August 2001 - cypherpunks-legacy

Information You Requested from Microsoft.com
by 1support＠microsoft.com 22 Aug '01

22 Aug '01

NOTE: PLEASE DO NOT RESPOND DIRECTLY TO THIS E-MAIL. THIS E-MAIL IS NOT MONITORED. Welcome to Microsoft Online ID secure Internet environment! Below is your membership information. Please keep this confirmation mail as a record of your password. Consider this information confidential and treat accordingly. Your Microsoft Online ID Password is: cypherpunks A Microsoft Online ID provides access to various Microsoft secured programs. Please check the Frequently Asked Questions and/or Help page of the program you are accessing for questions. Sincerely, Microsoft Online ID Administrator

1 0

Re: Anonymous Posting
by Faustine 22 Aug '01

22 Aug '01

anonymous wrote: Faustine wrote: > So why is it that the vast majority of the technical and insightful > contributions here seem to come from people who aren't averse to > using a reasonable simulacrum of a real name and address? >I find the content from remailers is far higher than average for the >list. Fine, but "average" in this context isn't as useful as measuring the top n percent in terms of total value of information to any given participant. > I made the deliberate choice not to use a remailer because I think > it's more interesting to contribute while having a prior body of > posts "attached" to me. People come to know more what to expect--and > if I irritate/bore/piss them off too much, they stop reading > me. Which is exactly as it should be. >>So sign your messages. With your true name, if that's important. I wonder why you seem to have missed my point about services like Hushmail and Cotse. > Though if you're after complete privacy re: your opinions and the > details of your life, you're better off not writing them down in the > first place, here or anywhere else. >>The technology isn't there yet, true, but it won't get there without >>deploying it and using it. Why isn't this obvious? Even if the technology were 100% reliable, it's a matter of common sense. No amount of technology will ever keep you from trusting the wrong person, writing down something you should have kept in your head, or blabbing when you should have kept your mouth shut. In an absolute sense, "complete privacy" is only possible with an absence of communication signifiers. Developing privacy-enhancing technology, on the other hand, is absolutely crucial. But as I agree with what Bruce Schneier said about there being no such thing as "absolute security", I think it's always going to be a matter of what's "private enough" for any given situation. How "high stakes" you find posting to a mailing list depends on your particulars. And for me, Hushmail and Cotse are fine. If somebody is hell bent on fucking me over--here or elsewhere--the best remailer in the world won't help if they have the requisite knowledge, time, and resources. And I never said there was anything wrong with using a remailer. It's just that in the context of participating in a list, I think people tend to act worse since they have no real (or even symbolic) attachment to anything they say. I used to use a remailer to post to another list every single day for months. But I enjoy it more being a little more connected to it the way I participate here, that's all. > I assume everyone here weighed those considerations for themselves > before they got here: as far as I'm concerned, nobody has the > slightest business deciding it for anyone else. >Don't worry, the cypherpunks list isn't going anywhere. It's just not >realistic to put that genie back in the bottle. It would have to be a >separate list entirely or one which rode on the current cypherpunks >list. If your goal is to get rid of the technically incompetent and improve the quality of the list's content, you have to weigh the possibility of the bullshitting troll quotient going way, way up as well. And anyway, I think you're overestimating the skill level needed to use one: sure, the absolute cretins will have to go, but it remains to be seen how much moronic juvenalia will still be left over. Unfortunately, being intelligent and being immature are not mutually exclusive. >We may not be able to decide for others, but we can certainly look >down on so-called cypherpunks who, in many cases, cannot even encrypt >a message, never mind "writing code". So are you basing your assessment of who to look down on solely on whether or not they use PGP and remailers here, or are you going by the total informative content(or lack thereof)in their posts? Personally, I wouldn't be too quick to assume I know what anyone around here can or can't do. > Many, in fact, exhibit >hostility towards remailers and anonymity, as you do. That is a gross misreading of what I said. In the context of addressing "what makes participating in a list worthwhile", I just don't believe dictating from on high "everyone must use a remailer" is going to fix all the problems you think it will. And it'll probably create a lot more new ones. But I could be wrong, it'll be interesting to see how it turns out if you actually get one going. >What I fail to understand is why such people are on this list in the >first place, but, as you say, people make their own decisions. >(None of these comments apply to Tim May, of course.) Interesting how you know full well when you really need to make an exception to your too-broad generalization about people who use their real names on the list. ~Faustine.

1 0

Product Give Away - Take 5 !
by Stephanie Key 22 Aug '01

22 Aug '01

If you cannot view this message, please visit http://www.globalzon2k.com/news_vercheck1.htm G7 Productivity Systems, Inc. is sending this email to its subscribed users. You are subscribed as: cypherpunks(a)algebra.com FREE Products shipped in Full Retail Packaging Pick up to 5 of each! <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=314&size=1> <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=315&size=1> <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=313&size=1> <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=317&size=1> <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=316&size=1> Fortune. (149.99 value) DataScan (149.99 value) eXpressForms 2000 (129.99 value) TransForm Personal (59.99 value) VersaClips (19.99 value) ? Fortune: Relationship manager and addressbook ? DataScan: Business card and telephone directory scanning software ? ExpressForms 2000: Forms, Invitation and Greeting Card generator to publish on the Internet ? TransForm Personal: Scan and convert your paper forms into editable electronic forms in seconds. ? VersaClips: Accentuate your checks, website and documents with handcrafted background images. Click on any of the graphics above to add your FREE products! About VersaCheck 2001 VersaCheck enables businesses and individuals to create their own custom checks. All it takes is a desktop printer, blank paper and VersaCheck software! The checks look professional and are fully bankable. VersaCheck is available at most computer retail stores and online. It works with most accounting and personal finance software such as Quicken, Money, QuickBooks, Peachtree and many more. Four popular versions to choose from: VersaCheck 2001 Personal Home & Business Professional Premium <http://www.g7ps.com> VersaCheck Comes with High Quality Blank Security Check Stock Available Colors: Tan, Burgundy, Green and Blue Sample Check Please call 800-303-2620 for questions or assistance regarding this offer. Thank you very much. Best regards, Stephanie Key Customer Relationship Executive 800-303-2620 To change your communication preferences Click Here <http://www.globalzon2k.com/scripts/de.asp?e=cypherpunks%40algebra%2Ecom > or simply reply to this Email with UNSUBSCRIBE in the subject line. Copyright © Globalzon, Inc. All rights reserved. Designated trademarks and brands are the property of their respective owners.

1 0

FREE $200 dollars to ALL VISITORS!
by flofest720＠yahoo.co.uk 22 Aug '01

22 Aug '01

How Would You Like $200 FREE? How Would You Like Others To Send YOU $20 CASH For LIFE? How Would you like to GET PAID by the MINUTE? Would you like this Money RIGHT NOW? For more info, Visit: http://www.magic-nj.com/powerads/suite37348 Best regards David Festus If this offends anyone, please forgive me. Further e-mails may be stopped by sending a reply to : flofest(a)esalesbroker.com with Remove in the subject line.

1 0

RE: Raid 'em, raid 'em now.
by Frog2 22 Aug '01

22 Aug '01

On Wed, Aug 22, 2001 at 08:46:19AM -0500, Aimee Farr wrote: > > On Tuesday, August 21, 2001, at 10:45 PM, Aimee Farr wrote: > > > > >> On Tue, 21 Aug 2001, Aimee Farr wrote: > > >>> spotlighted a tree around here, you would think it was Secret Squirrel > > >>> mating season. (If you know anything about raccoons and > > >> Crawford, Texas.) > > >>> > > >>> ~Aimee > > > > > >> I know raccoons like my garbage and are creative > > >> about getting to it. Does that tell me something > > >> about Crawford, Texas? > > >> MacN > > > > > > Uhm, no. The SS is very pro. And that is THE DETAIL. (As for me, I > > > figure > > > somebody can read my communication attributes. On second thought... > > > *ponder* > > > I think a keystroke logger would be a good thing for me.) Realize the > > > cultural differences. A bunch of highly-educated, clean-cut professional > > > agents breaking into a female's house around here... it could be that > > > some > > > women around here don't want to issue warrants -- they want to issue > > > invitations. > > > > > > I have an interest in VIP privacy problems, so I'm appalled by the > > > circus > > > and fanfare. I imagine they wanted some solitude -- what little they can > > > steal. I had a cabin in CLOSE proximity, and I didn't gawk once. All I > > > know: > > > I now have take-out prime rib down the road. > > > > ???? > > > > I can't make sense of _any_ of this. Do you _ever_ write clearly? > > > > --Tim May > > It went through some redaction. It gives rise to a form of elliptical > conversation. > > ~Aimee JYA may be obscure but you're just loony.

2 1

comp128
by Sa�d ABID 22 Aug '01

22 Aug '01

hi, me too, i'm searching executable of comp128, so plz if you have it, send it to me. Thank you a lot ______________________________________________________ Boîte aux lettres - Caramail - http://www.caramail.com

1 0

CFP: Financial Cryptography '02 (fwd)
by Jim Choate 22 Aug '01

22 Aug '01

1 0

Timing Analysis of Keystrokes and Timing Attacks on SSH (fwd)
by Eugene Leitl 22 Aug '01

22 Aug '01

-- Eugen* Leitl <a href="http://www.lrz.de/~ui22204/">leitl</a> ______________________________________________________________ ICBMTO : N48 10'07'' E011 33'53'' http://www.lrz.de/~ui22204 57F9CFD3: ED90 0433 EB74 E4A9 537F CFF5 86E7 629B 57F9 CFD3 ---------- Forwarded message ---------- Date: 22 Aug 2001 11:37:39 -0400 From: Perry E. Metzger <perry(a)piermont.com> To: cryptography(a)wasabisystems.com Subject: Timing Analysis of Keystrokes and Timing Attacks on SSH What I find really neat here is that up until now, serious traffic analysis has been fairly neglected in the open crypto community. Is this the start of things to come? ------- Start of forwarded message ------- Date: Wed, 22 Aug 2001 08:53:30 -0600 From: aleph1(a)securityfocus.com To: secpapers(a)securityfocus.com Cc: secureshell(a)securityfocus.com Subject: Timing Analysis of Keystrokes and Timing Attacks on SSH Message-ID: <20010822085330.J3366(a)securityfocus.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Timing Analysis of Keystrokes and Timing Attacks on SSH Dawn Xiaodong Song, David Wagner, Xuqing Tian University of California, Berkeley SSH is designed to provide a security channel between two hosts. Despite the encryption and authentication mechanisms it uses, SSH has two weakness: First, the transmitted packets are padded only to an eight-byte boundary (if a block cipher is in use), which reveals the approximate size of the original data. Second, in interactive mode, every individual keystroke that a user types is sent to the remote machine in a separate IP packet immediately after the key is pressed, which leaks the interkeystroke timing information of users' typing. In this paper, we show how these seemingly minor weaknesses result in serious security risks. First we show that even very simply statistical techniques suffice to reveal sensitive information such as the length of users' passwords or even root passwords. More importantly, we further show that using more advanced statistical techniques on timing information collected from the network, the eavesdropped can learn significant information about what users type in SSH sessions. In particular, we perform a statistical study of users' typing patterns and show that these patterns reveal information about the keys typed. By developing a Hidden Markov Model and our key sequence prediction algorithm, we can predict key sequences from the interkeystroke timings. We further develop and attacker system, Herbivore, which tried to learn users' passwords by monitoring SSH sessions. By collecting timing information on the network, Herbivore can speed up exhaustive search for passwords by a factor of 50. We also propose some countermeasures. In general our results apply not only to SSH, but also to general class of protocols for encrypting interactive traffic. We show that timing leaks open a new set of security risks, and hence caution must be taken when designing this type of protocol. http://paris.cs.berkeley.edu/~dawnsong/papers/ssh-timing.pdf - Elias Levy SecurityFocus http://www.securityfocus.com/ Si vis pacem, para bellum --------------------------------------------------------------------- To unsubscribe, e-mail: secureshell-unsubscribe(a)securityfocus.com For additional commands, e-mail: secureshell-help(a)securityfocus.com ------- End of forwarded message ------- --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: travel confirmation 17388
by mikeedso＠bemybabey.com 22 Aug '01

22 Aug '01

1 0

Raid 'em, raid 'em now.
by Aimee Farr 22 Aug '01

22 Aug '01

> At 06:02 PM 8/20/01 -0700, John Young wrote: > >Come to think of it Aimee's reminds of Jeff, and the timing > >is pretty good for another raid. > > > >Hark, wipe your disks. Mors et vita in manibus lingue. This terroristic defamation isn't funny, considering where I reside. If you spotlighted a tree around here, you would think it was Secret Squirrel mating season. (If you know anything about raccoons and Crawford, Texas.) ~Aimee

4 6