December 2003 - cypherpunks-legacy

Military Prisons for Citizen-Units
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 5:42 PM 7/28/95, Brian Davis wrote: >The military is not authorized to listen in to any phone calls they want >to hear. Otherwise, everyone on the list, including me, would probably >be in some hidden military prison. > >:-) for the humor-impaired. This is not so. The military _did_ put me in one of their hidden military prisons, but decided I would be more useful on the Cypherpunks list. I recognize several other names here from my work brigade. --Citizen-Unit Tim "The Zek" May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

NSA and the NCSA/Apache web servers
by Amir Y. Rosenblatt 17 Dec '03

17 Dec '03

I was flipping through the Apache http Server Project's web site <http://www.apache.org/> when I came across the following note: Note: We were informed by NCSA that the NSA (The US National Security Agency - yes, the folks who in 1994 said "we're only 10 years behind schedule") considered the hooks to encryption in NCSA's httpd to be in violation of the munitions export law, thereby making its distribution to foreign sites illegal. For various reasons, we decided to remove the -DPEM_AUTH code completely. This was followed by a pointer to http://www.apache.org/nopgp.html from which the following text was taken: On May 17th, 1995, we were asked by a representative of NCSA to remove any copies of NCSA httpd prior to 1.4.1 from our web site. They were mandated by the NSA to inform us that redistribution of pre-1.4.1 code violated the same laws that make distributing Phill Zimmerman's PGP package to other countries illegal. There was no encryption in NCSA's httpd, only hooks to publicly available libraries of PEM code. By the NSA's rules, even hooks to this type of application is illegal. Wow -- hooks to encryption are unexportable -- now THAT's bullshit. Sheesh. -Amir /\ Set the controls for the heart of the sun. -Pink Floyd ______/ \ ___________ __ __ _ _ _ _ . . . axon(a)neuron.net \ / \/ For PGP 2.6 key send mail with subject: SEND PGPKEY

7 9

Re: Java, Netscape, OpenDoc, and Babel
by david d `zoo' zuhn 17 Dec '03

17 Dec '03

[ Web Mall, OSF, Java, ports, etc] // See http://www.osf.org/comm/press/950276-ato.html for mroe details. Actually, try http http://www.osf.org/comm/press/950726-ato.html instead.

1 0

PS/2 passwd bypassed at bootup?
by jon cameron 17 Dec '03

17 Dec '03

I have my crummy IBM PS/2 passwd protected upon turning it on. I know that removing the battery in a PS/2 deletes the password. But can it be bypassed by an MIS-type if that person has an administration-type of diagnostic/setup/boot-up floppy? Jon C.

2 1

Re: mac share/freeware app for overwriting unused hd space?
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 2:27 PM 7/27/95, j. ercole wrote: >Can anyone point me towards a program that's freeware or shareware that >will overwrite all the unused i.e., "trashed" space on my hard drive(s)? I >sincerely apologise if this is a faq. I know norton's will do it but I >don't presently have that installed on my machine. Thanks oodles, Well, getting the commercial products (fairly cheap, for Norton) is the first line of defense if you're paranoid. Erasing a file and then filling the disk with other files (even copies of existing files) will do the same thing, albeit only once. At the most serious level of attack (the "threat model"), such as the FBI labs in Quantico or the NSA, there are reports that specialized disk drive heads are used to recover earlier signals that are not erased even with N active overwrite steps (apparently the head jitter in most drives means that each write cycle is slightly different, even on the same disk region, and a slight "shadow" or "ghost" of previous writes can sometimes be extracted). --Tim May, who hopes this will not reignite the thread about how to use thermite to permanently erase disk drives .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Re: Java, Netscape, OpenDoc, and Babel
by Rich Salz 17 Dec '03

17 Dec '03

>Just a quick note to chime in. The OSF just did a deal with Sun >to port Java to several platforms. The OSF is opening a "web mall" >where you can grab software objects and run them. Well, not quite. The "Open Mall" is part of OSF's new advanced technology offerings. Free source for non-commercial use, fetchable from the Open Mall, a Web server. You'll be able to find the mall (in a week or two) from OSF's home page, http://www.osf.org/. The Java ATO includes ports to SVR4 (dunno whose) and HP, and more importantly, a study of the security aspects and implications of Java: is it truly a "safe" language to write in? And what does safe mean, and for whom (server, client, user, hardware, etc)? The study will be a paper, also avail from the mall. See http://www.osf.org/comm/press/950276-ato.html for mroe details. /r$

2 1

Legal Crypto Bullshit and Lawyers reluctance
by Crypto Defender 17 Dec '03

17 Dec '03

Actually I am a lawyer...hehe... With the recent talk and action regarding the hooks for crypto in certain very valuable (or at least of increasing value) programs available on the net and elsewhere I find myself getting increasingly angry about the discourse and especially the arrogance of the parties involved. As a lawyer, I often send demand letters first in cases where the chances of winning a case in court are small and the ability for my client to withstand extended billing is low. In short, I send these letters as a weak effort backed up by little intent on pursuing the case (NOTE: I did not say no intent, I often do pursue cases with little or no money in them, and that explains why my school loans are not paid off 8-). What I am saying is that these demand letters that are being sent, especially regarding tenuous positions such as programs with crypto hooks are ITAR restricted, are causing more damage then they need to. I am not suggesting that Wei distribute his libraries and bare the brunt of prosecution. But I am certain there are bigger institutional players out there that can. I can not say we would take the case without obviously speaking with our management committee at my firm, but we often take on cases that will lose us money if they break into new areas of the law. Someone must be on this list whom in good faith, honestly believes that the ITAR restrictions dont apply to every piece of software on the net. While I can not and am not advocating breaking the law, nor am I soliciting business because I am sending to a general email list, If someone is interested in a challenge other than Phil Zimmerman's let me know. I also will not pursue anything without the relevant author's permission, obviously. I am not intending to get people in trouble here. I just feel that their stance on the law is weak at best and feel there has to be someone out there willing to take the chance. Matt Miszewski Attorney at Law matt(a)midex.com

1 0

Re: Java, Netscape, OpenDoc, and Babel (NewsClip)
by Rich Salz 17 Dec '03

17 Dec '03

>On the other hand, a Java object brokerage service sponsored by OSF OSF has no current plans to do this.

1 0

Re: carol....
by greg pitz 17 Dec '03

17 Dec '03

> In general, it isn't necessary to CC the world on your first interaction > with a customer service department; perhaps if you had sent us several > messages and we hadn't answered you, this would have been an appropriate > response. As it is, the situation is almost certainly either a human Sigh, but you haven't had the pleasure of getting to know Carol & her ways as we have..... ................................. pitz(a)onetouch.com greg pitz ..

1 0

Universal Password System?
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

I was thinking some more (look out, this could be dangerous) about the concept of using some kind of H(challenge+password) system to keep passwords away from ____(your threat model here)____, when it hit me that we could devise a standard password system, which would allow Joe Schmoe to have a single password for all of his interactions with puters. Ideally, Joe would need a "smart card" or PDA with IR link (this could even be the proverbial Windows Watch) that would not need to keep the actual passphrase at all (but would insure against a compromised system recording keystrokes) that would keep the pubkeys of all systems with which he has accounts. It would also need to be able to display in decimal and hex for systems without the IR link. When he is making connections to a new system, the system will give him its S and RSA or other public key K, so that the smart card can compute K( H(S+P) ), and send that as the password. To the system, Q = K"( K( H(S+P) ) ) =is= the password, but Joe only needs to remember P for everything. From then on, logons will include the system sending S and a non-reproducible challenge <C,D,....> (where C is iterated less-frequently and D is time.of.day) and the smart card responding with K( H( D + H(C+Q) ) ). As you may recall, the idea of the multi-part challenge was so as to allow the admin of the system to store Q remotely, and keep C -of-the-day and H(C+Q) for each user on the system itself. With appropriate safeguards (a physical switch on the case of the system which kills the NVRAM chip with the key for the secure file system, this would seem to be Pretty Secure. The system is extensible, allowing further nesting of challenge parts within the hash/concatenation function, so that layers of security can be used, if anyone can find an application for them. The basic principle of the master passphrase for all uses would make it easier to get Joe to use one that he can remember, without giving up anything to corrupt administrators (I have a hell of a time remembering all the passwords for every system, and must let the comm program remember them, protecting it with another password. Messy.) Comments? * Tribble: * Punk Tribble: Y Tribble Contortionist: & --- * Monster(a)FAmend.Com *

1 0