December 2003 - cypherpunks-legacy

Re: PC Expo summary!!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

rarachel(a)photon.poly.edu (Arsen Ray Arachelian): > FEB 17 CYPHERPUNKS TRANSCRIPT > Copyright (C) 1994, cypherpunks(a)toad.com All Rights Reserved. ^^^^^^^^^^^^^^^^^^^^ I wonder how the courts will interpret that ;) Pats on the back to you for going ahead with the distribution of disks. It would be a good idea to put up the contents of the disk at some FTP site, maybe soda. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

4 5

Detweiler clone at WSJ
by Brad Dolan 17 Dec '03

17 Dec '03

The drumbeat against all those anonymous pedophiles continues.... _Wall Street Journal_, 6/30/94 PERSONAL TECHNOLOGY by Walter S. Mossberg "Keeping Your Kids Away From Creeps As They Play Online" (...Talk about striking up electronic friendships online ...) But there's a dark side to this exciting phenomenon, one that's too rarely understood by computer novices. Because they offer instant access to others, and considerable anonymity to participants, the services make it possible for people - especially computer-literate kids - to find themselves in unpleasant, sexually explicit social situations (Sex-ed sessions led by Joycelyn Elders?) The online services all have rules banning bad conduct and, fearing possible government-imposed restrictions, have stepped up the policing of online abuse. But parents could do more to protect kids from these disturbing situations. And I've gradually come to adopt the view, which will be controversial among many online users (!), that the use of nicknames and other forms of anonymity must be eliminated or severly curbed to force people online into at least as much accountability for their words and actions as exists in real social encounters. (.. More talk about how your kid might [gasp!] download a "hardcore pornographic photo" [This guy should see the stuff on the newstands in Amsterdam!]...) Beyond that, I think it's time now for the services to jettison the long tradition of allowing members to hide behind "handles" or nicknames. In general people should conduct themselves online under their real names, or not at all. IN THE SAME VEIN, I THINK THE SERVICES SHOULD DELAY GRANTING NEW MEMBERS ACCESS FOR 24 OR 48 HOURS ...WHILE THEY VERIFY THAT THE APPLICANTS ARE REALLY WHO THEY SAY THEY ARE ... (emphasis mine). (And some folks thought that Brady-style fascism would only be applied to "gun-nuts"! Won't be long before you have to have a license to drive on the information superhighway.) (Article continues with more of same. Lambasts AOL. Talks about "the most dangerous forms of communication," etc.) ------------------------------------------------------------------- I didn't comment on NSA threatening Bidzos because dog bites man is not news. If you annoy the Nazis in power and they can get away with it they will kill you. BTW: The current _New Republic_ contains a story about an Oxford student being threatened by the Secret Service over a much more trivial matter.

6 5

Re: Password Difficulties
by smb＠research.att.com 17 Dec '03

17 Dec '03

Figure that each English character has 1.8 bits of entropy. (This is a conservative number, because it doesn't take into account case, spacing, or punctuation.) If I want a passphrase that will map into a 64-bit keyspace, I need at least a 35-chararcter phrase. Don't forget the difficulty of typing such a long phrase, with echoing turned off.

6 5

Re: Password Difficulties
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

joshua(a)cae.retix.com writes: >> Hey folks, passwords are hard to choose! > >? What part don't you understand? Give people the opportunity to chose "random" passwords and they choose easily guessed strings. (Well demonstrated.) Tell people to chose a *phrase* and they are going to frequently type "The quick brown fox...". (My assertion.) Your suggestion about rare steak is so long that "normal" people are not going to bother with it. Just getting people to type the 19-characters of "the quick brown fox"--just four words--is going to be hard, and there are not very many bits of information in 4 short common English words--forget that they are a chiche. Besides, your sample phrase might not have as many bits in it as you think. >Rare steak tastes good when it is cooked over a wood fire. better >chicken. better than fish. good with worcestershire sauce. 22 words, a good start. But all will appear in a short dictionary list, 4 gramatical sentences, sentences with related meaning. Not so good. Slightly non-standard capitalization--but only a few bits in that. You suggest a phrase that is going to seem annoying to people raised on 4-digit PINs, yet it still might not have, say, the 128-bits lots of people want. My 128 coin tosses can be roughly turned into 8-words, but out of a much larger word list than your phrase and with no gramatical connections--and hard to remember. Each transformation I might do to those words to help remember them chops off a few of my original bits. By the time I have something my mother is going to bother with there are few bits left. A little brute force and those bits are blown. And why should you care if my mom uses weak keys? Because it will undermine the legal weight of things like digital signatures. Because all communication you have with "normal" people will be nearly in the clear because of their poor security. If you want privacy, you need to help others have privacy. Back to a rephrasing of my original question: should programs like PGP super-duper encrypt the private key (and remove those hints poeple have mentioned recently) as a way of slowing down brute-force attacks? -kb P.S. Remember, even a good hashing algorithm should not be expected to create entropy out of thin air. Too few bits in means too few bits out. Just because I don't know how to analyze those bits does not mean you should be content. -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 31:15 hours of TV viewing so far in 1994!

5 4

Re: Password Difficulties
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

ben(a)Tux.Music.ASU.Edu and joshua(a)cae.retix.com both suggest ways to choose passwords/phrases--things no normal person will do. What do we do about a population which thinks a 4-digit PIN is secure? If people use their current ATM PINs--and a lot of computer users *do* when they are allowed--there will be problems: if we want privacy we had better figure out how to give everyone privacy. Part of my original post was cribbing from a paper I once read on the security of crypt on Unix machines. It talked of multiple applications of crypt to slow down brute-force password cracking. Should things like PGP use this technique in protecting the secret key? Does a million encryptions equal 10-bits added to the key? (Assuming the million encryptions cannot be composed into a single equivalent encryption.) -kb -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 31:15 hours of TV viewing so far in 1994!

5 4

elm and pine patched for a preprocessor
by sameer 17 Dec '03

17 Dec '03

I have hacked on elm and pine so that they will work with Raph Levien's "premail" package easily. It allows the use of a preprocessor to sendmail through the use of the PRESENDMAIL environment variable. -- I made the following changes to src/mailmsg2.c to allow use of setenv PRESENDMAIL "program" to allow an alternate sendmail. This is in elm 2.4 pl20. 95,97d94 < #define PRESENDMAIL /* Uncomment this if you don't want to allow users */ < /* to run a 'replacement sendmail' with the PRESENDMAIL */ < /* environment variable */ 209,211d205 < #ifdef PRESENDMAIL /* Hack to allow 'replacement sendmails' */ < char *pre_sendmail; < #endif 571,585d564 < < #ifdef PRESENDMAIL /* Hack to allow replacement sendmails */ < if(pre_sendmail = getenv("PRESENDMAIL")) < { < sprintf(very_long_buffer,"( (%s %s %s ; %s %s) & ) < %s", < pre_sendmail, mailerflags, expanded_to, < remove_cmd, whole_msg_file, whole_msg_file); < } < else < { < sprintf(very_long_buffer,"( (%s %s %s ; %s %s) & ) < %s", < mailer, mailerflags, expanded_to, < remove_cmd, whole_msg_file, whole_msg_file); < } < #else 589,591c568 < #endif < < } --- > } -- I made the following changes to pine/send.c to allow use of setenv PRESENDMAIL "program" to allow an alternate sendmail This is in pine 3.89. 63,64d62 < #define PRESENDMAIL /* Allow users to specify an alternate sendmail */ < 1512,1514d1509 < #ifdef PRESENDMAIL /* If we want an alternate sendmail to be specified */ < char *pre_sendmail; < #endif 1527,1539d1521 < < #ifdef PRESENDMAIL < if(pre_sendmail = getenv("PRESENDMAIL")) < { < sprintf(mail_cmd, "( ( %s %s ; /bin/rm -f %s ) < %s & )", < pre_sendmail, SENDMAILFLAGS, tmpfile, tmpfile); < } < else < { < sprintf(mail_cmd, "( ( %s %s ; /bin/rm -f %s ) < %s & )", < SENDMAIL, SENDMAILFLAGS, tmpfile, tmpfile); < } < #else 1542d1523 < #endif -- sameer Voice: 510-841-2014 Network Administrator Pager: 510-321-1014 Community ConneXion: The NEXUS-Berkeley Dialin: 510-549-1383 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

using PGP or RIPEM on AOL
by Carl Ellison 17 Dec '03

17 Dec '03

I've only used RIPEM on AOL -- but it should be the same. I run on a Mac, generating the armored file, and then use AOL's "paste from file" option in the File menu to include the encrypted file in the body of my message. In the other direction, I have to use Select All and Copy to get it out of AOL mail, Paste to get it into an editor. From there I can file it and give that file to PGP or RIPEM. BBEDIT on the Mac has good support for RIPEM. I wish I knew how to write BBEDIT extensions for Mac PGP as well. Anyone know if it's hard? - Carl -- Carl M. Ellison cme(a)acm.org RIPEM MD5OfPublicKey: 39D9860686A9F075A9A83D49589C677A PGP 2.4 Key fingerprint = E0 41 4C 79 B5 AF 36 75 02 17 BC 1A 57 38 64 78 PGP 2.6 Key fingerprint = 61 E2 DE 7F CB 9D 79 84 E9 C8 04 8B A6 32 21 A2

1 0

Business Week on Crypto
by John Young 17 Dec '03

17 Dec '03

There is a brief article on commercial crypto in Business Week of July 4, p. 13, by Stephen H. Wildstrom <techandu(a)mgh.com>. It sets out need for crypto; describes use of private and public keys; key management services by Northern Telecom Ltd. and National Semiconductor Corp.; future crypto by Lotus and Microsoft; war of RSA and NIST and resulting standoff.

1 0

Re: PC Expo summary!!
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

> You wrote: > > Lately, my reading of the list has been rather sporadic (too much work). > What's on the disks? PGP 2.6, PGS.99b, WinPGP1.0, SecureDevice 13b, White Noise 2.10, and tons of articles on the cypherpunks (some from Wired, some from EFF, CFP, Epic, Rishab's articles, the Cypherpunks Feb 17 Crypto-Anarchy speech transcript and other assorted goodies.) The .ZIP file also contains the DIM14A.ZIP program which is needed to restore the disk and is useful for making many copies of the disk, a README file that briefly describes how to use the disk at an expo such as PC Expo, and a post-script file for printing labels for the disks. It's basically a one stop Expo duplication package. :-) Incase you're just tuning in, I had this great idea (aren't all "my" ideas great?) that we as cypherpunks should distribute diskettes at PC Expo and other computer trade shows as an awareness raising campaign and a way to spread PGP, weaken Clipper's impact, etc.

1 0

Re: "Cypherpunk" vs. "Cryptorebel"
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 8:26 PM 7/6/94 +0100, Robert A. Hayden wrote: [snippeta, snippeta] >Cypher was an interesting play on words to describe this fight. > >Somehow, it seems far more appropriate than 'cryptorebel', which sounds a >whole lot like new-age PC crap designed to make us sound more appetizing >to the popular media. Yeah. What he said. "Cryptorebel" reminds me of "cryptofascist", which reminds me of "Myra Breckenridge", for some reason. ":-o Bob ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0