December 2003 - cypherpunks-legacy

Alice in Cypherspace
by David Lesher 18 Dec '03

18 Dec '03

I found my copy, if the person asking last week still needs it.... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Dimitri
by David Lesher 18 Dec '03

18 Dec '03

Dr.Dimitri Vulis KOTM sez: > Sounds like a crontab job, or Timmy May, or both. THIS sounds like our friend SternFUD. {Who, BTW, is back attacking folks in the pgp groups..} -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

2 1

Re: Wrap Up: Conference on Law Enforcement and Intelligence
by frantz＠netcom.com 18 Dec '03

18 Dec '03

At 11:13 PM 10/20/96 -0600, C Kuethe wrote: >On Sun, 20 Oct 1996, Bill Frantz wrote: >> (3) The devil is in the details. I still am not convinced that MacPGP has >> enough sources of entropy for its IDEA key generation. (But I am not >> convinced that it doesn't either.) I put integrating Jon Callas's entropy >> manager into MacPGP as a high priority. > >Tell me more... I use macpgp. I just built some new keys tonight, a 2048 >bit monster. PGP wanted 1496 bits of rand info... where is it's entropy >"Hole" > >And what is the "Entropy Manager"? When you build RSA keys in PGP it uses keyboard timings to acquire "true randomness" or entropy. This kind of randomness is related to quantum mechanical uncertainty. It probably has enough entropy to safely generate RSA keys by the keyboard technique it uses. In addition to RSA keys, it generates symmetric IDEA keys whenever you send a message. It uses keystrokes accumulated during normal operation and saved in a file called randpool (or something like that) to generate these keys. Since you almost never enter keystrokes during the normal operation of MacPGP, I am concerned that randpool does not have enough entropy. Entropy Manager is a program Jon Callas of Apple is working on. It uses well-known sources of entropy in the computer to build up a pool of entropy for use by programs that need it. The last I heard, it was nearly ready. I would trust it more than the ported PGP since Jon has examined sources available in the Macintosh specifically. ------------------------------------------------------------------------- Bill Frantz | Tired of Dole/Clinton? | Periwinkle -- Consulting (408)356-8506 | Vote 3rd party. I'm | 16345 Englewood Ave. frantz(a)netcom.com | Voting for Harry Browne | Los Gatos, CA 95032, USA

1 0

Re: Usenet and Re: extortion via digital cash
by Bill Stewart 18 Dec '03

18 Dec '03

> As an already existing, widely >disseminated and easily used message pool, Usenet is very valuable to us. >I'm concerned that it may not last though. Many people now complain about >how low the signal to noise ratio is [...] So, if it gets too bad, might it >just fade away? Or, if it remains but becomes unpopular, will it be easy to >restrict if we use it for anonymous messages? I haven't read all of Usenet in 10+ years :-) But it keeps growing, and if you're trying to piggyback anonymous messages on it, then it's great to have VOLUME, VOLUME, VOLUME, as the talk.bizarre folks put it. On the other hand, there are technical difficulties with using the current modes of Usenet for real applications, and volume may make it worse. Usenet used to work by flooding - every message goes to every machine, so it's not suspicious your machine receives an Anonymous Message. Most machines had multiple users (Unix, after all), and didn't log who accessed what files in the news spool (which you could do directly as well as through your newsreader.) Now, however, most users use NNTP to fetch news articles from their ISP, and the number of machines receiving the whole Nx100MB/day flood is probably smaller, though perhaps businesses and universities are putting up with it, and perhaps the usage patterns are different outside North America. Fetching material by NNTP is probably logged by many ISPs, and can also be detected by sniffers in the places where security is weak enough for them, which probably includes many major ISPs. So it's easier to detect who's reading alt.anonymous.messages, especially if some government agency subpoenas logfiles. azur(a)netcom.com (Steve Schear) wrote: >In the U.S., at least, attempts to enforce identification of Internet users >or anonymous posters to newgroups and such are likely to meet with stiff >legal resistance. The Supreme Court has ruled that anonymous use of >protected speech (e.g., political handbills) must be permitted. No legal resistance at all, if it's done by ISPs or businesses or individuals - only if the government tries it does it get into "protected speech" territory. There may be market resistance, and the Internet and Usenet are fundamentally worldwide cooperative efforts, so if the protocols support anonymity, then participants in the nets can choose to have their systems cooperate with or refuse to cooperate with anonymous messages, and you'll find some people doing each one. This may mean that small-ISP.net and xs4all.nl will permit anonymous users and aol.com, compuserve.com, and proxy.gov.sg will demand Internet Driver's Licenses to let your postings through, while nihilism.net won't allow any non-anomymous messages. Spontaneous order is like that. And the US government could probably get away with sponsoring Internet access for Real American Citizens and Green-Card Holders that requires positive identification because you can file your tax forms over it, as long as they don't prevent anonymous messages on _some_ part of the net. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

PLEASE take Mormon/LDS stuff to private mail.
by Peter Trei 18 Dec '03

18 Dec '03

While I realize that religious arguments, in the large sense, are a well-honed skill of many of the participants of this list, the current threads concerning the LDS/Mormon church are so far off-topic that it isn't funny, just annoying. PLEASE take this stuff to private mail. Most of us have little or no interest in it, and it's creating entirely unnecessary discord and hatred (not to mention using up bandwidth). Unless a group takes a stand on encryption, lets keep them out of it. Please! Peter Trei trei(a)process.com

2 1

RE: crypto cd once more
by JR＠ROCK.CNB.UAM.ES 18 Dec '03

18 Dec '03

>1) is there a system that can handle unix, windows and mac filenames > Yes. Use Rock Ridge extensions. That will allow for long UNIX names. If you couple it with ISO9660 youget both worlds. Caveats: Macs don't accept RR. Hell! Solution: Use level 2 (32+32) names. Problem: that's OK for VMS and perhaps Macs, but not for PC's. Solution: Use level 1 (8+3) ISO. That's easily done with the tools for Liux/Unix. I used them when I created my personal Crypto-CD a year ago. You tell the program to use Rock Ridge and convert all names to 8+3. That gives you a double directory hierarchy, one that's compatible with everything (8+3) plus one that allows long names (RR). If only Macs supported RR... ObCrypto: Have you considered the possibility of filling the unused portion of the disk with random noise from a good source? Some people could find it useful even if it is only for trial/test purposes. And, is there any possibility of making an international version of it? jr

2 1

Recent Web site cracks
by pjb＠ny.ubs.com 18 Dec '03

18 Dec '03

The recent cracks of the DOJ, CIA and Dole web sites have caused me to think about just what is going on here. Do you suppose that these entries were made via the httpd route, maybe via cgi-bin, or just a straight telnet-type entry to the server? I don't know what operating systems were involved with these three systems, or even if it was the same in all cases. I expect that there have been other such break-ins that we have not heard about. The speed with which the attacks are made, and the completeness of the hack seems to indicate that someone knows something. As a long-time Unix Sys Admin, I am aware that most security holes are due to piss-poor administration, with a few system holes that may be exploited by the reasonably sophisticated, but I am not aware of any glaring holes in the httpd code. I suppose it's stupid of me to think this, but I would have though that these three sites in particular, would have cleaned-up their act in this respect. I suppose that it is possible that there is a route back, through the browser, but this doesn't seem very likely, even with a thoroughly hacked, custom browser. Does anyone have any ideas about these attacks, how and where the entry was made, which operating systems were involved, etc? Cheers, -paul

1 0

Re: EUB - Pay attention next time guys.
by Peter Trei 18 Dec '03

18 Dec '03

> Maryanto Tuan dan Puan <lamdn(a)idola.net.id> writes: > > Please unsubscibe lamdn(a)idola.net.id > Where the heck is 'id'? > Dr.Dimitri Vulis KOTM > Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps Indonesia, as you should have been able to find out for yourself. Peter Trei trei(a)process.com

1 0

Re: PGP
by pjb＠ny.ubs.com 18 Dec '03

18 Dec '03

this is recycling at it's best. (-: -paul > From cypherpunks-errors(a)toad.com Mon Oct 7 03:05:47 1996 > Date: Sun, 6 Oct 1996 21:35:02 -0400 > To: cypherpunks(a)toad.com > From: dustman(a)athensnet.com (Anonymous) > Comments: Please report misuse of this automated remailing service to <dustman(a)athensnet.com> > Subject: Re: PGP > Sender: owner-cypherpunks(a)toad.com > Content-Length: 238 > > > From: nobody(a)cypherpunks.ca (John Anonymous MacDonald) > > > > There's a rumor that Timmy C. May sells his dead relatives as fertiliser as > > they constitute the best shit in California. > > Where can I buy some of this fertilizer? > > Thanks. > >

1 0

No Subject
by Thierry van Herwijnen 18 Dec '03

18 Dec '03

,,, (o-o) --------.oOO--(_)--OOo.-------------------------------------------------- ing. Thierry van Herwijnen \ t.vanherwijnen(a)rijnhaave.net Consultant \ \ thierry(a)herwijnen.com Rijnhaave Internet Services \ Louis Braillelaan 6 \ http://www.rijnhaave.net 2719 EJ Zoetermeer \ The Netherlands \ -------------------------------------------------------------------------

1 0