December 2003 - cypherpunks-legacy

Hacking commercial systems.
by hallam＠w3.org 17 Dec '03

17 Dec '03

Hi, A number of people have been proposing hacks on commercial payment systems. Could I point out that this is not necessarily a good idea? One vendor I spoke to has a contract clause with sublicensees which requires a legal response in such situations. His opinion was that attempting such a crack on a "live" system consitituted conspiracy to commit fraud and organisation of the same could involve RICO penalties. It would seem prudent to approach such projects with a little caution. If a request were made for a sample of material to work on most companies would oblige and a refusal would provide protection against legal tactics. Most sensible companies would see the advantage of offering a reward. Phill

2 1

Re: Netscape rewards are an insult
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > C. S. U. M. O. C. L. U. N. E. > WTF? I'm surprised you didn't get this. It's a simple phrasal substitution cipher, sort of like a license plate. Think of it as this: C SUMO CLU NE See Sumo Clue No (clever putting a foreign word there, eh? But not clever enough to throw us off! ) and realizing that sumo refers to sumo wrestling: See wrestling clue no and when you realize that a clue tells you about the reality of something: See wrestling reality no or rearranging: See wresting no reality or: See, wrestling has no reality! And you can see that it's a simple assertion that professional wrestling's not real. It's wrong of course. Think about when they pick someone up and throw them. If that happened to me it would hurt...don't you think? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Fred, Fred, Fred: Enough already!
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Can we please talk to Dr. Fred, the Poster Child of the Informal Fallacy, if we *really* have to, off line? I had my fill of specious arguments in college already. Speaking of both, I would reccommed any book on elementary logic (Copi used to be a good one), specifically the informal falacies section, if you want a good laugh, and to see why his "Did so, did not! Prove it didn't!" argument style makes me want to step outside and hork in the bushes. I would hate to kill-file people who are normally clueful, but I will, just to get this second-order Fredness out of my face. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Verification of Registration
by cypherpunks＠toad.com 17 Dec '03

17 Dec '03

>Your membership registration has been processed. To become a full member >of c|net online, please return the text of this message (to verify(a)cnet.com) > >The following magic token in this message [cypherpunks::752400770] will be automatically >processed to verify you. Please note: The number included in the token is >*not* your password; the one to use on the site is the one you entered on >the registration form. > >Please include the complete token appearing above, including the brackets. >The best way to return it to us is to include this entire message in your >reply. If you mailer does not allow you to do this, retype or cut and >paste the magic token (including the square brackets) into a new message to >verify(a)cnet.com. If you are having difficulty completing this process, >please direct your questions to support(a)cnet.com. > >Once you are verified you will be able to take advantage of the full >range of c|net online's services.

1 0

Re: Reformated: How secure....
by Paul Koning 1695 17 Dec '03

17 Dec '03

(Re Steve O's Privasoft followup) Your reply didn't really answer all the questions that have been raised. You mention a 2 digit key extension, so does that mean the key is 11 digits? If not, how is a key extension different from a key? Given that the program is exportable, why is it any stronger than any other exportable system? Re how you would recognize readable text: if the scramble is good, the output would tend to look like white noise. An invalid decrypt would have the same general look. But a valid one would have the properties of a normal fax, which is long run lengths. So if you do a run length check on the data, you could readily distinguish a valid decrypt from an invalid one. Incidentally, I looked at the sample encrypted document on the web. It has an amazing amount of structure in it, and certainly doesn't look at all like the white noise I expected. That in itself suggests a weakness. (Notice the dashed lines running down the page, 7 of them...) Also, you forgot to address the known plaintext attack. If I have both plaintext and cyphertext, then recognition of the correct decryption is no longer an issue (it's simply a compare). For the system to be valid by modern standards it has to be secure against a known plaintext attack, and preferably against a chosen plaintext attack. (In other words, if I get you to fax an image of my choosing I should still not be able to recover the key.) It doesn't appear that it is secure in that sense. Finally, the property you mention of being able to cope with damaged images doesn't sound at all unique. You would fail to have this property if you use a block cypher with long blocks, a cypher with error propagation (e.g. CBC mode in DES), or any cypher applied to the compressed form of the fax. But any stream cypher or transposition cypher (as I gather you use) applied against the raw bitmap has this property, since any flaws in the encrypted image would simply become noise in the plaintext image. (A black line would become a gray line in a stream cypher; in a transposition cypher it becomes pixel dust on the page.) paul

1 0

Re: MD5 weakness ? [was Re: Netscape Logic Bomb detailed by IETF]
by Nathan Zook 17 Dec '03

17 Dec '03

At 10:42 AM 10/24/95 -0400, Dr. Frederick B. Cohen wrote: >> > [...] uses an MD5 checksum which the members >> > of this list seem to place unlimited trust in (incorrectly in my view, >> > but that would be picking two nits with one keyboard entry). >> >> Can you elaborate with facts on the supposed weakness of MD5 ? > >I didn't say that there were any weaknesses in MD5, all I said was: > "unlimited trust ... (incorrectly in my view...)" > ... >> [btw who talked about 'unlimited' trust ?] > >There has been no limit given by anyone on this list to the level of >trust they place in MD5. Several people have posted (without >contention) that MD5 is sufficiently trustworthy to trust billions of >dollars in commerce to it's being able to prevent a selected plaintext >attack as eluded to above. If you think we should trust it, and you >don't limit your assessment of trust, what other assumption should I >make? If several people proclaim that trust and nobody stands up in >disagreement, tacit agreement is my normal (although not necessarily >justified) assumption. > The dear "Dr." Cohen strikes again: It would appear that "Dr." Cohen continues to assume that this list appeared the moment he first posted, or that we love to type the same symbols over and over. This list places no more trust in MD5 than in IDEA--or RSA, for that matter. But since banks CURRENTLY trust RSA for billions of dollars in transactions (and, I believe with fairly small moduli) this trust is the usual trust of experience. In fact there HAVE been discussions of the security of MD5 on this list--but since they occured before the good "Dr." Cohen arrived, perhaps we should have them again for his sake. But since most of us tire of typing (and reading) endless explainations that we DON'T trust something absolutely, we don't. We also don't spend all of our time correcting slightly overgeneralized statements. And of course there is the small fact that quite a few people here believe that if anyone is foolish enough to place absolute trust in an algorithm, who are we to disabuse them? But if "Dr." Cohen wishes to discuss the weaknesses of MD5, he should focus his attention on his prefered whipping dog--PGP. Some versions of PGP had an insecure implementation of MD5. But of course the "Dr." should know that an insecure implementation is very far from a demonstration that an algorithm is insecure. Nathan Zook --- Now installing Linux 3.0 or something...

1 0

Returned mail: unknown mailer error 2
by Mail Delivery Subsystem 17 Dec '03

17 Dec '03

The original message was received at Tue, 24 Oct 1995 17:44:00 +0100 from meriadoc.sophos.com [193.82.145.1] ----- The following addresses had delivery problems ----- |/home/ian/.mailscript (unrecoverable error) (expanded from: <ian(a)elbereth.sophos.com>) ----- Transcript of session follows ----- /home/ian/.mailscript: syntax error near unexpected token `|/' /home/ian/.mailscript: /home/ian/.mailscript: line 1: `|/usr/bin/filter -vo /home/ian/.elm/filterlog' 554 |/home/ian/.mailscript... unknown mailer error 2 ----- Original message follows ----- From: cypherpunks(a)toad.com Date: Tue, 24 Oct 1995 18:05:29 +0100 Apparently-To: ian(a)virusbtn.com Hello

1 0

Re: Sun speaks out - but not to the cypherpunks
by todd＠lgt.com 17 Dec '03

17 Dec '03

>-----BEGIN PGP SIGNED MESSAGE----- > >In article <v02110101acaf51651ef9(a)[204.156.156.4]>, >Todd Glassey <todd(a)lgt.com> wrote: >[ lines marked > > are from fc(a)all.net (Dr. Frederick B. Cohen) ] >> Pardon the flame but I really have just about heard enough of this BS... >[...] >> >> The area where we can (must) build trust is the computing base. >> >> Traditionally, this has been the OS, but in the case of java, it is >> >> the java interpreter (such as netscape 2.0 and hotjava). The browser >> >> is now the TCB (trusted computer base) for all practical purposes... >> > >> >Read: The Java interpreter is supposed to be a TCB. >[...] >> >Who here truly believes that the implementations of Java meet the >> >requirements of a TCB? >[...] >> Dr. Fred, you seem to spend a lot of engery slamming Java and HotJava. >[ ... flame deleted ... ] > > >No, here I think Dr. Cohen's comments are right on the mark. > >The Java interpreter *is* supposed to be a trusted computing base. >Do we have any reason to believe that this trust is well-placed? > >(If you don't agree, go through the Orange Book evaluation criteria, >and pay special attention to the assurance sections...) >- --- >[This message has been signed by an auto-signing service. A valid signature >means only that it has been received at the address corresponding to the >signature and forwarded.] > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 >Comment: Gratis auto-signing service > >iQBFAwUBMIwG2CoZzwIn1bdtAQEpowGAgHiyk0tTQk5SO/3TR5EZRMFmUy/TjQmu >NbYIt0R/Tf0g9xWbolm5XN0alu947uJs >=UZH0 >-----END PGP SIGNATURE----- Sorry abopt the above flame-war I caused. My point was almost benign in and of itself. Yes, the Java concept is sound, No, the currently available implementation has some real architectural considerations that must be addressed in order that we can build a stable and secure platform atop it. My real issue is that there is so much time spent on this list knocking the individual spokes that make up this wheel we call Electronic Commerce, that it is more and more costly to filter out the technology from the background noise. Still because of the value of that technology, I and others are forced to spend precious hours reviewing all that comes across our desks. Bluntly being an active member of several Security and Payment Mechanism working groups I view some 150+ pieces of email a day and sometimes get frustrated by the amount of noise, or the roar in the background, about what are to the largest percentage of us, meaningless dribble... Still there is the occaisional golden nugget that makes it all worth while.. Again My apologies to have stirred up this mess. I will retreat under my desktop from the mele' that seems to be unending. Todd Regards, T. S. Glassey Chief Technologist Looking Glass Technologies todd(a)lgt.com (415) 324-4318 -----BEGIN PGP SIGNATURE----- Version: 2.6 iQB1AwUBMFu5E6gNRnWhagU5AQHI+gL+Mwpcd3lAWd8FF06qcG6rnLhIYveHW71a XC7xh1T0uu8qnYX31yMp17OG28jWpKUbWec1IM9/eXOi+gInA7rKICWczV8zo9Z0 0puxjRRN7yO4KfRb3cPpk+r0p6pDg01Y =bTYb -----END PGP SIGNATURE-----

1 0

Re: Crypto's Role in Evil?
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Mon, 9 Oct 1995 11:20:41 -0700 I'm late getting to my mail backlog. >From: tcmay(a)got.net (Timothy C. May) >It's clear that cops cannot protect people, only try to catch the perpetrators. I heard a particularly scary quote from Director Freeh last Sunday on NPR's Weekend Edition (I believe that was the show -- segment A-1) in which he declared "our job is to protect the people". If that were the FBI's job, then we'd have to look at it as one does to a loving parent and give it all the authority and respect a child gives a parent. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Re: Does your software?
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>My get-only server is available in source form, is 80 lines long and >thus easily understood, has been shown to meet security properties, is >now in the process of being mathematically proven to meet those >properties, and is published in a refereed journal which can be used to >confirm its contents in detail. Hence, I do provide secure distribution >through purely physical means. > Uh, proofs only go so far. There was one Cornell CS professor who was a real devotee of "proving" your programs correct. He even published one of his proofs in a "refereed" journal. Big whoop. It still had an error. Proofs can help identify flaws, but they can never rule out all flaws. That's why their name is so bogus. I wouldn't be surprised if you could prove that the Finger daemon, which is sort of like a really low-level GET-ONLY HTTP server, is also safe. In fact, your math proving ability could probably even prove the pre-Robert Morris finger daemon is safe and secure. If programmers don't think of preventing finger requests longer that 512 bytes then why should the head-in-the-clouds program provers? - Peter >-- >-> See: Info-Sec Heaven at URL http://all.net >Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236 P.S. "FC" is your log in and "FC is found inscribed in the writings of the Unabomber. Coincidence?

1 0