December 2003 - cypherpunks-legacy

Re: none
by Arunas Norvaisa 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 12:09 AM 97.09.14 -0700, SL Baur wrote (and I quoted): > >bureau42 Anonymous Remailer <remailer(a)bureau42.ml.org> writes: > >> Since Sept. 11th: > >> http://www.ifi.uio.no/pgp/ > >> Forbidden > >> Your client is not allowed to access the requested object. > >Something is seriously wrong with the ifi.uio.no server. You can't get >much of anything off of it. I doubt the general outage is pgp related, >this isn't the first time there have been problems with it. > > Try this one instead...... http://zone.pspt.fi/pgp/ - -- greetz... Arunas Norvaisa - little guy, The Masses Inc. check the message headers for PGP key information _OR_ send mail with subject 'send key' to mailto:arunas@post1.com PGP for idiots page <http://www1.omnitel.net/an> and a US mirror site <http://www.post1.com/~arunas> IBM: I'm Beyond Mistakes -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: Watch out for the Big Brother iQEPAwUBNBz6uSOu3BjJDX4hAQExswfQvEPFzM9qS7XYNev427X7qtVTA5T4WU0H OYeGOCgX3E34IqOboBU0gnl7ngB09f760W/BPvxb8e1ijMniaukTUPjTMi1aTSa4 EyWpWsGx5rWUrpvQnotb9MhqTkO5Crci+FxNffjj9FA2ZMYaksOOkrN2HN3wv7hm mRxSxLY4PKf2pYzPlKTAYbNkicqtzwhicEjMoKerUDGy8CIOkgslUHGEFT4JK5f9 7oM3/Y8Z1ZTDT0jL80ECeHe4jA6YKVKYtuVMxbdfNnKWYSK9UXmTWRSYKywBakSL JZIBoUM64INh19UsEGolNzPUOAB5GWqO/bB5WbIXHCoong== =83mA -----END PGP SIGNATURE-----

1 0

Ignore
by Anonymous 17 Dec '03

17 Dec '03

Gag test. Ignore.

1 0

Report on Privacy Loss
by John Young 17 Dec '03

17 Dec '03

NYT has a front page special report today on the booming computer investigative industry which is using legal and illegal means to mine and peddle personal, corporate and political data, dirt and damaging secrets. As one nabbed dick says, it's no longer ex-intel and ex-feebs who are doing it, now the techies and beagles of all sorts have rubbed their eyes at the amazing golddust on their screens. It might boost the demand for crypto and other essential tools for privacy, or it may just lead to more cyber-TLAs and -bounties willfully busting the wrong Jim Bells while warning their still-connected buddies of "court-okayed" wiretaps and traps. http://www.nytimes.com

1 0

Re: Court proceedings under new SAFE act]
by Omegaman 17 Dec '03

17 Dec '03

On Thu, Sep 11, 1997 at 06:12:15PM -0700, Declan McCullagh wrote: > I'm reading the bill more closely. This is incredibly slick work. > > 1. When it appears that any person is selling, importing, or distributing > non-backdoor'd crypto or "about" to do so, the Atty General can sue to > stop them. "Upon the filing of the complaint seeking injunctive relief by > the Attorney General, the court shall automatically issue a temporary > restraining order against the party being sued." "distributing" Does that include paper copies of source code? How about slowly and carefully reciting source code to an audience? Writing it on a blackboard, perhaps? What if I respond to Adam Back and accidently forget to snip his .sig? (if that's not prior restraint, I don't know what is!) > 2. There are provisions for closing the proceedings -- at the request of > the "party against whom injunction is being sought." "Public disclosure of > the proceedings shall be treated as contempt of court." Can also be closed > if judge makes finding. This, of course, is what remailers are for. More prior restraint, of course. > You get notified not later than 90 days afterwards. There are a lot of > other "checks and balances" here that will be touted as safeguards. Who's being saved? Fuck 'em. -- --------------------------------------------------------------------- Omegaman <mailto:omegam@cmq.com>|"When they kick out your front door, PGP Key fingerprint = | How are you gonna come? 6D 31 C3 00 77 8C D1 C2 | With your hands upon your head, 59 0A 01 E3 AF 81 94 63 | Or on the trigger of your gun?" Send email with "get key" as the| -- The Clash, "Guns of Brixton" "Subject:" to get my public key | _London_Calling_ , 1979 ---------------------------------------------------------------------

5 4

Re: Nightmare Scenario: Public Key Distribution Controlled
by John Young 17 Dec '03

17 Dec '03

Does the following provision of the amendment lighten Tim's dim glim? "§ 2804. Encryption products manufactured and intended for use in the United States ... (d) USE OF PRIOR PRODUCTS LAWFUL.-- After January 31, 2000, it shall not be unlawful to use any encryption product purchased or in use prior to such date. [Bottom page 13] That gives about 450 days to widespread stego, surrept onions and backchannels to prepositioned stashes. Max use prior to. Or, say to hell with it, coders will forever evade USCoders.

8 7

Re: netscape bug
by David_A Wagner 17 Dec '03

17 Dec '03

In article <199509201855.LAA17261(a)netcom16.netcom.com> you write: > > none of the articles mention that the cracker must have login access > to the computer that the random numbers are generated on. is this true? > does the code require knowledge of the PID etc. that can only be obtained > by a login to the system that the netscape session is running on? > No, the time, pid, and ppid often leak to a remote adversary too. The attack probably requires a bit more sophistication when the cracker doesn't have login access, but I believe it's still possible. See my recent post to sci.crypt for some comments from Ian & I about this.

1 0

Security Update news release
by Jeff Weinstein 17 Dec '03

17 Dec '03

Here is the press release we put out this morning regarding the fix for RNG seed and stack overflow problems. --Jeff BETA VERSIONS OF NETSCAPE SECURITY UPDATE TO BE AVAILABLE WEDNESDAY FOR FREE DOWNLOADING Company Puts New Code on Net for Examination; Outside Security Experts Reviewing Software MOUNTAIN VIEW, Calif. (September 25, 1995) -- Netscape Communications Corporation (NASDAQ: NSCP) today announced that it has completed beta versions of the security update for its client and server software and will post the new software for free downloading from the Internet on Wednesday, September 27. The beta versions of the software updates, being posted following a review by internal and outside experts, are in response to the potential vulnerability in the company's security implementation discovered last weekend by two University of California at Berkeley students. In addition, Netscape is taking the opportunity to include other improvements with this update. Netscape addressed the potential vulnerability by increasing the amount of random information it uses to seed the random number generator in its security implementation. In Netscape's security approach, the random number generated is used in a mathematical formula to create a "session key" for encrypting information to be sent across the Internet. The new solution uses many times more random information than the previous version, ensuring much greater degrees of difficulty in identifying the key used to encrypt a particular session. The solution is also now assembled in a platform-dependent manner which, when combined with the increase in random information, makes Netscape's products substantially more secure than before the update. Netscape's source code that will be used to address the potential vulnerability has already been posted on the Internet so that it can be reviewed by anyone wishing to do so. This technique is often used in the development of security software to ensure the highest level of inspection possible before the final software is made available to customers. The code is also being reviewed by external security experts retained by Netscape and various Netscape platform partners with expertise in specific operating system environments to provide additional checks on the soundness of Netscape's approach. "We have always encouraged users to provide feedback on new versions of our software, and our posting of this security source code on the Internet is a natural extension of that approach," said Mike Homer, vice president of marketing at Netscape. "We plan to continue to use the Internet to test new software versions, as we will shortly with the beta version of our newly announced Netscape Navigator 2.0. We expect that this kind of open review will help us continue to create products of the highest quality." Netscape is using the opportunity of this week's beta releases to also update other portions of its software, addressing such issues as domain-name limitations in international versions of Netscape Navigator and potential stack overflow conditions. Netscape is also placing the beta versions of the security updates for its Netscape servers on the Internet for free download by customers. "We process hundreds of customer orders daily using Netscape software. Netscape's commitment to excellence as evidenced by the company's immediate action in response to reported vulnerabilities is one of the many reasons Internet Shopping Network has chosen Netscape products for conducting Internet commerce," said Randy Adams, president of Internet Shopping Network. "We have built a multi-million dollar business on the Internet using Netscape products and they are a major factor in our success." The beta versions of the updated software -- Netscape Navigator 1.2.1b for Windows, Netscape Navigator 1.1.1b for Macintosh and UNIX, Netscape Commerce Server 1.1.1b, and Netscape Proxy Server 1.1.1b -- will be available on Wednesday for downloading from Netscape's home page at http://home.netscape.com. All Netscape users are encouraged to download the new versions as soon as possible to ensure they are using the most up-to-date security software from Netscape. Final versions of the updates will be posted after all testing is complete. Netscape Communications Corporation is a premier provider of open software to enable people and companies to exchange information and conduct commerce over the Internet and other global networks. The company was founded in April 1994 by Dr. James H. Clark, founder of Silicon Graphics, Inc., a Fortune 500 computer systems company; and Marc Andreessen, creator of the NCSA Mosaic research prototype for the Internet. Traded on Nasdaq under the symbol "NSCP", Netscape Communications Corporation is based in Mountain View, California. ### Additional information on Netscape Communications Corporation is available on the Internet at http://home.netscape.com, by sending email to info(a)netscape.com or by calling 415-528-2555. Netscape Communications, the Netscape Communications logo, Netscape, Netscape Navigator, Netscape Commerce Server and Netscape Proxy Server are trademarks of Netscape Communications Corporation. All other product names are trademarks of their respective companies. -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine. We issued the following news release this morning: ---------------------- FOR IMMEDIATE RELEASE BETA VERSIONS OF NETSCAPE SECURITY UPDATE TO BE AVAILABLE WEDNESDAY FOR FREE DOWNLOADING Company Puts New Code on Net for Examination; Outside Security Experts Reviewing Software MOUNTAIN VIEW, Calif. (September 25, 1995) -- Netscape Communications Corporation (NASDAQ: NSCP) today announced that it has completed beta versions of the security update for its client and server software and will post the new software for free downloading from the Internet on Wednesday, September 27. The beta versions of the software updates, being posted following a review by internal and outside experts, are in response to the potential vulnerability in the company's security implementation discovered last weekend by two University of California at Berkeley students. In addition, Netscape is taking the opportunity to include other improvements with this update. Netscape addressed the potential vulnerability by increasing the amount of random information it uses to seed the random number generator in its security implementation. In Netscape's security approach, the random number generated is used in a mathematical formula to create a "session key" for encrypting information to be sent across the Internet. The new solution uses many times more random information than the previous version, ensuring much greater degrees of difficulty in identifying the key used to encrypt a particular session. The solution is also now assembled in a platform-dependent manner which, when combined with the increase in random information, makes Netscape's products substantially more secure than before the update. Netscape's source code that will be used to address the potential vulnerability has already been posted on the Internet so that it can be reviewed by anyone wishing to do so. This technique is often used in the development of security software to ensure the highest level of inspection possible before the final software is made available to customers. The code is also being reviewed by external security experts retained by Netscape and various Netscape platform partners with expertise in specific operating system environments to provide additional checks on the soundness of Netscape's approach. "We have always encouraged users to provide feedback on new versions of our software, and our posting of this security source code on the Internet is a natural extension of that approach," said Mike Homer, vice president of marketing at Netscape. "We plan to continue to use the Internet to test new software versions, as we will shortly with the beta version of our newly announced Netscape Navigator 2.0. We expect that this kind of open review will help us continue to create products of the highest quality." Netscape is using the opportunity of this week's beta releases to also update other portions of its software, addressing such issues as domain-name limitations in international versions of Netscape Navigator and potential stack overflow conditions. Netscape is also placing the beta versions of the security updates for its Netscape servers on the Internet for free download by customers. "We process hundreds of customer orders daily using Netscape software. Netscape's commitment to excellence as evidenced by the company's immediate action in response to reported vulnerabilities is one of the many reasons Internet Shopping Network has chosen Netscape products for conducting Internet commerce," said Randy Adams, president of Internet Shopping Network. "We have built a multi-million dollar business on the Internet using Netscape products and they are a major factor in our success." The beta versions of the updated software -- Netscape Navigator 1.2.1b for Windows, Netscape Navigator 1.1.1b for Macintosh and UNIX, Netscape Commerce Server 1.1.1b, and Netscape Proxy Server 1.1.1b -- will be available on Wednesday for downloading from Netscape's home page at http://home.netscape.com. All Netscape users are encouraged to download the new versions as soon as possible to ensure they are using the most up-to-date security software from Netscape. Final versions of the updates will be posted after all testing is complete. Netscape Communications Corporation is a premier provider of open software to enable people and companies to exchange information and conduct commerce over the Internet and other global networks. The company was founded in April 1994 by Dr. James H. Clark, founder of Silicon Graphics, Inc., a Fortune 500 computer systems company; and Marc Andreessen, creator of the NCSA Mosaic research prototype for the Internet. Traded on Nasdaq under the symbol "NSCP", Netscape Communications Corporation is based in Mountain View, California. ### Additional information on Netscape Communications Corporation is available on the Internet at http://home.netscape.com, by sending email to info(a)netscape.com or by calling 415-528-2555. Netscape Communications, the Netscape Communications logo, Netscape, Netscape Navigator, Netscape Commerce Server and Netscape Proxy Server are trademarks of Netscape Communications Corporation. All other product names are trademarks of their respective companies. Rosanne M. Siino Director of Corporate Communications Netscape Communications Corp. 415-528-2619

2 3

Re: List of US representitives
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <00996ED487C83F20.00003C77(a)sanchez.com>, gorkab(a)sanchez.com ("Brian Gorka") wrote: >Someone posted a list of US reps awhile back... Can someone forward me a copy? Everything you need to know put pressure on Congress critters is at http://www.NRA.org/pub/congress/104/ I especially recommend http://www.NRA.org/pub/congress/104/congress.awk.Z - From the readme: "congress.awk is a comma-seperated database of congress members & some unix awk code for manipulating the database" - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMGcQ9ioZzwIn1bdtAQHKLwGAnzE6f67qn0bZFVcOV/49gemiD9jAluJo ageYFxFsIIbkD9q28/a/7yX/GKaDNTSu =0h5T -----END PGP SIGNATURE-----

1 0

Article in 9/25 Computerworld about Netscape
by Mike Fletcher 17 Dec '03

17 Dec '03

Just got the Sept 25th issue of Computer world in my box and it's got a big first page article on the NS bugs. They get the key lengths wrong (30-bit and 300-bit), and they say that "... future products will also use 300-bit keys." And they mention Cypherpunks by name! :) --- Fletch __`'/| fletch(a)ain.bls.com "Lisa, in this house we obey the \ o.O' ______ 404 713-0414(w) Laws of Thermodynamics!" H. Simpson =(___)= -| Ack. | 404 315-7264(h) PGP Print: 8D8736A8FC59B2E6 8E675B341E378E43 U ------

1 0

Re: Notes security question
by Herb Sutter 17 Dec '03

17 Dec '03

At 14:52 1995.09.25 -0400, Jon Lasser wrote: >On Fri, 22 Sep 1995, Herb Sutter wrote: > >> While I'm at it, here's a question I've been wondering about recently: Why >> is it I've never heard of any security issues with Lotus Notes? Are there >> no known weaknesses? Or did existing weaknesses just not get much press >> because Notes isn't a commercially visible consumer product like Netscape? > >Perhaps the Notes pricing scheme is sooo outrageous (by the standards of >a student like myself, and probably most others, if it's still anything >like it was at the 1.0 release) that mostpeople have had zero opportunity >to examine the program, let alone really have time to play with it? Good point. However, since it's been around for years and is (in some people's eyes, at least) cutting-edge secure replication technology, it made me begin to wonder about the product's actual security. All I know is that they use one of RSADSI's libraries, since RSADSI mentions them in their "here are our current users" advertising. >From the deafening silence, though, it seems like there's not a whole lot of information or opinion either way on Notes' security...? Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

1 0