December 2003 - cypherpunks-legacy

RE: WINDOWS NT ????
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sat, 05 Oct 1996 07:57:22 -0700, John Fricker wrote: >>Microsoft claims C2 or higher for NT and deserves any ragging they get if >>it's not. Ditto for any other vendor who claims one thing and sells >>another. >You ought to read about C2. >DIdn't Steve Martin say something like "criticize things you don't know about". Okay, correct me if I'm wrong on this (as if you wouldn't...): 1. Microsoft markets NT with C2 security 2. Numerous industry magazines report that you can bypass NTFS file security by booting off of a diskette and using NTFSDOS. 3. Numerous industry magazines (and I believe MS finally mentioned it in some routine status update) all say that NT should now be considered C2 *ONLY* on machines w/o floppy drives. Sounds like they weren't quite honest on this one. Or are you trying to say that security-by-obscurity (relying on NTFS's then lack of external mounting programs) was a good choice? >>BTW: Bizarre NT Quirk #15413 - The Administrator account does not have >>access to the entire disk. You got it - if you're the administrator you >>still cannot look into certain directories belonging to another user - even >>if you've given all access privileges to the Admin account. Got a few >>chuckles at work. >It's not rocket science to defeat this. The administrator is prevented from casually peering >into user owned directories but any administrator worth a nickle can tap tap click and have >access to any directory. I know that you can get in there. It just seemed odd that it would be setup by default... # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

2 1

Re: RSA's Official Permission
by Bill Stewart 17 Dec '03

17 Dec '03

> REDWOOD CITY, Calif.---Oct. 2nd, 1996--RSA Data Security, Inc., a > wholly-owned subsidiary of Security Dynamics Technologies, Inc. > (NASDAQ: SDTI), issued the following comments on the administration's > recent announcement of a Key Recovery Initiative: [rave reviews deleted....] I wonder how much being bought by SDT has influenced their positions? # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk

3 2

Re: Sun's GAK position
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:32 PM 10/4/96 -0500, Frank Stuart <fstuart(a)vetmed.auburn.edu> wrote: >I haven't been able to find a position statemnet from Sun Microsystems about >the new GAK plan, but it looks like I did find a position. This is from >"http://www.sun.com/corporateoverview/CorporateEmployment/LISTINGDIR/JobDet ailAUF971004.html": ..... >>Extensive Security and Cryptography knowledge and skills, ability to >>authoratatively present and advocatae security technologies at technical and >>public policy levels, confidence and skill at writing and presenting >>security documents and presentations. specific knowledge of government >>security requirements. A US Government Top Secret SCI and potentially other >>clearances will be necessary for this position. etc. That's not looking for someone to do GAK work at Sun; that's just looking for someone to help Sun sell stuff to the Feds. They've been doing secure operating system support and selling Suns to the NSA, Pentagon, and everybody else for years. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk

1 0

SRC_rip
by John Young 17 Dec '03

17 Dec '03

10-7-96. NYP: "Seymour Cray, Computer Industry Pioneer and Father of the Supercomputer, Dies at 71." Markoff "I was fortunate in having an instructor at the University of Minnesota who was looking after me in the sense that when I said, 'What's next?' he said, 'If I were you, I'd just go down the street here to Engineering Research Associates, and I'd think you'd like what they're doing there." The company was doing contract work for the Navy in cryptography. Mr. Cray's first supercomputers permitted researchers to crack enemy codes. ----- http://jya.com/srcrip.txt (13 kb) ftp://jya.com/pub/incoming/srcrip.txt SRC_rip

1 0

Re: This list is a joke
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> When I subscribed to this list, I thought it would have decent > communication on worthwhile topics. I've come to realize though that 75% > of the messages I receive are from people whining like 4 year olds. I am > making a huge assumption in saying that most of the people on this list > are adults. It is time to start acting like it. > > Please take my name off this list. I think if you qualified as an adult you would be able to unsubscribe yourself from a mailing list without assistance. Keep the whingeing to yourself... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Missionaries (was: "Mormon Asshole?" re: GAK)
by Michael Peponis 17 Dec '03

17 Dec '03

> On Sat, 5 Oct 1996 15:55:42 -0700 (PDT), John C. Randolph wrote: > > >What's really sad is the way that every cult member tries to convince > >himself that *his* franchise has more to offer than Lifespring, > > Food for thought: suppose he didn't - why would any rational individual > follow a religion he thought was wrong? Simple, the average shuck does not have the backbone to stand up for something he/she thinks is full of garbage. They would rather let the bullshit slide than to make an issue of it, and risk being ostersized or worse. Peace and Tranqility are what people want, not truth(which is relative) and freedom(which is not). I guess I should clarify the distiction. Truth is subjective, there are many things I think are true, but I can't prove them beond a shadow af a doubt. Absolute freedom is easy, it boils down to one simple question. "Can I do what ever I want". If the answer is yes, I am free, if the answer is no, I am not free. ----------------------------------------------------------------------- I have no return e-mail, my ISP cut me off for violating community decency standards. BOYCOT FACSIT ISP, BOYCOT COMMUNITIES DECENCY STANDARDS

1 0

Re: Sun's GAK position
by Frank Stuart 17 Dec '03

17 Dec '03

Bill Stewart (stewarts(a)ix.netcom.com) wrote: [...] >That's not looking for someone to do GAK work at Sun; that's just looking for >someone to help Sun sell stuff to the Feds. They've been doing secure [...] The two aren't mutually exclusive. I suspect the government plans to buy lots and lots of GAK'ed products that come out of this consortium. Not only will this sweeten the pot for otherwise reluctant companies, it will also help make the products the defacto standard. In any event, the things that caught my attention most were the date (October 1), and the phrases "Export controls as they apply to encryption and security products", and "Public policy issues of cryptography and Key Escrow". | (Douglas) Hofstadter's Law: | It always takes longer than you expect, even Frank Stuart | when you take into account Hofstadter's Law.

1 0

"Drift net fishing," GAK, FBI, and NSA
by Timothy C. May 17 Dec '03

17 Dec '03

A couple of posters have talked about "drift net fishing" of communications, where random stuff is sampled and intelligence items gleaned. (I think it was Ernest Hua who cited the example in a Tom Clancy book/movie.) Perhaps, but let's go back to the discussions at the EPIC "SAFE" conference in Palo Alto several months ago. Some convincing evidence was presented that the moving force behind GAK is *not* the NSA, but is rather the *FBI*. Specifically, even 40-bit keys are probably too long for massive "drift net fishing," in that the cost per break is probably still too high. The cost for a "focussed attack" (I can't think of a fishing parallel...maybe "spear fishing"?) is of course low. The speaker at SAFE pointed out that the FBI is pushing for the 40-bit keys (and now is accepting the 56-bit keys?) because for focussed attacks, e.g., on the communications of a person under observation, they can call on other agencies to break the ciphers for them (even if they don't yet have their own such machines). In a nutshell, almost any level of encryption above, say, 30something bits, is too much when millions of messages per day are to be "drift-netted" is too much. (The exact number that is "too much" depends on a lot of factors, including the cost of the cipher-breaking machines, the number of messages to be read per day, etc. This number will change with time.) The FBI's interest may be changing, too. Their lead role in the TWA 800 investigation may have them sorely wanting "drift net" capabilities, as all other leads are exhausted. If we see more of these sorts of terrorist (maybe) incidents, it may be that more "drift net" capabilities are sought. A note on _contact analysis_. One thing the FBI probably wants badly are databases of who has travelled where, and when, for correlation analysis. Note that the crackdown on "valid IDs" for travel, for airlines, helps in this regard. I would not be surprised to learn that the airline databases are routinely fed to the Feds, so to speak. (Possibly via the FAA, acting as a kind of cutout.) Were I the head of the FBI, this is what I would want. The next step will be collecting hotel reservation databases. (Unlike the case with the FAA and the airlines, I don't know what kind of authority would grant them access to private hotel databases, but I expect they are working to find such authority somewhere. Maybe the infinitely malleable "regulation of commerce" clause, even if hotel stays are canonically _not_ interstate trade!) (They already got access to the credit card databases, decades ago, of course.) --Tim May "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Voice Stress Analysis of Debates?
by jim bell 17 Dec '03

17 Dec '03

At 09:23 AM 10/6/96 -0700, Dale Thorn wrote: >jim bell wrote: >> This reminds me... Years ago, somebody developed a technique called >> "Voice Stress Analysis," which was supposed to detect small variations >> in a person's voice in response to stress. Not exactly a lie-detector, >> but it was supposed to do nearly the same thing. Does anybody plan >> to analyze the debates for stress? Is there software to do this? >> (Tried to do a web-search; didn't see anything.) > >Pardon me for butting in. Some remailer says I post too much, and I >should cut out some. They didn't say which posts I should cut out, tho'. Cryptography is, basically, the area of hidden meanings. In a sense, a voice-stress analyzer is intended to seek out hidden meanings in a person's statements. So I'd say it's as on-topic as most of the stuff 'round here. >Anyway, as I understand it, the current technology in voice/stress >analysis goes way beyond the polygraph at its best (current) level of >technology. There was at least one agency that did voice analysis >during the Simpson debacle, and the results were (as I recall) very >promising. Apparently, a person who can beat a polygraph cannot beat a >voice/stress analysis. One thing I wonder is this: Can the stress indications be removed from a voice-containing signal by some sophisticated DSP processing? Just look for whatever effect that indicates stress, add it in equal and negative amounts to eliminate the apparent stress, etc. It might not make sense for anything less "critical" than debates, but if the control of the debates is as monopolized as we think it is, it is reasonable to think that debate participants would insist on a certain level of control over the audio signal. >BTW, the rule for these debates (as all presidential discourse) is: >"He's lying." >"How can you tell?" >"His lips are moving." Well, I sorta assumed this. But I would still be interested to get some kind of quantitative feedback on the debates. If anything, the ABSENSE of the news media's attempting to use voice-stress analysis is telling. Jim Bell jimbell(a)pacifier.com

4 3

Re: WINDOWS NT ????
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sun, 6 Oct 1996 01:28:16 -0500 (CDT), snow wrote: >> An NT machine running off the shelf protocols and services is certainly mor= >> e secure than your average linux install. Of course clueless administrators= >> for either (any) platform can leave the door wide open easily enough.=20 > How about an "average" NT install versus a "average" linux install? Or, better yet, the typical "rent-a-loser" admin install. You know, the one who installs everything in the root directory? (I've seen this happen; don't laugh) > Neither of my machines are all that secure, but they don't have to >be right now. Neither has more than 5 users, all of whom I either trust >personally, or don't know enough to do anything. On the other hand, I >would be willing to bet that Mr. Metzger, or adamsc (sorry, I forgot your >full name) could lock a linux box down as tight as a networked NT machine. With enough time and net access, just about anyone could - if they thought it was important. Unfortunately, many people just don't realize how open their system is... > Hell, I'd bet 20 bucks I could. The machine wouldn't DO a whole lot, >but it would be tough to break into. (basically, don't run telnetd, ftpd, >sendmail, run sshd for incoming/outgoing connections, use a secure httpd >IF NECESSARY, NO NFS, shadow passwords etc.) ++agree. >> But what do you mean by secure? > Safe from undesired intrusion. Now, the much harder one is: safe from undesired usage by authorized users. As in that guy from the Dept of Health who was handing out the AIDS info... # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0