November 2000 - cypherpunks-legacy

CDR: Duking it out with the FBI, or, Saving the White Race
by George＠Orwellian.Org 21 Nov '00

21 Nov '00

[very slightly snipped] http://foxnews.com/national/112000/duke.sml # # David Duke Phones Home, Learns of FBI Raid # # Monday, November 20, 2000, By Brett Martel # # # NEW ORLEANS - White supremacist David Duke finally called home # from Russia to learn that federal agents raided his home last # week and carried away boxes of materials, a spokesman said Monday. # # "He was outraged at this invasion of his home," said Vincent # Edwards, a spokesman for Duke's National Organization For # European-American Rights. # # The FBI is investigating whether Duke gambled away hundreds of # thousands of dollars he solicited from supporters of his white # supremacist cause. He has not been charged with a crime. # # Duke has been in Russia to promote his new book, The Ultimate # Supremacism, in which Duke argues that Russia and the former # Soviet bloc can save the white race from Jewish oligarchs and # organized crime. The book is being published in Russian. # # Edwards said he has never known Duke to visit a casino in the # two years he has worked for him, but said it would not be a crime # if he had. # # "He has been very clear in his mailings that the money is for # his work and to sustain him personally," Edwards said. "If he # accepts a supporter's check for $25 and happens to go out to # dinner that night and it costs $25, it's not a crime." # # Edwards also said he suspects the FBI's investigation is largely # based on the claims of disgruntled employees who have no # credibility.

1 0

CDR: E - mail Surveillance Tool Vindicated
by anonymous＠openpgp.net 21 Nov '00

21 Nov '00

WASHINGTON (AP) -- The Chicago law school dean who reviewed the FBI's controversial e-mail surveillance tool said Monday his report concludes it works the way the bureau described and generally doesn't ``overcollect'' evidence as feared by privacy advocates. On the eve of the Justice Department's release of his review findings, Henry H. Perritt Jr., dean of the Illinois Institute of Technology's Chicago-Kent College of Law, said the report contains recommended improvements to the Carnivore system -- both for efficiency and privacy -- that likely won't be made public Tuesday. ``I think that it's fair to say that it does pretty much what the FBI says it did. For the most part, it does not overcollect. There's certain recommendations as to how it could be improved,'' he said in an interview with The Associated Press. Perritt declined to list the recommendations or how Carnivore sometimes overcollected. Privacy advocates were alarmed by an FBI lab report last week stating that Carnivore ``could reliably capture and archive all unfiltered traffic to the internal hard drive.'' The FBI said that the lab report was the result of a test to determine Carnivore's ``breaking point,'' and that laws and court orders restricted Carnivore from being used so broadly. Privacy advocates, however, said the test shows that Carnivore is more powerful than the FBI has stated. Perritt said the FBI was ``completely open and cooperative'' during the review. Justice spokeswoman Chris Watney said Monday that the Carnivore report was received last week, and will be made available to the public Tuesday. The intervening days, she said, were needed to black out parts of the report that mention Carnivore's internal blueprints and other sensitive information. The recommendations probably will be held back as well, Perritt said. Carnivore was designed by the FBI to collect e-mail going to or from a suspect, in cases where a suspect may be using electronic communications. Privacy experts have worried about the breadth of Carnivore's capability and its ``black box'' nature. Shortly after IIT was chosen to perform the review, ordered by Attorney General Janet Reno, critics said the review would not be independent because the reviewers were government insiders. ``This important issue deserves a truly independent review, not a whitewash,'' House Majority Leader Dick Armey, R-Texas, a longtime Carnivore opponent, said in October. Perritt advised President Clinton's transition team on information policy and performing other tasks for the Clinton administration, as well as previous Republican administrations. Associate Dean Harold J. Krent, another member of the team, worked at the Justice Department in the 1980s, and several team members have current or former security clearances from the Defense Department, Treasury Department or the National Security Agency. Perritt repeatedly affirmed that he was completely independent, and that his reputation would be damaged if he was anything but impartial. Most of the nation's elite academic computer departments -- including the Massachusetts Institute of Technology, Purdue University and the San Diego Supercomputer Center -- either declined to review Carnivore or withdrew their applications after objecting to the requirements the Justice Department placed on the review. The bureau says Carnivore has been used about 25 times, mostly involving national security. ^------ On the Net: Federal Bureau of Investigation: http://www.fbi.gov Department of Justice: http://www.usdoj.gov Chicago-Kent College of Law: http://www.kentlaw.edu

1 0

CDR: Whistler To Block Unsigned Code
by A. Melon 20 Nov '00

20 Nov '00

By David Raikow, Sm@rt Partner November 20, 2000 5:31 AM PT URL: Speaking at a London press conference earlier this month, Microsoft VP for IT Infrastructure and Hosting Jim Ewel announced that the upcoming Windows release known as "Whistler" will include a range of new security options, including one that will block any software lacking a valid digital signature. Though implemented in response to e-mail-attachment viruses like the Love Bug and Melissa, the new feature will extend to "every piece of code executing on the machine," Ewel told British reporters. A Microsoft spokeswoman says that Ewel's announcement was consistent with security features in Windows 2000. "This is part of our overall commitment to security. ... Signed drivers and trusted applications are features found today in Windows 2000, and this capability will be supported in future versions of Windows," she says. Fear Of Redmond's Reign Microsoft has not yet laid out details of the new feature, however, and some analysts fear that it could increase the giant's power over Windows software developers. Win2K currently recognizes two types of signed code. A "trusted application" is signed by the software publisher, allowing end users to determine its source and verify that it has not been altered or tampered with. Developers may purchase the cryptographic certificates used to create such a signature from Verisign Inc.--Microsoft has no say in determining who may receive such certificates or what software may be signed. Windows 2000 will not automatically warn or block users from using untrusted applications; end users must manually check applications to determine whether they have a valid signature. Windows 2000 does, meanwhile, include an option that will automatically warn or block users from installing unsigned drivers--the software code that allows a computer to control hardware like printers. Developers wishing to have their drivers signed must submit them to Microsoft for testing, which maintains complete control over the signing process. What The Analysts Say Internet consultant Richard M. Smith believes that the new feature could represent a significant advance in Microsoft's approach to security. "Security people have been suggesting that Microsoft do something like this for a long time. I think it could be a good thing, particularly when it comes to virus defense." Jon Callas, director of engineering at Counterpane Internet Security, is not so confident. "I think IT managers will absolutely love this ... until it blocks a shareware tool they need," he says. "Then, all of the sudden, it's preventing work from getting done, and it gets turned off. My guess is that it won't last more than a few months in most shops." Callas also is concerned about the impact of the new feature on software developers. "At best, small developers are going to have to go out and buy certificates--not a big deal for the big guys, but a significant cost for shareware developers and the like," he adds. "At worst, they are going to have to get Microsoft's official seal of approval, which could be a huge problem for software directly competing with Microsoft apps. This could be a whole, new antitrust issue." Smith concedes that tight control over the signing process could be a problem. "I seriously doubt Microsoft wants to look like it's exercising that much control over the Windows software market; this would almost certainly be done through the existing Verisign process. Something that looked like the driver signing process, though, could be different story. That could be a real mess."

1 0

CDR: crypto
by Results＠TVEyes.com 20 Nov '00

20 Nov '00

Your keyword(s), crypto, was recently spoken on WNYW during X-Files. Monday, Nov 20 2000 at 12:21 AM ......new women s tylenol menstrual relief bye ladies bye dad you want to catch a killer you arrest that crypto son of a bitch who shipped that do g over here ...... For details, visit http://www.TVEyes.com/database/expand.asp?ln=2612269&Key=crypto Just follow the above link to keep your account active for this keyword. For total control of your keywords, go to http://www.tveyes.com/log_in.asp Get $200 in FREE Gasoline: no risk, no obligation! http://by.advertising.com/1/c/23066/7793// <a href="http://by.advertising.com/1/c/23066/7793//"> AOL users click here </a>

1 0

Re: Public Key Infrastructure: An Artifact...
by Lynn.Wheeler＠firstdata.com 20 Nov '00

20 Nov '00

as pure asside ... any SSL server certificate signed by any CA in my browswer's CA list is acceptable. for list of current valid signing CA's in a typical browswer see: http://www.garlic.com/~lynn/aepay4.htm#comcert14 http://www.garlic.com/~lynn/aepay4.htm#comcert16 my broswer makes no distinction on which CA signed what ... and/or even what they signed. If I get a certificate signed by any CA in my browswers list that says foo.bar ... and I think i'm connecting to foo.bar ... then the SSL connection will go thru. given that the supposed justification for SSL certificates is weaknesses in the domain name infrastructure integrity ... and they beef up the domain name infrastructure integrity (in part so that SSL certificate issuing operations ... like any from the above list ... can rely on domain names not having been hijacked) ... then it eliminates that as a business case & justification for SSL certificates. There are a lot of short-comings of the existing SSL certificate infrastructure. To a large extent, most PKI definitions are purely hypothetical (there is the line someplace, in theory there is no difference between theory and practice, but in practice there is) ... trivial example is that most PKI definitions include things like CRLs for dealing with revoked or compromised certificates/private keys ... and yet the SSL infrastructure doesn't have any of that in it (even tho client checking of server SSL domain certificates accounts for 99.999999% of all such PKI operations that occur in the world today). Ben Laurie <ben(a)algroup.co.uk> on 11/19/2000 05:03:20 AM This is not a comment on the crapness of PKI, it is a comment on the crapness of Verisign. The two are far from synonymous. Don't get me wrong - I don't think PKI is a perfect solution by any means - however, it gets us nowhere to attribute the faults of others to PKI. Cheers, Ben. -- http://www.apache-ssl.org/ben.html "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff

5 5

Re: Public Key Infrastructure: An Artifact...
by obfuscation＠beta.freedom.net 20 Nov '00

20 Nov '00

> On Sat, 18 Nov 2000 obfuscation(a)beta.freedom.net wrote: > > > Bram Cohen <bram(a)gawth.com> writes: > > > Unless that problem is fixed, man in the middle is hardly made more > > > difficult - for example, Mallory could break into some random machine on > > > the net and steal it's public key, then hijack local DNS and when someone > > > goes to amazon.com redirect them to amazon.hackeddomain.com, and then > > > proxy to amazon.com - now even SSL says the connection is safe. > > > > Are you sure that works? I would think the SSL client would do a > > connection to the URL the user typed, www.amazon.com, and check the > > name in the cert to see if it (approximately) matches. > > When the user goes to www.amazon.com, they get a plaintext http redirect > to amazon.hackeddomain.com, which does check. Still confused... The original connection to www.amazon.com is an SSL connection, right? We are following an https: URL? (Otherwise, SSL would not even come into the picture.) If you do a DNS hack to redirect www.amazon.com to amazon.hackeddomain.com, the latter site will not be able to complete SSL handshaking without triggering a browser warning, will it? Are you suggesting that the server would reply to the SSL handshake with a NULL transform? I just checked my browser (Netscape) and it did not offer NULL as an option. The only ciphersuites offered in the client_hello message were: V2CipherSpec SSL_RC4_128_WITH_MD5 = { 0x01,0x00,0x80 }; V2CipherSpec SSL_RC4_128_EXPORT40_WITH_MD5 = { 0x02,0x00,0x80 }; V2CipherSpec SSL_RC2_CBC_128_CBC_WITH_MD5 = { 0x03,0x00,0x80 }; V2CipherSpec SSL_RC2_CBC_128_CBC_EXPORT40_WITH_MD5 = { 0x04,0x00,0x80 }; V2CipherSpec SSL_IDEA_128_CBC_WITH_MD5 = { 0x05,0x00,0x80 }; V2CipherSpec SSL_DES_192_EDE3_CBC_WITH_MD5 = { 0x07,0x00,0xC0 }; The server must choose from this list, and all of these require the server to respond with an RSA certificate. So it looks to me like the SSL protocol will not allow the redirection attack to work without triggering a user alert, unless there is some subtlety here... Ob

3 2

CDR: test
by TAKA 20 Nov '00

20 Nov '00

:: Request-Remailing-To: 09071330009(a)docomo.ne.jp 成功？

1 0

CDR: Vá ao Cinema...Em Casa
by apoio＠giganetstore.com 20 Nov '00

20 Nov '00

<http://www.giganetstore.com> <http://www.giganetstore.com/index_promocao.asp> Para retirar o seu email desta mailing list deverá entrar no nosso site http://www.giganetstore.com , ir à edição do seu registo e retirar a opção de receber informação acerca das nossas promoções e novos serviços.

1 0

CDR: The Signature Issue
by Jim Choate 20 Nov '00

20 Nov '00

Here's a 'Texas' state view... http://faxxon.cifnet.com/taskforce/sigdisc.htm Think of a signature as proof of action/intent. It's a 'verb verification mechanism'. -- ____________________________________________________________________ He is able who thinks he is able. Buddha The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

CDR: NNA Online: Notary Certificates - All States
by Jim Choate 20 Nov '00

20 Nov '00

To at least the answer of requiring witnesses to 'signature by mark', appears to require two actually. http://www.nationalnotary.org/1-800-USNOTARY/certif_ALL.html The specific law is dependent upon your state. At least in Texas for things like voting, buying cars or houses, legal documents such as adoption papers, etc. this is pretty standard stuff. This has something to do with 'The Hague Convention' and is apparently international in scope. Remember, IANAL. -- ____________________________________________________________________ He is able who thinks he is able. Buddha The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0