July 2002 - cypherpunks-legacy

FWD: this sparked my love life
by Amber 12 Jul '02

12 Jul '02

1 0

RE: IP: SSL Certificate "Monopoly" Bears Financial Fruit
by Trei, Peter 12 Jul '02

12 Jul '02

> Lucky Green[SMTP:shamrock@cypherpunks.to] > > > James wrote: > > On 11 Jul 2002 at 1:22, Lucky Green wrote: > > > "Trusted roots" have long been bought and sold on the > > secondary market > > > as any other commodity. For surprisingly low amounts, you > > too can own > > > a trusted root that comes pre-installed in >95% of all web browsers > > > deployed. > > > > How much, typically? > > I'd rather not state the exact figures. A search of SEC filings may or > may not turn up further details. > > > And who actually owns these numerous trusted roots? > > I am not sure I understand the question. > > --Lucky > I think I do. A 'second hand' root key seems to have some trust issues - the thing you are buying is the private half of a public key pair .... but that's just a piece of information. How can you be sure that, as purchaser, you are the *only* possessor of the key, and no one else has another copy (the seller, for example)? Peter Trei

1 0

None
by aol.com 12 Jul '02

12 Jul '02

TRIPLE CLIMAX FOR WOMAN!!!!!!! INDUCES MULTIPLE EROTIC ORGASMS!!!! MONEY BACK GUARANTEE!!!!! $89.95 + $4.95 S/H TRIPLE YOUR ORGASMS NOW!!!!! GO TO WWW.TRIPLECLIM AX.COM OR CALL 1-800-341-4054

1 0

Slashdot | AT&T Concerned About H2K2 (fwd)
by Jim Choate 12 Jul '02

12 Jul '02

http://slashdot.org/articles/02/07/12/124203.shtml?tid=99 -- ____________________________________________________________________ When I die, I would like to be born again as me. Hugh Hefner ravage(a)ssz.com www.ssz.com jchoate(a)open-forge.org www.open-forge.org --------------------------------------------------------------------

1 0

Dental Floss Up The Butt Crack
by Tammy 12 Jul '02

12 Jul '02

1 0

Re: Ross's TCPA paper
by Eric Murray 12 Jul '02

12 Jul '02

On Fri, Jul 12, 2002 at 07:14:55PM +1200, Peter Gutmann wrote: > > >From a purely economic perspectice, I can't see how this will fly. I'll pull a > random figure of $5 out of thin air (well, I saw it mentioned somewhere but > can't remember the source) as the additional manufacturing cost for the TCPA > hardware components. Motherboard manufacturers go through redesigns in order > to save cents in manufacturing costs, and they're expected to add $5 to their > manufacturing cost just to help Microsoft manage its piracy problem? Motherboard makers don't pay for it. Microsoft pays for it. Or, Microsoft and Vivendi and Sony and ... all chip in. Each pays a portion, and reaps the rewards. Ok, really Wave or their ilk reaps the rewards as well. This is what Wave's been trying to sell for years now. It hasn't flown, yet. MS, Sony et al. would rather the chip get paid for by someone else first so they can use it for free. But there's a likelyhood that eventually someone will see where they can make money from it and go with it. If not with Wave or TCPA, with some other deal. >Sounds a bit like the SET business model in which the issuing bank got to carry > all the cost and liability and the aqcuiring bank got all the benfits. What killed SET wasn't that Visa got greedy and arrogant, although that certainly didn't help. They didn't want it to succeed. It was a placeholder against Mondex, which looked like it was going ot take off in the mid 90s.. When Mondex didn't happen, SET got harder and harder to actually implement (with new fees for participating inthe "standards body" and new fees for compliance testing, etc. etc) Visa makes more money from the current SSL situation because they charge a hefty added fee for 'card not present' transactions. SET would have gotten rid of that, which would have been good if there was a competing payment system (Mondex), bad if there's a virtual monopoly (what actually happened). It took me a year or so of going to SET meetings before I figured out that they really wern't that incompetent at getting a standard organized, they were fscking it up on purpose. Eric

1 0

Its expensive,but its here.
by Matthew X 12 Jul '02

12 Jul '02

http://www.idquantique.com/ Quantum encryption for the filthy rich,thats not right.Sorry, I'm not actually living in the real world. My imagination tends to get the better of me... "It's OK to tell people I'm crazy," . "You know I'm crazy, right?" "mentally ill" and an I.Q. of 70.favorite psychiatric ward at St. Vincent's hospital You know, people who have mongoloid babies don't love them any less."If I get pinched, all those years in the fucking asylum would be for nothing." "Quit fucking apologizing for filesharing. Intellectual property is evil, filesharing is freedom fighting, and the sooner Jack Valenti is bumming quarters for a living, the better. The question is not how to protect artists, it is how to muster enough force to protect the right to hack." favourite slogans at the march included: "All of you - go!!"

1 0

Re: IP: SSL Certificate "Monopoly" Bears Financial Fruit
by lynn.wheeler＠firstdata.com 12 Jul '02

12 Jul '02

and just to make sure there is a common understanding regarding SSL cert operation ... the browser code 1) checks that the SSL server cert can be validated by ANY public key that is in the browser preloaded list (I haven't verified whether they totally ignore all of the "cert" part of these preloaded public keys ... things like expiration date ... that these preloaded public keys are in the preloaded list appears to be sufficient ... details like the preloaded public keys happened to be wrappered in these certificate containers is almost extraneous). 2) validates the signature on the SSL server cert with the corresponding public key 3) checks if the website domain/host name is the same (or in some cases similar) to the domain/host name specificed in the SSL server cert. I have noticed that browsers tend to pretty much ignore the contents of these SSL server certificates ... things like expiration date ... except the public key, the domain/host name, and the signature (and the signature only has real meaning within the context of the infrastructure associated with the public key in the preloaded list with the lowest trust/integrity level; this is analogous to security weakest link ... a bank vault with a 4ft think vault door doesn't do much good if the vault has no walls). 4) uses the public key in the SSL server cert to validate communication with the server. all of this happens automagically from most users' standpoint (probably less than one percent of the population even knows that there is such a thing as a preload list). pgut001(a)cs.auckland.ac.nz on 7/10/2002 at 9:12 pm wrote: Both Netscape 6 and MSIE 5 contain ~100 built-in, automatically-trusted CA certs. * Certs with 512-bit keys. * Certs with 40-year lifetimes. * Certs from organisations you've never heard of before ("Honest Joe's Used Cars and Certificates"). * Certs from CAs with unmaintained/moribund websites ("404.notfound.com"). These certs are what controls access to your machine (ActiveX, Java, install- on-demand, etc etc). * It takes 600-700 mouse clicks to disable these certs to leave only CAs you really trust. (The above information was taken from "A rant about SSL, oder: die grosse Sicherheitsillusion" by Matthias Bruestle, presented at the KNF-Kongress 2002). >Why is not someone else issuing certificates? How many more do you need? Peter.

1 0

==> (( cypherpunks Try "Qcsbs" $1,500+/ Wk, Millionaire Cash System, Change Your Life !!! )) <==
by QCSBS-AMERICA 12 Jul '02

12 Jul '02

1 0

Communist Cypherpunks in the State Department.
by Matthew X 12 Jul '02

12 Jul '02

Professor Rat, the libertarian socialist author, offered to provide a secret Foreign Office propaganda unit linked to the intelligence services with names of writers and cypherpunks he regarded as "crypto-communist" and "fellow-travellers" who could not be trusted, documents released yesterday at the Public Record Office reveal. "Jamesd" was a trotskyist for 6(!) years and is a well known subversive. "james choate "has published Marxist screeds directly onto the Cypherpunk site. "Tim May" supports paying peoples ISP bills and anti-trust legislation,both well known authoritarian socialist policies.He also frequents radical areas even living near one.Has advocated violent revolution against democracy that he often and loudly professes to despise.A notorious national socialist."P.Trei".Possible homosexual british spy in league with May."Arbeit mach Trei" specializes in selling top secret cypher intel to the red Chinese.Uses a go-between with the code name "lucky Green"The paymaster of these dangerous extremists is one "robert Hettinger" from Boston.Seeks to flood the honest market with subversive and counterfeit currency.Only his manifest incompetence has saved the free world from massive attack.The plotters of this sinister cabal seek to place a feeble minded puppet,one "Bill Stewart" as head of their central committee with a shadowy sinister figure called "jya" handling propaganda.Are you now or have you ever been a cypherpunk?

1 0