December 2003 - cypherpunks-legacy

Cybercash questions...
by David Klur 17 Dec '03

17 Dec '03

Hello, Just a few questions about Cybercash... - How is the consumer's credit card # stored on his hard drive? Encrypted with the bank's public key? Or does the consumer have a private key? - How does the merchant know where to ship the goods? Is the merchant required to ship the goods to the billing address on the cardholder's credit card account? If so, does the bank provide the merchant with this info? How is it encrypted? Or does the customer indicate to the merchant where to ship the goods? Also, what infor does the merhcant send to Cybercash, and how is it encrypted? The fraud possibility I see is that Bob could steal Alice's encrypted credit card number (by sniffing when she buys something at Charlie's Internet shop). Then, without decrypting it, he could use it (still encrypted) at Don's Internet shop, and ask Don to ship the goods to Bob's address. Since Don will not decrypt Alice's card number he will not know that it is not Bob's card. Cybercash will validate Alice's card, but will not know that it is really Bob who is the customer. Don will ship the goods to Bob, and Alice will get a fraudulent charge on her bill. Am I missing something?

2 1

Re: taking electronic privacy into our own hands
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 15 Dec 1995, Eric Anderson wrote: > Would it be possible to write a program ( i.e. a worm or > Trojan) to ferret out personal information that is stored in databases > and encrypt it? > > I was just wondering what such an undertaking would entail. Actually, there is no need to write any such code. AT&T distributes just such a beast to any and all comers. It can take personal information and send it out over a secure socket layer. I think a couple of partners in crime, Cheswick and Bellovin of AT&T research had a hand in its continuing distribution. > Eric Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: Navy hacked by Air Force?
by vin＠shore.net 17 Dec '03

17 Dec '03

This might be relevant. This is a page from the NCCOSC web site <http://www.nosc.mil> The Naval Command, Control & Ocean Surveillance Center (NCCOSC) is the U.S. Navy's warfare center for command, control and communication systems and ocean surveillance and the integration of those systems which overarch multiplatforms. NCCOSC is based in San Diego, CA. NCCOSC Command Internet (NCI) is part of NCCOSC, of course -- and NCCOsc is part of SpaWar (Space and Naval Warfare Systems Command.) Clear? Note that NCCOSC recently decided to beef up NCI's user authentication. See "Current Initiatives." ================= [* ] NCI net - What it is * An enterprise network serving NCCOSC and other communities of interest * Modelled after the global Internet, logically part of the Internet * Communications nodes at each NCCOSC site, linked by T-1 lines * Nodes consist of... o Cisco router linking T-1 lines and local LANs o Annex terminal server and modem bank for dialup, SLIP, and PPP access o Sun servers providing general Internet services (email, name service, ftp server, world wide web, multicast routing, etc.) o NeXT server supporting corporate office functions * Provides ubiquitous high-speed low-delay TCP/IP connectivity throughout the organization and to the Internet * Provides dialup access from home or TDY via 1-800 number, including SLIP and PPP support [* ] [ ] Network Topology [* ] Recent activities and milestones * MIME adopted as corporate email standard, email systems upgraded o Many user agents upgraded to MIME compliance o Testing gateways for interoperability with non-compliant systems o Performing extensive interoperability tests * New sites connected o CINCLANTFLT, Norfolk, VA o The Pentagon + BRAC Office + OSS LAN + DASN/C3I o FTSCLANT (Portsmouth, VA) and NAVSEACENPAC (San Diego, CA) o Armed Forces Staff College, Norfolk, VA o USACOM site in Suffolk, VA + Joint Training, Analysis, and Simulation Center (JTASC) + NISE East Contingent at USACOM o NISE West Guam o NISE West Yokosuka Japan * Network accredited o Completed Security Test and Evaluation o Completed Risk Assessment o Published Contingency Plan and Configuration Management Plan * Network now under full configuration management * New Web server installed o "neelix", a Sun SparcServer 1000, installed outside firewall o "www.nosc.mil" now points at neelix o "Planet Earth" now served by neelix o Recent updates + 1 additional Sparc processor (completed 6/9/95) + 4 Gb more disk (completed 6/2/95) + another 64 Mbytes of memory (giving total of 96 Mbytes) (completed 6/2/95) + conversion to "Apache" http server (faster) (completed 6/1/95) [* ] Current Initiatives * Enhancing Infrastructure to provide ISDN dialup service * Implementing one-time-passwords using SecurID cards * Implementing Kerberos based authentication for additional security * Connecting additional sites o NISMC o USACOM at CINCLANT compound, Norfolk, VA o Pearl Harbor Naval Shipyard, Pearl Harbor, HI o Federal Internet Exchange (FIX) East, College Park, MD o New NISE East Detachment at Naval Weapons Station, Yorktown, VA o ONI at NMIC * Upgrading D.C. area connectivity to Metropolitan Fiber service at 10 Mbps * Getting sites 100% connected (TCP/IP to every desktop) * Developing MIME to X.400 gateway for connectivity to DMS world [* ] References * Dialup Quick Guide * Monthly Reports * June 28 Internet Security Briefing (postscript) Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

Re: AWARD: CHRISTMAS NET SCROOGE - AT&T & NETSCAPE??
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Just in case, anyone missed this yesterday, I thought I'd renominate AT&T & Netscape for the: *** 1995 CHRISTMAS NET SCROOGE *** *** AWARD *** (T-shirt sales coming soon, to a website near you ...) ------------ Alice here ... Back on Tue, 19 Dec 1995, I wrote: >>>Can anyone tell me whether Ian Goldberg and David Wagner got their >>>$25,000 from Netscape for finding the HUGE security flaws in Netscape's >>>existing product line?? >>> >> >I can't remember whether they got anything or not ... >> >> That would be no (well, except for the nifty T-shirt from Sameer; Thanks!). > > Not anything?? That's shameful ... where on earth are the values in > America, today? Everyone should ask this question. AT&T can sign-on to a two-page ad, calling on Congress to balance the budget -- to cut off veterans, and cut-off women with dependent children just before Christmas. It can sign on to this, but it can't bother to even offer a scholarship to the students who helped make its fortunes. It would rather leave the impression that it freeloads off of other's efforts. It's shameful. > AT&T and Netscape have jointly made a small fortune distributing this > product, and yet NEITHER company feels that the software engineers who > "voluntarily" made a difference -- a couple of students -- deserve > even a wooden nickel for the ideas which were used. > > It's absolutely shameful. But then, I guess that AT&T and Netscape > have no shame at all. > > They just steal "intellectual property" from students, and don't even > pay a token amount. > > And people wonder what's wrong with America? Luckily for those of us who don't live in the United States, we can perhaps look at that country and truly wonder what is going on over there, and what is wrong with America? Where are the values amongst ALL Americans, not just Netscape and AT&T? What are the role models that all the leaders -- business, sports, and political leaders -- show to the national youth. Here is all I've seen (as a foreigner), over the last while: Enid Greene Waldholtz blubbering in a news conference about how she as a congress person certainly COULDN'T be expected to resign after winning her election with stolen money. Blubbering for five hours straight (except when she had to stop to turn a page, I mean) ... She certainly said that "leadership" is all about playing "victim". Poor little Enid. (And even worse, she was _defended_ by Susan Molinari.) Bob Dole, deciding to go to Bosnia. The former WW II veteran willingly jeopardizing the lives of American boys -- boys who have put their lives on the line in a _volunteer_ armed force -- all for a lousy political photo-op. The chance to say ... "hey look at me, I'm here in Bosnia." Someone who's willing to overrule the Pentagon's own most diplomatic advice on how complex an operation this actually is. And then there is AT&T. A company who's Chairman can publish a letter which calls on Congress to cut off checks to mothers with dependent children and war veterans days before Christmas, all while stealing and freeloading off of the work of some students. Scrooge ... take heart. Here's Holiday wish #1. Enid do the right thing ... resign. Say the "right thing" and say that your child -- the future and the delayed gratification that the future brings -- is much more important than your own personal PRESENT political aspirations. Here's Holiday wish #2. Bob, lots of people worked their asses off to make sure that the American fighter pilot, and the two French fighter pilots could be rescued from Bosnia. If you want to go and get some photo-ops, go to Germany or Italy, and give one hell of a vote of support to the boys that are there -- a support which could just as easily have been given and should be given in Congress. A _real_ strong unfettered commitment. And here's Holiday wish #3. AT&T. Do the right thing. Reward those people who help make you a fortune. Stand tall as an example, rather than as an embarrassment to the nation. You've ignored this for so long now, that you've almost dug your own grave. But you still have a chance to save face. Have the courage to take the chance when it's offered. Simply say that the proposal to reward David Wagner and Ian Goldberg -- some holiday mad money and scholarships -- was lost in committee, and approval processes -- but it WAS in the works, and it was recommended and can now be announced just before Christmas, as a rightful reward. Some holiday cheer. Will people think it's a cynical attempt at manipulation? Yep. But it's a darned site better than the alternatives -- especially when you look at possible future outcomes. Trust me, this is far better than calling for veterans and single mothers with children to be cut-off just before the holidays. Perhaps, Enid, Bob, and AT&T will all learn when to use offense and when to use defense. They might also learn that the best offense is a good defense. They might even begin to look at what "courage" truly is, and of how difficult it can be for anyone to do the "right thing", especially when they think that they're surrounded by minefields. Even when the "right thing" is in your own best interest, you not only have to be shown the right path to take, but you have to have the motivation and courage to make the move and take action. Enid, Bob, and AT&T, take note. Hopefully for the holidays, everyone finds the courage to neutralize some portion of the vulnerability spectrum they've placed themselves in. > > - Ian "There's a reason people talk about `starving grad students'..." > > Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

3 2

Re: 900mhz digital phones
by Weld Pond 17 Dec '03

17 Dec '03

floyddb(a)alpha.c2.org: > There is a company called Optoelectronics that markets a > radio reciever > called the Interceptor. This is a broad band (several > hundred MHz) device designed to lock on to the most > powerful signal around, regardless of frequency. As > supplied, it only has a rubber duck antenna, but a > broadband, directional antenna (Log Periodic?) could be > attached. There are AM and FM versions that output audio > and a version called the Scout that controls a scanner. > These could have outboard devices hung on to them to decode > digital signals, record the conversation ... all for less > than $1000 I don't think that the Interceptor is going to be much use with spread spectrum reception. Unless you are really, really close to your target other non-ss signals are going to be much stronger. The freq range of the device is 30MHz-2GHz. It is also legal to sell even though it is great at picking up the cellular phone conversations in the car you are tailing. There is also the plausible deniability in a device like this because you don't know what frequency you are listening to so you don't know if it is one of those "illegal ones". A directional antenna isn't much use with a device like this because it will pick up many other stronger signals that will overwhelm your target transmission. I am speaking of suburban or urban areas here. This may work if you are in a rural region where there are no cell towers, braodcast towers, or repeaters in use. The Scout is a just frequency counter so you must have a scanner or the Interceptor to actually listen in. - Weld Pond -

1 0

Re: Navy hacked by Air Force?
by vin＠shore.net 17 Dec '03

17 Dec '03

Drescher/Cohen/Drescher/Drescher/Cohen/Cohen.... I'm new to C'punks, so I don't yet have a grip on the context in which you consider privacy, property, and other ultimate values. I do wonder, though: Do you spend a lot of time pissin' on each other's shoes like this?

2 1

Re: Newsweek Nerd 50
by jim bell 17 Dec '03

17 Dec '03

At 11:04 PM 12/21/95 -0600, you wrote: >Cypherpunk Notables on the List: "Newsweek's Epithet" >Phil Zimmerman: "Crypto Creator" >Marc Rotenberg: "Privacy Advocate" >Sameer Parekh: "Protector of Privacy" >Johan Helsingius: "Crusader" >and Steven Levy, who sometimes posts here has the byline on the "Year of >the Net" feature. >PS to Newsweek -- Prof. Hoffman should be called a "Data Goddess" not a >"Geek" for exposing those bogus factors the marketdroids want to use to >control their survey data back up to the population level. Of course, Newsweek should have included the "baddies" as well: Dorothy Denning would be the Wicked Witch of the West, and Sternlight would have been one of those Winged Monkeys...

1 0

Re: ex encrypted script
by jim bell 17 Dec '03

17 Dec '03

At 08:57 PM 12/21/95 -0800, you wrote: > >There is encrypt and then there is render useless to the reader. > >A tale I hear is that when HP had to deliver operating system source to >the french government they stripped all comments and changed all variable >and subroutine names to 32 byte strings of I 1 0 (zero) and O (uppercase O). >It still compiled but was 100% useless to human readers. >John Pettitt >email: jpettitt(a)well.sf.ca.us (home) > jpp(a)software.net (work) This is EXACTLY the kind of creative uncooperativeness that I was thinking of, on a different subject, when I proposed that Netscape do anything it could think of (legally) to sabotage, undermine, subvert, escape, and otherwise stifle any attempt by the US government to restrict crypto in general, or its export in particular. The fact is, we are all CREATIVE people, and presumably given any particular set of rules (laws) , it should be possible for us to "comply" with "the law" in such a way as to be as obstructively obnoxious as possible.

3 2

Re: Navy hacked by Air Force?
by vin＠shore.net 17 Dec '03

17 Dec '03

This might be relevant. This is a page from the NCCOSC web site <http://www.nosc.mil> The Naval Command, Control & Ocean Surveillance Center (NCCOSC) is the U.S. Navy's warfare center for command, control and communication systems and ocean surveillance and the integration of those systems which overarch multiplatforms. NCCOSC is based in San Diego, CA. NCCOSC Command Internet (NCI) is part of NCCOSC, of course -- and NCCOsc is part of SpaWar (Space and Naval Warfare Systems Command.) Clear? Note that NCCOSC recently decided to beef up NCI's user authentication. See "Current Initiatives." ================= [* ] NCI net - What it is * An enterprise network serving NCCOSC and other communities of interest * Modelled after the global Internet, logically part of the Internet * Communications nodes at each NCCOSC site, linked by T-1 lines * Nodes consist of... o Cisco router linking T-1 lines and local LANs o Annex terminal server and modem bank for dialup, SLIP, and PPP access o Sun servers providing general Internet services (email, name service, ftp server, world wide web, multicast routing, etc.) o NeXT server supporting corporate office functions * Provides ubiquitous high-speed low-delay TCP/IP connectivity throughout the organization and to the Internet * Provides dialup access from home or TDY via 1-800 number, including SLIP and PPP support [* ] [ ] Network Topology [* ] Recent activities and milestones * MIME adopted as corporate email standard, email systems upgraded o Many user agents upgraded to MIME compliance o Testing gateways for interoperability with non-compliant systems o Performing extensive interoperability tests * New sites connected o CINCLANTFLT, Norfolk, VA o The Pentagon + BRAC Office + OSS LAN + DASN/C3I o FTSCLANT (Portsmouth, VA) and NAVSEACENPAC (San Diego, CA) o Armed Forces Staff College, Norfolk, VA o USACOM site in Suffolk, VA + Joint Training, Analysis, and Simulation Center (JTASC) + NISE East Contingent at USACOM o NISE West Guam o NISE West Yokosuka Japan * Network accredited o Completed Security Test and Evaluation o Completed Risk Assessment o Published Contingency Plan and Configuration Management Plan * Network now under full configuration management * New Web server installed o "neelix", a Sun SparcServer 1000, installed outside firewall o "www.nosc.mil" now points at neelix o "Planet Earth" now served by neelix o Recent updates + 1 additional Sparc processor (completed 6/9/95) + 4 Gb more disk (completed 6/2/95) + another 64 Mbytes of memory (giving total of 96 Mbytes) (completed 6/2/95) + conversion to "Apache" http server (faster) (completed 6/1/95) [* ] Current Initiatives * Enhancing Infrastructure to provide ISDN dialup service * Implementing one-time-passwords using SecurID cards * Implementing Kerberos based authentication for additional security * Connecting additional sites o NISMC o USACOM at CINCLANT compound, Norfolk, VA o Pearl Harbor Naval Shipyard, Pearl Harbor, HI o Federal Internet Exchange (FIX) East, College Park, MD o New NISE East Detachment at Naval Weapons Station, Yorktown, VA o ONI at NMIC * Upgrading D.C. area connectivity to Metropolitan Fiber service at 10 Mbps * Getting sites 100% connected (TCP/IP to every desktop) * Developing MIME to X.400 gateway for connectivity to DMS world [* ] References * Dialup Quick Guide * Monthly Reports * June 28 Internet Security Briefing (postscript) Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

Re: ex encrypted script
by jim bell 17 Dec '03

17 Dec '03

At 11:20 PM 12/21/95 -0800, you wrote: difficult for the amateur attacker. >> >>A tale I hear is that when HP had to deliver operating system source to >>the french government they stripped all comments and changed all variable >>and subroutine names to 32 byte strings of I 1 0 (zero) and O (uppercase O). >>It still compiled but was 100% useless to human readers. > >There is a commercial product out there from Gimpel Software called _The C >Shroud_. It removes all structure from the code, replacing it with gotos, >renames all the symbols to axxxxxxx, converts constants and strings to hex, >substitutes all #defines and expands all macros, strips all formatting and >comments, etc., resulting in a perfectly compilable, but infuriatingly >obfuscated set of source files. >Steven Weller On the other hand, there are some programmers out there whose work product makes such a product totally redundant!

1 0

Re: Navy hacked by Air Force?
by RobL 17 Dec '03

17 Dec '03

At 04:58 PM 12/22/95 -0500, Vin McLellan wrote: > Drescher/Cohen/Drescher/Drescher/Cohen/Cohen.... > > I'm new to C'punks, so I don't yet have a grip on the context in >which you consider privacy, property, and other ultimate values. I do >wonder, though: Do you spend a lot of time pissin' on each other's shoes >like this? Laughing my ass off here.. not yet I have seen someone so precisely hit the nail on the head.. Seems this is happening a lot lately.. must be the tension of the holiday season.. <g> Guess I need to start adding plastic shoe-guards to the C-punk kit.. ;) ------------------|----------------------------------------------------------- Rob Lowry | PO Box 288 | Rockford Wa 99030 | ral(a)otc.mhs.compuserve.com robl(a)on-ramp.ior.com

1 0

More developments in Karn vs State Dept
by Phil Karn 17 Dec '03

17 Dec '03

I have been updating my web page almost daily with developments in my case. The latest is that we've written and asked the Court to accept a Supplementary Memorandum opposing the government's motion to toss out our suit, and I've backed it up with a Supplementary Declaration. In it I explain how I just found all of the source code at issue (the Applied Cryptography diskette) on a public FTP site in Italy. This took about 10 minutes using Netscape. I then downloaded the Triple DES code referenced in the earlier Declarations by NSA Deputy Director Crowell and myself in 1.7 seconds, adding that this is somewhat less time that it takes me to move to my computer, insert a floppy disk and return to the keyboard. The government is now asking the judge not to accept these latest filings. Stay tuned! The URL again is http://www.qualcomm.com/people/pkarn/export Phil

1 0

Re: [ecash] Re: Multi-issuer questions
by lvhove＠vnet3.vub.ac.be 17 Dec '03

17 Dec '03

>On Tue, 19 Dec 1995, Marcel van der Peijl wrote in the ecash mailing list: > >> Q: If user A signs up with bank A, and merchant B signs up with bank B, >> can user A buy at merchant B? >> >> A: In theory: >> >> Bank A and bank B need to have an interbank clearing agreement. User >> A sends his money to merchant B. Merchant B contacts his own bank, >> bank B. Bank B recognizes the money as being issued at bank A, >> contacts bank A, and clears the coins there. Bank A credits bank B's >> account at bank A, bank B sends an acknowledge to merchant B and >> merchant B sends the goods to user A. > On Fri, 22 Dec 1995, Patiwat Panurach <pati(a)ipied.tu.ac.th> replied: > I dispute this even on theoretical grounds. > >Am I right in assuming that the only reason Bank B has in contacting Bank >A is to confirm that the ecash hasn't been double spent? Once that is >confirmed, there should be no need for contact between the two banks. >Bank A should not have to credit Bank B's account as there has been no >transfer from Bank A to Bank B. The transfer has been the deposit from --------------------- I guess you mean: from Bank B to Bank A >Bank B's customer to Bank B. Bank B is allready "credited", i.e., its >(e)cash researves have increased, the moment Bank A confirms that the >ecash is valid. > In my understanding - and I'm sure Marcel van der Peijl :-) will correct me :-( if I'm wrong - the only way Bank B can verify with Bank A that the ecash it has received from merchant B has not been spent before is by actually sending the _coins_ to Bank A. Hence there _is_ a transfer from Bank B to Bank A and thus Bank A has to credit Bank B's account... Marcel? Ciao, leo _________________________________________________________________________ Leo Van Hove Centre for Financial Economics Vrije Universiteit Brussel (Free University of Brussels) Pleinlaan 2 B-1050 Brussels Vox: +32 2 629.21.25 Fax: +32 2 629.22.82 e-mail: lvhove(a)vnet3.vub.ac.be VUB's Web site: http://www.vub.ac.be _________________________________________________________________________

1 0

Houston C'punk gathering
by turner＠TeleCheck.com 17 Dec '03

17 Dec '03

For C'punks in the Houston area, there will be an informal gathering at Strack's Restaurant, tomorrow at approx. 11:00 a.m. I will attempt to get there a little early, and I will be the one with a red lamborghini countach on the table. Just come up and sit down. Strack's has a breakfast buffet which is reasonably priced, or at least it was the last time I went there. Possible Topics for Discussion: I will also be bringing the encryption algorithms used by VMS (the AUTODIN-II, Purdy with salted input, Purdy (Purdy V) with variable length username, and the Purdy (Purdy S) with additional bit rotation). I have tested these under VMS 6.2 and they seem to work fine, although they could be (and should be) optimized for brute forcing. I will also be bringing some password brute forcing code that utilize the system services to encrypt the password (and punch CPU usage through the roof). It will crack a three character password in under a minute on a loaded AXP 3000LX. I will also be bringing a copy of the infamous _Giant Black Book of Computer Viruses_ by Mark Ludwig. Interesting stuff. Directions (from Houston): Take I-45 North. You will pass 1960 and then will drive though a stretch of road riddled with construction barrels. Do not exit Holzworth, but take the next exit (Louetta). Get on Louetta (you will have to make a right turn and you will be on the overpass), and take the overpass west towards Tomball. You will cross through several intersections, Strack's will be on your left, after you cross Kukendaul (approx. 1-2 miles ahead). If anyone gets lost, or wants more info you can page me at: (713) 866-0989.

1 0

Re: Navy hacked by Air Force?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 22 Dec 1995, Vin McLellan wrote: > This might be relevant. This is a page from the NCCOSC web site > <http://www.nosc.mil> Thanks for posting this. It was very helpful. > The Naval Command, Control & Ocean Surveillance Center (NCCOSC) > is the U.S. Navy's warfare center for command, control and communication > systems and ocean surveillance and the integration of those systems which > overarch multiplatforms. NCCOSC is based in San Diego, CA. > > Note that NCCOSC recently decided to beef up NCI's user > authentication. See "Current Initiatives." Duly noted ... (as long as it don't lead to a false sense of security) > [* ] NCI net - What it is > > * An enterprise network serving NCCOSC and other communities of interest > * Modelled after the global Internet, logically part of the Internet ... > * Provides ubiquitous high-speed low-delay TCP/IP connectivity throughout > the organization and to the Internet > * Provides dialup access from home or TDY via 1-800 number, including > SLIP and PPP support Betchya that WATS line gets a whole lotta billings to it. <p> > * MIME adopted as corporate email standard, email systems upgraded > o Many user agents upgraded to MIME compliance > o Testing gateways for interoperability with non-compliant systems > o Performing extensive interoperability tests MIME??!!?? They adopted MIME??!!?? Good grief. This is not good ... not good at all. > * New sites connected > o CINCLANTFLT, Norfolk, VA > o The Pentagon > + BRAC Office > + OSS LAN > + DASN/C3I Oh no ... it's worse ... *sigh* ... no wonder that Newt and Dole had such a grim look on their faces when they emerged from their scheduled one-hour, (went for two) meeting with the US President -- the one that was the day before the freshman congress persons did their incredible end-run on their own leadership. Impressive. Truly. What would have caused both Newt and Dole to flush like they did? Did they demo a hack into the personal e-mail of the Vice-Chairman of the JCS? > * New Web server installed > o "neelix", a Sun SparcServer 1000, installed outside firewall > o "www.nosc.mil" now points at neelix Pretty firewall ... nice firewall ... <p> > * Enhancing Infrastructure to provide ISDN dialup service Good idea. ISDN dialup provides significant bandwidth. Very significant bandwidth. Almost enought to control a battleship. (If there were any battleships, I mean). > * Upgrading D.C. area connectivity to Metropolitan Fiber service at 10 > Mbps > * Getting sites 100% connected (TCP/IP to every desktop) > * Developing MIME to X.400 gateway for connectivity to DMS world Yep. Perfect. Just what the doctor ordered. TCP/IP to every desktop. And MIME for all. Oh, and to ice the cake, toll-free ISDN dial-ins. Hmm, let's see ... for Christmas Santa ... I'd like a packet-switched network with a public outdial to a toll-free ISDN dial-in ... oh, that and a Gulfstream V under the Christmas tree. What are they going to do next, give everyone some Czechoslovakian C-4? Stick a bit of civilian software into all of this, and let's all have a good look at whether someone can take over something a little more interesting than a battle ship. Like maybe an aircraft carrier?? Gee, that oughta harden their drawers ... Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E. P.P.S. Feel free to repost widely ... IW ... c4i-pro ... wherever ...

1 0

IW Mailing List iw/951222 (fwd)
by fc＠all.net 17 Dec '03

17 Dec '03

The following is forwarded from Risks [...s indicate missing regions of text] > --------------------------------------------- > FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) > ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator > ... > Date: Fri, 22 Dec 1995 00:59:09 -0500 > From: RSRMadison(a)aol.com > Subject: Re: Naval Battleship takeover (Long, RISKS-17.55) > > A message from the InfoWar list noted that: <<There are NO active US > battleships!!! And there weren't any last September.>> > > As stated, this is true. However, let the record show that the US Navy still > flies the flag daily over 1 commissioned battleship, the USS Arizona, > permanently stationed in Honolulu. > > ... > Date: Fri, 22 Dec 1995 10:53:56 -0500 > From: Bob Brewin <brewin(a)access.digex.net> > Subject: Re: Naval Battleship takeover (Long, RISKS-17.55) > > Yikes. This story will not die -- it just lives on a Web site at the > Daily Telegraph in London. Having worked for a British news > organization (Reuters) for years, if you believe the Telly story, call > me about a bridge I have for sale. > > The Air Force did not hack the Navy over the Internet. They did it over > a secure network (SIPRNET) which is firewalled from the Internet. > > The Air Force conducted this attack with the Navy's knowledge and > permission. > > The Navy does not have any battleships on active duty. > > The Air Force did not get control of the none-existent battleship. > > Yep. This does have the makings of a legend. > > Bob Brewin editor-at-large (whatever that means) federal computer week > antenna(a)fcw.com brewin(a)access.digex.net > ... -> See: Info-Sec Heaven at URL http://all.net/ Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

PAN_maw
by John Young 17 Dec '03

17 Dec '03

12-23-95. WashP: CyberCash this week plans to offer its shares of stock to the public. It is one of a handful of fledgling companies that hope to coin profits by helping others make financial transactions on the Internet. But consumers still worry that hackers on the Internet can ferret out credit card information. CyberCash's technology blocks online seeing of unscrambled credit card numbers. CyberCash and its IPO advisors believe they have developed schemes that will convince lemmings that there is the equivalent of steel-plated armor around their life savings as they vanish into the Internet's mega-panamaW$. "This is the latest Internet digital currency slaughter- offer for fat-fee hacking our Widows and Orphans Ever-Safe Pensions," choraled a split-gut ice-eyed Santanalyst. PAN_maw (5 kb)

1 0

Re: CFS and Linux
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

> 1: please make it install 'out-of-the-box' on Linux. AT&T's refusal to support CFS and other so-called "secure" software under Linux is typical and to be expected. Linux, the most popular alternative to Microsoft, represents a direct threat to AT&T's bread and butter and to their ability to control the security software market. The fact that the CFS install programme deletes other security software is no accident. We would be foolish to expect them to admit their malice - they will excuse it as a "mistake" or will ignore it altogether. I don't agree with all of the "Gates" character's claims against AT&T, however I think their motives can be summed up in three words: Greed, Greed, Greed. Use their software and you support the giant. Remember their theft from the Berkeley graduate students each time you accept "free" software from this greedy monster. I also do not accept Blaze's cowardly defense of his actions and of his too-comfortable situation; one cannot help but be reminded of the Nazi "just following orders" prattle repeated rote as they were called to answer for their crimes. It rings no less hollow to this day. But I will not condemn him, nor will I call on others to do so, preferring to leave that matter between him and his Maker. Weinstein, of course, is beast of another color, but that will have to wait. Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

4 3

ACLU Cyber-Liberties Update, 12/22/95
by Lynnclu＠aol.com 17 Dec '03

17 Dec '03

---------------------------------------------------------------- December 22, 1995 ACLU CYBER-LIBERTIES UPDATE A bi-weekly e-zine on cyber-liberties cases and controversies at the state and federal level. ---------------------------------------------------------------- IN THIS ISSUE: * ACLU Letter to U.S. Senators Opposing the Telecommunications Deregulation Bill, S. 652 (H.R. 1555) As Reported by the Conference Committee ---------------------------------------------------------------- FEDERAL PAGE (Congress/Agency/Court Cases) ---------------------------------------------------------------- December 22, 1995 Via Fax Subject: Why the Telecommunications Deregulation Bill, S. 652 (H.R. 1555), As Reported by the Conference Committee Should Be Rejected Dear Senator: The American Civil Liberties Union urges you to vote against S. 652 (H.R. 1555), the telecommunications deregulation bill as reported by the conference committee. The conference committee has produced a bill that will immediately damage freedom of expression, the bedrock value at the core of the First Amendment and will structure the telecommunications industry so that free speech and privacy are in permanent jeopardy. While the final text is still being written, these provisions are sufficiently destructive that they warrant rejection of the entire bill. Many reasons could be cited why S. 652 should be rejected; we will focus on just three areas where the conferees have needlessly chosen to attack essential First Amendment values. I. The "Deregulation" Bill Will Establish a Big Government Censorship Regime with New Speech Crimes for the Internet and Online Communications. Title V of the telecommunications bill as adopted by the conference committee will: - Subject first-year college students under 18 to two years in prison and $100,000 fine if they engage in overly salacious dating patter online (even in their private e-mail). - Subject parents to the same prison term and fine if they provide their own teen-ager with online materials that the parents have decided have merit if the material is deemed to violate the bill. - Subject adults merely looking on their own home computer at something deemed obscene to prison for five years for the first peek, plus another ten years if they look again. This is not far-fetched. Electronic "footprints" are left behind whenever a user goes somewhere in cyberspace. Some of the censorship groups backing the bill openly support prosecuting anyone who looks at such material as way of "drying up" demand for it -- so these groups have an incentive to pressure prosecutors to follow those footprints back to the adults at home. - Effectively reduce voluntary communications among consenting adults to those appropriate only for children. Much of what consenting adults -- even married consenting adults -- prize about some of their communications could well be deemed by outsiders as indecent if addressed to minors. The bill will infantalize all communications in cyberspace as users worry about how to avoid prosecution if prohibited material is sought out by someone underage. The educational value of the Internet would be reduced to the equivalent of the children's section in the video store. - Define its new speech crimes so broadly that it will hold access and service providers criminally liable for content they did not create unless the providers have legal departments large and skilled enough to utilize limited and vague defenses. Even then, the defenses would have to be established in costly and time-consuming court proceedings. The predictable effect will be enormous self-censorship, coerced by the government's failure to precisely define what is being made criminal and the threat of prison for transgressors. - Subject all Americans to the most narrow of community standards found in the most socially limiting of locations. Even those who have chosen to adopt the social mores of such locations should not insist on imposing those mores on the millions of Americans who have chosen to live elsewhere. These proposals violate the Constitution. They are also profoundly bad public policy. Title V of the bill is unconstitutional because it takes speech protected by the First Amendment and tries to regulate it in a way that violates what the Supreme Court has said must be the touchstone for regulating protected speech. For example, the bill fails to use the constitutionally required "least restrictive means" to obtain its putative goals. It also fails to take into account the particular characteristics of interactive media in the online environment, rendering its attempt to create new speech crimes constitutionally impermissible. Title V also unconstitutionally invades the privacy rights of those who communicate online. Cyberspace is the first genuinely mass medium in human history, where many individuals can speak to many others at the same time, and where the "start-up" costs of "publishing" are so minimal that almost all users are potential publishers. This is a democratic and truly libertarian communications medium without a centralized governing body. There is no network president or standards department, for example, ultimately overseeing everything that is broadcast -- in fact there is no "network" but instead an endless series of independent areas like newsgroups, chat rooms, bulletin boards and web sites. The conference bill tries to force cyberspace into the mold of the old media with a government-dictated, centralized command structure. Cyberspace gives its users -- including parents concerned about their children -- an unprecedented power over what materials are accessed, or not accessed, from their computers. Parents, for example, already have available software and other technology that will let them control what their children access from their computer. Tragically, the conferees have rejected further private sector development of user empowerment technologies. Instead, the conference bill imposes the most restrictive regime of government regulation over content on what should be the least governmentally restricted of all media. In doing so, the bill would strangle cyberspace, violating the free speech and privacy rights of all those who communicate online. The ACLU believes that all adults have the right to choose for themselves what they see or say online. The conferees have chosen to invest a minority of censorship extremists with the coercive power of the criminal law and Federal prison in order to impose on the rest of us their constricted view of what we should say or see. This is a truly historic turning point. Title V of the bill from the conference committee confronts the Congress with a stark choice: - Will the 104th Congress be seen in history as one who stood up for the freedom of communications in cyberspace and the Internet, or will it be counted as a tool of certain censorship groups determined to impose their conception of "proper" speech on all of us? - Will the 104th Congress stand up for the continuing vitality of private sector development of interactive media, or will it impose a big-government bureaucratic regulatory regime on cyberspace and the content of its communications? - Will the 104th Congress stand up for empowering users -- including parents concerned about their children -- to control what material is accessed from their computers, or will it give the coercive power of federal prison sentences to censorship groups who care more about interfering with what other adults see or say than about protecting their own children? II. The "Deregulation" Bill Will Impose a Big-Government Censorship Regime on Television Programming. The conference committee has agreed to V-chip language in S. 652 that will stifle expression on broadcast and cable television and prevent parents from exercising greater control over their children's television viewing habits. The V-chip provision will vest the government, not parents, with control over which television programs make their way to the family television set. The V-chip hardware is technology that will automatically block a program from television reception if it carries a certain encoded rating in its transmission. The encoding would be transmitted on the same signal that currently carries closed captioning information. However, the V-chip requirement does more than simply call for new hardware in television sets; the bill would set up a television rating system driven by government guidelines on content. Although the television industry is given a one-year window to "voluntarily" develop and transmit an encoded ratings scheme for violent, sexual, or indecent programing, the Federal Communications Commission would have the power to reject the industry's system in favor of its own. In this way, the government ultimately decides what content is appropriate for viewing and what is not. The bill calls for the government to form an "advisory committee" to set recommendations for guidelines on rating content, and those guideline will be formally issued by the FCC. Although the V-chip's congressional sponsors have claimed that these guidelines will not be mandatory, the ratings guidelines will surely have a chilling effect on the creative process in television programming. Would producers make a television mini-series about the violent Civil War? Perhaps not, if the broadcast will automatically be blocked from the television sets of countless families who will not have the opportunity to make an independent judgement as to the program's appropriateness. The weightiest and clearest guidelines for content rating would be that of the government. Such chilling of expression by the government violates the First Amendment. The Supreme Court has held that violent expression enjoys full constitutional protection. Furthermore, what would constitute "sexual" expression would be left up to the government's advisory committee or the industry's "voluntary" internal censors. Would a news program or documentary on breast cancer be blocked as "sexual" expression? That answer is yet unclear, but what is clear is that the encoded ratings will block expression fully protected by the First Amendment. Furthermore, the V-chip scheme created by Congress completely shuts out families from the decision making process. Instead, it empowers bureaucrats and television executives to make decisions for parents. Would the V-chip's automatic censors block out such "violent" programs as "Schindler's List," "Roots," or "The Burning Bed"? Other options for true parental control and choice in children's television viewing will be destroyed by the government's V-chip mandate. Private companies have recently developed technology, such as the Telecommander and the TV Guardian, that would empower parents to screen out the programs or stations that they feel are inappropriate for their children. Additionally, there is the possibility of a true "choice chip," which would allow parents to subscribe to the private rating service of their choice, whether run by the National PTA, TV Guide or the Christian Coalition. Technology and initiatives developed by private business will be crushed by the government's mandatory censoring technology and ratings system. The government will step in as a surrogate parent to turn off the television when a child turns to the "wrong" channel. However, the government's version of what is "wrong" might include a documentary, an afterschool special, or other programming that a parent would actually want their child to watch. Thus, the "V" in V-chip is for the government's "victory" over parental control and the First Amendment. III. The Bill Will Foster Communications Monopolies that Stifle Diversity and Free Speech. A core value of the First Amendment's guarantees of free speech and free press is the vital role in preserving liberty played by robust discussion of public issues among a diversity of viewpoints. Unfortunately, the bill undoes much of the existing protection ensuring diversity in points of view by allowing a greater concentration of media. The conference report would, for example, allow the FCC to use waivers so that a single corporation could own the television station, radio station, cable system, newspaper, phone company and Internet access provider in a locality. On the national level, the bill will allow a greater concentration of control over programming sources. No clearer example exists of the destructive impact on free speech such media concentration will have than CNN's recent rejection of advertisements opposing the telecommunications bill itself. CNN's corporate owners, of course, have vital interests generally being advanced by the bill, but the decision to reject opposing ads (followed up by a decision to reject all ads on the bill -- when the issue was generally developing in favor of CNN's owners) is the kind of content control that will only be repeated as media concentration increases. Conclusion The American Civil Liberties Union urges you to oppose the conference version of S. 652 (H.R. 1555), the telecommunications deregulation bill because it will impose new speech crimes on cyberspace and new censorship on television programming, as well as jeopardize the future of free speech in this country by destroying the diversity of media ownership. Sincerely yours, Laura W. Murphy Director Donald Haines Legislative Counsel ---------------------------------------------------------------- ONLINE RESOURCES FROM THE ACLU NATIONAL OFFICE ---------------------------------------------------------------- Stay tuned for news on the ACLU's world wide web site, under construction at http://www.aclu.org/. America Online users should check out our live chats, auditorium events, *very* active message boards, and complete news on civil liberties, at keyword ACLU. ---------------------------------------------------------------- ACLU Cyber-Liberties Update Editor: Ann Beeson (beeson(a)aclu.org) American Civil Liberties Union National Office 132 West 43rd Street New York, New York 10036 To subscribe to the ACLU Cyber-Liberties Update, send a message to cyber-liberties(a)aclu.org with "subscribe Cyber-Liberties Update" in the subject line of your message. To terminate your subscription, send a message to cyber-liberties(a)aclu.org with "unsubscribe" in the subject line. For general information about the ACLU, write to info(a)aclu.org. ----------------------------------------------------------------

1 0

Re: Cybercash questions...
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 13:39 12/22/95, David Klur wrote: > The fraud possibility I see is that Bob could steal Alice's encrypted > credit card number (by sniffing when she buys something at Charlie's > Internet shop). Then, without decrypting it, he could use it (still > encrypted) at Don's Internet shop, and ask Don to ship the goods to > Bob's address. Since Don will not decrypt Alice's card number he will > not know that it is not Bob's card. Cybercash will validate Alice's > card, but will not know that it is really Bob who is the customer. > Don will ship the goods to Bob, and Alice will get a fraudulent charge > on her bill. > > Am I missing something? If when Alice sends her encrypted card number to Charlie, it were encrypted with Charlie's Public Key, then the version that Bob gets is useless if sent to Don (since it will not decrypt with Don's Secret Key into something that when sent to Cybercash will yield Ann's CC# when decrypted with Cybercash's Secret Key). This still leaves the data as valid for use at Charlie unless the actual decrypt by Charlie contains more than just the CC#, so as to flag an "replay" attempt (ie: if the sending of the CC# is in realtime, there could be a check field in there to validate the response as being for the current request) and reject it.

1 0

Welcome to cypherpunks
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Welcome to the cypherpunks mailing list! If you ever want to remove yourself from this mailing list, you can send mail to "Majordomo(a)toad.com" with the following command in the body of your email message: unsubscribe cypherpunks Cypherpunks Mailing List <cypher(a)infinity.nus.sg> Here's the general information for the list you've subscribed to, in case you don't already have it: About cypherpunks ----------------- I. Administrivia (please read, boring though it may be) The cypherpunks list is a forum for discussing personal defenses for privacy in the digital domain. It is a high volume mailing list. If you don't know how to do something, like unsubscribe, send mail to majordomo(a)toad.com and the software robot which answers that address will send you back instructions on how to do what you want. If you don't know the majordomo syntax, an empty message to this address will get you a help file, as will a command 'help' in the body. Even with all this automated help, you may still encounter problems. If you get really stuck, please feel free to contact me directly at the address I use for mailing list management: cypherpunks-owner(a)toad.com Please use this address for all mailing list management issues. Hint: if you try to unsubscribe yourself from a different account than you signed up for, it likely won't work. Log back into your old account and try again. If you no longer have access to that account, mail me at the list management address above. Also, please realize that there will be some cypherpunks messages "in transit" to you at the time you unsubscribe. If you get a response that says you are unsubscribed, but the messages keep coming, wait a day and they should stop. For other questions, my list management address is not the best place, since I don't read it every day. To reach me otherwise, send mail to eric(a)remailer.net This address is appropriate for emergencies (and wanting to get off the list is never an emergency), such as the list continuously spewing articles. Please don't send me mail to my regular mailbox asking to be removed; I'll just send you back a form letter. Do not mail to the whole list asking to be removed. It's rude. The -request address is made exactly for this purpose. To post to the whole list, send mail to cypherpunks(a)toad.com If your mail bounces repeatedly, you will be removed from the list. Nothing personal, but I have to look at all the bounce messages. There is no digest version available. There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. Mail to cypherpunks-announce-request(a)toad.com if you want to be added or removed to the announce list. All announcements also go out to the full cypherpunks list, so there is no need to subscribe to both. II. About cypherpunks The cypherpunks list is not designed for beginners, although they are welcome. If you are totally new to crypto, please get and read the crypto FAQ referenced below. This document is a good introduction, although not short. Crypto is a subtle field and a good understanding will not come without some study. Please, as a courtesy to all, do some reading to make sure that your question is not already frequently asked. There are other forums to use on the subject of cryptography. The Usenet group sci.crypt deals with technical cryptography; cypherpunks deals with technical details but slants the discussion toward their social implications. The Usenet group talk.politics.crypto, as is says, is for political theorizing, and cypherpunks gets its share of that, but cypherpunks is all pro-crypto; the debates on this list are about how to best get crypto out there. The Usenet group alt.security.pgp is a pgp-specific group, and questions about pgp as such are likely better asked there than here. Ditto for alt.security.ripem. The cypherpunks list has its very own net.loon, a fellow named L. Detweiler. The history is too long for here, but he thinks that cypherpunks are evil incarnate. If you see a densely worded rant featuring characteristic words such as "medusa", "pseudospoofing", "treachery", "poison", or "black lies", it's probably him, no matter what the From: line says. The policy is to ignore these postings. Replies have never, ever, not even once resulted in anything constructive and usually create huge flamewars on the list. Please, please, don't feed the animals. III. Resources. A. The sci.crypt FAQ anonymous ftp to rtfm.mit.edu:pub/usenet-by-group/sci.crypt The cryptography FAQ is good online intro to crypto. Very much worth reading. Last I looked, it was in ten parts. B. cypherpunks ftp site anonymous ftp to ftp.csua.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany. There is a glossary there that all new members should download and read. Also recommended for all users are Hal Finney's instructions on how to use the anonymous remailer system; the remailer sources are there for the perl-literate. C. Bruce Schneier's _Applied Cryptography_, published by Wiley This is required reading for any serious technical cypherpunk. An excellent overview of the field, it describes many of the basic algorithms and protocols with their mathematical descriptions. Some of the stuff at the edges of the scope of the book is a little incomplete, so short descriptions in here should lead to library research for the latest papers, or to the list for the current thinking. All in all, a solid and valuable book. It's even got the cypherpunks-request address. IV. Famous last words My preferred email address for list maintenance topics only is hughes(a)toad.com. All other mail, including emergency mail, should go to hughes(a)ah.com, where I read mail much more regularly. Enjoy and deploy. Eric ----------------------------------------------------------------------------- Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy. [Last updated Mon Feb 21 13:18:25 1994]

1 0

No Subject
by floyddb＠alpha.c2.org 17 Dec '03

17 Dec '03

On Fri, 22 Dec 1995 andr0id(a)midwest.net (Jason Rentz) wrote: >> >> > >The problem with the Interceptor is that I think it can only receive one >freqency at a time, and it is adjustable by a thumb wheel, not digitally. >This would tend to make changing frequencies at high rates VERY hard. :) >Also it has no frequancy readout, so this means that if you know what freq. >you should be at it is hard to tune in that freq. without searching a little. > Dr0id > > >( Computer Consulting & Management ) >(P.O. Box 421 Cambria, IL 62915-0421) > The demo of the Interceptor I saw seemed to show it jumping from 150 MHz to 450 MHz without any external adjustments, it locked on the strongest signal. Granted, it can only receive one frequency at a time, but there shouldn't be any significant delays when the phone hops a frequency. The Interceptor's frequency readout is a bargraph style LED. The Scout, from what I can see in Optoelectronics' ad doesn't have any frequency controls on it, it does have a digital frequency readout. As far as timing is concerned, the Scout might be less useful because I think it feeds the frequency into the scanner for reception. Most scanners take a significant amount of time to change frequencies. Merry Christmas Floyd D. Barber floyddb(a)alpha.c2.org Key fingerprint: 8A 98 1F 6B 70 7A FE 24 35 D4 48 CF 9D F6 B0 91

1 0

(fwd) Java implementation of secure login protocol
by Adam Shostack 17 Dec '03

17 Dec '03

Look, Ma! Java code! Real cyph3rpunks, of course, flame each other anonymously. (Incidentally, I got tired of Alice making it to my noise box, and the following seems to work well. Deleting the leading ^ characters would cause all responses to go into the junk box; perhaps a good idea. This is, for those of you who don't recognize it, procmail code. My mail filter of choice for hacking in.) :0B: * ^Alice de 'nonymous * ^P.S. This post is in the public domain. | formail -a "Status: O" >> cjunk > From: greg(a)qualcomm.com (Greg Noel) > Newsgroups: comp.lang.java,sci.crypt > Subject: Java implementation of secure login protocol > Date: 19 Dec 1995 23:12:52 -0800 > Organization: QUALCOMM, Incorporated; San Diego, CA, USA > Lines: 64 > Message-ID: <4b8d1k$6o9(a)qualcomm.com> > NNTP-Posting-Host: guru.qualcomm.com > > Please note that this article is cross-posted both to comp.lang.java and > sci.crypt. If you follow up, please trim the newsgroups appropriately. > > Since a number of people expressed interest, I'm releasing an initial > implementation of a secure login protocol in Java. This is still very > much a work in progress (it's not really even of alpha quality), but > the protocol itself is functional. > > It's intended that the classes in crypto.* and qualcomm.qbs.login.* > live on the client; any other classes needed would be downloaded over > the encrypted link. Hopefully, the client-resident classes will be > few in number and change rarely; they are just intended to bootstrap > up the connection. In the long run, the classes in crypto.* could be > provided by the vendor of the Java VM. > > The distribution consists of two files: > ftp://ftp.qualcomm.com/pub/gnoel/java.login.tar.gz > ftp://ftp.qualcomm.com/pub/gnoel/java.no-export.tar.gz > The first file contains the logic to execute the protocol and launch > the splash screen (see below); it also contains the base classes from > crypto.* but no cryptographic functions. The second file contains the > base classes and the actual implementations of a few cryptographic > functions to demonstrate how the base classes can be used. > > For sci.crypt, I've tried to capture the essence of what cryptographic > functions can do in the base classes, without being specific to any > particular protocol. I'm not completely happy with it, and would welcome > any comments people might have on what might be missing. It's as minimal > as I could make it and still provide a basis for whatever protocols need > to be implemented. > > My motivation here is that Sun and Netscape are talking about defining > a standard way of incorporating cryptographic functions in Java; it would > be nice if the specification were usable for a lot more than the security > protocols that come with Netscape. (I wouldn't object to having access > to SSL from Java---in fact, I'd really like it---but I'd also like access > to MD5 and the like.) > > This implementation of the secure login protocol uses short text strings > to identify the packets being exchanged; that's for convenience while > debugging---in a production implementation, it would be done differently. > Other than that, I'd appreciate any suggestions as to how to improve the > implementation. (A MAC digest prefixed to the packets is something I'm > considering, for example.) > > For comp.lang.java, the splash screen is loaded over the secure connection > but attempts to instantiate a member of the class cause a NoSuchMethodError > to be thrown. The class itself seems to be defined correctly, and it should > be no different from how an applet would be loaded and instantiated, but it > still fails. If anyone can tell me what is going wrong and what I can to > to fix it, the pizza and beer will be on me. (This has been a showstopper > for four days now and I'm getting very frustrated by it.) > > The class design tries to minimize the number of classes that must be > present in the bootstrap set; this led to a somewhat, ah, baroque set of > functionality. If anyone has suggestions on how this could be done better, > I'd be pleased to hear about it. > > If anyone has any questions about this, don't hesitate to drop me a line > or post something in one of the newsgroups. I'm going home for some sleep > now, but I'll be banging my head against it again in the morning. > > -- > -- Greg Noel, UNIX Guru greg(a)qualcomm.com or greg(a)noel.cts.com

1 0

Re:
by stevenw＠best.com 17 Dec '03

17 Dec '03

>On Fri, 22 Dec 1995 andr0id(a)midwest.net (Jason Rentz) wrote: >> >>The problem with the Interceptor is that I think it can only receive one >>freqency at a time, and it is adjustable by a thumb wheel, not digitally. >>This would tend to make changing frequencies at high rates VERY hard. :) >>Also it has no frequancy readout, so this means that if you know what freq. >>you should be at it is hard to tune in that freq. without searching a >>little. >> Dr0id > >The demo of the Interceptor I saw seemed to show it jumping from 150 MHz >to 450 >MHz without any external adjustments, it locked on the strongest signal. >Granted, it can only receive one frequency at a time, but there shouldn't >be any >significant delays when the phone hops a frequency. The Interceptor's >frequency readout is a bargraph style LED. The Scout, from what I can >see in Optoelectronics' ad doesn't have any frequency controls on it, it does >have a digital frequency readout. As far as timing is concerned, the Scout >might be less useful because I think it feeds the frequency into the >scanner for >reception. Most scanners take a significant amount of time to change >frequencies. I used to work for a company that made frequency-hopping military radios. It's a catch-me-if-you-can game, a bit like the amusement arcade toy where stuffed rats pop up through holes and you try to whack them with rubber hammers. You can sure *see* where the next one is, but you can't get there fast enough to make contact. If you knew the pseudo-random pattern, you could anticipate and be there every time. Thus in a frequency-hopping radio you can push the retuning (read RF phase-locked loop) technology to its limit and build transmitters and receivers around them. These typically hop in the order of 100 times a second. The adversary has to find the uncorrelated signal very quickly indeed *and* have PLL technology at least as good as yours to recover anything from it. Finding the signal generally means listening to all frequencies at once, requiring huge amounts of hardware parallelism and/or realtime computing power. Once you throw ten or so radios onto the same band, it's no longer any use looking for the strongest signal, making that approach useless. The primary reason for FH is not to hide information, however. Encryption can be used for that. It's to prevent the enemy from hiding the information from the intended recipient through jamming. Radio jammers work by simply drowning out all other traffic so that the receivers either clip and distort everything or have to attentuate the input signal so far that the interesting stuff is undetectable. Like trying to have an intellectual conversation at a bad rock concert. By employing FH you require the enemy to have enormous and impractical jamming capacity. There are FH radars too. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

3 2

Re: CFS and Linux (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: CFS and Linux > Date: Sat, 23 Dec 1995 11:15:40 -0500 > From: "Perry E. Metzger" <perry(a)piermont.com> > > Alice B. Cohen writes: > anonymous-remailer(a)shell.portal.com writes: > > > 1: please make it install 'out-of-the-box' on Linux. > > > > AT&T's refusal to support CFS and other so-called "secure" software > > under Linux is typical and to be expected. > > God, you are an obnoxious prick. > Ditto. > First of all, this is Matt Blaze's pet project, not a product of > AT&T. It is given away for free and you should be happy to get it at > all -- no one is obligated to give you a gift. Have you mailed him a > Linux machine to do his testing on? Why do you assume he even has one? > As it happens, he doesn't, and probably doesn't want to go through the > hassle of paying for a computer and putting Linux on it. > > Be happy he's given you anything at all. > > Perry > If you are going to do it, do it right the first time. Second, I really doubt Blaze has a problem obtaining access to computing power and a $25 CD should be within his budget. Merry Christmas.

5 4