December 2003 - cypherpunks-legacy

Comments on Key Capture Survey
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

I am the author of the Last Resort keystroke capture program for the Macintosh, published by Working Software, Inc.. I am writing up the surveys for LR for Mac, DOS and Windows and will send them shortly. I have a couple of comments, which the list might be interested in hearing. Your entries for the Macintosh should record the file type and creator code, which are, for Last Resort, 'cdev' and 'mIKE' respectively (case is significant). If someone were to write an automated scanner meant to protect a disk against such utilities, it would be much more reliable if it looked for the creator codes, as Mac programs are usually written to not depend on having a particular file name. These codes live in the file system, but are not part of the name space as '.EXE' would be on DOS. You can view them with ResEdit's "Get File/Folder Info" item from the File menu. We spent a lot of time pondering the problem of password theft. We decided that the benefit to the consumer of having this utility available to save data outweighed the obvious danger of password and text theft. The problem increases, though, if one is not aware that Last Resort is installed. The Read Me file on the distribution disks has a discussion of this problem (as well as the problem of people snarfing your files when you share your disk to the whole company or campus), and there is a way to disable key capture temporarily, for password entry. I'm not real happy with the ease one can sneak Last Resort onto someone's machine, but I take a little ironic solace in knowing that similar programs that are "more hidden" than LR are available in source code form from Phrack, at least for DOS. On the plus side, I have gotten many, many letters, e-mails and phone calls from people who say it saved their butts when a piece of critical information would have been lost. I had the habit of taking customer orders over the phone while in the middle of debugging a program (like Last Resort!) and would frequently crash before the order could be saved or printed. LR saved my company real money in this case. David Pogue's book _Hard Drive_ is based in part on Last Resort, in that a key capture utility is used to recover a password that saves the world. I was quite tickled by this. I'm sad to say, though, that I know of one case in which Last Resort precipitated the end of a relationship, in which a fellow discovered the love letters his girlfriend had e-mailed to someone else in his Last Resort files. This particular fellow was glad that he found out about it, but I still feel a twinge of guilt when I think about it. I certainly support any effort made to document the existence of these programs. I might suggest that one way to defend against them would be to watch for the patching of certain system calls - patching GetNextEvent or installing a jGNEFilter on the Mac, and warning the user if this happens. It's easy to detect such patching; for the most part it will be innocent, but a hacker who had a fair amount of Mac programming knowledge could make a keystroke capture program in an evening of work, so attempting to catalog them all will provide only moderate protection against them. BTW... most of those other commercial keystroke capture programs (no names here) are clones of Last Resort. Some of them even had the gall to use our logo in their advertising (in a claim they were better than us). LR might not do as much as some of them, but I know that it is more reliable than the competitors I have tested. So if you are going to actually _use_ a key capture program for your own (legitimate!) use, consider getting The Real Thing, the One True Key Capture Program, the Saviour of Data: Last Resort. I don't work for WSI any more, but we remain friends, and they can be reached at: Working Software, Inc. PO Box 1844 Santa Cruz, CA 95061-1844 (408) 423-5696 (800) 229-9675 (408) 423-5699 FAX working(a)scruznet.com 76004.2072(a)compuserve.com Cheers, Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

1 0

EFF PGP Workshop
by Connie Sadler 17 Dec '03

17 Dec '03

Sure would be nice to have a PGP workshop in the Bay Area - any EFF members or others willing? Connie

1 0

Re: Anonymous payment scheme
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Brian Lane <blane(a)seanet.com> > I don't see why a debit card couldn't be anonymous, even to the point > of having no name, AND no picture on it. Yes, the bank has the money, but > their only obligation is to dish it out to the vendors/ATMs that you have > used your card with. Why should a bank care who you are once they have > your money in the account. Again, it is unclear here whether you are proposing that you would be anonymous to the bank or just have a blank card. As I wrote, banks are required to get SS#'s for depositers right now, and I wouldn't expect that to change any time soon. If anything, the trend appears to be towards more tightening rather than less. Duncan and/or Sandy have suggested giving a fake SS# when you open your secured account; maybe that would be legal but it sounds questionable to me. > As to avoiding fraud with the card, is it really that huge of a > problem? As long as noone copies the number(could go so far as no > embossed number. Just a gloss black card with a hologram of a Bald Eagle > on the front of it), and you don't lose the card how can someone use your > account? I used my VISA yesterday, and after swiping it through the now-ubiquitous card readers the vendor was required by the machine to manually enter the last four digits on the card. He complained that this was something new and was happening very frequently now (maybe a change with 1995?). I have heard of fraud where people make fake VISA cards (or steal them) and re-program the mag stripe to have a different number than what is on the front. Maybe this is a countermeasure for that. It doesn't sound like a blank card is the direction the industry is going. Does anyone have more info on this change? Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLwmNFBnMLJtOy9MBAQF4gAH7BgHuNzraGdAujkbnStXf9knBUYCKiJZv zodiYtbEFAKuuPUIT/aqyM1L7IPRbMuNMSW9hmel3k11g9ATHy+doA== =n71e -----END PGP SIGNATURE-----

3 2

Press attack on anonymity.
by James A. Donald 17 Dec '03

17 Dec '03

Yesterday an "opinion" article appeared in the SF Chronicle, written by some unimportant person who knew absolutely nothing about the internet. Today a similar, but better informed article, appeared in many newspapers, originating from the New York Times. Articles written for newspapers are written to survive arbitrary truncation, hence key points first, lesser points later. The interesting thing is that the two articles, despite different authors, had equivalent key points, implying that some single higher authority gave out a list of points to be made, but left the headline and overall spin to the columnist. Indeed, when one reads beyond the key points that were equivalent in both articles, it is as if one suddenly encounters a different journalist. There is an abrupt change of tone and style when one reads from the uniform part to lesser points. The key points in both articles are that the government should do something coercive to stop anonymity on the internet, and that there is widespread support for such a move. Note that since both articles are obviously tentacles, there is a mysterious and anonymous powerful person -- the single higher authority of which I spoke earlier -- who is anonymously attacking anonymity. In my opinion when a mysterious anonymous and powerful voice proclaims that the government should coerce someone, it is usually the government speaking -- a government department with guns is running up a trial balloon. --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we James A. Donald are. True law derives from this right, not from the arbitrary power of the omnipotent state. jamesd(a)netcom.com

2 1

NYT on MEMS
by John Young 17 Dec '03

17 Dec '03

Malcolm Browne has longish article today on MEMS and current mathematical and engineering research on their use to control turbulence -- in planes, ships, submarines, blood, water, flatulence. For email copy send blank message with subject: MEM_tug

1 0

Re: Phil's Plight
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> I think Phil deserves better than the > silence his plight has received as of late. True. But would it be good or bad help if something other than silence came from outside the USA? I mean if the rest of the world says they love him, the attorney will say "yes, of course. Therefore he gets sued." :-( Hadmut

1 0

Re: GUI: PGP vs novices
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <ab1c939b040210039926(a)[192.187.167.52]>, Dave Del Torto <ddt(a)lsd.com> wrote: >The Cypherpunks should really launch a new list oriented toward novices >with basic questions. It could be a Web page with a question form, or even >an email address for the Web-challenged (I may do it, but I welcome any >offers to help). As an incentive to Cypherpunks, their friends and >colleagues and members of the general public, I'm hereby offering to spend >some time answering questions for novice users at either: > > <crypto-questions(a)lsd.com> or > <pgp-questions(a)lsd.com>. I attempted to set something like this up about 7 months ago. I got so little interest that I never set up the mailing list. Better than a single person's address, I'd suggest a pgp-help mailing list for all interested folks, just as the flexfax list works for flexfax users and commercial products have their own lists. I just set up a list on pgp-help(a)hks.net, and I'll place pgp-questions(a)lsd.com on the list (assuming you won't object). Anybody else who's interested, send me mail at pgp-help-request(a)hks.net. I don't have the list of folks who volunteered last time, so this'll be fresh. - - -- Todd Masco | "'When _I_ use a word,' Humpty-Dumpty said, in a rather cactus(a)hks.net | scornful tone, 'it means just what I choose it to mean - cactus(a)bb.com | neither more nor less.'" - Lewis Carroll - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLwlY4hNhgovrPB7dAQEBvQQA1vxwGcYZ28qlytX3jrY95WN/L11X1FG2 MGwWjjk8BZ2cXk1uvLWtuhoNGwzqhup/aGLVGuPo2QjFPiqwjoA5pa+9+8093dpl tBMziDmJ5/Pg3jWirRiuuREa5Ki977I/uplp3Ysh0ioz07Ws44susZrcdDHbIChL TYKrC1DROi4= =GbTI - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLwmT2yoZzwIn1bdtAQFvxwGAgkaHPEh2A7NuPXJgtNBNqV4j9KrnLbex az8jQmFpTfBaAbLPfP5i7tdVPjJ21xom =yR+4 -----END PGP SIGNATURE-----

1 0

Re: Why I have a 512 bit PGP key
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> A compiler can recognize one specific piece of code or a few > specific peices of code and do something perverse. It cannot > recognize functionally equivalent code, this > being a high order artificial intelligence problem. It's enough to recognize DES tables or PGP procedures. Hadmut

2 1

Re: Siegel and Lewis
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

> >Peter also did little to interview anyone with substantial standing in >the internet community about what C&S were doing -- a quote or two >from an old net hand like a Gene Spafford or someone of that ilk might >have been valuable. As it was, he didn't produce much to counter the >viewpoint that they were the victims rather than the victimizers. Geez, thanks. He quoted me in an article on the C&S problem long ago. I had a legitimate beef because my service provider dutifully kept many empty newsgroups around just in case someone discovered them. C&S did and I literally spent 2 hours unsubscribing from all of them. I seem to remember that he quoted me as being really inconvenienced, which is pretty much what happened to everyone else. > >I think it is only because the "paper of record" published articles >that made them look like their point of view had any merit at all that >they managed to survive this long. As it is, the Tennessee Bar is >looking in to whether they have committed any new ethical >violations. I'd say, of course, that they had... You are correct, though, about this. They seem to draw much more unsuspicious attention then a pair of disbarred attornies should get. Of course, all attornies deserve caution and suspicion. > >Perry

1 0

Re: Why I have a 512 bit PGP key
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> While it's likely that a sysadmin could hack the kernel to substitute > bogus MD5 hashes, doing so in certain environments could earn the sysadmin a > quick exit from employment. If it wasn't the reason he was employed for. In Germany it is not allowed to spy out someone elses phone calls. (Is it in the USA?) But some cases got public where employees of several companys got their phones tapped. It was done to find out whether they do private phone calls or what they say in private phone calls. Hadmut

1 0