December 2003 - cypherpunks-legacy

Re: Anonymity: A Modest Proposal
by David Neal 17 Dec '03

17 Dec '03

> Date: Wed, 18 Oct 1995 16:01:00 -0400 (EDT) > From: s1018954(a)aix2.uottawa.ca > Reply-to: s1018954(a)aix2.uottawa.ca > Subject: Re: Anonymity: A Modest Proposal > To: Doug Cutrell <doug(a)cdsnet.net> > Cc: cypherpunks(a)toad.com > > > On Wed, 18 Oct 1995, Doug Cutrell wrote: > > > It seems that there could at least be a hierarchy of shadowed newsgroups, > > e.g. alt.freespeech.*, requiring the enduser to use special software to > > reassemble actual postings. This could even be integrated into the > > newsreaders, or even at a local newserver level. > > There already is. I think the *.test (or at least alt.test) groups have > good propagation. Nobody "reads" anything but their own posts anyway, so the > natives wouldn't be bothered. > YIKES! Think again. Many of the *.test newsgroups have auto-responders that remail the poster assuring them their post was received. This feature is used to make sure your newsfeed is working.

2 1

Oh to be a mouse in the corner...
by Brad Dolan 17 Dec '03

17 Dec '03

PR 10/17 1720 ABA: TERRORISM EXPERTS TO SPEAK Why is domestic terrorism on the increase? How serious a problem is it? Do we have international terrorism under control? These and other questions will be the focus of a two-day conference sponsored by the ABA Standing Committee on Law and National Security at the Hotel Washington in Washington D.C., October 19 and 20. The conference, entitled "National Security Law in a Changing World: The Fifth Annual Review of the Field," features experts in the field of terrorism, including former CIA Director William Colby, former FBI Director William Sessions, and Oklahoma Governor Frank Keating, whose state was the site of the worst domestic terrorist attack in U.S. history. Program highlights include: "The Press and National Security," 10:30 a.m. Thurs., Oct. 19 Panelists: Timothy Weiner, New York Times; Peter Rodman, National Review; Carl Robert Zelnick, ABC-TV; and Carl Stern, Department of Justice. "Reinventing the Intelligence Community," 2 p.m., Thurs., Oct. 19 Panelists: William Colby, Former Director of the Central Intelligence Agency; William Sessions, Former Director of the Federal Bureau of Investigation; and Admiral William Studeman, Former Acting Director of CIA. "Addressing the Threat of Domestic Terrorism," 8:30 a.m., Fri., Oct. 20 Panelists: Bradley Buckles, Bureau of Alcohol, Tobacco and Firearms; Howard Shapiro, General Counsel FBI; and Professor Stephen Sloan, University of Oklahoma. Luncheon Address, 12 p.m., Fri., October 20 Speaker: The Honorable Frank Keating, Governor of Oklahoma All Conference events will take place in the Ballroom, Lower Lobby Level at The Hotel Washington, 15th St. and Pennsylvania Ave., Washington D.C. For a complete listing of conference programs, please call Holly McMahon at 202-662-1036. CONTACT: Christine Lanier of the American Bar Association, 202-662-1792, or E-Mail: clanier@@attmail.com. -0- 10/17/95

3 2

Re: Anonymity: A Modest Proposal
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 9:42 AM 10/18/95, Hal wrote: >I think a remailer which forged headers would get people even angrier >than one which was up front about what it was doing. Forging headers is >really considered antisocial by a lot of people on the net. If you could >do it safely, you wouldn't need remailers. Since you need them, it's not >safe, hence the message will probably get traced back to the remailer. >This is prima facie evidence to get an account yanked at a lot of places. Of course. The problem is that protocols as implemented permit header-forging: it's a practical fact of the net, and one that maybe shouldn't be overlooked on (basically vague) 'moral' grounds, any more than Netscape should say, "Well, you just _shouldn't_ screw someone with a foo.foo.foo.foo... URL." Of course people shouldn't overflow your stack intentionally--but they _can_, and the implications of that fact are shaping the net as we speak. If the headers were forged in such a way as to falsely and _credibly_ attribute a transmission to an actual uninvolved third-party, that's one thing; but the existence of headers that are forged so incompetently as to be traceable to their actual origin suggests that forged headers might be worth meditating on. For example, what if two or three dozen independently maintained Mixmasters in three or four countries randomly forged headers (maybe even actually badly, or maybe craftily "badly") so as to make the last link in a chain look like one (or "one") of the other remailers; how would the Co$ cope with that? Anyway, you get the drift. Ted

3 2

Re: Anonymity: A Modest Proposal
by s1018954＠aix2.uottawa.ca 17 Dec '03

17 Dec '03

On Wed, 18 Oct 1995, Hal wrote: > Modemac proposes sending messages to remailers via newsgroup postings. > A fair amount of alt.test postings seem to be pgp'd (though a lot were Detweiler Blacknet tentacles, not that I've checked since Tim's Blacknet key was factored ). There was also an alt.anonymous.messages or something along those lines. Bad propagation. It seems to me that receiving messages through newsgroups (sent through remailernet) and having them retrieved automatically by your newsreader might be a better method of defeating traffic analysis. Sounds like Vinge's piece in True Names about downloading the entire world bbs. All you'd need to do here would be to scan your local feed of alt.test . While this would work in the short run, with a low level of users, in a high usage scenario, you'd post a destinated pseudonym (you might want it encrypted) in alt.test along with the name of the specific newsgroup the actual message would be posted to. Saves computing power.

2 2

the beverage you are about to drink
by mrm＠netcom.com 17 Dec '03

17 Dec '03

All this netscape-bashing reminds me ... Doesn't anyone think it's sad-funny now that every styrofoam coffee cup has to be labeled "Warning The Beverage You Are About To Consume Is Hot!!" The reality is, we don't want to get burned. But the coffee is hot. So you try to have some reasonable compromise since lukewarm coffee is just not appetizing. Marianne mrm(a)netcom.com

2 1

Re: Tales from Tech Support
by blob＠apple.com 17 Dec '03

17 Dec '03

At 12:24 PM 10/18/95, Chris Claborne wrote: >This is just one of the incredible "Tales from Tech Support" you can find on >web page: >http://128.218.7.140/auricular/homepage/tstales/tstales7.html [...] >Some poor SuperMac TechSport got a call from some middle level >official...from the legitimate government of Trinidad. [long story deleted] Nice story, but the Republic of Trinidad and Tobago haven't had a coup since 1990, and that coup attempt was unsuccessful. There was some tension in Trinidad and Tobago last summer due to the speaker of the house refusing to step down over some parlimentary issues, but it hasn't escalated into a coup (yet). If this happened, it happened in 1990. But even then, the legitimate government didn't fall. Several key buildings were occupied by rebels for a couple of weeks, and then the rebels surrendered and were pardoned to great public outrage. --Brian Bechtel, who shouldn't know so much about the Caribbean...

1 0

perl-RSA CJ request sent today
by Raph Levien 17 Dec '03

17 Dec '03

A number of people have been asking me whether I've gotten any response from the CJR yet. Well, I only sent it off today, because I've been so busy. I sent the main one priority mail, so I suppose the clock can be considered to have started ticking on the 20th, just in case anybody is keeping track. Raph

1 0

Re: Netscape rewards are an insult
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

> :I've deleted the rest of your content-free rant. Instead of alluding to > :some "flawed algorithm", why not tell us about the hole you say you've > :found in netscape? OK, Netscape functions by DESIGN as an enhanced delivery vehicle. Is that a sufficient explanation of the hole?? or is more detail necessary (which follows): Netscape blindly trusts any and all ports on all servers. On the basis of this trust, it begins a negotiation with a server that might well have a dynamic deliverability capability. The client then examines a Content-type header, trusts the content-type to decide what application it should launch, and then launches and processes the data block it is fed, all on good faith. It even trusts the server to redirect it to any arbitrary destination which it automatically loads and then executes. Is this enough of an explanation?? Or should I paraphrase: Netscape is a gateway that permits an untrustworthy server to take complete control of a client's machine. The server can tell the client where it should go, what it should load and how often, and what applications to execute on the client machine, as though this arbitrary server were its master. Does this help to underscore the problem?? The Netscape Navigator client was DESIGNED to be controlled remotely from any machine on the Internet. This is the "flawed algorithm". W3 was meant to be hypertext ... not a gateway that permits a server to deliver customized byte bombs down a clearcut path by remote-control. If people don't know that you don't let another person (or machine) take control of your machine and run programs on it ... well, like I said in the past. > "Let me make this absolutely clear. > > It should not be up to non-US citizens like myself to safe-guard US > economic security, and protect vital national interests. It is not > my job and certainly not my responsibility to protect the international > public and Fortune 500 companies from poor security." So without giving out another "exploitation algorithm" to the Internet, without extending a helping hand to Japan to retaliate against the US for the American Japanese auto surveillance, I will simply quote from two sources which are "public record" and mentioned in the FAQ. >From the "Orange Book", one of the volumes of the Department of Defence's "Rainbow Series" more commonly known as TCSEC (Trusted Computer System Evaluation Criteria) and available from: U.S. Government Printing Office INFOSEC Awareness Office Superintendent of Documents - or - National Computer Security Centre Washington, DC 20402 9800 Savage Road Fort George G. Meade, MD 20755-6000 which stipulates that: "... it is required that ADP (Automated Data Processing) systems that "process, store, or use classified data and produce classified information will, with reasonable dependability, prevent: a. Deliberate or inadvertent access to classified material by unauthorized persons, and b. Unauthorized manipulation of the computer and its associated peripheral devices." The above quoted reference is public information. And, since Netscape is making "no-comment" I will quote Netscape's public information. > NETSCAPE CLIENT APIS (NCAPIS) 2.0 > The NCAPIs are designed to allow third-party applications to > remotely control the Netscape Navigator client. They are > platform specific, utilizing the platform's native method of > interprocess communication (IPC). These APIs are not final > and may change with the release of version 1.1 of Netscape > Navigator (they do not work with Netscape Navigator 1.0). Herein is the "flawed algorithm" which is just a fancy way of saying that it's a flawed idea. And this isn't new ... it's been there for a long time. Generally, we don't routinely trust every other computer, foreign or domestic on the Internet to manipulate us by remote control. This is as basic as the idea that we don't give out our PIN numbers with our banking cards to anyone who asks us. If someone tries to suggest differently, then they are a fool. Let's recall that Version 1.1 of Navigator was released long ago, and trusts every machine on the Internet to do just that. It trusts every other machine on the Internet to be "trustworthy". Whether that machine is foreign or domestic. We are not speaking about the new and improved -- feature added -- "beta" 2.0 software, we are speaking of the software that AT&T is using internally and is selling to its customers as we speak as a "co-branded" product. Software which AT&T security "approved" of in direct contravention of the most basic of basic security principles. Let me reiterate this. Netscape's current existing software was designed in direct contravention of the US Department of Defence's evaluation criteria for Trusted Computer Systems, the TCSEC. It also contravenes the ITSEC (Information Technology Security Evaluation Criteria) which is a document developed by the British, German, French, and Netherlands governments. (Anyone can get a free copy of ITSEC by writing to the Commission of the European Communities in Brussels.) Netscape forgot one thing about trust. If you "trust everyone" ... even if you always trust everyone, you always cut the cards. And when you're playing poker at these stakes ... well ... 'nuff said. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. Please don't shoot the messenger. C. S. U. M. O. C. L. U. N. E. P.P.S If this is confusing to anyone, please direct your comments to one or all of the following newsgroups: alt.2600 alt.security comp.security.announce comp.security.misc comp.virus

6 5

Re: 50 attacks on Netscape - please send the check
by chip＠communities.com 17 Dec '03

17 Dec '03

fc(a)all.net (Dr. Frederick B. Cohen) writes: >50 Attacks: a.k.a. Why Not to Run Hot Java in your netscape (or other) browser: > ... (drivel elided) This fellow seems to be systematically (if not deliberately) ignorant about these things. One of my co-workers reviewed his book on computer viruses in IEEE Multimedia and noted that it manifests many of the same fallacies. You can read it (the review, not the book) at http://www.communities.com/paper/itsalive.html -- ------------------------------------------------------------------------------- | Chip Morningstar | | | Electric Communities | "I'm old enough to be living in | | 280 2nd Street, Los Altos, CA 94022 | the future I was warned about." | | 415-917-5640 | -- Myron Krueger | | chip(a)communities.com | | -------------------------------------------------------------------------------

1 0

Media Accuracy
by Martin Diehl 17 Dec '03

17 Dec '03

In the October 16, 1995 issue of PC Week, Spencer F. Katt writes: >Isn't it ironic? Andreessen creates the WEB while in college; now >college students are finding all the holes in it. Two students have >uncovered a serious bug in Netscape Navigator, one Katt source >contends. The browser has a 2K-byte buffer for reading HTML >documents. Well, these tipsters found that once the page has sent >more than 2K, any assembly code in the HTML document will be >executed. As an experiment, these kids set up a simple Web server >with some assembly code embedded in the HTML page to overwrite the >client computer's FAT table [sic]. Sure enough, it worked. >spencer(a)pcweek.ziff.com He might be talking about the (already fixed) bug that allowed an HREF that is longer than 356 bytes to overwrite the stack. Hadn't heard here that anything would happen other than getting Netscape to crash. No names or URL's were given in the story. Maybe he needs an update. Maybe we need an update. Martin G. Diehl

2 1