October 2000 - cypherpunks-legacy

CDR: Multi-part security solutions (Was: Re: Rijndael & Hitachi)
by Meyer Wolfsheim 12 Oct '00

12 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 11 Oct 2000, Arnold G. Reinhold wrote: > Derek Atkins adds: > > > > >Why try to pick a Medeco when it's locking a glass door? :-) > > The fact that some people put Medeco's in glass doors, doesn't mean > Medeco should never develop a better lock. Sure, Medeco should keep working on developing the best locks that it can produce. However, if you are going to design your structure with a glass door, it really makes no technological sense to exceed the security provided by the glass door with the other components (locks, hinges, etc.). Put a Medeco or an ASSA in a door that can be jimmied or broken down, and you've gained nothing that you wouldn't have had with a high quality lock lacking a sidebar. Except a warm fuzzy feeling inside: "We have unpickable locks!" Most burglar aren't going to spend the time picking your locks, regardless of what you have installed. The James Bond approach of sticking a pick in a lock (sans tension wrench), wiggling it a half a second, and then opening the door is pure fantasy. Lock picking, even for a very seasoned locksmith, takes more time than can be afforded in most cases. The same principle applies for fancy biometric access measures. I've seen high profile Internet security companies that have hand geometry scanners and I-Button controlled locks on doors that have door hardware that can be opened with pen-knives, coat hangers, and credit cards in a matter of seconds. How about ISP collocation centers with private, locked compartments for security conscious customers? Check the raised floors and the drop ceilings. In many cases, I fear, you will find that the steel doors on the compartment stop 18 inches above the concrete floor below, and/or don't extend past the ceiling tiles. Is it likely someone is going to pop the floor tile, craw around the cables and then pop up in your private collo space? No. But you as the customer deserve to be aware of where the weaknesses are. The only reasons I see for having a security system (be it an encryption product, or a physical access device) with a large discrepancy in the level of security that the individual components provide is either: a) Incompetence on the part of the designer, when the weaker component is thought to be as or nearly as secure as the stronger component, or b) An intentional marketing design stunt, where the purpose of the stronger component is to make the consumer comfortable with using an inherently weaker solution, or c) "Future capacity planning" (see also: budget cutbacks). Perhaps most excusable is "c", where the hypothetical Medeco would be installed in the glass door, with the intention of implementing a steel door in the future, while retaining the Medeco lock. The chances of such improvements happening decrease drastically the longer the weaker (but working) solution is in place. ("It's been good enough so far...") As for the other two reasons, obviously, "a" is the better case here, as the problem will (in a lot, if not most cases) be corrected after being discovered. I am disgusted by the use of security devices purely for marketing reasons. The mentality that "It doesn't matter that we can't provide quality entropy in our encryption product as long as we can say we use 256 bit Twofish" is demonstrative of negligence. I want to be told the security of the *weakest* part of the system, as that is the measure of the entire system's security. Then I will decide if it is sufficient for me. Certain things we just take for granted. No one seems phased by using wooden or glass doors to secure sensitive locations. Some people religiously arm their car alarms, but when was the last time you paid attention to a blaring car alarm, other than to wish it would stop? Does anyone hear one of those, and call 911 to report theft? I don't think so. Who here actually verifies ssh key fingerprints before accepting them upon connecting to a host for the first time? Or when the host key changes? Very few people, I would bet. Security is a ritual, not a product. - -MW- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.3 Comment: No comment. iQEVAwUBOeT/dSsFU3q6vVI9AQFVdwf/YvVNrEnup42xIZh6xasSkGuvW1IIqLTL rUBLgI67Ip/Cpv7Q127nzv/1oQzVkfSSPzfRmN7UnjQMDQab+LQHqUv22eIDk5Ft 9Zoqef5JeKmz7NkUjt+6GX/B4WTHo3ZefrIVD0Hqg4dkTTsFC+ibiqEnC3xM4gT6 xHUpbnX/Vhfudw+j1bpkUwTFFlP0lPKVEK803bNOMoPUcubHj9TRoFq64f+got5s ieEqPMEc3/EZAq+/72kZgZHMN1YEBg3rZ+i2EaZhG5iIleEO69DqYau6kVUxX5lJ nEditzNjXox4jV0p+CwBCRU4r6WFX27480zh5iAo6M24FFfQlg/sng== =fjfM -----END PGP SIGNATURE-----

4 5

CDR: test, ignore
by Vincent Labrecque 12 Oct '00

12 Oct '00

1 0

CDR: RE: Anonymous Remailers cpunk
by Trei, Peter 12 Oct '00

12 Oct '00

> ---------- > From: dmolnar[SMTP:dmolnar@hcs.harvard.edu] > On Tue, 3 Oct 2000, Steve Furlong wrote: > > > cost might be a little extra electricity. No funding is necessary unless > > the usage is so high that my ISP bitches at me. Personal time involved > > in maintaining the system will, I hope, be low; if it's more than > > negligible I won't be able to do it. I can see the sense of running the > > plan past a lawyer, but why would there be a continuing expense in this > > area? > > People will use your remailer to send spam and death threats. There may > even be people who will use your remailer to send spam and death threats > to themselves, simply because they hate remailers. The recipients will > contact you and your ISP. Repeatedly. > > My impression from reading alt.privacy.anon-server is that for many ISPs, > it doesn't take too much of this before the ISP asks the remailer to > leave. It's not a question of legal liability so much as the spam and the > hassle. (An example of how life is lived mainly outside the law, though > maybe in view of it.) > > You can implement spam-blocking filters on your remailer...but that's > another can of worms. > > -David > [Warning in advance: I don't run a remailer, and never have, so what follows could be labled uninformed speculation]. I would like to suggest that a remailer could eliminate nearly all it's problems by only sending out encrypted mails - that is, if after removing the encryption that was applied using it's own private key, it finds that the result is plaintext, it simply drops the message. This has some neat and useful properties. * It eliminates spam. Spammers would have to encrypt each individual message with the key of the recipient, which is too much hassle. * It eliminates any possibility of the remailer knowing the content, which alleiviates him/her of responsibility for that content. * The remailer still operates fine as a mid-chain remailer. * All recipients need to have keypairs. They are thus at least somewhat crypto-savvy people, and unlikely to place unreasonable requests on the remailer or his/her ISP. The only bad point: * All recipients need to have key pairs. Thus, a crypto-only remailer can't be a terminal remailer to mailing lists, newsgroups, or individuals without keypairs. Peter Trei

10 26

CDR: Re: Gov. Bush links Columbine
by A. Melon 12 Oct '00

12 Oct '00

Tim May wimps out: > Normally I vote Libertarian. This year I may vote for Bush as a vote > for who will do me, us, and the Constitution the lesser damage of the > two. (All voting is about bang for the buck, about effectiveness of a > vote...an election is not about "voting for the best man," it is > instead about minimizing damage.) Spoken like a true simp-wimp. A vote for *either* algore or gwbush is a direct vote for the New World Order. No ifs, ands, or buts. They are both trilateralists, scumbag bush even went the same Skull&Bones route his father did, his grandfather did, etc. There is no difference, Nader is right, it's TweedleDum & TweedleDee, Dumb & Dumber. Vote Nader -- at least he's honest. And don't give us all that horseshit about Nader=commutarian. Just because he's pro-labor and anti- megacorp doesn't make him a socialist, or commu-anything. You've shown your true colors, Tim -- you're just a simp-wimp under the skin. Vote for Bush and the NWO, commieboy.

1 0

CDR: britan to allow insurers to do genetic test for checking hereditary traits
by mikefreeman＠hushmail.com 12 Oct '00

12 Oct '00

--Hushpart_boundary_jxjHqnFohYQDqoYSiPrCarsndlHbIuEg Content-type: text/plain http://www.news.bbc.co.uk/hi/english/health/newsid_968000/968443.stm --Hushpart_boundary_jxjHqnFohYQDqoYSiPrCarsndlHbIuEg-- IMPORTANT NOTICE: If you are not using HushMail, this message could have been read easily by the many people who have access to your open personal email messages. Get your FREE, totally secure email address at http://www.hushmail.com.

1 0

CDR: Swedish Team Cracks Tough Computer Codes (was Re: NewsScan Daily, 12 October 2000 ("Above The Fold"))
by R. A. Hettinga 12 Oct '00

12 Oct '00

They must mean RSA512, of course. Given various people's pings to me about the death of 128-bit RC4, :-), someone should tell the New York Times, and others, about the difference between symmetric and asymmetric ciphers... Cheers, RAH At 9:12 AM -0700 on 10/12/00, NewsScan wrote: > SWEDISH TEAM CRACKS TOUGH COMPUTER CODES > A team of Swedish computer enthusiasts has succeeded in deciphering 10 > increasingly difficult codes presented by author Simon Singh in his > bestseller, "The Code Book." Singh, who has a doctorate in physics at > Cambridge University in the U.K., took two years to develop the brain > teasers with Dr. Paul Leyland, who works for Microsoft in Cambridge. The > codes, which took the Swedes the equivalent of 70 years of computer time to > decrypt, ranged from ciphers dating back to ancient Greece through the > famed Nazi Enigma code machine used in World War II. The team was awarded a > check for $15,000 for their efforts. Team leader Fredrik Almgren said the > task was extremely daunting and that he and his fellow scientists were > tempted to abandon the effort several times: "The first stages were very > simple but at one point we thought we wouldn't get any further than stage > eight. When you do come to the 10th stage it is a question of heavy > mathematics and rather difficult algorithms that I don't even claim to > understand myself." (Reuters/New York Times 12 Oct 2000) > http://partners.nytimes.com/2000/10/12/technology/12R-CODE2.html -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

CDR: thank you Mr. Bin Laden
by anonymous＠openpgp.net 12 Oct '00

12 Oct '00

Historical and current counter-US activities seem to be focussing more on hitting the .mil (and spyhqHHHembassies) vs. airlines. Members of the flying public appreciate your new, more-to-the-point focus, Osama, and your PR consultant should be praised. See you in Utah... By The Associated Press A look at recent terrorist attacks against United States interests. July 8, 1998 -- U.S. embassies in Kenya and Tanzania bombed, killing 224 people, 12 of whom were Americans. June 25, 1996 -- Truck bomb explodes outside the Khobar Towers housing complex near Dharan, Saudi Arabia, killing 19 Americans and injuring more than 500 Americans and Saudis. Nov. 13, 1995 -- Car bomb detonates at a U.S. military headquarters in Riyadh, Saudi Arabia, killing five Americans. Sept. 13, 1995 -- Rocket-propelled grenade pierces wall of U.S. Embassy in Moscow, but causes no injuries. Dec. 21, 1988 -- Pan Am Boeing 747 explodes over Lockerbie, Scotland on a flight from London to New York, killing 270 people. Sept. 5, 1986 -- Hijackers seize Pan Am jumbo jet carrying 358 people at Karachi Airport. Twenty people killed when security forces storm the plane. April 2, 1986 -- Four Americans killed when a bomb under a seat explodes on a TWA airliner en route from Rome to Athens. June 14, 1985 -- Shiite gunmen seize a TWA airliner and forced it to Beirut, Lebanon. U.S. Navy diver was killed and 39 Americans held hostage for 17 days. Sept. 20, 1984 -- Car bomb at U.S. Embassy annex in east Beirut, Lebanon kills 16 and injures the ambassador. Dec. 12, 1983 -- Shiite extremists set off car bombs in front of the U.S. and French embassies in Kuwait City, killing five people and wounding 86. Oct. 23, 1983 -- Shiite suicide bomber blows up U.S. Marine barracks in Beirut, Lebanon, killing 241 Americans. April 18, 1983 -- Suicide car-bomber blows up U.S. Embassy in Beirut, killing 17 Americans. Nov. 4, 1979 -- Islamic students storm U.S. Embassy in Tehran, Iran, holding 52 Americans hostage for 444 days.

1 0

CDR: RE: Make legal threats, go to jail for 20 years cpunk
by Trei, Peter 12 Oct '00

12 Oct '00

> Declan McCullagh[SMTP:declan@well.com] wrote: > > This is from a bill that both the House and Senate passed (yesterday): > > Whoever knowingly provides or obtains the labor or services of a > person...by means of the abuse or threatened abuse of law or the legal > process, > shall be fined under this title or imprisoned not more than 20 years, or > both. > > URL: http://thomas.loc.gov/cgi-bin/bdquery/z?d106:h.r.03244: > > I can imagine some abuses of this, in workplace situations or divorce > cases... > > -Declan > While almost any law can be abused, I think you'd need a really odd situation for normal people to be able to use this one abusively. For civilians, as far as I can see, it means that filing a totally bogus SLAPP suit, or (for example) threatening to make false reports of child abuse to get leverage in a divorce are now punishable beyond what they already are. Let us remember who the greatest abusers of law and the legal process are: LEAs and prosecutors. It appears to me that this law is far more a curb on the behaviour of bad cops and over-zealous DAs than anyone else. DAs too often obtain false testimony against third parties or plea bargains by threatening trumped-up charges. Corrupt cops can similarly threaten false or totally overblown charges to obtain services from the weak and defenseless. I suspect that in so far as far as any law can be considered 'good' this is one of the less bad ones. Of course, I rejoice that IANAL. Peter Trei

1 0

CDR: take me off ur list thank you!
by Vanessa Lynch 12 Oct '00

12 Oct '00

Vanessa Lynch Manager, Partner Services Predict It, Inc. P 212.217.1223 E vlynch(a)predicit.com

1 0

CDR: Re: Gov. Bush links Columbine massacre to Internet use
by Michael Motyka 12 Oct '00

12 Oct '00

G.W.Bush is mentally negligible. He's fully capable of linking Scooby Doo to the Columbine Massacre. And while right-wingers just attack the BOR from a different angle than left-wingers, Bush **may** be the minimal damage choice this time around. It's not a pretty picture.

1 0