- cypherpunks-legacy@lists.ogf.org

Re: Poor Man's Anonymous Remailer
by ghabrech＠ultrix.ramapo.edu 24 Feb '93

24 Feb '93

I think the idea is just that it is an e-mail account. I don't think you have any disk quota or such and probably can't even telnet or ftp from it. The idea for this is privacy. The best way to keep someone from reading your files is to make it so that they can't get their hands on 'em. George

1 0

Poor Man's Anonymous Remailer
by Duncan/Lois Frissell 24 Feb '93

24 Feb '93

To compensate the List for consuming bandwidth with my "political" posting on advertising yesterday, I thought I'd offer some ideas on easy anonymous posting -- no remailers required. Isn't an account that can't be traced to you anonymous? How about an (email only) account for $3/month billed to you (no credit cards required). AT&T Mail (desperate for customers) charges $3/month per Email box with no setup fee. They do charge a minimum of 70 cents per message sent (50 cents if you use their pricy communications software) but they charge nothing to receive mail and give you an Internet address that looks like dfrissell(a)attmail.com. If you open a mail receiving service box in a nome de guerre (which is not hard to do in spite of what you might have heard), call AT&T Mail at (800) 624-5672 and sign up. After you receive your signon info, you can drop the box at the mail receiving service and just pay your future bills without a printed bill. They'll be happy to tell you what your balance is. You can logon to AT&T Mail anytime at (800) 624-5123. Use a payphone if you are really careful and enjoy anonymous posting without outside help and without having to worry about flaky remailers. Duncan Frissell

2 1

Pgp v 2.2
by M..Stirner＠f28.n125.z1.FIDONET.ORG 24 Feb '93

24 Feb '93

According to a message I read today on the Fidonet Public Keys conference, PGP is now in version 2.2 & is available off CompuServe. Has anyone seen this yet? If this is for real, let's get this thing circulating pronto. . ~ . M. ... "Huh? BILL Clinton??? I thought I voted for GEORGE Clinton!!!" ___ Blue Wave/QWK v2.12 -- M. Stirner - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!28!M..Stirner INTERNET - M..Stirner(a)f28.n125.z1.FIDONET.ORG

1 0

Enough's enough already
by fergp＠sytex.com 24 Feb '93

24 Feb '93

Excuse me for dropping my two cents in here, but just what's the big, hairy deal? I apologize for initially bringing up the topic of self-encrypting viruses; had I known that folks would have reacted in such a childish manner, I would never have posted that topic at all. For those of you who wish to discuss it further, I'd suggest posting to comp.virus in the future. I suppose I would take it a tad more seriously when reading some of the posts that have drifted through this area, if they were originally posted to an area that was designed for virus banter. If this sounds like a plea for some sort of sanity check, then I must be coming across loud and clear. Now, I'd like to ask the cypherpunk readership to clarify the need (or perhaps a better term may be "desire") for anonymous remailers? Maybe I'm not getting the "big picture", but it would appear to me that insurance of private communications is the area of intended interest here. I know that someone may declare my query as naive, but if you feel strongly enough about a topic, why wouldn't you want the recipient to know who you are, where you are and who they can respond to? I think my train of thought is geared towards anon remailers protecting those who may operate in less than honorable means, without ethical guidelines and wishing to "hide" behind a veil of anonymity. Somehow, that just strikes me as less-than-honorable. (No, I was never a Marine. Army, yes. Marine, no.) Gee, I sure feel better. Paul Ferguson | Network Integration Consultant | "All of life's answers are Alexandria, Virginia USA | on TV." fergp(a)sytex.com (Internet) | -- Homer Simpson sytex.com!fergp (UUNet) | 1:109/229 (FidoNet) | PGP public encryption key available upon request.

1 0

Re: Crypto goals
by fnerd＠smds.com 24 Feb '93

24 Feb '93

>How about making a list of features we want, and/or a list of scenarios >we want to be able to handle? >... > executable but non-disassemblable code [is it possible?] >... >Have I missed anything? > >-- Marc Ringuette (mnr(a)cs.cmu.edu) Encrypted computing. This is even harder than non-disassemblable code. The idea is that you couldn't even tell what happened to the data if you watched it compute, tried again with slightly different inputs, etc. I've heard that some restricted sort of encrypted computing is possible with an exponential time cost! The main application I have in mind is a mix that would be trustworthy even if it was run by your worst enemies with the best computers in the world. This seems impossible but I don't have proof. -fnerd fnerd(a)smds.com (FutureNerd Steve Witham)

2 1

Front lines of anon.
by Hal 24 Feb '93

24 Feb '93

Lance Detweiler writes: > >You have these security threats which involve people being tricked into > >sending messages through the remailer in such a way that the recipient > >knows the true email address from where the messages are coming. > > These are completely analogous to users being tricked into supplying > passwords in regular login situations. Not a new problem. And anybody > who hasn't figured out that you should *never* put any identifying > information in the message itself is probably a little too clueless to > be using the service in the first place. However, the idea of giving a > warning in the use introduction is ok: ``under NO CIRCUMSTANCES EVER DO > THIS'' type thing. It's not that simple. "Deadbeat" reported that he discovered this problem when he sent mail via Penet to a list member asking a question. When that person replied, it exposed his anonymous ID. There was no need to put identifying information in the message itself. The mere fact that a particular message is being replied to gives away the true email address of the sender (because that is the address to which the question was directed). This means that if you receive mail asking an innocent question, like, "what is the address to subscribe to cypherpunks?", you need to be aware of whether that question came from the Penet remailer or one like it. If so, you need to take extra care when you respond so that your anonymous ID is not revealed. > The problem is that the anonymity is implicitly requested by a message > to the server. Hence replies are getting this anonymity. One > possibility is an override switch in the header that leaves it entirely > intact and the server just acts like another hub forwarder. But what is > this `harm'? We have to recognize these complaints as completely > frivolous and without merit. I don't think so. It seems to me that the current system makes it easy to accidentally expose your anonymous ID. If more people start operating pseudonym-based remailers it will be that much more difficult to keep track of whether you want to be anonymized or not. I think technical solutions are needed along the lines suggested by Eric Hughes and Deadbeat. Hal P.S. How about Deadbeat posting a public key? He keeps signing his messages but I can't check them.

1 0

Newbie comments. (fwd)
by kelly＠netcom.com 24 Feb '93

24 Feb '93

Forwarded message: > From cypherpunks-request(a)toad.com Tue Feb 23 15:40:37 1993 > From: J. Michael Diehl <mdiehl(a)triton.unm.edu> > Message-Id: <9302232326.AA26860(a)triton.unm.edu> > Subject: Newbie comments. > To: cypherpunks(a)toad.com > Date: Tue, 23 Feb 93 16:26:08 MST > X-Also-Known-As: Thunder > X-Goal-In-Life: To make a lot of money -- Wanna make a donation? > X-Mailer: ELM [version 2.3 PL8] > > I've been listening to this list quietly for about 2 weeks. Althought the > signal to noize ration as been a bit low lately, ;^) it's been very interesting. > > I like the idea of alt.whistle.blowers, and support anything that promotes > privacy, and Constitutional rights. > > But I have a (newbie?) question. Isn't it true that, at the network level, it > is still possible to tell where a message came from and where it's going. That > is, given the proper motivation, couldn't "and entity" sniff out all of this > information and find out which machine a particular message came from. And > from logs at that machine, which The Entity naturally has access to, It could > find out who send the message. Just wondering..... Hi there, well acutally at the network interface level all sorts of tricks are available... for example at the smtp daemon level all a snooper has to do is the following telnet toad.com smtp when the sendmail banner is seen then type VRFY cypherpunks That will yeild yet another line referring to cypherpunks-real which verifying will obtain ALL the mail addresses on this cypherpunks mailing list... I have a small fragment of perl which does the same trick recursively for every address on the cypherpunks mail list... why did I write such a thing... well I am writing a mail list to PGP key server extractor so I can automatically extract keys for members of cypherpunks-real... I didnt think of the privacy issue until some moments after I debugged the perl script and got it working... Similiar open holes exist at EVERY level of the Network and associated daemons and software, Johh and I have discussed this earlier via email and he as well as I dont feel its a REAL exposure as the means to protect yourself is well at hand... AND yes ALL network traffic can theoretically be traced thats when crackers and security admins start playing games with connection laundries and firewall as well as early warning systems... there are constraints to real world tracing... the Firewalls mailing list at Firewalls(a)GreatCircle.COM discusses these and other issues having to do with security at the network interface level > > Major suggestion: We need a FAQ! > > Well, that's about it. I'm still trying to get up to speed with pgp. > > +----------------------+----------------------------------------------------+ > | J. Michael Diehl ;-) | I thought I was wrong once. But, I was mistaken. | > | +----------------------------------------------------+ > | mdiehl(a)triton.unm.edu| "I'm just looking for the opportunity to be | > | Thunder@forum | Politically Incorrect! | > | (505) 299-2282 | <me> | > +----------------------+----------------------------------------------------+ > cheers kelly --

1 0

Social engineering tips
by Eli Brandt 24 Feb '93

24 Feb '93

It might be helpful for those involved in the penet flamewar to refer to the service it provides as "pseudonymity" rather than "anonymity". This suggests some level of continuity, responsibility, moral fiber... well, maybe not *that*. But it's worth pointing out that getting a penet pseudonym is no different, really, than getting an account called "u7364250(a)csvax.uza.za". PGP 2 key by finger or e-mail Eli ebrandt(a)jarthur.claremont.edu

1 0

anonymous return addresses
by Marc.Ringuette＠GS80.SP.CS.CMU.EDU 24 Feb '93

24 Feb '93

The recent penet troubles are a reminder that secure anonymous return addresses are a lot harder than secure anonymous mail with no return capability. Maybe it's time to go over the options available to us for anonymous return? 1. Remailer memorizes a pseudonym. I don't like this, mainly because it leaves the remailer operator vulnerable to pressure to reveal the correspondence between real and anonymous id's. It also opens up about a million possible security holes, as we've noticed. 2. The anonymous message includes a cryptographic "stamped self-addressed envelope" which contains a layered list of remailer addresses encrypted at each layer. This requires modified behavior of remailers; they must be willing to "unwrap" an address-list separately from the message body, and then "wrap" the entire message with the destination's public key, in order to disguise the correspondence between input and output. I think this has been discussed here before. Has anyone implemented it? I strongly suggest that this method be implemented in the cypherpunks remailers. Let's call it the SASE feature. What do you think? 3. The reply to an anonymous message can be posted in a public place encrypted for a key known only to the sender. Have I missed any important methods? -- Marc Ringuette (mnr(a)cs.cmu.edu)

3 2

Re: Finding Mac PGP software?
by Dave Banisar 24 Feb '93

24 Feb '93

MacPGP is available at mac.archives.umich.edu via gopher and FTP. FYI. The most recent copies of the pgp site list are available from the CPSR archive at cpsr.org /cpsr/crypto along with quite a few other files on crypto and privacy that may be of interest to the cypherpunks readers. > > I'm sure this is a FAQ, but can anyone point me to an FTP site > where I can obtain PGP for the Macintosh? Does such a beast exist? > Thanks for your time. > > +- eggo(a)titan.ucc.umass.edu Eat Some Paste -+ +- > Yorn desh born, der ritt de gitt der gue, -+ +- > Orn desh, dee born desh, de umn bork! bork! bork! -+ > >

1 0