December 2003 - cypherpunks-legacy

RE: rant on the morality of confidentiality
by Wayne Radinsky 17 Dec '03

17 Dec '03

> dilemmas do not prove a concept does not exist. That's correct. My point is natural selection can explain why the dilemma exists. > there are pretty clear cut cases Natural selection also explains why there are "clear cut" cases, since it assumes our "moral sense" is just our mental accounting of reciprocal altruism: what we've done for others and what (we think) others owe us. > natural selection does however support the idea of altruism. natural > selection does not require each individual seek survival. various aspects > of the genetic code that lead to survival of the species are what are > truly favored. a breed of animals that does nothing but try to kill > each other off leads to a situation where each individual is maximizing > the odds of its own DNA propagating, no? but how long would such a > species survive? and extra credit, to what "animal" am I actually > alluding to here? You are correct: the object is survival of the gene and this can be at odds with survival of an individual. This applies to all animals and even "non" animals; so I have no way of knowing which "animal" you are alluding to. > natural selection is relevant among species that have no intelligence > or intellectual control over their own destiny. it is only relevant to > humans insofar as we wish to behave like animals. Our "intelligence" itself evolved, presumably, because it enhanced genetic fitness in the evolutionary past. Intelligence exists to increase, rather than overcome, inclusice genetic fitness. >>So it is a myth that scientists live to find deep truths or to benefit humanity >>. They may do those things, but their real goal is maximizing their own >>inclusive fitness. > > false, even by your own reasoning, because a scientists DNA does not > necessarily lead to more scientist DNA. sons and daughters of scientists > may be anything they wish to be in a free country. All that is required is that the offspring can survive and reproduce. Scientists use their jobs as "scientists" to fund survival and reproduction. > natural selection among animals. and a pretty scary mind that would > consider us on that level. I agree there are some vague parallels for > human development. but humans do not have children in the mindless way > that animals breed, The use of birth control causes the trait, "conscious desire to have children" (and not use birth control) to be selected. It was not required before, so natural selection gave more weight to sex drive and love of offspring. > nor hopefully do they live their lives according > only to evolutionary instincts, The whole premise of evolutionary psychology is that we live according to evolutionary instincts, it's just that those instincts (and our behavior) are very complex, and that "consciousness" and "free will" are illusions. > but of course letters like yours tend > to make me wonder, and I'm being deliberately ambiguous here by what > I mean by that <g> Of course most people are bothered by the idea that copying genes is the only thing their life (and all lives) are about. Life is totally meaningless if you follow Darwin's logic to its conclusion, and the alternative is religion and belief in the afterlife. I personally believe someday we will see a synthesis of the two, but at the present, which to believe is a philosophical decision. ---------- From: Vladimir Z. Nuri[SMTP:vznuri@netcom.com] Sent: Thursday, January 15, 1998 12:52 PM To: Wayne Radinsky Cc: 'Blanc'; 'cypherpunks(a)cyberpass.net'; 'tcmay(a)got.net'; 'vznuri(a)netcom5.netcom.com'; vznuri(a)netcom11.netcom.com Subject: Re: rant on the morality of confidentiality philosophers have struggled with what is moral since the beginning of civilization. at least they are struggling with the question. each new civilization and era gives a new answer to the question, "what is morality", and hopefully each is more evolved than the last, unless humanity is regressing. "what is morality" is obviously something that cannot be settled in cyberspace, it hasn't even been settled by great writers, and there are only mediocre and borderline insane minds in cyberspace <g> >The reason morality is impossible to nail down is because it does not exist al >all in any absolute sense, at least as far as science is concerned. If you dec >lare, for example, that "murder" is "wrong" you are always left with dilemmas, >such as whether soldiers who kill during a war are doing something "wrong". dilemmas do not prove a concept does not exist. there are pretty clear cut cases, and less well clear cut cases. those that have difficulty with the concept of morality will tend to focus on the fuzzy cases and conclude that the whole exercise is a waste of time. >According to the principle of natural selection, all people, including scientis >ts, exist purely to maximize their own inclusive genetic fitness. "Fit" means >that an organism is well adapted to it's environment, so "maximizing inclusive >genetic fitness" means having the maximum number of offspring which are themsel >ves fit. natural selection does however support the idea of altruism. natural selection does not require each individual seek survival. various aspects of the genetic code that lead to survival of the species are what are truly favored. a breed of animals that does nothing but try to kill each other off leads to a situation where each individual is maximizing the odds of its own DNA propagating, no? but how long would such a species survive? and extra credit, to what "animal" am I actually alluding to here? >The underlying reason people benefit by promoting themselves as moral people, i >n general, is because of the benefit of what evolutionary psychologists call re >ciprocal altruism. With reciprocal altruism, both parties benefit if they are >in a non-zero-sum situation. Because most situations are non-zero-sum and the >benefits are so great, everyone has a stake in promoting themselves as a good r >eciprocal altruist, in other words, a good, trustworthy, moral person. This is > how natural selection explains the existence of the concept of "morality". natural selection is relevant among species that have no intelligence or intellectual control over their own destiny. it is only relevant to humans insofar as we wish to behave like animals. >So it is a myth that scientists live to find deep truths or to benefit humanity >. They may do those things, but their real goal is maximizing their own inclus >ive fitness. false, even by your own reasoning, because a scientists DNA does not necessarily lead to more scientist DNA. sons and daughters of scientists may be anything they wish to be in a free country. >The only way out is to believe in the afterlife, and religion, and that life ha >s meaning beyond the genes and material world. Doing so doesn't make moral dile >mmas go away, and you never know, people may just be believing such things for >the benefit of genes, after all natural selection has no real concern for "trut >h". natural selection among animals. and a pretty scary mind that would consider us on that level. I agree there are some vague parallels for human development. but humans do not have children in the mindless way that animals breed, nor hopefully do they live their lives according only to evolutionary instincts, but of course letters like yours tend to make me wonder, and I'm being deliberately ambiguous here by what I mean by that <g>

1 0

Re: proving that one knows how to break RSA
by Anonymous 17 Dec '03

17 Dec '03

Dimitri Vulis <dlv(a)bwalk.dm.com> writes: > Adam Back <aba(a)dcs.ex.ac.uk> writes: > > Dimitri Vulis <dlv(a)bwalk.dm.com> writes: > > > Bill Payne was with Sandia national lab (where they quite a bit of > > > crypto work) Bill claims to have discovered a very fast > > > factorization algorithm using shift registers, which he refuses to > > > publish. While I haven't seen the algorithm, I believe he may well > > > be right. > > > > Bill Payne's claim to having discovered a faster factorization > > algorithm than the current state of the art, allows us to invoke the > > oft discussed mechanisms for the author to prove this ability without > > divulging the algorithm, and then proceed to sell the algorithm to the > > highest bidder, whilst minimizing his chances of being killed. > ... > I believe Bill is genuinely afraid that if he published his algorithm, > then he'll be killed. I don't know enough to judge how realistic his > fear is. I've been involved in serious discussions of assassinations > over smaller amounts of money than is at stake here. He displays great > courage by saying anything at all at this point. Oh, please. Payne's so-called faster factorization algorithm was discussed on this list May 13. See the archives under the thread title "Public Key Break Paper". The algorithm is total garbage. Payne is obviously a nut case who is setting himself up for a contempt of court charge.

2 1

No Subject
by Mix 17 Dec '03

17 Dec '03

Timothy C. May sits at his terminal dressed in five-inch stiletto heels, fishnet stockings, a gold-lame mini-skirt, a purple halter with girdle underneath to keep in his flabby gut, a Fredericks of Hollywood padded bra also underneath the halter, a cheap Naomi Sims pink afro wig, waiting to yank his crank whenever a black man responds to one of his inane rants. \ o/\_ Timothy C. May <\__,\ '\, |

1 0

Re: RSA hardware
by Ryan Lackey 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Lucky Green: > The more I think about it, the less sense it makes to me to use a dedicated > hardware accelerator. I have seen $3,000 hardware accelerators that are > outperformed by a PP200. The nCipher device is excellent. 100 1024 bit RSA > signing a minute for $5,000. How much would be a nice multi-processor Alpha > that does about the same number of signings? Or just a stack 10 of Pentiums? > > Before buying an accelerator, make sure to do the math. Eric Young posted > timings for various common CPU's a while back. Keep in mind that there are metrics other than just keys per second for comparison. Often, hardware devices are certified RED/BLACK isolation devices, TEMPEST certified, tamper-resistant, etc. They are also usually easier to maintain than software systems on GP hardware. Also, the major consumers of such devices, the government/military, spend a *lot* more on hardware/software/user maintenance than any cypherpunk. Their computers are usually TEMPEST certified, etc., so their curve is a lot higher up. Assuming efficient markets, the reason so few of these devices are sold outside the military is that they're overpriced except for those in the same situation as the military. though :) I've been thinking of buying a wicked-fast FPGA prototyping board and making my own coprocessor. There are some really nice gate arrays, and David Honig has some fairly wonderful plans for how to use them for things like Blowfish, etc. I've mainly concentrated on high-speed symmetric ciphers, but they'd be applicable to RSA/DH, I believe. For one blowfish implementation, the limiting factor (assuming key setup can be done efficiently) is the PCI bus, I think. - -- Ryan Lackey rdl(a)mit.edu http://mit.edu/rdl/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNMMyzKwefxtEUY69AQGruwgAgsJTym5TsaFLVGgBXQQpUYwd8Ar2lquU SFM9F1LYLTQjcBIlzh9h3cQdfE2sOkpjENmVGqUvPhyZLwRAC5eWfHL8H/y0giIW 9Y+1xYY1pY3t/O7w5WgYDwye1fzbL5KDz4XEYKX830LWjShfAZhQxahzLbZd+qnd Z6KpjSnylTb9YSp+i5rafgk/i8GnjqFdv5925reexzFBhy/FQi3xwweJWxeRWa+o tNX4G/D7W2r1Lq4Z6Yxbk3dTDddif26UTE12M8EENhhlr/6VCO0zGI59VePUC55w ZeqgUDGviqe/il1EUMIKUfNdSYBJ0Ur5T4TL2lVYDPrZ6q4KjnHPjA== =9ejF -----END PGP SIGNATURE-----

2 1

Re: Barry Smith (FBI) to speak on encryption policy
by William H. Geiger III 17 Dec '03

17 Dec '03

Anyone going to this? ------------------------------------------------------------------------- The following message is forwarded to you by "William H. Geiger III" <whgiii(a)invweb.net> (listed as the From user of this message). The original sender (see the header, below) was "Dr. Alan Sherman" <sherman(a)gl.umbc.edu> and has been set as the "Reply-To" field of this message. ------------------------------------------------------------------------- >From: "Dr. Alan Sherman" <sherman(a)gl.umbc.edu> >Newsgroups: sci.crypt >Subject: Barry Smith (FBI) to speak on encryption policy >Date: 19 Jan 1998 01:54:28 -0000 >Organization: University of Maryland, Baltimore County Campus >Lines: 55 >Message-ID: <69ubok$lkn(a)news.umbc.edu> >NNTP-Posting-Host: news.umbc.edu >NNTP-Posting-User: sherman >Path: edison.dotstar.net!pull-feed.internetmci.com!news-out.internetmci.com!newsfeed.internetmci.com!204.59.152.222!news-peer.gip.net!news.gsl.net!gip.net!feeder.qis.net!news.umbc.edu!not-for-mail The UMBC Security Technology Research Group presents A Law-Enforcement Perspective on Encryption Policy Barry Smith Supervisory Special Agent, FBI moderated by journalist Peter Wayner 3:30pm - 5:00pm Friday, March 6, 1998 Lecture Hall V (LOCATION SUBJECT TO CHANGE) University of Maryland, Baltimore County http://www.cs.umbc.edu/events/spring98/crypto.shtml The second lecture and discussion in a two-part forum on encryption policy. Journalist Peter Wayner will introduce and moderate the event, which is free and open to the public. In Part I, freedom activist John Gilmore and Fritz Fielding (Ex-Associate General Councel, NSA) gave their divergent views, focusing on the Burnstein case. Barry Smith will articulate the needs of law enforcement to conduct lawful wiretaps; he will advocate the use of key-recovery techniques to achieve this end as a way that provides adequate privacy to law-abiding citizens. Schedule: The event will begin with a brief (10 minute) introduction by Peter Wayner. Following Barry Smith's talk, which will last approximately 45 minutes, there will be an opportunity to ask questions for approximately 20-30 minutes. Questions: Attendees are encouraged to ask questions in advance by sending email to sherman(a)cs.umbc.edu Directions: Take Exit #47B off interstate I-95 and follow signs to UMBC. LH V is on the 100-level of the Engineering Computer Science (ECS) Building, directly behind the University Center. There is a visitor's parking lot near the I-95 entrance to UMBC. Host: Dr. Alan T. Sherman Associate Professor, Computer Science sherman(a)cs.umbc.edu http://www.umbc.edu (410) 455-2666 This event is held in cooperation with the UMBC Intellectual Sports Council Honors College Phi Beta Kappa honors society CMSC Council of Majors IFSM Council of Majors ----------------------------------------------------- -- End of forwarded message ----------------------------------------------------- -- --------------------------------------------------------------- William H. Geiger III http://users.invweb.net/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://users.invweb.net/~whgiii/pgpmr2.html --------------------------------------------------------------- Tag-O-Matic: One man's Windows are another man's walls.

1 0

Re: proving that one knows how to break RSA
by John Young 17 Dec '03

17 Dec '03

Anonymous wrote: >Oh, please. Payne's so-called faster factorization algorithm was >discussed on this list May 13. See the archives under the thread title >"Public Key Break Paper". The algorithm is total garbage. Payne is >obviously a nut case who is setting himself up for a contempt of court >charge. We posted the notice about Payne's RSA paper. There's an archive of his (and fellow Sandian Art Morales') NSA suit and links to his papers : http://jya.com/whpfiles.htm Perhaps Bill's a nut case, and if so, he's probably a bellweather of other disaffected researchers in classified work who are being trashed for refusing to continue Cold War violations beyond the original conditions for signing secrecy agreements, and who are being ostracized by those who want the perks to continue. What folks like Payne are going to do with what they learned about what the USG has been up to is a good question. And what the USG will do to them if they start to tell is more so. That's what Payne's NSA suit is about, and it may be more consequential than the all-too-sane Bernstein, Karn and Junger suits. That will depend on what Payne chooses to reveal in spite of secrecy agreements. We may never know what Bill knows about faulty cryptography if DOE settles with him and Morales. Alternatively, he confesses to a fear of flying, for the reasons Dimitri states, based on what he says he knows of the insane accusations and actions of the TLAs when their own comfort and security is threatened by an ex-insider.

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord ?"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"cracker"} = "<remailer(a)anon.efga.org> cpunk mix remix pgp hash ksub esub latent cut ek reord post"; $remailer{'redneck'} = '<config(a)anon.efga.org> newnym pgp'; $remailer{"bureau42"} = "<remailer(a)bureau42.ml.org> cpunk mix pgp ksub hash latent cut ek"; $remailer{"neva"} = "<remailer(a)neva.org> cpunk pgp pgponly hash cut ksub ?"; $remailer{"lcs"} = "<mix(a)anon.lcs.mit.edu> mix"; $remailer{"medusa"} = "<medusa(a)weasel.owl.de> mix middle" $remailer{"McCain"} = "<mccain(a)notatla.demon.co.uk> mix middle"; $remailer{"valdeez"} = "<valdeez(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"arrid"} = "<arrid(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"hera"} = "<goddesshera(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"htuttle"} = "<h_tuttle(a)rigel.cyberpass.net> cpunk pgp hash latent cut post ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix reno winsock) (weasel squirrel medusa) (cracker redneck) (nym lcs) (valdeez arrid hera) This remailer list is somewhat phooey. Go check out http://www.publius.net/rlist.html for a good one. Last update: Thu 23 Oct 97 15:48:06 PDT remailer email address history latency uptime ----------------------------------------------------------------------- hera goddesshera(a)juno.com ------------ 5:03:45 99.86% nym config(a)nym.alias.net +*#**#**### :34 95.82% redneck config(a)anon.efga.org #*##*+#**** 2:00 95.44% mix mixmaster(a)remail.obscura.com +++ ++++++* 19:18 95.27% squirrel mix(a)squirrel.owl.de -- ---+--- 2:34:19 95.16% cyber alias(a)alias.cyberpass.net *++***+ ++ 11:26 95.11% replay remailer(a)replay.com **** *** 10:06 94.93% arrid arrid(a)juno.com ----.------ 8:50:34 94.41% bureau42 remailer(a)bureau42.ml.org --------- 3:38:29 93.53% cracker remailer(a)anon.efga.org + +*+*+*+ 16:32 92.80% jam remailer(a)cypherpunks.ca + +*-++++ 24:14 92.79% winsock winsock(a)rigel.cyberpass.net -..-..---- 9:59:18 92.22% neva remailer(a)neva.org ------****+ 1:03:02 90.39% valdeez valdeez(a)juno.com 4:58:22 -36.97% reno middleman(a)cyberpass.net 1:01:28 -2.65% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

religious discrimination alive and well in NEW Zealand (fwd)
by John Hackworth 17 Dec '03

17 Dec '03

Hmm. freedom(a)freedom-press.co.nz wrote: > this is not a spam > you may not be interested in this religion but the powers to > be are attacking a basic human right. So whats new.? > read how a new zealand couple are being prosecuted for their > religious beliefs > http://www.freedom-press.co.nz > Read the kiwi gemstone file,you may be suprised > just email us for a copy.put" kiwi "in the suject line > or join are mailing list for the latest in govt conspiracies > just type" join" in the suject line > The truth shall set you free (perhaps)

1 0

Fwd: FYI: Jefferson Club: "A World of Strong Privacy: Promises and Perils of Encryption"
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 Date: Fri, 16 Jan 1998 15:58:21 -0800 To: mac crypto list <mac-crypto(a)vmeng.com> From: Vinnie Moscaritolo <vinnie(a)vmeng.com> Subject: Fwd: FYI: Jefferson Club: "A World of Strong Privacy: Promises and Perils of Encryption" Sender: <mac-crypto(a)vmeng.com> Precedence: Bulk >>The Jefferson Club is proud to present: >>David Friedman, Professor of Law at Santa Clara University >>to speak on >>"A World of Strong Privacy: Promises and Perils of Encryption" >> >>Luncheon >>Wednesday, February 25th >>12:00 noon >>Ming's Villa in Palo Alto >> >>Reserve your place at http://www.ipser.com/jeffersonclub. >> >>A major theme in discussions of the influence of technology on society has >>been the computer as a threat to privacy. It now appears that the truth is >>precisely opposite. Three technologies associated with computers, public key >>encryption, networking, and virtual reality, are in the process of giving us >>a level of privacy never known before. The U.S. government is currently >>intervening in an attempt, not to protect privacy, but to prevent it. >> >>Professor Friedman will explain the technologies and demonstrate that current >>developments, if they continue, will produce a world of strong privacy, a >>world >>in which large parts of our lives are technologically protected from the >>observation of others. He will discuss the likely consequences, >>attractive and >>unattractive, of that change and provide a brief account of attempts by >>the U.S. >>government to prevent or control the rise of privacy. >> >>For a preview of the talk, see "A World of Strong Privacy: Promises and >>Perils of >>Encryption" >>(http://www.best.com/~ddfr/Academic/Strong_Privacy/Strong_Privacy.html) >>Come prepared with questions for Professor Friedman. >> >>For more information or to reserve your place, visit: >>http://www.ipser.com/jeffersonclub >> > > >_ Vinnie Moscaritolo http://www.vmeng.com/vinnie/ Fingerprint: 3F903472C3AF622D5D918D9BD8B100090B3EF042 "You can get a lot more with a smile and a gun then a smile, alone." - Al Capone --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

More Software Controls
by John Young 17 Dec '03

17 Dec '03

Denise Caruso reports today in the NYT on upcoming copyright legislation that would prohibit circumventing any copyright protection on digital works. Quote: Many products on the market would qualify for circumvention devices. These include software that allows systems managers to gain access to computers when users lose their passwords and any device used to test the strength of computer security -- products that cannot be tested without trying to break protection technology. There's also a report on The WWW Consortium's vote a few days ago to include the PICS standard for Web infrastructure and the vote's import for censorship. The report notes that technologists are now making decisions about public policy once dominated by lawyers, and defending the self-serving practice much the same: it's for the public good. http://www.nytimes.com

1 0

Eureka! Tue Jan 20 '98
by eureka＠eureka.abc-web.com 17 Dec '03

17 Dec '03

Welcome to Tuesday's issue of Eureka! DIGITAL EROTICA Featuring thousands of quality, hand-picked images, stories, streaming movies, live strip shows, free video-conferencing and a Usenet Decoding Service with Thumbnail Previews, for a limited time they are offering FREE trial memberships. Cool! DigitalErotica ........ http://www.digitalerotica.com/dream/ PLEASE VISIT THIS FINE EUREKA! PARTNER SITE THE ULTIMATE HARDCORE SITES http://sexplosion.com/adverts.shtml An incredible collection of over 30 sites featuring the hottest free hardcore photos. The pix are easy to find and the sites are all very accessible. You won't be disappointed. RAGTOP'S LESBIANS Click the link titled Ragtop's lesbian archives, from there you are onto some super hot free pix! It is a lesbian zone unlike any other on the entire world wide web. You have to cruise by this one! Dildos, pussy, pussy and more pussy. Go to this website right now you will not be sorry one byte! Ragtop's Lesbians .......... http://www.ragtop.com/Lez1.html SWEET LIPS Here we have some hot looking babes licking each others tits. Not a bad place to park your browser for a while. The image quality is very good. The women are in all sorts of sexy positions and licking a lot of pussy. Go and take a look! ................ http://islanderotica.nf.ca/SweetLips/ INDEX OF LESBIANS Interesting website. This falls under the no frills category. Just simple links to really hot images! Blondes with dildos, strap ons, surfer girls. Some images are gone but the ones that are there are good. You would be crazy to not look. .... http://www.sacattlemen.com/adult/lesbian.html CALIFORNIA GIRLS One of the true golden websites out on the Internet. Check this one out for sure. There is only eight images but the really cool thing is that they are thumnails of some of the hottest pussy action out there. Girl on girl, pussy spreads Some of these pictures are almost life sized! Very high quality images at full 1024 x 768 size! Go there right now! California .... http://sex.clubx.com/california/cbff100.html FREE STREAMING VIDEO Please note that most of these feeds require a Netscape bro- wser in order to successfully view them. Unfortunately Micr- osoft's browser does not have all the features of Netscape's yet. However, many of the feeds use the RealPlayer and will work in most browsers. If you do not have Netscape and want a free copy click here ... http://www.netscape.com/download/ Hardcore ........................ http://204.244.215.7/anal/ CHAT WITH OTHER READERS This chat is growing fast, and already there are a number of regulars you will meet most days. It's good to see Eureka! readers interacting with each other and having a great time! Adult/Sex Chat .................. http://137.39.63.229/chat/ General/Fun Chat ........ http://137.39.63.229/chat/funchat/ THE BEST PHONE SEX NEW!!!! LD Call only! - Live Hot Girls!!!!....1-664-410-3912 LIVE: 1-on-1, 2-on-1, Group, Dateline.........1-800-644-8779 FREE: Live 1-on-1 (international call only)....011-678-77416 AMATEUR SITE OF THE DAY MASHA & NATASHA: These 2 Russian imports make me wonder why we ever had a Cold War, because these chicks are HOT! So pour yourself a glass of vodka, grab some caviar and enjoy these lovely ladies. ............................ http://amateurindex.com/eureka/ EROTIC STORY SITE OF THE DAY VoyeurStories.com: Want some sizzling free voyeur erotic stories accompianied by GENUINE hidden camera pics? Satisfy your peeping tom curiosity by visiting VoyeurStories.com.... .............................. http://www.voyeurstories.com/ DAILY CARTOON ........... http://www.erosinorbit.com/eureka/ ADULT STAR PIC OF THE DAY Every day we bring you an exclusive choice pic of a famous adult porn star. And we must tell you - these pix are abso- luletly brilliant! .... http://www.xxxadultstars.com/eureka/ GAYEUREKA! The gay newsletter is now available. You can get it here! Gay Eureka! ........... http://eureka.abc-web.com/gayeureka/ EUREKA! TRANSLATIONS As well as English you can now choose any of these languages DEUTSCH ....... http://eureka.abc-web.com/eureka/deutsch.htm ESPAÑOL ....... http://eureka.abc-web.com/eureka/espanol.htm FRANÇAIS ..... http://eureka.abc-web.com/eureka/francais.htm ITALIANO ..... http://eureka.abc-web.com/eureka/italiano.htm PORTUGUESE . http://eureka.abc-web.com/eureka/portuguese.htm TODAY'S FREE PIX Pic 1 ........................... http://137.39.63.229/?200 Pic 2 ........................... http://137.39.63.229/?201 Pic 3 ........................... http://137.39.63.229/?202 Pic 4 ........................... http://137.39.63.229/?203 Pic 5 ........................... http://137.39.63.229/?204 Pic 6 ........................... http://137.39.63.229/?205 Pic 7 ........................... http://137.39.63.229/?206 Pic 8 ........................... http://137.39.63.229/?207 Pic 9 ........................... http://137.39.63.229/?208 Pic 10 ........................... http://137.39.63.229/?209 ============================================================ TO UNSUBSCRIBE FROM THIS NEWSLETTER, USE THE REPLY FUNCTION IN YOUR EMAIL PROGRAM, AND SEND THIS EMAIL RIGHT BACK TO US. ============================================================

1 0

This is so Incredible!
by garte6493＠compuserve.com 17 Dec '03

17 Dec '03

Work SMART......not hard! You can easily make hundreds a week just passing out this 800 number with your code number. Many are making thousands a week. This is positively the easiest money that I have ever made! The company does the selling for you, closes the deal, and sends you $100 for every sale PLUS monthly residual income. I have done a lot of programs but believe me, NOTHING comes close to this! Don't miss this opportunity! Call now! 1-800-811-2141 Code #44737 . 8 - 10 Mon-Sat (CST) (This is HOT! If it is busy, keep trying). In Canada call 1-800-588-9786 Code #44737 Shirley maceywW(a)hotmail.com The NUMBER #1 homebased business for 2 years in a row! ************************************************************************ To be removed from this list, please send remove requests to remove(a)remove.org. ************************************************************************ *************************************************************************** No Reply. Because of illegal acts by internet terrorists upon bulk friendly ISPs (mail bombs, hackers, ping attacks, etc) we regret that we cannot supply a valid reply address. ***************************************************************************

1 0

Congress' *real* job...
by lcs Mixmaster Remailer 17 Dec '03

17 Dec '03

>Congress' real job should not be passing laws providing funding, prohibiting >activities, etc. It *should* be in creating and passing Constitutional >amendments per the 10th that re-define the responsibilities and duties of >the federal government within the changing millieu of the current society. >This way the people via their state representatives have a much closer input >into what the feds are actualy enpowered to do and to who. Be careful what you wish for. This Congress is far more likely to pass amendments nullifying the 2nd, the 1st, the 6th, the 4th, and others. And they'll probably rewrite the 13th to read "no involuntary servitude...unless we say so."

2 1

Forwarded mail...
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: 19 Jan 1998 20:20:01 -0000 > From: lcs Mixmaster Remailer <mix(a)anon.lcs.mit.edu> > Subject: Congress' *real* job... > Be careful what you wish for. This Congress is far more likely to pass > amendments nullifying the 2nd, the 1st, the 6th, the 4th, and others. And > they'll probably rewrite the 13th to read "no involuntary servitude...unless > we say so." For Congress to pass a single amendment they must get 3/4 of the states to ratify the amendment. That's the check that keeps Congress from going nuts and gives the individual states a measure of equality. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Amending the Constitution
by Jim Choate 17 Dec '03

17 Dec '03

Hi, It is of some import to note that the legaly amend the Constitution takes considerably more than the 51% that those happy go lucky anarchists are so fond of quoting...it actualy takes 75%. ARTICLE V. [Constitution: how amended; proviso.] The Congress, whenever two thirds of both Houses shall deem it necessary, shall propose Amendments to this Constitution, or, on the Application of the Legislatures of two thirds of the several States, shall call a Convention for proposing Amendments, which, in either Case, shall be valid to all Intents and Purposes, as Part of this Constitution, when ratified by the Legislatures of three fourths of the several States, or by Conventions of the three fourths thereof, as the one or the other Mode of Ratification may be proposed by the Congress; Provided that no Amendment which shall be made prior to the Year One thousand eight hundred and eight shall in any Manner affect the first and fourth Clauses in the Ninth Section of the first Article; and that no State, without its Consent, shall be deprived of it's equal Suffrage in the Senate. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Eternity service??
by Kay Jones 17 Dec '03

17 Dec '03

Hello....listen, I was referred to you by a friend of mine who is helping me with a page I would like to create. I am a mom of three, aspiring Doula and EMT, and an advocate for natural pregnancy, childbirth, extended breastfeeding and attachment parenting. Here is why I am writing to you: Recently I was to coach a good friend of mine through her labor and birth. She very much wanted a natural birth and had written a very specific birth plan and had planned on signing waivers to release the hospital and docs from any legal action if anything went wrong. When we went to the hospital, the midwife on duty threw down her birth plan and told her that her child would be delivered on HER terms (the midwife's) or not at all. She literally forced me to leave my friend, and then had her physically restrained to insert IV's and apply monitors which my friend had NOT consented to, and in fact had specifically said she didn't want. Then, later, during the actual birth, the midwife let my friend's vagina tear horribly instead of giving her an episiotomy as she said "You want a natural birth...do it yourself" Then, my friends new baby was taken from her, and she didn't get to see the baby for three hours after the birth. The baby was subjected to tests and proceedures that my friend had specifically requested not be done, and the baby was given a bottle in spite of the fact that my friend wanted to nurse her baby. Anyway, my intent is to open a page to expose these so called 'medical professionals' for what they are.....butchers! What happened to my friend was pure and simple assault, but she has not much recourse, as this happened in a military hospital. Her husband, like mine is in the Army, and they are not very high ranking soldiers, so the risk of reprocussions (sp?) to them is very high if she takes action. I know that is the norm for most army hospitals, and I would like to open a *safe* arena for women to read and be warned of these people, by NAME and rank, and location, and also a *safe* place for them to post their horror stories with warnings also. Many people are afraid of being sued...I could care less tho my husband is a bit paranoid... do you see what I am trying to say here? Can you help me? Please let me know as soon as possible :) Thanks! -- Kay Jones KayEC/KayTIS/KayKDZ/KeWEL/KayOfBoz http://www.vvm.com/~kjones *Peace On Earth Begins At Birth* ICQ: 2935300

2 2

Re: British Ministers Adopt Unbreakable Crypto
by Bruce Schneier 17 Dec '03

17 Dec '03

> >LONDON (AP) -- It's a briefcase even James Bond could love. > >Britain's more adventurous Cabinet ministers soon will be spiriting >laptop computers inside their signature ``Red Box'' briefcases, >complete with fingerprint recognition systems and silent alarms. > [.....] > >``There is even a duress finger,'' Rushworth said. ``That is for if a >terrorist or gunman has a gun to the minister's head forcing him to >open the computer. It will appear to function normally but doesn't, >and sends a silent alarm to the Cabinet Office.'' This is INSANE. How could someone be so stupid as to announce such a feature in a newspaper. I guess this means that if a terrorist sees a Cabinet minister with such a computer, he had better shoot to kill. The whole point of a feature like this is that its existence is secret. Someone is NOT paying attention. Bruce ********************************************************************** Bruce Schneier, President, Counterpane Systems Phone: 612-823-1098 101 E Minnehaha Parkway, Minneapolis,MN 55419 Fax: 612-823-1590 http://www.counterpane.com

6 5

Distributed stock trading system
by ichudov＠Algebra.COM 17 Dec '03

17 Dec '03

I would like to hear your feedback on a project that I have just thought about. It is called a Distributed Asset Trading Network. It consists of Traders and Nodes. They trade Products (asset classes). A Product may be an Intel share, or a bond, or an option on S&P 500, or whatever. Who and how defines what the Product unit is is beyond the scope of this document. Each Node in the Network is a clearing corporation that is supposed to be a legitimate operation. To cover possible liabilities, Nodes can post [ecash] bonds to each other. They are ultimately liable for all counterparty defaults in Trades. Traders are clients of Nodes. They have Accounts. To buy or sell Products, they place Orders to these Nodes. The Nodes broadcast the Orders and collect Potential Trades (opposing orders that have not been filled yet). Nodes may have Policies that require Traders to meet certain requirements, in order to avoid potential liability. (ie, to sell stock, you have to have it on your Account, or have enough equity to cover the short sale liabilities, etc). The receiving Node has a short period of time (seconds) to decide which counterparties and which amounts to choose. The sending Node acquires Locks on the submitted Potential Trades and is liable to produce the Asset (or Cash) if the positive response comes back within that time period. This architecture can create a trading environment that is a) independent of borders and national laws, at least to some extent and b) eliminates certain forms of arbitrage, and c) more resistant to denial of service attacks (??), and possibly eliminates the bid-ask spreads and a whole lot of highly-paid intermediaries, and c) potentially increases privacy for transactions. The technical issues that are open, at the moment, are 1) clock synchronization, 2) the need for a central authority to clear liability issues and 3) potential denial of service attacks through acquiring too many locks (again, maybe with the proper liability agreement, it is not an issue). I think that such a system is not all that impossible to develop. Whether it will, or can be made to, work in the technical and social environment that we have is another question. I am curious if something like this has aleready been implemented. Thank you. ---------------------------------------------------------------------------- char*p="char*p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);} \=/, _-===-_-====-_-===-_-==========-_-====-_ | @___oo ( )_ /\ /\ / (___,,,}_--= ) ) /^\) ^\/ _) =__ Anything is good and useful if ) ) /^\/ _) (_ ) ) _ / / _) ( ) /\ )/\/ || | )_) (_ it's made of chocolate. ) < > |(,,) )__) ( ) || / \)___)\ (_ __) | \____( )___) )___ -==-_____-=====-_____-=====-___== \______(_______;;; __;;;

2 1

www.video-collage.com - another CDR node?
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Is the www.video-collage.com a new node on the remailer network? ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

politics of topology (was On the LAM--Local Area Mixes)
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

m k gandhi used to say that it was good india was colonised by the _british_ - the poor fools were vulnerable to non-violent rational argument and (relatively) concerned about such oddities as human rights. one problem with tim may's idea for local area mixes is just that: relying on US stickliness on wimpy rules for search/interception is all very well, but wouldn't fly in china. i won't get into the argument over how awful the US state is here, but if all cypherpunk technology can fight is the "tyrannical" democracies of the west, it's not much good, IMNSHO. besides, if such technology becomes widespread in, say, the US, then it's inevitable that the authorities will tend towards more _real_ tyrannical behaviour, diluting search/seizure protections and taking you closer to china. a weak vaccine _strengthens_ the microbe it is supposed to kill. today your tech may let you plan stink-bomb attacks on the IRS in peace; tomorrow it may not be sufficient to let you publish articles critical of the goverment. i always thought the cypherpunk idea ("write code" etc) was to develop tech that is _independent_ of political protections. technology will not undermine the power of governments, if it is based on (incorrect) assumptions that governments will continue to restrain themselves (e.g. search & seizure) when faced by increasing use of such tech. i should think that LAMs would be excellent test-beds for larger-scale systems, but it is larger-scale systems, where you don't assume the government's _not_ snooping because it's squeamish, that matter more. best, -rishab First Monday - The Peer-Reviewed Journal on the Internet http://www.firstmonday.dk/ Munksgaard International Publishers, Copenhagen Intl & Managing Editor - Rishab Aiyer Ghosh (ghosh(a)firstmonday.dk) Mobile +91 98110 14574; Fax +91 11 2209608; Tel +91 11 2454717 A4/204 Ekta Apts., 9 Indraprastha Extn, New Delhi 110092 INDIA

2 1

Ocean going cities
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Fri, 16 Jan 1998 16:32:41 -0500 From: <testarne(a)media.mit.edu> To: technomads(a)UCSD.EDU Subject: Ocean going cities Just read in an architecture rag called "Metropolis" about floating cities for the rich! I guess being a nomad is becoming chic. Anyways, the two ships are ResidenSea 958ft long with 250 1100-3200 sq ft homes ranging from $1.2-$4.3 million each. driving range putting green 2 pools, helipad gardens, retractable marina. According to the mag, this one looks like it will get built with construction to start soon. Freedom Ship 4320 ft 25 stories for 65,000 people starting at $93,000 includes library school bank hotel hospital, light manufacturing and 2 landing strips!!! How Stephensonesque. I'll be very depressed if the commercial folks do this before the hackers. Now, I wonder where I put that decommissioned aircraft carrier? :-) Thad Starner MIT Media Laboratory Wearable Computing Project --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

2 1

Lets Chat
by marketing＠shanesworld.com 17 Dec '03

17 Dec '03

///////////////////////////////////////////////////// This message is intended for adult webmasters only. If you are not an adult webmaster and recieve this email, I am very sorry for the inconvenience. If you'd like your name removed from my mailing list, please mail me with the subject "REMOVE". ///////////////////////////////////////////////////// Interested in Exchanging Links!! I would like to take a sec of your time to introduce myself. But I do not want to force you to do anything you do not want to do. (Unless you are into that HA!! HA!! ) Anyway, you can check me out at my site and that will give you an idea of who I am. http://shanesworld.com/ Now let's talk business. (Want to swap banners?) I have http://shanesworld.com/ on the web that receive anywhere from 30,000 to 60,000 hits a day and growing. Please respond to this email and I will place your link on my site. Just give me the name and URL of your Site and a brief description (how many free pix, thumbnails, and previews?) Also include a banner attachment in your mail. (Not Required) You can find my banner and info at http://shanesworld.com/linkexch.html link my banner to http://shanesworld.com/. After we are done with all the BS let me know where you've placed my link.( REMEBER, I WILL GIVE YOU AS MUCH LOVE IN THE PLACEMENT OF YOUR BANNER AS YOU GIVE ME!!! ) I am also involved in many live feeds featuring friends and myself. If you are interested in any info at all, let me know. I look forward to hearing from you and working with you in the future. Love, SHANE

1 0

security and hidden networks (was On the LAM--Local Area Mixes)
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

summary this post suggests that technically, routing through a sub-network does not necessarily increase complexity or hinder traffic analysis, as it can be treated as a virtual node. given that, LAM-type networks may not provide much protection in a politically unkind environment. i also suggest a way of rating (or classifying) secure networks based on how well they hide suspect data and routes in other traffic. as this in response to tim may's LAM post, i'll respond quoting that. Tim May <tcmay(a)got.net> writes: >A message would enter the physical site, bounce around to N machines, and >exit, perhaps going to other machines and sites, and back again, etc. (The >image was of perhaps 20 or 30 cheap PCs linked with Ethernet in a set of >apartments in Berkeley--obtaining search warrants or court orders to allow >monitoring of all 20 or 30 machines, scattered across several physical >addresses, would be "problematic.") i won't repeat my objections to a reliance on "problematic" court orders, which i've made in another post. let us simply assume, for example, that i am the NSA, and i don't need court orders, but i'm a sneaky sort so i don't want to go in with guns blazing just yet. Alice has a network, alice.net, 10.1.1.0. she has many machines on this network, some hers, some belonging to Bob. when Alice and Bob plan stink-bomb attacks on the IRS (sorry, when they, or Li-Xia and Bu-pang, write articles on human rights violations in xinjiang) to Carol and David, outside their network, they first bounce their packets around their 30 machines. i sniff all packets going into and out of the network 10.1.1.0, from the upstream provider (Alice has her whole building in a faraday cage, which is ok because she never tries to use her mobile phone indoors). so. does it matter in the least, to me, whether alice wrote her last rant from kitchen.alice.net (10.1.1.1) or garage.alice.net (10.1.1.2) or whether it was actually Bob - Bob Inc, to be safe - from 10.1.1.33? it could matter politically/legally (if i wanted to prosecute) or technically (if i want to trace traffic down, to, from or through alice's net). technically first: it doesn't really matter. i treat alice's net as a hermetically sealed virtual "node"... >-- the routing topology of the site may be an interesting area to look at. >Ideally, a "Linda"-like broadcast topology (all machines see all packets, >like messages in a bottle thrown into the "sea") could have certain ... which is all the more correct topologically if broadcast addresses (10.1.1.255) are used. so i treat alice's net as a single node, and monitor traffic as it enters and leaves that "node". just as i would monitor traffic entering and leaving a single machine, without caring much which disk drive or memory bank it passed through. with a single physical entry and exit point to the network it can be treated exactly as if it were a single node for the purposes of any traffic analysis (security/traceability). multiple physical connections might complicate it slightly, but if i'm sniffing them all, and they connect to the same set of machines (i.e. the same network), not much (if it's IP the address spaces may differ but that's a minor matter). depending on what remailer math tells us - and we really do need remailer math, as tim pointed out! - bouncing traffic around sub-nets may have little impact on security. it could remain the same; i don't see how it could become much better; it could plausibly get worse, if multiple nodes in a single subnet can eat into your random route hops resulting in concentration of traffic through fewer virtual "nodes". the only situation in which this isn't true is if the source and destination of traffic are both within the sealed network - presumably what would happen most of the time with tim's suggestion of voice/high-bandwidth stuff. now for the political/legal bit. given that i'd like to see cypherpunk technology as daring enough to be of use outside western democracies, let's look at a slightly challenging situation. you're a bunch of people, each with your own firm for added safety, in this building. now i'm not a decent american cop, worried about court orders etc. ok, i don't exactly want to shoot all of you at once. but if i am satisfied (which i could be, using technical methods) that lots of "suspicious" stuff is coming from your network, then i'll certainly come in and reeducate you all on your "errors and distortions." (sorry, just finished a week of watching andrzej wajda films at a retrospective.) oho. it's a BIG building. and i don't really suspect all of you. ok, i go have a chat with the network admin - Alice - and hold her responsible. she has great respect for the government and police and would never write such a nasty thing as "the state tortures political prisoners?" uh oh. so i tell her that for the good of the country she must let someone listen in at her machine ("you didn't keep logs? ah, that was a mistake, no?") - i'm now inside, and the sealed network shrinks. of course if i'm impatient and don't believe her innocent approach, i just use the rubber hose. the same goes for multiple physical links into the same network. can _technology_ - rather than relying on law-abiding cops, and rights-abiding laws - provide a solution? the key is the BIG building. the more non-suspicious routes there are - i.e. a route through normal, unsuspected people, typically but not necessarily outside the physically well-protected area - the harder to usefully treat a network as a virtual node. looking at 10.1.1.0 as a node may help, just 256 people there; but 10.1.0.0 is a bit big to make a coherent "node" so although a LAM may be a great way to _test_ new tech and protocols out, i'd think it a big mistake to actually deploy it, as it were, on a large scale. it wouldn't help at all in the tough spots, and it would only serve to make the easier spots tougher, strengthening the immune system of would-be tyrannical states (i.e. the nicer western democracies). in general "WAMs" would be much more helpful and secure. the other thing that helps is of course the degree of non-suspicious traffic on suspected routes. putting them together, i think you can get some measure of the utility of a protocol and topology. the ideal would a) make it technically impossible to trace the route of suspicious traffic; and b) make it politically/legally difficult to prosecute originators/destinations of suspicious traffic. it would do this by a) blurring the distinction between suspicious and "regular" routes; and b) make it difficult to distinguish suspicious from harmless traffic on those routes; c) make it difficult or impossible to block suspicious routes or intercept/monitor suspicious traffic without causing unacceptable deterioration of service for "ordinary" traffic. two ratios seem useful to me as a way of organising cryptoanarchic network protocols. suspicious routes/ordinary routes; suspicious/ordinary traffic on any route. an ideal universal DC-Net with padding to keep constant throughput would have both ratios tending towards 1 - there is only one route - broadcast - for everyone; and traffic is constant so the degree of really suspicious stuff is unknown. pure Blacknet-type systems tend towards [1,0] - there is only one route, assuming everyone uses it. but without padding, you could suspect all traffic. Pipenet tends towards [0,1] - there are many routes, and they're all pretty suspicious as it's possible for the monitor to discriminate among them. but traffic is constant, so you don't know when to suspect. regards, rishab First Monday - The Peer-Reviewed Journal on the Internet http://www.firstmonday.dk/ Munksgaard International Publishers, Copenhagen Intl & Managing Editor - Rishab Aiyer Ghosh (ghosh(a)firstmonday.dk) Mobile +91 98110 14574; Fax +91 11 2209608; Tel +91 11 2454717 A4/204 Ekta Apts., 9 Indraprastha Extn, New Delhi 110092 INDIA

1 0

ADULT TRAFFIC TRADE - FREE GIFTS!!!
by Adults-Best＠our.net 17 Dec '03

17 Dec '03

/////////////////////////////////////////////////////////////////////////////////////////// This email has been filtered thru the remove list at REMOVELIST.COM If you wish to be removed from future mailings, please enter your email(s) at http://www.removelist.com /////////////////////////////////////////////////////////////////////////////////////////// Adult Best is a Brand New Network of Adult Sites sharing the traffic that they have already lost, via our exciting, new exit console. http://www.adultbest.com/info.html Each site runs a SMALL - TEXT ONLY - UNOBTRUSIVE - EXIT CONSOLE making it load extremely fast. The exit console is opened ONLY when a surfer is leaving a site! Your hard earned traffic stays within your site until the surfer is leaving you. Yes, Traffic is Traffic, But .... This is targeted traffic and if we can keep these serious Adult Site surfers within the community that we are building, then that is where They will spend their money. Stop letting your hard earned traffic get away for nothing. Trade it in and get great content while you do !!! We divide the webmasters of our network into teams of 8 web sites with similar traffic and offer each the entire team great content incentives for teams that send 500+ and 1000+ hits a day to the console from all sites combined. That is only 62.5 and 125 exits a day from each site on the team !!!! HERE ARE THE CONTENT INCENTIVES: 1.) 1000 Team Hits - Free Live Video ( 495.00 Value ) 2.) 500 Team Hits - 250 Unique Thumbnailed Images ( Updated Monthly ) GET THE REST OF DETAILS & SIGN UP NOW: http://www.adultbest.com/info.html

1 0

Re: OpenPGP WG meeting minutes
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Hironobu Suzuki <hironobu(a)h2np.suginami.tokyo.jp> writes: > > > Miscellaneous: (Comments not recorded) > ... > > We should not just put in everyone's pet algorithms. > > I agree. > > But I want new algorithm id for MISTY1 when this document become > RFCXXXX. MISTY1 which was designed by Matsui-san looks so good. I > believe an algorithm which is described in RFC is not a `pet' one. > > > ----MISTY1 INTERNET DRAFT---- > INTERNET-DRAFT H. Ohta > Expires in six months M. Matsui > Mitsubishi Electric Corporation > December 1997 > > > A Description of the MISTY1 Encryption Algorithm > > <draft-ohta-misty1desc-00.txt> > > > --- > Hironobu SUZUKI Independent Software Consultant > E-Mail: hironobu(a)h2np.suginami.tokyo.jp > URL://www.pp.iij4u.or.jp/~h2np To learn some English, chop-chop. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

RC1 and RC3 ??
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

Why doesn't it have RC1 and RC3 though there are RC2, RC4 and RC5 of RSADSI RC series ? ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

$50 encryption policy contest
by Dr. Alan Sherman 17 Dec '03

17 Dec '03

$50 www Contest I will pay $50 to the best www page created by 12noon EST, February 15, 1998, meeting the enclosed specifications. In short, the page must have a form through which anyone may enter a question, which will be automatically entered onto a list of submitted questions displayed on another page. I will use the winning entry to collect questions for the upcoming March 6 talk on encryption policy by Barry Smith (FBI). How to enter: email a url of your entry to sherman(a)cs.umbc.edu include the phrase "Barry Smith Contest Entry" in the subject header. All URL's for all entries will be listed from http://www.cs.umbc.edu/events/spring98/crypto2.shtml Rules: 1. The page must work from the CMSC computing environment, but initial judging will take place on the designer's server. 2. Anyone in the world may enter. 3. If no one submits an adequate entry by February 15, a $20 prize will be awarded to the best entry that meets a restricted set of specifications. In this case, the contest will be extended for one more week, with a reduced prize of $30 for the best full entry received by 12noon EST, February 22, 1998. 4. Entries will be judged on the basis of satisfying the specifications, robustness, creativity, ease of use, and visual appeal. 5. Group work is allowed and encouraged. 6. I will be the sole final judge of the winner. Specifications: A. $20 Restricted Specifications 1. The form must include entries for a restricted-length question (at most 500 ascii characters), an email address, and optionally a name. 2. The form must include a submit button, which when clicked, will automatically append the question to a list of questions on a separate www page. Each displayed question must include the author's email and name (if provided). B. $50 Full Specifications In addition to the $20 specifications, the forum must also meet the following sp[ecifications: 3. (**important**) The page of submitted questions must have a means by which anyone can score the quality of the question on a scale of 1 to 5 (say, by clicking on the appropriate score button), with 5 being the highest score. For each question, its median score must be displayed. Questions must be listed in order of decreasing median scores. 4. The form must have an entry for optional URLs. These URLs must be posted with the question in such a way that they are active. 5. There must be an entry for sender status (selection from a list of options, such as cypherpunk, NSA employee, UMBC student, other student, government employee, faculty, industrial engineer, ...) 6. (optional) For each question, also list the number of votes entered for each score in addition to the median score. 7. (optional) Reject any question containing a vulgar word. 8. (optional) Feel free to add other appropriate constructive functionality.

2 1

Get More Orders For Anything You Sell
by 65982672＠hk.super.net 17 Dec '03

17 Dec '03

EMAIL USA Mass E-Mail Discount Program *************************************************** Advertise your Business or Website , with our Mass e-mail program. Fast * Affordable * Very Effective EMail USA will send out your message to a vast amount of potential customers in one day. Even if your website is in the top 10 you can't get the traffic that you would as if you targeted everyone that sees your ad. Why is our bulk e-mail program so effective? Our bulk e-mail service provides businesses & individuals the most inexpensive, and most effective way to reach millions of people over the internet. We currently have over 40 million addresses to offer, and counting. *******Special Offers******* Send your ad to 100,000 people for only $100 Send your ad to 225,000 people for only $200 Special discounts for larger runs. Ask About Our -Targeted List- Advertising Program. ****Lowest prices guaranteed**** Special discounts for larger runs. For more info on advertising with EMail USA please call (201)865-8919 * * * * * * * * * * * * * * * * * * * If you received this message in error, please accept our apology. Just type Remove, and reply to vx2001(a)hotmail.com Your name will be permanantly removed from our database. Thank You.

1 0

PipeNet description
by Wei Dai 17 Dec '03

17 Dec '03

I just got a couple of requests for information about PipeNet and I realized that I never did make my final description of it public. The attached informal write-up was done shortly after Crypto '96 as a result of discussions with Hal Finney, David Wagner, and Eric Hughes. I haven't worked on it since then, mostly because the Onion Routing project is doing similar work and appears to be much better funded (I did send them a copy of this write-up per their request). --- The Model Consider a network of processors which send messages to each other asynchronously. We assume that each node is identified by its public key, and that links between nodes are secure. The adversary may control a fixed subset of the nodes. However all messages between any two honest nodes are confidential and always arrive (unmodified) in the order sent (this can be achieved with a standard transport level security protocol). The Protocol The protocol is based on the idea of virtual link encryption. After an anonymous connection is established, the originating node sends a constant stream of (constant size) packets to a second node at a fixed rate. The second node shuffles the packets it receives during a time unit and forwards them in random order to others. A connection is a path in the network. The first node in the path is the caller, and the last node is the receiver. The rest are called switches. Anonymity in this scheme is asymmetric - the caller is anonymous, but not the receiver. Each node in the path shares a key with the caller and knows the nodes immediately in front of and behind it. Every pair of adjacent nodes shares a link id. Each switch in the path therefore has a key and two associated ids. Call the id that it shares with the previous node (the one closer to the caller) type A, and call the other id type B. For each id, the switch expects exactly one packet tagged with that id in each time unit. When it receives a packet tagged with a type A id, it decrypts that packet with the associated key, tags it with the corresponding type B id, and forwards it to the next node. When it receives a packet tagged with a type B id, it encrypts the packet with the associated key, tags it with the corresponding type A id, and forwards it to the previous node. The forwarding is always done at the end of the time unit, and the order in which packets are sent is random. For each packet going from the caller to the receiver, the caller must multi-encrypt it with the keys it shares with each of the nodes in the path, starting with the receiver. It then sends the packet to the first switch tagged with the appropriate link id. Each switch will strip a layer of encryption and forward the packet to the next node. For a packet going from the receiver to the caller, the receiver encrypts it with the key it shares with the caller and sends it to the last switch in the path. Each switch will add a layer of encryption and forward the packet to the previous node. To establish a connection, the caller (N0) performs the following steps: 1. Select a node (N1) at random and establish a key (K1) and link id (S1) with N1. 2. Select another node (N2) at random. 3. Request that N1 establish a link id (S2) with N2. 4. Establish a key (K2) with N2 through N1. 5. Request that N1 use K1 to decrypt all messages tagged with S1, tag the decrypted message with S2 and forward them to N2. Also request that N1 use K1 to encrypt all messages tagged with S2, tag the encrypted messages with S1 and forward them to N0. 6. Repeat steps 2 to 4 l-2 times. (Name the i-th node, key, and id Ni, Ki, and Si respectively.) 7. Repeat steps 2 to 4 a final time, but with the receiver node (Nl) instead of a random node. Timing We assumed earlier that communications links between honest nodes are vulnerable to delay attacks. Therefore we must ensure that link delays do not reveal traffic information. Each node expects one packet from each link id in each time unit. Extra packets are queued for processing in later time units. However, if it does not receive a packet for a link id in a particular time unit, it stops normal processing of packets for that time unit and queues all packets. This ensures that any delay is propagated through the entire network and cannot be used to trace a particular connection. The process of making and breaking connections must also not leak information. This can be done by using a protocol analogous to mix-net. Link forming/destroying requests are queued and performed in batches in a way similar to queuing and mixing of e-mail in a mix-net.

1 0

Re: (eternity) Eternity as a secure filesystem/backup medium
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:33 AM 1/18/98 EST, Ryan Lackey wrote: >Documents by specification last only as long as someone is willing to pay >to keep them up. This is not necessarily forever. But it can be, and the costs of doing so aren't much higher than storing it for the first couple of years. Depends on what service the customer wants to buy. And there are applications that require more than 100 years of data protection, e.g. ownership of copyrights which last 50 years beyond the author's death. But for Matt Barrie's question, any permanent document will do. >> Can we assume that using Moore's law this is at >> least 1 bit every 18 months for symmetric crypto? >Do the math, though, for 128bit. There are traditional analyses >which include the amount of silicon on the earth, the number of atoms >in the universe, etc. The general consensus is that traditional >techniques are not feasible for brute forcing 128bit ciphers before >the heat death of the universe. Hard to say. Assuming that Quantum Cryptography doesn't allow finite-sized computers to do large exponentially complex calculations in short finite time, you're probably limited by the number of atoms in the available supply of planets, and Heisenberg may still get you if that's not a low enough limit. Moore's law isn't forever. But there's no particular reason to limit RC4 or RC5 to 128 bits; those are convenient sizes for MD5 hashes of passphrases. So if you're paranoid, use RC4-256 and superencrypt with 5-DES. Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

API Specification for the AES
by Bill Stewart 17 Dec '03

17 Dec '03

>Date: Fri, 16 Jan 1998 14:59:37 -0500 >To: smid(a)csmes.ncsl.nist.gov >From: Jim Foti <jfoti(a)nist.gov> >Subject: API Specification for the AES > >Hello- > >As promised, we have placed on our AES Home Page a specification of the API >to be used for AES submissions (for both Java and ANSI C implementations). >It is available at <http://csrc.nist.gov/encryption/aes/api/api.htm>. > >As with past messages, this is being sent to all persons who have expressed >an interest in the AES development effort (one way or another) within the >last year. > >Regards, >Jim > > >******************************************************************* >Jim Foti > >Security Technology Group >Computer Security Division >National Institute of Standard and Technology (NIST) > >TEL: (301) 975-5237 >FAX: (301) 948-1233 > >******************************************************************* > >

1 0

BRAND NEW $10 MATRIX
by Vi.Sion＠19109.com 17 Dec '03

17 Dec '03

$$$$$$ PRE-LAUNCH $10 ULTIMATE MATRIX SYSTEM $$$$$$ ABSOLUTELY "BRAND NEW" JAN 1ST 1998 #$#$ JUST $10 ONE-TIME GETS YOU IN #$#$ NO SPONSORING EVER #$#$ NO DISKS, NO CODES, JUST CASH http://www.replinets.com/users/ce462043/ums.html

1 0

Financial Cryptography '98 Preliminary Program
by Ray Hirschfeld 17 Dec '03

17 Dec '03

Financial Cryptography '98 Second International Conference February 23-25, 1998, Anguilla, BWI CONFERENCE PROGRAM General Information: Financial Cryptography '98 (FC98) is a conference on the security of digital financial transactions. Meetings alternate between the island of Anguilla in the British West Indies and other locations. This second meeting will be held in Anguilla on February 23-25, 1998. FC98 aims to bring together persons involved in both the financial and data security fields to foster cooperation and exchange of ideas. Original papers were solicited on all aspects of financial data security and digital commerce in general. Program Committee: Matt Blaze, AT&T Laboratories--Research, Florham Park, NJ, USA Antoon Bosselaers, Katholieke Universiteit Leuven, Leuven, Belgium Yves Carlier, Bank for International Settlements, Basel, Switzerland Walter Effross, Washington College of Law, American U., Washington DC, USA Matthew Franklin (Co-Chair), AT&T Laboratories--Research, Florham Park, NJ, USA Michael Froomkin, U. Miami School of Law, Coral Gables, FL, USA Rafael Hirschfeld (Chair), Unipay Technologies, Amsterdam, The Netherlands Alain Mayer, Bell Laboratories/Lucent Technologies, Murray Hill, NJ, USA Moni Naor, Weizmann Institute of Science, Rehovot, Israel Frank Trotter, Mark Twain Ecash/Mercantile Bank, St. Louis, MO, USA Doug Tygar, Carnegie Mellon University, Pittsburgh, PA, USA Moti Yung, CertCo LLC (formerly: Bankers Trust E-Commerce), New York, NY, USA Conference Program for FC98: Monday 23 February 1998 800 -- 820 Breakfast 820 -- 830 Welcome 830 -- 905 Micropayments via Efficient Coin-Flipping Richard J. Lipton (Princeton University, Princeton, NJ, USA) Rafail Ostrovsky (Bellcore, Morristown, NJ, USA) 905 -- 940 X-Cash: Executable Digital Cash Markus Jakobsson (Bell Laboratories, Murray Hill, NJ, USA) Ari Juels (RSA Laboratories, Bedford, MA, USA) 940 -- 1015 Billing Without Paper...Or Billing Without Billers? Caveat Biller: 3rd Party Concentrators Could Come Between You and Your Customers Richard K. Crone (CyberCash, Reston, VA, USA) 1015 -- 1045 Coffee Break 1045 -- 1120 A Platform for Privately Defined Currencies, Loyalty Credits, and Play Money David P. Maher (AT&T Labs--Research, Florham Park, NJ, USA) 1120 -- 1155 Assessment of Threats for Smart Card Based Electronic Cash Kazuo J. Ezawa, Gregory Napiorkowski (Mondex International, Florham Park, NJ, USA) 1155 -- 1230 Using a High-Performance, Programmable Secure Coprocessor Sean W. Smith, Elaine R. Palmer, Steve Weingart (IBM T.J. Watson Research Center, Yorktown Heights, NY, USA) 1230 -- 1330 Lunch 1800 -- 1930 Cocktail Reception (at Mariners Hotel) Tuesday 24 February 1998 800 -- 830 Breakfast 830 -- 905 Secure Group Barter: Multi-Party Fair Exchange with Semi-Trusted Neutral Parties Matt Franklin (AT&T Labs--Research, Florham Park, NJ, USA) Gene Tsudik (USC Information Sciences Institute, Marina del Rey, CA, USA) 905 -- 940 A Payment Scheme Using Vouchers Ernest Foo, Colin Boyd (Queensland University of Technology, Brisbane, Australia) 940 -- 1015 A Formal Specification of Requirements for Payment Transactions in the SET Protocol Catherine Meadows, Paul Syverson (Naval Research Laboratory, Washington, DC, USA) 1015 -- 1045 Coffee Break 1045 -- 1120 On Assurance Structures for WWW Commerce Markus Jakobsson (Bell Laboratories, Murray Hill, NJ, USA) Moti Yung (CertCo, New York, NY, USA) 1120 -- 1230 Panel Discussion Certificate Revocation: Mechanics and Meaning Barb Fox (Microsoft, Redmond, WA, USA), moderator Joan Feigenbaum (AT&T Labs--Research, Florham Park, NJ, USA) Paul Kocher (Valicert, Palo Alto, CA, USA) Michael Myers (Verisign, Mountain View, CA, USA) Ron Rivest (MIT Laboratory for Computer Science, Cambridge, MA, USA) 1230 -- 1330 Lunch 2000 -- 2200 Rump Session Wednesday 25 February 1998 800 -- 830 Breakfast 830 -- 930 Invited Speaker Private Signatures and E-commerce David Chaum (DigiCash, Palo Alto, CA, USA) 930 -- 1005 Group Blind Digital Signatures: A Scalable Solution to Electronic Cash Anna Lysyanskaya, Zulfikar Ramzan (MIT Laboratory for Computer Science, Cambridge, MA, USA) 1005 -- 1045 Coffee Break 1045 -- 1120 Curbing Junk E-Mail via Secure Classification Eran Gabber, Markus Jakobsson, Yossi Matias, Alain Mayer (Bell Laboratories, Murray Hill, NJ, USA) 1120 -- 1155 Publicly Verifiable Lotteries: Applications of Delaying Functions David M. Goldschlag (Divx, Herndon, VA, USA) Stuart G. Stubblebine (AT&T Labs--Research, Florham Park, NJ, USA) 1155 -- 1230 Security of Digital Watermarks Lesley R. Matheson, Stephen G. Mitchell, Talal G. Shamoon, Robert E. Tarjan, Francis X. Zane (STAR Lab, InterTrust Technologies, Sunnyvale, CA, USA) 1230 -- 1330 Lunch 1330 -- 1405 Security in the Java Electronic Commerce Framework Surya Koneru, Ted Goldstein (JavaSoft, Palo Alto, CA, USA) 1405 -- 1440 Beyond Identity: Warranty-Based Digital Signature Transactions Yair Frankel, David W. Kravitz, Charles T. Montgomery, Moti Yung (CertCo, New York, NY, USA) 1440 -- 1515 Compliance Checking in the PolicyMaker Trust Management System Matt Blaze, Joan Feigenbaum, Martin Strauss (AT&T Labs--Research, Florham Park, NJ, USA) 1515 -- 1545 Coffee Break 1545 -- 1620 An Efficient Fair Off-Line Electronic Cash System with Extensions to Checks and Wallets with Observers Aymeric de Solages, Jacque Traore (France Telecom--CNET, Caen, France) 1620 -- 1655 An Efficient Untraceable Electronic Money System Based on Partially Blind Signatures of the Discrete Logarithm Problem Shingo Mayazaki, Kouichi Sakurai (Kyushu University, Fukuoka, Japan) 1655 -- 1700 Closing The conference schedule and additional information is available at the URL http://www.cwi.nl/conferences/FC98/. Breakfast and lunch are provided at the conference. The conference organizers have left time open for corporate sponsored events, for networking, and for recreational activities on the resort island of Anguilla. Participants are encouraged to bring their families. Workshop: A 40-hour workshop, intended for anyone with commercial software development experience who wants hands-on familiarity with the issues and technology of financial cryptography, is planned in conjunction with FC98, to be held during the week following the conference. For more information on the workshop, please see the URL http://www.cs.berkeley.edu/~iang/fc98/workshop.html. For workshop registration, see the URL http://fc98.ai/. Special Attraction: On Thursday, February 26, 1998, there will be a total eclipse of the sun. The narrow zone of 100% totality will pass just south of Anguilla. A boat excursion to the center of the eclipse zone is planned, for an optimal view of the eclipse. The excursion is included in the conference registration; additional tickets can be purchased for accompanying persons. Venue: The Inter-Island Hotel is a small 14-room guest house with a large, comfortable 150-seat conference facility and additional space for a small 10-booth exhibition. The Inter-Island is on Road Bay, near Sandy Ground Village, in the South Hill section of Anguilla. The conference, workshop, and exhibition will have TCP/IP internet access. Shuttle service to the conference will be available. Air Transportation and Hotels: Air travel to Anguilla is typically done through San Juan for US flights, or St. Maarten/Martin for flights from Europe and the US. There are also connections via Antigua. Anguillan import duties are not imposed on hardware or software which will leave the island again. There are no other taxes--or cryptography import/export restrictions--on Anguilla. Hotels range from spartan to luxurious, and more information about hotels on Anguilla can be obtained from your travel agent, or at the URL http://fc98.ai/. A block reservation has been made at Mariners, and this is the recommended hotel except for those seeking budget accomodations. General Chairs: Robert Hettinga, Shipwright, Boston, MA, USA email: rah(a)shipwright.com Vincent Cate, Offshore Information Services, Anguilla, BWI email: vince(a)offshore.com.ai Exhibits and Sponsorship Manager: Blanc Weber, Seattle, WA, USA email: blancw(a)cnw.com Workshop Leader: Ian Goldberg, Berkeley, CA, USA email: iang(a)cs.berkeley.edu Registration: You can register and pay for conference admission via the World Wide Web at the URL http://fc98.ai/. The cost of the FC98 Conference is US$1,000. There are reduced rates of US$250 and US$100 for full-time academics and students. Booths for the exhibition start at US$5,000 and include two conference tickets. For more information about exhibit space, contact Blanc Weber, blancw(a)cnw.com. Sponsorship opportunities for FC98 are still available. The cost of the workshop is US$5000, and includes meals but not lodging. You can register for the workshop, which runs the week after the conference, at the URL http://fc98.ai/. Financial Cryptography '98 is held in cooperation with the International Association for Cryptologic Research. It is sponsored by: RSA Data Security Inc. <http://www.rsa.com> C2NET, Inc. <http://www.c2.net> Hansa Bank & Trust Company Limited, Anguilla <http://www.hansa.net/> Sicherheit und Privat- International Bank <mailto:spbank@schloss.li> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.shipwright.com>

1 0

Re: $50 encryption policy contest
by Dr. Alan Sherman 17 Dec '03

17 Dec '03

On Tue, 20 Jan 1998, Lucky Green wrote: > Given that the majority of the serious people on the list charge upwards > of $100/hour (I charge $250/hour for even looking at a problem), $50 seems > to be insufficient to generate much interest. Your point is well taken. I should have explained that I am seeking assistance for altruism from someone who is interested in crypto policy. For example, no one is compensating me for the many hours I've volunteered to pull off this two-part lecture series (and it was quite a challenge to get anyone with government connections to go on stage with John Gilmore). See http://www.cs.umbc.edu/events/fall97/crypto.shtml I'm also trying to help students by suggesting a concrete, worthwhile, interesting project through which to learn about www programming. I am open to the idea of a prize fund: I will augment the prize with 100% of all prize donations mailed to me. If each of 200 people send me $1, the prize fund will grow to $250. (make out check to "UMBC") Dr. Alan T. Sherman Dept. of CSEE UMBC 1000 Hilltop Circle Baltimore, MD 21250

1 0

FDA bans human cloning [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > FDA: NO HUMAN CLONING WITHOUT AGENCY APPROVAL > > Cloning graphic January 19, 1998 > Web posted at: 9:18 p.m. EST (0218 GMT) > > WASHINGTON (AP) -- The Food and Drug Administration has a warning > for the Chicago physicist who wants to clone a human: The agency > will shut down anyone who tries without its permission. > > Richard Seed's cloning plans have sparked a public outcry and a race > by Congress and more than a dozen states to ban cloning. With the > FDA filling what critics had called a regulatory vacuum, scientists > say lawmakers should take more time to ensure vaguely worded > anti-cloning bills don't also ban lifesaving medical research. > > "It's been a public and media assumption that there is nothing on > the books that would even slow or stop Dr. Seed," said Carl Feldbaum > of the Biotechnology Industry Organization, which represents > biotechnologists involved in cloning research. FDA intervention > "creates at least some breathing space." > > FDA investigators plan to make clear to Seed that federal > regulations require that he file for FDA approval to attempt cloning > -- permission highly unlikely. > > "We're not only able to move, we're prepared to move," said Dr. > Michael Friedman, FDA's acting commissioner, noting the agency can > go to court to stop unauthorized cloning attempts. > [text deleted] ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Intel introduces new compression technology for surfers [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > INTEL INTRODUCES TECHNOLOGY TO SURF THE WEB FASTER > > January 19, 1998 > Web posted at: 9:35 p.m. EST (0235 GMT) > > HILLSBORO, Oregon (AP) -- The World Wide Wait may be over. > > Computer chip giant Intel on Monday announced a way for Internet > surfers to download images twice as fast over regular phone lines > without any special equipment or software -- but it will add about > $5 to monthly access fees. > > The technology called Quick Web is installed on the computers called > servers that Internet services use to store and relay data. The > combination of Intel hardware and special software compresses all > the graphic images that are piped through the server, boosting > access speed. > > "The more pictures on the screen, the faster it is," said Dave > Preston, Internet marketing manager for Intel. > [text deleted] ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

6 7

Additional Source of Income
by B_Crawford49＠earthlink.net 17 Dec '03

17 Dec '03

<HTML><PRE> ************************************************************* Our Research Has Indicated That The Following Message Will Be Of Interest To You. ************************************************************* THE HOME WORKERS SURVIVAL GUIDE If you plan on finding legitimate work at home, you need this book! Years of experience and thousands of hours of research have gone into "The Home Workers Survival Guide". There is no better source of information on at-home income opportunities. Use our listings to contact the right companies and you can start to receive weekly checks up to $1000! Please read on so you can get started right away! Get Your First Check in as Little as a Week! Hi, my name is Brian Crawford, and I have tried just about every work- at-home opportunity out there, from stuffing envelopes to assembling miniatures. Most of them turned out to be nothing more than a waste of time and money. However, among all the scams and rip-offs, I did come across many legitimate companies willing to pay for my services. I started to think, "Why doesn't someone just keep track of all the honest companies so that no one else would need to get ripped off when trying to find a decent work-at-home job?" I decided to do just that. Throw Away That Junk Mail! See, the reason most of us encounter problems is because we usually look for these jobs by responding to junk mail. Let me ask you, when was the last time an employer sent you a job offering in the mail? Probably never! You had to look for the job yourself, and it is exactly the same with work-at-home positions. The companies are out there, but you need to look for them. That is where my book "The Home Workers Survival Guide" really comes in handy. Over 200 Companies Waiting to Hear from You! In chapter three, you will find page after page of job listings for all kinds of work. Find something you like, and then contact them at the address listed. You could be on your way to a great paying at-home job for the cost of a stamp. Never send in $20-$30 for a bogus "processing fee" again! Anyone in the U.S. can work- no one is refused. What Do You Like To Do? What kind of work are you looking for? It's all here! -Sewing baby clothing -Building doll houses -Crafts of every kind -Assembling holiday decorations -Painting -Circular Mailing -Food/game/software testers -Baking (Yes, get paid to cook!) -Health products/food/jewelery -Plus many, many more opportunities including distributorships and sales All of these opportunities are available to anyone- no experience is needed. Just contact the listing that interests you and you can get started right away. These companies offer legitimate work and will be happy to send you full information before you make a decision. Watch Out For Scams! Chapter four will let you in on some of the most common work-at home scams. Make sure you read this. If you come across something that sounds too good to be true, remember- it probably is. Here are just two quick examples of information found in this chapter. 1. "Assemble Miniatures" If a company requires a large deposit or registration fee to get started but promises great pay, be careful. Most legitimate companies will charge only a small fee for the supplies they send you, and wil pay you a reasonable amount as well. After sending in a large payment, you may find that the company will call your finished work "inferior" and refuse to pay you. They were only after your registraion fee, and probably never intended on paying you. 2. "Stuff Envelopes" Nobody is going to pay you a dollar or even 50 cents to stuff an envelope. There are machines that can stuff thousands of envelopes a day for only pennies. What these companies should really tell you is that you will be mailing junk advertisements for them. They expect you to place an ad in your local newspaper offering "Home Workers Needed". You only get the "dollar per envelope" when people actually reply to this ad! Are They All Bogus? Like I said before, there are a lot of dishonest companies out there looking to take your money, but not all of them are like that. We list over 40 companies offering assembly work, from toys to clothes to weaving rattan. Choose the kind of work you like and write to the companies who offer it. Ask them any questions you have BEFORE you send in any money or buy any supplies. There are also several companies out there that will pay you a substantial commission for mailing their advertisements, and you won't have to pay them anything to be able to do it, just contact them and ask! Need Cash Fast? 48 Hours Soon Enough? When you get the book, look over the many excellent opportunities. Each listing includes a brief description of what is offered. Write to the companies you like and request an application form. They have openings right now, and they'll be happy to get you started. You can begin to make money even faster if you choose one of the programs or plans that the book describes in detail. I'll tell you everything you need to know to get started. By taking a few simple steps, you can already be making money just 48 hours after you receive the book. How Much Is This Going To Cost Me? "The Home Workers Survival Guide" costs just $29.95 plus $3.00 pastage and handling. I'm so sure this book will help you find legitimate work that I am backing it by an unconditional guarantee. If for ANY reason you do not feel the book helped you earn enough extra income, simply return it for a full refund, including postage and tax. What's better is that this rock-solid guarantee is good for two full months, which allows you to really look it over and check out the opportunities. You deserve to feel the joy of getting huge weekly paychecks. Please complete the order form and mail it today. Everything will be rushed to you by first class mail. Sincerely, Brian Crawford P.S. I've just added some great new information to the book. Some people are already making as much as $3000 a week with a new program that lets them work in the comfort of their own home. It costs nothing to get started and anyone can do it. It's like nothing I have ever seen before, and it is sure to make people a lot of money. Details will be rushed to you along with your book order. Please Print and Mail This Order Form to: cut here ------------------------------------------------------------------------------------------------- ANP #MP11 c/o Brian Crawford P.O. Box 712102 Santee, CA 92072-2102 ( ) Yes, I would love to get started immediately. Please rush me "The Home Workers Survival Guide" under your unlimited two month guarantee. Enclosed is $29.95 plus $3.00 shipping and handling.* $32.95 total. *Checks may be made payable to ANP Name____________________________________________ Address___________________________________________ City, State, Zip_____________________________________ Internal Code [E8SB(c)120] ------------------------------------------------------------------------------------------------- cut here

1 0

Re: (eternity) Eternity as a secure filesystem/backup medium (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 22:00:24 -0800 > From: Bill Stewart <bill.stewart(a)pobox.com> > Subject: Re: (eternity) Eternity as a secure filesystem/backup medium > (fwd) > Assume the existence of a for-profit service provider. > The service provider needs to cover the costs of the service, Which in general are a flat rate. I'll try to fill in the various issues you raise with as real-world numbers as I can get. > plus enough profit to make the effort interesting. > The prices charged need to reflect the costs (or be higher) > or the service provider can't make money and goes out of business. > So what are the costs, and who can be talked into paying for them? Everyone who uses the system. The question is who do we want to define as 'using'. I believe the provider of information is not 'using' the system in the strictest sense but rather making an investment of their time and effort in somebodies elses business model and hoping that work will bring them profit. > 1) Storage of information - Storage currently costs < $1/MB for raw disk, > and getting cheaper by the minute, Assuming your 5 year plan, a 1G drive costs $100 or less. That's roughly $20/G-yr. > but sysadmins, lawyers, etc. > cost money and they're not getting cheaper as fast. Granted, but except for the sys-admin you don't need them often. In all the years I have been in business I've needed a lawyer only a couple of times. Say $1k/lawyer-year. > The costs of the equipment for permanent storage are probably about > 10-50% more than the costs for storing for 5 years; A Cyrix P200 runs about $600 for a working box (I bought one just a few weeks ago). So that gives us about $120/cpu-year. > the costs of administration (assuming inflation is limited to > some small number) can be covered by an annuity. For reliable system administartion you're looking at 5 people (3 8-hr. shifts plus weekend coverage of 2 12 hour shifts). A sys admin with the skills and maturity to work in this environment is going to run you in the neighborhood of $40-60k/yr. So this means we're looking at, on the outside, $300k/sysadmin-yr. This is the real cost of doing business. > Every technology upgrade or two you need to copy the archives to > new storage media, and data that doesn't get accessed often may > get migrated out to slower or perhaps even offline media; > storage contracts need to reflect that retrieving data that hasn't > been accessed in a while may involve some delay. Not shure what the normal ratio for online versus offline storage actualy is currently, say 10:1. > 2) Transmission of information - Roughly proportional to MB/time - This seems overly simplistic to me. The actual cost of the bandwidth is reasonably fixed for a given site. Also if we throw in the other servers this model becomes a bit more flexible. Remember, under the Eternity model we don't know *which* server is being hit for the request. This means we have to consider the actual end user costs in a much more complicated fashion. It's one of the issue I'm working on myself. It does not seem clear cut nor well researched at all. > unlike storage, this one's not predictable, unless the provider and > author agree in advance (e.g. N free accesses per year, per password.) > So the provider could charge the reader for access, I fail to see the profit in giving away plans for man portable nukes or to turn commen cooking yeast into a THC producing horde when the various groups around the world would pay so many millions (or would that be billions) for some to get it and some to keep others from getting it. The potential for a access auction hasn't been explored as far as I am aware. > or use advertising > banners to fund retrieval costs (if that remains a valid model > for financing the web over the next N years, especially if the > readers retrieve data through anonymizers.) I believe advertising would be a necessity. The question is how. Would the payoff for doing a print ad in a magazine be worth it? Should it only be advertised on the net? > 3) Legal defense - This one's harder to predict :-) If the Eternity model works the question becomes which one and where are they located? Whose legal defense? Which jurisdiction? Put up an offer for 1 weeks notice of any pending legal actions against the network and make it worth the while. Say $500M. It would of course be fully anonymous and the information would have to be testable prior to payout. Leaves two option. First, the data is verified and the source is paid. Second, the server goes down and the source isn't paid - thus ruining the reputation of a server. It isn't clear to me what the total impact would be on the network as a whole. One way to mediate this impact on a given server would be to share the cost of the payout between the various servers. It is after all in all the servers best interest to keep as many going unharrassed and as well prepared and for-warned as possible. > The current US climate is that service providers are relatively immune > as long as they cooperate with subpoenas and court orders, True, but the current model doesn't allow anonymous providers as the norm either. The users may be anonymous but the ISP isn't. > If they want their names known, they can include them in the contents > of the data that readers retrieve, independent of what the server does. Then there is no reason to use an anonymous network, simply put the data on their own webpage and sell it direct, cut out the middle-man a tried and true business tactic. > and accumulate reputation capital under those nyms. One of the assumptions is that the source, individual server, and sink are all anonymous to each other as well as Mallet. Now we're changing the rules of the game in the middle of the game. Apples and oranges. If I were actualy going to impliment something like this I wouldn't even consider it unless I had at least $500k worth of funding for each of the first 5 years. That start up cost, $2.5M, is what is going to kill it. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

[Long] How to recover private keys for various Microsoft products
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

How to recover private keys for Microsoft Internet Explorer, Internet Information Server, Outlook Express, and many others - or - Where do your encryption keys want to go today? Peter Gutmann, <pgut001(a)cs.auckland.ac.nz> Summary ------- Microsoft uses two different file formats to protect users private keys, the original (unnamed) format which was used in older versions of MSIE, IIS, and other software and which is still supported for backwards-compatibility reasons in newer versions, and the newer PFX/PKCS #12 format. Due to a number of design and implementation flaws in Microsofts software, it is possible to break the security of both of these formats and recover users private keys, often in a matter of seconds. In addition, a major security hole in Microsofts CryptoAPI means that many keys can be recovered without even needing to break the encryption. These attacks do not rely for their success on the presence of weak, US-exportable encryption, they also affect US versions. As a result of these flaws, no Microsoft internet product is capable of protecting a users keys from hostile attack. By combining the attacks described below with widely-publicised bugs in MSIE which allow hostile sites to read the contents of users hard drives or with an ActiveX control, a victim can have their private key sucked off their machine and the encryption which "protects" it broken at a remote site without their knowledge. Once an attacker has obtained a users private key in this manner, they have effectively stolen their (digitial) identity, and can use it to digitally sign contracts and agreements, to recover every encryption session key it's ever protected in the past and will ever protect in the future, to access private and confidential email, and so on and so on. The ease with which this attack can be carried out represents a critical weakness which compromises all other encryption components on web servers and browsers - once the private key is compromised, all security services which depend on it are also compromised. A really clever attacker might even do the following: - Use (say) an MSIE bug to steal someones ActiveX code signing key. - Decrypt it using one of the attacks described below. - Use it to sign an ActiveX control which steals other peoples keys. - Put it on a web page and wait. On the remote chance that the ActiveX control is discovered (which is extremely unlikely, since it runs and deletes itself almost instantly, and can't be stopped even with the highest "security" setting in MSIE), the attack will be blamed on the person the key was stolen from rather than the real attacker. This demonstrates major problems in both Microsoft's private key security (an attacker can decrypt, and therefore misuse, your private key), and ActiveX security (an attacker can create an effectively unstoppable malicious ActiveX control and, on the remote chance that it's ever discovered, ensure that someone else takes the blame). Background ---------- About a year ago I posted an article on how to break Netscape's (then) server key encryption to the cypherpunks list (Netscape corrected this problem at about the same time as I posted the article). However more than a year after the code was published, and 2 1/2 years after a similar problem with Windows .PWL file encryption was publicised, Microsoft are still using exactly the same weak, easily-broken data format to "protect" users private keys. To break this format I simply dusted off my year-old software, changed the "Netscape" strings to "Microsoft", and had an encryption-breaker which would recover most private keys "protected" with this format in a matter of seconds. In addition to the older format, newer Microsoft products also support the PKCS #12 format (which they originally called PFX), which Microsoft render as useless as the older format by employing the RC2 cipher with a 40-bit key. In a truly egalitarian manner, this same level of "security" is used worldwide, ensuring that even US users get no security whatsoever when storing their private keys. However even RC2/40 can take awhile to break (the exact definition of "a while" depends on how much computing power you have available, for most non-funded attackers it ranges from a few hours to a few days). Fortunately, there are enough design flaws in PKCS #12 and bugs in Microsofts implementation to ensure that we can ignore the encryption key size. This has the useful - to an attacker - side-effect that even if Microsoft switch to using RC2/128 or triple DES for the encryption, it doesn't make the attackers task any more difficult. By combining the code to break the PKCS #12 format with the code mentioned above which breaks the older format, we obtain a single program which, when run on either type of key file, should be able to recover the users private keys from most files in a matter of seconds. A (somewhat limited) example of this type of program is available in source code form from http://www.cs.auckland.ac.nz/~pgut001/pubs/breakms.c. Because it's meant as a proof-of-concept program it's somewhat crude, and restricted to recovering passwords which are single dictionary words. Note: This does not mean that using (say) two words as a password instead of one will protect your private key. All it means is that I haven't bothered to write anything more sophisticated - no doubt anyone who was serious about this could adapt something like cracklib's password-generation rules and routines to provide a more comprehensive and powerful type of attack. Similarly, by making trivial changes to the key file data format it's possible to fool the program until someone makes an equally trivial change to the program to track the format change - this is meant as a demonstrator only, not a do-everything encryption breaker. To use the program, compile and invoke it with: breakms <Microsoft key file> <word list file> Here's what the output should look like (some of the lines have been trimmed a bit): File is a PFX/PKCS #12 key file. Encrypted data is 1048 bytes long. The password which was used to encrypt this Microsoft PFX/PKCS #12 file is 'orthogonality'. Modulus = 00BB6FE79432CC6EA2D8F970675A5A87BFBE1AFF0BE63E879F2AFFB93644D [...] Public exponent = 010001 Private exponent = 6F05EAD2F27FFAEC84BEC360C4B928FD5F3A9865D0FCAAD291E2 [...] Prime 1 = 00F3929B9435608F8A22C208D86795271D54EBDFB09DDEF539AB083DA912D [...] Prime 2 = 00C50016F89DFF2561347ED1186A46E150E28BF2D0F539A1594BBD7FE4674 [...] Exponent 1 = 009E7D4326C924AFC1DEA40B45650134966D6F9DFA3A7F9D698CD4ABEA [...] Exponent 2 = 00BA84003BB95355AFB7C50DF140C60513D0BA51D637272E355E397779 [...] Coefficient = 30B9E4F2AFA5AC679F920FC83F1F2DF1BAF1779CF989447FABC2F5628 [...] Someone sent me a test Microsoft key they had created with MSIE 3.0 and the program took just a few seconds to recover the password used to encrypt the file. One excuse offered by Microsoft is that Windows NT has access control lists (ACL's) for files which can be used to protect against this attacks and the one described below. However this isn't notably useful: Most users will be running Windows '95 which doesn't have ACL's, of the small remainder using NT most won't bother setting the ACL's, and in any case since the attack is coming from software running as the current user (who has full access to the file), the ACL's have no effect. The ACL issue is merely a red herring, and offers no further protection. Further Attacks (information provided by Steve Henson <shenson(a)bigfoot.com>) --------------- There is a further attack possible which works because Microsoft's security products rely on the presence of the Microsoft CryptoAPI, which has a wonderful function called CryptExportKey(). This function hands over a users private key to anyone who asks for it. The key is encrypted under the current user, so any other program running under the user can obtain their private key with a single function call. For example an ActiveX control on a web page could ask for the current users key, ship it out to a remote site, and then delete itself from the system leaving no trace of what happened, a bit like the mail.exe program I wrote about 2 years ago which did the same thing for Windows passwords. If the control is signed, there's no way to stop it from running even with the highest security level selected in MSIE, and since it immediately erases all traces of its existence the code signing is worthless. Newer versions of the CryptoAPI which come with MSIE 4 allow the user to set a flag (CRYPT_USER_PROTECTED) which specifies that the key export function should be protected with no protection (the default), user notification, or password protection. However the way this is implemented makes it pretty much useless. Firstly, if the certificate request script used to generate the key doesn't set this flag, you end up with the default of "no protection" (and the majority of users will just use the default of "no protection" anyway). Although Microsoft claim that "reputable CA's won't forget to set this flag", a number of CA's tested (including Verisign) don't bother to set it (does this mean that Microsoft regard Verisign as a disreputable CA? :-). Because of this, they don't even provide the user with the option of selecting something other than "no security whatsoever". In addition at least one version of CryptoAPI would allow the "user notification" level of security to be bypassed by deleting the notification dialog resource from memory so that the call would quietly fail and the key would be exported anyway (this is fairly tricky to do and involves playing with the CPU's page protection mechanism, there are easier ways to get the key than this). Finally, the "password protection" level of security asks for the password a whopping 16 (yes, *sixteen*) times when exporting the key, even though it only needs to do this once. After about the fifth time the user will probably click on the "remember password" box, moving them back to zero security until they reboot the machine and clear the setting, since the key will be exported with no notification or password check once the box is clicked. To check which level of security you have, try exporting your key certificate. If there's no warning/password dialog, you have zero security for your key, and don't even need to use the encryption-breaking technique I describe elsewhere in this article. Any web page you browse could be stealing your key (through an embedded ActiveX control) without you ever being aware of it. Details on Breaking the Older Format ------------------------------------ The Microsoft key format is very susceptible to both a dictionary attack and to keystream recovery. It uses the PKCS #8 format for private keys, which provides a large amount of known plaintext at the start of the data, in combination with RC4 without any form of IV or other preprocessing (even though PKCS #8 recommends that PKCS #5 password-based encryption be used), which means you can recover the first 100-odd bytes of key stream with a simple XOR (the same mistake they made with their .PWL files, which was publicised 2 1/2 years earlier). Although the password is hashed with MD5 (allowing them to claim the use of a 128-bit key), the way the key is applied provides almost no security. This means two things: 1. It's very simple to write a program to perform a dictionary attack on the server key (it originally took me about half an hour using cryptlib, http://www.cs.auckland.ac.nz/~pgut001/cryptlib/, another half hour to rip the appropriate code out of cryptlib to create a standalone program, and a few minutes to retarget the program from Netscape to Microsoft). 2. The recovered key stream from the encrypted server key can be used to decrypt any other resource encrypted with the server password, *without knowing the password*. This is because there's enough known plaintext (ASN.1 objects, object identifiers, and public key components) at the start of the encrypted data to recover large quantities of key stream. This means that even if you use a million-bit encryption key, an attacker can still recover at least the first 100 bytes of anything you encrypt without needing to know your key (Frank Stevenson's glide.exe program uses this to recover passwords from Windows .PWL files in a fraction of a second). The problem here is caused by a combination of the PKCS #8 format (which is rather nonoptimal for protecting private keys) and the use of RC4 to encryt fixed, known plaintext. Since everything is constant, you don't even need to run the password-transformation process more than once - just store a dictionary of the resulting key stream for each password in a database, and you can break the encryption with a single lookup (this would be avoided by the use of PKCS #5 password-based encryption, which iterates the key setup and uses a salt to make a precomputed dictionary attack impossible. PKCS #5 states that its primary intended application is for protecting private keys, but Microsoft (and Netscape) chose not to use this and went with straight RC4 encryption instead). This is exactly the same problem which came up with Microsoft's .PWL file encryption in 1995, and yet in the 2 1/2 years since I exposed this problem they still haven't learnt from their previous mistakes. For the curious (and ASN.1-aware), here's what the data formats look like. First there's the outer encapsulation which Microsoft use to wrap up the encrypted key: MicrosoftKey ::= SEQUENCE { identifier OCTET STRING ('private-key'), encryptedPrivateKeyInfo EncryptedPrivateKeyInfo } Inside this is a PKCS #8 private key: EncryptedPrivateKeyInfo ::= SEQUENCE { encryptionAlgorithm EncryptionAlgorithmIdentifier, encryptedData EncryptedData } EncryptionAlgorithmIdentifier ::= AlgorithmIdentifier EncryptedData = OCTET STRING Now the EncryptionAlgorithmIdentifier is supposed to be something like pbeWithMD5AndDES, with an associated 64-bit salt and iteration count, but Microsoft (and Netscape) ignored this and used straight rc4 with no salt or iteration count. The EncryptedData decrypts to: PrivateKeyInfo ::= SEQUENCE { version Version privateKeyAlgorithm PrivateKeyAlgorithmIdentifier privateKey PrivateKey attributes [ 0 ] IMPLICIT Attributes OPTIONAL } Version ::= INTEGER PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier PrivateKey ::= OCTET STRING Attributes ::= SET OF Attribute (and so on and so on, I haven't bothered going down any further). One thing worth noting is that Microsoft encode the AlgorithmIdentifier incorrectly by omitting the parameters, these should be encoded as a NULL value if there are no parameters. In this they differ from Netscape, indicating that both companies managed to independently come up with the same broken key storage format. Wow. For people picking apart the inner key, Microsoft also encode their ASN.1 INTEGERs incorrectly, so you need to be aware of this when reading out the data. Details on Breaking the PFX/PKCS #12 Format ------------------------------------------- The PFX/PKCS #12 format is vastly more complex (and braindamaged) than the older format. You can find an overview of some of the bletcherousness in this format at http://www.cs.auckland.ac.nz/~pgut001/pfx.html. After Microsoft originally designed the format (calling it PFX) and presented it to the world as a fait accompli, cleanup crews from other companies rushed in and fixed some of the worst problems and security flaws. However by this time Microsoft had already shipped implementations which were based on the earlier version with all its flaws and holes, and didn't want to change their code any more. A side-effect of this was that to be compatible, other vendors had to copy Microsofts bugs rather than produce an implementation in accordance with the standard. Newer versions of the standard have now been amended to define the implementation bugs as a part of the standard. Anyway, as a result of this it's possible to mount three independant types of attack on Microsoft's PFX/PKCS #12 keys: 1. Attack the RC2/40 encryption used in all versions, even the US-only one. 2. Attack the MAC used to protect the entire file. Since the same password is used for the MAC and the encrypted key, recovering the MAC password also recovers the password used to encrypt the private key. The cleanup crews added a MAC iteration count to make this attack harder, but Microsoft ignored it. 3. Attack the private key encryption key directly. Like the MAC's, this also has an interation count. Microsoft don't use it. Even if one of these flaws is fixed, an attacker can simply switch over and concentrate on a different flaw. I decided to see which one could be implemented the most efficiently. Obviously (1) was out (you need to perform 2^39 RC2 key schedules on average to find the key), which left (2) and (3). With the refinements I'm about to describe, it turns out that an attack on the private key encryption is significantly more efficient than an attack on the MAC. To understand how the attack works, you need to look at how PKCS #12 does its key processing. The original PFX spec included only some very vague thoughts on how to do this. In later PKCS #12 versions this evolved into a somewhat garbled offshoot of the PKCS #5 and TLS key processing methods. To decrypt data which is "protected" using the PKCS #12 key processing, you need to do the following: construct a 64-byte "diversifier" (which differs depending on whether you want to set up a key or an IV) and hash it; stretch the salt out to 64 bytes and hash it after the diversifier hash; stretch the password out to 64 bytes (using incorrect processing of the text string, this is one of Microsofts implementation bugs which has now become enshrined in the standard) and hash it after the salt hash; complete the hash and return the resulting value as either the key or the IV, depending on the diversifier setting; (it's actually rather more complex than that, this is a stripped-down version which is equivalent to what Microsoft use). This process is carried out twice, once for the key and once for the IV. The hashing is performed using SHA-1, and each of the two invocations of the process require 4 passes through the SHA-1 compression function, for a total of 8 passes through the function. Because the PKCS #12 spec conveniently requires that all data be stretched out to 64 bytes, which happens to be the data block size for SHA-1, there's no need for the input processing which is usually required for SHA-1 so we can strip this code out and feed the data directly into the compression function. Thus the compression function (along with the RC2 key setup) is the limiting factor for the speed of an attack. Obviously we want to reduce the effort required as much as possible. As it turns out, we can eliminate 6 of the 8 passes, cutting our workload by 75%. First, we observe that the the diversifier is a constant value, so instead of setting it up and hashing it, we precompute the hash and store the hash value. This eliminates the diversifier, and one pass through SHA-1. Next, we observe that the salt never changes for the file being attacked, so again instead of setting it up and hashing it, we precompute the hash and store the hash value. This eliminates the diversifier, and another pass through SHA-1. Finally, all that's left is the password. This requires two passes through the compression function, one for the password (again conveniently stretched to 64 bytes) and a second one to wrap up the hashing. In theory we'd need to repeat this process twice, once to generate the decryption key and a second time to generate the decryption IV which is used to encrypt the data in CBC mode. However the start of the decrypted plaintext is: SEQUENCE { SEQUENCE { OBJECT IDENTIFIER, ... and the SEQUENCE is encoded as 30 82 xx xx (where xx xx are the length bytes). This means the first 8 bytes will be 30 82 xx xx 30 82 xx xx, and will be followed by the object identifier. We can therefore skip the first 8 bytes and, using them as the IV, decrypt the second 8 bytes and check for the object identifier. This eliminates the second PKCS #12 key initialisation call which is normally required to generate the IV. As this analysis (and the program) shows, Microsoft managed to design a "security" format in which you can eliminate 75% of the encryption processing work while still allowing an attack on the encrypted data. To make it even easier for an attacker, they then dumbed the key down to only 40 bits, even in the US-only version of the software. In fact this doesn't really have any effect on security, even if they used 128-bit RC2 or triple DES or whatever, it would provide no extra security thanks to the broken key processing.

5 5

Intel, MS, & Compaq to boost Inet access x30 w/ new modem [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > REPORT: VENTURE PROMISES SPEEDIER INTERNET ACCESS > > Internet graphic January 20, 1998 > Web posted at: 9:21 a.m. EST (1421 GMT) > > NEW YORK (AP) -- Lightning-quick Internet access is in the works > under a reported new venture between three titans of the computer > industry and most local telephone companies. > > Executives at Intel, Compaq Computer and Microsoft said in The New > York Times on Tuesday that they want to develop a new type of > personal computer modem that would allow access to World Wide Web > pages at speeds 30 times faster than the usual several seconds to > minutes it now takes. > > Perhaps more important, the product would plug into normal telephone > lines, which would remain connected to the outside world. > Consequently, users would not need to dial a service and could > conduct normal voice conversations over the same line, the Times > said. > [text deleted] ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

China's New Net Regs
by John Young 17 Dec '03

17 Dec '03

Thanks to MK we offer the new Chinese net regulations as published by the US Embassy in Beijing: http://jya.com/cn-netreg.htm

1 0

Re: Your local phone company (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Ooops, I needed to do some editing that I missed....sorry for the confusion. > that base 4800 baud. Faxes get the 9600 because they use dual-tones, neither > of which is above the 4800. The problem with shoving more tones is that afer I should have changed all those 4800's to 1200's. I couldn't remember which one so I had picked one distinct from the example provided by ya'll and missed changing it to the correct value per the references. I got sloppy. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

ISLAMABAD, Pakistan (AP) - In a fresh move to promote Islamic culture, Pakistan's TV censors have been busy. They have slashed footage of pop musicians sporting long hair and jeans. Male and female co-hosts of local television programs are no more. Scores of commercials and programs have ended up on the cutting room floor since the launching recently of a campaign by Prime Minister Nawaz Sharif's government to impose its regimen of Islamic decency on television. For example, a toothpaste advertisement was considered unseemly because it showed a toothy young couple grinning at each other affectionately. Gone are the soap and shampoo commercials that showed "female glamour related to their bathing." Government officials say the campaign reflects Pakistan's traditional Muslim culture. The new policies are aimed at promoting Pakistan's rich heritage and Islamic traditions, not at trampling "acceptable" artistic expression, said Saddiq-ul Farooq, prime minister's spokesman. "The line of demarcation is that the animal instincts should not be aroused." But advertisers and artists say the new rules more reflect a slide toward Islamic fundamentalism that stifles freedom of expression - and costs them money. The campaign began in October after Prime Minister Nawaz Sharif reportedly complained that lascivious Western culture was polluting state-run Pakistan Television (PTV). PTV's censors took Sharif's gripe to heart. The censor board announced a new policy that banned footage of women "giving indecent and vulgar looks which are considered contrary to Islamic values." It also banned women from appearing in "jeans and seductive dress." Then a letter went out to advertisers saying commercials which depict "an alien locale and dresses not in harmony with our national culture will not be sanctioned for telecast." In conservative Pakistan, where sex outside marriage is a crime and many women don't venture outside the home without a veil, local film and television is traditionally conservative. Even before the newest campaign, Pakistani censors were discriminating, slicing footage of nudity, sexual intercourse, gratuitous violence and foul language from imported films and television programs. But critics say the new rules have gone too far. Advertisers have been warned against "exhibiting of body contours" and advised to avoid "unnecessary featuring of females." One of the first victims of the new rules was a soap commercial that featured a head and shoulder shot of a well-known Pakistani actress washing her face. Saying the footage was too seductive, censor board officials said it left to the imagination whether the actress was wearing any clothes, said Kareem Ramaal, an executive with Asiatic Advertising Ltd., the agency that produced the commercial. "It's quite a perverted attitude," he said. Ramaal and other advertising executives say the new rules could mean big losses for Pakistan's burgeoning advertising industry. Asiatic's clients have spent as much as $10 million producing some of the commercials that have been forced off the air. "That's just money down the drain," he said. If advertisers pull out, it could mean millions of dollars in losses for the cash-strapped state-run channel. PTV is Pakistan's only channel, but satellite dishes are making headway in this nation of 140 million people, offering dozens of channels over which the government has no control. A 1996 Gallup poll found that 58 percent of adults, about 38 million people, watch television. Seven percent said they had access to a satellite dish. "Culture and religious faith mean different things to different people ... the government should not even attempt to define them," the independent English-language newspaper The News wrote in an editorial. Pakistani singer, Salman Ahmed believes that the government worries that Western-influenced pop music and culture could foment discontent among the country's young. Ahmed said it wasn't his long hair and jeans that got his rock band, Junoon, banned from television, but rather government unhappiness over its hits, which speak of Pakistan's social ills and government corruption. "I think they are scared of us," Ahmed said. "The young generation listens to us and follows us - especially the social songs." PTV officials dismissed Ahmed's accusation, saying there was a difference between modernism and Westernization.

1 0

Re: [Long] How to recover private keys for various Microsoft
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

On avoiding use of commercial encryption products: In a session yesterday with a group of Japanese visiting the US to gather information on security products and export controls, a Westerner advised the group to avoid all commercial security products in any country, domestic or exportables, due to probability of being compromised. It was suggested instead to arrange a private service with a banking institution to covertly ride financial transactions, inland and external. Better was to arrange the same through military or governmental channels. Fees were claimed to be fairly reasonable depending on whether protection against national courts and counter-intelligence was needed at either origin or destination points. It was emphasized that these practices are now normal in countries where strongest info security was required for national economic protection against commercial and intelligence espionage, and that no one knowledgeable in the field would rely on commercial products from any source. The Western briefers were not identifed.

1 0

Taxonomy of crypto applications
by David Honig 17 Dec '03

17 Dec '03

Trying to make sense of the various applications of crypto, I came up with an illustration of their 'dependancies' at http://rattler.otc.net/crypto/mydocs/taxonomy.gif This picture illustrates topics that you should learn before others. For instance, digital watermarking depends on steganography and message-authentication codes. Anonymity requires understanding traffic mixing and practical encryption; practical encryption requires understanding public and secret key encryption. FWIW. Comments welcome. ------------------------------------------------------------ David Honig Orbit Technology honig(a)otc.net Intaanetto Jigyoubu "How do you know you are not being deceived?" ---A Compendium of Analytic TradeCraft Notes, Directorate of Intelligence, CIA http://www.jya.com/cia-notes.htm

1 0

Eureka! Wed Jan 21 '98
by eureka＠eureka.abc-web.com 17 Dec '03

17 Dec '03

Welcome to Wednesday's issue of Eureka! UNFAITHFUL Just once in a while a brand new site comes along that will blow your mind, and Unfaithful is one of them. Brought to you by two of the biggest names on the web, Intertain and Playgal, it offers MORE than both sites put together, which includes an amazing 3,000 video feeds - yes, thousands of hot, streaming videos, many totally live, and some even with audio too! With it's FREE trial offer don't miss this site! Unfaithful ... http://www.unfaithful.com/banner_Eureka0.html PLEASE VISIT THIS FINE EUREKA! PARTNER SITE LOOKING FOR *FREE* SMUT? - SEXY SAMANTHA REVEALS ALL! http://209.50.232.36/sexysam/ I'm Sam and I've searched the web for only the very best *FREE* adult sites. None of these are preview areas for pay sites, or adult verification sites. Just surf and find thousands of the hottest photos, mpegs and audio that you'll find anywhere on the web! ANAL LOVING LESBIANS Up the butt with dildos, fingers and dicks. Three pages with three thumbnailed images each. Not a bad deal for free! Good quality, hot looking brunettes. Double ended dildo fun too! Anal Loving ......... http://www.anallesbians.com/index.html MONICA'S HARDESTCORE IMAGES IN THE WORLD The title makes you interested, the websites delivers! Some of the images here may scare you. We are talking body piercing in the worst way. Needles in tits, clit rings. Wild images! .......... http://www.rawpussy.com/hardest/hard.html IN HER SNATCH OR DOWN HER HATCH? Click on the above titled link when you get there. Then on the following page at the bottom you will have two choices. Snatch or hatch, click on one any your in! In the hatch area you will find lots of thumbnail images of hot babes sucking on one cock or two alone and with another girl. Hot website! In Her Snatch .......... http://www.darkcorners.com/bedroom/ RACHEL'S RESTROOM There is a ton of text on this website but way down at the bottom of the page there are some thumbnails of some wild images. Pussy, panties and pissing. You golden shower guys are in for a real treat here. Checkout the bridge image. Rachel's Restroom ................. http://www.restroom.net/ FREE STREAMING VIDEO Please note that most of these feeds require a Netscape bro- wser in order to successfully view them. Unfortunately Micr- osoft's browser does not have all the features of Netscape's yet. However, many of the feeds use the RealPlayer and will work in most browsers. If you do not have Netscape and want a free copy click here ... http://www.netscape.com/download/ Just 18 ........................ http://204.244.215.7/teens/ CHAT WITH OTHER READERS This chat is growing fast, and already there are a number of regulars you will meet most days. It's good to see Eureka! readers interacting with each other and having a great time! Adult/Sex Chat .................. http://137.39.63.229/chat/ General/Fun Chat ........ http://137.39.63.229/chat/funchat/ THE BEST PHONE SEX NEW!!!! LD Call only! - Live Hot Girls!!!!....1-664-410-3912 LIVE: 1-on-1, 2-on-1, Group, Dateline.........1-800-644-8779 FREE: Live 1-on-1 (international call only)....011-678-77416 AMATEUR SITE OF THE DAY SOPHIA: This blue-eyed beauty will make your heart melt. Not only is this Texas gal beautiful, but she has a close connection to her fans who keep up with her life by reading her soap opera, a section devoted to her love life. Sophia is a real sweetheart, visit her now and you will not be sorry! ............................ http://amateurindex.com/eureka/ EROTIC STORY SITE OF THE DAY Very Sexy Erotic Stories: Ready for lots of hot, free sex stories? Look no further than Very Sexy Erotic Stories. All different subjects, all free. ..... http://www.verysexy.com/ DAILY CARTOON ........... http://www.erosinorbit.com/eureka/ ADULT STAR PIC OF THE DAY Every day we bring you an exclusive choice pic of a famous adult porn star. And we must tell you - these pix are abso- luletly brilliant! .... http://www.xxxadultstars.com/eureka/ GAYEUREKA! The gay newsletter is now available. You can get it here! Gay Eureka! ........... http://eureka.abc-web.com/gayeureka/ EUREKA! TRANSLATIONS As well as English you can now choose any of these languages DEUTSCH ....... http://eureka.abc-web.com/eureka/deutsch.htm ESPAÑOL ....... http://eureka.abc-web.com/eureka/espanol.htm FRANÇAIS ..... http://eureka.abc-web.com/eureka/francais.htm ITALIANO ..... http://eureka.abc-web.com/eureka/italiano.htm PORTUGUESE . http://eureka.abc-web.com/eureka/portuguese.htm TODAY'S FREE PIX Pic 1 ........................... http://137.39.63.229/?210 Pic 2 ........................... http://137.39.63.229/?211 Pic 3 ........................... http://137.39.63.229/?212 Pic 4 ........................... http://137.39.63.229/?213 Pic 5 ........................... http://137.39.63.229/?214 Pic 6 ........................... http://137.39.63.229/?215 Pic 7 ........................... http://137.39.63.229/?216 Pic 8 ........................... http://137.39.63.229/?217 Pic 9 ........................... http://137.39.63.229/?218 Pic 10 ........................... http://137.39.63.229/?219 ============================================================ TO UNSUBSCRIBE FROM THIS NEWSLETTER, USE THE REPLY FUNCTION IN YOUR EMAIL PROGRAM, AND SEND THIS EMAIL RIGHT BACK TO US. ============================================================

1 0

Re: (eternity) Eternity as a secure filesystem/backup medium
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Bill Stewart writes: > >Do the math, though, for 128bit. There are traditional analyses > >which include the amount of silicon on the earth, the number of atoms > >in the universe, etc. The general consensus is that traditional > >techniques are not feasible for brute forcing 128bit ciphers before > >the heat death of the universe. > > Hard to say. Assuming that Quantum Cryptography doesn't allow > finite-sized computers to do large exponentially complex calculations > in short finite time, you're probably limited by the number of atoms > in the available supply of planets, and Heisenberg may still get you > if that's not a low enough limit. Moore's law isn't forever. A practical 128-bit key-cracker could be built with about 10000 cubic meters of silicon. (Figure one transistor per cubic micron, 1 ghz operation, do the math...) The technology to build a computer of that size is still a few years away, but it is theoretically possible to build a 128-bit key-cracker without using quantum computers or travelling to other planets.

1 0

Certification
by sales&marketingproz＠diku.dk 17 Dec '03

17 Dec '03

"From: Steve Camfield, SME Board of Directors It is my privilege to formally invite you to become certified in sales or marketing management. Certification sends a clear message to your customers and colleagues that you are a true professional and have surpassed the highest standards of education, experience, and knowledge. For your convenience, I have placed full certification details and answers to questions you may have at www.selling.org (see Certification). ------------------------- SME is the non-profit worldwide association of sales and marketing management. Your address was provided to us by one of our chapters based on meeting attendance, inquiry, or suggestion by a local SME chapter board member but you may ensure removal by pressing the "Remove" option at the bottom of www.selling.org.

1 0

Regarding
by Important.News＠hotmail.com 17 Dec '03

17 Dec '03

"I finally found the secrets I've been looking for. Your manual tells all and has given me the tools I need to succeed, finally a genuine Internet insider tells all! If you're doing business on the web or have ever wanted to, this is a must have. You're the best, I'm making your manual into my Internet Bible! Thanks a million!" Best Regards, (satisfied customer) Florida WOW!, What a value your program is! Just the secrets on email was worth the price alone, not to mention all the other valuable things you included. I have already put up some ads and I eagerly anticipate positive results. Tom Hatcher - Minnesota ---------------------------------------------------------------------------------------- Hello Internet friend, What I am going to share with you may well be, for many of you, THE opportunity to start a unique, very successful business or take an EXISTING one to new untouched heights, by taking advantage of some breakthrough trends that are making "marketing history!" You will soon discover the art of . . . "How to Really Make Money on the Information Superhighway!" Some of you may already have purchased some "electronic marketing course" or tried to market some product online. Maybe you even made a sizeable profit! Whatever the case may be; No matter how successful you are right now, you can profit tremendously from what we are about to tell you! FACT: ANYONE WHO HAS THE DRIVE TO SUCCEED CAN ACTUALLY MAKE A SIZABLE PROFIT ON THE INTERNET. FACT: NOT MANY PEOPLE ARE WILLING TO TAKE THE TIME TO ACTUALLY DO IT. Why would people want to pass up this extremely valuable money making opportunity? Because learning is the key to succeeding online. Marketing on the Internet requires a wealth of knowledge. To learn everything you need to know about Marketing on the Internet takes more time than any human being can spare. The small amount of Internet marketers actually making a sizable profit know this all too well. Now think about this WHAT IF? I could provide YOU with an incredible Marketing Package that encompasses all the "How To" information you need to be a success on the Internet. This phenomenal package includes DETAILED Internet SECRETS (we don't hold anything back, its all here folks!!), which explains in detail how to Profit from the Internet Explosion. Whether you have a business of your own or you want to start one. It's filled with over 45 packed pages revealing the secrets about electronic marketing so many other online marketers DON'T want you to know. I thought that might interest YOU. Let me explain. <><><><><><><><><><><><><><><><><><><><><><><><> Right now there are over sixty million people surfing the Internet. By the year 2000, that figure is expected to more than double. With so many people using the Internet, smart "net"repreneur's are taking advantage of what this new (in terms of true commercial application) and exciting medium has to offer. The Internet presents one of the best ways to make money that has ever been introduced. On any given day you have the opportunity to reach more people than most cities have population wise. This is the reason so many businesses are scrambling to make their presence known on the Internet. Being "online" offers a person the ability to reach multitudes of people from all over the world. It also offers, to those who know how, THE ABILITY TO MAKE EXCELLENT MONEY. And we do mean excellent money!!! CONSIDER THIS POSSIBILITY: You wake up in the morning and you put on a pot of coffee. As you sip on your cup of hot "brew" you saunter over and turn your computer on. Then, as your monitor glows from dim to bright, you find that you have inquiries from all sorts of people requesting what you have to offer. Later, after you have finished reading your inquiries, you stroll out to your mailbox. You find it is filled with letters from people from all across the world! What's even better though, is that the letters are FILLED WITH MONEY; cash, checks, and money orders. Then, after tallying up the totals, you find that you have made anywhere between $200 to $1,000 and it isn't even one o'clock in the afternoon. Think of it: NO boss, NO traffic, and NO annoying Co-workers. Wouldn't it feel great to wake up in the morning knowing you are going to be making excellent money but don't have to leave your house to do it!?! Wouldn't your life be far less complicated? The truth is, you can be one of those who become financially independent via the Internet. AND THE BEST PART IS...IT DOESN'T REQUIRE A LOT OF MONEY!! What it does require is the knowledge of how, what, and where to do it. That is where we can help. We provide you with the knowledge of how to begin earning substantial income from your computer via the "information superhighway". We can remember how overwhelming the Internet seemed when we were first introduced to it. We realized the marketing and profit potential the Internet holds, but really had no idea how to pursue it. In our thirst for answers and knowledge, we purchased everything we could find that had information on the How, What, and Where. We spent thousands of dollars, but we now know what works and what doesn't. No where, in all of our searching, could we find a complete packet of information for all of our questions. That is why we decided to write this report. We have compiled every proven method and secrets that we have learned along the way into one complete, easy to understand report. This PROVEN REPORT makes believers of skeptics! Sound too good to be true? That's what others have said. That is, until they received their reports and saw for themselves just how easy it is to make money on the net! Hi NI, I received your report and free bonuses last Saturday and wanted to congratulate you on a job well done. I read through your report "How To Profit From The Internet" and I'm very impressed. I have bought other books and manuals about Online Marketing, Direct Marketing, E-mail, Mail Order, etc. Yours is the only one that explains the subject in an easy to understand language. I finally found the secrets I've been looking for. Once again, Great Job! Sincerely, John Strand - Satisfied Customer My father has always told me, "remember, Michele, there is no free lunch in life. You get out of life what you put into it." Through trial and error and a somewhat slow frustrating start, I purchased your report and finally figured out how to start a very profitable business from my home. Your report is great, you give the average person the tools and secrets to succeed. I know my dad is very proud of me now. I can't thank you enough =) Michele B from Oregon Good Morning, I hope this finds you well. I received your program yesterday after- noon and read it cover to cover. You have put together a very valuable resource indeed. I have finally found the program that tells all! Your program has given me the tools I need to succeed. Your program could truly end up being the best $39.95 I ever spent! Your the best, I'm making your manual into my internet Bible!! Thanks a million! Best Regards, Mary Wecker This is a wonderful opportunity, we urge you to take advantage of it. You won't find too many people that will give away ALL of their secrets!! The majority of the rich people today have copied what someone else is or has been doing. That is what we are offering you now--a chance to copy our success!! It is very easy and we ARE for REAL! Here's a little more incentive to check this out ~IF YOU ORDER WITHIN 3 DAYS~ We will send you: **** FREE $400 Bulk e-mail Software **** **** FREE $200 Check by phone, fax, E-mail Software **** **** FREE $10 Calling Card **** ----PLUS---- We will send you a list of over 100 major search engines ready to surf on the Internet or to place a free link to your web page. Also, you will receive a list of 98 of the best inexpensive newspapers to advertise in (U.S. orders only). The list is complete with papers name, city, phone number, circulation and frequency (Daily or Weekly). We will also include five free BONUS reports that include these topics: · How to Protect your PC from Viruses · How to get 300+ Quality Prospect to E-mail you Weekly · Tips and Secrets to Advertising with the major Online Services · What's wrong with the World Wide Web · Tax Advantages for the Home Business Owner. You will find that these five reports by themselves are worth thousands of dollars to you. These bonuses alone are worth several times the cost of the report. We will also give you a secret list of over 1500 of the best Web sites where you can place a FREE advertisement. This is a list we use every day to run our business and we are giving it to you! Imagine what a great offering we are giving you for FREE! And we're not through, if you order RIGHT NOW, we will give you 15 FREE "How to Reports" that you are free to market and sell on the Internet or through mail order for $15-30 each. They are 45-60 informational packed pages each. A great way to start your own Net based business! The topics are; 1) Earn Extra Dollars with a Home Based Answering Machine 2) How to Buy a Car with Bad Credit 3) How to Make Thousands of Dollars Winning Contests 4) U.S. Government Auction Sales 5) An Insider's Guide to Finding and Obtaining Grant Money 6) Home Based Business for Fun and Profit 7) How to Get a Job Fast 8) How to Make Money Without Leaving Your House 9) How to Turn the Hobby of Photography into Thousands 10) Making Money at Garage Sales, Swap Meets, and Flea Markets 11) How to Get Paid for Watching TV 12) Getting Your Start in Theater, Television, and Movies 13) Wills or Trusts? The Case for Living Trusts 14) How To Find Work with the Federal Government 15) How to Write Almost Anything and Get Paid for it! Are we nuts? No, it just shows how confident we are that you'll be delighted with the information you'll have...just like the others who are already using the information and making money. You will be surprised how quickly you can be earning money on the Internet! So you are probably thinking to yourself, this is wonderful, but how much? $149.95, $99.95 maybe even $79.95? You may have seen other companies marketing "How To" information on the Internet and charging these prices. People are actually buying these packages at these prices. Why? People want to know how to market a product or service the "Right" way on the Internet. "How to Profit from the Internet" could easily sell for any of the above prices. However, we feel that we would rather help those who may not have the ability to pay such a price in order to be successful. That is why we are offering "How to Profit from the Internet" for the unbelievable low price of $39.95. That's right, that was not a typo...$39.95. Still skeptical??? Lets put that to rest right now. We will make this completely risk free for you. If you are not 100% satisfied with the information you receive, and believe that you cannot use it to start a successful business or increase your current business profits, return it within 10 days and we will refund your money. No questions asked!! (Because this information is very easy to copy, the guarantee is only available on Disk Orders). I have sold this package at much higher prices in the recent past and will be forced to raise my prices in the very near future. One of the things you will learn in my manual is to constantly test your market. I am currently in the price testing phase of this marketing campaign. On February 1st, 1998 I will be raising the price of this package back up to $79.95 and eventually up to $129.95 to test the upscale market. If you act quickly, you have the opportunity to get these materials today for the unbelievable low price of $39.95. So, if you are seriously interested in learning how to acquire wealth by being online, ACT NOW!! This won't last for long! Print out this form and mail it to the address below, with your $39.95 cash, check, money order or credit card information. Natural Instincts 4676 Commercial St. SE Suite 201 Salem, Oregon 97302 Thank you =) ****Please print out the order form and mail it along with your payment**** ********************************************************** ORDER FORM ********************************************************** NAME______________________________________________________ ADDRESS___________________________________________________ CITY_______________________ STATE__________ ZIP__________ Deliver "How to Profit from the Internet" to the following email address: E-MAIL ADDRESS____________________________________________ (please note, all orders must include an email address incase we encounter a problem with processing) Area code and Phone number (Optional) Day time __________________ Evening: ________________________ [ ] If you prefer to have the report on disk, please check here. Please include an additional $3.00 for shipping and handling, thank you. Please check one of the following: [ ] I'm ordering within 3 days, please send my FREE software, $10.00 calling card, 15 How to Reports and "How To Profit From The Internet" and FREE bonuses for the unbelievably low price of $39.95 today. [ ] I'm not ordering within the first 3 days of receiving this letter, so I agree to pay $39.95 for "How to Profit from the Internet" by itself, less the bonus package. Payment Method: [Internal code 138109] [ ] Check [ ] Cash [ ] Money Order [ ] Credit Card, please make sure to include the mailing address above! [ ] Visa [ ] MasterCard Name of Credit Card: _____________________________ Name as it appears on Card: _________________________________ Card Number: __________________________________ Expiration Date: _____ / _____ Signature of Card Holder: _________________________. *********************************************************** "In mail-order work, anyone with imagination, determination, and a willingness to study and experiment may have very little difficulty getting started. A number of the most successful one-man operations obtain an income as high as $40,000 to $100,000 a year." - U.S. Department of Commerce ************************************************************ THE MARKET IS HERE - TODAY! TAKE ADVANTAGE OF IT!!!!! After you receive your report, I'll answer any questions time permits via email. I'm looking forward to helping you succeed!

1 0

Land Of The Freeh
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

News Of The Weird: >* Where's Barry Scheck When You Need Him? Malvin Marshall, >27, was finally released from jail in North Charleston, S.C., on >October 29 after being locked up for 6 weeks because a police field >test had found that he had heroin in his pocket. The state lab had >finally gotten around to analyzing the substance, which was >determined to be vitamin pills that had gone through a wash cycle >while in his pants pocket. Said a police lieutenant, "The field test >[is] not foolproof." COPYRIGHT: Neither the name News of the Weird nor any issue, or portion, of News of the Weird may be used for <any> commercial purpose <whatsoever>. "Any commercial purpose" includes something as small as a bartered advertisement on a Web page. If you have a Web page or a mailing list that you run purely as a hobby at entirely your own expense, and it is freely accessible by the public with <no fee charged>, you may use portions of News of the Weird without express permission provided that the portion(s) is(are) (1) not edited, (2) distinctly separated from material that is <not> from News of the Weird, and (3) identified on the Web site or message as from News of the Weird and with this copyright notice affixed: Copyright 1997 by Universal Press Syndicate.

1 0