- cypherpunks-legacy - lists.cpunks.org

Re: The Crisis with Remailers
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:00 PM 5/18/96 EDT, dlv(a)bwalk.dm.com (Dr. Dimitri Vulis) wrote: >> 2. there is no good way to deal with spams or other so-called "abuse" >Nor should there be. What's one person's abuse is another person's >free speech. Internet traffic should not be censored based on contents. I disagree - when I was running a remailer, I found several varieties of abuse, and some of them were worth blocking. Usenet, in particular, is divided into newsgroups so material can be directed to the groups where the readers want to find it, which is filtering, not censorship. * The most common was spammers sending lots of mail to a specific person who didn't want it; that's easy to block, and keeping up with that was a major part of traffic on the remailer-operators news groups. * Another was spammers who were sending out large volumes of spam; my remailer would shut down if it got too much volume (operator-settable), but usually I blocked senders like this based on remailer-operators notices from other remailers that were being spammed through. * Another was inappropriate news postings; most of the complaints I got were from phone sex ads in the pictures newsgroups, where they're unwanted (as opposed to misc.forsale or other group where they're in scope). They're a minor annoyance, and I didn't censor them; there'd probably be less of them from 2-way remailers, since people who objected could spam back. In general, these were posted to many newsgroups, and reducing the number of newsgroups that a message could be crossposted to would probably have helped, though it might have just resulted in multiple postings. * The nastiest spam, which I wasn't able to block, was to sign someone else's name on flamebait hate postings. Blocking by content (e.g. blocking postings with the address of someone who had complained) would cut down on repeat postings, but it only takes one or two postings to get thousands of flames sent to the victim. The damage could be reduced by putting disclaimer notices at the beginning and end of the text, reminding the reader that it may be a forgery, etc.; simple mail headers don't seem to get the attention of enough readers, even those whose newsreader software doesn't discard them. Similar spams can be done to mailing lists... # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: Rumor: DSS Broken?
by jim bell 17 Dec '03

17 Dec '03

At 08:33 AM 5/19/96 -0400, Robert Hettinga wrote: >At 9:41 PM -0400 5/18/96, Bill Stewart wrote: >> MD5 is at least weakened, maybe broken; there's an abstract by Hans Dobbertin >> that says something about generating collisions, and gives an example >> (though the abstract doesn't say how general the method is.) > >That's what I get for not reading the DSS stuff when it came out. I'd heard >lots about the MD5 stuff, but I didn't put the two together. > >It also looks like I'm behind in my reading. Time to buy another edition >of Applied Cryptography... It should occur to all of us that if the NSA was actually doing the job we are vastly over-paying them to do, it is THEY who should be finding, exposing, and correcting these kinds of cryptography faults. Has anybody ever heard any evidence that the NSA has ever acted in this sort of responsible role? Another question: If the government provided DSS, and it's now toast, and it provided Clipper... Somebody ought to ask The Wicked.... er... Dorothy Denning how she thinks we should be willing to trust the government's vetting of anything like Clipper when DSS may be flawed...and the government didn't find the error! Think about it. Jim Bell jimbell(a)pacifier.com

1 0

New Remailer (hidden)
by middle-man-admin＠alpha.c2.org 17 Dec '03

17 Dec '03

NOTICE: A new type of remailer has just gone into business! It's called a "hidden remailer-in-the-middle". The address is middle-man(a)alpha.c2.org. This new type of remailer uses a combination of Lance Cottrell's Mixmaster remailer and Raph Levien's premail program. Advantages: * The remailer is completely hidden. Attempting to discover the actual identity of the remailer site is virtually impossible. * The remailer uses both Type-I and Type-II remailer technology for handling remailer traffic. * Random remailer chains are selected separately for every outgoing message. * The remailer is designed to answer to a chained nym. * All Mixmaster administrative commands are also chained through multiple remailers. (i.e. remailer-help, remailer-key) How it works: The actual address of the remailer is hidden behind a chained nym. The plan is for the reply-block for middle-man to change approximately every 48-72 hours. This will be transparent to the net but will help to foil traffic analysis. The new remailer operates under a modified Mixmaster. The code has been modified so that outgoing messages are passed to premail to allow padding of extra remailer chains. Each outgoing message will have two type-I remailers randomly padded to the end of the chain based on the current status od Raph Levien's remailer reliability list. If you have any questions or would like more information, please contact middle-man-admin(a)alpha.c2.org. middle-man-admin(a)alpha.c2.org

1 0

Virtual machines?
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Hi. Pardon my ignorance, but I had a few questions haunting me since a while. Is there a way to have a remailer de-localize itself and relocalize itself over the internet? For example, could there be several machines around the worlds that, when you send an e-mail to it, is routed to differents physical places of the world depending on where the actual remailer process is actually running? Could there be such a thing as a virtual machine runing a remailer that gets to hop from physical machine to physical machine around the world? Just an idea to avoid jurisdiction problems. Just asking, probably quite futilely... Thanks JFA DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal JFA Technologies, R&D consultants; physists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

2 1

Re: Rumor: DSS Broken?
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:05 PM 5/19/96 -0800, Jim Bell wrote: >It should occur to all of us that if the NSA was actually doing the job we >are vastly over-paying them to do, it is THEY who should be finding, >exposing, and correcting these kinds of cryptography faults. They may have; they're just kind of selective in who they expose them to :-) Also, there are expert cryptographers outside the NSA, and outside the US; you might check where Dobbertin lives. And this is a Good Thing. >Another question: If the government provided DSS, and it's now toast, SHA-1 isn't toast; it's MD5 that might be at least a bit crunchy. (The NSA gave us SHA, and later added a correction that appears to make it stronger, unless there's something really subtle and nasty inside.) DSS isn't toast either, though the subliminal-channel stuff makes it necessary to look very carefully at any applications to find out what else is being done with them, which you can't always do. One of the purposes of DSS appears to be that it provides signatures without providing encryption, so the Feds can trust the Public to have it. Except of course that subliminal channels _do_ toast that part of it. On the other hand, NIST has been saying that DSS isn't covered by any patents, which the PKP folks had some very negative, skeptical comments about, before PKP fell apart; it probably still is covered by the Cylink/Stanford patents until they expire next year, though it's not covered by RSA. The patent licensing hassles probably have kept a lot of people from using it, except for specific sales to the government. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: SEVERE undercapacity, we need more remailer servers FAST
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"llurch(a)networking.stanford.edu" "Rich Graves" 18-MAY-1996 09:07:35.05 >On Thu, 16 May 1996, Bill Stewart wrote: >> ================================================================== >> This message was posted from the anonymous remailer at www.jim.com. >> Send any complaints to webmaster(a)www.jim.com . >> Please don't post any copyrighted material longer than fair use quotations. >> And did you know that Scientology's highly overpriced documents say that >> "<random paragraph quotation>" >> =================================================================== >Once I was more or less done laughing and got off the floor, it occurred >to me that this could provide a revenue stream for anonymous remailers. >You'd charge advertisers sub-pennies for these little trailers. I >understand that Sameer is getting very little Ecash for his >remail/by-www.html, but maybe if he sold advertising space? It's an interesting idea. One wonders if EFF would be interested in such a sponsorship? One could even add, say, an ACLU promotion to the end of messages without getting cash from the ACLU - this might encourage them to give more backing in case of a legal dispute. (You scratch my back, I scratch yours... I'm not meaning to be offensive to the ACLU, BTW.) -Allen

1 0

5 MINUTE CYPHERPUNKS SURVEY
by Sally D. McMillan 17 Dec '03

17 Dec '03

Hi! Im writing a paper for school on E-commerce and would like to include a brief section on the role of Cypherpunks in E-commerce. If you would, please email me your responses to the following questions. Some of these questions are broad, but please limit your response to each question to 0-100 words. Also, I am NOT attempting to stereotype the Cypherpunks, but am instead interested to learn whether there is a shared view among them. THANKS! PS- PLEASE RESPOND TO MY EMAIL DIRECTLY by FRIDAY, 5/24/96 : 103007.3426(a)compuserve.com 1. Would you call yourself a Cypherpunk? (Y, N, Not Sure) 2. What is the role of Cypherpunks in the DEVELOPMENT of secure E-commerce transactions? 3. What is the role of Cypherpunks in the MAINTENANCE of secure E-commerce transactions? 4. Why do Cypherpunks care about E-commerce? (Please limit to 100 words or fewer.) 5. What is a punk? What is a Cypherpunk? Can you distinguish between those who are up to no good, trying to crack security and those who try to crack security in order to maintain it? Do Cypherpunks, in your opinion, fall into either category? 6. What is the greatest security threat to E-commerce transactions? 7. On a scale of 1-10, how dangerous is it to give your credit card number to a vendor over the internet? (Please provide one number only for this answer.) 8. On a scale of 1-10, how would you rank your own knowledge of E-commerce and related security issues? (Please provide one number only for this answer.) May I quote part of or all of your answers in my paper? Would you like to be referenced by name, email address, or as Anonymous? Please provide pertinent details. THANK YOU FOR FILLING OUT THIS QUESTIONNAIRE! Please forward your responses to me at: 103007.3426(a)compuserve.com

1 0

Re: New Remailer (hidden)
by Bill Stewart 17 Dec '03

17 Dec '03

Cool. I've got a test message going now. Does your remailer accept PGP-encrypted email? It's really critical for high-security applications, at least for first remailer hops, but your key's not on the MIT keyserver. BTW, how do we know you're not a plant? :-) Aside from having an interesting nym, you've probably got the first remailer that makes it difficult to tell who's running it. You could be Sameer, or you could be Louis Freeh, but we don't know. At least folks like Xenon were known to be real people.... Even if you _are_ a plant, of course, we can still use your system, but I'd want to do encrypted email through other remailers on one end or the other. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: Why does the state still stand:
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"jimbell(a)pacifier.com" "jim bell" 18-MAY-1996 02:54:47.09 >On the other hand, the government also has enormous "obligations" that keep >it close to bankruptcy. It wouldn't take a great deal of interference in >its ability to collect taxes to put it solidly in the red based on current >receipts. And remember, if the individuals who populate government could be >persuaded that their tenure would be forcibly shortened if they didn't >resign, they wouldn't stick around. Once that cohesiveness of jointly >sucking on the government tit is eliminated, I think they'll cut and run. >These people are working for a fat paycheck and the promise of a retirement >package, and it wouldn't take much convincing to show them that they won't >get either for very long. I'm convinced that's why so many Senators and While quite a lot of people in the government are working just for the paycheck, there are also some idealists - and some who are working for a "power paycheck" rather than a "cash paycheck." I'm willing to bet that that's the case with the NSA and its _general_ opposition to cryptography. You'll have three basic groups: A. Those who are idealists. This can be divided into two categories. 1. Those who idealize the power of government, such as via a devotion to democracy. These oppose cryptography because it weakens the government. 2. Those who are primarily interested in protecting America from everyone else. These promote cryptography, and need to be supported. 3. Those who (stupidly) believe in the US government enough to "just follow orders," as the Nuremberg phrase goes. If you can get the type 2 idealists in power, these will do the right thing. B. Those who want power. These oppose cryptography because they will lose power if it is widely implemented. C. Those who are just there to get a paycheck. These will act in most situations about like an idealist of type 3, but when push comes to shove won't be willing to back it up seriously. I'd appreciate feedback from anyone who's dealt with the intelligence community more than I have (not particularly difficult) to confirm or deny the above classification system, and give some idea as to the proportions within the NSA, government in general, etcetera. -Allen

1 0

Re: The Crisis with Remailers
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"loki(a)infonex.com" 18-MAY-1996 20:02:12.04 >I was invited to the digicash API design meeting precisely to make sure it >could be used in remailers. It will not be using the current API. The >problem is that Mixmaster requires exact knowledge of the size of every >object in the message, to maintain constant message size. I could set aside >room for one, two, three coins, but there is no guarantee that the payment >will be made with only that many coins. The current API is going to be high >level. It will does not allow the program to know anything about the >internals of the payment. I need to be able to specify payment of amount X >using no more than N coins. As soon as I have that level of control, you >will see postage in Mixmaster. Good. I can see doing a limited postage now, actually, with relatively simple modifications - the postage goes to the initial remailer front end and to the remailer that sends out the message to something other than another remailer. -Allen

1 0