December 2003 - cypherpunks-legacy

Smoke & Mirrors
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A friend of mine has a business setting up networks for business's in the Baltimore area. He contracts out the security end of the setup to a firm called "Smoke and Mirrors". They create firewalls and handle encryption capabilities. I think the company is in the baltimore area, and was wondering if anyone on the list has heard of this company? With a name like smoke and mirrors I guess they better be good. Anybody know? Vaccinia(a)uncvx1.oit.unc.edu -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLyLIZD2paOMjHHAhAQHIuwQAhMdaCsA5j7W/Z/m2VHLeaendI7/JHNGv qm1hePuz3OolJmYgaWyAODlefcLkaKNapeEh5/xRoleEI8dUWuC+njJKvw6MKkr/ b6b/UbcKpLf/qqpFVuz+BbCnBUIY8iALhCLe832o5yxzAV2GT64Sj5gfjhUa3XVy 5dR4yI51SNc= =ZvUV -----END PGP SIGNATURE-----

1 0

E-Mail Security - New Book
by schneier＠chinet.chinet.com 17 Dec '03

17 Dec '03

E-MAIL SECURITY WITH PGP AND PEM: HOW TO KEEP YOUR ELECTRONIC MESSAGES PRIVATE ...a new book by Bruce Schneier John Wiley & Sons, 1995 ISBN 0-471-05318-X $24.95 The world of e-mail is the world of postcards. Between you and your correspondents may lurk a foreign government, a business competitor, an overzealous law enforcement agency, or even just a nosy neighbor. The problem is, all of these potential eavesdroppers, given fairly simple access tools, can read your messages as easy as a postal worker can read your postcards. E-MAIL SECURITY is about protecting electronic mail fm spies, interlopers, and spoofs--people who may want to destroy, alter, or just look at your private communications. The book shows how you can protect the financial information, contract negotiations, or personal correspondence you entrust to public or private networks--and it shows how this protection is available right now, with free or inexpensive software. The book discusses PGP and PEM: how they work, how they are different, and how to choose which one is right for you. TABLE OF CONTENTS: Part I: Privacy and Electronic Mail Chapter 1: The Problem Chapter 2: Encryption Chapter 3: Key Management Chapter 4: Authentication Chapter 5: Certificates Chapter 6: Keeping Your Private Key Private Chapter 7: Odds and Ends Chapter 8: Patents, Governments, and Export Laws Part II: Achieving Electronic-Mail Privacy Chapter 9: Requirements and Features Chapter 10: Privacy Enhanced Mail (PEM) Chapter 11: Pretty Good Privacy (PGP) Chapter 12: Comparing PGP and PEM Chapter 13: Attacks Against PGP and PEM Appendix A: Pretty Good Privacy Appendix B: Privacy Enhanced Mail ***************************************************************** If you are interested in a copy of E-MAIL SECURITY, please send a check for $25 + $5 postage (ask for rates abroad) to: Bruce Schneier 730 Fair Oaks Ave Oak Park, IL 60302 The book won't be available until at least the end of the month, so please be patient.

1 0

Another Book By Schneier...
by werewolf＠io.org 17 Dec '03

17 Dec '03

Saw this on one of the cryptography conferences..... From: schneier(a)chinet.chinet.com (Bruce Schneier) Subject: E-Mail Security - New book by Bruce Schneier Message-ID: <D2qsIJ.Dzz(a)chinet.chinet.com> Organization: Chinet - Public Access UNIX Date: Sat, 21 Jan 1995 06:25:31 GMT E-MAIL SECURITY WITH PGP AND PEM: HOW TO KEEP YOUR ELECTRONIC MESSAGES PRIVATE ...a new book by Bruce Schneier John Wiley & Sons, 1995 ISBN 0-471-05318-X $24.95 The world of e-mail is the world of postcards. Between you and your correspondents may lurk a foreign government, a business competitor, an overzealous law enforcement agency, or even just a nosy neighbor. The problem is, all of these potential eavesdroppers, given fairly simple access tools, can read your messages as easy as a postal worker can read your postcards. E-MAIL SECURITY is about protecting electronic mail fm spies, interlopers, and spoofs--people who may want to destroy, alter, or just look at your private communications. The book shows how you can protect the financial information, contract negotiations, or personal correspondence you entrust to public or private networks--and it shows how this protection is available right now, with free or inexpensive software. The book discusses PGP and PEM: how they work, how they are different, and how to choose which one is right for you. TABLE OF CONTENTS: Part I: Privacy and Electronic Mail Chapter 1: The Problem Chapter 2: Encryption Chapter 3: Key Management Chapter 4: Authentication Chapter 5: Certificates Chapter 6: Keeping Your Private Key Private Chapter 7: Odds and Ends Chapter 8: Patents, Governments, and Export Laws Part II: Achieving Electronic-Mail Privacy Chapter 9: Requirements and Features Chapter 10: Privacy Enhanced Mail (PEM) Chapter 11: Pretty Good Privacy (PGP) Chapter 12: Comparing PGP and PEM Chapter 13: Attacks Against PGP and PEM Appendix A: Pretty Good Privacy Appendix B: Privacy Enhanced Mail ***************************************************************** If you are interested in a copy of E-MAIL SECURITY, please send a check for $25 + $5 postage (ask for rates abroad) to: Bruce Schneier 730 Fair Oaks Ave Oak Park, IL 60302 The book won't be available until at least the end of the month, so please be patient.

1 0

Ben Goren Eyes Only
by John Young 17 Dec '03

17 Dec '03

On Mon, 23 Jan 1995 Ben Goren <ben(a)Music.ASU.Edu> said: Mr. Goren, Mail to <ben(a)Music.ASU.Edu> ricochets. Hep.

1 0

Re: The Remailer Crisis
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Tim writes: > One thing I should've noted is that a Linux-based cheap remailer is > mostly useless without a "live connection" to the Net. I disagree - live connections are great for fast-response systems, but we got along just fine in the uucp dialup world with occasional connections; in an environment like remailers where you _want_ batchy performance, the clunkiness can even be a "feature". I don't know how many providers are offerring uucp or ip dialout from their servers, or whether they're much cheaper than real ip, but you can do ok with, say, hourly polling to a TIA or term connection to fill your mailbox from a POP server, or nightly if that's enough. TIA also has the advantage over SLIP/PPP that outgoing mail from your system will _always_ have unverifiable IP addresses - you look like netcom.com, just like everyone else TIA-connecting from netcom does. And connections from shared-IP-address-pool systems like netcruiser or dialup PPP systems probably don't do much logging of who's used what IP address beyond when nameserver caches clear. Bill

6 7

RE: syrinx remailer up and running
by Johnathan Corgan 17 Dec '03

17 Dec '03

>Well folks, the syrinx remailer is up and running now. The particulars: > >Address: syrinx(a)c2.org Could you post the capabilities of this remailer, like cpunk, hash, pgp, ksub, latent, etc.? == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)scruznet.com -Isaac Asimov

3 2

Re: Data Vaults (vs. Data Havens)
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Tim and Eric write things like: > I fully concur. The connotations of the word "haven" imply activities > that ordinary people don't see themselves doing. This means that > ordinary people won't generally use something called a "haven", even > if they might use exactly the same service called something else. We can always call them "Private Storage Servers" or some such; an interesting question is whether the main uses will be for retrieval by the storer, or by someone else, or by a bunch of others, and how we describe the service may affect that. Bill

2 1

Re: T.A.Z. on Disk
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

>On Fri, 20 Jan 1995, Angus Patterson wrote: >> >> > I also saw another e-book site that had some more of [Bey's] stuff, can't >> > remember what it was though. > >On Fri, 20 Jan 1995, Mark Grant wrote: >> There's some more on the WWW at http://www.uio.no/~mwatz/bey/index.html. > >Bey sings the line that good is no different from evil, feeling >is better than thinking, and truth indistinguishable from lies. > >Sounds like a pile of crap to me. Still, I suppose that feelings >and lies are a poets job. Hm. Can we maybe head off the Ideology War before it becomes unstoppable? Cypherpunks write code, and do lots of other stuff too, but I'm hoping that endless political wars is something cypherpunks don't do, or at least try not to do on the cypherpunks list. [It's possible that the ideology of the list is as homogenously anarcho-capitalist as it seems, but I'd bet there's enough anarcho-others to sustain several never-ending political 'discussions' of the sort that will make the list even less useful then when we spent dozens of messages a day talking about logos.]

1 0

Re: traffic analyzing Chaum's digital mix
by Wei Dai 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > From: Hal <hfinney(a)shell.portal.com> > > I know that the Eurocrypt 89 proceedings had some articles on > cryptanalyzing Chaum's mixes. My library has an excellent crypto > selection but is missing this volume. Can anyone who has read this say > whether there is anything in those papers that isn't obvious? I found a copy of these proceedings in the library today. There is a paper titled "How to break the direct RSA-implementation of MIXes" by Birgit Pfitzmann and Andreas Pfitzmann. Here is its abstract: MIXes are a means of untraceable communication based on a public key cryptosystem as published by David Chaum in 1981 (CACM 24/2 84-88). In the case where RSA is used as this cryptosystem directly i.e. without composition with other functions (e.g. destroying the multiplicative structure) we show how the resulting MIXes can be broken by an active attack which is perfectly feasible in a typical MIX-environment. The attack does not affect the idea of MIXes as a whole: if the security requirements of [Chaum's paper] are concretized suitably and if a cryptosystem fulfills them one can implement secure MIXes directly. However it shows that present security notions for public key cryptosystems, which do not allow active attacks do not suffice for a cryptosystem which is used to implement MIXes directly. We also warn of the same attack and others on further possible implementations of MIXes and we mention several implementations which are not broken by any attack we know. My interpretation is that PGP-based remailers are not susceptible to the attack described by this paper. (Of course, they are currently vulnerable to much more trivial ones.) Wei Dai -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLyMeCTl0sXKgdnV5AQFoggP/XzBFSyChFgNMrX3gCQSNfOiwHrAEKgpD a0TGYX9KBRqRd6cdDIdauDzFtPST1XjU/1RpYvlGjKIhOSd60JZwO+7185SJGBM9 q/4cqE/hOiHzB2gaoHiQFySDIkfFTeJdlIiTiS/OjbR5awkMCF+zU8cxPrgWTrxr /sM1C39O8Cc= =J20K -----END PGP SIGNATURE-----

1 0

Re: port 25 forgeries
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 11:35 PM 1/21/95 PST, santa(a)northpole.toad.com, org(a)toad.com wrote: > ... >Received: from relay2.UU.NET by eri.erinet.com (4.1/SMI-4.1.1) > id AA16848; Sun, 22 Jan 95 02:56:29 EST >Received: from toad.com by relay2.UU.NET with SMTP > id QQxztg01780; Sun, 22 Jan 1995 03:01:32 -0500 >Received: by toad.com id AA23166; Sat, 21 Jan 95 23:55:03 PST >Received: from northpole.org (tower.stc.housing.washington.edu) by toad.com id AA22783; Sat, 21 Jan 95 23:36:47 PST > ... Presumeably the (tower.stc.housing.washington.edu) comes from a PTR DNS lookup. What happens if the IP address of the remailer isn't available from DNS, or the in-addr.arpa entry is wrong? (I don't know who exactly is responsible for the in-addr.arpa entry--is it the same as for the others?) --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

Re: Locksmith's Guild wants limit on free speech
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 12:42 PM 1/22/95 -0500, John Young wrote: > ... >Both fear that they do not know the code well enough to take the risk of >being found at fault by random municipal inspections of construction. >A-E's dread the liability and blame by owners for well-known construction >corner-cutting, and owners suspect their professionals competency and >ethics -- afraid that the pros will certify in ignorance or cupidity and >that the owners will face costly corrections without having the traditional >scapegoat of over-weening government to justify cheating in the field. A classic example of people being unwilling to accept responsibility for the outcome of their own actions. That said, building inspection serve much the same function as code reviews, and are a "good thing" for exactly the same reason. I suspect that the A-E's will lobby for liability exemptions, and if they fail to get them, they will wind up going to private building inspectors/"code consultants" just like in-house accountants bring in outside auditors. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

$8M for National ID registry
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

"Anti-immigration bandwagon," San Francisco Examiner, Sunday, 11/22/95, p. A-5: Amid an article discussing Clinton's effort to beat the Republican's in keeping out illegal aliens: "A federal advisory commision recently proposed that the government establish a computerized register of the names and Social Security numbers of citizens and aliens authorized to work in the United States, so that employers could check the immigration status of job applicants." "Clinton will seek $8.3 million for a pilot program to evaluate the effectiveness of such a system." Comforting words, especially given that children are to be assigned Social Security numbers at birth. Best Wishes, Michael D. Crawford crawford(a)scruznet.com crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

1 0

A Legal Web Page Issue
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Someone on the Cyberia mailing list has announced that his URL on legal matters (http://www.commlaw.com/pepper) can only be accessed by sites which charge a "flat rate." I'm not at all clear what he means by a flat rate here....is is flat rate per month, or per access, or what? In any case, I sent him (and the Cyberia list) a note saying I had already added it to my home page and that the nature of the Web is that URLs ripple out, either by linking with other pages or by publicizing the URLs (as he did, and as I have just done here). So, give it a browse and add it if you find it interesting. When he sees a bunch of accesses (assuming his system has logs he can look at) from sites over which he cannot possibly hope to set policy for, he may realize the futility of this. (He can stop accesses, or charge admission, with various means--maybe not yet fully developed, or with commercial Web servers such as Netscape is developing--but he cannot release the URL and then enforce his ideas of who can access it. God forbid we have people trying to "copyright" their URLs and then collect royalites anytime the URL shows up in someone's list of interesting places.) This experiment in guerilla ontology brought to you by, --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

2 2

Markoff/NYT on IP spoofing
by Brian A. LaMacchia 17 Dec '03

17 Dec '03

John Markoff writes in Monday's New York Times about a rash of computer security breaches using IP spoofing to penetrate routers and firewalls. That's all the technical info I coudld glean from the story; CERT is supposed to "make an announcement" later today and tell us what brands of routers can and cannot be modified to defend against this type of attack. Towards the end of the article Markoff puts in a nice plug for crypto: Most computer security experts say that real security on the Internet awaits the widespread adoption of encryption technology for scrambling data and authenticating messages. ``The right answer is encryption because when you encrypt your business data you don't care how many people get a copy,'' said Eric Schmidt, the chief technical officer of Sun Microsystems. ``My prediction is that this will be the only real solution to these problems.'' --bal

3 4

Re: A Legal Web Page Issue
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 9:55 PM 1/22/95, Timothy C. May wrote: >Someone on the Cyberia mailing list has announced that his URL on >legal matters (http://www.commlaw.com/pepper) can only be accessed by >sites which charge a "flat rate." I'm not at all clear what he means >by a flat rate here....is is flat rate per month, or per access, or >what? [...] >So, give it a browse and add it if you find it interesting. When he >sees a bunch of accesses (assuming his system has logs he can look at) >from sites over which he cannot possibly hope to set policy for, he >may realize the futility of this. > >(He can stop accesses, or charge admission, with various means--maybe >not yet fully developed, or with commercial Web servers such as >Netscape is developing--but he cannot release the URL and then enforce >his ideas of who can access it. God forbid we have people trying to >"copyright" their URLs and then collect royalites anytime the URL >shows up in someone's list of interesting places.) What a crazy thought. I will make sure to access his URL early and often. BTW, what is your homepage URL? Or was that just a spoof? -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

2 1

www.commlaw.com/pepper page
by Syed Yusuf 17 Dec '03

17 Dec '03

<p> Copyright 1994 by Pepper & Corazzini, L.L.P. All rights reserved. Reproduction is permitted so long as no charge is made for copies, no copies are placed on any electronic online service or database for which there is a fee other than a flat access charge, there is no alteration and this copyright notice is included. <p> legal translation: don't charge money to access this or copies of this page UNLESS you charge for internet access and EVEN then, don't charge extra just to look at this page. didn't want to bring this to the list unless it's to kill this discussion someone misread it.

1 0

Re: transient guerrilla remailers
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Nobody(a)rahul.net, forwarding from homer's remailer, writes: > If c2.org can offer RIAB accounts on a pre-paid basis, what's to > stop people interested in the cause from paying anonymously, > setting up the RIAB, and just walking away? When the pre-paid period > expires, the remailer goes away. Yeah - John Doe pays in cash, or uses a Post Office money order :-), to get X months of remailer service. After the initial account setup, he can keep it up dated by mailing in mostly-anonymous paper cash using the usually-anonymous paper remailer service offered by the US government, dropping the payments in a mailbox. If the sysadm is trustable, no problem, and the degree of trust is whatever a month's remailer service costs. If he's not, John Doe can detect it by occasionally using the remailer, and can spam the net with scanned-in copies of the money order showing it's payable to sysadm. If the sysadm wants to float the (low) cost of running a remailer for a month, he can even keep the money order around for a month or so to use as evidence if he's subpoenaed or otherwise legally harassed. One concern I have about this remailer strategy is whether everyone's remailer shows up as their own, or as "nobody" - can you tell the nobodies apart? John X. Doe

1 0

Re: "Internetpol"
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

Netcops By Hank, reprinted with permission <hank(a)vm.tau.ac.il> I eased the unmarked cruiser onto the highway, its 424 cubic cc, VJ engine purring. Traffic was heavy that day, as convoys of Usenet semi-trailers barrelled their way down the Information Super Highway. Biker gangs using Crack steered clear of our sedan searching instead for Internet tourists in Bermuda shorts and Nikon cameras around their necks. "Unit 7, Unit 7. Woman reporting a 426, over," came the printout on the Netcops IRC channel. Friday turned to me and gave me that look. The look that he gets when he wants to tear somone's head off. Friday is 6'6" and 230 pounds. he enjoys inflicting pain when necessary. "It's guys like this who give the Internet a bad name. Let's go see what we can do to help," said Friday, as he placed the flashing blue Kojak on top of the sedan as I popped the car into 5th and slashed by the Usenet truckers hauling their load of pornographic magazines and political soapboxes. We arrived at the Holiday Inn where the lady was staying. Her eyes were red and she looked like a Mac had hit her. Under the hurt she was actually quite pleasant to look at., kind of like the girl next door. Her name was Mary and in between sobs we sat her down and ordered espresso from the lounge bar. "It was terrible. I feel so violated. I'd like to kill the bastard," spat Mary with a vehemence that only Friday could understand. "Just the facts, mam," said Friday. "I'm here overseas for 9 weeks on assignment for my company. My husband is back home with our daughter and we decided to stay in contact via the Internet. I carry my subnotebook with me everytime I travel. My husband and I get along great but 9 weeks away from each other is just too long so we engage in cyber-sex. You know, private IRC channel, getting undressed behind locked doors and describing in intimate detail what wee are doing to each other. We've been doing it almost daily for 3 weeks,". "But this last time was different. My husband asked me to do all sorts of weird and kinky things and I agreed, but it just seemed wrong. After our three hour session, my husband called later that day saying that his Internet system was under ICMP redirect attack and that he hasn't been able to get Internet access for the past 24 hours,". Friday cut her off, "Do you use any protection?". "I normally would have used PGP (Pretty Good Privacy), but I forgot to install it before I left home. Listen, this guy at the other end must have been listening in on my previous sessions with my husband because he knew all the right things to say as to not arouse my suspicions,". Her lip trembled as she tried to hold back her tears but both Friday and myself knew time may heal all wounds but the scars remain. It was now my turn to bring down the hard facts, "Mary it looks like you are the victim of a 426 --net-rape. There are no laws on the Internet, no police, no government to turn to. Friday and myself act as volunteers in this neck of the woods, along with thousands of others throughout the world who mete out our form of frontier justice. What would you like done once we catch the perp?". She didn't hesitate for a moment, "I want nine of his fingers broken,". "Why nine," I asked. "There's no greater torture than using the Internet with one finger,". Friday smiled. Mary had made herself a lifetime fan. EPILOGUE We were able to track down the perp via the historical data sampling we collect daily via our RMON probe. We just correllated the packets with Mary's known IP address and the time of day that the incident happened. Once we had the perps IP address we contacted our fellow "cowboys" in that area who worked with the sysadmin who backtracked through the Unix logs and found the guy. Needless to say, he will never type fast again. ------ The story you have read is true (giggle) the names ahve been changed to protect the guilty. ------ This article appeared in Vol3 No2 Internet Society Magazine, 1994. Registered<BETSI>BEllcore Trusted Software Integrity system programmer *********************************************************************** Carol Anne Braddock "Give me your Tired, your Poor, your old PC's..." The TS NET REVOKED PGP KEY NO.0C91594D carolb(a)spring.com carolann(a)mm.com ************************************************************************ COMING SOON TO AN INTERNET NEWSGROUP NEAR YOU...............CENSORED.COM

1 0

Re: A Legal Web Page Issue
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 11:53 PM 1/22/95, Timothy C. May wrote: >Lucky Green wrote: > >> What a crazy thought. I will make sure to access his URL early and often. >> >> BTW, what is your homepage URL? Or was that just a spoof? > >Not a spoof, but not necessarily a normal home page. What I call my >home page is my "lynx" page, "lynx_bookmarks.html", to which I add >whatever URLs look interesting. (Netcom currently does not support WWW >pages for outside access.) I see. I thought that perhaps you had one of those ftp://* homepages that people here at Netcom seem to set up more and more. -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

4 3

Re: AA + Anonymous ECash = Unhappy Fundies
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > It strikes me that this would be the perfect way to generate > > consumer interest in anonymous digital cash protocols [. . . .] > The "cause" will do much better if the first major association is made > with something much less controversial. Girl Scout cookies, say. Girl Scout Cookies do crumble a bit when crammed through the net, and it's tough to deliver them to anonymous locations, unlike bits. And there are moral concerns there as well - not only do their "butter cookies" use non-butter shortening (:-), but there's the problem that it turns the Girl Scouts into a crass commercial enterprise, just another division of Nabisco, instead of teaching the kids that hard work will get them a 7 percent margin on their sales. On the other hand, being able to have Girl Scout cookies or flowers sent by anonymous donors may go over well in some circles... Bill

1 0

Re: hmmm, port 25
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

nutty elf writes, from tower.stc.housing.washington.edu, the message below. If I'd been watching recently for postings from that machine, I could point out who he probably was..... > From toad.com!owner-cypherpunks(a)ig1.att.att.com Sun Jan 22 03:18:20 1995 > Return-Path: <toad.com!owner-cypherpunks(a)ig1.att.att.com> > Received: from ig1.att.att.com by anchor.ho.att.com (4.1/EMS-1.1.1 SunOS) > id AA28663; Sun, 22 Jan 95 03:18:19 EST > Received: from att!toad.com by ig1.att.att.com id AA09271; Sun, 22 Jan 95 03:20:16 EST > Received: by gw1.att.com; Sun Jan 22 03:19:52 EST 1995 > Received: from toad.com by relay2.UU.NET with SMTP > id QQxzth02499; Sun, 22 Jan 1995 03:16:33 -0500 > Received: by toad.com id AA25129; Sun, 22 Jan 95 00:12:52 PST > Received: from northpole.org (tower.stc.housing.washington.edu) by toad.com id AA24523; Sun, 22 Jan 95 00:10:24 PST > Date: Sun, 22 Jan 95 00:09:36 PST > From: nutty_elf(a)northpole.org > Message-Id: <9501220810.AA24523(a)toad.com> > Subject: hmmm, port 25 > To: cypherpunks(a)toad.com > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > Status: RO > > That's strange, that last port 25 forgery didn't behave as expected. > Just checking it. > > --nutty elf >

1 0

Re: Security of UNIX, NT, etc. (Was: Clinton Freezes...)
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

James Donald writes: > > At present it seems to me that unix machines on the internet > > are intrinsicly insecure -- the methods used to secure them > > are a collection of ad hoc patches. For example all > > unix machines are vulnerable to the trojan > > horse attack. Depends on what trojan horse attack you have in mind. Well-designed B1-secure systems can get rid of most of the Trojan Horse attacks by storing the trusted computing base System Low and requiring root to only execute programs at that level, and running all users at higher classifications, like Unclassified. Since users can't write down, they can't hack the TCB, so the main opportunity for Trojan Horses is to trick trusted programs into interpreting data in dangerous ways (e.g. executable editor macros in email, or exploitation of a much smaller set of bugs than usual.) > > Windows NT is supposedly secure. <ftp://sounds.sdsu.edu/somedir/evillaugh.au> And Perry replies: > NT is about as secure as VMS was, i.e. not at all. Its just got > different bugs. As is any system that was designed for purposes other than security and had security added on. (On VMS: The C2-rated VMS systems came out somewhat before the Worms Against Nuclear Killers takeover of a NASA(?) network; it seems that being rated C2 doesn't prevent you from shipping systems with the factory-equipped SYSTEM and FIELD account passwords left alone.) > > Certainly its design makes it possible to write software that is > > intrinsicly secure, rather than creating a particular fix for each > > particular hole. > > You mean, it makes proof of security possible for real programs? > That there is a proof of security available for the NT kernel? > I'd settle for a proof of non-crashing myself. Short of that I'm > unaware of any system that is "intrinsically" secure. I thought there were systems at at least the B3 level, if not A1; Honeywell SCOMP comes to mind. Of course, all those levels are just Orange Book, and extending genuinely provable multilevel security to the multi-computer networked problem was far beyond current research when I was last current on the stuff. (They could update me, but then they'd have to kill me :-).) There was also KSOS, but I don't remember what level of security it reached. There have been B2-rated networks which let single-level machines share a LAN (Verdix VSLAN), and there's a certain level of security you can get running uucp on B1 systems, but bug-free shared networked general-purpose systems are, uh, not very common. And didn't Boeing have a high-rated fiber LAN of some sort? Actually, before networking, MS-DOS was perfectly secure. After all, there's only one User in the universe, and She is allowed to do anything She wants, however ill-advised.... Bill

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)204.95.228.28 This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)replay.com> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"myriad"} = "<remailer(a)myriad.pc.cc.cmu.edu> cpunk pgp hash latent cut ek"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk hash"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; $remailer{"q"} = "<q(a)c2.org> cpunk pgp hash latent cut ek"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. Use "premail -getkeys remailer.help.all(a)204.95.228.28" as a stopgap to get PGP keys for the remailer, at least until Matt Ghio gets his machine situation straightened out. Fingering this address works too. Last ping: Mon 23 Jan 95 6:00:01 PST remailer email address history latency uptime ----------------------------------------------------------------------- syrinx syrinx(a)c2.org #+ 4:59 99.14% penet anon(a)anon.penet.fi *******+**** 33:13 99.99% rebma remailer(a)rebma.mn.org _..-*.--.- 18:00:23 97.74% rahul homer(a)rahul.net ****#-** *-# 31:58 96.61% bsu-cs nowhere(a)bsu-cs.bsu.edu ***+#-#* *+* 7:18 96.59% ideath remailer(a)ideath.goldenbear.com --+---+- --- 1:57:47 96.59% alumni hal(a)alumni.caltech.edu ++-*#+-- **# 40:31 96.47% extropia remail(a)extropia.wimsey.com ++++++.. +++ 5:46:02 96.10% soda remailer(a)csua.berkeley.edu -..-.._. . 8:44:34 96.08% portal hfinney(a)shell.portal.com ##- ***- **# 20:48 95.82% mix mixmaster(a)nately.ucsd.edu +++++--+ ++ 1:01:24 95.72% nately remailer(a)nately.ucsd.edu ++++++-+ ++ 48:18 95.72% q q(a)c2.org +++--+-- + 1:41:44 95.06% usura usura(a)replay.com - +--+- -** 39:18 93.78% xs4all remailer(a)xs4all.nl - *-+++ -** 27:43 92.93% myriad remailer(a)myriad.pc.cc.cmu.edu *** 4:16 87.80% vox remail(a)vox.xs4all.nl -- - -- 9:08:07 84.62% c2 remail(a)c2.org _ + 26:06:32 75.08% flame tomaz(a)flame.sinet.org _ -+ 9:15:23 34.58% desert remail(a)desert.xs4all.nl .--____ 62:05:22 29.80% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Raph Levien

1 0

Writer Sets Sights on Net
by mpd＠netcom.com 17 Dec '03

17 Dec '03

I noticed the following solicitation mini-spamming its way into a number of newsgroups yesterday. Looks like yet another person plans a lurid expose of online services, BBS systems, and the Net. ------ From: FMGG44A(a)prodigy.com (Jerome Haden) Subject: Writer Seeks On-Line Crime Info REQUEST FOR INFORMATION I am currently writing a book length manuscript entitled : "Crash and Burn: A Parents Guide To The Dangers On The Information SuperHighway." I am seeking real events that are "public record" either newspaper articles or court documents which involve the following criminal activity: 1.) Sexual predators who have commited sex crimes on minors with a connection to a local computer bulletin board or a national on-line service such as Prodigy, Compuserve, or America On Line. 2.) Teenage computer hackers who have been charged with any type of telephone fraud, unauthorized access to another computer, or similar crimes. 3.) Any teenagers involved in making explosives with information obtained from a computer bulletin board. 4.) Any selling of illegal drugs involving minors on a computer bulletin board. 5.) Any other crimes invloving teenagers as either victims or perpetrators with the use of modems or any manner in "cyberspace". Any information must be a public record that can be verified by my literary agency and my publisher. Also would be interested in hearing from victims or perpetrators willing to be interviewed "off the record", and/or willing to appear on national talk shows. If you have any such information please contact me as follows: Jerome Haden E-Mail: FMGG44A(a)prodigy.com -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

NYT on Net Threat
by John Young 17 Dec '03

17 Dec '03

Toad is choking on a try 3 hours ago to send today's Markoff article on the new Net security threat Brian and others noted. Nail-biters can get it by email (if this passes the gory hole). Send blank message with subject: NEW_hak

1 0