Re: New remailer up.

Perry wrote,
"However, make no mistake that Netcom can and will cooperate with the
police if you use your remailer in a way that the government doesn't
like, so it seems that the security afforded isn't that good."

So you aren't interested unless you can commit serious felony crimes
using a given remailer? I would be happy if criminals stayed away from
my remailer. What do you mean by "security"? And if the police find out
a personally owned machine was involved, I couldn't imagine them not
just swooping in at midnight and taking it away at gunpoint. I hope
those privately owned machines don't have logs ;-). In my mind, the whole
secret to gaining privacy is not attracting attention in the first place.
Using a remailer DOES allow a person to communicate anonymously with
someone else, in two directions. If a party has enough power to tap
Netcom, then sendmail logs or no sendmail logs, they will find you.

and,
"Besides, $20 is a paltry sum for the amount of work involved."

Think of it as a trophy, which I'm sure most understood. I'm not offering
you a job.

I appreciate your view though, and since I've posted a request for
remailer comments, might you help us all and send me some comments about
the various remailers and what types of security each affords? If some
wish to use remailers for serious underground activity, which should they
use or not use? If they just want to keep bounced mail from telling their
system postmaster who they're talking to, then that's a different type
of security need.

-Xenon

qwerty-remailer@netcom.com  writes:
>
> Perry wrote,
> "However, make no mistake that Netcom can and will cooperate with the
> police if you use your remailer in a way that the government doesn't
> like, so it seems that the security afforded isn't that good."
> 
> So you aren't interested unless you can commit serious felony crimes
> using a given remailer? I would be happy if criminals stayed away from
> my remailer. What do you mean by "security"? And if the police find out
> a personally owned machine was involved, I couldn't imagine them not
> just swooping in at midnight and taking it away at gunpoint. I hope
> those privately owned machines don't have logs ;-). In my mind, the whole
> secret to gaining privacy is not attracting attention in the first place.
> Using a remailer DOES allow a person to communicate anonymously with
> someone else, in two directions. If a party has enough power to tap
> Netcom, then sendmail logs or no sendmail logs, they will find you.

  It seems that most (if not all) of netcom's unix machines are SunOS
  based.  If that is the case, by installing NIT in the kernel, one
  would be able to grab all of the packets that flow across that
  ethernet (192.100.81)  This includes your remailer mail.  The "cost"
  to set this up would be the risk of being caught and the time and 
  trouble to come up with root on one of their sun machines.  Aside
  from the obvious legal risks, there are ethical considerations to 
  keep in mind.  While I personally would not attempt such a thing,
  there are many out there who feel otherwise.  

  I won't hack into mail.netcom.com to demonstrate that it is possible
  to figure out who used your remailer.  But, if one of the admins from
  netcom wants to send me their syslogs, I'll do my best to put together
  a correlation.

> and,
> "Besides, $20 is a paltry sum for the amount of work involved."
> 
> Think of it as a trophy, which I'm sure most understood. I'm not offering
> you a job.

  Yes, but the trophy is hardly worth the effort.  Even though it wouldn't
  cost $50,000 in terms of actual equipment or time, it might well take
  such a sum to cause Perry to take the risk of being caught.  Unless the
  netcom folks are real slouches, I would think that they would notice
  that their kernel had been re-compiled and the machine rebooted.  Good
  luck not being detected...  Of course, there is always the off chance
  that they already have NIT compiled into the kernel...

 Jon Boone | PSC Networking | boone@psc.edu | (412) 268-6959
 PGP Public Key fingerprint =  23 59 EC 91 47 A6 E3 92  9E A8 96 6A D9 27 C9 6C

"Jon 'Iain' Boone" <boone@psc.edu>

> Yes, but the trophy is hardly worth the effort.  Even though it wouldn't
> cost $50,000 in terms of actual equipment or time, it might well take
> such a sum to cause Perry to take the risk of being caught.  Unless the
> netcom folks are real slouches, I would think that they would notice
> that their kernel had been re-compiled and the machine rebooted.  Good
> luck not being detected...  Of course, there is always the off chance
> that they already have NIT compiled into the kernel...

Ah, yes, but if you were a skilled machine lanugage hacker you could use
a dissassembler to patch the code while it was in RAM.  Very difficult
to do, but also very difficult to detect.  In theory, if you could steal
their kernal (or had a similiar one) and you compiled it on your own Sun
station, you could could probably isolate the routines you needed to
patch, write a program to locate the processes running on root, scan
memory looking for that subroutine, and then let you insert your own. 
The Netcom folks would have to look pretty hard to catch on to that type
of attack...and if they rebooted - poof! - the evidence disappears!  :)

It's certainly more than $20 worth of work tho...  and you'd still have
to find a way to get to root (or at least grab control of the cpu chip
for a few microseconds).

What kind of cpu do Suns use anyway?  (I've never used a sun before, and
I don't know much about them.)  I know NeXT used the 680x0...  What
about DEC?
(I'm just a PC user type showing my ignorace about other systems. :-)

>> However, make no mistake that Netcom can and will cooperate with the
>> police if you use your remailer in a way that the government doesn't
>> like, so it seems that the security afforded isn't that good."
>
> So you aren't interested unless you can commit serious felony crimes
> using a given remailer? I would be happy if criminals stayed away from

Things "that the government doesn't like" and "serious felony crimes"
are not the same.  People in positions of governmental power have
all too often in the past used that power to harrass others who have
committed no crime.  Remember how Nixon used to sic the IRS on his
political enemies?  And the ATF has a sordid history of harrassing
harmless people, including trying to trick them into committing
technical violations of obscure gun-control regulations.  Often enough,
government officials harrass people who have broken no law, but have
only behaved in a way that those officials WANT to be made illegal.

-----------------------------------------------------------------------------
Kevin S. Van Horn     | It is the means that determine the ends.
kevin@bert.cs.byu.edu |