- cypherpunks-legacy - lists.cpunks.org

Re: On the crime bill and remailers
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Someone out there asked: >On Sun, 18 Sep 1994, Robert Hettinga wrote: >> Hey. I get it. Solon. Lawyer. Nym. >I think it is too late in the day for me. When you have a minute, >please let me in on it so I too can "get it". Sorry. Operating with sparse data in "terse" mode again... Here's the verbose, shaky memory version. I think Solon (called after he died "the lawgiver") was a, well, tyrant, of Athens. Tyrants in ancient Greece tended to be dictatorial in the modern sense. They weren't born to the job. They stole it fair and square, so the job was theirs. (BTW, the job "Dictator" comes from Rome, where it was an ad hoc, special purpose office granted by the senate with unlimited power for a finite term, usually 2 years. The finite term was supposed to be a check against abuse. Ceasar liked the job so much he wanted to keep it for life, so they snuffed him. Didn't do them any good.) Anyway. According to legend, Solon wrote, by himself for the most part, the laws Athens operated under during the Periclean, "golden" age of its history. Can't remember whether he stepped down after he did it, but the laws he wrote, including most of the ones we call "democratic", stayed in place after he died. So. SOLONg has several puns in "his" name. One, Solon "the lawgiver", like "I speak law". Two, So Long, Solon, like, "so long laws". Since "his" first post was a legal one, he (I'll take the quotes off because the original Solon was male) must be a lawyer or a law student, or someone who is neither who wants to sound like they are. Basing the nym on Solon the lawgiver is a little pretentious, but, hey, what you expect for what turn out to be free legal counsel on cypherpunk issues, a focus-group-tested nym? In the meantime, we have someone at least claiming legal credentials willing to put an oar in here every once in a while. With our friend Vinny "The Pro" Bono, (rumored relation to an ex-mayor), that makes two anonymous lawyers on the list that I know of. That is good thing, I think. Time will tell of course, whether that really is the case... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

RC4 spaces...
by nobody＠kaiwan.com 17 Dec '03

17 Dec '03

Yoo Hoo, Did anyone notice the spaces at the end of most RC4 source code lines. Could they be .... 1 - Someone used a strange editor on the code. 2 - Someone deleted comments that were after the spaces. 3 - It is realy some crude Stego ID. Cheers,

1 0

news (fwd)
by Al Billings 17 Dec '03

17 Dec '03

This was forwarded by a friend of mine and a "witchhunt" list he is on at MIT. It seemed relevant given the government's current tactics. ---------- Forwarded message ---------- From: Sherrill Mulhern <smulhern(a)pasteur.fr> Subject: SRA CONFERENCE To: witchhunt(a)MIT.EDU Just thought that someone might be interested in checking out this conference. Last year it, at its first conference it advertized a number of big name MPD/SRA speakers including Roland Summit, Bennett Braun, Colin Ross, etc. Summit pulled out, however, I believe Braun and Ross attended and were joined by Catherine Gould (who wrote the check list of clinical indicators of satanic ritual abuse). "For Immediate Release:" Contact: Randy Skinner, Director National Criminal Justice Task Force (714) 262-7592/Fx(714) 252-0846 Cyber-porn Cover up-- Conference Unmasks Washington D.C. Computer Ring's Link to High Officials IRVINE, Calif -- Tasked with informing the nation about the prevalence of sexual crimes against children. The National Criminal Justice Task Force, a national multi-disciplinary group of judges, prosecutors, medical doctors and psychotherapists, is hosting the second national conference on Crimes Against Children, September 22-25 at Washington D.C.'s Ramada Renaissance Hotel. Slated for discussion is the first alleged cyber-porn ring -- the "Finders", a shadowy techno-cult allegedly specializing in electronic networks, disseminating child pornography and possibly smuggling children. According to Detective Sergeant Larry Lawson, of Florida, the mysterious group was discovered in Tallahassee in 1987 (? illegible) when police stopped a van driven by two adults, allegedly en-route to Mexico, carrying a cargo of six children, ages 3 to 6 years. Raiding a D.C. warehouse, D.C. Metro officers uncovered computers, detailed kindapping {sic} plans, child/animal blood-ritual photographs, and overseas orders for children. When a U.S. Customs/Washington Metro Police investigation was launched, the FBI's Counter-Intelligence Unit shut it down. Only under pressure from members of Congress-who just received information from associates of the National Criminal Justice Task Force - did the Justice Department renew the investigation. Uncovered recently is information that links corrupt federal officials to child-trafficking, as well as the use of influence to cover up their involvement with the Finders. For more information and press kit, contact Randy Skinner, director National Criminal Justice Task Force, (714) 262-7592/Fx (714) 252-0846

1 0

DC-Nets and sheep
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

doug(a)OpenMind.com (Doug Cutrell) > One possible way around this societal control of anonymous remailers might > be the existence of very large DC-nets (or related technologies). The idea I've been arguing that DC-Nets are among the crypto protocols that we've not exploited much so far. I was working on an implementation, till I got stuck with the 'net' part of it. The basic protocol is very simple, with hooks to the bit-flipping crypto routines. The problem is integrating the DC into an existing net protocol in a manner that makes it transparent and practical to use. Ideally a layer over IP or Ethernet, as DC-Nets share many of the basic problems of net protocols - conflict resolution, random wait-before-resend etc. Ideas? (Read section 13.4.8 of Tim's Cyphernomicon for an explanation of DC-Nets) Note that the major problems lie in the _practical_ implementation, which is not necessarily the speed - despite conflict resolution and anti-collusion techniques, the basic operation in a DC-Net, assuming the presence of a stream of random numbers, is the fast XOR. DC-Net implementation problems are more severe than those in secure-IP (swIPe etc) as they have to handle lots of things at a lower level in the network protocol. Doug goes on to suggest that to be immune from the "sheep^H^H^H^H^Hpeople" DC-Nets will have to have millions of members. But if anon remailers were used by millions, than they'd be immune too. All crypto is vulnerable to mob action until it's widespread. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I have written and installed a remailer pinging script which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html Please let me know about any other remailers which I missed. I've only included remailers which can mail to arbitrary addresses, so I already know chop and twwells are missing. This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://kiwi.cs.berkeley.edu/pub/raph/premail-0.22.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 10-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"chaos"} = "<remailer(a)chaos.bsu.edu> cpunk hash ksub"; $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk oldpgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk oldpgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut post"; $remailer{"wien"} = "<remailer(a)ds1.wu-wien.ac.at> cpunk pgp hash nsub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric pgp. post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)xs4all.nl> cpunk pgp. hash latent cut post"; $remailer{"leri"} = "<remail(a)leri.edu> cpunk pgp hash"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp."; $remailer{"underdog"} = "<lmccarth(a)ducie.cs.umass.edu> cpunk hash latent cut post"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 19 Sep 94 6:00:01 PDT remailer email address history latency uptime ----------------------------------------------------------------------- wien remailer(a)ds1.wu-wien.ac.at ***-+**++*** 9:04 99.99% bsu-cs nowhere(a)bsu-cs.bsu.edu ***++*****+* 6:05 99.99% c2 remail(a)c2.org +****-**+*-* 1:02:35 99.99% ideath remailer(a)ideath.goldenbear.com +****++*-.+* 2:32:19 99.99% chaos remailer(a)chaos.bsu.edu *******#**#* 1:48 99.99% leri remail(a)leri.edu *****-**+*-* 56:05 99.99% alumni hal(a)alumni.caltech.edu -*********** 13:07 99.91% soda remailer(a)csua.berkeley.edu +++++++... 5:41:04 99.97% portal hfinney(a)shell.portal.com -*********** 13:01 99.87% extropia remail(a)extropia.wimsey.com ++-- -++++++ 1:22:57 99.73% underdog lmccarth(a)ducie.cs.umass.edu ***** 3:43 99.59% vox remail(a)vox.xs4all.nl ---.. --.- 11:04:20 99.50% rebma remailer(a)rebma.mn.org --*-----+- 6:19:39 99.77% penet anon(a)anon.penet.fi ************ 2:02:48 98.91% jpunix remailer(a)jpunix.com *** *-** #** 7:34 98.87% desert remail(a)desert.xs4all.nl ..--.- ---- 25:55:50 81.03% usura usura(a)xs4all.nl ***** **+* 8:54 79.30% Suggested path: c2;bsu-cs;wien For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. special Accepts only pgp encrypted messages. History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). If you've got a Web page, please feel free to include a link to this page. If you think your Web page is relevant to the subject of remailers, let me know and I'll link it in. Comments and suggestions welcome! Note to remailer operators: this script generates hourly ping messages. If you don't want that, let me know and I will take your mailer off the list, or increase the interval between pings. Raph Levien

1 0

FOUR TIMES AROUND THE WHEEL
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Today is my birthday. I've circled the Chinese zodiac four times--from Year of the Dog 1946, to Year of the Dog 1992. This has not been a good year. Write something nice to me. I need all the encouragement I can get. S a n d y "The Old Dog" S a n d f o r t ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re: DC-Nets and sheep
by doug＠OpenMind.com 17 Dec '03

17 Dec '03

Rishab Aiyer Ghosh <rishab(a)dxm.ernet.in> writes: >Doug goes on to suggest that to be immune from the "sheep^H^H^H^H^Hpeople" >DC-Nets will have to have millions of members. But if anon remailers were used >by millions, than they'd be immune too. All crypto is vulnerable to mob action >until it's widespread. I think that there is an important difference between the case of anonymous remailers and DC-Nets. Even if millions of people were using anonymous remailers, it would still be the case that the remailer itself would provide a single, isolatable target for control. Although it might not be politically popular to force the remailer out of operation, the actual mechanics of doing so could be relatively simple. The strength of DC-Nets lies in their distributed nature. There is no single target for control which can be isolated from the rest. Even without millions of members, a DC-Net gains strength through cooperation... to effectively target it, all of the members of the net must be targeted in some sense. Whether the actual technology used is a DC-Net or something fairly different, the basic principle of replacing single targets with large cooperating groups seems to hold promise. Doug

1 0

art encryption...
by John Young 17 Dec '03

17 Dec '03

My recent post on use of PGP in architectural documents is limited to those produced by an all-volunteer group that provides free services. This work is often controversial and needs privacy protection. My commercial work does not yet deserve such elegant dressing. If and when it does I will relish paying for PRZ's hard work through his market channels. John

1 0

A Scenario
by Anonymous User 17 Dec '03

17 Dec '03

Anonymous User scripsit >> >> Let's say I have a digital cellular phone. I also have Anonymous Remailers, >> PGP, and over 100 BBS numbers (structured for which day and which hour each >> would be used) so that I can contact and talk to my "Friend." >> Please tell me how the LEA's can find me and understand the transactions >> between us? >You don't give us enough information. >Are your attackers looking for known parties? >How secure is your cellular? Do you operate from a known or a guessable >location? Is your "Friend" known? Suspected? His location, guessable? >Known? >If your location were known it would be a simple matter to monitor >the area, say put a van just outside your site and wait for cellular >activity of a strength that suggests your presence. How likely would it >be that someone else is using a cellular phone in your presence? Given >this, it is probably not difficult to obtain the billing/ESN number for >your phone, and then obtain detailed traffic information about your >transmissions. Given that it is a simple matter to conduct a lower tech >attack, say tempest, and pick up the conversation as you compose it, end >running the encryption so to speak. You think in too shallow a fashion. >Security is about more than communications security. >Even if yours is perfect, how about your friends. A tempest attack on >his site while he is using Word for Windows is just as effective as one >on you. >Modify this tactic to use a phone which uses several different ESN's at >random or move your location often and at random. >> >> If I have several encryption programs, can I 'layer' each document [I PGP the >> file, the I DES the PGP file, then IDEA for the final layer. >Worthless given the above attack. >> Does the NSA have to crack it one layer at a time, or can they bombard it, >> crack the layers in whatever order the supercomputer finds? >Again, unimportant given the cheaper low tech solution. >> If I am missing something, please let me know what I have missed. >Been there, did that. >-uni- (Dark) In the above scenario, I would never use my voice over the digital cellular [and I would be always moving {nothing done at home}]...strictly PGP/E-Mail. Even IF the parties are known, can they make their case? [How can they prove X sent Y if using PGP and anonymous remailers?] Of course, if one of them cooperates, that's different. Can Tempest be used as I'm driving/on a city bus? How expensive is it to maintain a Tempest surveillance in this fashion? This is a positive of portable computers and portable communications..no one can pinpoint [even remotely] where I'll compose/collect my pgp/e-mail. I am assuming that I'm covering my tracks smartly, and the only thing they have is what they can grab over the air, which is PGP, and that gets sent to some BBS [which they don't know] for my friend to pick up. The ESNs and the Keep Moving are really helpful, thanks.

2 2

Re:Profiling
by frissell＠panix.com 17 Dec '03

17 Dec '03

> In other words, your AZ tax can be based on your profile, irrespective > of your income or expenses. But the AZ D of R can't use a profile to actually *find* your money or, indeed, to determine that you are a resident of Arizona. > It's also a bit of an eye-opener to note that it is expected to > replace ID used for -other- than official business as well, like club > cards and health care access cards. If it's not in your profile or if > the money is not in your account, you can't do_it/have_it. Moreover, > you'll probably get automatically reported for followup investigation > to determine willfulness and intent. I *love* it when the government decides to use automation to cut people off from permissions/benefits if they don't "toe the line." Since I would like them to cut *everyone* off from permissions/benefits, every step closer to that situation is an improvement. Apparently, "Seaquest, DSV" had a little automated punishment example on yesterday's show. A guy on a motorbike was speeding and his plates were scanned on the fly and he was notified, while still driving, that his "Social Security Account" had been docked for some $700 in fines. Note that all they accomplish by such things is to convert people into "outlaws." If government benefits and permissions are withdrawn from you then the incentive for you to play their game is reduced. Automated punishment also weakens the hold of the government even on those who obey the law because they knwo that they can lose their government "benefits" at any time and so they value them less. In a strictly practical sense, such punishments encourage those punished to learn how to live outside the government's reward/punishment system. Note the non-compliance rates in New York City for driver's license, insurance, and registration rules. The DMV computers automatically suspend someone's license (even if he's never had one) and he keeps driving anyway. People accumulate hundreds of suspensions. DCF ************************************************************************* ATMs, Contracting Out, Digital Switching, Downsizing, EDI, Fax, Fedex, Home Workers, Internet, Just In Time, Leasing, Mail Receiving, Phone Cards, Quants, Securitization, Temping, Voice Mail.

1 0