- cypherpunks-legacy - lists.cpunks.org

Verification of Registration
by verify＠cnet.com 17 Dec '03

17 Dec '03

Your membership registration has been processed. To become a full member of c|net online, please return the text of this message (to verify(a)cnet.com) The following magic token in this message [cypherpunks::752400770] will be automatically processed to verify you. Please note: The number included in the token is *not* your password; the one to use on the site is the one you entered on the registration form. Please include the complete token appearing above, including the brackets. The best way to return it to us is to include this entire message in your reply. If you mailer does not allow you to do this, retype or cut and paste the magic token (including the square brackets) into a new message to verify(a)cnet.com. If you are having difficulty completing this process, please direct your questions to support(a)cnet.com. Once you are verified you will be able to take advantage of the full range of c|net online's services.

1 0

Mark Twain Bank (was: Anonymity: A Modest Proposal) (fwd)
by sameer 17 Dec '03

17 Dec '03

> pretty steep for someone wanting to spend $.10 on something.) My > understanding is that the _bank account_ is FDIC insured, but not > the ECash. I could be wrong -- their materials are extremely confusing > and hard to follow. My understanding is that the accounts are "WorldCurrency Access" accounts-- which appear to be Money Market funds, which can be denominated in one of 25 currencies. (Ecash-linked accounts must be denominated in dollars.) Being a money market fund, a positive return is -not- guaranteed, and it is not FDIC insured. It is an "investment" account, not a "savings" account. (That is my understanding, which could very well be flawed.) Does anyone understand their non-merchant pricing structure? It had me very confused. Also, what is the difference between a merchant and a non-merchant. I saw nothing on the pages describing that. Suppose Community ConneXion wanted to accept ecash. Could we get a non-merchant account? > > As one of my co-workers said today, "It will be interesting to sit > back and watch them take regulatory mortar fire." Indeed. > > I'm really hoping that they pull their act together -- I've already > sent in my account application -- but things look really grim at > the moment. There are certainly a lot of projects list members are > working on that would be greatly enhanced by functioning, popular > e-cash. I encourage everyone to give them lots of helpful feedback > so that they can turn this around. > > On another note, I'm hoping that some of you will also bite the > bullet, get accounts, and join me attempting to win valuable > prizes in Sameer's "Hack Digicash" promotion. I'd rather see one > of us find holes in this than see the whole thing melt into the > ground. > > This extremely unprofessional, bungled launch does, I admit, make > Mondex (with scads of beautiful marketing literature) look better all > the time, although based on some conversations on Sunday, it appears > that they may have _extremely serious_ architectural security problems. > We'll see how things play out. > > Later, > > Doug > > > With the release of digicash I hope that we can soon make this > >stuff for-pay and much of the spam problem will be fixed. (Not all of > >it, of course.) > > (I am rather hesitatnt to setup an account with Mark Twain > >though.. $2,500 min balance and not FDIC insured?) > > -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

3 2

Re: PA Remailer Concerns
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Lee Tien writes; > > What is the cite for [the PA anti-remailer] statute? > Pennsylvania Consolidated Statutes, Title 18, Sections 910 and 3926. It's available on the web at http://moose.erie.net/~italo/rssb655.html - - the Westlaw version of the enacted bill is at "1995 PA S.B. 655 (SN)". -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIxskH3YhjZY3fMNAQGkCgQArF13peddXG+zXThyf2uz7Syo7/sQpLtx 2f5UNaPE0VMZbk/rnAq2KbeBjqiOQ6waQ7awQXs1EFnBfAhIUONeI66fdX2OJY+0 X7Nw4hq06pWk/3HSl58Svd5EgZ1yjzylWn1tutAa5e3SPlKV5ABextzN2EnAB8Vd 8/cI687VeT0= =te/3 -----END PGP SIGNATURE-----

1 0

Re: [reformatted] how secure can privasoft be?
by Rich Salz 17 Dec '03

17 Dec '03

>their framework...it's the pluggable encryption that NSA has had such a hard >time with but seems to be in favor of now. What makes you say the NSA is in favor of pluggable crypto?

1 0

Re: FidoNet Remailer
by Jim.Cannell＠f21.n216.z1.fidonet.org 17 Dec '03

17 Dec '03

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -----BEGIN PGP SIGNED MESSAGE----- Thanks to all of you who have responded to my announcement of the FidoNet remailer. I appreciate the good words. So far, the remailer has handled everything that you have thrown at it. One remailed message bounced back to me because the FidoNet/internet gateway system could not find the addressed system. That one looks like a gateway problem. Please keep sending messages through it. Send grunged messages, improperly addressed messages -- anything you can think of to make it barf. I want it to be able to withstand the vicious attacks that I'm sure will come once the control phreaks in Fido find it exists. I will be gone the next two weeks, so the system may go down. Don't expect any response from me until then, either. I will answer any mail when I return. In the meantime, I'm off tomorrow morning to enjoy Vincent Cate's hospitality at the Anguilla cypherpunks meet. Jim - International SecureMail Host (ISMH) PGP key 1024/B7822B3D fingerprint = 0F F4 79 06 3B 33 99 D1 07 36 66 66 80 85 76 B3 Protect your right to privacy. Say no to GAK. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIxwyCWTIMO3gis9AQFFqgP/eODPSOVdx3yMHnTRqWzSNkGVFTxf66rs 9JahzuOrM8lleL+RDCAJXYL/bhPcYKwcOWcgMrri/WZjIBsf/uS1WtDO+v1cOnv5 p5doPIslL/8dZlUJGMeWblNeCj4recHwX+dZQxLyFAPbhDtpF9AzEmsF4Ch0Q8b8 N3y02QVHOr0= =WYIx -----END PGP SIGNATURE-----

1 0

FidoNet Remailer
by Jim.Cannell＠f21.n216.z1.fidonet.org 17 Dec '03

17 Dec '03

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -----BEGIN PGP SIGNED MESSAGE----- I have been a long time lurker on this list, as well as having a long time interest in crypto. Most of my activity in this area has been on FidoNet rather than the internet. Due to the control phreak nature of much of FidoNet, I've spent a lot of time and effort in an attempt to just simply route around the bastards. I created the SecureMail system, which is a network of FidoNet nodes that agree to route any and all traffic without monitoring or censorship. Within SecureMail, encrypted traffic is not only permitted, it is encouraged. Which brings me to the point of this message. I have written a anonymous remailer program for FidoNet. It is currently running on my FidoNet node in an alpha test mode. It has only been running a couple of weeks, and seems to be doing quite well. I have just added internet addressability to it. What this means is that now anonymous messages can be remailed between FidoNet and the internet. Having still another routing path should further decrease the traceability of these messages. I would like to ask the cypherpunks to help me test the remailer across the gateway. Please send many messages through this remailer from both the FidoNet and the internet side of the gateway. Try to break it. I want a good reliable piece of software, and if it can survive attempts by this group to break it, there will be a lot more confidence in it. Following are instructions for using the FidoNet remailer: - From FidoNet, send your message to Remail at 1:216/21. From the internet, send your message to: remail(a)f21.n216.z1.fidonet.org In all cases, the first text line of the message must contain a double colon. The second line contains the remail command, and the third line is blank. The actual text to be remailes starts on line 4. To send a message to Joe Sixpack at FidoNet address 1:102/903, enter: :: remail-to: Joe Sixpack @ 1:102/903. To send a message to an internet address, enter: :: remail-to: tcmay(a)got.net (Sorry, Tim -- couldn't resist using you as an example :-) To get a short help file, enter: :: help To post a message to the FidoNet SYSOP Echo, enter: :: remail-to: SYSOP I'll welcome discussions of this remailer on the list, or in private mail. Bug reports and/or comments are encouraged. I can be reached at Jim.Cannell(a)f21.n216.z1.fidonet.org BTW, I will be at the cypherpunks meeting in Anguilla next week. Hope to meet some of you there. Jim - International SecureMail Host (ISMH) PGP key 1024/B7822B3D fingerprint = 0F F4 79 06 3B 33 99 D1 07 36 66 66 80 85 76 B3 Protect your right to privacy. Say no to GAK. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIg6pSWTIMO3gis9AQEKLQP/TVodxgTJiik3KQK1C8QgSp/O3wzdxi+P eC2flE6qgtlmwh6X4vbBNTmj4bKAfGLgbJyvdcMAZCESYab1dxO8q1lwOAnayW8d qoSRhL+zT0KepmV5FXyLscq+SbzgxKoX3gkWgHlhrhHbmycr3rFGLKz6ZsoR/xmb WX16LX2JVFk= =vBaR -----END PGP SIGNATURE-----

1 0

Re: Netscape Logic Bomb detailed by IETF
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Perry E. Metzger writes: >anonymous-remailer(a)shell.portal.com writes: >> Clearly, someone has a vested interest which they are expending a >> great deal of effort to protect. My email to Netscape detailing their >> logic bomb has gone unanswered, and unacknowledged for ten days now. > >Maybe because you're an idiot and they don't feel that its necessary >to answer. What more need be said? I see that Perry is as charming as ever? Perry, I just don't think that it is wise to stick your head in the sand and ignore a severe flaw in your algorithm, while actively misrepresenting matters to those people who are not intimately familiar with the IETF. >Those of us who care run our postscript interpreters with all the >dangerous commands stripped out, Perry, I'll call you on that one, cause you simply can't do it. Postscript isn't like any other language around. Operator names have no special significance to the interpreter. You can't just "strip out" dangerous commands. They aren't "reserved" in the sense that operator names are in other languages, like COBOL or BASIC. In Postscript, operator names are simply keys into a LIFO dictionary. This makes Postscript different from other languages because you could redefine these names if you wanted to. Stripping something from a dictionary doesn't matter because, the search sequence is top down. If I rewrite an operator name, and put it at the top of the stack, there's not anything you can do. Gee's Perry, even if you haven't stripped something out, I can rewrite it. And the interpreter will find the rewritten version before the version that's in your machine. And before someone attacks me for an inelegant "style" these potentially confusing antics are routinely used under extraordinary circumstances. There's no malice involved at all, simply real-world operation. And this is why the Request-For-Comments from the IETF warns: "Postscript is an extensible language, and many, if not most, implementations of it provide their own extensions. This document does not deal with such extensions explicitly since they constitute an unknown factor ..." Is that clearer?? If you thought that you had "safety" cause you stripped your interpreter, then you're in trouble, cause that doesn't work. > but given that Netscape doesn't supply postscript interpreters, its not > really their fault or problem. Well, that line might work on those who don't know any better, but that's also why the Internet Engineering Task Force (IETF) tries to protect the public by suggesting that implementors like Netscape not pass the ball: "The execution of general-purpose PostScript interpreters entails serious security risks, and implementors are discouraged from simply sending PostScript email bodies to "off-the-shelf" interpreters." Netscape ignores this suggestion. I guess that Netscape simply knows more (or cares less??) than the entire collected wisdom of the International contributors who make up the IETF. Gee, there's lotsa wisdom over there at Netscape. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

3 2

Quebec Libre
by J. Kent Hastings 17 Dec '03

17 Dec '03

-- [ From: J. Kent Hastings * EMC.Ver #2.5.02 ] -- Cpunx, especially offshore banking "fonts of wisdom," A friend asks: > Concerning Quebec Libre, I would love to establish residence there before the > separation (not necessarily physical residence). Have these fonts of wisdom > on St. Louis and Anguilla banking anything on getting Quebec residency, mail > services, and bank accounts? Any plans if Quebec secedes? Kent -- "Put pages for your business on the World Wide Web, just $5 per month!" -- J. Kent Hastings -- zeus(a)pinsight.com -- http://www.pinsight.com/~zeus/

2 1

Re: Remailer-in-a-Box, Everyone a Remailer
by Jay Campbell 17 Dec '03

17 Dec '03

>Rather, a single physical machine site can and should be able to run many >remailers, out of user accounts. (Accounts on systems like Sameer's C2. Or >Hal's remailer running on Portal. Or maybe some of the Mixmaster clients.) This also brings up the idea of 'opportunistic remailers' again (somebody gimme a snazzy name for that) - a PC/Mac-based SMTPish server that isn't always online. Shell accounts are becoming a piece of history for most users; part-time dialup IP (ppp/slip) is the predominant connectivity layer. A user could run an opportunistic remailer, and compile a list of other opp remailers his server would poll in addition to the standard shell-based 'always up' remailers. Given a large enough list (ie, everyone on this list ran this app in the background) there should be plenty of opp remailers online and ready to relay at any given time to make this an effective model. -- Jay Campbell Regional Operations Manager -=-=-=-=-=-=- Sense Networking (Santa Cruz Node) edge(a)got.net MIT PGP KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Re: Netscape rewards are an insult
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > C. S. U. M. O. C. L. U. N. E. > WTF? I'm surprised you didn't get this. It's a simple phrasal substitution cipher, sort of like a license plate. Think of it as this: C SUMO CLU NE See Sumo Clue No (clever putting a foreign word there, eh? But not clever enough to throw us off! ) and realizing that sumo refers to sumo wrestling: See wrestling clue no and when you realize that a clue tells you about the reality of something: See wrestling reality no or rearranging: See wresting no reality or: See, wrestling has no reality! And you can see that it's a simple assertion that professional wrestling's not real. It's wrong of course. Think about when they pick someone up and throw them. If that happened to me it would hurt...don't you think? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0