December 2003 - cypherpunks-legacy

Reno and Freeh to be assassinated!
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Dave Del Torto wrote: > "All members of Congress, and particularly those of us on the Intelligence > Committee, have a responsibility to find the proper balance between forward > thinking commercial policies and the unquestioned need to protect the > security of the American people and America's national interests." said > HPSCI Chairman Porter J. Goss I think we should all send Chairman Goss a letter of appreciation for his offer to assassinate Child Murderer Janet Reno and Murderer Louis Freeh. Most politicians are too cowardly to promise strong actions such as this. > Terrorist groups that plot to blow up buildings; drug cartels > that seek to poison our children, and those who proliferate in deadly > chemical and biological weapons are all formidable opponents of peace and > security in the global society. These bad actors must know that the United > States' law enforcement and national security agencies, working under the > proper oversight, will have the tools to frustrate illegal and deadly > activity and bring international criminals to justice," Goss said. Chairman Goss is also going to prosecute the employees of the CIA as well. It is good to finally see someone taking a strong stance in this regard. What a wonderful, wonderful man. He is probably a good husband and father too.

1 0

Re: XDM has the same problem as netscape ?!
by Arve Kjoelen 17 Dec '03

17 Dec '03

Ian Goldberg wrote: >Nelson Minar <nelson(a)santafe.edu> wrote: >>Last time I looked, the MIT-MAGIC-COOKIE-1 scheme used in X11R4 had >>the same problem: the random seed was based on the current time to the >>microsecond, modulo the granularity of the system clock. I think I >>figured that on my hardware, if I could figure out which minute the X >>server started (easy with finger), I'd only have to try a few >>thousand keys or so. Caveat: I never actually proved the idea. >Wow. I just checked, and Nelson's right. >[ code extracts snipped] I just checked X11R6, and the same method is used there, so it hasn't changed since X11R4. -Arve.

1 0

Re: Another Netscape Bug (and possible security hole)
by Duncan Frissell 17 Dec '03

17 Dec '03

At 01:17 PM 9/22/95 -0400, Thomas Grant Edwards wrote: >On Fri, 22 Sep 1995, Dietrich J. Kappe wrote: > >> Netscape 1.1N on a powermac crashes hard on that url. If anyone wants to try >> it out, I've put up a simple page with the url at >> http://www.redweb.com/experiment/bug.html > >Netscape also crashes (error 1) on regular Macs...sigh. I'm contacting >someone who just wrote a http server to see how tough it would be drop >some code on the stack. > >-Thomas On my 486 running Windoze for Workgroups 3.11 and the latest Netscape Beta it causes Netscape to die but doesn't lock me up. Generally I've found Netscape blows up in a much firendlier way than other Windoze programs. I can often recover the Netscape session itself and it doesn't lock me up as much. DCF > > >

1 0

Crypto Sync Issue
by kelso＠netcom.com 17 Dec '03

17 Dec '03

Hello, I am interested in encrypting a SLIP link between my PC (running Linux) and my Netcom shell account (running SLIRP). My question has to do with error conditions on the line. If I drop a character or packet, the two sides will loose crypto sync and result in things scrambled from then on. The modems will fix most of the low level problems. However, Murphy's Law has not been repealed. :) Are there any standard methods to provide the SYNC between the sender(encryption) and the receiver(decryption) on an Async connection ? Since Slip uses IP packets, I was planning on an encryption of the data portion of the IP packets (leaving the header alone). Thanks, Tom Rollins <kelso(a)netcom.com>

2 1

Worms and New Netscape Bug
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

Although Netscape will certainly fix their new bugs, it's likely that many old copies will remain on computers on the net, and the holes will remain. Netscape could "fight" against this with a modified worms/webcrawler which looks for blatantly dangerous domain names in URLs and reports them to "CERT" or blockware companies like Surfwatch. For example, they'd find the foo* link at the bottom of My page Not a complete solution obviously (e.g. the server could selectively reply to requests, and hide from the webcrawler IP). What happens when someone using the AOL browser clicks on one of these HREF's... does it crash all of AOL? --- Concurrent VLSI Arch. Group 545 Technology Sq., Rm. 610 MIT AI Lab Cambridge, MA 02139 (617)-253-0972

1 0

Privacy secrecy law for driver's records struck down
by Declan McCullagh 17 Dec '03

17 Dec '03

AM-Driver's Privacy,0594 Judge blocks driver's records secrecy law in S.C. By MONA BRECKENRIDGE Associated Press Writer COLUMBIA, S.C. (AP) - A federal law that prohibits the release of personal information from driver's licenses and car registrations is unconstitutional, a judge ruled Thursday in blocking enforcement of the law in South Carolina starting this weekend. State Attorney General Charlie Condon had challenged the Driver's Privacy Protection Act of 1994 on behalf of media groups from five states and two national media organizations. Condon contended the law was an improper infringement on states' rights. U.S. District Judge Dennis Shedd agreed, ruling that Congress "clearly exceeded its power." He said the government, which argued that the law would prevent stalkers from tracking their victims, failed to show that it was necessary to protect a constitutional right of privacy. Drivers should not expect their names, license numbers, addresses, phone numbers and photographs to be private, the judge said. Shedd's ruling blocks enforcement of the law, which is to take effect nationwide on Saturday, in South Carolina only. The only other state to challenge the law so far has been Oklahoma, where the case is pending. "This is a real victory for open governments and open records," said Bill Rogers, executive director of the South Carolina Press Association. "South Carolina already has a very good law to protect people from stalkers and harassing phone calls." Thirty-four states make motor vehicle records public in some form, according to the Reporters Committee for Freedom of the Press. The federal law would restrict almost everything in state motor vehicle records that can be looked up using a license plate or driver's license numbers, unless an individual agrees to its release. The law was sponsored by Sen. Barbara Boxer, D-Calif., in response to the 1989 slaying of actress Rebecca Schaeffer, who was killed at her California home by a man who used a private investigator to obtain her driver's records. The law, however, might not have prevented Schaeffer's slaying, since it would keep motor vehicle records open to police, private investigators, insurance companies, credit agencies and direct-marketing companies. States that did not designate their records as secret could face federal penalties of $5,000 a day. State workers who give out such information could be penalized $2,500 each time. "We are very disappointed by Judge Shedd's decision. We think that driver's privacy protection is an important anti-crime measure," said David Sandretti, Boxer's spokesman in Washington. Justice Department spokesman Joe Krovisky said he could not comment because the agency had not seen Shedd's ruling. Agency officials have 60 days to decide whether to appeal to the 4th U.S. Circuit Court of Appeals, he said. Shedd relied partly on the U.S. Supreme Court's June ruling on the so-called Brady Law, in which the justices said Congress could not make local police do criminal background checks on people who want to buy handguns. "Unquestionably, the states have been, and remain ... responsible for maintaining motor vehicle records, and these records constitute property of the states," Shedd wrote. The media groups that challenged the law were the press associations of South Carolina, North Carolina, Virginia, West Virginia and Maryland-Delaware, and the Newspaper Association of America and the American Society of Newspaper Editors.

1 0

Re: Project: a standard cell random number generator
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>At 02:50 PM 9/20/95 -0700, you wrote: >> In this sense, NSA ought to be *encouraging* Intel and >>IBM and Motorola to put "generate random bits" instructions into >>their instruction sets... Intel produces a random generator (in a chip package) that is used in STU-II..'s. You can't buy such devices, random sources good enough to be used for initialization for military grade cryptography are Controlled Cryptographic Items. One would think that the NSA is attempting to exploit the lack of availability of random initialization values against their targets. The question becomes one of whether or not the general populace (of the U.S.) is considered a potential target, or simply casualties of the situation in undeclared hostilities. As a minimum one could infer that the availability of random numbers is considered quite important for NSA secure communications. I used to work at a company that subscribed to NSA (National Standards Association) which provided government and other standards on microfiche and/or hardcopy. There was an interval before Reagan took office when the NSA provided all of their unclassified standards into general availability, an era of open- ness that came to an end with the Star Wars era. One of those standards was for random data sources. The only recent standards that come to mind are the X.509 stuff for session key generation, FIPS PUB 140-1 which describes randomizer tests, and the recent FIPS PUB for a password generator. These three use block ciphers to produce psuedo-random output. If NSA requires real stochastic results for military crypto, what would we as casual cryptographers feel comfortable with? The Netscape episode shows the comfort level needs improving. How good is good enough?

1 0

Netscape sub rosa?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:33 AM 9/20/95, Alan Olsen wrote: >At 03:06 PM 9/19/95 -0500, you wrote: >>NPR reported on the security flaw in Netscape, >> >>3:05 pm CDT. > >As well as CNN Headline news. (With the big Netscape N logo and ^^^^^^^^^^^^^^^^^^^ >everything.) They spent a fair amount of time (for CNN Headline news) on >the story. Gee, where's that "Cypherpunks logo" when you really need it? A rose covering the Netscape "N" logo? A crypto eagle swooping down and pecking at weak keys? Netscape sub rosa? --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Forwarding of Federalist Papers from Canada for U.S. Citizens promoting democracy
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Six wrote: > If you have a desire to educate the citizens of foreign countries > as to the value of democracy, I would be pleased to forward a copy of > the Federalist Papers to any email address you desire, upon receipt > of only the email addresses, with no instructions or requests. I think we should all send a copy of the Federalist Papers to Sadaam Hussein. It would be the American thing to do. Six also wrote: > If for any reason you feel that the terrorists who are ruling your > country might be able to persecute you for exercising free speech, > I would be happy to forward PGP 5.0 upon receipt of only the email > addresses, with no instructions or requests. I am certain we can trust Six not to mix up the addresses with no instructions and no requests meant for forwarding the Federalist Papers with the addresses with no instructions and no requests meant for forwarding strong encryption. TrustingMonger

1 0

Government promotes strong crypto!!!
by EFF 17 Dec '03

17 Dec '03

[Electronic Forgery Foundation] <Bienfait, Saskatchewan> [Washington, DC] In a startling turn of events, the U.S. government has come out in support of the use of strong encryption. In order to give incentives to criminals to use strong encryption, the government has announced that the penalty for using weak encryption in the commission of a crime will be an extra five years in prison. Lying Nazi Fuck Freeh stated, "Theoretically, the law applies to those criminals who use strong encryption, as well, but in practice, we will not be able to prosecute, because if we can't break it, then we have no way to prove it is being used for criminal purposes." Dog-faced Child Murderer Reno stated that the high level of publicity given to the effective use of encryption in crime has served the government's aim of making certain that the vast majority of criminals will recognize the value of using encryption to hide evidence. Lying Nazi Slut Dying FineSwine stated that she opposed the use of strong encryption by child pornographers because she and the vice police had grown so accustomed to high-quality computer graphics of child pornography, that they just couldn't get off on photographs any more. Marked for deletion SwineSwine said that she would like to comment more on child pornography, but talking about it made her hot, and she then rushed of to the ladies room. ----------------------------------------------------------------------- This message was forged under the auspices of the Electronic Forgery Foundation. Any misuse or abuse of this message will probably give your Congressman a hard on. They're weird that way. -----------------------------------------------------------------------

1 0