December 2003 - cypherpunks-legacy

Extra
by John Young 17 Dec '03

17 Dec '03

The recent study by Blaze, Diffie, Shimomura, et al, of stunted cryptography is featured in the TWP story on crypto exports offered with WYZ_qak.

1 0

White House Not Decent
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

(Reprinted without permission from the Seattle Times Personal Technology section) White House Site Blocked Add the White House to the Internet's extensive list of dens of sin. Surfwatch, a widely used software program that prevents access to, and downloading of, sexually explicit material on the Internet, accidently blocked access to the White House home page recently - all because a "White House for Kids" Web site address contained the word "couples." That's a dirty word in the Surfwatch universe because many sexually explicit online sites use it as part of their come-on. In this case, "couples" merely referred to the Executive Branch tandems of President and Hillary Rodham Clinton and Al and Tipper Gore. Surfwatch fixed the problem within hours, although some might still find the site offensive. For political reasons, that is.

1 0

Re: TED_hal
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:17 PM 2/25/96, Brad Dolan wrote: >Lipke's neighbors indicate his income didn't match his lifestyle. > >FINCEN at work? I'm skeptical. How would Lipka's neighbors know what his "income" is, unless he told them? (My neighbors don't have any idea what my income is, for example.) Sounds like typical bullshit by neigbors, saying they knew something was "suspicious" (always after the fact, it seems). Also, all indications so far revealed are that Lipka was only paid by the Sovs in the mid-to-late 60s. And then only, according to released information, something like $500 to $1000 per dead drop, about once a month. Hardly a huge sum, even back then. Even if he invested this, which is unlikely, how would his neighbors know if this was part of his "income" or not? Sounds more like, "Yeah, we knew there was something strange about him," which about half of all neigbors say about arrested fugitives in their midst. (The other half saying, "But he was a really nice guy.") --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Encryption Chips
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:47 PM 2/25/96, "A. Padgett Peterson P.E. Information Security" >The nice thing about am implimentation in software is that the code can be >examined for just this sort of thing *on a randomly selected operating unit*. >- hard to do with a chip. But of course one's compiler may have been subverted, as Ken Thompson showed some years back. Software implementations are sensitive to different sorts of attacks than hardware implementations are. Me. I don't have any hardware crypto chips at all, and think it unlikely I will in the next several years. So I use only software crypto implementations. And I admit to not having verified that my copy of MacPGP is the same one now at the various sites...I figure that if the NSA has pulled a blag bag job on me and replaced my MacPGP with a special version that I've got other problems to worry about! Your mileage may vary. If I were responsible for crypto for large financial transactions, I'd have a different set of worries. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RE: White House Not Decent
by Chris Grantham 17 Dec '03

17 Dec '03

Gee, Someone should forward this thing to Bill, Hmm I think I will... Chris ---------- From: Anonymous[SMTP:nobody@REPLAY.COM] Sent: Sunday, February 25, 1996 9:43 AM To: cypherpunks(a)toad.com Subject: White House Not Decent (Reprinted without permission from the Seattle Times Personal Technology section) White House Site Blocked Add the White House to the Internet's extensive list of dens of sin. Surfwatch, a widely used software program that prevents access to, and downloading of, sexually explicit material on the Internet, accidently blocked access to the White House home page recently - all because a "White House for Kids" Web site address contained the word "couples." That's a dirty word in the Surfwatch universe because many sexually explicit online sites use it as part of their come-on. In this case, "couples" merely referred to the Executive Branch tandems of President and Hillary Rodham Clinton and Al and Tipper Gore. Surfwatch fixed the problem within hours, although some might still find the site offensive. For political reasons, that is.

1 0

Hack attempt? "12 days" from anon.com
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

Regarding the mysterious mail from mailer-daemon(a)anon.com that many people have received: 1. The mail was apparently sent by a daemon bouncing an undeliverable mail. anon.com is a "virtual domain" hosted at io.com, so it's unlikely that the daemon would have an anon.com address. 2. Headers show it was routed through 38.10.221.81 and smtp1.interramp.com. That IP address showed up as ip81.la.ca.interramp.com the first time I tried a traceroute. The second time it showed up as ip81.syracuse.ny.interramp.com. In any case, traceroute went recursive between los-angeles.ca.isdn.psi.net (38.145.221.110) and lan.losangeles.ca.psi.net (38.145.221.1). This indicates the target could not be reached - perhaps it's a PPP address, or disconnected. 3. There is an X-Sender: (Unverified) header entry. So the mail was SMTP faked without the HELO protocol. 4. The error purpoting to originate from mailer-daemon(a)anon.com says the mail was addressed to PeppermintPty(a)loacst.org. loacst.org is not a registered domain. 5. PeppermintPty is obviously Peppermint Patty; the "original message" is signed Marcie. Peanut fans will recognise these characters. So - what was it all about? An elaborate prank? A convoluted NSA plot? I would lean towards the first, but perhaps we'll know on March 1st, the date to "gain access to target". Rishab ps. the copy I received follows: >From mailer-daemon(a)anon.com Fri Feb 23 20:08:00 1996 Received: from m-net148.arbornet.org (m-net.arbornet.org [148.59.250.2]) by shellx.best.com (8.6.12/8.6.5) with SMTP id UAA20969 for <rishab(a)best.com>; Fri, 23 Feb 1996 20:07:44 -0800 Received: from smtp1.interramp.com by m-net148.arbornet.org with smtp (Smail3.1.29.1 #4) id m0tqBGv-0009SHC; Fri, 23 Feb 96 23:07 WET Received: from [38.10.221.81] by smtp1.interramp.com (8.6.12/SMI-4.1.3-PSI-irsmtp) id XAA24970; Fri, 23 Feb 1996 23:06:42 -0500 X-Sender: (Unverified) Message-Id: <v01520db9ad53979e9858(a)[38.10.221.81]> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Fri, 23 Feb 1996 08:11:33 -0800 To: (Recipient list suppressed) From: mailer-daemon(a)anon.com (System Mail Manager) Subject: Twelve Days of Christmas Status: RO -- <System Report> -- UNDELIVERABLE MAIL: Unknown Host("PeppermintPty(a)loacst.org") UNDELIVERABLE MAIL: Bad Key -- <Original Message Follows> -- *** TOP LEVEL: DESTROY IMMEDIATELY UPON READING *** *** DO NOT PRINT OR SAVE. Code1.8 Table2Hex6 *** DAY 10: DR. BLACK located a promising entry point at the target site. DR. BLACK recovered four of the six password tokens before his position was compromised. DR. BLACK will be replaced by DR. ORANGE. Estimated time to recover the remaining two password tokens and gain access to target: EIGHT DAYS (03.01.96) Confidence is HIGH. My team has been working around the clock for a month now. Please tell your people to be more tolerant. Yelling doesn't help anything. Marcie

2 1

WinSock Remailer
by Joey Grasty 17 Dec '03

17 Dec '03

C-punks: You can now check out the features of the WinSock Remailer at: http://www.c2.org/~winsock/ The remailer is now scheduled to be operational about March 21, 1996. After a one month alpha test, the executable will be available for download for beta testing by anyone who wants to run a remailer. Regards, -- Joey Grasty jgrasty(a)gate.net [home -- encryption, privacy, RKBA and other hopeless causes] jgrasty(a)pts.mot.com [work -- designing pagers] "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin." -- John Von Neumann PGP = A7 CC 31 E4 7E A3 36 13 93 F4 C9 06 89 51 F5 A7

1 0

mismaster
by Black Unicorn 17 Dec '03

17 Dec '03

Where is the latest version of mixmaster available? I can't seem to get hold of obscura for lance's homepage and * http://nately.ucsd.edu/~loki/ * ftp://nately.ucsd.edu/pub/remail/ seem to be down. Any ideas? --- My prefered and soon to be permanent e-mail address: unicorn(a)schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information

4 3

Re: Cypherpunks vs. Coderpunks
by Chris Claborne 17 Dec '03

17 Dec '03

At 09:49 PM 2/24/96 GMT, attila wrote: >** Reply to note from Perry E. Metzger <perry(a)piermont.com> 02/13/96 1:29pm -0500 > > [snip] >= The thing that makes Cypherpunks worthwhile is that its a place where >= you could, once, get news updates about GAK, information on the latest >= research into cryptography, organize mass key crackings, discuss APIs, >= talk a bit about the politics of cryptography, etc. >= > sounds like we're having the sme problems as "democracy" --it soon becomes >irrelevant! example: > > I was out of town for 6 days: I returned to find 1056 messages in the sorted > mailbox! yes: 1056 messages which it took close to an hour to delete almost 800 > of them as irrelevant. some you can discard automatically depending on the > author, some by content, etc. but I agree: it is clutter. I spend most of my time here as a lurker but I must chime in now. :) I filter to an unread area and then try to read once per week. I know that I trim off good articles while trying to trim the fat off. If you can't exercise restraint, how about putting "junk" as the first word in your subject. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = 7E BF 38 3F 24 A7 D1 B0 54 44 96 AA 10 D0 5D 51 Avail on Pub Key server. PGP-encrypted e-mail welcome! Dreams. They are just a "screen saver" for the brain.

2 1

Re: DNS-related problem, and, motherhood 'n apple pie, etc
by mrm＠netcom.com 17 Dec '03

17 Dec '03

I hope people evaluate Java (and all software) based on technical issues, and not based on whether or not you think I'm clueless, brain damanged or a liar. We take the DNS-related problem very seriously; we do understand how DNS works (I did say "apologies for the oversimplifiation"); we never have put our heads in the sand. I do think it's a bit unfair to the Java team to say we put our heads in the sand, since we are deliberately trying to be as open and honest and forthcoming as we can. I mean, we are publishing full source code, which I'm not sure is the case for lots of software that people place a lot of trust in, implicitly or explicitly. As I've said every time I've said anything, every time security awareness on the net is raised, I think it's good for the net. I personally don't regard the internet as secure, and any information I care about I have encrypted on disk. Any information I really, really care about I don't even have on the internet. I do regular backups. I'm not saying this is what everyone has to do. But it's not that hard or time-consuming, and it wouldn't hurt. But people who are in charge of corporate security for their company, or people who have very sensitive or very valuable information on their disks, should consider the many ways that the internt is insecure, not just how some applet could be exploited. Having said that, does that imply that I think it's OK for a Java application to have security holes? Of course not! I hope we can use Java-the-language to build more secure systems than we've gotten used to surviving in the past. Does that mean I'm downplaying the importance or seriousness of any applet-related hole? Of course not! I think it's possible simultaneously to understand the seriousness of a security hole, AND still to say it's a good idea for people to practice safe internet. Marianne Mueller I work for Sun, on the Java team. mrm(a)netcom.com mrm(a)eng.sun.com http://java.sun.com/people/mrm/

1 0