December 2003 - cypherpunks-legacy

BoS: Bug bugs privacy file but a fix is on the way (fwd)
by Patrick Oonk 17 Dec '03

17 Dec '03

Forwarded message: >From best-of-security-request(a)cyber.com.au Tue Aug 26 08:30:09 1997 Resent-Date: Tue, 26 Aug 1997 16:16:35 +1000 (EST) From: darrenr(a)melb.convergent.com.au (Darren Reed) Message-Id: <199708260343.NAA08202(a)duchess.melb.arcsystems.com.au> Date: Tue, 26 Aug 1997 13:43:37 +1000 (EST) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: darrenr(a)cyber.com.au Old-Status: O Resent-Message-ID: <"kYO8a.A.IkC.-PmA0"@plum> X-Loop: best-of-security(a)cyber.com.au Errors-To: best-of-security-request(a)cyber.com.au Precedence: list Resent-Sender: best-of-security-request(a)cyber.com.au To: best-of-security(a)cyber.com.au Resent-From: best-of-security(a)cyber.com.au X-OS: FreeBSD3.0-current X-Mailing-List: <best-of-security(a)cyber.com.au> ftp://ftp.cyber.com.au/pub/archive/b-o-s/ X-Subscription: To unsubscribe from this fine mailing list mail best-of-security-request(a)cyber.com.au with Subject: unsubscribe Subject: BoS: Bug bugs privacy file but a fix is on the way A "flaw" in the encryption program PGP 5.0 was reported to the Australian security organisation AusCERT lat week, and a recommended fix was issued later in the week. Security consultant Paul Drake, an expatriate Australian working for a company called NetSafe, said he had discovered a bug that menat PGP 5.0 (for "Pretty Good Privacy") kept passwords in memory "at all times", as well as part of the text of whatever had been encrypted. The keyfile was also being kept in a relatively insecure file, he said. AusCERT confirmed the problem had been reported and said they were investigating. PGP advocate peter Moon, who is pushing for wider use of the software in Australia, said while the problems pointed out by Drake were "valid", they were more weak points than "bugs". "The PGP encrpytion algorithm is - as anyone knows - as solid as a rock. The attacks are all based on the principal that if you want to break into the strongest box in the world, the easiest way is to pinch thekey." He said a product called bcwipe could clear the saved information and the keyfile should probably be deleted altogether. Drake said PGP, a United States-based company, would release "PGP 5.01" without the problem. -- Jenny Sinclair, Page D4, The Age, Tuesday 26 August 1997 -- | Patrick Oonk - http://patrick.mypage.org/ - patrick(a)pine.nl | | PGP Key ID 0xDA2E93FA - Internic PO59 - <clicketyclick> | | Pine Internet B.V. Consultancy, installatie en beheer | | Tel: +31-70-3111010 - Fax: +31-70-3111011 - http://www.pine.nl/ |

1 0

"Living in real time, side A" (article ref)
by Cortland D. Starrett 17 Dec '03

17 Dec '03

"Living in real time, side A" by Ted Lewis, Naval Postgraduate School, is an extremely concise (<3 pages) and insightful look into the future of information technology and society. Subjects dear to many cypherpunks are indirectly addressed throughout. A detail of particular interest to the lawyers on the list described "A vapor trail of litigation". The author notes that, "Plea bargaining, out-of-court settlements, and appeals are the norm in Post-industrial legal circles. These are all legal devices for delaying the opposition rather than deciding on a proactive course of action. In the Info Age, legal procedures will be too cumbersome and too expensive to accommodate the rate of change." ... "The mechanisms for protecting Info Age property (information) are trade secrets and obsolescence." other key terms: Moore's Law, civilization on speed, inverse economics, rate of change, Direct democracy tending toward anarchy... The article can be found on page 8 of the September issue of IEEE Computer. Cort. (Mistakes in quotes are mine.)

1 0

Re: Searchable Crypto Paper Archive?
by David J. Bianco 17 Dec '03

17 Dec '03

On Sep 6, 12:32, Adam Shostack sent the following to the NSA's mail archives: > Subject: Re: Searchable Crypto Paper Archive? || | Anyway, this is what I'd like to see. I'm willing to work on such a || | system if there's enough positive feedback. Does anyone else think || | they'd like to use or contribute to such a system? || | || || I think this would be a fabulously useful service, one which I'd be || glad to subscribe to as an amateur. (I could see forking over $20-50 || for search priority, possibly more if it was really well done). || Ack! Money involved? "Just say no!" 8-) When I said "contribute" I meant placing papers in it, or if you've got a lot already, adding your own database to the list of possible search sites. I wanna do this as a free service. There are several reasons (like I can't see charging people for information that I didn't even produce), but the real reason for doing it is simple: I wanna use it. I made a mock up of CTRS, which is available at: http://www.itribe.net/CTRS/ https://www.itribe.net/CTRS/ (of course we have to offer SSL 8-) There aren't any crypto papers in it yet, though. The iTRiBE database (the only one available for searching right now) is filled with some NASA test data. Try doing searches on things like "ratio" or "nasa" for an example of the output you'd get. || || Don't forget the value of sci.crypt[.research] and cypherpunks || postings, nor of crypto 'rump session' papers. I admit I hadn't thought of these. I'm not sure I could sign up for the task of archiving the newsgroups (disk space) but if the authors/copyright holders of rump papers want to submit them, I'd be happy to index them. I don't think the database necessarily has to be composed only of referreed papers or anything. I'd be happy to index rump papers, technical reports or maybe even presentation materials like postscript copies of overhead transparencies. Anyway, thanks for the reply! -- ========================================================================== David J. Bianco | Web Wonders, Online Oddities, Cool Stuff iTribe, Inc. | Suite 1700, World Trade Center | email: <bianco(a)itribe.net> Norfolk, VA 23510 | URL : http://www.itribe.net/~bianco/

1 0

Re: Searchable Crypto Paper Archive?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:45 PM 9/6/95, David J. Bianco wrote: >S'ok with me. It's not like I'm dead set on doing this or anything. It's >just an observation, and an offer of service if anyone thinks it'd be >useful. > >Oh, BTW, another thing I probably should mention that seems obvious to me: > I'm offering to do this for free. That is, the database would be a public >service, with no charge to list papers, add another database to the >searching list or to query/retrieve abstracts. I'll look forward to seeing this, then. I was just noting some issues which seem likely to arise. But if you plan to do this "if anyone thinks it's be useful," then I think it would be useful, so you've met your criterion for doing the project. Good luck! Keep us posted. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: BXA Meet in Portland OR
by John Young 17 Dec '03

17 Dec '03

Alan Olsen wrote: >I am going to try very hard to be there. It claims that statements will >be taken on the EAR. Anyone want to help write a statement to be read to >the commitee? An excellent start would be Adam Shostack's questioning of the legal authority for the feds to restrict publishing. See his Tom Paine taunt in Peter Wayner's NYT report yesterday, and as posted here. Declaring yourself to be a cpunk, well, can you get a hearing at a hearing of closed EARs any better way?

2 1

The Rest of the Story / Re: I've got a Volvo (and I'm not afraid to use it!)
by Anonymous 17 Dec '03

17 Dec '03

Anonymous wrote: > FROM MOUNTAIN MEDIA > THE LIBERTARIAN, By Vin Suprynowicz > 'The fight's over. There's no one left to fight' > On June 4, 1997 the trial of the only Viper Militia defendant to face > a jury -- after months in jail, 10 have pleaded guilty to one charge or > another, while one still awaits trial -- got underway before Judge Earl > H. Carroll in the federal district courthouse in downtown Phoenix. # # # I asked Knight what he believes the government's real goal is, in pressing such prosecutions. "Their goal is to disarm the public. This is to make sure everyone knows that if they can put me in prison for five years for going out to two field exercises in six months, after 15 years in business in this town, meeting the public all day every day, a church-going guy, a good father ... if we can throw this guy in prison, think what we can do to you. ... "When the jury came back hung, and he asked them if there was any chance of reaching a verdict if he sent them back and they said no, (the judge) was bound by law to declare a mistrial, but he did not. ... Instead he sent them back. And I have a feeling the jury thought they were going to be there forever if they didn't come back with a unanimous verdict. ... # # # "Aren't they just speeding up Darwinism?" I asked attorney Abrams of the government's prosecutions of these highly-visible, "public" militia units. By shutting down the goofier militias, the guys who parade around in public in camouflage fatigues, aren't they just teaching those who profoundly fear and distrust the government how to be more secretive, more serious, more professional ... and simultaneously walling them off from the influence of more moderate voices? "But that's what they want to do," the self-described liberal Democrat replied. "Look at the War on Drugs, which is dependent on evil men with evil-sounding Hispanic names: Marcos Fernando Guzman. And the more of them we can create, we have our enemy and our target and then we can create our government agency. It is to the government's advantage to make more and badder militias, because the worse they are, the more agencies like the ATF can come out and say, 'We are the first line of defense, we are saving the nation from ruin, we need money from Congress.' ... "You put these guys from New York out here where the real disaffection is, and they'll be shocked first of all at the depth of it. I'm shocked at the depth of the disaffection, but also at the way it permeates all layers of society. I don't know anyone who trusts the government, including my father who has a PhD law degree, but you get him out here for a breath of fresh air, and he starts to talk like one of them. ... Contributions to help fund Chuck Knight's appeal may be sent to the Charles Knight Legal Defense Fund, Account No. 14928432, Bank One, 4922 E. Bell Road, Scottsdale Ariz. 85251 Vin Suprynowicz is the assistant editorial page editor of the Las Vegas Review-Journal. Readers may contact him via e-mail at vin(a)lvrj.com. The web site for the Suprynowicz column is at http://www.nguworld.com/vindex/. The column is syndicated in the United States and Canada via Mountain Media Syndications, P.O. Box 4422, Las Vegas Nev. 89127. This essay originally appeared in the September, 1997 edition of "The Rothbard-Rockwell Report." ***

1 0

Anonymous CU-SeeMe reflector
by Thomas Grant Edwards 17 Dec '03

17 Dec '03

If anybody has worked on or is interested in working on creating an anonymous CU-SeeMe reflector, please contact me (where anonymous in this case means that CU-SeeMe clients do not report the proper IP numbers of other clients). I've done a bit of work on it but can't quite get "normal" reflector behaviour. -Thomas Edwards

1 0

Dial in authentication
by Mike 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 What products could be used for dial in authentication? I am interested in something like a piece of hardware that shows one time passwords and allows users of Win95/NT4 to dial in to an NT/Unix network and use NetBIOS/TCP file servers. Can anybody recommend something is this area? Is it possible to export strong authentication products from the US, or is it necessary to purchase the hardware from abroad to allow international users to dial in? Mike -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNAKQRsUc8bdD9cnfEQIETACgy1W5aJLOfnHKnnmPeE2HQf925QgAn1bS s6nH12HKSBmwtVRvV0MyhdLC =f9eC -----END PGP SIGNATURE----- Mike.

1 0

Anonymous http daemon?
by Dave Lambert 17 Dec '03

17 Dec '03

Hi. Some time ago, there were some discussions concerning an anonymous http daemon. As far as I can recall, the discussion just sort of trailed off, and nothing got implemented. I'm considering making an anonymous server available, and would like: 1. to know whether I need to hack some code (or if someone has done so already) 2. to reopen the discussion of the desirable characteristics such a beast would possess. - David C. Lambert dlambert(a)aigtc.com

1 0

Re: Growth of actions definded as crime. Which math formula?
by alt＠iquest.net 17 Dec '03

17 Dec '03

At 02:00 AM 9/6/95 -0400, Black Unicorn wrote: >Created crimes are few and far between. You mean like buying a 30 round magazine, or putting a different stock of your choice on a rifle, or owning an automatic weapon, or mailing crypto out of the country, or hiring someone due to their race, or not hiring someone because they are "fat?"

1 0