December 2003 - cypherpunks-legacy

Re: Micro$oft and Java
by Joel McNamara 17 Dec '03

17 Dec '03

I was at the Microsoft presentation. Crypto-relevant info: A patch will be published in the next few days to address the weak .PWL encryption. I got a rather lame excuse about how the encryption was first implemented in 1991, and how it was sufficient then. They will supposedly be changing the seed. I asked about what MS was doing in regard to future strong crypto. Got an interesting response in that that "the government was going to let them implement 768 bit keys." I later asked an MS person if these were RSA session keys or what. He said yes, but I really don't think he knew what he was talking about based on some of his other comments. Visual Basic Script will be MS's response to JavaScript. The interesting thing here is a plan to use digital signatures on controls and scripts as a means of authentication. The comment was made "you'd trust something signed by Lotus or some other big name, but you probably wouldn't be that trustful of a piece of shareware." Hmmm... MS will be releasing a "safe" runtime version of Visual Basic that will supposedly prevent nasty virii and trojan horses from being implemented on Web pages. IMHO, Perry's previous comments on the security of Java apply. Servers and some clients will support end-to-end encryption. No details... I didn't ask about GAK. Bill said there was a white paper explaining Microsoft's position on encryption. Maybe I'll test the search capabilities of the MS Web site later tonight. Overall, the presentation was interesting (but obviously lacking in technical details as the audience was mostly press). MS is going to throw a lot of resources at this in order to maintain its industry dominance. Thought for the day. Bill on the relevance of the briefing being held on Pearl Harbor day quoted Admiral Yamamoto after the 1941 attack, "we have awoken a sleeping giant." Draw your own conclusions on that one... Joel

3 2

Re: GAK solutions was: Is there a lawyer in the house?
by Carl Ellison 17 Dec '03

17 Dec '03

>>This is not far from the idea that CME proposed that the NSA/FBI/CIA >>publish public keys, and we'll hack a voluntary version of PGP that >>encrypts the session key with the LEA public key -- instant >>voluntary Key Escrow. > >I still think that's the only way the gov't will get GAK -- :) Actually, the real proposal (http://www.clark.net/pub/cme/html/no-ke.html) is to have them give me their public keys. I would sign and post them. The world's citizens would then add them to their public keyrings and, when they feel like volunteering GAK, would include these agencies as crypto-recipients -- on a per-message basis. No meetings -- no hassle -- nearly 0 cost -- and the gov't could have GAK tomorrow. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Re: PGP
by Adam Hupp 17 Dec '03

17 Dec '03

Sorry...I was always taught that the user should not be mandated to finish the job of the programmer. Please, do not take me wrong, PGP is a remarkable tool...but I was not aware I had iron out the bugs. That part is the easiest to do compared with the genius of the program... but I still should not have to do it. This is not "ironing out bugs". It is configuring the program to run on your version of Unix. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQBtAzCNppQAAAEDALhWZl7IuGZ9zZT5bACo0b/1L0Nv0C72vKHIO3IHh+cwpHHa 2Ozb9aeO0UvXGwkkZIYgUm0EvmzKh7yb1GTLvBp5kXpR3I9w+Yj4LGlBDERpUWw6 x4ED49pwDnz1Hl5FBQAFEbQYYXNoIDxhaHVwcEBwcmltZW5ldC5jb20+ =PtJK -----END PGP PUBLIC KEY BLOCK-----

1 0

Netscape stock on 12/7/95
by Adam philipp 17 Dec '03

17 Dec '03

2 1

Oh Yeah? ipsecure
by Ecafe Mixmaster Remailer 17 Dec '03

17 Dec '03

For Immediate Release Contact: National Semiconductor Lori Sinton (408) 721-2448 lori(a)ipower.nsc.com http://www.ipsecure.com CryptoSampler, from National Semiconductor, Demonstrates Ease of Building Secure Electronic Commerce and Communications Applications Company's iPower(tm) Business Unit Launches Free CryptoSolver to Inaugurate New Web Site SANTA CLARA, Calif., November 27, 1995 --- National Semiconductor Corporation today announced the availability of its CryptoSampler package for applications developers interested in gaining a "hands on" understanding of how cryptography solves modern business problems. Developed by National's iPower Business Unit, the program consists of three demonstration applications and the PersonaCard(tm) 100, a hardware token for personal, portable data security. The package contains both the demonstration applications including "build-it- yourself" tools to integrate security easily into electronic commerce and communications applications. Priced at $129, the CryptoSampler package is available to the first 1,000 U. S. respondents and can be ordered directly from National's iPower Business Unit. In a related move, the company's iPower Business Unit launched its own web site along with CryptoSolver, an interactive game that invites participants to solve encrypted messages based on the concepts of substitution ciphers and the alphabetic frequency table. CryptoSolver, a technology-teaser game rates players' deciphering skills and can be downloaded from iPower's new web site free. "As networks become the lifeblood of corporations and the principal means of commerce, securing electronic transactions and proprietary information over public and private networks is absolutely critical," said Tom Rowley, marketing director for National's iPower Business Unit. "Through this program, we hope to help broaden individual's understanding of how modern security technology can solve real problems on the Internet and in Electronic Commerce business applications," Rowley explained. CryptoSampler Package - Token Plus Three Applications in One ------------------------------------------------------------ The CryptoSampler package consists of a PersonaCard 100 data security token, a floppy disk containing all three demonstration applications, a cryptography primer written by recognized cryptography expert Bruce Schneier, and a questionnaire. Customers who choose to complete and return the questionnaire, will receive a free copy, while supplies last, of Bruce Schneier's newly-released book, Applied Cryptography, second edition. o PersonaScreen(tm) System Lockout Utility is a screen locker that prevents unauthorized entry into a personal computer by locking the keyboard and mouse. The PersonaCard Token, implemented in the PC Card (formerly PCMCIA) Type II format, locks and unlocks the desktop computer. o PersonaSecure(tm) Word Utility enables users to sign, seal (encrypt, decrypt), and verify documents as well as e-mail messages from within Microsoft Word 6.0 for Windows. Installed automatically, PersonaSecure displays a toolbar that corresponds to the functions of National's PersonaCard data security token. The hardware token incorporates RSA's industry-standard digital signature and encryption formats which are now "token aware." In addition to protecting and validating Microsoft Word documents, users can encrypt and decrypt e-mail messages with others who have installed the PersonaSecure Word Utility. o PersonaDLL Library for Visual BASIC 3.0 is a Dynamic Link Library (DLL) of routines that enables developers to quickly and easily develop their own applications incorporating high-level data security features. PersonaDLL includes a Visual BASIC application, Visual BASIC source code, and access to all of the features of the PersonaCard 100 token including digital signatures, RSA key generation, encryption, and verification. System requirements to run the CryptoSampler package are: Microsoft Windows 3.X, Windows for Workgroups 3.X, and a PC Card slot (version 2.1 or later). Microsoft Word 6.0 is required for the PersonaSecure Word Utility. Pricing and Availability ------------------------ The CryptoSampler package is available with or without a PC Card Reader. For those who plan to run CryptoSampler applications on a desktop or portable personal computer already equipped with a PC Card slot, the basic package is offered at a special price of $129 (including handling and shipping). A CryptoSampler package with PC Card reader is available for $199. The total retail value of the basic package and configuration with card reader is $300 and $500, respectively. To order the CryptoSampler package in either configuration, call 1-800-272-9959 Ext# 631 between the hours of 7 AM and 7 PM Central Standard Time. To play CryptoSolver and for more information about the CryptoSampler program, see the iPower web site at http://www.ipsecure.com . iPower Security Solutions ------------------------- Introduced a year ago, iPower technology provides the highest-level of commercially available security in a personal, portable hardware token. iPower solutions are already being incorporated by OEMs, ISVs, and VARs into a variety of applications and hardware platforms including e-mail and messaging, electronic commerce, network security, and secure access to on-line services including the Internet. National Semiconductor Corporation provides technologies for moving and shaping information. The company focuses on four key areas - communications, consumer, industrial, and personal systems. National Semiconductor is headquartered in Santa Clara, California, and has 22,300 employees worldwide. -30- Note to Editors: To receive a CryptoSampler package for review, call or e-mail Lori Sinton, 408 721-2448 or sampler(a)ipower.nsc.com iPower and PersonaCard are trademarks of National Semiconductor Corporation. All other trademarks are held by their respective companies.

1 0

Re: [NOISE] Re: FW: websurfer 4.6
by Ed Carp 17 Dec '03

17 Dec '03

> Date: Thu, 7 Dec 1995 15:49:09 -0600 (CST) > From: Aleph One <aleph1(a)dfw.net> > To: Rich Graves <llurch(a)networking.stanford.edu> > Cc: cypherpunks(a)toad.com > Subject: Re: [NOISE] Re: FW: websurfer 4.6 > On Thu, 7 Dec 1995, Rich Graves wrote: > > [snip] > > Microsoft's strategy is to support VB. > [snip] > > -rich > > > > Its interesting to note that all the people that were raving mad about Java > seem to be quiet now that MS is proposing to use VB. At least Java was > designed from the ground up with security in mind. But VB? Actual binary Well, at least it's easy and fun to program in (if you can call drag-'n-drop "coding"). Of course, until 4.0, their setup utility didn't check what version of DLL you were installing, so it's easy to get your DLLs out of sync on your system and blow your applications all to hell, and 4.0 throws all thos OLE crap in, even if you don't need/want/use OLE in your code and makes a 300K application into a 3M one, and they won't tell you what really goes on underneath the hood (I guess they're paranoid about getting ripped off), and never mind that it's almost trivial to write a VB decompiler (the .EXE is just a big jump table into offsets into VBRUN300.DLL), etc., etc., etc... And all this from a software company that took over 10 years to make their "operating system" do preemptive *anything*. But I guess I shouldn't complain. After all, VB has made me a pretty decent living for the past year or so...

1 0

Re: FW: websurfer 4.6
by Ed Carp 17 Dec '03

17 Dec '03

> Date: Thu, 7 Dec 1995 15:12:07 -0500 > Subject: Re: FW: websurfer 4.6 > To: cypherpunks(a)toad.com > From: Rich Graves <llurch(a)networking.stanford.edu> > -----BEGIN PGP SIGNED MESSAGE----- > > On Thu, 7 Dec 1995, Anonymous wrote: > > > Not surprising. They confuse random doodling with software, too. > > > > The real problem with NetManage is a severe case of brain death. > > My, thanks for your opinion. > > It may interest you to know that Microsoft recently licensed a bunch of > stuff from NetManage (San Jose Merc, no real details given). Yeah, and they also think that Windoze is a real opearting system, too...

1 0

Is there a lawyer in the house?
by cme＠acm.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Sat, 2 Dec 1995 03:39:00 -0500 (EST) >From: Black Unicorn <unicorn(a)polaris.mindport.net> >Subject: Re: Netscape gives in to key escrow >An individual has no legitimate expectation of privacy in the encryption >numbers in his GAK browser, we reasoned, because he voluntarily conveyed >those numbers to the government when he purchased the software. It could be even worse. I was on a panel last year with Scott Charney (sp?) (I believe from DoJ) during which he commented that if you give your secret key to anyone -- e.g., your own company -- then you have given up the presumption of privacy. That leaves the police open to get that secret without a warrant. This claim should be checked by a real lawyer. +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMdbP1QXJENzYr45AQF64QP/dXHnfLuh6FFwCY2GxKNYC5lHlj/hcFmy KqwWLYVqyr5vf/ZFEA6wlnVRMAARnenfCDmu7XQ9v9YzRjVrpjQMQAFrl9qlBivB 5wFGYSLME9sVtKIIPR0YSV8Xbw613bLmEnKiGrXxPNQ/bkaO30WOxG3N9Oen9DX4 sFfVbA+Ek0c= =CEEO -----END PGP SIGNATURE-----

3 2

(no subject)
by Nicholas Philp 17 Dec '03

17 Dec '03

WE WANT SOME PUSSY PICTURES

2 1

Re: Micro$oft and Java
by leefi＠microsoft.com 17 Dec '03

17 Dec '03

| The interesting thing here is a plan to use digital signatures on | controls and scripts as a means of authentication. There was a press release on this. The PR index on http://www.microsoft.com/corpinfo/pr.htm points to a few Internet-related announcements that were made on 12/7. A brief quote on these signatures: "Microsoft plans to propose the Internet digital signature specifications to the W3C and the IETF as an open Internet standard. The technology will be an open, proposed specification available to the entire Internet community. In addition, as part of the Open Process Design Review, Microsoft will host a digital signature design preview in January to solicit feedback from the Internet community." This week there was also another workshop for ~150 ISVs, and these signatures were one of the topics. The event was not under any NDA, so you should start seeing feedback once folks get home and they catch up with mail (at least two were on Cypherpunks). The folks putting on the event have put lots of docs on the "Sweeper" SDK, on the below-referenced web site. Honestly, I'm not sure if all the stuff from the event this week is up there; if not now, most of it will get added in the next week or so. | Servers and some clients will support end-to-end encryption. No details... I believe SSL in current versions of the web browser and server, PCT around the corner (perhaps PCT is earlier than I'm thinking). | Maybe I'll test the search capabilities of the MS Web site later tonight. The clearinghouse for internet developer info (opened 12/7): http://www.microsoft.com/intdev/ It contains info on various VB Script, OLE Control, etc, as they refer to some of our Internet solutions. A page related to this press briefing (I presume also opened 12/7): http://www.microsoft.com/internet/ Hope this helps, Lee Fisher (wondering if I really should've de-lurked)

1 0