December 2003 - cypherpunks-legacy

Re: a hole in PGP
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> This is where you are very wrong. I am not saying that "if you can't > find any holes it must be secure". What I am saying is that the > source is available, and thousands of people have looked at the > source, and none of them have found any holes in it. It is definitely much more difficult to implant a backdoor into a program which is available as source code than into a black box. BTW: Has anyone ever found a modified and weakened version of pgp ? Hadmut

1 0

There's a hole in your crypto, dear Eliza dear Eliza...
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Alright, here's my 2 cents worth for this petty flamewar... Once upon a time, there was PGP 2.3. MIT had nothing to do with it. The population of the net that used the program was fairly small. In addition to being small, they were all (mostly) computer literate people. These people were confident in the security of PGP because the had read and understood the source code. It was checked and declared good. Then, in stepped MIT. I, and a few others, raised concerns about a possible conflict of interest with MIT distributing the code, and encouraged everyone to double check the code for back doors and other NSA nasties. It was checked and declared good. Now, we are in the present. MIT is still part of the equation. However, the demographics of the net have chaged. Fewer people are here that (by percentage) are computer literate to the level to do source code investigations. A few question why they shoudl trust PGP when they don't know it's secure. We, those who have grown up with PGP, point out that it is good, yet that really isn't a great reason to trust it. So the question is, why shoudl non-technical people believe that PGP is good? They don't have the skills to check it for themselves, and you have to admit that the associations of MIT with various TLAs are at the very least concerning. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMB2F0DokqlyVGmCFAQGhpgP9EIaGx3cHG78pFic0poPsgI/Yo1UNn6SY gRG9kfx3M1XzWITND5m2ywUx1B9n48hGoPfgP9ISvGoXDd5/yHgsY6uEjzZCGaLU tXzace1PvdjL5htH9prvh5GMoghCi34B9cDh01d1U2hKXEypj1pTRA+z+xWUfnGT teMJ9uEaOu0= =2aWA -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.0 GED/J d-- s:++>: a-- C++(++++) ULU++ P+! L++ E---- W+(-) N++++ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G++++>$ e++ h r-- y++** ------END GEEK CODE BLOCK------

3 2

Re: Set phone permit "wire" taps
by Rich Salz 17 Dec '03

17 Dec '03

Sorry to keep cluttering up the list. I'll try to make this my last message in this thread. You did not answer my request. Of course you're under no obligation to do so, but a claim like the following: >I've been arrested too amy times, an done enough local, state, and >federal time to know. Is just too hard to accept without verification. Please tell me, if not the whole list, where and when you've been incarcerated -- preferably at the federal level -- so that I can, say, call the warden and verify. >Now SHOW ME something. Sure, what? If you have more questions after looking at my homepage http://www.osf.org/~rsalz/ let me know. Or for more fun, here's my SSN: 314-15-9265. >You sure question a lotta credentials, >like you've REALLY been somewhere or done something. I don't see how these two parts relate, but I've never done anything cool like you might be thinking of. In my professional life I'm primarily a programmer who's written lots of code, and been able to give away some of it. I just think you're a fake. >Love Always, Kisses to you too, but I'm still waiting for an answer. /r$

1 0

pkzip cracking
by an264373＠anon.penet.fi 17 Dec '03

17 Dec '03

Does anyone have a utility to crack password encrypted/protected zip files? Or an address to download one? All replies / flames / pointers appreciated. Sauroth ---------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. If you reply to this message, your message WILL be *automatically* anonymized and you are allocated an anon id. Read the help file to prevent this. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Info
by Mabidex1 17 Dec '03

17 Dec '03

Hey guys, I know next to nothing on this sort of stuff, but I do have a friend that works at the phone company...I'm REALLY interested in learning the ins and outs of the trade... have any Ideas where I can start? what files I should read, etc... I would appreciate your help... Mabidex 102415.404(a)Compuserve.com

1 0

Re: Sex & Crime TV filter
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> >However, to help derail this V-chip being mandated, what if we (I mean > >activists, writers of columns, etc.) "insisted" that _commercials_ be > >similarly labelled? > > I love it. Great idea, Tim! Someone in Germany developed a device which stops the VTR while they are showing the commercials, but it isn't available yet. Hadmut

1 0

Re: ssh protocol
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Matt Ghio wrote (on cypherpunks): >I've been playing with the cryptotcp program available from utopia.. It >has some bugs but works pretty well, if you don't mind waiting 20-30 >seconds at the beginning. It does a Diffie-Hellman exchange and 3DES over >telnet. How hard would it be to add some sort of authentication to this >program? I haven't actually compiled the code (it's not very DOS-friendly), but it looks easily modified; some parts of the problem are still hard, such as identifying the client to the server. Some issues to deal with for adding authentication: 0) RSAREF2.0 would have been nice, and comes with D-H and DES. 1) The option negotiation is simple but hard-coded; it would be easy to add one thing at a time, but would benefit from a more flexible option-negotiator. That would also let you pretend it was just a general-purpose telnet-with- various-processors and avoid ITAR restrictions for the authentication-plus-compression bones version, but the authors, not being Yankees, don't have to worry about that. 2) Authentication means that some process on each machine is willing to make a digital signature using a private key - how do you store that key safely? For a client operated by a human, that's not a big problem; for a server, or a client operated by a program without a direct user-interface, it's harder. Do you just leave the key in a file (trusting root?) Do you only start the server daemon by hand? For most Unix applications, I suppose a root-read-only file containing the key is OK, since if a cracker can read that file you've got far more serious problems (and the cracker can take over your email anyway.) 3) One big difficulty in authentication systems is securely but conveniently exchanging authentication parameters; you don't want to risk man-in-the-middle by trusting keys you got from the other side (otherwise you could use plain D-H), but getting keys from a keyserver is slow and hard to integrate, and requiring the other side to already have your key parameters limits your usefulness. 3A) How do you know who you're talking to so you know which authentication data to use? For the client, that's pretty easy - the client knows it's calling server(a)foo.bar.edu, so it can get the keys in advance and not worry. (It still needs the PGP web-of-trust or X.509 hierarchy to validate the keys.) But how does the server know who the client is? IP address? What if it's spoofed? What if it does a DNS lookup, which gets spoofed? You could use a password-file equivalent, but that does mean you can only send mail to people who trust you? 3B) How do you do error recovery in PGP, i.e. you either can't find the other side's keys, or can find them but can't validate them because you don't have a web of trust that gets from you to them. Do you just fail the call? (That's secure but boring.) If you complete the call anyway, that means there's a major security risk, which is that Bad Guys can spoof keys by sending you keys you can't validate. 3C) If you use X.509 hierarchical certification, you _can_ just hand across the certificate instead of waiting for a PGP keyserver to respond, since the web of trust is built-in if you're part of the same hierarchy, but there's still the problem (for the server) of knowing whose certificate to use. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- # Crypto in 3-4 lines of perl --> http://dcs.ex.ac.uk/~aba/

1 0

Currency risk on bank accounts (Was: Zimmermann legal fund)
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>> > > The US banking industry has gone to the dogs. The day a non-US bank offers >> > > an account that can be accessed over the net will be the day I close my US >> > > accounts. Some of the Channel Island banks offer accounts with ATM cards; I think some of them are in Jersey (you don't have to remind people you didn't say _New_ Jersey :-) >I open an account with U.S. $$ in a foreign bank who uses francs ... a month >later the franc loses 20 % of it's value as compared to the U.S. dollar. Happens to me all the time - I deposit my money in a dollar-based account, the dollar takes a dive relative to the Yen, so my account's worth 20% less in new Japanese cars... Most of the banks in major European banking centers and other banking-haven countries will let you have accounts in your choice of major currencies, and a number of the smaller countries have local currencies that keep parity with the US dollar or British pound. That means your account really has X US dollars in it, not X-US-dollars-converted-to-francs-on-deposit, or maybe X Bahamian dollars which are officially worth X US dollars but may be harder to withdraw quickly. There is still some risk that (for example) the Bahamas government may decide to default on its foreign debt by suddenly declaring the Bahamas dollar to no longer match US dollars, but you can only get away with that sort of thing once, so it's a desperation move, the kind of thing you do just before or after the revolution. You're more at risk from small private banks that are offering high rates of interest on foreign deposits because they're ripping off their depositors, e.g. BCCI or Nugan Hand, but that's more risk in the Caribbean than Europe (where the big risk is that they're paying you less interest than you might get in the US, or where the local tax on bank-interest may be higher than your US tax rate.) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- # Crypto in 3-4 lines of perl --> http://dcs.ex.ac.uk/~aba/

2 1

Re: punk's not dead!
by Andrew.Spring＠ping.be 17 Dec '03

17 Dec '03

>hello? i'am new on this stuff, help me! Sorry, this a mailing list for Country & Western music. -- Thank you VERY much! You'll be getting a Handsome Simulfax Copy of your OWN words in the mail soon (and My Reply). <Andrew.Spring(a)ping.be> PGP Print: 0529 C9AF 613E 9E49 378E 54CD E232 DF96 Thank you for question, exit left to Funway.

1 0

QIK_san
by John Young 17 Dec '03

17 Dec '03

8-1-95. W$Japer: "Your Home Computer Will Soon Be Your Banker and Broker." The first on-line banking transaction will be a historic moment not unlike the first automobile sale or the first commercial airline flight. It will signal a commercially viable use of a new technology that may ultimately eliminate what until now we have considered the retail aspects of banking, stock brokerage and more. The implications are profound. The promise is electronic access to all financial transactions at substantially lower cost. One's personal computer can, in essence, become an in-home bank branch, brokerage outlet and financial planner. For example, with Intuit's software and with its union with American Express, Smith Barney and 17 large banks, consumers will be able use one link for the first time to access traditional banking, credit- and charge-card services, brokerage services, financial planning and more. The effect on the banking and brokerage business and their employees is going to be profound. The retail sales forces of banks and brokerage houses may shrink substantially, as may the ranks of financial planners. The number of bank and brokerage buildings may also shrink. QIK_san

1 0