December 2003 - cypherpunks-legacy

DREI 97: Cryptography and Network Security
by John Young 17 Dec '03

17 Dec '03

http://dimacs.rutgers.edu/drei/1997/schedule/DREI97_ad_Research.htm DIMACS Research & Education Institute DREI 97 Cryptography and Network Security July 28 - August 15, 1997 Rutgers University, NJ Speakers and papers (abstracts available at the site): Martin Abadi, Digital Systems Research Center, DEC "Strengthening Passwords" Ross Anderson, Cambridge University, "Medical Records Security" and "Steganography" Alex Biryukov, Technion "Cryptanalysis of the Portz Interconnection-Network Block-Cipher" and "Cryptanalysis of RC5" Daniel Bleichenbacher, Bell Labs "Comparing RSA and RSA-Type Cryptosystems Over Elliptic Curves" Gilles Brassard, University of Montreal "The Impact of Quantum Mechanics on Cryptology" Ran Canetti, IBM "Towards Realizing Random Oracles: Hash Functions That Hide All Partial Information" and "On the Adaptive Security of Multiparty Protocols" Benny Chor, Technion "Private Information Retrieval" Claude Crepeau, Universite de Montreal "Cryptographic Power of Noisy Channel" Cynthia Dwork, IBM "Positive Applications to Lattices of Cryptography" Carl Ellison, Cybercash, Working Cryptanalysis of the German Enigma" and Key Management in the Post-Identity Era" Yair Frankel, Sandia "New Techniques for Sharing Cryptographic Functions" Matthew Franklin, AT&T Labs - Research, "Ecash and the Power of Positive Paranoia" Rosario Gennaro, IBM "How to Sign Digital Streams" Stuart Haber, Surety Technologies, "Ensuring the Integrity of Records On Line: How to Time-Stamp a Digital Document" Jack Lacey, AT&T Labs - Research, "Music on the Internet and the Intellectual Property Protection Problem" Susan Landau, University of Massachusetts at Amherst "Cryptology, Technology and Policy" David P. Maher, AT&T Labs - Research "Security Models for Partially Accounted E-Cash Systems" Dalia Malkhi, AT&T Labs - Research "Auditable Metering with Lightweight Security" Moni Naor, The Weizmann Institute "A Formal Teatment of Remotely Keyed Encryption" Hilaire Orman, DARPA "The Imperfection of Secrecy in Real Network Protocols" Pino Persiano, University of Salerno "A Transparent Distributed Cryptographic Filesystem" and "Randomness-Efficient Non-Interactive Zero-Knowledge Proofs" Marcus Ranum, Network Flight Recorder, Inc., "Hacking and Networked Terrorism" and "Problems with the Firewall Concept" Mike Reiter, AT&T Labs - Research "Toward Acceptable Metrics of Authentication" Fred Schneider, Cornell University "Mobile Code Security Issues" Rich Schroeppel, University of Arizona "Fast Arithmetic in GF[2^156]" Adi Shamir, The Weizmann Institute "A New Paradigm for Massively Parallel Random Search" and "Cryptanalytic Fault Attacks" Martin Strauss, AT&T Labs - Research "Proxy Cryptography" and "A Formal Teatment of Transactional Trust Management" Edlyn Teske, University of Manitoba "Space Efficient Group Structure Computation Using Pollard's $\rho$-Method"

1 0

Congratulations! We found your site!
by PR.Dept.at.SUBMITKING＠keepmailing.com 17 Dec '03

17 Dec '03

Greetings from SUBMITKING, the leader in automated URL submissions! We found your website using our high-technology, specially designed, "web crawling" software. Unfortunately, most people don't have access to this type of technology. But we can help! As you're aware, most people find websites using any number of popular (and sometimes not so popular) search engines and other marketing resources (like "Site of the Day" (Week, Month, etc.)). But who has the hours and hours to spend searching the Web to find these resources and THEN submit the information to each one? We did it for you! SUBMITKING has taken thousands of man hours to research the top resources people use to find what they need on the Internet. With even more hours we have written special software for each individual resource so that with the information from one form you fill out we can register YOUR site with each of these resources as well as you could do it yourself...if you had 20 or so hours on your hands. Sure, we charge for this service. It's $19.95 for submission to all 200 resources. Which works out to less than a dime each. If you COULD do each site in just 5 minutes (paying yourself .10 each) you'd do 12 an hour (thus earning a whopping $1.20 per hour). Probably 50 or 100 visitors to your site is all it would take to see a huge return on your investment. It's a logical thing to do when you consider all the benefits you stand to gain from being listed in 200 places. That being said we can say no more. We simply invite you to visit the site at http://www.submitking.com and Thank-you for your time. Kind regards, SUBMITKING

1 0

Netscape Bug Reproduced
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Subject: Netscape privacy problem reproduced at EIFIST Date: 6/16/97 5:34 PM Netscape privacy problem: Using information gleaned from the web site of the Danish company that first reported the problem, Keith Woodard and Dave Humphrey at EIFIST have built a web page which reproduces the privacy problem in Netscape Navigator and Communicator web browsers. From that effort they have developed a better understanding of how the Netscape bug works, and what defensive measures users can take until a bugfix is available from Netscape. First, the problem is indeed read-only, and involves only files to which the explicit path name is known. Second, all file systems accessible from the Netscape user's system are reachable -- that means mapped network drives as well as the local hard disk. Third, JavaScript can be used by a web site to automate reading a user's file so that it is invisible to the user. However, the bug does not involve use of Java at all. The demo website can be visited at the following URL: http://eifist.frb.org/hacker/fileupload.html Please urge all Internet web users to take the following interim steps until a permanent fix is available from Netscape: * In Navigator 3.x and 2.x, go to the Options menu and select Security Preferences. Select the "Submitting a Form Insecurely" preference to enable that warning dialog box. This will generate a warning box whenever a site tries to upload a form, giving the user a chance to decide whether to allow it. * Also, in Navigator 3.x and 2.x, go to the Options menu and select Network Preferences. Turn OFF the "Enable JavaScript" preference. This will block execution of JavaScript code which might try to perform an invisible file upload, while permitting display of the rest of the page. These measures are temporary until a full bug fix is made available by Netscape and proven against the EIFIST demo page. Regards

1 0

Re: eDrugs / Re: e$: Skins vs. Shirts
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Drug Monger wrote: >> Wow. I actually understood all that... >> The scent of the cogs is unmistakable hereabouts. > > Hetting and Young both pass on a variety of highly informative and >exceedingly normal, reality-based material for the most part. Then, >out of the blue, they post Taoist-Kerouac, acid-flashback missives >which indicate that the Orphan Zombies roaming the computer Nether- >world have not yet managed to steal their souls. > Since John and Bob's psyche-meanderings often seem to occur within >the same time-frame I have concluded that they both have the same >drug connection. > > So...did you bring enough for everybody? That's the nice thing about data-based drugs - just tear open this hypercard and look at the nice binary patterns, and you can make lots of copies for your friends. Do _you_ have the hacker nature? <IMG HREF="http://www.blacknet.net/snowcrash.gif"> Do you _still_ have the hacker nature? Raven

2 1

ACLU/EPIC: First Amendment Pledge Campaign
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 16 Jun 1997 14:04:22 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: ACLU/EPIC: First Amendment Pledge Campaign ---------- Forwarded message ---------- Date: Mon, 16 Jun 1997 16:50:00 -0400 From: Dave Banisar <banisar(a)epic.org> To: press <info(a)epic.org> Subject: Press Release: First Amendment Pledge Campaign JOINT PRESS RELEASE: American Civil Liberties Union Electronic Privacy Information Center ACLU, EPIC Call on Congress and Clinton to "Take the First Amendment Pledge" FOR IMMEDIATE RELEASE Monday, June 16, 1997 Contact: Emily Whitfield, ACLU Nat'l Office (212) 549-2566 emilyaclu(a)aol.com David Sobel, EPIC (202) 544-9240 sobel(a)epic.org NEW YORK -- As the nation awaits a Supreme Court decision on the future of free speech on the Internet, the American Civil Liberties Union and the Electronic Privacy Information Center today launched www.firstamendment.org, a website dedicated to upholding the First Amendment in cyberspace. The groups called on President Clinton and members of Congress to be among the first to "Take the First Amendment Pledge" and cease any further attempts to draft legislation to censor the Internet in the event the Supreme Court upholds a lower court decision striking down government regulation of the Internet as unconstitutional. "In our view there is no such thing as a 'Constitution-proof' law criminalizing so-called indecency in cyberspace," said Chris Hansen, ACLU Senior Staff Attorney and lead counsel in Reno v. ACLU. The launch of the website comes as Clinton Administration officials have begun publicly discussing a shift in policy on Internet regulation, saying that "industry self-regulation" -- not laws criminalizing certain Internet communications -- is the solution to shielding minors from online "indecency." Hansen added that if the Administration had indeed adopted such a policy, it is obligated to announce it to the Court before they rule in the case. "If the report in this morning's New York Times is indeed true, it would appear that the Clinton Administration is preparing to take the 'Pledge,'" Hansen said. Reno v. ACLU challenges censorship provisions of the Communications Decency Act aimed at protecting minors by criminalizing so-called "indecency" on the Internet. The ACLU, along with EPIC and 18 other plaintiffs, filed a challenge to the law the day it was enacted. A ruling on the case could come as soon as Thursday, June 19, the next scheduled day for release of Supreme Court decisions. "Attempts to censor the Net will not end with the Supreme Court decision ," said David Sobel, legal counsel for EPIC and co- counsel in Reno v. ACLU. "Proponents of Internet content regulation have already indicated their desire to take a 'second bite of the apple' if the Communications Decency Act is struck down." In anticipation of such new attempts at online censorship, visitors to www.firstamendment.org are invited to "Take the First Amendment Pledge," which reads: "I pledge to support free speech and free expression for all Americans and to urge Congress to uphold the First Amendment to the United States Constitution and pass no law abridging our freedom of speech." Online users can capture the "First Amendment Pledge" GIF (graphic image file) for placement on their own website. Other features planned for the site include an "action alert" that informs users of legislative threats to the First Amendment and allows them to instantly e-mail or fax their member of Congress, and an online "postcard" that can be e-mailed to friends, relatives and elected officials, urging them to "Take the Pledge." The ACLU is a nationwide, non-partisan organization dedicated to defending and preserving the Bill of Rights for all individuals through litigation, legislation and public education. The ACLU can be found online at www.aclu.org and through America Online at keyword: ACLU. EPIC is a non-profit, education and research organization based in Washington, D.C. EPIC examines civil liberties and privacy issues that arise in new electronic media. It maintains a website at www.epic.org. ..

6 6

Re: Declan as a Crime Beat Reporter
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 17 Jun 1997 14:38:49 -0700 (PDT) From: Joe Shea <joeshea(a)netcom.com> To: Declan McCullagh <declan(a)well.com> As a real Hollywood reporter, I'm sorry to tell you both Chasen's and the Brown Derby are long shuttered. So is Scandia and Cock 'n Bull. About the only old-line place of that type left is Tam O'Shanter. Best, Joe Shea Editor-in-Chief The American Reporter joeshea(a)netcom.com http://www.newshare.com:9999

1 0

Re: Homer on Terrorism
by John Young 17 Dec '03

17 Dec '03

Steve Schear wrote: >I agree. It seems a bit like blackmail to me. These 'consultants' would >have better off having friends buy put options on Netscape stock prior to >the phone call. Then if Netscape won't pay their price they get the money >from the market when they make the information public, including the source >code. Spare me the insider trading rants. Good point. Perhaps CNNfn and PC Rag insiders did just that. Maybe even got a few for CaboComm's account. Maybe the insiders at NSCP dumped a few after the negotiations tanked. Screaming "terrorism" for smoke. Isn't it conventional wisdom that the market is churned with with blackmail, greenmail, "terrorist" slaughter of W&O and such, laying down "free market" smoke. Story from Federal pen here is that the WTC bomb aimed to topple the pile onto World Financial Center across the road where the plushest players squat on gold but job-lock TLAs running the op said no-no, just terrify the fats into upping our CT-consulting fees and budgets, like IRA @ London City. Inmate Ian was heard to warn, "Worked like a charm, din it: now shut your hole Youseff about that salted laptop fabbed up St Andrews, Great Malvern."

1 0

Re: Flag Burning...
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:52 AM 6/13/97 -6, Peter Trei wrote: ... >Think about this: > >Would you rather people did not burn the flag because: > >1. They'll be thrown in the slammer if they do. >2. The[y] revere the values for which it stands, and will not descrate a > meaningful symbol of these values. > >In (2), we can look at the (very rare) individuals who *do* burn the >flag, and determine for ourselves if they have a valid point to >convey. > >In (1), we'll never know. > >For Congress to deny the freedom to burn the flag is a desecration of what >the flag stands for - a descration of the flag by the government itself. (I'm on Ray's FCPUNKS, please cc me directly, my replies may be delayed and this may have already been covered anyway. Probably was.) 1. Burning is a proper way to dispose of old flags, according to my old boyscout handbook, so I guess this is thoughtcrime. 2. Why not outlaw desecrating the Bill of Rights? (Oh, yeah. Congress does that daily right now...) 3. Since when was "the flag" sacred, anyway? Doesn't something have to be sacred for it to be desecrated? Isn't this a secular country? 4. Doesn't this seem like a way _not_ to discuss the sea of red ink that this country is currently drowning in, and just stir up folks' emotions instead? Sure does to me...I wish veterans and others who get hot under the collar about this would get 1/8 as pissed about the national debt. 5. Burn my flag (or copy of the Bill of Rights) and you'll probably wind up shot. Burn your own flag/copy and watch me yawn. This law is a *particularly* stupid one. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBM6Y7IjUhsGSn1j2pAQFLCwfQyJd1lPvX/TJOu6draMvMuZW9fBSHQI09 vflL8+Po+Y8KS6v12qi8wsUsVSINYOL2SS+/BSu87GbqExLxgqDji5H3imH9lKmO v7ipjyg8T9ybrKWinpkFGh/SWXNsJt6vsLltbRQgzurHRKVXAAs4KhCeHFUrwdQT 5GYh9CQkWsiyRW15/7iR2gkn3wcnZdnQBemFrTAIwswwuS9McyyluX+NO6a/nS27 HDU7aqlVtJ12i9eXY1yg60BGRK66fa4a/52XkIRe92mhWDp7soxDaeWTE4akCIiG Hd2APfyVI+CAnaUlocgbg0o6j6nCe5ZKKB3JbX9sevA8Pw== =Cytc -----END PGP SIGNATURE----- Regards, Jim Ray <jmr(a)shopmiami.com> DNRC Minister of Encryption Advocacy One of the "legitimate concerns of law enforcement" seems to be that I was born innocent until proven guilty and not the other way around. -- me http://shopmiami.com/prs/jimray/ PGP id.A7D63DA9 98 1F 39 BA 93 86 B4 F5 57 52 64 0E DA BA 2C 71

1 0

Re: IBM sues critics?
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In <v0302090bafcb5bb9218f(a)[207.226.3.11]>, on 06/16/97 at 05:13 PM, Alan Davidson <abd(a)cdt.org> said: >At 11:17 AM -0500 6/16/97, William H. Geiger III wrote: >> >>Has there been any conformation on this? >> >>I would like to get in touch with some of my contacts at IBM but would >>like to have some info on this first. >To the best of my knowledge neither CDT nor any of the individual authors >has been served with any papers or received any other notice of a suit >regarding the key recovery report. (Available at >http://www.crypto.com/key_study) >I suspect that the last thing IBM would want to do is give this experts' >report >more publicity. At this point, rumors of a lawsuit appear to be >unfounded. >And remember: In libel cases, truth is always a defense. :) I figured that it was FUD but I have seen IBM do much more stupid things than this so it seemd worth the effort to follow up. Thanks, - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBM6W9PY9Co1n+aLhhAQEYVwP+PUDMGuCZI/3JQUYPTuF0gY/lcru7cB+O m4Bv68B1FRma7TXHOHBTy56uoD2+jDeAf1rhELcnNhyblowBxlWccwXO1slTDpUm f+UHJ59KeC73Mr4k0qDDwOIzArHLMVwJ8qeyz5ZoZLay7n90U4Ol8uuPAvTObf6y N6nNzGeMHUI= =LN2a -----END PGP SIGNATURE-----

1 0

Re: Anonymous proxies & ITAR question
by Tim May 17 Dec '03

17 Dec '03

>The renter of a car or truck is not responsible for the contents. The >driver of a truck is ^^^^^^ This is ambiguous. By this I meant the "person who rents to another," not the "person who rents from someone." --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 3

LAN_law
by John Young 17 Dec '03

17 Dec '03

Los Alamos lab is using its supercomps to develop pattern-recognition programs to spot fraud in the health care system similar to work for IRS to spot tax cheats. LAN_law

1 0

If only...
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Bill Stewart wrote: > At 07:10 PM 6/13/97 -0700, Tim May wrote: > >>You mean they can license handguns, but not reporters??? > > >Indeed, it is strange. What part of "Congress shall make no law" > >do they not understand? > > the part between "Congress shall make no law" and "shall not be infringed"... If only they had written "Congress shall make no law." and left it at that... TM

1 0

Re: Declan as a Budding Washington Insider
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Paul Bradley wrote: > > I must side with Declan here, true, sometimes Declans articles show a > subtle hint of insiderism <tm>, but I believe that is an inevitable > consequence of working around people in D.C. who don`t want to be > directly associated with certain statements, to quote them against their > will would be journalistic suicide and would soon see Declan with no > contacts whatsoever. The editor of the main newspeak print media for the area I live in told me that their reporters are instructed to write their articles so as to be readable to someone with an eighth grade education. I certainly do not envy Declan for being in the position of having to make his articles readable for the people who are still trying to find the "Any" key while trying not to leave the cypherpunks with the impression he's a fucking retard. *** Next Week *** Declan reveals who is buried in "Grant's Tomb." TruthMonger

1 0

Re: Anonymous proxies & ITAR question (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Forwarded message: > From: "William H. Geiger III" <whgiii(a)amaranth.com> > Date: Mon, 16 Jun 97 17:48:52 -0500 > Subject: Re: Anonymous proxies & ITAR question > >>The renter of a car or truck is not responsible for the contents. The > >>driver of a truck is > > ^^^^^^ The renter is not responsible until they take contractual possession of the truck. From that point until placed on the companies property and the key is placed in the lock-box hanging on the fence (or whatever system they use where you live) it is the responsibility of the renter/driver/physical possessor of the truck for its behaviour or contents. > If I went and rented a truck and there was a "roach" in the ashtray I > should not be held accountable for possesion unless it could be proved > that it was mine and not from someone else that had used the truck or even > a worker at the retal shop. > > Ofcource if I had the trailer loaded with 100K of coke it would be a > little hard to say that someone else left it there. :) Why should coke be treated any different than pot? How much pot should I be able to put in such a truck and 'get away' with as a function of SOP? How much coke? No, ambiguity like this has no place in law. The litmus test should be whether a person or their property were damaged without their prior permission. Crimes should be a function of physical interaction and not some qualitative or even quantitative test. If it is a crime to do 100 of them then it should be a crime to do 1/10 (assuming it should be a crime in the first place). I can see it now, "Sorry sir, we had to let him go. He only 1/4 raped her." Blah. ____________________________________________________________________ | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: Capitalist Assassination Politics
by Bill Stewart 17 Dec '03

17 Dec '03

Bell's AP isn't a Democratic Assassins Program - it's a free-market system. In a free market, when enough people want something enough to pay for it, like buying dope or killing someone, someone may decide it's worth their while and just do it. The catch is that he confuses mechanism with policy; the market doesn't really care _why_ someone has a price on their head. In a Democratic Assassins Program, everybody gets together and haggles about who ought to be killed and why, and if a majority wants someone killed, they go do it, or hire someone to do it for them, and tell the minority what a wonderful thing Democracy is. The US theoretically has a Republican Form Of Assassination - everybody votes on some representatives, and the representatives do whatever they can get away with, given future elections as a moderating threat, such as assassinating hundreds of thousands of Iraqis instead of the one Iraqi they told us we should all Hate for Two Minutes, or sending poisoned cigars to annoying bearded guys. In practice, we have a Capitalist Mixed-Economy Assassination Process - the Representatives decide to assassinate some people because it seems to be popular in the polls, and other people because the Big Business interests want them assassinated, or because the Pentagon wants to advertise their availability for future jobs, and some free-market "work" gets done, since you don't _have_ to annoy the national-scale interests to get assassinated, some things get done by Good Old Fashioned Volunteerism*, government-hired assassins decide ignore some collateral damage or work overtime in the war on Republicanly-Selected Substances and some people are society offenders who might best be underground or just tempt Darwin too many times. [* President's Commission on Volunteerism http://www.whitehouse.gov/volunteer.htm ] ---- Attachment Converted: http://www.cia.odci.gov/assassination/nominations.doc ---- # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list or news, please Cc: me on replies. Thanks.)

1 0

LOW_orb
by John Young 17 Dec '03

17 Dec '03

Motorola plans to loft its third low-orbit sat system, dubbed Celestri, for high-speed data, video and broadcast. That will make 7 systems for highbanding low wares. LOW_orb

1 0

Re: ACLU/EPIC: First Amendment Pledge Campaign
by Tim May 17 Dec '03

17 Dec '03

Before I even log in and see if anyone else caught this, I wrote: >And will EPIC then withdraw its support of Pro-CODE, which says that >certain forms ^^^^^^^^^^ I meant SAFE, of course. Pro-CODE contains no criminalization of crypto speech provisions, at least not that I've seen. It's SAFE that's so pernicious. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Homer on Terrorism
by Secret Squirrel 17 Dec '03

17 Dec '03

Of course it was blackmail. The reason people are confused about this is they assume that blackmail is bad. Blackmail is good. The alternative is releasing the damaging information. Blackmail gives the person who has something to hide a chance to keep the information quiet. He has more options than he would have in a system where blackmail was impossible. Laws against blackmail are even more senseless than laws against libel. In the case of blackmail, the supposed victim is asking not to be allowed to take actions which are in his own self interest, a classic case of protecting someone from himself. Fortunately, cryptography will liberate blackmail just as it will other forms of communications. BlackMonger

1 0

More about Netscape Bug finder
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Mon, 16 Jun 1997 18:24:32 -0500 From: Bill GL Stafford <springco(a)arn.net> Organization: Spring Management Company MIME-Version: 1.0 To: "dcsb(a)ai.mit.edu" <dcsb(a)ai.mit.edu> Subject: More about Netscape Bug finder X-Priority: 3 (Normal) Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Bill GL Stafford <springco(a)arn.net> Christian Orellana, gambled $1000 and lost. Not the worst thing he could have done. Now the world knows how Netscape approaches a potential crisis. They did not panic although they may have come close to it. I've seen that much lost in a cloak room with a pot not near as big as Christian sought. Anyway you look at it it's just a roll of the dice.Bill GL Stafford springco(a)arn.net Wired Magazine on web An Email Trail from Bug Spotter to Netscape 6:01pm 13.Jun.97.PDT The following is a copy of the email exchange between Netscape officials and Christian Orellana, the Danish consultant who found the Netscape Navigator bug. A copy of the text was provided to Wired News by Netscape and appears unedited. Wired News has chosen not to publish Orellana's email address. Subject: Major security bug in Netscape Navigator 3 and 4 Date: Mon, 9 Jun 1997 19:19:13 +0200 From: Christian Orellana To: stracy(a)netscape.com Hello! We have discovered a major security bug in Netscape Navigator 3.0, which remains uncorrected in the new Communicator release. The bug affects Navigator running on all platforms in the standard configuration. The bug allows access to any file on the clients file system, and does not affect Microsoft Internet Explorer. This bug is potentially very interesting to Netscape considering that the new release of Navigator is due in just three days. The bug has not previously been reported, and remains unknown to anyone but us (to the best of our knowledge). Please get back to us a.s.a.p. (before Netscape DevCon) if this knowledge is of any interest to you. You can reach me at the phone number below. I have tried to reach Netscape for a while now, and if Netscape remains uninterested in the issue I may contact some other interested parties. Yours sincerely, Christian Orellans [sic] --- Subject: Please confirm Date: Mon, 9 Jun 1997 20:14:08 +0200 From: Christian Orellana To: stracy(a)netscape.com Hello! Could you please confirm that you have received my previous letter. Also I would like to restate my claim that this is of the utmost importance for the upcoming launch of Communicator. The bug allows complete read access to the clients hard disk. Christian Orellana. --- Subject: Re: [Fwd: Major security bug in Netscape Navigator 3 and 4] Date: Mon, 09 Jun 1997 11:51:04 -0700 From: edithg(a)netscape.com (Edith Gong) Organization: Netscape Communications To: Shannon Tracy , lalam(a)netscape.com References: <339C3C32.FE3F5683(a)netscape.com> Shannon, I don't know what else to do. Can someone in DSE contact this person to get the details by phone. We can't investigate until we understand what the issue is. I'll see if someone in tech support can contact the customer Edith --- Subject: Re: Please confirm Date: Mon, 09 Jun 1997 12:00:03 -0700 From: Shannon Tracy Organization: Netscape Communications To: Christian Orellana References: Dear Christian Orellana: Yes, I received your message. The project manager just responded that they are trying to find someone to contact you, however, we can't investigate until we understand what the issue is. Can you please furnish a few additional details so that we know who best might be able to handle this situation? Thanks, Shannon Tracy --- Subject: Re: Please confirm Date: Mon, 9 Jun 1997 21:11:44 +0200 From: Christian Orellana To: stracy(a)netscape.com (Shannon Tracy) References: Dear Shannon. In short the first version of the bug I had up and running allowed me to get any file whose path I knew on the clients hard disk. I just got another version up and running, and considering that the location of quite a few files on a typical windows/mac/unix installation is pretty well known, it should be no surprise that this new version can actually scan the clients harddisk for specific files, and download them. I can not reveal much more detail, without giving away the bug, which I will not do, since I think this information is so valuable to Netscape that it should be worth a good deal of money. The information is certainly worth a bit on the free market, and I am currently awaiting responses from other parties. In other words I think the person most suited for handling this, is someone in charge of the company check book (-; Regards - Christian --- Subject: final note on Navigator bug Date: Mon, 9 Jun 1997 23:07:59 +0200 From: Christian Orellana To: stracy(a)netscape.com (Shannon Tracy) Netscape: I think my approach to you on this subject has been fair and serious. I am offering you a piece of information that I consider of very high value. The implications of the bug mentioned in previous emails are immense. Considering the widespread use of home-banking software, not to mention the impact on multiuser systems in the government and corporate sector, like unix and NT environments, where access to the encrypted password-files would render the systems extremely vulnerable, I think all pre Communicator versions of Navigator (supposing you fix the bug in Communicator) would be pretty useless. I will leave it to you to estimate what impact that would have on Netscape stocks. I have to inform you that David Gross at CNN is on hold with the news, and is only waiting for me to give him the final demonstration, to verify the bug. I must also inform you that CNN is not the only interested party, and that I will consider my options once I get Netscape's standpoint on the matter. I would be more than happy to give a demonstration of the bug, under controlled circumstances, but we would have to sign some sort of agreement first. Regards, Christian Orellana. --- Subject: Re: [Fwd: Major security bug in Netscape Navigator 3 and 4] Date: Thu, 12 Jun 1997 16:40:33 -0700 From:chrish@netscape.com (Chris Holten) Organization: Netscape Communications To:chrish@netscape.com References: 1 Subject: Major security bug in Netscape Navigator 3 and 4 Date: Mon, 9 Jun 1997 19:19:13 +0200 From: Christian Orellana To: stracy(a)netscape.com Hello! We have discovered a major security bug in Netscape Navigator 3.0, which remains uncorrected in the new Communicator release. The bug affects Navigator running on all platforms in the standard configuration. The bug allows access to any file on the clients file system, and does not affect Microsoft Internet Explorer. This bug is potentially very interesting to Netscape considering that the new release of Navigator is due in just three days. The bug has not previously been reported, and remains unknown to anyone but us (to the best of our knowledge). Please get back to us a.s.a.p. (before Netscape DevCon) if this knowledge is of any interest to you. You can reach me at the phone number below. I have tried to reach Netscape for a while now, and if Netscape remains uninterested in the issue I may contact some other interested parties. Yours sincerely, Christian Orellans --- Subject: Please confirm Date: Mon, 9 Jun 1997 20:14:08 +0200 From: Christian Orellana To: stracy(a)netscape.com Hello! Could you please confirm that you have received my previous letter. Also I would like to restate my claim that this is of the utmost importance for the upcoming launch of Communicator. The bug allows complete read access to the clients hard disk. Christian Orellana. For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

5 4

Receiving Messages Anonymously
by pdh＠best.com 17 Dec '03

17 Dec '03

Receiving anonymous messages is still an open problem. The solutions we have so far are cumbersome to operate. They also depend on a chain of machines remaining up and reliable for a long time, which is expensive. A quick solution is to use the list to send anonymous messages. It is inexpensive to tell if a message is encrypted for a key you control so it is cheap to find messages you can read. The nice thing about this solution is that it is quite difficult to make a complete list of cypherpunk recipients given the multi-rooted "tree" structure of the list. There are leaves in many countries. Even if every wire were tapped and tracked, it would be hard to guarantee that people were not moving list traffic around on diskettes. To make filtering easy for people, I would suggest adding an "X-Private-Message" field to the header. For PGP messages, the contents of this field could be "PGP-Key-Id:0xDEADBEEF". (New formats can be invented as new protocols are invented.) Some people will object to this new form of "noise" message. It should be easy for somebody to set up a subsetted version of the list which pre-filters the private messages. (Although, how anybody can read the raw list without a filter of their own is a mystery to me.) A good reason to receive the complete list is that it conceals the fact that you are receiving (or not receiving) anonymous messages. If you think you might ever in the future receive an anonymous message, this will allow you to do so without revealing it. This scheme could be attacked by actively intervening with the propagation of the list and supplying people with different messages depending on which branch of the "tree" they are on. This could be used successively to narrow the list of "suspects" receiving a certain message. There are two ways to prevent this. One is to receive the list from more than one source and compare the messages received. If many people are doing this, which is likely since each has a strong motivation to detect this attack, then the first attempts should be detected immediately. The other method is to have a trusted person post a signed list of message ids and checksums that have come down the wire every day. (Acknowledgement: This is probably a rehash of BlackNet.) Peter

2 2

McVeigh Sentence
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

I was watching Dateline NBC interview the McVeigh jurors about the trial and the interviewer asked them what they found to be the strongest or most convincing evidence against McVeigh. A grandmotherly type answered that the most convincing of the evidence against him was the pictures of the dead bodies. Perhaps the prosecution could have gotten McVeigh convicted on even more charges if he had shown some pictures of heroin. I also watched McVeigh's lawyer give a statement that sounded like it was prepared for him by the Whitehouse spin doctors. From the very first, right through to the end of the trial, I had the feeling that McVeigh's lawyer seemed to be more of a spokesperson than a lawyer. I've had lawyers show more skill and ferver in keeping my dog out of the pound than he showed defending McVeigh. I don't know what exactly he was being paid $15 million for, but it sure as hell wasn't for defending McVeigh. Even when he speaks about the judge not allowing him to put on a real defense he acts like it's just a minor matter of no real import. The only mystery in the trial was whether McVeigh was part of the great pretense taking place or if he really thought his lawyer was working in his best interests. I suspect that he's just naieve. I wouldn't place any large bets on MvVeigh living long enough to take part in an Oklahoma City trial if that ever happens. The political interests down there want more than just a showcase trial--they want to find out the real story. Unless they get bought off or blackmailed the Feds are going to have to bring Jack Ruby out of retirement. TruthMonger

5 5

RE: Digiweb.com's Movie Boys
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Brad Shantz <BradS(a)TRIsource.com> writes: > I already sent them the statutes against junk faxes (currently the only > real spam-killer we have available), and reported them to a number of > different agencies including the CAUCE. Check out www.cauce.org for > more information. This thread had nothing to do with crypto and has taken more time and effort to delete than the original troll. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: [IMPORTANT] Accounts payable
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Timmy C. May styles his facial hair to look more like pubic hair. .oooO Oooo. ( ) _ _ ( ) \ ( / ) ( \ ) / ----\_)-/ (---) \-(_/---- Timmy C. May ( ) ( ) oooO Oooo

2 1

PGP for Windows 95
by Silvakow 17 Dec '03

17 Dec '03

Has anyone yet checked out PGP for Windows 95? It's $50 at stores right now. Information from pgp.com, but I want to know more before I buy it. Is it worth it? Should I stick with PGP for DOS? And does anyone know if those PGP public keys are compatible with DOS PGP? |[(*+- Silvakow -+*)]|

2 1

Re: PGP for Windows 95
by Arunas Norvaisa 17 Dec '03

17 Dec '03

On 08:55 AM 97.06.17 +0000, Silvakow wrote (and I quoted): > >Has anyone yet checked out PGP for Windows 95? It's $50 at stores >right now. Information from pgp.com, but I want to know more before >I buy it. Is it worth it? Should I stick with PGP for DOS? And >does anyone know if those PGP public keys are compatible with DOS >PGP? What d'ya mean??? PGP 5.0 is much more (not USD 50 in any case); freeware PGP (latest version 2.6.2 for USA and 2.6.3i outside US) is working just fine in MS-Dos shell under windoze'95... If you mean specific shell (what I doubt), it's not PGP itself and you'll still will get those dos windows anyway... -- greetz... Arunas Norvaisa - little guy, The Masses Inc. <mailto:arunas@post1.com> with subject: 'send key' to get PGP key PGP for idiots page <http://www.a-vip.com/an> and a mirror site <http://www.post1.com/~arunas> Programming Department: Mistakes made while you wait.

2 1