December 2003 - cypherpunks-legacy

Re: ssh protocol
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Matt Ghio wrote (on cypherpunks): >I've been playing with the cryptotcp program available from utopia.. It >has some bugs but works pretty well, if you don't mind waiting 20-30 >seconds at the beginning. It does a Diffie-Hellman exchange and 3DES over >telnet. How hard would it be to add some sort of authentication to this >program? I haven't actually compiled the code (it's not very DOS-friendly), but it looks easily modified; some parts of the problem are still hard, such as identifying the client to the server. Some issues to deal with for adding authentication: 0) RSAREF2.0 would have been nice, and comes with D-H and DES. 1) The option negotiation is simple but hard-coded; it would be easy to add one thing at a time, but would benefit from a more flexible option-negotiator. That would also let you pretend it was just a general-purpose telnet-with- various-processors and avoid ITAR restrictions for the authentication-plus-compression bones version, but the authors, not being Yankees, don't have to worry about that. 2) Authentication means that some process on each machine is willing to make a digital signature using a private key - how do you store that key safely? For a client operated by a human, that's not a big problem; for a server, or a client operated by a program without a direct user-interface, it's harder. Do you just leave the key in a file (trusting root?) Do you only start the server daemon by hand? For most Unix applications, I suppose a root-read-only file containing the key is OK, since if a cracker can read that file you've got far more serious problems (and the cracker can take over your email anyway.) 3) One big difficulty in authentication systems is securely but conveniently exchanging authentication parameters; you don't want to risk man-in-the-middle by trusting keys you got from the other side (otherwise you could use plain D-H), but getting keys from a keyserver is slow and hard to integrate, and requiring the other side to already have your key parameters limits your usefulness. 3A) How do you know who you're talking to so you know which authentication data to use? For the client, that's pretty easy - the client knows it's calling server(a)foo.bar.edu, so it can get the keys in advance and not worry. (It still needs the PGP web-of-trust or X.509 hierarchy to validate the keys.) But how does the server know who the client is? IP address? What if it's spoofed? What if it does a DNS lookup, which gets spoofed? You could use a password-file equivalent, but that does mean you can only send mail to people who trust you? 3B) How do you do error recovery in PGP, i.e. you either can't find the other side's keys, or can find them but can't validate them because you don't have a web of trust that gets from you to them. Do you just fail the call? (That's secure but boring.) If you complete the call anyway, that means there's a major security risk, which is that Bad Guys can spoof keys by sending you keys you can't validate. 3C) If you use X.509 hierarchical certification, you _can_ just hand across the certificate instead of waiting for a PGP keyserver to respond, since the web of trust is built-in if you're part of the same hierarchy, but there's still the problem (for the server) of knowing whose certificate to use. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- # Crypto in 3-4 lines of perl --> http://dcs.ex.ac.uk/~aba/

1 0

Re: punk's not dead!
by Andrew.Spring＠ping.be 17 Dec '03

17 Dec '03

>hello? i'am new on this stuff, help me! Sorry, this a mailing list for Country & Western music. -- Thank you VERY much! You'll be getting a Handsome Simulfax Copy of your OWN words in the mail soon (and My Reply). <Andrew.Spring(a)ping.be> PGP Print: 0529 C9AF 613E 9E49 378E 54CD E232 DF96 Thank you for question, exit left to Funway.

1 0

QIK_san
by John Young 17 Dec '03

17 Dec '03

8-1-95. W$Japer: "Your Home Computer Will Soon Be Your Banker and Broker." The first on-line banking transaction will be a historic moment not unlike the first automobile sale or the first commercial airline flight. It will signal a commercially viable use of a new technology that may ultimately eliminate what until now we have considered the retail aspects of banking, stock brokerage and more. The implications are profound. The promise is electronic access to all financial transactions at substantially lower cost. One's personal computer can, in essence, become an in-home bank branch, brokerage outlet and financial planner. For example, with Intuit's software and with its union with American Express, Smith Barney and 17 large banks, consumers will be able use one link for the first time to access traditional banking, credit- and charge-card services, brokerage services, financial planning and more. The effect on the banking and brokerage business and their employees is going to be profound. The retail sales forces of banks and brokerage houses may shrink substantially, as may the ranks of financial planners. The number of bank and brokerage buildings may also shrink. QIK_san

1 0

Re: Commercial killers
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 1:00 AM 8/1/95, Robert Hettinga wrote: >God help me, all of this reminds me of a Carl Sagan book, of all things. >One of his science fiction characters was said to have made his first >fortune by building a commercial zapping chip for VCRs. > >Butthead Astronomer, indeed... There have been _billions and billions_ of proposals for commercial zappers. (Actually, not such a saganesque number, but dozens at least.) Harry Bartholomew was telling me a year or so ago about some ideas for detecting volume changes. I think, however, the problem of distinguishing commercial from non-commercial signal is, I think, a tough one. My point earlier was not to actually do this, but to suggest that if the V-chip is to code various kinds of content, then the logic is strong for commercial content to be similarly coded. (For example, schools often show taped broadcasts...they might claim that it would be harmful and improper for children to be exposed to beer commercial during school hours...) This would gore the ox of the advertisers, so they might quietly have the whole V-chip thing killed. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

3 2

Re: a hole in PGP
by Doug Hughes 17 Dec '03

17 Dec '03

>How is it "unscholarly, unprofessional, needlessly personal, and just >plain insulting" to question the idea that hundreds of thousands of >people are trusting their freedom to software that is probably not >secure? I think it is highly unprofessional to try to claim that PGP is >secure and to try to bolster that position by claiming that some >"Request for Comments" supports it when that same said RFC refutes it. ... ... >As far as the potential that they are working with the NSA to subvert >personal privacy, it is a potential, just as it is a potential that I am >working with the NSA to undermine confidence in PGP. The issue is and >should be, why (specifically) do you believe that PGP is secure. Here you go again. "Probably not secure". Earlier you make implications of trap doors. The only way for a trap door to be there, would be if one of the authors put it there. Otherwise, you would be suggesting that one dark night, on a new moon, the NSA snuck in to MIT, changed the source code, inserted a back door, and snuck out without anybody being the wiser. Implying there is a trap door is much different than implying there may be a flaw in the code itself that allows a security breach. I agree with Matt's assessment on your behavior Fred. Your statements lead me (among others) to believe that you think that one or more of the authors are not trustworthy and have tampered with the code to insert trap doors. His remarks on your statements being near-defamatory hit mighty close to home for this on-looker. I'm sure I'm not alone.

1 0

Re: Sex & Crime TV filter
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

Wow! I think Ted just hit on something that could be used to quickly derail the "V-chip": At 4:02 PM 7/31/95, Thaddeus J. Beier wrote: >The chip that interprets the content does it solely based on the rating >information. This is the so-called "v-chip" (v for violence, I think, >not for video) that you see in the press. ... >qualifications of most people. Besides, what I would really >like to filter out, what I find to be incredibly violent to the >minds of children, is commercial advertising. Private rating >services could take care of these, easily, as well. I agree, of course, about it not being the role of government/FCC/etc. to mandate such ratings, such chips, etc. However, to help derail this V-chip being mandated, what if we (I mean activists, writers of columns, etc.) "insisted" that _commercials_ be similarly labelled? "Yes, if violence and sex is to be "voluntarily rated," we think that commercial advertising ought to be similarly rated." It might be hard for the legislators to avoid the logic of this. Advertisers, fearing people would of course mute the commercials, would then quietly urge them to drop the whole idea. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Re: Zimmermann legal fund
by nsb＠nsb.fv.com 17 Dec '03

17 Dec '03

At 12:20 PM 8/1/95 +0800, Enzo Michelangeli wrote: >Now, my main objection to opening a US account is that it's unclear >whether or not, for simply receiving payments there, a non-resident and >non-citizen account holder like myself incurs in any tax liability with >Uncle Sam's Inland Revenue. Can anybody on this list shed light on the >issue? Last time I checked, the guys at FV weren't sure either. The real question isn't based on your bank account, but on whether or not Uncle Sam thinks you are "doing business in" the US. This is the fundamentally thorny question that is raised by cyberspace businesses. Having payments made to a US bank account may make it more likely that the US will decide that you are doing so, but they could decide it anyway just because you have buyers in the US, or because you're using a US-based payment server. The laws are, to say the least, not clear on such points. As a practical matter, however, it is true that using a US account will make it easier for Uncle Sam to tax you if it decides that's appropriate. -- NB

1 0

Software Glitch FYI
by lindat＠iquest.net 17 Dec '03

17 Dec '03

A Congressman's aid called me today to explain that if you send email to all the Congressmen's offices at one time, the software at their end causes each Congressman to receive 50 copies. Please be sure everyone is aware of this glitch. To prevent 50 copies from being sent to each Congressman, it is necessary to break the mailing list into 5-10 addresses at a time. Every list I've ever received of Congressional Emails has annoying spaces and formats, so my list doesn't have that. It can be copied directly into a nickname box in Eudora or to a Bcc: list on a message. senator(a)boxer.senate.gov senator_brown(a)brown.senate.gov, sen_dodd(a)dodd.senate.gov, senator_lieberman(a)lieberman.senate.gov, joe_biden(a)biden.senate.gov, senator_coverdell(a)coverdell.senate.gov, tom_harkin(a)harkin.senate.gov, chuck_grassley(a)grassley.senate.gov, larry_craig(a)craig.senate.gov, dirk_kempthorne(a)kempthorne.senate.gov, senator(a)simon.senate.gov, senator(a)moseley-braun.senate.gov, wendell_ford(a)ford.senate.gov, senator(a)breaux.senate.gov, senator(a)johnston.senate.gov, senator(a)kennedy.senate.gov, john_kerry(a)kerry.senate.gov, senator(a)mikulski.senate.gov, senator(a)levin.senate.gov, mail_grams(a)grams.senate.gov, senator(a)wellstone.senate.gov, john_ashcroft(a)ashcroft.senate.gov, max(a)baucus.senate.gov, conrad_burns(a)burns.senate.gov, bob(a)kerrey.senate.gov, mailbox(a)gregg.senate.gov, opinion(a)smith.senate.gov, senator(a)bradley.senate.gov, senator_Bingaman(a)bingaman.senate.gov, senator_domenici(a)domenici.senate.gov, senator_reid(a)reid.senate.gov, senator_dewine(a)dewine.senate.gov, nickles(a)rpc.senate.gov, lugar(a)iquest.net senator_chafee(a)chafee.senate.gov, senator(a)hollings.senate.gov, tom_daschle(a)daschle.senate.gov, larry_pressler(a)pressler.senate.gov, senator_frist(a)frist.senate.gov, senator(a)hutchison.senate.gov, senator_robb(a)robb.senate.gov, senator(a)warner.senate.gov, senator_leahy(a)leahy.senate.gov, vermont(a)jeffords.senate.gov, senator_Gorton(a)gorton.senate.gov, russell_feingold(a)feingold.senate.gov, senator(a)rockefeller.senate.gov, everett(a)hr.house.gov, budmail(a)hr.house.gov, sbachus(a)hr.house.gov, jdickey(a)hr.house.gov, edpastor(a)hr.house.gov, dcaucus(a)hr.house.gov, woolsey(a)hr.house.gov, gmiller(a)hr.house.gov, sfnancy(a)hr.house.gov, talk2tom(a)hr.house.gov, petemail(a)hr.house.gov, annagram(a)hr.house.gov, tellnorm(a)hr.house.gov, zoegram(a)hr.house.gov, samfarr(a)hr.house.gov, george(a)hr.house.gov, andrea22(a)hr.house.gov, tellbuck(a)hr.house.gov, jharman(a)hr.house.gov, tucker96(a)hr.house.gov, housesst(a)hr.house.gov, rpackard(a)hr.house.gov, skaggs(a)hr.house.gov, schaefer(a)hr.house.gov, bozrah(a)hr.house.gov, cshays(a)hr.house.gov, delaware(a)hr.house.gov, kthurman(a)hr.house.gov, cstearns(a)hr.house.gov, canady(a)hr.house.gov, pdeutsch(a)hr.house.gov, hastings(a)hr.house.gov, jlinder(a)hr.house.gov, georgia6(a)hr.house.gov, saxby(a)hr.house.gov, ga10(a)hr.house.gov, runderwo(a)hr.house.gov, brush(a)hr.house.gov, luisg(a)hr.house.gov, hfawell(a)hr.house.gov, dhastert(a)hr.house.gov, durbin(a)hr.house.gov, johnhost(a)hr.house.gov, emailpat(a)hr.house.gov, edky01(a)hr.house.gov, mward2(a)hr.house.gov, bunning4(a)hr.house.gov, torkma06(a)hr.house.gov, jmoakley(a)hr.house.gov, cardin(a)hr.house.gov, tellhoek(a)hr.house.gov, congehlr(a)hr.house.gov, davecamp(a)hr.house.gov, repsmith(a)hr.house.gov, chrysler(a)hr.house.gov, lrivers(a)hr.house.gov, jconyers(a)hr.house.gov, gil(a)hr.house.gov, dminge(a)hr.house.gov, mn03(a)hr.house.gov, vento(a)hr.house.gov, tellbill(a)hr.house.gov, tocollin(a)hr.house.gov, oberstar(a)hr.house.gov, goldsmit(a)iquest.net talentmo(a)hr.house.gov, demldr(a)hr.house.gov, bemerson(a)hr.house.gov, bthompson(a)hr.house.gov, funnc02(a)hr.house.gov, thechief(a)hr.house.gov, mail2nc5(a)hr.house.gov, crose(a)hr.house.gov, myrick(a)hr.house.gov, chtaylor(a)hr.house.gov, melmail(a)hr.house.gov, epomeroy(a)hr.house.gov, zeliff(a)hr.house.gov, franksnj(a)hr.house.gov, dzimmer(a)hr.house.gov, mpforbes(a)hr.house.gov, lazio(a)hr.house.gov, tmanton(a)hr.house.gov, molinari(a)hr.house.gov, rangel(a)hr.house.gov, jserrano(a)hr.house.gov, engeline(a)hr.house.gov, boehlert(a)hr.house.gov, bpaxon(a)hr.house.gov, portmail(a)hr.house.gov, hokemail(a)hr.house.gov, istook(a)hr.house.gov, furseor1(a)hr.house.gov, pdefazio(a)hr.house.gov, murtha(a)hr.house.gov, jonfox(a)hr.house.gov, mchale(a)hr.house.gov, pa16(a)hr.house.gov, jspratt(a)hr.house.gov, cwilson(a)hr.house.gov, samtx03(a)hr.house.gov, barton06(a)hr.house.gov, doggett(a)hr.house.gov, frost(a)hr.house.gov, ggreen(a)hr.house.gov, enidutah(a)hr.house.gov, ortonut3(a)hr.house.gov, opickett(a)hr.house.gov, talk2bob(a)hr.house.gov, ninthnet(a)hr.house.gov, bsanders(a)igc.apc.org, repwhite(a)hr.house.gov, asklinda(a)hr.house.gov, dunnwa08(a)hr.house.gov, rtate(a)hr.house.gov, mneumann(a)hr.house.gov, badger02(a)hr.house.gov, roth08(a)hr.house.gov, commerce(a)hr.house.gov, slabmgnt(a)hr.house.gov, resource(a)hr.house.gov, housesst(a)hr.house.gov, smbizcom(a)hr.house.gov ============================================ Dr. Linda D. Thompson American Justice Federation 3850 S. Emerson Avenue, Suite E, Indianapolis, IN 46203 Telephone: (317) 780-5203 AEN News BBS: (317) 780-5211 Fax: (317) 780-5209 Orders (Visa/MC) 1-800-749-9939 Internet: lindat(a)iquest.net *******************************************************************************

2 1

Re: commerical busters
by WOOD＠VAX2.ROCKHURST.EDU 17 Dec '03

17 Dec '03

ON: 31-JUL-1995 20:14:46.10, dan(a)netmarket.com wrote: > At 8:50 PM 07/31/95, Patrick May wrote: > > > My dim memories from a project I did for Sony a couple of years > >ago are that commercials are separated by a fixed number of black > >frames and some, at least, have tracking information encoded so that > >advertisers can monitor how often they are played. I'll try to dig up > >more info. > > From: dfitzpat(a)interserv.com > Wednesday July 26, 1995 -- ShopTalk > > - -- > > NEW VCRs TAKE ON COMMERCIALS POINT-BLANK > > By Jonathan Takiff > Philadelphia Daily News Staff Writer > > > Already besieged by Washington politicians over the content of TV > programming (and threats of a show-blocking chip), television > broadcasters are about to be hit with another whammy. This time it's > VCRs that automatically blank out commercials. > > <snip> > > $$$$ $$$$$ $$$$ > -----BEGIN PGP SIGNATURE----- > Version: 2.6.2 > > iQCVAwUBMB193KZKaCr9f/gtAQFa5AP/ZEmtSM/hSXb6zcFHDmv9Me0thtAqqCxZ > 7COYgWxuLkl78+y/INpFKW861mrNig1UlO8Q+vDImKK3qUmTS1tzRWNIH9XVyYtA > pJ05g/Z/WKUPx17jd2no9oRqut4bziLa4iMj59B/4nxAhIjEtE5TZFP6okCQ1HGm > qbFhOteJavc= > =Opny > -----END PGP SIGNATURE----- > dan Hello all, I have thought about this before, as usual my ideas are not new. My vision was like this. 1. Develop a few methods to recognize commercials through cable T.V. a. The blank spaces between broadcasting? b. Analysis of image information? c. Analysis of sound information? d. Understanding cable T.V. protocols? e. etc? 2. My commerical buster would work on a delay. a. The broadcast information would enter a queue. b. The broadcast information would be evaulated. c. If all of the tests for commericals passed, display. d. If any of the tests fail, the T.V. goes blue, and my CD player is served. e. The time of delay is dependent on the time to analyze the broadcast information. I wish it could happen, I hate commericals. Many Thanks, ------------------------------------------- | "Computers are boring and slow." | | | | David Wood | | Information Systems Specialist? | | wood(a)vax2.rockhurst.edu | -------------------------------------------

2 1

Re: U.S. Banks are not all that bad
by cman＠communities.com 17 Dec '03

17 Dec '03

As near as I can tell, there are spotty instances of the behavior Lucky describes, but it is becoming more common, especially wrt required ID. I must say that I've had some absolutely amazingly bad experiences with banks in Asia, Mexico and Central America, so I'm a skeptic when it comes to assuming that non-US banks are light years better. Although I have no direct experience of European banking, I do know that the European banking industry, taken as a whole, is substantially behind the US banking industry in automation and efficiency. Most of the irritation that I hear reported about US banks is the result of pushing customers too hard to change expensive banking habits or erecting policies that eliminate money-losing practices without regard to their impact on customer goodwill. At First Interstate recently, I had to make a withdrawal from the teller, as the ATM was broken. Their policy _does_ reqiure a "counter check", and normally they charge, but when I explained that the ATM was kaput they did it for free. It is _much_ cheaper for them if you use the ATM, and this kind of policy is designed to encourage you to do this. It's the kind of thing that the market will sort out nicely -- if it irritates people and loses them money more than it saves them money, they will stop doing it. Remember, the US has an absolutely fantastic amount of competition wrt banking services, especially when compared to other countries.

2 1