- cypherpunks-legacy - lists.cpunks.org

Need help with this scenario
by Anonymous User 17 Dec '03

17 Dec '03

How can the following be thwarted? If I was a bad guy, this seems to be the perfect way of communication. Even if I was not a bad guy, I just wanted complete and total privacy.... Let's say I have a digital cellular phone. I also have Anonymous Remailers, PGP, and over 100 BBS numbers (structured for which day and which hour each would be used) so that I can contact and talk to my "Friend." Please tell me how the LEA's can find me and understand the transactions between us? If I have several encryption programs, can I 'layer' each document [I PGP the file, the I DES the PGP file, then IDEA for the final layer. Does the NSA have to crack it one layer at a time, or can they bombard it, crack the layers in whatever order the supercomputer finds? If I am missing something, please let me know what I have missed.

1 0

RE: (fwd) \"Will You Be a Terrorist?\" ( Moi? )
by Pat Farrell 17 Dec '03

17 Dec '03

In message Sat, 17 Sep 1994 17:41:26 -0700, blancw(a){pylon|microsoft}.com writes: > . Violation > It is so telling, that legal documents on crime will always > state that violations are of "section 351, 844 (f) or (i), > 1114, 1116, 1203, 1361, 1363, 1751, 2280, 2281, 2331, or > 2339", or a violation of "this or any other Federal criminal > law". This is the usual obfuscation that your congresscritters prefer. It is interesting to compare that with the approach used when the Feds are serious. I just received a DoD clearance after filling in my life's history, fingerprints, financial report, etc., waiting for the folks to check out if I lied, etc. Before it became active, I was handed a stack of papers with all the applicable codes and sections, and told to read them. They had the usual things that you'd expect, the penalty for treason is death or life in jail, $30,000 fine for this or that minor crime, warnings about disclosing "codebooks and ciphers", etc. Then they hand you another form that says you read the stack. There is no way that I can claim that I didn't know exposing classified information is bad. The crime bill that you and Tim quote looks to me to be just another place for selective enforcement. Pat ob crypto: none, or little, even if the phrases "codebook or cipher" was scattered throughout the stack of chapters and verses. Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Re: terrorist FORTRESS SLEUTH remailers & FORTRESS lists
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 5:57 PM 9/17/94 -0700, Eric Hughes wrote: >I would prefer to deal with this situation when it appears likely to >happen and concentrate on achievable results now. Focusing on the >harder problems of greater repression will prevent useful progress >from being made. I agree with Eric. I was raised by a chronic societal pessimist, one of the last words of whom that I remember was "I have seen the Golden Age of America and it's over". It annoys me just a little when, looking backwards, people trip over a paradigm shift. It's even worse when they don't know they've tripped. It's like yelling "theatre" in a crowded fire. Or something. Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Re: privacy in Unix environment
by Pierre Uszynski 17 Dec '03

17 Dec '03

> From: chen(a)intuit.com (Mark Chen) > > > I'm looking for some kind of utility that will allow script files > > to be run, to spawn off processes, but will wipe out environment > > and "ps" info from being read. i.e. imagine that the commands > > being called must shield their arguments and environment from [ps]. > > Perl might be a good alternative. You get to perform fairly > high-level functions without spawning additional shells. Perl lets you manipulate files and directories, and perform functions like 'sort' and all the pattern matching you would expect (and more) without leaving the language. It also provides the hooks to change the apparent command name when you run an external command (ps will see that name). But Perl does not let you mask the arguments of such a command, at least not that I know of. I'd say, for whatever you get to write, don't pass arguments on the command line, but in files or through pipes, and for what you can't control, work with meaningless temporary file names: arg1, arg2, arg3... Before, and after you are done, change the file names to the real thing using Perl scripts. As for command line switches... I have no idea. Pierre. pierre(a)shell.portal.com

1 0

Re: (fwd) "Will You Be a Terrorist?"
by rparratt＠london.micrognosis.com 17 Dec '03

17 Dec '03

cactus(a)bb.com wrote: > In any case, perhaps a way around this can be found: what we may > need is "stealth remailers," software that will behave as a remailer > through non-obvious "security holes" with correct cooperation from > software the original user runs. > > For example, hack sendmail so that it never wants to reverse-lookup DNS > and given a particular set of commands (saying "EHDR" for 'enhanced > headers') will operate as an anonymous remailer. Such sendmail-hackage > could be distributed with other changes that give enhanced security > (for example, that turn off EXPN and VRFY) so that people could claim > that they had no idea that they were operating an anonymous remailer. When Sendmail gets a mail to an unknown user (e.g. nobody(a)grunt.com) it will reject the mail. The relaying mailer is then supposed to bounce the mail back to the author. So if we forge the From: line, the mail should bounce back to the bogus target. If I forge a mail as follows: From: cypherpunks(a)toad.com To: nobody_at_all(a)bb.com ------blah blah blah----- It should bounce and thus appear on the cypherpunks list, without a sender. Of course, it will have paths, etc, which give the game away. What is needed to give 'Stealth' remailing is a mailer that when seeing a header such as 'X-Bounce-Strip: 1' removes headers and sends body text only back. This is a useful feature to reduce network bandwidth when bouncing mail, and should be included in all sendmails (grin). -- Richard Parratt

1 0

art encryption...
by John Young 17 Dec '03

17 Dec '03

Responding to msg by lile(a)art.net (Lile Elam) on Mon, 19 Sep 0:11 AM >So, I have been thinking that a way an artist can >insure a viewer that the art they are viewing is really >that of the artist, the artist can *sign* their art >with their private key and others can check it with >their public key. Now, the art would be factered into >the key generated that others would check with the >public key. > >So, a image file (gif, jpeg, tiff whatever) would be >run through a encryption coding that would generate a >signage based on the artist's image and their private >key. The image would remain unchanged. Then viewers >could run the same encyription coding on the image and >apply the artist's public key to see if it really *is* >their work.... As a parallel to your inquiry I offer: Thanks to help from this list my firm uses PGP to encrypt, sign and verify CAD architectural documents exchanged with consultants and clients. We also conceal ID in the documents by a simple steganographic method using combined PGP and CAD posted here a few weeks back, which is not revealed to the recipients, as a check on authorized use and distribution. Any suggested improvements would be welcome. John

1 0

Profiling (fwd)
by Stanton McCandlish 17 Dec '03

17 Dec '03

At Lee's request, I'm forwarding this note to several relevant forums. - mech(a)eff.org Forwarded message: Date: Thu, 15 Sep 1994 06:15:37 -0600 From: ap524(a)Freenet.HSC.Colorado.EDU (Lee Knoper) Subject: Profiling Reply-To: 6564559(a)MCIMail.COM [...] Here's a situation in which "profiling" by a government agency is already causing a problem. Recall that recently on <eff-activists) there was brief discussion regarding the use of "profiles" in advertising efforts, in the context of interactive TV. Some participants favored what was perceived as a probable improvement in the efficiency of such advertising. Others saw distinct dangers, especially if profiles were marketed or traded among private sector entities, or if government became more involved. This particular situation is quite disturbing because it involves a state tax agency, and as everyone can appreciate, here is an example of where one is effectively presumed guilty until proven innocent, and is subject to asset seizure pending resolution as well as possible forfeiture. A correspondent is trying to defend himself against some aggressive actions by the AZ Department of Revenue. He has discovered that AZ Revised Statutes section 42-117 permits the DoR, at its discretion, to assess a personal income tax which is based on a "statistically valid sampling method." Although this option is seldom used, it is being applied in his case due to partial loss of records during a move. In other words, your AZ tax can be based on your profile, irrespective of your income or expenses. Worse, AZ DoR cites ARS 42-113 through -115 as requiring one to keep records for four years after filing. Yet it asserts that there is no statute of limitations for audits - it can audit a filing at any time, and can presumably apply the statistical sampling method retroactively if it so desires. Obviously, this situation goes well beyond profiling to determine who to audit. These and other, equally onerous provisions comprise a pit of despair. Ironically, DoR asserts that "all laws are presumed to be constitutional." The U.S. military is also involved in profiling, which is probably not much of a surprise because the military is often used as a test bed for social engineering experiments anyway. New ID is being issued to retired and current members of the military and their dependents, and to commissioned officers in the U.S. Public Health Service. The new ID is replete with a digitized photo, two bar codes and what amounts to a kind of PIN linked to the SSAN. It is intended to be machine-readable and linked to local and central databases. It's also a bit of an eye-opener to note that it is expected to replace ID used for -other- than official business as well, like club cards and health care access cards. If it's not in your profile or if the money is not in your account, you can't do_it/have_it. Moreover, you'll probably get automatically reported for followup investigation to determine willfulness and intent. Does unrestrained profiling start to look a little ugly by now? It ought to. If there's money to be made, or power to be wielded, neither Constitutional law nor existing statutory law holds much sway. Lee_K

1 0

EMBARRASSED, I?
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks (did I ever tell you, it's pronounced "spunks"?), Blanc Webber made me feel like JFK being sung to by Norma Jean. The part I didn't understand, though, was when she wrote: May this email totally embarrass you. Hell, Blanc, why should it embarrass me? You're the one with the dirty picture. It's a candle? Sorry, my mistake. (But it looks just like my... oh, never mind.) Thanks Blanc, S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ rom owner-cypherpunks Mon Sep 19 13:30:56 1994 Return-Path: <owner-cypherpunks> Received: by toad.com id AA02563; Mon, 19 Sep 94 13:30:56 PDT Received: from mail.crl.com by toad.com id AA02557; Mon, 19 Sep 94 13:30:50 PDT Received: from crl2.crl.com by mail.crl.com with SMTP id AA23474 (5.65c/IDA-1.5 for <cypherpunks(a)toad.com>); Mon, 19 Sep 1994 13:29:20 -0700 Received: by crl2.crl.com id AA12797 (5.65c/IDA-1.5 for Cypherpunks <cypherpunks(a)toad.com>); Mon, 19 Sep 1994 13:29:19 -0700 Date: Mon, 19 Sep 1994 13:29:01 -0700 (PDT) From: Sandy Sandfort <sandfort(a)crl.com> Subject: THE BEST MINDS IN CYBERSPACE To: Cypherpunks <cypherpunks(a)toad.com> Message-Id: <Pine.3.87.9409191301.A12756-0100000(a)crl2.crl.com> Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-cypherpunks(a)toad.com Precedence: bulk ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, I'm always telling people how smart the Cypherpunks are. Now I have proof. Paul Robichaux wrote: I suggest we all kick in $10 or so and hire Alison Armitage to jump out of a cake or something. Seems like the least we could do. It's like he read my mind--especially the "or something" part. Thanks Paul. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: On the crime bill and remailers
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 1:22 PM 9/18/94 -0700, Anonymous wrote: >Current drafts of the crime bill include a scienter requirement. >You are liable only if you know or intend for your remailer to be >used by a terrorist. > >This is SOLONg's first post to this list. Hey. I get it. Solon. Lawyer. Nym. Cool. Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

Re: On the crime bill and remailers
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 5:38 PM 9/19/94 -0400, Black Unicorn wrote: >Some lawyer, can't do stat. intrepretation to save his/her life. > >As I pointed out before, the requirement for INVESTIGATION is reasonably >appearing to have intent. The statuatory offense itself includes NO >REFERENCE to intent. > >The scienter requirement here is "gloss on the surface" of the kind >intended to win votes from on the fencers. Ah. I see. Then this stuff on my face is egg, no? Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0