- cypherpunks-legacy - lists.cpunks.org

for-pay remailers and FV (Was Re: Remailer Abuse)
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 4:10 PM 01/06/95, Nathaniel Borenstein wrote: >I hate to say it, because I generally tend to take the pro-FV side of >most arguments :-), but I think Jonathan's closer to the mark in this >case. If mail goes through ten remailers, and they ALL charge via First >Virtual, then the last one in the chain won't have to know who you are, >but it will have to know your FV billing account. Thus it, together >with FV, have enough information to break anonymity. > >This is NOT the same as saying that ANY one operator, together with FV, >can burst anonymity; it means that the last one + FV can do so. I Hmm. Maybe I don't completely understand how this is going to work, but won't _every_ remailer in the chain need to know your FV billing account? How would the rest of them charge via FV without knowing your billing account? What Russell was suggesting (I think), was that only the first would bill via FV directly, so only the first would need to know your billing account, and then he'd settle up with the others at the end of the month. (A particular variation of that scheme is what you mentioned later in your message, and I'll get to that). But assuming that every remailer along the chain _was_ charging via FV, I fail to see how only the last one would need your billing account; seems to me they all would, and thus any one could collude with FV to violate your anonimity. [...] >Personally, for my taste this is sufficiently anonymous for any >reasonable purpose. HOWEVER, I can imagine how to make it even more >anonymous. Imagine that there are ten for-profit anonymous remailer >operators who form an "anonymous remailers consortium". Each of them >operates TWO remailers, a for-pay one and a free one, but the free one >will only take things that have come directly via some consortium >member's anonymous remailer, so your message has to be paid for once, at >the entry point to the overall system. Now you can build up a chain >that STARTS with a payment, but then threads its way through a bunch of >less traceable systems. where the operators can't give tracing >information even under court order. The consortium members would >probably have to agree to some revenue sharing arrangements, but you >could make this work. Yeah, that's a specific instance of the type of thing Russel was proposing in the message you were replying to. An instance which avoids many of the critisisms I made directly after Russell's message, but not all. The remailer operators still have to have an organization and remain in close contact, which I am uncomfortable with because it seems to make collusion more likely. And it's still dificult to intermix for-pay and free remailers within your chain, or even just for-pay remailers from several different consortiums. And there are a variety of problems in that inability. [The consortium, as far as I can tell, would also find it rather dificult to charge more for a longer chain, I can't think of any way for them to charge anything excpet a uniform amount regardless of length of chain, unless you give the first remailer a way to tell the length of your chain, which is undesirable. I'm not sure if this is a problem.] >I think this level of engineering is overkill -- for my personal level >of paranoia, I would settle for a single for-pay anonymous remailer >located in a country with very different laws than those that governed >the payment system. Such a system would probably be "breakable" for And this level of paranoia would be perfectly well surved by a Julf/penet style remailer, which _would_ work well with an FV-payment system, as I agreed before. The cypherpunks chained remailernet system as a whole is overkill for your paranoia needs, but appearantly not for the needs of those who use it over Julf's. It appears to me, that an FV-style payment scheme can't be added to the cypherpunks chained remailer system without dropping it's security to the level of Julf's. Which might be good enough for you, but not good enough for me, or presumably for anyone else that uses cypherpunks remailers. [Do you understand how cypherpunks remailers work, and the difference between them and a julf/penet style remailer? Do you understand how encryption is used in a cypherpunks-style remailer chain to make it so each individual remailer only knows the next remailer along the chain, and not the entire rest of the chain?]

2 1

Re: ecash trial issues explained
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> From: Wolfgang Roeckelein <wolfgang(a)wi.WHU-Koblenz.de> > > >-> Digital cash should not be "anonymous" -- paper currency isn't. Serial > > There seems to be a misconception here what is meant with anonymous. Paper cash > is anonymous: I can't derive the person I got the note from from the note > itself. So if I meet a guy in the street, he gives me a pack of cigarettes and > I give him cash, this transaction is anonymous. It isn't difficult to make paper cash less anonymous, though, by tracking serial numbers. This is occasionally done in "law enforcement" situations - recording the notes used to pay ransom or bribes. It wouldn't be difficult to add serial-number recording equipment/mechanisms to automatic bank-teller machines, to record what serial numbers would be given out to whom. (This can be done either by adding scanners to the ATMs themselves, or by scanning the money before putting it into the ATM, and having the ATM record that transaction #43 dispensed the 105th-110th bills in the stack. Scanning can either be done by OCRs, or by replacing the human-readable numbers with bar-codes, as some of the paranoids periodically suggest the US Treasury is about to do as part of some heinous plan. However, the original posters' assertion that digital cash should not be anonymous is not a technical statement, it's a value judgement, and in my opinion it's a bad one. There are a lot of genuine social needs that anonymity can support, and a lot of bad things that can be done with traceable money. Aside from that, traceability costs money. Original gold and silver money didn't need to be traceable, though coiner's and assayer's marks were useful, and it is easier to keep track of your pile of gold bars if they're numbered. But paper money has serial numbers largely to prevent easy copying; gold is a lot harder to counterfeit, unless you've got a king who insists that coins with his face on them should be worth N times as much as anonymous coins. Bill

1 0

floating point crypto?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

I'm incensed. I casually mentioned somewhere else that I saw something on this list about floating-point math being used in crypto, contrary to popular belief, and somebody had the *timerity* to call me on it. ;-). I think it had to do with factoring, but maybe even in key-generation, though that doesn't sound right at all... So, are there c-punk archives I could look in? I remember hearing something about that, too. However, if someone remembers off the top of their head, or if they have an actual copy of the posting, that would be great, too. Please send me whatever it is by e-mail. No point cluttering the list more than I already have... Of all the nerve.... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

sniff passwords on PC (DOS)
by m00012＠KANGA.STCLOUD.MSUS.EDU 17 Dec '03

17 Dec '03

As a demonstration of concept, I wrote a small, simple program that replaces the keyboard interrupt and stores all keystrokes in a buffer. It was very very easy to write. It works while using pgp and windows\net. It does not work after starting windows. Not sure, but it seems obvious that MS windows installs it's own keyboard interrupt. I suppose it would be easy to enhance this simple program (I bet it's been done by others) to store passwords into a secret file on a hard drive unbeknownest to the user. I first suspected that such a program already existed after hearing, two days after his arrest, that the CIA had cracked Aldrich Aim's encrypted files. (sorry if I spelled his name incorrectly.) Think about it, the govt. could spend 50,000 to 100,000 to create a freeware gif viewer, for example, that installed such a tsr. Mike P.S. If the guy who wanted to see his gf's files writes me, I'll send you this keyboard sniffer program.

1 0

Re: sniff passwords on PC (DOS)
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Mike writes: > days after his arrest, that the CIA had cracked Aldrich Aim's encrypted > files. (sorry if I spelled his name incorrectly.) FYI, I'm fairly sure it's "Aldrich Ames". > Think about it, the govt. could spend 50,000 to 100,000 to create a > freeware gif viewer, for example, that installed such a tsr. ...most of that going to Compu$erve/Uni$y$... > P.S. If the guy who wanted to see his gf's files writes me, I'll send you > this keyboard sniffer program. Just to clarify slightly, the person who originally asked the question (Adam Gerstein aka THE MAC GURU) said he had a _friend_ who wanted to see his (the friend's) gf's files. - - -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLw0I8mf7YYibNzjpAQEF/wP9GPKLX7KifBFRenzmbvsCdbOQ7Narlm8/ qiW/nSLRr7jZUtjAyhYM71eI9GsQbO6lADfV9ncoPIATNB/eJNCqa2O0cmNa67O/ KuUSQl0NQPiUQyevkLRldllEb9hSuTNeHyJZ4SFDpMbFrGYXX4Iu/w9RYcn9ssNS 29qFs0vNK30= =Z0ZM - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLw0J9ioZzwIn1bdtAQHXVgF8CVyuTHInzoYDUZmZZXwksIosAuiP4TSh pfZJLbRcoPPP9sJ63CTfnexZXenEzhLf =zrNo -----END PGP SIGNATURE-----

1 0

Re: True Names
by frissell＠panix.com 17 Dec '03

17 Dec '03

> >--Mike, still looking for a copy himself > Boy, for people who can make the World's Governments tremble with the click of a keyboard some of you seem a bit print disabled. How to buy an Out of Print Book (c) 1995 Offshore Enterprises 1) Find an OP book search specialist 2) Ask he/she to find it for you 3) Pay for it To accomplish 1), ask at (independent) bookstores in your vicinity (those are places you may have seen around town full of processed tree carcasses), libraries, etc. DCF -- Correlation between (40 years of pack-a-day)second-hand smoke and cancer: +1.19 Correlation between having had an abortion and cancer: +1.50 Correlation generally accepted as significant for disease studies: +3.00

1 0

Re: Chain letter bounced (fwd)
by Carol Anne Braddock 17 Dec '03

17 Dec '03

Inasmuch as I sent the prior posting the way I did, (as I can only read one letter at a time), You do not speak for all the cypherpunks, neither do I. On the time cronology you are the first to complain about the account closing notice. That doesn't constitute a WE yet. So please do not send me further personal mail. I'm glad I'm not so clueless about Stalking Laws in the State of Minnesota. Now I've go to my free.org account and get my Star-Trib address archive back. Carol Anne Braddock signed 1/6/95 11:25 A.M. On Fri, 6 Jan 1995, david d `zoo' zuhn wrote: > // come through, but for now I'm kinda clueless. > > Very very true. > > And please stop including this stuff at the end of every message. WE DON'T > CARE. > > > // From carolann(a)vortex.mm.com Fri Jan 6 01:39:29 1995 > // Date: Thu, 5 Jan 1995 21:57:05 -0600 > // From: Carol Anne Braddock <carolann(a)vortex.mm.com> > // To: carolann(a)vortex.mm.com > // > // [icicle.winternet.com] > // Login name: carolann In real life: CarolAnne Braddock > // Directory: /usr2/carolann Shell: /etc/scripts/tcsh-susp > // Last login Thu Jan 5 21:38 on ttyq5 from annex3-1.wintern > // New mail received Thu Jan 5 21:16:23 1995; > // unread since Mon Jan 2 13:18:25 1995 > // Plan: > // This account has been disabled permanently. > // > // Mike Horwath - Admin - Winternet - drechsau(a)winternet.com > // > >

1 0

TRUE NAMES FOR FREE
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Angus Patterson wrote a short while ago: S6>I've been trying to get True Names by Vernor Vinge, and have been told it's >out of print (like most good cypunk ), does anybody have it scanned? Laissez Faire Books has a stockpile and they're giving them away! LF sends you _True_Names_ free when you buy _Solomon's Knife_ by Victor Korman (a pen-name). Order FN5136, $9.95 for both + $3.25 shipping: Laissez Faire, 938 Howard Street #202, San Francisco, CA 94103, tel 800-326-0996, fax 415-541-0597. They have their own Laissez Faire Book News list, too, with previews and samples. Ask Chris Whitten for more info at <whitten(a)panix.com>. "Capt'n Bob" Correspondents: Communications went down recently when 2 remailers shut up shop. A new address will be up and running during next week.

1 0

Carol Anne - C'Punk Poster Person?
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

It occurs to me that Carol's problem may well be of considerable interest to c'punks and free speechers everywhere. Not that I favor spam or it's derivatives - but Cancelmoose and others define spam as *_50_* or more groups, esp. without crossposting. My basis for saying that Carol's situation is of interest is ---- as the net becomes more vulnerable to regulation, who among is immune to a quick cancellation of account? For something such as, say, the irresponsible (and antisocial?) advocacy of crypto? If an account can be chopped for 10 posts, where is the bottom limit? 5 perhaps? 2 maybe? 1 post that the sys-admin disagrees with? Developing the idea, and combining it with for-profit remailers...what would be wrong with a provider offering a unix shell based account, with the option of registering the account under a nym - and with finger user switchable from on to off and back again? The login ID would also be unconnected to the name. Frankly, none of this seems that radical...our friend, America On Line has some of these characteristics! Various 'anti-true spam' strategies could be used to prevent massive postings of Make Money Etc...But instead of a remailer, an actual *_system_* would be used. Payments could be by electronic invoice and money orders... Any thoughts on this? Dave

1 0

Re: Remailer Abuse
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 7:28 AM 01/06/95, Nathaniel Borenstein wrote: >Again, this comes down to definitions of anonymity. In this case, if >you start from the silly assumption that the anonymous remailer actually >keeps records that correlate messages to payment mechanisms, Doug is >right, but barely. To break the anonymity, you'd need collusion between >the operator of the anonymous remailer AND First Virtual, because the >former knows which account sent a message, and the latter knows who that >account belongs to. (And before you tell me that this sounds a lot like While this might be secure enough for some people, it is important to note that it definitely is less secure then the current free remailer net. Currently, if I send my message through 10 remailers, many more then just two of the operators need to cooperate in order to get my true identity. I think that at least 8 or 9 of them do, actually. In a First Virtual payment-scheme remailernet, no matter how many remailers I send my message through, any _one_ operator, together with First Virtual, can burst my anon bubble. I suppose this still might be enough security for some people. After all, penet is enough security for some people. But I'd guess that most people using cypherpunks remailers instead of Julf's penet remailer aren't going to be willing to settle for it, because it doesn't give you very much more security then penet. My trust of Julf, who has an amazingly good reputation on the net and furthermore isn't in the U.S. (and presumably isn't subject to U.S. government coercion), certainly isn't any less then my trust of First Virtual. And if I'm still sending through 10 remailers, which I'd be doing for traffic analysis reasons, any _one_ of them, together with FV, can compromise me. Weakest link in the chain. Which means my risk _rises_ with increased remailer chain length. If I was willing to accept that level of risk, I'd just use penet which is much more convenient. The First Virtual method does seem possible for Julf's remailer, since users are pretty much already trust Julf completely, so the Julf+FV system isn't any less secure then the just Julf system. But it's just not anonymous enough for cypherpunks-style remailers.

3 2