December 2003 - cypherpunks-legacy

Symantec's Your Eyes Only
by Clay Olbon II 17 Dec '03

17 Dec '03

If you read this weeks "Network Computing", there is a report on Symantec's Your Eyes Only encryption software for Windoze 95. The article can be found at: http://techweb.cmp.com:80/techweb/nc/711/711sneak2.html. Looks like a PGP competitor - uses RSA public key, DES, triple-DES, RC4, RC4 or blowfish secret key algorithms. It can also be used to encrypt directories on the hard-drive while retaining the ability to use them. This appears aimed at corporate users, and includes a "super-user" access to all encrypted files/messages. Also includes the capability to create an "unlock" disk that will decrypt everything should you lose your password. Now my $.02. I am concerned about the lack of a distinction between transient communications and stored data. This is apparent in the GAK proposals, but is also increasingly apparent in mainstream corporate products such as this one and ViaCrypt BE. It is apparent (to me anyway) that corporate access to stored data (data owned by the company, on machines owned by the company) is probably necessary. I do not see this same need for access to transient communications. Am I way off base on this one? Clay *************************************************************************** Clay Olbon II * Clay.Olbon(a)dynetics.com Systems Engineer * PGP262 public key on web page Dynetics, Inc. * http://www.msen.com/~olbon/olbon.html ***************************************************************** TANSTAAFL

1 0

Re: Surf-filter lists
by declan＠well.com 17 Dec '03

17 Dec '03

>Vlad: How can consumers make an informed decision as to which filter >they wish to purchase, if they are not told exactly what information >each product is filtering out? > >Meeks et al may be guilty of flamboyant, emotionalistic prose, but I >find the concept that the public is expected to buy various filters >without knowing what they filter...frankly, ridiculous. Flamboyant prose? Moi? Never! More to the point, as I wrote at the end of the original CWD, it's a bait-and-switch maneuver. Go after porn, they say, but the censor political information. And you don't know about it. -Declan

3 2

Banning Anonymity As Well (was Re: How I Would Ban Strong Crypto
by Deranged Mutant 17 Dec '03

17 Dec '03

On 15 Jul 96 at 11:53, Bill Frantz wrote: [..] > I still think this whole GAK thing is going to fail on the, "Which > government?" question. I don't see either multi-nationals or their > governments wanting to share their secrets with each other, and I don't see > how to set up universal GAK to prevent that form of industrial espionage. > Also, the key which decodes the GAKed data is just too valuable and too > easy to steal. Assuming the info is encrypted with one GAK key, yes. There might be a series of keys, perhaps for each escrow agency, or an id-number that identifies the key. Note that such methods will not allow much anonymitiy, since each communication must be escrowed. The method used to id. the key can be used to trace a sender or receiver's id. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

RE: Government: Home-Business
by Blanc Weber 17 Dec '03

17 Dec '03

>From: Mike Rose >I'm getting more and more of this kind of crap sent to me. I have >a procmail script which greps a file of undesirable addresses I've >compiled, but that hasn't proven very useful as there aren't many >repeat offenders. (the procmail script is available at >http://www.universe.digex.net/~mbr/unix/junkmail.html) > >How are other people dealing with this? ............................................................. For this particular one, I faxed all 6 pages back to the phone number they gave ("send your check to.....), declining the offer. .. >Blanc

1 0

Re: Chancellor Group (symbol = CHAG) (new data)
by David Lesher 17 Dec '03

17 Dec '03

The SEC already is aware of this ahem activity. They are looking into it. If you have further data, direct it to Al Lapins of "OIEA" at the SEC..... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Cookie alternatives
by Hal 17 Dec '03

17 Dec '03

There has been quite a bit of discussion recently about the "cookies" used by Netscape Navigator and their effects on privacy of users. Here is some background and some thoughts on alternatives. I think the term "cookie" goes back to the 1960's. According to legend, there was a virus-like program called "cookie monster" which would occasionally pop up on people's terminals and say "gimme cookie". You then had to type the word "cookie" to satisfy the program, and it would go away. The program was hidden in the core memory of the large, multi-user computer systems which were common in those days. I first heard "cookie" used similarly to its current context in the 1970's. It referred to a data item which would be given by a service to a client of that service, and which would be used on later interactions. I think the usage comes from the cookie monster, where you imagine the client saying "gimme cookie" to the server. The cookie is an "opaque" data item, that is, its structure if any is not visible or documented for the client. It has meaning only to the service. There is a similar concept in cryptography, the "nonce". A nonce is a random value which is generated by one party in a cryptographic protocol and which is exchanged at later stages of the protocol. The purpose of the nonce is to prevent replay attacks and to maintain continuity during the (possibly) many exchanges of data which make up the protocol. When the client sends a request to a service it includes a nonce, and the return reply includes the same nonce. This way the client can make sure that this is a reply to its current request and not something which is replayed from an earlier interaction. Cookies seem a little more general than nonces, in that nonces are pretty clearly supposed to be just random numbers, while cookies are more general and could have internal structure which is known by one of the parties, although it is usually opaque to the other. However I think in current usage on the web cookies are most commonly used basically as nonces, random values whose purpose is to maintain continuity in a series of interactions. When a server gives a cookie to a web browser, that browser supplies the cookie on future interactions with the server. The cookie probably does not have any specific data about the user or the interaction, but is used only to link up the interactions which take place. It is most probably used as an index into a database maintained on the server itself. Its only requirements for this purpose are that it is unique and that it can easily be used as such an index. One typical usage would be to maintain a "shopping cart" while browsing at a store. If I am visiting an online clothing store, I may choose to buy some pants, a shirt, and a jacket as I browse around. Each time I click on the "buy" button, my browser includes the cookie I received when I first visited the site. This indexes into a database on the server which is keeping track of what I have bought. With each new item, the cookie allows the server to add it to the correct virtual shopping cart. Then when I "check out", again the cookie allows the server to display everything I bought. Given that cookies generally work this way it is clear that the notion of editing cookies doesn't make much sense. If cookies are opaque data structures, changing them is just going to make them invalid. You might as well just delete them. This also implies that you don't have much control over what kinds of information the server is maintaining in its database which is indexed by your cookie. In the shopping cart example, the cookie is sent on every transaction, not just when you click to make a purchase. This will allow the server to track your progress through the site, see which if any ads you have seen, and generally record many details about your interactions. More generally, cookies are used for this purpose even on sites which do not need them for shopping carts. As a user of the web, I would prefer to have more control over the kind of information which servers gather about my browsing habits. Of course, since web interactions are voluntary, a server is free to put whatever restrictions it wishes on clients in return for letting them access its information. It can require clients to accept cookies, to register with their names and addresses, or to FedEx their firstborn children to the store, for that matter. Nevertheless to the extent that I have bargaining clout in these interactions, I will prefer systems which do not infringe so much upon my privacy. It is interesting to consider how shopping carts might be done without cookies and similar technologies which allow servers to get more information about me than necessary. I would prefer a system where the list of things I have chosen to buy is saved on my own computer, in a format I can clearly see, and without linking my purchase decisions to other browsing I may have done on that site. Consider a system where when I click on "buy", a dialog box pops up in the corner of my screen which is my virtual shopping cart. It holds a list of the items I have selected for purchase, with each new item appended to the list. When I go to check out, the contents of this dialog box are uploaded (with my permission) to the site, where payment arrangements are made. Since I can see what is being put into the dialog box and what is being uploaded, I know that I am controlling exactly what information is being revealed about me. I don't have to trust the server to protect my privacy by not recording excessive information about my browsing. (Given the difficulties in creating new protocols for this kind of support, I think a step in the right direction would be to change the user interface so that cookies are only sent upon user request. Maybe you have to shift-click or use some other key modifier to send a cookie. Then shopping pages could ask you to shift-click the buy button to add the item to your shopping cart.) All this is in accord with the general principle that we support here, of protecting privacy by limiting the collection of infringing data, rather than trying to pass laws to restrict the dissemination and sharing of such information. We support ecash since it allows transactions without identification, rather than using credit cards but trying to put legal restrictions on what the CC companies can do with their transaction data. Cookies allow many kinds of privacy infringing data to be collected. I would prefer to see alternate mechanisms to allow for the kinds of transactions that cookies are needed for, which allow users to protect their own privacy. Are there other uses of cookies for which alternatives are needed? Hal

5 4

Government: Home-Business
by Creative Financial Alternatives 17 Dec '03

17 Dec '03

Dear Friend, Thank you for your interest. Please take a minute to read this important information or simply print it out. All the information here is 100% accurate and can be verified with the Department of HUD in Washington D.C. *************************************************************** Honest Home-Business NO MLM or SELLING involved Earn $500 to $1,000 per week guaranteed. *************************************************************** *************************************************************** NOW YOU CAN MAKE UP TO $1,000.00 A WEEK OR MORE, IN YOUR SPARE TIME WORKING AT HOME AND HELPING THE GOVERNMENT FIND PEOPLE WHO THEY OWE MONEY TO! *************************************************************** You'll be your own boss. Work when you want... as much as you want. Sound Good? Then, read on because it gets a whole lot better!! Dear Friend, The truth is, the US Government really does have money to give away. In fact, right now there is more than $70,000,000.00 that legally belongs to millions of unsuspecting US citizens. Where does this money come from? When the US Department of Housing and Urban Development (HUD) and the Federal Housing Administration (FHA) approve a loan for a house, 1/2 of one percent of the loan amount is added by HUD/FHA to the loan interest as insurance in the event that the borrower does not pay the mortgage. That money accumulates interest over the life of the loan. If the house is taken away from the borrower through foreclosure, that money is forfeited. However, when the borrower pays off the loan, they are entitled to a full refund of that money. Over 20-30 years, that can add up to a substantial amount of money!! So what does this mean for you? EASY MONEY!! I'll explain. Most people do not know that this amount is due to them- many have relocated. Since HUD/FHA doesn't have the resources to track down each and everyone of the borrowers due a refund, they developed the Refund Tracer Program for the purpose of allowing people, just like you, to earn money by locating borrowers. You see, thanks to the little known Mortgage Refund Tracer Program, you can easily perform a valuable service. As a Refund Tracer, you can help return millions of dollars to rightful owners and collect part of what you return in processing fees. Just think of it!! A fantastic opportunity to earn substantial amounts of money. You can start right away and earn $300 to $1,000.00 a week or more, right from your own home. There is really no limit what you can earn. It's up to you how much you want to work. You can be young or old, male or female, single or married, employed or unemployed. It doesn't matter. A WIN/WIN/WIN SITUATION! The government wins since the money must be refunded to it's rightful owners. The borrower wins because he or she receives money the borrower is entitled to. You win because you receive a generous processing fee. Everybody wins! NO EXPERIENCE NEEDED The good news is that you don't need experience, or special training. In fact, if you can read, write, and follow simple step-by step instructions, you can earn lots of money in this business. That's where the REFUND TRACER PROGRAM MANUAL comes in. It explains everything you need to know. It is a step-by-step instruction manual that will show you secrets that will allow you to start receiving cash payments quickly. Nothing will be left unanswered, and once you have the manual, you will not have to purchase anything else from us. Here's an example of what you'll get... * An information-packed manual with easy to follow instructions. * All government forms provided by HUD/FHA * Sample letters needed to inform borrowers that you are a Refund Tracer and are willing to help them get what is due to them. Plus, all other letters you will be sending during the processing time period. * A FREE STATE Listing for any STATE. * You'll also have our technical support along the way. * SPECIAL BONUS " Personal Complete Guide to the Internet". This is a 175 page 15 Chapter E-Book that covers the whole Internet and it is yours FREE when you order our program within the next 10 days. Here's some of what you'll learn... * How to obtain names of people due mortgage refunds from HUD * The easiest ways to locate those due a refund * How to contact them to get an immediate response * How to process the necessary forms so that refunds are promptly issued * How to claim your share of their Government refund ...and much more! You can get started immediately without any special training or education and our manual will show you how. You will be able to start making money almost at once. You can get started on a shoestring!! You will be amazed at how easy it is. Imagine, earning hundreds....even thousands of dollars each week helping the government refund money. It will give you a good feeling just knowing you are helping people receive money they didn't know they had coming. You'll be getting paid for doing it! In 1986, Congress mandated that HUD make available to the general public lists of borrowers who were due refunds. We investigated and discovered one of "The Best Kept Money-Making Secrets In America". When I learned of the little-known Refund Tracer Program, We knew it was just what we had been looking for. This is probably the easiest, 100% legitimate, way to make money from scratch ever! You will find that... The fastest and best way to make a HUGE amount of money quickly is to trace people who have MILLIONS of DOLLARS in refunds due to them and then claim YOUR SHARE in Processing Fees. As long as HUD/FHA continues to approve loans, the money will never stop growing. Your money- making potential is endless! Every month, thousands of names become available for processing, names that are available for you to earn cash by helping borrowers receive their government refunds. WHAT COULD BE EASIER? Now just ask yourself, what message is more powerful than telling someone that you are going to help them receive a substantial sum of money that they didn't know they had coming? Believe us, they will love you for it, and will be more than happy to pay your fee. But this is only part of what makes this program so easy to use. Our manual will make it even easier for you to get started earning CASH RIGHT NOW! THE ULTIMATE WORK-AT-HOME MONEY-MAKER!! We know what you're thinking (it sounds too good to be true). But believe us, it is 100% true and completely legitimate. Imagine a money-making program that was established by the government. You can do this right at your kitchen table, or if you have a computer your even one step ahead. Let your computer start helping you make some money, instead of costing you money! The Refund Tracer Program is recognized as an extension of the services provided by HUD/FHA. This program is a gratifying way to earn extra money, especially since you are also helping someone else at the same time. The work you will be doing is simple, pleasant and absolutely anyone can do it! Without any formal training or education, Refund Tracers who have just started are earning $300 to $1,000 or more a week! It depends on your determination, and how much you want to make! If you have any additional questions for us feel free to call us at: 216-226-8799. Please don't delay. The only way you can lose is doing nothing, and that would be a shame. You owe it to yourself and your family. So act now. You'll be glad you did! We give you everything you need to get started right away, including a FREE state listing Nobody can even come close to matching this offer. Other people sell you the Manual then charge extra for the State Listing, not us. We give you the whole business for almost nothing. For a small amount, you can take a big step towards financial independence. We're looking forward to hearing from you! Plus, if you order the program we will personally assist you with any ideas or questions you may have while working the program, so your not alone in this. We'll be here to help you along you're way Below is an example of the State Listings. ---------------------------------------------- Name Address & City Case# & Zip Date & Money owed ------------------------------------------------------------- Smith, Joe 1626 Ansel Drive 441-024360 07/06/94 Dayton OH 45416 $1,800.00 Virgil Baker 804 10th Avenue 411-031524 03/01/95 Middletown OH 45042 $1,134.76 ------------------------------------------------------------------------- As you can see you are provided with quite a bit of information. This is what make the program so EASY to work!!! ********** 90 DAY MONEY BACK GUARANTEE ************** Here's how our policy works all you have to do is try the program for 90 days then if your not satisfied simply return it for a refund. So you have nothing to lose. If your looking for a real opportunity you found it. Respectfully yours, Creative Financial Alternatives The Program Only Costs $33.95 Send payment to: Creative Financial Alternatives Unclaimed Funds 18645 Detroit Ave. Suite 714 Lakewood, Ohio 44107 We accept Money Order or Check Made Payable to: Creative Financial Alternatives We are pleased to announce were able to accept checks by phone or fax to help you get started immediately. If you want to get started right away. The purpose of accepting checks by phone and fax is that it speeds up the process so you can get started immediately. Phone us at: 1-216-226-8799 Fax your check to: 1-216-226-3225 * Please note that if you do check by phone or fax you will need to keep that specific check for your own records. Please do not mail it to us or deposit it at your bank. Simply void it out and keep it for your own records. ************* QUESTIONS & ANSWERS ***************** You are bound to have some questions about the Government Refund Tracer Program. Below are some commonly asked questions and my straightforward answers. Also, if you have any questions that aren't answered below please call us at: 216-226-8799 We'll be glad to answer them for you. Q: Is the Government Refund Tracer Program legal? A: Yes, in 1986 Congress mandated that HUD make available to the general public lists of borrowers due refunds. Subsequently, HUD created the Tracer Program. Q: Can I do this from any state? A: Yes, you can live in one state and trace people in another state, you can do it from anywhere! Q: How much does the Tracer receive? A: We recommend 25%-30%, of the refund. Q: How do I obtain the names of the refund recipients? A: You can get them directly from HUD or us. Q: Why can't the person owed a refund get the money for themselves? A: They can, however the vast majority of people don't know anything about the Government refund process. They would need a case number and other specific information only you have. This lack of knowledge is what makes the tracer so valuable, because they can't do it without you. Q: Does this program require a large investment? A: No, expenses (such as lists of names, stamps,etc.) will depend on how large an area you intend to cover and since you will be self-employed these expenses will be tax-deductible. Most of your investment will be your time and effort. Q: What is the average refund amount? A: The average refund amounts range from $800-$1,000, but refunds of $4,000 are not unheard of. It all depends on the area or state you target. Q: If I did a refund for $1,130.94 how much would I get? A: Your fee is 30% so you would get $339.28 for that one claim!! Q: How do I find these people? A: You can go through the phone book directory or if you have a computer with a CD-ROM drive you can purchase a copy of "Home Phone" it's a directory of over 85 million residential phone numbers. The majority of these people are still at the current addresses on the form from HUD. Thank you very much and we look forward to talking with you in the near future. Creative Financial Alternatives 18645 Detroit Ave. Suite 714 `\|||/ Lakewood, Ohio 44107 (o o) Phone: 216-226-8799 Fax: 216-226-3225 ooO_(_)_Ooo________________________________________________ _____|_____|_____|_____|_____|_____|_____|_____|_____|_____| _____|__ __|_____|_____|_____|_____|_____|_____|_____|_____| _____|_____|_____|_____|_____|_____|_____|_____|_____|_____|

2 1

COMMUNITY CONNEXION ANNOUNCES STRONGHOLD VERSION 1.2
by sameer 17 Dec '03

17 Dec '03

For Immediate Release - July 16, 1996 Contact: Sameer Parekh 510-986-8770 COMMUNITY CONNEXION ANNOUNCES STRONGHOLD VERSION 1.2 Oakland, CA - Community ConneXion, Inc., the leader in uncompromising security for the World Wide Web, today announced the release of its newest version of Stronghold: Apache-SSL for the US. Stronghold is a webserver based on the popular Apache server, which has the highest marketshare of all webservers on the Internet according to the Netcraft server survey at http://www.netcraft.com/survey/. Stronghold's marketshare has more than doubled every month since its release in January of this year. "[The competition]'s secure servers just didn't work the way we wanted them to; the interface was clunky and required firewall adjustments to run, the access control didn't work well for us, and it was just too black-boxey for us," commented Dan Kearns, of the Motorola ISG Internet Business Group. "We like the lean/mean-ness of Apache in general, and the actual useful development that goes on. We look forward to generating client certificates for our channel partners using the bundled internal certificate authority tools." "We have been working with Community ConneXion for over a year to enable our Digital IDs in their Stronghold server products," said Greg Smirin, Product Line Manager at VeriSign, Inc. "We look forward to using their new version of Stronghold to demonstrate client certification on our own website." VeriSign is the leading provider of digital authentication services and products for electronic commerce and other forms of secure communications. "Stronghold is the first widely used web server that can authenticate clients on the basis of their digital certificates," said Dr. Andrew Csinger, President of Xcert Software, Inc. "Stronghold is a natural server platform for Xcert's Sentry suite of security enhancement products. The combination of Stronghold's uncompromising security profile and Xcert's flexible certificate management and secure database technology represents great value and convenience for Internet users." Xcert and C2 have entered into a co-marketing agreement to provide easy access to the Stronghold/Sentry bundle. The Stronghold/Sentry combination puts organizations of any size in control of their own security, allowing them to cost-effectively implement secure Intranets based on public key certificates. Xcert Software, Inc. is the premier provider of security enhancement software for safe and secure commercial Internet applications. Xcert's Sentry product line is the first cross-platform, server-independent public key infrastructure implementation. A live demonstration using the Stronghold webserver has been available on the company's website since April 1996 (http://www.xcert.com) Because it is based on Apache, Stronghold can be used with the innummerable third party CGI and Apache API applications which have been developed for Apache, including perl & python integration, database connectivity, and Kerberos support. "Direct support within the server for scripting languages can produce an excellent performance improvement over standard CGI methods," said Sameer Parekh, President of Community ConneXion, Inc. Community ConneXion ships binaries for Sparc Solaris 2.5, x86 Solaris 2.5, Sparc SunOS 4.1.3_U1, DG/UX, FreeBSD 2.1, BSDI 1.1, AIX 3.2.5, IRIX 5.3, HP/UX (9 & 10), OSF/1, UnixWare, Ultrix, BSDI 2.0, and Linux (ELF & a.out). Additional platforms may be supported on request. Stronghold may be ordered and downloaded at http://www.us.apache-ssl.com/. Portions developed by the Apache Group, taken with permission from the Apache Server http://www.apache.org/. This product includes software developed by Ben Laurie for use in the Apache-SSL HTTP server project. This product includes software developed by Eric Young (eay(a)mincom.oz.au)

1 0

Re: #E-CASH: PRODUCT OR SERVICE?
by Alex de Joode 17 Dec '03

17 Dec '03

[..] : "Ecash" is a registered trademark of DigiCash. It is registered : with the Benelux trademark office and the United States : trademark office. I believe that it is considered unwise to use : minor variations on trademarked names, but I'm not an : intellectual property rights lawyer. The Benelux (Netherlands, Belgium and Luxembourg) trademark laws don't allow for slight variations, certainly not if there is a change that people get confused, it is very very likey that the judges of the benelux trademark court will decide that ecash and e-cash are just to simular, and will thus confuse the public. (art 5 lid 1 BMW) btw: I'm surprised DigiCash didn't file for a European Trademark, but opted for Benelux and US protection. bEST Regards, -- -AJ-

1 0

Re: Seek-and-Destroy
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

I've thought about similar things... I thought it would be more interesting to start feeding it a huge list of words so that my host would show up on just about any search.. Or, feed it an infinite string of characters. Ryan ---------- Previous Message ---------- To: Ryan.Russell cc: snow, declan From: snow @ smoke.suba.com @ smtp Date: 07/16/96 02:26:39 PM Subject: Re: Seek-and-Destroy On 16 Jul 1996, Ryan Russell/SYBASE wrote: > I tried it... > it just seemed to threaten me for about 10 minutes, and > then disconnected. Couldn't see any effect. > What was supposed to happen? Would it have tied up a "spider" for ten minutes? If so, then that is probably enough. Personally I'd have started dumping bogus link, or set up about 2000 circular links to keep the damn thing busy. Petro, Christopher C. petro(a)suba.com <prefered for any non-list stuff> snow(a)smoke.suba.com

1 0