December 2003 - cypherpunks-legacy

Re: speeding detected by civilians
by btmoore＠iquest.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:01 PM 7/13/95 -0700, Vladimir Z. Nuri wrote: >hate to start another endless thread on speeding limits, but >this is an interesting privacy anecdote... hope this hasn't >been posted here. > > >=== > >From: "Steven M. Horvath" <horvath(a)comm.mot.com> >Subject: Speeder's Beware of Vernon Hills, IL. >To: snet-l <snet-l(a)world.std.com> > >- - -------- FYI------------------FYI--------------------FYI----------------- > >Vernon Hills, IL. > >Vernon Hills, Illinois, a Chicago suburb, has passed legislation allowing >citizens to check out radar guns from the local police department to >catch speeders in their community. The radar guns are combined with >cameras in order to instantaneously capture the car, license number, and the >rate of speed. The citizens can check out the units for a week at a time. The >police have stated that they, at this time, will use the data to issue >warning letters to the violaters. > > > > > > >- ------- End of Forwarded Message Actually... this sounds like a GREAT IDEA!!! Do you know how many cops you could catch with one of those??? I cannot count the times I've had cops go by me at speeds in excess of 80 mph without lights or sirens! Everyone ought to check one of those things out, catch the cops and turn it in to your local media establisment! Benjamin T. Moore, Jr. btmoore(a)iquest.net (Jian #AJF - IRChat) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMBMV/4SAJOVFNaChAQEO0wf/W8Nudez5Xu6+VqomN6jlE5aKixkNz59M UTh9y57zRMuYr1sE1abqr90kmANwo6bG8CmOmn1CS9vnGjvhzO4MeJJGfsc3elwT EMXTJy4Er5DPoswqUehNKghKvoNEvxL0+CUcTVjkMNCrOt6O5oetUq4hzPBKwC8a G98Mk8uTZ64YpU1IIZQmHaZrUgA0DpV2tDFA3vX4dSxpeKYP0EHmEIeV1jL8kax+ /DQqYYzYaQYGjfA7bAo6d9jBJkjlPqSYiJVnjTKSScqF7ke31nPfNMCC1B+XdhpQ G7+rDEcyFubj0awwV8liYE7dnM3j0wxAy9hb0fzNINUv5xNjbj3KTA== =sx7M -----END PGP SIGNATURE-----

1 0

Re: big word listing
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

AS> > <process-ID.clock@hostname>password AS> > AS> >and sends it to the server as "APOP username 58349485whatever89583449". AS> Of course, this requires the user password to be stored unencrypted on the AS> server; which you may not want to do. Here's a variation, then: Instead of using process-id.clock to generate the random stuff for the challenge, have your own (P)RNG make up a bunch of them ahead of time, calculate the hashes, and store the challenges and hashes on the server. The password file is kept encrypted, and only decrypted to run the above. You could even do the whole thing by remote access, making up a batch of id: pairs of challenge/repsonse on one machine, encrypt the thing and send it to the server via remailer chain. The reason for the "stealth" bit is because the locus of control is moved to the remote machine, which may itself fall prey to attack. So, the supervisor needs to login as a Mere User (could have several accounts like this, and/or change them frequently) so as to not leave a trail of bread crumbs back to the cottage. * Long, long ago, in a tagline far far away... --- * Monster(a)FAmend.Com *

1 0

About your online business.
by 05551984＠turboma.dyn.ml.org 17 Dec '03

17 Dec '03

---> Do you run an online BUSINESS? ---> Are you interested in electronic MARKETING? ---> Do you want to dramatically INCREASE your SALES? Keep reading... we will explain you how your business can take advantage of bulk e-mail's incredible power! Dear fellow online entrepreneur, If you're like me, you're certainly very enthusiast about the Internet's possibilities. However, we all know that the biggest challenge is to give our sales material a decent visibility. With all those competitors around, you must take action to reach out for customers, to directly reach your potential buyer. You probably already tried dozens of different ways to promote your online business... Search Engines are now overloaded and unlikely to bring much business... Online Malls are expensive and they often won't bring you sales... Newsgroups promotion is now out of question. You need a media that directly reaches out for the customer. You need to use bulk e-mail. Imagine... your sales pitch sent to thousands of potential buyers. It's almost like a virtual flyer distribution. And the best part is that you won't have to spend much to take advantage of this incredible marketing tool. Here's a glimpse at our prices: - 100,000 mailings: only $69.95 - 1,000,000 mailings: only $249.95 To get full details and contact information, just write any message to our automatic autoresponder: siminfo(a)answerme.com Again, all you have to do is to send us any e-mail at siminfo(a)answerme.com You will then receive all information via e-mail within minutes. Bulk E-Mail will turbocharge your business. Don't delay. Act now! Yours trully, Pierre Roussil - SIM Inc. PS: Request the information NOW to take advantage of our HOT limited time offer! ***************************************************************** If you wish to be removed from our mailing list, please write us at simrem(a)answerme.com . You will receive a removal confirmation via e-mail. Thank you. *****************************************************************

1 0

crypto-stegonography?
by merriman＠arn.net 17 Dec '03

17 Dec '03

I got to thinking about crypto and stego, and wondered if it wouldn't conceivably be a useful technique to marry crypto and stego in the following manner (probably thought of before :-): 1> encrypt a message in the Usual Manner. 2> by prior arrangement with the other party (or parties, more on that in a moment), select a random character that has a bit position value equal to a bit in the encrypted message. That is, if the first bit of your encrypted message was a '0', randomly select a character that had a '0' in a specific bit position (say, bit 3). repeat for remainder of message. 3> transmit said message, mimicing any one of a number of formats. I think such a scheme would have a number of benefits, in that it could _conceivably_ support up to 8 recipients (8 different messages encrypted independently), though 6 would probably be a practical limit. The message could easily be formatted to resemble a uuencoded image or almost anything else (with minimal prior arrangement). It maintains real encryption while providing a considerable 'distractor' effect on an opponent (ie, the old magician's trick of "watch this hand while I do the real stuff with the other one" :-). With the same message sent to multiple recipients, the _apparent_ harmlessness of the message would seem to increase, as well. For a single recipient, the bandwidth requirements really sucks rocks, but for multiple recipients, the efficiency goes *way* up. As observed, this has probably been thought of before, but I'd be interested in hearing any comments.... Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Re: big word listing
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

Monty Harder <monty.harder(a)famend.com> wrote: Andrew Spring <ANDREW.SPRING(a)PING.BE> wrote: >AS> > <process-ID.clock@hostname>password >AS> > >AS> >and sends it to the server as "APOP username 58349485whatever89583449". > >AS> Of course, this requires the user password to be stored unencrypted on the >AS> server; which you may not want to do. > > Here's a variation, then: Instead of using process-id.clock to >generate the random stuff for the challenge, have your own (P)RNG make >up a bunch of them ahead of time, calculate the hashes, and store the >challenges and hashes on the server. Instead of that, send H(pid,clock,hostname,H(password)) to the server, for some hash function H(). Then the server only needs to keep H(password) around, rather than the plain password. This is similar to current systems, except the plain password isn't sent across the network. H() can be whatever you fancy; 25 crypts, MD5, SHA-1, etc. Of course, I'm sure this is far from being a new idea.... -- David R. Conrad, ab411(a)detroit.freenet.org, http://web.grfn.org/~conrad/ Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 No, his mind is not for rent to any god or government.

1 0

Re: NOISE: advice on applications
by Peter Trei 17 Dec '03

17 Dec '03

> > > I've just recently set up a PPP account, mainly so I could > run Netscape. I'm thinking of adding PC Eudora for mail. > Any advice on a good newsreader and any other applications > it would be handy to have? > Thanks. > AR While I have yet to find the Perfect PC Mail Client, I have to say that I find Pegasus far superior to Eudora. The free version of Pegasus includes mail filtering capabilities, essential if you expect to receive mailing lists (such as cypherpunks). Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

1 0

CALLER ID AVOIDANCE
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, While reading the July issue of Soldier of Fortune, I ran across an ad for yet another telephone anonymity service. It reads: CALL 1-900-CUT TRAX Secure your most sensitive calls from all forms of caller I.D. and return-call technologies? Now make calls from your own telephone safely and anonymously. No need to find a public phone to be discreet. Trackers never see your number...only ours! And their number will not appear on your phone bill. Call any number in the continental US... Just $3.95 a minute for safe secure conversations! Call 1-900-CUT-TRAX (1-900-288-8729) Beacon Telesystems 914-423-3329 Not necessarily as secure as they would have you believe, but it does demonstrate there is a market for anonymity, I guess. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 4

Re: Three strikes you're out! for politicians... yeah we wish!
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:52 PM 7/22/95 -0400, Rich Salz wrote: >Better yet do it the way Comedy Central wanted to: > Three strikes your out and term limits. You can run for re-election > but if you lose you get shot. >

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.taylored.com This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp. hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"crown"} = "<mixmaster(a)kether.alias.net> cpunk pgp hash latent cut mix ek reord"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)spook.alias.net> cpunk mix pgp hash latent cut ek"; $remailer{"gondolin"} = "<mixmaster(a)gondolin.org> cpunk mix hash latent cut ek ksub reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. 21 Apr 1995: The new version of premail (0.33) is out, with direct posting, perl5 and better MH support, and numerous bug fixes. Last ping: Mon 24 Jul 95 6:07:21 PDT remailer email address history latency uptime ----------------------------------------------------------------------- hacktic remailer(a)utopia.hacktic.nl *+********** 12:38 99.99% spook remailer(a)spook.alias.net *--********* 25:21 99.99% flame remailer(a)flame.alias.net +-++++++++++ 57:34 99.99% replay remailer(a)replay.com *+****++***+ 13:12 99.99% rmadillo remailer(a)armadillo.com +++++++++++ 49:13 99.99% crown mixmaster(a)kether.alias.net --+-+++-+--+ 1:25:56 99.98% bsu-cs nowhere(a)bsu-cs.bsu.edu ###*-#*#**** 13:47 99.98% portal hfinney(a)shell.portal.com #######***** 4:03 99.96% vishnu mixmaster(a)vishnu.alias.net ++*******+** 13:36 99.73% gondolin mixmaster(a)gondolin.org +*----*----- 1:45:44 99.73% vox remail(a)vox.xs4all.nl .------.-- 15:58:51 99.99% ideath remailer(a)ideath.goldenbear.com ........-. 14:21:20 99.32% ford remailer(a)bi-node.zerberus.de #-#+#++-**-* 39:46 99.26% extropia remail(a)extropia.wimsey.com _ --. -..-- 13:25:43 99.20% hroller hroller(a)c2.org +*-++#+#*--* 1:13:04 99.05% syrinx syrinx(a)c2.org +-------- -- 3:28:31 99.01% penet anon(a)anon.penet.fi --+++------ 8:45:41 98.69% alumni hal(a)alumni.caltech.edu #*#** ***** 4:36 97.24% rahul homer(a)rahul.net *##+-##***++ 10:07 99.98% rebma remailer(a)rebma.mn.org +--+-.-+_.- 21:34:08 86.95% c2 remail(a)c2.org ++-+++- -- 2:41:11 85.54% mix mixmaster(a)remail.obscura.com ---+ 3:12:31 77.55% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Now You Can Own a 'Munitions Tshirt'
by dhenson＠itsnet.com 17 Dec '03

17 Dec '03

Now you can wear a TSHIRT that has been classified as a MUNITION by the US Goverment. That's right! The US International Traffic in Arms Regulations (ITAR) makes exporting cyrptographic materials illegal. ITAR further defines export as providing cryptographic information to a non-US/Canadian citizen even if you are inside the US at the time. Providing information is further defined as telling or showing information to a non-US/Canadian citizen. The Munitions Tshirt has a Perl implementation of the RSA algorithm (the one used by PGP) printed on the front along with a bar-code of the same algorithm. What all the above means is that if you wear the Munitions Tshirt where a non-US/Canadian citizen can see it, even if it is inside the US, you have just exported cryptographic material (which is already freely available outside the US) and have become a criminal in the eyes of the US Government. Now you too can become an international arms dealer for the price of a tshirt (US$15.95 - US$19.95, depending on size) and the guts to wear it. If you are a non-US/Canadian citizen, you can still own a Munitons Tshirt by ordering the tshirt from a source that is outside the US. The email response to a request for info (see next paragraph) includes full instructions for ordering the tshirt no matter where you live. For more information on how to own this classic example of civil disobedience, just send email to dhenson(a)itsnet.com with the subject of 'SHIRT'. (You don't have to be a US/Canadian citizen to request the info.) Or, if you have WWW access, just point your Web browser to: http://colossus.net/wepinsto/wshome.html By the way, 25% of the profits from the sale of the tshirt (in the US/Canada) goes to the PHIL ZIMMERMANN LEGAL DEFENSE FUND to help defend the author of PGP from harassment and possible prosecution by the Fedgoons. And if you get arrested for wearing the Munitions Tshirt, we'll refund your purchase price. :-) Get your Munitions Tshirt now. Who knows how long they'll stay in production! Don Henson, Managing Director (PGP Key ID = 0X03002DC9) West El Paso Information Network (WEPIN) Check out The WEPIN Store at URL: http://colossus.net/wepinsto/wshome.html

1 0

Re: Exporting from Canada (was Re: Let's try breaking an SSL RC4 key)
by M. Plumb 17 Dec '03

17 Dec '03

Sorry for taking so long to respond to this. I have been checking out the Canadian rules for exporting crypto. Basically (according to "A Guide to Canada's Export Controls", published by the Department of Foreign Affairs and International Trade) public domain software can be exported from Canada -- one might need to file a form with Canadian Customs for each export, but the export it self is legal. (Public domain is defined as technology that has been made available without restrictions upon it's further dissemination. Copyright restrictions do not remove technology from the public domain. So, I'm not quite sure if PGP falls within that definition.) However, goods of U.S. origin are export restricted, unless said goods are further processed outside the U.S. so as to result in a substantial change in value, so some of the PGP development would need to be done in Canada. -- -marc

4 4

Re: An idea about Java and remailer clients and servers...
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Phil Fraering writes: > Does it have to be the case, then, that we even have separate client > and server versions? If a new program is going to be written in > Java, can't it have the functionality of both client and server? > > Why not "charge" for the ability to send an anonymous message with > the duty to have for a short time (maybe an hour or two) running > on your machine a node in a remailer network? Futplex writes: > It would be interesting to see how the market would react to this. > There might be quite a bit of reluctance to take on the liability > of a remailer operator just to send an anonymous message (maybe > that's a good thing ;) Running a remailer is forbidden by many ISP usage agreements. Many of the potential users of a remailer may not be able to 'pony-up' a few hours of remailer operation lest they loose their account. I thought the idea was to get more people using the remailers, not fewer (perhaps just fewer abusers)... Also, users must be aware of a remailer (and have its public key) to use it. I suppose you could temporarily add the user to a web page which clients checked for a list of current remailers. However, there are issues of reputations of long-running remailers, etc... andrew

1 0

PKA_boo
by John Young 17 Dec '03

17 Dec '03

7-24-95. NYPaper: [Denise Caruso's column] "New Microsoft network will offer a wealth of privacy." It seems unthinkable that anything has been left unsaid about the Microsoft Network. And even less has been said about MSN's design, which Microsoft has said complies with the new data-privacy rules that the European Union is expected to adopt in September. The new European policy would set out clear guidelines about the way in which companies -- in this case, Microsoft and its independent content providers -- can collect and use the personal data about their European customers that the companies gather electronically. Microsoft has said it plans to extend the same privacy provisions to its American customers. The European provisions are a striking departure from current practices in the United States, where few restrictions protect consumers from marketeers, who collect and sell consumers' personal information. PEK_boo

1 0

MSN privacy
by Tom Bizzell 17 Dec '03

17 Dec '03

Here is some info that was circulating around our office today. > *** Forwarding note from KKASTRP --RHQVM12 07/10/95 10:43 *** > To: KURT --RHQVM02 Anderson, K. K. LLANDER --RHQVM17 Anderson, L.L. > > Karen R. Kastrup 8/826-4664 9/(914)766-4664 > Manager, Services Accounting > Somers 4, 3J36 > Subject: Windows 95 > > *** Forwarding note from KASTRUP --ISSCVM 07/10/95 10:31 *** > To: KKASTRP --RHQVM12 > > *** Resending note of 07/10/95 09:43 > STAN KASTRUP > ISSC - INFORMATION STRATEGY & MANAGEMENT > 8/351-3229 9/(914) 288-3229 > SUBJECT: Windows 95 > Amazing! (I chopped off about 10 "forwards.") > ------- Forwarded Message > > > From: Carlos Shaw IBMMAIL:USIB2T2D cshaw(a)vnet.ibm.com > > *************************************************************** > > Subject: news on Windows95 > > ---------------------------------------------------------------------- > > Newsgroups: comp.risks > > From: cnorloff(a)tecnet1.jcte.jcs.mil > > > > Date: Wed, 17 May 95 13:44:40 EDT > > > > Microsoft officials confirm that beta versions of Windows 95 include a > > small viral routine called Registration Wizard. It interrogates every > > system on a network gathering intelligence on what software is being run > > on which machine. It then creates a complete listing of both Microsoft's > > and competitors' products by machine, which it reports to Microsoft when > > customers sign up for Microsoft's Network Services, due for launch later > > this year. > > > > "In Short" column, page 88, _Information Week_ magazine, May 22, 1995 > > > > The implications of this action, and the attitude of Microsoft to plan > > such action, beggars the imagination. > > > > An update on this. A friend of mine got hold of the beta test CD > > of Win95, and set up a packet sniffer between his serial port and the > > modem. When you try out the free demo time on The Microsoft Network, it > > transmits your entire directory structure in background. > > This means that they have a list of every directory (and, potentially > > every file) on your machine. It would not be difficult to have something > > like a FileRequest from your system to theirs, without you knowing about > > it. This way they could get ahold of any juicy routines you've written > > yourself and claim them as their own if you don't have them copyrighted. > > > > Needless to say, I'm rather annoyed about this. > > So spread the word as far and wide as possible: Steer clear of Windows > 95. > > There's nothing to say that this "feature" will be removed in the final > > release. > > > > David > > > > Carlos Shaw | nodeid/userid: stlvm6(cshaw) > > IBM - STL (J95/E443) | (408) 463-4995; (tie) 8-543-4995 > > 555 Bailey Ave | fax (408) 463-4763; (tie) 8-543- > > San Jose, CA 95141 | CompuServe id: 73203,1424 > > Subj: news on Windows95 > > > >ÿÿ > > >-------- End of Forwarded Message > > ------------------------------------- E-mail: dough(a)syntec.com (Doug Hadley) Date: 07/24/95 Time: 10:54:04 -------------------------------------

2 1

Re: S/MIME and the Future of Netscape
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 12:54 PM 7/23/95, Bob Snyder wrote: >tcmay(a)sensemedia.net said: >> With regard to SSL and Netscape not being open to outside developers, >> several leading e-mail outfits, including Qualcomm, Netscape, >> Frontier, etc., are working on an interoperable secure e-mail >> standard called "Secure/MIME," or "S/MIME." > >Do you have sources for this information? MOSS is out there at least as a >Internet Draft, and possibly further along, and Steve Dorner of Qualcomm, the >original author of Eudora, is pretty active in the MIME community and I doubt >he would support a second MIME type to do the same thing... Some of you have expressed skepticism about the mention of "S/MIME." The longterm significance of S/MIME is debatable, of course. But here's the press release I got from Jim Bidzos: Date: Wed, 19 Jul 95 10:34:04 PDT From: jim(a)RSA.COM (Jim Bidzos) To: tcmay(a)sensemedia.net Subject: Integrating RSA into Netscape (Netnews and Mail) FYI... RSA News Release For information, contact: Patrick Corman or Lisa Croel Corman/Croel Marketing & Communications (415) 326-9648 or (415) 326-0487 Corman(a)cerf.net or Lcroel(a)mediacity.com Major Networking and Messaging Vendors Endorse Open Specification for Secure E-Mail S/MIME Based on RSA Public-Key Encryption Technology Redwood Shores, CA -- July 24, 1995 -- Several major networking and messaging vendors, in conjunction with leading cryptography developer RSA Data Security today announced their endorsement of a specification for interoperable e-mail security, to be known as "S/MIME", short for "Secure/Multipurpose Internet Mail Extensions". Several of the vendors announced plans to release S/MIME-compliant products next quarter. The S/MIME specification is based on the popular Internet MIME standard (RFC 1521), which provides a general structure for the content type of Internet mail messages and allows extensions for new content type applications... like security. S/MIME will allow vendors to independently develop interoperable RSA-based security for their e-mail platforms, so that an S/MIME message composed and encrypted on one vendor's application can be successfully received and decrypted on a different one. Major vendors who today announced support for the S/MIME secure interoperable e-mail plan include Microsoft, Lotus, Banyan, ConnectSoft, QUALCOMM, Frontier Technologies, Network Computing Devices, FTP Software, VeriSign, Wollongong, SecureWare and RSA. Sophisticated encryption and authentication technology has been viewed as the crucial enabling technology for electronic commerce over the World Wide Web -- but encryption has been slow to come to e-mail, with most packages offering no security whatsoever. "Commercial e-mail packages don't offer encryption because, up until now, there have been few open security specifications," said Jim Bidzos, RSA President. "Internet Privacy-Enhanced Mail (PEM) is excellent for text-based messages. MIME represents the next generation, and has been widely adopted because of its ability to handle nearly any content type. The new S/MIME allows you to secure this rich content." Today's flurry of official endorsements from industry bodes well for the S/MIME plan. "We fully expect S/MIME to be the defacto standard for vendor-independent e-mail encryption. Solid encryption is something that our customers have been asking us for, but up until now, we didn't have a viable option. S/MIME gives them everything they want: RSA encryption, digital signatures, and the ability to mix different vendors' e-mail systems without losing that security," said Bob Dickinson, ConnectSoft Vice President and General Manager Consumer Online Products & Services Division. "Frontier Technologies believes that in the future most companies will routinely encrypt electronic mail messages sent over the public Internet," said Dr. Prakash Ambegaonkar, Frontier Technologies' president. "This will only happen once there is a well-understood standard for secure e-mail that is easy to implement. Frontier has several years experience in developing secure e-mail solutions. In order to speed the adoption of the S/MIME specification, Frontier Technologies intends not only to be one of the first vendors to support S/MIME in its networking software, but to also make our initial implementation of the S/MIME protocol freely available for other vendors to use as a reference." "The freedom to have a private conversation is fundamental to personal communication that is the essence of electronic mail," said John Noerenberg, Director of Engineering for QUEST products at QUALCOMM. "Wide-spread acceptance of specs like S/MIME make it possible for individuals and organizations alike to conduct their business over the net secure in the knowledge that their private business is, in fact, private." "FTP Software is glad to endorse the S/MIME blueprint for secure electronic communication," said John O'Hara, director of development for FTP Software. "Whether communicating with customers, business partners or remote offices, companies need to ensure that confidential information stays confidential. This was difficult in the past, since organizations are connected through diverse messaging systems from competing vendors. S/MIME eliminates those barriers by facilitating implementations across multiple vendor products." "Network Computing Devices is commited to answering market demand for network information access software providing an even higher level of protection and interoperability over LANs and across the Internet," said Mike Harrigan, co-founder and vice president of NCD. "S/MIME will further enhance our customers' ability to utilize our e-mail solution, Z-Mail, and Internet navigation software tool, Mariner, in such a secure networked environment. For this reason we fully intend to support the specification provided by S/MIME within the next quarter." This wll be an exciting catalyst for the rapid deployment of secure, interoperable e-mail from most of the industry leaders," said Web Augustine, VeriSign vice president of marketing & business development. "VeriSign is committed to making our Digital ID services available to all companies that implement S/MIME and desire to work with a trusted third-party to certify public keys for their end-users." S/MIME is based on the intervendor PKCS (Public Key Cryptography Standards) which were established by a consortium of RSA, Microsoft, Lotus, Apple, Novell, Digital, Sun and the Massachusetts Institute of Technology in 1991. PKCS is the most widely implemented suite of commercial cryptographic standards in the United States. The common PKCS specifications allow developers to independently develop secure applications that will interoperate with other PKCS-secured applications. Developers interested in S/MIME can get more information at RSA's web site, at http://www.rsa.com, in the "What's New" section. RSA Data Security is the world's "brand name" for cryptography, with over 10 million copies of RSA encryption and authentication technologies installed and in use worldwide. RSA technologies are part of existing and proposed standards for the Internet and World Wide Web, CCITT, ISO, ANSI, IEEE, and business, financial and electronic commerce networks around the globe. The Company develops and markets platform-independent developer's kits, end-user products, and provides comprehensive cryptographic consulting services. Founded in 1982 by the inventors of the RSA Public Key Cryptosystem, the company is headquartered in Redwood City, California. S/MIME Vendor Contacts: Connectsoft Tamese Robinson 206/450-9965 Frontier Dennis Freeman 414/241-4555 FTP Software Jill Dudka 508/659-6458 Qualcomm John Noerenberg 619/597-5103 Microsoft Tom Johnston 206/936-3233 Lotus Kevin Kosh 617/860-5632 Wollongong Bob Brodie 415/962-7203 Banyan Jay Seaton 508/898-1000 NCD Mike Harrigan 415/694-0663 SecureWare David Luther 404315-6295 VeriSign Web Augustine 415/508-1151 ### RSA Public Key Cryptosystem and PKCS are trademarks of RSA Data Security, Inc. All other product or company names are trademarks of their respective corporations.

1 0

NOD_off
by John Young 17 Dec '03

17 Dec '03

7-24-95. NYPaper: "For I.B.M. Faithful, Questions About Windows 95." These are difficult days for OS/2 users."Every time I say I am an OS/2 user, I get immediately marginalized," an elderly woman confided to a young man sitting next to her at last week's OS/2 World convention in Boston. "It's amazing what saying you are an OS/2 user brings out in people." "You just have to explain that you are at the cutting edge of a powerful new technology," the young man advised her with a heavy dose of sarcasm. WRP_spd "Computer Pornography Hearing Will Not Include Expert Witness." The principal researcher in a computer pornography study will not testify at today's Senate hearing on children and computer pornography. Senator Charles E. Grassley, Republican of Iowa, removed the researcher, Marty Rimm, from the witness list late last week, after Carnegie Mellon University announced a formal investigation into whether Mr. Rimm and his faculty advisers had violated academic and ethical guidelines in preparing and publishing their study. WIT_les 1 +1: NOD_off

1 0

re: big dictionaries
by Chris Gorsuch 17 Dec '03

17 Dec '03

Bill, Good point about using a "slow" hash algorithm. A "dictionary" attack on the hash should fail because, in order to currently use the password the old password had to not be in the dictionary in the first place. However "keyspace" attacks (brute force) would still be quite feasible. Would probably want to put something similiar to a salt in there to help increase the keyspace. Keep in mind that the only reason I suggested a hash at all is to prevent an admin who, in general, would not go through the effort to replace login/password or install a sniffer to get your password, but might be "unnecessarily" tempted by having easy to access passwords stored in plaintext on the server (still in a file only the admin could read). Basically just as a method to keep honest people honest. To verify that a user wasn't using a variation on the original, you would want to only store the hash of the original, but do hashes of the variants on the "new" password and compare with the stored hash of the old password. And of course, only store a password AFTER it has been changed. Really paranoid admins should use challenge/response/one-time passwords with/or kerberos. chris gorsuch chrisg(a)ti.com

1 0

Python export-a-cryptosystems
by sdw＠lig.net 17 Dec '03

17 Dec '03

I hadn't seen this on the list, so I'm forwarding it. (I may have skipped it in my 'catchup on a rainy day' mail archive.) A friend arranged a lunch today with Guido (the author of Python, Guido van Rossum <guido(a)CNRI.Reston.VA.US>) and a few other friends. I haven't formed an opinion of Python yet. Notice that bc/dc isn't needed. ------- Forwarded Message Date: 06 Jul 1995 14:20:13 +0000 From: Andrew KUCHLING <fnord(a)maggie.cs.mcgill.ca> To: python-list(a)cwi.nl Subject: Re: Obfuscated Python Following modifications from Richard Jones and Guido van Rossum, we've now achieved a 4-line RSA script. (Shouldn't we all be doing some *real* work, I wonder? :) ) I've added a 2-line one-time pad program, which simply XORs the contents of the two files whose names are provided on the command line. Generation of random data (and securely exchanging it with your correspondent) is left as an exercise for the reader. So, the Python export-a-crypto-system-sigs are: Try: echo 'This is a test.' | rsa.py 10001 1967cb529 #!/usr/local/bin/python -- -export-a-crypto-system-sig -RSA-in-4-lines-Python from sys import*;from string import*;a=argv;[s,p,q]=filter(lambda x:x[:1]!= '-',a);d='-d'in a;e,n=atol(p,16),atol(q,16);l=(len(q)+1)/2;o,inb=l-d,l-1+d while s:s=stdin.read(inb);s and map(stdout.write,map(lambda i,b=pow(reduce( lambda x,y:(x<<8L)+y,map(ord,s)),e,n):chr(b>>8*i&255),range(o-1,-1,-1))) Try: echo 'This is a test.' | rc4.py messagekey #!/usr/local/bin/python -- -export-a-crypto-system-sig -RC4-in-4-lines-Python from sys import*;st,x,y,i2,k,s=range(256),0,0,0,map(ord,argv[1]*256)[:256],1 for i in st[:]:i2=(k[i]+st[i]+i2)%256;st[i],st[i2]=st[i2],st[i] while(s):s=stdin.read(1);x=(x+1)%256;y,c=(y+st[x])%256,len(s)and ord(s);( st[x],st[y])=st[y],st[x];stdout.write(chr(c^st[(st[x]+st[y])%256])[:len(s)]) Try: otp.py message pad >ciphertext #!/usr/local/bin/python -- -export-a-crypto-system-sig -OTP-in-2-lines-Python from sys import*;t=p=1;s,i,j=stdout,open(argv[1], 'r'),open(argv[2], 'r') while(t and p):t,p=i.read(1),j.read(1);t and p and s.write(chr(ord(t)^ord(p))) Andrew Kuchling andrewk(a)cst.ca fnord(a)cs.mcgill.ca (http://www.cs.mcgill.ca/~fnord) sdw -- Stephen D. Williams 25Feb1965 VW,OH (FBI ID) sdw(a)lig.net http://www.lig.net/sdw Consultant, Vienna,VA Mar95- 703-918-1491W 43392 Wayside Cir.,Ashburn, VA 22011 OO/Unix/Comm/NN ICBM/GPS: 39 02 37N, 77 29 16W home, 38 54 04N, 77 15 56W Pres.: Concinnous Consulting,Inc.;SDW Systems;Local Internet Gateway Co.;28May95

1 0

Regulatory Arbitrage Server
by Alex de Joode 17 Dec '03

17 Dec '03

Please check out: 'http://www.replay.com/exon', for the problems and suggestions about the scripts mail Adam Back <aba(a)dcs.ex.ac.uk> for flames mail me. Have Fun! -- Alex de Joode Fear Uncertainty and Doubt, Inc.

1 0

IPSEC
by perry＠imsi.com 17 Dec '03

17 Dec '03

For those interested in reading up on the IPSEC work, check out ds.internic.net's "internet-drafts" directory. The following are the drafts that you will want to look at. draft-ietf-ipsec-ah-md5-03.txt draft-ietf-ipsec-arch-02.txt draft-ietf-ipsec-auth-02.txt draft-ietf-ipsec-esp-01.txt draft-ietf-ipsec-esp-des-cbc-04.txt draft-ietf-ipsec-photuris-02.txt I believe that the -ah-xx.txt draft is missing. Perry

2 1

Re: An idea about Java and remailer clients and servers...
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Phil Fraering writes: > Why not "charge" for the ability to send an anonymous message with > the duty to have for a short time (maybe an hour or two) running > on your machine a node in a remailer network? User X on Machine A sends a form via HTTP (or a variant- SHTTP, HTTPS, etc.) to Machine B. User Y on Machine C receives an anonymous mail from Machine B. Suspecting User X, User Y sends a mail to be anonymized and sent back to himself to User X. User X's temporary remailer does as it's told. User Y now has a strong reason to suspect User X has sent the said mail. Cpunks write code and all, but I don't think this one's going to work. :-(

4 4

Re: An idea about Java and remailer clients and servers...
by cman＠communities.com 17 Dec '03

17 Dec '03

> I forgot to add. There is no reason User X has to run his remailer >immediately. His software could simply commit to running a remailer for >1 hour at some specified future date < some threshold. Any messages >sent to him for remailing would be queued until that time. Therefore, >all your technique would tell you is that the user remailed a message >sometime between date X and date Y. if Y-X > few days to week or two, >the intelligence gathered on User X is miniscule. Traffic analysis would >detect User X using the remailer network anyway. > When I've thought about this, it's been from the p.o.v. of message senders being able to earn prepaid service tokens (not unlike digital cash) for offering their machine as a remailer for a set period of time or number of message or total bandwidth or whatever. This activity could be completely asynchronous to any origination of messages, and, in fact, a regular habit of accumulating tokens like this would make for excellent cover traffic.

1 0

R. v. Pecciarich decision is online (fwd)
by craig＠passport.ca 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Defcon agenda
by Samuel Kaplin 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Can some kind soul forward me a copy of the agenda for Defcon? I need dates and times for the various speakers. Thanks, Sam -----BEGIN PGP SIGNATURE----- Version: 2.6.1 Comment: PGP Signed with PineSign 1.0 iQCVAwUBMBVTh+5wXwthmZO1AQGMvgQAhB5RANbZTSPBX+mvdhMiUCnmY2tlYWC3 kTeZc9WNv0qAQSUaYZE0www8pu+X2pZhRaQOKFgbB5cnHvwxoWdgCMj6O8rmDT9X ft/cgB1cls/EOHOysZdPzzx3en+aVM9EedXpLrsx53uTzaG5SHTWVOfY4nexO65e HCTFO93Ct1I= =nNPb -----END PGP SIGNATURE-----

1 0

Part IX: Allegations re Vince Foster, the NSA, and Bank Spying (fwd)
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 24 Jul 1995 23:11:45 -0400 (EDT) From: KALLISTE(a)delphi.com Subject: Part IX: Allegations re Vince Foster, the NSA, and Bank Spying -----BEGIN PGP SIGNED MESSAGE----- Allegations Regarding Vince Foster, the NSA, and Banking Transaction Spying, Part IX by J. Orlin Grabbe July 23, 1995 Gregory Wierzynski Assistant Staff Director U.S. House of Representatives Committee on Banking and Financial Services 2129 Rayburn Building Washington, D.C. 20515 202-225-7502 Dear Mr. Wierzynski: Thank you for email letter, a copy of which is attached. I am not sure why you think my quoting selections from Mr. Jim Norman necessarily implies endorsement or acceptance of them on my part. I have, of course, quoted many, many selections from Mr. Norman, so perhaps you could be more specific with respect to the ones you are concerned about. Perhaps I could be of assistance to your inquiries among the spooks, if only you could describe to me which points you have investigated, and how you have investigated them. I certainly wouldn't want to promote anything that, as you say, "flied in the face of facts." On the other hand, I am greatly concerned about the use by Alltel Information Services (formerly Systematics) of a libel attorney, Charles O. Morgan, in an attempt to intimidate journalists and destroy the First Amendment to the U.S. Constitution. And I am also gravely concerned about the possible leak of U.S. codes and nuclear secrets to a foreign power, which is an issue of *real* national security concern to the U.S. (Of course you and I both know that "national security" is often used to hide the truth about sell-outs of national security from the American people, by clamping a lid on the discussion or reporting of things that are common knowledge among U.S. military and security agencies, and even common knowledge to the general public of the foreign power to which these secrets have been compromised.) Before reading my email, and your letter, I sent you a copy of "Part VIII: Allegations Regarding Vince Foster, the NSA, and Banking Transactions Spying". There you will see from the quotes that the theft of U.S. nuclear secrets by Israel is openly discussed in Israeli newspapers, so I am sure that this is not one of the "off-the-wall" issues to which you are referring. (With respect to that issue, I suggest that you do some investigation in Tel Aviv.) With respect to money laundering I am not concerned, for reasons I have indicated in my essay "The End of Ordinary of Money", Parts I and II, a copy of which I previously provided the Committee. The money-laundering laws ought to be abolished, but in the meantime I do find the selective enforcement of these laws troubling. With respect to "Chuck in Kentucky", I know more than one Chuck in Kentucky, so perhaps you could be more specific which Chuck you refer to. What stories did he tell you, and how is it that they didn't pan out? Since you have already spoken to both Jim and Chuck, I am taking the liberty of sending a copy of this letter (and your letter) to Jim Norman, and to one possible Chuck you may be referring to, so that perhaps they can explain to me their failing to satisfy you as to the accuracy of their information. Now, Mr. Wierzynski, I would like to bring up an issue about your Committee's behavior that is troubling me. I am sure that there is an innocent explanation that I am missing. You will recall the meeting that I had with you and Mr. Stephen Ganis, the Counsel to the Committee, at the Four Seasons in Georgetown on Monday, June 12, 1995. Two days previously I had been playing volleyball in the Mall with Dana Rohrbacher and Jack Wheeler and some others, and I had pulled most of the muscles in my right ankle. So I asked everyone I was meeting to come over to the hotel, and you and Mr. Ganis graciously consented. We met in the Four Seasons lounge, where I was the only person not wearing shoes. You told me that, more than money laundering in Mena, Arkansas, you were interested as to whether there were any documents connecting Vince Foster to Systematics, or whether I knew the name of any Systematics programmers that may have worked to modify the PROMIS software to spy on banking transactions. I told you I couldn't recall seeing any such documents, and that I had come across the name of one programmer, but I had subsequently forgotten it. It was a pleasant meeting, so to be helpful I gave you a copy of Jim Norman's *Fostergate* that had been spiked from *Forbes*. "Why would Steve Forbes kill the article?" you asked. I said I didn't know, but that--since you appeared to know Steve Forbes--you should call him yourself. Now, much to my surprise, I find that the following happened: Just as *Media Bypass* was about to run Jim Norman's article *Fostergate*, they received a letter from Charles O. Morgan, indicating grave consequences if they were so foolish as to print the article. Mr. Morgan claimed to know what was in the article, because, he said, he had received a copy from Mr. Stephen Ganis of your Committee! I am bothered by the fact that while you alleged to me you were investigating Systematics that at the same time you are passing along information to Systematics. I am sure there is an innocent explanation. But consider this: what if I had given you Foster-related documents and the names of Systematics programmers? Would these have been passed along to Mr. Morgan also? As you know, a number of people connected to this whole business have died violent deaths in Arkansas. (Of course, I understand some of them had already been paid off to keep their mouths shut, and didn't, and so--under any standard of morality--deserved what they got.) Well, things are never what they appear, so perhaps you can clear things up for me. Please pass along my concern to Mr. Ganis, and tell him I will be glad to sit down with him and have a drink, or share a line, and have a frank discussion about this issue. (I have nothing against the use of any drug, if used in moderation, and in the appropriate context.) Regards, Orlin Attachment: Your letter to me - --------------------------------------------------------------------- From: IN%"gregorw(a)netcom.com" 23-JUL-1995 19:53:52.82 To: IN%"KALLISTE(a)delphi.com" CC: Subj: RE: Part VII Return-path: <gregorw(a)netcom.com> Received: from netcom13.netcom.com by delphi.com (PMDF V4.3-9 #10880) id <01HT7ZLMQQTC9VUSVZ(a)delphi.com>; Sun, 23 Jul 1995 19:53:50 -0400 (EDT) Received: by netcom13.netcom.com (8.6.12/Netcom) id QAA03469; Sun, 23 Jul 1995 16:51:04 -0700 Date: Sun, 23 Jul 1995 16:51:04 -0700 From: gregorw(a)netcom.com (Gregory Wierzynski) Subject: Re: Part VII To: KALLISTE(a)delphi.com Message-id: <199507232351.QAA03469(a)netcom13.netcom.com> Content-transfer-encoding: 7BIT Orlin -- We're reading your stuff with interest. Thank you for including me in your list of recipients; I pass the material on to my boss and my colleagues on the Committee. I am somewhat surprised, however, that you accept the Norman piece without raising any questions about its sources. We've talked to Jim and tried to check out the sources he thought he could share with us. We have also done a fair amount of investigating on our own using the resources available to us--by which I mean officials inquiries to the spooks. So far we draw a complete blank. Worse, the preponderance of the evidence suggests that Jim's piece is pretty much off-the-wall. Worse still, it appears to fly in the face not just of facts, but simple logic as well. I haven't, by any means, given up on this subject, but pursuing a trail grown cold is difficult to justify when you're paid by the taxpayer. Do you have suggestions on how we could verify some of the elements in the Norman story? I've talked to Chuck in Kentucky and am still in touch with him. But his stories have not panned out, even partially. I would be most interested in your ideas. Best regards. Greg - - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMBP21mX1Kn9BepeVAQGP3AP9Hm/kwmUuz9kNH+q9D728Xe6rdHHPjpT8 bAxwzIK9UsJsIF5oLfjTVWovEtGBj3QvJlmFY7hkVFZAYpx6q4R65NUX/ZpHtKaF QDugRJZJUxKRaD+9CYepFFt6+ZTK8pQr+me3CgY1ZBVbdNZL4LE9rLFA1Z4XD/vL csNGnDpuTq0= =t4hx -----END PGP SIGNATURE-----

3 3