- cypherpunks-legacy - lists.cpunks.org

Re: SCHEME for FULL-SPEC RETURN PATH
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Sorry, either I mixed it up with regular cypherpunks mail or didn't realize you were expecting a response. To summarize your method, messages going from the original sender to the recipient have headers like To: recipient X-Anon-Sender-Path: X-Anon-Reply-Path: where the X-A-*-P: headers have the form remaileruser+stuff@remailersite and "stuff" is similar-sorm stuff encrypted with a remailer's public key. When going from the sender to the recipient, remailers take their names off the X-A-S-P line, decrypt the stuff, and encrypt themselves onto the X-A-R-P line, which the recipient can use to reply. My two main problems with it are 1) It leaves the recipient's address visible the whole way. Not only is this a security risk, but the recipient may not have made it known, since the recipient may have set up some messy remailer-chain using different syntax to get replies. 2) The syntax may be symmetrical, but it's ugly :-) It would be cleaner to package it into the To: field if you can, though the user+stuff@somewhere format seems to be an Andrewism, and the Internet standard @somewhere.com:user@domain or user%foo(a)bar.com forms only carry machine names, not machine and user names. Because you're not using the standard mailer syntax, it means that you have to build a chain of only your flavor of remailers to get a reply to work, though I suppose almost any method has that problem. But you run the risk of a normal machine or smart-mailer along the way just seeing the To: recipient(a)machine.com and sending it directly instead of sending it to your remailer-user. Better to keep roughly your same syntax, except have the To: line be only the next hop, and the recipient's real address be hidden inside the X-A-S-P pile. That's also more symmetric, letting you take a reply from this sort of system and reply back to it again. Bill

1 0

Misc replies
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sandy Sandfort <uunet!crl.com!sandfort> writes: > Ever notice how few mail bombs we get from Trump or Gates? Maybe the > rich are rich because they've learned self-restraint. Bet you dollars to > donuts that LD doesn't have a pot to pee in or a window to throw it out. H. Ross Perot. ==== Xenon <qwerty(a)netcom.com> writes: > So tell my why I should censor > Larry 'cause I don't see why I should. It's a lost cause. He will simply > aquire other accounts, or telnet to port 25 of a remailer and fake his > address, but this time with greater ambition to do damage. I second Hal's suggestion to route Detweiler's traffic through Xenon's remailer. (Xenon - the point isn't to keep Detweiler off the net. We all know that's impossible. The point is to keep Detweiler from getting remailers shut down by abusing them. That's why this is particularly unlike censorship; Detweiler's goal is to keep all people from using remailers.) -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLWHDgH3YhjZY3fMNAQEIowQApVUiB4wdXYhTmj8ZuLOSiwTy94+uOUim mZCfbKca40cXkKzdUlX36deIeJ/NLFQsVJ+KVIUqn19IsfGcIQZnZFPJgVnrovji VYTChpGwVQ9LCHjc2ppmmBSC83145+AyKSKXuFt+auLHWLtWrPZGvohweyDv51HY argqt4+Czu0= =1FP6 -----END PGP SIGNATURE----- -- Greg Broiles ".. has bizarre Cyberanarchist theories relating greg(a)goldenbear.com to human punishment." -- L. Detweiler

1 0

Re: Pynchon as roadkill on the digital superhighway
by mcb＠net.bio.net 17 Dec '03

17 Dec '03

Tim May writes: > [...] > It seems that in the early morning hours of January 28, 1990, someone > accessed the Department of Motor Vehicles computer files and got a > printout of the elusive man's home address, personal characteristics, > etc. A copy of this was forwarded to someone who studies Pynchon, and > thence to me, for reasons I won't go into right now. > > The implications for Cypherpunks, privacy, and Pynchon as roadkill on > the digital highway are clear. Just looked at the date on this again, and realized it is not as surprising as it sounds -- until 1991 CA DMV records were open to anyone who made a request. No need to break in and look at secret files, all you had to do was go to the DMV and request them. This was changed, I believe, mostly as a response to a case involving a TV actress in LA who was stalked by an obsessed fan, who got her address from the DMV and eventually ambushed her there and murdered her. And as cool an author as Pynchon is, I suspect he is an amateur at the privacy business; anyone who would put their true residence address on their driver's license is obviously not paranoid enough to be serious about not being found. (Don't know if it has been mentioned here, but Simson Garfinkle has an article in this month's WIRED titled "Nobody Fucks With the DMV", about the privacy implications of the amassing of personal data by state DMVs. It's a good -- and scary -- read.) -- Michael C. Berch mcb(a)net.bio.net / mcb(a)postmodern.com / mcb(a)remarque.berkeley.edu

1 0

money maker
by Gary Jeffers 17 Dec '03

17 Dec '03

I have an idea of how ambitious cypherpunks could make money. They could be communications intermediaries between financial clients in the U.S. & financial institutions in locations such as the Bahamas & Switzerland. This would require a cypherpunk in the U.S. & another cypherpunk in the foreign country. From now on in text cypherpunk = CP. The U.S. CP would get message from client & then use the internet with anonymous remailers & strong encryption to send message to CP in foreign country. CP in foreign country then decrypts message & gives it to local financial institution. Financial institution gives message to foreign CP who then encrypts & uses anonymous remailers to send info. back to U.S. CP. U.S. CP decrypts & gives info to client. In this way, encryption naive client could have access to great financial privacy & CPs get money. At this point, I think everybody gets the basic idea. CPs would have initial problem getting clients. To do this they would need to hook up with a financially sophisticated partner. That shouldn't be too hard. College friends in finance, local CPA's you've dealt with,th, lawyers, etc.. CPs would probably be the rare & precious birds. Once the CP has his financial contact, that financial contact can develop the clients. In the foreign country, the CP shouldn't have much of a problem getting a financial partner/advisor & could probably operate with neon lights. In the land of the free (the U.S.), I would advise discretion. This business should not take a lot of capital. CPs would bring the rare communications technical expertise & the financial expertise should be plentiful. There is a possibility of harassment, so the CP's should have courage. By the way, there was someone on CYPERPUNKS that was offering a percentage of the profits for great financial ideas. I would like to volunteer this idea. It might not meet all the specifications, but then someone might like to change specifications & accept this idea. This idea may be half baked. In which case, I leave it to my fellow cypherpunk geniuses associates to fully bake it. Good luck - Gary Jeffers GO TEAM GO! - GO TEAM GO! PUSH EM BACK! - PUSH EM BACK! WAAYY BACK! BEAT STATE! - BEAT STATE!

2 1

Re: Clipper and Traffic Analysis
by smb＠research.att.com 17 Dec '03

17 Dec '03

> Also, it probably goes via a different physical path. And at least some > SS7 trunks are encrypted with DES. Care to say anything about which ones are encrypted and why? Or to ask it another way, who decides? I phrased it that way because I'm not certain of the extent, and I'm not certain how much of what I know is AT&T-proprietary. But the obvious risks that encryption avoids are traffic analysis by enemies (pick your own definition of enemy), information on what channels to wiretap (remember the furor a few years ago about the location of the then-Soviet embassy on a hilltop in Washington, D.C.?), and the threat of phone-phreaking by introducing bogus call setup messages. On the latter point, recall that out-of-band signaling was introduced in part in response to ``blue boxes'' and other device that exploited in-band signaling technologies.

1 0

New Crypto product & other ramblings
by baum＠newton.apple.com 17 Dec '03

17 Dec '03

I think the only way to prevent Clipper is pre-emptively. The advantages of Clipper are twofold: Gov't volumes may drive the price down The Algorithm is fast, and the silicon required to implement it is small. Modular arithmetic is (belief here, not fact) bigger, slower, and more expensive. There is enough knowledge, experience, and money on this mailing list to design an encryption chip to compete against Clipper. It would be better if we could just buy them- maybe that will happen. SGS-Thompson has just announced a smart-card chip with Modular Arithmetic Processor (ST16CF54) developed by an Israeli company, Fortress U&T Ltd. It's optimized for 256 and 512bit exponentiations, but can handle 1024 bit. It sounds like this is just for public key signature verification- it can't encrypt or decrypt at high speeds. Anyone know more about this product? (ref. EEtimes 2/14/94 pg 20) ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, 20525 Mariani Ave, MS 305-3B * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

1 0

Big Brother PostScripts
by Robert A. Hayden 17 Dec '03

17 Dec '03

Thanks to some help, I have the Big Brother PostScript but have reduced its size so that it is about 1" x 1" or so (no ruler, just a guest). This is a perfect size for printing on stickers, letterheads, etc. If anyone wants a copy, please drop me a line and I'll be happy to mail it to you. If someone at cpsr.org wants to put it up for FTP, please also contact me and let me know where to upload it to (or if you want me to email it to you.) [As a side note, I'm thinking of breaking into the lab some night and putting these stickers on all of the workstations. Just thinking about it, not actually going to do it :-)] ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> In the United States, they \/ Finger for PGP 2.3a Public Key <=> first came for us in Colorado... -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

I was recently helping a new start-up phone company get in operation]We As part of the initial acquisition process of a DCO/CS (Stromberg Carlson) based switch facility which the start-up was acquiring from a previous failed company we went on a swwitchroom tour... There tucked in a back corner and hooked to the "hacker" and fraud intercept trunks of the CS was a intercept operation... the previous consultant (who was giving the tour) bragged of having listened to Hot Ladies etc (usual sort of Drivel) Talking to the former owners I find the former switchroom tech(not this guy) was fired for this type of offense... this company and its sucessor used to carry my long distance traffic... NO MORE!!!... with clipper... this will become a pernicious typr of action ... impossible to stop... BTW the company and its sucessor is SF Bay Area Based... :)

1 0

No Subject
by nobody＠soda.berkeley.edu 17 Dec '03

17 Dec '03

Extremely high activation potentials caused Xenon to ionize: ## "I am afraid of knowing the truth, for when you offer it to ## people, they call you mad." But if they call you mad, it says nothing about your possession of truth. Goddamn converse-is-not-the-contrapositive-ignorant, I-couldn't-possibly- be-wrong-claiming, solipsism-tending, basic-logic-error-making, self- deceiving, to-his-own-authority-pointing, self-esteem-up-propping ranters!

1 0

stickers
by Matt Thomlinson 17 Dec '03

17 Dec '03

Re: big brother stickers, Robert Hayden wrote: > Uh, how do you do dat? Well, I was able to use Word for Windows just now and drop a bunch of them on a page at once (they're postscript; import them as an .eps), resize them at will, and print the page out. If you wanted to make your own laser-stickers or whatnot, I could see this working for you. Of course, a nicer program (one more suited for the task) would be preferred, but .. :) Matt Thomlinson Say no to the Wiretap Chip! University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 548-9804 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

1 0