December 2003 - cypherpunks-legacy

Re: Lotus Notes
by Rich Salz 17 Dec '03

17 Dec '03

>So from who did Lotus license RC4? RSA, of course. I don't know the arrangements of RSA's license with Lotus, of course, but where did someone say that RSA mandated the keylength that Lotus uses?

1 0

Re: Lotus Notes
by Rich Salz 17 Dec '03

17 Dec '03

>I find this very interesting. RSA prohibits its licencees from using RSA >software with truly secure keylenghts. Hunh? I could find no mention of keylength or keysize in the RSAREF documents I had around. I'm at home now, but I also recall no mention of keysize or keylength in the license OSF has, either. /r$

3 2

Re: "German service cuts Net access" (to Santa Cruz)
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:53 AM 1/28/96 +0100, Alex de Joode wrote: > >Belgian TV (the dutch language channel) has a page on teletext (Ceefax) >[I don't think US tv has that feature] stating that the French backbone >is thinking about blocking sites that provide information that they deem >ethicly unacceptable, like sites that promote the denial of Konzentrations >Lagers, the extreme right, pornografic and pedophile sites. > >[page 128 BRTN, for those who can receive BRT] > > What about "the extreme left." Don't those people deserve to be blocked too? And how about US radio stations on RealAudio 2.0. Cultural Imperialism. So how do we overcome these "backbone blocking" maneuvers? DCF

2 1

Re: [FACTS] Germany, or "Oh no not again"
by Duncan Frissell 17 Dec '03

17 Dec '03

At 06:10 PM 1/29/96 +0100, Thomas Roessler wrote: >In particular, they are right now >*checking* whether providing internet access is a criminal >offence due to the possibility to gain access to `inciting >material' (the German word is `Volksverhetzung') via the Net. Whether providing mail service is a criminal offence due to the possibility to gain access to `inciting material.' Whether providing phone service is a criminal offence due to the possibility to gain access to `inciting material.' Whether selling radios is a criminal offence due to the possibility to gain access to `inciting material.' Whether selling satellite dishes is a criminal offence due to the possibility to gain access to `inciting material.' Whether teaching reading is a criminal offence due to the possibility to gain access to `inciting material.' >Quite similar to the RSA T-Shirt story in the States. ,-) But with much more reaction from the prosecutors. I guess Germans are easy to set off. That means BTW that others can control them since they "have to react." Has German jurisprudence ever encountered the concept that the person who requests something like a web page is the "actor" in this drama not the carrier. The carrier is not doing anything. The requestor is controlling the system momentarily. DCF

1 0

Apology and clarification
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

First of all, I believe that I owe the cypherpunk community an apology for an error in judgement on my part. The message that I sent out yesterday regarding our demonstrations of a newly-discovered security threat was the exact same text that I sent to a far less technical audience. As such, I understand that many people on this list found the tone of my message to be insulting and offensive. I apologize, and I certainly didn't mean to insult anyone's intelligence. Having said that, please cut me a break. If you read my message as saying "FV has just invented keystroke sniffing" you've completely missed the real attack here. If you really think I'd throw away my reputation on a bogus claim like that, you're insulting *my* intelligence. My (charitable?) take on it is that a lot of people were so put off by the tone of my mass-market message that they leapt to the quick but erroneous conclusion that there was no underlying content. There is. The threat is NOT from keystroke sniffing per se, and we're certainly not claiming to have invented keystroke sniffing. However, we do have to *explain* keystroke sniffing in the public announcement, because it is a *part* of our attack, and most of the public does NOT already know that it's possible. What we at FV have done is to demonstrate how easy it is to develop an FULLY AUTOMATED attack that undermines the security of all software-based credit card commerce schemes. It is the automated aspect that separates it from all of the "dumpster-diving" attacks on credit card numbers which have previously been widely discussed, because it provides a path to large-scale fraud that has never been publicly discussed before, to my knowledge. The key "invention" in our approach is to integrate several techniques that are already well-known (in this community) into an automated attack that we consider to be devastating to commerce systems based on software-encrypted credit cards. Our approach combines the following four known problems into a fatal attack: 1) Consumer machines are insecure and easily compromised. 2) Keyboard sniffers are easy to write. 3) Credit card numbers are self-identifying (they have check digits) and can easily be extracted from a huge stream of input data. 4) Once intercepted, small amounts of information (e.g. a cc #) may be distributed completely tracelessly over the Internet. When you put all four of these together, you have an attack that IS new, in the sense that nobody we know of has ever mentioned it before, and which could in fact be used by a single criminal, with only a few weeks of programming, to tracelessly steal MILLIONS of credit cards, if software-encrypted credit-card schemes ever caught on. This is a very real threat. If you think we're just re-hashing keyboard sniffers, you haven't yet understood what we're demonstrating. The real threat is the traceless theft of millions of credit card numbers by a single easily mounted automated attack. So here's the factual claim, to be proven or disproven: One good programmer, in less than a month, can write a program that will spread itself around the net, collect an unlimited number of credit card numbers, and get them back to the program's author by non-traceable mechanisms. Does anyone on this list doubt that this is true? If so, I'd like to know the flaw in my thinking, -- I am *not* too proud to withdraw any claims that aren't true. If not, I think it's worth noting that this fact was previously completely unknown to the bankers and businessmen who are putting large sums of money at risk on the net. The only way to get the message to those communities is with a very visible public announcement of the kind you saw yesterday. -- Nathaniel -------- Nathaniel Borenstein <nsb(a)fv.com> Chief Scientist, First Virtual Holdings FAQ & PGP key: nsb+faq(a)nsb.fv.com

3 5

RE: more RANTING about NSA-friendly cpunks
by blanc 17 Dec '03

17 Dec '03

From: Vladimir Z. Nuri, aka Agent Provocateur no, your own fear is harming you. no law requires that you be in fear of it (some may try, but that is not a law that can be written). that is the point of the law, that is the intent of it. .............................................................................................. "The Law" is using psychological warfare in its attempts to keep stray cats in line. This is because they haven't thoroughly considered the nature of the circumstance within which they are attempting to operate - the condition of respect for the individual and a support for the rights of liberty. They too are afraid. They also are moved by the fear of threats like "the four horsemen". They are so focused on this fear that it overrides their "Prime Directive", which is to uphold the above mentioned principles. They use the threats of the law to inspire complicity, but they do have the resources to carry out their threats. While an agency like the NSA is sufficiently well-funded where they can concentrate on pursuing their case against a target, a company or individual is engaged in creating their income at the same time that they must also use a portion of these resources to defend themselves in court (as well as defend their public image). It would be a noble project to challenge something like the ITAR in a court of law, where the issues and flaws of the government's attitudes & methods could be brought out in detail, dashed to the ground by brilliant reasoning and argument, winning a battle not only for privacy, but for the lofty goal of individual sovereignty. But it would take a lot of time, some very able talents, and a lot of cash; most lone cryptographers would not be able to do these two things at once (making a living while also fighting the dragon). It's easy for you, Vlad, to chastise others for being cowardly, when you have nothing to lose (and only incendiarism to offer). Those who are enjoined to take action must calculate how much they can afford to invest in such an expensive venture. You asked me in an earlier post how I could distinguish just any poster to the list from someone who might be an "agent provocateur". By this: they only provoke action from others - encouraging, cajoling, shaming, pushing them into thoughtless action, without themselves taking on any of the risk involved, without themselves facing any of the dangers but only getting others to do so. The government does operate on support, and criticism of their policies lets them know where they stand (unsupported). But it also communicates to those in office ideas which they find it difficult to consider (or outrightly disdain). It serves to educate them as well, these controversial meetings and discussions: it reveals to them how just how educated everyone is on the matter of their rights under government, on the matter of how they see themselves in terms of self-determination, and on how they are each prepared to act accordingly. Public discussions have the value of education for those govmt representatives who do not consider thoroughly the implications of their policies, who are not clear on concepts of privacy. It would be great to have a show of fireworks in a court of law. But (and I don't mean to begin a long thread of discussion on this) I myself would wonder why the Supreme Court wouldn't already be defending us from the attacks against basic ideals like personal privacy. There are already in existence a body of "authorities" assigned to the task of preserving the Constitution, educated in Law and the principles for which this nation stands. They are the ones whom I would address with inquiries over negligence & lilly-livered, yellow-bellied non-involvement. I guess someone has to bring the matter to their attention, bringing up charges of injustice for their wisdom to cogitate upon. Nevertheless, it is to them, who are in charge of maintaining consistency to the ideals within The Constitution, that I would ask, "why have you forsaken us"?

2 1

Domain hijacking, Guardian objects
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

Eric, It is good that you're open to suggestions on the Guardian bject draft, but is just me or have you been rather quiet about it? I haven't seen this blared from the rooftops, or even discussed in security/admin groups with anywhere near the prominence it merits. My main worry with the latest draft is that it seems rather daunting. That is perhaps not so important anymore, as teh days of DIY domain registrations are over, with most people going through ISPs (unless they're pretty experienced themselves). And I wonder what you've planned to do about the huge existing domain base. When you make the announcement, and include guardians in domain forms, new registrations will be OK. But it will be a free for all as far as the others are concerned - as the same evil.org could register a Guardian Object for victim.com, making it impossible for poor victim.com to do simply file another (unauthenticated) update, as is possible right now. There will be simply nothing InterNIC could do either, as the admin and technical contacts will all be (guarded) addresses of the evil.org owners, so verification will be almost impossible without legal action (for which, mind you, some may hold the InterNIC liable). Perhaps the solution would be NOT TO ALLOW GUARDIAN OBJECTS TO COVER OLD DOMAINs (and hosts, etc). At least, not initially. When the next payment comes in to cover the entry, it should include a Guardian object application, so that will authenticate the association between the organisation in the real world of money, and its Net presence. Another option would be to prevent modification of domains and other objects that are 'known' to be static, such as mit.edu. I don't know how thei would be practical for most domains, though. Regards, Rishab ps. a new peer-review journal on the Internet is starting soon, with an editorial board full of big names. I'm the international editor with additional charge, as it were, for technical and security issues. This is an informal call for papers on not- so-obvious security holes and bottlenecks, such as the InterNIC's lack of authentication. I'd be interested in a paper on Guardian Objects; I'm open to writers from within the InterNIC/NSI itself.

1 0

Re: Lotus Notes
by Charlie_Kaufman/Iris.IRIS＠iris.com 17 Dec '03

17 Dec '03

Lucky Green wrote: > > At 11:09 1/30/96, Charlie_Kaufman/Iris.IRIS(a)iris.com wrote: > > >p.s. re: the fact that it's 64 bits rather than 128. That was the limit on key > >size of the crypto software we licensed from a third party. That crypto > >software also limited us to 760 bit RSA keys. > > I find this very interesting. RSA prohibits its licencees from using RSA > software with truly secure keylenghts. What may have incenitvised them to > take this bizzare position? The problem is not with the license, but with the software. And not with the latest software, but with some antique software we started using a long time ago (before RSAREF was a twinkle in anyone's eye) when 760 bit RSA keys and 64 bit RC2/RC4 keys seemed impenetrable. Given that interoperability with the installed base is a higher priority than resistance to some theoretical attack, we can't increase key sizes until the market rolls over to the latest software. We do have plans to get there. --Charlie Kaufman (charlie_kaufman(a)iris.com) PGP fingerprint: 29 6F 4B E2 56 FF 36 2F AB 49 DF DF B9 4C BE E1

1 0

Re: Fooling people with Java applets
by Michael Peponis 17 Dec '03

17 Dec '03

On Monday, 29 Jan 1996 Benjamin Renaud wrote :All graphical UI elements spawed by an applet, which are the only ones :that can get user events, are clearly marked as "untrusted applet :window"s. :So unless you type your password in a pop-up marked "untrusted applet :window", you should be fine. And if you do, you arguably deserve :whatever happens to you.... As sad as it sounds, I actually had this happen. Some shmuck put in sensitive information into a window clearly maked "Untrusted Java Applet" Unfortunatly, the smuck was a Sr. Vice President, so what can you do. Regards, Michael Peponis PGP Key Avalible form MIT Key Server,or via finger

1 0

[NOISE] FV keyboard sniffer name contest entry
by Raph Levien 17 Dec '03

17 Dec '03

HypeSucker Raph

1 0