December 2003 - cypherpunks-legacy

Archives current again
by Leslie Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've just updated the archives (http://www.hks.net/cpunks/index.html) To bring everybody up to date on what's happening: Hypermail simply isn't up to this size of an archive. All sorts of bugs are coming out into the open, so I've been implementing a system designed for large archives. Alas, reality has intruded and I haven't had the time to finish it. So, I'll be updating the archives by hand from time to time until I can get the new system on line. Sorry 'bout that, folks, but you get what you pay for. - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMGgVHCoZzwIn1bdtAQE0gwF/dQiO+4lTabDqAt0SgyHmEJSKXgCABGa6 kEOsJIgd/4uIUzrunV+fXBucevMsW4yG =BngF -----END PGP SIGNATURE-----

1 0

Re: Hack Microsoft?
by RJ Harvey 17 Dec '03

17 Dec '03

At 10:33 AM 9/26/95 EDT, Dan Bailey wrote: >On Tue, 26 Sep 1995 00:04:08 -0400 (EDT) you wrote: > >> >> >> Microsoft recently got C2-security status approved for Windows NT by >>the National Computer Security Center, a division of the NSA. They >>are supposed to put systems through "laborious testing and review" before >> If Cypherpunks can find flaws that the NSA can't, or won't divulge, >>what does that say about their so-called COMSEC ability. >> >For fun ways to hack NT, check out http://www.somar.com/security.html. > Some of these are really laughable. You can use NT's LogonUser API >call to repeatedly guess passwords until you hit it, since NT offers >no way to limit number of login attempts. I don't believe that's correct; under User Manager, select the Account option under the Policies menu item; it lets you select whether to lock-out the account after a given number of invalid logon attempts, and to set the number. The main problem here is that by default, I don't believe the 'lock out' option is enabled (and thus, brute-force attempts at Guest or a similar account might indeed work). rj --------------------------------------------------------- R. J. Harvey email: harveyrj(a)vt.edu WWW for job analysis/personality: http://harvey.psyc.vt.edu/ PGP key at http://harvey.psyc.vt.edu/RJsPGPkey.txt

1 0

Re: Hack Microsoft?
by Mike Markley 17 Dec '03

17 Dec '03

Dan Bailey <dan(a)milliways.org> writes: | There also is no way to stop remote users from modifying the | registry. *Any* user with an account can remotely dump and modify the | system registry. So in theory you can write a bruteforce program to | keep guessing until it gets a password, then modify the registry to | make the system to "interesting" things. The worst part of all this | is that the Registry is very poorly documented, MSoft must consider | most of that info "confidential." | Fortunately, when using NT's SMB services such as drive and file | sharing, passwords are never sent in the clear. Just make sure you | disable that "Guest" account.:) This is not entirely true. If I log in as 'guest' I cannot modify just any key in the registry. I can only modify the ones that I have permissions to change. Also if you know what you are doing you can set permissions on any key in the registry so that it can't be modified by just anyone. I can also modify the account permissions so that if a logon attempt fails, after a specified number of retries the account is locked and will not accept logons until the administrator unlocks the account. I'd recommend that you get a copy of Windows NT and the Windows NT Resource Kit, install it and play around with the security system before you make generalized statements about it. Mike. ===================================================== Mike Markley <mmarkley(a)microsoft.com> I'm not a Microsoft spokesperson. All opinions expressed here are mine. =====================================================

1 0

RE: More on "Entropy"
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DFHJDD.Ap(a)sgi.sgi.com>, David Van Wie <dvw(a)hamachi.epr.com> writes: > David Van Wie wrote: >>> The entropy E is defined by the sum across n states of -P_i log_2(P_i), > Timothy C. May wrote: >> Hah! Another physicist converted to the information-theoretic view of > entropy! > Indeed. I was able to track down the literature, and it is most > interesting. I am still a little bit skeptical of the "superset including > thermodynamic entropy" school of thought, but I haven't finished reading all > of the materials yet! Clearly, the IT "version" of entropy is a well > defined and useful thing.... We used this formulation of entropy in Statistical Mechanics. It's especially useful in Quantum Thermo where you can actually enumerate all of the states instead of relying on probabilistic arguments. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

1 0

Re: Golden Coy Freeh
by mkj＠october.ducktown.org 17 Dec '03

17 Dec '03

PGP message

1 0

Re: Security Update news release
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <9509251617.ZM167@tofuhut>, jsw(a)netscape.com ("Jeff Weinstein") wrote: >-- >--PART-BOUNDARY=.19509251617.ZM167.tofuhut >Content-Type: text/plain; charset=us-ascii > > Here is the press release we put out this morning regarding the fix >for RNG seed and stack overflow problems. Do the new versions use PGP's randseed.bin? If Netscape even only looks at data used to keep PGP secure, Netscape will be banned from my computer and every computer I am responsible for. -- For good. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMGduUCoZzwIn1bdtAQFEgwGA3265JY1cahyqqd2VEe+1RPXI96DQBPRV r1EWdjxzjgXvxplLMagh9yWOPBq9OKRX =F3qb -----END PGP SIGNATURE-----

2 1

Re: Netscape "random" number seed generator code available
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199509251159.EAA08528(a)mycroft.rand.org>, jim(a)acm.org (Jim Gillogly) wrote: >I'm nervous enough about all the Easter Eggs that have been reported in >Netscape, like the secret keystroke shortcut to get to Fishcam, or the >different behavior it exhibits when it finds a certain obscurely-named >directory at the top level. Would you please elaborate? TIA, - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMGdsfSoZzwIn1bdtAQG3ZwGAk5ZFceYsUmo9OgQJ9oVZGcNcXnorr9a2 cLP/xy3vB/COr3uKjfr0mcYY6JMMLxfa =nXHi -----END PGP SIGNATURE-----

3 2

Re: cypherpunks press releases/contact list
by mkj＠october.ducktown.org 17 Dec '03

17 Dec '03

PGP message

3 2

First Payments WG Meeting Announcement
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

The World Wide Web Consortium is holding a Workshop on payments. The workshop is intended to be a small, technically oriented meeting of its payments working group. Although it is a members only event I am willing to listen to special pleading, alternatively companies may wish to join the consortium at our extreemely reasonable rates. See http://www.w3.org/pub/WWW/Consortium/ for details. -- Phillip M. Hallam-Baker Not speaking for anoyone else hallam(a)w3.org http://www.w3.org/hypertext/WWW/People/hallam.html Information Superhighway -----> Hi-ho! Yow! I'm surfing Arpanet! ANNOUNCE: First W3C Payments WG Meeting, October 11 ---------------------------------------------------------------------------- What: 1st W3C Payment WG Meeting Where: MIT EECS, Grier Room 34-401 (subject to change) When: Wednesday October 11, 9am - 5pm Who: W3C Member Representatives ONLY URL: First W3C Payments WG Meeting W3C is making progress on supporting electronic payments on the web. This WG Meeting has been called to foster discussion and feedback between W3C and its members. Discussion will focus on proposals to the W3C for payment protocols, interfaces, and e-commerce support. The agenda for the electronic payment workshop is still being settled. At the current time we have confirmed presentations by VISA, IBM, W3C, and the Financial Services Technical Consortium (FSTC). Additional invitations have been issued, and suggestions for additional presentations would be welcome. Contact Phillip Hallam-Baker (hallam(a)w3.org) or Jim Miller (JMiller(a)w3.org) with suggestions. There is a separate W3C Security WG Meeting at MIT on Tuesday, October 10th. Contact Rohit Khare for details (khare(a)w3.org) To RSVP for the Payments WG Meeting, email the coordinator, Phillip Hallam-Baker (hallam(a)w3.org) or call 617/258-5967 by 5 October. This workshop is aimed at technologists; please include a brief description of any relevant payments work you or your organization are involved in. This is a preliminary announcement of the date and time only. We have arranged for hotel rooms at the Kendall Square Mariott. To qualify for the MIT discount, notify Susan Hardy (susan(a)w3.org) For a review of the Consortium's plans, see W3C's report on Electronic Payment Schemes and the Third W3C Security Workshop.

1 0

Re: getting netscape to support the remailers
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> I started thinking about what it would take to get Netscape > to support sending mail through the remailers, after having > read the S/MIME specs which Netscape 2.0 is apparently going to > support. Perhaps with enough browbeating Netscape 3.0 will support > the remailers. Netscape doesn't need to support remailers explicitly since Netscape will be supporting Java. I think a remailer client is within Java's capabilities... Anyone disagree? andrew

4 3