November 2000 - cypherpunks-legacy

CDR: Carnivore All-Consuming
by George＠orwellian.org 20 Nov '00

20 Nov '00

EPIC FOIA... http://www.latimes.com/wires/20001117/tCB00V0387.html WASHINGTON--The FBI's controversial e-mail surveillance tool, known as Carnivore, can retrieve all communications that go through an Internet service -far more than FBI officials have said it does -a recent test of its potential sweep found, according to bureau documents [snip]

2 1

CDR: Re: Public Key Infrastructure: An Artifact...
by Bram Cohen 20 Nov '00

20 Nov '00

On Thu, 16 Nov 2000 obfuscation(a)beta.freedom.net wrote: > Bram Cohen writes: > > In the vast majority of cases, preventing man in the middle attacks is a > > waste of time. > > In the sense that, in the vast majority of communications, there is no > man in the middle attack being mounted? Yes. > Couldn't the same thing be said of cryptography, since in the vast > majority of cases there is no eavesdropping? Yes, but it's a less vast majority than the ones for which man in the middle is happening. > The point in both cases is that if you construct a protocol which has > weaknesses, eventually people may begin to exploit them. And if you build a protocol which is a pain to use, noone will use it. -Bram Cohen

2 2

CDR: info
by Digbe616＠aol.com 20 Nov '00

20 Nov '00

please send me more info........do to the delicate nature please do not contact me through e mail. mail me more info at Christopher Smith PO box 57 Rancocas new jersey 08073

2 1

CDR: We're back...
by Jim Choate 20 Nov '00

20 Nov '00

Hi, Sorry, had a hardawre failure and it was harder than expected to get a replacement. We're not expecting futher problems. ____________________________________________________________________ He is able who thinks he is able. Buddha The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

CDR: Re: ssz.com network trouble
by auto58194＠hushmail.com 20 Nov '00

20 Nov '00

Neil Johnson wrote: > > Is there something wrong with ssz.com. I haven't gotten any list mail and I > can get to the site. > ICANN action. Jim has become dangerous.

1 0

CDR: Carnivore not as selective as FBI said, privacy group charges
by anonymous＠openpgp.net 20 Nov '00

20 Nov '00

http://www.computerworld.com/cwi/story/0,1199,NAV47_STO54114,00.html Carnivore FOIA Docs http://www.epic.org/privacy/carnivore/foia_documents.html By JENNIFER DISABATINO (November 17, 2000) Carnivore, the FBI's e-mail surveillance software, is capable of capturing "all unfiltered traffic," despite assurances from the FBI this summer that the program only captures e-mails going to people on whom the FBI has a warrant. The Electronic Privacy Information Center (EPIC) in Washington requested all FBI documents on Carnivore through a Freedom of Information Act request, and those documents are being released piecemeal after a judge's order (see story). An independent review team from the Illinois Institute of Technology Research Institute (IITRI) is due to file a draft "technical report" on the Carnivore system with the U.S. Department of Justice today. "The little information that has become public raises serious questions about the privacy implications of this technology," said David Sobel, general counsel for EPIC. "The American public cannot be expected to accept an Internet snooping system that is veiled in secrecy." The latest release of documents to EPIC was posted online yesterday. According to the released document, which summarizes tests done to the Carnivore software in May, "The PC [running Carnivore] could reliably capture all unfiltered traffic to the internal hard drive (HD) (words deleted)." "I think they just ran a test just to see the capabilities," said a spokesman at the FBI, who confirmed the release of the documents to EPIC. He added that the test may not be how Carnivore is actually deployed. Previously released documents reveal that Carnivore was originally created in February 1997 under the name Omnivore, and it was originally proposed for a Sun Microsystems Inc. Solaris X86 computer. In June last year, Omnivore was replaced by a system the FBI now calls Carnivore, which runs on a Windows NT-based computer. The data released by the FBI also includes a discussion of interception of voice over IP and reviews of tests for performance and recovery from attacks and crashes for both Omnivore and Carnivore. The existence of Carnivore was revealed when an attorney for Atlanta-based Internet service provider Earthlink Inc. told a House Judiciary Committee in April that the FBI was requiring the company to install the system on its network to fulfill court-ordered surveillance of criminal suspects. But the company resisted the installation of the secretive system because it caused performance problems on its network. It also couldn't examine the technology to determine if its capturing of e-mail, IP addresses and other traffic violated the privacy of other customers.

1 0

CDR: Re: Public Key Infrastructure: An Artifact...
by obfuscation＠beta.freedom.net 20 Nov '00

20 Nov '00

Bram Cohen <bram(a)gawth.com> writes: > Unless that problem is fixed, man in the middle is hardly made more > difficult - for example, Mallory could break into some random machine on > the net and steal it's public key, then hijack local DNS and when someone > goes to amazon.com redirect them to amazon.hackeddomain.com, and then > proxy to amazon.com - now even SSL says the connection is safe. Are you sure that works? I would think the SSL client would do a connection to the URL the user typed, www.amazon.com, and check the name in the cert to see if it (approximately) matches. If some DNS redirection is done in the background so that amazon.com gets mapped to amazon.hackeddomain.com, the client will not be aware of this (will it?) and so it will still throw up a warning when it sees a cert for hackeddomain.com on a connection to amazon.com. Ob

1 0

CDR: " WE currently hiring SERIOUS HOMEWORKERS Position: Home Typist, Clerk, Secretary, Mail Processing, Supervisor, Manager...
by trueopps＠lycos.com 20 Nov '00

20 Nov '00

Earn $3,500 -$5,000 per month! Experience is NOT necessary. Part time/full time. ANYWHERE in the world! This is a GREAT and EASY home business to start and REAL job for everyone. Apply now Please, be serious in accepting this job, because we are only hiring serious homeworkers. We offer you a REAL job that you can do at home and increase your income. If you are looking for a get-rich-quick scheme or MLM program, please do not e-mail me. If you are not interested please hit "Reply" and type in the word "Remove" in the subject field and you will not be contacted again. For more infomation please apply to homeworker65(a)alloymail.com Please provide a valid E-Mail Address so I may respond to you. Subject:homeworker Please write short text those who are serious. Thank you for your time Rachel Mother of 1

1 0

CDR: Initiative - key to Become Successful Home Worker! -AYXK
by gar1ry＠hotmail.com 20 Nov '00

20 Nov '00

Don't delay, don't lose Your Chance! Use Your FREEDOM of Choice! Get Clear Home Work! Start Perfect Own Internet Home Business! Make FREE money as partner! Boost your Internet Connection Speed! Speed up your computer! Go to: http://www.virtue.nu/garry/ http://www.geocities.com/garryusar/ ***************************************** Further transmissions to you by the sender of this email may be stopped at no cost to you by sending a reply with the word REMOVE in the subject line.

1 0

CDR: Key-Address correspondence in networks?
by Ray Dillinger 19 Nov '00

19 Nov '00

I want to run this idea past some knowledgeable people and see if it looks like a good idea.... In an application which passes encrypted messages from one host to another, it is desirable to have the message differently encrypted at each 'hop' along the way (to defeat traffic analysis). But, this link-to-link encryption requires keeping track of an enormous number of keys, and that introduces complexity which a cracker could use to get into the system. Bluntly, after reviewing PKI and x.509 certs, I don't think that there is a sufficient reason to trust that the machine I'm talking to is actually the machine its cert claims it to be. The proposal is to use longer keys for each machine, and have the IP address of each machine be part of its key. (or in another network environment, assign it an "address" which happens to *be* its key...) That way, you can instantly spot at least one class of bogus requests and constrict the possibilities for an attacker. (ie, "if the key presented does not match the address it's presented for, refuse no matter what DNS or the key database say about the name-to-key correspondence and the name-to-entity correspondence".) Note, these keys are for asymmetric encryption - probably elliptic- curve or RSA. The IP address will be on the public-key side. The actual packets will be encrypted under a symmetric algorithm, with the key for the packet encrypted under the asymmetric algorithm and transmitted with it. My questions: 1) Is using a longer key just paranoia in this case, or is there an actual weakness in constricting the choice of public key that makes the private key easier to derive? 2) Is there a reasonable class of attacks and spoofs that this protects against? 3) If so, does this protection make the system noticeably harder to break? (ie, does it protect against what would otherwise be the easiest attacks?)

2 1