November 2000 - cypherpunks-legacy

Re: Public Key Infrastructure: An Artifact...
by Lynn.Wheeler＠firstdata.com 20 Nov '00

20 Nov '00

note also that current SSL infrastructure is vulnerable to things like domain name hijacking; aka, at least part of SSL protocol is to make sure that you really are talking to the host that you think you are talking to ... i.e. the SSL certificate contains host/domain name (all this, in theory because of weaknesses in the domain name infrastructure) ... and when SSL goes to check something in the certificate ... it is checking the hostname/domainname against the hostname/domain name that the browser is using. However, SSL-certificate issuing CAs have to rely on the domain name authoritative infrastructure with regard to issuing SSL-certificates & domain name ownership issues ... this is the same authoratative infrastructure that supposedly can't be relied on and justifies having a the whole SSL-certificate infrastructure to begin with. In any case, the domain name infrastructure has been looking at ways to beef up the integrity of its operation ... like having public keys registered as part of domain name registration. Now, if domain name infrastructure is going to use public key registration as part of beefing up its integrity ... that would medicate much of the justification for the SSL-certicate infrastructure. Furthermore, if a higher integrity domain name infrastructure included public keys in the domain name record ... clients could request a real-time, trusted copy of the public key as a adjunct to host-name lookup. This would further eliminate the requirement for any certificate involvement in the majority of the existing SSL transaction operation (i.e. client gets the public key at the same time hostname resolution is done ... the client can trust a real-time host/domain name because of the improvement in the domain name infrastructure integrity ... and at the same time it can trust a real-time publickey for the same host/domain). Bram Cohen <bram(a)gawth.com> on 11/18/2000 11:15:38 AM

3 8

CDR: Public Key Infrastructure: An Artifact...
by Jeffrey Altman 20 Nov '00

20 Nov '00

> The problem with all of these things is that they are still based on > creating an association between a domain name and a key, when in fact what > you want is an association between some abstract concept of a counterparty > which exists in an end user's mind (like, say, amazon) and the ownership > of a machine that user's browser is talking to. > > Unless that problem is fixed, man in the middle is hardly made more > difficult - for example, Mallory could break into some random machine on > the net and steal it's public key, then hijack local DNS and when someone > goes to amazon.com redirect them to amazon.hackeddomain.com, and then > proxy to amazon.com - now even SSL says the connection is safe. > > -Bram Cohen I don't understand this last paragraph at all. If you put a proxy on amazon.hackeddomain.com and I connect through the proxy to the real amazon.com, where is the threat? If the SSL connection is established with the proxy, then the X.509 certificate on that host does not match www.amazon.com and the connection would not verify. If the connection is proxied to the real www.amazon.com the SSL connection will verify, and because it is protected end to end the proxy will not be able to do anything other than disconnect the connection at an arbitrary time. There is no man in the middle attack here. Jeffrey Altman * Sr.Software Designer The Kermit Project * Columbia University 612 West 115th St * New York, NY * 10025 * USA http://www.kermit-project.org/ * kermit-support(a)kermit-project.org

1 0

CDR: ADMIN: List Moving (fwd)
by Jim Choate 20 Nov '00

20 Nov '00

____________________________________________________________________ He is able who thinks he is able. Buddha The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- -------------------------------------------------------------------- ---------- Forwarded message ---------- Date: 19 Nov 2000 13:13:40 -0500 From: "Perry E. Metzger" <perry(a)piermont.com> To: cryptography(a)c2.net Subject: ADMIN: List Moving The cryptography list will be moving in the next few days from c2.net to a server I control elsewhere. "Stay tuned." Perry

1 0

CDR: Public Key Infrastructure: An Artifact...
by Jeffrey Altman 20 Nov '00

20 Nov '00

> On Sat, 18 Nov 2000, Ben Laurie wrote: > > > Bram Cohen wrote: > > > > > > Unless that problem is fixed, man in the middle is hardly made more > > > difficult - for example, Mallory could break into some random machine on > > > the net and steal it's public key, then hijack local DNS and when someone > > > goes to amazon.com redirect them to amazon.hackeddomain.com, and then > > > proxy to amazon.com - now even SSL says the connection is safe. > > > > Yes, and Mallory can't read the data - so what was the point? > > Yes he can - he's presenting the key for hackeddomain.com, which he stole, > so he's quite capable of reading requests sent for it. > No he can't. What hackeddomain.com is sending is the certificate for hackeddomain.com which does not contain the host name www.amazon.com. Therefore, it won't be accepted by the client. If hackeddomain.com acts as a proxy, then the certificate that is received by the client is the real one from www.amazon.com and so the session is protected. You can't have it both ways. Jeffrey Altman * Sr.Software Designer The Kermit Project * Columbia University 612 West 115th St * New York, NY * 10025 * USA http://www.kermit-project.org/ * kermit-support(a)kermit-project.org

1 0

CDR: Re: Aces high (long reply)
by jonathan＠screaming.org 20 Nov '00

20 Nov '00

> Even if meant in jest, as a comment on the situation, it undermines > the basic issue of law. Hear hear. I have to say that I agree that what has been proceeding in FL has the possible impacts of undermining some basic issues of Constitutional Law(tm). Unfortunately, I also have to agree (on this one issue) with Commrade Troll G. Orwell vis-a-vis Mr. May's objectivity on this point(*). IANAL, but my understanding of the situation is a follows (this is not a linear or algorithmic logic, just a rough progression of related observations): a) The state of Florida has a recent history of poorly conducted elections, with allegations of tampering, confusion, etc. like those we now hear being relatively commonplace. b) The above notwithstanding, Florida state LAW dictates that Candidates may LAWFULLY request manual recounts of ANY or ALL counties of their choosing, providing such requests are filed within 72 hours of the election, and providing they meet other LAWFUL criteria (emphasis mine, obviously, to make the point that the relevant statutes don't state that any particular party must be given a clear advantage in such proceedings, eg. because he's Jewish, or because Crack Whores like him, etc.--see (f) below). c) The results of the Florida election remain within a win/lose margin much smaller than the statistical margin of error of *any* counting system (by at least one order of magnitude), regardless of counting mechanism. (Many invokations of the statistics of scale have been brought to bear on this point in this forum, but the reality remains that by any rational statistical analysis, the state of Florida must be considered a draw. No amount of recounting--or lack thereof--appears to negate this fact. To argue FOR recount after recount is as statistically invalid as is to argue for NO recounts, as is to argue for a die toss, a card game, a duel (my favorite, as someone must die), etc. When a binary decision margin is smaller than the statistical margin of error, the answer is UNDEFINED. Duh.) d) As with (c) above, the US popular vote is statistically a draw--but we have a mechanism to deal with this event: it's called the Electoral College. As defined in its duties by the Constitution, the delegates are to meet on Dec 18th IIRC, and there is no provision for them showing up late. In fact, IIRC, he who gets the majority of them present wins, and "them" need not be all there could be--just all of them there that day. e) As with (c) and (d) above, if Florida can't get their Poop in a Pile by Dec. 18th, then they don't get to play. Tough shit. (And IMHO, it serves them right; they've had a demonstrably fucked process for at least two terms, and haven't fixed it. Maybe this will give the People of Florida the impetus to get with the ballgame the next time around.) f) Getting back to Florida's current problems, and (b) above, if GWB's camp had been on the ball, they'd have requested all of their recounts, manual or otherwise, within or without of Florida, by the damn deadlines. Instead, they were too busy Spinning for the Crowd about how He'd Won (by a statistically invalid margin), and only too late realized that AG's campaign had taken LAWFUL means to dispute the Arrogant Son's ascension to his Invalid Throne. The GWB camp then BROKE THE BARRIER by being the first (in this election) to SUE to stop a LAWFUL process. Furthermore, the SpinTeam claimed that The Counting needed to be over expediently--as in NOW--when the reality is, as in (e) above, they've (Constitutionally) got all the time of a month to count, count, count, as many times as need be to reduce the win margin below the error margin.(**)(***) g) Based on all of the above, the act of a Candidate exercising his right to call for per-state sanctioned recounts, of whatever prescribed manner, should not be abbrogated, in case of the event that a statistically valid margin can be demonstrated, in however partisan a manner (they've both got the same rules to play by). This is what we call the Rule Of Law (cf. May above). Any Secretary of State, Candidate, or Lawscum seeking to abbrogate that process has earned killing. h) As above: It is the Constitutional right of each State to send Electoral Delegates on Dec 18th, though it is apparent that Federal Judges appropriately have some jurisdiction over how Federal Elections are certified (i.e. prejudiced Sec's of State cannot ignore the actual ballots and lawful process, and certify whatever result pleases them, voters be damned). Ultimately, however, it is up to the States to sort out their own messes to the satisfaction of Federal oversight in Federal elections--as it should be(****). In the end, whoever plays best by the Rules Of Law, and gets the most Electoral Votes of them what was present, ought to win. And if anyone, and I mean anyone at all, abbrogates this responsibility, I say we load Mr. May's guns for him and shove him out the door (load his truck with dynamite, etc.)... /jonathan (*) To whom it might concern: I've been lurking here the Guilded and Proscribed Waiting Period, and have consequently learned much. I came here a lowly though learned security architect--and Libertarian--and have been guided towards the way of CryptoAnarchy by the likes of such prolific persons as Surly Tim May, Anti-Physics Choate, Esteemed Journalist Declan, Vigilant John Young, and a host of other characters. (In this respect I owe you all a sincere debt of gratitude.) I also happen to be a fan of shock-art in any form, and have admired Mr. May for his fomenting talents for some time -- my own visual art pieces pale in comparison to his simple "needs killing" theme. (Please keep up the good work, BTW, you are a necessary anti-cog in the anti-machine, man.) (**) Clearly this is not possible, as many here have implied. The only statistically valid response on the part of the State of Florida is to call it a Draw and send no delegates. But as Partisan Politics rage on, the Bush Lobbyist^H^H^H^H^H^H^H^H^H^H^H^HSecretary of State will have to see fit to "certify the count" regardless of its statistical validity. And then go to court, and appeal, and so on, ad infinitum. (***) Disclosure: I voted for neither Major Party Candiddate, have respect for neither, and would be pleased to see them both drown in their own shit. I live in Montana (for those of you who are of the conviction that I Need Killing(tm), and are brave enough to find and storm my compound); consequently my vote was for naught via the Electoral College, the wisdom of which may or may not be sound. (****) Unlike some others present, I do not cotton to claims that VP Gore carries some clear manipulative advatage. Certainly his is extant, but so is that of his opponent. For Pete's Sake(tm), he is the Favored Son of ex-CIA Director, ex-President Bush, and Heir Apparent to the Whole Host of Reaganite Republicans. As with the vote, both popular and by state, they are equally matched in this regard, IMHO.

4 4

CDR: Bush Cousin Made Florida Vote Call For Fox News
by No User 20 Nov '00

20 Nov '00

http://washingtonpost.com/wp-dyn/articles/A14686-2000Nov14.html By Howard Kurtz Washington Post Staff Writer Tuesday, November 14, 2000; Page C1 In yet another bizarre twist to an already surreal campaign, the head of Fox News's Election Night decision desk - who recommended calling Florida, and the election, for George W. Bush - turns out to be Bush's first cousin. Even as he was leading the Fox decision desk that night, John Ellis was also on the phone with his cousins - "Jebbie," the governor of Florida, and the presidential candidate himself - giving them updated assessments of the vote count. Ellis's projection was crucial because Fox News Channel put Florida in the W. column at 2:16 a.m. - followed by NBC, CBS, CNN and ABC within four minutes. That decision, which turned out to be wrong and was retracted by the embarrassed networks less than two hours later, created the impression that Bush had "won" the White House. Which is why media circles were buzzing yesterday with the question of why Fox had installed a Bush relative in such a sensitive post. "Appearance of impropriety?" asks Fox Vice President John Moody, who approved Ellis's recommendation to call Florida for Bush. "I don't think there's anything improper about it as long as he doesn't behave improperly, and I have no evidence he did. . . . John has always conducted himself in an extremely professional manner." But Moody admits that Ellis's Election Night conversations with the cousins "would cause concern." Ellis - whose mother, Nancy Ellis, is the sister of former president George Bush - boasted to the New Yorker that "everyone followed us." He also said the morning after the election that "Jebbie'll be calling me like eight thousand times a day." Ellis did not respond to an interview request yesterday. Ellis's support for his cousin was hardly a secret. He wrote in The Washington Post's Outlook section nine days ago that the Texas governor is "smart, engaging, enormously energetic, possessed of dynamic leadership skills, funny, wry [and] optimistic," as opposed to "the morally berserk universe of the Clintons." Tom Rosenstiel, director of the Project for Excellence in Journalism, said: "The notion that you'd have the cousin of one presidential candidate . . . in a position to call a state is unthinkable. Fox's call precipitated all the other networks' calls. That call - wrong, unnecessary, misguided, foolish - has helped create a sense that this election went to Bush, was pulled back and he is waiting to be restored." Critics say the Ellis connection will reinforce Fox's reputation as a conservative network whose anchors include Tony Snow, a former Bush White House staffer, and such commentators as Newt Gingrich. Fox maintains it merely provides a balanced alternative to the liberal networks. But, says Rosenstiel, "the marketing slogan 'We report, you decide' is obliterated by the fact that one candidate's first cousin is actually deciding, and then they report." Marvin Kalb, Washington executive director of Harvard's Shorenstein press center, calls Ellis "a fine writer and columnist, and he's always sensitive about his relationship with his first cousin. His mother is very, very close with former president Bush. Therefore I am puzzled as to why he'd put himself in a position where he would seem to be the one making the call for his cousin. It clearly conveys the wrong impression." As a Boston Globe columnist last year, Ellis wrote after some reader complaints: "I am loyal to my cousin. . . . I put that loyalty ahead of my loyalty to anyone else outside my immediate family. That being the case, it is not possible for me to continue writing columns about the 2000 presidential campaign." Ellis worked for NBC News as a producer and researcher in the political unit from 1978 through March 1989, soon after President Bush took office. Fox says it hired Ellis this year for work during the primaries and on Election Night. He also worked for Fox in 1998 when, Moody says, he called George Bush's reelection in Texas (though that was a landslide). Ellis, who lives in Irvington, N.Y., was among those briefing Fox News President Roger Ailes last Tuesday night, but he was not a total Bush loyalist. At 7:52 p.m., Fox called Florida for Al Gore based on Ellis's recommendation, though Fox was not the first to make that projection. After Fox's report, according to the New Yorker, Jeb Bush called and asked Ellis: "Are you sure?" The Gore call, based heavily on exit polls from Voter News Service, also turned out to be wrong and was retracted by the networks two hours later. At 2 a.m., Ellis called his cousins to say it was "statistically impossible" for Gore to win Florida. "Their mood was up, big-time," Ellis told the New Yorker's Jane Mayer. "It was just the three of us guys handing the phone back and forth - me with the numbers, one of them a governor, the other the president-elect. Now that was cool." But it was decidedly uncool to some Fox staffers, angry at what they see as Ellis exaggerating his role. Some are calling him "John 'Alexander Haig' Ellis," declaring himself to be in charge. Whatever the Yale graduate's job description, it remains unclear why a television network allowed him to call the election for his cousin. "You factor that in to everything else, but John is a professional," Moody says. "It would be as strange not to hire him because of who he's related to as to hire him especially because of who he's related to."

1 0

CDR: Re: ssz.com network trouble
by Bill Stewart 20 Nov '00

20 Nov '00

At 11:26 AM 11/19/00 -0500, BMM wrote: >cyberpass has "lost" its subscriber list at least once, so you might want >to confirm that you actually are currently subscribed. SSZ has occasional >extended downtimes and the charming CDR prefix. I'm unsure of the status >of algebra.com, as Igor has asked me to deliver to those who were >subscribed there. That leaves openpgp.net and minder.net. Anyone with >some dedicated, reliable bandwidth want to run a node? Cyberpass seems to be working fine. Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

CDR: Florida Supreme Court freezes certification
by George＠Orwellian.Org 20 Nov '00

20 Nov '00

Florida Supreme Court freezes certification. (That's it.)

6 6

CDR: Bob's Bank. Hi, I'm Bob. Just slip it in this pocket here.
by George＠Orwellian.Org 20 Nov '00

20 Nov '00

http://www.foxnews.com/national/1117/d_ap_1117_84.sml # # Group accused of operating bank to defraud IRS # # 10.54 a.m. ET (1609 GMT) November 17, 2000 # # PORTLAND, Ore. (AP) - An Oregon-based tax resistance group # operated a "warehouse bank'' that allowed hundreds of people # to illegally conceal income and assets from the IRS, a federal # indictment alleges. # # Six people listed in the indictment were arrested and another # was being sought, authorities said. # # The nine-count indictment filed Wednesday in federal court charges # the seven members of the Christian Patriot Association of # conspiring to defraud the Internal Revenue Service and violate # federal income tax laws. # # Members of the group have declared themselves sovereign citizens # exempt from paying taxes, officials said. # # The illegal bank, operated out a warehouse just east of Portland, # offered customers anonymous banking transactions to conceal income # and assets, according to IRS Special Agent Kathleen Sulmonetti. # Nine hundred customers deposited $186 million in the warehouse # bank with the money then being shuffled into legitimate commercial # bank accounts, she said.

6 6

CDR: Tired Of Working For What Someone Else Thinks You Are Worth?
by profer929.＠yahoo.com 20 Nov '00

20 Nov '00

Do Your Goals Include: -Controlling Your Financial Future? -Taking Back Your Time -Feeling Good About What You Do And Helping Others? Are You: -Tired Of Working For Someone Else And Getting Paid What "They" Think You Are Worth? -Tired Of The MLM "Dream Scene"? -Looking For A Legitimate Home-Based Enterprise That Will Generate $10k-$20k And More Monthly? THEN HERE IT IS: -Free Enterprise In Its Purest Form, Not MLM Or Franchise. -No Personal Selling. -Lead Generation System That Brings Qualified Prospects To You! -A Multiple Six Figure Income Is Realistically Attainable In 1st Year! -2 to 4 Year Retirement Program...PERIOD! -This Program Is All About Money...How To Make It, How To Keep It, And How To Make It Work For You. If You Are Serious About Wealth Creation, This May Very Well Be The Enterprise You Have Been Looking For. CALL TOLL FREE: 1-800-320-9895 Extension 5436 (24 Hour Recorded Message) "Whatever The Mind Can Conceive And Believe, It Can Achieve." Napoleon Hill To be removed respond at profer929(a)yahoo.com

1 0