December 2003 - cypherpunks-legacy

Re: "and two forms of ID"
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>I'm sufficiently impressed with the arguments against name credentials >that Carl Ellison has made that I'm looking seriously into systems >that don't do any sort of conventional certificate binding at all... ... and I bet, Wei Dai's contentions to the contrary, that they'll be *cheaper* to use than those which do certificate binding, all other things being equal. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

3 2

fun with the web and security
by daw＠orodruin.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

Here's a fun way to exploit security holes via the web: http://www.cs.berkeley.edu/~daw/js1.html A rough representation of its contents follow. Whee! The web is awfully convenient for exploiting security bugs.... The following URL contacts your sendmail SMTP server and attempts to exploit an old, well-known security hole, trying to gain root access. Click _here_ to try it. As it stands, clicking on the URL above does not do anything harmful to your machine-- but it could! (This is a test of the emergency broadcast system. This is only a test.) ______________ We can get you to send arbitrary text, to an arbitrary port on an arbitrary host, from your machine. (If you are inside a firewall, we can thereby send arbitrary text to any internal machine by getting you to click on the link above.) The technique is simple: we list the host and port in a gopher URL, and encode the text to be sent in the path. For instance, a successful exploit of the hole could leave a backdoor root shell, and inform us via a pseudonym at an anonymous remailer. The exploit could be hidden by use of the JavaScript "width=1,height=1" techniques pioneered at John LoVerso's _JavaScript security hole page_; then you wouldn't even know when you'd been attacked. The exploit could be forced on you via many standard tricks: the Redirect: or META-EQUIV Refresh: or JavaScript mechanisms work fine, for instance. This is most dangerous when you are behind a firewall. Typically, there will be many machines inside a firewall which run insecure software. Normally, that would be safe, since the firewall prevents an outsider from connecting to the unsafe sendmail servers inside-- yet the example URL above allows outsiders like us to exploit security holes on the inside of your firewall. Nothing stops us from putting the IP address of a vulnerable machine inside your firewall in the URL above, and waiting for you to click on it: the firewall doesn't prevent connections from you to the internal vulnerable machine, and thus can't stop this attack. Using JavaScript, we don't even have to wait for you to click on anything. Furthermore, a JavaScript program could systematically and invisibly try all the machines inside your firewall. We could have used many other well-known security holes: there's nothing special about this particular sendmail bug (except that it was convenient for us to implement). ______________ Be afraid. Be very afraid. -- Ian Goldberg and David Wagner.

2 3

Re: Ass. Politics
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:51 PM 2/25/96 -0500, David R. Conrad wrote: > >Salman Rushdie, in a speech I heard several years ago, said that it was >widely doubted that Iran would or could actually come up with the three >million dollar bounty on his head. >This may play a large part in why he is still around. A few people who basically seem to oppose my idea ("Assassination Politics") try to use the Rushdie example as being some sort of "evidence" why it wouldn't work. ("If Rushdie is alive years later, with a few million on his head, that proves assassination doesn't work...") I, on the contrary, believe that it actually SUPPORTS my theory: Clearly, nobody has trusted Iran's leadership enough to genuinely believe he would be able to collect the reward, and thus the apparently size of the reward is discounted in people's minds. When I respond to these objectors, I point out that if Iran was REALLY serious about expecting to see Rushdie dead, they would have long ago set up some sort of system, analogous to AsPol, that would allow an anonymous assassin to kill Rushdie and collect the reward, guaranteed, without risk of exposure. Clearly, that hasn't happened. (I think we would have heard about it if it had.) This doesn't make the Iranians any more "civilized," obviously, it just means that they are either less competent or trustworthy about achieving their goals (or are seen to be so), or that they really don't want to/can't pay anybody the money for Rushdie's death. I don't recall every seeing anyone even attempt to contradict this counter-argument; they always agree that nobody really believes anyone can safely and reliably collect the Rushdie reward. Needless to say, this raises serious doubts about the competence of many objectors to critically analyze the issues in AsPol. It would be interesting to get Rushdie's opinion about AsPol. It's understandable if he had an initial feeling of revulsion about such a system, on the other hand he should recognize that this system would also allow opponents of the Iranian government to eliminate those who called for his death in the first place. It is reasonable to suppose that had this system been functioning years ago, Iran's government would have been taken down long ago. >I think all the analyses of the economic costs of protecting one person >vs. protecting many people are rather beside the point, in light of this. I agree. AsPol will work even if a few people can be protected, and protecting many people is simply not an option. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTJ0NPqHVDBboB2dAQGLmAP/dAPz0FrZNT12NjEvkXuXm5JHVbdJPwDq JhwDBTAReTOirpNJ8mcgn8KN4hsL5rK5Qwyp+7YO3xRPMh39HPH2uBpq63/RZn2p uu7eXmrR4HQMKhuK5XReYJtARdPdTgL/F3cmMr1TNUW7M+aJikGo4b1OEycIYNdo Aa1o/peUXlw= =059O -----END PGP SIGNATURE-----

1 0

Re: In favour of privacy legislation
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

> Why shouldn't I be able to sell it. Information is free. If > it's illegal to sell it in the US, I'm sure Marketing Info, Inc., > operating out of Costa Rica, would be happy to sell the information > about your buying habits. If we're talking about a US-based, on-shore operation, the reason why you should not be able to sell my buying habits, ethical and legal, would be that I gave them to you in the first place, for a specific purpose. If we're talking about Costa Rica, which has achieved mythical status as a data haven in some future cupherpunked world, thenwe're not in the US any more. We're in the world of the Internet, of the technology-is-law life that appeals to so many of us (including me), and you wouldn't be able to track my buying habits anyway. I'd be using the alpha.c2.org remailer, which would have conveniently located itself in - where else - Costa Rica. ---------------------------------------------------------------------- The Indian Techonomist - newsletter on India's information industry http://dxm.org/techonomist/ rishab(a)dxm.org Editor and publisher: Rishab Aiyer Ghosh rishab(a)arbornet.org Vox +91 11 6853410; 3760335; H 34 C Saket, New Delhi 110017, INDIA

2 2

Re: TIS--Building in Big Brother for a Better Tommorrow
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 04:41 PM 2/26/96 -0800, anonymous-remailer(a)shell.portal.com wrote: >On 22 Feb 96, John Young wrote and quoted Steve Walker: >> To supplement TIS's Web site information on CKE, here's a >> mailing from Steve Walker earlier this month: >> TRUSTED INFORMATION SYSTEMS, INC. > February 2, 1996 >> There has been amazing progress on TIS's Commercial Key >> Escrow (CKE) initiative since my last status report. > [Much quite-valid disgust with CKE (GAK!) deleted] >> ...it represents the first export approval of a DES-based key >> escrow encryption system, a small step... > >...backward. > >> ...the private sector's need for encryption protection and >> governments' needs to be able to decrypt the communications >> of criminals, terrorists, and other adversaries... > >There is no difference between the justification for this and >what was offered to justify Clipper. > >"Other adversaries," like those who want to keep their affairs >private, or wish to live free in an increasingly unfree world? >I think I'm gonna puke. Instead of "and other adversaries," why didn't they just come out and say, "and Jim Bell"? I feel left out! Ignored! Now I know how "the Professor and Mary Ann" felt. This is a social slight I can't possibly tolerate! Jim Bell, Adversary. jimbell(a)pacifier.com Klaatu Burada Nikto Something is going to happen... Something...Wonderful! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTJzNPqHVDBboB2dAQFROAQAge2OrsqHHnQ6fBPw2UWoWdiJcagwWspA s8Zed6Rfeo/X3Hhuy6KT8AaRq2TwaHaiykaEaDMEzdRUhgKQi32pOP3/Pr/ISUqH PXh8QEDdmaYPmVTnw++2TZTJtWosPvn0g/zgpAqPVy5ibVJ03dzdToAj2+2vjdxF j9zauQHsvxQ= =xLqm -----END PGP SIGNATURE-----

1 0

PGP to PC mail integration
by Mike Ingle 17 Dec '03

17 Dec '03

Mail user interface integration remains the biggest barrier to widespread PGP use. As long as it's inconvenient each time you want to send a mail message, people won't use it. Existing efforts to fix this are usually mail-program specific (elm-pgp port, some Pegasus and Eudora hacks) and/or not terribly convenient (ViaCrypt and similar win-pgp front ends). It seems to me that people are attacking this problem from the wrong end of the pipe. Almost all internet mail programs (Eudora, Pegasus, Netscape, Exchange client with Internet mail, you name it) talk to a POP server and an SMTP server. They allow you to specify the hostnames of each. Instead of messing with user interfaces, you set the POP and SMTP addresses of your mail program to "localhost". You run locally a Visual Basic program that sits on ports 110 (POP) and 25 (SMTP) listening for connections. The VB program is configured with the addresses of your real SMTP and POP servers, and acts as a proxy. When your mail program retrieves POP mail, it goes through the VB program, and the VB program decrypts any PGP mail it sees. When it sends mail, the VB program encrypts any mail it has a PGP key for the recipient of. Once this is set up, the user burden is near zero, and it works with any winsock-based mail program. What do you think of the idea? Mike

2 1

RC
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

And might I point out that "RC" has been the registered trademark of the Royal Crown Bottling Company since long before Mr. R... P.fla

1 0

PGP backdoor? (No, I'm not paranoid.)
by Mark Bainter 17 Dec '03

17 Dec '03

I was recently speaking with a newly-made aquaintence, and we were discussing the merits of various encryption systems. Now, I had heard about all the people who claimed the reason versions later than 2.3 wouldn't work with 2.3 was because of a backdoor for the government. I personally thought they were being paranoid. However, this guy tells me that he met Phil at defcon and phil told him that he co-operated with the government and gave them information that would enable them to crack key's for versions later than 2.3. I don't know whether to believe him or not, as I said earlier he is not a long-time friend or anything, so he could just be lying to me. If anyone has any information on this I would appreciate it. --- "Man did not enter into society to become worse than he was before, nor to have fewer rights than he had before, but to have those rights better secured." --- Thomas Paine 1791 >>My key is on the keyservers.

3 2

[South SF Bay Area] PLAY ANNOUNCEMENT: "Breaking the Code" (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

FYI. Might be amusing. I'll probably go, if I can find a free moment. -rich The Dream Team ---------- Forwarded message ---------- Date: 25 Feb 1996 20:55:33 -0500 From: Michael Deleon <deleon(a)rahul.net> Newgroups: ba.announce, ba.motss, rec.arts.theatre.plays Subject: PLAY ANNOUNCEMENT: "Breaking the Code" Menlo Players Guild Presents BREAKING THE CODE by Hugh Whitemore Based on the Book: Alan Turing: The Enigma by Andrew Hodges The private life of an extraordinary and brilliant man becomes the means of his destruction in this dramatic story, which won acclaim on Broadway. At its center is Alan Turing, the mathematician and British war hero who broke the famous German Enigma Code, giving the Allies the key to winning World War II, and yet was persecuted by his government for his sexual orientation. This portrait of a complex, visionary man torn by society's conflicting rules is chillingly powerful. February 23 - March 16 Thurs-Sat, 8pm Sunday March 10 at 2:30 Burgess Theatre, 601 Laurel Street, Menlo Park Tickets and info call (415) 322-3261 Visit our web page at http://www.best.com/~carjack

1 0

Re: S/MIME outside the US?
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:49 PM 2/24/96 -0500, Lewis wrote: >volley(a)lls.se writes: >> If I got things right, DES is "exportable" as long as the keysize >> is kept under a certain size, which is too small to be really secure? > >All things are exportable as long as the keysize is kept under a certain size, >which is too small to be really secure. That's not correct - you can only export crypto code from the US for which you have Permission, and they'll only give you Permission if it's weak crypto or you agree to be Well-Behaved (e.g. US banks can export real DES for talking to other banks, but US banks can be subpoenaed and forced to hand over the plaintext.) There have been people who've gotten export permission for modified DES, e.g. real 56-bit DES with the key chosen from a 40-bit keyspace. I'm assuming from volley's address that he or she is in Sweden, and thus not directly limited by US export laws. Write what you want, and post it somewhere outside the US; we can import it legally. As a non-American, you probably couldn't get US export permission for even 40-bit RC4, and maybe not even for rot13. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

3 2