- cypherpunks-legacy - lists.cpunks.org

Re: Exporting cryptographic materials, theory vs. practice
by Lile Elam 17 Dec '03

17 Dec '03

But what if that plane crashed... It's better to spread people out over several flights... -lile

1 0

Anonymous payment scheme
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This idea just popped into my head, just as I was about to fall asleep. Being the idiot that I am, I had to get up to write it down. This idea has probably been presented before...but I haven't seen it here yet. Let's suppose myself and 10,000 of my closest friends form the First National Cypherpunk Bank and Trust. We go through all of the hassles in order to be the issuer of a Master Card or Visa. Now instead of having a credit line, it is set up as a debit card. The card's limit is how ever much you have prepaid the bank in advance. Once you have hit your prepaid amount the card no longer gets approved. Now because everything is prepaid, there is no risk to me, so I'll put any name you want on the card. The questions I have are: Is this legal in the U.S.? If so, is anyone doing it? If it's not legal in the U.S., is it legal anyplace else. If this is a gray area, why wouldn't this scheme work? If this scheme was set up, it appears to me that the infrastructure for anonymous payments/netcash is already in place. Of course the issuer would get a healthy fee for issuing the card...but then again, there truly is no such thing as a free lunch. As my 10,000 friends and I have no plans to set this up, feel free to pick it apart at will. (which I'm sure it will be) Sam ============================================================================== There is an order of things in this universe. -- Apollo, "Who Mourns for Adonais?" stardate 3468.1 ============================================================================== skaplin(a)skypoint.com | Finger skaplin(a)infinity.c2.org for | a listing of crypto related files PGP encrypted mail is accepted and | available on my auto-responder. preferred. | (Yes...the faqs are there!) | E-mail key(a)four11.com for PGP Key or | "...vidi vici veni" - Overheard Finger skaplin(a)mirage.skypoint.com | outside a Roman brothel. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLwe/6clnXxBRSgfNAQGZBAf9FAHHsI63OJ1uQo4SGAggs6Mk7BAe8Ysm oxibQfvNMN0dSPdyLjHutEm5/rtyTrRjU731QRQSDLUi0LSC9I0N5/cQsGeI+VV8 kAIiuHDq1eF4oZmZTuKIcKz42THliSAhSTkmpL8dZvcU3sJVPwIfGK5dNbQyUQHw J33h74Vg1jRIkeoodnAtTXPeUKi5HkcAp95zt8C/tGpke4+fx8QhqHSAvJgJoGdL a8clRTdilqwDfrdQlpgKHt33T5aLiYuQA8m9NpMiDKw/wEF+XvMrHYrksIUyQ2ZD gllxFl0WJcarRZTnIgtgAdA+hzQCbkfG10kcZUVTzquGcrgiKnp9ug== =l5Mr -----END PGP SIGNATURE-----

9 10

Re: Exporting cryptographic materials, theory vs. practice
by Marc Horowitz 17 Dec '03

17 Dec '03

>> My conclusion from all this is that it just isn't possible for an >> individual traveler to follow the rules. I can think of a at least half a dozen cypherpunks who will be going to IETF in Stockholm in July. I suspect there are more. Perhaps we should all arrange to take the same flight, while carrying some bit of approved-for-export material. Should drive the Customs guys completely nuts. Marc

6 5

EVEN MORE creis for regulation
by Nesta Stubbs 17 Dec '03

17 Dec '03

Yet ANOTHER call for net regulation. There are so many now I am hard pressedto keep track of them. It appears that the media may adopt "regulation of the Internet" as it's next babe. Ya know how the adopted the Internet itself first, now watch as the entire mainstream media is flooded with calls for net regulation. Bigots' Growing Use Of Computer Networks Assailed The Simon Wiesenthal Center on 12-13-94 sent a letter to Prodigy protesting bigots online messages of hate. Rabbi Abraham Cooper of the center decries the growing use by hate groups. The Wiesenthal Center wants government policing of the internet. They fear one-sided exposure of youths to white supremacist messages. Civil libertarians and white supremacists say that free speech should prevail. Marc Rotenburg of the Electronic Privacy Info Center says that it's a difficult issue and that censorship and control are ver y inappropriate. White supremacist groups like the National Alliance and the American Rennaisance can spread propaganda nationwide. These types of hate groups are kept out of mainstream media and are thus short of funds. Valerie Filds of West LA said she saw an anti latino diatribe on Prodigy that plugged American Rennaisance of Louisville KY. She says she saw a message that seemed to be from a white supremacist group. She says she saw one referring to the "Diary of Anne Frank" as a "Jewish Hoax". The Wiesenthal cente r wants such messages deleted. Anti-semitic comments on Prodigy in 1991 resulted in a policy prohibiting "blatant expressions of hatred". Kevin Strom, who produces a radio show for National Alliance, said he was recently blocked from forums on Compuserve. He said that "the system operator decided we didn't deserve free speech." His article "The Wisdom of Henry Ford" about the book "The International Jew" was downloaded 120 times. Georgia Griffith of Compuserve said "we are not oblidged to publish it for him." There are 5 m subscribers to commercial online services, 2 m to Prodigy, 20 m accessing the internet. Rabbi Cooper wants the FCC to place a cop on the internet. White supremacist propaganda is available on the internet. The Institute for Historical Review's article "Frequently Asked Questions about National Socialis m" is available. Far-right activists say anonymity removes inhibitions too. The National Alliance uses Netcom Online Communications Services in California. Texts and promotions of its radio show are available there. National Alliance chairman William Pierce said "The major media in this country are very biased against our political point of view. They present us with ridicule or in a very distorted way. The information superhighway is much more free of censorship."

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut post ek"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)replay.com> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; $remailer{"q"} = "<q(a)c2.org> cpunk hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 2 Jan 95 6:00:02 PST remailer email address history latency uptime ----------------------------------------------------------------------- nately remailer(a)nately.ucsd.edu +++++++++++* 32:53 99.99% mix mixmaster(a)nately.ucsd.edu +++++++++-+ 41:39 99.99% rahul homer(a)rahul.net --***#***#** 9:40 99.98% penet anon(a)anon.penet.fi ********+*** 26:09 99.99% vox remail(a)vox.xs4all.nl .-..------- 12:53:05 99.99% soda remailer(a)csua.berkeley.edu .-.._-.-.. 8:50:49 99.67% usura usura(a)replay.com *****+- -- * 22:53 99.33% flame tomaz(a)flame.sinet.org ** *-*-*-** 32:52 99.09% jpunix remailer(a)jpunix.com ** *-#-*-** 32:26 99.06% c2 remail(a)c2.org --__.-+*--** 2:50:57 98.95% rebma remailer(a)rebma.mn.org ---*----* 7:52:32 99.27% ideath remailer(a)ideath.goldenbear.com ++* ++** - 2:09:26 98.05% bsu-cs nowhere(a)bsu-cs.bsu.edu +* --#+##** 1:40:45 96.01% q q(a)c2.org --_ . --+ 6:03:15 92.56% alumni hal(a)alumni.caltech.edu *****#*++ *- 27:00 89.60% portal hfinney(a)shell.portal.com #*#**#*** *- 21:31 89.60% extropia remail(a)extropia.wimsey.com +.-+* +++ 12:38:44 77.66% xs4all remailer(a)xs4all.nl *** *-- 20:22 75.57% desert remail(a)desert.xs4all.nl ----____.-- 40:43:30 71.96% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Comments and suggestions welcome! Raph Levien

1 0

(Fwd) Re Anonymous posting
by John Young 17 Dec '03

17 Dec '03

For those interested in the anonymity issue there is a lively debate on list Cyberia-L (a legal list) which was stimulated, in part, by Peter Lewis's articles on anonymity and the LaMacchia case dismissal. For participation send message to: listserv(a)listserv.cc.wm.edu subscribe cyberia-l Your name Provocatively, I forward the following: Forwarding mail by: jsilverm(a)reach.com (Jared Silverman -- NJ Bureau of Sec. - Newark) on Mon, 2 Jan 11:58 AM ------------------- On January 1, 1995, Buford Terrell wrote: >Anonymity is very much a core 1st Amendment value and at the >center of both political speech and the right to assemble. [Snip] >Often times, the only way weak or unpopular minorites can speak >is anonymously. There have been many times when to couple one's >name to one's writings would be to invite martyrdom. I had >rather risk a few perverts than to stifle this most important >channel for dissent. It is one thing to claim First Amendment protection to shield political speech, IMHO it is another to shield fraud and criminal behavior. Besides the First Amendment runs against the government, not in favor of individuals in actions brought by private parties. In the sexism thread, would anyone claim that an individual has the right to harass or stalk a person under the guise of the First Amendment? Would the First Amendment be a defense in a defamation suit? Of course not (Times v. Sullivan aside). Doesn't an individual have the right to know the identity of someone who is trying to communicate with him/her on a private basis? To a certain extent, the question was crystallized in the caller ID debate -- Who has the superior right, the calling party to anonymity or the called party to knowing who is calling? One of the areas of my professional concern is the use of cyberspace for securities fraud and manipulation. Cyberspace is an ideal medium for these activities because of the availability of anonymity and pseudonymity. Even on commercial BBSs, where "member lists" are available, posting to these lists is voluntary and those who draw my attention are rarely on these lists. Does all of cyberspace become off limits to conventional private rights and law enforcement under the rubric of "freedom of speech and assembly?" |--------------------------------------------------------------| |A. Jared Silverman, Chief-New Jersey Bureau of Securities | |jsilverm(a)reach.com | 201-504-3600 (phone) | 201-504-3601 (fax)| |**************************************************************| | My purpose holds to sail beyond the sunset - Tennyson | |**************************************************************| |The foregoing is the personal opinion of the sender and is not| |the official position of either the Bureau of Securities or | |the New Jersey Attorney General and the Department of Law and | |Public Safety. Affiliation given for identification only. | |--------------------------------------------------------------|

1 0

Re: Exporting cryptographic materials, theory vs. practice
by nobody＠rahul.net 17 Dec '03

17 Dec '03

Matt has a good story, and the lesson that he draws, that presently the average person can't follow the rules, seems valid. But I don't see the point of the proposals to replicate his experiment. Doesn't Matt's experience really show simply that not enough people try to follow the rules, so the agencies aren't set up yet to make it easy? Is it our goal to change this, to get Customs to streamline their operation so that everyone really does register their crypto equipment on travels overseas? It seems to me we are better off with the present informal system where you can actually use crypto overseas without worrying much. I could see a system where you routinely fill out and have your card stamped when you check your luggage to show that you are carrying crypto. Then you turn it in when you come back. This might not be too different from what you do now when you declare items you are taking out and bringing back to show they are free of customs duties. How does this advance the CP cause?

2 1

RFC: Key Capture Utility Survey
by KEY-CAPTURE＠lsd.com 17 Dec '03

17 Dec '03

REQUEST FOR COMMENTS ON KEY CAPTURE UTILITIES --------------------------------------------- Key capture utilities present a serious threat to the security of passwords on individual and networked computing systems, especially when novice users are unaware of their presence. Well-educated users and administrators help make all systems on and off the Internet more reliably safe for everyone's data. If you are a: -- privacy, system security or cryptography advocate/activist -- network admin concerned with the password-hygiene of your users or -- computing professional with an appreciation of good security, then please complete and return this quick survey. By contributing to the knowledgebase on the subject of password protection, you can help educate yourself and many novice/intermediate users about a common weakness -- utilities that may capture their keystrokes unseen as they enter their *password* -- in ALL secured systems (a user's encryption app, your network or its dial-in access, your company's email system or database fileserver, etc.). The intent here is to create a *central list of all key-capture utilities* which will help people to at least be aware of their existence or operation on a given system and describe in simple terms how to disable the utility. The results of the survey will be tabulated and put in the public domain on the Internet. If your reply is included, your name will be acknowledged in the resulting document, which will be: part of the new "Beginner's PGP FAQ" for new users of the PGP (Pretty Good Privacy) application; a msg posted on various Internet lists and online services and; a text file available by anonymous FTP as: ftp.netcom.com:/pub/dd/ddt/crypto/crypto_info/key_cap_util.txt Please forward this survey to anyone you think can/will help - and thanks in advance for your contribution! _______________________________ THE KEY CAPTURE UTILITY SURVEY: The survey is very easy to participate in. Just send as much information as you can, even if you're only partially able to complete the form. Every piece of information that can lead us to the utility - even just a fragment of a name and an email address of someone who might know more about it - will help us compile a fairly exhaustive list. To assist us in easily tabulating the incoming mail on this topic, please send your reply to: - - <KEY-CAPTURE(a)lsd.com> - - Format your answer as follows: ******* PLEASE RETURN ONLY THIS INFORMATION ******* TO: KEY-CAPTURE(a)lsd.com SUBJ: PLATFORM/Utility Name MSG BODY: [1] OPERATING-SYS <--- i.e. WIN/DOS/MAC/OS2/UNIX, etc. [2] "Utility-Name" (utility-package-name, if not a stand-alone product) [3] Developer-Name (company-individual) [4] <developer-email-address> [5] Type <--- i.e.: system extension, autoexec, TSR [6] Path-to-file-location-when-loaded. [7] How to disable the utility's key capturing operations (step-by-step if possible). Please be brief, but aim for a novice level user. If disabling the key capturing is too complex to describe easily, then just explain what the user should ask a sys admin to do for them (while they watch, if applicable). *************************************************** (Here's an Example:) SUBJ: MAC/Now Save MSG BODY: [1] MAC [2] "Now Save" (Now Utilities v5.x), "NowSave" (Now Utilities v4.x) [3] Now Software, Inc. [4] <support(a)nowmail.nowsoft.com> [5] System extension/Control Panel device (CDEV) [6] [startup HD]:System Folder:Control Panels:Now Save (or :NowSave) [7] How to Disable: Open the "NowSave" (v4.x) or "Now Save" (v5.x) Control Panel. v4.x: Click the "Preferences" button. Click the "Key Capture..." button. Click the "OFF" radio button (upper right corner of dialog). Click the "OK" button. v5.0: Click the "Key Capture..." button in the button-bar. Click the "OFF" radio button (in upper right corner of dialog). Click the "OK" button.

1 0

Reminder: January 14th "Tools Demo Day" Meeting
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

This is a reminder that the January 14th "Tools Demo Day" meeting is coming up, standard place and time at the Silicon Graphics building in Mountain View, CA. I described this several weeks back and asked for folks interested in demonstrating any sort of software tools, crypto code, languages, etc., to get in contact with me. One person, Henry Strickland (Strick), has done so. In any case, the meeting will go on. I'll have my PowerMac 7100 there, and will demo some things like Mathematica, SmalltalkAgents, MacPGP, etc. An SGI Unix box is of course available. An Intel box running something of interest will presumably be brought by someone. Anyone planning to demo something should either plan to run on a machine they know will be there, or bring their own. A video projector is sometimes usable, and I plan to bring my video camera. The idea is that laptops and other non-video out systems can still be seen by lots of folks. (Someone mentioned also that an LCD projector may be available.) The normal meeting time is 12-5, but people usually spend the first hour shmoozing and eating their burritos, so I plan on starting the formal meeting at 1 (but don't get there at 1 and _then_ expect to shmooze/eat for the next hour!). The machines should be ready to go by 1:30 at the latest, so that demos can begin. If we have a lot of demos--not likely based on current information--then I'll propose parallel tracks. Please don't be bashful about doing a demo! The idea is to educate and expose people to tools and software they might otherwise only vaguely know about. Demos don't have to polished and professional. And please send me a brief note if you want to demo something. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

1 0

RE: Reminder: January 14th "Tools Demo Day" Meeting
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Some may recall an idea I wrote about a couple weeks ago to provide transparent encryption/signing/remailing facilities to users of Windows Sockets based mail agents on PC's (e.g., Eudora). I have completed an initial portion of the program as a "proof of concept." All it does right now is act as a SMTP server and accepts mail from a mail agent, performs requested encryption/signing operations on received messages, and puts RFC 822 compliant outbound messages in a directory for submission to a 'real' SMTP server. (No remailing features present). Of course, the next module to write is the SMTP client that takes this outbound message queue and sends it off to the actual SMTP server. It is a bare bones app with no user interface, fault tolerance, or configuration options, and probably only works on my machine at the moment :) I don't expect to make any significant progress on the program between now and the Jan. 14 meeting, but if anyone is interested I will bring it to the meeting and "demo" what little there is at the moment. == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)scruznet.com -Isaac Asimov WWW: ftp://ftp.netcom.com/pub/jc/jcorgan/www/homepage.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLwhxw+lPfVlQ1n99AQH6CAf8DJmXqtuP24C39k3/qk4mRuGxm4IehWdQ zdFjTgrzMuTXuM4SOtkV1k+JGZrjAW5G+tqiNLbNHDDzCWC/75G/8HMjUdWMSINq gOHXUl3oKtm6R27ClGhIZKuWJwLF0UH4XpUDWvawj5lFdWhKmSThuuF3WG1RKivQ PZjRh6Iq7wHf9wFI+rFRi8UHu311ZcyW4jR4h5R7siFeTd9GcBCEJ9CCQy+j+Vsu AbplhNZVztooLVitsAkYdcNu2gcAdun5u7WOPuEIM/Mwsokg53z4+AoUrYCkjqmu sqeAVr/S+1fwKXjMTSxt7qpIEUkErzTzhgQeQgLWYcUcnHg71A8AiA== =rOcl -----END PGP SIGNATURE-----

1 0