December 2003 - cypherpunks-legacy

NYT on Internet Flaws
by John Young 17 Dec '03

17 Dec '03

The New York Times, October 11, 1995, pp. A1, D3. [Page One] Discovery of lnternet Flaws Is Setback for On-Line Trade By John Markoff San Francisco, Oct. 10 -- Newly publicized weaknesses in the basic structure of the Internet indicate that the worldwide computer network may need a time-consuming redesign before it can be safely used as a commercial medium. The flaws could allow an eavesdropper or criminal to divert many types of documents or software programs traveling over the Internet, examine or copy or alter them, and then pass them on to the intended recipient -- who would have no easy way of knowing that the files had been waylaid. Not only could electronic mail be read in transit or credit card numbers be copied en route, but special security techniques meant to protect such transactions could be dismantled without the user's knowledge. That such security flaws exist is not surprising in a system designed originally as a scientific experiment. But the recent rush to the Internet by companies seeking to exploit its commercial possibilities has obscured the fact that giving the system a new purpose has unearthed fundamental problems that could well put off true commercial viability for years. "Companies would have you believe this is a trivial problem," said Eric Brewer, a professor of computer science at the University of California at Berkeley. "But now there is a financiat incentive to exploit these flaws and to do it secretly." The problems were described in a posting that researchers at the university made on Monday to several on-line discussion groups. While the discussion groups are intended for computer security experts, they are potentially accessible to millions of Internet users -- including break-in artists, who are known to monitor such discussion groups for tips on new ways to crack computer systems. The researchers who described the Internet weaknesses include two Berkeley computer science graduate students who noted a security weakness in a popular Netscape Communications Corporation software program last month. Then as now, the students' stated motivation in publicizing the problems was to underscore vulnerabilities facing all companies and customers wishing to use the Internet for commerce. When the Netscape problems were disclosed last month, the company said the security flaws would be corrected in the next version of its software, which users would be able to download at no charge from Netscape's Internet site. But the newly publicized flaws in the Internet itself indicate that even if a user downloaded a copy of the new, improved Netscape program, a criminal could tamper with the copy along the way and make it unsafe for use in credit card transactions. The problem is not Netscape's alone; it potentially affects any organization that operates a computer from which files or software could be downloaded over the Internet. The weakness can be traced to the technical underpinnings of the network, which was set up more than a quarter-century ago not as a medium for conducting business but as a way for academic and scientific researchers to exchange information. The disclosure of the flaws casts doubt on the aspirations of companies like Netscape, which last summer had one of the most successful stock offerings in Wall Street history based on the promise of the impending arrival of a full-fledged on-line marketplace. "Companies should take a step back and think about this a little more," said Ian Goldberg, one of the Berkeley students. "If it takes a bit longer but comes out more secure, we will all be better off in the long run." The way many Internet systems are set up -- especially the Internet's increasingly popular World Wide Web service in which software images and even video and audio clips can be easily downloaded -- information is stored on a computer called a file server and then transferred to a user's computer when it is needed. The newly publicized weakness occurs in a widely used Internet protocol -- or technical standard -- known as the Network File System, or NFS. Because NFS does not have any means for allowing the recipient of a program or document to verify that it has not been altered during transmission from the file server to the user, any interception or tampering would go undetected. "The Internet protocols have been insecure since day one," said Jeffrey I. Schiller, the manager of computer networks at the Massachusetts Institute of Technology and director of an industry task force that is trying to design a new secure version of the Internet. But the group's timetable is uncertain, and even when it does have recommendations ready, Mr. Schiller is not optimistic that the industry will be willing to devote the time and money to put them into effect. He said that many technologies already exist for improving commercial security on the Internet, but many of them require too much technical sophistication on the part of computer users. He criticized makers of hardware and software for not moving more quickly to make easy-to-use security features a built-in part of the technology used on the Internet. "The people who should be the leaders in offering security have been too busy counting their money to build these features in to their products," Mr. Schiller said. Some commercial Internet merchants have tended to play down the potential for harm from an illegal interception of credit card information over the Internet. They point out that consumers routinely make their credit card numbers available in transactions done by mail or telephone and that the law puts limits on a consumer's liability in cases of credit card fraud. But Mr. Brewer, the Berkeley professor, said that the crucial difference in the proposed Internet commerce systems was that for the first time it would be relatively simple for a criminal to collect hundreds or thousands of credit card numbers. Then a thief could use each credit card only one time, making detection much more difficult. Sensitive to heightened concerns about security, Wells Fargo, the large California bank, which earlier this year began permitting customers with personal computers to view their account information with the Netscape software, suspended the service in September after the Berkeley students reported the flaw in Netscape. After Netscape followed with an improved version of its software, Wells Fargo officials found it secure enough that they planned to resume the service later this week. The bank will, however, require customers to use the corrected version of the Netscape program. Even then. Wells Fargo customers will be able only to view account balances and other information, but not transfer money or conduct other transactions of the type that might leave them vulnerable to the Internet NFS weakness. "We still hope to be able to offer transactional capabilities next year, but this has slowed us down a little bit," said Lorna Doubet, a Wells Fargo spokeswoman. "Many of our customers feel that security is absolutely essential and we have to be cautious in this regard." Executives at Netscape said yesterday that they were aware of the security issues surrounding NFS and would make changes in the next release of their software expected before the end of the year to permit a recipient of a downloaded program to check it for signs of tampering. And hoping to take advantage of the fault-finding talents of the Berkeley researchers and other like-minded software experts, the company announced a contest today called Netscape Bugs Bounty, in which Netscape will award prizes to users who find bugs or security loopholes in its software. Some Internet experts said they expected that many security weaknesses like the one the Berkeley group had demonstrated would be found, because the Internet was simply not designed to insure secure commerce. "Imagine a walled town or a house," said Noel Chiappa, a member of the Internet Engineering Task Force, a standards-setting group. "It doesn't matter if 99 windows are tight as can be -- if the 100th is wide open, the bad guys will bypass your security. " [End]

3 2

Re: MITM evasion
by Jay Campbell 17 Dec '03

17 Dec '03

The message below (posted earlier today) caught my attention - I believe it is a (fake?) MITM-generated message, because Tim's sig file has changed recently (new domain name (got.net) and a disclaimer was added). The sig attached to this anonymous message is at least a month out of date. Even if this isn't just a mistake, it's not a true MITM attack, since this is a third party /not/ between Tim and toad.com ... more of a spoof. Do I win anything? >Return-Path: owner-cypherpunks(a)toad.com >Date: Wed, 11 Oct 1995 09:55:07 +0100 >Subject: MITM evasion >To: cypherpunks(a)toad.com >Subject: MITM evasion >From: anon-remailer(a)utopia.hacktic.nl (Anonymous) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >Organization: Hack-Tic International, Inc. >Comments: Hack-Tic may or may not approve of the content of this posting >Comments: Please report misuse of this automated remailing service to <postmaster(a)utopia.hacktic.nl> >Sender: owner-cypherpunks(a)toad.com > >Two years ago, I pointed out that getting a single message past >the man in the middle isn't good enough; you have to convince your Unconvinced, for one ^^^^^^^^ >readers that the key they received on one channel is more accurate >than the key they're receiving on all the other channels. >But if they'll believe that, they may also believe the man in the middle's >announcement that the key in your name on all the keyservers is >wrong, and the correct key is the one he's putting out. >Can't win either way, but it's still important to get the key out. > >My current key is 0x54696D4D; the fingerprint is >4D 65 44 75 53 61 21 2F 41 73 55 64 85 6D 21 7F. This key isn't registered with the MIT keyserver; not proof in any sense, but worth mentioning. > >.......................................................................... >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero >408-728-0152 | knowledge, reputations, information markets, >Corralitos, CA | black markets, collapse of governments. >Higher Power: 2^756839 | Public Key: PGP and MailSafe available. >"National borders are just speed bumps on the information superhighway." > > -- Jay Campbell Regional Operations Manager -=-=-=-=-=-=- Sense Networking (Santa Cruz Node) edge(a)got.net MIT PGP KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Enigma
by John Young 17 Dec '03

17 Dec '03

The NYT reports today on a British best-selling novel about breaking the Enigma codes, published this month in the US: Enigma, by Robert Harris, Random House. Harris interviewed many of the people who worked at Bletchley Park, and, most challenging, had to wrestle with complex mathematics to explain how the codes were broken ... by an elite comprised of an eccentric band of British and refugee intellectuals, aided by young women carefully picked from upper-class British families. So, Mr. Harris was asked, is the book a celebration of British amateurism? "There's a bit of that," he conceded. "Just as the British benefited from that tradition, the Germans were undone by the ruthless military efficiency, which made it easier to read their messages. The idea of brains taking on brute strength does have a certain romantic appeal." More than one reviewer said Harris was a thriller writer in the British tradition of Eric Ambler, Len Deighton, John Le Carre and John Buchan. "Harris has fashioned a story that is as humane, intelligent and gripping as documentary fiction can get, the critic Anthony Quinn wrote in The Financial Times. This is a story of intelligence, romance, twisted logic and necessary compromise," Peter Millar wrote in The Times of London, adding that it was "altogether top-class stuff."

1 0

Type2.list/pubring.mix
by John A. Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here's the latest! type2.list vishnu mixmaster(a)vishnu.alias.net bb460f08811a98682def423d30852d11 2.0 spook remailer(a)spook.alias.net ca8c8679f7b1cbdcff46d780fba97673 2.0 flame remailer(a)flame.alias.net 64bbf500097b541a8ddcb2dd80373238 2.0b11 anon mixmaster(a)anon.alias.net e3ca4cc5beb9934ae6d52dd27da80332 2.0.2b secrets secret(a)secret.alias.net bc2e4251dbddfa74dfae8b274904c2be 2.0.2b wmono wmono(a)spook.alias.net f68e6add16880b60eb48a4a4330e2e36 2.0.1 mix mixmaster(a)obscura.com db91418edac3a4d7329feaee0b79c74f 2.0.1 knight mixmaster(a)aldebaran.armory.com 6bb0d89a29fd188c67b8e04516b5af33 2.0 robomix robo(a)c2.org 3d523f1fd30b5a1c57214960a00f1c4e 2.0b11 syrinx syrinx(a)c2.org 6c4e7372e84d7092e0d0e69c20d5be46 2.0b11 rebma mixer(a)rebma.mn.org e7d84921298b0aadaf8f050d145ccf03 2.0b11 replay remailer(a)replay.com e3e2b4d67314b6165ee03b0b0ae07a7f 2.0b11 hacktic remailer(a)utopia.hacktic.nl bf61835a7b3cfa59c409caeab4e8a222 2.0b11 crynwr remailer(a)crynwr.com 64c62de6b347b3050fbb6e94c649112d 2.0b11 gondolin mixmaster(a)gondolin.org 1d767b08fefa0a79d508be73e472d326 2.0.1 q q(a)c2.org c44e1cb0f0709465c21b07ac972bf973 2.0.1 Armadillo remailer(a)armadillo.com 7251877ae6fed509ebf7567715974d1b 2.0.1 pubring.mix mix mixmaster(a)obscura.com db91418edac3a4d7329feaee0b79c74f 2.0.1 - -----Begin Mix Key----- db91418edac3a4d7329feaee0b79c74f 258 AATL25WGQY5CMM0/xBjYtuN6IT75h+aBQwwKqZZc isOrqdsl8HWAzARrB0iAtcr34c2qqPBzSRNa5UE8 d3jOYu/wp9K9M5abUSRogcDl7gkPlqxc+e72SdKd 2Gdgib8VDGVLpJdaPk4uSY/pkmsYB30OaQH3W8dU PPciTvSJKAYcTQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- vishnu mixmaster(a)vishnu.alias.net bb460f08811a98682def423d30852d11 2.0b11 - -----Begin Mix Key----- bb460f08811a98682def423d30852d11 258 AAShg2h4xGHueryUFNsFBbtSGZBcj+oDImFMkOZA EQPcbeG6ReEnTnoQ8HBgwtx9isMT9hZ93lBaRY07 ygupHQRi6f+FnlQEZTKqOe+8E+WyDx+ox/1ywgt+ KGFOW+t8WRXA/loKuqD0KH4pwpe7FYE0arGbtm4J EscGM2DE3TeS3QAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- knight mixmaster(a)aldebaran.armory.com 6bb0d89a29fd188c67b8e04516b5af33 2.0 - -----Begin Mix Key----- 6bb0d89a29fd188c67b8e04516b5af33 258 AATOSyg7N2PVg9VgA8voDWglq6ESNBLqH0heB2iE NfvmR/VnyAHCb4ZBtHzvM7ZRBdXYmH/Jt490wg6O ZCbhcIceFKSsibLEH77+111isAhUbHvn0Nh9gOI7 5ngjOGDQaLQvGUbNHRXQaPAZ0rc4lv9gmChJONOJ 7sFC2J96QR4aewAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- robomix robo(a)c2.org 3d523f1fd30b5a1c57214960a00f1c4e 2.0b11 - -----Begin Mix Key----- 3d523f1fd30b5a1c57214960a00f1c4e 258 AATQ2zxiRZ5bQuNBKHEvg11R7L69Hc9ZrjTon3o3 s7fbXmuEaiym48sHoRLAttZ3ADuH1FgbuYt1DF+L Il9Yp5U9znm9MX0rS8xq1iGg7YDED/3x6OWIp7za 17+pWnYmEF+Rz6YZ2o/67ujcBfrJ/odz+SVlaGqF rWWjaG/oWdqWWwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- syrinx syrinx(a)c2.org 6c4e7372e84d7092e0d0e69c20d5be46 2.0b11 - -----Begin Mix Key----- 6c4e7372e84d7092e0d0e69c20d5be46 258 AATKhnhAIHXRCKZAi2tehJfQ9s+IsVPjEQQk5xwQ 60VXzmgkC2YirmDFeLz1feNgCMd78GkKHYK5p9WM HBkPNTDPLraJhJLNDHeHqGtqAI4BTHq/lZ/RMyOH GV/X5TaUEG69IGb2Rl8OnzNWF9fhKwH6PTE+QiQX kIcxJnVW+yYOpwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- rebma mixer(a)rebma.mn.org e7d84921298b0aadaf8f050d145ccf03 2.0b11 - -----Begin Mix Key----- e7d84921298b0aadaf8f050d145ccf03 258 AASjOGqzTLdjweTMiwirrpVNqXj/ODJVyh9pEo5i q5ERILOd1hMNKY9XLNFYM30mUR/Fkh0MnYI/ujWz OTb0rR2a31nvmaLMdaB75nTdGJwHitCmo8k2eTjL XQsXV6zKrzXGp8H8NO34DAFWJy1qVcev+6lLAWGy j/fsJJyJNtl94wAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- replay remailer(a)replay.com e3e2b4d67314b6165ee03b0b0ae07a7f 2.0b11 - -----Begin Mix Key----- e3e2b4d67314b6165ee03b0b0ae07a7f 258 AATZBfJhv+DGg4OEfQfgVnzZZpumEZHI9CES+Ux2 dBp9RBPpJnAtLpcAyCIkNjSaik0togcKhFgcR3nt XIrWclJ/uO/Z1fqW7ESLwzXozCpqnG5S/y6mUPuL yzA9bqtAGd+pvxuK/Cw2Zzx+1QGp0VtWb46KxqvC S4POHYFljkrQiQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- hacktic remailer(a)utopia.hacktic.nl bf61835a7b3cfa59c409caeab4e8a222 2.0b11 - -----Begin Mix Key----- bf61835a7b3cfa59c409caeab4e8a222 258 AATkwgy72zwwavCHn1OytNMsBYAIBnCFa2hcbZPi IN6eS4jDgFdld5DlcqqzdN6Lxv96i0Dg7ElFyAFR 5zmof3oaNqh5vbq/fTEbvFtX9EGyuqkfN6fKoAEv G7gtmkfosoIg/jnI8AL9KC/J5mGaxrWYB6XBe+v9 iI1pOSbPsDCsdQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- crynwr remailer(a)crynwr.com 64c62de6b347b3050fbb6e94c649112d 2.0b11 - -----Begin Mix Key----- 64c62de6b347b3050fbb6e94c649112d 258 AATLe0CWPSn844FCeL7FzUlf+vE2qfYBPs/8PYYm BfITjknJjD0dk7vXhX9Qc5PFgDWRHhVoIRlFT3sc Jp2UVFLOZ5zn/WiT9Wa1tZsqejDf3MRIDT/K6cHB uB/SUaxLzNfk/wG1uBTUHukdjwCyDxNLHuYA5mVz opYJhQR0Nc/ESQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- spook remailer(a)spook.alias.net ca8c8679f7b1cbdcff46d780fba97673 2.0 - -----Begin Mix Key----- ca8c8679f7b1cbdcff46d780fba97673 258 AATZXVb4yP3MGt/ZCR5FtrHPMgYNyXHBmnG8KWO0 UaT5jbMqBdRQEzOVrCN/5RXerpS8Hctbc5MrwhSr fh/byQLwLkY50zYAxWSRBpaAJgZtCnQtVTgmt9yu BDiCE2OasFnZlwsi+9t8+c5R2bS3C6UhjQsgybbF Aw7xWK3v3fPJqQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- flame remailer(a)flame.alias.net 64bbf500097b541a8ddcb2dd80373238 2.0b11 - -----Begin Mix Key----- 64bbf500097b541a8ddcb2dd80373238 258 AAS5NFs7yPSFv+WwpO26/2OS7CYJDtrhlrEasf8S jJ9P0jqWXuorDIMKT3YfvSkk2xKqAHiHrOFEqltY plIUCoXyAf/7CmNyPYdTN6xNxO74ZIsTQnNgAJT3 6a8+JL92DZJM6pYfhpSvPq7lj5X0h6Hj/oCAlqiS 31TZJkd2jenjDQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- gondolin mixmaster(a)gondolin.org 1d767b08fefa0a79d508be73e472d326 2.0.1 - -----Begin Mix Key----- 1d767b08fefa0a79d508be73e472d326 258 AATAwVkC3FI6NDi0GJvH+FBIK6MYVHvXofEoKMTc u7P1rI7yCW00JOF71k373wyepZDksw9wjZdrHZAB uyN7SICMaKPRvMA4rseZFjefzYaoFf5tO0OqFgcQ /pMOPDwYl0nHyuLJvqjpADMDtatQaN2+/T/HtcMX Q1KCcLk24jEWbQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- q q(a)c2.org c44e1cb0f0709465c21b07ac972bf973 2.0.1 - -----Begin Mix Key----- c44e1cb0f0709465c21b07ac972bf973 258 AATDBaiKBy4jPlRUIQmVvcjO/GhWLbsls+mKloml 5EScYl+3fGw04P4xVcWOSledFVxKVfNy+xTVI8pE XGXSr0cRUIa1NttzNPk/KObb5SvkeqGtWAyRiWBS G91MkWM6LbqzKPcu6gUON47wJCJCzdvgbUIeVJIT MnyBvMWJX5CKAwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- Armadillo remailer(a)armadillo.com 7251877ae6fed509ebf7567715974d1b 2.0.1 - -----Begin Mix Key----- 7251877ae6fed509ebf7567715974d1b 258 AASWRIpH97WDVCNc/kiLqvmxqwN9cAAbZFi+FIwr gCixQRTtD/SXuXd62iIqRMp3xm4c+uSnTzLijIxi fCYLacNMVeh0PXAszfFIh6CBicPq1UWt82Wu5dqw K/goNULqNDUypGQtOfOpHSQKPwAphXplKhv75OZs SjtMoEcv0CCk3wAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- secrets secret(a)secret.alias.net bc2e4251dbddfa74dfae8b274904c2be 2.0.2b - -----Begin Mix Key----- bc2e4251dbddfa74dfae8b274904c2be 258 AATBBbpmFw7omad8hpvxQiylmoi5MBXs5SivpcY6 65jnhZIiL9HvTE+Rq+30STccDsQWze0/iZthg1RL tCXYtABwkfsHOf60/aq1aOBobkquzBItvzQMG0W/ TkVinZYUTqfdytl/pfLDIQiXv7Z0t98MrLsmVopE 1NQS7sH6g9srFwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- anon mixmaster(a)anon.alias.net e3ca4cc5beb9934ae6d52dd27da80332 2.0.2b - -----Begin Mix Key----- e3ca4cc5beb9934ae6d52dd27da80332 258 AATZuNYrX4bw6A01PA00qMr7KeJsnHIq9wYoSc5P OrHUEvPUoCxmLfuhwF9eEfSkV4t9DLPIMhKXM4iL Afhv2IZKeWaA98q4NHb6E7Gg6/e6uCI1O3nmXXK8 la4ij9RneCHig5K6JlCh3MJTkuW/IEYQjMrz2/H5 RUDEwx+/HL5K0QAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- wmono wmono(a)spook.alias.net f68e6add16880b60eb48a4a4330e2e36 2.0.1 - -----Begin Mix Key----- f68e6add16880b60eb48a4a4330e2e36 258 AASe+l+eIE1GYugbIPDG87h9wIFD0KqLWrMiN0PN RBCmRwsHOu1mZDnJTPlg7RXI17+DJMkk+huGPTuA T+KilAv8WFKWmvHuOpIBwxVBMXFKHsrQYHES63t0 UMQvRCv9LXZZvmiBWKrZp5vQaSOZKYLf4v3pQw7U SsbB5geSP9fQ2wAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- John Perry - KG5RG - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by mkpgp, a Pine/PGP interface. iQEVAwUBMHusbaghiWHnUu4JAQEVhgf9EsZdugAsPzB9qjXf9S4w9ucjG8myCq5l J4/9rYYTOLusK+L07QXQsGZcAQsDvULXMKshKY+4dKTfYp9Z8fClk7nBUO0h0PZK 4eAfAOLwADZl4do0tAlh7AyIWI0QRAwWrh4ufhY6MuLaKJpgraHGaK0sbDvZZdEZ OBvn50HkksSBkHv441g8u5ZvXRfbFdeW0ii4qIPqoKhB22yWv2L1DnRdWP8/b/OL aLN9c0w054AFXo1f4hd+ZW3ufT8f7YXnda3rUCGe0GstPMvrpB22bdkt+t2QuYBn Mn4gzS6bMfBFms8hYQgaLd+ACHWVuc6WTZ4svNp8nDGSDK8EX7ou5g== =wrcD -----END PGP SIGNATURE-----

1 0

Open Mkt Sudden Infant Death
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Open Market Web Site Launches Free "Internet Security" Cambridge, MA, Oct 10 -- In a teleconference, Open Market launched a three-pronged attack on Internet "security breaches" that includes an online "security checker" for multivendor Web browsers belonging to end users, free upgrades from the Netscape Secure Server to the Open Market's Secure WebServer, and the giveaway of sample code to operators of "any extensible secure Web server." The trio of security remedies will all be available free of charge starting this week from the Open Market Web site at <http://www.openmarket.com>, officials reported during the teleconference. "Our entire business is based on people having trust in open networks," noted Shikhar Ghosh, Open Market's chief executive officer (CEO). "We'll make a significant investment, with the view that all of will suffer if (the public) loses trust." Consumers are only "gradually gaining some confidence" in the Internet, according to Ghosh. But recently, reports have surfaced of security problems with the Netscape Secure Server, and some Web sites using the Netscape product have been "saying they are going to go off the air." As a result, he added, Open Market is introducing a policy that allows licensed users of the Netscape Secure Server to download Open Market's Secure WebServer "at no cost." The other two planks in Open Market's new pro-security Web "resource center" are "informational," the journalists and analysts were told. Open Market will work with the makers of Web browsers to track information on "known problems" with browsers, including browser tampering. "We will (also) inform the (Web) software companies of problems," the CEO maintained. The Open Market Web site will perform a database look-up on the type of browser in use, and will then report back to the user on any security issues known to be associated with that kind of browser, elaborated Open Market's Win Treese. "One strength we have is that we don't have a browser. We are agnostic," Ghosh told the telephone audience. Open Market also performs "extensive testing" on Web browsers. "We do as many as several hundred versions of browsers coming in at any time. We definitely expect (to) unite the industry, rather than dividing the industry," he added. The sample code to be offered from the Open Market Web site will provide "underlying code" for "reference implementations on what are the major ways of handling the known (Internet security) problems," according to Ghosh. "To reiterate, security is one of those pillars on which the entire industry rests," contended the Open Market chief, to conclude the teleconference. Contact: Open Market, 617-621-9500; Press Contacts: Wendy Ziner, Open Market, 617-374-6508; Dawn Geary or Merrill Freund, Schwartz Communications for Open Market, 617-431-0770) -----

1 0

Re: [NOISE] was Re: java security concerns
by madden＠mpi-sb.mpg.de 17 Dec '03

17 Dec '03

> Rather than trying to prove a program to be correct (which I agree is doomed > to failure for the forseeable future for all but trivial programs) I disagree: automatic program verification has come along in leaps and bounds, largely due to the current research impetus in safety critical systems. Various sorting programs, bin-packing programs, to mention but a few, have all been successfully auto. verified (and these are non-trivial programs, which form the building-blocks of even less trivial "industrial-sized" programs). Indeed, the technology has been extrapolated to the automatic verification of electronic circuits, compilers, schedule problems and computer configerations (all w.r.t. a user's specification). The real problems lie with specifying the program/problem correctly in the first place (so-called specifications capture), and with automatic program *synthesis* from specifications (which, in mathematical theorem proving terms, presents the problem of creating existential objects, as opposed to just verifying that they do the right job). I do, however, agree with the need/desire for a greater diversity of program properties which can be automatically checked. Regards, Peter ================================================================= Dr Peter Madden, Email: madden(a)mpi-sb.mpg.de Max-Planck-Institut fuer Informatik, Phone: (49) (681) 302-5434 Im Stadtwald, W-66123 Saarbruecken, Germany. Fax: (49) (681) 302-5401 =================================================================

2 1

Re: [NOISE] was Re: java security concerns
by madden＠mpi-sb.mpg.de 17 Dec '03

17 Dec '03

> Did you also send this post to cypherpunks(a)toad.com? No I didn't -- wasn't sure if that's where F. Stuart's email originated from. Please feel free to circulate to the universe, along with some further clarification below. I hope I wasn't too positive in my support of auto. program verification. There are real problems. However, with the development of the field called formal methods, computation has been directly linked to mathematical logic, which is a much better understood, and well circumscribed, domain than programming languages per se. Applications of formal methods in software engineering depend critically on the use of automated theorem provers to provide improved support for the development of safety critical systems. Potentially catastrophic consequences can derive from the failure of computerized systems upon which human lives rely such as medical diagnostic systems, air traffic control systems and defence systems (the recent failure of the computerized system controlling the London Ambulance Service provides an example of how serious software failure can be). Formal methods are used to provide programs with, or prove that programs have, certain properties: a program may be proved to terminate; two programs may be proved equivalent; an inefficient program may be transformed into an equivalent efficient program; a program may be verified to satisfy some specification (i.e. a program is proved to compute the specified function/relation); and a program may be synthesized that satisfies some specification. Program Verification boils down to proving a mathematical conjecture specifying that a given program will, for all inputs of a certain type, generate outputs of a certain type. This is relatively straightforward -- we already have the program P described in the initial conjecture to be proved. Program synthesis, on the other hand, starts with a similar conjecture *except* that P remains an unidentified variable. The task of synthesis (auto. or otherwise) is to incrementally identify P as the conjecture proof is unraveled. This requires all kinds of "intelligent", and often intuitive, choices during the proof, and is consequently a difficult process to automate. Peter ================================================================= Dr Peter Madden, Email: madden(a)mpi-sb.mpg.de Max-Planck-Institut fuer Informatik, Phone: (49) (681) 302-5434 Im Stadtwald, W-66123 Saarbruecken, Germany. Fax: (49) (681) 302-5401 =================================================================

3 2

Public Awarreness of Security
by Martin Diehl 17 Dec '03

17 Dec '03

On October 11, 1995, John Markoff of the NYTimes writes: "Newly publicized weaknesses in the basic structure of the Internet [snip] .. advantage of the fault-finding talents of the Berkeley researchers and other like-minded experts, the company announced a contest today called Netscape Bugs Bounty [snip]" On October 11, 1995, Joan E. Rigdon of the Wall Street Journal writes: "The software industry is starting to sweep the bugs out of the closet [snip] ... Netscape is trying to systematically tap the intelligence of the hackers instead of randomly waiting for them to find mistakes. [snip]" Both of these stories bring out not only the flaws in the Internet and software to use the Internet, but also the work going on both at the software developers as well as that by groups such as ours that are active in identifying the risks. Congratulations to the Cypherpunks Martin G. Diehl

1 0

Re: Basic Flaws in Internet Security and Commerce
by Herb Sutter 17 Dec '03

17 Dec '03

At 21:33 1995.10.10 -0700, Patrick Horgan wrote: >Paul said: > >> A fine piece of work. The ideas expressed in this paper should scare >> the hell out of everyone who uses NFS for any serious applications, >> which for a fact includes most banks and all investment banks and >> brokage houses. In this particular area I KNOW what is at risk. >> Again, I congratulate the authors on a first-class effort. > >I agree, it's a good job of publicizing these holes, but (not to take >anything away from these guys, I'm sure they know this), these are not >newly found holes. These attacks on NFS have been known and exploited >for years and are well known within the security community. To repeat a comment I made in sci.crypt... the described hole applies equally well to a program (virus or other) that sits on a workstation and intercepts calls to OS file services. This is particularly pernicious on platforms like PCs, but are there any platforms that don't have this potential flaw? The main question, in my mind, is: How can a user know he is even running the app he thinks he's running? Once you have an attacker who can intercept OS file system calls, it seems to me you can know -nothing-... checksums are no use, signatures are no use, nothing is any use at that point -- including keeping your authent software on a floppy, write-protected or not, since it can simply be patched as it's read in, or the system may just execute a different program altogether. In fact, if it's properly done, there may not be any way to even detect that the system has in fact been subverted. So: If you can't trust your path to your own file system, what can you trust? (And this is without even talking about things like firmware upgrades and BIOS patches and all sorts of other potential approaches.) Can we do no better than simply assume the local workstation file system can be trusted? Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

1 0

Re: Hal's Third Challenge?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 01:45 PM 10/11/95 +0000, Magnus Logi Magnusson wrote: >Im interested too... if there is a 32 bit client for NT/Win95 (or a single >thredded one for Win32s) capable of reporting automatic to the >server/local server, I could probably throw in c.a. 40-50 pentiums and a >lot more 486 (and a few HP/Sun/Alpha) :-) Anyone working on self-reporting >win32 client? > Try: http://www.brute.cl.cam.ac.uk/ftp/pub/brute/w32clnt.zip DCF

2 1