- cypherpunks-legacy - lists.cpunks.org

Re: Anonymity: A Modest Proposal
by Adam Shostack 17 Dec '03

17 Dec '03

Futplex wrote: | The fundamental conflict, as I see it, is this: | For security reasons, we want messages to be distributed to a very wide | audience, although those messages are only of interest to a very narrow | audience. News admins understandably are generally inclined to accept | bandwidth only in proportion to readership. For practical reasons, they don't | want to carry messages to people who aren't interested in them. It's not | easy to convince the news admins to do it anyway out of altruism. How about a local group, such as ucb.anonymous? Those news admins who wanted it could get it. Not perfect, but reduced polyticks, increased usablity. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: Problem in draft FIPS `CRYPTOGRAPHIC SERVICE CALLS'
by p.v.mcmahon.rea0803＠oasis.icl.co.uk 17 Dec '03

17 Dec '03

DATE FROM SUBJECT Two related points: 1. Sorry to waste list bandwidth with such a question, but could someone please post to me the original "Problem in draft FIPS `CRYPTOGRAPHIC SERVICE CALLS'" item? (my server was down at the weekend). 2. NIST have proposed the draft FIPS to a number of standards development organisations - including X/Open and POSIX - and I know that Microsoft have reviewed it, so it will likely influence interfaces to commercially available cryptographic software and devices. If there is anybody with interest in crypto APIs on this list, then your informed comments on this NIST proposal, or other candidates (which I could make available if the level of interest warranted it), or alternatives, would be useful and timely. Thanks Piers -------------------------------------------------------------------- P V McMahon 09AUG94 ICL Enterprises post: Kings House, 33 Kings Road, Reading, RG1 3PX, UK email: p.v.mcmahon(a)rea0803.wins.icl.co.uk OR p.mcmahon(a)xopen.co.uk phone: +44 734 634882 fax: +44 734 855106 ---------------------------------------------------------------------

1 0

PARTY! Nov. 18th, sponsored by Community ConneXion
by sameer 17 Dec '03

17 Dec '03

Subject: PARTY! Nov. 18th, sponsored by Community ConneXion (Apologies if you receive this multiple times) Mark your calenders... Community ConneXion: the Internet Privacy Provider is having a party! We're partying to celebrate the spread of privacy on the net, through the increased security of internet products, as well as the growth of our services. (Many new services and new features on existing services will likely be announced before the party. Stay tuned.) We're inviting all our customers and other potentially interested parties, which includes you, if you've received this note. So please join us, and send a copy of this invitation to anyone else you may know who would be interested in attending. Where: Icon Byte Bar & Grill 299 9th Street (at Folsom) SF CA 94103 When: Sat. Nov. 18 1995 7:00 PM This is a good chance to meet and network with the people who are making privacy on the internet a reality. Find out more about the HackNetscape and HackMicrosoft contests. Learn about our specialized web services, found nowhere else but at Community ConneXion. Hear about the anonymous and psuedonymous servers here and what we're doing to improve them. There will be catered snacks and a no-host bar.

1 0

Re: airport security
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

Futplex writes: >DCF writes: >[re: shwoing picture ID to board commercial flights in the U.S.] >> I wonder how many have challenged this. >Any pointers to news articles or govt. press releases that actually state >some rationale for the ID checks, however spurious ? >> I suppose they are trying to discourage people from buying tickets in >> false names so that the databanks can be more useful to the authorities. >It's bad enough that it is "illegal" (at least according to some recent ARC >flight coupons of mine) to sell or otherwise transfer your tickets to someone >else. I'd love to see them try to justify crap like that. Without actually agreeing with the FAA, the reason you can't have a name other than your own on your ticket, as well as why you are required to be in your assigned seat on take-off and landing is because if there is a plane crash, they need to be able to identify an otherwise difficult to identify body. This does have some relevance to airport security if a plane is blown up. Sorry about this, Bob

2 1

EDDB/RN
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

I don't know if anyone else has had this particular idea before, but it might be worth some consideration. I referred to it very briefly in my posting on RemailerNet v0.2 (RN02). Eric points out that users of remailer networks want to be able to trust in silence as well as trust in delivery, and RN02 accordingly specifies that messages should be erased immediately after acknowledgement of delivery. However, there should be a use for persistent store, for a remote encrypted database accessible anonymously. Everyone must have had this sort of experience: someone walks into your office. There is something on your desk that you would rather this other person not see. So you toss it into a drawer, to get it out of sight. Imagine that you are working on a document and someone walks into your office. Rather than tossing it into a drawer, you toss it to Finland. The document is sent encrypted. (The storage facility also encrypts it.) When its receipt is acknowledged, your local copy is destroyed, if you wish. You can retrieve it in seconds from anywhere, providing that the system supports the notion of an identify distinct from your log-in address. Ideally, the data is stored on a distributed data base, with some redundancy in case one or more gateways go down, and with the data striped across gateways, so that no one gateway has all of the data. Because the data is encrypted by you and encrypted by the EDDB, it cannot be recovered by anyone without your cooperation. If the data is striped over a number of gateways (with, say, every first byte here, the next byte there, the next byte at a third gateway, and every fourth byte at a fourth gateway), it would take widespread collusion even to recover a copy of the encrypted document. Once you have such a system in place, you could then do interesting things like storing a document in the EDDB, and selling it to someone by selling him your passwords. I also think that a very reliable version of this system could be used to handle electronic cash (e$). -- Jim Dixon

2 1

Re: Don't Kill the Messenger--A New Slant on Remailers
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Thu, 19 Oct 1995, Timothy C. May wrote: > "You have a piece of mail awaiting at our mail delivery service. The > originator is unknown. The title of the message is "Tentacles of Medusa > Must Die!" You may retrieve this message by replying to this notification > with the word "Yes" anywhere in the Subject field. This message will be > kept for 60 days and then deleted." I suspect that I could easily hack this into Mixmaster in a day or two, but wouldn't it open you to attacks where Anonymous Fed, say, sends terrorist kiddy-porn through your remailer and busts your ISP during those 60 days for possession ? I'm not sure if it would be better or worse than current setups from that point of view. I might do it anyway, and set it up to only forward PGP-encrypted messages, but I certainly wouldn't be able to keep messages for 60 days with only a MB or so to spare. Mark "Yes Judge, when we siezed their computer we found 300 MB of *kiddy porn* and plans for *terrorist attacks* [that we'd mailed to the in the last two weeks...]"

1 0

GAK & RSA
by paul＠poboy.b17c.ingr.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- RSADSI has been adamantly opposed to Clipper. You'd expect them to be opposed on business grounds; after all, Clipper wouldn't bring them any revenue and could quite possibly put them out of business if other forms of encryption were outlawed. I don't remember seeing many specific comments indicating that RSA was opposed to GAK on philosophical grounds (well, OK; some quotes on their "Sink Clipper" poster, if those count). Other groups were opposed to Clipper because Skipjack is of unknown strength. Putting the cypherpunkesque arguments about how GAK is a big step down the path towards a surveillance state, is it possible that the software GAK (SGAK) scheme could easily incorporate RSA's technology? Imagine: Schlafly et al win their court case, and RSADSI's patents on RSA and other public-key technology are declared invalid. SGAK can thus use RSA without any problem. The "Skipjack, DSS, and SHA may be weak" crowd can't object to RSA's strength, and of course RSADSI will be in no position to object. Another scenario: RSADSI wins and their patent remains valid. They can't refuse licensing to any entity which meets their terms, so SGAK can still be deployed, but RSADSI then gets a royalty. _This_ is what's scaring me. If Microsoft, Apple, et al offer weak encryption as part of SGAK, objections can be made to the weakness. If they use RSA, that avenue is gone. - -Paul - -- Paul Robichaux, KD4JZG | "Information is the currency of democracy." perobich(a)ingr.com | - some old guy named Thomas Jefferson Of course I don't speak for Intergraph. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLkemSKfb4pLe9tolAQGYiAP9EEwh/ImtxO6VoeGW6Ur15lwM+eJy9MRR liYk+LMisjfJUwdO7Ngz2EDg/gKWky3u/t2LOm5347tekShXJXEqFqmRlGIt2xu7 8eSMRxRpewYTtYstPWPBaxBe6nzBSfD7BciQseqEU1b6ug21pB53hzHgYP7OwtrY NEZSuas7C9g= =+J/I -----END PGP SIGNATURE-----

4 3

Voicemail Security
by Rich Graves 17 Dec '03

17 Dec '03

Please see article <46775j$2tg(a)news.eecs.nwu.edu> in news.admin.net-abuse.misc. It has also been cross-posted elsewhere. I wonder how often Jeff checks his messages. It would be interesting, from a purely academic perspective of course, to see if one could anonymously drop off more information about Jeff and his clients at that number for private distribution. For example, credit card, driver's license, and social security numbers. I assume that Jeff is reading this group. How would Jeff go about protecting his voicemail box from this sort of attack? How would *I* go about protecting *my* voicemail box from this kind of attack? -rich Whose list was also spammed, but only I got it because majordomo is set to bounce all messages from non-subscribers to the list owner. Btw, is this list set up this way?

1 0

S.F. judge to rule on encoding software
by Jeff Weinstein 17 Dec '03

17 Dec '03

http://www.sfgate.com/net/abate/1021.html FYI. The above URL points to a SF Examiner article about the Bernstein case, including friday's proceedings. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

Re: NYT on Internet Flaws
by MDresser＠aol.com 17 Dec '03

17 Dec '03

In article <199510120347.UAA27336(a)infinity.c2.org>, sameer wrote: > > I completely agree that the reporters on this list make things > very difficult and people do need to be very careful about posting > things which will get misinterpreated by reporters.. etc.< FYI, the day after the Markoff piece ran in the NYT, The Baltimore Sun ran an article debunking it, based on independent reporting. Generalizing about reporters is about as intellectually valid as generalizing about hackers. Michael Dresser, who wrote it (speaking for myself, not my employer)

1 0