December 2003 - cypherpunks-legacy

Virus-Blocker
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, This item from 11 07 95 Edupage may be of interest to you: VIRUS-BLOCKER McAfee Associates has a new product called WebScan that identifies virus-tainted programs before they're downloaded and warns the user not to continue. Security experts say WebScan is the first product that prevents viruses from in- fecting a computer to begin with, rather than attacking the problem after it's already occurred. (Wall Street Journal 6 Nov 95 B6) Cordially, Jim NOTE To subscribe to Edupage, send a message to: listproc@ educom.unc.edu In the body of the message type: subscribe edupage <your name>

1 0

Re: PGP Comment feature weakens remailer security
by James A. Donald 17 Dec '03

17 Dec '03

At 05:47 PM 11/8/95 -0800, Raph Levien wrote: > So let me rephrase the question: what's the minimum number of entropy > bits that can be used and still give you that warm and fuzzy feeling > that you don't have to worry about the possibility that the message > might be corrupted? I guess that if comet hits the earth and exterminates the human race you would not be unduly worried by a corrupted message, so let us make the odds equal to human civilization being destroyed on the same day. We get roughly one massive extinction every hundred million years, or so and a smaller blast that would demolish our technology every ten million years or So the probability of an error was equal to the human race and most major species being destroyed the same day, you would not be unduly worried. Probability of human civilization and all large animals being wiped out by comet impact tonight is 2.7E-11, so thirty five bits should be sufficient. But, if you want to feel really comfortable, make it forty bits. The probability of hitting a forty bit combination by chance is equal to the probability that all large animals on earth will be wiped out by comet impact in the next three quarters of an hour. But you might have a million lines, and send a million messages, each of a million lines. So let us make the probability that one of those fails equal to the chance that all large animals on earth get wiped out in the next half hour. Well in that case make it eighty bits. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: DejaNews all over again
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Wed, 8 Nov 1995, Perry E. Metzger wrote: > anonymous-remailer(a)shell.portal.com writes: > > I wish that Detweiler could (seriously) go back to wherever he came from. > > What a fascinating statement to make, considering that you are > probably Detweiler. Fascinating. First, I'm accused of being noted computer viral expert, Dr. Frederick B. Cohen, (simply because he agrees with my assessment of the critical algorithm flaw in Netscape Navigator) and now I'm accused of perhaps being at the other end of the spectrum. Of being Detweiler, simply because he can take my signature and identity by signing an email, as Alice de 'nonymous or simply accusing me of posting in his "style". I see that the character assassination sport continues, and I am now a targetted. Hunter become hunted. I wonder why?? And why, by of all people, Perry? Is it perhaps because, I speak the truth, and the truth makes people very, very nervous. Is it because the flaw which is in the Navigator product is woven into the code fabric, and can't be *fixed*. Afterall, Netscape (and AT&T) have had, over THREE WEEKS to work on this problem or to make some form of public comment, and have done nothing, but put some of their programmers -- unofficially ... speaking for myself ... not speaking for the Company -- programmers on this list Meanwhile people are having their PGP keyrings collected, their passwords monitorred, and all of the information -- even information which they have NOT posted to Usenet, information that is simply on their personal hard drives, or on a private corporate network that is behind a firewall -- collected by anyone who actualy understands *how* to use Netscape Navigator's standard features to do it. And so the question is: Why am I having my character asassinated while this threat continues?? And while the loss and damage continues. Why are Netscape and AT&T not mitigating the damage? Is it because what I say is simple common sense stripped of the veneer of "technical language" and jargon?? And can't be *commented* on or *fixed*. Is this the fear which any truth teller faces, not only on the Internet, but in any forum where they try to challenge Goliath. Maybe, that's one reason to post anonymously. To clear the record definitively, I am neither Detweiler nor Dr. Frederick B. Cohen, and I am not the issue. I am simply myself, and I will _reveal_ my identity to the international public once the timing is appropriate. If anyone wants to know who I am, they can contact the PR department of AT&T or Netscape and ask. (Their address can be requested from either postmaster(a)att.com or postmaster(a)netscape.com, respectively.) Both companies have an email address for me, and would _likely_ *cough* forward any email enquiries to me without any editing. That way, everything is done clearly and out in the open. Nothing hidden, and nothing private, and none of my comments will become "their sole property to be used in their sole discretion". Neither company can accuse me of attacking them with daggers in the dark of night, from behind a shield of anonymity, when I advocate public open disclosure and commentary. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Register
by viking＠pacifier.com 17 Dec '03

17 Dec '03

Register I'd like to sign up for email Bob

1 0

Re: ecash speed
by Bill Stewart 17 Dec '03

17 Dec '03

>"Perry E. Metzger" <perry(a)piermont.com> writes: >>I suspect that as CPU speed exponentiates this will become less and >>less of a problem. It doesn't especially worry me. CPU speed in desktop or notebook computers isn't much problem; CPU speed in smartcards is still an issue, and it may be one or two more rounds of exponentiation before we'll see cards that are both fast enough and really secure. At 09:08 PM 11/8/95 -0800, Hal <hfinney(a)shell.portal.com> wrote: >Consider, though, what happens in the current ecash system if it were >used to charge a penny per page. You would click on a link in your web >browser to go to the new page. It would set the GET request to the >remote server as usual. For penny-a-page on-line services, unless ecash transaction costs are _radically_ cheap, it probably makes more sense for the service to sell its own tokens, bought with (anonymous or non-anonymous) ecash, which you then trade for pages. No calculation required, just an on-line lookup for double-spending and you don't get your page if you double-spend. An alternative to them picking the token numbers is for you to give them the numbers and them to keep them in their database, but that's probably unlikely to be done and doesn't really buy you much privacy. If that's not anonymous enough for you (because your IP address could be traced when you buy the tokens, and coordinated with them later), use a packet laundry, or connect from your dialup access provider, which will tell the newspaper you're port43.server29.netcom.com or something equally uninformative; or dial in from the public library or cafe. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Re: "Industry Group Rebuffs U.S. on Encryption" (NYT 8Nov95, C3)
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:50 PM 11/8/95 -0800, you wrote: >A group of 37 companies and trade and privacy associations sent a >letter to Al Gore yesterday, complaining about Clipper-II and crypto >export controls, and promising to send their own policy proposals >to Congress and the Administration within six months. We talked about this at dinner - what kind of proposals can industry offer, other than "128 bits and honest escrow" or "64 bits and no escrow"? "128 bits now, with no escrow if you want any campaign contributions this fall" or simply "get stuffed, we're all buying our crypto from Europe and including it in all our products" ? According to one of the newspaper articles, the gang of 37 is a Jerry Berman/CDT coordination, so I don't expect one of the more radical answers from them, but maybe they'll do the right thing. The fact that Netscape is including secure email in their Navigator next release can be a big lever pushing the Feds toward giving up, and perhaps deserves some publicity once the release version is out the door. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Coding-Export Limits Opposed
by John Young 17 Dec '03

17 Dec '03

The New York Times, November 9, 1995, p. D4. Coding-Export Limits Opposed The political right has joined the opposition to the Clinton Administration's proposed restriction on the export of data-coding systems. A group of 12 conservative organizations -- including the National Rifle Association, Americans for Tax Reform and the Competitive Enterprise Institute -- sent a letter yesterday to House Speaker Newt Gingrich protesting Administration efforts to limit the export of cryptographic software and hardware. Calling the proposal anti-consumer, anti-business and anti-progress, the groups urged Mr. Gingrich to support the relaxation of export controls. "The Administration's approach is the wrong policy for today's marketplace," the letter stated. The letter to Mr. Gingrich followed one sent on Tuesday to Vice President Al Gore from 37 corporate and publicpolicy groups, including the Microsoft Corporation and America Online Inc. The letter to Mr. Gore opposed Administration efforts to strike a compromise that would limit the strength of encryption software exports and require an escrowed code-key system, which would contain trapdoor access for American law enforcement agencies. [End]

1 0

Re: (cpx) Re: ecash speed
by Donald E. Eastlake 3rd 17 Dec '03

17 Dec '03

There is certaily no need for an extra connection from the merchant back to the customer. See draft-eastlake-internet-payment-00.txt. Donald (not on cybpherpunks) On Thu, 9 Nov 1995, Robert Hettinga wrote: > > --- begin forwarded text > > Date: Wed, 8 Nov 1995 21:08:51 -0800 > From: Hal <hfinney(a)shell.portal.com> > To: cypherpunks(a)toad.com > Subject: Re: ecash speed > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > "Perry E. Metzger" <perry(a)piermont.com> writes: > > >Hal writes: > >> The point is that if the anonymity afforded by ecash is too costly in > >> terms of time, then we may end up stuck with a non-anonymous system > >> simply because that is the only one efficient enough to work. It would > >> be good to find out if that is a serious problem. > > >I suspect that as CPU speed exponentiates this will become less and > >less of a problem. It doesn't especially worry me. > > Consider, though, what happens in the current ecash system if it were > used to charge a penny per page. You would click on a link in your web > browser to go to the new page. It would set the GET request to the > remote server as usual. > > The server would fire up a CGI script which will run the shop software. > That software will make a TCP stream connection back to your ecash wallet > software which is running on the system where your client is. It sends a > request to get payed $.01. Assuming the wallet is configured to > automatically approve such a payment, it will send a one penny coin to > the shop software along the opened link. (This may also involve doing a > PK encryption on the coin as an anti-theft measure; this aspect of the > current ecash system is not documented AFAIK.) > > The shop software then opens a TCP stream connection to the bank, and > forwards the coin there. The bank receives it, and checks the public > key signature in the coin. It then compares the coin against every other > coin which has ever been spent (within the validity period of the coin) > to make sure it is not being doubly spent. If this all checks out it > sends back some authentication message to the original server. The shop > software then delivers the new page to the client browser. > > This all has to happen whenever you click on a link in your browser. > Even with fast CPU's I think the extra step of connecting to the bank, > having it check against all coins, and getting approval will be > considerable for each link traversal. > > Hal > --- end forwarded text > > > ----------------- > Robert Hettinga (rah(a)shipwright.com) > Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 > USA (617) 323-7923 > "Reality is not optional." --Thomas Sowell > >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<< > > > ===================================================================== Donald E. Eastlake 3rd +1 508-287-4877(tel) dee(a)cybercash.com 318 Acton Street +1 508-371-7148(fax) dee(a)world.std.com Carlisle, MA 01741 USA +1 703-620-4200(main office, Reston, VA)

1 0

Re: Cybercensor in Singapore
by James A. Donald 17 Dec '03

17 Dec '03

At 06:15 PM 11/8/95 +0100, Anonymous wrote: > The Government has blunted an uncensored > Internet forum on Singapore political life by assembling > a group of users who make sure the Government's views are > represented. That is censorship? I visited the Singapore forum a few months ago -- When I visited Cuba (physically) everyone was visibly afraid. When I visited the Singapore electronically, they were not afraid. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Mime/multipart (was Re: PGP Comment feature weakens remailer security)
by Dave Crocker 17 Dec '03

17 Dec '03

At 5:56 AM 11/9/95, Laurent Demailly wrote: >I've waited a bit, but as nobody seem to have pointed out, you can >definitly find a unique stream in a *single* pass (but maybe what you >really want is no pass at all ?) engineering versus math. you can do it in zero passes, sort of. Generate a heafty pseudorandom number and convert it to a heafty ascii string. What are the odds that that string will appear in ANY kind of data you are generating? Low. Measured in years and probably decades. As you do the mime encapsulation, also scan for a collision. When you get it (once every 20 years or so), abort the processing and start over. d/ -------------------- Dave Crocker +1 408 246 8253 Brandenburg Consulting fax: +1 408 249 6205 675 Spruce Dr. dcrocker(a)brandenburg.com Sunnyvale, CA 94086 USA http://www.brandenburg.com

1 0