December 2003 - cypherpunks-legacy

Re: pkzip cracking
by lharrison＠mhv.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 05:17 AM 8/2/95 UTC, an264373(a)anon.penet.fi wrote: > >Does anyone have a utility to crack password encrypted/protected zip >files? Or an address to download one? All replies / flames / >pointers appreciated. Sauroth - Did you ever get a response and, if so, what was the answer? Regards - Lynne -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMCT4GD5A4+Z4Wnt9AQEdGAP+Nne+hetfsjLPNjNeAoWOHCIe14lqWOm3 iXYE8ol7PCf/B0CypYYShkpzX9Y1+319veAPLe6nzHU95TQkEGffwEJpFrLt2IA8 k0azeeRJvEERTVCC+4WUWXvE9ugsAXBn755Eg4HW6lEu1qNp/K3zn4fWGuNLeFna Wt+Co+O7iQ0= =s0hA -----END PGP SIGNATURE----- ******************************************************************** Lynne L. Harrison, Esq. Poughkeepsie, New York E-Mail: lharrison(a)mhv.net Lynne.Harrison(a)Execnet.com "Say not, 'I have found the truth', but rather, 'I have found a truth.'" - Kahlil Gibran from "The Prophet" ********************************************************************

1 0

MS Money password problem
by Matt Miszewski 17 Dec '03

17 Dec '03

We recently lost (ok fired) our office manager, but not before she put nifty passwords on all the MS Money data we had and now she has, of course, gone on a three week vacation. I have all the relevant WP password retrieving mechanisms but not one for MS Money. Anyone with pointers or programs, your help would be greatly appreciated. Matt

2 2

Questions about SMTP and NNTP
by Joey Grasty 17 Dec '03

17 Dec '03

C-punks: While working on the SMTP and NNTP clients for the WinSock remailer, I have uncovered two questions I don't know the answer to. Here they are: 1. When sending a message to the SMTP server, I use scenario 4 as shown in RFC821 as a basis for my client. There seems to be a huge security hole in SMTP. I can use just about any name when sending the VRFY command. For example, I could connect to "sensemedia.com" and pretend to be "tcmay". Is there something I'm missing here or is there really that big a security hole in SMTP? 2. How do you do user authentication in NNTP? There's nothing about it RFC977. Is there a later RFC that describes how to do user authentication? All of my newsreaders support this function, but I haven't been able to figure out how to do it. Any help you can give me would be appreciated. ObWinSock Remailer: I have the POP3, NNTP and SMTP clients functional now. With luck, I'll have an alpha test version of the remailer in two or three weeks. ObCypherPunks: Is the list down? I haven't heard a peep since about noon. I send a "who cypherpunks" to majordomo and received a quick reply which shows I'm still subscribed. Any idea? Regards, -- Joey Grasty jgrasty(a)gate.net [home -- encryption, privacy, RKBA and other hopeless causes] jgrasty(a)pts.mot.com [work -- designing pagers] "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin." -- John Von Neumann

1 0

Re: MS Money password problem
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 7:34 PM 8/21/95, Matt Miszewski wrote: >We recently lost (ok fired) our office manager, but not before she put >nifty passwords on all the MS Money data we had and now she has, of >course, gone on a three week vacation. I have all the relevant WP >password retrieving mechanisms but not one for MS Money. > >Anyone with pointers or programs, your help would be greatly appreciated. This, of course, is the rationale for the "key escrow" systems (as opposed to the government-mandated "key escrow" proposals, which are not an "escrow" sytem of this kind). "Escrow" is sufficiently overloaded with real estate connotations that I wish the industry would adopt a different term. Carl Ellison's "GAK" is cute, but is hardly likely to ever be adopted widely. (No, I'm not calling for another round of suggested names, just opining that "key escrow" is a terrible name.) --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Encrypted internet traffic to Singapore??
by Joe McGuckin 17 Dec '03

17 Dec '03

A client of mine wishes to set up a connection to their Singapore office using the internet rather than a dedicated leased line. They would like to encrypt the data going between the branch office in Singapore and the home office in California. I am considering using something like swIPe for this? Seem reasonable? The data is not very secret, they merely wish to foil 'hacker' type eavesdroppers. Also, what are the legal ramifications? Can I get an export license for this? Is there an encryption method that doesn't require an export license? What laws does Singapore have on encryption? Is swIPe legal? That is, are any patents being misappropriated by the current version? I see announcements on this list about DH and Public Key software being released. I would assume that these software tidbits are technically illegal for commercial use? Thanks, Joe

2 1

FC's Typs? (NewsClip)
by nobody＠valhalla.phoenix.net 17 Dec '03

17 Dec '03

FBI may have partial set of Unabomber's prints Washington, Aug. 6 (Reuter) -- The FBI may have a partial set of fingerprints from the elusive Unabomber, now considered the country's most wanted man, Newsweek magazine reported Sunday. The partial set of prints, lifted from an explosive device mailed several years ago, were uncovered with newly available forensic technology, the magazine said. While not certain the fingerprints belong to the serial bomber, the report said federal agents believe that identifying the prints could lead them to the Unabomber, whose letter bombs have killed three people and injured 23 others over 17 years. Federal agents are seeking the bomber by looking for machines he might use to construct his home-made pipe bombs, and are trying to track the manual typewriter used to write the bomber's lengthy anti-technology manifestos, Newsweek reported.

1 0

Quibbling about definitions of "proof"
by tcmay＠got.net 17 Dec '03

17 Dec '03

Look, you all, I'm *really sorry* I even brought up the subject of proofs of correctness! As I feared, any mention of certain loaded words immediately brings the quibblers out of their lairs to dissect the "real meaning" of one or more terms. I had thought that my carefully worded mention of the Boyer-Moore prover and that this means little for actual implementations would deter quibbling over the cosmic significance of "proof." (An interesting topic, by the way, as Ray's knowledgeable article makes clear. But metamathematics is an arcane subject and short articles are rarely persuasive...we debated the same stuff a couple of years ago on the Extropians list.) With 700 subscribers, quibbling is the usual state of affairs. No matter what is said, someone will quibble over terms or meanings. No wonder it is the major venal sin at West Point. The Boyer-Moorer theorem prover is an accepted ("Huh? Define what you mean by "accepted"! Not all of us accept that term.") term of art. If you disagree, or wish to raise the possibility that the computer glitched during the proof, there are entire newsgroups devoted to such arcania. On a more mundane note, my Internet Service Provider of the past 6 weeks just sent out an urgent notice tonight announcing that they are no longer "sensemedia.net" and have become "got.net" (as in "got net?" as in "got milk?). This means my 3 years as "tcmay(a)netcom.com" is followed by 6 weeks as "tcmay(a)sensemedia.net" and an as-yet-undetermined time as "tcmay(a)got.net" (at least until the "Got milk?" ad people get wind of this pun and tell them to change to something else. --Tim May Special note: My ISP has changed its domain name from "sensemedia.net" to "got.net" (as in "got milk?"), so I have to again ask you all to bear with me and use my new e-mail address, "tcmay(a)got.net". ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

5 5

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.taylored.com This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp. hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"crown"} = "<mixmaster(a)kether.alias.net> cpunk pgp hash latent cut mix ek reord"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)spook.alias.net> cpunk mix pgp hash latent cut ek"; $remailer{"gondolin"} = "<mixmaster(a)gondolin.org> cpunk mix hash latent cut ek ksub reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. 21 Apr 1995: The new version of premail (0.33) is out, with direct posting, perl5 and better MH support, and numerous bug fixes. Last ping: Mon 7 Aug 95 6:00:20 PDT remailer email address history latency uptime ----------------------------------------------------------------------- spook remailer(a)spook.alias.net *****+***-*+ 1:17:21 99.99% gondolin mixmaster(a)gondolin.org * -++*-+**** 43:12 99.98% ford remailer(a)bi-node.zerberus.de .*-**++**-** 15:34 99.97% portal hfinney(a)shell.portal.com ***#####**** 3:17 99.94% bsu-cs nowhere(a)bsu-cs.bsu.edu ***##*#+#** 6:11 99.94% replay remailer(a)replay.com ****+******* 11:17 99.87% rmadillo remailer(a)armadillo.com ++.-+*++-+** 1:36:12 99.84% alumni hal(a)alumni.caltech.edu ***##****** 4:08 99.83% hacktic remailer(a)utopia.hacktic.nl ************ 12:39 99.74% crown mixmaster(a)kether.alias.net ----------- 2:05:54 99.74% vox remail(a)vox.xs4all.nl .-..-..... 23:52:15 99.99% rebma remailer(a)rebma.mn.org -..+-.+..-- 16:26:15 99.68% vishnu mixmaster(a)vishnu.alias.net *****+* **-- 36:02 99.32% penet anon(a)anon.penet.fi - -**++-++*+ 2:39:49 98.59% hroller hroller(a)c2.org * -+*-#**+* 44:23 98.16% syrinx syrinx(a)c2.org - -------- 2:33:46 97.89% mix mixmaster(a)remail.obscura.com -__.-------- 6:25:13 97.55% c2 remail(a)c2.org * -++-+++-+ 1:34:04 97.30% extropia remail(a)extropia.wimsey.com -.__..--.-. 15:02:35 96.68% ideath remailer(a)ideath.goldenbear.com ..- .-.-- 12:33:17 95.40% flame remailer(a)flame.alias.net ++++++++++ 52:48 95.20% rahul homer(a)rahul.net ****#**++*** 5:28 99.99% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

(Fwd) Re: Law enforcement and PGP ban in Australia (fwd)
by Rev. Ben 17 Dec '03

17 Dec '03

Followup on the Ozzies banning PGP: ------- Forwarded Message Follows ------- Date: Mon, 07 Aug 1995 16:44:12 +1000 From: "Danny Smith, AUSCERT" <D.Smith(a)auscert.org.au> To: mauvais(a)ocelot.llnl.gov Cc: first-teams(a)CSRC.NCSL.NIST.GOV Subject: Re: Law enforcement and PGP ban in Australia Organization: FIRST, the Forum of Incident Response & Security Teams Reply-to: "Danny Smith, AUSCERT" <D.Smith(a)auscert.org.au> Paul (et al), > I'm curious about what people have heard about this? > > I'm trying to find out more from this end....doesn't look good... Surprised you didn't come to us first. :-) > Subject: Australia next to ban PGP I believe you can treat this as net.rumour. I have the paper now, and will read it tonight. I will also talk to the author whom I am led to believe is rather annoyed at the misrepresentation of the content of his paper. More information later this week. Danny Smith. ========================================================================== Danny Smith | Fax: +61 7 3365 4477 AUSCERT | Phone: +61 7 3365 4417 c/- Prentice Centre | (answered during business hours) The University of Queensland | (on call after hours for emergencies) Qld. 4072. Australia | Internet: auscert(a)auscert.org.au

1 0

Over 350 'Munitions T-shirts' Shipped
by dhenson＠itsnet.com 17 Dec '03

17 Dec '03

As of 27 July 1995, we have shipped over 350 of the RSA/Perl Munition T-shirts. Orders are still pouring in. Don't be left out. Order your's today. Now you can wear a TSHIRT that has been classified as a MUNITION by the US Goverment. That's right! The US International Traffic in Arms Regulations (ITAR) makes exporting cyrptographic materials illegal. ITAR further defines export as providing cryptographic information to a non-US/Canadian citizen even if you are inside the US at the time. Providing information is further defined as telling or showing information to a non-US/Canadian citizen. The Munitions Tshirt has a Perl implementation of the RSA algorithm (the one used by PGP) printed on the front along with a bar-code of the same algorithm. What all the above means is that if you wear the Munitions Tshirt where a non-US/Canadian citizen can see it, even if it is inside the US, you have just exported cryptographic material (which is already freely available outside the US) and have become a criminal in the eyes of the US Government. Now you too can become an international arms dealer for the price of a tshirt (US$15.95 - US$19.95, depending on size) and the guts to wear it. If you are a non-US/Canadian citizen, you can still own a Munitons Tshirt by ordering the tshirt from a source that is outside the US. The email response to a request for info (see next paragraph) includes full instructions for ordering the tshirt no matter where you live. For more information on how to own this classic example of civil disobedience, just send email to dhenson(a)itsnet.com with the subject of 'SHIRT'. (You don't have to be a US/Canadian citizen to request the info.) Or, if you have WWW access, just point your Web browser to: http://colossus.net/wepinsto/wshome.html By the way, 25% of the profits from the sale of the tshirt (in the US/Canada) goes to the PHIL ZIMMERMANN LEGAL DEFENSE FUND to help defend the author of PGP from harassment and possible prosecution by the Fedgoons. And if you get arrested for wearing the Munitions Tshirt, we'll refund your purchase price. :-) Get your Munitions Tshirt now. Who knows how long they'll stay in production! Don Henson, Managing Director (PGP Key ID = 0X03002DC9) West El Paso Information Network (WEPIN) Check out The WEPIN Store at URL: http://colossus.net/wepinsto/wshome.html

3 2