December 2003 - cypherpunks-legacy

Re: A weakness in PGP signatures, and a suggested solution (long)
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- An entity calling itself Rich Graves <llurch(a)Networking.Stanford.EDU> allegedly wrote: > > An easy short-term partial solution would be to modify mailcrypt, bap, or > whatever front end you use to automatically put the current date and (a > shortened form of) the To: or Newsgroups: header into the PGP signature > Comments: line. I wrote: > > A good idea, and one I was about to implement for BAP, but > doesn't PGP itself stick a timestamp into the signature? > When I verify a signature it says "verified, signed at > XXX time & date.". Whoops! I misunderstood. The fix I am considering is putting some information inside the *body* of the message, probably at the end just before the signature. Regards, Bryce -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMP2Bj/WZSllhfG25AQHxWwP/bHmOcuAPAHdCShaeZhpLYQPJEJWyApuV EQhA/k1TSxmowH0cPff1rBZw4+2HFzfKiWHgBO12lf6gO+ihVGq/7GAJuwEVmMb6 aNKhSRESmb2YgV8/luj401KnknSP1x3xC56wzE1mhIiN8LOtav2J+rxM398DTzEc 8mzb7dETBRU= =ZDiw -----END PGP SIGNATURE-----

1 0

Re: Information Sent by Netscape during Queries
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Jeff Weinstein writes: > > 3) Can we go completely stealth inside of Netscape without a proxy server? > No. Right now you can't disable cookies, you can't disable > referer, and you can't mask your IP address. But on Unix systems, at least, you can make "referer" more difficult for nosy servers to use -- subject to the "applicable laws" where you live. (The license agreement says, "...you agree not to modify the Software ... except to the extent [that] applicable laws specifically prohibit such restriction.") Just back up your Netscape executable, then load it into Emacs (or any editor which can handle arbitrary binary files), search for the "Referer:" string, and change it to an appropriate string of the same length. "MYOB: " sounds like an appropriate string to me... -----//---------------------------------------------------------------- Please note: This message has been anonymized on request of its sender. If you would prefer not to receive anonymous mails from this machine, please contact postmaster(a)bi-node.zerberus.de and say so. For further information regarding this service, please send mail to remailer(a)bi-node.zerberus.de with subject 'remailer-help'.

1 1

Re: CryptoAPI and export question
by Joe Thomas 17 Dec '03

17 Dec '03

On Wed, 17 Jan 1996, Tom Johnston wrote: > Two points: the CSP development kit is export-controlled; and signing a > CSP developed by a foreign vendor is treated as a export -- so the signature > is export-controlled. The *signature* is export controlled?!? What the hell kind of sophistry could the State Department use to deny an export license to a signature? Joe

1 0

Re: Microsoft's CAPI
by Lee Fisher 17 Dec '03

17 Dec '03

Matt Blaze <mab(a)research.att.com> writes: | I attended a meeting at Microsoft the other day at which they | described their Crypto API project. As CAPIs go, it's reasonable | enough; ... As of today, some basic information on "Microsoft CrytoAPI" is available at http://www.microsoft.com/intdev/inttech/cryptapi.htm. It looks like this page has an overview, a 25-page Programmer's Guide, and 5 sample apps which use the API. In general, http://www.microsoft.com/intdev/ is the best place to check for any new for Internet developer-related stuff from MSFT. __ Lee Fisher, leefi(a)microsoft.com, 206.936.8621

1 0

ITSEC?
by Juan D. Sandoval 17 Dec '03

17 Dec '03

does anyone know where I can get info on Information Technology Secure Evaluation Criteria (ITSEC)? I think it is more or less like "the orange book" but in Europe. Thanks

1 0

Re: A Modest Proposal: Fattening up the Proles
by Duncan Frissell 17 Dec '03

17 Dec '03

At 06:46 PM 1/17/96 -0800, Steven Weller wrote: >See also _The End of Work_ by Rifkin. It chronicles changing work patterns >from agriculture through mass manufacturing and the service age on to an >uncertain future. Lots of interesting numbers and "look what is already >happening" statements. It also shows that the changes are inexorable, just >as the decline in agriculture based on human and animal labor was. Except when I had Rifkin on the phone on a National Commie Radio talk show he dishonestly refused to admit the fact that -- so far -- employment in the US (total and percentage workforce participation) is higher than it's ever been. A lot of that is the commie belief that a job is something someone else gives you rather than something that you do. It's a bit hard to be without work if you assign it to yourself. And if wants are unlimited then one of the "goods" for which wants are unlimited is labor. DCF "A job he calls it! Reading the legal notices in the Times searching for unclaimed bequests in his name." -- The New Yorker

1 0

PARTY-PARTY-PARTY
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, You are all invited to the party I am having on 10 February. Instead of using old-fashioned e-mail to give you the details, I'm using a Web page donated by co-host Sameer. Check it out: http://www.c2.org/party/masquerade/html By the time you read this, there should be a map on the page. If not, try back in a day or two. If you do not have a browser, send me e-mail and I'll send you an ASCII invitation. Cheers, S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re: Blacknet & Lotus Notes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 19:13 1/18/96, Adam Shostack wrote: [...] > So...Is Notes V4 shipping yet? Do we know how many bits of >key we're after? (NB: I'm assuming that (some part of) the US >government has an RSA private key which is used to encrypt the 24 bits >of GAK'd key.) What I would like to know is which agencies have the key. Any hard info? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

The I Bomb
by John Young 17 Dec '03

17 Dec '03

A&E presents this week the BBC Horizons show, "The I Bomb," featuring Tim May smart-bombing various brass and infowar chicken littlers. It also shows an SAIC wizard sniffing a system to plant evil polymorphous code a la Shimomura -- presaging the recent GNN report on NSA's net traps. ---------- From: http://www.aetv.com A&E _________________________________________________________________ Series: Voyages. The I-Bomb. A look at how information--not bombs--is becoming the most important weapon in war. Includes interviews with top U.S. military strategists and futurists Alvin and Heidi Toffler. Duration: 1 hour DateTime Thursday1/18 10pm [EST, presumably, since the show just finished] Friday1/19 2am Saturday1/20 11am _______________________________________________________________

1 0

re: CAPI signing
by m5＠dev.tivoli.com 17 Dec '03

17 Dec '03

A Microsoft person just responded via direct e-mail that they'll do CAPI signing in the United States (the word "only" wasn't in there, but that certainly was the implication). This means, to me, that there won't be much CAPI-compliant software produced outside the US, or at least that people who do it will have to bear that insult. It's reminiscent of the Lotus thing. I see no reason for Microsoft to be reluctant to have non-USA signings other than fear of USGov reprisals. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Nobody's going to listen to you if you just | Mike McNally (m5(a)tivoli.com) | | stand there and flap your arms like a fish. | Tivoli Systems, Austin TX | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0