December 2003 - cypherpunks-legacy

Banned Zambian newspaper now on the Web
by Declan McCullagh 17 Dec '03

17 Dec '03

We now have the banned February 6 issue of _The Post_ online! Frank Stuart kindly provided a copy of the text. I've HTMLized it, added background documents and information about other international censorship efforts, and put it online at: http://www.cs.cmu.edu/~declan/zambia/ Zambia's president-cum-tyrant Frederick Chiluba has plenty of practice censoring local dissidents, broadcasters, and newspapermen. Now, if he likes, he can take on the Net. I've copied this message to the state news service, Zambia Today. Please redistribute as appropriate. -Declan ------------------------------------------------------------------------ http://www.cs.cmu.edu/~declan/zambia/ ------------------------------------------------------------------------ NET CENSORSHIP AND ZAMBIAN DICTATORS By Declan McCullagh declan(a)well.com Zambian President and Dictator-for-Life Frederick Chiluba has made a career of intimidating, harassing, arresting, and censoring those who disagree with him. Now his attempts to muzzle his critics have reached the Net -- specificially, Zamnet, the only Internet service provider in this impoverished African country. Chiluba has plenty of experience intimidating traditional media. At Chiluba's bidding, in December 1994 an armed paramilitary unit raided the Lusaka offices of The Post newspaper and its printer Printpak in Ndola looking for "seditious and defamatory material" -- just as the presses were starting to roll. Germany's ambassador to Zambia, Peter Schmidt, who witnessed the raid, told InterPress Service that "the raid amounted to an attempt to intimidate the free press." A few days later, police arrested the top editors of the weekly Crime News and held them without bail and without filing charges. The journalists' offense? The newsweekly had revealed that Chiluba's wife was involved in drug trafficking. The year before, Chiluba sued The Weekly Post for libel after the paper reported on his shady financial dealings with South Africa. Chiluba also fired the head of the Zambia National Broadcasting Corporation for not broadcasting appropriately pro-government programming. In 1994, the ever-vigilant Chiluba introduced legislation to make the Zambian media answerable to a government-appointed secret tribunal with broad, undefined powers of censure and punishment. Chiluba's latest state-sponsored terrorism came in early February 1996, after The Post published a report revealing the government's plans to hold a referendum on the adoption of a new constitution -- plans Chilbua hoped to keep secret to the disadvantage of his political opponents. True to form, the hypersensitive Chiluba ordered his forces to invade the newspaper's office, ransack the paper's files, arrest the editors, and stop the presses. Security forces then sealed the offices of The Post. Chiluba's despotic behavior is reprehensible. Foreign governments immediately should yank the $1.8 billion in foreign aid Zambia receives each year and demand Chiluba's ouster. That failing, it's high time for the Zambian people to kick their thin-skinned tyrant out of office. February 16, 1996: Zamnet Communication Systems, which hosts the the web version of The Post, removes the online copy of the February 5 issue after police threaten a raid. David Lush of the Media Institute of Southern Africa publishes an advisory. February 18, 1996: After reading Lush's advisory, I send an appeal requesting the text to several mailing lists. February 19, 1996: Frank Stuart contacts me when I'm logged into the WELL, saying he has a copy of the banned issue of the newspaper. February 20, 1996: This archive goes online after I translate Frank's text into HTML. ###

2 3

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 6:46 PM 2/20/96, IPG Sales wrote: >Hedging, hedging, hedging - why? I did not noitice this <...> IPG, why don't you sit down and draw up the terms of a challenge? Specify: * what information and/or materials IPG will release * to whom it will release them and when * who is or isn't elligible * what you will and won't accept as "breaking your system" * the arbitrating body * a starting time and a deadline * the award You'd do well to be _very_ thorough in these terms, since any perception that IPG was trying to throw the game would draw that much more fire. You'd also do well to make terms terms conform to real-world circumstances: for example, if someone hacking the office machines on which which you generate, store, and/or disseminate RNs is a practical threat to your product, then admit that as an acceptable part of a "break." Ted

5 7

Web Browsers and Anonymous Mail (Was: NSA net trolling)
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

Wayne Madsen wrote somewhere: > A knowledgeable government source claims that > the NSA has concluded agreements with [...] Netscape to > permit the introduction of the means to prevent the anonymity of > Internet electronic mail, [...] I suspect this may actually mean that they're pushing Netscape to incorporate cryptographic authentication into browser email, which I think is a useful development. I'm not aware of any public remailers previously operated by Netscape Communications Corp. that have now shut down. ;) At any rate, it's an excuse for me to ask some questions: (0) I'm not aware of any class library objects or methods in stand-alone Java for calling the local mail transport agent. Is there any class library support in Java+{Navigator, HotJava, Mosaic, NetCruiser, the AOL web tool, etc.} for applet calls to the local mail agent that's configured in the browser ? I would prefer not to reimplement SMTP using the Socket class in my own applets. Ideally I'd like to have an applet that presents a form with some entry boxes and check boxes, quantizes and encrypts the input according to the check box settings, and spews the resulting byte streams to the MTA. (1) As I recall, I used to be able to set (as an Option) the path and name of the local MTA (e.g. /usr/lib/sendmail) in an earlier version of Netscape. That seems to have disappeared in Navigator 2.0. Is there indeed no longer a way to set that ? It occurs to me that we could have achieved partial integration of remailing into Navigator quite cheaply with that option. Comments from Sun and/or Netscape and/or anyone else would be welcome. Thanks :) -Lewis "You're always disappointed, nothing seems to keep you high -- drive your bargains, push your papers, win your medals, fuck your strangers; don't it leave you on the empty side ?" (Joni Mitchell, 1972)

2 3

Big Java security hole
by Robichaux, Paul E 17 Dec '03

17 Dec '03

Forwarded to me by a fellow webmaster; I don't know the original source. -Paul Date: Sun, 18 Feb 1996 23:57:02 -0500 From: Drew Dean <ddean(a)CS.Princeton.EDU> Subject: Java security problems We have discovered a serious security problem with Netscape Navigator's 2.0 Java implementation. (The problem is also present in the 1.0 release of the Java Development Kit from Sun.) An applet is normally allowed to connect only to the host from which it was loaded. However, this restriction is not properly enforced. A malicious applet can open a connection to an arbitrary host on the Internet. At this point, bugs in any TCP/IP-based network service can be exploited. We have implemented (as a proof of concept) an exploitation of an old sendmail bug. If the user viewing the applet is behind a firewall, this attack can be used against any other machine behind the same firewall. The firewall will fail to defend against attacks on internal networks, because the attack originates behind the firewall. The immediate fix for this problem is to disable Java from Netscape's "Security Preferences" dialog. An HTTP proxy server could also disable Java applets by refusing to fetch Java ".class" files. We've sent a more detailed description of this bug to CERT, Sun, and Netscape. A second, also serious, bug exists in javap, the bytecode disassembler. An overly long method name can overflow a stack allocated buffer, potentially causing arbitrary native code to be executed. The problem is an unchecked sprintf() call, just like the syslog(3) problem last year. Many such bugs were in the alpha 3 release's runtime, but were carefully fixed in the beta release. The disassembler bug apparently slipped through. This attack only works on users who disassemble applets. The fix is to not run javap until Sun releases a patch. Note that we've only had success in exploiting the first flaw on an SGI. Windows 95 and DEC Alpha versions of Netscape have other bugs in their socket implementations that make it harder (although not necessarily impossible) to exploit the problem. This is the second time that unrelated implementation bugs have prevented us from demonstrating security problems in Java. http://www.cs.princeton.edu/~ddean/java will contain more information soon, including a revised version of our paper, to appear in the 1996 IEEE Symposium on Security and Privacy. Drew Dean <ddean(a)cs.princeton.edu> Ed Felten <felten(a)cs.princeton.edu> Dan Wallach <dwallach(a)cs.princeton.edu> Department of Computer Science, Princeton University For more information, please contact Ed Felten, 609-258-5906, FAX 609-258-1771. _______________________________________________________ Travis Weller WebMaster, Metrowerks, Inc. tcweller(a)metrowerks.com http://www.metrowerks.com/

3 2

A Challenge (perhaps!)
by KarL MarX 17 Dec '03

17 Dec '03

Hi! My friend has just written a new crypto program that he is trying to get included on a PC Magazine CD-ROM over here... I don't know too much about it at the moment, but he said he thought it would be a good idea to see if anyone on this list could crack it and thus help to make it more secure. I don't know too much about it ATM... I know it doesn't exercise key technology and relies on the secrecy of the algorithm (which from my very limited knowledge on cryptography I think makes it almost doomed from the start (?))... I have some ciphertext of this application but apart from that I have nothing else... Would anyone have any objectiosn to this being posted to the list? If not, could someone tell me what I should post to the list, plaintext and resulting ciphertext, would that be enough, or shoudl I post some info on the algorithms as well ??? The application is written in Visual Basic and I could probably get a copy of the compiled (well VB is actually interpreted, but that's neither here or there) .EXE file.... -- Karl Marx

2 1

San Diego Cypherpunks Physical Meeting
by Chris Claborne 17 Dec '03

17 Dec '03

San Diego Area CPUNKS symposium Thursday, Feb 29, 1996 Invitation to all Cypherpunks to join the San Diego crowd at "The Mission Cafe & Coffee Shop" were I hope to get an update of Lance Cottrell's new anonymous e-mail server, "mixmaster", exchange keys, and discuss other topical CP stuff. There might also be an announcement of a new Internet Service Provider in San Diego providing, among it's other premier services, anonymous remailers and other privacy services. Don't forget to bring your public key fingerprint. If you can figure out how to get it on the back of a business card, that would be cool. Place: The Mission Cafe & Coffee Shop 3795 Mission Bl in Mission Beach. 488-9060 Time:1800 Their Directions: 8 west to Mission Beach Ingram Exit Take west mission bay drive Go right on Mission Blvd. On the corner of San Jose and mission blvd. It is located between roller coaster and garnett. It's kind of 40s looking building... funky looking (their description, not mine) They serve stuff to eat, coffee stuff, and beer. See you there! New guy, bring your fingerprint. Drop me a note if you plan to attend. 2 -- C -- ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. Dreams. They're just screen savers for the brain.

1 0

Re: Let the Snake Oil Flow
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:22 AM 2/23/96, sameer wrote: > All valid points, but when the likes of Nathaniel Borenstein & >his cohorts use the failures of snake oil to discredit all >cryptography, then we have a problem. (Not to say that Netscape is >selling snake oil... but I figure that FV would capitalize on a snake >oil failure to further their anti-cryptography agenda just as they >have used the Netscape RNG bug) Please don't misunderstand...I'm not _approving_ of snake oil, just suggesting that maybe the list shouldn't go into paroxysms every time someone reveals their Captain Midnight Decoder Ring crypto system. Sci.crypt used to be wracked with such issues...I don't look at it much these days, so I don't know if it still is. But the Cypherpunks list has become the de facto place to debate new crypto systems, which we can look at as an achievement as well as a curse, so it's inevitable that new flavors of snake oil will be sold here every few weeks. --Tim May THE X-ON CONGRESS: INDECENT COMMENT ON AN INDECENT SUBJECT, by Steve Russell, American Reporter Correspondent....You motherfuckers in Congress have dropped over the edge of the earth this time... "the sorriest bunch of cocksuckers ever to sell out the First Amendment" or suggesting that "the only reason to run for Congress these days is to suck the lobbyists' dicks and fuck the people who sent you there," ....any more than I care for the language you shitheads have forced me to use in this essay...Let's talk about this fucking indecent language bullshit.

2 1

No Subject
by Andy Silber 17 Dec '03

17 Dec '03

> NED_PUEV <NED_PUEV(a)HP-Loveland-om2.om.hp.com>, > Radar <radar(a)itouch.net>, > Denise HP TechSupport <sdm(a)hpuerca.atl.hp.com>, > sgajar <sgajar(a)crosslink.net> >Subject: FW: FWD>Bill O Rights >Date: Wed, 21 Feb 96 14:27:43 PST >Encoding: 120 TEXT >X-Mailer: Microsoft Mail V3.0 >Status: > > > > ---------- >From: Dave Behrns >To: MIS Mail Group >Subject: FW: FWD>Bill O Rights >Date: Wednesday, February 21, 1996 2:10PM > > > >>>To whoever may read this, >>> >>>This is not a typical letter, in that by passing it on to as >>>many people as you can, you are taking part in what may yet become the >>>world's biggest practical joke. The U.S. Government has rece ntly >>>passed an act which enforces censorship on the internet. A group of >>>internet users has now come together to kick back at this oppression, >>>and have a bit of fun at the same time. >The aim of this exercise is >>>to re-establish the United States as "The land of the Free", not a >>>fascist state where freedom of speech and thought are curtailed. >>>Communist Russia fell as a result of s uch limits being placed upon >>>the minds of the general populus. On receiving this letter, please >>>pass it on to as many friends or E-mail lists as you can. We predict >>>that if everybody copies the lette r to 5 other addresses, by February >>>29th 1996, this letter should have reached in excess of 2 million >>>people. That's when the fun begins........ >On February 29th, please >>>send the message: >>> >>>Dear Mr. President, >>>Do you remember this: >>> >>>And afterwards enclose the pre-typed copy of the Bill of rights. By >>>sending the letter on the date above, you will contribute to either >>>one huge petition for freedom, or else lead to a crash of the >>>whitehouse server.Send all letters to: >President(a)Whitehouse.gov >>> >>>Remember that solidarity is the key to success !!!!! >>> >>> >>>--------------------------------------------------- >>> >>>THE BILL OF RIGHTS >>> >>>Amendment I >>> >>>Congress shall make no law respecting an establishment of religion, or >>>prohibiting the free exercise thereof; or abridging the freedom of >>>speech, or of the press; or the right of the people peaceably to >>>assemble, and to petition the government for a redress of grievances. >>> >>>Amendment II >>> >>>A well regulated militia, being necessary to the security of a free >>>state, the right of the people to keep and bear arms, shall not be >>>infringed. >>> >>>Amendment III >>> >>>No soldier shall, in time of peace be quartered in any house, without >>>the consent of the owner, nor in time of war, but in a manner to be >>>prescribed by law. >>> >>>Amendment IV >>> >>>The right of the people to be secure in their persons, houses, >>>papers, and >>>effects, against unreasonable searches and seizures, shall not be >>>violated, and no warrants shall issue, but upon probable cause, >>>supported by oath or affirmation, and particularly describing the >>>place to be searched, and the persons or things to be seized. >>> >>>Amendment V >>> >>>No person shall be held to answer for a capital, or otherwise >>>infamous >>>crime, unless on a presentment or indictment of a grand jury, except >>>in cases arising in the land or naval forces, or in the militia, when >>>in actual service in time of war or public danger; nor shall any >>>person be subject for the same offense to be twice put in jeopardy of >>>life or limb; nor shall be compelled in any criminal case to be a >>>witness against himself, nor be deprived of life, liberty, or >>>property, without due process of law; nor shall private property be >>>taken for public use, without just compensation. >>> >>>Amendment VI >>> >>>In all criminal prosecutions, the accused shall enjoy the right to a >>>speedy and public trial, by an impartial jury of the state and >>>district wherein the crime shall have been committed, which district >>>shall have been previously ascertained by law, and to be informed of >>>the nature and cause of the accusation; to be confronted with the >>>witnesses against him; to have compulsory process for obtaining >>>witnesses in his favor, and to have the assistance of counsel for his >>>defense. >>> >>>Amendment VII >>> >>>In suits at common law, where the value in controversy shall exceed >>>twenty dollars, the right of trial by jury shall be preserved, and no >>>fact tried by a jury, shall be otherwise reexamined in any court of >>>the United States, than according to the rules of the common law. >>> >>>Amendment VIII >>> >>>Excessive bail shall not be required, nor excessive fines imposed, nor >>>cruel and unusual punishments inflicted. >>> >>>Amendment IX >>> >>>The enumeration in the Constitution, of certain rights, shall not be >>>construed to deny or disparage others retained by the people. >>> >>>Amendment X >>> >>>The powers not delegated to the United States by the Constitution, nor >>>prohibited by it to the states, are reserved to the states >>>respectively, or to the people. >> >> >> >

1 0

REM_ote
by John Young 17 Dec '03

17 Dec '03

2-23-96. WSJ: "H-P Acquires Most of Internet Security Firm." SecureWare technology is used by the Pentagon to safeguard transmission of military secrets. The firm's team of about 40 programmers is "a substantial fraction of the hired guns available in the on-line security world" who snake oil an extra virgin security that not even hackers can cross. Hackers would question that; they have a remarkable history of eventually figuring out ways to get past advances in faked chastity. "Netscape Will Issue Fix for Flaw Found In Browser System." The company confirmed that Princeton researchers found a security flaw in the "applets" created with Java, but said the flaw was minor and that the company will issue a software fix for it next week. Jeff Treuhaft said exploiting the flaw would require extremely skilled hacking. Marianne Mueller, Java security engineer, also said the chances of such hacking occurring are "remote." REM_ote

6 7

Re: "and two forms of ID"
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>You got my position completely backward on this. I feel much better now. :-). I really didn't want to cross swords with someone who's S/N ratio is as high as yours is around here. >You may be thinking of what I said about the >cost of defeating traffic analysis. That must have been it. >The natural state of the Net seems to be a kind of semi-anonymity. Ah. I believe this is what I'm talking about... >Trying to push it in either direction (complete traceability or >anonymity) is costly. I'm going to build a rant about this pretty soon, but I think that in a geodesic network, audit trails of any kind cost more money, particularly in the "fringes" of the network, where all the processor growth is going to happen, assymetries or not. As processors handle smaller and smaller stuff faster and faster, it becomes harder and harder to "control" and monitor all of them. To operate efficiently, they have to be more and more autonomous. One way to provide decision rules for autonomous processors is to introduce micro-e$ auction markets into the net's infrastructure. A good example might be packet routing. Suppose you attach some very skinny money to a packet (something issued with Micromint, maybe?), and strip it off as the packet goes through the network, sender pays. Routers price their throughput based on their load at any given moment. When you create this "economy of switches", it becomes harder to establish the hierarchical book-entry control/coodination models we all know and love, certificate hierarchies among them. I think that something like this might work as a way of randomizing traffic in a network of remailers, by the way. Let the market determine the remailer path. Specify the number of hops left, and attach enough money for that number of hops. This is one way for people to pay for the use of remailers, and eventually, it could map to packet-level-anonymity someday. For the moment, I'm going to claim that anonymous auction markets are always more efficient than identified, command economies, just like flight is faster than surface travel. At least that's what I think this morning. :-). More as I get some time. However, I do agree that it's foolish to simply declare that everything must be unauditable, just as it is to declare universal auditability. It's better to let the market figure this out. ;-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0