December 2003 - cypherpunks-legacy

SAFE Gut Amendment
by John Young 17 Dec '03

17 Dec '03

Thanks to Declan we offer the full text of the "Amendment in the Nature of a Substitue to H.R. 695 Offered by Mr. Goss and Mr. Dicks," passed by the House Intelligence Committee on September 11. http://jya.com/hr695-amend.htm (63K)

1 0

Seattle Cypherpunks
by Joel McNamara 17 Dec '03

17 Dec '03

Seattle-area Cypherpunks Get Together Thursday, September 28 7:30 PM Seattle Center House/Food Circus Entrance opposite the Flag Pavillion look for a table with a Compaq laptop busily signing keys This is a very informal, unstructured get together. More of a chance to meet other folks with similar interests. With all of the recent activities in crypto-land, I'm sure there will be lots to talk about. Bring a disk with your key so I can put my ancient 386 laptop to some good use. I'll also load up some relatively new Windows crypto software for show and tell. Eastsiders (Bellevue/Redmond environs) that don't feel like braving the bridge, let me know. I've got a van and will be headed west from Carnation and would be happy to car-pool. Hope to see you there... Joel McNamara joelm(a)eskimo.com - http://www.eskimo.com/~joelm for PGP key Thomas Jefferson used strong crypto, shouldn't you?

1 0

Re: netscape bug
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DFALB4.A5u(a)sgi.sgi.com>, "Perry E. Metzger" <perry(a)piermont.com> writes: > I can tell you in general terms -- I don't write MIPS assembler > myself. However, I will point out to you that you use an ancient > Sendmail, and that it uses syslog(3) on user produced data, and that > syslog uses a static buffer. Trick sendmail into logging something > very big, and you can do what you like. The 8lgm people wrote a demo > for Sparc as a proof of concept. Hmm, after having looked at the syslogd code, it looks like this particular bug has been fixed for at least several years. However, there sure are a hell of a lot of fixed size buffers being alocated off the stack and some of them are being used in unsafe ways. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

2 1

"Going after Netscape"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:37 AM 9/23/95, Jim Ray wrote: >I'm with Lucky, let's go after Netscape itself. They deserve it more >than their customers do, and they would then have a strong motivation ><evil grin> to fix it. The press release would then *only* involve >Netscape, and maybe a few C-punks could buy a few Netscape puts ;) >and donate the bucks made for something like Tim's stable remailer. I think we need to be very careful not to do things like we have a vendetta against Netscape. Netscape has a Cypherpunks presence, of course, and His Andreeseeness was even on the list for a while last December. Today's "San Jose Mercury News" had a photo of Goldberg and Wagner and a fairly long article about how James Barksdale, Pres. of Netscape, plans to hire them to help improve Netscape's security. He even made noises about thanking them for their cracking efforts, and said improving Netscape's security is a high priority. It's sort of hard for me to imagine a company being more "Cypherpunks friendly" than this. (I mean about the issues that interest us.) So, keep on "attacking" Netscape (kudos to Ray, by the way, though I've seen Netscape bomb on certain sites, as with the Cypherpunks archive site, as several of us noted a few months ago...probably a different problem, but indicative that Netscape can be corrupted). But let's be careful not to convey any flavor of this being a vendetta. --Tim May Notice: Don't expect me to reply to trivial questions and complaints. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Test [No Reply]
by Jim Choate 17 Dec '03

17 Dec '03

Link Test No reply required

1 0

macworld crypto articles
by steven ryan 17 Dec '03

17 Dec '03

The current (11/95) issue of MACWORLD magazine has two good crypto articles in it. 1 - Protect your E-Mail by Bruce Schneier Good introduction for neophytes, the basic how and why. Get some reprints and give them away with PGP to your nonCypherpunk computer friends. 2 - False Security by Gene Steinberg They searched for an applications programmer *UN*skilled at cryptography to try and crack the password protection of the 8 best selling Mac programs. Quicken 5.0 was cracked in 5 minutes. Adobe Acrobat in 2 hours. Steven Ryan sryan(a)reading.com

1 0

Link Test [No reply - last one]
by Jim Choate 17 Dec '03

17 Dec '03

Link Test No reply needed This is the last one

1 0

Re: The Next Hack
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199509231919.MAA01818(a)infinity.c2.org>, sameer(a)c2.org (sameer) wrote: >> >> What exactly is the point of this? We have: > > Is Netscape going to cover the cost of getting the new keys >that the servers generate signed and certified by Versign? Is netscape >going to tell its customers that they need to regenerate their >keys and get new certificates? > > Like I've said, I'm very impressed with netscape's quick >response and almost everything they've done. I would be even more impressed if Netscape made their code publicly available for examination. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMGRoeyoZzwIn1bdtAQGg4wF/XTLT2U7mXi2MZ5pgSZQMd9VdLZJcp5MD wgBWaGCNIzsQnkwB4ZkTyjJAOwFf0OkJ =+ZRt -----END PGP SIGNATURE-----

1 0

HEY!!! WAS: The Next Hack
by carolann＠censored.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hey wait a minute!!! You HAD stated a patch would be available by Friday. Now we are at early next week. I watched the stock rise in the face of bad facts. Almost 25% of your stock changed hands yesterday. For the moment, it seems to me, anyway, you're getting a lot of work done here for dirt cheap. I don't know cypher codes very well, but I know Wall St. codes really well. And THEY ARE BEING VIOLATED! I am glad there is no anonymity on Wall St. We are starting to get into the realm of SEC action. And I could really care much about what happens out on the list. This is not a problem that lends itself to 'quick fixes'. For the only "quick fix you can give is still insecure crypto". That is the point of this. You can't really fix it. Most of us know it. The lies mount up on the stock price. I normally couldn't care less, I'm a Coca-Cola trader. My stock is at an all time high as I write this. It's up over 1200% in 10 years. No one can match it. (even MSFT) This is much worse than NEW COKE! For you are now better off letting them break key after key, server after server, until the laws change. I'd go back and talk to your management fast. For now you've become a pawn in a political game. And millions of dollars change hands daily as a result. Soon they will halt your stock trading if this keeps up. Something, in a way far worse than ever having Netscape cracked! Think about it. Love Always, Carol Anne ps I shipped all the postings to Washington already. > What exactly is the point of this? We have: > > 1) acknowledged that the RNG used in the server private-key > generation has the same problem > > 2) said that we will provide a patch early next week > > 3) said that we will provide new certificates for all customers > > 4) promised to make source code for our new seed generation code > publicly available > What else do you hope to gain by breaking a server key? I think >Jeff Weinstein - Electronic Munitions Specialist >Netscape Communication Corporation >jsw(a)netscape.com - http://home.netscape.com/people/jsw >Any opinions expressed above are mine. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGP6MIrpjEWs1wBlAQFh3QP8D+m5NyD4WNZEyOSzollcUDqEQusjxr5s 0t9455KBAGnvt/5UAyaQ0JdDqZ3wRePsoC9VVxHiiITjhZGbwalcgrDVmajAXVbG T+Hm4PEpM7tWt+R6pMvjhGcP2ldtzZf+OErE/yCSPTooxuOX5H6bBpb5e88n0eqo JpbxSBXgCX4= =C7J9 -----END PGP SIGNATURE----- -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

3 2

The Next Hack
by sameer 17 Dec '03

17 Dec '03

Now that we've seen that Netscape is doing a good job towards trying to fix the hole that Ian and David have uncovered, it's time to start looking at new things. Given the recent post to the www-security list that was forwarded here, it seems like just replacing the server may not work for all the secure servers out there-- keys may have to be replaced as well. Let's find out. Proposal for action: 1) Reverse-engineer a server to see if the keygen phase uses a weak RNG seed. -- if so, determine the exact algorithim. 2) Organize a net-wide search over the space of the RNG seed to crack the private key of some well known secure server. 3) Release the private key to the net. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 An Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

5 6