December 2003 - cypherpunks-legacy

Netscape the Big Win
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

Here is my experience with the last month of heavily using Netscape (1.1N), after several years of using a mix of Unix-based tools on a Unix shell account at Netcom (and several years of using Portal before that, beginning in 1988). (And intermittent Net use from 1973, when I had a very primitive account in college at UC Santa Barbara, on the "Arpanet," to the mid-80s, when I had various accounts while still at Intel.) * I use Netscape to read News. * I use Netscape to access the Web. * I still use Eudora to send and receive Mail. (Netscape can currently send mail, but not receive it. This is likely to change soon.) Why is this important? I believe, quite strongly, that we are headed toward a situation where the large majority of Net/Web users are using some variant of Netscape, or Mosaic/MacWeb/etc. (but probably Netscape, for various reasons). Integration of crypto into Netscape is thus the Big Win. I felt this was the case as far back as last fall, but my recent experiences tell me this is more important than ever. Integration of PGP and other crypto routines into Tin, Pine, Elm, Joe, Emacs, etc., is just not as important. IBM just paid nearly $3 billion for Lotus, largely for the "common platform" of Lotus Notes. I believe Netscape is an even more important common platform, and will displace Notes. I have been asked many times by various of you about investments, as I've been making my living the past decade through investments. The message here is my strongest statement about what to invest in. (I'm not saying one has to stand in line for the August IPO of Netscape Communications, but the overall market will favor the Web browsers, especially Netscape.) The relevance for Cypherpunks interested in writing code is that, in my carefully considered opinion, writing for Netscape and other Web browsers is the Big Win. Even over Windows (except Windows browsers, of course). --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

7 6

PS/2 passwd bypassed at bootup?
by jon cameron 17 Dec '03

17 Dec '03

I know that removing the battery in a PS/2 "disengages" the password. But can it be disengaged if a person has an administration-type of diagnostic/setup/boot-up floppy?

1 0

Re: Netscape the Big Win
by cman＠communities.com 17 Dec '03

17 Dec '03

>Integration of crypto into Netscape is thus the Big Win. > This is why Amanda and I have been working on crypto tools for Java, a "safe" programming language that will be embedded in Netscape in the (hopefully) not-too-distant future. In addition to eventual incorporation in Netscape, it is currently available on Suns running Solaris 2.4 and PCs running Windows NT. See: http://www.cs.utexas.edu/users/achou/JCrypt/packages.html This is also why October is "Java month" for the cypherpunks Bay Area meeting. Marianne Mueller (mrm(a)eng.sun.com) is organizing speakers and coordinating the schedule for that month's meeting. Java will be available for Windows 95 about the time Win 95 is released, and a Mac version is due out "Real Soon Now." The Mac version has been demoed to industry insiders already. One of the obvious advantages is that it should be possible to write a nice, GUI interface once, and be done with all of the tiresome porting that seems to occupy too much of our time.

8 7

Re: Stego Standards Silly
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

LM> I think I need to clarify my threat model. I'm positing a scenario in which LM> transmission of ciphertext and stegoed anything is illegal, but transmission LM> and use of "conspicuous" digital signatures is legal. Furthermore, the govt. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Ah. No big deal then. After stegoing, you sign the GIF. LM> sanitizes the LSBs of digital images for our protection, perhaps distorting LM> a mean of X% of the LSBs of a mean of Y% of transmitted images. Out-of-stego- LM> channel checksummation would IMHO be crucial in such a situation. Sending multiple copies of the same GIF would go a long way toward solving this, if X% and Y% were low enough. Say I get 5 copies, and reconstruct the origial via a "voting" protocol. Also, if we break down the file into smaller blocks, and sign each block individually, we can narrow down the errors. But I am having a real problem with an overt policy of fiddling with people's mail. If they did that, it would likely cause a huge backlash that would be felt at the ballot box. * --- * Monster(a)FAmend.Com *

2 1

FWD:Speaker needed
by corbeau＠seanet.com 17 Dec '03

17 Dec '03

>Sender: html-authors-guild-owner(a)lists.Stanford.EDU >Status: > >Two topics to this post: > >1. I have been asked to speak at an Internet/WWW conference that will be >held in Charlotte, NC on October 23rd. Is the SC gonna jump on me for >mentioning my membership in the Guild in the bio that they will print in the >advertising flyers? <g> > >2. I have been contacted by the producer of the conference and asked to >contact the Guild for help in finding an Internet Security Guru to speak at >the conference... If interested, point of contact is: > >rstoker(a)accunet.com > > >I will be posting more info (costs, location, times, etc.) as they come to me. > >BTW: Speaking of security, I have asked a question that has gone unanswered >(possibly due to being sidetracked by flamewars & whatnot)... anyone out >there know how to set up password security on pages running off >MacHTTP/WebStar servers? Any help is appreciated! > >TIA > > -AL GORDON > ProEMail Internet Services **************************** Thot one o' y'all might fit this bill... -corbeau

1 0

Re: (Cracking) Netscape (is) the Big Win
by Andrew Roos 17 Dec '03

17 Dec '03

Peter Trei says: > This is why it's imperative for cpunks to work on the SSL challenge > recently posted. Cracking 40 bit RC4 will provide a strong industry > incentive to move towards stronger crypto standards, and to pressure > the government to relax ITAR. The SSL project is at an advanced stage. I am regression testing the third (and, I hope, final) version of the SSL bruter, while Adam and others are working on the key distribution mechanism. It is important in a project of this nature that everything be thoroughly tested before we start, so we don't waste thousands of hours of CPU time... Andrew ___________________________________________________________________________ #!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL ($k,$n)=(a)ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2% Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*' ,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2) Andrew Roos Realtime PO Box 15170 Vlaeburg 8018 Phone: +27-21-244350 Cape Town Cape Town Fax: +27-21-221507 South Africa

1 0

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by an253398＠anon.penet.fi 17 Dec '03

17 Dec '03

Ray Arachelian writes: > Hell, at this point, my guess is that the mafia(s) doesn't use crypto, or > that if it does, it can be caught via other means. A strong, well > developed crypto system in use by the mafia would more than likely never > happen... not until mobsters get into computers. Ditto for terrorists. Sounds like an untapped market segment. In which periodicals should one advertise consulting services in order to cover the mobster market? Seriously, I imagine that organized crime, like any other business, uses computers. Their level of crypto usage could be impressive, given the incentives. > If they did use crypto, I suspect they wouldn't get caught. (For the > paranoid, assuming they used crypto, and they didn't get caught, then the > FBI or other TLA is doing the same as the gov't in Farenheight 451... > pick someone else, and jail them. Otherwise, how do you explain all the > jailbird mobsters?) "There is no honor among thieves." Wiretaps, bugs, tails, informants, and good, old-fashioned, physical intimidation probably produce plenty of leads. I wasn't entirely facetious above about working for the mob, they probably pay well and don't bother with FICA and such. Plus there's that "family" atmosphere.... ---------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. If you reply to this message, your message WILL be *automatically* anonymized and you are allocated an anon id. Read the help file to prevent this. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

"Cypherpunks Write Code" as a Putdown
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 5:25 PM 7/20/95, Patrick J. LoPresti wrote: > If it is ever feasible to >do what you suggest, someone will do it; your musings will have no >effect on that. If you want to make a difference, try writing some >code yourself... I want to comment on this latest version of the "Cypherpunks write code" universal putdown. It's become common for debates on what is possible, what is likely, and what should be done for someone to "trump" the argument with the mantra of "Cypherpunks write code." In my posting on why I think Netscape and related operating environments represent the likeliest targets for widespread crypto use (the "big win" I used in my title), I did not whine that others ought to write code for me. I said that this is where users were going in massive numbers. Take it or leave it, as an analysis, but the "try writing some code" is a meaningless insult. The world is made up of bridge designers, legal experts, authors, chip designers, and on and on. Not just programmers. The line "Cypherpunks write code"--which is sometimes treated here with a reverence its origins do not support--was a reference to our view that technology, meaning actual deployment, was more important and interesting than yet more gabbing about liberty and privacy. And what is "writing code"? Is it only Perl and C? Or does defining what a remailer needs to do count as writing code? (Attendees at the first Cypherpunks meeting, almost 3 years ago, can confirm that I was the one who spend about two hours describing Chaum's mix work, and running the "remailer experiment"...we debated how a remailer could actually work, and Eric Hughes took on the task of writing the first one.) The "BlackNet" experiment I ran actually worked...the keys worked, the mechanisms worked, and the experiment has been used by many as an actual concrete illustration of how untraceable information markets will develop. An actual demonstration is worth more than mere speculation, and this was an actual demonstration. I call this "writing code," albeit not C code. (My actual code writing, in real computer languages, is oriented toward Mathematica, on my Mac, and Smalltalk Agents. Not all programming is oriented toward writing Unix tools, and I think the narrow interpretation of "Cypherpunks write code" to mean this is misleading.) In any case, even the ur-crypto hacker Zimmermann is writing very little actual code in PGP these days...does this mean he should "try writing some code" instead of doing what he apparently does best? In short, the insulting tone of many Cypherpunks these days is saddening. I plan to continue to speak my mind, to point out what I think are the more important routes to a desirable future, and to criticize what I think are dead ends and ghettoized approaches. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

8 7

Re: "Hey Phil! Stop telling people *not* to use PGP!"
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:00 PM 7/19/95 -0500, Robert A. Hayden wrote: >> I am fond of saying that we PGP enthusiasts have two choices ahead of us >> within a couple of years: either 5,000 enthusiasts using PGP with >> MAXIMAL SECURITY at all times, or 5,000 enthusiasts with MAXIMAL >> SECURITY and 10,000,000 computer-illiterate e-mail users using PGP with >> push-button interfaces and multi-user remote systems. >I said it last week, and I'll say it again. From a sociological >standpoint, it's those 10,000,000 computer-illiterate e-mail users that we >need to focus all of our efforts towards. Those 5,000 literate people we >really don't have to care about. But there are two different classes of issues here - the convenience-only issues, which can be fixed with bells and whistles and GUIs and audio-enhanced-RTFM-buttons, and the security-related issues. For security, there are three classes of users: 1 - folks with standalone systems and dial-up mail - no problem This is a _lot_ of users - AOL, Compuserve, etc. 2 - folks with single-user systems on networks - they need to make sure they've got PGP installed right (relatively easy, with local disks, but fancy install widgets may help), but beyond that they've got to know that PGP is only as secure as their machine and network configuration. Mostly ok, and to the extent it's not, they've got other serious problems. This is also a lot of users. 3 - folks with shared machines - these folks (mostly Unix users and college students, plus people who have web-space they need to telnet to, like me) do need to know their limitations, and currently have the most problems with convenience, having to haul files back to a secure machine to encrypt securely. The first step is education - manuals that say "Don't Panic Unless You Need To Be Paranoid" instead of "Panic Immediately", that can make them aware of the risks and tradeoffs. It's about two pages of well-written stuff, if someone wants to write it. The next step is either building convenient tools to help them with encryption, or building convenient installation scripts for the tools that already exist (e.g. mail, or scriptable terminal emulators which can automate a lot of the hauling around.) The big payoffs are for groups 1 and 2, but a lot of the technically savvy people who read manuals and have to convince system administrators to install stuff are in group 3. So this is basically a writing job, plus talking the PGP 3.0 people and maybe Phil into including the discussion with the manuals. Remailers, btw, are in this class, since they need to leave their passphrases out in relatively unprotected shell scripts. I used to run PGP on a diskless workstation (at least I was one of the people with the root password :-), but I was aware of the risks. I'm now using it both on my Netcom+Eudora+PrivateIdaho system and on the machine where I have web space, which I have to telnet to across Netcom. I take care of the trust problem there by using a short key with a big ugly "untrustable" string in the user name, and using S/Key to log in; if I had an encrypted telnet to run on both ends I'd probably want to use it, so I'm watching the Stel and other new stuff coming out. Bill Stewart -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: You can get PGP by anonymous ftp from ftp.ox.ac.uk iQBVAwUBMA4HvfthU5e7emAFAQFrMwH9Hh1oYQKvsuV/IyVUskv2aZbmuh8fXQgK XpSpucrJV27tlFbjIDVqmapMR77arZVOm2Hs0/NTB2uT2jDG1r5+Lw== =fRtS -----END PGP SIGNATURE----- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: Is it legal for commercial companies to use PGP?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 10:30 PM 7/19/95 -0400, tim werner wrote: >>From stewarts(a)ix.netcom.com Tue Jul 18 02:51:50 1995 >>Selling software containing the code is pretty clearly commercial. >>Non-commercial messages from your personal non-business machine are >>clearly non-commercial. Providing a service of encrypting and decrypting >>messages for people for money sounds like it's _very_ probably commercial. >>Encrypting and decrypting messages to/from your business that deal with money >>are a very gray area. > >Maybe "commercial company" is the wrong expression. All I meant was >that my company is not non-profit, or a university, or a government >organization. It is an engineering firm. What I have in mind is >nothing to do with a commercial use of encryption per se. That's what I thought you meant. >1) I have some email pen-pals that I would like to be able to use PGP to That would be fine to use PGP 2.6.2 for; there's realky no question. >2) It's entirely likely that people within the company may wish to get > into the habit of transmitting company data in encrypted form. This > is not a question of incorporating the encryption technology into a > product, or even into the sale of a product -- it's just a question > of keeping intra-company information transfers private. >The first is the one I'm really concerned with. The second would be >sort of a natural extension that, if legal, would be nice. I can't >imagine that these uses are subject to the ViaCrypt license, but I need >some reassurance/ammunition in order to be a little more open about >getting it installed on the machines in my department. The ViaCrypt license only matters if you're using ViaCrypt. The question of whether you can use PGP 2.6.2 for these is something you _do_ need to read the RSAREF license about, and maybe ask Jim Bidzos <jim(a)rsa.com> or a company lawyer-type about; encrypted mail within the company is probably ok, encrypted mail sending credit card numbers to pay for stuff is more questionable. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0