- cypherpunks-legacy - lists.cpunks.org

RE: CreditCard info
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 11:49 PM 8/7/94 -0500, Brian Lane wrote: > ....in 10 years all >newborns will have a small uP implanted into their hand(ala Demolition >Man) that will keep track of all their electronic data. Scares the crap >out of me. We just had thread about that. I had brought up Gerry O'Neill's old book "2081", which had a discussion of buying things by picking them up and walking away with them (everything, including you, had an identifying transponder). There was some talk about Xerox PARC's work with transponders in their "Ubiquitous Computing" office concept. What I didn't understand was how to implement Esther Dyson's idea about people owning all their personal information and protecting all that "property" with strong crypto. Paradoxically, I bet both these ideas (transponders and personal information as property through strong crypto) can work together. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Digicash address?
by Adam Shostack 17 Dec '03

17 Dec '03

Could someone send me contact information for David Chaum's Digicash company? An email address would be great... Thanks in advance, Adam

2 1

Looking for info on PGP enabling mail apps. . . .
by Garth Brown 17 Dec '03

17 Dec '03

i'm looking for info on enabling automatic PGP signing of mail messages from PINE and ELM. Perhaps i'm babbling about something in a FAQ i missed, in which case i'll filter flames to /dev/null. =) thanks garthB> ------------------------------------------------------------------------------ Garth S. Brown, Semaphore Corporation 122 South Jackson Street, Suite 350 garthb(a)semaphore.com Seattle, Washington 98104 InterNIC WHOIS: GB(31) -Public key available via finger of garthb(a)semaphore.com -PGP2.6 Key fingerprint = 65 0E 48 A1 F7 38 DB 03 3F 77 77 9E B5 53 2E 96 ------------------------------------------------------------------------------ All problems can be solved with the proper application of high explosives.

2 1

Anonymous Transport Agents (Was: Latency vs. Reordering)
by Jeff Gostin 17 Dec '03

17 Dec '03

hughes(a)ah.com (Eric Hughes) writes: > Simulating any of the salient features of a link encryptor over the > Internet is an interesting exercise, particularly in regard to price > negotiation with your service provider. I'm about to branch into the limits of my knowledge on this particular topic: I run a DOS site under a heavily modified version of Waffle (1.65 base), so the Unix-ish transport mechanisms are a tad out of my realm of knowledge. With that in mind... Suppose an encryption-savvy mail transport agent, say ESMTP, was developed. Further suppose that part of handshaking protocol for this transport protocol included an ENCRYPTED reverse lookup on IP identities to check that the message is actually coming from where it claims it's coming from. Suppose again that the results of this lookup were only checked for correctness (boolean), and then discarded WITHOUT LOGGING, or at least with minimal logging. If the reverse lookup was TRUE (IE: the sending machine was who it said it was), the message was accepted. If it failed, the message would be accepted, and then sent to the bit bucket. In this model, one could provide anonymous transportation of anonymous mail FOR EVERY MACHINE ON INTERNET providing that the original message wasn't forged. All that would be required (beyond running ESMTP) is an encrypted version of the return address (a la Soda remailer) to be placed some predetermined place in the message. This seems too easy: What am I missing? Have I actually come up with a way to do this? --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

2 1

PGP BUG/FEATURE: multi-platform keys
by nobody＠alumni.cco.caltech.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Recently I have received two keys that were unusable without modification (from wonderer and Sameer) because they were not prepared using canonical text. I had to replace all the carriage returns by hand (this is the workaround for mac users who receive PC keys). Why is non-canonical text even an option in pgp? Who would use it except by mistake? As long as I'm at it, here are some more macPGP2.3 bugs, for those who care. Trying to decrypt a message signed by a key I don't have causes a serious crash requiring reboot. Trying to select cancel in a signature dialogue just raises the same dialogue box instead of cancelling. I'm running on a powerbook 145 under system 7.0.1. Eternal!Optimist(a)anon.penet.fi (copyright 1993, Eternal Optimist [Ha Ha Ha]) 0) 0) =:()]-< <na26436(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLNe7R4jvfLxJbYYtAQFFHQP7BCqn1JKaI09wBrWnjOF73CPz7GetaC/y XL8zqhmzDdrGdLbWB/vBDgXW7z+2EJHazbvqaUhq1GQw8bq+opC2fe4mXcw2x3Y+ wliLy1CWDtfl24L8ah//nLQMtttfG4kXjiB8JqUnS7US+W3vvH3AXxi+wZb5W2qi 7gPXMErUCUA= =Ew/6 -----END PGP SIGNATURE-----

1 0

Re: Latency vs. Reordering (Was: Remailer ideas (Was: Re: Latency vs. Reordering))
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <199408080514.WAA28015(a)netcom7.netcom.com> "Timothy C. May" writes: > Jim Dixon writes: > (quoting Hal Finney) > > > If this idea seems valid, it suggests that the real worth of a network of > > > remailers is to try to assure that there are at least some honest ones > > > in your path. It's not to add security in terms of message mixing; a > > > single remailer seems to really provide all that you need. > > > > Yes, in an ideal world. Each additional remailer introduces another > > chance of being compromised. > > No, I'm afraid you have this backwards. A remailer cannot introduce > a chance of increase the chance of being compromised. There are at least two models of remailer networks being kicked around. In what I have called RemailerNet, if a gateway is compromised, then some degree of traffic analysis is possible, and other parts of the system become less secure. Security increases when there are two remailers handling your traffic, because then neither should know the identity of both sender and receiver. Whether the addition of more intervening remailers increases the security of the system in RemailerNet is a complex question. In the second model of remailer networks, I also believe that using more than two remailers and the random selection of remailers decreases the security of the system if there is regular traffic between correspondents. To argue this at all, one would need a much clearer model with all of the assumptions spelled out in detail. For the argument to be interesting, the model would have to be realistic. My personal impression is that the second model is highly insecure in cases where there is regular traffic between two parties and some third party has significant resources. -- Jim Dixon

1 0

RE: CreditCard info
by Mike Markley 17 Dec '03

17 Dec '03

Garth Brown writes: ---------- | From: Garth Brown (Semaphore Software) <v-garthb> | To: <cypherpunks(a)toad.com>; <owner-cypherpunks(a)toad.com> | Subject: RE: CreditCard info | Date: Sunday, August 07, 1994 5:41PM | | It's my understanding that it's technically illegal for anyone to require | your SSN for anything if they are not using it for SS related purposes. | I had heard that congress passed a law when SSNs were issued to this | effect. | | Am I hallucinating, or has someone else heard this too?! | I have heard this also. On a related note it is also no longer legal to require credit cards for identification when writing a check. Mike. ===================================================== Mike Markley <mmarkley(a)microsoft.com> I'm not a Microsoft spokesperson. All opinions expressed here are mine. =====================================================

1 0

Re: reordering
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Steve Witham writes: > > (Oh, you mean the key is to _randomly reorder_ the messages, not just > > delay them by an hour when the average number of messages in an hour > > is less than 1 anyway? Oh, now I see. Never mind!) > > > > --Tim May, who is as tired as Eric is of hearing the hoary old > > chestnuts about 'random delays,' this without regard to calculating > > the amount of reordering. > > Tim, you sound like you mean calculating the amount of reordering based > on the delay vs. average traffic--exactly what Eric is arguing against! > The thing is to write the software to do reordering directly, not > calculate how much it's going to do after you've written it... No, I mean that if it is desired to reorder with a batch of 10 messages (10 messages in, 10 messages out), then that's what one does, whether it takes 10 minutes or 10 hours to get this many messages. I think in my last paragraph above I made it clear that "random delays" are a lose, generally, and that the "amount of reordering" is what's needed. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

TOMMY THE TOURIST IS COMPROMISED DON'T USE IT
by Jeff Gostin 17 Dec '03

17 Dec '03

Tommy the Tourist (Anon User) <nobody(a)CSUA.Berkeley.EDU> writes: > Tommy the Tourist is compromised, it is possible to trace who sent the > message from the anonymous remiler called "Tommy the Tourist" > Anonymity cannot be assured, please direct anonymous traffic through > other anonymous remailers. I'll believe you when you post this signed with TtT's PGP key? Is there a 'punk that can verify this, or is just an assanine game played by adolesents? --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

2 1

Re: Improved remailer reordering
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <199408081502.IAA08127(a)jobe.shell.portal.com> Hal writes: > >You need not pass over the 'flaw of lack of message quantization in > >the final sending'. Someone running a private high security gateway, > >an "empowered user", participates in the same way as the other RemailerNet > >gateways, and there is in fact no way to determine even whether he is > >sending or receiving, or in fact whether he is doing anything at all. > >He may be just sending and receiving noise packets. > > >Users accessing the net using low security versions of the software do > >have less security, but that is a consequence of their use of low > >security software. > > I could see this would come up in Jim's description. Who exactly are these > "empowered users"? And how much security do the second-class citizens ac- > tually get? Will it work for everyone to become "empowered", or are there > scaling problems in terms of bandwidth? > > It seems to me that the most sensible approach is to make message fragmen- > tation into standard-sized packets, along with reassembly, be at the > end user site. This way everyone becomes a first-class citizen. I think that you want at least three levels in this system, with increasingly strong requirements as you go up the levels and (necessarily) increasingly weak security as you go down. You should be able to pop messages into the system from any terminal anywhere, just using ordinary email. But you should also be able to casually dump a few hundred megabytes into the system without making too big a splash, if you have the right equipment. Ideally, the empowered user's (your term, yes?) system is functionally a gateway, but it has a nice front end on it, something like Mosaic. It is probably a single user system with a RemailerNet interface bolted on to it; it probably runs under Windows; it may even be a modified version of Mosaic. The system at the next level up is a workhorse. Its user interface would be a system manager's, designed to show him how traffic is flowing, highlighting bottlenecks, etc. It would be designed to run automatically. -- Jim Dixon

1 0