December 2003 - cypherpunks-legacy

Macintosh PGP CDEV Idea
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have a proposal for a piece of code I'd like to try and put togethor over Xmas break, and I want to bounce it off of the group to make sure that I'm not duplicating anyone else's work. I work mostly on the Macintosh, and this program would be for the mac. It would be a CDEV (good 'ol desk accessory) which would contain a smaller version of PGP. By smaller, I don't mean less secure, I mean a little less functionality. All it would do would sign, encrypt, or decrypt text files. By being a desk accessory, it would allow a message that's been downloaded by whatever means (MS Mail, FTP, Kermit, etc.) to be quickly decrypted, or to encrypt files for uploading. The idea is to have a simple, easy graphical interface on a small floating pallete type window. Since it would be a CDEV, it could be used simultaneously with a communications program even if the machine was running 6.0 w/ the unary finder. Keys would still be generated in the full fledged version, but these keys would be accessible by the CDEV. A possible later version could also take advantage of Apple Events, thus becoming a module which other programs could send files to to become decrypted, or encrypted without worrying about the process themselves. I've begun poreing through the source code to see how easy or difficult this is going to be, but first I'd like to make sure that their aren't already projects like this in development, or if there is any body who would like to help with the development process. It must be made clear that I am a beginning C programmer and a beginning developer of hard-coded Macintosh applications. I've started to consider tackling this project as something that will force me to learn both. Anybody have any ideas, comments, proposals? E-mail me directly, unless you think its a discussion that should be posted to the group as a whole. later, - -john. -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLNJm3qNqtARNqVmxAQGL2wH/dYM7nkpeNbrFniRseZUHEl0X1p4Cn5md iqPkZWhznhwa+QhcEm6s8RGSq/Kf/uEPsy1C58wVfFbwhMF23WfPhQ== =car+ -----END PGP SIGNATURE-----

1 0

Has anyone seen "Applied Cryptography" yet ?
by trestrab＠GVSU.EDU 17 Dec '03

17 Dec '03

If anyone has seen Bruce Schneir's new book, "Applied Cryptography", please post a short review to the list so that others can know whether to special order it. Thanks. Jeff

1 0

Question about Proper Names of Crypto Companies
by Mike Godwin 17 Dec '03

17 Dec '03

A journalist friend asks me the following: > what is the proper (as in inc., corp. co., etc) > name + location of viacrypt + austin code works? I know where Austin Code Works is, of course, but couldn't be authoritative on the other matters. Could someone fill me in? --Mike, not afraid to express uncertainty

2 1

LATEST PGP INFO FILE?
by zeek＠IO.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Could somebody please direct me to either an address or ftp site where I can get the latest pgp-info file? I have one from a few months ago. Just wondering if there have been any updates. The info file I have can be found by "finger zeek(a)io.com" Any help is appreciated. Thank you, - -z -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLNK+BmH4Xujemt89AQEyDAQA1BULUB+pvSKndcOEmlYA8bbb04zlz04d J0xTD4bd7TQ5T/xvlkYFRUUDPOvNlT2pmfsDxPhLb/qOa2dHttoQUB2DPNAK9Pvm L/CEsTu4Gb2wquPcZ4Fw/HJtGaafKK9FMXoxeMEhfIoaLCkLk9W8UBFfb+Yr9koq P9xJlAX48Uk= =lwjm -----END PGP SIGNATURE-----

1 0

Re: ON THE ROAD TO NOSINESS...
by an15489＠anon.penet.fi 17 Dec '03

17 Dec '03

>In Europe, I believe that there are highways >that you can speed on, and then receive a ticket in the mail >when the camera photographs your plate. This happens here in the United States. In Campbell, California the police have a small van which they set up on major streets. If the radar thinks you're speeding, it photographs you and mails you a ticket. Jack ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

"Who the hell are CNET?"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 24 Jul 1997 16:04:16 -0700 From: Rose Aguilar <rosea(a)cnet.com> To: "Phillip M. Hallam-Baker" <hallam(a)ai.mit.edu> Cc: chris_barr(a)cnet.com, fight-censorship(a)vorlon.mit.edu Subject: "Who the hell are CNET?" For the company explanation go to: http://www.cnet.com/Community/Welcome/About/profile.html Here's my explanation: CNET doesn't compare itself to Microsoft, IBM, or MCI. Do you categorize a "significant industry player" based on its household name and revenue status? CNET has a variety of services...we have 10 Web sites and 4 TV shows...each one has a different goal. CNET doesn't "speak" for the whole Net community. That's not our goal. Our goal is to _provide_ the Net community with various services whether it be reviews, news, TV shows, or commentaries, all of which focus on technology and the Net. That might not be significant to you Phil, but it is to the million+ who use our services. Netizens may not always agree with CNET's stories, reviews, or commentaries...and we welcome opinions. You know the saying: "Negative feedback is better than no feedback." Hope this answers your question. --Rose At 01:29 PM 7/24/97 -0400, Phillip M. Hallam-Baker wrote: > I've been wondering for some time. Who the hell are CNET? > >I've never heard of them doing anything significant and I have not heard >of them in relation to any significant industry player. They are not >Microsoft, not IBM, not MCI. > >There is a problem, too many people the idea that they are speaking for >the whole net community. Too many people think that because they have >made a paper fortune from the chumps who invest in the stock market that >they are somehow important. > > Phill > > > > > > > *************************** Rose Aguilar CNET Radio Reporter/Producer 150 Chestnut St. San Francisco, CA 94111 415/395-7800 X 1227 Fax: 415/395-7815 http://www.radio.com/ ***************************

1 0

OMNI CARD
by ME 17 Dec '03

17 Dec '03

I just got this from last night's edition of "BEYOND 2000" on the discovery channel.... A Eurpoean banking system is experimenting and using a new card they call the OMNI CARD. What this does is provides some form of authentication aside from the PIN number. The procedure: 1) You place your phone call to the bank and make your request. 2) You type in your PIN number into the OMNI card (sort of a hacked calculator card, I suppose) 3) The OMNI card generates a number from this which you verbally read to the bank. 4) The bank clerk responds with a "Challenge Number" which you type into the OMNI card. 5) The OMNI card generates a result from this number which you verbally read to the bank clerk. If all is in check, this is proper authentication of who you are. The purpose is to avoid having to read your actual PIN number aloud, or type it in where someone can see you. The OMNI card uses a random formula to calculate its numbers in conjunction with the challenge number; supposedly this is different for each transaction. A sample number which was displayed was: Challenge Number: 28385180 Result : 572738 The technology was sold to "two major US computer companies" recently. I suppose this is some metamorphicly generated checksum. Until someone gets ahold of one of these OMNI cards and takes it apart... Just FYI...

1 0

cypherplonks mailing list
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

A couple of weeks ago someone jokingly proposed creating a parallel mailing list for flames, rants, and other non-crypto posts. If that ever happens, I propose calling it the "cypherplonks" mailing list. Jim_Miller(a)suite.com

1 0

Are we gatewayed to Usenet?
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <199311092038.MAA06532(a)mail.netcom.com> tcmay(a)netcom.com writes: > I believe someone has gatewayed the list onto Netcom, which is > available to many thousands of subscribers, including local POPs > (points of presence) in Washington, D.C., Boston, Atlanta, Austin, and > of course all up and down the West Coast. > > Is this such a good idea? And should it be unilaterally done? If there > was discussion of this, I must've missed it somehow (which I doubt). There is absolutely nothing wrong with a local redistribution of a mailing list. It probably isn't bidirectional, but even if it is, so what? What you're really saying is you don't want too many people reading who you can't keep tabs on, isn't it? Or are you really just rankled that *Sternlight* can read cypherpunks and you won't know about it? I guess that must be it because we've *lots* of local redistributions signed up for this list. (Anyone who wants to see the complete direct membership list merely has to telnet to toad.com's smtp port and EXPN the real list name) I have a great deal of sympathy about 'private space', but if you want to make this list in some way semi-private, then you *must* issue a policy notice when anyone signs on the list, saying what the conditions are, eg that it is not to be quoted in other forums or reposted to local lists etc. Otherwise people (unethical people, I mean) can do what they like with our posts whether we approve or not. I could show you some of the warnings I've seen elsewhere, except I'd be in breach of those lists rules by reposting them :) [no, really, I just don't have one handy...] In fact, the truly paranoid would make list membership a two-stage process where you first sent out the rules, then waited for a mail accepting them... I *don't* advicate this course by the way. I'm happy with things as they are, until DS turns up :-) Graham

1 0

Phiber, The MOD, and The LOD.
by lex＠mindvox.phantom.com 17 Dec '03

17 Dec '03

"L. Detweiler" <ld231782(a)longs.lance.colostate.edu> writes: > >Anyway, this letter is an attempt to find a topic that someone will not >flame me about, and is relevant to the cypherpunk list as I understand it! > >Phiber Optik >-- > >I have been watching the trial of Mark Abene, aka Phiber Optik, >closely, and I think I even fowarded articles on it to the cypherpunks >once. This is a very fascinating trial. We learn, for example, of the >first use of wiretaps for digital data (modem communications) for a >successful prosecution. Also, we learned about how LOD (Legion of Doom) >-- or was it MOD, Masters of Deception, I get all these criminal >organizations mixed up! -- infiltrated phone systems. I think I even >heard in one news report that some in the group performed illicit wiretaps. Although some people on this list could care less about the details, since you confused the two ex-hacking groups, I feel the need to set the record straight. It was MOD *not* LOD that phiber has been recently affiliated with. MOD was in my opinion a malicious group of hackers who used their knowlege and abilities to relentlessly harass people, wreak havoc on computer systems and networks by shirking the 'hacker ethic' of not causing damage, and allegedly to perpetrate various forms of fraud and theft. Please note that Phiber Optik was probably the most mellow one of the MOD and having spoke with him a number of times, it seems that he is not a malicious type. IMHO his mistake was teaching his 'friends' in the group how to do certain things without regard to what they intended to do with that knowlege. LOD was a whole different type of group. If you want to classify us as a criminal organization due to gaining unauthorized access into various computers and networks over the years, fine. But the LOD maintained a high standard of ethical behavior in the way of not intentionally causing damage to computer system, not violating people's privacy for the sole purpose of harassment or fraud, and the overall mentality of spreading knowlege and information to those who were interested. Obviously those ethics were warped as none of the ex-members that I am in contact with (erik bloodaxe - editor of Phrack, the marauder, Lord Digital and Deal Lord - Mindvox owners, etc.) believe that unauthorized access to computers is/was right nor legal. I am not defending what we did all those years ago, but just clarifying the degree to which we were involved. To make this clear, gaining unauthorized access to computer systems is illegal and wrong under just about any circumstance. Violating a person or company's privacy is wrong also, even if it was done out of curiousity or a thirst for knowlege. One other thing, it was reported in the press a number of times that there was some sort of war between hacker groups. I think this is silly and although I had 'retired' by 1989 which was about the time a lot of the alleged MOD activity took place, my version is that there was no 'war'. There are always personality conflicts between people and arguements between erikb and phiber appears to have been blown way out of proportion as usually happens when things get reported by the press. >I find this *fascinating*. Can anyone elaborate to me the wiretapping >that was going on? who did they wiretap? how did they do it? how did >they avoid detection? more importantly, have the phone systems been >upgraded or modified to be protected from this kind of extremely insidious >crime? One of the things some MOD members allegedly did was gain access to certain key computer systems that controlled various functions of BT's Tymnet packet switching network. There are some systems that allow a privileged user to monitor network traffic (XRAY for example), by gaining access to these systems and knowing the correct commands, one can 'wiretap'. It should be noted, if you read through the old hacker BBS message bases (which you can do if you contact lod communications who is compiling messages from the very first phreak boards such as Modem Over Manhattan and 8BBS circa 1980 up through boards such as the Phoenix Project circa 1989/1990, see the review of the project in Autumn 1993 issue of 2600 or CuD #5.39 for more details or email lodcom(a)mindvox.phantom.com) that the LOD had access to those same systems years before MOD was around, and no one was the wiser simply because it was more of an exploration of the systems as opposed to an exploitation of the systems. I for one operated on the premise that if I didn't know what a certain command did, I did not type it in. That kind of caution allows you to explore and learn as safely as possible by helping to avoid accidental damage. As for tapping phone lines, most any reader of the cypherpunks list can do this physically. What the MOD *may* have done (or use the word allegedly if you like), is to gain access to certain phone company systems, such as LMOS (Loop Maintenance Operating System) which allow a person who has a privileged account and the correct commands and syntax, to REMOTELY monitor phone lines. The phone company does this for repair and maintenance reasons and not to spy on subscribers. As we all know, most technologies can be used for reasons other than for what they were originally intended, this being a classic example. As for avoiding detection, if one had access to the Switching Control systems, they would be able to do a whole host of other things from putting traces on subscribers served by the particular switch to seeing if there were any 'traces' on their lines. In addition, putting call forwarding onto a network access port number and then forwarding calls to their computer, would allow the perpetrator to gain untold amounts of usernames/passwords for systems on whichever network they forwarded the calls from. >I read in `Cyberpunk' by K.Hafner and J.Markoff (the latter my favorite >cyberspatial writer) that K. Mitnick in California also had this >capability of wiretapping, and used it in an extremely sophisticated >way. Apparently he actually tapped the lines of police stations and >knew when they were coming, or knew when they had detected or `sniffed' >his own illegal wiretapping. >Did this happen? or is all of this rumor? Back in 1984 or so, a fellow lod member, The Blue Archer, dealt a lot with Mitnick (using the handle The Condor if I remember correctly). I specifically recall speaking with Blue Archer when he told me to not discuss certain things for fear that Condor was listening to his line remotely. Not only this, but Condor gave Blue Archer a phone number in California that forwarded to his real phone number which was located 1000 miles east. This number lasted for a long time and somehow there was never any billing associated with this long distance forwarding situation. Therefore, I believe the above happened and was not rumor. What is interesting is that he was capable of this type of technology manipulation nearly a decade ago. Condor/Mitnick was one of the 'best' there ever was, but it appears that he used his knowlege and abilities in ways that he probably should not have. >I remember Phiber Optik posting to *this list* on the subject of phone >wiretapping. I think he might have been a bit too knowledgeable for his >own good, eh? What ever happened to K. Mitnick, anyway? He did serve >federal time, I know that. I remember reading that story and thinking >-- here is someone we should keep our eyes on, even after he is out of >prison, *especially* when he is out! > >Conspiracy Charges >-- > >Another question. I understand that Mr. Abene was charged with >`conspiracy' or at least that was one of the charges involved in the >whole affair, perhaps against others. My question: what is the legal >criterion for a `conspiracy'? what are the penalties? did Abene >actually get successfully prosecuted for `conspiring'? what was the >conspiracy? Did it have anything to do with the wiretapping?what are >famous conspiracy cases? I'm sure that some cypherpunks may be >knowledgeable on these subjects. I sincerely hope I haven't offended >anyone in asking. Mr. Finney posted some outstanding analyses of the >ITAR (which I subsequently incorporated into a RISKS article), for >example, so there is definitely some strong legal background here. > >please cc: your replies to me or I may not see them. > Reply was cc'd to you. Lex

1 0