December 2003 - cypherpunks-legacy

Re: ADDRESS DATABASE? (fwd)
by Charles Gimon 17 Dec '03

17 Dec '03

Forwarded message: > From toad.com!owner-cypherpunks Thu Dec 14 17:36:57 1995 > Date: Thu, 14 Dec 1995 14:50:19 -0800 (PST) > From: Sandy Sandfort <sandfort(a)crl.com> > > So far, no one has come up with anything stronger than specula- > tion about my database question. Some "anonymous" told me how > easy it was to buy *phone numbers* on CD-ROMs. Great, but I > didn't give the guy my phone number. > It was probably a shrewd guess on the part of the phone peon, combined with a fresh database from the telephone company. Are there many people in your zip code with the same last name as yourself? If not, that pretty much answers your question right there. When you pull a credit report from TRW's database, the only information TRW needs is the first four (?) letters of the last name, the initial of the first name, the numeric part of the address, the first character of the street name, and the zip code. I'll leave it to the experts in information theory to explain that in rigorous technical detail. Given only a last name and a zip code, I wouldn't be surprised if you found the proper individual most of the time. (If you're in Minnesota and you're looking for Swenson in 55419, you may need more info, but not much.) Another anecdote to add to the pile: I moved to a new apartment last May. For various reasons, I got an unlisted number, and had my credit card bills and magazine subscriptions sent to a mail drop (MBE). The phone, gas, electric and cable bills went to the new apartment, not to the mail drop. I didn't get any junk mail at the new apartment until a couple of weeks ago--right after I changed my subscription to Byte to come here (now I'm getting AOL disks, etc.). Before that, I got no junk mail here (except from the phone or cable company). I get almost no telemarketing calls; I used to get at least one a night with a listed phone number. My experience appears to be that credit card and magazine companies sell lists; utility and cable companies don't. Mass mailers must not get unlisted number customers on the lists they get from the phone company. Again, this is only from my experience, all disclaimers apply. And all this has no relevance whatsoever when you bring the government into the picture. Crypto relevance? Well, I did mention information theory...

1 0

Re: And the standard continues to lower...
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:17 PM 12/13/95 -0600, you wrote: >Dr. Brian L. Crissey includes in his .sig, courtesy of cactus(a)hks.net >[ much WRT YetAnotherSecureInternetCreditCardPaymentSystem(*tm) deleted ] >> ***Dr. Brian L. Crissey, Chair CS Dpt, Linfield Col., McMinnville, OR 97128 >> (503)-434-2426 brianc(a)linfield.edu >> Professionals built the Titanic, amateurs built the Ark... > >However, the Ark was *designed* by GOD (if you believe the story). Can Dr. >Brian L. Crissey say the same thing about his payment system? He seems to think so... He is so assured as to the security of his system. I am going to ask if I can post his challenge he made to me in private e-mail here. He needs to be taught some basics in security. (I do not have the proper hardware to subvert his scheme. I do have some other ways of subverting it, but that would be telling... (I occasionally assist with the web server on Teleport. Changing his script to collect information would not be difficult...)) I will see if he will let me forward his e-mail to the list. (I will also check with the webmistress on Teleport before I do... She might get pissed if I turned the people on the list onto Teleport's server.) | What is the Eye in the Food Pyramid? | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | <fnord> |

1 0

Another One-Time Pad Reference
by Richard Charles Graves 17 Dec '03

17 Dec '03

http://www.atria.com/~dawson/tbtf/archive/0044.html

1 0

Re: e-mail forwarding, for-pay remailers
by Andrew Loewenstern 17 Dec '03

17 Dec '03

E. Allen Smith writes: > There's one problem with this in regards to the "no necessary > connection," and that 's the governmental requirement for mail > forwarding. MBE and any legal other one will want to see at least > two forms of ID including one photo, and have a form that they fill > out using that and send to the local post office. Anyone have a > way around this problem? Why does an account provider need a snail-address and phone-number? Usually for billing purposes. However, this isn't necessary for accounts paid with ECash. I believe C2.org already offers non-dialup access accounts, paid for with ECash, that do not require a valid snail-address or phone-number. I am sure that there will be many more to come. andrew

1 0

Re: ADDRESS DATABASE?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Some "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . " wrote: >C'punks, > >So far, no one has come up with anything stronger than specula- >tion about my database question. Some "anonymous" told me how >easy it was to buy *phone numbers* on CD-ROMs. Great, but I >didn't give the guy my phone number. You don't get it, do you? Sandfort A & K Irvine, CA 92714 Sandfort Christine San Jose, CA 95113 Sandfort Curtis J 19841 River Rd Gladstone, OR 97027-2285 Sandfort D 105 Cypress Ave Santa Cruz, CA 95062-3710 Sandfort D O 780 N Circle D Way Tucson, AZ 85748-3845 Sandfort Glenn & Sophia 24314 Carter Rd Bothell, WA 98021-9413 Sandfort Jack 4057 Lower Honoapiilani Rd Wailuku, HI 96793 Sandfort Jack L 6761 Hwy 49 N Mariposa, CA 95338 Sandfort Joe 1203 SE Malden St Portland, OR 97202-5935 Sandfort Rebecca F 1111 E Apache Blvd Tempe, AZ 85281-8600 Sandfort Rick 850 Kimball Rd Red Bluff, CA 96080-4533 Sandfort Robert & Marian 8575 Rue Jenny Ln Los Molinos, CA 96055-9729 Sandfort Robert Jr & Joann 859 Locust St Red Bluff, CA 96080-4218 Sandfort Astrid 3 Channing Cir Cambridge, MA 02138-4715 Sandfort D 640 Sfourth Ave Pleasantville, NJ 08232 Sandfort E 2641 Ridge Ave Pleasantville, NJ 08233 Sandfort Ed & Donna 15 Kristin Way Trenton, NJ 08690-2441 Sandfort Edward 8 Sixpence Ct Huntington, NY 11743-6436 Sandfort G B 187 E 7th St Clifton, NJ 07011-1739 Sandfort John 19 Sanfort Ln Warwick, NY 10990-3136 Sandfort K 10 Annette Dr Portsmouth, RI 02871-3704 Sandfort Karl Spencer Rd Red Hook, NY 12571 Sandfort Peter & Sandr 9 Peach Hill Ct Ramsey, NJ 07446-1226 Sandfort Phil P 3907 Rippleton Rd Cazenovia, NY 13035-9602 Sandfort R 481 Smithburg Ct Jackson, NJ 08527-4444 Sandfort Sherri 434 W 52nd St New York, NY 10019-6340 Sandfort Thomas D 1819 Beach Blvd Point Pleasant, NJ 08742-5218 Sandfort A 235 Larry St Augusta, KS 67010-1906 Sandfort Brad Catrock Rd Lake Ozark, MO 65049 Sandfort Brian 1215 11th St West Des Moines, IA 50265-2574 Sandfort Charles RR 3 Humboldt, NE 68376-9803 Sandfort David G 3610 W Clay St Saint Charles, MO 63301-4433 Sandfort David G Cpa 3660 W Clay St Saint Charles, MO 63301-4433 Sandfort David L 820 Timberwood Cir Mc Kinney, TX 75069-9183 Sandfort Ed Rm 307 1043 10th Humboldt, NE 68376 Sandfort Edward L 4436 Windsor Ave Kansas City, MO 64123-1736 Sandfort Fred F 1655 S Grorgetown Wichita, KS 67208 Sandfort G 133 Kunze Dr Saint Charles, MO 63303-5928 Sandfort G H 9802 NW Shaggy Bark Ln Kansas City, MO 64152-2560 Sandfort Gerhard 1813 S Washington St Casper, WY 82601-4853 Sandfort Gerhard Jr & Melanie 1500 W Odell Ave Casper, WY 82604-4708 Sandfort Harold & Jackie RR 2 Box 209a Fremont, NE 68025-9696 Sandfort Howser RR 3 Eldon, MO 65026-9803 Sandfort Irvin J 3614 W Clay St Saint Charles, MO 63301-4433 Sandfort J 3229 Herrington Dr Casper, WY 82604-5421 Sandfort James 844 Hollyridge Dr Ballwin, MO 63011-3552 Sandfort Jane L 6009 Sandhurst Ln Dallas, TX 75206-4730 Sandfort John R 214 Columbia St Augusta, KS 67010-1535 Sandfort Kay 1024 S Spruce St Casper, WY 82601-3621 Sandfort Keith 1315 East Ave Holdrege, NE 68949-1323 Sandfort Larry 3034 W State St Springfield, MO 65802-5168 Sandfort Leland K Catrock Rd Lake Ozark, MO 65049 Sandfort Loyd 108 W Brockman Ave Eldon, MO 65026-2206 Sandfort Melvin 114 N Benton Ave Saint Charles, MO 63301-2708 Sandfort Michael 844 Judson St Lincoln, NE 68521-2633 Sandfort Michael RR 1 Talmage, NE 68448-9801 Sandfort Neil 623 N 6th St Seward, NE 68434-1405 Sandfort Robert RR 1 Brock, NE 68320-9801 Sandfort Robert M 3612 W Clay St Saint Charles, MO 63301-4433 Sandfort Roger RR 3 Eldon, MO 65026-9803 Sandfort Ross 303 9th Brock, NE 68320 Sandfort S C Rt 1 Box 145-Dd Augusta, KS 67010 Sandfort Sara 202 Manor Dr Eldon, MO 65026-9678 Sandfort Waldo D 2150 Randolph St Saint Charles, MO 63301-0844 Sandfort Wayne W 6969 Brentwood Ct Arvada, CO 80004-1900 Sandfort Wm PO Box 1393 Lake Ozark, MO 65049-1393 Sandfort Eva Rl Est 901 S Pine St Spartanburg, SC 29302-3310 Sandfort Eva Rlest 901 S Pine St Spartanburg, SC 29302-3310 Sandfort F 108 Thistle Knoll Ct Asheville, NC 28803-2014 Sandfort John P 209 Woodgrove Trce Spartanburg, SC 29301-6431 Sandfort John W 6540 Greyledge Ct Alexandria, VA 22310-2410 Sandfort Mark R Oakdale, PA 15071 Sandfort Marni 2140 L St NW Washington, DC 20037-1510 Sandfort Raymond Warren Center, PA 18851 Sandfort Ruth A 111 Jonthnct Oakdale, PA 15071 Sandfort Sarah 114 Maury Ave Charlottesville, VA 22903-3058 Sandfort Clarence 1016 Highway 63 Baldwin, WI 54002 Sandfort Daryl L 12676 W Hart St Waukegan, IL 60087-1122 Sandfort David J 14 Wintergreen Ct Downers Grove, IL 60517-1713 Sandfort E F 2400 S Finley Rd Lombard, IL 60148-7029 Sandfort Gary 340 N Plum St Carlinville, IL 62626-1316 Sandfort George 1380 Maple St Baldwin, WI 54002-9395 Sandfort J 300 3rd St Ann Arbor, MI 48103-4307 Sandfort J 6947 N Elm Tree Rd Milwaukee, WI 53217-3705 Sandfort James 34217 N Stonebrdg Ln Grayslake, IL 60030 Sandfort James 314 Oakridge Dr N Hudson, WI 54016-1117 Sandfort John 3101 N 13th St Terre Haute, IN 47804-1233 Sandfort John P 3149 N Mountain Maple Ct South Bend, IN 46628-3716 Sandfort Larry 8225 Knox Ave S Minneapolis, MN 55431-1413 Sandfort M Thos 2034 Chandler Ln Columbus, IN 47203-4015 Sandfort Melissa 910 Lake St Evanston, IL 60201-4319 Sandfort Melissa 706 Seward St Evanston, IL 60202-2946 Sandfort Mike 7394 Christie Chapel Rd Dublin, OH 43017-2415 Sandfort R W 275 E Dunedin Rd Columbus, OH 43214-3803 Sandfort Ronald G 602 21st Ave W Menomonie, WI 54751-3825 Sandfort Stephen 607 Washington Blvd Oak Park, IL 60302-3954 Sandfort Stephen & Rebecca 218 Second Sheb Fls Sheboygan Falls, WI 53085 Sandfort Steve 2654 Briarcliffe Ave Cincinnati, OH 45212-1306 Sandfort A M 2903 Nepperhan Rd Louisville, KY 40218-4715 Sandfort Christopher 10209 Barkley Dr Jeffersontown, KY 40299-3120 Sandfort Federick H 2495 Paddock Way Oviedo, FL 32765-8067 Sandfort Greg 1125 Carpenters Trce Covington, KY 41017-4416 Sandfort J 1550 NE 191st St Miami, FL 33179-4145 Sandfort Jeff 132 Landing Cir Hazel Green, AL 35750-8807 Sandfort John F 11 Estes Dr Bella Vista, AR 72714-5613 Sandfort Joseph & Lynn 311 Castle Blvd Paris, KY 40361-2455 Sandfort M 14191 Georgian Cir Fort Myers, FL 33912-5646 Sandfort Michael & Deb 457 Sun Lake Cir Lake Mary, FL 32746-3332 Sandfort Phillip L 4623 Soundside Dr Gulf Breeze, FL 32561-9275 Sandfort Road Assembly Of God 205 26th Ct Phenix City, AL 36869-6463 Sandfort Scott & Robyn 401 E Intendencia St Pensacola, FL 32501-6139 Sandfort Tad Rev 8304 Quail Run Dr Zephyrhills, FL 33544-2048 Sandfort Terry N 1680 NE 191st St Miami, FL 33179-4102 Sandfort Weldon W 407 Rock St Dardanelle, AR 72834-3402 This took about a minute using a shabby consumer-level DB. *Now* do you get it? Hieronymous -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMNEPY73g0mNE55u1AQGE7AH/VmrgEKI1cf3QoF3sR+tUqjOsbp/5OgOd nFhuSPro8+W2wJIdNcQ8n4oyo1ecm6UCN90HUBycie5Xh5c4Zebc+A== =WWU1 -----END PGP SIGNATURE-----

2 1

Re: Fwd: Corporate Crime and CDT Funding on behalf of so-called medical privacy
by clarkm＠cnct.com 17 Dec '03

17 Dec '03

Thanks (belatedly) for posting this, Russell. Who was it said, "Follow the money." Great stuff. For a good time, call the EFF about these folks. For a better time, call the ACLU. It might be hilarious to make some inquiries around Stanford... Maybe Rich Graves can give us the poop. Best, Clark Probably time someone wrote an expose of industry and cryptocrats "hacking" public policy groups. Wonder where one could PLAGIARIZE such tidbits? ;-) (apologies -- "plagiarize" is an inside joke for the filterslugs ;-) //--- forwarded letter --------------------------------------- > MIME-Version: 1.0 > Date: Tue, 21 Nov 95 12:01:10 -0500 > From: JWRCLUM(a)aol.com > To: cypherpunks(a)toad.com > Subject: Fwd: Corporate Crime and CDT Funding on behalf of so-called medical privacy > The following article appeared in the current issue of > Corporate Crime Reporter (Volume 9, Number 44, November 20, 1995, > page one). It is redisseminated on the Internet with the > permission of CCR. > > SELF-PROCLAIMED "PUBLIC INTEREST" GROUP HEAVILY FUNDED BY > COMPUTER, TELECOMMUNICATIONS, DATABANK CORPORATIONS THAT WOULD > BENEFIT FROM "MEDICAL PRIVACY" LEGISLATION GROUP SUPPORTS -- > EQUIFAX, TRW, DUNN & BRADSTREET IN THE MIX > > The Center for Democracy & Technology (CDT), a self- > proclaimed "public interest organization," is in fact heavily > funded by large private computer, telecommunications, and > databank corporations. > Funders of CDT, a two-year old Washington, D.C.-based > advocacy organization, include Dunn & Bradstreet Corp., Equifax > Inc., and TRW Information Services, three large databank > corporations that stand to benefit from federal legislation CDT > actively helped shaped and is shepherding through Congress. > This year, CDT has received $699,643 from more than 30 large > corporations, including $100,000 from Microsoft, $75,000 from > AT&T, $60,000 from Bell Atlantic, $50,000 from Apple Computer, > $25,000 from IBM, $10,000 from TRW Information Services, $10,000 > from Dunn & Bradstreet, $5,000 from Direct Marketing Association, > and $5,000 from Equifax Inc. (For a complete list of CDT's > funders, see At A Glance, page 16) > At a hearing before the Senate Labor and Human Resources > Committee last week, CDT deputy director Janlori Goldman said > that CDT "strongly supports" legislation, S. 1360, sponsored by > Senators Robert Bennett (R-Utah) and Patrick Leahy (D-Vermont), > because it represents "the most comprehensive and strong privacy > bill the Congress has yet considered in this area." > But opponents of the bill argue that the legislation is not > a privacy statute at all, but instead is a vehicle that would > legitimize the creation of large computerized databanks of > personal medical information, thus benefitting those companies > like TRW and Equifax that give financial support to CDT. The > legislation would allow for broad, unauthorized searches of those > databanks, opponents claim. > In an interview, Goldman told Corporate Crime Reporter that > all of CDT's corporate funding is earmarked for other projects > and that none of the corporate funding is supporting her work on > the medical privacy bill. > "The corporate funding is not related at all, in any way > shape or form to my work on this bill," Goldman said. "The reason > we are doing this bill is that I've worked on privacy issues for > a decade. The most important privacy issue to work on is the > passage of the medical records privacy legislation. That is a > very sincere issue for me." > "None of the corporate support that CDT gets is related to > my work on this bill," Goldman emphasized. "None. Zippo." > CDT's executive director, Jerry Berman agreed. "We have no > funding for the medical privacy project -- zero," Berman said. > But critics of the CDT's position on the legislation were > skeptical. > "During the Senate hearing this week, Senator Bennett was > angered at the suggestion that S. 1360 was an industry bill," > said Jamie Love of Ralph Nader's Center for Study of Responsive > Law. "He claimed that he had widely consulted with privacy groups > and patient advocates. CDT's Janlori Goldman was the key person > who decided who was in the loop, and who was not in the loop on > this issue. Groups that were not receptive to the idea of massive > database systems of personal medical records were excluded from > deliberations." > "To find out that CDT has been funded by companies such as > Equifax, TRW, Dunn & Bradstreet, IBM and the telephone companies > is remarkable, because these are among the groups who have the > most at stake in legitimizing and preserving the current system > of maintaining and managing medical records," Love said. "I think > that Janlori Goldman should have mentioned in her Senate > testimony that CDT was funded by corporations who have an > interest in this issue." > "If CDT were doing its job, TRW and Equifax wouldn't want to > give it money," Love added. > Harold Eist, president-elect of the American Psychiatric > Association, said that "any datagathering and large computer > company would clearly benefit from legislation that drives large > amounts of individually identified data about American citizens > into data banks without the knowledge and permission of those > American citizens." > "Selling that information would represent a gold mine for > those companies," Eist said. > "It is not surprising that an organization with a > disingenuous name -- Center for Democracy & Technology -- would > be supporting a bill with a disingenuous name -- The Medical > Records Confidentiality Act," Eist said. "In fact, this bill > represents an effort to give away the privacy of American > citizens without their knowledge." > "My understanding is that Janlori Goldman was involved in > writing the bill," Eist said. "It seems to me that as a former > civil libertarian, she should know very well that there are > loopholes in that bill regarding protections to privacy that you > could drive a Mack truck through." > "Unless people can be assured that their privacy will be > protected, there is little or no chance that they will reveal the > kind of tormented and dark secrets that they have to reveal to > recover from their illnesses," Eist said. "Confidentially is the > sine qua non of medical treatment, and especially if it is > psychiatric medical treatment." > A driving force behind the effort to derail the > Bennett/Leahy bill is Denise Nagel, a Boston physician who > organized the Coalition for Patient Rights of New England "to > restore confidentiality to the doctor-patient relationship." > Nagel refused to comment on CDT's funding. > At the Senate hearing last week, Nagel told the committee "I > have no industry ties." > Nagel charged that S. 1360 was written "to advance the > interests of certain segments of the computer, > telecommunications, data processing and health-care industries." > "With this bill they would be able to careen full speed > ahead to develop data networks that will give innumerable people > access to our medical records legally and without our knowledge," > Nagel said. > "I am convinced that S. 1360 is not at all primarily > concerned with the confidentiality of medical records," Nagel > told the committee. "It is just the opposite. It talks about > informed consent, but then authorizes the creation of databases > without patient knowledge or consent. It talks about individual > rights, and then allows police broad authority to search > databases directly instead of obtaining a specific record from > the patient's doctor. It talks about civil and criminal > sanctions, and then pre-empts all common law and most existing > and future state statutes. It talks about ensuring personal > privacy with respect to medical records, and then sets a ceiling > rather than a floor on medical confidentiality." > > AT A GLANCE: CENTER FOR DEMOCRACY AND TECHNOLOGY FUNDING, 1994- > 1995 > > American Advertising Federation 500.00 > America Online, Inc. 25,000.00 > Apple Computer Inc. 50,000.00 > AT&T 75,000.00 > Bell Atlantic 60,000.00 > Business Software Alliance 6,000.00 > Cellular Tellecomm Indust Assn 10,000.00 > CompuServ 30,000.00 > Delphi Internet Services Corp 10,000.00 > Direct Marketing Association 5,000.00 > Dunn & Bradstreet Corp 10,000.00 > EMA 5,000.00 > Equifax Inc. 5,000.00 > John Gilmore 2,500.00 > Hartford Foundation 153,000.00 > IBM 25,000.00 > Information Technology Industry 5,000.00 > Interactive Digital Software 5,000.00 > Lotus 6,250.00 > MARC 80,000.00 > MCI Telecommunications 15,000.00 > Microsoft 100,000.00 > National Cable Television Assn 15,000.00 > Netscape Communications Corp 5,000.00 > Newspaper Association of Am 5,000.00 > Nynex Government Affairs 25,000.00 > Pacific Telesis 25,000.00 > Prodigy Service Company 10,000.00 > Software Publishers Assn 10,000.00 > Time Warner Inc 5,000.00 > TRW Information Svcs 10,000.00 > US Telephone Association 10,000.00 > US West Inc 10,000.00 > > Total Funding 814,020.00 > > Received 1994 114,377.00 > Received 1995 699,643.00 > > Total Funding 814,020.00 > > > > Russell Mokhiber > russell(a)essential.org > voice: 202/429-6928 > [big birdie follows] .---. .----------- * :::::::::::::::::::::::::::: / \ __ / ------ * clark.matthews(a)paranet.org / / \(..)/ ----- * :::::::::::::::::::::::::::: ////// ' \/ ` ---- * //// / // : : --- * PERMISSION TO \\/ / * / /` '--* COPY / REPOST \*/ * //..\\ x-x-UU----UUx-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x '//||\\` N E M O..M E..I M P U N E..L A C E S S I T x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x

4 3

"Strongly Voluntary" Key Escrow
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:18 PM 12/14/95, jim bell wrote: >I disagree. The issue is one that might be called "standing." Who, >exactly, is responsible to whom in such an arrangement. Let's suppose key >escrow (for keys for non-exported encryption devices) is REALLY VOLUNTARY. >In that case, the escrow agent's only legal responsibility is to the owner >of the encryption device. The government isn't a party to this voluntary >arrangement, and thus hasn't a complaint if the escrow agent refuses to comply. > >I could, for example, enter into a voluntary arrangement with an escrow >agent so that he would be obligated to erase the key no more nor less than 5 >days after he received it. If he did so 1 day after, and I needed the key, >he would have breached his obligation to ME, but not to the government. >Likewise, if he failed to erase the key, he would likewise be breaching his >agreement with me. I agree with this analysis. When key escrow was being debate in the summer of '94 here, I called this criterion the basis for a "strongly voluntary" system. Specifically, that one could have the bit bucket as an "escrow agent," with of course no retrieval by the government. Or one's lawyer, or one's spouse, or an offshore bank, and so on. All of these are "voluntary" key escrow (though I hate that misuse of the word "escrow") systems. None of them involve government certification, and there are few circumstances where I think "government certification" is even useful, let alone necessary. Any scheme in which the government interjects itself in what would not normally involve them can hardly be said to be strictly voluntary. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: OSF security announcement
by Rich Salz 17 Dec '03

17 Dec '03

There are two or three dce-web folks on this list, so if anyone has questions after reading the web pages (http://www.osf.org/www/dceweb) drop me a line or post. /r$

1 0

Re: mailing list
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

On 15 Dec 95 at 1:13, JerelRobertson wrote: > Hey I want to get on this list. How do I do it? There's a test, Jerel. You may retake it in three months. We

1 0

simple Unix CPU time quantization functions available
by Matt Blaze 17 Dec '03

17 Dec '03

I've made available a simple CPU time quantization package that provides a simple interface to encapsulate code blocks that must run in a multiple of a coarse-grained "quantized" amount of CPU time. It is useful in building various on-line cryptographic protocols in which an attacker could otherwise learn key information by observing the time the target takes to perform calculations that use the secret (c.f., Paul Kocher's recent attacks). The basic idea is that you can specify a "quantum" such that at the end of an encapsulated block the CPU will busy-wait until the next quantum multiple. Fine-grained (below the quantum) timing information is thereby denied to the observer (including unprivileged processes on the same machine). The code is quick-and-dirty and only runs on Unix-centric platforms. Test and use at your own risk. There are (basically) no restrictions on the use or distribution of the (very simple) code. Get it from: ftp://research.att.com/dist/mab/quantize.shar The quantize package is also part of Jack Lacy's cryptolib package (watch this space for details). -matt

1 0

Re: e-mail forwarding, for-pay remailers
by Duncan Frissell 17 Dec '03

17 Dec '03

At 01:20 PM 12/14/95 EDT, E. ALLEN SMITH wrote: > The more critical question is likely to be what the people at the local >MBE/whatever _think_ the rules are. When I last got a box (under my real name, >in case anyone's wondering), I seem to recall that they'd accept credit cards. >Once one has one box under a given name, this opens up the possibility of >getting a secured credit card to make future access easier. However, I believe >that they do want at least one form of photo ID; I can't remember just off what >their specifications were. > -Allen I have found that credit cards are very good ID (even though they aren't ID at all) since people are sure that you can't get one without getting thoroughly checked out. A secured credit card in a nome de guerre backed up with employment photo "ID" will usually get you what you want. The reason that market access controls like these break down is that they are dependent on every seller on earth giving up the profit involved in selling to you. Sellers are different. You can usually find one who doesn't check ID well or is in another jurisdiction (in the case of non physical transactions). A new effect is the spread of libertarian (small L) political ideologies which means that a growing group of market participants are philosophically opposed to traditional control regimes. Eg C2.ORG. A final problem for control freaks is that Friction Free Capitalism is eating away at the traditional market institutions that have grown up during the control era. Thus if traditional banking, telephony, and electricity distribution are wiped out by new forms of competitive business activity it is hard for regulatory agencies to extend their traditional controls to the new entities. Budget restraints play a part as does inertia. All of this is before the new market players deploy anti control technologies and procedures. They are in business because they can displace traditional quasi-monopoly institutions and often see government as just another competitor to be bypassed. DCF

1 0

Re: ADDRESS DATABASE? [getting noisy]
by Charles Gimon 17 Dec '03

17 Dec '03

Forwarded message: [Sandfort summer picnic invitation list deleted] > > > This took about a minute using a shabby consumer-level DB. > *Now* do you get it? > > > Hieronymous > Well, "information wants to be free", and all that stuff...

1 0

Re: Secured RM ? (source)
by jps＠monad.semcor.com 17 Dec '03

17 Dec '03

I don't think this will work. When you > if ( (Pfp = fopen(Pfilename, "wb") ) == NULL) the file will be truncated. Subsequent writes could be anywhere on the platter; you're building a new file. I think you can work this way if you open the file for read/write access, although I'd be more inclined to take the file name into the directory and then walk the inodes. jps -- Jack P. Starrantino (215) 674-0200 (voice) SEMCOR, Inc. (215) 443-0474 (fax) 65 West Street Road jps(a)semcor.com Suite C-100 Warminster, PA 18974

3 2

Re: "Strongly Voluntary" Key Escrow
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim wrote: <snip> >All of these are "voluntary" key escrow (though I hate that misuse of the >word "escrow") [...] I do too, and I hate it enough that I must (again) object to any use of it where there is not a _NEUTRAL_, _THIRD_ party involved, as explained before on the list (at length) by me, James A. Donald, and many others. [So, why are you *again* consuming bandwidth on this subject, Jim?] Because I love the English language, and because I am quite aware that those who define the terms end up winning the debate, every time. I do not want the word "escrow" in a key context to go the way of the word "voluntary" in an income-tax context (or the word "take" in an enviro- law context). The government has snaked in a Newspeak meaning for the latter two terms, but I hope that cypherpunks will only use the term "GAK" when talking to or about the government. Failure to do so will not only put "our side" in a worse public-relations position, it may (in the future) do violence to the English language. While I enjoyed Tim & Uni's "voluntary" sarcasm, I think we have enough material for *ample* humor without adding even more words to the Newspeak roll. <snip> >there are few circumstances where I think "government certification" "Government Key Certification" might be an OK compromise-term compared to "key escrow," but we should [IMNSHO] continue to stick to "GAK." As you know, I prefered the term "FUCKED," but now we must be "decent" in our communications. <sigh> >is even useful, let alone necessary. I can think of only two, but perhaps there are others: 1. Government employees (but only while working on government time). 2. Convicted felons (I wouldn't include the failed drugwar's felons). >Any scheme in which the government interjects itself in what would not >normally involve them can hardly be said to be strictly voluntary. Indeed, but we have already "lost" the word "voluntary" to Newspeak, which is why it's necessary to qualify it with words like "strictly" and "strongly." JMR - ---------------------------------------------------------------------- Regards, Jim Ray http://www.shopmiami.com/prs/jimray "Thank God we don't get all the government we pay for." -- Will Rogers [Said back when we paid for (and got) a _lot_ less government.] - ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Public Key id. # E9BD6D35 <liberty(a)gate.net> IANAL - ----------------------------------------------------------------------- Help Phil! e-mail zldf(a)clark.net or http://www.netresponse.com/zldf _______________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMNF6U21lp8bpvW01AQGhXwP/ZDmtjY77AnAnnmddpd/rX93E4nGm7JBg 8KXyM7TGiiifpPfLRLJR3LncS0OE7V6CIcaq6zSox+qK97SfNZJhwP+GUIMegChJ WiqIaU5el2x6n0KeD/Km4loXMah6o4q4RJyVyo/M3uLlvYsBUyi9i4MQHy6fHpdU BSBnPIz0j0w= =9K29 -----END PGP SIGNATURE-----

1 0

Re: Blinding against Kocher's timing at
by ljo＠ausys.se 17 Dec '03

17 Dec '03

Hal <hfinney(a)shell.portal.com> wrote: >From: ljo(a)ausys.se (Johansson Lars) >> Does anyone know whether David Chaum's patent on >> blind digital signatures extends to this application? [Parts omitted] >It's conceivable that Kocher's blinding would be a patentable technique >in itself, and not impossible that he has already applied for a patent >before publishing. Probably he would have said so if that were his >intention, though. I just found this at RSA:s <http://www.rsa.com/rsaqa.htm> home page: >Q: Has RSA been "broken"? > > A: No. The attack that Paul Kocher describes is academically interesting, but it is >easy to defend systems against his attack using a technique called > "blinding", developed by Dr. Ron Rivest of RSA. ^^^^^^^^^^^^^^^^^^^^^^^^^ When did Dr. Rivest develop this "blinding" technique? Was it pre or post Chaum? Perhaps Rivest himself have applied for this patent. More info from RSA:s home page: > Another way is to use a technique called "blinding", in which a random number > is introduced into the decryption process, making it impossible to get any useful >data out of timing these transactions. > >so instead of doing the usual RSA decryption: > > m = c^d mod n > >we perform: > > m = r^-1*(c*r^e)^d mod n > >where r is a random number, and is its inverse. /Lars

1 0

Re: kocher's timing attack
by Hal 17 Dec '03

17 Dec '03

From: dreschs(a)austnsc.tandem.com (Sten Drescher) > On Firewalls, "Jonathan M. Bresler" <jmb(a)FreeBSD.ORG> said: > JMB> After > JMB> several large key signing parties hundreds of known ciphertexts > JMB> could have been generated using Alice's key--each one a public key > JMB> of someone else. over several years it piles up. the known > JMB> ciphertexts can be tested/analyzed to yield Alice's secret key. > JMB> ouch. ;/ > > Are you sure about this? It would seem that the same principle > would then apply to signed messages as well, and I find it a bit hard to > believe that signing messages would make ones key pair vulnerable. As Kocher's paper implies, the known ciphertext attack is a TIMING attack. Simply accumulating known text/signature pairs as you would have after a "key signing party" does not help. You must know exactly how much time each signature took. Hal

2 1

Re: Kocher's RSA attack
by Hal 17 Dec '03

17 Dec '03

From: Derek Atkins <warlord(a)MIT.EDU> > I must disagree, software implementations of RSA can and probably do > allow the timing attacks. It all depends on the modexp implementation. > Most implementations that I know of, when performing an x^y mod n will > require a squarings and b multiplies, where a is the number of bits in > y and b is the number of 1-bits in y. This is not enough - Paul Kocher's attack depends on the individual modular multiplies taking different times. (Actually, that is for his attack on Diffie Hellman. The RSA CRT decryption attack uses a completely different principle, but I guess we are ignoring that for now.) The fact that timing a modular exponentiation would give information about the density of 1 bits in the exponent is not particularly new or surprising, as has been mentioned here. What is new is that you can actually figure out the specific exponent value. But that requires variable-timing modmult, not just variable-timing modexp. PGP is somewhat unique in having a multiplicity of modmult algorithms which can be selected at compile time. I am not sure which of these might be variable time and which might be fixed. The most likely place for time variation IMO is in the modular reduction rather than the multiply; the multiply is generally deterministic with no variation due to data values (although as was pointed out here, on some processors a hardware multiply instruction may take variable time depending on its inputs). Some modular reductions involve trial division to some extent or other, with different numbers of iterations possible depending on certain (maybe unusual) values. However I believe at least one of the PGP modular reductions consists of multiplying by the reciprocal of the modulus, followed by a fixed shift, and this one should be constant time on a machine which has constant-time multiplies and shifts. (This is just going from memory, I haven't looked at the algorithm in several years.) Hal

1 0

DCSB: Future Scenarios for e$
by rah＠shipwright.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston (Formerly The Boston Society for Digital Commerce) Presents Art Hutchinson and John Kelly Northeast Consulting Resources Inc., (NCRI) "Future Scenarios for e$" Tuesday, January 2, 1995 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Mr. Hutchinson is a Senior Consultant at Northeast Consulting Resources, Inc. (NCRI). His primary area of focus is NCRI's Information Commerce practice. He has advised clients on the application of different approaches to, and technologies for managing (and getting paid for) digital intellectual property on the Internet, the World Wide Web, and private/hybrid networks. Mr. Hutchinson is an active member of the Electronic Rights Management Group of the Information Industry Association, and a founding member of the Digital Commerce Society of Boston. He speaks regularly at conferences on the topic of rights management in cyberspace He is a principal contributor to NCRI's Future Mapping(r) conferences, including "The Future of Information Commerce" and "The Great Infrastructure Debate"(r). Prior to joining NCRI, Mr. Hutchinson was Director of Consulting Services at BIS Strategic Decisions. Prior to BIS, Mr. Hutchinson managed the Distribution Channels Information Service at International Data Corp. (IDC). Mr. Kelly, a Senior Consultant at Northeast Consulting Resources, Inc. (NCRI), has specialized in designing group planning and decision making activities that help teams clarify their strategic options. He also analyzes new applications in multimedia training and groupware. He is one of the leaders of the Mapping the Future of Information Commerce seminars. Mr. Kelly has led seminars on strategic planning and Future Mapping for a large international oil company, a Fortune 100 diversified manufacturing company, a leading computer hardware and systems company, and numerous software and telecommunications companies. He has contributed to the development of databases of critical events that help companies chart their future business opportunities in the areas of computing, communications, and interactive multimedia. Before joining NCRI, Mr. Kelly served as an Associate Editor and consultant for the Seybold Office Computing Group. Mr. Kelly also worked for the Information Systems Group at Lotus Development Corporation and was the Director of Interactive Technology Projects at the WGBH Educational Foundation. Prior to that, Mr. Kelly was Manager of the Seminar Division at Information Mapping, Inc. and later served as a consultant to IMI. Art says: >Art Hutchinson and John Kelly of Northeast Consulting Resources, Inc. (NCRI) >will facilitate an interactive exercise that helps to paint a picture of the >group's collective thinking about future events and milestones >in the development of electronic commerce. Specifically, we will be culling >through the last year of posts to www-buyinfo, e-payment, and various other >mailing lists, as well as our own database of 17,000 "events" used in >previous scenario planning conferences. From this, we will be create a set >of about 40 potential future events which - depending upon whether they >happen or not - will drive the digital commerce arena in varying directions. > > >Everyone at the lunch will be given an opportunity to 'vote' on and discuss >with their peers the likelihood (or un-likelihood) of these events happening >within a particular time frame. After the 'voting', we will lead a >discussion of what the results might mean, and how some things that this >group believes correspond to what other corporate and industry groups have >said in the recent past in voting on some of the same events. Suggestions >for controversial, interesting, watershed events that might happen in the >digital commerce arena over the next 3-5 years are welcome. Please e-mail >them directly to Art Hutchinson at <hutchinson(a)ncri.com> This meeting of the Boston Society for Digital Commerce will be held on Tuesday, January 2, 1995 from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, One Federal Street. The price for lunch is $27.50. This price includes lunch, room rental, and the speaker's lunch. ;-). The Harvard Club *does* have a jacket and tie dress code. We need to receive a company check, or money order, (or if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, December 30 (that's two weeks from this Saturday), or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, c/o The Shipwright Development Corporation, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they must be made payable to "The Harvard Club of Boston". If anyone has questions, or has a problem with these arrangements (We've had to work with a few glacial A/P departments ourselves, for instance), please let us know via e-mail, and we'll see if we can work something out. Planned speakers for the following few months are: February Fred Hapgood Freelance Author March Glenda Barnes X.9 Electronic Commerce Security Group April Donald Eastlake CyberCash May Perry Metzger Security Consultant and Cypherpunk June Dan Shutzer FSTC We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, rah(a)shipwright.com . For more information about the Boston Society for Digital Commerce, send "info dcsb" in the body of a message to majordomo(a)ai.mit.edu . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to majordomo(a)ai.mit.edu . Looking forward to seeing you there! Cheers, Bob Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMNGdJPgyLN8bw6ZVAQGSgQP/Q5PfwoevxNRBaC1B6dUaIDl07bhGTpSm v9pYx3kuHTEc0Mei3Zzxj4G/yaSGFHoOuz8rslxsKBIrsLeB0Xc7gehs8OjgXsuU fcR6gvT4mlY9Mvs8E9MaeTlTlHAz5R38g1lv1ST4Xti7kBQ4l9EEErTjPOM4oHy/ 6kglzZsCSM4= =QJbV -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/ >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Web O Trust, active attacks against same, etc. AGAIN. (was: Usability of Cryptography (was Re: More FUD from First Virtual) )
by James A. Donald 17 Dec '03

17 Dec '03

At 01:39 PM 12/13/95 -0700, Bryce wrote: > >-----BEGIN PGP SIGNED MESSAGE----- > > An entity calling itself "James A. Donald" <jamesd(a)echeque.com> >allegedly wrote: >> >> Web of trust is a mess because it attempts to link keys to >> physical people, which in general cannot be done. > ******************************* > > >Do you wish to substantiate this rather brazen assertion? >I am very sure that PGP public key 0xCC56B2E9 belongs to my >housemate Sebastian Kuzminsky <kuzminsk(a)colorado.edu>. Is >there some reason why I should doubt this belief? No, but there is some reason you should gain familiarity with the english language If I had intended to say "generally cannot be done" I would have said "generally cannot be done" instead of saying "in general cannot be done" --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: [NOISE] The Enquirer
by blancw＠accessone.com 17 Dec '03

17 Dec '03

Now, THAT's what I call "The News Update". This is the kind of encapsulated [NOISE] we could all stand to hear! ha-ha-ha .. Blanc

1 0

Re: e-mail forwarding, for-pay remailers
by Martin Diehl 17 Dec '03

17 Dec '03

Obviously, we need a certificate authority that will digitally sign personal identification documents (Name, address, photo (digitized), date of birth, etc.) Martin G. Diehl ______________________________ Forward Header __________________________________ Subject: Re: e-mail forwarding, for-pay remailers Author: "E. ALLEN SMITH" <EALLENSMITH(a)mbcl.rutgers.edu> at Internet-USA Date: 12/13/95 5:33 PM From: IN%"gbroiles(a)darkwing.uoregon.edu" "Greg Broiles" 13-DEC-1995 03:40:50.49 >I don't have much faith that the people who are currently doing the DNS for my domain name (goldenbear.com) are going to do anything about the current bouncing-messages phenomenon anytime soon, so I'm looking into other ways to get & send E-mail [snip] netbox.com ( http://www.netbox.com ) provides web pages and E-mail storage or forwarding for people; [snip] There's one problem with this in regards to the "no necessary connection," and that 's the governmental requirement for mail forwarding. MBE and any legal other one will want to see at least two forms of ID including one photo, and have a form that they fill out using that and send to the local post office. Anyone have a way around this problem? -Allen The following is an attached File item from cc:Mail. It contains information that had to be encoded to ensure successful transmission through various mail systems. To decode the file use the UUDECODE program. --------------------------------- Cut Here --------------------------------- begin 644 RFC822.TXT M4F5C96EV960Z(&9R;VT@9V%T93$N9'1T=7,N8V]M(&)Y(&-C,BYD='1U<RYC M;VT@*%--5%!,24Y+(%8R+C$Q(%!R95)E;&5A<V4@-"D-"B`@("`[(%=E9"P@ M,3,@1&5C(#DU(#$W.C,S.C0W($-35`T*4F5T=7)N+5!A=&@Z(#QO=VYE<BUC M>7!H97)P=6YK<T!T;V%D+F-O;3X-"E)E8V5I=F5D.B!F<F]M(')E;&%Y,RY5 M52Y.150@8GD@9V%T93$N9'1T=7,N8V]M("@U+G@O4TU)+5-64C0I#0H@("`@ M:60@04$Q,3`P.3L@5V5D+"`Q,R!$96,@,3DY-2`Q-SHS,#HU-R`M,#8P,`T* M4F5C96EV960Z(&9R;VT@=&]A9"YC;VT@8GD@<F5L87DS+E55+DY%5"!W:71H M(%--5%`@#0H@("`@:60@45%Z='IO,#$W.#@[(%=E9"P@,3,@1&5C(#$Y.34@ M,3@Z,3,Z-30@+3`U,#`@*$535"D-"E)E8V5I=F5D.B!B>2!T;V%D+F-O;2!I M9"!!03$R,#(Y.R!7960L(#$S($1E8R`Y-2`Q,SHR,SHS,2!04U0-"E)E8V5I M=F5D.B!F<F]M($]#14Q/5"Y2551'15)3+D5$52!B>2!T;V%D+F-O;2!I9"!! M03$R,#$R.R!7960L(#$S($1E8R`Y-2`Q,SHR,SHR,2!04U0-"E)E8V5I=F5D M.B!F<F]M(&UB8VPN<G5T9V5R<RYE9'4@8GD@;6)C;"YR=71G97)S+F5D=2`H M4$U$1B`C,3(Q.30I(&ED#0H@/#`Q2%E22E-54T9,4SA9-%HS1T!M8F-L+G)U M=&=E<G,N961U/CL@5V5D+"`Q,R!$96,(a),3DY-2`Q-CHQ.2!%1%0-"D1A=&4Z M(%=E9"P@,3,@1&5C(#$Y.34@,38Z,3D@1414#0I&<F]M.B`B12X@04Q,14X@ M4TU)5$@B(#Q%04Q,14Y334E42$!M8F-L+G)U=&=E<G,N961U/@T*4W5B:F5C M=#H@4F4Z(&4M;6%I;"!F;W)W87)D:6YG+"!F;W(M<&%Y(')E;6%I;&5R<PT* M5&\Z(&=B<F]I;&5S0&1A<FMW:6YG+G5O<F5G;VXN961U#0I#8SH@8WEP:&5R M<'5N:W-`=&]A9"YC;VT-"DUE<W-A9V4M260Z(#PP,4A94DI355-&3%,X631: M,T=`;6)C;"YR=71G97)S+F5D=3X-"E@M16YV96QO<&4M5&\Z(&-Y<&AE<G!U M;FMS0'1O860N8V]M#0I8+59M<RU4;SH@24XE(F=B<F]I;&5S0&1A<FMW:6YG M+G5O<F5G;VXN961U(@T*6"U6;7,M0V,Z($E.)2)C>7!H97)P=6YK<T!T;V%D M+F-O;2(-"E-E;F1E<CH@;W=N97(M8WEP:&5R<'5N:W-`=&]A9"YC;VT-"E!R 096-E9&5N8V4Z(&)U;&L-"@`` end

1 0

Re: PAY-OFF TIME FOR BUG-BUSTERS, NETSCAPE PLEDGES "DOGFIGHT"
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Mon, 11 Dec 1995, Michael Coates wrote: > PAY-OFF TIME FOR BUG-BUSTERS, NETSCAPE PLEDGES "DOGFIGHT" > Netscape Communications has awarded two software sleuths $1,000 each for > finding security gaps in its Netscape Navigator 2.0 software. The company > also awarded gifts to 50 other contestants in its "Bugs Bounty" program for > identifying non-security problems. (Wall Street Journal 11 Dec 95 B7) Can anyone tell me whether Ian Goldberg and David Wagner got their $25,000 from Netscape for finding the HUGE security flaws in Netscape's existing product line?? I can't remember whether they got anything or not ... (Sorry, but I've been away from the list. One of those, "fate of the Free World hangs in the balance" thingies ... ;-) Have Netscape and AT&T shown some holiday goodwill, or are they still engaged in their felonious freeloading foolishness? Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Re: And the standard continues to lower...
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 15 Dec 1995, Peter Trei wrote: > This guy's home page is a hoot - he's into UFO contacts and dolphin > communication. > > After writing to him and getting back a description of his system, it's > clear that he's clueless. He seems to think that info sent to a vendor > using his system can't be sorted out from the gazillion other packets > on the Net. > > I described to him sniffer attacks, subverted routers, etal, and > reccomended some basic reading (Cheswick & Bellovin, Is this the two partners in crime from AT&T?? Cheswick & Bellovin?? I think that they're probably not all that reputable (or knowledgable) from what I've seen of their writings and contributions to the AT&T DSRP (Data Security Response Program) mailing list. (If they are the same people, I mean ...) > Kaufmann, Perlman, & Speciner, and Schneier). He said he'd > look into it. (Yes, I know there's plenty of other attacks, such as > OSPF spoofing, but I didn't describe them). > > I think we can educate this guy. Plenty of educating can probably be done, I think. Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Encrypted telnet...
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

I am looking for an encrypted telnet (or rlogin/etc) package that supports a Windoze client. It looks like all the normal ones that I can find (SSH, SRA telnet, SSLtelnet, etc) are just under Unixoids. Don't get me wrong - I would prefer to use Unix, but I am headed off to locations, where I know all I'll have access to is Windows, with a PPP stack to some ISP. I'ld write it myself, - pasteing different packages together, but I need it working in a day or two. Can anyone help me here? Thanks, Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

3 2

Re: ADDRESS DATABASE?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sandfort-8802 unit: >> This took about a minute using a shabby consumer-level DB. >> *Now* do you get it? ^^^^^^^^^^^^^^^^^^^^^^^^ > > hint hint hint hint < >Nope. MY name isn't on your list. In addition, my home phone >number is unlisted--therefore contracturally unavailable for >resale. *Now* do you get it? It's kind of cool how much faith you have in the idea that your number is unlisted, considering the fact that you started this thread by griping that someone had the goods on you. The reason you were "taken aback" is because your beliefs don't correspond to reality -- "cognitive dissonance," in the lingo. H -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMNHGg73g0mNE55u1AQEfcwH9HPcXAyMQPv9ZNQ2MxvBHfTtsIfqw15zG n7S7yppwR2AsayZgSZQFIDoee0tLRBqEvPFhxNqnOiPCht5PK01YGA== =gIKw -----END PGP SIGNATURE-----

2 1