December 2003 - cypherpunks-legacy

28M_dip
by John Young 17 Dec '03

17 Dec '03

8-17-95. FPeach: "Russian 'in $2.8m Citibank computer fraud'." Citibank New York fell victim to a $2.8m fraud after a Russian computer hacker penetrated the bank's security system in Wall Street and removed the money from the accounts of corporate clients, it was claimed in a London court yesterday. The alleged fraud was carried out by a 24 year-old mathematics graduate using a computer in his office in St Petersburg, claim the US authorities, which are seeking his extradition from the UK. 8-17-95. NYPaper: "Russian Accused of Citibank Computer Fraud." A judge set another hearing for Sept. 15 after Mr. Levin's lawyer argued that the Government has not shown that any computer in the United States was involved. Stereo: 28M_dip (about 6kb)

1 0

BULK EMAIL LIST GETS RESULTS QUICKLY TRY IT
by OIL.PATCH.MARKETING＠08746.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> Profitable Internet Marketing Using Bulk Email Best Bulk E-Mail Prices on the Internet!!!!!! Bulk Email is the most cost effective form of advertising in the history of the world !!!!!!!!!!!!!!! --------------------------------------------------------------------------- Why is Bulk Email Successful ? - Bulk Email is successful because it works. Advertising in any form is a numbers game. The more people exposed to your message (an impression in advertising terminology), the more sales you will make. Bulk Email gets your message in front of a vast amount of people for a very modest investment. For the price of one black and white ad, appearing one day only, in a daily newspaper in a medium to large city, you can send your Bulk Email message out to 1,000,000 people !!! Most of these large newspapers don't even have a circulation of 1,000,000. Sure not everyone is going to read your Bulk Email message, but not everyone sees your ad in the newspaper either. Bulk Snail Mail (regular junk mail) has been very successful and not everyone reads it. If regular junk mail wasn't profitable, you wouldn't be seeing so much of it. The reality is Bulk Email works and that is why you are seeing it repeatedly. If Bulk Email didn't work you wouldn't see it being used !!!!!!!!!! --------------------------------------------------------------------------- What is the Future of Bulk Email ? My advice is to get out there while you still can and build up your business with Bulk E-mail. --------------------------------------------------------------------------- What is Bulk E-mail ? - Bulk E-mail is the sending out of unsolicited Email Messages. These Bulk E-mail messages can be sent to target list of Email addresses or to just anyone. It is entirely possible to send out several million pieces of Bulk Email in one day. These Bulk E-mail messages can contain information, offers to sell goods or services, or simply promote a web site. --------------------------------------------------------------------------- General Bulk E-Mail Mailing Rates These prices include the creation of the Bulk E-Mail message, the use of the mailing list and the sending out of the Bulk E-mail. Small Starter Size 25,000...............................$99 Try it Sampler Size 100,000..............................$199 Medium Size Run 250,000..............................$299 Large Run 500,000..............................$499 Serious Run 1,000,000..............................$899 Professional 2,000,000. ............................$1500 Business Builder 3,000,000..............................$2200 Mega Market Run 5,000,000..............................$3000 --------------------------------------------------------------------------- Mailing Lists ( Does not include Bulk E-Mailing) 1,000,000 E-mail addresses........................................$99 2,0000,000 E-mail addresses......................................$149 5,000,000 E-mail addresses.......................................$299 10,000.000 E-mail addresses......................................$499 --------------------------------------------------------------------------- We have over 40,000,000 names in hand. This list is updated every few weeks. This gives our customers the NEWEST list available anywhere. We can assure our customers that thier order will be processed A S A P. If there is ever a doubt we send extra names. We may not be the cheapest but we give our customer "TOP QUALITY SERVICE". --------------------------------------------------------------------------- OIL PATCH MARKETING RT 2 BOX 396A JENKS, OK 74037 Call Bill Moore at 918-291-7546 Or fax your order to 918-291-7546 We accept Visa, MasterCard, Discover/Novus, American EXpress If you're not interested in receiving this type of email, DO NOT HIT REPLY. Send a blank e-mail message to <takemeoff(a)answerme.com> </FONT><FONT COLOR="#000000" SIZE=3>

1 0

NIST Release on Key Escrow
by Dave Banisar 17 Dec '03

17 Dec '03

EMBARGOED FOR RELEASE: NIST 95-24 3 p.m. EDT, Thursday, Aug. 17, 1995 Contact: Anne Enright Shepherd COMMERCE'S NIST ANNOUNCES (301) 975-4858 PROCESS FOR DIALOGUE ON KEY ESCROW ISSUES Furthering the Administration's commitment to defining a workable key escrow encryption strategy that would satisfy government and be acceptable to business and private users of cryptography, the Commerce Department's National Institute of Standards and Technology announced today renewed dialogue on key escrow issues. A Sept. 6-7 workshop will convene industry and government officials to discuss key escrow issues, including proposed liberalization of export control procedures for key escrow software products with key lengths up to 64 bits, which would benefit software manufacturers interested in building secure encryption products that can be used both domestically and abroad. Key escrow encryption is part of the Administration's initiative to promote the use of strong techniques to protect the privacy of data and voice transmissions by companies, government agencies and others without compromising the government's ability to carry out lawful wiretaps. In a July 1994 letter to former Rep. Maria Cantwell, Vice President Gore said that the government would work on developing exportable key escrow encryption systems that would allow escrow agents outside the government, not rely on classified algorithms, be implementable in hardware or software, and meet the needs of industry as well as law enforcement and national security. Since that time, discussions with industry have provided valuable guidance to the Administration in the development of this policy. For example, many companies are interested in using a corporate key escrow system to ensure reliable back-up access to encrypted information, and the renewed commitment should foster the development of such services. Consideration of additional implementations of key escrow comes in response to concerns expressed by software industry representatives that the Administration's key escrow policies did not provide for a software implementation of key escrow and in light of the needs of federal agencies for commercial encryption products in hardware and software to protect unclassified information on computer and data networks. Officials also announced a second workshop at which industry is invited to help develop additional Federal Information Processing Standards for key escrow encryption, specifically to include software implementations. This standards activity would provide federal government agencies with wider choices among approved key escrow encryption products using either hardware or software. Federal Information Processing Standards provide guidance to agencies of the federal government in their procurement and use of computer systems and equipment. Industry representatives and others interested in joining this standards-development effort are invited to a key escrow standards exploratory workshop on Sept. 15 in Gaithersburg, Md. This workshop is an outgrowth of last year's meetings in which government and industry officials discussed possible technical approaches to software key escrow encryption. The Escrowed Encryption Standard, a Federal Information Processing Standard for use by federal agencies and available for use by others, specifies use of a Key Escrow chip (once referred to as "Clipper chip") to provide strong encryption protection for sensitive but unclassified voice, fax and modem communications over telephone lines. Currently, this hardware-based standard is the only FIPS-approved key escrow technique. NIST officials anticipate proposing a revision to the Escrowed Encryption Standard to allow it to cover electronic data transmitted over computer networks. Under this revised federal standard, the Capstone chip and other hardware-based key escrow techniques developed for use in protecting such electronic data also will be approved for use by federal agencies. As a non-regulatory agency of the Commerce Department's Technology Administration, NIST promotes U.S. economic growth by working with industry to develop and apply technology, measurements and standards. - 30 - Note to editors: Readers who are interested in obtaining more information about the workshops can contact Arlene Carlton, (301) 975-3240, fax: (301) 948-1784, e-mail: carlton(a)micf.nist.gov.

1 0

Re: Where is the key cracking farming software?
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Fri, 18 Aug 1995 02:11:00 -0400 you wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >With all the talk about cracking SSL, where is the cracking software? >Sombody just offered me a six Pentium workstation, if I agree to give it a >"real workout". I'd like to be able to say: "Sure, will do." There must be several versions of the code at this point. The Cypherpunks release, Damien's release and whoever else wrote some code to do the chore. If someone could pass me a pointer to the version that's best-commented and most understandable (one man's C is another man's crypto) I'd like to port it to Windows NT and write a simple installation to install it as a service. Perhaps a general-purpose OO bruteforcing library (addition to Crypto++?) would be a good idea. Just pass a pointers to the encrypt() and decrypt() functions to use for this session to the Cracker object, which in turn takes a number of bits and starts cracking.:) The problem with this is the disparity among out-of-the-box encrypt and decrypt functions. But I suppose it's nothing that couldn't be overcome with wrapper functions. Just thinking out loud. :) Dan ****************************************************************************** "I think, therefore I am" - Descartes Dan Bailey "I don't think, therefore I'm a moustache." - Sartre dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ******************************************************************************

1 0

Re: NSA leak (fwd)
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Date: Sun, 27 Jul 1997 23:11:22 EST From: Ian Goldberg <iang(a)cs.berkeley.edu> Uh-huh. Unless the Administration has granted a secret Executive Order repealing the Laws of Physics for the NSA, the above statement, if true, would imply one of the following things: [3 violations of physics as we know it] I'm not saying that the posting was legit, but you can apply the same thinking to the breaking of Enigma using 1940 technology. The assumption which might not be valid is that 128 bits of key in RC4 or RC2 (the popular export algorithms) is worth a full 128 bits. - Carl -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: mailcrypt-3.4 iQCVAwUBM9wu3FQXJENzYr45AQEcjQP+N0TJh91ciAoxWmIQdIRRfKJ6XA7UuTk5 bL/3LEJKJ+r3WmbmQGSozMIrMM/Dn6sWCuo3XYOQI+Mrj7VG327lXFi3NnnhyXZe t4yV+zxVZbUqkB9Ms5BhUL7mOFeZ3T2C9jBlUg2gq5D3TxVBn6U9QWe3jnHbA8jr jQ1pgN/nxi4= =zFC5 -----END PGP SIGNATURE-----

1 0

[frissell@panix.com: Re: CoS Raid on "Copyright Terrorist"]
by David Taffs 17 Dec '03

17 Dec '03

--RAV01412.808624601/portland.ebt.com Content-Type: message/rfc822 Return-Path: dat Received: from veronica.EBT.COM (veronica [198.112.112.3]) by portland.ebt.com (8.6.9/8.6.9) with SMTP id MAA01172 for <maryt(a)wv.mentorg.com>; Tue, 15 Aug 1995 12:06:21 -0700 From: David Taffs <dat> Received: by veronica.EBT.COM (5.0/CF5.1L) id AA08383; Tue, 15 Aug 1995 12:04:37 +0800 Date: Tue, 15 Aug 1995 12:04:37 +0800 Message-Id: <9508151904.AA08383(a)veronica.EBT.COM> To: maryt(a)wv.mentorg.com Subject: [frissell(a)panix.com: Re: CoS Raid on "Copyright Terrorist"] content-length: 1249 X-Sender: frissell(a)panix.com X-Mailer: Windows Eudora Version 2.1.1 Mime-Version: 1.0 Date: Tue, 15 Aug 1995 09:18:43 -0400 To: futplex(a)pseudonym.com (Futplex) From: Duncan Frissell <frissell(a)panix.com> Subject: Re: CoS Raid on "Copyright Terrorist" Cc: cypherpunks(a)toad.com Sender: owner-cypherpunks(a)toad.com Precedence: bulk Content-Type: text/plain; charset="us-ascii" Content-Length: 855 At 09:28 AM 8/14/95 -0400, Futplex wrote: >Some CoS news: > >This past Saturday (95/08/12) a prominent Church of Scientology litigator, >Helena Kobrin, and some U.S. federal marshals raided the home of Arnaldo >Lerma, seizing pretty much all his computer hardware, disks, etc. So why is it that people insist on listing their home addresses with their ISP's rather than a mail receiving service or something else. It is very hard to raid a mail drop and obtain anything useful. While it is true that if you blow up buildings, the Fibbies may be able to find you, quite simple techniques can frustrate even quite dedicated private parties. DCF "We warned you mental defectives back in '65 that the socialized medicine offered by Medicare and Medicaid would be expensive, lousy, and eventually not there at all but you didn't believe us. Good luck." --RAV01412.808624601/portland.ebt.com--

1 0

[frissell@panix.com: Re: CoS Raid on "Copyright Terrorist"]
by David Taffs 17 Dec '03

17 Dec '03

--RAK01412.808623897/portland.ebt.com Content-Type: message/rfc822 Return-Path: dat Received: from veronica.EBT.COM (veronica [198.112.112.3]) by portland.ebt.com (8.6.9/8.6.9) with SMTP id RAA13095 for <maryt(a)wv.mentorg.com>; Tue, 15 Aug 1995 17:52:35 -0700 From: David Taffs <dat> Received: by veronica.EBT.COM (5.0/CF5.1L) id AA10092; Tue, 15 Aug 1995 17:50:51 +0800 Date: Tue, 15 Aug 1995 17:50:51 +0800 Message-Id: <9508160050.AA10092(a)veronica.EBT.COM> To: maryt(a)wv.mentorg.com Subject: [frissell(a)panix.com: Re: CoS Raid on "Copyright Terrorist"] content-length: 1370 X-Sender: frissell(a)panix.com X-Mailer: Windows Eudora Version 2.1.1 Mime-Version: 1.0 Date: Tue, 15 Aug 1995 16:00:06 -0400 To: m5(a)dev.tivoli.com (Mike McNally) From: Duncan Frissell <frissell(a)panix.com> Subject: Re: CoS Raid on "Copyright Terrorist" Cc: cypherpunks(a)toad.com Sender: owner-cypherpunks(a)toad.com Precedence: bulk Content-Type: text/plain; charset="us-ascii" Content-Length: 975 At 01:17 PM 8/15/95 CDT, Mike McNally wrote: >Mailboxes Etc. insists on getting a picture ID; at least they did last >time I checked. Some smaller mom&pop places will take a business card >(time to break out your Jim Rockford Business Card Fabrication Kit). I always supply picture ID these days. It's really rough getting those cold lamination-Employee ID kits from Office Depot, taking the polaroid on a blue background, trimming the photo, and assembling the employment ID. I'm one of my best employees. Don't forget to include your EMP_NO. It gives the clerk something to write down. DCF "Governments are simply not fully sovereign in the world of information; their powers within it are strangely limited....This weakness of government control within computer nets--a product of strongly protected privacy, a lack of frontiers and confusions of jurisdiction--make them natural places for subversion." -- The Economist "Softwar--A Survey of Defence Technology" --RAK01412.808623897/portland.ebt.com--

1 0

CPAC, XtatiX, and the Censor-State
by Mike Duvos 17 Dec '03

17 Dec '03

The self-proclaimed "child protectors" are at it again. This time, an ex-police officer with far too much time on his hands has declared war on all so-called "boylover" web sites on the Internet. This includes not only sites where legal issues surrounding youthful sexuality are discussed, but virtually every site in which the word "boy" appears, including photography web sites, young celebrity sites, and any sites such sites link to. We're not talking about porn here, but material which is perfectly legal, the vast majority of which would attract little attention aside from the fact that a bunch of Christian wankers have unilaterally decided for all of us that they do not want it on the Net. They have sworn to harrass each and every ISP carrying material on their "hit list," until the material is removed. Tactics include intimidating snail mail spams and phone calls by people claiming to be associated with law enforcement, as well as late night phone calls threatening bodily harm to ISP management and their families. The rantings of this individual and his similarly minded friends can be found at... http://mavrick-bbs.com/cyranch/sewer2.htm and http://www.thecpac.com/net-safety.html The latest organization to be attacked by Officer Friendly and his contingent of jackbooted thugs is XtatiX.com, a small provider which until recently had hosted a number of web resources which CPAC didn't like. The nature and content of these web sites were clearly discussed with XtatiX before they were chosen to host them, and assurances were given that no problem existed. XtatiX.com states explicitly on their home page, and I quote... "XtatiX supports the concept of an open Internet. Xtatix does not censor accounts or content in any form. We encourage our users to exercise sound and responsible judgement when creating their web pages." "We also understand that some internet sites may have content that some find objectionable. Software products exist which give the individual the ability to limit unwanted material. This software does not interfere with the rights of others to surf as they wish." So one might think that anything legal and resonably tasteful goes at XtatiX, right? Well, that's the way it was until the CPAC contingent hurled a few threats in their direction. In response to the harrassment, XtatiX is now sending a letter to web customers whose pages are, according to XtatiX, "too controversial." XtatiX says in part... "We regret to inform you that we can no longer host your website, due to many local and national pressures on us, to get rid" of sites of the nature of yours, and also a few more sites with other natures that could be considered controversial." "We sincerely apologize, because we _DO NOT_ like censorship, nor do we endorse its use. We have had to practice it of late, though, because of many law enforcement and other officials emailing us, and or calling us in regards to some of the sites we are now hosting." "Again, if it were based soley upon our choice, then we would not change our censorship policies, and would not have to do things such as these, which pain us very much. We would appreciate it very much if you would please copy the files you need to host your site off the server within 48 hours, and delete the copies on the server." "This does not mean that we do not still want you on as an XtatiX customer, but we can no longer deal with as many hate mails, phone calls, and emails from law enforcement officials and users on other systems. Please bear with us." Now XtatiX is certainly welcome to accept or turn away business as they see fit, although it seems somewhat disingenuous of them to loudly advertise their service as one that "does not censor accounts or content in any form," while at the same time, crawling all over themselves to get rid of customers they consider "too controversial," based on harrassment orchestrated by a single pressure group. Now to some Cypherpunk issues this case illustrates... "Information Wants To Be Free" Our working model of information services has always been comprised of three things. First, a dynamic collection of information service providers with complete discretion as to whom they choose to do business with. Second, a Net which regards censorship as damage and routes around it. And third, market forces that ensure that any legal information has a home where others may access it. Providers that censor lose customers, who give their money to providers who don't. The CPAC/XtatiX case study demonstrates another reality. First, a dynamic collection of information service providers in a mad race to see who can come in second to last when the awards for "Enemy of the State" are handed out. Second, a Net in which almost nothing is multi-homed which cannot even regard damage as damage and route around it. And third, market forces which ensure that censorship is frequent, silent, and never publicly spoken of in policy statements. Whether it's CPAC wanting to nuke all web sites containing the word "boy," Sen. Swinestein wanting to nuke all web sites containing the word "bomb," or Sen. Hatch wanting to nuke all web sites containing the word "sex," the optimal strategy for service providers has turned out to be to quietly remove any material some squeeky wheel is uncomfortable with, keep proclaiming themselves to be the strongest supporters of free speech in the entire Net community, and stonewall when asked questions which might suggest anything to the contrary. This behavior of the Net mirrors the behavior of the other so-called "free" market-driven media. There are issues and points of view you will never see discussed on the evening news, or in Time and Newsweek. There are books that disappear from your local library and bookstores and are not replaced. The Net is starting to look a lot more like just another "self-regulated" media outlet, where the individual citizen has access only through a company whose principals are well versed in whose feathers must not be ruffled. The CPAC/XtatiX dance is being repeated each and every day, with providers like Tripod and Geocities, and with search engines quietly removing Horsemen-related articles from their databases, all while proudly displaying their Blue Ribbon Campaign icons for Free Speech on the Net. What's happening now is that a lot of sites are moving offshore, but it probably won't be long before "The Attorney General's List of Horseman-Related Offshore IPs" is dutifully prepared for Congress each year, and Router-Blocked at our borders under threat of criminal penalties. "Information Laundering" will undoubtedly become the Fifth Horseman shortly thereafter. All of this represents a big shoe in the clockwork of Crypto-Anarchy, and a problem needing a technological solution post haste. Suggestions and discussion are welcome. -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

1 0

Re: Netscape security
by harveyrj＠vt.edu 17 Dec '03

17 Dec '03

At 11:08 AM 8/18/95 -0400, Alex Tang wrote: >On Fri Aug 18 10:11:07 1995: you scribbled... >> >> On the subject of Netscape: >> Now that Netscape is making the Commerce Server available >> for free to students, faculty, libraries, etc. (i.e., groups >> with limited ability to cough-up $290 to RSA to get the >> 1-year digitially-signed certificate needed to make it operate >> in "secure mode"), does anyone know of alternative methods for >> producing such certificates? > >are you sure that this is a commerce server? Last I saw, It was only the >Communications server (doesn't have SSL). I could be wrong though. > >...alex... > Yes, I got an email on it this morning. Check-out: http://home.netscape.com/comprod/server_central/index.html. rj ------------------------------------------------------ R. J. Harvey email: harveyrj(a)vt.edu WWW site for job analysis & personality research: http://harvey.psyc.vt.edu/ PGP key at http://harvey.psyc.vt.edu/RJsPGPkey.txt

1 0

Re: Export policy change
by David K. Merriman 17 Dec '03

17 Dec '03

At 10:25 AM 8/18/95 -0500, you wrote: >On Fri, 18 Aug 1995, David K. Merriman wrote: > >> >Ok, let's escrow our keys with Julf :-) >> > >> >Seriously, there might be a market for somebody to become a professional >> >escrow agent.... >> > >> >(tongue partially in cheek) >> > >> >> I will cheerfully escrow keys for 1$ ecash/key. Please be advised, however, >> that key storage will be on an old 40M RLL drive on an 8088 machine, so >> retrieval may be a bit slow and unreliable....... > > >Same here -- I have an original Compaq "Sewing Machine" Portable with >a 40MB hard card. Of course the HD sticks and needs a good whacking >sometimes, and the last floppy came out of the drive smoking and >covered in grease. (You DO have a 5 1/4" 360K floppy don't you?) Yeah - it's my 'good' fdd. The other one is a 180K :-) Dave This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

Re: SSL challenge -- broken !
by Pierre Uszynski 17 Dec '03

17 Dec '03

Jordan (jordan(a)Heuristicrat.COM) attempts to correct me ;-) > > From pierre(a)shell.portal.com Thu Aug 17 18:29:41 1995 > > > > Unfortunately, in this case, insecure credit cards are not an > > obstacle to banks making money, so why should they care? > > [...] if you think that the major card issuers "don't care" about > cutting (or eliminating) fraud, you're not talking to the right > people. Fraud eats away a big chunk of revenue [...] Creative quoting aside, the point of my post, if it needs further clarification, was that the cost of fraud is not only a burden to the banks as some people seem to think. It is not even only transmitted back to the customers in the form of higher fees and interest rates. Card issuers can, do, and should as long as they can get away with it, rely on methods against fraud that are less costly to them. That's because they answer to their bottom line, to their share holders. There are disincentives to fraud in the form of legal penalties and threat of same, even the impression that credit cards are insecure may help by limiting what (some) people dare to do with them. The costs of these methods of fighting fraud is carried in part even by us who don't even usually use credit cards! The highest the penalties and cost of enforcement, the lowest the direct burden on banks, but that does not necessarily mean that our (user's) bottom line will improve. For citizens and tax payers who are not significant share holders, it's not enough to ask the card issuers what the cost of card insecurity is to them. "Our cost is higher." By making some credit card fraud illegal, enforcing, etc... we actually allow card issuers to use less secure mechanisms and procedures (although I'll agree this does not apply to the 40 bit key nonsense, that's one case where banks and businesses would be happy to use longer keys.) (the equivalent mis-quote about politicians applies here :-) Pierre. pierre(a)shell.portal.com (And I will not contribute further to this side thread.)

1 0

Re: Where is the key cracking farming software?
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Dan Bailey <dan(a)milliways.org> writes on cpunks: > There must be several versions of the code at this point. The > Cypherpunks release, Damien's release and whoever else wrote some code > to do the chore. If someone could pass me a pointer to the version > that's best-commented and most understandable (one man's C is another > man's crypto) I'd like to port it to Windows NT and write a simple > installation to install it as a service. Yep there's lots of versions of the brutessl software, ones I know of (in no particular order): - Damien Doligez wrote one - Andrew Roos wrote on (this is the one we're using for the challenge) - Eric Young wrote one - I wrote one More related softwares, specifications etc. - Piete Brookes, Andy Brown, and I wrote a protocol specification for a SMTP style key doler - SKSP (Simple Key Search Protocol) - draft RFC like document on brute (www url below). - Piete wrote a unix socket based key server and client for generic unix machines (in perl). - Andy Brown wrote a Windows NT client which talks the same protocol - David Byers did a MasPar port of the brutessl code > Perhaps a general-purpose OO bruteforcing library (addition to > Crypto++?) would be a good idea. Just pass a pointers to the > encrypt() and decrypt() functions to use for this session to the > Cracker object, which in turn takes a number of bits and starts > cracking.:) The socket based key distributer allows you to write clients which interact with the key server. Take a look at Andy's code. > The problem with this is the disparity among out-of-the-box encrypt > and decrypt functions. But I suppose it's nothing that couldn't be > overcome with wrapper functions. Just thinking out loud. :) Not sure how Andy addresses this in the NT code (I don't have NT), but for the unix client you'd just get another brute force program, compile it and update the client. Piete has a WWW URL for the software (the protocol spec is there too) at: http://www.brute.cl.cam.ac.uk/brute/ (Brute is a subsubdomain he set up for the purpose). Also this: ftp://ftp.brute.cl.cam.ac.uk/pub/brute/ should work. And the socket server runs on: sksp.brute.cl.cam.ac.uk (port 19957). I think we're ready to start another challenge, this one a collaborative project like the brute rc4 one. Just need some challenges now (asked Hal about this). Adam

4 3

NSA leak magic
by Zooko Journeyman 17 Dec '03

17 Dec '03

A million monkeys operating under the pseudonym "Ian Goldberg" typed: > Uh-huh. Unless the Administration has granted a secret Executive Order > repealing the Laws of Physics for the NSA, the above statement, if true, > would imply one of the following things: > > 1. <snip> > 2. <snip> > 3. <snip> 4. It takes 33 minutes to view the satellite images, wiretaps, and TEMPEST recordings, and bribe, threaten, cajole or torture the subject's friends and business partners, and run the "stupid passphrase/weak random seed" cracker. I believe it. Z who is still trying to grok how the girl scouts figure in. "You're a thought criminal!"

1 0

SSL challenge and escrows
by fc＠all.net 17 Dec '03

17 Dec '03

I think a lot of people miss the distinction between automated message cracking and dumpster diving. Dumpster diving is not free. It costs at least a dollar each to get credit card slips by dumpster diving. Consider that in order to use the information, you have to get the slip, pull off the numbers, enter them into a computer (or even worse yet, create a phoney card or make a phone call) in order to use the information. The break-even point for an automated cracking and usage system is more than a dollar per stolen card. My parallel processor is actually more cost effective for crimilar theft via credit card fraud. What does this have to do with escrow? My escrow offer costs less than the cost of crimial attack. If it reduces attack, it is cost effective and should lower the overall cost of transaction processing. In fact, I have a friend who says he will escrow keys for free, but he is less trustworhty than I am, and I think he wants to get his dollar on the other side. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

2 1

Perot and Scrap Cycles
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:31 AM 8/19/95, Michael Froomkin wrote: >Didn't Ross Perot make his fortune by running data processing tasks nights >and weekends on machines he leased to other people (all legal)? I hadn't heard this. And until I hear more details, I'm skeptical. (Trivia sidenote: I was in high school in 1970 and met Ross Perot at a shindig in Dallas--his wife picked me up at the airport and drove me to the hotel. He had just that spring lost a billion dollars in a single day, due to a glitch in EDS stock. A billion dollars in 1970 was a lot of money.) Now in 1970 EDS was indeed leasing lots of IBM mainframes to customers, and running them. Also, doing processing jobs. But how many IBM mainframes were idle at night? Not many. This was the day of multimillion dollar mainframes and programmers making $10,000 a year to keep them busy at all times. So, I doubt the machines were idle in the same way our workstations and PCs are largely idle (obviously, machines now cost less $2000-6000, and programmers make 10-20 times that...the tables have turned). I don't discount the possibilty that EDS made a deal on the lease rates. I haven't read up on EDS in this era. I just know that Perot wasn't using "scrap cycles" (to use Doug Barnes' term), because there probably weren't many of them. But I'd like to hear the details. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

House Committee Hearing on Money Laundering
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: jmuller(a)brobeck.com (John D. Muller) Mime-Version: 1.0 Precedence: Bulk Date: Sun, 27 Jul 1997 20:32:04 -0700 From: jmuller(a)brobeck.com (John D. Muller) To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: House Committee Hearing on Money Laundering For those with a strong stomach for testimony on the need to strenghten money laundering laws and extend know-your-customer requirements to non-banks, material from last week's hearings on money laundering and the drug trade by the House Judiciary Committee's Subcommittee on Crime are now on-line at http://www.house.gov/judiciary/364.htm John Muller jmuller(a)brobeck.com ---------- The e$ lists are brought to you by: Intertrader Ltd: "Digital Money Online" <http://www.intertrader.com/library/DigitalMoneyOnline> Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! <http://www.shipwright.com/beg.html> For e$/e$pam sponsorship, mail Bob: <mailto:rah@shipwright.com> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: Netscape security
by Rich Salz 17 Dec '03

17 Dec '03

> There is no word as to how to become a KSA. Netscpe has >ignored the question on several occaisons. I'm fairly sure that I remember Taher saying at the W3C security meeting that they intend to do this, and that hardcoding the CA's into the library was as quick hack. I also have the impression that they don't know how to do it, but my recollection is fuzzier there. /r$

1 0

PGP encryption for HTML forms
by Dorab Patel 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've developed a simple protocol for encrypting the submission of HTML forms using PGP. I've written up the protocol in an "Internet Draft". We are distributing two reference implementations (with sources --- copyrighted, but freely redistributable). One is a modification to lynx sources to handle this protocol natively. The other is a "helper application" (by Jun Hamano) to do the encryption written in python. You can get the package via anon ftp. ftp://ftp.cs.ucla.edu/pub/sitp.tar.gz Comments welcome. Snarf it before it becomes illegal! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.2, an Emacs/PGP interface iQCVAwUBMDTTYGnoQvE1ROndAQE5dQP/SWII7eR/eFYWsdU6mOilLZautmtS1rb9 kRcifS02p7WS3N3sY+MRu20uuPmuL+f+5rriYWJWVgd//s3jgegs8HGqmRuxVQdL qMFRmtMB5oUfYkLmTiDebHsksr2YLF+AB8vrBCgXIbgKAcSRF4OStRyXBUeXfZ/3 gp9MiACvXV4= =PxCp -----END PGP SIGNATURE-----

1 0

DCSB: Duncan Frissell and MarketEarth
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: rah(a)mail.shipwright.com Mime-Version: 1.0 Date: Mon, 28 Jul 1997 07:36:46 -0400 To: dcsb(a)ai.mit.edu, dcsb-announce(a)ai.mit.edu From: Robert Hettinga <rah(a)shipwright.com> Subject: DCSB: Duncan Frissell and MarketEarth Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Robert Hettinga <rah(a)shipwright.com> -----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston Presents Mr. Duncan Frissell, Frissell Associates "Markets Rule! OK Bet on MarketEarth -- Bet Against Bureaucracy" Tuesday, August 5, 1997 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Mr. Frissell, the Net's most enthusiastic Technoptimist will answer such questions as: Why did Central Planning, Deutsche Telecom, and X.25 lose and the Market, telecoms competition, and TCP/IP win? Can banks compete with nonbanks? Why controlling the Nets is as hard as controlling the thoughts of other people. Why popular measures like immigration control are doomed. What do such phenomenon as the Jewish Holiday Effect, the Sack Full of Cats in the River Effect, the Canadian Air Service Effect, the Saturday Morning Shopping Trip Effect, and the Taiwanese Privatization Effect tell us about the future of government and the individual? Why things are not the same and never will be again? Why the Market is "X-The Unknown," "The Blob," -- and why even Steve McQueen couldn't save us from it? "Duncan Frissell makes Kevin Kelly sound like Jimmy Carter." -- Anonymous Mr. Frissell, an Attorney, privacy consultant, and author, has worked in what he insists on calling the "Right Wing Nut Investment Community" for more than 20 years. This meeting of the Digital Commerce Society of Boston will be held on Tuesday, August 5, 1997, from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, on One Federal Street. The price for lunch is $30.00. This price includes lunch, room rental, various A/V hardware, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men (and no sneakers or jeans), and "appropriate business attire" (whatever that means), for women. Fair warning: since we purchase these luncheons in advance, we will be unable to refund the price of your lunch if the Club finds you in violation of the dress code. We will attempt to record this meeting and put it on the web in RealAudio format at some future date We need to receive a company check, or money order, (or, if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, August 2, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston", in the amount of $30.00. If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Upcoming speakers for DCSB are: September Christof Paar Elliptic Curve Cryptography October Peter Cassidy Military Fiat and Digital Commerce November Carl Ellison Identity and Certification for Electronic Commerce We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, <mailto: rah(a)shipwright.com> . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . We look forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQEVAwUBM9yEOcUCGwxmWcHhAQHq2ggAr93eyPf+gg23sANSwkHQpzDCHUZl9UaI rXjmSA1EkDTWSEWxy90BlWexUdHa4a+rKtYU3DNpMSB5WPAzq0Et3rnqCHEkYh3D NM9cOCSkP7HOP07yISh3yFhyisqIDQR5fK3f3NBjGfDjzT8QDkaGWEOAh4O7nzuL kKdm6diPBMUePtHxGzUbqtWP239vpY3kfhu2CbdP766NxsMD2Hsq4bLaAnUk2NPy NkzS3Vv9+opl01IbJQ05MWm4E23ATSsjVJGvFnO6l0HOQ7W6NMqDKFHxS/i9WLmz vQS2sKrNHqnr7Z8eXEXk8HdmzCim7b+P0BhvEGyrbPW0xD9d+dExtg== =gSKM -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb-announce Or, to subscribe, write: subscribe dcsb-announce If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: Netscape security
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>Now, I can see calling a MasPar a "parallel supercomputer"; another effort >at the SSL challenge got the answer about 2 hours before Damien's did, >and used about 4 days of spare time on the MasPar. Last time I looked, >a MasPar was selling for about $150K, though I don't know how big the one >used on SSL was. At that price, you could have your own for ~$500/day, >and ripping off $2000 on a credit card isn't tough in today's automated world. >Next year - computer time costs half as much. Well, lets put it this way, an MP-2 with 16K processors could attack a 56 bit key about as fast as a 486 could attack a 40 bit key. The next generation MP will be less than an order of magnitude faster, although able to use more processors. An MP2 with 1K processors can do 220K crypt(3)/sec. Now, if it weren't so darned hard to program one for performance... One tends to wonder if there are analytical methods to reduce the search space.

2 1

Re: Article in Time Magazine
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>In the Time Magazine of this week there is an article about a new way >to make war. Instead of sending bombs, tanks, and soldiers, the >enemies computers and communication networks are attacked by sending >viruses and worms and by using backdoors to sabotage the infra structure. I've been getting flyers from the Armed Forces Communications Electronics Association (AFCEA) for a symposium on information warfare this fall. Parts are classified SECRET NOFORN. (SIGNAL magazine is a good source for basic articles, its the latest rage in the War Colleges)

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord ?"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"cracker"} = "<remailer(a)anon.efga.org> cpunk mix remix pgp hash esub latent cut ek reord"; $remailer{'redneck'} = '<config(a)anon.efga.org> newnym pgp'; $remailer{"bureau42"} = "<remailer(a)bureau42.ml.org> cpunk mix pgp hash latent cut ek"; $remailer{"neva"} = "<remailer(a)neva.org> cpunk pgp pgponly hash cut ksub ?"; $remailer{"lcs"} = "<mix(a)anon.lcs.mit.edu> mix"; $remailer{"medusa"} = "<medusa(a)weasel.owl.de> mix middle" $remailer{"McCain"} = "<mccain(a)notatla.demon.co.uk> mix middle"; $remailer{"valdeez"} = "<valdeez(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"arrid"} = "<arrid(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"hera"} = "<goddesshera(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"htuttle"} = "<h_tuttle(a)rigel.cyberpass.net> cpunk pgp hash latent cut post ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix reno winsock) (weasel squirrel medusa) (cracker redneck) (nym lcs) (valdeez arrid hera) The remailer list here has been out of date for some time, but should be up to date now. I'm still working on updating the web page. Last update: Mon 28 Jul 97 6:49:34 PDT remailer email address history latency uptime ----------------------------------------------------------------------- redneck config(a)anon.efga.org #*-**#*##-+ 23:42 99.99% nym config(a)nym.alias.net ######**-+## 1:09:39 99.97% htuttle h_tuttle(a)rigel.cyberpass.net #*### :42 99.96% cracker remailer(a)anon.efga.org *+ -++++++-+ 39:07 99.92% hera goddesshera(a)juno.com +----------- 4:13:46 99.92% weasel config(a)weasel.owl.de +-++++++++- 1:31:07 99.87% squirrel mix(a)squirrel.owl.de +-+++++-++- 1:30:29 99.86% arrid arrid(a)juno.com +--- *+*+++* 49:18 99.84% winsock winsock(a)rigel.cyberpass.net .-+-------+ 4:57:25 99.65% cyber alias(a)alias.cyberpass.net ***+****-++ 20:17 99.56% mix mixmaster(a)remail.obscura.com ** -* -*-++ 2:32:46 99.10% reno middleman(a)cyberpass.net .-+ + +*++ 1:57:53 97.61% replay remailer(a)replay.com * ** * 32:46 96.23% neva remailer(a)neva.org #-* + +** 39:46 93.10% jam remailer(a)cypherpunks.ca * +** 50:05 90.34% valdeez valdeez(a)juno.com *.-- +---- 4:14:27 89.14% bureau42 remailer(a)bureau42.ml.org *----- 3:34:59 28.56% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Certificates/Anonymity/Policy/True Names
by Michael Froomkin 17 Dec '03

17 Dec '03

I have a question which is of course purely hypothetical. Suppose you were designing the legal framework that would govern the operation of Certification Authorities (the people who issue certificates vouching for public keys used for digitial signatures), called CAs for short. The CAs will operate in a hierarchical model (not a PGP-web-of-trust model), with a state agency being at the root, and issuing certificates for private CAs. You have decided to allow the private CAs to issue certificates of varying degrees of corroberation so long as the degree of verification used is deducible from the certificate. E.g. a certificate might say "we check the passport"; or "we check driver's license" or "we took blood, hair, fingprint, retinal scan and first-born child". It might even say "we checked nothing". You have also decided that a CA may issue a certificate in the name of a pseudonym, so long as the CA retains information about the True Name. Now the issue arises as to whether one should allow the CA to issue certificates to pseudonyms where it has *no record* of the real identity of the person proffering the key pair. Is there any reason why a person would want such a certificate? In other words, given that the recipient of a digital signature will easily be able to check the value of the certificate (nil), won't the transaction/communication be in all ways identical to one where there was no certificate at all. So is anything of value lost by prohibiting such a certificate? I understand, of course, that in a world where the CA has no duty to check the client's representations, there is a somewhat farcical element to this debate, but this hypothetical problem involves group decision making and groups find themselves debating irrational things. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | mfroomki(a)umiami.ir.miami.edu U. Miami School of Law | P.O. Box 248087 | It's hot here. And humid. Coral Gables, FL 33124 USA | See http://www-swiss.ai.mit.edu/6095/articles/froomkin-metaphor/text.html and http://www.law.cornell.edu/jol/froomkin.htm

2 2

Complete Bulk Email Pkg only $49.95
by emailblaster＠mail-response.com 17 Dec '03

17 Dec '03

*Special Promotion* Complete Bulk Email Package only $49.95 including Unlimited Email Addresses (25 Million and Growing!!!). Our company is running this special promotion to allow you try out our software at an affordable price. We know that if you enjoy using this package that you will be our future customers. Our program ranks up with all the other bulk email software such as Floodgate, Email Magnet, Netcontact, Extractor Pro. etc at hundreds of dollars less!!! Why pay $399 just for a bulk email software, when you can pay $49.95 including email addresses??? HOW DOES E-MAIL BLASTER WORK? E-Mail Blaster has dozens of special filters to automatically harvest E-mail addresses from major online services such as: America OnLine, Compuserve,Delphi, Genie, and of course the internet and will email your marketing letter to 13k consumers per hour at the single push of a button!!! SPECIAL CLOAKING DEVICE: Email Blaster can successfully hide the origin of all email being sent out. Email Blaster can mask itself to look like it came from the recipients own host. This will help stop users from flaming your email box! FRIENDLY BULK EMAIL PROVIDER: Now you can have your account 100% Bullet Proof by taking advantage of our Bulk Email Provider Service for only $99 per month. This will also include your own website, 3 autoresponders, and your own domain name. SIMPLE TO USE: E-Mail Blaster does all the work for you and, unlike other E-mail programs, with E-Mail Blaster there is no need to purchase any additional software. NO SPECIAL EQUIPMENT NEEDED: E-Mail Blastert runs on a PC with Windows 3.xx Windows 95, Windows NT, a 386 or faster processor, 4 MB RAM, and a hard drive with at least 10 MB free and your own SLIP or PPP connetion. No other software needed. Also runs on a Macintosh with SoftWindows installed Plus.... Turn $99 into $995 Cash Instantly distributing "Email Blaster. This is the #1 business opportunity on the net! You become a distributor of Email Blaster for only $99 and you receive 5 Complete Email Blaster packages. Let's say you resell Email Blaster package at a discount of $199 each. $199 x 5 packages = $995 CASH!!! Your potential is unlimited! This price is a Special Promotion and is only available to new distributors!!! Our distributor package normally sells for $199. Take advantage of these low prices for the month of July now and reserve as many copies as you want. he more you buy the more $$$ you can make!!! Price List 5 Packages: $99 10 Packages: $149 20 Packages $299. Larger quantity discounts are available upon request. Benefits of becoming a Distributor Now: 50% Discount for the month of July No Shipping (You simply refer all your customers to our website to download their package.) No postage No inventory (We keep track of how many packages you have and how many you sold electronically.) No hassles (We have full tech support that will assist your customers for you! This is invaluable!!!) No need to worry about payment methods ( We can assist you in obtaining a method of being able to accept major credits and 900# service for billing. No credit checks or approval necessary!!!) Plus.... You will be able to distribute all future software programs and receive the best prices!!! Additional questions (No problem, call our office at: 609-933-3527 What are you waiting for start making money today SIGN UP NOW!!! ********************************************************************************************************** To take advantage of this opportunity, please fill out the order form below and fax or mail to: Internet Marketing P.O. Box 276 Bellmawr, NJ 08099 Phone: 609-933-3527 Fax: 609-933-1499 Don't miss out on this opportunity! Special Promotion!!! Name: _____________________________________________________ Address:____________________________________________________ City:___________________________________________ State:___________________________ Zip:_____________________________ Telephone::_____________________________________________ E-Mail Address:__________________________________________ Once we receive your order, you will receive a confirmation by email, informing you of our tech support number , website address so you may go and download your packages immediately and info on our Bulk Email Provider Service. No need to ever wait for a package in the mail!!! ---------------------------------------------------------------------------------------------------------------------------------- "COMPLETE EMAIL BLASTER PACKAGE" only $49.95 ________ 1 Copy of Email Blaster 1 Electronic Help System: Email Blaster Help System will provide you with step by step directions on how to use Email Blaster and help with setting up your provider. For your convience this is built right into your copy of Email Blaster. Unlimited Email Addresses: 25 Million And Growing Our Email Addresses are updated monthly. You can download these addresses right from our website at your convenience. ----------------------------------------------------------------------------------------------------------------------------------------- 5 DISTRIBUTOR PACKAGE only $99: _________ This is a Special Promotion to new distributors only!!! 5 Copies of Email Blaster 5 Electronic Help System:Email Blaster Help System will provide you with step by step directions on how to use Email Blaster and help with setting up your provider. For your convience this is built right into your copy of Email Blaster. 5 Unlimited Email Addresses: 25 Million And Growing Our Email Addresses are updated monthly. You can download these addresses right from our website at your convenience. Now you can take advantage of Email Blaster Package and resell each package up to $299. each. You make $1495 10 DISTRIBUTOR PACK only $149. _______ Includes 10 Complete Packages of Email Blaster. You can make up to $2990.00 20 DISTRIBUTOR PACK: ONLY $299 ________ Includes 20 Complete Packages of Email Blaster. You can make up to $5980.00 ************************************************************************************************* If you would like to pay by check, please make check payable to: Internet Marketing mail to: PO Box 276 Bellmawr, NJ 08099 or Fax to 1-609-933-1499 along with this order form. If you are paying with a Fax Check please include an additional $3.00 for check processing fees. Credit Card: _______________________________________________ Visa, Master Card and AMEX. EXP. Date: _____________________ Total to be charged: $________________________ Signature:___________________________________________________________ 3024

1 0

Re: SSL challenge -- broken !
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

David Neal wrote: >On 18 Aug 1995, Panzer Boy wrote: >> John Pettitt (jpp(a)software.net) wrote: >> : Huh? So you run on 120 workstations worth how much? to steal a credit >> : card number worth how much? Get real - there are hundreds of ways >> : to get credit card numbers that cost less. >> >> Has anyone thought about starting up a distributed rc4 cracking web. >> Send in your message to a web server form, it will then spawn of requests >> to a pool of machines willing to try cracking rc4 for you. Allow anyone >> to offer up spare cycles towards the effort. >> > >I suggested that very thing just yesterday in the list, but my message >seems to have gone awry. In short, I suggested we use E-Cash payments >for cracking efforts. This would establish a reward for participating >and an 'exchange rate' for e-cash at the same time. I'd we willing to set up a "crackweb" mailing list, or perhaps a site to register your machine(s) with % available and MIPS ratings. DJK

1 0