December 2000 - cypherpunks-legacy

[Fwd: Re: "The End of SSL and SSH?"]
by sunder 21 Dec '00

21 Dec '00

-------- Original Message -------- Subject: Re: "The End of SSL and SSH?" Date: Tue, 19 Dec 2000 13:47:56 -0500 From: "Perry E. Metzger" <perry(a)PIERMONT.COM> Reply-To: "Perry E. Metzger" <perry(a)PIERMONT.COM> To: BUGTRAQ(a)SECURITYFOCUS.COM References: <20001218101802.J26453(a)naughty.monkey.org><877l4w5lzq.fsf(a)snark.piermont.com><005901c069ea$3f73eec0$ca00030a(a)seifried.org> "Kurt Seifried" <seifried(a)securityportal.com> writes: > It is also incredibly difficult for users to ascertain whether the > key is legit or not. Generally, if a key is already in use, it is very likely legitimate. If a key comes up as having changed, it is probably not legitimate. This does leave the question of how do you get keys in the first place. In most organizations, however, systems administration is capable of maintaining such things reasonably well. We could perhaps make that problem a bit better with mechanisms such as on-line key lookup (using a sort of public key version of what kerberos provides for private key protocols), but PKI qua PKI won't improve the situation, and in practice you can (somewhat cumbersomely) get 90% of the benefits right now simply by being systematic about key management. > Most users will happily accept SSL certs that > have expired, point to the wrong site or are self signed (all of > which could be a man in the middle attack or a lazy admin). And yet, SSL certs are based on the X.509 PKI architecture. You claim a PKI will fix things, but obviously it hasn't in this instance. > I used to religously sign email's with PGP until I realized that > no-one probably checked, how did I know this? I started modifying > the email after signing so that it wouldn't verify, no-one ever > complained. I'm hardly surprised. The tools to check are hard to use and the need is rarely obvious. > SSH and SSL are in my opinion poor implementations of security > protocols, they also lack a lot of things such as > repudiation/etc. To believe they are the best we can do makes me > very sad. I suspect in 5 years we'll talk about ssh/ssl like we talk > about telnet right now. I doubt it. SSH and SSL are fine protocols, but are dependent on key management mechanisms. What you are noting is that key management is a hard problem. Well, so it is -- but that doesn't mean that if we change the way we do key management that SSH and SSL would go away. The protocols themselves are fine. In general, PKI is probably not the answer. Among other things, the fact that it requires revocation infrastructure in the first place gives one pause. CRLs do not work in practice. Perry

2 1

vmware 2 Beta (with support for OS/2 as a guest OS)
by Mario Grieb 21 Dec '00

21 Dec '00

Hallo Joe Cypherpunk, I have read in http://www.shmoo.com/mail(cypherpunks/mar00/msg/00133shtml a Mail from VMware Team to you. Can you mail me the Beta of VMWare 2 with support for OS/2 as a guest OS? I can't find it on www.vmware.com. Thanks Mario ---------------------------------------------------- Mario Grieb Informationstechnik GRIEB GmbH / http://www.grieb.de EMail: mario.grieb(a)grieb.de Tel : 06054 / 911911 Fax : 06054 / 6334 63633 Birstein, Langgasse 31 ----------------------------------------------------

1 0

PUK CODE
by paul adjutor lacaron 21 Dec '00

21 Dec '00

Dear Sir, Mabuhay! Greetings from Philippines! I'm one avid readers in your website. Finally,I'm curious upon knowing about the PUK CODE of the SIM CARD. Do you have a knowledge how to UNLOCK THE PUK CODE of the SIM CARD if your SIM CARD asks enter PUK CODE??? And if you really don't know the PUK CODE because you forgot it or you lost it. Sir,is there an a HARDWARE or a SOFTWARE to help to UNLOCK the PUK CODE of the SIM CARD??? In a way, thanks for your kind consideration. I'm hoping you can do a favor regarding my request. GOD SPEED AND MORE POWER TO YOU!!! Sincerely Yours, Paul Lacron __________________________________________________ Do You Yahoo!? Yahoo! Shopping - Thousands of Stores. Millions of Products. http://shopping.yahoo.com/

1 0

Tapping cellphones for National Security
by Bill Stewart 21 Dec '00

21 Dec '00

Total Telecom is a free (registration-probably-required) news-clipping service covering telecom issues. This lovely article is about the FBI's current hypocritical pretenses of protecting "national security" and "privacy" by increasing their wiretapping abilities, using laws that were written to prevent hostile foreign domination of (ok, and competition with US firms for) critical national infrastructure. (Mind you, I think the laws are bogus, but the FBI is increasing the bogon density around them considerably.) http://www.totaltele.com/view.asp?ArticleID=35057&pub=tt&categoryid=0 U.S. works out security issues with VoiceStream & DT By Jeremy Pelofsky, Reuters 20 December 2000 U.S. law enforcement authorities are working to address national security concerns about acquisitions of VoiceStream Wireless Corp. and Powertel Inc. by Deutsche Telekom AG , which is partially owned by the German government. The Federal Bureau of Investigation and the companies filed a joint petition made available on Tuesday asking the Federal Communications Commission, which has to determine whether the combinations are in the public interest, to hold off ruling until the parties reach an agreement. VoiceStream , based in Bellevue, Wash., agreed to be acquired by the German telecommunications giant earlier this year in a $34 billion deal. VoiceStream also agreed to acquire Powertel for about $6 billion in August. Law enforcement agencies "have concerns that the merger could, absent an appropriate agreement, impair the ability of authorized governmental agencies in the U.S. to satisfy their obligations to preserve the national security, enforce the laws and protect the public," according to the petition. Germany's 44 percent stake in DT, which the government has pledged to divest, has raised concerns among some in the U.S. Congress about the impact the German government backing could have on competition and U.S. national security. The agencies are seeking assurances of the ability to conduct lawfully-authorized electronic surveillance of domestic calls and those that begin or end in the United States, the petition said, a copy of which was filed with the FCC. The FBI and U.S. Justice Department also said they are seeking to prevent as well as detect foreign-based or other illegal surveillance that could risk U.S. security and the privacy of the nation's telecommunications system. "The parties are currently and in good faith working diligently working toward such an agreement," the filing said. A VoiceStream spokeswoman declined to comment on the petition. The company in the past said it expected to have to address concerns raised by U.S. law enforcement authorities but did not anticipate any problems reaching an agreement. The merged company would represent a "substantial U.S. wireless service provider" offering near nationwide personal communications service (PCS) coverage as well as in Europe using the global system for mobile communications standard (GSM), according to the petition. Sen. Ernest Hollings, a South Carolina Democrat, has urged the FCC to block the VoiceStream-DT deal because he says U.S. law prohibits a telecommunications company that is more than 25 percent owned by a foreign government from acquiring U.S. firms. ~~~~~~~~~` Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

RTFM-709
by Stephen Griffin 21 Dec '00

21 Dec '00

1 0

Hi, Low price inkjet cartridges
by rmoffrm＠china.com 20 Dec '00

20 Dec '00

from the last look at our site we think that this new inkjet price list will save you even more money. We currently have the follow specials on new inkjet compatible cartridges for Epson, Canon and LOTS of others ... >>>Remove at bottom<<<

1 0

The very good proposal
by Alex Fax 20 Dec '00

20 Dec '00

<--- Это не спам, вы обращались ко мне за информацией ранее ---> Хорошая новость EOTB начинает раздавать свободные $10 (абсолютно бесплатно) за собственную регистрацию плюс $3 за каждого реферала! Компания явно идет в гору - за 180 дней они выплачивают 375% от депозита (минимальный депозит $25 e-gold). платят регулярно, внимательно ознакомьтесь с этой компанией. Мой линк (YouriyM): http://www.eye-of-the-beholder.net/cgi-bin/r.cgi?YouriyM Деньги вносите с Вашего аккаунта в e-gold, регистрация в e-gold: https://www.e-gold.com/newacct/newaccount.asp?cid=191365 Пополнить ваш e-gold аккаунт можно воспользовавшись этими ссылками: http://www.golddirectory.com/e-gold.htm http://www.freedomhound.com/servlet/echannel?Request=Render&ID=458805&Data=1 http://www.bigbooster.com/business_opportunities/funding.html Удачи! P.S. Просьба, не делайте фальшивых регистраций - это прослеживается, да и вообще не стоит губить эту компанию

1 0

Membership Processed
by support＠donventures.com.au 20 Dec '00

20 Dec '00

--------------------------------------------------------------------------- Welcome Aboard, We have to processed your application. Warning! Do Not Share your username/password with anyone.... it is for the Members Area Only and is monitored by the software and it will delete your access permission if it is abused! We are Striving to create financial Well Being in this area to make EE-BizVentures one of the best memberships available.... DO NOT ABUSE those resources by sharing with those that haven't joined OUR Membership.... EE-BizVentures Admin

1 0

Application Approved
by support＠donventures.com.au 20 Dec '00

20 Dec '00

--------------------------------------------------------------------------- Welcome Aboard, We have to processed your application. Warning! Do Not Share your username/password with anyone.... it is for the Members Area Only and is monitored by the software and it will delete your access permission if it is abused! We are Striving to create financial Well Being in this area to make EE-BizVentures one of the best memberships available.... DO NOT ABUSE those resources by sharing with those that haven't joined OUR Membership.... EE-BizVentures Admin

1 0

Question??????
by lc123 20 Dec '00

20 Dec '00

I recently downloaded potato for remailers including Mixmaster among others. I set up all my directories, have read approx all 50 pages of the how-to & help pages, and I still can't figure out how this program "works" let alone how to "use" it. I can't figure out where to compose the text body, where to save it to, what to call it, how to send it, etc etc etc etc....... Is there a place that offers instructions for the "instructions"??? It appears that all the text support is geared to those who really don't need it. Any help would greatly be appreciated. lc

1 0