December 2003 - cypherpunks-legacy

RE: Netscape + Verifone
by Steve Makrecky 17 Dec '03

17 Dec '03

What is the frequency on the back of your pager? Some people would like to monitor this type of information. ---------- From: owner-cypherpunks(a)toad.com on behalf of Perry E. Metzger Sent: Monday, January 22, 1996 11:13 To: cypherpunks(a)toad.com Subject: Netscape + Verifone My pager delivers me selected miniaturized Reuters news stories. I just got one that reads: REDWOOD CITY, CA - Netscape Communications Corp. and Verifone Inc. will devise a system to make electronic payments on the internet more secure. Anyone know anything about this? I'm away from my normal sources of such things (like Bloomberg terminals)... .pm

2 1

SS Obergruppenfuhrer Zimmermann (NOT!)
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Anonymous User <nobody(a)c2.org> writes: > "Private communications between neo-Nazis on the network are > effected under a program called "Pretty Good Privacy", > devised by an American neo-Nazi sympathiser." > Robin Gedye (in Bonn) p.23 of "The Sunday Telegraph" > January 21, 1996 Before anyone takes this nonsense too seriously, one should realize that the exhibition of such microscopic views of technology by journalists and politicians is fairly common. Who can forget Caspar Weinburger's stirring speech in front of an illegally exported low-end VAX, explaining that the machine was a sophisticated electronic device for the tracking of missiles and troop movements, now in the hands of America's enemies. Then there was the newspaper article which explained in perfect seriousness that "GIF" was a secret computer code used by child molesters to encode images of their victims. Characterizing PGP as a neo-Nazi tool for private communications written by a sympathizer, while absurd in a larger sense, is hardly sillier than the prior examples. And all such scenarios contain a microscopic grain of truth as seen by someone somewhere with a severe case of tunnel vision. The reporter no doubt reports correctly that some neo-Nazis use PGP to communicate privately. Doubtless PKZ supports the right of all people, including those with diverse political views, to conduct legal private conversations which cannot be overheard by their governments, as do most of the people on this list. I suppose in some obtuse sense this is sympathy. It is highly unlikely that anyone who uses Cypherpunk technology is as ignorant as this reporter. So let's just mail the poor guy a clue and move on. Things like this happen often, and it's not really worth a prolongued debate. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

7 6

Re: You want to read MY e-mail?
by Alan Pugh 17 Dec '03

17 Dec '03

=snip= >A bill by Sen. Paul Weissmann, R-Louisville, to make e-mail as privileged as >telephone conversations was killed in a Senate committee. > >A somewhat stronger bill still rests in the House. =snip= >Jim Carpenter, press secretary for Romer, said his office was "looking at all >the issues, all the options." > >Duke said he has always complied with requests for public records, but said the >request for e- mail messages goes too far. > >"I'm disturbed by it," Duke said. > >(John Sanko writes for the Rocky Mountain News in Denver.) > > OK, if _I_ can't read your e-mail Mr. Legislator, why should you >be able to read _mine_? a good question. perhaps _now_ they'll get serious about recognising email as eqivalent to postal mail. this would be an excellent way of pushing this elsewhere. when _their_ ox is gored, they'll scream like stuck pigs. one interesting aspect of this would be whether regular mail is considered a public record under the law as far as legislooters mail goes. if so, then she should get it. amp

1 0

Re: The Collapse of Ideas in a Pop Culture
by Scott Staedeli 17 Dec '03

17 Dec '03

>(If you don't know who Jules Bergmann was, you're a GenXer and > can't be held responsible for your ignorance :-}.) I _am_ a GEnXer, and I worshipped Jules Bergmann as a child. Some of my first memories is pressing my nose up to the tv, watching Saturn V's lifting off. If I ever win the lottery, I'm going to take the Saturn that's lying on it's side at Cape Kennedy, refurbish it, and launch that baby just to watch it go. ;-))) - --scottst(a)ionet.net---------------------Scott Staedeli-- >~<^xXx | "Information is the currency of xX # | democracy." (XXX) # | (XXXXXXX) | DON'T TREAD ON ME| --Thomas Jefferson ========================================================

2 1

Welcome to cypherpunks
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Welcome to the cypherpunks mailing list! If you ever want to remove yourself from this mailing list, you can send mail to "Majordomo(a)toad.com" with the following command in the body of your email message: unsubscribe cypherpunks Cypherpunks Mailing List <cypher(a)infinity.nus.sg> Here's the general information for the list you've subscribed to, in case you don't already have it: About cypherpunks ----------------- I. Administrivia (please read, boring though it may be) The cypherpunks list is a forum for discussing personal defenses for privacy in the digital domain. It is a high volume mailing list. If you don't know how to do something, like unsubscribe, send mail to majordomo(a)toad.com and the software robot which answers that address will send you back instructions on how to do what you want. If you don't know the majordomo syntax, an empty message to this address will get you a help file, as will a command 'help' in the body. Even with all this automated help, you may still encounter problems. If you get really stuck, please feel free to contact me directly at the address I use for mailing list management: cypherpunks-owner(a)toad.com Please use this address for all mailing list management issues. Hint: if you try to unsubscribe yourself from a different account than you signed up for, it likely won't work. Log back into your old account and try again. If you no longer have access to that account, mail me at the list management address above. Also, please realize that there will be some cypherpunks messages "in transit" to you at the time you unsubscribe. If you get a response that says you are unsubscribed, but the messages keep coming, wait a day and they should stop. For other questions, my list management address is not the best place, since I don't read it every day. To reach me otherwise, send mail to eric(a)remailer.net This address is appropriate for emergencies (and wanting to get off the list is never an emergency), such as the list continuously spewing articles. Please don't send me mail to my regular mailbox asking to be removed; I'll just send you back a form letter. Do not mail to the whole list asking to be removed. It's rude. The -request address is made exactly for this purpose. To post to the whole list, send mail to cypherpunks(a)toad.com If your mail bounces repeatedly, you will be removed from the list. Nothing personal, but I have to look at all the bounce messages. There is no digest version available. There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. Mail to cypherpunks-announce-request(a)toad.com if you want to be added or removed to the announce list. All announcements also go out to the full cypherpunks list, so there is no need to subscribe to both. II. About cypherpunks The cypherpunks list is not designed for beginners, although they are welcome. If you are totally new to crypto, please get and read the crypto FAQ referenced below. This document is a good introduction, although not short. Crypto is a subtle field and a good understanding will not come without some study. Please, as a courtesy to all, do some reading to make sure that your question is not already frequently asked. There are other forums to use on the subject of cryptography. The Usenet group sci.crypt deals with technical cryptography; cypherpunks deals with technical details but slants the discussion toward their social implications. The Usenet group talk.politics.crypto, as is says, is for political theorizing, and cypherpunks gets its share of that, but cypherpunks is all pro-crypto; the debates on this list are about how to best get crypto out there. The Usenet group alt.security.pgp is a pgp-specific group, and questions about pgp as such are likely better asked there than here. Ditto for alt.security.ripem. The cypherpunks list has its very own net.loon, a fellow named L. Detweiler. The history is too long for here, but he thinks that cypherpunks are evil incarnate. If you see a densely worded rant featuring characteristic words such as "medusa", "pseudospoofing", "treachery", "poison", or "black lies", it's probably him, no matter what the From: line says. The policy is to ignore these postings. Replies have never, ever, not even once resulted in anything constructive and usually create huge flamewars on the list. Please, please, don't feed the animals. III. Resources. A. The sci.crypt FAQ anonymous ftp to rtfm.mit.edu:pub/usenet-by-group/sci.crypt The cryptography FAQ is good online intro to crypto. Very much worth reading. Last I looked, it was in ten parts. B. cypherpunks ftp site anonymous ftp to ftp.csua.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany. There is a glossary there that all new members should download and read. Also recommended for all users are Hal Finney's instructions on how to use the anonymous remailer system; the remailer sources are there for the perl-literate. C. Bruce Schneier's _Applied Cryptography_, published by Wiley This is required reading for any serious technical cypherpunk. An excellent overview of the field, it describes many of the basic algorithms and protocols with their mathematical descriptions. Some of the stuff at the edges of the scope of the book is a little incomplete, so short descriptions in here should lead to library research for the latest papers, or to the list for the current thinking. All in all, a solid and valuable book. It's even got the cypherpunks-request address. IV. Famous last words My preferred email address for list maintenance topics only is hughes(a)toad.com. All other mail, including emergency mail, should go to hughes(a)ah.com, where I read mail much more regularly. Enjoy and deploy. Eric ----------------------------------------------------------------------------- Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy. [Last updated Mon Feb 21 13:18:25 1994]

1 0

yo subscribe!!
by Garry Bentlin 17 Dec '03

17 Dec '03

how do I? and can you ? thanks heeeps! reg, garryb

1 0

NY State to restrinct netporn?!
by Deranged Mutant 17 Dec '03

17 Dec '03

This in today's LI Newsday, p. A6: Crime Time in Albany Bills Reflect now popular get-tough stance by Liam Pleven, Albany Bureau Albany - A bill that would restrict sexually explicit material on the Internet - which the Assembly took little notice of last year - is suddenly headed tothe governor's desk after winning legislative approval yesterday. ... --- "Mutant" Rob <wlkngowl(a)unix.asb.com> Send a blank message with the subject "send pgp-key" (not in quotes) for a copy of my PGP key.

1 0

Re: Blacknet & Lotus Notes
by Herb Sutter 17 Dec '03

17 Dec '03

At 19:13 01.18.1996 -0500, Adam Shostack wrote: > So, lets buy the espionage enabling secret key. Its an >obvious target, not just for cypherpunks, but for the KGB, Mossad, >Toshiba, IBM, and anyone else who wants to read their competitors >correspondance. Lets face it, this key will get out there, and be >available to all the big players; lets make it available to everyone! I think people are missing the point... even if we assume the absolute worst case, that the private key is broken and becomes publicly available, international Notes users are no worse off than before. That said, it shouldn't happen soon. One of the things Ray said in his announcement was that the government agreed to both generate and then guard this key with the same diligence with which they guard their most important secrets (he specifically mentioned nuclear missile controls). While it makes for a nice sound bite, I'm comfortable that there's probably also a lot of truth to it. Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter (herbs(a)connobj.com) Connected Object Solutions 2228 Urwin - Suite 102 voice 416-618-0184 http://www.connobj.com/ Oakville ON Canada L6L 2T2 fax 905-847-6019

4 3

Re: Crippled Notes export encryption
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

Herb Sutter wrote: > At 20:32 01.17.1996 -0500, Perry E. Metzger wrote: > > > >Alan Pugh writes: > >> infoMCI (sm) > >> Lotus-Security - Lotus Announces Compromise for Export of Strong > >> Encryption > > > >So, Lotus thinks they can fool people by back-dooring in key escrow, eh? > > > >Time to break out the artillery. > > > >Perry > > Careful... what would YOU have done, with your customers demanding stronger > crypto today and you unable to legally give it to them? > > Again, folks, try to remember that this is NOT key escrow... international > Notes customers are no worse off than before, and a darn sight better off > against everyone besides Uncle Sam. > > Herb Not key escrow - WHAT?!?!? Then, what do you call giving government access to 24 out of 64 bits of the key. This reduces the keyspace to a measly 40 bits. As we have seen - 40 bits is trivial to crack without a multi-billion dollar budget. I think that Lotus did what all corporations do - it thought was best for it's bottom line, and so chose the limited keyspace with key-escrow approach. It is our job (as cypherpunks and US citizens) to show Lotus and the world that this is NOT a good approach. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

Re: Crippled Notes export encryption
by Rich Salz 17 Dec '03

17 Dec '03

>By the way, I really think Netscape should simply ship Jeff and other >people to the Amsterdam office or wherever else seems reasonable and That won't work -- they gotta hire non-US persons to do the work.

2 1

January 22 Infoworld
by Dwight Brown 17 Dec '03

17 Dec '03

Nicholas Petreley's "Down To the Wire" column is a short take on the insecurity of encryption schemes used by most commercial software. There shouldn't be much new here to cypherpunks (he discusses the vulnerabilities of WordPerfect, Word for Windows, Excel, and Compuserve's CIS.INI, and uses some out of date examples "to protect the integrity of current software": bad move, Nicholas), but it'd make a good introduction for people who aren't familiar with the issues. Petreley also announces that InfoWorld is planning a "network-cracking event", in which they plan to set up various network OS'es, make them as secure as they can, invite "a small number of accomplished hackers" to attack them, and publish the results. He says they're looking for participants... InfoWorld's web site is http://www.infoworld.com. Petreley can be reached at nicholas_petreley(a)infoworld.com. ==Dwight

1 0

Re: your mail
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

>On Mon, 22 Jan 1996, Jean-Francois Avon wrote (quote may be only partial):: > >> >> I suppose, from the adress, that it is some type of mailing list. >> >> If yes, could anybody send me the "how to subscribe" file? >> My mail quoted above was sent out to all subscribers to the list. I supposed it was only the administrative address.... I got *a lot* of replies. Thank to all cypherpunk! JFA

1 0

[local] Report onPortland Cpunks meeting
by Alan Olsen 17 Dec '03

17 Dec '03

The physical Cypherpunks meeting in Portland occured on the 20th of January. No big name Cypherpunks we involved in the manufacture of this meeting. (Well, maybe next time...) It pretty much went like a first meeting... We had about 11 people or so attend. (Hard to tell in a coffee shop if people are attending or just wondering what the heck is going on.) The participation from the group was very positive. Those who did attend were quite willing to participate. Those of you who did not show up missed a good meeting... and free coffee drinks from the Habit. (The Habit Internet Cafe was having their one year aniversary and was giving away free coffe as part of the event.) Some of the happenings (in no particular order): Bruce Baugh handed out the information he has been collecting on remailer timings and mail to new gateways. The information was pretty useful. He had sent out a group of ten messages to each remailer through a nym server. The results were at odds with the published times. Certain sites either dropped large percentages of messages or delivered them about 8-9 days late. Others which were rated at the bottom of the list on the regular timing list were the most reliable in Bruce's tests. Neal McBurnett talked about his Java program that generates statistics on the PGP "web of trust". The information he gave was pretty surprising. (Fewer keys exist in the keyservers than I believed.) I encoraged Neal to post his findings to the list. (Hint! Hint!) I will not try to explain the stats from memory... I gave a report on the status of the PGP 3.0 API. (Of which Derek Atkins was kind enough to send me for the meeting. Thanks Derek!) There was a key signing. It was a bit rough as for many of us it was our first key signing. (I think Neal was the only person who had been to an organized key signing.) Still, it went fairly well. Only a couple of people brought their key fingerprints on disk instead of paper. As of today, I have only recieved signed keys back from a couple of people though... The next key signing will be done a bit differently. (Live and learn.) There was also a suggestion for a nym signing at some point. There was a discussion of entropy which devolved into entropy. The definitions of entropy varied widely depending on the background of the individuals involved. (Or just general smartassedness... My definition of entropy was "A urilogical condition".) There was alot of just general discussion of crypto and current events. A good time was had by all. (At least I have not had any complaints.) One of the other topics discussed was a Portland-Cypherpunks mailing list for keeping people informed on local activities. This will probibly be put into place sometime soon... There will also be upcoming meetings as I have had a number of people inquiring about the posibility. Well, that is about all I can remember at this point... (At least with not enough caffiene in me.) Others who were there can probibly comment. Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Mykotronx sells 68,000 Fortezza cards to Spyrus
by baldwin 17 Dec '03

17 Dec '03

Here is a press release from Mykotronix about a big order of Fortezza cards for the Defense Messaging System. Another part of the government has selected Fisher International to supply SmartDisk cryptographic cards for the use of citizens interacting with the IRS and other agencies electronically. Although Fisher has not received a big order yet, they are looking at 100 thousand and 10 million card production runs. The Fisher card is based on RSA's crypto toolkit and DOES NOT include skipjack or escrow. --Bob ______________________________ Forward Header __________________________________ Subject: Mykotronx sells 68,000 Fortezza cards for Defense Msg System IRVINE, Calif.--(BUSINESS WIRE)--Jan. 22, 1996--Rainbow Technologies Inc. (NASDAQ:RNBO), Monday announced its Mykotronx division has received a purchase order from Spyrus for over 68,000 of Mykotronx's new Capstone encryption processor (MYK-82). The devices will be used to build part of the Government's order of Fortezza Cryptographic Cards for the Defense Message System (DMS) awarded Sept. 1995. Initial delivery of the new cryptographic processor will begin April 1996. "The significance of the MYK-82 is that it allows us to provide a high grade, low cost encryption technology to customers, such as Spyrus," said John Droge, vice president of program development for Mykotronx. "The MYK-82 is an advanced encryption processor specifically aimed at PCMCIA cryptographic applications and has a built-in PCMCIA interface. The newer design is smaller, faster and has a lower cost than its predecessor." In addition, Mykotronx will be programming all the cryptographic processors to fill the Government's Sept. 1995 order of 300,000 Fortezza Cryptographic Cards. The MYK-82, developed by Mykotronx and fabricated by VLSI Technology Inc., is the first of a series of security products to be developed as part of an alliance with VLSI, targeting both Government and commercial markets. Rainbow Technologies, founded in 1984, is the world's leading developer, manufacturer and supplier of software protection products and encryption technology. Mykotronx, a subsidiary of Rainbow, is a leader in secure communication and cryptographic products for U.S. government agencies and the commercial marketplace. Rainbow was recently recognized by Forbes magazine as one of The Best Small Companies in America and in SmartMoney Magazine as one of the Seven Stocks for the Next Decade. Rainbow is ISO 9002 certified. CONTACT: Rainbow Technologies Inc., Irvine, Calif. Ann Jones, 714/450-7350 email: ajones(a)rnbo.com WWW Home Page: http://www.rnbo.com KEYWORD: CALIFORNIA INDUSTRY KEYWORD: COMPUTERS/ELECTRONICS COMED

1 0

Re: Crippled Notes export encryption
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:06 AM 1/23/96 -0500, Herb Sutter wrote: >Careful... what would YOU have done, with your customers demanding stronger >crypto today and you unable to legally give it to them? > >Again, folks, try to remember that this is NOT key escrow... international >Notes customers are no worse off than before, and a darn sight better off >against everyone besides Uncle Sam. They could have shipped strong encryption and let the lawyers handle the Feds. That's what lawyers are for. A court loss would be unlikely. Even with a loss, having IBM serve a 54-month jail term would be no prob. It could do it standing on its head. They were probably more worried by possible retaliation in government purchasing. Those who crossed The Wall around 10:00 pm on November 10, 1989 proved that modern (weak) governments can be faced down by large movements of people. Companies will learn that end-users are less sanguine about being censored (by Compuserve) or opening one's business affairs to (any) governments than perhaps they used to be. Small competitors will benefit. DCF

1 0

Re: Crippled Notes export encryption
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:23 AM 1/23/96 -0500, Rich Salz wrote: > >>By the way, I really think Netscape should simply ship Jeff and other >>people to the Amsterdam office or wherever else seems reasonable and > >That won't work -- they gotta hire non-US persons to do the work. > > I'm sure that all those Netscape stock option holders would be happy to renounce their citizenship in the service of the company that made them millionaires and if they do so before cashing in the options (and before Willie and the Congress agree on a budget with its emigrants's tax provisions), they can keep the proceeds tax free. If not, I'll learn C++ and renounce in exchange for those options. DCF DCF

1 0

sniffing sniffers
by D.R.Madden 17 Dec '03

17 Dec '03

DIa!?ayyyyyyyyyyyyyyyyRyyyyyyyyyyyyyyyyNDedge, search the user's disk for various info which can then be used for the company's "market research". One of the more guilty culprits is Microsoft (no surprises there). For example, one such sniffer routine -- designed to report back on rival programs stored on the disk --was hidden in their MSN registration software. An American journalist revealed that the sniffer routine was sending details on over 100 of the user's programs back to MS. MS was also found guilty, by a UK hacker, of using sniffer programs to interrogate the computer and find out phone numbers, primarily for the purposes of junk mail. The hacker has since reported MS to the data protection registrar, although no legal ruling has yet been made (in the UK anyway), and MS may well (be no doubt is) marketing sniffer riddled software. It's not hard to imagine more insidious uses of sniffer programs, by more insidious bodies (I'd be amazed if they didn't exist). Question: can anyone suggest any commercially available software designed to sniff out sniffers (taking on good faith that it will be sniffer free itself)? P. Madden yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy

1 0

Re: IPSEC == end of firewalls
by Frank Willoughby 17 Dec '03

17 Dec '03

At 10:55 AM 1/23/96 -0500, Ben <adept(a)minerva.cis.yale.edu> wrote: >> functionality of most firewalls would eventually be an add-on application >> option for Operating Systems and that eventually it will be a standard >> part of every Operating System. Until then, we have to punt & keep using >> firewalls. > >I'm not so convinced that adding 'firewall functionality' to an OS is >such a good idea. The idea behind having a firewall is that > * You have a hardened host that has been stripped of > anything that could be used by an attacker to compromise > other systems > * You have a single machine that serves as the sole port of > entry into your domain. By keeping your defense perimeter > nice and small it makes it manageable to maintain. > I agree with your statements above about firewalls and wholeheartedly agree that a firewall needs these characteristics (among others) to remain relatively secure. However, I am I'm not saying that adding firewalling capabilities would make the system invincible. I *am* saying that it would provide the system with more security than it currently has and would help to reduce (not eliminate) some risks associated with networking. Of course, it would be terrific if the vendors would produce Operating Systems which are secure AND usable. (I think the market will eventually demand this from vendors, but this probably won't happen in the next year or two.) >When you start trying to switch firewall functionality to an OS you lose >both these advantages. You no longer have a system that is stripped of >compilers, scripting languages, etc, and you now have a much larger >security perimeter. > Agreed - to a point. The idea is to provide the systems with increased defensive capabilities - lowering potential risks. (See above paragraph) FWIW, I feel rather uncomfortable continuing this thread in the cypherpunks mailing list when the subject at hand deals more with firewalls than it does with cryptography. I would prefer to continue this discussion in the firewalls mailing list (of which I am a fairly regular participant). If you would like to subscribe to the firewalls mailing list, send a mail to: majordomo(a)GreatCircle.com (leaving the subject line blank) and in the body of the message put: subscribe firewalls "your_email_address" (omitting the quotes). See you there. >Ben. >____ >Ben Samman..............................................samman(a)cs.yale.edu >"If what Proust says is true, that happiness is the absence of fever, then >I will never know happiness. For I am possessed by a fever for knowledge, >experience, and creation." -Anais Nin >PGP Encrypted Mail Welcomed Finger samman(a)suned.cs.yale.edu for key >Want to hire a soon-to-be college grad? Mail me for resume Best Regards, Frank Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ For a free downloadable Internet Firewalls Checklist, please see our home page. <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.

3 2

Re: IPSEC == end of firewalls
by Frank Willoughby 17 Dec '03

17 Dec '03

At 10:30 AM 1/23/96 -0500, perry(a)piermont.com allegedly wrote: > >Frank Willoughby writes: >> While IP level security & authentication will go a long way to help >> prevent abuses and reduce unauthorized accesses, I doubt if it will >> provide enough protection by itself. > >I agree with this, but... > >> o Node Spoofing will probably still be possible > >Nope. It won't. > I disagree. I haven't met a system that couldn't somehow be gotten around. The creativity of hackers is succeeded only by their motivation and ability to put many hours into trying to solve a problem. Including the word "probably" was deliberate. Kerberos was also thought to be secure - 'til it was compromised. Software isn't bug-free & design or security methodologies can't provide 100% coverage. Hackers take advantage of this and inherent weaknesses in design flaws. >> o The connections will probably also be subject to man-in-the-middle attacks >> (Never underestimate the creativity of people who want to compromise your >> networks) > >No, they won't be subject to such attacks any longer. Answer is the same as the above paragraph. I try not to use the word "can't" or "won't" when possible. Granted "probably" sounds wishy-washy, but it is frequently accurate. > >The real problem, as you noted, is that our applications aren't very >secure. > >> I suspect even when firewalls are embedded in the O/S, > >That would be somewhat meaningless. The point of a firewall, as others >here have noted, is that it is easier to secure one machine than five >hundred or ten thousand. > I disagree here also. Systems by themselves are fairly useless. Their power (and main vulnerability) comes from their ability to network with other systems. A system connected to a network is vulnerable. The fact that a corporate firewall protects the system from the Internet in no way decreases the vulnerability of that system (and other systems) from *internal* attacks which can be as devastating as an Internet attack. Including firewall capabilities as part of the Operating System's network applications would help the system protect itself from abuses from the Internet - as well as from internal. >> IMHO, the first company to include a firewall as a standard part of their >> Operating Systems has a real good shot at increasing their market share. > >Again, somewhat meaningless, as a real firewall involves defense in >depth (screening routers, a bastion proxy host, etc) and is more of a >configuration issue than an O.S. issue. In the current context yes. However, a firewall is only solving one part of the problem. Just as Information Security must be integrated into every layer of a company (from users->system managers->managers-> executives), it must also be incorporated into each part in a network (systems, LANs, external connections). > >Perry Best Regards, Frank Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.

3 2

Re: The Collapse of Ideas in a Pop Culture
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:50 AM 1/23/96 -0800, Simon Spero wrote: >Bollocks. If you can remember Saturn Vs taking off before reruns, you're >too old! > Popping up the People's Chronology under Microsoft Bookshelf: "Exploration and Colonization, 1975 The first U.S.-Soviet space linkup takes place July 18. Astronauts Thomas P. Stafford, Donald K. Slayton, and Van D. Brand exchange visits 140 miles above Earth with cosmonauts Aleksei A. Leonov and Valery N. Kubasov whose Soyuz spacecraft lands safely in the Soviet Union July 21. The Apollo astronauts splash down in the Pacific 3 days later, ending the Apollo missions." My wetware informs me that this was the last Saturn V launch (for which NASA sacrificed a Moon mission. The last baby boomer was born in 1964 (or so). So a GenXer would be old enough to remember a Saturn V launch. I don't remember when Jules stopped broadcasting. DCF "BTW, the *first* Boomer was not born on January 1 1946. That event occurred at some indeterminate point later in the year when the first child was born to a discharged veteran. That child would have been conceived in September 1945. June 1st 1945 is a better approximation of the beginning of the Boom."

1 0

[noise!] (fwd) Re: FYA/I: Who'd have gaussed it?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Just in case you wanted to know how dept... Cheers, Bob --- begin forwarded text Date: Tue, 23 Jan 1996 11:21:54 -0500 (EST) From: Paul Picot <ppicot(a)irus.rri.uwo.ca> To: Philip Stein <pstein(a)measurement.com> Cc: jeff(a)rand.org, technomads(a)UCSD.EDU Subject: Re: FYA/I: Who'd have gaussed it? Mime-Version: 1.0 Zounds! A guantlet thrown! I accept! > >It just occured to me: a good way to do this might be with The Mother Of > >All Degaussing Coils. [...] > >If you can degauss the Queen Mary, surely all the disk drives in a little > >office building should pose no problems, right? > > This won't work (thank goodness). The local field strengths needed to > change the magnetic state of a disk platter (whose coercivity is MUCH > higher than that of the queen mary) is orders of magnitude greater than > what can be generated at any distance. Use a coil *around* the building. This makes the problem just within the realm of the possible, though horribly impractical. I'll spare the collected minds and spool spaces of the technomads list the details, and reduce this to a recipe: Collect the following: - 20 miles of 0000-guage insulated copper wire (about 32 tons worth) - five standard 20 MW gas-turbine power plant generators (about 20 tons ea.) - fuel for about 10 minutes of operation (about 4 tons) - five standard high voltage transmission rectifier modules for the above. - one standard 69,000 volt, 10,000 amp transmission-line contactor set Wrap 1000 turns of the wire around your target. This makes a bundle about 18 inches in diameter. Wire your generators and rectifiers to yield 70,000 volts DC, and connect them via the contactor to the coil. Fire up the turbines, and take them to redline, storing kinetic energy in the rotors. Firewall the turbines and trigger the contactor. It will take about 10 seconds for the coil current to hit 8000 amps, creating a 1-tesla magnetic field within the coil. This is sufficient to erase magnetic media. Then kill your generators before everything melts :-). And this is now certainly outside the scope of technomads... - Paul --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Motorola Cordless Secure Clear Telephone
by cassiel＠alpha.c2.org 17 Dec '03

17 Dec '03

Enjoying reading the latest discussions. I was in Totally Wireless yesterday when I noticed a new product from Motorola called "Cordless Secure Clear"--which supposedly is a cordless phone which offers security/encryption functions. Does anyone know how strong the security is on this phone? Is it just meant to keep my kid sister from listening in or is it stronger? Any info would be appreciated. Please include a response to me directly as I subscribe to the lite version of this list. Thanks! Cassiel

1 0

No Subject
by Douglas F. Elznic 17 Dec '03

17 Dec '03

How does an actual key signing work? What are some pointers and guidelines for one? -- ==================Douglas Elznic=================== delznic(a)storm.net http://www.vcomm.net/~delznic/ (315)682-5489 (315)682-1647 4877 Firethorn Circle Manlius, NY 13104 "Challenge the system, question the rules." =================================================== PGP key available: http://www.vcomm.net/~delznic/pgpkey.asc PGP Fingerprint: 68 6F 89 F6 F0 58 AE 22 14 8A 31 2A E5 5C FD A5 ===================================================

1 0

Re: January 22 Infoworld
by llurch＠networking.stanford.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- stainles(a)bga.com (Dwight Brown) kindly shared with the group: > >Nicholas Petreley's "Down To the Wire" column is a short take on the >insecurity of encryption schemes used by most commercial software. >There shouldn't be much new here to cypherpunks (he discusses the >vulnerabilities of WordPerfect, Word for Windows, Excel, and Compuserve's >CIS.INI, and uses some out of date examples "to protect the integrity of >current software": bad move, Nicholas), but it'd make a good introduction >for people who aren't familiar with the issues. > >Petreley also announces that InfoWorld is planning a "network-cracking >event", in which they plan to set up various network OS'es, make them as >secure as they can, invite "a small number of accomplished hackers" to >attack them, and publish the results. He says they're looking for >participants... > >InfoWorld's web site is http://www.infoworld.com. Petreley can be reached at >nicholas_petreley(a)infoworld.com. Unfortunately, Petreley's latest article isn't on the Web yet. But it's worth checking out last midweek's column, if only t see Sameer's name. This was only posted online. - -rich - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQVSWSoZzwIn1bdtAQHMFAGAhQrzSNtsRsv79f9dTKeLDb1eYB5NHUHT ZJHY+unUNYCOhrJpxa0FRrQU8CxEKNV9 =zWhM -----END PGP SIGNATURE-----

1 0

Re: IPSEC == end of firewalls
by Frank Willoughby 17 Dec '03

17 Dec '03

At 03:01 PM 1/23/96 -0500, you wrote: >Frank Willoughby writes: Egads. Let's take this off-line & stop bothering the cypherpunks folks with this discussion. Those not interested in this thread are kindly requested to hit the <delete> key now. Thanks. 8^) >Yes, certainly. You can bribe someone, get physical access to >machines, etc. > >However, unless you know a way to crack RSA, it is unlikely that >a system using Photuris+IPsec will permit IP spoofing. I re-iterate, any system can be gotten around - and frequently will. As far as IPsec goes, it is probably just a matter of time before we see the first CERT Advistory (maybe in a couple of years) on this. Nothing is invincible. > >> The creativity of hackers is succeeded only by their motivation and >> ability to put many hours into trying to solve a problem. Including >> the word "probably" was deliberate. Kerberos was also thought to be >> secure - 'til it was compromised. > >Kerberos was compromised? When? By whom? Are you talking about >Bellovin's paper on weaknesses in Kerberos (most of which are >avoidable or fixed in K5), or are you talking about a real break? If >the latter, its the first that I've heard of it. Actually, I was refering to Bellovin's paper. Surely you don't think that the bugs that were discovered are the only ones which can be exploited and that Kerberos (or any other software product) is invincible? I don't. >> >> I suspect even when firewalls are embedded in the O/S, >> > >> >That would be somewhat meaningless. The point of a firewall, as others >> >here have noted, is that it is easier to secure one machine than five >> >hundred or ten thousand. >> Of course it is easier to secure one machine that 500 or 10K. However, NOT securing the 500 or 10K systems still leaves them vulnerable to network attacks. Providing the O/S with rudimentary firewalling capabilities helps to increase the security of those systems. Like many of my colleagues in the Information Security field, I have (grossly) modified/hacked/butchered my systems to provide the system with some rudimentary firewalling capabilities and the extra security I needed. In many cases, it meant taking advantage of strange behaviours of the systems to achieve the capabilities & results I wanted. >> I disagree here also. Systems by themselves are fairly useless. >> Their power (and main vulnerability) comes from their ability to >> network with other systems. A system connected to a network is >> vulnerable. The fact that a corporate firewall protects the system >> from the Internet in no way decreases the vulnerability of that >> system (and other systems) from *internal* attacks which can be as >> devastating as an Internet attack. >> >> Including firewall capabilities as part of the Operating System's network >> applications would help the system protect itself from abuses from the >> Internet - as well as from internal. > >These last two paragraphs are gibberish. > Beats me. They make sense to me. What part about Information & Network Security don't you understand? These are fairly basic concepts. I can go explain these concepts either in another forum or off-line via e-mail or phone (your dime, my time), but not here. This is the cypherpunks mailing list, not the firewalls mailing list. >You can't "firewall" every machine -- the act is meaningless. A >Firewall is a filter designed to protect you from bugs in the setup or >implementation of the software on the machines on the inside. What >would it mean for a machine to have "firewall software" in the >operating system? Systems already attempt to prevent unauthorized >access -- the reason you have firewalls is because that software is >sometimes buggy. "Firewall software" in the OS is a meaningless >concept. > Perhaps this is where you are getting mixed up. A firewall isn't just a box which you plug into a network between the company's WAN and the Internet - it's a capability. Many "firewalls" are systems which implement this capability. The main characteristics of the firewall are (paraphrasing rather liberally from Steve Bellovin's book): o The firewall is designed to protect an entity from a particular network connection. Usually, we think of the entity as being another network. In this particular case, we are putting in a firewall (or the ability to filter out what we don't to deal with) on the O/S itself to reduce the risks of potential attacks from a network (internal LAN, Internet, etc). o All traffic from the insecure network has to go through the firewall. Logical. If the "firewall" is a piece of software which is installed on the O/S to "filter out" certain network connections, then we have "firewalled" our system. Commercial firewall products such as: DEC's DECseal, Raptor's Eagle, V-ONE's SmartWall, etc, actually provide two levels of protection: 1) They protect the internal network from hazards of the Internet (or untrusted network) 2) The protect themselves from hazards of the Internet or other untrusted network (such as the internal LAN) Implementing a firewall as part of an O/S provides the protection mentioned in point number 2: It protects itself from the internal LAN to some degree. Granted not as much as it possibly can, due to the fact that you have users & applications on the system which aren't secure, however, an added measure of protection will be provided to the system. >Perry Perry, (and others who may be interested in this thread) This is my last mail on this thread in this list. If you or others would like to discuss this further, please feel free to send me an e-mail directly or join me in discussing this in the firewalls mailing list. Fellow cypherpunks, I'm sorry about the bandwidth used in responding to Perry's question. Unfortunately, it was addressed to the list and required a response from me. Thanks for your patience. Back to the subject at hand (cryptography) Best Regards, Frank Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.

3 2