December 2003 - cypherpunks-legacy

Re:
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQ+x2ioZzwIn1bdtAQFLvgGArC5EiVmF0J6VZSZnboc9yoTW3eiJXN1M 4L9v0f1tkuoJlC10gX6fRo3SW19vILT4 =LmRK -----END PGP SIGNATURE-----

1 0

RE: More FUD
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

>"real professionals?" You mean the kind that take meetings to avoid work and >leave the office by 5:00? No, those are managers. (Have better equipment at home anyway 8*). >As far as "virus writers" there are relatively few that I would lump >into that category, but the ones who do get there are worthy >of at least a little respect. The ones I know who could, don't. Is considerably harder to write an antivirus program that can account for Zenith ZDOS 3.21 or the original PC-AT BIOS than a virus that blows up if you run it under NW-DOS. >>True, in early '92 when [Mich] came out things were more difficult - not >>everyone had 640k in their machine so the user acurally had to have a clue >>how much memory was supposed to be there. Today is there anyone with 512k ? >If my memory serves me correctly, by '92 386's were rolling off the assembly >lines. You missed my point (and my canary trap). When a Pentium starts up it is in 8086 "real" mode and is limited to the same 1 Mb basic address space (know about the 64k - 16 bytes, is different from 8086/8). What I was referring to was the "640k limit" imposed by 1-2-3 waaaay back when - is stored in Bios data area (0:400) and CMOS. >Maybe you should use WordPerfect instead. Actually I prefer WordStar 7.0. Magazines and the gov like WordPerfect. >Solution: Get rid of Windows. Upgrade to '95, NT, or go to Linux, even OS/2. Have been warped. Have Liniux & FreeBSD. As for Win95, why would I want to degrade my system ? >>And you tell me that someone is going to spread a virus on the net that will >>capture keystrokes on any machine it hits without anyone noticing ? It is >>to laugh (and if they can, they are wasting their time with credit card >>numbers). > This sounds like a challange. Is it worth a T-Shirt? Wasn't a challenge (though getting something to work on a "strange" NCR notebook like mine might be 8*), never saw a BIOS leave dangling interrupts following POST before...) >Not if it is written properly. A lot of viruses become known only when they >drop their payload. Others are just poorly written, no different from a bad >software product. It is not that they are written badly, just that most virus writers lack experience and their worldview is narrow - the [Mich] we mentioned - is obvious not that the writer did not know how to handle floppies, rather that all he/she/it/other knew of were either 360k or 1.2 Mb. "Nightfall" writer had apparently bever seen a Zenith 248 kit 5 BIOS. Ludwig's LBB boot sector virus will only work under Dos 3.3 because DOS 4-up leaves different values in the registers. >>Fact is that the greatest protection the net has is that no two machines are >>alike, may even start that way but after six months, no way. >Ahhhhh.. but your wrong. Granted, the underlying strata may be radically >different, but I can run an MS-DOS program on an 300 Mhz DEC Alpha (under NT) >without any problems (except I couldn't get DOOM to run). No, you can get *some* programs to run and on your machine you may get *all* your programs to run. But they will not run on *any* machine. > There is already a >read-only Filesystem driver for Linux that will read NT. Like TCP/IP, the >operating systems are going towards interoperability. Type 7 ? Nothing magic, just different. >The big computer companies recognize that they have to compete to survive. No >longer can IBM design a machine and lock in their customers to IBM parts, IBM >service, and an IBM operating system. Strength from diversity 8*). Meanwhile, back at FV, if someone wants to break it badly enough, they'll buy one (or one of the FV employees) and take it apart at home. No "professional" would attack anything that she/he did not already know how to break. A *real* professional would buy two or three just to see if they were all the same. Is the same problem with the "Sidewinder Challenge" though it did get a lot of print. Warmly, Padgett

1 0

Call for Papers
by winn＠Infowar.Com 17 Dec '03

17 Dec '03

January 31, 1996 Attention: Information Warriors: ***** CALL FOR PAPERS ***** Please feel free to distribute this widely. I first want to thank the thousands of people who have been so incredibly supportive of my work over the last several years, and who have helped the public debate on Information Warfare gain and sustain the momentum we have all created. As a result of the continued interest in the subject, my publisher has asked if I would create a 2nd. Edition with substantial updates to the original "Information Warfare" which was published in 1994. I told them that the new revised edition should include much of the thinking that has evolved on the topic in the last couple of years. Believe it or not, they agreed! So, I am asking (begging? :-) for a couple of things. 1. We want to include a comprehensive Appendix "D" to include references and bibliographic information for those already in and for those entering the field. We would greatly appreciate any and all types of references that you feel will be useful for students of Infowar today and in the future. The kinds of material we hope to include are: - Web sites, mailing lists, usenet, etc. - Monographs and their source - Published papers and their source - Books with publisher, author, date, ISDN (oops, ISBN) price and a one sentence commentary. - Global resources on the subject. - Courses (civilian, military, etc.) - Organizations, private and gov't. We will also add a credit/acknowledgments page for all of the Information Warriors who have assisted in this effort. Please supply name, title (or rank) contact info, and affiliation as you want it to appear in the book. (If you don't want your name or affiliation to appear, please so indicate and we will honor your request. (Honest . . . .) Ideally, we will need to have a hard copy of the materials that we reference. PLEASE RESPOND TO BETTY(a)INFOWAR.COM 2. In order to portray the current thinking of Infowar from its many facets, I am also looking for short commentaries on your particular take on Infowar - and heavens knows there are so many . . . perhaps googols! I would like to include a large number of 500-800 word overviews, or executive summaries of topics of interest to you, comments on my work, or perhaps on the efforts that you or your org are putting into the field. I am hoping to find a balance between the civilian viewpoints and military and international ones so that students and readers can see just how much work in occurring in the field. Organizations like AFIWC and DISA (and so on) are invited to submit a similar overview of their efforts in addition to individual submissions. It is not necessary to agree with me (that would be heresy in some cases :-)) but let's be civil about it, OK? The purpose is to get the neurons vibrating and moving the field forward. If you take issue with, or relate to specific items/topics/comments in "Information Warfare" please note page number so we can tie it all together thematically. There will be suffixes to each chapter, and I am hoping that many of the responses will comment on or add to each of the chapters. As for credit, we will list your name, contact info, affiliation etc., along with your particular contribution. With each submission, please just say something like, "I hereby give Winn Schwartau, Interpact, Inc., and Thunders Mouth Press non-exclusive permission to use this work." That keeps the publisher happy and still lets you own your own words. If it's a personal opinion, and not an official one of your organization, a simple disclaimer like, "these are the opinions of the author, and not necessarily those of my organization." We will provide a general suffix disclaimer to that effect anyway. If it is the official view of your org, then please indicate so clearly, so we may make an accurate distinction. If we decide to edit your piece substantively, we will run it back to you for approval before printing. All we will ask is a timely return. To get your brain thinking on the kinds of topics I am looking for: - Civilian Defense - "This is an act of War" - "This is not an act of War" - Infowar as an alternative to conventional conflict. - Non-lethal conventional warfare - Enhancing military efficiency with Infowar - PsyOps as Infowar - Hackers: A National Resource Please consider all three Classes of Infowar when deciding what you want to say. Since you only have 500-800 words to say it, I suggest that it be clear, concise and to the point. Controversy is good. But just as good is if your comments are thought provoking and stimulate additional discussion about your subject. For each contribution we accept, (and there will be a lot we will!) we will provide a free copy of the new revised "Information Warfare: Revised Edition" (or whatever they decide to call it.) PLEASE RESPOND TO: BETTY(a)INFOWAR.COM 3. We have already received a large number of short "pull quotes" of one or two sentences for the cover and inside covers where we give full attribution. If anyone is so inclined, we are looking for a few more that comment on the existing works. PLEASE RESPOND TO BETTY(a)INFOWAR.COM 4. Robert Steele at ceo(a)oss.net has agreed to help me pull together a "Who's Who" of Information Warfare. Please supply names, contact information and brief biographies to him at CEO(a)OSS.NET. Again, I want to thank everyone out there for their support, and I look forward to seeing what everyone has to say. Please send your input to BETTY(a)INFOWAR.COM no later than February 29, 1996. Feel free to distribute this widely and/or post as you see fit. Winn Schwartau Peace Winn Winn Schwartau - Interpact, Inc. Information Warfare and InfoSec V: 813.393.6600 / F: 813.393.6361 Winn(a)InfoWar.Com

1 0

RE: No FV supporters?
by Rich Salz 17 Dec '03

17 Dec '03

> if people like Sameer and Rich Salz (e.g., who have reputations > as knowledgeable and aware) are going to trash FV Thanks for the compliment. I never trashed FV or its protocols, as I don't know anything about them. I did comment on some of the principles of their principals, however, as this whole brou-ha-ha strikes me as a continuing slide to technical-intellectual dishonesty. /r$

1 0

Re: [rant] A thought on filters and the V-Chip
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"frissell(a)panix.com" "Duncan Frissell" 29-JAN-1996 11:02:03.09 >What parents are attempting to do when they restrain their children's access to "sex and drugs and rock and roll" (or Republicanism for that matter) is to mediate their "spiritual" environment to keep them from becoming hardened. They know the kids will grow up, they just want them to grow up in a nice way. ------------------- From what I've seen, kids are better off when they don't see the world through blinders/rose-colored-glasses. For instance, benign neglect is a lot better for children than overprotectiveness... I wish my parents (as much as I love them) had applied it to me, I'd have turned out a lot better. (I am also getting information from multiple psychiatrists and psychologists, including ones who (unlike me) have raised children). ------------------- >Children who listen to Vera Lynn's singing and Cole Porter's songs will end up quite different from those who favor louder, less vocal music. Note that in spite of what liberals might think, fundamentalist christians are less likely to divorce, less likely to report spousal beatings, less likely to kill themselves, and more likely to measure high personal satisfaction ^^^^^^^^^^^^^^^^^^^^^^^^^^ levels on standard psychological tests than are, say, readers of The Nation. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ------------------- Well, yes, someone with a blind conviction that they're going to someplace nice when they die, confidence that their intolerance is right, and other such ideas tends to have higher personal satisfaction levels. Also, this "personal satisfaction" is overrated... as Jack L. Chalker pointed out, a blade of grass is perfectly happy... even after it's picked. ------------------- >The cypherpunks relevance of all this is that it should soon be possible to create completely mediated environments for ourselves and our children. Through the use of implants and real-time VR processing, it will be possible to edit our "interface" with the Real World such that unpleasant aspects are edited out. We will be able to change the attire, hair, facial expressions, voice, and even smell of those around us to conform to our own esthetic desires. Likewise with our physical surroundings. Safety may discourage making a complete transformation in one's surroundings, but one can certainly soften the edges. --------------------- Sasha's enhanced reality or whatever it was called, yes. The cypherpunk relevance would appear to be more that there should be methods to get true information to kids (and those under repressive governments, which is about the same thing in most families) despite attempts to stop it. Anyone for posting (anonymously) some image viewers and pornographic site locations to one of the k12 groups? -Allen

1 0

Nautilus?
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi. I was wondering if some of you ever used Nautilus, if it was good, if it has a backdoor, etc. I am not knowledgeable enough to inspect source by myself. Any comments? Since the topic was probably discussed extensively, feel free to reply to me directly. Regards to all cyphering punks! JFA Why, you might wonder, is it that civil servants never look out through the window in the morning? What would they otherwise occupy themselves with in the afternoon?

1 0

Online Libel Rules
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

UK - New Rules For Online Libel Called For Wokingham, Bershire, England, 31 January 1996 -- CompuServe, Europe Online, and Microsoft Network (MSN), have banded together to lobby the British Government for a clear definition of the legal rules for online libel. In British law, libel is defined as a defamatory statement. Because of the "new" nature of online services, however, online libel is treated as something of a gray area as regard legal issues. In a joint submission to the Lord Chancellor's department, the three online companies claim that online service providers typically cannot control the content of messages that users of their services or the Internet, send. The companies are recommending that the online service provider not be held responsible for libels statements made online, unless the service provider has "reasonable notice" that a libels statement has been transmitted on to its system, and "has the ability and the authority to prevent" its publication, but "fails to do so" within a reasonable time. According to Andrew Gray, European business manager with CompuServe, the Chancellor's Department is currently conducting an extensive review of UK libel law to deal with a number of current problems. Based upon this review, the Government is expected to introduce new libel legislation this spring. "We applaud the Lord Chancellor's Department's efforts to bring the defamation law up to date. We hope that the upcoming legislation will deal effectively with the problem of libel that takes place over an online service or the Internet," Gray explained. Andreas Breijs, manager of Europe Online, meanwhile, said that online services are not like traditional newspapers or magazines. "These services are more like a railway train, where the operator may own the passenger cars, but has no idea what the passengers may be saying to each other, and no way of controlling their conversations," he said. Judy Gibbons, manager of Microsoft's MSN operating in the UK, said that the major online providers work hard to run responsible services. "They should not be penalized for the actions of unrelated individuals who might happen to make libelous statements using their services without the knowledge or consent of the service provider," she said. Alistair Kelman, a lawyer specializing in information technology (IT) affairs, said that he was not surprised by the online services' request to the Lord Chancellor's Department, especially given the current situation. "There is no case law on this subject and it is likely that a test case will come sooner, rather than later. The Government is keen on a clarification on the issue, as it is itself publishing a lot of its information on the Internet, in the move towards a more open and IT-relevant Government," he explained. Peter Sommer, an IT security specialist and Fellow of the London School of Economics, said that, far from being just another publishing medium, it was important that people understand that the Internet is very similar to a telephone line. "If I libel someone over the phone, you're not going to involve the telephone company, are you? It's the same with the Internet and some online services. Of course, if the online service has the ability to remove someone's comments and does not do it, then it's a different matter and that is what the definition by the Lord Chancellor's office is all about," he said. --

1 0

Re: Crypto-smart-card startup Inside Technologies
by jim bell 17 Dec '03

17 Dec '03

At 12:30 AM 1/31/96 -0800, Peter Monta wrote: >There's an article in the January 29 _EE Times_ about a French >cryptographic-smart-card startup called Inside Technologies. >Tidbits: > > ..."In public-key cryptography, 512-bit keys are typical and > already vulnerable. So we are looking at 640-bit-long keys > supported by a scalable design." This kind of thing disgusts me. We already know 512-bit keys are weak. As I recall, I was told that 512 bit keys could be cracked in 20,000 MIPS-years. If the ballpark formula holds that adding 10 bits doubles the security, that merely means that 640 bits is 2**(128/10) or 8000 times strong. While obviously better than 512, it is not ENOUGH better to make me confident that this is a long-term secure length. 768 or 1024 bits should be considered the minimum. A deliberate design of 640 bits makes it look like it's intended to be crackable in 5-10 years, much as DES was suspected of a similar design decision in limiting its keylength to 56 bits.

2 1

Re: The FV Problem = A Press Problem
by vin＠shore.net 17 Dec '03

17 Dec '03

Mr. Bornenstein's press release ("FV's position on Merc article") was egregiously self-serving and embarrassingly over-inflated. Yet, First Virtual's CC-focused keyboard sniffer ("...a program which completely undermines the security of every known credit card encryption mechanism for Internet commerce") and his postulated widespread stealth attack on unprotected consumer PCs highlighted an obvious -- but oft forgotten, at least in non-CompSec circles -- vulnerability. An encrypted link is only as secure as the CPUs at either end. Not an unimportant consideration as we plunge into Internet commerce; and surely a valid point for one vendor to make, if it suggests unrecognized risks in a competitor's scheme for consumer purchases and payments. Borenstein is handling his inevitable mugging in C'punks with zest and considerable aplomb; even including an apology for submitting his sensationalistic attack on crypto-based competitors to this List. Before folks leap from FV's text to damning the San Jose Mercury New's articles by Simson Garfinkel, however, they should pause and read or maybe re-read Garfinkel's three articles. <http://www.sjmercury.com/clips/> Mr. Garfinkel is probably the single most technically-literate journalist writing about computer security for mainstream (or trade press) media. His Mercury News article is precisely focused on FV's initiative in developing this demo program (a trojan screen saver) and the campaign by the Southern California company to use the demo to illustrate a relatively unguarded aspect of Netscape's SSL-protected credit card transactions, which have been widely touted as the be-all of Network Commerce. It was, as Garfinkel bluntly put it: "a direct attack against the security promised by Netscape Communication Corp.'s popular Netscape Navigator..." Mr. Borenstein later expressed his regret that Garfinkel had cast the story as a competitive attack, but IMNSHO Garfinkle was right on target: the FV campaign was a targeted bombardment of their most prominent competitor. And a campaign it was -- well deserving media attention. FV apparently carted their demo code and attack model back and forth across the country. FV gave presentations to NIST, NSA, the US Treasury, and the White House, according to Garfinkel. The only silly comment in Garfinkel's article was a direct quote from FV's Bornenstein: "One of the things we've heard from people inside government were comments along the line, 'We thought only NSA knew how to do this....'" (And if a world-class CompSec/UNIX expert like Garkinkel wasn't chuckling when he wrote that -- and expecting knowledgeable readers to giggle and grin when they read it -- I'll stew and eat my beaver hat!) The Merc's quotes from independent security experts -- commenting on FV's attack model -- were notably dry and balanced. Yes, the attack and threat vectors were real -- but, noted the American Banker's Association's Kawika Daguio: "It is a classic attack." "I've seen it, and I've seen things like it before," said Mr. Daguio. Nothing new. Matt Bishop, the UC prof, also sounded less than awed by FV's creativity: "There is no reason why one could not write a program to monitor keystrokes, look for numbers which look like credit card numbers, and sent them out over the Internet," in an unobtrusive way, to a thief elsewhere. (Prof. Bishop might have had more to say, had he been told it took a FV programmer a _month_ to write a keyboard sniffer optimized for credit card data;-) As a newcomer to this List, I have the impression that C'punks are a little jaded when it comes to mass-market CompSec and ComSec threats -- and perhaps a little rabid when it comes to anyone rash enough to suggest that the first mass-market crypto product (in the hands of naive consumers, with unprotected PCs and poor CompSec habits) may have dangerous procedural vulnerabilities. A little perspective, guys! Crypto from an insecure base has risks that deserve to be highlighted; and credit cards numbers are uniquely negotiable passwords. FV is scare-mongering, sure -- but that's combat marketing. Mr. Borenstein's press release posted in C'punks was chumming with raw bloody beef -- and that was just dumb -- but it was striking how blithely many folks here acknowledged (and immediately dismissed) the threat he described. Nothing wrong with FV trying to slow the bandwagon of a major competitor by drawing attention to vulnerabilities or potential vulnerabilities of their technology in a mass market. This happens a lot -- although most corporate perpetrators try to hide their hand a lot more than FV did, and they generally sound a lot less self-righteous -- but a little brawling is not a bad thing, particularly in IS security. (Some markets, like firewalls, desperately need a little more competitive clarity.) On the other hand, Mr. Borenstein's hyper-inflated presentation of First Virtual's case all but begged for the C'punk lynch mob that has followed him down through several threads on this List. If he didn't expect the reception he got, he should fire his PR advisor and get someone who knows how to write without the purple prose and napham. Simson Garfinkel and the Mercury News are getting a bad rap from folks caught up in the mob chasing Mr. Borenstein. Read the three articles. The on-line version has a headline that is a bit overwrought ("Program shows ease of stealing credit information") but overall, it's a credible, savvy, and amusing piece of journalism about FV. Quite professional, I'd say. Suerte, _Vin Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

parallel encryption
by Simon Spero 17 Dec '03

17 Dec '03

Ok, so I've got my BeBox and so finally have an SMP of my own again; anyone want to suggest any cool crypto stuff that parallelises well? Rogaways hashs look interesting, and nDES offers an obvious process network for pipelining, but what about things like running multiple interleaved CBC streams in parallel, with each stream starting off from a different IV? I can't think of any practical ways of speeding up a single RSA operation, although twice as many processors obviously gives twice the thruput. Simon ------ "GM spent $3.6 billion giving birth to the Saturn, and it doesn't even go supersonic." - Ben Rich, Skunk Works head (75-91)

2 1