- cypherpunks-legacy@lists.ogf.org

FWEE!: Supreme Court news
by Joe Thomas 30 Mar '93

30 Mar '93

-----BEGIN PGP SIGNED MESSAGE----- In the ÒWhy We Need an Anonymous Whistleblower GroupÓ department, I quote the last few paragraphs of a story in todayÕs paper (ÒJustices to Rule on ÔPretty WomanÕ Parody,Ó but thatÕs not what this is about...) The Washington Post, page A4, Thursday, 30 March 1993, reproduced without permission: Separately yesterday, the justices refused to hear an appeal by two former defense contractors who were convicted in 1991 of illegally obtaining Pentagon information in the fraud scandal known as ÒOperation Ill Wind.Ó Thomas D. McAusland and Christopher M. Pafort, former executives at Litton Data Systems, which was seeking Navy contracts, were prosecuted under federal statutes that bar theft of government property. In their appeal, they argued that government information is not ÒpropertyÓ and that no statute or published regulation actually barred dissemination of the information. Their lawyers said an appeals court ruling in the case, _McAusland v. U.S._, could make any leak of government information, even to the press, the basis for criminal liability. [The defendants are apparently typical sleazy contractors who managed to get some inside information on a contract they were pursuing. Obtaining such information was made a crime _after_ they got the information, so the government charged them with the Òtheft of government propertyÓ crime -JGT] And, from an editorial in the Post (Ò. . . Custom and CrimeÓ), page A20: It is not necessary to make a judgment on the defendantsÕ conduct to be appalled by the use of the theft statute to prosecute them. There should be a presumption that government information belongs to the people unless specifically protected by law, as national security data have been for some time and as contracting information now is. The Washington Post joined other media organizations in filing a brief in this case to make exactly that point. The high courtÕs failure to review this case leaves in place a ruling that would make it possible to prosecute journalists who receive tips from government sources about corruption or public advocacy groups that listen to whistleblowersÕ charges about waste and inefficiency. It is not enough to say, as the government does, that this probably wonÕt happen. The court should have reversed these convictions to make clear that it cannot happen. -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK7iTLYwu6QoBw6rbAQHcMgP+N0g3KbTfy5KOlKoylYMg+ZFZrw+Rf4T7 pERTml6QQ4ZYkerLXZD24QGqJHNv/eNeHhwQmTvm4b8mQIY0M1fdecOZNsfKV9GJ sRKs2gu0Jgl/PW51gDkbZaIvTnz1bJF5gbvGylcZHOiMwva+p5ioxYOMhey79bOk 15KzBlhTQ94= =G3NJ -----END PGP SIGNATURE----- -- Joe Thomas <jthomas(a)access.digex.com> PGP key available by request or by finger. PGP key fingerprint: 1E E1 B8 6E 49 67 C4 19 8B F1 E4 9D F0 6D 68 4B

1 0

ANON: UUNET Info.
by Hal 30 Mar '93

30 Mar '93

Thanks to Greg Broiles for the information on UUNET. I ftp'd some info from ftp.uu.net as he suggested. Here is an edited version of one of their main info files. I have left in the part relevant to UUCP connections. I would comment that this looks like it would not be an economical approach for providing an anonymous posting service. The volume experienced by these services has been very high. Greg indicates that he gets about 700 chars per second for his link. Any posting or remailing request is going to have to be transmitted twice (once in, once out). At $2.47 per connect-hour we're talking about $2.00 per megabyte posted or remailed. I believe Julf has seen several megabytes per day. So this volume will push the bill up to the range of hundreds of dollars a month. This is pretty expensive just to support truth, justice and the American way on the net. (This could be reduced if large messages were filtered, but I don't know if UUCP allows for a way to filter incoming messages so you don't get billed for them. After a while, though, if people learned that large messages don't get remailed, they might stop sending them. OTOH, the operator of this service would be vulnerable to mail bombs by those opposed; the bombs would land right in his wallet.) Info from UUNET, edited, follows below. Hal 74076.1041(a)compuserve.com -------------------------------------------------------------------------- UUNET offers access to: * UUCP mail - Over 2,000 direct mail connections - UUNET is an authorized Internet mail gateway, and can act as your Internet mail forwarder. - UUNET serves as the principal gateway to European, Australian Asian, Indian, and South American UUCP sites. * USENET news - UUNET offers a full or partial news feed; all news groups are offered. - Over 1,000 news feeds [...] WHICH ACCESS METHODS ARE AVAILABLE? * From within the United States: - Dial your closest CompuServe network access number (local from thousands of US cities). You are then connected to UUNET via the X.25 public data network. No registration with CompuServe is necessary. - Direct dial modem at our Austin, TX; Berkeley, CA, Boston, MA; Falls Church, VA; Palo Alto, CA; Portland, OR; and San Jose, CA hubs. - 800 number - 900 number for anonymous access to our archive * Connection Methods - UUNET supports all standard modems (V.32 / V.22bis / Bell 212A / Bell 103) - For those of you with UNIX platforms, you only need the standard UNIX uucp programs. For those with non-UNIX platforms, software is available through commercial vendors. * Modem Types - UUNET uses Telebit T2500 Modems - We support Telebit PEP / 9600 V.32 / 2400 / 1200 / 300 bps [...] HOW DO I SUBSCRIBE TO UUNET? We have several subscription options for users with different needs. The options and pricing are described below. Call us and ask for the General Information Packet on UUNET and AlterNet. Fill out the UUNET Subscription Form and send the original in to us! Subscription options are: * Regular uucp Our basic service which provides email and news connectivity for $36 per month plus your connect hours. Charges for connect hours are listed below. RATE TYPE RATE LESS 5% MINIMUM _____________________________________________________________________ Local Inbound (per hour) | $2.60 | $2.47 | 1 min. Local Outbound (per hour) | $2.60 | $2.47 | 3.6 min. | | | Remote Inbound (per hour) | $5.60 | $5.32 | 1 min. | | | Compuserve Modem (per hour) | $5.60 | $5.32 | 1 min. | | | Inbound (800) and Outbound WATS Daytime | $16.00 | $15.20 | 1 min. Inbound (800) and Outbound WATS Evening | $13.00 | $12.35 | 1 min. Inbound (800) and Outbound WATS Night | $10.00 | $9.50 | 1 min. -------------------------------------------------------------------- * Low-volume Users All sites are entitled to three connect hours per month for an annual fee of $300, paid in advance. Customers may connect via local dialup, remote dialup, or the CompuServe remote network (CompuServe charges are included in the fee). In addition, customers may use UUNET's 800 number for an additional $180 per year (total $480, paid in advance). Restrictions - Sites exceeding three connect hours will be charged at regular UUNET rates for the entire monthly usage, not just the excess. This includes the $36 administrative fee. - The yearly fee is non-refundable and will not be prorated for partial months. - This offer is only available in the continental USA and may be withdrawn at any time. [...] WHO DO I CONTACT WITH QUESTIONS? Please contact us and ask for Customer Support. WHERE IS UUNET? The address is: UUNET Technologies, Inc. 3110 Fairview Park Drive, Suite 570 Falls Church, Virginia 22042 USA +1 800 4UUNET4 (voice) +1 703 204 8000 (voice) +1 703 204 8001 (fax) info(a)uunet.uu.net

1 0

Re: discount datacom rates?
by jcook＠pro-storm.metronet.com 30 Mar '93

30 Mar '93

Well you definitely have my interest peaked. Let's discuss this scheme some more Julian Cook JCook(a)pro-storm.metronet.com ProLine: jcook@pro-storm Internet: jcook(a)pro-storm.cts.com UUCP: crash!pro-storm!jcook Bitnet: jcook%pro-storm.cts.com(a)nosc.mil

1 0

Anybody out there?
by scott＠shrug.dur.ac.uk 30 Mar '93

30 Mar '93

I have received nothing on this list sicne Feb 20th, is it just me? Thanks, Scott

1 0

discount datacom rates?
by George A. Gleason 30 Mar '93

30 Mar '93

I've discovered there may be a way to provide late night (1am - 4am) dialup data communication at a substantial discount in long distance charges. We'd need something like a few thousand users in order to get this running. Feedback...? Ideas...? Email gg(a)well.sf.ca.us

1 0

Re: PGP Secure?
by baumbach＠atmel.com 29 Mar '93

29 Mar '93

> This has been recently hashed over in sci.crypt. Here are a few > generalities, read the articles in sci.crypt for the real numbers. For those of us who don't have access to USENET, is there a mailing-list that echo's it's content and allows posting? > -If you did 1000 attempts to break a 1024 bit RSA key every second > and started your calculations at the beginning of the universe, you > would still have several trillion years to go. > -If you stored every attempted key in a single atom, you would run > out of atoms in the universe long before you ran out of keys. Couldn't this argument also be made about a simple substitution code? How secure is PGP with current smarter attacks? Peter Baumbach baumbach(a)atmel.com

1 0

anon email/caller id
by Mr. Noise 29 Mar '93

29 Mar '93

Phil Karn's anology between anonymous e-mail & caller i.d. gets it right, I think. If you don't want to read it, don't, just as you may block calls without caller i.d. There are two concerns I'd like to see addressed, though: first, what about those who use anon email to get away with behavior that wastes net resources? When the identity of the poster is know, they can be 'disciplined' by other net.citizens (call it frontier justice if you like...). second, from the opposite end, won't the availability of caller i.d. mean that it will become more diffuclt to engage in truly anonymous conversations over the telephone network, as revealing one's identity becomes the norm? As to the first objection, I suppose we could continue to rely on the site administrators (& remailer admins) to discipline the offenders. After all, the sites are still subject to the same discipline we can inflict on the individual poster if known. As to the second, I suppose we can always observe that those who won't accept our anonymous call aren't worth talking to in the first place, but that evades the question IMHO. Also, having the capability in the phone system means someone can still abuse it without our knowledge. I would suggest another solution to this dilemma: 'handles'. Having a semi-secret identity means having control over your Real Life exposure to risk, whiel still allowing those you come in contact with to indentify you-- & ignore you if they wish with minimal trouble. It also means that you can set different levels of security: anyone who cares to can find out who Mr. Noise is, but how many of you know the *other* 'real mes'? Well, just some rambling thoughts at lunchtime as a way of saying hello to all of you on this list, since I just joined a week ago & didn't want to 'lurk'. :-) Have an anonymous day! Mr. Noise

1 0

a blackmail opportunity
by Eli Brandt 29 Mar '93

29 Mar '93

While writing some appropriate paranoia for a canned response to remailer info requests, I realized that running a remailer is a perfect prelude to blackmail. An unscrupulous person running a remailer can obviously keep records of truenames, along with messages that their senders do not want associated with them. Making use of this information could involve a scenario to the crypto-extortion previously discussed, but blackmail would be far more believable than anonymous threats. Alternatively, the blackmailer could be low-tech and resort to present techniques. Always encrypting helps with mail, but not with news. PGP 2 key by finger or e-mail Eli ebrandt(a)jarthur.claremont.edu

2 1

anonymous services
by Lord Krieg 29 Mar '93

29 Mar '93

-----BEGIN PGP SIGNED MESSAGE----- After reading Mr. Finney's response to my comments, I can see that I really shouldn't try to make suggestions on how an anonymous service should be implemented. I clearly don't have the knowledge necessary to address this subject without sounding like an idiot. :-) So... I'll instead simply say what I would like to see in an anonymous service, and I'll leave discussion of the technicalities to people who know what they're talking about. I'd like to see something which combines the strengths of the different types of anonymous services while reducing or eliminating the weaknesses. A service which can be used as easily as anon.penet.fi would certainly be nice. I'd also like to see encryption available as an option. Ideally, messages would not _have_ to be encrypted. Making encryption optional would be good for paranoid individuals such as myself, while making the service more accessible to people who are willing to sacrifice security. This would also accomodate people within the U.S. who want to use the service put are afraid of Mr. Sternlight. :-) I like the way the Cypherpunks Remailers let users chain and encrypt their messages so that even the remailers can't know both the sender and recipient. This is something I'd also like to see in a new anonymous service. I still think that one or more back-up servers would not be a totally bad idea. I realize that I don't know what I'm talking about, but I just don't understand why it would be impossible to have a back-up server (with a copy of the active server's database) on standby. I'm not saying that the existence of such a back-up should be advertised--I just think that it should be possible to have somebody set up a backup _without actually running it_ so that when the active server gets shut down, it can quickly step in to take over. Oh, and on a unrelated subject... Could anybody with information on $50/month UUNET connections please send it to me, or tell me who I should write to about it? Thanks in advance. Kenneth G. Hagler ********************************************************************** * Internet: cvadsaav(a)csupomona.edu * My insurance company * * Phone: (909) 865-7751 * is Beretta U.S.A. * * PGP 2.2 key available on request * * *--------------------------------------------------------------------* * ...study of the military arts will make one who is naturally * * clever more so and one who is born somewhat dull rather less * * so. * * --Daidoji Yuzan Shigesuke, _Budo Shoshinshu_ * ********************************************************************** -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK7aFnSipatcRAyu9AQF6UgQAwmchM/JwJS16i/FA6MF0yVAhUg2gpkX2 osLEPpPrlISCwy1dulBxpHJhFyIVSshTx2J5962efiw4pR9+/1F47tOESFHbGLN1 yfKU1pJo1pNyh2ZX72YKK2AvOvAtgz22sXZK01I7jDJbCZdvfoha2T1c5H4KfRQ6 23ddGKcUOVc= =VXNO -----END PGP SIGNATURE-----

2 1

PGP Secure?
by uni＠acs.bu.edu 29 Mar '93

29 Mar '93

Forgive my slow math mind, but I pose the following question, knowing in advance that it's a FAQ, but I can't find an answer anywhere.... Given a brute force attack on ciphertext encrypted with PGP2.2 using the 1024 bit key, how many operations are required to hit on the session key...? (The session key being used with the IDEA cipher) What about derriving the RSA key pair from the public key and message? How many operations might this require? Along these lines, what's the best guess at the highest technology level available today with regard to speed? How many operations per second might the most resourced orginization be expected to achieve? The real meat of this question boils down to: What are the capabilities currently, and what is required to brute force the various stages of PGP? Also: What does 1024 bit refer to? The IDEA session key? or the RSA key? Thanks in advance... uni

3 2