December 2003 - cypherpunks-legacy

Re: Security Update news release
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DFIKyx.63G(a)sgi.sgi.com>, shamrock(a)netcom.com (Lucky Green) writes: > Do the new versions use PGP's randseed.bin? If Netscape even only looks at > data used to keep PGP secure, Netscape will be banned from my computer > and every computer I am responsible for. -- For good. This is ludicrous. You couldn't compromise PGP's security even if you posted the contents of randseed.bin to the net. It's contents are carefully sanitized before it's saved to disk and before it's used. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

1 0

Re: First Payments WG Meeting Announcement
by pays＠gctech.edelweb.fr 17 Dec '03

17 Dec '03

At 15:41 26/09/95, Phillip M. Hallam-Baker wrote: >The World Wide Web Consortium is holding a Workshop on payments. The workshop >is intended to be a small, technically oriented meeting of its payments working >group. Although it is a members only event I am willing to listen to special >pleading, alternatively companies may wish to join the consortium at our >extreemely reasonable rates. See http://www.w3.org/pub/WWW/Consortium/ for >details. > >-- >Phillip M. Hallam-Baker Not speaking for anoyone else >hallam(a)w3.org http://www.w3.org/hypertext/WWW/People/hallam.html >Information Superhighway -----> Hi-ho! Yow! I'm surfing Arpanet! > >ANNOUNCE: First W3C Payments WG Meeting, October 11 > >---------------------------------------------------------------------------- > >What: 1st W3C Payment WG Meeting > >Where: MIT EECS, Grier Room 34-401 (subject to change) > >When: Wednesday October 11, 9am - 5pm > All that is extremely fine and an awaited initiative BUT for one point the EXTREMELY SHORT DELAY and notification!!!!!! Our company is just in the "joining the consortium" process, especially because we were expecting such an event. However, to be able to catch a flight and spend a couple of days at MIT within less than a fortnight is another matter. I don't yet know if we will able to attend, and we really would hate to be unable to attend and participate. Thus I would urge the Web Consortium to consider postponing this meeting for at least 2 or 4 weeks so that any interested party is able to decently cancel other commitments and get prepared for the meeting. If W3C is really interested in attracting all interested party, it would be fair as I suspect we are not the only ones with Please let me know as soon as if this is possible or if I must as soon as possible try to change my agenda. regards, -- PAP _________________________________________________________________________ PAP: paul-andre.pays(a)gctech.edelWeb.fr tel: +33 1 34 52 00 88 fax: +33 1 34 52 25 26 GC Tech "The Globe Online and Globe ID Technology Company" http://www.globeonline.fr/ http://www.gctech.fr/

1 0

Netscape Stock Prices
by Jeff Simmons 17 Dec '03

17 Dec '03

Here's the history of Netscape's stock price to date, with the dates of some Cypherpunk exploits, the Wall Street Journal Articles about them, and major Netscape press releases. Date High Low Close Volume 950809 75.000 53.750 55.500 3851.8 950810 56.500 51.375 51.375 2795.9 950811 53.000 48.750 51.500 1907.4 950814 51.750 50.250 51.250 530.9 950815 55.250 51.250 54.625 1040.6 Damien's Crack - AT&T deal 950816 56.500 55.250 55.625 997.6 Developer's Partnership announced 950817 55.250 52.500 54.875 562.5 WSJ article re: Damien 950818 55.250 52.250 52.625 409.5 950821 52.750 51.000 51.000 290.0 950822 51.500 50.500 50.625 258.5 Win95 Navigator released 950823 53.500 50.500 52.000 414.2 950824 52.000 51.250 51.250 119.7 950825 52.000 51.250 51.250 89.2 950826 Brute Crack 950828 51.750 51.000 51.000 210.2 950829 51.250 46.750 48.250 1037.9 950830 48.500 46.000 46.625 319.3 950831 49.500 45.750 49.500 423.0 950901 49.500 47.750 48.750 164.4 950905 49.250 46.000 46.250 277.8 950906 49.500 47.250 48.750 351.9 950907 50.750 48.750 50.250 499.1 950908 51.000 50.000 50.250 147.6 950911 54.750 50.250 53.250 533.7 950912 54.500 51.000 52.250 211.5 950913 52.750 50.000 50.750 150.8 950914 51.250 50.250 50.250 79.9 950915 53.750 50.250 53.250 242.1 950917 Ian & Dave's Crack 950918 55.250 51.750 52.500 350.1 New Software Announced 950919 53.250 49.000 53.375 373.5 WSJ article re: Ian & Dave 950920 56.250 53.250 54.750 302.5 950921 59.125 54.250 58.750 436.9 Collabra Purchase Announced 950922 63.250 59.750 62.750 807.7 Ray's overflow bug 950925 69.000 62.250 67.000 684.0 WSJ article re: overflow bug Stock prices from MIT's stock price history server and the Wall Street Journal. Cypherpunk dates from Sameer's Hack Netscape Page (not sure when Ray posted). Press anouncement dates from Netscape's home page. Any typos or mistakes from me. -- Jeff Simmons jsimmons(a)goblin.punk.net

1 0

[More NOISE] Re: Netscape for OS/2, when? (Re: Another Netscape Bug)
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:30 AM 9/26/95 EDT, Sentiono Leowinata wrote: >I wish Netscape will port it to OS/2 (already ask them, but no comment >from Netscape). I don't try it on Netscape 1.1N as it doesn't run >reliably under Win-OS/2 (10 min -> crash! ;) According to Netscape they will *NEVER* support OS/2. (They have made the statement a number of times.) They seem to think that OS/2 will never amount to much. (They may be right...) | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

PGP and FBI?
by Deranged Mutant 17 Dec '03

17 Dec '03

There's some sort of documentary on WBAI 99.5 FM out of NYC now. They're talking about PGP and right wing militias... the guy being interviewed called PGP a "one time pad system" and doesn't understand it... *sigh*

3 3

RE: More on "Entropy"
by David Van Wie 17 Dec '03

17 Dec '03

David Van Wie wrote: >>The entropy E is defined by the sum across n states of -P_i log_2(P_i), Timothy C. May wrote: >Hah! Another physicist converted to the information-theoretic view of entropy! Indeed. I was able to track down the literature, and it is most interesting. I am still a little bit skeptical of the "superset including thermodynamic entropy" school of thought, but I haven't finished reading all of the materials yet! Clearly, the IT "version" of entropy is a well defined and useful thing.... >I should've pointed out in my reading list that several names stand out in >this interpretation: I'll read with that endoresement in mind. Your thoughts on rigorous, _concise_, design criteria for sources of entropy would be appreciated (unless there is good quality work in the literature I haven't come to yet). dvw

1 0

RE: `Random' seed.
by David Van Wie 17 Dec '03

17 Dec '03

Matt Blaze <mab(a)crypto.com> wrote: >Here's my current favorite quick-and-dirty true-random-in-software generator. >Use at own risk and read the comments carefully... [...] > * Physically random numbers (very nearly uniform) > * D. P. Mitchell > * Modified by Matt Blaze 2/95 [...] > * WARNING: depending on the particular platform, truerand() output may > * be biased or correlated. In general, you can expect about 16 bits of > * "pseudo-entropy" out of each 32 bit word returned by truerand(), > * but it may not be uniformly diffused. While this comment provides some general information, it does not give the expected entropy in the form of testable assumptions. A first step in this direction is to provide the entropy series used to arrive at the 16 bit per 32 bit word estimate. The second step, as I recommended last week (RE: RNG Resource FAQ... on 9/22), is to provide a concise argument drawn directly from the mathematical weaknesses of the entropy series. In that post, I posed the following four criteria because they address the mathematical (theoretical) weaknesses of the entropy series, while using a vocabulary that should be sensible to a rigorous designer: 1) The states exist and can be identified. 2) The number of states n is known. 3) The index value i uniquely identifies a state. 4) The function P_i is known and well-behaved. In this way, an analyst can review both the entropy series itself, and a _concise_ statement of the criteria under which the series is defined (i.e. when the 4 mathematical weaknesses have been appropriately addressed), and the argument "why" has been scrutinized against the code or proposed design. dvw

1 0

RE: Netscape "random" number seed generator code available
by David Van Wie 17 Dec '03

17 Dec '03

Phil Karlton wrote: >[You will be expected to show your work. :-)] In the spirit of showing work, how about a run through your entropy series? dvw

1 0

Banks eyeball sci-fi style identification for ATMs
by an215712＠anon.penet.fi 17 Dec '03

17 Dec '03

Date: Sun, 24 Sep 1995 10:20:05 PDT NEW YORK (American Banker) - Biometric identification, a process formerly seen only in futuristic movies and high-security government offices, may soon become part of the most common consumer banking transactions. Bankers' interest in biometric ID -- a sophisticated antifraud measure that exploits the fact that every human possesses unique physical characteristics -- dates back more than a decade. But until recently most banks and equipment manufacturers have watched the development of technology that recognizes fingerprints, voices, and other personal traits from a distance. That has begun to change, experts said. One of the companies leading the charge toward everyday use of biometric identification in banking is Sensar Inc., a Princeton, N.J.-based company that is developing an automated teller machine application for its patented Iriscan process. According to experts, the eye is one of the most unique parts of the human body and the iris biometric more reliable than virtually any other, including fingerprints and voice. Voices change over the course of a life, and fingerprints sometimes disappear on people who work with their hands. By contrast, the iris, which is the colored area of the eye, is stable throughout a lifetime. They are thoroughly unique and naturally visible. In a nutshell, the company's product, to be sold under the name Irisident, is being designed to capture an image of a consumer's eye and match it to an image on file before authorizing an ATM transaction. ``The research that's been done with consumers indicates they like the idea of having biometric verification -- it gives them a feeling of greater security,'' said Liam Carmody, a principal with the Ridgewood, N.J.-based consulting firm Carmody & Bloom. ``But they don't want intrusive verification.'' Sensar officials understand that the use of the eye as an identification tool is likely to meet with skepticism from some bankers, who wonder whether consumers will rebel against it. However, they said their ATM application -- which should be available in prototype in the next few months -- is being designed to address the consumer concerns. And they insist that Irisident products will be of practical use to bankers. ``We are operating under the assumption that the consumer is not going to put his eye up to something to be scanned,'' said Kevin McQuade, vice president of strategic business development at Sensar. ``The breakthrough here is the ability to obtain the image of the eye unintrusively,'' said Thomas Drury, president and chief executive of Sensar, which is a unit of the David Sarnoff Research Center Inc., also based in Princeton. Several influential companies have committed money to the development of an ATM application for Sensar's technology, including Huntington Bancshares Inc., OKI Electric Industry Ltd., and a money-center bank that does not want to be identified. Though the bankers declined to discuss their investment in the project, OKI Electric has committed a minimum of $25.8 million for development funding in return for the exclusive rights to market the products in Japan, where the Tokyo-based company is the leading vendor of ATMs. Experts said this support shows that the financial services industry is looking for alternatives to the personal identification numbers and computer passwords that have been compromised with increasing frequency in recent years. The choices are many, and include fingerprints, on-line signature verification, and even the measurement of facial thermal zones. ``Bankers are interested in alternatives to the PIN,'' said V. John Stroia, a marketing manager with Diebold, Canton, Ohio. Diebold and IBM operate an ATM joint venture known as InterBold. ``The major barrier is not so much the technology as getting the customer acclimated to'' using biometric technologies. But, he added, capturing sensitive biometric data -- such as that from the eye or face -- ``is going to have to be covertly done.'' ---------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. If you reply to this message, your message WILL be *automatically* anonymized and you are allocated an anon id. Read the help file to prevent this. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: WSJ on Netscape Hole 3
by jsw＠neon.netscape.com 17 Dec '03

17 Dec '03

In article <199509252300.QAA29812(a)infinity.c2.org>, sameer(a)c2.org (sameer) writes: > He's -asking- for an exploit. Tshirts to Ray and the person who > does the exploit, if it gets written. Maybe I should just ring up 8lgm and > have them do one. > > > > > > On Mon, 25 Sep 1995, John Young wrote: > > > > > The Wall Street Journal, September 25, 1995, p. B12. > > > > > Marc Andreessen, vice president of technology at Netscape, > > > said the company will issue fixes for the recent glitches > > > later this week. He added that it's unclear whether > > > anything other than temporarily crashing a user's computer > > > could result trom the recent flaw. > > > > Oh Marc, you didn't really want to say that, did you? > > > > -Thomas > > I asked Marc about this one, since it bothered me too. Apparently Jared asked Marc if he was aware of specific examples of how this bug might be exploited. Marc replied that we had not seen anything other than what was already posted on cypherpunks. Since the original article did not use quotes, I assume that what was written was a paraphrase, and as such it has been interpreted by the author. That said, we take this problem seriously, and have taken steps to fix it. The patch that will be released tomorrow will include fixes for this buffer overflow, and others that we found during a review of all of our code. I think it would be more constructive to pound on the new version than one that is known to be busted, and will be patched by tomorrow. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0