December 2003 - cypherpunks-legacy

Re: How I Would Ban Strong Crypto in the U.S.
by um＠c2.org 17 Dec '03

17 Dec '03

Michael Froomkin <froomkin(a)law.miami.edu> writes: >> So, who is in this "emerging consensus"? >Foreign governments? The recent issue of the German law journal NJW-CoR contains a report on the "ICC/BIAC/OECD Business Government Forum on Global Cryptography" in Washington, D.C., 1996-05-07. The author claims that the commerce representatives at the conference said they understood that governments had legitimate interest in key escrow and that key escrow could have commercial benefits. The Japanese government delegation stated that they were shocked about the American and European plans, because the Japanse Constitution prohibits mandatory key esrow. OECD will decide on crypto policy guilelines early in 1997.

1 0

New type2.list/pubring.mix
by John A. Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello Everyone, There is a new type2.list/pubring.mix combination on jpunix.com. Of note is the new middleman remailer, Janet Reno (reno). welcome aboard! The file are available by WWW at www.jpunix.com as well as by anonymous FTP at ftp.jpunix.com. John Perry - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMe1SvFOTpEThrthvAQGttgP+JxuFMaHByPlqjmsXu5oJJMbEGN+zZ1mY qPBFWyiNVezGhg/8dE4ZCqPYpClLCMAFSXFPAlioFuZRjkJ2TvSH+a0E1s5oyeOP zHJmc8+z7QlAbKYPRYdcX+KWzoXBtT01kUsi2AXm02vsaNP2HxKdSF8LviZn3YjA AZorDmtOdPA= =QqZJ -----END PGP SIGNATURE-----

1 0

Re: Government: Home-Business
by Martin Janzen 17 Dec '03

17 Dec '03

Mike Rose <mrose(a)stsci.edu> writes: >>Dear Friend, >>Thank you for your interest. Please take a minute to read this >>important information or simply print it out. > >I'm getting more and more of this kind of crap sent to me. >[...] >How are other people dealing with this? Since you say you have procmail, you could try something along this (as yet untested) line: :2HB cypherpunks(a)toad.com ^dear friend /dev/null I find that people who address me as "Dear Friend" are invariably pushing some kind of chain letter, religion, multi-level marketing scam, or the like. My real friends _know_ my name. -- Martin Janzen janzen(a)idacom.hp.com

1 0

Re: CookieScan 0.0 rev 0
by John Pettitt 17 Dec '03

17 Dec '03

At 08:02 AM 7/16/96 -0700, David Sternlight wrote: >At 5:34 PM -0700 7/15/96, Christopher Hull wrote: >>Do y'all think there might be an interest in a >>utility which would allow the user to deal with >>browser cookies? >> >>What I imagine is a little utility that would >>display the cookies stashed on a machine and >>give the user the option to either delete or >><snicker> edit </snicker> any given cookie. >>(Hey, it's *your* computer, not the website's). > >And they'll simply <snicker> start encrypting the cookies if they don't do >so already. Have a nice day. > >David > > > we have already <snicker>:-)</snicker> John Pettitt, jpp(a)software.net EVP, CyberSource Corporation, 415 473 3065 PGP Key available at: http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=0xB7AA37…

1 0

No Subject
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Does anyone know how to tanslate PGP into Burmese?

1 0

Re: Word lists for passphrases
by John Deters 17 Dec '03

17 Dec '03

At 10:33 AM 7/15/96 -0700, David Sternlight wrote: >At 12:45 AM -0700 7/15/96, Bill Stewart wrote: >>At 09:43 PM 7/8/96 -0700, ??? wrote: >>>If the purpose is for use with "Crack" or some similar program, it might be >>>better than you would think. You won't get the "unusual" words, but you >>>will also get the words in common usage that do not appear in dictionaries. >>>(Such as fnord, jedi, killfile, and the like...) >> >>"fnord" is in _my_ dictionary - can't you find it in yours? :-) >> >>>Another thing to look for when choosing dictionaries/wordlists for crack is >>>not sticking to english. If you have a userbase that is known to have a >>>certain percentage of people of a non-english background, you will want to >>>find lists of words from that background. (I had a sysadmin asking me about >>>Yiddish and Hebrew wordlists for just that reason.) These can be a bit >>>harder. (Especially for unusual languages.) >> >>Grady Ward has his Moby Words databases with some of this kind of information. >>In addition to the usual sets of languages, it's useful to include any >>available lexicons of Elvish, Klingon, Unix, and other popular >>hacker-languages, > >It is pretty easy to defend against dictionary attacks by using an expanded >character set--mixed caps and lower case; numbers substituted for some >letters according to easily-remembered personal rules. Then I caution you to review the program 'Crack'. Crack comes with two sets of rules with which it mutates the words from two separate dictionaries. Things like: replace 'i' with 'y', 's' with '$', 'e' with '3', change capitalization to pattern AbCdE, etc. Typically, there is an extensive set of rules (I remember 47) that perform more "morphing" of a shorter "hot" dictionary list, followed by a common subset of the rules applied to the entire dictionary. The shorter dictionary list I remember seeing contained an extensive list of female first names, common computer "words" such as foo, bar, etc., and even some Klingon and Elvish words. These words were subjected to extensive letter shifting, case changing, and substitutions. The balance of the dictionary was subjected to the simpler subset of rules (22, I believe) regarding substitution, reversal of letters, capitalizing the first and/or last letters, suffixing a single non-alpha character, etc. I know a rather paranoid sa who used to think he had secure passwords because he'd look around for some "word" of some random object nearby, then transmogrify some letter (typically substituting 'y' for 'i'). Crack found him out in very short order. The reason I post this is that these word lists are invaluable to the Crack operator. *ANY* knowledge that reduces the search space can render the security useless. For example, if a Crack operator learns that you once had a password of "any0ne", he or she will make sure to include a rule substituting zero for 'o' in both dictionaries, they will probably make an effort to emphasize letter-to-number substitutions of the words in their dictionary, and maybe even focus less (or at least test last) on other attacks, such as case-changing or number-suffixing. Those "easily-remembered personal rules" to which you refer can catch you pretty quickly. >"Da5id" in "Snow Crash" by Neal Stephenson is an obvious example, since the >"v" is a roman numeral 5. Another is the "Compuserve method" of inserting >punctuation characters between words making up a password or key. Since the >length of the words used is unknown to the cracker, this makes his job >harder. Harder is not NP-hard. It's a very very long way away from NP-hard. >That is--a dictionary which accomodates such things as the above will be >pretty large. With the number rule, there would have to be 10 additional >versions of the one-letter word, 10 versions of each leading character >making up a two letter word, and then it starts increasing combinatorially. >Might as well use brute force. A "pretty large" dictionary is still much! smaller than brute force. And even if it is the precursor to brute-force, it's still a better starting point than 0x00000000000000, if you have reason to believe that it's based on an ASCII password. Just remember the old joke: entropy ain't what it used to be. And every generation of faster processor that arrives makes this statement more relevant to cryptanalysis. John -- J. Deters "Captain's log, stardate 25970-point-5. I am nailed to the hull." +-------------------------------------------------------+ | NET: jad(a)dsddhc.com (work) jad(a)pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'33"N by 93^16'42"W Elev. ~=290m (work) | | PGP Key ID: 768 / 15FFA875 | +-------------------------------------------------------+

1 0

blowfish bug
by oolid＠acqic.org 17 Dec '03

17 Dec '03

Could someone recap the reference to the Blowfish bug fix and where it is and is not correct? I have lost the emails that referenced this. Best Regards, --- Joseph L. (Joe) Moll, Greenville, SC USA mailto:oolid@acqic.org

1 0

It's no "WON_der"
by Deranged Mutant 17 Dec '03

17 Dec '03

On 16 Jul 96 at 1:08, John Young wrote: > 6-15-96. NYP, Book review: > > AFTER THOUGHT > The Computer Challenge to Human Intelligence > By James Bailey > Illustrated. 277 pages Basic Books/HarperCollins. $25. > ISBN 0-465-00781-3 > Mr. Bailey, a former senior manager at the Thinking > Machines Corporation, foresees an "electronic computing > revolution" whose "intellectual impact will be greater than > anything since the Renaissance, possibly greater than > anything since the invention of language." In his view, the > greatest challenge posed by the computer revolution will be > for humans to trust processes of thinking they won't > necessarily understand, such as neural networks spotting > patterns without supplying proof "in any human-absorbable > form." Of course it's important to note that all models of computing (serial, neural, etc.) are based somewhat on conceptions of how humans think, compute, etc. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Netscape download requirements
by Alex de Joode 17 Dec '03

17 Dec '03

In article <199607161346.JAA07227(a)jekyll.piermont.com> you wrote: : Jeff Weinstein writes: : > If you are not comfortable providing this information, then you : > may either run the export version, or purchase the retail navigator : > package, which also includes the US only version when sold in the US. : But you can't buy the Linux or other similar versions, so this is not : an option for many of us. Well one 'ITAR gangsta' can alwas upload the linux version to a 'liberated ftp site'. It seems that the program checks something in the supplied phone, area code and zip code, so why not do a 'whois netscape.com' and enter the Netscape Communications Corps. data ? Afterall whois to know .... (for the humorly impaired: *g*) bEST Regards, -- -AJ-

1 0

Re: Put Uncle Sam in your Calling Circle
by Alex F 17 Dec '03

17 Dec '03

> Hey guys, > > I just got a really cool poster from RSA. It's a big circle split off > into several sections showing people talking to each other, the upper > right hand corner shows two NSA dweebs looking like Bevis & Butthead in > suits, one smoking, the other seated infront of an old 60's reel to reel > audio tape recorder, a sign on the wall behind them says "Key Escrow" You can get images of these at the RSA homepage (www.rsa.com) Click on "Art Gallery." The Key Escrow sign is impossible to read though. Alex F =-=-=-=-=-=-=-=-=-=-=-=-=- Alex F alexf(a)iss.net Marketing Specialist Internet Security Systems =-=-=-=-=-=-=-=-=-=-=-=-=-

1 0