December 2003 - cypherpunks-legacy

Re: Netscape security
by Rich Salz 17 Dec '03

17 Dec '03

> There is no word as to how to become a KSA. Netscpe has >ignored the question on several occaisons. I'm fairly sure that I remember Taher saying at the W3C security meeting that they intend to do this, and that hardcoding the CA's into the library was as quick hack. I also have the impression that they don't know how to do it, but my recollection is fuzzier there. /r$

1 0

PGP encryption for HTML forms
by Dorab Patel 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've developed a simple protocol for encrypting the submission of HTML forms using PGP. I've written up the protocol in an "Internet Draft". We are distributing two reference implementations (with sources --- copyrighted, but freely redistributable). One is a modification to lynx sources to handle this protocol natively. The other is a "helper application" (by Jun Hamano) to do the encryption written in python. You can get the package via anon ftp. ftp://ftp.cs.ucla.edu/pub/sitp.tar.gz Comments welcome. Snarf it before it becomes illegal! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.2, an Emacs/PGP interface iQCVAwUBMDTTYGnoQvE1ROndAQE5dQP/SWII7eR/eFYWsdU6mOilLZautmtS1rb9 kRcifS02p7WS3N3sY+MRu20uuPmuL+f+5rriYWJWVgd//s3jgegs8HGqmRuxVQdL qMFRmtMB5oUfYkLmTiDebHsksr2YLF+AB8vrBCgXIbgKAcSRF4OStRyXBUeXfZ/3 gp9MiACvXV4= =PxCp -----END PGP SIGNATURE-----

1 0

DCSB: Duncan Frissell and MarketEarth
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: rah(a)mail.shipwright.com Mime-Version: 1.0 Date: Mon, 28 Jul 1997 07:36:46 -0400 To: dcsb(a)ai.mit.edu, dcsb-announce(a)ai.mit.edu From: Robert Hettinga <rah(a)shipwright.com> Subject: DCSB: Duncan Frissell and MarketEarth Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Robert Hettinga <rah(a)shipwright.com> -----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston Presents Mr. Duncan Frissell, Frissell Associates "Markets Rule! OK Bet on MarketEarth -- Bet Against Bureaucracy" Tuesday, August 5, 1997 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Mr. Frissell, the Net's most enthusiastic Technoptimist will answer such questions as: Why did Central Planning, Deutsche Telecom, and X.25 lose and the Market, telecoms competition, and TCP/IP win? Can banks compete with nonbanks? Why controlling the Nets is as hard as controlling the thoughts of other people. Why popular measures like immigration control are doomed. What do such phenomenon as the Jewish Holiday Effect, the Sack Full of Cats in the River Effect, the Canadian Air Service Effect, the Saturday Morning Shopping Trip Effect, and the Taiwanese Privatization Effect tell us about the future of government and the individual? Why things are not the same and never will be again? Why the Market is "X-The Unknown," "The Blob," -- and why even Steve McQueen couldn't save us from it? "Duncan Frissell makes Kevin Kelly sound like Jimmy Carter." -- Anonymous Mr. Frissell, an Attorney, privacy consultant, and author, has worked in what he insists on calling the "Right Wing Nut Investment Community" for more than 20 years. This meeting of the Digital Commerce Society of Boston will be held on Tuesday, August 5, 1997, from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, on One Federal Street. The price for lunch is $30.00. This price includes lunch, room rental, various A/V hardware, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men (and no sneakers or jeans), and "appropriate business attire" (whatever that means), for women. Fair warning: since we purchase these luncheons in advance, we will be unable to refund the price of your lunch if the Club finds you in violation of the dress code. We will attempt to record this meeting and put it on the web in RealAudio format at some future date We need to receive a company check, or money order, (or, if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, August 2, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston", in the amount of $30.00. If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Upcoming speakers for DCSB are: September Christof Paar Elliptic Curve Cryptography October Peter Cassidy Military Fiat and Digital Commerce November Carl Ellison Identity and Certification for Electronic Commerce We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, <mailto: rah(a)shipwright.com> . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . We look forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQEVAwUBM9yEOcUCGwxmWcHhAQHq2ggAr93eyPf+gg23sANSwkHQpzDCHUZl9UaI rXjmSA1EkDTWSEWxy90BlWexUdHa4a+rKtYU3DNpMSB5WPAzq0Et3rnqCHEkYh3D NM9cOCSkP7HOP07yISh3yFhyisqIDQR5fK3f3NBjGfDjzT8QDkaGWEOAh4O7nzuL kKdm6diPBMUePtHxGzUbqtWP239vpY3kfhu2CbdP766NxsMD2Hsq4bLaAnUk2NPy NkzS3Vv9+opl01IbJQ05MWm4E23ATSsjVJGvFnO6l0HOQ7W6NMqDKFHxS/i9WLmz vQS2sKrNHqnr7Z8eXEXk8HdmzCim7b+P0BhvEGyrbPW0xD9d+dExtg== =gSKM -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb-announce Or, to subscribe, write: subscribe dcsb-announce If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: Netscape security
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>Now, I can see calling a MasPar a "parallel supercomputer"; another effort >at the SSL challenge got the answer about 2 hours before Damien's did, >and used about 4 days of spare time on the MasPar. Last time I looked, >a MasPar was selling for about $150K, though I don't know how big the one >used on SSL was. At that price, you could have your own for ~$500/day, >and ripping off $2000 on a credit card isn't tough in today's automated world. >Next year - computer time costs half as much. Well, lets put it this way, an MP-2 with 16K processors could attack a 56 bit key about as fast as a 486 could attack a 40 bit key. The next generation MP will be less than an order of magnitude faster, although able to use more processors. An MP2 with 1K processors can do 220K crypt(3)/sec. Now, if it weren't so darned hard to program one for performance... One tends to wonder if there are analytical methods to reduce the search space.

2 1

Re: Article in Time Magazine
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>In the Time Magazine of this week there is an article about a new way >to make war. Instead of sending bombs, tanks, and soldiers, the >enemies computers and communication networks are attacked by sending >viruses and worms and by using backdoors to sabotage the infra structure. I've been getting flyers from the Armed Forces Communications Electronics Association (AFCEA) for a symposium on information warfare this fall. Parts are classified SECRET NOFORN. (SIGNAL magazine is a good source for basic articles, its the latest rage in the War Colleges)

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord ?"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"cracker"} = "<remailer(a)anon.efga.org> cpunk mix remix pgp hash esub latent cut ek reord"; $remailer{'redneck'} = '<config(a)anon.efga.org> newnym pgp'; $remailer{"bureau42"} = "<remailer(a)bureau42.ml.org> cpunk mix pgp hash latent cut ek"; $remailer{"neva"} = "<remailer(a)neva.org> cpunk pgp pgponly hash cut ksub ?"; $remailer{"lcs"} = "<mix(a)anon.lcs.mit.edu> mix"; $remailer{"medusa"} = "<medusa(a)weasel.owl.de> mix middle" $remailer{"McCain"} = "<mccain(a)notatla.demon.co.uk> mix middle"; $remailer{"valdeez"} = "<valdeez(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"arrid"} = "<arrid(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"hera"} = "<goddesshera(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"htuttle"} = "<h_tuttle(a)rigel.cyberpass.net> cpunk pgp hash latent cut post ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix reno winsock) (weasel squirrel medusa) (cracker redneck) (nym lcs) (valdeez arrid hera) The remailer list here has been out of date for some time, but should be up to date now. I'm still working on updating the web page. Last update: Mon 28 Jul 97 6:49:34 PDT remailer email address history latency uptime ----------------------------------------------------------------------- redneck config(a)anon.efga.org #*-**#*##-+ 23:42 99.99% nym config(a)nym.alias.net ######**-+## 1:09:39 99.97% htuttle h_tuttle(a)rigel.cyberpass.net #*### :42 99.96% cracker remailer(a)anon.efga.org *+ -++++++-+ 39:07 99.92% hera goddesshera(a)juno.com +----------- 4:13:46 99.92% weasel config(a)weasel.owl.de +-++++++++- 1:31:07 99.87% squirrel mix(a)squirrel.owl.de +-+++++-++- 1:30:29 99.86% arrid arrid(a)juno.com +--- *+*+++* 49:18 99.84% winsock winsock(a)rigel.cyberpass.net .-+-------+ 4:57:25 99.65% cyber alias(a)alias.cyberpass.net ***+****-++ 20:17 99.56% mix mixmaster(a)remail.obscura.com ** -* -*-++ 2:32:46 99.10% reno middleman(a)cyberpass.net .-+ + +*++ 1:57:53 97.61% replay remailer(a)replay.com * ** * 32:46 96.23% neva remailer(a)neva.org #-* + +** 39:46 93.10% jam remailer(a)cypherpunks.ca * +** 50:05 90.34% valdeez valdeez(a)juno.com *.-- +---- 4:14:27 89.14% bureau42 remailer(a)bureau42.ml.org *----- 3:34:59 28.56% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Certificates/Anonymity/Policy/True Names
by Michael Froomkin 17 Dec '03

17 Dec '03

I have a question which is of course purely hypothetical. Suppose you were designing the legal framework that would govern the operation of Certification Authorities (the people who issue certificates vouching for public keys used for digitial signatures), called CAs for short. The CAs will operate in a hierarchical model (not a PGP-web-of-trust model), with a state agency being at the root, and issuing certificates for private CAs. You have decided to allow the private CAs to issue certificates of varying degrees of corroberation so long as the degree of verification used is deducible from the certificate. E.g. a certificate might say "we check the passport"; or "we check driver's license" or "we took blood, hair, fingprint, retinal scan and first-born child". It might even say "we checked nothing". You have also decided that a CA may issue a certificate in the name of a pseudonym, so long as the CA retains information about the True Name. Now the issue arises as to whether one should allow the CA to issue certificates to pseudonyms where it has *no record* of the real identity of the person proffering the key pair. Is there any reason why a person would want such a certificate? In other words, given that the recipient of a digital signature will easily be able to check the value of the certificate (nil), won't the transaction/communication be in all ways identical to one where there was no certificate at all. So is anything of value lost by prohibiting such a certificate? I understand, of course, that in a world where the CA has no duty to check the client's representations, there is a somewhat farcical element to this debate, but this hypothetical problem involves group decision making and groups find themselves debating irrational things. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | mfroomki(a)umiami.ir.miami.edu U. Miami School of Law | P.O. Box 248087 | It's hot here. And humid. Coral Gables, FL 33124 USA | See http://www-swiss.ai.mit.edu/6095/articles/froomkin-metaphor/text.html and http://www.law.cornell.edu/jol/froomkin.htm

2 2

Complete Bulk Email Pkg only $49.95
by emailblaster＠mail-response.com 17 Dec '03

17 Dec '03

*Special Promotion* Complete Bulk Email Package only $49.95 including Unlimited Email Addresses (25 Million and Growing!!!). Our company is running this special promotion to allow you try out our software at an affordable price. We know that if you enjoy using this package that you will be our future customers. Our program ranks up with all the other bulk email software such as Floodgate, Email Magnet, Netcontact, Extractor Pro. etc at hundreds of dollars less!!! Why pay $399 just for a bulk email software, when you can pay $49.95 including email addresses??? HOW DOES E-MAIL BLASTER WORK? E-Mail Blaster has dozens of special filters to automatically harvest E-mail addresses from major online services such as: America OnLine, Compuserve,Delphi, Genie, and of course the internet and will email your marketing letter to 13k consumers per hour at the single push of a button!!! SPECIAL CLOAKING DEVICE: Email Blaster can successfully hide the origin of all email being sent out. Email Blaster can mask itself to look like it came from the recipients own host. This will help stop users from flaming your email box! FRIENDLY BULK EMAIL PROVIDER: Now you can have your account 100% Bullet Proof by taking advantage of our Bulk Email Provider Service for only $99 per month. This will also include your own website, 3 autoresponders, and your own domain name. SIMPLE TO USE: E-Mail Blaster does all the work for you and, unlike other E-mail programs, with E-Mail Blaster there is no need to purchase any additional software. NO SPECIAL EQUIPMENT NEEDED: E-Mail Blastert runs on a PC with Windows 3.xx Windows 95, Windows NT, a 386 or faster processor, 4 MB RAM, and a hard drive with at least 10 MB free and your own SLIP or PPP connetion. No other software needed. Also runs on a Macintosh with SoftWindows installed Plus.... Turn $99 into $995 Cash Instantly distributing "Email Blaster. This is the #1 business opportunity on the net! You become a distributor of Email Blaster for only $99 and you receive 5 Complete Email Blaster packages. Let's say you resell Email Blaster package at a discount of $199 each. $199 x 5 packages = $995 CASH!!! Your potential is unlimited! This price is a Special Promotion and is only available to new distributors!!! Our distributor package normally sells for $199. Take advantage of these low prices for the month of July now and reserve as many copies as you want. he more you buy the more $$$ you can make!!! Price List 5 Packages: $99 10 Packages: $149 20 Packages $299. Larger quantity discounts are available upon request. Benefits of becoming a Distributor Now: 50% Discount for the month of July No Shipping (You simply refer all your customers to our website to download their package.) No postage No inventory (We keep track of how many packages you have and how many you sold electronically.) No hassles (We have full tech support that will assist your customers for you! This is invaluable!!!) No need to worry about payment methods ( We can assist you in obtaining a method of being able to accept major credits and 900# service for billing. No credit checks or approval necessary!!!) Plus.... You will be able to distribute all future software programs and receive the best prices!!! Additional questions (No problem, call our office at: 609-933-3527 What are you waiting for start making money today SIGN UP NOW!!! ********************************************************************************************************** To take advantage of this opportunity, please fill out the order form below and fax or mail to: Internet Marketing P.O. Box 276 Bellmawr, NJ 08099 Phone: 609-933-3527 Fax: 609-933-1499 Don't miss out on this opportunity! Special Promotion!!! Name: _____________________________________________________ Address:____________________________________________________ City:___________________________________________ State:___________________________ Zip:_____________________________ Telephone::_____________________________________________ E-Mail Address:__________________________________________ Once we receive your order, you will receive a confirmation by email, informing you of our tech support number , website address so you may go and download your packages immediately and info on our Bulk Email Provider Service. No need to ever wait for a package in the mail!!! ---------------------------------------------------------------------------------------------------------------------------------- "COMPLETE EMAIL BLASTER PACKAGE" only $49.95 ________ 1 Copy of Email Blaster 1 Electronic Help System: Email Blaster Help System will provide you with step by step directions on how to use Email Blaster and help with setting up your provider. For your convience this is built right into your copy of Email Blaster. Unlimited Email Addresses: 25 Million And Growing Our Email Addresses are updated monthly. You can download these addresses right from our website at your convenience. ----------------------------------------------------------------------------------------------------------------------------------------- 5 DISTRIBUTOR PACKAGE only $99: _________ This is a Special Promotion to new distributors only!!! 5 Copies of Email Blaster 5 Electronic Help System:Email Blaster Help System will provide you with step by step directions on how to use Email Blaster and help with setting up your provider. For your convience this is built right into your copy of Email Blaster. 5 Unlimited Email Addresses: 25 Million And Growing Our Email Addresses are updated monthly. You can download these addresses right from our website at your convenience. Now you can take advantage of Email Blaster Package and resell each package up to $299. each. You make $1495 10 DISTRIBUTOR PACK only $149. _______ Includes 10 Complete Packages of Email Blaster. You can make up to $2990.00 20 DISTRIBUTOR PACK: ONLY $299 ________ Includes 20 Complete Packages of Email Blaster. You can make up to $5980.00 ************************************************************************************************* If you would like to pay by check, please make check payable to: Internet Marketing mail to: PO Box 276 Bellmawr, NJ 08099 or Fax to 1-609-933-1499 along with this order form. If you are paying with a Fax Check please include an additional $3.00 for check processing fees. Credit Card: _______________________________________________ Visa, Master Card and AMEX. EXP. Date: _____________________ Total to be charged: $________________________ Signature:___________________________________________________________ 3024

1 0

Re: SSL challenge -- broken !
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

David Neal wrote: >On 18 Aug 1995, Panzer Boy wrote: >> John Pettitt (jpp(a)software.net) wrote: >> : Huh? So you run on 120 workstations worth how much? to steal a credit >> : card number worth how much? Get real - there are hundreds of ways >> : to get credit card numbers that cost less. >> >> Has anyone thought about starting up a distributed rc4 cracking web. >> Send in your message to a web server form, it will then spawn of requests >> to a pool of machines willing to try cracking rc4 for you. Allow anyone >> to offer up spare cycles towards the effort. >> > >I suggested that very thing just yesterday in the list, but my message >seems to have gone awry. In short, I suggested we use E-Cash payments >for cracking efforts. This would establish a reward for participating >and an 'exchange rate' for e-cash at the same time. I'd we willing to set up a "crackweb" mailing list, or perhaps a site to register your machine(s) with % available and MIPS ratings. DJK

1 0

Cypherpunks' ideal escrow agent
by Childers James 17 Dec '03

17 Dec '03

I've seen the idea of voluntary key escrow discussed before on this list. (And no, not the government's idea of "voluntary", either.) A question I would raise is this: What would be the ideal setup for an escrow agency? If I were to open up an agency for business, what would be some characteristics you would look for? "Freedom is meaningless unless | ic58(a)jove.acs.unt.edu - James Childers you can give to those with whom| No man's freedom is safe you disagree." - Jefferson | while Congress is in session EA 73 53 12 4E 08 27 6C 21 64 28 51 92 0E 7C F7

2 1