December 2003 - cypherpunks-legacy

Re: Root Causes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199507140151.UAA01504(a)arnet.arn.net>, merriman(a)arn.net (David K. Merriman) wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >While I respect the ideas and opinions submitted by the majority of the >members of this list, I wonder if perhaps we're failing to deal with the >_root_ problem of such things as the CDA, Clipper, DTA, etc. > >Specifically, I wonder if it wouldn't be a better approach to *prevent* such >measures from ever being proposed in the first place. Short of a 50 kilo ton bomb on Washington, I don't see any way that could be accomplished. <No, I don't advocate nuking DC.> >Is there any precedence or possibility of either filing civil or criminal >charges against a Government official for their _official_ actions? >Something that will not only make for some Serious Press, but hit them from >an unexpected angle? You can't sue the government without its prior consent. Government officials are also usually immune from being sued over their official actions. >It would seem that things such as the CDA, etc, are patent violations of the >Bill of Rights. As such, wouldn't the Congressrodent(s) proposing such >measures be violating our civil rights, and thus be criminally liable? >Aren't Congressrodents supposed to take an Oath of Office that involves >upholding the Constitution? The oath is not ment to be kept. It's sole purpose is to provide a photo op for the incomming congresscritters. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMAXVPioZzwIn1bdtAQFp5gF/WnEoNO15G11gXi9G/BmtFzu/toHZPBmj ldONnU+mbB5c9LIGeJH3usQZLdT/D4Sw =NpN9 -----END PGP SIGNATURE-----

1 0

co-sponsors S.974
by John Young 17 Dec '03

17 Dec '03

Responding to msg by perry(a)imsi.com (Perry E. Metzger) on Thu, 13 Jul 4:51 PM >I searched Thomas and couldn't find any evidence of >co-sponsors to the Senate bill. Am I wrong here? As you know, gnu(a)toad.com sent the EFF analysis which included: > From: ssteele(a)eff.org (Shari Steele) > ... > Fortunately, the bill does not have a very promising > future. The bill has no co-sponsors. It was immediately > referred to the Committee on the Judiciary, where it > currently sits. LEXIS's bill tracking report only gives > it a 10% chance of passing out of the committee. ... In contrast, the following is from law list Cyberia-L today: > At 8:17 AM 7/13/95 -0400, James R. Coleman wrote: >> Anyone know the committee status of this bill. Does it >> have co-sponsors? House sponsors? Are hearings >> scheduled? Or is Grassly not serious but tryint to get >> some press in Des Moines? > The bill was co-sponsored by Sens. Kyl (R-AZ) and Leahy > (D-VT). It has the enthousiastic support of the > administration. In a DOJ press release following its > introduction, AG Reno is quoted as saying "computer crime > is fast becoming everyone's problem. I'm encouraged that > this bill is off to a bipartisan start, and I hope > Congress will move quickly to enact it." > > If there's a companion bill in the House, I'm not aware of > it. > > John Noble Anyone got better info on yes/no sponsors or seen the DOJ press release?

2 1

Re: co-sponsors
by cman＠communities.com 17 Dec '03

17 Dec '03

>I searched Thomas and couldn't find any evidence of co-sponsors to the >Senate bill. Am I wrong here? > >.pm According to Shari Steele: > Fortunately, the bill does not have a very promising future. The bill has > no co-sponsors. It was immediately referred to the Committee on the > Judiciary, where it currently sits. LEXIS's bill tracking report only > gives it a 10% chance of passing out of the committee.

2 1

Re: Ssh security hole?
by Tatu Ylonen 17 Dec '03

17 Dec '03

(I'll forward your message to a couple of lists where it might be of interest; the original message is at end.) I think you are right in your analysis. There is indeed a problem with RSA authentication. Basically what this means is that if you log into a corrupt host, that host can at the same time log into another host with your account (by fooling you to answer to the request) provided that you use the same RSA identity for both hosts. A workaround is to use a different identity for each host you use. The default identity can be specified on a per-host basis in the configuration file, or by -i options. And, yes, I think the same problem might occur with client host authentication. Though, there you would still have to do IP-spoofing, DNS spoofing or similar to get through (breaking RSA based host client effectively reduces RhostsRSAAuthentication to conventional .rhosts authentication). The protocol will need to be changed somewhat because of this. I'll think about it tomorrow and let you say you opinion about it. Thanks! Tatu Ylonen <ylo(a)cs.hut.fi> Date: Thu, 13 Jul 1995 13:08:15 -0700 From: David Mazieres <mazieres(a)pa.dec.com> To: ssh-bugs(a)cs.hut.fi Cc: rtm(a)eecs.harvard.edu, dm(a)eecs.harvard.edu, tbl(a)eecs.harvard.edu Subject: Ssh security hole? I believe there is a serious problem with the RSA authentication scheeme used in ssh, but then again I could be misreading the proposed RFC. Is the following really the case? As I understand the protocol, here is what happens during SSH_AUTH_RSA authentication. Suppose the holder of SKu, is allowed access to account U on machine B (which holds SKb). Both PKu and PKb are widely known. In addition, machine B has a session key, PKs, which changes every hour. When U on machine A wants to log into machine B, here's what I think happens based on my reading of the RFC: A -> B: A B -> A: (PKb, PKs, COOKIE) [A flags an error if PKb is not the stored value.] A -> B: (COOKIE, {{Kab}_PKs}_PKb) A -> B: {U}_Kab A -> B: {PKu}_Kab [B aborts if SKu is not allowed access to account U.] B -> A: {{N}_PKu}_Kab A -> B: {{N}_MD5}_Kab (*) [B aborts if the MD5 hash is invalid.] B -> A: access to acount U with all data encrypted by Kab. The problem is, suppose U actually wanted to log into machine C, which was maintained by an untrusted person. The person maintaining C could initiate a connection to B the minute U tried to log into C. When given a challenge {{N}_PKu}_Kbc, C could simply give this to A as the challenge to respond to, and then forward the response to B. To fix the problem, A must at the very least include B in the response line marked (*). I have reason to believe (after having just seen a lecture on authentication), that you might even need to include more. A safe bet might be (but then again I am no expert): A -> B: {(N, A, B, Kab)}_MD5 I think similar problems arise for the other authentication methods. Other than that, though, I am really impressed by by ssh. It's easy to install and easy to use. In fact, it is even more convenient to use than standard rsh, because the X forwarding happens automatically. Thanks for such a great package! David

3 2

Deployment
by an250888＠anon.penet.fi 17 Dec '03

17 Dec '03

>In addition, now is the time to deploy stego, on a massive scale. >How many stego programs have been released for Unix? Unix? The masses use DOS, Windows, Mac, and OS/2. All you Unix gurus with nifty Unix crypto utilities that PC users can only wonder about need to buy PC's and start porting now if you want to get anywhere. Unix? Hah! Gimme a break! Unix is a Warsaw ghetto. ---------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. If you reply to this message, your message WILL be *automatically* anonymized and you are allocated an anon id. Read the help file to prevent this. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Timothy C. May: Re: Crisis Overload (re Electronic Racketeering)
by Perry E. Metzger 17 Dec '03

17 Dec '03

Well, I guess I've been plonked by no less than Tim. Time will tell which of us is correct. ------- Forwarded Message To: perry(a)imsi.com From: tcmay(a)sensemedia.net (Timothy C. May) Subject: Re: Crisis Overload (re Electronic Racketeering) At 6:30 PM 7/13/95, Perry E. Metzger wrote: >Tim, I respect your opinions a lot, but I don't think you know squat ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >about this topic. You don't understand how Washington works. I believe >I have a better grasp on this than you do. Its hard, but not even >remotely impossible, to derail this crap. We should make every >possible effort to do so. The defeatism you are emitting is silly. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Perry, I have all I'm going to take of your acerbic rudeness to me. I will no longer be responding to any of your messages. - --Tim .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway." ------- End of Forwarded Message

2 1

Looks like "Cypherpunks Key Cracking Ring" is done .....
by Piete Brooks 17 Dec '03

17 Dec '03

I noticed that http://dcs.ex.ac.uk/~aba/percent.html was reporting: Percentage complete PERCENTAGE COMPLETE 4094 / 4096 = 100.6 percent which looked a bit odd to me :-) Do I detect a Pentium at work ?? Anyway, I grabbed a 29 bit address space and got: ffe0000000 29 THATS IT FOLKS! ALL DONE! and now it reports: Percentage complete PERCENTAGE COMPLETE 4096 / 4096 = 100.7 percent

1 0

Re: Fight, or Roll Over?
by unicorn＠polaris.mindport.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 9:55 PM 7/13/95, Perry E. Metzger wrote: >"Robert A. Hayden" writes: >> On Thu, 13 Jul 1995, Douglas Barnes wrote: >> >> > Since the Anti-Electronic Racketeering Act of 1995 might as well >> > be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see >> > Tim throw in the towel already, when the bill hasn't even made it >> > through committee yet. >> >> I don't think Tim threw in the towell on this bill, but has come to >> realize that the overall war on privacy cannot be won by concentrating on >> the individual battles. > >Thats true. However, I think that one strategic move would be to get a >PR firm involved that is capable of severly embarassing any politico >who puts his name any of these proposals. After two or three of those >they start getting gunshy. > >Folks, this isn't trivial. It isn't an easy thing to do by any >means. However, it is far from impossible. > [...] > >Anyone who is saying that it is impossible to fight the legislative >battles hasn't been thinking. It takes millions of dollars, but there >is a lot of money out there to be had in my opinion. Perry and I discussed this a bit today. I have a call into a friend of mine at one of the larger firms in D.C., who I will neglect to name until I hear back. I have a feeling there are a pile of funds to be had, and I'm going to try to work with Perry to get the people who should be interested, interested. > >Perry -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMAc23y1onm9OaF05AQGbvwf+OrqSIlELmS4bDSMqkPU3WKoqH2GGG+/p ki4l4AW2mM9FUEwfSUErFibnXqik+6zRjkOsKPDEpbmbOc9HM/OnEO0v8MTM6nQZ 1QT6mFcR9rpF8v+ZNlN35davf9VLcsMX0avjWZmNJbtQHEG3wL1Vt1BhCBaJjA/b XkrNMAI5gbIp0ervus5WGcGEajGr2BhGU9EOpA0eLRs/eoCg4W2rVSuTxGXZ9XhL 2nLdBor/XJENRrTmW38sya8x5vuDKwOLMMCTVgsg2QxzbGIk1jE2JjYmi2tqmISf V69UVKfvEsqhq9uKUksJG8tmoiyFs4b0Ctra/n/AibxYYKcCK5Qb3g== =/c9H -----END PGP SIGNATURE-----

1 0

Re: Eudora MacPGP Woes
by Steven Champeon - Imonics Development 17 Dec '03

17 Dec '03

| From: "Robert A. Rosenberg" <hal9001(a)panix.com> | Subject: Re: Eudora MacPGP Woes | | At 14:40 7/8/95, Black Unicorn wrote: | >I have noticed that an X-Attachement: header is added, but I have no idea | >how to remove it without opening the Eudora outbox with teachtext or | >something. | | Highlight the file name on the attachments line and hit delete to remove an | attached file request. I guess I'm still confused about why there's an X-Attachment: header being added. If the file is being generated by MacPGP without using the Applescript, you can simply open the resulting encoded file (provided it is being ascii- armored) from within Eudora then copy and paste it into an open Compose window. Voila. No X-Attachment: header. If you delete the file name on the attachments line, it also removes the attachment. Mr. Unicorn: have you had any luck with the Applescript? You might try booting without extensions (except for Applescript) and open Eudora off-line and keep trying. Hope this helps, Steve

2 1

Re: Dr. Seuss, Technical Writer
by Christopher.Baker＠f14.n374.z1.fidonet.org 17 Dec '03

17 Dec '03

* In a message posted via CYPHERPUNKS dated: 11 Jul 95, you stated: > What If Dr. Seuss Did Technical Writing? > > Here's an easy game to play. > Here's an easy thing to say: and what if there was a complete version of this somewhere? [grin] --- Following message extracted from REC.ORG.MENSA @ 1:374/14 --- By Christopher Baker on Thu Dec 15 11:27:49 1994 From: Mike Steiner To: All Date: 15 Dec 94 02:40:52 Subj: Bits in a Box From: steiner(a)best.com (Mike Steiner) Organization: Society for the Preservation of Endangered Societies A Grandchild's Guide to Using Grandpa's Computer Bits Bytes Chips Clocks Bits in bytes on chips in box. Bytes with bits and chips with clocks. Chips in box on ether-docks. Chips with bits come. Chips with bytes come. Chips with bits and bytes and clocks come. Look, sir. Look, sir. Read the book, sir. Let's do tricks with bits and bytes, sir. Let's do tricks with chips and clocks, sir. First, I'll make a quick trick bit stack. Then I'll make a quick trick byte stack. You can make a quick trick chip stack. You can make a quick trick clock stack. And here's a new trick on the scene. Bits in bytes for your machine. Bytes in words to fill your screen. Now we come to ticks and tocks, sir. Try to say this by the clock, sir. Clocks on chips tick. Clocks on chips tock. Eight byte bits tick. Eight bit bytes tock. Clocks on chips with eight bit bytes tick. Chips with clocks and eight byte bits tock. Here's an easy game to play. Here's an easy thing to say.... If a packet hits a pocket on a socket on a port, and the bus is interupted as a very last resort, and the address of the memory makes your floppy disk abort then the socket packet pocket has an error to report! If your cursor finds a menu item followed by a dash, and the double-clicking icon puts your window in the trash, and your data is corrupted cause the index doesn't hash, then your situation's hopeless, and your system's gonna crash! You can't say this? What a shame, sir! We'll find you another game, sir. If the label on the cable on the table at your house says the network is connected to the button on your mouse, but your packets want to tunnel on another protocol, that's repeatedly rejected by the printer down the hall, and your screen is all distorted by the side-effects of gauss, so your icons in the window are as wavy as a souse, then you may as well reboot and go out with a bang, cause as sure as I'm a poet, the sucker's gonna hang! When the copy of your floppy's getting sloppy on the disk, and the microcode instructions cause unnecessary risc, then you have to flash your memory and you'll want to RAM your ROM. Quickly turn off your computer and be sure to tell your mom! (God bless you Dr. Seuss wherever you are!) +----------------------------------------------------------------------+ Origin: COBRUS - Usenet-to-Fidonet Distribution System (1:2613/335.0) -30- TTFN. Chris --- GenMsg [0002] (cbak.rights(a)opus.global.org)

1 0