December 2003 - cypherpunks-legacy

Re: Sun's buggy MD5?
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 20:45 8/18/95, michael shiplett wrote: >MD5 test suite: >MD5 ("") = f00001c0effffba8429b59d50529097c >MD5 ("a") = f00003c0effffba8aec5fcf4284a8dbe >MD5 ("abc") = f00005c0effffba896fc8af8ca60a911 >MD5 ("message digest") = f00007c0effffba8f373218f317a9558 >MD5 ("abcdefghijklmnopqrstuvwxyz") = f00009c0effffba896b4f24acb3f4738 >MD5 ("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789") >= f0000bc0effffba8cef237a614aa457d There certainly is something VERY wrong. I think that the result is being reported from a location that is 8 positions left of where it should be pointing. Position 9 is where the "random" (ie: Probably correct) data starts. The first 8 positions are f0000Xc0effffba8 (where X increments by 2 for each invocation). Thus this looks like some kind of constant or fixed work area.

1 0

Re: Certificates/Anonymity/Policy/True Names
by Rich Salz 17 Dec '03

17 Dec '03

I think there are many people who might be willing to use an "anon CA" should it exist: Whistleblowers, perhaps Deep Throat would have used email People writing letters to the editor who don't want to trust the editor to withhold their info People who desire anonymyity yet don't want to trust the gov't to certify their communications as authentic/forged (Unabomber, Om Shin-rkyo) Any number of writers who have used psuedonyms and now want to get paid in ecash; Mark Twain?

3 2

RealAudio website temporary password
by RealAudio Welcome Wagon 17 Dec '03

17 Dec '03

This is an automatic response to your request for a free user account on the RealAudio site. Welcome to the world of RealAudio. The following temporary password will only be used once, in order to activate the username and password you selected for yourself during signup. To activate your account, please visit our Account Activation page at http://www.RealAudio.com/welcome.html and enter the temporary password in the proper blank. The user name you selected is: cypherpu Your temporary RealAudio password is: Toledo.Francisco If you have trouble with the software, please refer to the RealAudio FAQ and Technical Notes available at http://www.RealAudio.com/help.html You can also contact us through http://www.RealAudio.com/comment.html Thank you for becoming a RealAudio user.

1 0

WhiSSLing in the Dark
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Netscape Encrypted Data Cracked Tokyo, Japan, Aug. 18 (NB) -- Two computer users have managed to break Netscape's Secure Sockets Layer (SSL) encryption code in response to a challenge posted to the Internet. But far from scaring people away from using the system for online purchases, the results could reassure people of the safety. In mid July Hal Finney, a US computer user, posted data in an Internet message that he recorded when he sent an order, containing a fake name and credit card details, to Netscape's own computer. Setting a task for the hacking community, he wrote, "The challenge is to break the encryption and recover the name and address info I entered in the form and sent securely to Netscape." Early this week, news came from Damien Doligez, a French computer user, that he had cracked the code and revealed the contents of the message. Several hours later a message from an American team also claimed the same feat, actually cracking it two hours earlier than Doligez. While the results look damaging on the surface, Netscape, and Doligez, pointed out the amount of computer processing power needed to hack just one message and the difficulty in repeating the process. Roseanne Siino of Netscape told Newsbytes, "The real issue is whether this compromises security on the net. He used 120 computers for 8 days just to crack one message." Siino points out that to break into another message would require another eight days at the same 120 workstations and 2 parallel computers. In home computer terms, Doligez guesses a network of about 80 Intel Pentium-based machines would be equivalent to the system he had access to via his workplace, INRIA in Paris, and computers an Ecole Polytechnique and ENS. Netscape estimates the total cost of this computing time at around $10,000, meaning there are many more economical ways of getting credit cards numbers than hacking into Netscape SSL messages. Doligez agrees, writing on his home page: "The technical implications are almost zero. Everybody who understands the technical details knew perfectly well that this was do-able and even easy. You have to understand what happened exactly. I did not break SSL itself. I did only break one SSL session that used the weakest algorithm available in SSL. If I want to break another session, it will cost another 8 days of all my machines." The vulnerability of the encryption system is shown by its international use. The coding system available via Netscape software from the Internet makes use of a 40-bit encryption key. A stronger version, using a 128-bit key, is available to US citizens but restricted from export outside the United States by government regulations. Netscape's Siino explained the US government allows export of the lower security version "because they can break it." There are some hopes that this demonstration will help persuade the US government to lift export restrictions on some harder-to-crack versions of the code. Netscape is currently developing a new Secure Courier code which just encrypts the financial data in the messages using 56-bit keys. Siino explained, "You can export over 40-bit keys for a specific application." The new system should be available early next year. Many companies working on secure transaction systems hope the much more secure 128-bit code version of the system will be available for export eventually. This is said to be almost unbreakable, requiring a trillion times more processing power to crack than the 40-bit version. Internet users can view a copy of the original challenge, access Doligez's home page with details of his result, get copies of the program used to crack the code and read Netscape's response to the news through a special section at Netscape, http://home.netscape.com/newsref/std/key_challenge.html Press contacts : Roseanne Siino, Netscape, +1-415-528-2619 , Internet email roseanne(a)netscape.com; Damien Doligez, Internet email damien.doligez(a)inria.fr ; Hal Finney, Internet email hfinney(a)shell.portal.com)

2 1

RE: Queries from a Cyper-newbie?
by Chris Avery 17 Dec '03

17 Dec '03

1. Thanks for the comments. I indeed meant "crackable" when I said "unencryptable", as you surmised. I'll learn. 2. I don't precisely know what it means to "change hashes" on RSA keys, though I get the drift. Where can I go for details? 3. I'll do the www.crypto.com thing, thanks for the pointer. This may be a critical last stand on the privacy of communications issue. What gets me is the blind arrogance with which govt "servants" assume that their (even if legitimate) pursuit of crime somehow excuses or justifies diminishing privacy rights for everyone else. There must be some kind of ratio: 1,000,000 rights diminished for 1 criminal activity detected? Doesn't make sense. Thnks. ---------- From: bennett_t1@popmail.firn.edu[SMTP:bennett_t1@popmail.firn.edu] Sent: Monday, July 28, 1997 5:35 PM To: Chris Avery Cc: cypherpunks(a)toad.com Subject: Re: Queries from a Cyper-newbie? -----BEGIN PGP SIGNED MESSAGE----- At 03:45 PM 7/28/97 -0700, you wrote: >Anybody willing to offer a bit of help to a cypher-newbie? I'm trying to sort out a few of the basics: Well as long as you ask like that instead of what most newbies do, such as try and subscribe by sending "Add me to the mailing list" to the list. >1. PGP 5.0 -- good software? It's better integrated for Mac Lusers and Windows 95ers. It is, however, flawed in some respects. >If not, what problems? Why to use DSS vs/ RSA keys? How is 5.0 different than 2.6.3i ? Which is better? 2.6.3i cannot use CAST, or (who would want to , it's DES!) Triple- DES. It does however, can use other hashes with RSA, thanks to someone's discovery on PGP-USERS. 2.6.3i is dos native, and complex. A shell integrates nicely, but it's still not the same. >2. Are emails encrypted using PGP 5.0 decypherable by PGP 2.6.3i (and vice versa?) Using RSA keys? ONLY using RSA keys. DSS/Diffie-Hellman support is being added to old PGP's. RSAREF is used in PGP 5.0 . MPILIB, Phil Zimmermann's original PGP RSA algorithm implementation is used in international versions. It's becuase of RSA's patent stuff. >3. I understand certain encryption s/w cannot be legally exported, I am aware that such s/w is nevertheless being used (and built) abroad. My queries: Is purely domestic use being threatened by the pending legislation? Is it already illegal to send an encrypted msg out of the US? If so, is it illegal to receive an encrypted msg from outside the US? Unless it is the "shitty 40 bit" type. It can be built abroad, for example, IDEA was made in switzerland, or something like that..., PGP 2.6.3i was made legally, I think. Domestic use is being threatened by Nazi Motherfuckers like Billy-Bob Clinton [spit], The FBI, and the NSA. Oppose them. Go to www.crypto.com and do some of the stuff there. Sending and recieving mail from the outside of the US *is legal*. >4. How strong is strong? My MS Explorer has the 128 bit encryption scheme to secure domestic financial transactions (such as credit cards). How "un-encryptable" is this? I read some recent postings here re difficulty of breaking 128 bit keys -- but this had reference to stronger methods of encryption than MS Explorer uses, right? So 128 bits is hard to break (umptyump years, terrawatts, etc.)? Then why does my PGP 5.0 software offer keys that are 768, 1024, etc. up to 4096 bits in length? Are these numbers on the same scale? Unencryptable? What the fuck are you talking about? If you mean crackable, let's just say it'd take several time the age of the Universe to crack it. The RSA keys are weaker than symmetric cyphers, unless we're talking about DSS/Diffie-Hellman keys with 4096bits. They are not on the same scale. >Any "strength" differences between RSA, DSS, and Diffie-Hellman? IS there some layman-understandable difference between these? Well, RSA's are patented and RSA is really anal with their patents. DSS/Diffie-Hellman keys are unpatented. You can change hashes on RSA keys (RIPEM160, MD5 [was broken already], and SHA-1). But to use those RSA's with older PGP's, use only MD5. >5. Is international data traffic somehow monitored (or monitorable) to detect encrypted traffic? It can be detected that you're using encryption. Breaking PGP is another thing. If any other cypherpunks want to correct me here, do so. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBM9065B0+FhmmTrSJAQEdsgQAmRAJR7CxQCy4Wfny8YM6oJ3chLKnJCnA E45EElRsAVS8zyAWy06/ZJFG8XjInjgAzmx+fRvGoN0qHvObyFfrDMPML0w+405s cddgcApc0DfbjP8narKHVBQnbOhwuSjdDbwTbFF9F+EG0OkXewgYKXS/QnS11ov/ ofr4ooPGcr0= =rowH -----END PGP SIGNATURE-----

1 0

Re: RealAudio website temporary password
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199508210449.VAA20788(a)www.realaudio.com>, welcome(a)realaudio.com (RealAudio Welcome Wagon) wrote: >This is an automatic response to your request for a free user account >on the RealAudio site. Welcome to the world of RealAudio. > >The following temporary password will only be used once, >in order to activate the username and password you >selected for yourself during signup. >To activate your account, please visit our Account Activation page >at http://www.RealAudio.com/welcome.html >and enter the temporary password in the proper blank. > >The user name you selected is: > >cypherpu The password has been changed to "cypherpunks" - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDgVmCoZzwIn1bdtAQF6IwF+INj+evDl7CrkIKHTpozs+8yMixV9fEh4 FvaTNdx/Jl/kWoyrjFTk+oYm85DmVv91 =xB75 -----END PGP SIGNATURE-----

1 0

List of P.E.E.L. district managers near you!
by putpeel2＠orbisnet.com 17 Dec '03

17 Dec '03

Remove yourself from this list by clicking on reply and typing remove in the subject line. This is a list of P.E.E.L. district managers, their city, name, email and phone number. YES! We want to help you build your P.E.E.L. business in person! Please read the purpose of district managers, how they can benefit you as a distributor or factory outlet owner, and company guidelines in the following Email. If you are a distributor or factory outlet owner, feel free to contact anyone below. All the people on this list are willing to help you build your business, at no cost or obligation to you. A district manager is not your boss, they are only here to help you, if you so choose. This is a service provided by P.E.E.L. If you are not on this list but want to be, please contact me. ATTENTION: Would you like to have a free distributorship selling Earth friendly, cruelty free products and earn 50% or more to start? Would you like to have your own store on the internet for only $49.00, never handle product and have weekly commission checks of 25%? We have this and a lot more. Please visit our distributor website at http://www.putpeel.com/distributors To see how to own your very own store, http://www.putpeel.com/factory-outlet ARIZONA DBMcCLURE(a)aol.com David B. McClure Chairman & CEO BetaCom Inc. Tuscon AZ 85710 520-751- 8716 fax 752 CALIFORNIA BAAB-BAKZ CafeDarci(a)aol.com Fountain, Carla T. Ripon CA 95366 (209)599-2970A CONECTICUT AAAAK-BAEH cgunt(a)aol.com Gunther, Claudia Guilford, CT 06437 203-458-8418 FLORIDA Wantom(a)aol.com Probst, William F. (Bill) Jacksonville FL 32225-1888 904 641-0709 Fax: 904 998-9012 AAAA-BAAB frakam(a)ix.netcom.com integrated(a)ix.gen.com Kammerdiener, Francis R. Miami Beach FL 33160 (888) 206-8104 (305) 933-2207 Fax(305) 682-0284 AAAA-BALQ wbroderick(a)hawk.net Broderick, William Ft. Myers FL 33905 (941)693-5161 INDIANA AAAA-BAAK paprwaydtp(a)aol.com Lemler, Kim Bourbon IN 46504 (219)646-2100 AAAAK-BAK3 IrishKenn(a)juno.com McRoden, Kenneth C. Ossian IN 46777 (219) 622-6331 (888)616- 5647 IOWA Riveris4U(a)aol.com Bowers, Kate Prole IA 50229 515 981-1442 MARYLAND BABA-BABS OIS(a)aol.com Wimmer, Karen Baltimore MD 21207 (410)944-7849 MASSACHUSETTS AAAA-AAAB, AWOOD(a)aol.com, Wood, Arthur F. Eddington, MA 04428-9710 (207)843-6020 MINNESOTA AAAB-BAGK karaoke629(a)aol.com Peterson, David Bloomington MN 55438 (612)941-1025 NEBRASKA WigleyK(a)MindSpring.com Wigley, Kathy Bellevue NE 68123 (402) 682-9069 OHIO joneill563(a)aol.com O'Neill Jr, John 2914 Harkie St. Middletown OH 45044 (513) 423-6558 OREGON AAAA-BAJK a-coctoau(a)aol.com Meyer, Angela Portland OR 97214-4026 (503)239-8087 OKLAHOMA AAAA-BAAZ Jump100(a)aol.com Durbin, Julie Oklahoma City OK 73135 Still, Terry Tulsa OK 74135 (918) 744-4048. PENNSYLVANIA BAKT-BAKT-BALV kaloftus(a)epix.net Loftus, Kandis Wilkes-Barre PA 18705 (888)202-1121 LinkArt(a)aol.com Begg, Richard Philadelphia PA19131 215-878-8258 215-878-8268 TEXAS AAAA-BAEP ANT5LEY(a)aol.com Antley, Teresa Dickinson TX 77539 281-534-3279 SNelson140(a)aol.com Nelson, Lloyd San Jaun TX 78589 956-781-2451 CANADA MANITOBA wtsvg(a)mb.sympatico.ca Williams, Sr, Wade Tudor. Winnipeg, Manitoba R3V 1R8 (204) 275 - 7265

1 0

Re: RealAudio website temporary password Re: RealAudio website temporary password
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

The Cypherpunks RealAudio free account is now activated with password "writecode" (case sensitive -- make them letters small). The user name is still "cypherpu". RealAudio.com does not truncate names longer than 8 characters during login (meaning "cypherpunks" fails), but their signup page won't allow entry of more than 8. Silly. Don't have too much fun listening to NPR, now... > Date: Sun, 20 Aug 1995 21:49:23 -0700 > From: RealAudio Welcome Wagon <welcome(a)realaudio.com> > To: cypherpunks(a)toad.com > Reply-To: welcome(a)realaudio.com > Subject: RealAudio website temporary password > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > This is an automatic response to your request for a free user account > on the RealAudio site. Welcome to the world of RealAudio. > > The following temporary password will only be used once, > in order to activate the username and password you > selected for yourself during signup. > To activate your account, please visit our Account Activation page > at http://www.RealAudio.com/welcome.html > and enter the temporary password in the proper blank. > > The user name you selected is: > > cypherpu > > Your temporary RealAudio password is: > > Toledo.Francisco > > If you have trouble with the software, please refer to > the RealAudio FAQ and Technical Notes available at > http://www.RealAudio.com/help.html > > You can also contact us through http://www.RealAudio.com/comment.html > > Thank you for becoming a RealAudio user.

1 0

Re: RealAudio website temporary password Re: RealAudio website temporary password
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Lucky Green wrote: >>This is an automatic response to your request for a free user account >>on the RealAudio site. Welcome to the world of RealAudio. >> ... >>The user name you selected is: >> >>cypherpu > >The password has been changed to "cypherpunks" > Oops. Thank you for changing the password. Shall we not use writecode unless the site does not allow "cypherpunks" as the password? I get it now. Crypto relevance: http://www.realaudio.com/rafiles/npr/password/nb081801-4.ram The segment is overly optimistically billed as: "Dan Charles reports the Clinton administration has reached a compromise with the security industry about the export of encryption equipment that will protect personal computer files and allow law enforcement agencies access to them if necessary. (3:30)"

1 0

Will Spam For Food (Not Spam) / Re: Spare DigiCa$h? / Re: AN APPEAL TO THE HUMAN RACE
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I find it interesting that the cynical/sinister/paranoid cypherpunk list members seem to be the ones who are most able to predict the future trends of events on the Internet, particularly in areas which surround very major and very minor issues. The Tim May's and Declan McCullagh's shed interesting light on the future course of major events while the Monger's and Dog Boy's turn their precognitive abilities in the direction of the more mundane aspects of the Internet as a reflection of humanity/society. The "Spare DigiCa$h" post gave me pause to reflect how long it will be before technology is sufficiently developed that when we hit our <Pause> key, "CyberBums" will approach and offer to clean our video monitor with an oily rag. Will we be cursed for offering CyberBums a form of e$pare- change which cannot be spent on email-order wine? Will laws be passed which prevent CyberBums from approaching us for e$pare-change within two relay hops of an eCa$h site? Will CyberBums sort through our killfile dumpsters for eTra$h? Was it Kevin Mitrick whose conditions of probation required him to stay off the Internet and away from computers? Will the future bring laws which permit restraining orders against individuals accessing certain parts of the Internet? Sex offenders/sex sites; burglars/financial sites; pedophiles/children's sites? It seems to me that increasing regulations and laws surrounding the access and use of the Internet will require strict laws requiring the user to be able to show verification of identity/age/criminal history/ financial history/(approved government) reputation capital, and all manner of information to place us all in categories needed to monitor our compliance with laws and regulations. Once browsers are required by law to support a certain rating system and children manage to get around it, there will no doubt be laws passed requiring fascist monitoring of who is actually using the software.(And LEA's who demand that phone companies provide them with the ability to trace/locate cellular phone users will undoubtably want the same capabilities with Internet users, in a war against anonymity.) There will be no shortage of James Love's, Kent Crispin's and Hallam- Baker's to call for "reasonable compromise" in order to facilitate fascist censorship on things which we all "unambiguously" agree on (by _their_ way of thinking, of course). The only way to prevent the atrocities perpetrated upon our rights to freedom and liberty in physical space from becoming the norm in CyberSpace is to fight against the systems, the governments and the individuals who are striving to extend their fascist control by building ElectroMagnetic Curtains in CyberSpace, is to prepare now to fight against Electronic Oppression--to prepare for an Electronic Revolution--now. CyhperDog ~~~~~~~~~ {This post contains an Email Rating System classification of: Redundant Cowardly Anonymity.} (This means than an Anonymous Coward is posting in reference to one of his/her own posts under a second anonymous pseudonym.) -------------------------------- The first Anonymous Coward wrote: > amaninneeeedeer443553444(a)aol.com wrote: > > PLEASE HELP > > What follows is an example of the CyberBums predicted by one of the > list members some time back. This A(ssh)OL(e) is using his spambot to > "Spare change?" millions of people at a time and it turns out that > besides his required, basic tale of woe, that he also has the proverbial > parent who is dying from cancer. > > Don't send him any money. > Send *ME* money. I will use it to buy enough cheap wine to enable me > to throw up on my shoes. > (Wouldn't you rather send your hard-earened money to an honest drunk > than to a lying bum?) > > CyberBum > > ----- > > I WAS A SMALL BUSINESS OWNER IN THE ATLANTA AREA. I RAN THIS > > BUSINESS SUCCESSFULLY UNTIL ABOUT 60 DAYS AGO. AT THAT TIME, 2 > > SEPARATE COMPANIES FILED BANKRUPTCY AGAINST ME FOR A TOTAL OF > > $ 47,000. I COULDN'T SURVIVE THAT. > > > > CONSEQUENTLY, I WAS UNABLE TO PAY MY CREDITORS, MOST OF WHOM > > WERE FRIENDS. THEY HAVE FAMILY AS I DO AND I CAN'T LIVE WITH THE > > THOUGHT OF DOING TO THEM WHAT HAS BEEN DONE TO ME. I'VE SPENT > > MANY SLEEPLESS NIGHTS TRYING TO COME UP WITH A SOLUTION. I HAVE > > NO WHERE TO TURN EXCEPT TO MY FELLOW MAN. MY ONLY FAMILY IS > > MY FATHER. HE IS 74 AND SUFFERING FROM DIABETES AND PROSTATE > > CANCER. > > > > I HAVE SLOD EVERYTHING EXCEPT THE CLOTHES OFF MY BACK AND MY > > COMPUTER. AFTER THIS FINAL ATTEMPT FOR HELP, I WILL BE SELLING > > IT. > > > > I WANT TO BE HONORABLE, BUT I CAN'T DO IT ALONE. I WOULD NEVER DO > > THIS EXCEPT AS A LAST RESORT, BUT I KNOW THAT I WOULD HELP > > SOMEONE IF I COULD. > > > > WILL YOU HELP ME?? ANY AMOUT WOULD BE VERY MUCH APPRECIATED. > > THANK YOU > > > > W.E. HENDERSON > > P.O. BOX 486 > > SMYRNA, GEORGIA 30081

1 0