December 2003 - cypherpunks-legacy

RE: `Random' seed.
by David Van Wie 17 Dec '03

17 Dec '03

Matt Blaze <mab(a)crypto.com> wrote: >Here's my current favorite quick-and-dirty true-random-in-software generator. >Use at own risk and read the comments carefully... [...] > * Physically random numbers (very nearly uniform) > * D. P. Mitchell > * Modified by Matt Blaze 2/95 [...] > * WARNING: depending on the particular platform, truerand() output may > * be biased or correlated. In general, you can expect about 16 bits of > * "pseudo-entropy" out of each 32 bit word returned by truerand(), > * but it may not be uniformly diffused. While this comment provides some general information, it does not give the expected entropy in the form of testable assumptions. A first step in this direction is to provide the entropy series used to arrive at the 16 bit per 32 bit word estimate. The second step, as I recommended last week (RE: RNG Resource FAQ... on 9/22), is to provide a concise argument drawn directly from the mathematical weaknesses of the entropy series. In that post, I posed the following four criteria because they address the mathematical (theoretical) weaknesses of the entropy series, while using a vocabulary that should be sensible to a rigorous designer: 1) The states exist and can be identified. 2) The number of states n is known. 3) The index value i uniquely identifies a state. 4) The function P_i is known and well-behaved. In this way, an analyst can review both the entropy series itself, and a _concise_ statement of the criteria under which the series is defined (i.e. when the 4 mathematical weaknesses have been appropriately addressed), and the argument "why" has been scrutinized against the code or proposed design. dvw

1 0

RE: Netscape "random" number seed generator code available
by David Van Wie 17 Dec '03

17 Dec '03

Phil Karlton wrote: >[You will be expected to show your work. :-)] In the spirit of showing work, how about a run through your entropy series? dvw

1 0

Banks eyeball sci-fi style identification for ATMs
by an215712＠anon.penet.fi 17 Dec '03

17 Dec '03

Date: Sun, 24 Sep 1995 10:20:05 PDT NEW YORK (American Banker) - Biometric identification, a process formerly seen only in futuristic movies and high-security government offices, may soon become part of the most common consumer banking transactions. Bankers' interest in biometric ID -- a sophisticated antifraud measure that exploits the fact that every human possesses unique physical characteristics -- dates back more than a decade. But until recently most banks and equipment manufacturers have watched the development of technology that recognizes fingerprints, voices, and other personal traits from a distance. That has begun to change, experts said. One of the companies leading the charge toward everyday use of biometric identification in banking is Sensar Inc., a Princeton, N.J.-based company that is developing an automated teller machine application for its patented Iriscan process. According to experts, the eye is one of the most unique parts of the human body and the iris biometric more reliable than virtually any other, including fingerprints and voice. Voices change over the course of a life, and fingerprints sometimes disappear on people who work with their hands. By contrast, the iris, which is the colored area of the eye, is stable throughout a lifetime. They are thoroughly unique and naturally visible. In a nutshell, the company's product, to be sold under the name Irisident, is being designed to capture an image of a consumer's eye and match it to an image on file before authorizing an ATM transaction. ``The research that's been done with consumers indicates they like the idea of having biometric verification -- it gives them a feeling of greater security,'' said Liam Carmody, a principal with the Ridgewood, N.J.-based consulting firm Carmody & Bloom. ``But they don't want intrusive verification.'' Sensar officials understand that the use of the eye as an identification tool is likely to meet with skepticism from some bankers, who wonder whether consumers will rebel against it. However, they said their ATM application -- which should be available in prototype in the next few months -- is being designed to address the consumer concerns. And they insist that Irisident products will be of practical use to bankers. ``We are operating under the assumption that the consumer is not going to put his eye up to something to be scanned,'' said Kevin McQuade, vice president of strategic business development at Sensar. ``The breakthrough here is the ability to obtain the image of the eye unintrusively,'' said Thomas Drury, president and chief executive of Sensar, which is a unit of the David Sarnoff Research Center Inc., also based in Princeton. Several influential companies have committed money to the development of an ATM application for Sensar's technology, including Huntington Bancshares Inc., OKI Electric Industry Ltd., and a money-center bank that does not want to be identified. Though the bankers declined to discuss their investment in the project, OKI Electric has committed a minimum of $25.8 million for development funding in return for the exclusive rights to market the products in Japan, where the Tokyo-based company is the leading vendor of ATMs. Experts said this support shows that the financial services industry is looking for alternatives to the personal identification numbers and computer passwords that have been compromised with increasing frequency in recent years. The choices are many, and include fingerprints, on-line signature verification, and even the measurement of facial thermal zones. ``Bankers are interested in alternatives to the PIN,'' said V. John Stroia, a marketing manager with Diebold, Canton, Ohio. Diebold and IBM operate an ATM joint venture known as InterBold. ``The major barrier is not so much the technology as getting the customer acclimated to'' using biometric technologies. But, he added, capturing sensitive biometric data -- such as that from the eye or face -- ``is going to have to be covertly done.'' ---------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. If you reply to this message, your message WILL be *automatically* anonymized and you are allocated an anon id. Read the help file to prevent this. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: WSJ on Netscape Hole 3
by jsw＠neon.netscape.com 17 Dec '03

17 Dec '03

In article <199509252300.QAA29812(a)infinity.c2.org>, sameer(a)c2.org (sameer) writes: > He's -asking- for an exploit. Tshirts to Ray and the person who > does the exploit, if it gets written. Maybe I should just ring up 8lgm and > have them do one. > > > > > > On Mon, 25 Sep 1995, John Young wrote: > > > > > The Wall Street Journal, September 25, 1995, p. B12. > > > > > Marc Andreessen, vice president of technology at Netscape, > > > said the company will issue fixes for the recent glitches > > > later this week. He added that it's unclear whether > > > anything other than temporarily crashing a user's computer > > > could result trom the recent flaw. > > > > Oh Marc, you didn't really want to say that, did you? > > > > -Thomas > > I asked Marc about this one, since it bothered me too. Apparently Jared asked Marc if he was aware of specific examples of how this bug might be exploited. Marc replied that we had not seen anything other than what was already posted on cypherpunks. Since the original article did not use quotes, I assume that what was written was a paraphrase, and as such it has been interpreted by the author. That said, we take this problem seriously, and have taken steps to fix it. The patch that will be released tomorrow will include fixes for this buffer overflow, and others that we found during a review of all of our code. I think it would be more constructive to pound on the new version than one that is known to be busted, and will be patched by tomorrow. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

Internet draft on MIME/PGP
by P.J. Ponder 17 Dec '03

17 Dec '03

Don't want to start another MIME war, but thought some on the list might be interested in this. ---------- Forwarded message ---------- Date: Tue, 26 Sep 95 15:10:57 -0400 From:Internet-Drafts@CNRI.Reston.VA.US To: IETF-Announce: ; Subject: I-D ACTION:draft-elkins-pem-pgp-00.txt A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : MIME Security with Pretty Good Privacy (PGP) Author(s) : M. Elkins Filename : draft-elkins-pem-pgp-00.txt Pages : 3 Date : 09/25/1995 This document describes how Pretty Good Privacy (PGP) can be used to provide privacy and authentication using the Multipurpose Internet Mail Extensions (MIME) security content types described in RFCXXXX (draft-ietf-pem-sigenc-03.txt). Internet-Drafts are available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-elkins-pem-pgp-00.txt". A URL for the Internet-Draft is: ftp://ds.internic.net/internet-drafts/draft-elkins-pem-pgp-00.txt Internet-Drafts directories are located at: o Africa Address: ftp.is.co.za (196.4.160.8) o Europe Address: nic.nordu.net (192.36.148.17) Address: ftp.nis.garr.it (192.12.192.10) o Pacific Rim Address: munnari.oz.au (128.250.1.21) o US East Coast Address: ds.internic.net (198.49.45.10) o US West Coast Address: ftp.isi.edu (128.9.0.32) Internet-Drafts are also available by mail. Send a message to: mailserv(a)ds.internic.net. In the body type: "FILE /internet-drafts/draft-elkins-pem-pgp-00.txt". NOTE: The mail server at ds.internic.net can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e., documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. For questions, please mail to Internet-Drafts(a)cnri.reston.va.us. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft.

1 0

Re: Netscape Stock Prices
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 4:45 PM 9/26/95, Jeff Simmons wrote: >Date High Low Close Volume > >950809 75.000 53.750 55.500 3851.8 : : >950925 69.000 62.250 67.000 684.0 WSJ article re: overflow bug Yup. Looks like the old "wall of worry" trick to me. Stand back and let the train go buy folks, madness of crowds and all that. Actually, Netscape is still the only game in town as far as Wall Street goes. What the market needs is a foregone alternative, and some lucky sailor to mistake a tulip bulb for an onion... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

weak links in DigiCash system
by Bryce Wilcox 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jerod, I'm forwarding your message to a couple of lists. I thought you made good points. Of course DigiCash is only running a demo, but still-- why demo poor security? I think it doesn't make a good impression. Bryce, signatures at end - ------- Forwarded Message To: ecash-feedback(a)digicash.com cc: netherto(a)taussky.cs.colorado.edu, wilcoxb(a)taussky.cs.colorado.edu Subject: Security in your ecash project. Date: Tue, 26 Sep 1995 17:00:15 -0600 From: Jerod D Netherton <netherto(a)taussky.cs.colorado.edu> I have a couple of problems/complaints with your ecash project. When I was sent my Acct ID and Passwd they were sent to me plain text instead of being PGP-encrypted first. This means that some malicious hacker could have intercepted the e-mail message and stolen the free cyber-bucks you were so generous as to give me. Second, on the WWW-page where one downloads the software it does not seem to do a secure connection between my browser and your server (on netscape there is a small key in the lower-left hand corner that is supposed to show when one is securely connected to a secure server). So someone could sniff my password from the transaction when I GET the software. Also When I'm buying/selling things it would be smart for all parties involved to be using PGP, and I think you should stress this point more in your page. Otherwise this is another vulnerable point in your system IMHO. Thank you for your time. /\ The Scottish Claymore of All CyberSpace UgradLab DumpMeister /\ Watcher of Anime. Addictor to Muds. WebMaster of OAA at CU! < E A N O R JaDuN Comes. Shade and Sweet Water \/ Yuri, Miyu, Nene, Ranma-chan, Ryoko, B-ko! \/ Anime, Chivalry, and Physics Forever!!!! Finger for PGP Key Email:netherto@colorado.edu Phone:(303)786-8311 Pager:(303)610-1203 http://ugrad-www.cs.colorado.edu/~netherto/Home.html Lab:(303)492-6207 - ------- End of Forwarded Message signatures follow To strive, to seek, to find and not to yield. bryce(a)colorado.edu http://ugrad-www.cs.colorado.edu/~wilcoxb/Niche.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Automatic PGP clearsigning under Unix with Bryce's Auto-PGP v1.0 iQCVAwUBMGiNz/WZSllhfG25AQHFMAQApc6Td8e6bQsBqpCU+EnfbYhueJthyYPS rkHfFrenHNwG/MCEFtwXBBxEQP3yyvnY2qD9RrrhC3cN0HcFw2jE8r++2Y3Z9H7u dJuIKodi2LP8POoW6dJPlW93N5E/+LhuCZvfqe78T2bIl20GIYQ5x0UUTm+APo2f MLu6wUEAHTE= =ofwj -----END PGP SIGNATURE-----

1 0

Re: Cypherpunks Press release
by tcmay＠got.net 17 Dec '03

17 Dec '03

I guess you all know how much I hate this "who will be our spokesman?" thread, but my opinion has been explicitly asked, so I will again comment. Hopefully, adding a few new points. At 6:55 AM 9/26/95, Craig Hubley wrote: >Damn fine idea, but how do a bunch of (p)anarchists choose a mouthpiece ? >Should we assign someone to be 'our' lawyer ? > >I'd volunteer to be 'spokespunk', I've certainly been interviewed for TV and >print enough, and know how to handle and present myself to the press, but if >this is considered an 'honor' rather than a 'pain in the ass and potential >legal lightning rod' then I'd like to suggest someone with a longer pedigree >who has been writing more code lately take it on. Tim ? I've turned down several recent chances for interviews, for these reasons: 1. I feel the people doing the work should be interviewed, not just someone who has some visibility (whatever mine might be). If PGP is the issue, then they should talk to those working on PGP. If anonymous remailers are the issue, etc. If, by some chance, they are interested in things I have directly worked on or written extensively about, then maybe they should interview me. (Although for other reasons I refused to have my name attached to the cover story in "Information Week" about "Internet Theft," BlackNet, etc.) 2. Location, location, location! The media foci are Washington, New York, and San Francisco, at least for our area of interest. Occasional forays into Austin, Miami, L.A., etc. This is where the taped interviews are done. Several "crews" recently in SF wanted "sound bites" and "video bites" from people like me. I refused, pointing out the wastefullness of my time in driving 100 miles over mountain roads to SF, fighting parking problems, waiting around, and ending up with a 7.89 second clip of me saying something scripted. (In February I stupidly agreed to travel to LA for a filming of a BBC show about encryption. Left at dawn, drove to San Jose, flew to LA, took shuttle to Hollywood, waited around for several hours while crew finished taping Alvin and Heidi Toffler, set up my laptop, was interviewed by show's producer, agreed at her repeated prodding to say "I am a Cypherpunk." Got back to my house at midnight. Guess what they used? The stupid line "I am a Cypherpunk" and maybe about 20 seconds of other random comments. This is what we face, as other high tech shows I see have the same disjointed, out-of-context flavor.) The point? These "journalists" are tuned to looking for catchy quotes, all the more so on video than in print. Text journalists can handle complex themes much better than video reporters can, for many and oft-discussed reasons. (Even more disgusting than this was a more recent appearance of a BBC film crew at a Cypherpunks meeting. They wanted to "stage" the news, to have the meeting discuss a 2-year-old topic, because that's what their script called for. I got up and left, as did several other people. I haven't seen this BBC show, but I gather from a URL that this is the one that has "performance art" examples of crypto....) Any "spokesman" needs to be easily accessible when they need a "filler quote," or a "reaction quote." However: 3. THERE IS NO SPOKESMAN, THERE IS NO CENTRAL OFFICE, THERE IS NO BOARD OF DIRECTORS! With no organization, no office, no coordination, we cannot "feed the media machine" the way it expects to be fed. Nor can we "elect" such folks. I didn't help start this list--not that this gives me more moral sway--in order that J. Random Volunteer will start speaking for "our beliefs" or will start explaining "our goals" and "our plans." Far better that journalists like Steven Levy and John Markoff subsribe to the list, or to condensations by people like Eric Blossom, and then deal directly with the experts in some area. Thus, on the latest Netscape flaw, they would contact Ray Cromwell directly, not deal with the press releases written by J. Random Volunteer. Anarchy is part of our charm. More importantly, part of our theme. Face it, we don't have a press office, we don't have staffing, and--most importantly--there is no one out there who speaks for me. A spokesman for the Cypherpunks is an oxymoron. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

7 6

Re: Hack Microsoft?
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Tue, 26 Sep 1995 00:04:08 -0400 (EDT) you wrote: > > > Microsoft recently got C2-security status approved for Windows NT by >the National Computer Security Center, a division of the NSA. They >are supposed to put systems through "laborious testing and review" before > If Cypherpunks can find flaws that the NSA can't, or won't divulge, >what does that say about their so-called COMSEC ability. > For fun ways to hack NT, check out http://www.somar.com/security.html. Some of these are really laughable. You can use NT's LogonUser API call to repeatedly guess passwords until you hit it, since NT offers no way to limit number of login attempts. There also is no way to stop remote users from modifying the registry. *Any* user with an account can remotely dump and modify the system registry. So in theory you can write a bruteforce program to keep guessing until it gets a password, then modify the registry to make the system to "interesting" things. The worst part of all this is that the Registry is very poorly documented, MSoft must consider most of that info "confidential." Fortunately, when using NT's SMB services such as drive and file sharing, passwords are never sent in the clear. Just make sure you disable that "Guest" account.:) Dan Bailey *************************************************************** #define private public dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ***************************************************************

2 1

(fwd) FBI COMPUTER FRAUD WEB SITE DIVISION
by imschira＠nyx10.cs.du.edu 17 Dec '03

17 Dec '03

Path: mnemosyne.cs.du.edu!uunet!in2.uu.net!noc.near.net!das-news2.harvard.edu!oitnews.harvard.edu!newsfeed.rice.edu!news.sesqui.net!news.concom.com!news From: Rick Casimir <rikkkk(a)concom.com> Newsgroups: misc.forsale.computers.pc-specific.misc Subject: FBI COMPUTER FRAUD WEB SITE DIVISION Date: 21 Sep 1995 17:47:42 GMT Organization: Connections.Com Lines: 9 Message-ID: <43s8fu$r4t(a)carbon.concom.com> NNTP-Posting-Host: dial139.concom.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: Mozilla 1.1PE (Windows; I; 16bit) HELLO, If you or someone you know who has been scammed or did"nt ship you products after you prepaid or for whatever reason who screwed you. REPORT THEM TO THE FBI: <http://www.fbi.gov/compcrim.htm> -- -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information To be a skeptic is to refuse to be a victim. "This is my .sig. There are many like it, but this one is mine." Freedom...yeah, right.

1 0