- cypherpunks-legacy - lists.cpunks.org

Re: TEMPEST
by joelm＠eskimo.com 17 Dec '03

17 Dec '03

Tim May wrote: >TEMPEST has very little to do with Cypherpunks goals, actually. First, >buying such a gadget, tweaking it, exploring capabilities, etc., would >lead to what? The ability to park a van in front of someone's house >and--maybe--monitor their screens? We already know this is possible. >(You all knew that, didn't you?) If a Cypherpunk goal is to champion electronic privacy, it seems to me that it is important to fully understand any threats to the methods used to ensure privacy. The old Sun Tzu "know your enemy" philosophy. If I was running a Data Haven, I'd want to understand how and if my system could be passively eavesdropped on, and what countermeasures to take to minimize the risk. (Second or third down the list from knowing my encryption algorithm was secure.) Granted, I'd spend more efforts with firewalls because a hacker/cracker attack would be a more realistic threat, but if there was even the most remote chance that a government agency/well-funded concern with TEMPEST capability was interested in me, I'd sure like to make their job more difficult. The thing that I find frustrating about TEMPEST, is most informed people say "yes, it's possible," but I have encountered only breadcrumbs of real-world, technical information and sources on it (the VanEck article, the BBC tape, Grady Ward's paper, etc.). This is what prompted the original message to the list. Yes, TEMPEST is real. But what I'm trying to do is shift out TEMPEST reality (and capabilities) from the magical black-box in parked vans tales. Joel McNamara joelm(a)eskimo.com - finger for PGP key

2 1

Re: Another problem w/Data Havens...
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> I could write a procmail recipe and a script in about an hour to > automatically secret-share-split and redistribute the incoming submission. > If the authorities attempt to indict you for possessing illegal > information / kiddie porn / whatnot, they have to prove that you > interfered with the automatic redistribution process and examined the > contents of the submission. If you in fact did not look at the submission, > they would have a difficult time doing so. The problem with a procmail script, unlike the ugly on-the-fly SMTP-like splitting method I proposed, is that the suspicious message is in your mail system, intact, and if they nail you before you can dispose of it, they can prove you had it. (Even though procmail does stuff quickly, sendmail still accumulates the material before delivering it, doesn't it?) They still have to prove that there's something illegal or forfeiture-supporting about the way you possessed the message, but by then you're hauled into court and your computer is stolen. The Feds argued in the Steve Jackson Games fiasco that intercepting unread mail in mailboxes is different than intercepting it in transit, and while we can hope that will be overturned, it's better not to be the guinea pig. If your machine never has more than a few bits of the message, they can't catch you in possession of the message - they can only argue that bits of it flowed through your machine, and that's much harder to build a case on, and given the abuse the judge gave the Bad Guys in the SJG case, it's probably easy to prevent them from keeping your machine as evidence, or at least get it back. Your paranoia may vary.... Bill

1 0

Re: Scientologys Attempts
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > > who has the authority to remove alt. groups? jamesd writes: > Anybody has the power. Nobody has the authority. More precisely, anybody has the power to send a rmgroup message, just like anybody has the power to send a cancel message. Aside from ettiquette and ethics, the question is whether most of the news servers out there will respond to them, which is a local decision. The last time I ran a news server was in B News days, so your mileage may vary, but responses to newgroup and rmgroup messages can be turned on and off. I used to leave them turned on; not only did new groups appear on my system without manual intervention, but the Great Renaming took care of itself automatically on my box. > [...] This is a classic case of net abuse. Yep. rmgroup wars happen occasionally on the net, usually about alt.joe.newuser.die.die.die and other spam groups run by (or about) people with more spare time than taste. The difference here is that it's part of an organized group-sponsored censorship attempt, rather than an individual squabble, so it retains some degree of classicity. Bill

1 0

Remailer-on-a-CD
by xpat＠vm1.spcs.umn.edu 17 Dec '03

17 Dec '03

>The "Linux mavens" followed by the "black box" stuff sparked an idea... >package. To make it as easy as possible, I'd use the UMSDOS filesystem so >that Linux could be installed on a DOS machine without any reformatting >repartitioning, or similar headaches. >distribution already has) and some boot options, you'd have an "instant >remailer" software package, able to transform any 386SX/4MB RAM DOS macine >or better into a Linux-based remailer site, complete with aliases, loggng >So, am I dreaming, or does this sound viable to y'all? OK, let's ponder the minimum hardware necessary, possible minimal configuration (Intel/clone based): (1) Case. (2) Power supply. (3) Motherboard/CPU and 4mb RAM. (4) Hard drive w/ controller. (5) modem card. (5) No monitor, keyboard, floppy, or video card. (a) would require some "umbilical cord" connection to initially set up from another PC. (b) need to operate on "umbilical", direct and uucp modes. I am just thinking out loud here, but the hardware could be damn cheap (sub $500). You can find old 386 boards with 4mb right on the board (no SIMMs) for next to nothing (the decreasing popularity of 30-pin SIMMs makes this a surplus store reality, as nobody wants to bother to strip out the RAM chips anymore). I have also seen an ad by the KILA company in Boulder, CO who advertise some sort of compact pc-on-a-card deal, that might be applicable. Comments? ------------------------------------------------------------------- P M Dierking |

2 1

Re: Factorisation and Discrete Logs (was Re: EE Times on PRZ)
by Hal 17 Dec '03

17 Dec '03

From: dwa(a)mirage.svl.trw.com (Dana Albrecht) > Choose, at random, "a" such that gcd(a,N) = 1. > > Compute x such that: > > a^x = 1 (mod N) [ Discrete log time! ] DH uses prime moduli, I believe. Solving the DL problem sufficiently to break DH may not let you solve it for composite moduli, not without knowing the factors. Hal

1 0

Re: Abuse and Remailer Ethics
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

>This thread illustrates (at least if setup's like this are >worthy of a place in Raph's list) that penet.fi is the safest >way to go for the moment. I would just hate it to have my >head on the plate of a remailer operator who takes an interest >in subtile ethical discussion of whether to sell me out or not. If you chain it through 3 or 4 remailers with PGP, then pretty much all 3 or 4 of them have got to decide to sell you out. I trust Julf a lot, but I'm not sure I trust him four times as much as much as every other remailer operator. Or something like that. You can also probably use penet as a link on your larger chain, although I've never tried this to see how it works. And I would note that the "subtle ethical discussion" seemed to consist of the operator trying to figure out what he should do in the future about this sort of thing, and he never even seemed to consider turning over the name of the anon user. Although he did acknowledge that in the future he might, or might work with other operators to try and discover a True Name. *shrug*

3 2

Surety Technologies announces: Digital Notary System is on-line
by stuart＠surety.com 17 Dec '03

17 Dec '03

Many readers of this list have heard about the work that Scott Stornetta and I have done, beginning as Bellcore researchers a few years ago, on the problem of cryptographically secure digital time-stamping. In 1993 Bellcore spun off a company in order to commercialize this work. The company is called Surety Technologies, and we call our product and service the Digital Notary(tm) System. I am happy to report that we have just launched the product. To read about it, as well as to get the software, please visit our World-Wide Web home page: http://www.surety.com You can get the software and installation instructions directly by anonymous ftp to ftp.surety.com in the directory /dns/windows. Scott and I would both like to thank those readers of the list who have offered us their support, encouragement, and advice over the years. Stuart Haber | Surety Technologies provides Chief Scientist | the Digital Notary(tm) System. Surety Technologies, Inc. | General info: info(a)surety.com stuart(a)surety.com | (201) 701-0600, fax -0601

1 0

Anonyous Cash through Options Trading
by pcw＠access.digex.com 17 Dec '03

17 Dec '03

Several months ago, there was a discussion at length about how one could use the futures and options markets to transfer funds anonymously. This week's edition of Forbes magazine (Jan 30, 95) has the headline, "OIL! GUNS! GREED! Was Chase Manhattan ripped off by arms traffickers?" In the story, Forbes guesses that some suspiciously large losses in the options market could have been a smoke screen for money laundering: Oil traders do big business in unlisted options, providing a further smoke screen. Perkins points to deals in which Harris would buy a put option on a cargo of crude from a friendly counterpart like Bayoil and resell a similar contract in the oil market. If oil prices climbed, the put would expire worthless and Bayoil would pocket the price of the option, while Arochem would break even. If oil prices dropped, and the ultimate buyer exercised the put, Arochem could absorb the loss while conveniently neglecting to exercise its put against Bayoil, Perkins theorizes. (pg 87)

1 0

Re: (none)
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

Mats Bergstrom wrote: >On Tue, 17 Jan 1995, Name withheld on request wrote: > >> wonders to what end remailers are being put by people who are worried >> about being "sold out". > >The fundamental principle here is that an e-mail message is just so >many bits of 1's and 0's. It can never, in it's own capacity, steal, >molest or kill. It is therefore not unethical to run a no-log 'fortress >remailer' and auto-delete ALL complaints, without exception. It might >not be feasible to do so if one wants to stay out of jail, but hope- >fully this will change with the rapid increase in country domains >and the soon-to-come digicash market. Discussions of programming to >make fortress remailers work and to make them easily exportable to >African Linux-boxes are interesting. So are discussions of expected >repercussions on society. Ethical discussions of what is abuse or not >are better left to the clergy. Here comes the clergy! :-) I'm sure that when your hypothetical remailer comes up and I decide to spam you with your own words (now I wouldn't do that, now would I? ;-), your sysadmin will be comforted by knowing that it's only ones and zeros filling his hard disk. He would be especially comforted if I spammed postmaster(a)wherever.you.are rather than your own account in a move to protect your own anonymity. Advocating a remailer such as you describe is only possible in a world where anonymity is considered the supreme good, a goal to achieve no matter how many other ethical rules we break. In the real world, however, there will always be problems with "acceptable use" and "abuse", along with the additional problems with establishing policy and so on.

3 2

Re: Electronic cash illegal?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Within the United States (and most other sovereign states) Hal Finney is > correct to point out that the power to print currency is reserved to the > government. I would think that e-cash is a currency and therefore illegal > TO ISSUE WITHIN the geographical (legal) domain of the US. He didn't say it was illegal to print private banknotes, just taxable. Anybody can issue paper or metal tokens or whatever - the difference with goverment-issue currency is that they can pass laws saying you must accept it as payment for debts, even though your contract specified repayment in real money instead of private bogons like green paper IOUs or lightweight impure-metal coins with politician's pictures on them. As far as I know, the legal definition of a "dollar" in the US is still a certain weight of silver, and payment in silver legally satisfies debts; under current silver prices, that probably costs more than a $1 US Federal Reserve Note, so nobody bothers. Bill

3 2