- cypherpunks-legacy - lists.cpunks.org

Re: MAIL: anon mailing list
by Jonathan Rochkind 17 Dec '03

17 Dec '03

> Say somebody wants to run a mailing list as you propose. I think they > should just run the list at the same address unless the remailers can > suitably pad, delay, and randomize incoming messages and redirect them > to the true list site (but then delay and randomization may lead to > loss of coherency on the list ;). If not, surely external observation >of the contact point will show where all the messages are headed. Hmm. I'd think that if the list address were an encrypted remailer path with several hops, it would be non-trivial to find the contact point by external observation. Would it even be possible? Regretably, probably so. An additional layer of security could be having the list address underneath all of the encrypted remailer stuff be an anon address at the server in Finland. Although it's probably quite easy to to determine your true address by external observation of anon.penet.fi, unfortunately. Still, the combination of chained encrypted remailer paths, and the finnish anon server would definitely make it dificult to determine the contact point. But I guess not as dificult as I had hoped. > The resources needed would be higher than a normal list since each > incoming message would need to be checked for a digital signature (or > the list could become victim to an anonymous mail bomber, and you Yeah, quite true. It would be impractical for a very large list. At least, if you wanted a list with more then maybe 70 members, you'd need to dedicate some machine to it, probably. Although maybe not; I don't want to concede that until it's actually tried to see how much proccesing power is required in practice. :) And yeah, it would take users who were actually committed to doing it, as most users of _this_ list (including me), don't even sign their messages, as you point out. If we won't even sign our messages, then I don't know who is going to be willing to sign, encrypt, append remailer path, to it. Although I guess if the list required it, as it would, then people might join the list and do the stuff, just for the principle of it. And automated shell scripts certainly help. You could have an automated shell script particularly for the mailing list that took cleartext, encrypted it to the list, signed it, appended the remailer stuff to the front, and sent it off to the proper remailer.

1 0

Hardware RNG's
by John A. Thomas 17 Dec '03

17 Dec '03

Pat Farrell and others have been discussing hardware random-number generators. Since I've built such devices, I thought I'd put in my opinions. I used a reverse-biased transistor junction for the noise source. The noise is amplified by a three-stage op-amp circuit with about 60 dB of voltage gain in the passband and a 3-dB bandwith of 10 Hz - 3 KHz. A spectrum analyzer shows the noise is random, with no frequencies standing out more than others. The analog noise feeds an op-amp comparator wired as a zero-crossing detector. The output is a logic level which switches randomly, but on average, on and off about 50% of the time, respectively. This logic level gates a 5 MHz TTL oscillator, producing bursts of pulses of random length. These pulses are counted by an 8-bit counter, producing random 8-bit numbers. The outputs of the counter are latched and read through a PC bi-directional parallel port. Allowing the slowest changing bit to turn over 10 times between samples suggests a maximum sampling rate of 1000 bytes/sec. The chi-square test and the runs tests on these samples show very good statistical properties. For large samples (> 100,000 bytes), there seems to be a slight predominance of "one" bits (e.g. 0.6% difference). This is probably due to some factor in the sampling process which I haven't figured out yet. Anyway, exclusively-or'ing successive samples together removes this bias. I'd appreciate any ideas about this. I don't know what practical use this device has, except for those who need one-time pads, but it was fun to hack up and test. John A. Thomas b858jt(a)utarlvm1.uta.edu 75236.3536(a)compuserve.com PGP key available on request

2 1

REMAIL: Remailer that only remails to other remailers
by ghio＠cmu.edu 17 Dec '03

17 Dec '03

One of the problems in convincing people to run remailers is that they don't want to have to deal with complaints. Someone posted awhile ago that they would be willing to run a remailer that would only remail to other remailers. This would enhance the security of remailer chains while not creating too many political problems for sensitive sysadmins. If anyone's still interested, here's how to do it: ftp cs.cmu.edu cd /afs/andrew.cmu.edu/usr12/mg5n/public get ghio.cp.remailer.tar.gz This is a copy of the remailer that I run on kaiwan. gunzip and untar it. Modify remailer and sendlatents with the proper directory names for your system. Now, you need to modify a line at the end of block.c. Change if (match==0) printf("%s",argv[1]); to if (match!=0) printf("%s",argv[1]); Now it is a pass-address filter instead of a block-address filter. Now put the addresses that you want the remailer to be able to send to in blocked.addresses (you can rename the file in the remailer csh script.) Now create a PGP key for your remailer, set up a .forward file to 'remailer' and you're all set...

1 0

CYPHERPUNK OPERATIVE
by Sandy Sandfort 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Okay, somebody needs to fess up. I *know* someone on the Cypherpunks Channel is writing about the Clipper Chip and other crypto-privacy issues for /Expat World/. I thought I was the only one who had even heard of this newsletter for expatriates until I saw some of the crypto articles. Whoever it is, is doing a great job. In the June 15 issue, in the article, "How Big Brother Wants to LIsten, Too," the writer coined the term "Al Gorewellian." Gotta love it. If the writer of these articles is reading this note, please let us know who you are. You deserve the recognition. (If you want to keep a low profile, how 'bout sending me private e-mail? I'd like to discuss some things with you.) S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLgYBPU5ULTXct1IzAQEINgQAhzypoIDVoX5bad9Vd8psttmS5ClRbKqr vNA7L88jallJzrmUL5NZv6SO7NPAFxQzC2bnS2KJv4MpyRFl+ZYIku2cQZfQWShY 3TLUXuqK9HVHED7rCzq3Xq1Kny/fZZ9U74PSLe8fi+L9xsL5Ht0yDEmBYCG3REkv J0npF+9FCHw= =xgFs -----END PGP SIGNATURE-----

1 0

Re: Real truth about Cell phone tracking
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: From: Rusty Hodge <rusty(a)hodge.com> : 3. There is a test mode defined in the NAMPS standard that causes a phone : to begin transmitting on a designated frequency. And since the mouthpiece : on a cellular phone is not switched off when the phone is on hook, you can : easily bug someone's car this way. Woo! Built-in infinity-transmitter mode! (Just like ISDN actually) : 6. For under $1000, you can buy a box which hooks up to a PC and controls a : scanner and decodes the cellular control channels (and reverse channel data : too). This includes software for following cellular calls as they hop from : cell to cell, paging requests (get a phones attention), and displaying the : MINs that register in a given cell (or cells, but you need one receiver for : each cell you are monitoring!). These are selling on the black market over here in Britain for 3 or 4 K pounds. People who buy them use them to close phones, then sell time on the cloned phone over a weekend before it's discovered. G

1 0

Re: Keep Out--The Journal of Electronic Privacy
by John.Schofield＠f903.n102.z1.fidonet.org 17 Dec '03

17 Dec '03

rr> About "Keep Out": you might want to be more precise in your blurbs. As rr> things stand, I'm leery of trusting anything I might see in rr> your journal. rr> RSA is not broken, as far as I know. If you have verifiable details that rr> it has, that'll be quite a scoop. If you meant to say "the _factoring_ of rr> RSA-129," well, you should have said that instead. My apologies to the net. RSA is certainly not broken, and I was aware of that when this press release was written. My word choice was sloppy. In the article, the information comes from people I have interviewed who have direct, first-hand knowledge of the effort--people like Arjen Lenstra, who wrote the software that made the factoring possible. rr> > * An interview with Phil Zimmermann, including his thoughts on rr> privacy in the digital age, export controls on cryptography, the rr> copyright on RSA (the algorithm used in PGP), and information on his rr> struggle with US Customs over exporting PGP rr> A publisher, of all people, really needs to understand what a copyright rr> is. Note that we cannot copyright ideas, only our expression of those rr> ideas. Referring to a copyright on "the algorithm used in PGP" is rr> nonsense. Instead, PKP holds licensing rights to a system _patent_ on rr> using RSA to perform public key encryption. Again, I used sloppy language. And again, my apologies. This is certainly not the last mistake I will make. There will be errors in Keep Out. However, I will do my damndest to make sure Keep Out remains as accurate and unbiased as it can be. And when I make mistakes, I trust Cypherpunks to let me know about them, so I don't repeat the mistakes. It's a damn sure bet I won't be making these two errors again! --John Schofield -- : John Schofield - via mcws.fidonet.org - Public Access (213)256-8371 : ARPA/INTERNET: John.Schofield(a)f903.n102.z1.fidonet.org : UUCP: ...!cheshire!mcws!903!John.Schofield : Compu$erve: >internet:John.Schofield@f903.n102.z1.fidonet.org

1 0

(None)
by Jeff Gostin 17 Dec '03

17 Dec '03

tcmay(a)netcom.com (Timothy C. May) writes: > And an even better solution is for folks to have their own private > machines and access to one of the cheap Internet service providers > springing up all around. Then they won't have to worry about their > corporations "snooping" in their e-mail files. Or restricting them > about using PGP or other crypto. Isn't Cleveland Freenet still giving out freebie accounts? If they are, that's a good place to start. > Having your own computer means never having to say you're sorry. That's why I have my own computer and net.access. I'm the only admin making silly rules now! :-) > (I fear laws telling corporations they *can't* snoop as much as I fear > Clipper. The reasons are obvious, to me at least, and I can expand on > this point if anyone's really interested.) Me too, don't worry. :-) --Jef -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

(None)
by Jeff Gostin 17 Dec '03

17 Dec '03

"Phil G. Fraering" <pgf(a)srl.cacs.usl.edu> writes: > I was on a trip out of town a while back... as soon as I crossed > into another cellular network boundary, I got a call from the > provider's sales droid, telling me how to use their service. They > _are_ tracking individual phone movement, IMHO. Not just IMHO... They are tracking individual phone movement. I know this for fact. What happens is this: When you are out driving, your phone is constantly checking the local zone for strength. When the strength goes down, or signal quality is too low, it scans for a new zone. Then it "logs in" to the new zone while "logging out" of the old zone. Big cities, like LA, have ALOT of zones, none of which are all that big. By knowing which zone one is in, one is leaving, and one is entering, it is very easy to determine where someone is, especially if that zone tracks along a major highway. Then, it's just a matter of time until he's found. --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

(None)
by Jeff Gostin 17 Dec '03

17 Dec '03

carterm(a)spartan.ac.brocku.ca (Mark Carter) writes: > Encryption as a weapon is something that's not often talked about, despite > the fact that everyone's always rambling about how valuable information > is... If you have backups and keep paper trails like any serious company, this is merely inconvenient and annoying. > The arguments for restraining encryption in corporate situations can > go on and on... just as the arguments for encouraging private encryption > can go on and on. This argues similiarly to the gun control argument. Encryption, like guns, are a tool. When used responsibly, tools don't cause problems. When used irresponsibly, problems occur. Responsible use of encryption is for privacy. Irresponsible use is for some damaging purpose. --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

Re: Having your own computer means never having....
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> >Beyond that, unrestrained encryption is dangerous to corporations, because > >what's to stop a ticked off employee from encrypting everything in the office > > What to stop him/her from shredding everything in the office? This is a > personnel/legal problem; there's nothing special about the use of > cryptography (except that it might be reversable). Reversability is the main difference - the disgruntled fired ex-sysadmin can encrypt everything and promise to restore it for big bucks plus amnesty. On the other hand, hiding the backup tapes and shredding everything is relatively reversable as well, and has the advantage that you can threaten to sell it to the competitors, so it's not much different. When I was an undergrad, an ex-sysadmin left the University, and a week or so after he was gone, the database system announced that it would self-destruct in a week. They had to keep the system shut down for a couple of weeks and change the system clock while they hunted for the time-bomb, and the same sort of thing could be done in many modern systems without crypto, though crypto makes it easier.

2 1