December 2003 - cypherpunks-legacy

Re: stego virus
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:56 PM 8/28/96, Moroni wrote: > If a virus is embedded into a giff ,is it executed when the giff is or >does it require the usual overwriting etc methods to execute it? > TIA The virus is activated when the GIF is _viewed_. The viewing of the GIF activates the cerebro-visual processing centers of the brain, activating the ancient Sumerian meme complex. I assume, of course, you are referring to the deadly Snow Crash Good Times virus. If infected, the only solution is to unsubscribe from the Cypherpunks list before others are similarly infected. Hey, Moroni, we've missed your particular slant these last few months. --Klaus We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Clinton follies ideas?
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Wed Aug 28 21:57:52 1996 Our esteemed figurehead, Bill Clinton, will be doing the first stop of his "Road to Victory Tour" campaign this Friday, just a few blocks from my apartment. Does anybody have any cool suggestions on things to do to harass, heckle, or maybe get taken down by the Secret Service? (Or should I just yell, 'Clinton, you suck!'? :) dave Special P.S. to all FBI wiretappers: This is a joke. - ----- David Smith, Thinker of Deep Thoughts :) http://www.prairienet.org/bureau42/library.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMiUHMzVTwUKWHSsJAQE4ygf9F5ihhla2NguUFEFEgqDEb97haqqIv2ak MQ07CRohP+QHYBsMnsnqjMvZslVnQCkr+mJWa8DC22dEPvGQ58+8NdsuykspIgEE jegvZuQqGBmHex3fz6NLcYBQXFuyF8fbGEaXuHJjmvszkZDBqe3Fo95ywuMJPklZ TIpZjE2xbX7T+H6yK2itIi/cmyPHN7zTfHKpdvjWcAY6hMVXuQwLx5g/cg3AErA4 R7MhDTnL2uH/16ccYQKPnpyBqxZ/DYg/DzrwO0Jj1RzeXBllTyALXMt5pQRKrbuy xl8IJJ4j1cFIjeiOvg/tTBpOoFP1f3tj8iDLBYrzqxCytelyWxgQnw== =LK29 -----END PGP SIGNATURE-----

1 0

desubscribe
by backdraft＠earthlink.net 17 Dec '03

17 Dec '03

I would like you to desubscribe me from you mailing list

1 0

NSF yanks Iran's Internet connection, from HotWired
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 28 Aug 1996 20:08:06 -0700 (PDT) From: Declan McCullagh <declan(a)eff.org> To: fight-censorship(a)vorlon.mit.edu Subject: NSF yanks Iran's Internet connection, from HotWired Attached is my column on the NSF and Iran. After I filed it, I received an unconfirmed note from the NSF saying that they removed the restriction in response to my calls earlier today. I'll verify tomorrow. I have some original documents on the Iran sanctions law and executive order at: http://www.eff.org/~declan/global/ -Declan // declan(a)eff.org // I do not represent the EFF // declan(a)well.com // http://www.netizen.com/netizen/96/35/special3a.html HotWired The Netizen Banning Iran by Declan McCullagh (declan(a)well.com) Washington, DC, 28 August The US government has quietly pulled the plug on Iran's Internet connection. The catch? No one gave it permission. Earlier this month, a National Science Foundation official blocked crucial international links to Iran, apparently in response to an Iran and Libya Sanctions Act that became law on 5 August. The move prevents people in the United States from connecting to Iranian computers by cutting off access to the country's only permanent Net connection - a single, achingly slow 9600 bps modem. The link joins the Internet at Austria's Vienna University, which received a letter from an NSF employee - who the foundation claims acted without authority - asking their network gurus to cease forwarding Iranian data to American networks. The NSF employee, Steve Goldstein, told the university that the United States embargoed such exchanges with Iran. From Austria, packets travel across the Atlantic through links funded in part by US taxpayers, which Goldstein claims gives the NSF control over them. Goldstein works in the agency's Networking and Communications Research and Infrastructure division. The NSF's action, however, tramples on the First Amendment. The Supreme Court has upheld the right of Americans to receive a wide range of information from abroad. An existing executive order explicitly allows the import and export of Iranian informational materials regardless of medium of transmission, according to Solveig Bernstein, a lawyer with the Cato Institute. "Congress intended any sanctions the president took to be directed at money and weapons production, not communications," she said. The NSF isn't accepting responsibility. The agency claims Goldstein acted on his own volition. Although Goldstein declined comment, the agency's lawyers say he was not authorized to block the line. "We were not asked by Dr. Goldstein for any opinions, so I'm not sure on what basis we're doing it," said John Chester, NSF legal counsel. Other NSF officials did not return repeated phone calls. Many Iranians in the United States are outraged at losing access to friends, family, and educational links in Iran. Farhad Shakeri, a software engineer at Stanford University who operates the Iranian Cultural and Information Center, says: "Lots of people in Iran are confused. They can't talk to any university in the world.... We just want the problem fixed." Anoosh Hosseini, a webmaster at the Global Publishing Group, says: "It affects me as a person. I want to visit my cousin's homepage, and my brother's homepage. The University of Texas has a Middle Eastern research center, but now they can't research Iran [on the Net]." ###

1 0

Re: DoJ is poking around
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

>> >looks like the DoJ have been looking around at the mirrors.. maybe to >> >legally hassle people about them.... >> Or, just maybe, some DoJ employees wanted to see what folks on the outside >> were doing to tweek their bosses:-)? Reminds me of the *thousands* of hits >> the "Intel Secrets Page"(http://www.x86.org/) has gotten from users at >> intel.com Out of curiosity, has anyone used a decompiler to check if any of the undocumented stuff is getting used in shipping programs? - "'Anonymity is bad,' says a source who wishes to remain anonymous." - Nuff' said. * Home: Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp * Autoresponder: send email w/subject of "send resume" or "send PGPKEY" * Work: cadams(a)acucobol.com | V.M. (619)515-4894 | (619)689-6579 * Member in good standing of the GNU whirled hors d'oeuvre

1 0

Re: SUN_pak
by Andrew Loewenstern 17 Dec '03

17 Dec '03

I was looking at the description of this patent (thanks to JYA for providing easy access to this article...), and I can't believe Sun got a patent for this. Tunneling encrypted IP sessions over regular IP by using a gateway router is hardly a novel idea and is immediately obvious to anyone who is knowledgable in networking and crypto. Aren't there already products out there (hardware and software) that implement this sort of thing? I seem to remember Cisco producing a router and MorningStar producing software that did this. I also seem to remember the concept being discussed on this very list several years back (can't check the archives from work though...) I believe there is even a name for it: VPN (Virtual Private Networks) John Gilmore is currently putting together a project to do much the same thing in software... Did I miss something innovative in this patent, or is this another example of clueless patent examiners granting patents for things that don't deserve patent protection? andrew

1 0

Re: In reference to comments made to me and to the Group
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com, whgiii(a)amaranth.com Date: Thu Aug 29 11:53:46 1996 I kind of like this valid discussion going on. PERIOD. But I believe that although there's something (maybe, maybe not) politicians (be they Protestant, Palestinians or from Dresden) might find a misdemeanor, one shouldn't boast with possible unwarranted encryption. No, seriously, your arguments tend to be belittled by your spelling. (Maybe you should get Pronto Secure, it has a spellchecker included) BTW, I don't get paid by Commtouch for writing that (SNIF!). A quick overview: beleive, politions, disscusion, orginised, sponcered, orginization, wekness, vailid, Dresdin, durring, expantion, Prodistant, Palisinians, unwarrented, PEROID, somthing, mistamener, mabye, mabye not, possiable, encyrption, disscussing, bost I hate teachers and people who show of with their spelling (and I'm a split personality). Yeah, me too. - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMiVoqxFhy5sz+bTpAQFYUgf/eu+dQvQALz7Of3DCWLoBWVICY2fmnDJB tQcHTNbuPXybjACVq8+LxdKT2wjXzuU401/rv4dW5+LgrMRlKMIhjx8xAIKSKBOg VBb2ruV9SG2/+sY0iYzJY1Dz4opf5c9aCLgN5ptM2LeWyWOtK71VtV8ASDaoGBP7 HIs9jVJ3sbyQaf8CPfR+pEQSjGLHCm8QshazSjPvuUdIRxB5f9Etpy+45vK4FVPP EXWYaN3jTBOPC24Qe8qGs+Dn/9C5ZR9y0Y2edv/XzWDZrdg951lSdQKxca4wtCbD nyKQ/R86wvfy65uwrBDzUSFupuA1M8TcF63ncybQ/316cHl8x/z0rA== =musf -----END PGP SIGNATURE-----

2 1

Desubscribe
by MrAdvent＠aol.com 17 Dec '03

17 Dec '03

I would like you to desubscribe me from you mailing list

3 2

Re: There is no Agent Toby Tyler at the FBI [UK Observer St
by Peter Trei 17 Dec '03

17 Dec '03

Duncan Frissell <frissell(a)panix.com> writes: > At 03:17 PM 8/28/96 -0700, Richard Charles Graves wrote: > >...two different sources, both of whom are anonymous because they work for > >competing newspapers, tell me. > > > >Could someone else with contacts/time to kill/attributability please confirm > >this? > > When I first saw the name, I remembered my misspent youth: > Toby Tyler, or Ten Weeks with a Circus (1960) > USA 1960 Color > Produced by Walt Disney Productions Which proves little (though it is suggestive). People get names for a variety of reasons, and before 1960, there would have been little reason *not* to use the name. Back in the 70's I remember hearing many reports from a news announcer at the BBC World Service named Dick Tracy. Peter Trei trei(a)process.com

1 0

Re: MUD anyone?
by jim bell 17 Dec '03

17 Dec '03

At 09:47 AM 8/27/96 -0700, Jon Leonard wrote: >> Would anyone out there be interested in helping set up a >> crypto-anarcho-capitalist MUD to play around with some of the social >> aspects of crypto-anarchy and anarcho-capitalism? I can probably hack >> together a basic lpmud in a month or two if someone has a machine which >> it could run on and which could run a mailing list for those involved. > >I've been planning to run a MUD like that, at mud.umop-ap.com port 2121. >I just don't have enough coded to be worth announcing yet. >Which cryptographic primitives should be coded in initially? >Obvious choices are: >Pseudonyms >Anonymous digital cash (issued by any pseudonym, not just "banks") >Public and private keys >Secret sharing >Anonymous broadcast & message pools >Anonymous markets > >What am I missing? Should there be direct support for Jim Bell's >assasination markets? It'd provide a means of demonstrating its >ineffectiveness as a means of social control. Aren't you writing up the results of the experiment before you even take the data? That's called "dry-labbing." In any case, I'd welcome such a simulation, but there are a number of caveats. To me, the most obvious one is GIGO: Simulations, especially political/social ones, might depend heavily on assumptions that are programmed into them. A trivial, yet interesting example is the computer game "Sim City" which allowed you to adjust the "tax rate" but problems always cropped up the further away you were from 7%. The libertarians were frustrated that we were unable to drop the tax rate and still get a well-functioning, happy society. It is unlikely, obviously, that there is anything magical to a society about a tax rate of 7% The answer is likely that the people who wrote the program simply hard-coded it into the game, either directly or as a consequence of various political/social assumptions that they didn't realize they were making. Another problem was demonstrated a few weeks ago when a "game theory"-type problem was proposed on CP, the one where 20 thieves sequentially are given the task to propose the disbursement of $20 million in loot, with a vote on the proposal and death for the proposer of a rejected proposal. I pointed out that the difficulty with an _exact_ (game-theoretical) solution to such a problem is that the "cost" of death in this problem is undefined. A person might be willing to take a risk of death for $20 million that he's unwilling to take for $20 THOUSAND, and certainly not $20 DOLLARS. AP (Assassination Politics), at least the initial "government-eliminating" function of it, should work on a financially-sound principle: Actuarially, the value of a continuing $1/year obligation is $20 if the real interest rate is 5%. This means that if a randomly-selected government employee is paid $40K per year including benefits (money which is stolen from taxpayers), it would be worth a one-time cost (actuarially speaking) of 20x40K, or $800,000 to see him dead and not replaced. Assuming his death can be purchased for less than this, you are dollars ahead to buy it. If you can buy his death for, say, $20,000 (half his yearly salary) you have, in effect, profited by $800,000-$20,000 or $780,000 to do this. (Technically, the amount _society_ would benefit is actually the amount of salary cost eliminated, minus the ordinary benefit of that government employee doing his usual job. A person (statist?) might try to conclude from this that getting rid of them won't save much. That's the collectivist point of view. However, the people who (unwillingly) finance these salaries with their tax dollars, and the people who arguably benefit from these employees are, in my estimation, two separate and distinct groups of individuals, so my analysis is still valid for the former group.) It gets even better. If most of these employees decide that discretion is the better part of valor, and 90% of them resign rather than (almost literally!) get the ax then the average cost of getting rid of a given employee is reduced by another factor of 10, perhaps to $2,000. And obviously, the system feeds on itself: Once the average cost of getting rid of them drops to $2,000, their fate is so certain that the resignation rate would probably skyrocket to well over 99%, which would further reduce the average cost to perhaps $200, and so on. The overall effect is somewhat akin of "falling off a cliff," or perhaps the collapse of a star destined to become a black hole: Once a certain point it reached return is impossible or impractical. Now you should understand why I'd be quite pleased to see such a system modelled: It would be great to be able to vary the initial conditions, and see that the outcome turns out almost identically each time. Such an outcome would make you very nervous: It would show that I am correct! (BTW, a similar analysis will probably suggest that the amount of money traditionally spent on US national defense would drop from the current figure of about $250 billion to no more than 1/1000th of this, or maybe even far less, and for similar reasons.) Jim Bell jimbell(a)pacifier.com

1 0

Annoucing LivePGP - content security for web (fwd)
by Black Unicorn 17 Dec '03

17 Dec '03

-- I hate lightning - finger for public key - Vote Monarchist unicorn(a)schloss.li ---------- Forwarded message ---------- > From ssl-lists-owner(a)minbne.mincom.oz.au Thu Aug 29 01:00:59 1996 > Message-Id: <01BB9594.5E8FC740@minuet> > From: Ming-Ching Tiew <mctiew(a)csi.po.my> > Subject: Annoucing LivePGP - content security for web > Date: Thu, 29 Aug 1996 10:25:07 +-800 > Encoding: 54 TEXT > Sender: ssl-lists-owner(a)mincom.com > Precedence: bulk > > Inspired by Adam Cain's write-up ( and others ) on comparison on the using of PGP, > SSL/HTTPS, SHTTP and others on Web technologies, I have written a LivePGP > plugin for Navigator 3.x and is available for evaluation for anybody who cares to > send me a email ( as I don't have a leased line connection to internet ). > > See below for a summary. > > Thank you, > Regards, > Ming-Ching > mctiew(a)csi.po.my > > ------------------------------------------------------------------------------------------------------ > As a summary, this is a plugin for Navigator 3.x which I developed it > myself, and which I called it LivePGP because it uses LiveConnect and > PGP. > > LivePGP is a plugin to be loaded on Navigator machine; it secures the > content before transmittion to the network. Therefore, it doesn't matter > what network or what's or ever. > > With absolutely no intention to compete with SSL and SHTTP, LivePGP > attempts to address some issues with existing security products :- > > 1. 1024-bit key length of PGP in comparison with 40-bit for SSL ( due to > international export limitation ). PGP is a well-known product which > has survived years to testing. > > 2. Extended security vs point-to-point security provided by SSL. Content > coming out of SSL client and server are plain text, which may > be subjected to system administrator's tempering with the data. Using > LivePGP, the decryption of data can be relayed as late as (operationally) possible. > > More important practical reason is that the signed content can be logged > on the client and server; it is very useful to addresss non-repudiation. > The client cannot argue that he didnot submit the transaction, because > the content which contains the client's signature can be logged and printed out. > > Similary, system administrator's tempering the data could be checked against > with. > > 3. Even thought the plugin is developed using C/C++ and Java, > deployment for any scenerio need only standard HTML/Javascript. > > 4. Client is Win95/NT. Server can be anything. Win3.11 is unknown. > > 5. Every part introduced by me is source code available. > > 6. Can use it together with SSL to make use of the high transparency > of SSL. > > 7. Can use it to upload ( signed and encrypted ) local files, in addition > to uploading ( signed and encrypted ) web content.

1 0

Re: In reference to comments made to me and to the Group
by Institute for Security and Intelligence 17 Dec '03

17 Dec '03

Mr. Geiger: I do not have interest in nor time for a flame war. But I do appreciate your perspective, whether or not I agree. Rather than flaming, I propose that all interested readers post their *CONSTRUCTIVE* ideas on the CyberTerrorism issue. If you feel it is not an issue, then don't respond. I'm not looking for opinions on politicians, the government, etc., nor do I care what you think of me or my views. However, if you can put some _solid_ thoughts into bullet items, or any other format you deem useful, perhaps we can move forward. Ideas. Actions. No commentary, raves, rants, flames, or other bandwidth wasters. Let's see what we come up with. Barry C. Collin Institute for Security and Intelligence

3 2

Re: In reference to comments made to me and to the Group
by Ross Wright 17 Dec '03

17 Dec '03

Sir, Please get a spell checker before you post any more thousand word flame-outs On Or About: 29 Aug 96, 0:05, William H. Geiger III wrote, jumping into a flame war before he learned how to spell polititions orginised, > campaines Prodistant Prodistant Palisinians > Unauthorised mistamener <sp?>. mabye, mabye possiable > obsecurity conserned . Ofcource experiance comprehention big bost These are just a few of the spelling errors in a huge rant!!!!! =========== Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

Re: There is no Agent Toby Tyler at the FBI [UK Observer Story]
by Duncan Frissell 17 Dec '03

17 Dec '03

At 03:17 PM 8/28/96 -0700, Richard Charles Graves wrote: >...two different sources, both of whom are anonymous because they work for >competing newspapers, tell me. > >Could someone else with contacts/time to kill/attributability please confirm >this? When I first saw the name, I remembered my misspent youth: Toby Tyler, or Ten Weeks with a Circus (1960) USA 1960 Color Produced by: Walt Disney Productions Genre/keyword: Children's / Drama Language: English Runtime: 96 Also Known As: Toby Tyler (1960) Directed by Charles Barton Cast (in alphabetical order) Henry Calvin Kevin Corcoran .... Toby Tyler James Drury Gene Sheldon Bob Sweeney Written by Lillie Hayward James Otis Kaler (novel) Bill Walsh DCF

1 0

Simulations
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:05 PM 8/28/96 -0800, jim bell wrote: >To me, the most obvious one is GIGO: Simulations, especially >political/social ones, might depend heavily on assumptions that are >programmed into them. A trivial, yet interesting example is the computer >game "Sim City" which allowed you to adjust the "tax rate" but problems >always cropped up the further away you were from 7%. The libertarians were >frustrated that we were unable to drop the tax rate and still get a >well-functioning, happy society. I was taking economics back in the Armonk Iron days and we played around with an economic simulation program written in Fortran. One was supposed to adjust government spending and taxes to find an optimum level. I set both taxes and spending to zero. We got a lot of economic growth and a lot of inflation (this was not a monetarist simulation). But we were happier. DCF

1 0

MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

Just downloaded the most recent English Version 2.1 for Windows 3.1. This does appear to do the same in terms of no encryption at all after the server hello. To be fair to Microsoft the number of cycles performed for the private key echange is quite high. Therefore, not having any key and not doing the RSA calculations makes the access quite a bit faster. The older versions (and some Win95 versions) that we have found around seem to just crash our server. I am not really feeling like debugging that.

1 0

Re: Thoughts on CyberTerrorism {per request}
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: whgiii(a)amaranth.com, cypherpunks(a)toad.com Date: Thu Aug 29 15:45:06 1996 > The issue of cyberterrorism can be divided into 3 main parts: > Catastrophic Terrorist Attack > Major Criminal Attack > Minor Hacker Attacks > The CyberTerrorist > The CyberTerrorist/Mad Scientist > The Computer Criminal > The Hacker It seems that you have a very broad view as to what constitutes terrorism. According to you, somebody who hacks into a system is a cyberterrorist. It seems, that would make a burglar a real life terrorist, too. So, to state my point: you use the word cyberterrorism in conjunction with ALL possible attacks on a system. Did I get that definition right? If not, why not? Greetings, Remo Pini - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMiWe5BFhy5sz+bTpAQGf5gf+L6Mkx4rqvdvsWe84j2TzLYaeOpbO7VCe S1Ia3EC9rByfXK71zmDCWRd7bTdmRULq297dD/Aqr7KWSEEtsBpQCLs8tGiPCV3I S+M613ud6Uy9QXtIyw14Ao7XILijWUDU2Hdwb5xfmJ/GIIQiZyDjMVLDXABM7rgb 4d+5AP+gh6VTRNqd2LmhwcvhUoupeJ40QxlRyOJ2A4ZNT7xaS7shUPnbS5kcuSrF z27nRmnaPkRmh3VD870OIoTRsWUOIQ9lwUkXrPdly9w8E23FyuXGPEMkW+KdUCNZ 6hI7YYsBnCJjM+aUzq3Ypt/N/iUcbPvKO4T+FtbKJHB15IbtDTUr4A== =pg+4 -----END PGP SIGNATURE-----

1 0

Realtime Keyserver update
by Osborne, Rick 17 Dec '03

17 Dec '03

First off, let me say thank you to all of those who responded to my first message, I gained alot of useful information. Mark Rogaski <wendigo(a)pobox.com> and I have decided to write up a RFC on it and are going through the initial stages of deciding on its functionality. We would appreciate any and all useful input on the subject. All ideas are welcome. You can email my autoresponder (at this same address) to get the latest information on what we've decided. Just make the subject GET KEYSERVER INFO for the response. Thank you for your interest and help. Rick Osborne

1 0

List owner named in law suit (fwd)
by Damien Lucifer 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 28 Aug 1996 16:52:36 -0400 (EDT) From: Clay Irving <clay(a)panix.com> Subject: List owner named in law suit I can't believe this one! Peter Laws, a recent graduate of the University of Arkansas, maintains an electronic mailing list called "SCAN-L". The list is provided for radio scanning enthusiasts. There are a few hundred subscribers to the list. Recently, in a thread about scanning publications, an employee of publication "A" apparently wrote something to offend someone at publication "B". Lo and behold, next thing you know, Peter is named in a lawsuit because he is the maintainer of the list. Something seems very, very wrong with this. I've never heard of anything like this before. Can a Email list maintainer be held liable for something someone else writes? Peter *just* graduated, and he needs all the help he can get. Thanks, in advance. -- Clay Irving N2VKG clay(a)panix.com http://www.panix.com/~clay/

1 0

Re: MSIE cryptography
by Peter Trei 17 Dec '03

17 Dec '03

John Hemming - CEO MarketNet" <johnhemming(a)mkn.co.uk> writes: > Just downloaded the most recent English Version 2.1 for Windows 3.1. > This does appear to do the same in terms of no encryption at all after > the server hello. > > To be fair to Microsoft the number of cycles performed for the private key > echange is quite high. Therefore, not having any key and not doing the > RSA calculations makes the access quite a bit faster. > > The older versions (and some Win95 versions) that we have found around > seem to just crash our server. I am not really feeling like debugging that. I understand that some versions of MSIE support SSL level 3. SSL3 includes a capability to switch 'cipher suites' in mid-session, or pick one at the start of the session. One of the standard cipher suites performs authentication, but not encryption. This is consistant with your description. Please ensure that the server you are connecting to is not configured for authenticate-only. It would be a pity to raise a big ruckus over what may be just a mis-configured server. Peter Trei trei(a)process.com

2 1

Small German bank claims first with online service
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

> FRANKFURT, Aug 28 (Reuter) - German private bank Gries & >Heissel Bankiers on Wednesday launched an Internet banking >service -- the first comprehensive service of its kind in a >country where online bank options are gradually taking off. > The small Berlin-based bank linked up with U.S. computer >firm Hewlett Packard Co to develop the system, which Internet >users can access using a high-security personal code. > Clients will be able to view detailed balances on their >deposit, current and securities accounts and transact all normal >banking business on the World Wide Web. > Although online banking is a developing trend on the German >financial services market, larger banks with far broader >customer bases are working on more selective Internet packages. > Thomas Gries, one of Gries & Heissel's personally-liable >directors, said he regarded Internet banking as a logical >supplement to the bank's existing services. > ``We have had an Internet home page since October 1995. This >move from a pure information medium to an interactive one was a >logical one,'' Gries said. > Banking officials attending the CEBIT electronics conference >in Hanover this week said German online banking business was >poised to grow dramatically. > ``In the next six months, five to ten German banks will be on >the Internet,'' said Stefan Schoeller, board member at Bayerische >Vereinsbank AG unit Vereins- und West Bank. > Vereinsbank plans to launch Internet services within about >six months via its Advance Bank direct unit, pending a review of >security options. > Rival discount broker Direkt Anlage Bank, a unit of >Bayerische Hypotheken- und Wechsel Bank AG, on Tuesday launched >an Internet service for its securities account holders at half >the cost of its telephone banking service. > Meanwhile market leader Deutsche Bank AG is to test >electronic cash on the Internet this autumn in a joint >initiative with Dutch electronic payments group Digicash NV. > Vereinsbank officials at CEBIT said they planned a steady >expansion of the bank's online options over the coming years, >predicting 10 to 15 percent of its current account clients would >be online by the year 2000. Around 12 million Germans would rely >on home banking by that date, the bank predicted. > At the moment, around 3.7 percent of the bank's clients, or >45,000 individuals, handle their banking via PC alone, Stefan >Schoeller said. > Hewlett-Packard's German sales manager Michael Lindner said >his company, which last year helped set up the world's first >Internet bank, Security First Network Bank, had spoken to >several other German banks about some kind of Internet venture. > ``We certainly do not plan to limit our involvement to a >small exclusive bank,'' he said. > Lindner said there were about two million Internet users in >Germany and 35 million worldwide. He admitted that the amount of >bank business transacted on the Net -- about $200 million -- was >``very limited'' but predicted a dramatic rise in volume. > Vereinsbank's Schoeller said the cost advantage alone made >it worthwhile for customers to go online. A normal current >account incurred charges of 8.40 marks a month, while the same >account online would cost just 5.40 marks, he said. > All banks are stressing the security of the Internet. > > > _______________________ Regards, Boredom is the feeling that everything is a waste of time; serenity, that nothing is. -Thomas Szasz Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

>> Just downloaded the most recent English Version 2.1 for Windows 3.1. >> This does appear to do the same in terms of no encryption at all after >> the server hello. >I understand that some versions of MSIE support SSL level 3. SSL3 includes a >capability to switch 'cipher suites' in mid-session, or pick one at the start of the >session. One of the standard cipher suites performs authentication, but not >encryption. This is consistant with your description. >Please ensure that the server you are connecting to is not configured for >authenticate-only. It would be a pity to raise a big ruckus over what may be >just a mis-configured server. The server is one which interoperates correctly with Netscape and my own routines. It does strike me that this change is potentially the source of the bug. However, to have a "locked" symbol on the bottom right hand of the display would indicate to me as a user that a secure session has occurred. For SSL devotees the records sent are: 1. Client hello (from the client) 2. Server hello (from the server). 3. Plaintext data packaged up in SSL records from the client. 4. The client then accepts plaintext data packaged up in SSL records. SERVER_VERSION_MSB and SERVER_VERSION_LSB indicate version 2 of SSL. I have not changed the code in any way to deal with version 3 of SSL making I think the valid presumption that browsers using 3 and 2 should be able to cope with a server using 2. I shall reboot my system, trace a bit of a session and post that.

1 0

Re: MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

For the real SSL devotees here are the first three transmissions. Client Hello 16.8 1025->443 seq 00000001 ack 00000001 PSH ACK wind 4096 data 30 80 1C 01 00 02 00 03 00 00 00 10 02 00 80 69 AE 0E F0 FA 2E 01 63 BC 59 AF 0F 1C C1 B1 7B 16.8 443->1025 seq 00000001 ack 0000001F PSH ACK wind 5640 data 590 Server Hello 82 4C 04 00 01 00 02 02 2E 00 03 00 10 (cert starts) 30 82 02 2A 30 82 01 93 02 05 26 FB 85 54 3F 30 0D 06 09 big snip of server hello (of the certificate) CC 1F BC A8 9C D7 47 41 D2 33 27 (cert has ended) 02 00 80 4A E7 13 36 E4 4B F9 BF 79 D2 75 2E 23 48 18 A5 16.9 1025->443 seq 0000001F ack 0000024F PSH ACK wind 4096 data 333 Client Master Key should be here, but instead we get 81 4B 47 45 54 20 2F 20 48 54 54 50 2F 31 2E 30 G E T sp / sp H T T P / 1 . 0 0D 0A 41 63 63 65 70 74 3A 20 2A 2F 2A 2C 20 71 Server Hello 82 4C 04 00 01 00 02 02 2E 00 03 00 10 (cert starts) 30 82 02 82 4C - SSL RECORD 04 - Server Hello 00 - Session ID Hit (no prior session) 01 - Certificate Type 00 - Server Version MSB 02 - Server Verson LSB (ie server version of SSL is 2) 02 2E - Certificate length (mainly snipped) 00 03 - Cipher specs length 00 10 - Connection ID length I think the probability is that the unusual circumstance that causes what seems clear to me as an error is that the cert is signed by a CA other than Verisign. Essentially, however, I do not think it is right for a program to display a locked key regardless of any other issues if the data being transferred is not encrypted.

1 0

Re: Stego Virus
by Robb＠SpeakOut.org 17 Dec '03

17 Dec '03

For a virus (a program) embedded in a .gif file to affect you, it would have to unsteg and then run. Just dont run it it you unsteg it. Robb Hill National Association for Home Care 228 7th Street SE Washington DC 20003 202-547-7424 202-547-9312 fax robb(a)speakout.org

1 0

see you guys later
by robbhill＠southwestpaper.com 17 Dec '03

17 Dec '03

This list used to focus on privacy issues, crypto protocols, algorithms, national crypto policy, etc. I saw the Netscape cracks announced here, I saw squeamish ossifrage here, now I see nothing of the sort. Now I see that people are discussing heckling the pres., black helicopters???. I have heard Phil Zimmerman frequently call Paul Zimmerman. See you guys later. Robb Hill National Association for Home Care 228 7th Street SE Washington DC 20003 202-547-7424 202-547-9312 fax robb(a)speakout.org

2 1