December 2003 - cypherpunks-legacy

Flame Wars
by zoetrope＠infinet.com 17 Dec '03

17 Dec '03

I am sorry if I have annoyed or offended anyone here, It was not my intention of course......I dont want to hold any grudges especially with Sameer....I havent done much cracking and have alot of questions I bet alot of you had when you were 13 anyway zoetrope as in coppolla's studio....again sorry If I offended or annoyed you.... Sincerely, CyberPunc X

3 2

T-Shirts
by zoetrope＠infinet.com 17 Dec '03

17 Dec '03

Ya but a multi million dollar corp like netscape should be paying big bucks for those bugs....Or the mob might...ya get my drift....Alot of people give personalized T-shirts but not everyone can jeapordize a corps existed? Waiting a reply, CyberPunc X

3 2

CYPHERPUNKS EXPOSED
by L.Detweiler 17 Dec '03

17 Dec '03

Attn Reporters and Writers!! who are the CYPHERPUNKS? what are they talking about? what have they done in the past? who are the "leaders"? what do they believe in? what are their *real* goals? My name is L.Detweiler, and I've made a serious study of the more ulterior aspects of the CYPHERPUNKS for several years, and I invite you to peruse my findings at the web site below. I've been quoted in various articles and I'm available for serious interviews with anyone who wants the REAL STORY BEHIND THE CYPHERPUNKS. note: be forewarned that key cypherpunks consider me a heretical blasphemer because of the tenacious, unforgiving honesty and zealous antisychophancy by which I have pursued this herculean study. | /\ |\| /~ L~ ``I have to spew this stuff, or I'd be on the L_ /~~\ | | \_ L_ roof with a high power weapon.'' -Jim Carrey http://www.csn.net/~ldetweil

2 1

looking for anti-tamper software
by ecarp＠netcom.com 17 Dec '03

17 Dec '03

I used to have this C source that I could embed in a program, and it would tell me if the software had been tampered with at runtime. I've lost/mislaid/whatever the source, and I was wondering if anyone had anything that would do the same thing. As I recall, it calculated a simple CRC and embedded it into the .EXE file (it was written for MS-DOS). It doesn't need to be cryptographically secure - I just need to check to see if the executable has been corrupted. I've leafed through alt.sources and comp.sources.*. Thanks in advance... -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/digital pager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi "Past the wounds of childhood, past the fallen dreams and the broken families, through the hurt and the loss and the agony only the night ever hears, is a waiting soul. Patient, permanent, abundant, it opens its infinite heart and asks only one thing of you ... 'Remember who it is you really are.'" -- "Losing Your Mind", Karen Alexander and Rick Boyes

2 1

NYT Markoff Article and one person's response
by fc＠all.net 17 Dec '03

17 Dec '03

I sent the following letter to the editor of the NYT expressing my personal view of the article. Perhaps others on this list should send letters expressing their viewpoints as well. Dear Sir/Madam: I have been reading, with great interest, the responses from security experts all over the Internet to John Markoff's October 11 article titled "Discovery of Internet Flaws Is Setback for On-Line Trade", and I thought your readers might like to know what real experts in the field think about Mr. Markoff's article. While the most recent announcement by Professor Brewer was generally taken as a positive step from American academia in catching up to the rest of the information security world, it is hardly a breakthrough, or even a novelty. To get a perspective on this, an average of about 10 new vulnerabilities of this magnitude or larger are discussed on Internet forums every month. The "CERT" team at Carnegie-Mellon University has published more than 10 similar types of attacks so far this year, the Internet forum "8lgm" publishes an average of more than one per month, the "BugTraq" Internet forum tracks and shows fixes for about two similar holes per month, and the "cypherpunks" forum uncovers several holes in cryptographic and other systems each month. The idea portrayed by Mr. Markoff that businesses rushing to the Internet are largely unaware of these risks is also quite naive. A recent Computer Security Institute study showed that one in every five enterprises has reported suffering an Internet security incident. Most experts believe the reality is much worse and that many who responded "no" either refuse to admit it or simply don't know. Over 50 percent of companies connected to the Internet provide high-risk features such as FTP and WWW to all employees, and 39 percent have no firewall to limit attacks from the Internet. According to several published papers, about 10 times as many attempted attacks are detected when firewalls are in place than are detected when they are not in place. Since the Internet was first introduced, many of the American Universities that have been so active in developing information technology have essentially ignored the security issues. Their ignorance of these issues has produced literally hundreds of protocols that are now in use by millions of computers from all over the globe and which, because of their insecure designs, are inherently difficult to secure. Thousands of individuals from all over the world have spent their spare time, often on nights and weekends, helping other people by developing and freely distributing new security technologies. They have been finding security problems and solving them for many years, most often without recognition or renumeration. They have been trying to tell the people developing these protocols about protection problems and have been widely ignored, with a few notable exceptions, by the American Universities. I personally think that it is a travesty that a relatively minor contribution by a few people at Berkeley gets front page headlines while the ongoing contributions of thousands of volunteers goes largely unrecognized. If you want the real story about electronic commerce and security issues on the Internet, listen to the people who are doing the work every day. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

FT on IT Standards
by John Young 17 Dec '03

17 Dec '03

The Financial times today has four-page insert on the complexity and difficulty of developing international standards for all types of products. There is a passing mention of the Internet security issue. An article on standards for IT confirms Perry's oft-made points about the slow pace, protracted angling for market share, and the by- pass of standards by market go-getters who foster messes. Here are quotes on the last point: Paul Callahan of Forrester Research: "When a company owns a market they can determine the pace -- a company in its early stages of domination can move the ball forward swiftly -- such as the Internet Web software provider Netscape. Netscape didn't spend a lot of time with standards bodies -- it simply joined forces with MasterCard to co-develop Secure Courier, much as Microsoft enrolled Visa to develop its STT, Secure Transaction Technology. Only afterwards are the overtures made to standards bodies. That's commerce, and it's the way things are in the real world." Henry Ryan, convenor of the Iso-IEC JTC1 ad hoc working group on GII: "People ask, 'Can you afford to wait for standards?' I'd turn it round. If you don't, you suffer in the long term and end up with an unholy mess. If people do their own thing then the benefits -- and the problems -- may not be concentrated in one sector of the industry. We're finding that with the convergence of technologies, such as the superhighway, it isn't enough to develop standards for the IT sector, telecommunications, or consumer electronics individually."

1 0

Re: IDEA algorithm
by Jonathan Zamick 17 Dec '03

17 Dec '03

At 6:38 PM 10/12/95, Adam Shostack wrote: >| This may be an odd question, but who is it that owns the IDEA algorithm? >| >| We've had a number of requests regarding licensing RSAREF tying into >| legitmizing PGP products. Part of that includes IDEA obviously. > > Dr Peter Profos > Ascom-Tech AG, Solothurn Lab > Postfach 151 > 4502 Solothurn, Switzerland > v. +41 65 242 885 > fax _41 65 235 761 > > Now go buy a copy of Applied Cryptography, which answers this >and other questions you might have. :) I know.. I blush. I've become such a netjunkie that not being able to find any of the answers on web pages, or Cypherpunk logs I just panicked. Thank you everyone who sent me a message with the reference. I'd say more, but I have to run and get my fix in. (Btw... what would be the absolute coolest thing folk would like to see added to RSAREF? That is, other than code that we will need to negotiate for. What new thing, speed upgrade, enhancement, etc would just tickle?) Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

3 2

Re: Anguilla Cypherpunks Meeting
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:41 PM 10/13/95, s1018954(a)aix2.uottawa.ca wrote: >Really? I thought except for incomes taxes, US laws only apply in American >territory as opposed to applying to American people wherever they are (as >I heard Germany's does). It depends on what is meant by "outside the country." The law forbidding travel to Cuba, for example, is not enforced by U.S. cops outside the country, but upon reentry to the U.S. Ditto for other laws, such as those affecting aid and support of countries we don't like, and the laws about trading with the enemy. >What if you were a dual citizen (US/Canada in my case)? For the purposes of crypto laws (and many other laws, truth be told), Canada is treated as a smallish northern state in the U.S. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

OneTimePasswd (not Pad)
by Laurent Demailly 17 Dec '03

17 Dec '03

Hello, I'm about to implement an OTPasswd (mostly like s/key) scheme to my www browsers/clients/proxy, but I was wondering is the mere principle of storing H^n(S) and requesting H^(n-1) from peer (H beeing your favorite one way strong hash function (MD5), and S your seed+secret passwd) could possibly be patented somehow and thus preventing using a similar scheme without getting a license (from bellcore?),.... if there are any usage conditions/restrictions?,... Also, can one compute the amount of information (if any) leaked by the method, ie, an attacquant who would have all the H^i i={a...b} (by snooping for instance) would have is job easied, and by 'how much' to find S? (or H^a-1) . is there any studies on that for H=MD[45] ? (and what is the status of free use of MDx btw ?) ps: I just an a thought that maybe the last P in elementrix POTP would be Passwd and not Pad... it could still be quite interesting to have H^n(S) (maybe variant with large n) used has 'secret' keys between parties, you'll get lots of plus against standard attacks, provided that there is no problem with know the function H^n for several (possibly large) n... hmmm why this hasn't been implement ? what obvious flaw am I missing ? dl -- Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|... Freedom Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept Soviet NORAD SDI $400 million in gold South Africa plutonium KGB

2 1

The Economist on Netscape "hackers"
by Raph Levien 17 Dec '03

17 Dec '03

Looks like every cypherpunk's favorite newsweekly has slipped a bit. This week's Economist (Oct 7-13, 1995, pp. 77-78) has a story about banks getting on the Internet, and some of the security risks involved. It's not _too_ bad, but, well, judge for yourself: "By far their biggest worry, however, is the threat posed by computer hackers. In recent months, numerous defects have been detected in the state-of-the-art Navigator program developed by Netscape, the leading maker of Internet ``browsing'' software. Earlier this year, a French hacker broke the program's code, albeit with the help of 120 computers. Although Netscape claims that the glitches in Navigator have now been smoothed out, their very existence has shaken confidence. ..." Sigh. No mention of export restrictions (I wanted to add "of course," but for the Economist it shouldn't be an "of course"). Shall I write the letter to the editor, or does someone else want to? One thing I'll need is a brief outline of Damien Doligez's acheivements to support the idea that characterizing him as a "hacker" is not quite right. Raph (who's wondering if there's something inherent in the media process that keeps them from getting their stories straight)

4 3