December 2003 - cypherpunks-legacy

Alta Vista, Great Stuff!
by Beethoven 17 Dec '03

17 Dec '03

Hey, I saw a message on the list about personal mail showing up in an A.V. search, and figured why not try it out and see what comes up under one of my nyms... Lo and behold, my nym corresponds with the title of a popular comic strip and an episode in a bad TV show... Crypto related? Imagine your nym is related to something common-place at the time of posting. Even though you may be well known under that nym, simple searches for that name will turn up loads of crapola, or at least some light entertainment for someone searching for oyur past posts. (It can also turn some unsuspecting people looking for the crapola onto your interests...) Yes, I know that sophisticated search engines and simple expressions can filter out most of the unwanted junk, but not all of it. Likewise filtering will let some of your posts fall through the web-crawler-cracks.

1 0

Re: new web security product
by Alan Olsen 17 Dec '03

17 Dec '03

At 04:22 PM 1/16/96 +0000, you wrote: >Perry Metzger wrote: >> I don't think its going to fly. No one wants to pay for an unneeded >> $100 piece of hardware to encrypt the same credit card over and over >> again, when a nearly zero marginal cost piece of software can do the >> same thing. > >I agree with Perry. Hardware encryption does add a layer of security >not normally found in software, but it is hardware. > >Shoot, I don't even have a 28.8 modem yet, why would I want a black >box that supposedly does something with my Credit Cards? This is not something that will wind up being used by the average person at home. It will be used by the small businessman/woman who needs to do some credit card transactions on-line. The media is so hyped on this "credit card on the net" train of thought that any credit card encryption scheme will be presented as if it is for the home user. Just another case of the media not understanding the technology they are reporting on... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Re: Crypto anarchist getting through customs
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

At 1:38 PM 1/15/96, Timothy C. May wrote: >Frequent travellers to Europe will no doubt confirm what I'm saying. I >travelled to dozens of countries in Europe a while back, and never was >checked at any borders, save for a quick glance at my passport. > While this is generally true, I do remember that I decided to take an overnight ferry/train ride between Paris and London to save money by spending one less night on the hotel. I didn't get seasick, but I was very disheveled when I got off the boat. The hours of 3 to 6 am were spent in the ferry's duty-free shop because I was bored and I couldn't sleep. The British customs guy pulled me over and started searching my bags and questioning me. It went something like this: "Are you aware of the duty-free restrictions?" "Yes. You can bring in up to four liters of wine and one liter of hard liquor. Or you can use your one liter alotment of hard liquor on wine and bring in a five liter jug. Cigarettes must be limited to..........." "Okay, you can go on."

1 0

Re: Crypto anarchist getting through customs
by James A. Donald 17 Dec '03

17 Dec '03

At 08:20 AM 1/16/96 +0000, attila wrote: > Bubba signed PPD 25 which permits UN control of US > forces, _in America_! and allows the UN to bring in UN troops. While there are undoubtedly people plotting a one world government, the miserable performance of the blue helmets means that there is no present danger. Soldiers are just not willing to die for the greater glory of the United Nations. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: Eggs at Customs (fwd)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:36 PM 1/15/96, Lindsay Haisley wrote: >There has (fortunately!) been a big crackdown recently on the illegal pet >bird import trade, something akin to the slave trade of the 19th century for >those of us who like pet birds. One of the methods people use to import >birds is to wear special vests full of pockets for rare bird eggs. If the >person who wrote this was coming in from SE Asia, especially Australia, then >this was very possibly the meaning of the question. Yes, Cliff Stoll described how this plot was hatched in his book "The Cuckoo's Egg." (This was a yolk, folks. I stoll it.) P.S. I am persuaded that the importation of rare tropical birds into the U.S. is a GOOD THING, and that the attempts to ban such imports are misguided eco-fundie efforts. Diversity will be enhanced by having the birds in the U.S., and if left in their native jungles, most will die anyway. Better a pampered tropical bird in a gilded cage than lunch for some predator, or starvation as the jungles are cleared by slash-and-burn farmers. The same data transparency of borders, where truckloads of stuff come in easily, means that truckloads of birds, eggs, embryos, babies, etc. can also make it in. Most such shipments are only caught when surveillance yields a shipping schedule...such surveillance is becoming more and more difficult because of the technologies we push. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

10 13

Spiderspace
by tcmay＠got.net 17 Dec '03

17 Dec '03

I've been thinking a lot about the problems and opportunities that are coming up as more and more "spiders" (Web searchers, crawlers) are indexing directories and files on systems they can find. For the sake of this post, the files and whatnot these spiders and super-spiders can hit constitute a universe I'll call "spiderspace," as it semi-euphoniously matches cyberspace and cypherspace. Two things caused me to think more intensely abou this: 1. At the Saturday Cypherpunks physical meeting, Marianne Mueller (I think) was telling me about an experience where an old letter she'd written to someone showed up in an Alta Vista search. A personal letter, that is. How this happened was that the letter to her friend was buried several subdirectories deep in a directory he made accessible to the outside world. Presto, Alta Vista found it, indexed it, and made it keyword-searchable! (Humans are pretty bad at doing such meticulous file prep work, but all-seeing spiders are very good at seeing everything.) 2. Someone on the Cyberia-l list, Mike Godwin in fact, asked if anyone had a particular post he'd written last summer, a post he'd neglected to save but that he needed. I had not kept that post, according to my own archives, but I decided to see what Alta Vista might turn up. (The Cyberia-l list is not officially archived, and I believe archives of it are discouraged by the list owner, for various reasons especially worrisome to lawyers and law professors!) Sure enough, a search of "Cyberia-l" in Alta Vista showed all sorts of hits, including what appeared to be several _private archives_ of parts of the traffic. (By "private" I mean in the sense that they were someone's personal archives, and not necessarily complete or even semi-officially sanctioned.) And a search of "Cyberia-l AND Godwin AND parental AND Ferber" (some of the keywords in the post he knew he was looking for) produced two hits, most probably of the post he was seeking. (They were on a Kent Law School archive site that, I believe, is no longer accessible to the outside...the Alta Vista spiders must have gotten to it and indexed it before the site was made less accessible...just a thought.) This fits with the point made above, that increasing numbers of odd things--letters, love letters, resumes, job applications, even things like PGP passwords!--will likely show up by accident in spiderspace. I've started to look for things like PGP files laying around buried in subdirectories. I can imagine attacks based on this. Declan McCullagh, on the Cyberia-l list, followed up to my post on this topic by noting that things will really get interesting when the internal file systems of many sites are made searchable, such as with the Andrew File System (AFS) at CMU and elsewhere. Apparently most users make their directories accessible to others. Implications for Cypherpunks? First, an alert for you to be very careful about what you make accessible to the outside world. It's no longer just a matter of people taking the time to rummage through your subdirectories, it's now trivial to find things with the new Web search engines. Second, what is out there in spiderspace is incredibly useful for building dossiers, for compiling correlations, and for doing competitive analyses. Third, more and more kinds of files are going into spiderspace. This may include files compiled by others, such as files containing Web accesses! (All it takes is for someone to keep a record of site accesses, subscriptions, etc., and then put record in a searchable place: it then becomes trivial to search on a name and find out interesting things.) Fourth...left to your imagination. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

new web security product
by Ed Carp, KHIJOL SysAdmin 17 Dec '03

17 Dec '03

I wouldn't pass this along normally, but it seems to allow folks to use their credit cards at home securely. Bye-bye, First Virtual... ;) http://www.cnn.com/TECH/9601/encryption/index.html -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/digital pager 800/558-3408 SkyPager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi "Past the wounds of childhood, past the fallen dreams and the broken families, through the hurt and the loss and the agony only the night ever hears, is a waiting soul. Patient, permanent, abundant, it opens its infinite heart and asks only one thing of you ... 'Remember who it is you really are.'" -- "Losing Your Mind", Karen Alexander and Rick Boyes

3 2

Re: Spiderspace
by ecarp＠tssun5.dsccc.com 17 Dec '03

17 Dec '03

> From: tcmay(a)got.net (Timothy C. May) > Sure enough, a search of "Cyberia-l" in Alta Vista showed all sorts of > hits, including what appeared to be several _private archives_ of parts of > the traffic. (By "private" I mean in the sense that they were someone's > personal archives, and not necessarily complete or even semi-officially > sanctioned.) There are any number of reasons this migh have shown up - if the private archives are accessible to the public, for example ... but ... > Declan McCullagh, on the Cyberia-l list, followed up to my post on this > topic by noting that things will really get interesting when the internal > file systems of many sites are made searchable, such as with the Andrew > File System (AFS) at CMU and elsewhere. Apparently most users make their > directories accessible to others. ... I was under the impression that the only documents that most web crawlers will search are documents that are link-accessible. Are you saying that this isn't true? Are you saying that Alta-Vista will search EVERYTHING that's publicly accessible, whether by anonymous FTP or web?

2 1

Re: Need confirmation of Win95 password encryption back door
by gorkab＠sanchez.com 17 Dec '03

17 Dec '03

A friend and I were working on an exploit of this. It is true. We were not working on a grepper, but we found the offset where the passwords reside and were going to dump them into a dialog box. If you are planning to exploit this, we will stop our previous efforts. ---------- From: Rich Graves[SMTP:llurch@networking.stanford.edu] Sent: Monday, January 15, 1996 5:20 PM To: cypherpunks(a)toad.com Cc: frank(a)funcom.no; pgut01(a)cs.auckland.ac.nz Subject: Need confirmation of Win95 password encryption back door -----BEGIN PGP SIGNED MESSAGE----- A Major Media Outlet requires confirmation that Windows 95, to facilitate its automatic reconnect feature for sleeping laptops and temporary network outages, caches all network passwords (NetWare, NT, UNIX running Samba, SLIP/PPP dialup) in unprotected memory in clear text, whether you've disabled persistent "password caching" to disk and applied the December 14th 128-bit RC4 .PWL patch, or not. There seems to be no way to turn this off. The idea, of course, is that a simple trojan horse could do whatever it wanted with this information. We know that this vulnerability exists in Windows for Workgroups, and Peter wrote a little demo (on hackmsoft page below, without source), but the APIs appear to have changed in Win95. So, anyone have Win95 and some time to kill, or can anyone recommend a good DOS/Windows RAM grepper? - -rich(a)c2.org http://www.c2.org/hacknmsoft/ $ Mon Jan 15 22:17:10 PST 1996 $ $ From llurch(a)networking.stanford.edu to cypherpunks(a)toad.com $ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPtDLo3DXUbM57SdAQEN7QP+J6Gmk6m8dv3X96SKZciI/L7DM04bDSoi HZa+dIoajAiRrfG9oSNcIYbVDDs67qwCSKGFg9hc5K3x99nhbq3Aw2mio62YQj+2 K62pBT9hQLe4dv8AMhLtIqyG4ZztYy+dDjGzsaUIkBUZKo5//Eh8c81xXLQrqXtk RFV+xkXBgww= =12rk -----END PGP SIGNATURE----- ---------- Brian Gorka Key fingerprint = ED 7D 78 7E 95 E8 05 01 27 01 A1 74 FA 4B 86 53

1 0

Re: Spiderspace
by Martin Diehl 17 Dec '03

17 Dec '03

On 1/16/96 12:35 PM, tcmay(a)got.net (Timothy C. May) at Internet-USA wrote: > I've been thinking a lot about the problems and opportunities that are > coming up as more and more "spiders" (Web searchers, crawlers) are > indexing directories and files on systems they can find. [snip] > Sure enough, a search of "Cyberia-l" in Alta Vista showed all sorts of > hits, including what appeared to be several _private archives_ of parts > of the traffic. (By "private" I mean in the sense that they were > someone's personal archives, and not necessarily complete or even > semi-officially sanctioned.) [snip] > I've started to look for things like PGP files laying around buried in > subdirectories. I can imagine attacks based on this. [snip] > Fourth...left to your imagination. > --Tim May > We got computers, we're tapping phone lines, we know that that ain't > allowed. > ---------:---------:---------:---------:---------:---------:---------:---- > Timothy C. May | Crypto Anarchy: encryption, digital money, > tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero > W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, > Higher Power: 2^756839 - 1 | black markets, collapse of governments. > "National borders aren't even speed bumps on the information superhighway." I gather that it would be a Bad Thing (TM) to have someone get both the encrypted and clear text forms of your message (from either you or from the recipient) Maybe regularly changing your encryption keys is a Good Thing (TM) Martin G. Diehl

1 0