December 2003 - cypherpunks-legacy

PRNG in VB
by Jerry Whiting 17 Dec '03

17 Dec '03

I am answering the courteous inquiry from Thomas Womack about my request for help with a Visual Basic-only PRNG. The premise is that those who will not or can not afford hardware-based RNG's need something relatively secure in the face of nothing at all or at best a lesser implementation. I was reluctant to post code at first but rather asked for an interpretation of 10 runs of 9999 characters each. I want peer review of source code but the threads in CypherPunks have been of a shall we say "low signal to noise" ratio of late. Even more so than usual. I just didn't want to feed the beast at this time. That said, here's the outline of what I'm doing. A splash screen loads first displaying a random tip'o'the day about good key management. I make use of the getcurrenttime() Win API a lot. Said to have 50 millicent increments. ' Load splash screen first Sub Form_Load () ' first randomize using number of milliseconds since Windows was launched Randomize getcurrenttime() ' then rotate the tip'o'the day (30 currently, adding unknown some delay) For j = 1 To Int(n * Rnd + 1) Select Case j Case 1 hint.Caption = "You passphrase is SUPPOSED to look like gibberish." ... Case n hint.Caption = "Change your passphrases often." End Select Next j End Sub ' user clicks an OK button and up comes 2nd screen Sub Form_Load () ' mix things up Randomize getcurrenttime() End Sub ' main screen's OK button Sub Command1_Click () Screen.MousePointer = 11 scramble = "" keyLen = Val(keyLength.Text) ' repeat for the number of characters in the desired key For i = 1 To keyLen ' character set is ASCII 33 to ASCII 127 scramble = scramble & Chr$(Int(94 * Rnd + 33)) ' reseed Randomize getcurrenttime() ' now make it wobble to throw off any regularity in the loop ' this loop works because as the 7 increases, so does execution time For j = 1 To Int(7 * Rnd + 1) 'idle Next j Next Screen.MousePointer = 0 secondaryForm.keyLabel.Caption = scramble End Sub I'd be happy with an analysis of just how random this is. My working assumption is that over a >8 character key, it beats trying to dream one up in one's head. Besides the getcurrenttime API, I don't know what else to sample without an external DLL or hardware. I started out attempting a keyboard timing routine but had second thoughts. My software company has been doing bar code printing tools for years. Now we're moving from simple encoding to encryption. After playing with RSA Secure briefly, I realized that one way to spoof a request to type willy nilly to initialize anything is to use a bar code scanner. The common type is sometimes called a wedge because you plug your keyboard into it, and it into the keyboard port. It's wedged between the keyboard and the CPU. So when asked to type (obstensibly to input randomly timed events) I scan a very large block of bar coded material. I fill the keyboard buffer at a fixed rate; the throughput of my scanner and PC. If I scan a large bar code, yes, I'll fill the keyboard buffer as fast as possible. Little entropy in my eyes. Oh yeah, with common symbologies like Code 39 and Code 128, I can recreate the whole lower ASCII 128 including tabs, LF/CR, etc. So I can tab to activate buttons in some UI scenarios. Or do macros any any combination that may include control characters. So gang, what about bar code scanners being used to thwart random typing requests?? Jerry Whiting jwhiting(a)azalea.com

1 0

Re: Credit card numbers
by Jerry Whiting 17 Dec '03

17 Dec '03

Credit card check sums are based on the Luhn code. Double the odd digits (1, 3, 5, etc.). Use the sum of any 2-digit results. Add all these numbers together to end up with one single digit. Add this single digit to the sums of all the even digits. The Luhn check digit is the mod 10 of that final subtotal. For example 641205002340106 yields 4. jwhiting

1 0

Re: Telephone card tech. howto needed
by Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Kristian Sagi wrote: [..] > Only 6 are connected ... Has anyone ideas, how this card works ... i > something like telephone card hardware tutorials or something ... I [..] What kind of telephone card? Probably a smart card with PK crypto which isn't so easy to defeat. In terms of technical details, check 2600 magazine (but avoid alt.2600, since there's more noise there than this group has) or do a web search. You might want to check other magazines like Hac Tic (no longer printed?) - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSqqvSoZzwIn1bdtAQHIMQF+N7aisKNZZ+wM7sSUSRxfo7cZ2DC1maxR 8i3tFjE8yPc6CPbuQf4j5vwcPBa64D9N =IPIj -----END PGP SIGNATURE-----

1 0

ViaCryptPGP 4.0?! (was Re: PGP integrated into Z-Mail)
by Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- David A Wagner wrote: [..] > A full review of Z-Mail for Windows and other Z-Mail products is > available over NCD Software's site on the World Wide Web at > http://www.ncd.com/Z-Code/zcode.html, or via e-mail at info(a)z-code.com. > ViaCrypt information is available over the Web at http://www.viacrypt.com ViaCrypt's page talks about a beta version of PGP 4.0 available at some sites. Hmmm. The Windows version is tantalizing. A PGP.DLL would be a wonderful thing. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSqspioZzwIn1bdtAQHUYgGApl4OV143Q/LL2/mPC1m0PDHiGYbVB4xm sB66fpLRrpjHBYxqYg/fGTL1rN6Z4Ydu =OmqS -----END PGP SIGNATURE-----

2 1

breakable session keys in Kerberos v4
by asantos＠retesa.es 17 Dec '03

17 Dec '03

Se han encontrado huecos en Kerberos v4. Aqui teneis la informacion: >Return-Path: <owner-cypherpunks(a)toad.com> >Received: from control (controli.retesa.es) by sun2.retesa.es (5.x/SMI-SVR4) > id AA01592; Tue, 20 Feb 1996 09:59:01 GMT >Received: by control (SMI-8.6/SMI-SVR4) > id DAA19612; Tue, 20 Feb 1996 03:02:47 -0800 >Received: from relay3.uu.net(192.48.96.8) by control via smap (V1.3) > id sma019610; Tue Feb 20 03:02:35 1996 >Received: from toad.com by relay3.UU.NET with SMTP > id QQadse08697; Tue, 20 Feb 1996 04:01:50 -0500 (EST) >Received: by toad.com id AA24982; Tue, 20 Feb 96 00:28:15 PST >Received: from sfi.santafe.edu by toad.com id AA24976; Tue, 20 Feb 96 00:28:11 PST >Received: from nelson.santafe.edu by sfi.santafe.edu (4.1/SMI-4.1) > id AA02389; Tue, 20 Feb 96 01:24:08 MST >Received: (from nelson@localhost) by nelson.santafe.edu (8.7.1/8.7.1) id BAA21074; Tue, 20 Feb 1996 01:28:01 -0700 >Date: Tue, 20 Feb 1996 01:28:01 -0700 >Message-Id: <199602200828.BAA21074(a)nelson.santafe.edu> >From: Nelson Minar <nelson(a)santafe.edu> >To: cypherpunks(a)toad.com >Subject: breakable session keys in Kerberos v4 >Sender: owner-cypherpunks(a)toad.com >Precedence: bulk >Content-Type: text >Status: O > >I'm a bit suprised this hasn't turned up yet on Cypherpunks. A couple >of forwarded messages: first, an announcement made Fri Feb 16 by Gene >Spafford at COAST about an exploitable flaw they've found in Kerberos, >and then a comment on the www-security list that it is due to a bad >random number generator. Same old story! > >The message (lifted from the COAST web site) >-----BEGIN PGP SIGNED MESSAGE----- > >Personnel at the COAST Laboratory (Computer Operations, Audit, and >Security Technology) at Purdue University have discovered a >vulnerability in current versions of the Kerberos security system. >Graduate students Steve Lodin and Bryn Dole, working with Professor >Eugene Spafford, have discovered a method whereby someone without >privileged access to most implementations of a Kerberos 4 server can >nonetheless break secret session keys issued to users. This means that >it is possible to gain unauthorized access to distributed services >available to a user without knowing that user's password. This method >has been demonstrated to work in under 1 minute, on average, using a >typical workstation, and sometimes as quickly as 1/5 second. > >The Kerberos system was developed at MIT in the mid-1980s, and has >been widely adopted for security in distributed systems worldwide. >Kerberos is most often used on UNIX platforms by various vendors, and >is often enhanced, sold and supported by 3rd-party vendors for use in >academic, government, and commercial environments. > >The same researchers at COAST have also found a small, theoretical >weakness in Kerberos version 5 that would allow similar access, given >some additional information and considerable preliminary computation. >Kerberos version 5 does not exhibit the same weakness as described >above for Kerberos version 4. > >The researchers at COAST had intended to release the specific details >of the problem to affected vendors and incident response teams during >the week of February 19, prior to making a public announcement of >their findings. However, as rumors have begun to circulate and >several representatives of the news media have apparently received >indication of the problem, we are releasing this preliminary >announcement at this time. > >Government and industry sponsors of the COAST Laboratory were made >aware of the preliminary details of these findings in January (full >sponsors receive early notification of significant discoveries as a >result of COAST research). Other affiliates of COAST as well as the >world-wide network of FIRST computer incident response teams were made >aware of the general nature of the findings during the week of >February 5. The original plan at COAST was to release specific >details only to FIRST (Forum of Incident Response and Security Teams) >teams and to MIT prior to announcement by affected vendors of a fix >for these weaknesses. The flaw in Kerberos version 4 is significant >enough that disclosure of its details prior to a fix would allow >someone with moderate programming skills to exploit it; there is >currently no reason to believe that others know the details of the >flaw and are exploiting it, so there is no immediate danger to the >public that would warrant release of the details at this time. > >COAST personnel have been informed that MIT has already developed a >fix for the flaw in version 4 Kerberos and is preparing it for >release. Additionally, COAST researchers are cooperating with MIT >personnel to identify what (if any) fixes are necessary for version 5 >Kerberos. Users of either version of Kerberos should contact their >vendors for details of any fixes that may be made available; vendors >of products incorporating Kerberos should contact MIT directly for >details of the problems and fixes. > >COAST is a research group of faculty and students dedicated to >research into information security and computer crime investigation, >and education in computer and network security. It is the largest >such university-based group in the United States. > >Information on COAST may be found on the WWW at > http://www.cs.purdue.edu/coast >Information on FIRST teams may be found on the WWW at > http://www.first.org >Information on MIT's Kerberos may be found on the WWW at > ftp://athena-dist.mit.edu/pub/kerberos/doc/KERBEROS.FAQ > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 >Comment: Key @ ftp://ftp.cs.purdue.edu/pub/spaf/pers/pgpkey.asc > >iQCVAwUBMSZ42cpvK4P8DALVAQHg8QP/TRmqwP7vG32aaBjvbMof2iuVQ2bcWrg9 >p55KN5wBfrBzxq5/NE+6lodkqq2w1ib8q/47uYT1S8iR+z2tnbvL64dxrtDEh4iY >iEWjfpTMtQxLmZ1gA3Sxxn4A+6KwlXq5z4Lp2BROUXyeSR7HPAEeEQucRNWkzz8o >IOMHuBAcBKo= >=yWxe >-----END PGP SIGNATURE----- > >(a comment I found in reply) > >------- Start of forwarded message ------- >From: jis(a)mit.edu (Jeffrey I. Schiller) >Subject: Re: Kerberos Vulnerability >Newsgroups: hks.lists.www-security >Date: 19 Feb 1996 21:42:08 -0500 >Organization: HKS, Inc. >Path: hks.net!news-mail-gateway!owner-www-security >Lines: 8 >Sender: root(a)hks.net >Message-ID: <ad4e9fc40602100421be(a)[18.162.1.1]> >NNTP-Posting-Host: bb.hks.net > >There will be a fix distributed by MIT later this week. The problem is that >the random number generator in V4 is worse then we thought! The fix is to >retrofit the V5 generator (which is decent) into the V4 KDC. Note: Only the >KDC needs to be updated, clients and servers are unaffected. > > -Jeff > > >------- End of forwarded message ------- > > Agustín Santos Méndez, RETESA, S.A. C/Orense 4, Planta 10. 28020 MADRID SPAIN. Ph: +34.1.342.67.91 Fax +34.1.597.28.77 E-mail: asantos(a)retesa.es

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- IPG Sales wrote: [Notice "Sales" wrote this...] > We are not currently revealing all the details of our system because of > patents in process, and other relat6ed matters. We are offering the Do you know what "patent pending" means? > software. You should be able to readily decompile it and determine the > algorithms used andf how they are used to generate random number sequences If you're so concerned about secrecy and patents, why encourage anyone to reverse engineer it? If it's as secure as you say (and it's not) and yet unpatented, then you sure as hell don't want anyone reverse engineering it... you don't even want to publish the compiled binary either (if that were true). [..] > If you are aware of encrtypting technology, you recognize that hardware > prime number cycle wheels for the basis of some of the most secured > hardware systems employed for encryption. We simply expand that You mean like Enigma machines? (chuckle) > Thus we can eliminate the need to have the length of the OTP to be equal > to the length of the file - if you do not belive that it works, try it > and see - it takes inly a few hours to set such a trial up. We generated OTP = One Time Pad ^^^ Used once. Not repeated. Equals the size of the file. Completely erased from the cosmos after decryption and never seen again. Anything else just isn't a one time pad. > over 790 gigabytes of charcaters, on multiple backups, and tested. Our > standard deviations, chi squares, Delta ICs for bits, characters, sets, > and the entire set were random. The sets are random, and you can take > that to the bank. Gee. It sure looks random. Must be secure. [Sarcarm mode off] > Someone, will decompile it and discover that it is truly random, at least > from the practical usage basis. But we need that time to file patents, > cvopyrights and the like. Truly random? If it's based on an algorithm and not an unpredictable source of external randomness, it just ain't random. If it's fed the same seed, will it produce the same output? If so, 'taint random. Don't call it that. Just don't. > The IPG system solves the key management problem and produces a truly Oh really? And how does it do that? ... [..] > "Unless we know, we do not experience by talking," Plato Interesting that you quote Plato, who believed in such fairy tales as essential orbs of "truth", "beauty", etc. floating around in some neuminal hyperspace. Faith was rather important, and the western religions were really damn peachy about it. Oh, I get it... OTP stands for Onto-Theological Platonism. Philisophical snake oil... - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSqxhCoZzwIn1bdtAQFrnwGAxffXmBmuZchYHTFapCNqc5xxiEqDy7BD RL9cJeuP/2CHnVUgvfRX5uHfabPZz+Z7 =akNJ -----END PGP SIGNATURE-----

1 0

Symantec Caf�
by asantos＠retesa.es 17 Dec '03

17 Dec '03

La empresa Symantec ha sacado al mercado un entorno de programacion JAVA para WindowsŽ95/NT. Quien se apunta a evaluarlo? El URL es :"http://www.symantec.com/lit/dev/javaindex.html" o bien :"http://www.symantec.com/lit/dev/java.html" Agustín Santos Méndez, RETESA, S.A. C/Orense 4, Planta 10. 28020 MADRID SPAIN. Ph: +34.1.342.67.91 Fax +34.1.597.28.77 E-mail: asantos(a)retesa.es

1 0

Re: Secure Split
by loki＠obscura.com 17 Dec '03

17 Dec '03

I wrote a program which does secret sharing calles SecShare. It is on my home page. As my first venture into crypto programming it is a major kludge, but it does the job. -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Web Browsers and Anonymous Mail (Was: NSA net trolling)
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

Wayne Madsen wrote somewhere: > A knowledgeable government source claims that > the NSA has concluded agreements with [...] Netscape to > permit the introduction of the means to prevent the anonymity of > Internet electronic mail, [...] I suspect this may actually mean that they're pushing Netscape to incorporate cryptographic authentication into browser email, which I think is a useful development. I'm not aware of any public remailers previously operated by Netscape Communications Corp. that have now shut down. ;) At any rate, it's an excuse for me to ask some questions: (0) I'm not aware of any class library objects or methods in stand-alone Java for calling the local mail transport agent. Is there any class library support in Java+{Navigator, HotJava, Mosaic, NetCruiser, the AOL web tool, etc.} for applet calls to the local mail agent that's configured in the browser ? I would prefer not to reimplement SMTP using the Socket class in my own applets. Ideally I'd like to have an applet that presents a form with some entry boxes and check boxes, quantizes and encrypts the input according to the check box settings, and spews the resulting byte streams to the MTA. (1) As I recall, I used to be able to set (as an Option) the path and name of the local MTA (e.g. /usr/lib/sendmail) in an earlier version of Netscape. That seems to have disappeared in Navigator 2.0. Is there indeed no longer a way to set that ? It occurs to me that we could have achieved partial integration of remailing into Navigator quite cheaply with that option. Comments from Sun and/or Netscape and/or anyone else would be welcome. Thanks :) -Lewis "You're always disappointed, nothing seems to keep you high -- drive your bargains, push your papers, win your medals, fuck your strangers; don't it leave you on the empty side ?" (Joni Mitchell, 1972)

2 3

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by Peter Trei 17 Dec '03

17 Dec '03

ipgsales(a)cyberstation.net writes [...] - I do not now what KDC's are... [...] > Incidentally crypto wheel systems are still employed in 1996 at some of > the highest levels of usage - some called then rotors at one time - they > are still used because the produce non repeatable sequeces It's sort of amazing that a person can show themselves so foolish and ignorant in less than four full lines of text. No person or organization who has studied crypto beyond the Captain Midnight Decoder Ring level can take these people or their product seriously. Peter Trei ptrei(a)acm.org

1 0

JavaScript to grab email
by Jyri Kaljundi 17 Dec '03

17 Dec '03

Another annoying feature in JavaScript and Netscape. Have a look at <http://www.popco.com/grabtest.html> The page uses JavaScript to steal your e-mail address and sends a test e-mail message to the address it grabbed. It works with Netscape, which is probably only browser supporting JavaScript. Probably there will soon be thousands of pages which include this code, and people using Netscape 2.0 will be spammed with commercial messages. So just put some false e-mail address in your Netscape browser to disable this feature. The script was developed and announced by Glenn Fleishman, moderator of the Internet Marketing mailing list. Thanks for letting people know. Jüri Kaljundi jk(a)digit.ee Digiturg http://www.digit.ee/

5 6

Re: Web Browsers and Anonymous Mail (Was: NSA net trolling)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

>(0) I'm not aware of any class library objects or methods in stand-alone Java >for calling the local mail transport agent. Is there any class library >support in Java+{Navigator, HotJava, Mosaic, NetCruiser, the AOL web tool, >etc.} for applet calls to the local mail agent that's configured in the >browser ? A look at the documentation does not show one. You may have to implement the whole MTA protocol yourself :-(. It does occur to me that such a library would only be possible in a browser that knows (via configuration) how to find MTAs. Good luck - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Conexion a control
by asantos＠retesa.es 17 Dec '03

17 Dec '03

Por favor, no useis el modem hasta que no pongamos en marcha el sistema de retorno de llamadas y nos aseguremos que estan las medidas de seguridad correctas. >Return-Path: <jfla> >Received: by sun2.retesa.es (5.x/SMI-SVR4) > id AA01057; Tue, 20 Feb 1996 15:58:35 GMT >Date: Tue, 20 Feb 1996 15:58:35 GMT >From: jfla (Jose Fernando Luis Alarcon) >Message-Id: <9602201558.AA01057(a)sun2.retesa.es> >To: gruporetesa >Subject: Conexion a control >Content-Type: text > >Hola a todos: > Teneis a vuestra disposicion el acceso a control por modem , la linea >tendra el numero 3426751 , entrareis como terminal remoto .., la conexion ppp >a control todavia no esta disponible.., pero lo estara en poco tiempo. > Un saludo, > _ > /____/______ > (_/-- /__ /-\ > Agustín Santos Méndez, RETESA, S.A. C/Orense 4, Planta 10. 28020 MADRID SPAIN. Ph: +34.1.342.67.91 Fax +34.1.597.28.77 E-mail: asantos(a)retesa.es

1 0

Re: Optical repeaters
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 07:35 PM 2/19/96 -0800, Timothy C. May wrote: >By analogy, it is not clear to me that a simple regeneration mechanism, >with no local observer or recording apparatus, will collapse the wave >function. Seems to me an experiment may have already been done along these >lines: separate fibers producing an interference pattern and then these >inline amps added...if the interference pattern remains, as I would expect, >then the amps/regenerators did not constitute a "measurement" in QM terms. An amplification mechanism will usually couple the signal to the vacuum, and introduce vacuum noise. Another way of thinking of vacuum noise is that amplification mixes the state of the signal, with the (unknown) phase of the universe at infinity. Of course any statement in words about quantum mechanics is necessarily false, so the above statement is a metaphor or parable, rather than literal truth. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by geeman＠best.com 17 Dec '03

17 Dec '03

There are remarkable similarities between this 'system' and the Elementrix one. Could it be that E-ix is selling some licenses to the unsuspecting? Or perhaps it's the other way around. Both involve: - An ill-defined cure-all solution which can't realy be revealed because of patent-pending status - An OTP (so they say) that's not really an OTP - Starting with a 'seed' that is truly random and then algorithmically generating a stream that is XOR-ed with the data, based on analogies to "rotors" and "dice" - Encrypting keystream data using portions of the previous keystream ** fairly remarkable coincidences. Or is it that great minds think alike?

1 0

SOW_hat
by John Young 17 Dec '03

17 Dec '03

2-20-96. FT: "Cash versus cashless." Assays Y/Ns of e-cash and declares DigiCash the winner for its privacy and anonymity. Echoes DC privacy mantra and sketches DC/DC tests underway by the EU. Compares froth of issuers, fear of banks and so-what of consumers: "Physical cash already offers consumers a product that is universally accepted, convenient, anonymous and has no direct costs." 2-20-96. WSJ: "Security Sytem On the Internet Contains Flaw." Two Purdue University students discovered a major flaw in Kerberos that could allow a hacker to penetrate corporate networks in about 5.8 seconds, giving another black-eye to electronic commerce. SOW_hat

1 0

CRYPTO INFO
by crisper 17 Dec '03

17 Dec '03

I am fairly new to this crypto group and was looking for any good places to get some basic information on current cryptography techniques. Anyone with som info on this topic please E-MAIL the response dont post on the mailing list. E-mail to crisper(a)ascensionet.com IF ANYONE KNOWS OF ANY GOOD PLACES TOGET A GOOD PGP SHELL FOR WINDOWS PLEASE ADD THE URL OR FTP SITE. THANX

1 0

Re: JavaScript to grab email
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 4:33 PM 2/20/96 +0200, Jyri Kaljundi wrote: >Another annoying feature in JavaScript and Netscape. Have a look at ><http://www.popco.com/grabtest.html> > >The page uses JavaScript to steal your e-mail address and sends a test >e-mail message to the address it grabbed. It works with Netscape, which >is probably only browser supporting JavaScript. > >Probably there will soon be thousands of pages which include this code, >and people using Netscape 2.0 will be spammed with commercial messages. >So just put some false e-mail address in your Netscape browser to disable >this feature. >... Anyone know the email address of an email reflector that automatically sends everything sent (not bounced) to it back to the sender. Or I suppose I could use invalid names/domain names. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Chaotic physical systems as random number sources
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

I'm curious if anyone knows of any attempts to use a chaotic physical system (such as the famous double pendulum) as a source of random numbers. I did an Alta Vista check on the problem, and all I turned up was a paper (in postscript, so I couldn't read it) on all mathematical pseudorandom number generators being logical chaotic systems. (It's at http://csl.ncsa.uiuc.edu/~herring/publications/rand.ps) One problem that I can see is that of strange attractors. While the path through each time would be different, they're still _close_ to each other, and a practical mechanical system might not be sensitive enough to pick up the differences. Thanks, -Allen

1 0

New Remailer
by remailer＠meaning.com 17 Dec '03

17 Dec '03

The Nemesis Remailer is online at remailer(a)meaning.com. It supports Type 1 (Ghio) and Type 2 (Mixmaster) messages. It is still in beta testing. Comments to remailer-owner(a)meaning.com would be appreciated.

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by Jim_Bostwick＠cargill.com 17 Dec '03

17 Dec '03

In <199602200851.DAA02057(a)thor.cs.umass.edu>, Lewis mentioned: > Could you explain what the acronyms "ADC" and "LOB" mean here ? I [and] > I might guess that LOB = Low Order Bits. Now, I'm way (WAY) over my head on this forum wrt crypto. However, an idea -- ADC might mean Analog Digital Converter. LOB might mean Low Order Bit (singular). So, IPG may just be watching the LOB of an off-the-shelf analog input card. Rash speculation, of course. However, if true, a Novitiate Crypto Wizard might be prompted to ask: "Assuming I use an audio source to drive the ADC, which of the following would yield higher entropy?: * Greatfull Dead * Al Gore speeches * The Beatle's White album (at 78, backwards) * The hiss after the local AM station shuts down for the night. " :-) -jim P.S. My name is Jim Bostwick, I hate big SIG files, and my employers opinion might actually coincide with my own - but probably not.

1 0

Internet Privacy Guaranteed
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, (KEY #1) Date: Mon, 19 Feb 1996 20:01:06 -0500 From: "Perry E. Metzger" <perry(a)piermont.com> To: IPG Sales <ipgsales(a)cyberstation.net> Cc: cypherpunks(a)toad.com Subject: Re: Internet Privacy Guaranteed ad (POTP Jr.) [snip] > ...keymanagem,ent makes RSA systems unmanageable for large > organizations - offer such a suystem to Merrill Lynch and be > laughed out of the office.... [snip] Even private key systems are quite workable. I actually work with these firms [large organizations] -- its what I do for a living. They have existing systems based on KDCs (do you even know what a KDC is?) and they function just fine. As for public key technologies, they [large organizations] are in many cases implementing technologies based on public key system. [snip] (KEY #2) Date: Mon, 19 Feb 1996 20:37:42 -0500 From: "Perry E. Metzger" <perry(a)piermont.com> To: IPG Sales <ipgsales(a)cyberstation.net> Cc: cypherpunks(a)toad.com Subject: Re: Internet Privacy Guaranteed ad (POTP Jr.) [snip] IPG Sales writes: > there is no need in talking in circles - You may think that > you know everything there is to know about encryption, but > believe me, there is a lot more for you to learn - I do not > now what KDC's are, Key Distribution Centers, the center of Needham-Schroeder and similar key management protocols, like the Kerberos protocols. [snip] (KEY #3) Date: Tue, 20 Feb 1996 01:28:01 -0700 From: Nelson Minar <nelson(a)santafe.edu> To: cypherpunks(a)toad.com Subject: breakable session keys in Kerberos v4 I'm a bit suprised this hasn't turned up yet on Cypherpunks. A couple of forwarded messages: first, an announcement made Fri Feb 16 by Gene Spafford at COAST about an exploitable flaw they've found in Kerberos, and then a comment on the www-security list that it is due to a bad random number generator. Same old story! The message (lifted from the COAST web site) [snip] (a comment I found in reply [to the COAST message]) ------- Start of forwarded message ------- From: jis(a)mit.edu (Jeffrey I. Schiller) Subject: Re: Kerberos Vulnerability Newsgroups: hks.lists.www-security Date: 19 Feb 1996 21:42:08 -0500 Organization: HKS, Inc. Path: hks.net!news-mail-gateway!owner-www-security Lines: 8 Sender: root(a)hks.net Message-ID: <ad4e9fc40602100421be(a)[18.162.1.1]> NNTP-Posting-Host: bb.hks.net There will be a fix distributed by MIT later this week. The problem is that the random number generator in V4 is worse then we thought! The fix is to retrofit the V5 generator (which is decent) into the V4 KDC. Note: Only the KDC needs to be updated, clients and servers are unaf- fected. -Jeff ------- End of forwarded message ------- (KEY #4) Kerberos offers a better network security model than ignoring network security entirely. Unfortunately, it is plagued with holes, from windows that remain "authenticated" for hours while the user is at lunch, to passwords that are stored in plain text on the authentication server. Page 553 of: Evi Nemeth, Garth Snyder, Scott Seebass, Trent R Hein. UNIX System Administration Handbook. Second Edition. Prentice Hall PTR. 1995. ISBN: 0 13 151051 7 email: sa-book(a)admin.com http://www.admin.com Cordially, Jim NOTE. The above message excerpts are reformatted.

1 0

Re: Easy Nuclear Detonator
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"jimbell(a)pacifier.com" "jim bell" 20-FEB-1996 09:01:32.20 >As for the inclusion of your private note: sorry again. But at the time, >it just didn't occur to me that you'd object to this. "Nettiquette" is new >to me. Ah. I understand mistakes. I've made one similar to this before, although it was through not noticing that a mailing to me wasn't also to Cypherpunks, rather than not knowing the (rather basic element of) Nettiquette of not posting someone else's private email. Apology accepted. -Allen

1 0

Chaotic physical systems as random number sources (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 20 Feb 1996 14:47 EDT > From: "E. ALLEN SMITH" <EALLENSMITH(a)ocelot.Rutgers.EDU> > Subject: Chaotic physical systems as random number sources > > I'm curious if anyone knows of any attempts to use a chaotic physical > system (such as the famous double pendulum) as a source of random numbers. I have used magnetic pendulums for this as well as chaotic dripping (both with an old C64). > One problem that I can see is that of strange attractors. While the > path through each time would be different, they're still _close_ to each other, > and a practical mechanical system might not be sensitive enough to pick up the > differences. Not necessarily. In both the magentic pendulum and chaotic pendulums this is not a problem. Jim Choate ravage(a)ssz.com

1 0

Re: NET_run
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"abostick(a)netcom.com" 20-FEB-1996 09:07:55.46 >should not be confused with Steve Jackson Games' GURPS Cyberpunk module >for Jackson's GURPS role-playing system, which was published later.) >"What the hell does this have to do with cryp%*##~~~ Actually, it does. Steve Jackson Games (SJG) was raided by the Secret Service for that game, in which the Secret Service showed their total ignorance of computers by mistaking it for a "handbook of computer crime." Since they're the ones also concerned with counterfeiting: A. this indicates something about how much one needs to worry about counterfeiting, and one reason that even with the new changes, US currency is still one of the easiest ones to counterfeit with modern technology. B. they're likely to be total idiots when it comes to digital cash On the other hand on the last point, they did look at one private currency scheme and deem it allowable, since the (physical) bucks in that case didn't resemble US currency. The governmental group that _did_ have problems with it was the SEC, who decided that since its non-inflationary qualities were based on direct funding through a group of investments, it qualified as an unlicensed mutual fund. Moral of the story: don't base it in the US, or don't make it run off of investments. -Allen

1 0