- cypherpunks-legacy - lists.cpunks.org

Yardley's 1st ed. "Black Chamber" $25+
by baum＠apple.com 17 Dec '03

17 Dec '03

I found one in a bookstore. I didn't buy it, but I'll go back and get it & ship it if someone is interested. ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, MS/305-3B fax (408)974-0907 * * 1 Infinite Loop * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

2 1

[ANNOUNCEMENT] eCash reality !!
by usura＠berserk.com 17 Dec '03

17 Dec '03

e-WAVE [issue 42], a dutch language electronic newsletter published by Riverland Publications, reports that DigiCash has reached agreement with a big US bank to make eCash real. DigiCash promised the 'scoop' to Newsweek, so in next monday's issue of Newsweek we will know wich bank that is. (They are also said to be talking with a Dutch or Belgian bank or financial institution). Since there has been cut a deal with the monetary powers I wonder if we get the whole anonymous ecash or a 'diluted spieces'. -AJ- For the many subscribers of the cypherpunks mailinglist that are able to read Dutch, here is the portion of e-WAVE that has the announcement. <g> ------BEGIN QUOTE------ Tijdens de toelichting op de toepasbaarheid van Digicash's encryptie-technologie op stemmen, komt het vermaarde e-cash ter sprake. Dinnissen heeft een primeur maar mag nog niks verklappen: 'Volgende week maandag zullen wij bekend maken met welke grote Amerikaanse bank Digicash in zee gaat om e-cash tot een legitiem en valide betaalmiddel te maken.' WAT!!! E-CASH LEGAAL?! Wow, gelijk de cyberbucks natellen. En met welke bank? 'Kan ik niet zeggen.' Ook nog Nederlandse of Belgische banken? 'Er zijn ook gesprekken dichter bij huis, ja.' Kan dat eigenlijk zomaar? 'Er zijn afspraken gemaakt met monetaire instanties. De scoop is beloofd aan het Amerikaanse tijdschrift *Newsweek* dat op die maandag uitkomt.' (Shit) Spoedig meer hierover. For more information mail: erwin(a)wave.riv.nl ------END QUOTE------ 88888b d888b 888b 88 8P 888888 88888b 888 888b 88 88 d888b 88 88 88 88 88 88`8b 88 88 88 88 88 88 88`8b 88 88 88 ` 88 88 88 88 88 88 88 88 88 88888P 88 88 88 88 88 88 88 88 88 88 88 88 88 `8b88 88 88 d8888888b 88 `8b88 88 88 , "" 88888P `888P 88 `888 88 88 88 `8b 88 `888 88 `888P 88

1 0

I want to learn!
by VINCENT810＠aol.com 17 Dec '03

17 Dec '03

Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs.

1 0

PINs
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

What if You had Two PINs ??? And One Works and One Sounds a Silent Alarm . Then If You are Forced to give your PIN ,You give Them your Second PIN and They get Caught !!!!!!

2 1

Re: I want to learn!
by stevenw＠iglou.com 17 Dec '03

17 Dec '03

>>From: VINCENT810(a)aol.com >>Message-Id: <951017234254_126621887(a)mail06.mail.aol.com> >>To: Cypherpunks(a)toad.com >>Subject: I want to learn! >>Sender: owner-cypherpunks(a)toad.com >>Precedence: bulk > >>Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs. > > Me Too, I'm catching on but some help would help ! ^^^^^^ Looks like this is now a proper noun, thanks to AOL. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more +1 415 390 9732 | than just a place to find pictures | of people having sex with dogs." stevenw(a)iglou.com | -- Time Magazine, 3 July 1995

2 1

I want to learn!
by Leo_Martensen_at_~~HEID-DHS＠ccmail.odedodea.edu 17 Dec '03

17 Dec '03

>From: VINCENT810(a)aol.com >Message-Id: <951017234254_126621887(a)mail06.mail.aol.com> >To: Cypherpunks(a)toad.com >Subject: I want to learn! >Sender: owner-cypherpunks(a)toad.com >Precedence: bulk >Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs. Me Too, I'm catching on but some help would help ! Leo_Martensen_at_~~HEID-DHS(a)ccmail.odedodea.edu

1 0

Anonymity: A Modest Proposal
by Modemac 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Several weeks back, I posted a message stating the need (in my opinion) for a system of anonymity on the Internet that would be more secure than the anonymous remailers. Despite the valuable service provided by the remailers, I am troubled by their vulnerability. It seems likely that at some point in the near future, a remailer is going to be silenced, and possibly (though not inevitably) the contents of its database made public. This may possibly lead to criminal charges being filed against someone, based on alleged criminal acts in which the remailer plays a part. (I am not going to state what these "criminal acts" may be, because I don't know which ones will be involed. I don't know when this blow to the remailer system will come, or who it will happen to. I simply believe that, given the growing trend towards censorship and anti-privacy in government and business circles, the blow will come sooner or later.) The vulnerability of the remailer system, in my opinion, rests in the fact that a remailer is physically located in a certain place. This makes the remailer a target for attacks, as shown by the futile efforts (so far) of the so-called "church" of Scientology to silence the remailers at anon.penet.fi and xs4all.nl. (The original demand of Scientology in the Penet affair was for the entire contents of Julf's database to be revealed, but fortunately Julf was able to limit the exposure to a single user. When Scientology attempted to raid xs4all, their original seizure order was against the remailer itself - -- but fortunately (again) the remailer itself had been closed two months before. The representative of Scientology had to re-phrase the seizure order on the spot, declaring instead that the reason for the seizure was the existence of the infamous "Fishman Affivavit" on an xs4all Web page.) I believe a system of anonymity is needed that can withstand attacks of this sort. The current remailer system may be able to weather the oncoming storm, but it will suffer damage in the process. A system to reduce the effect of pro-censorship forces on sources of online anonymity is needed. But what shall this system be? Since the prime vulnerability of the remailers rests in their physical locations, we have the possibility of physically hiding their locations. This is impossible in the long run, and it hampers the ability to set up a remailer on a short-term basis. How hard is it to set up a node that is hidden from efforts to discover its location? If setting up a remailer requires you to go into hiding, many would-be privacy activists will be dissuaded from giving it a try. Rather, I wonder if it would be possible to devise a system that introduced a random element into the picture, one that lessens the possibility of blame being placed on any one individual, or any one site. The Netherlands responded to Scientology's attack on xs4all by spreading the Fishman Affivavit far and wide. At the time of this writing, this document now exists on more than eighty Web pages in Holland, and this makes it far more difficult for Scientology to stop the spread of information. (They are still trying, however. The latest word from Europe is that a member of Scientology's "Office of Special Affairs" has flown to Europe, and is now calling service providers and individual users. A lawyer for Scientology is there as well. See alt.religion.scientology for more details of this case.) Using Scientology as an example once again (this will be my last mention of it, I promise), note the failure of the "church" to shut down alt.religion.scientology. They have tried every possible means to prevent the newsgroup from spreading information to the world, and every attempt to stop this "leak" has failed. If it was possible to effectively eradicate a newsgroup, Scientology would certainly have done so by now. Alt.religion.scientology cannot be shut up because it is distributed to thousands of sites around the world, thus making it impossible to shut them all down. That's why I believe a newsgroup for anonymous messages would be able to withstand attacks by would-be censors. Previously, I had suggested the possibility of a "moderated" anonymous newsgroup that would forward all postings to the address of the "moderator," where they might then be randomly distributed to remailers before being posted to the anonymous newsgroup. However, that idea had several inherent weaknesses, including attacks on the "moderation" site and newgroup messages designed to compromise the newsgroup and send postings to other places. The way to prevent a newsgroup from being compromised in this manner, then, would use a different method -- one that is immune to control messages. In the course discussion with a group of cyberpunks on IRC a couple of days ago, another possible system for anonymity was devised. This system can reply on a unmoderated newsgroup as a source for messages. Instead of forwarding messages to an address in order to hide the ID of an anonymous poster, it was suggested that PGP be used to protect the messages themselves. The basic idea for this system goes like this: 1) A person writes a message and encrypts it with PGP. 2) That person then posts his message to the "anonymous messages" newsgroup. 3) A remailer scanning the newsgroup picks up the message, decrypts it, strips the headers and makes it anonymous, and sends it to its destination. Because the anonymous messages come to the remailer by scanning a newsgroup, tracking a remailer's incoming-mail logs would be useless. To offer further protection for the remailers, a random system could be devised to ensure that no one knows exactly which remailer scans a particular message at a particular time. I am not a programmer, and some of the technical details in this proposal go over my head. Hopefully you can clairfy some of the points presented here and see if this system is possible or not. The actual remailer code, involving scanning the newsgroup for PGP-encrypted messages and stripping headers, could be written with PERL scripts. This would keep it portable, and it would be easy for a person to tell if it has been tampered with. This code would be distributed widely. A series of remailers would be used to decrypt anonymous messages. A "token" (like the token ring of IBM fame) would be passed back and forth between all of the Cryptoclients in the remailer network, so that only one remailer would be "active" at any given time. This token would be passed back and forth at random, so no one would know exactly which remailer is being used to anonymize a message. The "token" is the key to this remailing system. This token would include necessary information such as the last message scanned, and to coordinate timing among the remailers. This will work to avoid duplication of messages. (Of course, the remailers should also hold messages for a random amount of time -- say, up to two hours -- in order to prevent someone from being traced, based on the time he posted his encrypted message to the newsgroup.) The decryption key for the anonymous messages would be created using a 2047-bit PGP key. To prevent this key from falling into the wrong hands, a "web of trust" could be used to pass pieces of the key among each other. If enough sites trust remailers trust a site, that site will receive enough pieces of the group key to be able to respond and "accept" the token. The public key for this PGP key would be sent to the keyservers. People would encrypt their messages using this key. The mental image I have is that of a virtual "anon demon," zipping back and forth among the network of remailer sites, stopping at each site to scan messages from the newsgroup and send them to their destinations. If a large network of remailers is connected in this fashion, it becomes impossible to prevent stop anonymous messages from reaching their destination simply by attacking one site, or even a series of sites. The "anon demon" would simply bypass the compromised sites and use other points in the network. Comments are welcome concerning the vulnerability of this system, its complexity, its ability to withstand attacks, and any other constructive criticism. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIToGR7ohFhEPknNAQHEtwP9EmdEVtNoEJC6MtokZs66ea27Nx874K+s ueOiX21QL01SGjn7AvHUxTDPSiNXdnqSlDRqsnc2nefNlkhc2bzZklovlnZ15XC/ ZUxRWtCBk0LFoPyxbc/kEOM2cjqJdZ4llxYRHed0RcH0ABvYcGv8ZTjxtKEwN9Sy IDxmiTlqHXU= =yLqV -----END PGP SIGNATURE-----

7 9

Re: Microsoft: WFW & Win95 TCP/IP is insecure, and alleged serious computer crime
by llurch＠Networking.Stanford.EDU 17 Dec '03

17 Dec '03

Posted, emailed, and archived. I probably should have talked to a lawyer first. Oh well. Followup-To poster (that means email) or spawn new threads. The FAQ is at http://www-dccs.stanford.edu/NetConsult/Win95Net/faq.html. It's getting dated; please download the new.txt link, in UNIX mbox format. The quixote list archive server has been turned off for security reasons. -----BEGIN PGP SIGNED MESSAGE----- In article <461u88$luk(a)dingo.cc.uq.oz.au> in a few newsgroups, DavidS(a)gpo.pa.uq.edu.au (David Steadson) writes: >In article <45rims$9fc(a)Networking.Stanford.EDU>, llurch(a)Networking.Stanford.EDU >says... >> >>Note that Microsoft's "in order to have this problem, there must be a >>UNIX >>computer on your network" really means "if you're connected to the >>Internet, and you're not behind a firewall that disallows all SMB traf >>fic, >>you have this problem." Some other bits are misleading as well. > >Ummm, this is new?? I knew about this security hole in MS TCP/IP months ago, >via newsgroups. Lots of things are new, and very interesting, especially for Usenet readers, because the story involves forged cancels, apparently stolen passwords, and serious computer crime. I'm so glad you asked. Unsurprising Fact: Microsoft has finally acknowledged and documented the problem, and, without fanfare, released a patch for Windows for Workgroups that claims to fix it. Fact: several people at Microsoft have been lying about the problem. In early September, paulbal(a)microsoft.com assured a gathering of Stanford computing support staff that the problem had been fixed in build 490, so I looked no further into it. For a while. Fact: On September 27, I reposted a July article from the SAMBA email list archive about the bug you know all about. I asked for confirmation on whether it had been fixed in the release version of Win95, and whether a fix was available for WFW. Supposition: Early morning September 28, my kerberos password was apparently hacked, and my .forward file was disabled on several UNIX machines, preventing me from receiving some personal and work-related email. I did not notice this problem until October 6 because I seldom log on to the machines in question. Fact: On September 28, I received several replies to my post, several saying that Microsoft had assured them that it had been fixed at some specified (often specified different) build. I also received two replies that the problem had *not* been fixed, and volunteering to reproduce the problem for me. Fact: I posted the confirmation of the bug to win95netbugs(a)lists.stanford.edu. Fact: The Windows for Workgroups security bug fix patch on Microsoft's FTP server is dated late night September 28. Fact: On October 2, Paul_Krill(a)InfoWorld.Com phoned and emailed me inquiring about the problem. He had also been assured by Microsoft sources that the problem had been fixed. I forwarded several articles his way indicating that it had not been fixed. I again searched the Microsoft Knowledge Base for any mention of "SAMBA" or "SMBCLIENT" and found none. Fact: On October 4, received an email message from henrysa(a)microsoft.com inquiring about the problem and offering to investigate for me the current status of the problem. In reply, I sent him the three email messages that are included at the bottom of this post. I have not received any sort of reply from Henry. Fact/Supposition: October 2 (?), somebody made a directory on a Stanford FTP server world-readable and world-writeable, uploaded several megabytes of "warez," and advertised the site on hacker BBSes. Since many people had access to this directory, there were no suspicions about who was responsible. My kerberos password, which I now believe was stolen, would have been sufficient to cause this problem. Fact: Late night/early morning October 14-15, in a routine browse of the Microsoft Knowledge Base, I came across articles on the SMB security bugs, which we all know about now. I posted them, with commentary rather less lurid than what you have seen from me since, when I was perturbed. Fact: The article was canceled. On this day 10/18/95, under penalty of perjury, I swear that it was not canceled by me. My PGP signature should be legally binding. Fact: I also Cc'd the article to \win95netbugs and myself via email. The email made it. NewsWatcher works such that separate Message-IDs are created for news and email, and someone reading the news post has no way of knowing whether the article was also emailed. Supposition: the canceler did not know that NewsWatcher worked this way. Fact: In the morning, I noticed the article was missing, but that earlier and later articles by me were there. I figured something must have gone wrong, so I reposted it. Fact: From 12:10 to 5PM, I was with Kevin Morris at Sacred Heart school in Atherton, building a local PhoneNET network. Obviously, I had no Internet access. While I was there, my second post of the article was canceled. Fact: Around 7PM, I noticed the second cancel, and a followup thereto from a netcom account confirming that the article had been posted and propagated, got really pissed off, and posted it a third time. I also posted to news.admin.net-abuse.misc and our local news administration group. I also Cc'd several PC and networking magazines via email, and cross-posted to a .test group so that I would have verification of the propagation of the article in hand. Fact: Today, as was the case 15 hours after it was posted, article <llurch-1510951157410001(a)tip-mp3-ncs-3.stanford.edu>, to which there was that netcom followup, is missing, presumed canceled, from the core Stanford news servers nntp and csd-newshost. It is present on the secondary news host morrow.stanford.edu, and on external sites. No one has been able to provide any explanation for this. Supposition: the canceler either screwed up or canceled the cancel or, more likely, forged a repost after seeing the netcom followup. For some reason, however, the article did not make it back onto nntp or csd-newshost. Fact: Later that night and in the morning, I received copies of the forged cancels of my messages as seen from nasa.gov, rand.org, and mcom.com. I posted them to news.admin.net-abuse.misc. Supposition: an individual or group has gone great lengths, engaging in quite a bit of highly illegal and unethical behavior, in order to cover up security and networking bugs in Microsoft products. Opinion: they have failed. In a big, big way. - -rich graves distributed computing and communication systems stanford university llurch(a)networking.stanford.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMITf34ND7LjhcPQ9AQGlsQP+KFNuOehBPLExKjJc0e/7bv8iAF29bYgi o4ioLYuwx4AKtR2hER85PWWPNBuDO+G8uqDBcDNzKZ+VxrNDWvhP9oSfTy9ry9OM p5hkcQfB/MqqeDZ5nFOXmTkI2y+EI3az1lHWBr9kQuSalpAVkXTx0/qeW9WWYVFZ cuZ8+Tf3W7o= =G/Dk -----END PGP SIGNATURE----- Unanswered letters to henrysa(a)microsoft.com:

1 0

Re: Netscape PR
by Charles Gimon 17 Dec '03

17 Dec '03

Forwarded message: > > If you wish to get an official statement from Netscape, you should > contact our PR department. Their number is 415-528-2802. > They don't have e-mail?

1 0

Anonymity: A Modest Proposal
by John Curtis 17 Dec '03

17 Dec '03

I think that what you propose could be modeled as an anonymous remailing distributed process. If designed correctly, such a process could be made extremely difficult to shut down (even for us!) There are more than enough texts written on how to do this correctly; no need to reinvent the wheel.

1 0