December 2003 - cypherpunks-legacy

Re: hohocon
by smb＠research.att.com 17 Dec '03

17 Dec '03

We use challenge/response devices from the Internet: \begin{figure} \begin{quote} \logsize \begin{verbatim} $ telnet guard.research.att.com Trying... Connected to guard.research.att.com. Escape character is '^]'. This is the new inet. Authorized use only. Authentication Server. Id? ches challenge: 348201 response: d2c3f97d TCP host name? cetus rlogin cetus -l ches IRIX Release 4.0.5C System V cetus.research.att.com Copyright 1987-1992 Silicon Graphics, Inc. All Rights Reserved. cetus=; exit Connection closed.Connection closed by foreign host. $ \end{verbatim} \end{quote} \caption{\label{fig:hha-connect} The full text of an actual terminal session using our challenge/response-based guard.} \end{figure}

1 0

Re: hohocon
by smb＠research.att.com 17 Dec '03

17 Dec '03

It seems to me that a simpler solution than challenge-response would be to emultate the tear-sheet crypto systems and just have a series of one-shot passwords generated. Each time you log in, it requires the next password from the sheet, so capturing the old one does no good (just as breaking the one-time codes from tear sheets doesn't help). Now if I could just figure out a simple way to do this on UNIX... See @article{lamport-pw, author = {Leslie Lamport}, journal = {Communications of the ACM}, month = {November}, number = 11, pages = {770--772}, title = {Password Authentciation with Insecure Communication}, volume = 24, year = 1981 } The Bellcore S-Key system implements this scheme, and is, I think, freely available. I know that it's included in TIS's firewall toolkit: \software{ftp.tis.com}{/pub/firewalls/toolkit}

1 0

PGP keys, laptops, HoHo Con
by ravage＠wixer.bga.com 17 Dec '03

17 Dec '03

On the topic of HoHo Con and keys, I should have access to at least 2 laptops rrunning PGP under linux. I believe that mentor(a)io.com will vouch for my authenticity at least for casual casual key generation.

1 0

FCC policy
by George A. Gleason 17 Dec '03

17 Dec '03

Re Strick's item on "used to be legal to listen to anything that passed through your airspace as long as you didn't (divulge or sell)..." Yes this used to be the case. I'm not sure if ECPA is what changed it, but.... there is some hope of getting it changed back again... Bill Clinton just signed a piece of legislation which restored a pre-1990 standard with regard to religious freedom, overturning a more authoritarian standard prmulgated by the Supreme Court in the last couple of years. The critical case involved Native American use of peyote, a sacramental cactus which is also a controlled substance. Anyway, if Clinton is backing efforts to return to older and more libertarian standards in one area, it's worth a try he'd go for it in another area as well. He made a decent statement about how religious freedom is vital to the 1st Amendment, is foundational in our country, and so on; one could make the same case around a freedom to *hear* which is the necessary corrolary to the freedom to speak. -gg

2 1

FTP archive for PGP
by A.J. Janschewitz 17 Dec '03

17 Dec '03

Sorry for the list post of a FAQ, but I've been away from this area of the net for a while. What are current ftp sites for PGP? Please reply by direct email ... thanks.

1 0

Re: hohocon
by Jef Poskanzer 17 Dec '03

17 Dec '03

At Hackers 8.0 a hallway discussion (including Eric Hughes) came up with an amusing variation on these sniff-resistant authentication schemes: use a pager. It goes like this. You telnet from an insecure site to your home system, and type your userid. Instead of prompting you for a password, your system looks up your pager number, dials out to the pager service, and pages you with a random but syntactically valid phone number. Then it prompts you. You receive the page and type that number as your password. Authentication is based on physical posession of the pager, and knowing what userid/machine it corresponds to. A possible attack would be to monitor the pager frequencies and try to snag the number out of the air. Possible defense against this would be to require a special password before the page is generated - an attacker would have to monitor both the network and the radio. Not military grade security, but lots of folks have pagers and could hack together something like this in a day or so. --- Jef

1 0

hohocon
by Peter shipley 17 Dec '03

17 Dec '03

I am wondering if anyone I plan to bring a (cheap) laptop to I can collect and trade (& sign) PGP keys PS: I to not read all my cypherpunks email so if you reply keep "hohocon" in the subject so I know to read it :-)

7 6

CELL STRUCTURE
by Sandy 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, Allan Bailey referenced "The Republic of Desire" in Gibson's /Virtual Light/. He asked: Anyone have a ref for something that discusses guerilla cell organizations? One of my all-time favorite books, Heinlein's /The Moon is a Harsh Mistress/, has a great description of how traditional guerilla cells are structured. In addition, he creates a new cell structure based on secure communications in a computer mediated setting that foreshadowed many of the concepts we deal with on this list every day. Free Luna! S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

HoHoCon key exchanges
by crunch＠netcom.com 17 Dec '03

17 Dec '03

in relation to the HoHoCOn event... >> >> I am wondering if anyone I plan to bring a (cheap) laptop to I can >> collect and trade (& sign) PGP keys > John Draper has already expressed an interest in having everyone > exchange keys, and will probably mention this during his speech. > I can guarantee there will be numerous laptops, and even full > systems avaialable. Last year, we even had 4-machine internet > site going - hohocon.com. Yeah, it was great for about 5 minutes > until all the power in the wing went out. Yes... And lets have at least SOMEONE who can have a Mac at HoHoCon this time.... Last time there was NOBODY that had one. Yukk!! whatta bummer.... I am also interested if there is any rave taking place on the weekend of the HoHoCon. I sure want to get in some dancing while I'm there :-) .... CC

1 0

latest procmail and recipes.
by J. Michael Diehl 17 Dec '03

17 Dec '03

Hi all! I just thought I'd post to let you know that I can send any interested parties the latest version of procmail and my pgp recipes for procmail. Send me a message with the subject: send help for more details. Lagers, J. Michael Diehl ;^) |*The 2nd Amendment is there in case the mdiehl(a)triton.unm.edu | Government forgets about the 1st! <RL> Mike.Diehl(a)f29.n301.z1 |*God is a good Physicist, and an even .fidonet.org | better Mathematician. <Me> al945(a)cwns9.ins.cwru.edu|*I'm just looking for the opportunity to (505) 299-2282 (voice) | be Politically Incorrect! <Me> Can we impeach him yet? |*Protected by 18 USC 2511 and 18 USC 2703.

2 1