December 2003 - cypherpunks-legacy

64 bit keys breakable by the NSA or just some random key length?
by zinc 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- cpunks, i was thinking about the recent Clinton/LEA proposal regarding exportable crypto. the new rules would allow 64 bit keys to be exported, as long as the master key was made available through some key escrow service. now, we know it is relatively easy to break a 40 bit key. additionally, we know it is nearly impossible to break 128 bits. i'm not so sure how hard 64 bits is (need to brush up on that ol' mathematics some time...). why did the govt pick 64 bits? is this length still within the range of the NSA if they really wanted to read something but didn't feel the need or want the exposure of obtaining a key from escrow? i'm curious if anyone thinks this gives us a little more info on the capabilities of the NSA regarding brute forcing a key. additionally, since this *is* an escrow system, why didn't the gov't just go with the unbreakable 128 bit key length? - -pjf patrick finerty = zinc(a)zifi.genetics.utah.edu = pfinerty(a)nyx.cs.du.edu U of Utah biochem grad student in the Bass lab - zinc fingers + dsRNA! ** FINGER zinc-pgp(a)zifi.genetics.utah.edu for pgp public key - CRYPTO! zifi runs LINUX 1.2.11 -=-=-=WEB=-=-=-> http://zifi.genetics.utah.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMDYyb03Qo/lG0AH5AQGhDwP/c2NmiU3IwQSAPuYyFgLG3o8Tc+8i9v7b j8+vdT9wwmBM0hMXtIya6Dnb9hHo+oyBJkL+70N44sV7gy+J6LlZQcY/dNICAdD5 lEJ67YEfKp5Mb010MljsEcwMEIhjZ/IWrhSZipg4rkfIutXCIj6iNvOtOgi9WjKW wz1j7FimJpI= =1j3L -----END PGP SIGNATURE-----

1 0

Cypherpunks on IRC?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Where do the CPs hang out on IRC? I am just giving IRC another try and there was no CP channel (There is now). Perhaps we are too busy writing code? <g> - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDY13yoZzwIn1bdtAQHe7QF8CyJJsrUtP7RPckKwRegQ1yTUbL7wreip moqo7qqcehtE5efi4aCHPMleBU7eZNH/ =DWBj -----END PGP SIGNATURE-----

1 0

Re: 64 bit keys breakable by the NSA or just some random key length?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.LNX.3.91.950819123758.27374A-100000(a)zifi.genetics.utah.edu>, zinc(a)zifi.genetics.utah.edu (zinc) wrote: >why did the govt pick 64 bits? is this length still within the range >of the NSA if they really wanted to read something but didn't feel the >need or want the exposure of obtaining a key from escrow? > >i'm curious if anyone thinks this gives us a little more info on the >capabilities of the NSA regarding brute forcing a key. additionally, >since this *is* an escrow system, why didn't the gov't just go with >the unbreakable 128 bit key length? I think the obvious conclusion would be because 64bits is crackable if need be and if you have the resources the goverment has. Not for routine monitoring of undesirables, but for those special cases where they don't want to expose their activities by requesting a warrant. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDY3jSoZzwIn1bdtAQGV3gGA26/BZOnXiuMuO8IDgGCnnONVhVtL4/o1 5HVVD3Mqfjp3Sr7QJMQMrfD4JRWRphTL =evHi -----END PGP SIGNATURE-----

1 0

Apologies
by Brian Lane 17 Dec '03

17 Dec '03

Sorry, the group of SSL related files wasn't supposed to go to the list. Its been one of those weeks, you know? Brian ----------------------------------------------------------------------------- "A little rebellion now and then is a good thing." | PGP Key and .plan -- President Thomas Jefferson | email Subj: blane-info =============================================================================

1 0

Re: Economic Model for Key Cracking
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:29 PM 8/18/95, Howard Cheng wrote: >We need to make sure that someone did do the work honestly, but I don't know >how to check this (other than doing the work yourself to confirm the results, >but this defeats the whole point of the system). Perhaps we should require >that people buy the work first, and when they report the results, they get >the money back + some profits. The "abstract protocol" that works in many economic transactions is simple: _spot checks_. That is, random samples. You don't have to do all the work yourself. "Quality Control" (QC) is based on this. The "Inspected By: Foobar" tags on manufactured items provided traceability/feedback to a manufacturer--a reputation system, if you will. Lot numbers, seals, etc. Yes, this is an obvious point, but it's interesting because the "spot check" is a kind of protocol that is almost like "cut and choose" in its crypto connotations. >Assuming everyone is honest, I am sure many people in businesses As the Great Leader once said, "Trust, but verify." There is no reason to make assumptions about honesty: just spot check the work and downgrade the reputation of anyone who slacks off or is deceitful. (This "web of distrust," in terms of black marks in reputations, is as important as the web of trust. The same, really. And yet another reason why one doesn't want government=root, as they would undoubtedly frown on anything that was "discriminatory" or "hurtful to the differently abled.") --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Liability for Key Cracking in Idle Hours?
by tcmay＠got.net 17 Dec '03

17 Dec '03

I have a feeling that many businesses will set policies to try to stop their workstations and computers from being used in key cracking attempts. They don't now, mainly because for one thing they don't even know about it, and for another thing, it would be a headache to try to administer such a ban. However, the notion that "IBM Corporation" or "Bank of America" will say "Sure, use our idle CPU time to try to crack keys!" seems farfetched. California is one jurisdiction that has made "hacking" a crime. Not clear what this means, but some construe it to mean that any attempts to break into the account of another--or crack a key--is a crime. Not tested in court, etc. But will Bank of America want to decide whether a key cracking effort is a "legitimate academic exercise" (such as the SSL Challenge was, as it involved no damage to any party) or an attempt to use their computers to break into an account or to otherwise compromise a transaction? (I am NOT saying that key-cracking = hacking, in the negative sense of "hacking," but I can certainly imagine cases where it would be. And when Microsoft Network comes out, soon, I think a lot of people will want to poke holes in its security, as we've already seen a bit of. Corporations will not likely take kindly to being involved in something like this.) Thus, I expect something in between the extremes: -- corporations fear liability and will not openly encourage this, even to make a few extra bucks (and it's not at all clear how such bucks would be made, or if big companies would give a rat's ass about earning a few dollars a night....) -- but people with access to these machines will continue to use them for key cracking, factoring, etc. challenges. Could I be wrong in this? Sure. Maybe companies will not care. I doubt this, though. Damien may be able to tell us if Ecole Polytechnique has raised any questions about his highly-publicized attack on the SSL Challenge key. I will _speculate_ that the normally-security-conscious French are considering policies against this. After all, this is one of the countries that bans private possession of strong crypto. (Or, as a French computer scientist told me recently, "Sure, one can apply for a license for crypto...the procedure is the same as applying for a license for your own private Exocet missile.") --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

DAM_lyz
by John Young 17 Dec '03

17 Dec '03

Information Week of August 28 has a cover story on "Internet Theft." It sees security threats in "freeware public-key encryption algorithms and anonymous remailer programs." BlackNet is red-flagged. Laggard law is cited. "This is where all the crime will be in the 21st century," says Joseph Seanor, a federal government intelligence veteran. "Law enforcement officials are trying to get a handle on it, but they really can't stop it." Seanor adds, "When it comes to technology, criminals always seem to be one step ahead of law enforcement." If you can't steal the damthing: DAM_lyz

1 0

Re: SSL Challenge #2
by Ian Goldberg 17 Dec '03

17 Dec '03

Is there a standard way we're supposed to get together to divvy up the keyspace? Not knowing of any, I'll just announce that I'm working on those keys that start with "a", from 0xafffffffff down to 0xa000000000. I seem to be getting about 200000 to 400000 keys/sec, so it should take about another 2 days (assuming the machines stay up that long...). If anyone wants to join in, feel free. Get original source from http://pauillac.inria.fr/~doligez/ssl/slave.c (Damien's code), and patch it with the diff at the bottom. Note: I don't think there's any crypto in the diff, and the rest of the sources are in France, so this should be OK with the spooks. But you never know... Compile the patched source on anything you can get, and run ./slave -t -d csclub.uwaterloo.ca 9114 The IP is 129.97.134.11 if you need it. You can add -v or -V for more verbosity, and -n num if you have num processors. - Ian "REALLY hoping I didn't screw up the code..." --- dist/slave.c Thu Aug 17 15:19:52 1995 +++ slave.c Sat Aug 19 13:54:25 1995 @@ -297,18 +297,18 @@ register int i; /* set up the block of data */ -#define x0 0xb894890e -#define x1 0x2eb90ebf - x2 = 0x00074450 + ((~stpoint << 4) & 0xff000000); -#define x4 0xa784af30 -#define x5 0x6913f879 -#define x6 0x539b2520 -#define x7 0x75ae60a0 -#define x8 0x90ebbf51 -#define x9 0xe10c2cf8 -#define x10 0x11ac18ea -#define x11 0x2114834c -#define x12 0x000080b6 +#define x0 0x9109c0fb +#define x1 0x15a61060 + x2 = 0x00368f3f + ((~stpoint << 4) & 0xff000000); +#define x4 0x7bea0730 +#define x5 0x61eb659d +#define x6 0x7441bbfa +#define x7 0x5f3a45e8 +#define x8 0x38e6d5c6 +#define x9 0xa1a88cd6 +#define x10 0xf82ecaae +#define x11 0x0296e2c8 +#define x12 0x000080a4 #define x13 0x00000000 #define x14 0x00000188 #define x15 0x00000000 @@ -506,7 +506,7 @@ int w; strcpy (progname, "worker"); - nice (40); + nice (5); while (1){ sock = open_socket (); if (sock == -1){ @@ -547,7 +547,11 @@ Verb1 ("SIGCHLD received\n"); while (1){ +#if 0 pid = wait3 ((void *) &chldstat, WNOHANG, NULL); +#else + pid = waitpid ((pid_t)-1, (void *) &chldstat, WNOHANG); +#endif if (pid <= 0) break; Verb2 ("got child: %ld\n", pid); for (i = 0; i < nproc; i++){ @@ -610,6 +614,7 @@ } } if (!ignore_ttys){ /* then look at ttys */ +#if 0 d = opendir ("/dev"); if (d == NULL) fatal ("opendir"); while (1){ @@ -629,6 +634,7 @@ } } if (errno) fatal ("readdir"); +#endif } } @@ -901,7 +907,7 @@ if (entry == NULL) fatal ("gethostbyname"); memcpy (&serverhost, entry, sizeof (serverhost)); - sanity_check (); + /* sanity_check (); */ speed_test (); init_devices (); supervisor ();

2 1

Spooks and Hackers Inc
by John Young 17 Dec '03

17 Dec '03

Eye-catching quote in the Info Week story on Internet theft: Another threat is the growing number of information brokers who use online communications to match buyers and sellers. An increasing number of these brokers -- many of whom are former government intelligence employees in the United States and Eastern Europe -- work closely with hackers dealing in illicit data. "The biggest security problem organizations face today is information brokers," says Dan White, national director of information security at Ernst & Young in Chicago. "Since the end of the Cold War there have been a lot of people trained in espionage who don't have a lot to do."

1 0

Re: 64 bit keys breakable by the NSA or just some random key length?
by Chris Claborne 17 Dec '03

17 Dec '03

At 12:51 PM 8/19/95 -0600, zinc wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >cpunks, > >i was thinking about the recent Clinton/LEA proposal regarding exportable >crypto. the new rules would allow 64 bit keys to be exported, as long >as the master key was made available through some key escrow service. [good stuff deleted] >since this *is* an escrow system, why didn't the gov't just go with >the unbreakable 128 bit key length? This is the kicker! If what I heard is true, anyone can escrow the keys under this new plan. We know that the govt has no problem breaking it's one rules by saying the magic words "matter of national security", so why don't they require the keys be held by the govt? ... You know they can break it. ... I guess they assume the middle american will buy it! Just kills me. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. PGP-encrypted e-mail welcome!

1 0

Re: The Official Cypherpunks Screen Saver?
by Chris Claborne 17 Dec '03

17 Dec '03

At 11:49 AM 8/17/95 -0700, you wrote: >At 5:11 PM 8/17/95, Jim Gillogly wrote: > >>I would hazard a guess that 90% of the compute cycles in the world are used >>running screen savers... this gives a <lot> of slack for people who would >>like to harness them to perform productive work like making points about >>the strength of security. > >It would really be cool to have a screen saver that did useful work while >displaying pretty pictures. > >Imagine a screen saver, maybe with code modules running in "After Dark," >that updates the screen with keys tried...could be a nice demonstration of With the strength of today's NT workstations (Multi-processor pentium and Alpha chips) this would be a great idea. Every NT workstation ships with a screen saver built in. I'd use that one. Too much fun! ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. PGP-encrypted e-mail welcome!

1 0

The greater socio-economic good
by David Murray slIP 17 Dec '03

17 Dec '03

I came acreossoss this in the july Law UPdate of Phillips Fox, an Auastralasionan law firm. This edition was entitled 'Your money or your E-cash', and hasd a section entitled 'Privacy' which said/says: At the moment, your cahsh transactions cannot be recorded in the same way as your cheque, credit cards or Eftpos spending. This means that your cash spending cannot be readily traced, checked, investigated or analysed. The big excitement for banks, marketing consultants and governments is being able to do all these things. On the other hand, toatally untraceable e-cash will enable huge amounts of money to be moved (laundered) outside the bankiongng systyeem. Consumers will need to make a decision whether they want untraceable e-cash, or to contribute to the greater socio-economic good. I think they're being serious? DM

1 0

Re: Certificates/Anonymity/Policy/True Names
by Richard.Johnson＠Colorado.EDU 17 Dec '03

17 Dec '03

The certificate gets their messages into systems that demand a certification, whether for transport or display. >But this is precisely the issue: what does the *certificate* get any of >these people that a simple digital signature does not provide? > >On Sat, 19 Aug 1995, Rich Salz wrote: > >> I think there are many people who might be willing to use an >> "anon CA" should it exist: >> Whistleblowers, perhaps Deep Throat would have used email >> People writing letters to the editor who don't want to trust >> the editor to withhold their info >> People who desire anonymyity yet don't want to trust the gov't >> to certify their communications as authentic/forged >> (Unabomber, Om Shin-rkyo) >> Any number of writers who have used psuedonyms and now want to >> get paid in ecash; Mark Twain? >>

1 0

EFF, Mike Godwin, Cliff Stoll
by Andre Bacard 17 Dec '03

17 Dec '03

*** PLEASE REDISTRIBUTE FREELY *** Hello CyberFolks, Wednesday, August 16th BayFF (Bay Area Chapter of EFF) held a meeting in San Francisco with speakers Mike Godwin and Cliff Stoll. Attached are a few notes for those of you who missed the opportunity to attend. See you in the future, Andre Bacard ====================================================================== abacard(a)well.com Bacard wrote "The Computer Privacy Stanford, California Handbook" [Intro by Mitchell Kapor]. http://www.well.com/user/abacard Published by Peachpit Press, (800) Enjoy your privacy... 283-9444, ISBN # 1-56609-171-3. ======================================================================= Notes from the BayFF Semi-Underground Authorized by Andre Bacard <abacard(a)well.com> Wednesday, August 16, 1995, I found myself cruising through Golden Gate Park. Suddenly I swerved into the right lane and shouted "Eureka." For those who don't know, Eureka is the California state motto which, in the tradition of the Gold Rush, means "I found it!" In San Francisco IT means a parking place. Feeling euphoric about my good fortune, I started the short walk long on memories towards the Haight-Ashbury district. It was delightful and fogless. The salty air was cool. The smell of grass (the type that city gardener's mow) was fresh. Passing a guitarist, I thought of the Grateful Dead's Jerry Garcia, recently deceased. My mind flashed back twenty-five years ago when I first visited Haight-Ashbury. Twenty- five years ago at the dawn of the Computer Age... So many silicon chips under the bridge... I thought of all the people in the Haight mourning Garcia and donating to the Haight-Ashbury Free Clinic in Garcia's memory. I flashed back upon my first meeting with John Perry Barlow, lyricist for the Grateful Dead and co-founder of EFF. That meeting helped inspire me to write COMPUTER PRIVACY HANDBOOK. Such were a few of the images that danced through my mind as I entered the Cole & Page Street Public Library... It was appropriate to be attending an EFF meeting. John Gilmore, EFF Board Member, was the first person I saw. Gilmore reminds me of a lean Chesire cat. He has a mischievous smile as if to say, "You won't believe what just happened." Maybe we'll never discover what just happened with John, since he's so much into crypto. In any case, Gilmore introduced Mike Godwin as "The first lawyer in Cyberspace and EFF's first employee." Mike Godwin ("a cool guy who survived law school with his personality intact" according to an anonymous EFF publicist) spoke for 90 minutes about how to deal with reporters and, more specifically, about his role in trying to correct the damage done to cyberspace by TIME's infamous "CyberPorn" cover story. Godwin detailed many flaws in Carnegie Mellon University undergraduate Mr. Rimm's study of cyberporn that led to the "CyberPorn" piece. Godwin said of Rimm's paper: "It's as if you surveyed the bookstores in Times Square in Manhattan and generalized to all bookstores in America." Cliff Stoll ("a wild and crazy guy with interesting hair" according to the same anonymous EFF publicist) is the author of the best-selling book SILICON SNAKE OIL. Stoll personifies the eccentric heritage of the San Francisco counter-culture. With lots of humor and drama, Stoll presented a critical view of the Internet. "The Internet is a perfect diversion from learning" and "The Internet opens many doors that lead to empty rooms" were two of his many memorable lines. Stoll noted that wisdom and experience play little role in the Computer Cult (i.e., all the Hype surrounding the Information Superhighway). The EFF events that I've attended at WIRED's office in the San Francisco Mission District and last night are well worth the hassle of hunting down a parking place. To learn more about future monthly BayFF meetings, send this e-mail: To: listserv(a)eff.org Subject: [ignore] subscribe BayFF See you at future events, Andre Bacard P.S. I'm the guy with the fedora hat who people mistake for Indiana Jones.

1 0

Re: Costs of Credit Card Fraud and Brute-Force Codebreaking
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >you're assessment that this cost our anon friend some money to obtain >these cc numbers is simply not true. when you have nothing else to do, >choosing one thing over another involves no cost. if anything, he made >money by using the cc numbers to make long dist calls instead of using >any cash he might have from working or an allowance. > >my $0.02, > There's also the factor that the dumpster diver is - if s/he continues the practise in a certain area - going to learn which dumpsters are more likely to contain valuta, thus reducing the 'overhead'. My ha'penny :-) Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMDZ9h8VrTvyYOzAZAQGQvgP+L/Zq5BChW1Y3ZkN5N0XCe2fw/QbWrgtt 2/6Mxdpg96ureHYfaPaxDTxstCC9pTyD6lrOqkCeu5/Pr/GZ8FFPRzPOx1xDdqmO iufGGeUzRqcTcqRjOFBkBJ9GcZLgsZ3FZ4XtCCwQZ7w5aumBnA8xvfoP7DgCRrp1 55noMpWFwmk= =g27w -----END PGP SIGNATURE----- This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

Re: Spooks and Hackers, etc.
by Alex de Joode 17 Dec '03

17 Dec '03

Brad Dolan sez: : ---------- Forwarded message ---------- : Subject: Internet Police : According to an AP story, Wisconsin Attorney General James Doyle says that : police must monitor the Internet to stop child porn, drug trafficking, and : fraud. : "We need to see that police are surfing the Internet just as other people : are," Doyle said. "This is a good example of where the law is slower than : technology." "Stop Wisconsin Internet Police" "Your'e speeding" "Get Lost" "Get Real" -- Alex de Joode Fear Uncertainty Confusion and Kaos, Inc.

1 0

Netscape to copyright URLs?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Today's surf of Netscape's home page yielded an interesting question. Is Netscape trying to licence links to their products? To me http://home.netscape.com/comprod/mirror/netscape_now_program.html seems to suggest tha you can only display certain logos and info if you are licensed by Netscape. You could for example not put up a link to their "Download Netscape NOW" page without prior approval by Netscape. This seems to be a new development on the web. Since when does one need a license to include certain URLs in one's home page? Comments? - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDbYcCoZzwIn1bdtAQHE1gF/WoY8jEAv16lL1pGylJKp4MZnVsKYRfMe SzgQcpGouFnT6Ij+zwlS7dkuudQIJyvX =b88z -----END PGP SIGNATURE-----

1 0

Would it be legal for a foreign site to carry Netscape?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- If someone would export the full 128 bit version of Netscape, would it be legal to make it available on a foreign site? After all, Netscape is a copyrighted product. TIA, - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDbaNioZzwIn1bdtAQEb/gF+JJ9e3FqwEwIboLX7ISW6X4QWjcO6QCkt gMuEghppSrv2G2sPmzyDzOoweTlglfi/ =Y7nR -----END PGP SIGNATURE-----

2 1

Re: Netscape to copyright URLs?
by harveyrj＠vt.edu 17 Dec '03

17 Dec '03

At 02:39 AM 8/20/95 -0400, Lucky Green wrote: >Today's surf of Netscape's home page yielded an interesting question. Is >Netscape trying to licence links to their products? To me >http://home.netscape.com/comprod/mirror/netscape_now_program.html seems to >suggest tha you can only display certain logos and info if you are >licensed by Netscape. You could for example not put up a link to their >"Download Netscape NOW" page without prior approval by Netscape. > >This seems to be a new development on the web. Since when does one need a >license to include certain URLs in one's home page? > >Comments? > My reading of that page suggests a somewhat different motive and interpretation: what they seem to be doing is copying the Microsoft approach with respect to setting criteria that must be met before you can use their logo on your page/product. It doesn't prohibit putting links to their download page; it just prohibits using their "Netscape Now!" logo without their permission. Note the criteria for being allowed to use their logo: you have to design your server to break with the current "standards" (e.g., CGI) and embrace Netscape's extensions (e.g., backgrounds; client pull/server push, SSL encrypted transactions), which they would like to foist on us as the new "standard." Essentially, they want us to help them create the perception that if you don't show the "Netscape Now!" flag (didn't Nixon have a similar slogan?) on your page, that you're just not a high- quality operation. Or maybe they're trying to change the subject from the unfortunate publicity from the success of SSL Challenge... rj ------------------------------------------------------------ R. J. Harvey email: harveyrj(a)vt.edu WWW for job analysis/personality: http://harvey.psyc.vt.edu/ PGP key at http://harvey.psyc.vt.edu/RJsPGPkey.txt

1 0

MSN hackers heaven (fwd)
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Subject: The MSN is Hacker Heavan As most of us are aware, the commercial online services, such as AOL, Compuserve and Prodigy, represent certain risk to the unsophisticated user. Unfortunately, the Microsoft Network (MSN) raises the vulnerability of such users to unprecedented heights. Key to this vulnerability is the richness and complexity of the MSN/Windows 95 environment. What is most dangerous is the ability for the author of an e-mail or (certain) BBS documents to embed "objects" in that document. These objects can be readily disquised to appear totally benign to the casual user and be nothing more than MSN navigational aids. Once double-clicked by the recipient, these objects can readily infect the recipient's PC with a virus. Worse, what this object could do is only limited by one's imagination. It is worthwhile noting that MSN appears to be migrating to an open architecture, with the MSN user connecting through the Internet. If this is true, there is nothing which prevents an object, once activated, from transmitting information stored on the user's PC to any other location on the Internet. In theory, embedded objects can be interrogated to ensure their validity. Unfortunately, this interrogation process is not likely to be carried out by the average user. Even if it is, the user is not likely to understand what they are looking at. It is like warning automobile drivers to look under the hood of their car before starting it to make sure there is not a bomb inside. Most drivers would assume that the odds were with them. Those that did check would have no idea what they were looking at. (At least that's my feeling when I look under the hood of my car :-). Microsoft's position appears to be that the MSN user is no more vulnerable than one who uses a competing system. I would maintain that this position is just not true. With system complexity comes excessive vulnerability. MSN rates a 9 in complexity. The other services a 4. The bottom line: Users of MSN are placing themselves at significant risk. If one must use MSN, avoid at all cost activating (double-clicking) objects in e-mail messages and BBS posts. Sophisticated users may think they know what they are doing, but it probably won't be long before they are outwitted by someone who figures out how to totally disguise an object's true purpose.

1 0

Re: MSN hackers heaven (fwd)
by Alan Olsen 17 Dec '03

17 Dec '03

>The bottom line: Users of MSN are placing themselves at significant risk. >If one must use MSN, avoid at all cost activating (double-clicking) objects >in e-mail messages and BBS posts. Sophisticated users may think they know >what they are doing, but it probably won't be long before they are outwitted >by someone who figures out how to totally disguise an object's true purpose. It it just Microsoft's way of guaranteeing "good times" for all. ];> (Its a cheap shot, but someone has to take it.) | What mime type is Marcell Marceu? | alano(a)teleport.com | |"Would you rather be tortured by the government | Disclaimer: | |forces or the people's liberation army?" -mklprc | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

A glance at the future of missing child identification
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- We all read the stories. "Infant stolen from crib in Hospital", "Thousands of children abducted every year". Many parents would jump at the anything that might increase the chance of recovering their children should they be abducted. Just take a look at lines during "Child Fingerprint Days" at you local mall. The solution? Transponder implants at birth. Modern transponders can be injected into an infant where they grow into the tissue, unable to be removed without major surgery. If schools make implants a requirenment, such as vaccinations are today, children can be routinely scanned when entering kindergarden. Later in life, the same transponders can be used to verify legal age for obtaining a driver license or purchasing alcohol. The transpoders also provide ID for the ATMs and credit card termials of the future. No criminal can loot your account. You can leave the ATM card at home. How convenient! How do you prevent the dead from voting? Simple. One transponder, one vote. Even better, childmolesters, individuals out on bail or parole, and other "security risks" can be similarily tagged to prevent escape from US jurisdiction. A combination metal detector/scanner for airport and border use is just one of the obvious ideas to increase the value of this technology. For an example of such a transponder see http://www.dfw.net/~tqg/eid/tx1400l.html I predict that you will see the first such implants in children within five years. An enterprising Cypherpunk who has become disillusiond that the statists can be stopped could make a fortune by offering a "Children's Safety Identification Service." Any idea if offering such a service would require an M.D. or only a R.N.? Perhaps even a cosmetology licesnse would suffice, since "body piercers" do similar insertions every day. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDeIayoZzwIn1bdtAQFo3QGAzU13qIy4qIeKQ7F13JtmnRE4Oo4AsXpt RktLZfE/8K8EauRuisl/MxU23oMkTgD0 =Vm+o -----END PGP SIGNATURE-----

1 0

Re: NSA into antigravity?
by tcmay＠got.net 17 Dec '03

17 Dec '03

(No, I see no relevance for "coding in C," but even critics of "off-topic" posts have commented on this, so I will too, especially as how physics was my old career and in 1974 I interviewed with a Santa Barbara company doing ICBM geogravitic trajectory work.) At 5:50 PM 8/20/95, Sandy Sandfort wrote: >I can see why the folks at Ft. Meade would be hinkie about such >measurements being made around them. No need to hypothisize >micro-singularities or anti-gravity experiments. Occam's Razor >in action. I can't. At least not with regard to microgravity measurements. If you mean missile trajectory stuff, this is extremely implausible. A missile targetted at Fort Meade is not going to be deflected by more than a few centimeters (if that much) by nearby variations...the missile is moving very fast and there's little "integration time" for slight errors in trajectory to build up. (Also, but related to this, the closing trajectory is near vertical, so it's doubly hard to imagine local g-field anomalies affecting the point of impact.) As to what the folks were doing with their equipment, I have no idea. Maybe measuring water tables in and around the Chesapeake Bay (only a few miles from the Fort). The NSA people probably were upset with the equipment itself, not the idea that Meade was being more precisely targetted for ICBMs. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

MSN hackers heaven (fwd)
by John Young 17 Dec '03

17 Dec '03

This is a variation on Brad's forward of the MSN security hole: Information Week, August 28, 1995, p. 24. Risk Looms On Microsoft Network. E-mail icons can hide viruses. A feature designed to make electronic mail easy to use on the Microsoft Network online service may also make it easier for hackers to trick users into running destructive software programs on their PCs. When a Microsoft Network user sends a binary file embedded in an E-mail message, the file appears as an icon on the recipient's screen. The recipient can double-click on the icon to automatically download the embedded file and execute it. To download the file without executing it, the recipient must use the mouse's right button, which has been rarely needed until now. Though other online services offer automatic downloading of files, Microsoft's goes one step further in allowing the file's automatic execution. That file could be a virus or other malicious program that could erase files or reformat a hard disk, according to Mike Wyman, VP and chief technical offficer of Interactive Data Corp., an investment information firm in Lexington, Mass., and a Microsoft Network beta user. "On the Microsoft Network, I can disguise an icon so that it looks innocuous," says Wyman. "The analogy I like to use is the Unabomber. If you get a package in the mail that's wrapped in duct tape and brown paper, you'd regard it as suspicious. But if it's a plain white envelope with Ed McMahon's picture on it, you wouldn't think twice about opening it." Microsoft says the feature is a convenience, not a security hole. "There are risks of getting [data] off the network in any form," says George Meng, group product manager for the Microsoft Network in Redmond, Wash. "People have to be aware of what the source of information is." Winn Schwartau, president of Interpact Inc., a computer security consulting firm in Seminole, Fla., disagrees. "If the ability to execute programs bypasses conventional filtering and virus controls, then you certainly have a security hole," he says "Potential 'Trojan horse' programs could be sent by anyone." By Mitch Wagner and Clinton Wilder [End]

1 0

Re: Netscape to copyright URLs?
by Lindsay Haisley 17 Dec '03

17 Dec '03

At 02:39 AM 8/20/95 -0400, you wrote: >Today's surf of Netscape's home page yielded an interesting question. Is >Netscape trying to licence links to their products? To me >http://home.netscape.com/comprod/mirror/netscape_now_program.html seems to >suggest tha you can only display certain logos and info if you are >licensed by Netscape. You could for example not put up a link to their >"Download Netscape NOW" page without prior approval by Netscape. > >This seems to be a new development on the web. Since when does one need a >license to include certain URLs in one's home page? The Netscape general info document specifically states .... >Aside from the ftp mirrors we list on our home page, we do not allow >redistribution of our software. This means that it is not legal to put >our software on your ftp server, nor to include it on disks you are >distributing, although you're more than welcome to include a pointer to >our home pages so that people can download the latest version for >themselves. They have specifically given permission here for links, at least to their home pages, possibly even to other items such as a downloadable netscape. (______) Lindsay Haisley (oo) "The bull FMP Computer Services /------\/ stops here!" fmouse(a)fmp.com / | || Austin, Texas, USA * ||---|| (512) 259-1190 ~~ ~~

1 0