- cypherpunks-legacy@lists.ogf.org

Re: Digital cash issues...
by fnerd＠smds.com 26 May '93

26 May '93

> Regarding the issue of what to do under Chaum's scheme when someone double- > spends a piece of digital cash & their identity is revealed... I don't think > it's going to be a serious hindrance in the long term. ... Any credit card > company, phone company, or other corporation that does a lot of billing > already has staff dedicated solely to that function, with collection agencies > providing a second tier of functionality for the tougher cases. > > Dr. Cat / Dragon's Eye / New traditions for the next century Yes, but we would like to steer towards a world where no one you do business with knows or can reconstruct who you are or where you live. "Collection"-- the whole idea of "billing," in fact--is a way of doing business that's rooted in non-privacy. But also it's based on wanting to make transactions easier for people in a world without easy electronic transactions, accounting, budgeting, negotiation, reputations, etc. So maybe with these sorts of things, billing would be unnecessary. Anyway, thinking up variations on offline payment systems is a passtime of mine. Situations where people can't be online with the bank are special cases, so you can make up special-case solutions, like o "Tokens" or gift certificates that you buy in advance, or o Annonymous checks that expire and are refundable if the (specific, annonymous) payees don't cash them in a certain amount of time. Credit as it exists often seems like a trade with the devil of privacy invasion. Jeez, what would the world be like without *credit cards* and *junk mail*!? -fnerd

1 0

DE platform
by meyer 26 May '93

26 May '93

My apologies for not thinking to state what platform Dolphin Encrypt currently runs on. It's vanilla MS-DOS. Other versions are planned. The Dolphin Encryption Library (16 or so functions, containing the core encryption functions from DE) is also for MS-DOS (designed to work with the Microsoft and Borland development systems). This is all standard ANSI C code, so should port to other platforms without much problem. Currently there's a Clipper-oriented (that's the database language) version in preparation. Developers on other platforms (Unix, Amiga, etc.) who are interested in porting the library should send me email. I am most interested in contacting someone who can not only port the library but also market it. Porting of the Dolphin Encrypt program is a Stage II task, and depends on successful porting of the library. -- Peter

2 1

Re: Just the facts, ma'am.
by jthomas＠kolanut.mitre.org 26 May '93

26 May '93

From: composer(a)beyond.dreams.org (Jeff Kellem) > > On the cypherpunks mailing list, Strat wrote... > > Rarely will you find a system administration staff more concerned with > > your privacy that the guys at Digital Express Group. As I recall, the > > set of username->real name mappings isn't even on machine readable media > > on the system. > > Really? That's odd, especially for a unix box, which access.digex.com > seems to be. And, as a matter of fact, it does seem to show "Robert > Stratton" for the username of "strat". So, it seems they do maintain > username to "real name" mappings (even if they allow the user to change > the "real name" listed. Digital Express doesn't require that the GECOS field of /etc/passwd contain real names, although they obviously allow it. (Finger jthomas(a)access.digex.net for my full name, as well as my PGP key :^) I seem to remember that the new user signup script they use explicitly gives you the option of signing up under a pseudonymn, although they'll check up on you by phone if you do (and presumably write your name in the Big Book at that point). I've seen quite a few public access Unix sites advertising "anonymous" accounts lately, especially after Julf's server went down. Joe

1 0

Re: Selling Tapes ?
by smb＠research.att.com 26 May '93

26 May '93

> Rick Adams of UUNET confirmed on the com-priv list that his > organization had been selling the FBI a usenet feed on tape. I coul d > find the exact reference if you want. I don't know for sure that th e > NSA has a feed, or from whom, but it wouldn't surprise me. Seems like the low tech way of doing it. Both organizations have machines on the Internet right now. FBI is ho oked in via ALTERNet, and the NSA (NCSC) is on the MILnet. % traceroute ard.fbi.gov % traceroute tycho.ncsc.mil (and see what happens) This incident goes back quite a while, to the days when uucp was the normal (and almost the only) way of getting netnews.

1 0

Just the facts, ma'am.
by fergp＠sytex.com 26 May '93

26 May '93

Okay, folks. Let's bring this into focus. I don't like unfounded allegations, especially when they are involving my own communications providers, but let's let the truth be known. I'd like to summarize to the list several trains of thought and track this down to a reliable source. If, in fact, a UUNet operator/provider has, indeed, stated that this has been common practice, I think that it may behoove them to own-up to these allegations. Before I do confront the UUNet staff, however, I must get the allegations correct, and I therefore rely on you crypto-rebels to provide them for me. Please. In my original message I stated: >From: uunet!sytex.com!fergp (Paul Ferguson) Message-Id: <VgH54B1w165w(a)sytex.com> Date: Tue, 25 May 93 16:30:06 EDT Organization: Sytex Communications, Inc On Tue, 25 May 1993 14:56:48 -0400, andrew m. boardman <uunet!cs.columbia.edu!amb> wrote - > Food for thought: that, at least as of recently, the NSA bought > weekly dumps of all usenet articles on tape. I highly doubt they > were for their reading pleasure... Is this hearsay, innuendo or fact? If fact, what can you site as reference to support your statement? If you know this to be fact, please cite your references and provide as much detail as possible. Cheers. - -- In subsequent posts, we received these replies. (I'd like to have additional affidavits, if necessary. If you do not care to get involved, fine. If you care, please re-affirm.) From: > Date: Tue, 25 May 1993 17:11:22 -0400 > From: Marc Horowitz <uunet!GZA.COM!marc> >> Is this hearsay, innuendo or fact? If fact, what can you site as >> reference to support your statement? If you know this to be fact, >> please cite your references and provide as much detail as possible. > Rick Adams of UUNET confirmed on the com-priv list that his > organization had been selling the FBI a usenet feed on tape. I could > find the exact reference if you want. I don't know for sure that the > NSA has a feed, or from whom, but it wouldn't surprise me. I would like. Specifically, an e-mail address other than "postmaster." The point is this, Marc: Those of us who subscribe to UUNet through third party services have no idea that our communications may be recorded or archived for intelligence purposes (I know, but that's beside the point). If UUNet _is_ doing this without a broad policy statement, then I think a change is in order. Also, (and I do not implicitly imply that UUNet is responsible), I've had some very interesting problems passing encrypted traffic. For some strange reason, it just disappears. Fancy that. Should I question that? You bet. And I shall. I, and my comm provider, pays in good faith for our Internet services. We are protected under Law, and as far I know, UUNet does not expressly forbid encrypted _private_ communications. But, it happens. They just disappear sometimes. Go figure. > However, the obvious next point is, so what? It's a public system. > Any idiot can pay $20/month and get a public access account. If you > say something in a news post which you wouldn't want the FBI or NSA or > whoever to see, you're the person who has done something stupid. I beg your pardon. Since when does stupidity become a prerequisite for privacy rights violations? I'm not talking about Usenet or List posts, Marc, but private e-mail. > Tapping a news feed isn't like tapping a phone line. It's more like > turning on the television. Of course it is. This is not an issue. > Date: Tue, 25 May 1993 17:26:58 -0400 > From: andrew m. boardman <uunet!cs.columbia.edu!amb> > This was based on a verbal conversation at Interop with someone from > uunet, from whom the tapes are purchased. I or they could be > mis[led|informed|remembering], but if you really care, ask uunet. Thank you for your insights. I will ask UUNet, but I'm beginning to wonder if other local comm providers practice the same deceptions. Does anyone have any experiences with digex.com that they would like to share? If so, it would aid in our attempts to bring these unknown anomalies to light. I don't like spending money to have my private e-mail compromised. > Date: Tue, 25 May 93 18:28:31 EDT > From: Matt Blaze <uunet!crypto.com!mab> > Actually, the most alarming revelation here could be that someone at > uunet is going around casually disclosing information about their > customers. Actually, I find this possibility both extremely disturbing, yet possible. I don't wish that this what we will find out; I hope that legal inquiries will not be necessary. However, if information concerning these topics is not divulged voluntarily, then we must take legal action to bring this to the surface. > Most communications companies, especially those that seek to be > regarded as "common carriers", make quite clear to their employees > that customer data are among their most proprietary and that > revealing any of it is grounds for lightning-speed dismissal. > (Obviously, they reveal data that they SELL about their customers, > and will disclose anything on a court order, but that's not > what we're talking about here). Indeed, we are not speaking of the dissemination of USENet or List information, but rather private e-mail. > Date: Tue, 25 May 1993 19:13:37 -0400 > From: andrew m. boardman <uunet!cs.columbia.edu!amb> > Having just spoken to someone who contracts at the NSA (and no, > this name I will not post), he does not believe they get such a > beast, although, as many people have pointed out, the FBI did. > That, then, would be the origin of that, along with some TLA > confusion. I'd have to be presented with factual documentation to actually believe that. > A lot of people perceive the government as having neither a right > nor a need to privacy. Certainly there are also quite a few who > label themselves "privacy advocates" whose standards do a 180 > when the privacy involved is that of the likes of Mykotronx... Funny how that works, huh? The dumpster divers band together when t comes to stuff like that, from what I'm told. Cheers Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

2 1

Re: Steganography and Steganalysis
by TO1SITTLER＠APSICC.APS.EDU 26 May '93

26 May '93

Begin quote from gnu(a)toad.com on Tue, 25 May 1993 15:27:27 -0700 From: gnu(a)toad.com (John Gilmore) Message-Id: <9305252227.AA27968(a)toad.com> To: kqb(a)whscad1.att.com, cypherpunks(a)toad.com, gnu(a)toad.com Subject: Re: Steganography and Steganalysis In-Reply-To: <9305252149.AA27051(a)toad.com> Date: Tue, 25 May 93 15:27:27 -0700 My favorite scheme was to encode messages in trailing spaces and/or tabs in netnews messages. You could also put internal tabs in place of spaces. In fact, you could do this with news messages that flow "through" your site, (if the messages aren't protected with a crypto checksum), so that you would not be the message's sender (and it wouldn't be addressed to anyone either -- recipients get very good privacy). This would be one way for a Unix "worm" program to report back to its master...and/or receive instructions. John Gilmore PS: You could put short interesting stuff just in your message-ID's! Not to mention the low order bits of timestamps (exactly *what* second did it arrive, now?). ===================================================================== Trailing spaces, however, are likely to be changed by other sites: padded or cut. This might be a good idea if you used mime/PGP's radix-64 or uuencode or something similar. Kragen

1 0

Re: Just the facts, ma'am.
by Bob Stratton 26 May '93

26 May '93

> Date: Wed, 26 May 93 09:14:50 EDT > From: jthomas(a)kolanut.mitre.org (Joe Thomas) > Subject: Re: Just the facts, ma'am. > > > > Thank you for your insights. I will ask UUNet, but I'm beginning to > > wonder if other local comm providers practice the same deceptions. > > Does anyone have any experiences with digex.com that they would like > > to share? > > Nothing but good ones. Doug Humphrey <doug(a)access.digex.net> even > posted to the list a few times as I recall. I'm still not sure I see > a problem with someone providing a newsfeed to the NSA, FBI, or anyone > else, though. > As one of the former tech-weenies at Express Access, and now just a friend with no formal association to the business, I feel compelled to give you my thoughts on that particular service provider. Rarely will you find a system administration staff more concerned with your privacy that the guys at Digital Express Group. As I recall, the set of username->real name mappings isn't even on machine readable media on the system. When I was working with them, we had a big book, and people only accessed the book when absolutely necessary, for instance to inform a user of a file system problem or the like. In fact, on several instances, I would ask other staff people who a particular username belonged to when I had a need to contact them - more often than not, they/we couldn't remember, and I had to look it up anyway. This was by design. >From day one, there was a policy of not disclosing customer information to ANYONE without a warrant. To date, thankfully, I don't think that it's been put to the test, though I have no doubts as to the grief they'll give those trying to get the information. The original machine room was one of the best jobs of low-cost RFI/EMI shielding construction I've ever seen. (BTW, the foam insulation with foil on both sides is a boon to mankind.) It wasn't really intended to keep people from looking at the emissions as to keep the emissions from wiping out all the shortwave receivers in use, but hey, every little bit helps. I'm still a user there, and I have a hell of a lot of respect for that crew. I would also implicitly trust them as a site for anonymous remailing, key certification, or the like. I hope that becomes a part of their business focus in the future, because we need service providers who won't be intimidated. --Strat

2 1

Re: Mike's bummer moving adventure
by smb＠research.att.com 26 May '93

26 May '93

Pat Farrell writes: > The article says that he went onto the WELL and the electronic commu nity > offered to help replace some of his books, etc. A word or two from o ur > community might help raise his spirits. Thanks for the good thoughts, Pat. Anyone who wants the details of my own little disaster down here should send me e-mail--offers of help are appreciated. One request this list could help me with: Does anyone know how I can find a hardbound copy of Kahn's THE CODEBREAKERS. I didn't own a copy before the fire, but I had started my crypto collection, and I'll be continuing to work on it. It's still in print: STATUS: Active entry TITLE: The Codebreakers AUTHOR: Kahn, David PUBLISHER: Macmillan PUBLICATION DATE: 09/1967 (670901) LCCN: N/A BINDING: Text ed., $60.00 ISBN: 0-02-560460-0 VOLUME(S): N/A ORDER NO.: N/A IMPRINT: N/A STATUS IN FILE: New, 80-12 SUBFILE: ST (Scientific and Technical Books and Serials in Print) LIBRARY OF CONGRESS SUBJECT HEADINGS: CRYPTOGRAPHY (00118102) PAPERBOUND BOOK SUBJECT HEADINGS: HISTORY-GENERAL-STUDY AIDS (00001338)

1 0

Re: PGP: Environment protection for UNIX
by stig＠netcom.com 26 May '93

26 May '93

I wrote: > > > main (int argn, char **argv, char **envv) > { > for ( ; *envv ; ++envv) { > if (!strncmp(*envv,"PGP",3)) { > char *c=*envv; > while (*c) *c++=' '; > } /* end of if */ > } /* end of for */ > system("printenv"); > sleep(10); > } > And I should've enclosed it in #ifdef STUPID ... #endif. I misread the putenv(3) man page and didn't realize that you could just use putenv("PGPPATH="); putenv("PGPPASS="); To wipe those variables out of your environment... They still might get caught by a 'ps -eaxuww' but chances are slim. Is it posible to alter your arguments so they're not visible to 'ps -auxww'? Well as a matter of fact, it does seems to work on my sparcstation: main (int argn, char **argv, char **envv) { system("ps -uww"); for (;*argv;++argv) { while (**argv) { *(*argv)++ = ' '; } /* end of while */ } /* end of for */ puts("--------------------------------"); system("ps -uww"); } Not elegant, but that's what makes it a GLP (grungy little program). So, is there a more elegant way to do this? How portable is it? Finally, of how much use is it? Stig /* Jonathan Stigelman, Stig(a)netcom.com, PGP public key on request */ /* fingerprint = 32 DF B9 19 AE 28 D1 7A A3 9D 0B 1A 33 13 4D 7F */

3 2

Mike's bummer moving adventure
by Pat Farrell 26 May '93

26 May '93

This is a bit off topic, please excuse the list bandwidth... Today's (5/26/93) Washington Post has a story on page 1 of the Style section about net-lawyer and occasional cypherpunk poster Mike Godwin (mneumonic(a)eff.org) Seems that Mike just moved from Cambridge to Washington DC, and the moving truck that had all his stuff caught fire and burned. He lost "90%" of his stuff, books, clothes, records, family photos, etc. Serious bummer. The article says that he went onto the WELL and the electronic community offered to help replace some of his books, etc. A word or two from our community might help raise his spirits. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

2 1