- cypherpunks-legacy - lists.cpunks.org

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

"So meanwhile, are you giving root(a)netcom.com permission to try to identify the source of your mail and win the $20 for finding out whether you're really Xenon or you're really L.D.'s evil twin Skippy?" I have no answer to that. I don't know what "permission" means in this context. I never discluded Netcom employees though. I doubt they would wish to appear to have lax security by posting the answer though. Does L.D. have an evil twin? I hope he doesn't get a Unix account. Seriously, your comments were the first I've seen that really explain to me what sort of security problem a Netcom remailer faces. Now then, I ask you as well, might you fill in a few of the blanks in the remailer list I posted. I could send it to you if you missed it. What are the "serious" remailers, do they keep mail logs, and are they reliable? -Xenon

1 0

Re: anonymous mail
by IGOR 17 Dec '03

17 Dec '03

If there is an admin above him, speak with that admin, also mail cert(a)cert.org and mail the nsf explaining to them what has been happening, or mail kfithen(a)cert.org She is a really nice lady, and she could help you on this. If all else fails, do that and send the fakemail...if you are sure that you wont get caught. Bob \//// (0 0) *------------------------------oOO--(_)--OOo---------------------------------* | Bob Christian II "IGOR" * Internet:Christi1@muvms6.mu.wvnet.edu| | Marshall University ***** E-Mail: Christi1(a)muvms6.wvnet.edu | | Huntington, WV * GET HIGH....LEARN TO FLY! IP-ASEL | | Student/D.J 88.1 WMUL FM * Major:Undecided(CJ/LAW) Minor:AVT | *----------------------------------------------------------------------------* --I love flying because there is no speed limit(^10k) and Radar is your friend! --Marshall assumes no libility for what I say, because my words are MINE!

1 0

Re: New server up.
by pgpkeys＠wasabi.io.com 17 Dec '03

17 Dec '03

PGP Slave, I hear and obey O Master. Could you please announce my full name, phone number, address, visa card number, a giff of my signature, height, weight and driver's licence number not only to the Cypherpunks mailing list but to many usenet groups as well, If you insist :-) (Can you give me a few more days to comply?...I`m having some trouble getting a copy of your signature. One of the guys in the chem faculty says he knows where he can get one at the weekend...) since you obviously feel I no longer wish to be known to the masses as Xenon, and I instead want them to start calling me and postal mailing me asking for copies of PGP. Thanks asshole. I thought the people on this list were concerned with privacy, but I was wrong. I mention Xenon in my personal .plan, but I ask people to let me keep the small amount of extra privacy I still retain. Hey bud, you`ve clearly misunderstood the whole point of the movement. You get whatever privacy you can make for yourself through technology. Any dolt who goes to the extent of using two remailers and a penet id to hide his identity then puts his nym`s secret key in his True Name signature file gets the privacy he deserves. Anyway, whats the big deal?...noone who read my post will have a clue who you are unless you tell them yourself; and anyone who could track you down from the two bits of info in that post is more than capable of tracking you down the same way I did from the public logs on netcom. I was just waving enough of a red rag at you to make the point forcefully... (remember your the one arguing against putting delays more than 15 minutes in a remailer system...) The point I was making was that you cannot rely on trust such as a lack of logs alone to keep things like remailer chains secure...you *have* to build the security into the technology and the protocols. You must assume that The Bad Guys (tm) have full access to all the logs of all the machines that run remailers...if not directly then by watching the wires. So any remailer scheme has to include dummy traffic, significant delays, and encrypted input way back at the sender`s end. And the protocol has to be such that a remailer chain is as strong as its strongest link, not as weak as its weakest link, meaning if 9 out of 10 remailers have been compromised but the 10`th is run by Honest Joe, then Honest Joe`s trustworthiness is sufficient to defeat the evil forces of TBG with there 9 bogus servers. You wrote, "qwerty account or not, the public logs on netcom show more than enough info to trivially track people down." Trivial? And so you hack out the info that a message went from remailer A through qwerty and on to remailer B, at a certain time. You haven't tracked down anyone my friend. Yo dude, I found *you* didn`t I? And it took me less than 5 minutes. So bite me. PS How to build your own mailer logs on netcom...just stay on long enough and keep typing `mailq`...no problemo...I can`t be bothered but if I could thats how I`d track traffic through qwerty for your $20...

1 0

Re: Archiving mail-lists...
by Matthew Bernardini 17 Dec '03

17 Dec '03

What do you call 1,000 copyright lawyers chained to the bottom of the ocean ? 1)A good start. 2)A drop in the bucket. 3)A boring Swim Party. I can't take five hundred messages in a week from people calling each other names and including 500 lines of previous posts !!!! Give my mailbox a rest, eh ?

1 0

Re: New remailer up.
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ndw1: mail qwerty(a)netcom.com Subject: Re: new server up. :: Request-Remailing-To: cypherpunks(a)toad.com (Skip to end for actual remailer discussion.) PGP Slave, "If you insist :-) (Can you give me a few more days to comply?...I'm having some trouble getting a copy of your signature. One of the guys in the chem faculty says he knows where he can get one at the weekend...)" Thanks again. Now everyone knows to never tell YOU any secrets, no matter how trivial they might be, since you will post them. Who's the 'punk? and, "Hey bud, you`ve clearly misunderstood the whole point of the movement. You get whatever privacy you can make for yourself through technology. Any dolt who goes to the extent of using two remailers and a penet id to hide his identity then puts his nym`s secret key in his True Name signature file gets the privacy he deserves." I'm not sure you understand what -----BEGIN PUBLIC KEY BLOCK----- means. Or were you fingering someone else? Am I missing something? I am using two remailers to help out with the lack of traffic, not to hide my identity. There are many levels of privacy, and the one I am concerned with does not involve anything other than that Usenetters who are NEWBIES being forced to contact me via e-mail. It also involves not having the people I work around who are not my close friends gossiping about, mindlessly, about "what I am trying to hide" with my use of PGP. This is a personal thing, and using a nickname on Usenet is as strong of security as I need to meet this need. When I joined this list and started using Cypherpunk remailers I decided to not maintain my anonymity in a vigorous manner. I think you are trying to show off what a super hacker you are by typing "last qwerty", or even just "finger qwerty" from outside, to see my local site that I telnet in from, then typing the master-hacker magic-line "rusers my.site". I am impressed that you too can type these commands, and you get the Xenon Hacker God Award for the entire year of 1994. However, I would rather talk about remailer security levels than trying to cope with someone embarrassing themselves posting their "discovery" of my "real identity". I am not "hiding my identity", I am maintaining a minimal amount of PERSONAL privacy, at a security level that fits my needs; I am using a NICKNAME. For this purpose, qwerty and catalyst serve me well. I'm not sure why you have so much fun disrespecting a person's privacy. I arrived here with a simple question, "Can I use your remailers for bulk mailing of 1-3MB a day to people wanting the PGP FAQ and MacPGP Guide? What are the qualities of each remailer?" I think I understand the movement quite well, but I understand there IS NO fully secure remailer network which I would bet my life on. And I understand and am acting upon what few seem to care about, which is getting a large number of people outside of the internet-skilled culture using secure encryption. There are 50-100 million Mac and Windows users, and the majority of those with a modem use their internet connection for simple e-mail ONLY. Many only HAVE e-mail in fact. PGP has mass media attention, but very few are using it since they can't get it by a 1-800 number. I hope ViaCrypt will change this, with Mac and Windows versions. -----BEGIN REMAILER DISCUSSION BLOCK----- and, "logs on netcom. I was just waving enough of a red rag at you to make the point forcefully... (remember your the one arguing against putting delays more than 15 minutes in a remailer system...)" Finally we are talking about remailers! Thank-you. My telnet log is public. Netcom's sendmail logs are not (?). There IS a difference. I was arguing against long delays, which should only be needed if no baseline traffic is going on. Many people will not be able to function well if say, mail is batched out at midnight. Rapid two-way communication is very important these days in getting ANYTHING done, be it above ground OR underground. and, "PS How to build your own mailer logs on netcom...just stay on long enough and keep typing `mailq`...no problemo...I can`t be bothered but if I could thats how I`d track traffic through qwerty for your $20..." Now you really do get an award, but not the $20 since that will go to the person who WAS downloading mailq logs from Netcom ;-). You seem to be absolutely right. Here is an outgoing piece of mail sent from qwerty: qwerty: mail alt.test(a)news.cs.indiana.edu Subject: Ignore ignore test. This is a test of 'mailq'.

1 0

Re: New remailer up.
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- (Skip to end for actual remailer discussion.) PGP Slave, "If you insist :-) (Can you give me a few more days to comply?...I'm having some trouble getting a copy of your signature. One of the guys in the chem faculty says he knows where he can get one at the weekend...)" Thanks again. Now everyone knows to never tell YOU any secrets, no matter how trivial they might be, since you will post them. Who's the 'punk? and, "Hey bud, you`ve clearly misunderstood the whole point of the movement. You get whatever privacy you can make for yourself through technology. Any dolt who goes to the extent of using two remailers and a penet id to hide his identity then puts his nym`s secret key in his True Name signature file gets the privacy he deserves." I'm not sure you understand what -----BEGIN PUBLIC KEY BLOCK----- means. Or were you fingering someone else? Am I missing something? I am using two remailers to help out with the lack of traffic, not to hide my identity. There are many levels of privacy, and the one I am concerned with does not involve anything other than that Usenetters who are NEWBIES being forced to contact me via e-mail. It also involves not having the people I work around who are not my close friends gossiping about, mindlessly, about "what I am trying to hide" with my use of PGP. This is a personal thing, and using a nickname on Usenet is as strong of security as I need to meet this need. When I joined this list and started using Cypherpunk remailers I decided to not maintain my anonymity in a vigorous manner. I think you are trying to show off what a super hacker you are by typing "last qwerty", or even just "finger qwerty" from outside, to see my local site that I telnet in from, then typing the master-hacker magic-line "rusers my.site". I am impressed that you too can type these commands, and you get the Xenon Hacker God Award for the entire year of 1994. However, I would rather talk about remailer security levels than trying to cope with someone embarrassing themselves posting their "discovery" of my "real identity". I am not "hiding my identity", I am maintaining a minimal amount of PERSONAL privacy, at a security level that fits my needs; I am using a NICKNAME. For this purpose, qwerty and catalyst serve me well. I'm not sure why you have so much fun disrespecting a person's privacy. I arrived here with a simple question, "Can I use your remailers for bulk mailing of 1-3MB a day to people wanting the PGP FAQ and MacPGP Guide? What are the qualities of each remailer?" I think I understand the movement quite well, but I understand there IS NO fully secure remailer network which I would bet my life on. And I understand and am acting upon what few seem to care about, which is getting a large number of people outside of the internet-skilled culture using secure encryption. There are 50-100 million Mac and Windows users, and the majority of those with a modem use their internet connection for simple e-mail ONLY. Many only HAVE e-mail in fact. PGP has mass media attention, but very few are using it since they can't get it by a 1-800 number. I hope ViaCrypt will change this, with Mac and Windows versions. -----BEGIN REMAILER DISCUSSION BLOCK----- and, "logs on netcom. I was just waving enough of a red rag at you to make the point forcefully... (remember your the one arguing against putting delays more than 15 minutes in a remailer system...)" Finally we are talking about remailers! Thank-you. My telnet log is public. Netcom's sendmail logs are not (?). There IS a difference. I was arguing against long delays, which should only be needed if no baseline traffic is going on. Many people will not be able to function well if say, mail is batched out at midnight. Rapid two-way communication is very important these days in getting ANYTHING done, be it above ground OR underground. and, "PS How to build your own mailer logs on netcom...just stay on long enough and keep typing `mailq`...no problemo...I can`t be bothered but if I could thats how I`d track traffic through qwerty for your $20..." Now you really do get an award, but not the $20 since that will go to the person who WAS downloading mailq logs from Netcom ;-). You seem to be absolutely right. Here is an outgoing piece of mail sent from qwerty: qwerty: mail alt.test(a)news.cs.indiana.edu Subject: Ignore ignore test. This is a test of 'mailq'. qwerty: mailq Mail Queue (58 requests) --Q-ID-- --Size-- -----Q-Time----- ------------Sender/Recipient------------ (much deleted....) UAA29300* 27 Wed Feb 2 20:13 qwerty alt.test(a)news.cs.indiana.edu And some incoming, as bounced off of hh(a)cicada.berkeley.edu: UAA29978* 6 Wed Feb 2 20:20 <hh(a)cicada.berkeley.edu> "|/u1/qwerty/remail/slocal.pl" slocal.pl is part of Hal's remailer scripts. So who has a remailer to send me that will avoid this? Looks like I'd not use qwerty or catalyst as the first or last stop in a remailing chain. But if the only way to track this is AS the mail arrives or goes out, I'd still classify qwerty/catalyst as being good for casual security uses such as my post to Usenet above. It would be a lot faster than anon.penet.fi! Then again, a person could blackmail someone for posting to alt.sex.bestiality. When can I and many others switch from Netcom to a pubic service Unix network that is private/secure? *Again, I'm trying to compile a list of remailers and what levels of security each entails. Such a list does not seem to exist. If you ever want more traffic.... -----END REMAILER DISCUSSION BLOCK----- PGP Slave, despite this misunderstanding, could we declare peace and get on with a discussion about REMAILERS, instead of my nickname. I'm out here to learn and try to contribute what I can. I am sending info about secure encryption to at least a dozen people a day, many of whom would not otherwise get their hands on PGP or even the PGP FAQ, and I have thus become the most prolific user of the Cypherpunk remailers. I am doing this randomly, chained between two remailer at a time. This volume could triple if I started advertising. I don't misunderstand the movement? -Nik (Xenon) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLVBTPASzG6zrQn1RAQH2/QP/dexRZeXe7KRZpADn+hCBUoUExelRJ6hv A6kARzcymCAa3571u1XDauIcmNTPXDQTQ4bf3D5x94eR2AM43NjPcVBWkZcUYgEk ROGkIP3fAFnpBCbn0RZPOhIfYt8NnvWY53knRd5JxJbJ6jQxjRG9SfADs2ip8Fpl v4p6WPlnFHM= =j2FI -----END PGP SIGNATURE-----

1 0

Re: New remailer up.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

I must thank Hal Finney for pointing me to 'gopher chaos.bsu.edu'. I will be much better informed about remailers for having found this site. I'm not sure why it's taken a week for someone on this list to tell me this. -Nik (Xenon)

1 0

Commodity Jurisdiction success for Kerberos Bones!
by gnu 17 Dec '03

17 Dec '03

( ) United States Department of State ( State Dept ) Bureau of Politico-Military Affairs ( Logo ) Office of Defense Trade Controls ( ) Washington, D.C. 20522-0602 In reply refer to Feb 1 1994 OTDC Case: CJ-012-94 YOUR LETTER DATED: January 13, 1994 REQUEST FOR COMMODITY JURISDICTION FOR: "Kerberos 900104 bones.tar.Z patchlevel 6" software program This commodity jurisdiction (CJ) request was referred to the Departments of Commerce and Defense for their review and recommendations. As a result, the Department of State has determined that the referenced commodity falls under the licensing jurisdiction of the Department of Commerce. Please consult that agency's Office of Technology and Policy Analysis at (202) 482-4145 to determine their requirements prior to export. Should you require further assistance on this matter, please contact Maj. Gary Oncale at (703) 875-5655. Sincerely, (signed -- but it doesn't look anything like the name below) William B. Robinson Director Office of Defense Trade Controls John Gilmore Cygnus Support 1937 Landings Drive Mt. View, CA 94043 -- end of letter from State Department -- Now, what does it mean that we got a Commodity Jurisdiction for the Kerberos Bones? It means that the State Department has formally excused itself from worrying about us exporting the Bones. If the Commerce Department lets us do it, it's fine with the State Department. Exporting the Bones will not violate the International Traffic in Arms Regulations (ITAR). (Doing so might still violate other laws -- the State Dept has expressed no opinion on that.) This is no surprise, since the Kerberos Bones were deliberately emasculated to remove anything that might cause the State Department or the NSA to get upset. The letter just confirms that that effort was a success. I will do a formal check with the Commerce Department, as suggested in the State Department letter. My current understanding is that under Commerce rules (the Export Administration Act), publicly available software can be exported to any destination. In particular, I believe this means that there's nothing to fear from putting up the Bones for ordinary FTP. (There's a serious First Amendment issue being debated, over whether export control laws can prevent you from publishing software via FTP at all -- but even the most paranoid should now figure it's not an issue for the Bones.) I encourage people and companies who are interested in export issues to submit a commodity jurisdiction request for some software that you want to export, and go through the process. In public. The State Department and NSA don't publish their guidelines for what is exportable and what isn't, so the only way we-the-public are going to find out is by asking, and then telling each other. I've set up an FTP archive of such information on ftp://ftp.cygnus.com/pub/export. It includes `cjr.kit', which is the info you need to file your own CJ Requests, and three files regarding Commerce Department licensing. `commerce.gtda.license.faq' in particular is a FAQ from the Commerce Department about when the General license for Technical Data to All destinations lets you export without any paperwork. -- John Gilmore gnu(a)toad.com -- gnu(a)cygnus.com -- gnu(a)eff.org Can we talk in private? Join me in the Electronic Frontier Foundation. Not if the FBI and NSA have their way. Ask membership(a)eff.org how.

1 0

J. Michael Diehl's procmail-pgp
by Sameer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- If J. Mike Diehl is out there (mail to the address I have for him is bouncing) or someone else has that procmail-pgp .procmailrc he has written, I would appreciate it if you sent it to me. Thanks! - -Sameer -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLVCoZni7eNFdXppdAQHzQwP/eXkVO/lN0794NwREP/YXfpF3xVubCYAA TN6F+fjv3zpxkp95GRDbwpIxiw/Aytz/5qXjgJfV0Gatrc8CNPj/zbzBdB0Wc7Yq kcaLJYwoBCazhUy6gC+3w1A79H8Uav8bgbWfx2coBQMhp69+OYyH88GuNf+01m+4 LTNcml4sJEc= =InuS -----END PGP SIGNATURE-----

1 0

Re: A serious question of ethics
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Well, if the Federal Reserve has a guest account with no password, maybe they're inviting guests... Ok,, mailing them through a remailer might not hurt, though it might point out to them that remailers exist, if they haven't figured it out already. Personally, if I were logged on to one of their machines, I'd start looking for the "print" command :-) Signed, Anonymous --

1 0