureka/deutsch.htm ESPAÑOL ------> http://eureka.abc-web.com/eureka/espanol.htm FRANÇAIS ----> http://eureka.abc-web.com/eureka/francais.htm ITALIANO ----> http://eureka.abc-web.com/eureka/italiano.htm PORTUGUESE > http://eureka.abc-web.com/eureka/portuguese.htm TODAY'S FREE PIX Pic 1 --------------------------> http://137.39.63.229/?130 Pic 2 --------------------------> http://137.39.63.229/?131 Pic 3 --------------------------> http://137.39.63.229/?132 Pic 4 --------------------------> http://137.39.63.229/?133 Pic 5 --------------------------> http://137.39.63.229/?134 Pic 6 --------------------------> http://137.39.63.229/?135 Pic 7 --------------------------> http://137.39.63.229/?136 Pic 8 --------------------------> http://137.39.63.229/?137 Pic 9 --------------------------> http://137.39.63.229/?138 Pic 10 --------------------------> http://137.39.63.229/?139 ============================================================ TO UNSUBSCRIBE FROM THIS NEWSLETTER, USE THE REPLY FUNCTION IN YOUR EMAIL PROGRAM, AND SEND THIS EMAIL RIGHT BACK TO US. ============================================================

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

I'm in El Paso Texas... so close to the border I can see Old Mex outside my window as I write this.. I'm over there nearly every day for lunch ( I actually walk there from my house it's so close) If I write a crypto program on my laptop over there and ftp it to a web page I have on a server outside the US will I have avoided the foolish export regs?? Does anyone know of someone trying this before??

2 1

Re: TOP_tap
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:55 PM 1/25/96 -0500, Rich Salz wrote: >Up until recently (18-30 months ago) NSA employees were only allowed >to identify themselves as employees of DoD. It was common knowledge, >that unspecific references to Fort Meade meant NSA; and if you saw >a P.O. from Procurement Office, Fort Meade, it meant the NSA was buying >it. Back in the dark ages (I think early 1980s), I attended a Symposium on Operating System Princples at Asilomar, California. My luck-of-the-draw room mate was wearing a badge which proclaimed that he was from NSA, Fort Mead, MD. A story of California hippy meets US-DOD. Bill

4 4

Re: Trust
by rdew＠el.nec.com 17 Dec '03

17 Dec '03

James, That one is easy. NSA does not get all the recovery key info from stuff developed in Australia. On Fri, 13 Feb 1998 James Morris <jmorris(a)intercode.com.au> wrote: > > I'm just wondering if anyone else finds it particularly odd that while > Australia is prepared to commit SAS troops, medical and intelligence > personnel to a possible strike against Iraq, the US government still > doesn't seem to trust us enough to use US developed cryptography > products with adequate security. > > - James. > Bob De Witt, rdew(a)el.nec.com Opinions expressed are my own, and in no way relate to those of my employer, or anyone else. -rdew

1 0

Re: "This post is G-Rated"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:58 PM 1/25/96, Bill Frantz wrote: >goal. The big problem is how are the labels attached to the programs. I >agree with Tim that it is probably imposible for individual Usenet >postings. However is should be possible for TV programs, and whole >newsgroups. Coincidentally, after writing my post this morning, I saw a report on CNN or CNBC about how broadcasters, networks, and producers are strongly opposed to the mandatory V-chip. Not news, but some of there reasons were: not enough time. The movie business produces about 600 hours of product per year, and the ~weeks it takes for the MPAA to view the final product and rate it (and then negotiate with the director about cutting out scenes to make an R-rated film into a PG, etc.) is marginally tolerable. Such is not the case with television, with many shows in a final version only hours before broadcast (and obviously some with even less or no advance time available). And remember that the MPAA rating is most definitely NOT a "self-rating." I see self-ratings of Usenet and mailing list posts as possible, just nearly worthless. And the reall contoversial stuff, this kind of goddamned fucking shit, will not get screened out. After all, I voluntarily rated this thread "G," and look what got through! (And it's only the tit of the iceberg, so to speak.) A meaningful "parental filter" cannot be done on-the-fly with self-ratings. Some minor steps can be taken, but not all worth the expense and hassle of a mandatory system. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

CAs and Digital Timestamping
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: sci.crypt, sci.crypt.research, cypherpunks ## Date: 01/25/96 10:08 am ## Subject: CAs and Digital Timestamping ] At the RSA conference last week, it occurred to me that there's a really neat application for digital timestamps (as done by Surety). Whenever a CA (Certification Authority) issues a public key certificate, it should also digitally timestamp it. This provides a relatively clean way to recover from top-level CA key compromises. First of all, let's talk about hash trees. A hash tree (I think the idea was originated by Merkle, but I could be wrong) is a binary tree. Each node in the tree eventually winds up with a hash value associated with it. The bottom nodes on the tree are hashes of individual messages. The other nodes are made up of the hash of all their children. This looks like this: (pardon the ASCII art) : H_0 = hash(H_1,H_2) : / \ : H_1 = hash(H_3, H_4) H_2 = hash(H_5,0) : / \ / \ : H_3 = hash(M_0) H_4 = hash(M_1) H_5= hash(M_2) 0 : : The neat thing about this is that, if I know H_0, then when someone wants to verify that M_0 appears in the hash, they only have to tell me H_4 and H_2, and the position of M_0 in the tree. I can then find H_3 = hash(M_0), H_1 = hash(H_3,H_4), and verify that the final H_0 = hash(H_1, H_2) gives the right output value. (Compare this with a hashing chain, and you can see that, for large trees, there's a big advantage here. The number of values needed to authenticate a given message in this tree is log_2(number of messages in the tree), while the number of values to verify a chain is is the whole number of messages in the chain. In the digital timestamping service offered by Surety, they use hash trees of this kind, because this allows efficient verification of a digital timestamp. The idea behind this is that a message is hashed into the hash tree, and that the final value of the hash tree each day or week is widely published, including in the New York Times. So long as it's not feasible to go back and change that value, and it's not possible to find collisions for the hash function, any hash value that appears in that tree must have been presented to the timestamping people at some point before that tree's final hash was calculated. Here's how we use this in having a CA sign certificates. CA Signs a Key: 1. At the beginning of the day, the CA generates a random value, R_0, and has it digitally timestamped. The resulting timestamp is used as one of the entries in today's hash tree. (If the CA is their own digital timestamp service, then they'll have to use the previous day's ending value, which is reasonable enough. They'll also have to work a lot harder to publish this value each day or week.) 2. For each certificate to be generated: a. The CA verifies the information in Certificate_u, then signs it with SK_{CA}. Certificate_u contains some indication of the time and date. b. The CA hashes Certificate_u into its daily hash tree. c. The CA sends Certificate_u to user u. 3. At the end of the day, the CA publishes its own final hash tree value, and gets this value digitally timestamped. (This amounts to having the CA act as its own "node." for the timestamping service.) Now, imagine that the CA's key has been compromised. (We have to assume that the CA's daily operations were OK--if not, there doesn't seem to be a clean way to recover cleanly.) The person who has the CA's key can issue false certificates. After a while, one of these false certificates are noticed. How do we recover? We use the hash trees and the digital timestamps which we've made in the past to verify each certificate presented for recertification. The digital timestamps allow us to immediately verify that this certificate was issued by this CA at this time. And we can be certain that this hash tree is correct because it's been digitally timestamped. What this does, essentially, is to allow us to quickly recover from key compromises. We still have problems if someone can take over the operations of our CA for a few days or weeks, though in that case, we probably know the likely dates. No compromise at the CA can put a different date's timestamp on a certificate. Now, I should note that I think Merkle talks about using hash trees to do public key certificates, in his thesis, and the idea may be patented. (It's been a couple of years since I looked at his thesis, so this is a little hazy.) However, we're not using them here to provide certificates--we're using them to authenticate the certificates in the event of a catastrophic key compromise. I don't think Merkle talked about this, but I could be mistaken. (At any rate, I've never seen any mention of it since then, though it's an obviously useful idea.) If the tree structure is patented, then we could still do this by using chains or some other structure. Does anyone know if this basic idea has been proposed before? I am pretty sure I haven't seen it, but it seems pretty obvious now that I think about it. We could even recover using this method from a break of the hash function supported (so long as the timestamps are done with multiple hash functions, and at least one isn't broken), or the public key algorithm used. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQfn70Hx57Ag8goBAQETUQQA3S7k8rrYDud5N3uVdUqSVHC3VH+Tpmuu wcRisf8PrYX/I9Q4vBTN7SS0H30Xl1bRTQyS1mQP+CuyBlESi1qn0OMKbgAYPndd 1qYOvrX/29fMbhrO7VQjAcSAHpCZOvoVfsq0fWwv4zzUIhJBZNFnMxdSm4eNrmEv U3/oo5CiM2o= =7TIl -----END PGP SIGNATURE-----

1 0