- cypherpunks-legacy - lists.cpunks.org

Re: Economic assumptions
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

Eric Hughes: >Let's take remailers as an example. One current suggestion is to add >some sort of money system to the remailers as a condition of use. >This is exactly the wrong priority at the current time. The remailers >are already hard enough to use, and adding a payment system on top of >that will make them used even less. Making a system harder to use >increases the transaction cost. > >The current priorities should be to lower these costs. When the >remailer system begins to be overloaded, then adding some restriction >on use, perhaps by means of payment or a payment analogue, will be >warranted, because it will lower overall transaction costs, trading >off ease of use for throughput and reliability. > >What are some of these costs that should be lowered? > >-- Finding out that remailers exist and what they do. build a remailer "who" server into each remailer >-- Finding a remailer to use. ditto >-- Deciding what remailer to use. ditto (remailer server should list remailer properties like keylength, private?, delay length, chaining?, mixing?, padding?, encryption required? etc) >-- Figuring out how to use a particular remailer. standardize remailer help system, standard remailer command format (but not neccessaily the commands themselves) Sorta like an SGML for remailers >-- Formatting a message for a remailer. see above >-- Receiving mail through a remailer. Get/Creating a nice client. At the moment, 100% of the mail in my mailbox is encrypted. I wrote a script called "deliver" which encrypts incoming mail, then pipes it through procmail/slocal. I modified morepgp and made it a lot more user friendly (and recursive). Reducing complexity cost: All of this could be lowered by creating an easy-to-use remailer client which is compiled (or perl/tcl interpreted) and installed with every unix out there so it becomes ubiquitous. If someone's machine doesn't have a client, they can telnet to a machine where one is set up (just like gopher, archie, www) by some generous cryptoaltruist. The current remailer solution of putting all of the remailer system complexity on the server side can't make remailers too easy to use. My Extropians list software attempted to make it easy to use by allowing commands to be contained in-band with messages to be posted. It's still too complex for the user who wants hot-key style operation. (which is why I will eventually write a client for it) Once you write a generalized client that can communicate with standardized remailers, you can easily include digicash/postage in the system. >There much more need for improving the ease of use of remailers than >for paying for them. Are you objecting to paying for remailers on a philosophical grounds (anti-property/money)? No one has proposed paying real money for remailer use (although that is a future possibility). There needs to be some way to authenticate remailer users and limit use in a "free" sense (instead of top-down rationing) The best way to do this is to use some form of monetary system. >The less expensive privacy is, the more privacy there will be. >Privacy has non-linear benefit; the more that people are private, the >better any individual's privacy actually is. Every standard is enhanced by more people using it. However, this alone can't be a justification for making services into public goods which are free to everyone. If the Detweilers of the world take advantage of totally free remailers, they could end up limiting the privacy for all. The same "free" philosophy has killed many a porno/music/book site (or created absolutely long user queues reminiscent of food lines in the xUSSR) Spamming/Spoofing attacks on remailers must be dealt with. The situation is not helped by either-or logic. We need both ease-of-use and some notion of postage. -Ray -- Ray Cromwell | Engineering is the implementation of science; -- -- rjc(a)gnu.ai.mit.edu | politics is the implementation of faith. --

2 1

Re: has this been on cypherpunks? (fwd)
by zinc 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- cpunks, i particularily like this quote: "Role Of Encryption For added protection, users of Anonymous Re-mailers tend to encrypt their messages just in case one of the remailing links are compromised. PGP (Pretty Good Privacy) encryption is favored because it is freely available and easy to use. A typical digital signature would look like this: [...]" hell, i'd like to see these guys hang out on alt.security.pgp answering questions all day... pjf, 'easy to use' my ass "Those that give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -- Benjamin Franklin (1773) finger for PGP key zifi runs LINUX 1.3.57 -=-=-=WEB=-=-=-> http://zifi.genetics.utah.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by mkpgp1.6, a Pine/PGP interface. iQCVAwUBMRha1E3Qo/lG0AH5AQESIwP9HUKUmvlVqOteom2xWLKW7az4V1lH4lex e3MJMK1e5a6C2JRbs6JeoEj2o3hUIKwcF8DF0HmnAeETfXyM2qtY6PdkLQlWy+Qh 9w3BDi+m6cxy7TmADcLyBtg0bc6imdJGHyeTtcsT7XUyrKlf/O+o6QX9ip4FOqZz 5/OZ8j8KwK0= =6K1U -----END PGP SIGNATURE-----

1 0

Re: How to prevent a virus infection :-)
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Lucky Green wrote: > > Just watched an "expert" on Bay TV (SF Cable). He stressed that websites > without firewalls pose the risk of spreading viruses when downloading files > from them. A GIF was being downloaded in the background... (chuckling) I remember when one of the Michaelangelo scares was going on (hey, is it that time of year again?) the place where I was working got a telemarketing call selling anti-virus software. String that one up with conspiracy theories... - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMRimFioZzwIn1bdtAQHyIAF/YKlGvU0JeP9V4+VoDHksXn0SCd6wE86x 1HptGTwiHjH1I/BhjRLyY9xiCFqNLwSf =Kqj2 -----END PGP SIGNATURE-----

1 0

A Warning Re: Hardware RNG support for PGP 2.63
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- rngaugp(a)alpha.c2.org wrote: > Here is the README file that comes with the modifications. > - ------------------------------------------ > Hardware Random Number Support for PGP. > PGP 263 international version > > Ever get tired of typing in keyboard timing strokes while generating a > PGP key? Ever want to use PGP unattended, but be foiled because there is > no one there to type the keyboard timing strokes? > > Ever wonder if PGP's method of generating random number might have some > subtle flaw which would expose it to cryptanalysis?[..] Ever wonder that a random number device driver or hardware will have a subtle flaw??? Relying on the /dev/random NOISE.SYS driver now while it's still in beta isn't nec. a good idea. For experimentation, sure. I'm also rather concerned as to how this version of PGP handles it. Very much so. The current and latter versions of NOISE.SYS parallels the Linux random.c driver in that there are two devices, /dev/random and /dev/urandom... the older versions (pre version 0.4) will return as many bytes as are requested (from /dev/random) whereas the current version returns only as many bytes as are conservatively estimated to be "truly random". If you are using the older NOISE.SYS /dev/random or the newer version's /dev/urandom for key generation then essentially you're using a pseudo-RNG based on SHA rather than real random data. The implementation should try to get as many bits as are needed from the driver and then request some keystrokes, collect more data, etc. until you have enough bits (advantage over older PGP method? You only need to sample from driver, and not worry about processing raw samples yourself; driver also samples from other sources than keystrokes as well...) I'd be wary of relying on NOISE.SYS or any similar driver for PGP-key generation until the driver gets more thorough examination; I'd also be VERY wary of an improper use of the driver. - --Rob (who wrote NOISE.SYS). - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMRjSNSoZzwIn1bdtAQEn+wF/ZxQKqOCRyKrJjmdtYtE2kVG6v+3NkOOb 84JMpWkpzkMVe8L7LHr7bLdgzkVxDB+8 =m54+ -----END PGP SIGNATURE-----

1 0

Re: [noise] the individual and the tribe
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

>Rob said: >> ... in the sense that >>tribal societies are individualist. Jean-Francois Avon (JFA Technologies, QC, Canada) wrote: >I absolutely don't agree. The subordination of the individual to the tribe >is fundamental of their vision of the world. Some tribal societies are individualist, some are not: Most of the myths and legends of the Australian Aboriginals have a lone ranger character as the hero or villain, or at least most of the ones that I have read feature a person whose life is dramatic or heroic in part because he is tribeless, perhaps for the same reason as most heroes in Disney cartoons are orphans. Individualism is not about the >personnal opinions, it is about the vision of Man as an entity in itself, not >a type of cattle that owe his service to the collectivity of the tribe. > >Crypto makes the tribe (and it's sorcerers) loose their grip... :) > >JFA > > > --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

RE: Why am I wrong?
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

(Was referring to the govs ability to control communications *with them*) >Perhaps I do not understand your point. They can perhaps >control the communication between them and me, but not between me and >everyone else. Ok please view my three points fromn the standpoint that so much of the total traffic would be affected by at least one, that "uncontrolled" communications would be minimal. >>2) communications using someone else's equipment/network (university, >> employer, etc) >Employers nor universities have any jurisdiction over whether you use >encryption in your transmissions while using their networks unless it >specifically does not allow it when you first agree to have an account with >them. I think you had better review the concept of "property rights". Unless you have a contract that says you can, or can establish "expectation", the property owner who allows you to use their equipment may control how it is used. >>3) communications with anyone (Internet merchant, etc) who says "this >> is not what <MasterCard|Visa|AmEx> approves..." >I don't quite understand your meaning. I am a merchant and I encourage my >customers to use PGP when they send information over the internet, whether >to me or to anyone else. That is fine but what if MasterCard refuses to accept this method ? (Not saying they will, just "what if" ? You are free to use digicash if you want but is not "legal tender for all debts public and private". >Comments? Bring 'em on! :-) I dood it. Warmly, Padgett

1 0

Re: Windows PGP mail reader
by Ted Garrett 17 Dec '03

17 Dec '03

At 09:56 PM 2/3/96 GMT, you wrote: >In article <4eaksb$6i9(a)recepsen.aa.msen.com>, jims(a)conch.aa.msen.com says... >>Hi. Can anyone recommend a Windows based email/POP3 reader that can decrypt >>content? Please reply via email: > >Have a look at Pegasus Mail. It handles PGP very nicely with a recent >addition. by John Navas, both are free: >http://users.aimnet.com/~jnavas/winpmail.htm > I recently picked up "PGP Windows Shell". I have found it to be an excellent utility for encrypting and decrypting messages as easily as cutting to and pasting from the clipboard. All operations are automated, you can use whatever mailer you want, and it's freeware. The URL is http://iquest.com/~aegisrc/utils2.shtml Also, if you want something to automate usage of the cypherpunk style remailers, check out Joel McNamara's Private Idaho. It's an excellent tool, also freeware, and is available at URL http://www.eskimo.com/~joelm/pi.html Another utility you might like to look at (of course it's freeware too) is PGP WinFront. While it's a little more cumbersome than PGP Windows Shell, it has all the same functionality. There is also a shareware utility available from the same URL, called PGP QuickFront. The combination of QuickFront and WinFront make using PGP under windows almost pleasant. It can be found at http://netaccess.on.ca/ugali/crypt/ .

1 0

Re: Electronic Grille Cipher?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"wlkngowl(a)unix.asb.com" 6-FEB-1996 03:23:01.15 >An idea occurred to me the other day, for hiding multiple texts in one file using multiple keys. The gist of it is to take a reasonably large file of random data and then to hide the bytes of a message in scattered locations. The method of determining where each byte is would be based on a good cipher which for each iteration would return a relative offset from the last location in the file. ----------------- I had a similar idea a bit back, and Lewis/Futplex kindly referred me to some parts of the Archives discussing it. However, the main objection to this idea was that the cops would just do a search warrant for the second group of information. My solution to this is to have quite a few groups of information, which would admittedly make the spacing problem a bit hard. The following might be an example for someone of such a scheme: A. Accounting information that you give the IRS (and the cops if they come) B. Your collection of vanilla, heterosexual alt.sex.stories (give to cops) C. Your collection of digitized playboy centerfolds (give to cops) D. Your collection of, say, homosexual bestiality stories (don't give) E. Your collection of digitized photos of the above (don't give) F. Your _real_ accounting information (don't give) G. Your plans to violently overthrow the government (don't give). You'd just reveal the top two at first; if they asked if there was anything more, you'd reveal the third. All three are things that you can easily justify wanting privacy for- and some of them are ones that you'd want different people to have access to (your accountant vs your lover, for A & B). -Allen

1 0

RE: How to solve the tax problem w/o anarchy or force (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: Matthew James Gering <mgering(a)ecosystems.net> > Subject: RE: How to solve the tax problem w/o anarchy or force (fwd) > Date: Mon, 9 Nov 1998 17:25:45 -0800 > I don't think many cpunks (and other freedom loving people) are necessarily > nihilistic so much as they have come to the conclusion that to ignore and/or > subvert government has higher probability of success than trying to reform > it -- much to the demise of the Libertarian Party. There is certainly little historical evidence to support such a thesis. > The whole cryptography > and geodesic communications being the bane of the nation-state theme tends > to support this idea. Cryptography is the bane of anyone who wants to listen in, it's not just nation-states that get hit with it. As to geodesic communications, it's been around a lot longer than the Internet and nation states are still here. ____________________________________________________________________ Lawyers ask the wrong questions when they don't want the right answers. Scully (X-Files) The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: CDA Yes Votes; Collection
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:10 PM 2/8/96 +0000, Tim Cook wrote: >Find out if yours ( or any ) representative or senator voted for the >CDA. Send me email with the subject CDA-YES. Put their name and >where they are from in the body. I'll compile the list and post it. >When this is over they'll wish they realized how powerful the >internet REALLY is. Most of those voting against the Telecoms Bill did so because they were against the dereg provisions not the CDA. Most of those who voted for it favored the general technical provisions. Most who thought about the CDA and still voted for the bill decided to let the courts handle the unconstitutional provisions because "federal judges don't have to stand for election." Political retaliation is useless in the face of a 90% yes vote. If you are deeply upset by the high-handed manner in which the legislature has screwed around with your life, welcome to the club. Every bill they pass and every regulation upsets someone just as badly as you are upset. That is why some of us want less legislation and less regulation to minimize just this sort of human suffering. Maybe next time those of you who are into "proactive" government will think before you crush other people's lives. DCF "Par Example -- I hate the Pure Food and Drug Act and the FDA just as much as I hate the CDA. Both are utterly evil."

1 0