December 2003 - cypherpunks-legacy

Re: Remailer-in-a-Box, Everyone a Remailer
by Jay Campbell 17 Dec '03

17 Dec '03

>Rather, a single physical machine site can and should be able to run many >remailers, out of user accounts. (Accounts on systems like Sameer's C2. Or >Hal's remailer running on Portal. Or maybe some of the Mixmaster clients.) This also brings up the idea of 'opportunistic remailers' again (somebody gimme a snazzy name for that) - a PC/Mac-based SMTPish server that isn't always online. Shell accounts are becoming a piece of history for most users; part-time dialup IP (ppp/slip) is the predominant connectivity layer. A user could run an opportunistic remailer, and compile a list of other opp remailers his server would poll in addition to the standard shell-based 'always up' remailers. Given a large enough list (ie, everyone on this list ran this app in the background) there should be plenty of opp remailers online and ready to relay at any given time to make this an effective model. -- Jay Campbell Regional Operations Manager -=-=-=-=-=-=- Sense Networking (Santa Cruz Node) edge(a)got.net MIT PGP KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Re: Verification of Registration
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > Curious. Did anyone else receive this unsolicitated *invitation*? > > At 11:31 PM 10/23/95 -0700, verify(a)cnet.com wrote: > >Your membership registration has been processed. To become a full member > >of c|net online, please return the text of this message (to verify(a)cnet.com) Someone signed the mailing list up. I'm sure that they'll tell us about it when they get done. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

encryption products
by privsoft＠ix.netcom.com 17 Dec '03

17 Dec '03

I am presently evaluating / testing / researching three encryption products and I was wondering if any of ya'll are familliar with them. 1. TECSEC'c VEIL product ( so far only available through mailorder) 2. K. Briggs's Puffer, ( available for demo download off the web) 3. P. Glen's THE CRYPT , ( also available off the web) I am looking for comments about their respective crypto strengths, verstility, and capability. Thanks in advance for any assistance. Steve O ************************************************* PrivaSoft TM * 1877 Springfield Ave PO BOX 600 * Maplewood NJ 07040-0600 * Tel. 201-378-8865 Fax. 201-762-3742 * Http://www.privasoft.com/privasoft * E-mail: privsoft(a)ix.netcom.com * *************************************************

1 0

Re: [reformatted] how secure can privasoft be?
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > > This can at most buy you a constant factor - useful, but not very. > ... > > Someone else on this list mentioned that an edge detection algorithm > ... > > It could give you a quick go/no go. > > Don't forget that in most cases it'll be obvious that it's the wrong > key - only when it isn't would you submit the thing to a second-level > analyzer to check for edges/characters etc. I'm confused here. How will it be obvious? Unless you mean that you're going to sit there and watch it while it goes through the, (on average), 999999999/2 keys it would have to try before finding it. That could take awhile and really slow things down if it took user intervention for each test. You can't beat the human eye on visual discrimination though. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: Verification of Registration
by Lynne L. Harrison 17 Dec '03

17 Dec '03

Curious. Did anyone else receive this unsolicitated *invitation*? At 11:31 PM 10/23/95 -0700, verify(a)cnet.com wrote: >Your membership registration has been processed. To become a full member >of c|net online, please return the text of this message (to verify(a)cnet.com) > >The following magic token in this message [cypherpunks::752400770] will be automatically >processed to verify you. Please note: The number included in the token is >*not* your password; the one to use on the site is the one you entered on >the registration form. > >Please include the complete token appearing above, including the brackets. >The best way to return it to us is to include this entire message in your >reply. If you mailer does not allow you to do this, retype or cut and >paste the magic token (including the square brackets) into a new message to >verify(a)cnet.com. If you are having difficulty completing this process, >please direct your questions to support(a)cnet.com. > >Once you are verified you will be able to take advantage of the full >range of c|net online's services. > > ******************************************************************** Lynne L. Harrison, Esq. Poughkeepsie, New York lharrison(a)mhv.net "Say not, 'I have found the truth', but rather, 'I have found a truth.'" - Kahlil Gibran from "The Prophet" ********************************************************************

3 2

Attacks on Products and Companies
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:02 AM 10/24/95, Ian Goldberg wrote: >We should be keeping in mind that the goal here is to end up, in one way >or another, with a _secure_ way of transacting on the net. To that end, >it may be necessary to demonstrate that some current products don't >provide that way. We certainly don't want people to be scared away >from using one insecure product, only to use another, especially >if the latter is less secure than the former. ... >Everything would be _so_ much easier to check, though, if these >people would stop this "security through obscurity" garbage and >publish their protocols, if not their source. > > - Ian "Mr. Worf, activate targetting scanners." I don't wish to beat a dead horse, but my main point is not that we (the list members, and others) should not be scrutinizing and trying to break systems, but that it should be done with less general nastiness. What do I mean by "nastiness"? (And let me first hasten to add that neither Ian Goldberg nor his partner were nasty in their attacks on Netscape.) The problem I see is that people often _personalize_ the attacks, or treat members of companies who show up on the list as _adversaries_. I can't know for sure if the various folks from Netscape, First Virtual, Digicash, Intuit, etc., who hang out on this list feel besieged, but I know I sure would. If everything I said, even with disclaimers that I don't speak officially, were to be torn apart and the ulterior motives speculated upon, I'd either shut up on this list or get off it completely. (Recall that we had Marc Andreessen on this list last December--for whatever reasons, and there are likely several, he left. I recall many attacks on his company. He perhaps figured "What the hell do I need this for?") Legitimate, scientific analysis is commendable. The brute force attack on Netscape was great, and even better was the random seed attack. But many of the attacks are less solid: "How can you people at Digital Datawhack produce such crap? The assumptions you make in the Flogisticon module are disgusting, another example of security through obscenity." (What I think this piling on is likely to accomplish is to push company list subscribers here to just shut up. They see that the more is said by folks from Netscape, as the best current example, the more fireworks and insults ensue. The less that is said the better. This is not a good situation.) I'm not arguing for "niceness," just that some of the edge be taken off the attacks. The "bounties" that are being offered in press releases have the danger of inviting premature announcement of results. And of discouraging companies from actively participating in this list and discussing what might be done to improve security. Just my views. No doubt some will think I'm a shill for some company. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Hacking commercial systems.
by hallam＠w3.org 17 Dec '03

17 Dec '03

Hi, A number of people have been proposing hacks on commercial payment systems. Could I point out that this is not necessarily a good idea? One vendor I spoke to has a contract clause with sublicensees which requires a legal response in such situations. His opinion was that attempting such a crack on a "live" system consitituted conspiracy to commit fraud and organisation of the same could involve RICO penalties. It would seem prudent to approach such projects with a little caution. If a request were made for a sample of material to work on most companies would oblige and a refusal would provide protection against legal tactics. Most sensible companies would see the advantage of offering a reward. Phill

2 1

Re: Netscape rewards are an insult
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > C. S. U. M. O. C. L. U. N. E. > WTF? I'm surprised you didn't get this. It's a simple phrasal substitution cipher, sort of like a license plate. Think of it as this: C SUMO CLU NE See Sumo Clue No (clever putting a foreign word there, eh? But not clever enough to throw us off! ) and realizing that sumo refers to sumo wrestling: See wrestling clue no and when you realize that a clue tells you about the reality of something: See wrestling reality no or rearranging: See wresting no reality or: See, wrestling has no reality! And you can see that it's a simple assertion that professional wrestling's not real. It's wrong of course. Think about when they pick someone up and throw them. If that happened to me it would hurt...don't you think? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Fred, Fred, Fred: Enough already!
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Can we please talk to Dr. Fred, the Poster Child of the Informal Fallacy, if we *really* have to, off line? I had my fill of specious arguments in college already. Speaking of both, I would reccommed any book on elementary logic (Copi used to be a good one), specifically the informal falacies section, if you want a good laugh, and to see why his "Did so, did not! Prove it didn't!" argument style makes me want to step outside and hork in the bushes. I would hate to kill-file people who are normally clueful, but I will, just to get this second-order Fredness out of my face. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Verification of Registration
by cypherpunks＠toad.com 17 Dec '03

17 Dec '03

>Your membership registration has been processed. To become a full member >of c|net online, please return the text of this message (to verify(a)cnet.com) > >The following magic token in this message [cypherpunks::752400770] will be automatically >processed to verify you. Please note: The number included in the token is >*not* your password; the one to use on the site is the one you entered on >the registration form. > >Please include the complete token appearing above, including the brackets. >The best way to return it to us is to include this entire message in your >reply. If you mailer does not allow you to do this, retype or cut and >paste the magic token (including the square brackets) into a new message to >verify(a)cnet.com. If you are having difficulty completing this process, >please direct your questions to support(a)cnet.com. > >Once you are verified you will be able to take advantage of the full >range of c|net online's services.

1 0