December 2003 - cypherpunks-legacy

Re: Spaces in passwords
by Bill Stewart 17 Dec '03

17 Dec '03

>Ben Rothke writes: >> Do spaces (ASCII 20) in passwords make them less secure? > >Of course not. In a normal Unix password, adding spaces to the >password search space increases the search space, so it necessarily >makes the search harder. Depends on the space of ideas that are leading to your passwords. If the reason you're adding spaces is to separate an n-character word from the dictionary from a 7-n character word from the dictionary, this reduces the search space for a cracker considerably. At least pick random punctuation instead. On the other hand, if your password is a bunch of randomly chosen characters, having another character in the space doesn't hurt. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: why compression doesn't perfectly even out entropy
by Jay Holovacs 17 Dec '03

17 Dec '03

Perhaps keyspace analysis and randomness analysis should be done from a Bayesian technique, with the the potential perspective of the cracker, or your estimate of the potental prospective of the cracker as a priori conditions. Hamlet could well qualify as a random string, however if your cracker was using 'Great Books of Western Civ' as a dictionary source, it would not be so good. ----------------------------------------------------------------------- Jay Holovacs <holovacs(a)ios.com> ----------------------------------------------------------------------- PGP Key fingerprint = AC 29 C8 7A E4 2D 07 27 AE CA 99 4A F6 59 87 90 On Wed, 17 Apr 1996, Simon Spero wrote: > On Wed, 17 Apr 1996, Mark Rogaski wrote: > > > Is it possible to find a percentage of the key space to eliminate that > > will optimize security assuming that the attacker will try the easy > > stuff first (and is it possible to quantify "easy stuff")? > > Hmmm- I think this could be interesting to study; if we treat the space > of possible passwords as a non-uniform probability distribution > (Zipfian?), and then transform it in such a way to be uniform (by > having the probability of certain passwords being disqualified be > based on their relative probability it should be possible to get a > situation where all passwords are possible, and all have equal probability.

1 0

NYT on Bernstein Suit
by John Young 17 Dec '03

17 Dec '03

http://www.nytimes.com/library/cyber/week/0418suit.html

1 0

Re: EFF/Bernstein Press Release
by SBinkley＠atitech.ca 17 Dec '03

17 Dec '03

>On the other hand, a virus is malicious speech, no? Sorta like libel or >fraud. You said bad and untrue things to the victim's computer and the >dimwitted OS believed it. > >Also this is impersonation. You spoke words that led the OS to think that >you were a legit user and, having its gained trust on false grounds, it lets >you do malicious things. Does this mean that an OS is legally considered an entity??? /sb

1 0

Unsubsrive
by John Robert LoVerso 17 Dec '03

17 Dec '03

Unsubsrive me!

3 3

Re: DANGER! Baby-Food Bombs on the Internet! [was Re: (Fwd)]
by Peter Trei 17 Dec '03

17 Dec '03

> From: Rich Graves <llurch(a)networking.stanford.edu> > > On Thu, 18 Apr 1996, the intrepid anonymous-remailer(a)shell.portal.com > FUDded to cypherpunks: > [Senatorial panic at the spread of knowledge deleted] > Does anyone know the documents that Senator Biden is quoting? I *must > know* how to build The Dreaded Baby-Food Bomb. As usual, altavista comes to the rescue. *A* baby food jar bomb is described at: http://studentweb.tulane.edu/~llovejo/explode.txt and echoed overseas at http://ps.cus.umist.ac.uk/~vivaldi/boom/original.txt I could not find the article on harvesting gunpowder from shotgun shells. Neat stuff in australia on making primary and secondary explosives however (neurocactus). With the Internet in place, government attempts to legislate the flow of ideas and knowledge are about as effective as attempts to legislate the migration routes of birds. Peter Trei trei(a)process.com

1 0

Re: Spaces in passwords
by frantz＠netcom.com 17 Dec '03

17 Dec '03

>Ben Rothke writes: >> Do spaces (ASCII 20) in passwords make them less secure? > >Of course not. In a normal Unix password, adding spaces to the >password search space increases the search space, so it necessarily >makes the search harder. I used to recommend that passwords be a phrase of at least 15 characters. Spaces fall naturally into that model. If your spelling is as bad as mine, then your password is resistant to dictionary attacks. However, then I discovered that there are many brain damaged systems which restrict passwords to 8 characters. (e.g. IBM's VM/ESA, Netcom's UNIX) For those systems, I can only parrot the conventional wisdom, no words, include numbers and/or punctuation, no acronyms, include both upper and lower case, etc. etc. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: [NOISE] Suscrive toasterpun
by SBinkley＠atitech.ca 17 Dec '03

17 Dec '03

>> If cypherpunks made toasters... >> Jim B and Black Unicorn would argue about whether toast should be >> buttered, and what the appropriate flavor of jam/jelly should be; TC May >> would point out that it wasn't really toast, but rather, sliced and >> slightly-burned bread; Perry would kvetch about the lack of crypto-relevance >> of toasters; and a few others would form a new listserver for toasterpunks. >> The service department would be flooded with calls from newbies, asking how >> to make toast. >> >> If Netscape made toasters... >> They'd beta-test the toasters for months, then make one slot too >> wide and the other too narrow. It wouldn't be until a cook in a diner >> pointed out that the toast wasn't coming out right that they'd have their >> design reviewed by a 3rd-party Toaster Engineer. >> >and during daylight savings time, you wouldn't be able to reload the >toaster for an hour unless you set your toaster to standard time or >created a timezone variable. And newbies would start crying when the forgot how to get off the list!!

1 0

Re: (Fwd) RE: Noise Sphere in Java
by Deranged Mutant 17 Dec '03

17 Dec '03

On 18 Apr 96 at 11:13, Hal wrote: [..] > There was a post on cypherpunks a few days ago claiming that the output > of "pgp +makerandom=2000 rand.pgp", which uses the PGP internal RNG, > showed visible structure in the output of a noise sphere program. I > tried modifying Chuck's Java version and ran it with data from pgp > +makerandom, and it looked fine to me. Hm. I didn't see that post... (I wonder if he plotted an ASCII file... or I suspect a troll?) > However, that isn't very meaningful, because I find the that program > output looks fine even with Chuck's version, which is using the Java > internal RNG, a LCM from Knuth. Specifically the Java code is: [..] A lot of bad PRNGs look good with noise spheres.... but what I found while experimenting with them was data based on timer drift samplings that passed a variety of randomness tests but showed up with very clear patterns on a noise sphere... so I made the original post to the list and sci.crypt about it. Noise spheres will show certain correlations in the data. It doesn't mean that the RNG is crypto-usable if it looks good. But if it looks bad then you know to be suspicious.... a visual image makes a clear point better than analyzing a lot of numbers on a page. By no means should it be relied upon as a sole test. [..] > see it. Oh, sometimes I can almost convince myself I'm seeing structure, > but it is never repeatable from run to run. And I see as much with the > output of pgp. Particularly when the graph is sparse you can see some > clumping, but I think it is just random noise. > If the noise sphere can't even reject an LCM RNG, it doesn't sound > that useful to me for crypto purposes. If you see definite spirals and loops then it's more than random noise. It doesn't pass or reject anything. It plots data. If the data shows *definite* patterns, you can reject the RNG. If not, use more sophisticated tests. [..] > at right angles to this. Because polar coordinates are not uniform in > space, the points are clustered along the north-south axis inside the > globe. You can see this in the views, where the upper right view should [..] That's probably what the poster to c'punks wrote about... *sigh* Rob. --- Send a blank message with the subject "send pgp-key" to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

[CDA] "Million Geek March" on Washington
by Dave Del Torto 17 Dec '03

17 Dec '03

[fwd from: Keith A. Glass <salgak(a)dcez.com>] >Friends of Free Speech on the Net: > >On June 30th, 1996, a large anti-CDA rally, the Electronic Freedom March, >is planned for the Ellipse, in front of the White House. But without your >help, it won't happen. > >We need volunteers to help us plan the EFM and the logistics required for >it, people to help us raise funds to pay the expenses (the Park Service >has required us to provide 80 porta-potties, at a cost of nearly $4500.00 >alone, and that's not our only requirement. . .), and people to help us >run the March on June 30th. Not to mention publicity, etc. > >We need your help. **I** need your help. I've posted this to the DC area >groups, as well as to a few groups that I feel might be useful in >gathering more volunteers and interested people. But I need your >committment to help NOW, or we won't be able to run the EFM, or as it's >been called, the "Million Geek March". Come on, out there: help us out!!! > >-- >* Keith A. Glass, Annandale, Virginia, USA, Filker/punster at large * >* Washington Coordinator, Electronic Freedom March * >* 30 June 1996, Washington DC URL: http://www.efm.org * >* Note: the following line is an intentional act of Civil Disobedience: * >* FUCK THE TELECOMMUNICATIONS DECENCY ACT--DEFEND THE FIRST AMENDMENT ! *

1 0