- cypherpunks-legacy@lists.ogf.org

tempest devices and use
by treason＠gnu.ai.mit.edu 16 Dec '92

16 Dec '92

For those who are interested in tempest devices and such... It is currently legal to create/buy and use tempest devices for any citizen under any circumstances. It is also legal to sell such devices, with the exception of selling to non US citizens and governments. This is the good news. The bad news is: It is illegal to use any device as a tempest shield, including lead, tesla coils or any other materials that can possibly interfere with tempest reception! You need a government license to use these, and then you must have reason to have such a device(this is how banks can use such things.) I have a few tempests, one with a range of about 200 yards using aricraft vdo's. If anyone wants a file discussing the legal issues of the tempest, please ask, and I'll forward it here. treason@gnu

1 0

remailers
by treason＠gnu.ai.mit.edu 16 Dec '92

16 Dec '92

I don't know if this message got through, but I'll repost it just in case... What I would like is a list of remailers with maybe a description of the fucntions(non-standard mail) like pgp abilities or whatever. A list of remailers would be good in itself. treason

1 0

remailers
by treason＠gnu.ai.mit.edu 16 Dec '92

16 Dec '92

Does anyone have a ongoing list of remailers addresses and functions that they could send me? I haven't had time to compile a list myself, but would appreciate itt greatly if I could get one. Treason

1 0

Inf0
by wendtj＠jplpost.Jpl.Nasa.Gov 16 Dec '92

16 Dec '92

Does anyone know of companies that will sell Tempest shielding to a private citizen, and if so; what regulations and licensing are required to own this equipment. Thanks in advance, JPW ----------------------------------------------------------- JPL: 03-90 - 12-31-92. Goldin + Peace + Politics = Layoff Anyone out there looking for an AA? -----------------------------------------------------------

2 1

ps -laxww for randmoness?
by yanek＠novavax.nova.edu 16 Dec '92

16 Dec '92

How about using ps -laxww as a source of randomness? Of course it would be run throug something like MD5 to get rid of the structure. This would not be good on a multi-user system because ps command may have been modified to log the person invoking it, time, and output to somewhere. But on a personal workstation that you trust, it could be a pretty good source of unpredictable data. This is not my original idea, I think it was suggested in one of the multiple precision math packages I looked at recently.

5 6

subscribe
by ahawks＠nyx.cs.du.edu 15 Dec '92

15 Dec '92

Please subscribe me to the list...Heard about it from alt.cp, Mondo, Paco Xander Nathan, and my own FutureCulture list... -- ahawks(a)nyx.cs.du.edu FutureCulture: In/f0rmation ahawks(a)mindvox.phantom.com future-request(a)nyx.cs.du.edu

1 0

remailer extension (contact field)
by Karl L. Barrus 15 Dec '92

15 Dec '92

I've added a contact field to my remailer. To contact me (the operator of remailer03 <elee7h5(a)rosebud.ee.uh.edu>) you can use the following header: ----cut here---- :: Contact: ----cut here---- Note the colon after contact and the blank line at the end. Encryption of this header is supported as well; you can reach me by encrypting this contact header and doing the usual. For those interested - here are the changes to maildelivery and remail.pl (I haven't been able to study the remailer code much, and am just learning perl, so this can probably be improved.) Changes to maildelivery, before the * on the last line Add the following: (I spaced everything out in the file) Contact "" pipe R remail.pl Contact "" file A archive.remail Add to remail.pl, before the block that begins if (/^Request-Remailing-To:/ || /^Anon-To:/) if (/^Contact:/) { chop ; s/^.*// ; $addressee = $_ ; $addressee = "my.id(a)some.other.machine" ; } I don't know perl well enough to figure out what can or can't be deleted (specifically the $addressee = $_ line, etc.) /-----------------------------------\ | Karl L. Barrus | | barrus(a)tree.egr.uh.edu (NeXTMail) | | elee9sf(a)menudo.uh.edu | \-----------------------------------/

1 0

Re: Remailers.
by Marc.Ringuette＠GS80.SP.CS.CMU.EDU 15 Dec '92

15 Dec '92

> It relies on there being at least one operator who won't reveal > his logs. If one of your bounces happens to be through your own > remailer, you can guarantee this. Let's be clear on exactly how useful it is to route your messages through your own remailer. It's not as useful as it first appears. If the Awful Nasties convince all of the remailers downstream of yours to give up their logs, they trace the message back to your machine. You then might choose to say, "Hey man, it wasn't my message, it was just my remailer. And I'm not giving you the logs." But if you're going to use this excuse, you needn't really have routed your message through your remailer at all; you just need to be operating a remailer and routinely refuse to divulge its logs. -- Marc Ringuette (mnr(a)cs.cmu.edu)

1 0

Remailers.
by Hal 14 Dec '92

14 Dec '92

Tim's message brings up a point I've been wanting to mention. The prototype remailer software keeps log files of all messages passed through it. There are different reasons why people running the software might wish to have these logs. One purpose is for debugging; the remailers don't produce much in the way of error messages and the log files can be useful for tracking down errors. A few weeks ago, for example, one user was having difficulty sending messages through my remailer, and he posted here about it. I was able to confirm that his messages had come in and been sent out. However, another possible reason is for the case of abusive messages. I had one message go through that appeared to be directed towards the sender's boss, and was rather unfriendly in tone. The remailers give the outgoing messages the superficial appearance of having come from me. This message wasn't that bad, but there's nothing to stop someone from sending a really vicious, racially or sexually harrassing message, and I am very concerned that I could get in trouble for that. What I've generally done is to delete the log files every few days, usually after a quick perusal to see if there are any messages which the recipient might object to. Sometimes if I see a message which is of an illegal format so that it didn't get sent, (like forgetting the ":" in "Request-Remailing-To:") I'll send a message to the sender telling him what he did wrong. I feel that people who run remailers should set their own policies as far as the confidentiality of the messages they forward. Running a remailer can be somewhat risky in the current climate and the operators can legitimately seek whatever level of protection they are comfortable with. However, I think it would be good if the users of the remailers could get some information about what the privacy policies are. Maybe some remailers will simply not keep logs; maybe others will keep logs but not look at them unless a specific circumstance arises, and so on. Eric Hollander has been creating a list of remailers; perhaps he could solicit this kind of information from the operators and publish it along with the remailer addresses and keys. Hal 74076.1041(a)compuserve.com Distribution: CYPHERPUNKS >INTERNET:CYPHERPUNKS@TOAD.COM

3 2

A minor experimental result
by tcmay＠netcom.com 14 Dec '92

14 Dec '92

One of the purposes of setting up remailers is to experiment with them, see what kind of emergent behavior appears, see what kind of flaws and obstacles arise, see how they break, etc. Here's one: the compromise of my "anonymity" by one of the folks running a remailer. (Who and where don't matter, just the phenomenon itself.) I used a single bounce without any encryption to send a message and got a query from the owner of the remailer saying "I couldn't help looking through my remailer archives and noticing...." and requesting more information from me!! Hoist by my own petard! Several lessons: * Multiple bounces help, even without encryption, as then the remailer sysop can't be sure who originated the message. * Encryption is of course even more desirable, though a hassle (especially for Mac users). * Remailer sysops should make a point to _not_ look at their remailer archives. In fact, they should discard them immediately (for their own legal protection, and for slightly greater trust amongst users, though this is a hazy area...). (Recall that the "mix" on which our software-based remailers are loosely patterned are "memoryless," i.e., the tamper-resistant modules that implement the receive-decrypt-store-forward protocol have no memory of the mapping between incoming and outgoing messages. In fact, the outside world cannot possibly compromise the protocols to get at this information.) So, my laziness in using only a single bounce, combined with the curiosity of a remailer sysop, breaks the anonymity. Neither surprising nor profound, but I thought you folks would like to know. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP Public Key: by arrangement.

3 2