December 2003 - cypherpunks-legacy

Mr. throw@yourself.up
by jamie＠comet.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- He's some little turd at telnor.net. Probably rex(a)telnor.net Throw ftp://ftp.telnor.net/pub/firewall/downloaders.HTM into your favorite browser. The ftp server is world writable too. Fuckin' IRC scum. Oh yeah. Merry Christmas. jamie - ------------------------------------------------------------------------------ jamie(a)comet.net | Comet.Net | Send empty message | Charlottesville, Va. | to pgpkey(a)comet.net | (804)295-2407 | for pgp public key. | http://www.comet.net | "When buying and selling are controlled by legislation, the first things to be bought and sold are legislators" -P.J. O'Rourke. - ------------------------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMrkpX/MDfTuunU79AQEeogf+Lq4bmq3klEUXHyMAozReqBJgX55AshYs SKh+dZUSEd4kXGM2zDbApLyO8htzxVlpMfcql8ra//9S55OqIOrI3EaVlm3MJ1jt q0oBLM93SNPUmExVAiR38LEybPi7m8qWpfPj6xQUrt20Jlh3FG1aZJJW0JxW1vHP QwsZCbp2QKifCYA+ej404HdsVjfPoC/IyTcZ/QTi5BOcXMLRbjkfLb3XuVjPfuiE 5wrqqVnXmQpGOp9Pd1yUHvGUYcxKIRBqx23IwaxcIpfONtWsDfTlZixLGZNVOjc8 SJmbOukE+KeOSJRElwrJFuWVTB+qtTyif9qksopmuj6vsCQpbrQ94g== =aDfS -----END PGP SIGNATURE-----

1 0

Proof that "cypher punks" have complete degenerated...
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

No one even commented on the latest Dr. Dobbs issue. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

4 5

BUY_spy
by John Young 17 Dec '03

17 Dec '03

12-18-96. "Special Chips Off-Load and Speed Encryption Transactions" Buy-spy GAK chips from IRE, Rainbow, Atalla, IBM. "Clinton administration opposed to encryption bills" "Goodlatte to resubmit encryption bill" Commerce Department has said it expects to issue rules implementing the new Clinton export policy by January 1, 1997. [NYT reports final rules are due out December 22.] "Method and apparatus for the secure communication of data" Patent: An auto-dialer suitable for use as a smart card capable of being acoustically coupled to a telephone and being reprogrammed in response to acoustic signals. A device for generating a set of tones encoded with data. "Enciphered file sharing method (Fujitsu)" Patent: An enciphered file sharing method adapted to an area distributed type data processing system. "EMD Encryptor; First 32-Bit desktop utility to provide multiple encryption capabilities for home and corporate computer users Largest encryption key size: 256-bit. ----- BUY_spy

1 0

RE: The virus I got...
by Mullen Patrick 17 Dec '03

17 Dec '03

You already had the Monkey (or whatever) virus. It was not included in the file distributed to the list. The file was a pure Trojan, not infector. PM _______________________________________________________________________________ From: Internaut on Thu, Dec 19, 1996 3:30 Subject: RE: The virus I got... From: Mark Rosen[SMTP:mrosen@peganet.com] Sent: Wednesday, December 18, 1996 04.37 PM >Oh, and as far as I know, no virus was installed, >though you should check for one just for good measure. There was one, though I don't remember what it's name was. Maby it was Monkey. I already deleted it. --Internaut

2 1

RE: !! Point 'n Crypt -- Win95 Privacy for Everyone !!
by Peter Trei 17 Dec '03

17 Dec '03

> From: Walt Armour <walt(a)blarg.net> > Subject: RE: !! Point 'n Crypt -- Win95 Privacy for Everyone !! > Security through obscurity is no security at all. > > As for PnC (actually, the scCryptoEngine beneath it), we get the 40 bits > from the 56 bits by nulling out the high nybble of every other byte. > > walt > > ---------- > From: Peter Trei[SMTP:trei@process.com] > Would you mind telling us just how you expand the 40 key to the 56 > bits needed for DES? (Security through obscurity has a bad rep on > this list). For many methods of doing so, 40bit DES is NOT > secure against a motivated individual's attack. > > Peter Trei > trei(a)process.com Thanks for being so forthcoming! There are methods for using 40 bit keys that are a lot better than this. My contention stands: 50 200MHz Pentiums *WILL* crack this overnight. A single 100 MHz Pentium will do it in a month. (This assumes a known plaintext attack in EBC or CBC mode). Not utterly trivial, but well within the means of a motivated individual. Peter Trei trei(a)process.com

1 0

EFF: Bernstein court declares crypto restrictions unconstitutional
by Rich Burroughs 17 Dec '03

17 Dec '03

> COURT DECLARES CRYPTO RESTRICTIONS UNCONSTITUTIONAL > Free Speech Trumps Clinton Wiretap Plan > >December 18, 1996 [snip] This is the best news that I have heard in some time :) Congrats to John, EFF, Cindy Cohn, and the other counsel for Professor Bernstein. I am very much looking forward to seeing that decision... Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb U.S. State Censorship Page at - http://www.teleport.com/~richieb/state dec96 issue "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

passphrase protection (was: Re: [PGP-USERS] Security LeakPrograms)
by Dave Del Torto 17 Dec '03

17 Dec '03

In Reply to the Message wherein it was written: >I have just in the last few minutes realized how I need to bring attention >to the security level of my own computer or PGP means NOTHING in terms of >protection. Indeed, Floyd: the dirty little secret is that passphrase protection is a more serious weakness than almost any other factor. I don't just mean dictionary attacks: those are way too expensive if you can just grab a text stream saved to an invisible file on an unsuspecting user's net-accessible machine. The new generation of PGP software (3.x) includes several new prompts/enhancements to the passphrase entry process: perhaps subsequent releases could take those even further into the realm of system-level monitoring. >PZ writes in the manual about the inability to fully wipe, etc. >when using virtual memory but this problem I just encountered in security >goes beyond that, I believe. >I have been installing a Macintosh program, FileGuard, which adds several >levels of security. I knew about and had used the invisible extension >HiddenOasis that saves EVERY keystroke made on the machine. I started doing an informal survey of all key capture utilities (on all platforms) a couple of years back, but there were so few utilities publicly available back then, very few respondents came back at me with items to list. It occurred to me then that if there _were_ persons trying to grab passphrases from an individual's machine, it would be a significant advantage to have "invisible" keystroke monitors and for all knowledge of the existence of such utilities to remain a closely-guarded secret (from, say, the laptop of an FBI counter-intelligence instructor suspected of selling secrets to foreign agents for a few hundred thousand dollars, or something improbable like that). However, it's not the "good guys" we mainly need to be concerned with: there is a great deal of industrial espionage that needs some sunshine. The viability of personal privacy software in the marketplace is threatened if such utilities spread: as a responsible company protecting both the public's interest and our own company's survival, we need to plan for very sophisticated passphrase attacks and constantly educate users about this danger. That having been said, this invisible "HiddenOasis" item you mention is a new one to me: I'd like a copy to test in our lab and my interest in hearing about everyone's favorite keycapture utility is rekindled. Maybe my boss will let me devote, oh, about 0.73% of my time to this. ;) PGP's engineers have already spec'ed out some good defenses against subtle attacks like ion migration (memory burn-in), and with everyone's help (we can't watch every security leak, that's why we need you guys!), we can continue to work up defenses against such wee beasties. Any whistleblowers are also invited to drop a dime: my public key is widely available (even clickable) through the header URL above and we still have anonymous remailers in this country. Nudge-nudge, say no more, etc. [elided] >To my surprise as I set user priveledges with FileGuard, I saw a previously >unnoticed folder far from my root directory called, "Ghostwriter." This gives new meaning to the term "spook"... >I rummaged through it and many, most of the files therein (900k of files) >showed various passwords I had consdered absolutely uncompromised in >plaintext. It's quite a shocking feeling to realize what defaults are built into some popular commercial apps, isn't it? :/ You don't often see "insignificant" items like this get mentioned in any popular reviews either. It could be that even more users out there are ignorant of this issue than there are sysadmins who haven't read up on the SYN attack. >It turns out that the spell-check program, SpellCatcher [elided] created >these files which (from the manual), "For the Ghostwriter feature, Spell >Catcher saves a continuous stream of keystrokes to a text file inside the >SPEL CATCHER FOLDER." The manual does mention disabling Ghostwriter before >typing a "sensitive password." But offers no way to PERMANENTLY shut this >feature OFF. [elided] If confirmed, this is an absolutely unconscionable design flaw, IMHO. Anyone who has a specific comment (include URLs if possible), please mail me and put "passphrase protection" somewhere in the subject line. <"mailto:ddt@pgp.com?subject=passphrase protection"> I'll collect them, filter to our engineers where appropriate and eventually, when we have enough for a decent matrix, I'll either post a summary on our website or write up an informational RFC. dave ________________________________________________________________________ Dave Del Torto +1.415.524.6231 tel Manager, Strategic Technical Evangelism +1.415.631.0599 fax Pretty Good Privacy, Inc. http://www.pgp.com web

1 0

thread?
by danalogi＠videotron.net 17 Dec '03

17 Dec '03

can we read this thread as a newsgroup somehwre? or it's avaible only as remail? fred.

1 0

Re: Pretty Lousy Privacy
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

At 06:19 AM 12/19/96 -0800, you wrote: :John H West wrote: :> Are Dr DVT & Ray Arachelian the same pair who relentlessly :> spammed the Net about three years ago. [snip] How soon can we expect Turkish and Armenian language modules for this beta? What is status vis-a-vis export? Thanks for the effort. Cordially, Alec PGP Fingerprint: Type bits/keyID Date User ID pub 1024/41207EE5 1996/04/08 Alec McCrackin <camcc(a)abraxis.com> Key fingerprint = 09 13 E1 CB B3 0C 88 D9 D7 D4 10 F0 06 7D DF 31

5 10

RE: permanent invasion of privacy
by Blanc Weber 17 Dec '03

17 Dec '03

From: Dale Thorn Maybe if you got off your ass and did something worthwhile for society, things would really change for the better. But I won't hold my breath. ............................................................. Don't be so presumptious, Dale. I could be a secret cpunk NSA tentacleH^H^H^H^agent on the list trying to discourage people from pursuing certain ideas - like yours, for example. .. Blanc (LOL) > >

1 0