December 2003 - cypherpunks-legacy

Re: JavaScript to grab email
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 4:33 PM 2/20/96 +0200, Jyri Kaljundi wrote: >Another annoying feature in JavaScript and Netscape. Have a look at ><http://www.popco.com/grabtest.html> > >The page uses JavaScript to steal your e-mail address and sends a test >e-mail message to the address it grabbed. It works with Netscape, which >is probably only browser supporting JavaScript. > >Probably there will soon be thousands of pages which include this code, >and people using Netscape 2.0 will be spammed with commercial messages. >So just put some false e-mail address in your Netscape browser to disable >this feature. >... Anyone know the email address of an email reflector that automatically sends everything sent (not bounced) to it back to the sender. Or I suppose I could use invalid names/domain names. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Chaotic physical systems as random number sources
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

I'm curious if anyone knows of any attempts to use a chaotic physical system (such as the famous double pendulum) as a source of random numbers. I did an Alta Vista check on the problem, and all I turned up was a paper (in postscript, so I couldn't read it) on all mathematical pseudorandom number generators being logical chaotic systems. (It's at http://csl.ncsa.uiuc.edu/~herring/publications/rand.ps) One problem that I can see is that of strange attractors. While the path through each time would be different, they're still _close_ to each other, and a practical mechanical system might not be sensitive enough to pick up the differences. Thanks, -Allen

1 0

New Remailer
by remailer＠meaning.com 17 Dec '03

17 Dec '03

The Nemesis Remailer is online at remailer(a)meaning.com. It supports Type 1 (Ghio) and Type 2 (Mixmaster) messages. It is still in beta testing. Comments to remailer-owner(a)meaning.com would be appreciated.

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by Jim_Bostwick＠cargill.com 17 Dec '03

17 Dec '03

In <199602200851.DAA02057(a)thor.cs.umass.edu>, Lewis mentioned: > Could you explain what the acronyms "ADC" and "LOB" mean here ? I [and] > I might guess that LOB = Low Order Bits. Now, I'm way (WAY) over my head on this forum wrt crypto. However, an idea -- ADC might mean Analog Digital Converter. LOB might mean Low Order Bit (singular). So, IPG may just be watching the LOB of an off-the-shelf analog input card. Rash speculation, of course. However, if true, a Novitiate Crypto Wizard might be prompted to ask: "Assuming I use an audio source to drive the ADC, which of the following would yield higher entropy?: * Greatfull Dead * Al Gore speeches * The Beatle's White album (at 78, backwards) * The hiss after the local AM station shuts down for the night. " :-) -jim P.S. My name is Jim Bostwick, I hate big SIG files, and my employers opinion might actually coincide with my own - but probably not.

1 0

Internet Privacy Guaranteed
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, (KEY #1) Date: Mon, 19 Feb 1996 20:01:06 -0500 From: "Perry E. Metzger" <perry(a)piermont.com> To: IPG Sales <ipgsales(a)cyberstation.net> Cc: cypherpunks(a)toad.com Subject: Re: Internet Privacy Guaranteed ad (POTP Jr.) [snip] > ...keymanagem,ent makes RSA systems unmanageable for large > organizations - offer such a suystem to Merrill Lynch and be > laughed out of the office.... [snip] Even private key systems are quite workable. I actually work with these firms [large organizations] -- its what I do for a living. They have existing systems based on KDCs (do you even know what a KDC is?) and they function just fine. As for public key technologies, they [large organizations] are in many cases implementing technologies based on public key system. [snip] (KEY #2) Date: Mon, 19 Feb 1996 20:37:42 -0500 From: "Perry E. Metzger" <perry(a)piermont.com> To: IPG Sales <ipgsales(a)cyberstation.net> Cc: cypherpunks(a)toad.com Subject: Re: Internet Privacy Guaranteed ad (POTP Jr.) [snip] IPG Sales writes: > there is no need in talking in circles - You may think that > you know everything there is to know about encryption, but > believe me, there is a lot more for you to learn - I do not > now what KDC's are, Key Distribution Centers, the center of Needham-Schroeder and similar key management protocols, like the Kerberos protocols. [snip] (KEY #3) Date: Tue, 20 Feb 1996 01:28:01 -0700 From: Nelson Minar <nelson(a)santafe.edu> To: cypherpunks(a)toad.com Subject: breakable session keys in Kerberos v4 I'm a bit suprised this hasn't turned up yet on Cypherpunks. A couple of forwarded messages: first, an announcement made Fri Feb 16 by Gene Spafford at COAST about an exploitable flaw they've found in Kerberos, and then a comment on the www-security list that it is due to a bad random number generator. Same old story! The message (lifted from the COAST web site) [snip] (a comment I found in reply [to the COAST message]) ------- Start of forwarded message ------- From: jis(a)mit.edu (Jeffrey I. Schiller) Subject: Re: Kerberos Vulnerability Newsgroups: hks.lists.www-security Date: 19 Feb 1996 21:42:08 -0500 Organization: HKS, Inc. Path: hks.net!news-mail-gateway!owner-www-security Lines: 8 Sender: root(a)hks.net Message-ID: <ad4e9fc40602100421be(a)[18.162.1.1]> NNTP-Posting-Host: bb.hks.net There will be a fix distributed by MIT later this week. The problem is that the random number generator in V4 is worse then we thought! The fix is to retrofit the V5 generator (which is decent) into the V4 KDC. Note: Only the KDC needs to be updated, clients and servers are unaf- fected. -Jeff ------- End of forwarded message ------- (KEY #4) Kerberos offers a better network security model than ignoring network security entirely. Unfortunately, it is plagued with holes, from windows that remain "authenticated" for hours while the user is at lunch, to passwords that are stored in plain text on the authentication server. Page 553 of: Evi Nemeth, Garth Snyder, Scott Seebass, Trent R Hein. UNIX System Administration Handbook. Second Edition. Prentice Hall PTR. 1995. ISBN: 0 13 151051 7 email: sa-book(a)admin.com http://www.admin.com Cordially, Jim NOTE. The above message excerpts are reformatted.

1 0

Re: Easy Nuclear Detonator
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"jimbell(a)pacifier.com" "jim bell" 20-FEB-1996 09:01:32.20 >As for the inclusion of your private note: sorry again. But at the time, >it just didn't occur to me that you'd object to this. "Nettiquette" is new >to me. Ah. I understand mistakes. I've made one similar to this before, although it was through not noticing that a mailing to me wasn't also to Cypherpunks, rather than not knowing the (rather basic element of) Nettiquette of not posting someone else's private email. Apology accepted. -Allen

1 0

Chaotic physical systems as random number sources (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 20 Feb 1996 14:47 EDT > From: "E. ALLEN SMITH" <EALLENSMITH(a)ocelot.Rutgers.EDU> > Subject: Chaotic physical systems as random number sources > > I'm curious if anyone knows of any attempts to use a chaotic physical > system (such as the famous double pendulum) as a source of random numbers. I have used magnetic pendulums for this as well as chaotic dripping (both with an old C64). > One problem that I can see is that of strange attractors. While the > path through each time would be different, they're still _close_ to each other, > and a practical mechanical system might not be sensitive enough to pick up the > differences. Not necessarily. In both the magentic pendulum and chaotic pendulums this is not a problem. Jim Choate ravage(a)ssz.com

1 0

Re: NET_run
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"abostick(a)netcom.com" 20-FEB-1996 09:07:55.46 >should not be confused with Steve Jackson Games' GURPS Cyberpunk module >for Jackson's GURPS role-playing system, which was published later.) >"What the hell does this have to do with cryp%*##~~~ Actually, it does. Steve Jackson Games (SJG) was raided by the Secret Service for that game, in which the Secret Service showed their total ignorance of computers by mistaking it for a "handbook of computer crime." Since they're the ones also concerned with counterfeiting: A. this indicates something about how much one needs to worry about counterfeiting, and one reason that even with the new changes, US currency is still one of the easiest ones to counterfeit with modern technology. B. they're likely to be total idiots when it comes to digital cash On the other hand on the last point, they did look at one private currency scheme and deem it allowable, since the (physical) bucks in that case didn't resemble US currency. The governmental group that _did_ have problems with it was the SEC, who decided that since its non-inflationary qualities were based on direct funding through a group of investments, it qualified as an unlicensed mutual fund. Moral of the story: don't base it in the US, or don't make it run off of investments. -Allen

1 0

Re: Optical repeaters
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"thad(a)hammerhead.com" 20-FEB-1996 09:52:39.27 >But, and this is the interesting part; you cannot use this feature to tap >the line. Measuring either one of these photons would disturb the other, >destroying the state that it has. I believe that all of this comes down to what and when is the "waveform collapse" - what and when is observation. If any interaction with something else counts as observation, then it won't work. This problem is where one gets into the many worlds hypothesis et al. -Allen

1 0

Re: Optical repeaters
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 08:04 AM 2/20/96 -0800, jamesd(a)echeque.com wrote: >At 07:35 PM 2/19/96 -0800, Timothy C. May wrote: >>By analogy, it is not clear to me that a simple regeneration mechanism, >>with no local observer or recording apparatus, will collapse the wave >>function. Seems to me an experiment may have already been done along these >>lines: separate fibers producing an interference pattern and then these >>inline amps added...if the interference pattern remains, as I would expect, >>then the amps/regenerators did not constitute a "measurement" in QM terms. > >An amplification mechanism will usually couple the signal to the vacuum, >and introduce vacuum noise. Another way of thinking of vacuum noise >is that amplification mixes the state of the signal, with the (unknown) >phase of the universe at infinity. I would think that the action of a optical fiber amplifier is, in a sense, "negative loss," or the inverse of the kind of loss normally found in a fiber cable. Thus, if quantum crypto can be done through a long fiber at all, the fiber amplifier shouldn't negatively affect it. However, if polarization is important (and I know that "polarization maintaining" fibers are available) then I assume that the amplifier would probably also have to be designed to ensure that polarization would also be maintained through the EDFA (Erbium-Doped Fiber Amplifier.) Jim Bell jimbell(a)pacifier.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMSoOwfqHVDBboB2dAQGyawP/TZDei/hk1S3ohFGCz+z8hlLbYuL5Bswo 17UYtM/NyCdKtZ3K/4t2wuGjKwhzUY8iuzi9b1DiKG5pqlsi4rIMz6VqF5V3dIie 5MjDmlCVabYJR5a5DKbWGb/osVsKJfEDskhMcGKtnjMQc3L/Ua9DzkhXhfQ2GWUh u+4hhjL+i5E= =f/Cm -----END PGP SIGNATURE-----

1 0