February 1993 - cypherpunks-legacy@lists.ogf.org

Re: Anonymous flooding
by tcmay＠netcom.com 25 Feb '93

25 Feb '93

Johan Helsingius <julf(a)penet.FI> writes: >> Ultimately, I think this is the only way that anonymous remailers will >> be able to function. Otherwise, the public outcry the first time one of >> these remailers are abused will cause these full remailers to be >> shutdown, or otherwise cut off from the net. > >Exactly as has happened to anon.penet.fi. ;-) > > Julf Have I missed something? Has anon.penet.fi been shut down or cut off from the net? Please fill us in. I think most of us are rooting for you and your system (though some *.army.mil readers are probably not--they just can't stand the thought of defense secrets being sold on crypto anarchy nets!). -Tim -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

2 1

Re: Re: Anonymity vs accountability - a balanced view (maybe?)
by Johan Helsingius 25 Feb '93

25 Feb '93

> Folks who have watched USENET for any appreciable length of time know > that reason is not highly prized there. Volume is. > > The self-apponted gods of the net can't stop us, they can only bitch > about us. Let them. > > This is no different than any other USENET issue. The only way to win > is not to play. I have been trying to do that. But... Unfortunately they *can* stop a lot of us. Let's take anon.penet.fi as an example. A poor 386 box playing sitting duck for anyone who really wants to flood it (and Karl Kleinpaste, among others, has spoken about doing this on news.admin.policy). The other thing is that in some official circles news.admin.policy is regarded as some kind of semi-authority. If that group reaches a consensus to ban anon postings I would get hassled by at least the academic network in Finland, for "causing Finland a bad name on international networks". It wouldn't stop me, but might make my life a bit unconfortable. And it has managed to stop almost every anonymous posting service to date. Julf

1 0

problem installing pgp on a sun4...
by Eric Fogleman 25 Feb '93

25 Feb '93

Cypherpunks, I downloaded 'pgp' from soda.berkeley.edu and 'unproto' from win.tue.nl, ran the Makefile (make sun4cc) and got a binary that passes the test given in setup.doc. However, I got the following warnings: "crypto.c", line 1445: warning: constant 256 is out of range of unsigned char comparison "crypto.c", line 1445: warning: result of comparison is always true (along with the same messages for line 2445.) Here are the relevant lines... from pgp.h: #define MAX_PATH 256 from crypto.c: unsigned char litfile[MAX_PATH]; ... 1445 --> if (litfile[0] < MAX_PATH) 2445 --> if (litfile[0] < MAX_PATH) I can see where this is a problem; 256 won't fit into eight bits. What is the correct way to fix this. Should MAX_PATH be set to something else? Thanks for your help, Eric Fogleman

1 0

dispatches from the front lines of anonymity
by John.Nieder＠f33.n125.z1.FIDONET.ORG 25 Feb '93

25 Feb '93

("L. Detweiler") states: BK> the BK> possibility of a centralized moderator stripping addresses, while BK> already currently supported in the software mechanisms, is problematic BK> because it is a single location with all the traffic--hence the need to BK> go through independent anonymous servers first. But I think the BK> localized header-stripping is totally superior to all this. Having a BK> message bounce around a net a bit with *real* information is very BK> vulnerable, when the ID could be stripped off at the source. There is also the problem of those (like me) who access the internet from outside, through gates. The messages are not only marked with the point of origin automatically by the originating BBS's software, but are also subject to monitoring by any number of systems operators en route to internet. When all of the headers (including passwords for the anonymous servers) are in plaintext, the entire anonymous system seems compromised. While some servers I haven't tried yet seem to be PGPed, this doesn't seem to be the case with penet.fi. BK> How about an EFF sponsored server? Yes, and preferably at a site outside the US, just for good measure. There is an obvious appeal to having servers outside the jurisdiction of American law-enforcement busybodies. JN ... "A Few Years in the Absolute Elsewhere..." --- Blue Wave/Opus v2.12 [NR] -- John Nieder - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!33!John.Nieder INTERNET - John.Nieder(a)f33.n125.z1.FIDONET.ORG

2 1

Re: Internet is Not the Long Term Solution
by pmetzger＠shearson.com 25 Feb '93

25 Feb '93

> From: tcmay(a)netcom.com (Timothy C. May) > > I want to clarify some points about my earlier posting on how remailer fees > fix the "anonymous flooding" problem which Marc Ringuette mentioned. > > Implicit in my comments were some assumptions which I ought to break out > separately: > > * The current Internet, glorious as it is, is not the likely long term > solution. The various bans and constraints on business interactions, on > fees, on commercial use, etc., are major limits to what we're talking about > here. (Some alternatives exist, like Alternet (sp?), but Internet is what > most of us are now using.) Alternet is part of the Internet. There is no central control on the internet -- only on segments of it. UUCP is even more anarchic... > * The Internet policy statements are often invoked by sysadmins and > would-be censors (David Sternlight comes to mind) who are worried about > uses, abuses, and out of the ordinary situations. Ditto for Prodigy and > similar systems. The talk about bans on anonymous mail (nothing seriously > proposed, so far as I know) reflect the government-dominated nature of the > current Internet. The NSF NET has policy statements. There are no policies for the internet and indeed given that the internet spans at least thirty or so national jurisidictions and tens of thousands of different networks its impossible to have one policy statment. The risk is that Al Gore and Company will manage to ram through their goverment managed internet which would put PSI and company out of business and which would permanently assure that most traffic passes through zones with draconian policies. Perry

1 0

Re: Enough's enough already
by dmandl＠shearson.com 25 Feb '93

25 Feb '93

> From: John.Nieder(a)f33.n125.z1.fidonet.org (John Nieder) > > Paul Ferguson writes: > > BK> I know that someone may declare my query as naive, but if you > BK> feel strongly enough about a topic, why wouldn't you want the > BK> recipient to know who you are, where you are and who they can respond > BK> to? > > I just had a chilling example of why last month. Someone who made my > life a living hell (in real life, not cyberspace) "found" me again in a > discussion in a tech newsgroup and sent me a "yoo-hoo!" e-note. I could > have gone a long time without that. My identity was irrelevant to the > discussion, but was unfortunately very relevant to making this nasty > little surprise possible. > Yup, there are dozens of reasons to want anonymity. This should be completely obvious to anyone moving in cypherpunk circles--or alt.sex circles, where, amazingly, some well-respected sexosophists actually spoke out against anonymous posting recently. No offense intended, but anyone who can't think of situations where anonymity is essential should get out more. Any first grader can list dozens of places where even mild blasphemy will get you locked up for a long time. [Begin Zerowork tangent] And even if you think the U.S. isn't one of them (which it is), keep in mind that most workplaces are effectively stalinist dictatorships, and bosses may not be thrilled about having their employees discuss crypto anarchy, the overthrow of governments, or S & M on the net. --Dave.

1 0

Enough's enough already
by John.Nieder＠f33.n125.z1.FIDONET.ORG 25 Feb '93

25 Feb '93

* Reply to msg originally in Cypherpunks <INET> Paul Ferguson writes: BK> I know that someone may declare my query as naive, but if you BK> feel strongly enough about a topic, why wouldn't you want the BK> recipient to know who you are, where you are and who they can respond BK> to? I just had a chilling example of why last month. Someone who made my life a living hell (in real life, not cyberspace) "found" me again in a discussion in a tech newsgroup and sent me a "yoo-hoo!" e-note. I could have gone a long time without that. My identity was irrelevant to the discussion, but was unfortunately very relevant to making this nasty little surprise possible. As the penet.fi helpfile mentions, one of the concerns was for the privacy of those participating in theraputic discussions on such touchy subjects as incest and abuse. In that many theraputic disciplines stress a confessional mode of treatment, the security required for persons to "open up" must be (or appear to be) absolute. These electronic therapy groups may not appeal to you or me, but they have large followings and seem to serve a useful purpose for some. Maximum anonymity is desirable for those participants. I can think of several other very serious reasons for persons to desire untracable communications, but they go beyond the scope of the matter at hand. More to the point, in my experience I have found very little to be gained by revealing my true identity. The less known about me, the better for my personal security. That's the whole point of the privacy "movement." Who I am is nobody's business but mine. JN ... "Is it too late to get the Russians to drop a nuke on Washington?" --- Blue Wave/Opus v2.12 [NR] -- John Nieder - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!33!John.Nieder INTERNET - John.Nieder(a)f33.n125.z1.FIDONET.ORG

1 0

link encryption
by Timothy Newsham 25 Feb '93

25 Feb '93

ahh.. I just thought of something I should mention about that code I have sent out. I am releasing MY CODE to the public domain, but parts of the package are not mine :) In particular the RSA code and the DES code come from other places. I dont think there are any restrictions on the code, but they dont become public domain with my code :) Lets keep me out of trouble

1 0

Re: Anonymity vs accountability - a balanced view (maybe?)
by an5877＠anon.penet.fi 25 Feb '93

25 Feb '93

In-reply-to: Matthew Rapaport's message of Wed, 24 Feb 1993 08:20:43 -0800. <9302241620.AA25561(a)netcom2.netcom.com> -----BEGIN PGP SIGNED MESSAGE----- Matthew argues for balance in the USENET battle over pseudo/anonimity. Matthew is preaching to the choir. Folks who have watched USENET for any appreciable length of time know that reason is not highly prized there. Volume is. The self-apponted gods of the net can't stop us, they can only bitch about us. Let them. This is no different than any other USENET issue. The only way to win is not to play. DEADBEAT -----BEGIN PGP SIGNATURE----- Version: 2.1 iQBFAgUBK4wpGPFZTpBW/B35AQFppwF/fACfJjSLzYDi7LNCRCndyZwxTIRbpuIp G+G9pvcjA/dJQn6Z/AtDuyIe0guaihxS =VpJU -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind system, any replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi. *IMPORTANT server security update*, mail to update(a)anon.penet.fi for details.

1 0

Anonymous flooding
by Marc.Ringuette＠GS80.SP.CS.CMU.EDU 25 Feb '93

25 Feb '93

I wonder if full crypto anonymity as we envision it will be stable? I'm very concerned about the problem of anonymous users intentionally flooding the network with garbage in order to bring it to its knees. Current practice, in the non-anonymous world, is to trace excess traffic to its source and stop it from being generated. This will no longer be possible when true anonymity is available. This would particularly be a problem if a remailer is willing to forward an incoming message to more than one destination. In that case, by sending a single anonymous message, a saboteur could generate an exponential amount of net traffic. This would be bad. Two basic precautions for a remailer to take are 1. To require a 1-1 correspondence between input and output messages. 2. To require that the address portion of the message shrink at each step (preventing infinite loops). If this is done, then the saboteur's original message can be at most n-fold replicated, where n is the maximum number of remailer hops allowed. However, I still have some fundamental concerns that an anonymity-based system is vulnerable to flooding and denial of service by the bad guys, including Big Brother, who may wish to prevent effective use of such systems. This may make operating a remailer a difficult proposition. I'm discouraged. Any thoughts? -- Marc Ringuette (mnr(a)cs.cmu.edu)

4 5