December 2003 - cypherpunks-legacy

M$NBC covers "Fear of a Hack Planet" and "Hate Goes Online"
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At the risk of giving M$NBC more attention than it deserves... BillG's latest misadventure editorializes on free/hate speech tonight at 7 and 10pm. Current and past fluffage at http://www.thesite.com/cgi/worl.cgi There's also a blank message area for "Would you bank through your computer? Do you think the technology is secure enough?" but no story. Maybe that's tomorrow. - -rich http://www.c2.org/~rich/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMfUvjpNcNyVVy0jxAQF9pgH/cYKc2FlkNt9xD1MFXHnMg9tshZsVqKjW O7ZYEyDOxutgBTgNoDkW2VA1FqkKioqxDGjurvUJmuvRGBu3E2GOfA== =bFqb -----END PGP SIGNATURE-----

1 0

No Subject
by Bill Stewart 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks From: Bill Stewart Date: 7/23/96 Tim wrote: >| More realistically, 1000+ list members x 10% who make plans to >| contribute x half of these who actually follow through x $10 = $500. >| (If that....) >| Prizes have their place, but are hard to set up properly. All right, $100 to the winner, by the end of 1996, for a reasonably-convincingly-non-rigged public crack of DES, whether it's from a net-run or screen-saver effort, a DES cracker using fancy special equipment, supercomputers, microcomputers, DES chips, or Gate Array chips. $100 extra bonus if the winner is from the NSA or FBI (Black-bag jobs, rubber-hose cryptanalysis, and subpoenas all count as rigged - sorry :-) At 08:46 AM 7/23/96 -0500, Adam Shostack <adam(a)homeport.org> wrote: > A better way to set up a prize is to find a few big companies >willing to sponsor such a demonstration. AT&T, Nortel, RSA, Netscape, >Microsoft, Qualcomm, and many other companies have an interest in >seeing stronger than DES crypto exportable. Perhaps one of them could >set up a prize, similar to netscape's Bugs Bounty, or the RSA-129 >challenge. Perhaps cracking 56-bit DES would count as a new bug for Netscape's existing Bugs Bounty? Bill Stewart -----BEGIN PGP SIGNATURE----- Version: 2.7.1 Comment: PGP available outside U.S.A. at ftp.ox.ac.uk iQBVAwUBMfWVOPthU5e7emAFAQG99QIAlKIBWs8ynr00uincnNBCymdz2E8CrlL3 MhCndNxOgpFIkjvJSdHNT+4alt2hsgU3fMlK8xWOK56R8WxdkTZvMw== =GesG -----END PGP SIGNATURE-----

1 0

RE: [Noise] was Re: Giving 6 year old kids Uzi's
by Bill Olson (EDP) 17 Dec '03

17 Dec '03

Perry E. Metzger writes: > > >"Bill Olson (EDP)" writes: >> I don't care if it takes my son 6 years to get through 2 grade levels, >> anyone who allows there kid to pack a gun (or a rifle?) should get their >> head examined > >Why? What, objectively, is wrong with allowing, say, a twelve year old >to go plinking with a .22? Lets not hear vitriol -- lets just hear >cold hard reasons not to allow it. > >Myself, I'd say that it appears that there is no good objective >reason. > >Perry I find nothing wrong with plinking. Hell, I'm from Montana--we used to go shooting all the time. But when the shooting was done, the guns were put away. What I find disturbing is that a child is taking it to school, or just carrying it around. I say that any parent who thinks their child is mature enough to carry a gun for non-recreational reasons is less mature than the child. In fact, I'd go so far as to say they are a danger to their own children. I guess I don't really have to worry too much, though. It is illegal for children to possess such items publicly, and any parent who condones it is simply breaking the law. I don't blame the child, I blame the moronic parent who let's it happen.

1 0

Re: Bare fibers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:56 PM 7/23/96, Bill Frantz wrote: >At 12:30 AM 7/23/96 -0500, Douglas R. Floyd wrote: >>Not really sure how. I have had heard of ways to tap a fibre optic link >>noninvasively, but its not related to Van Eck or anything like that. > >You could break the fiber and add a repeater (if you know enough about the >light protocol). Plastic fiber can be cut with a pocket knife, glass >requires a machine which will make a square cut and polish the end. Those >machines are not yet cheap. Fibers can be tapped noninvasively, and without cutting them, by placing detectors in direct proximity to the fiber. That is, touching the glass or plastic. For fibers relying on total internal reflection at the fiber boundary, the waves actually partly exist beyond the boundary (with an imaginary component). Another fiber or a detector placed near this boundary can make this imaginary component become "real," and hence detect the wave. This is "tunneling," of course. (A simple demonstration is done with a glass prism reflector, a reflector relying on total internal reflection. If a symmetrical prism is placed up against the first prism, the "total reflector" ceases to be.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

new bbs
by SOMSER BBS 17 Dec '03

17 Dec '03

You are going to receive a week to all our areas for free. You will have access to all the files of our BBS (Except Adult) for one hour each day. Your week will expire on 30-7-96 ID 25324 PASSWORD 19062 Le hemos obsequiado con una semana gratuita a nuestro bbs Podra acceder a todas las areas excepto a las de adultos La semana gratis termina el 30-7-96 NOMBRE 25324 CLAVE 19062 WEB (SOMSER BBS) This BBS is being operated in Spain and its address is http://www.somser.hnet.es (194.177.1.171) We are now in a test period and operational every day from 20:00 to 05:00 GMT and from 10:00 to 13:00 GMT. 20.000 files. 10 GB on disk. No CDROM 50 news files per day plus 200 areas. Welcome! Be our guest! ====================== We would be thankful if you send your opinion and your comments to the sysop in order so the BBS can be improved. If you desire a utility or program that you don't find leave a message to the sysop and we will attempt to get it. Hundreds of stages for DOOM, HERETIC, DESCENT, SIMCITY, SIMTOWER, WARCARFT, etc. WEB (SOMSER BBS) Nuevo BBS que es un BBS, el primero que existe en España La dirección es: http://www.somser.hnet.es (194.177.1.171) Estamos en periodo de pruebas y está en funcionamiento desde las 22:00 a las 8:00 y desde las 12:00 a las 15.00 GMT Tenemos más de 20.000 en disco. 10GB sin CDROM 50 ficheros nuevos cada día. Más de 200 areas diferentes. Estais invitados, esperamos vuestra conexion. Agradeceria que dejaran su opinion y sus comentarios al sysop para poderlo mejorar. Si desea una utilidad o programa que no encuentra deje un mensaje al sysop e intentaremos conseguirla Cientos de escenarios para los juegos del DOOM, HERETIC, DESCENT, WARCARFT, SIMCITY, ETC. HERETIC, DESCENT, WARCARFT, SIMCITY, ETC.

1 0

Re: passphrase and Diceware [was Re: Length of passphrase beneficial?]
by reinhold＠world.std.com 17 Dec '03

17 Dec '03

>The author of the Diceware system is Arnold G. Reinhold and can be contacted to reinhold(a)world.std.com >He has three pages: The Diceware Passphrase home page (html), The Diceware >WordList (ascii) and a text with the technical rationales behind the list >(ascii) >I don't remember the URL, sorry >Greeting, >Jean-Paul > >~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~- >Jean-Paul et Micheline Kroepfli >eMail: JeanPaul.Kroepfli(a)utopia.fnet.fr The Diceware Passphrase home page: http://world.std.com/~reinhold/diceware.page.html The Diceware WordList: http://world.std.com/~reinhold/diceware.wordlist.asc Technical rationales behind the list: http://world.std.com/~reinhold/diceware.txt Other stuff that may be of interest, including a survey on PGP passphrase usage and a rant on why p=?np has nothing to do with crypto: http://world.std.com/~reinhold/papers.html Regards, Arnold G. Reinhold reinhold(a)world.std.com

1 0

DES-busting Javanese pagers and TVs
by Deranged Mutant 17 Dec '03

17 Dec '03

On 23 Jul 96 at 15:53, Timothy C. May wrote: [..] > A while back I proposed one approach: a brute force "screen saver" for > Windows machines. Other platforms, maybe, but the most cost-effective thing > to do is to go after the Windows market only. How about applets for java-aware pagers or tv-sets that will supposedly show up in the near future? When a crack is found, you can call a toll-free number, give them the code, and win a prize (ala Chinese-lottery). Would it be better to have them all try random keys rather than use assigned keyspaces? Can't keysearches be shorted by half (not that it's that significant, 2^55 rather than 2^56) using complement keys? First thing one should check are the weak and semi-weak keys (a good implementation will avoid them, but that doesn't mean one shouldn't check for them). [..] > Acquiring chunks of keyspace remains an issue, but I think we resolved a > while back that a probabalistic method works OK: people just pick chunks at > random, and the decreased efficiency as compared to perfect scheduling is > something like a factor of a couple (I have the numbers I calculated > somewhere, and I recall Hal Finney made the same estimate). > > Some means of communicating results--especially wins!--is still needed. > This is where Perry's idea of a Java program is a good one. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

2 1

Re: DES-Busting Screen Savers?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:02 PM 7/23/96, Lucky Green wrote: >At 15:53 7/23/96, Timothy C. May wrote: > >>Or several times that number of machines or time for machines with less >>crunch. Say, 100K Pentium-type machines for a month or two. How might this >>be gotten? >> >>A while back I proposed one approach: a brute force "screen saver" for >>Windows machines. Other platforms, maybe, but the most cost-effective thing >>to do is to go after the Windows market only. > >A friend of mine actually wrote an RC4-40 cracking screen saver during the >initial RC4 crack. We finished the brute force so quickly that he never >released the software. > Too bad. Properly modularized software, i.e., with a place to drop in the specific system/algorithm being attacked, could be adapted quickly to DES-busting, or whatever. If your friend still has this, and it's not just spaghetti code, maybe he can adapt it to a truly large-scale attack. BTW, sitting in my hot tub last night I quickly reconstructed the math for the "random" keyspace inefficiency: -- Imagine that N users are "randomly" picking chunks of keyspace to search. That is, they are not coordinating with others to avoid duplication. -- By the time the total amount of computons expended has equalled the amount that would have been expended in a "no duplications" allocated search, the Poisson probability distribution says that 1/e = 36.8% of the keyspace will not have been searched; the rest of the probabilty lies in keyspace searched once, twice, three times, etc. -- Thus, the calculation will have to go 2-4 times longer to give a high (>95%) chance that the answer is found. For example, at 3 times the "efficient" search time, there is only a 1/e^3 = 5% chance that nobody has found the answer The probabalistic assignment is less efficient, obviously, but has the advantage of not requiring a registry of keyspace allocations. Further, "denial of service" attacks (lying about having searched a chunk, or incorrectly searching or reporting) are not a problem. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: Decrypt Unix Password File
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:46 PM 7/23/96 +0800, Jerome wrote: >How can I decrypt Unix password file? Get the source for a a Unix-compatible password encryptor, reverse it to make it a decryption program, take the line for a user from the password file, decode it from printable-ASCII format to the binary value, and enter the user's password. If you've written your programs correctly, you'll get the original secret value*. If this secret value is less than exciting to you (:-), try lots of things that might be the user's password, and one of them will work. Exercises for the reader: 0) What's a "shadow password file"? Does it affect the methods described above? 1) Since you know the secret value, you could try using your existing Unix password software and seeing if you get the correct encrypted value when you put in the correct password. 1A) Does this suggest some more useable algorithms? 1B) What does the Unix manual page for crypt(3) say about it? 1C) Can you implement a program that does this successfully? 1D) How many tries do you think it will take? 1E) Does anybody on your system use wimpy passwords? 2) Are there any books or papers describing how the Unix Password System works that would help you understand? 2A) Where would you look for them? 2B) Are they on the Web? How would you find out? 2C) Which of the following famous authors of Unix wrote important papers about the topic: Dennis Ritchie? Ken Thompson? Brian Kernighan? Rob Pike? Fred Grampp? Bob Morris Sr.? Jr.? The Brahms Gang? Bill Joy? Matt Crawford? How would you find out? Did they write anything else interesting? 3) Has anyone else implemented any Unix password cracking programs? What countries with very cold weather would have them on popular ftp sites? Are they more effective than your implementation in 1C)? Why? 4) If you're trying to crack passwords on a System V Unix system, why should you always try to crack root's password? [* hex 0000000000000000, I think. ] In a later message, Jerome Tan also wrote: > What is the code of password file of Unix? I have them but don't > know how read them. Any file converter or viewer for that? A) The code is "RTFM" B) The code is "Ask the user" # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

RE: SHI_fty
by Bill Olson (EDP) 17 Dec '03

17 Dec '03

Vinnie Moscaritolo writes: <snip> >>>Uh I think apple had that for a while, it's called cyberdog >>>http://cyberdog.apple.com screw this ole fud. >> >>Very true. But once again, it is not the technology that molds the >>world, but the exploitation thereof. Welcome to capitalism. >>> > >so shit floats...whats your point? Let me spell it out for you: M-O-N-E-Y. Shit floats. Apple doesn't... don't kill the messenger.

1 0