December 2003 - cypherpunks-legacy

No Subject
by anonymous-remailer＠replay.com 17 Dec '03

17 Dec '03

perry shut the fuck up you arrogant dweeb

1 0

No Subject
by ddt＠lsd.com 17 Dec '03

17 Dec '03

X-PGP Key ID: 4AAF00E5 X-PGP Fprint: 30D81F3484E6A83F 6EC8D7F0CAB3D265 Date: Tue, 13 Dec 1994 21:08:38 -0800 To: cypherpunks(a)toad.com From: ddt(a)lsd.com (Dave Del Torto) Subject: KEYSRVR: remove w/o revoke? -----BEGIN PGP SIGNED MESSAGE----- A Keyserver Dilemma: Through the good graces of one Craig Steinberger, I discovered that the keyserver Michael Graff runs at Iowa State has an old, defunct key for me. Naturally, I've tried to update it, but am not sure if I was successful yet, but here's my question: Is there a mechanism for deleting your own key from a keyserver's ring without revoking it? I think not, on the surface of it, it goes against general key hygiene procedures. History: I sent that 512 key to two people almost two years ago as a test and never used it since. Apparently it got put on someone's keyring and transferred to Iowa at some point. (Note: _I_ never added it to any keyserver, so there's a problem with posting other people's keys and not telling them that also needs addressing here.) Now, since I never expected to use that key again, I deleted the secret half of the pair, and hence am unable to revoke it. Asking Michael nicely to remove it from Iowa (which requires a certain measure of trust most keyserver-owners might not extend under normal conditions) is fine. But what about all the other keyservers that propagate the bogus key all over (and back to Iowa)? How can one deal with that problem? Key management is one of my _least_ favorite aspects of PGP. grrrrr... BTW, my (good) key is available at: ftp.netcom.com:/pub/dd/ddt/crypto/ddt-PGP-key.txt My apologies to anyone who hasn't been able to verify my signatures because of the bogus key. dave _____________________________________________________________ "To solve a maze, start at the cheese and mouse backwards." -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLu5noaHBOF9KrwDlAQHHogP/ds8Nr2nlnR6mRZbul24Kk07FvBrNCqrb TY70MN9aEsKLoALXpdvC4ZIc2npwk3HWK/UN7mayqZsVWwOpJf/NZwATcYHrlGxT 5sHsAhGAzb7TlpByEUJ+He65e7a8doyqffHuUeNdokM5YFkxQi/LRfPVkIDi3cGG jq6NJR20SKs= =+Zfi -----END PGP SIGNATURE-----

1 0

No Subject
by ddt＠lsd.com 17 Dec '03

17 Dec '03

X-PGP Key ID: 4AAF00E5 X-PGP Fprint: 30D81F3484E6A83F 6EC8D7F0CAB3D265 Date: Tue, 13 Dec 1994 21:08:19 -0800 To: cypherpunks(a)toad.com From: ddt(a)lsd.com (Dave Del Torto) Subject: Re: calling all cpunks on netcom At 11:46 am 12/13/94, Shrieks wrote: >Just floating a trial balloon. Are you tired of the high traffic on >the cypherpunks list Well, yes, it does get a BIT junked-up at times (mea culpa). >and having to wade through a ton of mail every >day? Any of you folks approaching your 5M limit from archiving too >many messages? No, I don't rely on Netcom to store it for me, I POP back it to my home machine and fill the nooks and crannies on my HD before I archive it all to big, monthly searchable text files (which lay compressed at the botton of another drive hanging off my home ether). But that's just me: when I first subscribed in 92 from Budapest (gaak! telecom hell!), I had a very funky and expensive connection and it was a "nagy" pain in the ass. Of course, the volume back then wasn't quite as... "intense." >Well, I am and I don't really want to start paying for the extra memory. I'm sympathetic to that: if there's a better way to do it, I'm all eyes. >I was wondering if it might be worth petitioning the netcom sysadmins >to start up a local newsgroup (eg. netcom.cpunks) [elided] As far as trial balloons float, it's not a horrible one, BUT: while I applaud the intent, the method sorta suc-er-(let's see... #10 on Engineer's New Terminology list...from October's FUN10 list ... ah here we go: "WE WILL LOOK INTO IT"(1). Besides the feasibility problems that Timothy mentioned (Netcom bonking files after a while), I'm just convinced that getting Netcom to do somthing this _complex_ would be *UTTERLY IMPOSSIBLE*. I mean, they don't return phone calls, they don't answer support mail (well, almost never), and it took them three-and-a-half-months (yes, you read that correctly) to find the 2 minutes to set up an anon ftp directory for one of my clients (still no explanation for that, btw). Not to mention that certain dept managers there have a tendency to "work around the truth." Now, you tell ME that they can handle something like a local ng (no smirking, now!). Hell, they can't handle the quotidian business they HAVE much less something "technical." Uh, flame off. Yikes. Sorry 'bout that, lads. It's just that I can think of other things I'd prefer to RAM up my butt than more Netcom hassles. Wait a minnit: isn't this alt.netcom.sucks? Oh dear, I wanted the room down the hall. Excuse me. Also, did someone (Tim?) mention that Netcom filters all our packets to the NSA? I'd like to know how anyone could ping that out, but maybe it might be a good idea all the same if we just try to set up our own box overseas. If it could give us a bit more security/fewer intrusions, I'd send the Hack-Tik boys (fer example) in A'dam some fraction of my pathetic bank account to get it up (in the red light district, perhaps, wouldn't _that_ be appropriate?), and/or maybe someone who shall remain nameless with the initials JG might be overcome by philanthropism (yet again) and help us put an old unused box online "somewhere". I'm just thrashing here, but maybe there's kernel of a worthwhile idea here (all puns intended, always). What about Arthur Abraham? Arthur? >Another alternative might be to set up something along the lines of >discuss at mit [elided] This might be viable, but sick puppy that I am, I LIKE getting all this mail dumped on my machine from Eric's remailer. I kind of understand Tim's point: with the files local, I can browse/search at will at greater speeds, etc. And ruthless deletion is the only way to survive the onslaught. Of course, this all means I can never go on vacation unless I unsub for the duration, or else I DO get those dorky "your mailbox is full" msgs from you-know-who. s i g h >Just a thought. Pheedback? Screeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-oops, sorry, forgot to turn my radio down. dave [1] Which means: "Forget it! We have enough problems right now." ____________________________________________________________________ "I'm quite confident about the Republicans salvaging the Economy: heck, look what a swell job they're doing down in Orange County!"

1 0

Re: Emergency! Need single use passwords!
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >| Hi all. We discovered that someone has been >| running a packet sniffer on our subnet of several >| dozen computers. He has all the passwords. >| This is my chance to try to get single use password >| login programs installed here. Please give me recomendations >| and ftp locations. > > S/Key is a very nice software only solution (no smart cards). >It has clients for Mac, PC, Unix, and supports paper lists as well. >Can be configured to only be invoked if the connection is from outside >your net. ftp.win.tue.nl:/pub/security/logdaemon.tar.Z > > In quick reply to Derek's suggestion of Kerberos, I will point >out that Kerberos does not deal well with remote users. As far as I >know, you need a special connection mechanisim or your password will >travel in the clear to the boundary of your keberized network. (There >is Kerberos support for S/key, there may be telnet programs. There is >no paper list or palmtop support.) > >Adam > > If you're interested, I can mail you the intro to S/Key sent >to our user community. It covers S/key and PGP, since we have users >all over the globe. > >-- >"It is seldom that liberty of any kind is lost all at once." > -Hume Wonderful, thanks. That is exactly what I was looking for. I forgot the name of the program. BTW, remailer@nately and mixmaster@nately will be down till tomorrow morning because we yanked the thicknet connection out of our Ethernet repeater. Lets see a hacker get through THAT security ;) No messages will be lost. They should be back up around 11:00 AM PST tomorrow. To spare you other remailer operators out there a flood of messages, I turned off my pinging scripts ;) -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLu6LblVkk3dax7hlAQHq6gP+NnwclSRJ9b9G5qV9qsfE/1MH0o+K+vcq 2JNRgPgPhdo9CrBO+c65KnVXXse8k6wiAY2vcwJdN/01c4SmqoHnrAU0n7Zpoyxx v3uilFCBIOLw4jtwBPq8ipspYDJior5q86Shhc1Cy66iPyU67DOiXMDssucBGLaU w3rgkImkCHU= =jZ6r -----END PGP SIGNATURE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Home of "chain" the remailer chaining script. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

Emergency! Need single use passwords!
by loki＠nately.UCSD.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi all. We discovered that someone has been running a packet sniffer on our subnet of several dozen computers. He has all the passwords. This is my chance to try to get single use password login programs installed here. Please give me recomendations and ftp locations. Thanks. - ---------------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche - ---------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLu5mUFVkk3dax7hlAQGP9gP8DB5WGmLQsSR6AGPTKkPMOqyAew+NDsiE ftwsDXJV2ijZfabkY+2V84ea4lDLku7BPmz+5p4gI7E2ezDFHgJ/bQ/cDspsjZoO EzmqiJqJGkCNggFdKzD29jsU1v+icZEdMOuwGZ7rMKEAfCtBCmT9X8Uvk4q7S+YO udLS1eGddAY= =7gbf -----END PGP SIGNATURE-----

4 3

Elliptic crypto is patented
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Eric asks whether elliptic encryption might not be a solution to the world's patenting woes. Last April, schirado(a)lab.cc.wmich.edu (Schirado) asked whether anyone was interested in trying an implementation. I was relatively free of work at that time, and volunteered. Then I got busy; IAC it appeared far too slow for software. Read: _An Implementation of Elliptic Curve Cryptosystems Over F-2-155_ , IEEE Journal on Selected Areas in Communications, Vol. 11, #5, June 1993 (page 804). Incidentally Next Computer's Fast Elliptic Encryption, FEE, used elliptic curves, and is patented (by R E Crandell, USP# 5,159,632,27 October 1992); also, elliptic crypto is probably covered by the DH/PKP patents. "We know everything about you that we need to know" - Coleta Brueck, IRS ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

3 2

Welcome to HotWired!
by newaccounts＠wired.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Welcome to HotWired! ++++++++++++++++++++ The verification number for "cypherpunks" is: 96472 You may also use the following URL to verify yourself, using cut and paste if you can: http://hard.wired.com/cgi-bin/users/ver?number=96472 Note: This is your *verification* number, *not* your HotWired password. Your HotWired password is the password you gave us when you created your account, and has not changed (and won't change unless you change it). Please type (or copy and paste) this number into the verification form. To reach the verification form, connect to HotWired, click Yes to signify that you are a member, and click on the region of the image map that reads, "You should verify NOW." (You really should.) You can also reach this directly as http://www.hotwired.com/Login/verify.html You will then be able to take advantage of the full range of HotWired services. Thanks! - ---------------------------------------------------------------------- HotWired FAQ What Is HotWired? HotWired is new thinking for a new medium. We call it a cyberstation, a suite of vertical content streams about the Digital Revolution and the Second Renaissance with an integrated community space. While HotWired is currently bound by technological limitations that restrict bandwidth, it represents the genetic blueprint that will evolve into the overarching media environment of the next century. At the core of HotWired's editorial is point of view. We are not in the content business, we are in the context business. People today don't have the time or inclination to make sense of the data flood. HotWired is Wired's answer to the need for professionalism in a new medium that has been filled until now with something that resembles public access television programming. HotWired is live, twitching, the real-time nervous system of the planet. What Does HotWired Look Like? HotWired is a stunning reinterpretation of the World Wide Web. Developed by Creative Director Barbara Kuhr of the award-winning design firm Plunkett + Kuhr, HotWired's look is clean and bright, filled with playful logos by Dutch designer Max Kisman and bursting with world-beat colors. HotWired can be accessed on the Internet via the World Wide Web and a client application such as Mosaic or NetScape (though be warned, NCSA Mosaic for Windows has a bug which makes it unusable). How Is HotWired Different? HotWired doesn't look like any online service out there - it zigs where all the others zag. (HotWired's unofficial design watchword was "war on bevelled edges.") Its content and perspective are as innovative as those of its mothership, Wired magazine, while at the same time being utterly different. Its community space is technologically unrivalled - the first graphical conferencing system for the World Wide Web. Isn't Advertising Anathema on the Net? The Net community does indeed react negatively to invasive advertising - the kind of spamming conducted recently by the Arizona lawyers Canter and Siegel, which elicited a massive rejection by the Net's immune system. The advertising on HotWired is the opposite of invasive. Each advertiser is accessible only through a single discreet banner at the head of a content section. Most advertising is 90 percent persuasion and 10 percent information; advertising on HotWired reverses this ratio. And the privacy of members is guaranteed by HotWired's unqualified commitment to never divulge a member's personal information to advertisers. Why HotWired, Why Now? Because while Big Media and the telecom behemoths have been busy forming "strategic alliances" to build the "information superhighway" and sending out press releases about the tests they're launching any day now, thousands of companies and millions of people have quietly built a new interactive medium called the Internet. This medium is not magazines with buttons, any more than television was radio with pictures. It's a new medium with a new aesthetic, a new commercial dynamic. Many media companies shovel their leftovers into the online world and call it content. HotWired is not one of them. Where Wired is a clear signpost to the next level, HotWired is operating from that next level. HotWired is a constantly evolving experiment in virtual community. It's Way New Journalism. It's Rational Geographic. Today is like 1948; a new medium has reached critical mass. We're trying to help define the future of that medium before it ends up like television. So if you're looking for the soul of our new medium in wild metamorphosis, our advice is simple. Get HotWired. What Does HotWired Cost? HotWired is free to members. HotWired's revenue model is similar to broadcast media - content supported by sponsors. HotWired's sponsors are some of the bluest chip advertisers in America, including IBM, AT&T, Volvo, Sprint, MCI, Zima (Coors), Internet Shopping Network (Home Shopping Network), Club Med, etc. What Hotwired Is Not HotWired is not Wired magazine with another name (Wired works perfectly well in print, thank you). It's not a so-called online magazine (print content reduced to ASCII and shoveled into another medium, narrowband interactive). It's not video-on-demand (a pie-in-the-sky marketing concept created by out-of-touch old-media executives to justify their headlong rush into a new medium they don't understand, broadband interactive). It's not an online service like Prodigy or AOL (now rendered obsolete by the explosion of interest in the Internet and the development of the Web and graphical browsers). And like Wired before it, HotWired is not a cold, marketing concept, but the heartfelt expression of the passion of its creators. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu6SbCoZzwIn1bdtAQHuEwGA3eIONz/osE9684/lB2U8qXM+e2NxJhYw nQCC0yOux4zkXVvIfGMnlmP4SaTIQvNy =n77t -----END PGP SIGNATURE-----

2 1

re: BofA + Netscape
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

> It seems that Perry and other are flaming Netscape for doing things > their own way. > Yes, Netscape have made a lot fuckups. But they are out there > bringing really cool crypto to the masses. > First guy on the block always does a lot of dumb fuckups. This is by far the most intelligent commentary I've read so far in this "NetScape" debate. Does anybody remember PGP 1.0? Released in the summer of 1991, using the Bass-O-Matic cipher... which was worthless. This list didn't come into existence until around the same time PGP 2.0 came out. Thus, nobody railed against the weaknesses of PGP like they are railing against NetScape. So maybe the first version of NetScape could use some enhancements. Just like PGP 1.0 did. Nobody would argue that based on the direction of PGP 1.0, the whole PGP project should be scrapped. Or would they? I think NetScape is doing overall good. Sure, improvements can be made. But SOMETHING is being accomplished.

3 2

Encrypted Credit Card Numbers For Transmission....
by werewolf＠io.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I thought about this recently when I bought a subscription to Wired for X-Mas for a friend. Why don't organizations like Wired (who are ostensibly closely connected to the 'net) not have public keys (ie through Viacrypt, as they are a commercial enterprise) that subscription purchasers could encrypt a credit card number to them, and then e-mail that cyphertext file to them for processing. The company could then snail mail to the purchaser confirmation of the cc purchase just like what happens for a credit card phone purchase. It seems straightforward or am I missing something? I mean, PGP is extremely widespread, and other organizations encrypt data for transmission between points with DES, so use of encryption is hardly a novel concept for business to swallow (particularly a magazine like Wired, who likely have a reasonably encryption knowledgeable readership or potential readership). Routine use of encryption at this simple level would likely get the ball rolling in the direction of other endeavors, like e-cash, or at worst become another convenience for the customer and allow encryption and the 'net to gain wider acceptance. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLu6Cl3BFBj7pSNyhAQGzRQf/WjlkdJaLfTpc8cdDF6EV6IoGN0P0i6l1 dXPMoqRwNn3Aol04pBRQn3+KrK5GaII9ZopRWtEysCzIdv4nbA2t6qLZBZ8oXUgg 3o5Bdp+RIcgXNPtoRmZH5yDGw8kOQqgBH3glWsL25v2BOd87ic10HbhjSZn9FfWD s0qNKFblbqOb6Ur/XZklfjEpPJbE8rvVawt6RQqDO1ky5rKxrgDeGeQVfnu8m7ti fFo9lqTGpBKW9vk8JnTpF5gJvgTcj/iPxNzzeRw6UBD/nIDV2Ttg/lJni5yhGOxe 5LLINeaGVDvtioGbcehz0veXFZ5t7pNJgRxbIIG0AgA+plP0RQdp8A== =iUO3 -----END PGP SIGNATURE-----

3 2

Re: Using HotWIRED without provoking junk mail
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- > I get enough junk mail already, and I don't want vendors to be able to > capture market research at the browsing level (I haven't > looked at WIRED's server for precisely this reason). A while back someone established a HotWIRED account in the name "cypherpunks" with password "cypherpunks" to get around this. I make a point of mentioning that whenever I point someone to HotWIRED. I'm assuming here that they're not collecting identification data in some other way (if you're not using Netscape ;). - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLu55rGf7YYibNzjpAQExGwP/S0ahTCimJlYKQCK1DGjHbdSxcaovbHHI Ybtcw8iaGwYZxmEWcK5fM8tRqORV99oGUISdynMrFCw0VV+cvozot4q+GSMCpcND uIsSgkw/D3F3XWfWLtJDocme3Joot1cARfmo6lj7YmqBjHS2e27OOke8BQ2JeOBh 3wceidNaEKk= =fWzB - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu564ioZzwIn1bdtAQExZwF9EEHP+++Y3ODxhxSZPY3IeVSC0JtOc7vc xu2avrEaeNetk0yPogy1+tmjwb6JC2e8 =qVmS -----END PGP SIGNATURE-----

3 2