- cypherpunks-legacy - lists.cpunks.org

Electronic Funds Transfer without stealing PIN/TAN
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Rachel Willmer <rachel(a)intertrader.com> Mime-Version: 1.0 Precedence: Bulk Date: Sun, 2 Feb 1997 15:03:25 +0000 From: Rachel Willmer <rachel(a)intertrader.com> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: Electronic Funds Transfer without stealing PIN/TAN --- From RISKS digest --- Date: 1 Feb 1997 05:12:02 GMT From: weberwu(a)tfh-berlin.de (Debora Weber-Wulff) Subject: Electronic Funds Transfer without stealing PIN/TAN The Berlin newspaper "Tagespiegel" reports on 29 Jan 97 about a television show broadcast the previous evening on which hackers from the Chaos Computer Club demonstrated how to electronically transfer funds without needing a PIN (Personal Identification Number) or TAN (Transaction Number). Apparently it suffices for the victim to visit a site which downloads an ActiveX application, which automatically starts and checks to see if Quicken, a popular financial software package that also offers electronic funds transfer, is on the machine. If so, Quicken is given a transfer order which is saved by Quicken in its pile of pending transfer orders. The next time the victim sends off the pending transfer orders to the bank (and enters in a valid PIN and TAN for that!) all the orders (= 1 transaction) are executed -> money is transferred without the victim noticing! The newspaper quotes various officials at Microsoft et al expressing disbelief/outrage/"we're working on it". We discussed this briefly in class looking for a way to avoid the problem. Demanding a TAN for each transfer is not a solution, for one, the banks only send you 50 at a time, and many small companies pay their bills in bunches. Having to enter a TAN for each transaction would be quite time-consuming. Our only solution would be to forbid browsers from executing any ActiveX component without express authorization, but that rather circumvents part of what ActiveX is intended for. A small consolation: the transfer is trackable, that is, it can be determined at the bank to which account the money went. Some banks even include this information on the statement, but who checks every entry on their statements... Debora Weber-Wulff, Technische Fachhochschule Berlin, Luxemburger Str. 10, 13353 Berlin GERMANY weberwu(a)tfh-berlin.de <http://www.tfh-berlin.de/~weberwu/> -- Rachel Willmer, Intertrader Ltd, Cova House, 4 John's Place, Edinburgh Email: rachel(a)intertrader.com Tel: +44 131 555 8450 Fax: +44 131 555 8451 Sun Internet Associate and winner of 1996 SMART Award for Innovation "We develop Java Commerce Solutions" --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Re: If guilty of a lesser crime, you can be sentenced for a greater
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Dale Thorn wrote: > Igor Chudov @ home wrote: > > > How about this scenario: I borrow 1 million dollars from, let's say, > > Phill Hallam-Baker. Not wanting to pay it back, I pay to the > > assassination bot and arrange him to be murdered. > > Igor, there's an old saying in this country: the best way to lose a > friend is to lend him money. Phill, in this example, is not my friend, but a lender. > > Another story: suppose that I negligently caused fire that destroys > > house of, say, Toto. Toto knows that if he sues me, I can arrange him > > murdered for the amount less than the amount of damages. As a result, > > he refrains from suing me, or (if he is a mean person) pays additional > > money to have me murdered. A suit would probably be a much better outcome. > > Sometimes you have to pay a steep price for negligence, like neglecting > to watch how close you get to the edge of the road on, say, Topanga > Canyon or one of those (long way down). Now, since people *know* to > be extra careful on the canyon roads, don't you think by the same > analogy they'd be extra careful with other things when AP is running? Mmm, likely the result will be that Toto will be impoverished (it is an example, do not take it personally) and will not only not be able to murder me, but also will be too afraid to sue me (because I would rather pay for a cheaper assassination than to pay damages). > > Another story: suppose that OKSAS hired me to work for her, but then > > our relationships go south and she fires me. Again, her fate is very > > unclear, although I would probably spare her life if it were she. > > If she does it right, with empathy, there is not likely to be a > problem. On the other hand, if she bad-mouths you to prospective > employers or customers you want to do business with, you might be > inclined to hit her. This happens a lot when AP is not available. ... But would happen more often if it was. > > The bottom line is, it becomes very hard to do ANYTHING that disappoints > > at least somebody. That can lead to a lot of inefficiencies. > > To get rid of everyone who pisses you off, you'd have to pay a lot > more money than you'll ever have, therefore not a problem. Those Why, I will have a lot of money. > people who have such money are not going to bump off very many more > people than they already do, because: > > 1. They need the people to make money off of (Mafia rule #4, never > kill someone who owes you money [or is a money source]). This is a wrong Mafia rule, they do kill debtors who are in default. > 2. Rich people have a lot of eyes on them, and it would be easy to > triangulate a series of murders to them, even without hard evidence. > In an AP world, this triangulation/correlation would be enough to > convince people to either shun this killer, or kill him outright. When ten people make deals with each other, it becomes hard to triangulate. And it is easy, if you know what deals are done, to change the result of triangulation: suppose that I know that you borrowed 1 million from Toto, that my _and_ yours business partner had been murdered (by me, but no one knows), and I am afraid that someone will triangulate me and implicate me in that murder. I secretly order the AP bot to kill Toto, and you get implicated. Not good. - Igor.

1 0

Re: Key Security Question
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In <199702021555.HAA25423(a)toad.com>, on 02/02/97 at 09:34 AM, "Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> said: >ichudov(a)algebra.com (Igor Chudov @ home) writes: >> Dr.Dimitri Vulis KOTM wrote: >> > Bill Stewart <stewarts(a)ix.netcom.com> writes: >> > > On the other hand, if the "repairman" replaced your pgp executable >> > > with version 2.6.3kgb, which uses your hashed passphrase as the >> > > session key, you're hosed. Or if he installed a keystroke sniffer, >> > > or added a small radio transmitter to your keyboard, or whatever. >> > > Depends on your threat model. If you need to be paranoid, >> > > they've already gotten you.... >> > >> > If you're really paranoid, you can boot from a clean floppy and >> > reinstall everything from your backup tapes. You do have a >> > contingency plan in case your hard disk goes bad, or gets a >> > virus, don't you? Well, if you're in doubt, exercise it. >> >> And what if the repairman replaces BIOS ROM chips with KGBios? >On some computers it's possible to add executable code to the boot >sequence without replacing the actual ROM chip because they're >rewritiable. Examples: most Sun boxes; intel motherboards with 'flash >bios'. V-Communications has a nice Bios Pre-Processor for their dissasembler for anyone intrested it playing with their bios code. Most newer MB's come with Flash Bios and the software to Flash the chip is available for download from the Manufacture. I'v gone and tinkered around with the bios on a couple of my AMI motherboards. Flash bios does open the possibility for a virus infection of ones bios. I have had several intresting discussions with the AMI programmers about this. IMHO any device that has flash bios should have a jumper on the circuit board to enable/disable the flash option. I have not seen anyone that is doing this with their products. The MB bios is relativly safe as the flash process happens pre-post but considering that flash bios can be found in almost all computer prerifials the potential for harm is there. Currently on my system I have flash bios on the HD's, modem's, NIC's, & SCSI card's. All are a potential hiding spot for a virus. - -- - ----------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. Finger whgiii(a)amaranth.com for PGP Key and other info - ----------------------------------------------------------- Tag-O-Matic: Air conditioned environment - Do not open Windows. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Registered User E-Secure v1.1 0000000 iQCVAwUBMvUl1Y9Co1n+aLhhAQHVcAQAmlU7/gY80+0C3KTowerMkZHa1ro4A5g5 0qKRuuAO08eOmnwND16bBxOo5KKZU/2Xxydvdg2CpE4C9ga/po3QTasa+kKzpsR7 jBQxDAWauirLlJtXCnfiaYQrycxX6YoFoZanRGticT4ObRmFvT0OcqYqqL/fgXe0 oSiw02JDATQ= =S97o -----END PGP SIGNATURE-----

1 0

VOICE STRESS ANALYSIS
by jim bell 17 Dec '03

17 Dec '03

Awhile back we were discussing voice-stress analysis; just got this item on the subject; he said it's okay to post it. >From: Spectre334(a)aol.com >Date: Sun, 2 Feb 1997 09:31:17 -0500 (EST) >To: jimbell(a)pacifier.com >cc: BLAMES2778(a)aol.com, AFSCA(a)aol.com, JLeek426(a)aol.com >Subject: VOICE STRESS ANALYSIS > >MR. BELL: > >I FOUND YOUR QUERY ABOUT VOICE STRESS ANALYSIS ON THE INTERNET, AND I TOO, >HAVE FOUND A DEARTH OF INFORMATION THERE - UNTIL NOW. > >I'M PLEASED TO REPORT THAT VOICE STRESS ANALYSIS (VSA) IS ALIVE AND WELL. IT >HAS BEEN QUIETLY PERFORMING IN THE SHADOW OF THE POLYGRAPH FOR MANY YEARS. > NOW, HOWEVER, IT IS COMING INTO ITS AND IS USED IN MANY STATES TO AID IN >CRIMINAL INVESTIGATIONS AND OTHER APPLICATIONS. > >AMONG ITS OTHER BENEFITS, VSA REQUIRES NO INTIMIDATING HOOKUP TO THE >SUBJECT'S BODY, IN ORDER TO MEASURE THE LEVEL OF STRESS. IT CAN BE CONDUCTED >VIRTUALLY ANYWHERE - EVEN WHERE NO ELECTRICITY IS PRESENT. PERHAPS MOST >PERTINENT TO YOUR QUESTION, VSA CAN BE SOMETIMES PERFORMED ON PEOPLE WHO ARE >NO LONGER AROUND, THROUGH THEIR RECORDED VOICES. THIS IS CALLED "NARRATIVE >ANALYSIS" AND IS SOMEWHAT TOUGHER THAN THE BASIC QUESTION - AND -ANSWER >APPROACH, SINCE THE EXAMINER CANNOT CONTROL THE CONTENT AND SEQUENCE OF >QUESTIONS, IF THE SOURCE IS A PAST RECORDING. > >THE DIOGENES GROUP, INC., OF WHICH I AM PRESIDENT, HAS DEVELOPED A TOTALLY >DIGITAL APPROACH TO VSA, AND BEGAN DELIVERING SYSTEMS TO LAW ENFORCEMENT >AGENCIES IN DECEMBER, 1996. THE PREMIER DIOGENES VSA PRODUCT IS REDUCED TO >THE SIZE OF A NOTEBOOK COMPUTER, BUT PRODUCES REALTIME PROCESSING FOR >SOFTCOPY DISPLAY, AND HARDCOPY PRINTING WITHIN SECONDS. > >YOU MAY BE FAMILIAR WITH THE PREVIOUS STATE-OF-THE-ART, WHICH WAS A >RELATIVELY LARGE ANALOG MACHINE, USING A SINGLE CHANNEL AND PRINTING OUT THAT >DATA ON A ROLL OF THERMAL PAPER. THOSE DAYS ARE GONE FOREVER. > >IF YOU WOULD LIKE MORE INFORMATION ON THE DIOGENES GROUP AND ITS PRODUCTS, >PLEASE USE THIS CHANNEL TO SEND ME YOUR MAILING ADDRESS, PHONE NUMBER, AND >FAX NUMBER. > >THANKS FOR YOUR INTEREST IN VOICE STRESS ANALYSIS. > >SINCERELY, > >TOM > >(THOMAS F. MCGRAW) > > Jim Bell jimbell(a)pacifier.com

1 0

Re: "Secret" Postal Device stolen
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, On Sun, 2 Feb 1997, Roy M. Silvernail wrote: > In Minneapolis and Anchorage (the two cities of which I have knowledge) > mail carriers have a key that opens not only apartment-style mailboxes, > but little boxes on the outside of apartment buildings that hold a key > to the building's lobby. Snag one of those keys and a large portion of > the city opens its doors to you. (some buildings have further locked > doors beyond the mailbox lobby to counter this threat) So much for key escrow. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Timmy May has been a source of endless embarassments to his sympathizers on and off the net. o/ Timmy May <| / >

1 0

Man in the Middle
by winsock＠rigel.cyberpass.net 17 Dec '03

17 Dec '03

Derisve Vibrator K[retin]OfTheMonth had his foreskin ripped off last night by a vacuum cleaner. .-._ {_}^ )o {\________//~` ( ) Derisve Vibrator K[retin]OfTheMonth /||~~~~~||\ |_\\_ \\_\_ "' ""' ""'"'

1 0

Re: "Strong" crypto and export rule changes.
by Vin McLellan 17 Dec '03

17 Dec '03

Ian popped the 40-bit RC5 (not RC4) challenge with 259 processors, almost all standard Unix college-lab workstations, as I understand it. (RC5 has a variable block size and a variable number of rounds; but the unknown plaintexts for this contest were enciphered using a declared 12-round RC5 with a 32-bit word size.) The message Ian revealed was something like: "That's why you need a longer key!!!!!" RSA posted rewards for anyone who can break a 56-bit DES challenge and/or any of 12 variable-length RC5 challenge messages. The 40-bit RC5 cipher was the least of these and was expected to fall quickly. The initial RSA announcement of the contest emphatically declared that even 56-bit-key crypto (DES or RC5) offers only "marginal protection" against a committed adversary -- which is not to in any way minimize Ian's accomplishment, or the efforts (some also successful!) of others who also tackled the 40-bit challenge. SDTI/RSA celebrated Ian's achievement enthusiastically at the RSA Security Conference in San Fran last week. Burt Kalisky, the Chief Scientist at RSA, preempted a main session at the Conference to do an on-stage telephone interview with Ian about his attack. SDTI (RSA) apparently hopes to use Ian's "timely" achievement to urge Congress to challenge the idiotic 40-bit EAR ceiling and the key-escrow contracts required to get a 56-bit export license. (The network Ian used to link his lab workstations, NOW at Berkeley, is definitely not standard, however. I think there is a description of it online; but briefly, NOW seems designed to very efficiently handle this sort of intensive distributed processing project. More important, perhaps, was the fact that Ian just chewed through the possible keys with a pure brute-force attack on the key space. His attack was not really optimized for RC5, or designed to attack any specific element in the RC5 crypto architecture.) Jim Bitzos of RSA also gave a thought-provoking thumbnail summary of the IBM Key Recovery Alliance (making a better case for it in 30 seconds than the long technical presentatations from IBM.) As Bitzos explained it, the variable key-size control allows a corporate user to communicate through encrypted links to a variety of international recipients -- dynamically adjusting the encryption mechanism to whatever varied restrictions are required by the French, German, US, UK, etc. , govenments. "It's an imperfect world," growled Bitzos -- but both users and vendors need workable mechanisms today to allow them to adapt to whatever contraints on strong encryption that are, or will be, required by the various national authorities. It's a mistake, he suggested, to think of the IBM Key Recovery Initiative soley in terms of US controls. Many governments are reacting with hostility to the availability of strong encryption -- and until the Market finds a voice and educates the political and spook cultures, commercial entities will inevitably have to adapt their work-a-day communications security to a wide variety of national crypto controls and key-length restrictions. (What I got about the IBM presentations was the realization that there is nothing in the key recovery mechanism, per se, that requires the recovery key to be held by a third party. That, to my mind, is the essential distinction between key escrow and key recovery. I also realized that IBM has, for years, quietly held a crucial piece of the PKC scheme in its patented "control vector" tech, which irrevocably binds a whole set of context-specific rules and constraints to a decryption key. I now realize that the control vector technology was the foundation much of the the DoD's Blacknet development. Important stuff -- check it out!) Like Big Jim said, it's an imperfect world -- and likely to become more so, from the C'punk perspective, before it becomes better. The rumor mill among the 2,500 cryptographers, mostly developers, who attended the RSA Conference was pumping overtime. One of the saddest and most persistent rumors was that the Clinton Administration would, within months, introduce a Congressional bill to make unescrowed strong encryption illegal in the US. (Personally, I'd put bitter money on that one. <sigh>) David Aaron, US Crypto Ambassador and the US permanent rep to the OECD -- in which role he has strove to convince the newly liberated nations of Eastern Europe that built-in wiretap links are essential design components for a modern democratic nation's communications infrastructure -- was charming and gracious... but it was no surprise that he didn't budge a bit from the "sovereign right to listen" policy line. You shouldn't have skipped the RSA bash, Adam, not even for your DCS gig in the sunny Caribbean. There were numerous Lion and the Lamb drinking bouts thoughout the week (some rather amazing, in terms of both the participants and the volume of "input".) You would have loved it. Passions often ran high, but usually in quiet intense coversations. I (one Lamb, white wool turning gray;-) had distinct impression that there many US government cryptographers uncomfortable with the Administration's NSA/FBI-inspired absolutist POV. Not even all senior feds feel that Constitutional Law should be (re)written by FBI case agents obsessed with making it easier to bust some two-bit crack dealer next month. (Doesn't mean much in the larger scheme of things, but the pained ambivalence vividly reminded me of Vietnam debates so many years ago.) My favorite quote, from a federal LEA lawyer deep in his cups: "If the colonial cops, rather than the philosophers, had drafted the Constitution -- would Madison and Jefferson, et al, have been willing to even put their names to it??" Suerte, _Vin -------- In Reply To: >Steve Schear wrote: >| > What the US government will allow to be exported is not "strong >| >encryption." It is encryption only slightly too strong to be broken >| >by an amateur effort. For the right investment in custom hardware, it >| >falls quickly. (500,000 $US = 3.5 hour avg break). >| > >| >| Considering Ian's feat you certainly seem to have had your crystal >| ball in hand. Adam Shostack responded: > I wear three around my neck. Its a new age thing. > > More seriously, that estimate is the cost of breaking DES on >custom hardware, based on Wiener's figures. Ian got RC4-40 in 3.5 >hours on I don't know how much hardware, not a lot of it custom, >AFAIK. Vin McLellan + The Privacy Guild + <vin(a)shore.net> 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548

2 1

Re: Free & Open Society & toleration (fwd)
by jim bell 17 Dec '03

17 Dec '03

At 10:18 PM 2/1/97 -0600, Jim Choate wrote: > >Forwarded message: > >> Nobody has a problem with your ideals, it's just that Jim Bell is >> trying to say (correct me and forgive me if I'm wrong) that: >> >> 1. Society will never subscribe to your ideals. > >But other than two points they already do. The two points being, > >1. Libel is a recognized legal concept now, the difference is one of degree. Maybe this will appear to you to be too-subtle a distinction, but I don't share the misimpression of equating what "society" (the citizenry?) accepts and what government-types accept. For instance, as I understand it the public uniformly rejects the concept of wiretaps as a method of law-enforcement, yet they are done anyway. In effect, it would be correct both to say: a. Society will never accept wiretapping. (where "society" is defined as the collection of individuals) as well as saying... b. Wiretapping is a "recognized legal concept now." (because the implication is that "recognized" refers to a tiny subset of society, the thugs who run the "justice system.") Now, it's my own personal opinion that wiretapping is unconstitutional, but is done anyway for the same reason other unconstitutional things are regularly done by government: Despite public disapproval, the public is never actually given the opportunity to make the decision. The fact is, libel lawsuits are apparently a rather rare "tool" that we don't even need. Perhaps a REAL LAWYER <tm> who is aware of the statistics can tell us how often they actually occur. I argue that something that rare is, almost by definition, not really needed. >My solutions to these two issues are: > >1. Removal of the lawyer from the ultimate choice of whether the case > should be pursued. Yes, I'd like to "remove a few lawyers," as well. Not quite the way you would, however. >4. By the implimentation of a bond proviso on the part of the plaintiff > the system provides a check and balance reducing nuisance cases as > well as reducing the taxation load on the citizenry. Why not a full "loser pays" system? And I mean NOT ONLY for civil cases, but also criminal cases! Perhaps the government would be a bit less enthusiastic about harassing drug defendants if it was forced to pay for their acquittals after a FIJA loss! Consider, for example, that if the government had to pay after a loss, it would become very difficult for the government to harrass a person like Phil Zimmermann, unlike today where charges can be brought even if it is recognized they won't stick, secure in the knowledge that he'd be out a great deal of money in his defense. How much sweeter would the victory be if all costs were compensated? > >> 2. Society is not static, i.e., instead of remaining at a constant >> level of corruption, the officials will keep demanding more, >> until there's a sudden, catastrophic break. > >Absolutely, that is one of the reasons I refuse to seperate those who >represent the social contract (eg the Constitution) and those who are >impacted by it, which includes even those who represent it and enforce its >various responsibilities. AP relies on this distinction as axiomatic. Do you always produce such opaque commentary? <Sigh> Perhaps you could re-write the above statement in ordinary English. The reality is, the guarantees supposedly provided by the US Constitution are guarantees in name only. The system is thoroughly corrupted and biased. >This >axiomatic view is ultimately based in a jealous greed for what others have >(ie power, percieved or real) and the implicit belief that all people are >NOT created equal. It's hard to know how you come to this conclusion. If anything, what I'm trying to do is to permanently destroy a system which has allowed a tiny fraction of society to control things for the rest of us for centuries, and longer. If anything, it is the system I'm trying to destroy which has taken the position that, in reality, people are not equal. On the other hand, I'm NOT a proponent for "egalitarianism," or enforced equality, at all! I'm confident that once the system is dismantled that enforces inequality on us, we can live with the result. >> 3. The AP solution has the potential to stabilize the level of >> corruption, which should make violent revolutions and genocide >> unnecessary. > >But it doesn't. What it does is provide a mechanism for de-stabalization. >Just look at the Middle East and the history of assassination. >Assassinations have never stabalized that region or any other. It's interesting that I keep seeing the same misinterpretations of the AP system. AP is not simply about killing people. And no, it hasn't been tried before. The occasional assassination is no more like AP than a random shot in the dark is like a well-aimed round. The first may, rarely, do the same thing as the second, but there is no prospect of a likely repetition. _SOME_ people seem to "get" this, why not you? The _absolutely_essential_ element that distinguishes AP is the system that allows people's individual desires to be denominated in terms of money, and accumulated until an anonymous person satisfies that desire and collects the reward. And, moreover, that this system remains in place forever. > There is >nothging in our current understanding of human psychology and social >interactions that leads to the conclusion that threats of violence will >necessarily force people to comply. If it did the government (as perceived >by AP) would not have to deal with real opposition. Simply threaten the >opposition and it melts away for the same reason that supposedly the >government would cease to oppose radicalism (ie changes in the status quo >forced by small groups upon the masses). If anything every real world >example of AP demonstrates an increase in corruption (eg. Beirut). I keep telling you that "AP has never been tried before." > >The closest analog in history to AP is the "Flowery Wars" as practiced by >the Aztecs. However, these were motivated by a belief in religous homogeneity >and not one of politics. Also, implicit in this was the axiomatic acceptance >of a real class seperation between those who ruled and those who were ruled. >By no means could one accept the premise that this caused the Aztec rulers >to be more sensitive to corruption or the continued existance of their >system. Another good example is assassination in ancient Rome, it is clear >that such activities in no way reduced corruption. AP is NOT the same thing as mere assassination. Period. If anything, there are excellent reasons why ordinary assassination can, indeed, increase corruption while the AP system would reduce it. The most obvious difference is this: The motivations are vastly different. Heretofore, assassinations have occurred based on the desires of only a tiny fraction of the population. Often one person, or only a few. In other words, the assassinations which DO occur are NOT the ones that "the rest of us" would choose. The latter type DO NOT occur! >If anything AP provides a rationale (ie self-defence) to impose even harsher >a priori conditions on sections of a society by another part of that society. >Hardly what I would consider a stabalizing condition let alone democratic. It isn't necessary that any system be "democratic." "Democracy" assumes that certain questions need to be answered by VOTE, as opposed to simply allowing individuals to answer those questions for themselves. We don't all get together and vote on what religion we'll all be forced to observe, do we? No. That's because it is accepted that certain areas are off-limits for even a "democratic" system to decide. We don't have a national vote to decide what color to paint ALL of our houses. We don't have a vote to decide what meal to eat next Thursday. Well, in my opinion there are few if any proper functions for a so-called "democratic" system. That's because I believe that most if not all decisions currently made in any "democratic" system shouldn't be made at that level at all! >What is required for stability is for each group to feel unthreatened and >secure in expressing their beliefs without fear of reprisals and at the same >time recognizing they must provide room for others beliefs. There must also >be the realization that refusal to abide by these precepts will be met with >immediate consequences. Something AP can't do, as it explicitly promotes >threats and the carrying out thereof. You clearly don't understand it! Jim Bell jimbell(a)pacifier.com

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk mix pgp hash latent cut ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle ?"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"death"} = "<x(a)deathsdoor.com> cpunk pgp hash latent post"; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 3 Feb 97 6:48:17 PST remailer email address history latency uptime ----------------------------------------------------------------------- nym config(a)nym.alias.net #**#+*#**-#+ 4:51 100.00% dustbin dustman(a)athensnet.com ---+-------+ 1:50:51 99.99% weasel config(a)weasel.owl.de ++++--+++++ 1:09:14 99.85% lead mix(a)zifi.genetics.utah.edu ++--++++++++ 50:42 99.80% balls remailer(a)huge.cajones.com ###*###+-- # 5:45 99.62% squirrel mix(a)squirrel.owl.de ++++--+++ + 1:07:30 99.46% cyber alias(a)alias.cyberpass.net +*+ *++++*++ 40:43 99.23% winsock winsock(a)rigel.cyberpass.net ----------- 3:42:43 99.09% lucifer lucifer(a)dhp.com + ++++++++ 47:05 99.03% exon remailer(a)remailer.nl.com ##### #* *# 2:02 98.68% middle middleman(a)jpunix.com ++.--.- ---+ 5:48:30 98.23% haystack haystack(a)holy.cow.net ***#*+# *#-+ 15:27 97.21% extropia remail(a)miron.vip.best.com ------- .- 6:28:55 96.31% replay remailer(a)replay.com * +++-*** 15:53 93.06% reno middleman(a)cyberpass.net +--+ --+ 1:20:32 91.27% mix mixmaster(a)remail.obscura.com +-.-_-*+ 14:45:36 77.02% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0