- cypherpunks-legacy - lists.cpunks.org

REMAIL: Changes to chaos and bsu-cs remailers
by Chael Hall 17 Dec '03

17 Dec '03

Today I installed an updated version of the anonymous remailer on the following remailers: nowhere(a)bsu-cs.bsu.edu remailer(a)chaos.bsu.edu Recent changes: "Refuse" addresses now apply to From: lines as well as To: lines When sending from an address that is refused, you will receive a bounce message (only from chaos remailer) stating that remailer access is denied. When sending to an address that is refused, you will receive a bounce message (only from chaos remailer) stating that remailer recipient is illegal. When you forget the recipient address, you will receive a bounce message (only from chaos remailer) stating that a recipient is required. Please note that all bounces will only occur when using the chaos remailer. -- Chael Hall, nowhere(a)chaos.bsu.edu

1 0

Re: cypherpunks meeting in Mt. View last weekend.
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 18:52 2/15/94 -0500, wcs(a)anchor.ho.att.com (bill.stewart(a)pleasantonca.ncr.com +1-510 wrote: >Hi, Strick, ... > >Chip Rosenthal talked about >Habitat, an early Commodore-64-client+central-world-server system That was "Chip Morningstar", not "Chip Rosenthal".

1 0

Another clipper editorial
by Jonathan Corbet 17 Dec '03

17 Dec '03

The following appeared as an unsigned editorial in the 2/14 Christian Science Monitor. It lacks the fire of Safire's piece, but it's nice to see anyway. CLIPPING PRIVACY With the rise of electronic mail, public data networks, and cordless and cellular phones has come a rise in devices to encode data to protect the users' privacy. But law enforcement officials worry that these advances will undercut their ability to secretly gather evidence through wiretaps and other surveillance methods. To respond to law enforcement's need, the Clinton administration reportedly is seeking a bill that would require phone and cable companies to use software designed to allow law enforcement agencies to monitor phone and data transmissions. Earlier this month, the administration decided to push federal agencies to include so-called Clipper Chips in computers and phones they use. If that extends to vendors and contractors, the chip may become a de facto industry standard. The chips were designed in conjunction with the National Security Agency to permit unscrambling of coded data transmissions. These moves represent potential dangers to privacy; they take on added urgency with the imminent marriage of computers, phones, and cable services in ways that reduce the diversity of people's means of communication even as they use those means for more activities. No one doubts the need for effective law enforcement. The government, however, should not be in the business of asking manufacturers to build secret backdoors into their equipment, particularly when government holds the keys. The proposals also raise questions as to how appealing United States technology exports will be overseas if such backdoor access is built in. Congress should take a hard look at any bill that tries to expand the government's ability to peer through the electronic blinds, no matter how well-meaning the motive.

1 0

Re: Wide Spread use of PGP
by mdbomber＠w6yx.stanford.edu 17 Dec '03

17 Dec '03

>I find Bob Cain's comments that PGP should not be used on a netcom account >disturbing. I think the priority that should be set is to get people using >PGP, "in the habit" and then make sure they are using it on a local PC or >Mac. > >Some people, believe it or not, might only have acess to a multi-user >systems. These people should not be denied acess to PGP. This is what I do. I connect to the net through SLIP and then use Eudora to retrieve my mail from a DECstation. PGP is secure that way. However, the password to attach to the POP server goes out in plaintext, and was undoubtedly compromised in the packet-sniffing incident we heard so much about. I have been trying to look into alternatives to plaintext passords flying around, but have only confused myself. What is available? Internet: mdbomber(a)w6yx.stanford.edu Matt Bartley GPS: 33 49' xx'' 117 48' xx'' (xx due to SA :-)

3 2

Need a challenge?
by paul＠hawksbill.sprintmrn.com 17 Dec '03

17 Dec '03

I feel like a real slug posting this here, but we have several positions available for network engineers with heavy multiprotocol router background. If you're thick-skinned and competent, willing to relocate and don't mind forging ahead in a new digital forntier, let me know. The job is in the Washington DC area, the pay is substantial. E-mail to: _______________________________________________________________________________ Paul Ferguson US Sprint Enterprise Internet Engineering tel: 703.904.2437 Herndon, Virginia USA internet: paul(a)hawk.sprintmrn.com

2 1

Re: Wide Spread use of PGP
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

I agree with those who disagree with Bob Cain about use of PGP on insecure machines (i.e. machines you yourself don't control.) Yes, it's less secure than using it on a machine you control yourself. But it still gives you *some* security - for instance, if your correspondent is in some country with limited freedom of speech, such as China or Canada, your crossborder conversations are protected. Sure, the NSA will tap them, but as long as they're not tapping netcom's internal networks, and you're dialing in rather than telnetting in from somewhere else (sending your passphrase across the entire internet for the FBI\\\BadGuys to wiretap), you've gained some security. Of course you should use a personal machine with good security on it to discuss overthrowing your current government or trading in politically incorrect substances, like money. But even so, it increases the use and acceptability of encryption, and makes you more accessible for people in other not-sufficiently-free countries. [Note - I'm just picking on netcom because they're a popular service used by hundreds of subscribers. I'm not aware that they're being wiretapped, and I suspect that the legal implications of trying to do so would be interesting. Tapping their Internet connection would be legally easier than tapping their phones, though.] [Blatant Quasi-Commercial Mention: Some 10baseT hub vendors, starting with the AT&T SmartHub but followed by others as well, provide a no-eavesdropping feature, which prevents packets from being sent to incorrect destinations. Unlike bridges and routers, which limit traffic, the SmartHub replaces the data field with 10101010...., which it can do faster and less expensively since there isn't the complication of buffering, etc. One use in a dialup networking environment would be to put the herd of terminal servers and cpus on smart hubs, which limits the damage that can be done if some user breaks a system and starts snooping the net, since he'll only see packets for the machine he's on and not the whole broadcast. Obviously, in a larger environment, routers, etherswitches, etc. can handle more traffic, but the different technologies can be used together.] Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

re: rEaL wOrLd EnCrYpTiOn
by Mark Hittinger 17 Dec '03

17 Dec '03

> Sandy writes: >I would like to start a new thread. I want to know what the >people on this list intend to do with cryptography in the "real >world." >... >My interest is more than academic. I am one of the Cypherpunks >involved in creating a digital bank. Sandy - In the real world there are already secret banks. There are already forms of untraceable cash and forms of completely fungible money. These techniques are very ancient and time honored. They are well understood. Many of them have stood the test of time and have not been compromised by various incarnations of police states. Given the existence of efficient, accessible, secret, and widely accepted monetary exchange I can't really see the need for a digital bank from the privacy side. I can't really see anyone who uses the current techniques being interested in a new experimental form unless they are techno-junkies. Nevertheless, please continue. Some of us are techno-junkies. It is already well known to privacy fanatics that you should not use credit cards, debit cards, checks, atm cards, or other forms of electronic money. All transactions are logged and are easily analyzed. Astute people cash their pay check at the employer's bank and pay cash for everything. Admittedly, this is somewhat paranoid, but on the other hand it is fun to defeat the monolithic database builders who want to make money off of selling information that belongs to you. Cypherpunks must concentrate on solving problems that are true problems now. Do not spend time creating a variant of an existing/workable/fun solution. Email privacy was a true problem. Clear text on your pc's hard drive was a true problem. Right now there is the well known problem of ethernet sniffers and the trivial security breaches that can occur. A telnet/lat traffic encrypter is needed badly by the Sun/Dec/HP world. Novell needs something badly as well. Cellular phones desperately need something. The masses just have NO IDEA how badly cellular needs something! Fax machines need a variant of PGP. Pagers probably need it too. I think the larger issue that cypherpunks need to blue sky about is wether they will be content with a role as grey-area political criminals underneath the boot of an ever growing police state. Can crypto be more than a defensive weapon? What would people be defending against? Crypto can do some things but it won't be the total solution. In the end we need to strengthen the rights of the little guy and devise ways to dilute any new state powers that are created by technology. Crypto is just one compartment on our batman utility belt. People always argue that criminals would use these tools. I'm certain of it. Strengthening the state's hand to fight criminals always screws the little guy. The criminals all go to work for the state when its powerful enough! We've seen this over and over. --------- I'd like a 250 Mhz 128 bit hybrid processor with 64 meg of 8 way interleaved memory, a 10 megabyte per second i/o channel, two 3 gig hard disks, two dat drives with compression, and a large diet coke. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAiz4FWMAAAEEALBCb7HZS7V4gbsp9yJ7Yty49jQ9wcgRhkLjNNgdyJbrJZCq 5/sv4Ljy/4AhVhjlJyZS8L3owS8l0ClZVzWw4/kO3KN7MPz4YPPR7+qIlPQVM0yv gWpJ43EZZ8b8cvAkE9HATCKWktY2ReRSX5DLnScDH/n5jivw+MD/UO8fURCVAAUR tCBNYXJrIEhpdHRpbmdlciA8YnVnc0BuZXRzeXMuY29tPg== =VbKi -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: cypherpunks meeting in Mt. View last weekend.
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> >Chip Rosenthal talked about > >Habitat, an early Commodore-64-client+central-world-server system > That was "Chip Morningstar", not "Chip Rosenthal". Sigh. I knew that, but I'd been drinking decaf all morning :-) Thanks; Bill

1 0

Big Bother Inside Stickers at cpsr.org
by Dave Banisar 17 Dec '03

17 Dec '03

The Big Brother Inside Graphic files are now available at the CPSR Internet Archive - ftp/gopher cpsr.org /cpsr/privacy/crypto/clipper big_brother_inside_sticker.ps (postscript-change the size to fit your project) big_brother_inside_logo.gif (Color GIF - good startup/background screen) big_brother_inside_picts_info.txt (Info on the files) Have fun. Dave

2 1

ITAR vs. Diffie-Hellman Key Exchange?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

In the discussions about people sniffing the net and the need for encrypted telnets, one problem that has come up is the ITAR hassles that make exporting Kerberos politically incorrect, though John Gilmore has gotten them to admit that the Kerberos bones is none of their businesss :-) However, is Diffie-Hellman exportable? After all, it's not crypto, it's *just* key exchange, and people can plug in their own triple-DES from the usual sources. It looks to me like it's probably legal, though if you were to then transmit the password by XORing with the login key or some such probably-unsafe behaviour it might not be. I had heard somebody say there would be an updated RSAREF version including Diffie-Hellman key exchange, though it's not in the package I just ftp'd from rsa.com. Is this correct, and is there a planned release date? Thanks; Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

5 4