December 2003 - cypherpunks-legacy

Re: responce to graphic encryption replies
by jps＠monad.semcor.com 17 Dec '03

17 Dec '03

> ... The graphic file is going to have a highly correlated > structure, long runs of white space etc. This is not the case for digital imagery. For any given band, if you sample a significant portion of the image it would not be surprising to see a more or less random distribution over the range. > The statistics for such a file > would be different than the random distribution you'd get from using the > wrong key. If you decrypt with the wrong key, do you get a random distribution? Would this be the case for all wrong keys? Would the statistics change in any discernible pattern as the keys got "closer"? > Even if the graphics format is compressed, leading to a more > even distribution, ... This may give a better result. Most compressions involve a shift to the frequency domain with a quantization of the samples. You might be able to write a detector based on this discontinuity. You could also try throwing an edge detector or some other morphological recognizer at the output. It would still be cheaper than having to a man in the loop, but you're going to spend a lot of cpu time. jps -- Jack P. Starrantino (215) 674-0200 (voice) SEMCOR, Inc. (215) 443-0474 (fax) 65 West Street Road jps(a)semcor.com Suite C-100 Warminster, PA 18974

2 1

Re: Certificate proposal
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DGF06D.HGJ(a)sgi.sgi.com>, daw(a)lagos.CS.Berkeley.EDU (David A Wagner) writes: > In article <199510120147.LAA13833(a)sweeney.cs.monash.edu.au>, > Jiri Baum <jirib(a)sweeney.cs.monash.edu.au> wrote: >> What you are missing is that you should not say >> "I want to send my credit card number to Egghead Software" >> you should say >> "I want to send my credit card number to 12 34 56 78 9A BC DE F0" > Why does this sound so much like defining the problem away? > Maybe I just don't get it... I agree. Sending your cc# to a key or an IP address is not what you want to do. As a consumer, I want to make sure that I send my cc# to the merchant I am buying from. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

2 1

old doc cohen
by an116512＠anon.penet.fi 17 Dec '03

17 Dec '03

<<this post was written by me and two other people who have been watching cohen's career for the last few years. i'n sorry for the spelling mistakes and typos.>> dr frederick b. cohen's frequent rants in which he expresses nothing but contempt for everyone else in the security and crypt business have to be understood in their context: he's trying to sell something. what's he selling? who's he trying to sell it to? there are several answers. all are partly true and taken together explain his posts pretty well. directly, he's trying to get us to buy his products, services, and books, or at least recommend them to others. it is obvious how setting himself up as the only one who recognizes these serious flaws would enhance his consulting business. he doesn't care about netscape or pgp. he cares about his wallet. indirectly, he's testing out halfbaked ideas here to better learn how to refute those who see through their weaknesses so that he'll be better prepared when he spews in more "serious" forums. this is a low risk place, as far as he's concerned, to make a fool of himself. socially, he's selling the idea of his own academic respectability. notice how he reminds us he's "dr." (look at me! i have a doctorate!!!) cohen. the truth is he never managed to get the respect of the mainstream academic and research worlds. he's been reduced to playing the role of victim-soothsayer. we'll all regret not listening to him back when we had the chance, one of these days. look at the reaction to his "seminal work" on viruses for a great example of how the real research world yawns at him to understand why this is so important to him. he feels cheated out of the respect he deserves. (he's willing not to care about his wallet to the extent that he gets this) psychologically, he's selling the idea that he's respectable to himself. ultimately it doesn't matter that most of us see right through him as long as he gets enough people listening to him to feed his very delicate ego. he needs us (someone, anyone, even us cypherpunks if that's what it takes) to love him and take him seriously. it's very sad. let's just ignore him. he'll find somewhere else to play (he always does). --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

Re: Postscript in Netscape
by lyalc＠mail.mpx.com.au 17 Dec '03

17 Dec '03

> >WRONG!!! Netscape claims to be "secure" - hence it is Netscape's job to >be secure - regardless of the user's use of their product. Otherwise, >the ads should read: > > "Netscape can be used securely by sufficiently knowledgeable > users who have emasculated their postscript interpreters before > using them to view files of unknown origin, and who have removed > all other known, unknown, and/or undisclosed security holes from > their systems. Otherwise, Netscape is insecure and should not be > trusted." > >-- cars are claimed to "safe". That only applies is driven sober, within speed restrictions and road conditions by a (basically) trained driver. The same analogy applies, in my view. lyal

1 0

PGP interface for Mac--well...
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

Has anyone seen this yet? The only upload I've seen, on info-Mac, unbinhexes into something called "My Preschool Demo," and that's pretty much what it is. http://hyperarchive.lcs.mit.edu/HyperArchive/Archive/cmp/ mac-pgp-control-10b1-as.hqx >From ~/mac-pgp-control-10b1-as.hqx.abs >Abstract of INFO-MAC archived encoded Mac binary file > 'cmp/mac-pgp-control-10b1-as.hqx' > Uploaded 10/20/95 250028 bytes > >From: raif(a)mpx.com.au ( Raïf S. Naffah) >Subject: MacPGP Control 1.0 Beta 1 > >Hi there, > >Please find attached the first public release (Beta 1) of the MacPGP >Control application. > >MacPGP Control (or MPGPC for short) is an AppleScript application --written >in AppleScript English dialect and FaceSpan 2.0.1-- that offers an >easy-to-use, more Macintosh friendly user interface to MacPGP. > >The main features of MPGPC are: > >1. [Mac]PGP related features: >* Allows definition and use of nicknames for Users and Groups recepients. >* Offers more control for keyring related actions, through a true Macintosh >Human Interface and -in some cases- direct manipulation of keyring file >data, including: editing trust flag byte, enabling/disabling, extracting, >checking, certifying, fingerprinting, and forcing Warn-Only bits. >* Secure clean clear-signed PGP ciphers, through the implementation of >features such as: expanding tabs, transliterating non-USASCII characters, >and word-wrapping lines before processing and handing over to email >application. >* Allows viewing of PGP packets for educational and debugging purposes. >* Allows opaque signing (asciified clear-signed text) >* Supports (low-level) and use HTTP for PGP Keyserver querry and update of >public key information. >* Transparent use of user's UserIDs found in his/her secret keyring file. >* Allows encryption for multiple recepients. >* Generates Key Revocation Certificates. > >2. Eudora related features: >* Supports latest Eudora versions (2.1.3/1.5.3) known to break certain scripts. >* User-configurable Auto Move PGP messages to designated mailbox. >* User-configurable Auto Decrypt source data before processing. > >3. Macintosh related features: >* Handles encrypting/decrypting messages larger than 32K internally, while >allowing editing of the top/first 32K chunck. >* Extensive support of drag-and-drop. >* Documented handlers calls for use by other scripters. > >To run MPGPC you need: > >1. The Scriptable Finder, >2. Geneva font family, >3. MacPGP (tested with the 2.6ui and 2.6.2 versions), >4. The following additional extensions should be in the Extensions folder >inside the System Folder: > * AppleScript, > * FaceSpan Extension v2.0.1, which lives on > <ftp://199.72.251.93//pub/sdu/FaceSpan/FaceSpanext20.sea.hqx> >5. The following osaxen which should be part of the standard distribution >of the Scriptable Finder, and which should reside in the Scripting >Additions folder inside the Extensions folder: > * Choose File, > * Display Dialog, > * File Commands, > * Load Script, > * New File, > * Numerics, > * programmer's tool, > * Read/Write Commands, > * Store Script, > * String Commands. > >MPGPC is a freeware. > >cheers;

1 0

Re: 50 attacks... [NOISE]
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DGpCsv.9r5(a)sgi.sgi.com>, fc(a)all.net (Dr. Frederick B. Cohen) writes: > And how secure is the hash? It it possible to create values that will > hash to each prime (or something else that does the job)? Is the hash > something we can figure a way to precompute using massively parallel > processing so that we can then provide a set of codes which will produce > the desired results? (etc.) Perhaps you should consider learning something about cryptography before you cast aspersions on someone else's cryptographic protocols. To date, MD5 appears to be a secure hash. If you manage to find a way to reverse it, please let us all know. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

1 0

Re: Netscape rewards are an insult
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DGq01x.ADx(a)sgi.sgi.com>, Aleph One <aleph1(a)dfw.net> writes: > On Thu, 19 Oct 1995 anonymous-remailer(a)shell.portal.com wrote: >> > NETSCAPE CLIENT APIS (NCAPIS) 2.0 >> Generally, we don't routinely trust every other computer, foreign or >> domestic on the Internet to manipulate us by remote control. This is >> as basic as the idea that we don't give out our PIN numbers with our >> banking cards to anyone who asks us. > Have you actually read the stuff? The NCAPIS is not on by default. > You *must* enable it by tellling it to which port to listen on. > Further more Mosaic had a remote control API before Netscape did. They can also be used only from the local machine on Windows or from any machine your X server trusts on Unix. Unless the attacker can control what software is installed on the target system, there's no way for him to use this to his advantage. Of course, there's always the possibility of exploting bugs, but that's not a "flawed algorithm". -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

1 0

Dr. Fred
by rah＠shipwright.com 17 Dec '03

17 Dec '03

While Dr. Fred may have a (diminishing) few defenders left on this list, I have found that <Plonk!>ing him was useful, at least until his latest series of trolls stirred up the unaware. I agree with the people who say that if he's ignored, he'll go away. After all, it has worked before, yes? Prove to me it won't work. ;-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: 1(800)MY-ANI-IS
by amp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Date: Friday, 20-Oct-95 07:58 AM From: John McGough \ Internet: (john.mcgough(a)mail.industry.net) To: amp \ Internet: (alan.pugh(a)internetmci.com) Subject: 1(800)MY-ANI-IS JM> Looks like MCI is looking for a authorization code during that JM> tone. Do you have any idea how many digits is standard on their JM> stuff? Or better yet, if you figure it out, please let me know. JM> I'll do the same. while i wouldn't be at liberty to get you a valid code, (i'm not sure of the number of digits it wants as i haven't gotten mine yet), i would suggest you call one of mci's customer service centers and _politely_ request that they allow access to this service to non-mci employees. i would suggest that they put some kind of message on the number before they give you the ani like "this service provided by mci." i would see this as a good public relations tactic for the company for telecom-type folx who would be using it. my 2 cents. unfortunately, i don't speak for my company. amp <0003701548(a)mcimail.com> <alan.pugh(a)internetmci.com> PGP Key = 4A2683C1 PGP FP = A7 97 70 0F E2 5B 95 7C DB 7C 2B BF 0F E1 69 1D October 20, 1995 10:11 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMIeuJCgP1O9KJoPBAQEEqAf8DAWR7BJ3SmuPNlXLpgdSmx/lPHFEQlU0 y71SR2D9h5S8cVlhWxpG/vPutCOVRwriLZD4/CP0AwOftm6LuqXY1O6o8B4us8OC BeqAvm5iQRDZ1xyPHofT0vjxytUp40SQ08mvYsCYxDTFZIvlgx8dk4O/Pt8Kt0Ka kDzkKHG3t/cJbr5oDjPtLNqUz4GrQY75qemxb1j/GvwEauC5+/pDaaqrzuQiwgB3 sMqBiyCqNflL/IxhKvxA5gKBXAzQoUuX7JZm5E52gWKPHEmx1OuceTPxYupcqmnv 6s2pBpXrE8WvpKAyrFkBxhv0EUhdu2FqSOns4VMPAqk8lHlAsxTh3w== =D7Uw -----END PGP SIGNATURE-----

1 0

Denver area meeting, SUNDAY, 10/22, 2 pm
by adwestro＠ouray.cudenver.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- As usual, we'll congregate in the food court in the basement of the Tivoli, and probably wander to a nearby restaurant when we have a quorum. I'll try to remember to bring my newly acquired copy of _SOLVING CIPHER PROBLEMS, Cryptanalysis, Probabilities, and Diagnostics_, by Frank W. Lewis, for perusal by anyone interested in classical cryptanalysis. Email for directions, additional info, etc. Alan Westrope <awestrop(a)nyx10.cs.du.edu> __________/|-, <adwestro(a)ouray.cudenver.edu> (_) \|-' 2.6.2 public key: finger / servers PGP 0xB8359639: D6 89 74 03 77 C8 2D 43 7C CA 6D 57 29 25 69 23 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIexV1RRFMq4NZY5AQFk0gP/YJpNdaD9LP0/u+fkkGHV1DdQ2X0Zxb/U 263M6fn3aoe0voEjfgH791SeHuhbQcuK30SaeVbn59tZDbbMmiZi9qFp5wUwFxVZ c27pkR9cCs0jKwPSuuofMWqKCMuWjuQdHRFtpAUSSq0QG8VUCnKh7Imda2TXGI4D t0pRiz2JGe4= =X3HL -----END PGP SIGNATURE-----

1 0