December 2003 - cypherpunks-legacy

"Practical Joke"
by Information Security 17 Dec '03

17 Dec '03

>Pssst... > >When John Glenn returns from space, everyone dress in ape suits. > >Pass it on.

1 0

Netscape inside scoop on "Smart Browsing"
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Authentication-Warning: tarnhelm.blu.org: majordom set sender to owner-isig(a)blu.org using -f From: rivalcs(a)ma.ultranet.com To: <isig(a)blu.org> Subject: Netscape inside scoop on "Smart Browsing" Date: Thu, 5 Nov 1998 06:00:21 -0500 MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 Importance: Normal Sender: owner-isig(a)blu.org Precedence: bulk Reply-To: isig(a)blu.org > * IS SMART BROWSING REALLY SO SMART? > (contributed by Mark Joseph Edwards, http://www.ntsecurity.net) > Many of you are aware of Netscape's new versions of its Navigator Web > browser. But do you also know that, starting with version 4.06, the > product's Smart Browsing feature can report to Netscape every Web page > you visit, including addresses to private sites on your internal > network? And are you aware that when you download a secure version of > Netscape's browser, the process places a cookie on your system that can > match your name and address to your Web surfing habits? Matt Curtin, > Gary Ellison, and Doug Monroe of Interhack published a report that > outlines the details. Netscape's What's Related? browser feature (a > technology provided by Alexa Internet) seems to be the cause of this > potential invasion of privacy. For those who don't know, the What's > Related? feature delivers a list of URLs associated with the Web page > you're visiting. The feature does this by automatically appending the > URL of the page you're visiting to the end of another URL and sending > it to a server at Netscape. For example, if you visit my Web site > (http://www.ntsecurity.net) the URL that Netscape receives is > http://www-rl4.netscape.com/wtgn?www.ntsecurity.net. And when Netscape > uses this URL to return a list of URLs for related sites, the URLs > aren't directly linked-they go through Netscape, telling Netscape which > site, if any, you chose from the list. The related URLs link to > http://info.netscape.com, which forwards you to the intended > destination. The link URLs look like this: > http://info.netscape.com/fwd/rl/http://www.ntshop.net:80/. > The report states that the group isn't accusing anyone of malice, and > clearly points out that even the best-intended systems can have > undesirable consequences. The real bone to pick here is the lack of > disclosure to potential users of the Smart Browsing technology, and > lack of a statement about the intended storage and use of private > browsing information collected from unsuspecting Netscape users. > According to the report, the feature enables by default, and no > documentation on the feature existed until the report became public. I > don't know about you, but if I bought a new Corvette from General > Motors (GM), and the Corvette reported to GM every place I went, I'd > expect GM to tell me up front. Otherwise, I'd feel deceived and taken > advantage of. But then again, maybe I'm being paranoid when I assume > that private actions should remain private. > http://www.interhack.net/pubs/whatsrelated/ > http://home.netscape.com/escapes/related/faq.html > Rick Desautels Sr. Systems Engineer Rival Computer Solutions rivalcs(a)ma.ultranet.com -- To unsubscribe from this list, send mail to majordomo(a)blu.org with the following text in the *body* (*not* the subject line) of the letter: unsubscribe isig --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: TEMPEST laptops (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 4 Nov 1998 23:19:17 -0800 > From: Tim May <tcmay(a)got.net> > Subject: Re: TEMPEST laptops (fwd) > >It depends on the frequency. Last time I checked a laser or a maser (both > >are radio waves strictly speaking) travel LOS. The scattering comes from > >beam divergence and incidental refractions and reflections from the > >molecules in the air and supported detritus. > > Oh come on, let's not get into sophistry. And lasers are not considered to > be radio frequency devices by anyone I know of...visible, IR, and UV lasers > are all treated as _photon_ devices, "light." (Yes, yes, I know about > particles vs. waves.) p-v-w is irrelevent. No Tim, it's photons as the intermediate vector boson for EM radiation. *ALL* physicist consider light to be hi-freq radio waves, or radio waves to be low-freq light. Hell, strictly speaking standing in the middle of a dark room waving a bar magnet back and forth is a very low freq. flash light. And you have a physics degree...... > Nope, they'll still get out. The parallel mirror scenario. Irrelevant. Last time I checked my microwave was 8 corner reflectors. That says that ultimately the ray goes back along the way it came with a shift in beam axis. How a microwave works is that up in one corner is a small grating. Behind that grating is a magnetron/klystron/etc. tube. That tube sends a beam out through that little grating. The axis of the tube is slightly mis-aligned ,otherwise the beam would come back into the tube and burn it out - also why you don't put metal things in there, it disrupts the reflection pattern. As a consequence of this design the corners and the exact center of the cavity don't get enough microwave radiation to do much of anything with. If you were to actualy map the microwaves you'd see beams bouncing back and forth and not continous coverage. There are actualy spots in every microwave oven cavity that get zero radiation. Anything put in there cooks as a function of the water in its neighbor heating up and transfered by the standard thermodynamic (which is also EM by the way) mechanism. Test it yourself. > We're talking about signal strength of the emitted RF being knocked down > 80 or 100 dB by the shielding. This is a common way of talking about the > effectiveness of a Faraday cage. True, the point I'm trying to make to you folks is that it *ISN'T* the absolute level of the signal that you are necessarily concerned with but rather the dynamic range in that signal. Simply knowing there's a 3mV signal out there won't do you a damn bit of good unless you have enough signal range to decode the contents. In actuality you could be emitting GW's of signal and if there was only say 1uV of signal range you'd never get anything off it. It just occured to me that one way to weaken TEMPEST is to mask the signals (not sure exactly how) that are emitted by encrypting (ie whitening) the signal when it's on exposed/radiating buss or connector. ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Cryptography Study Group - Palo Alto (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 4 Nov 1998 22:45:42 -0800 > From: John Cutler <jcutler(a)via.net> > Subject: Cryptography Study Group - Palo Alto > A Palo Alto-centered cryptography study group has been been formed. > Our first project is to read Schneier's "Applied Cryptography." We > meet a couple times each week to go over assigned reading and to play > with ideas about cryptography. While the current participants all > have a professional interest in the field, we are loosely organized. > Readings are decided at the previous meeting giving us the flexibility > to explore particular ideas in depth. > > Please contact me if you would like to join us. This is a GREAT! idea John. If you don't object, and since Austin Cypherpunks are dead dead dead, I believe I'll start something similar. I think the approach I'll use is a bit different in that I'm going to ask participants to read say the first chapter and get together over some period and actualy write a program (probably in Perl) that impliments the topic(s) under discussion. If it were to meet say every other week for two hours they should be able to go through a chapter every couple of months or so. Now I've got to find a place suitable....:) ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Y2K prompts many to prepare, 6-month delays now common
by Declan McCullagh 17 Dec '03

17 Dec '03

>X-Sender: declan(a)mail.well.com >X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0.2 >Date: Thu, 05 Nov 1998 08:24:55 -0500 >To: politech(a)vorlon.mit.edu >From: Declan McCullagh <declan(a)well.com> >Subject: FC: Y2K prompts many to prepare, 6-month delays now common >Sender: owner-politech(a)vorlon.mit.edu >Reply-To: declan(a)well.com >X-Loop: politech(a)vorlon.mit.edu >X-URL: Politech is at http://www.well.com/~declan/politech/ > >[I think this is important news: Y2K fear has grown faster than many of us >expected it would. Companies tell me that unless you place your order by >early next year, you'll receive it after 1-1-00. --Declan] > > >http://www.wired.com/news/news/politics/story/16035.html > > Companies selling bulk food, > generators, and solar energy systems > report backlogs of up to six months. The > reason: nationwide hand-wringing over > the millennium bug. By Declan McCullagh. > > > > > >-------------------------------------------------------------------------- >POLITECH -- the moderated mailing list of politics and technology >To subscribe: send a message to majordomo(a)vorlon.mit.edu with this text: >subscribe politech >More information is at http://www.well.com/~declan/politech/ >-------------------------------------------------------------------------- >

1 0

How to test *your* microwave oven distribution pattern.
by Jim Choate 17 Dec '03

17 Dec '03

Here's a simple way to test the bounce-pattern of your micro-wave oven: - Go to your local hobby store and buy some small balsa or pine sheeting, stringers (4x), and glue (non-water based). You'll also need several small open top containers (like a shot glass but smaller for best effect) and a marker. - Cut the stringers to the vertical height of your oven cavity. - Cut the sheeting into 1in. sq. pieces. - Mark the stringers evenly such that there is enough room to glue the sheeting between the stringers, forming a multi-leveled tower. - On each level place your container with a suitable amount of water (fill it almost to the brim). - Place the tower w/ it's containers in one of the corners. Mark a line around the base so you know where you been. - Start your microwave up (adjust time as needed, say start with 30s) and note the temperature of each container after the time. Note that putting your thermometer in there will cool it slightly and you'll also need to have the same number of runs and levels so so each level can be measured immediately after opening the door. If you have access to an optical pyrometer you could potentialy measure them all. - Once you've measured it here, move it over to be adjacent to the lines you drew above, outline the base again and repeat as needed. - Run your regression and your done, tadah. Some glasses will be hot, others won't. Trace the path of the beam out of the magnetron and you'll get a good idea of what your oven is really doing. Whether the cavity is stricly a corner reflector (ie corners are square) or is trapezoidal (slightly off square to help disperse the bounce pattern not the beam) is irrelevant to the actual holes in the pattern, they will be there. I'll mention but not go into the shadowing effect of objects placed in the cavity and the requirement for even cooking means that they have to be rotated for even dispersal of the cooking effect. Another indication that the beam doesn't disperse as widely or quickly as some claim. On another topic about holes and escaping microwaves, if the holes are the right size (which the screen in the glass in the front of your oven is) they will preferentialy absorb the microwave, if it's correctly grounded very little of the radiation will escape (as you can measure with a standard microwave oven leak detector). Now, let's talk about ways to build a laptop that will reduce the emissed radiation to a minimum. First, put all the computing guts into a small box that is well grounded (running on a battery will pretty much screw you here since it ain't grounded unless you drive a stake into the ground). Then make sure that any openings or gaps are in the front edge or on the bottem pointed down. There should be no breaks in the sides, rear, or top. Make sure the floppy, CD, hard drive are placed in the front of the laptop container adjacent to the metal box above and make sure any openings in them point out. The reason you want the openings in the front edge is that your body will make a very good sheild to that hi-energy rf that folks want to tap. The openings on the bottem will direct it to the ground where where they are absorbed (why they call it a ground-plane). Make sure that all cabling from the peripherals to the computing box are shielded (remember, ground the shield at one end only). The seam or hinge between the display and the case should be shielded with standard copper fingers. The cabling should also be well shielded. Make sure there is a grounded screen covering the front of the LCD (and for gods sake don't ever use a plasma display). The exterior case should be metal (why I love my Tadpole 3XP and IBM N40). All openings for batteries and such should be screwed down and not simply retained by a latch of some sort. The *ONLY* way to power the laptop should be by battery. There should be no provision to power it off the ac mains (this is going to be inconvenient since you'll need to carry extra batteries, an external charger for them, and the screw drivers and such to change them - no simply and easy pop-outs here). As to the display, the ideal display would be a dual-display HMD that was also sheilded. This is based on the assumption that if your data is so sensitive that you don't want people snarking it out of the air you probably don't want them reading it over your shoulder (up close or through a tele-photo). If you do decide to stake your laptop as refered above there are a few things to know.... - Make sure the stake is in suitable ground without lots of quartz and other similar peizo-electric materials. - The stake should extend at least 3ft. into the ground. - When the stake is driven in, the ground should be thoroughly wetted which usualy means quite a bit of water (30 gals or so should do it), if possible wet it over a 24 hour period prior to staking. - Make sure the stake and the cable leading to the laptop are copper (or silver if you're rich) - You don't want to be close to phone, power, and other sorts of underground utilities. ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

Who Cares (fwd)
by Albert P. Franco, II 17 Dec '03

17 Dec '03

> >Forwarded message: > >> From: "Blanc" <blancw(a)cnw.com> >> policy: what are all those other people doing? > >From: Jim Choate <ravage(a)EINSTEIN.ssz.com> >If you're talking about the people who didn't vote, they're trying to keep >from going under. Probably working two jobs, keeping the kids in school and >out of trouble, saving for college, paying the house morgage off, etc. Who's >in office won't make a whit of difference to any of that. It's irrelevant. > >If you're talking about the politicians, they're laughing their ass off on >the way to the bank to cash their tax-derived income. > > And then there are those of us who are denied our opportunity to vote because the damn absentee ballot always seems to arrive a week after the election!! Coincidence? Bad Luck? Or is it design? APF

1 0

(Fwd) Re: DigiCash Inc. to File Reorganization, Seeks Partners
by Warren E. Agin 17 Dec '03

17 Dec '03

For those who are really interested, the DigiCash Incorporated Chapter 11 case was filed in the Northern District of California. The case number is 98-58986. -Warren Agin ___________________________________________________ Warren E. Agin Law Offices of Warren E. Agin 76 Canal Street, Boston MA 02114 (617)227-3201 (f)(617) 227-6365 www.agin.com ___________________________________________________

1 0

US Cyberthreat Policy
by John Young 17 Dec '03

17 Dec '03

The USIA E-journal, Foreign Policy Agenda, for November is titled "Cyberthreat: Protecting US Information Networks." It has articles by the head of NSA, DoD's Hamre, CIAO's Hunker, Y2K Office's Koskinen, Senator Kyl, and reps from Microsoft, IBM and others: http://www.usia.gov/journals/itps/1198/ijpe/toc.htm Martin Libicki of RAND criticizes the administration's crypto policy for hindering widespread information protection: http://jya.com/ml110498.htm

3 2

How to save a real audio stream?
by Bart van Moorsel 17 Dec '03

17 Dec '03

Can anybody explain how to save a real audio stream? I think I saw this question before, sorry to ask for a replay.

1 0