December 2003 - cypherpunks-legacy

SpokesPunking...
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 3:03 AM 9/26/95, Craig Hubley wrote: >"Consensus on cypherpunks seems to be that 40 bit encryption is not viable > for commercial applications, and that Netscape seems to have taken less > than due care to choose an appropriate random seed for its session keys." No offense offered Craig, 'cause I like reading your stuff here, but the concensus opinion on cypherpunks is "We don' need no steeenking spokespunk!". It seems to me that you can say that without any title, and the mouthier amongst us will be tapped for quotes as individuals anyway... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

Re: Hack Microsoft NT C2 Rating?
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:27 AM 9/26/95 -0700, todd(a)lgt.com (Todd Glassey) replied to Ray: >>So, if one can find bugs in NT's security, one can >>toss a little more egg on the NSA's face and the sham that part of >>their activies to *help* to secure american computers. A simple >>violation of NT's C2 status would be to demostrate a flaw in it's >>memory protection implementation. One of the bigger cracks on VMS was after it got its C2 rating; a strong system doesn't do you much good if you don't change the default passwords for the SYSTEM and FIELD service accounts :-) I'm more surprised by the rating since the Orange Book is basically for non-networked systems; Red Book rating is _much_ harder, unless the NSA's taking a different view of trustability of software encryption for authentication purposes than they used to. >As per NT's orange book C2 Rating... C2 is about the lowest level of Secure >that you can get. In fact I personally am unimpressed, rather it is a box >on an RFQ that gets checked. Very few people run C anything sites in reality. A C2 rating says that most of the obvious bugs have been found, access to the system and individual files requires authentication, and you can do an audit trail to find out who accessed what data when. Ignoring networks, that's not too bad. But, yeah, one of the big reasons for C2 rating is that government RFPs generally require C2 security, at least for military or sensitive non-military purchases. B-level ratings give you multi-level security, so you can run SECRET and CONFIDENTIAL on the same box; it's not a very useful security model for non-military applications, but does let you do a better-trusted job of system integrity. >IMHO - Military sites passing real classified data usually are not run on >anything as low as C2. If you want a secure os, look at the Harris Computer >Corp's B1-Certified version of ES/MP UNIX (they call it CX/SX). Hah. Maybe it's changed since I was working with the AT&T System V/MLS folks, but the vast majority of classified processing back then was done on unrated or C2 systems running System High - everybody's cleared, and the boxes with the classified stuff aren't connected to the outside except by limited sneakernet. You can get a _lot_ of security by keeping your computers in locked rooms, and the average PC of those days could fit in a big safe at night even if it couldn't fit in a locked file cabinet. (And floppy disks or external shoeboxes were easy to lock up.) Dan B. wrote >For fun ways to hack NT, check out http://www.somar.com/security.html. >Some of these are really laughable. You can use NT's LogonUser API >call to repeatedly guess passwords until you hit it, since NT offers >no way to limit number of login attempts. That's the kind of thing that would get changed for a C2 version, just as the Unix login program had to be souped up for C2 and B1. Even adding a constant delay, or an increasing delay after bad attempts, is a good start for systems like that. (It turns out that logging user names on bad attempts has to be done carefully to avoid increasing risk - if users get out of sync on typeahead when entering their login and password, you can end up logging passwords, which was especially bad when that sort of data got printed on the paper console...) #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

3 2

Re: Security Update news release
by Bill Stewart 17 Dec '03

17 Dec '03

>>Do the new versions use PGP's randseed.bin? If Netscape even only looks at >>data used to keep PGP secure, Netscape will be banned from my computer >>and every computer I am responsible for. -- For good. > >This is the second person who has expressed this sentiment. I don't >understand it. If you believe that the possibility of randseed.bin >getting out is dangerous, then why do you leave it online? Do you >really trust every piece of software you run, every piece of software >that can possibly access your machine over the net, to not look at >that file? It makes a little bit of sense - I'm not aware of any software, other than PGP and now Netscape, that _explicitly_ goes after randseed.bin, though of course just about anything can try. Assuming the code is inspectable (which it currently is), if I can see that all it's going to do with the file is crunch it into MD5 along with a bunch of other stuff, I'm not too worried, even though it is stealing slack(entropy) from PGP. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

2 1

First Payments WG Meeting Announcement
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

The World Wide Web Consortium is holding a Workshop on payments. The workshop is intended to be a small, technically oriented meeting of its payments working group. Although it is a members only event I am willing to listen to special pleading, alternatively companies may wish to join the consortium at our extreemely reasonable rates. See http://www.w3.org/pub/WWW/Consortium/ for details. -- Phillip M. Hallam-Baker Not speaking for anoyone else hallam(a)w3.org http://www.w3.org/hypertext/WWW/People/hallam.html Information Superhighway -----> Hi-ho! Yow! I'm surfing Arpanet! ANNOUNCE: First W3C Payments WG Meeting, October 11 ---------------------------------------------------------------------------- What: 1st W3C Payment WG Meeting Where: MIT EECS, Grier Room 34-401 (subject to change) When: Wednesday October 11, 9am - 5pm Who: W3C Member Representatives ONLY URL: First W3C Payments WG Meeting W3C is making progress on supporting electronic payments on the web. This WG Meeting has been called to foster discussion and feedback between W3C and its members. Discussion will focus on proposals to the W3C for payment protocols, interfaces, and e-commerce support. The agenda for the electronic payment workshop is still being settled. At the current time we have confirmed presentations by VISA, IBM, W3C, and the Financial Services Technical Consortium (FSTC). Additional invitations have been issued, and suggestions for additional presentations would be welcome. Contact Phillip Hallam-Baker (hallam(a)w3.org) or Jim Miller (JMiller(a)w3.org) with suggestions. There is a separate W3C Security WG Meeting at MIT on Tuesday, October 10th. Contact Rohit Khare for details (khare(a)w3.org) To RSVP for the Payments WG Meeting, email the coordinator, Phillip Hallam-Baker (hallam(a)w3.org) or call 617/258-5967 by 5 October. This workshop is aimed at technologists; please include a brief description of any relevant payments work you or your organization are involved in. This is a preliminary announcement of the date and time only. We have arranged for hotel rooms at the Kendall Square Mariott. To qualify for the MIT discount, notify Susan Hardy (susan(a)w3.org) For a review of the Consortium's plans, see W3C's report on Electronic Payment Schemes and the Third W3C Security Workshop.

1 0

Re: getting netscape to support the remailers
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> I started thinking about what it would take to get Netscape > to support sending mail through the remailers, after having > read the S/MIME specs which Netscape 2.0 is apparently going to > support. Perhaps with enough browbeating Netscape 3.0 will support > the remailers. Netscape doesn't need to support remailers explicitly since Netscape will be supporting Java. I think a remailer client is within Java's capabilities... Anyone disagree? andrew

4 3

[NOISE] Re: Easter Eggs
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:21 AM 9/26/95 -0400, you wrote: >I also think that in Netscape their existance is an >indication that the managment at Netscape is a bit less uptight than >management at some other places. Depends on the department. They have at least one manager at Netscape with a permenent case of high blood preasure. (He happens to be in charge of the support department.) >I didn't know about the FishCam Easter Egg, but I know that Netscape >has a couple of Easter Eggs related to the activity indicator in the >top right of the display. Typically this is the Big N logo with >animated meteors, etc. flying by when the window is active. One >Easter Egg temporarily turns this into a compass which spins to >indicate activity. Another causes the animation to show a dragon >(Mozilla) breathing fire for the remainder of the session. I won't >spoil your fun by telling how to find them. If he is not running X Windows, he is going to be searching along time for the Compass easter egg. You also need X windows to find the Mozilla animated icon hack on Jammie Zawinski's page. Which easter eggs that are available is dependant on which client you are running. obNetscapeHack: There is a feature called a "cookie file" in Netscape that is ripe for exploitation as a security leak. If you are using a Netscape server (and you may not even need that), you can feed all sorts of information into it without the user's knowlege. I have heard of one page that overloads the cookie file until the machine runs out of drive space. I am sure that there are other exploitable holes there... Any takers? | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

3 2

IBE_dam
by John Young 17 Dec '03

17 Dec '03

9-26-95. W$Japer: "On-Line Service to Assist Global Trade." A group of multinational companies is expected to unveil today an on-line service to businesses to engage in international trade. Dubbed IBEX, it is a joint effort of AT&T, Dun & Bradstreet, General Electric and the U.S. Chamber of Commerce to let businesses use on-line traffic to line up suppliers, negotiate contracts, make and receive bids, and arrange the delivery of goods and services around the world. IBEX expects the backing of Chase Manhattan, Microsoft, DEC and Simon & Schuster. The IBEX software allows companies to sign on and submit a request for goods or services, which is posted anonymously. The request could be styled using an array of categories offered by the service, including location, product category, payment and shipping terms. The customer would then receive bids from businesses hoping to land the contract. Once a bid is chosen, the identities of the businesses are disclosed and negotiations begin. IBEX allows them to attach documents such as confidentiality agreements, contracts and purchase orders. IBE_dam (5 kb)

1 0

Re: Security Update news release
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DFIKyx.63G(a)sgi.sgi.com>, shamrock(a)netcom.com (Lucky Green) writes: > Do the new versions use PGP's randseed.bin? If Netscape even only looks at > data used to keep PGP secure, Netscape will be banned from my computer > and every computer I am responsible for. -- For good. This is ludicrous. You couldn't compromise PGP's security even if you posted the contents of randseed.bin to the net. It's contents are carefully sanitized before it's saved to disk and before it's used. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

1 0

Re: First Payments WG Meeting Announcement
by pays＠gctech.edelweb.fr 17 Dec '03

17 Dec '03

At 15:41 26/09/95, Phillip M. Hallam-Baker wrote: >The World Wide Web Consortium is holding a Workshop on payments. The workshop >is intended to be a small, technically oriented meeting of its payments working >group. Although it is a members only event I am willing to listen to special >pleading, alternatively companies may wish to join the consortium at our >extreemely reasonable rates. See http://www.w3.org/pub/WWW/Consortium/ for >details. > >-- >Phillip M. Hallam-Baker Not speaking for anoyone else >hallam(a)w3.org http://www.w3.org/hypertext/WWW/People/hallam.html >Information Superhighway -----> Hi-ho! Yow! I'm surfing Arpanet! > >ANNOUNCE: First W3C Payments WG Meeting, October 11 > >---------------------------------------------------------------------------- > >What: 1st W3C Payment WG Meeting > >Where: MIT EECS, Grier Room 34-401 (subject to change) > >When: Wednesday October 11, 9am - 5pm > All that is extremely fine and an awaited initiative BUT for one point the EXTREMELY SHORT DELAY and notification!!!!!! Our company is just in the "joining the consortium" process, especially because we were expecting such an event. However, to be able to catch a flight and spend a couple of days at MIT within less than a fortnight is another matter. I don't yet know if we will able to attend, and we really would hate to be unable to attend and participate. Thus I would urge the Web Consortium to consider postponing this meeting for at least 2 or 4 weeks so that any interested party is able to decently cancel other commitments and get prepared for the meeting. If W3C is really interested in attracting all interested party, it would be fair as I suspect we are not the only ones with Please let me know as soon as if this is possible or if I must as soon as possible try to change my agenda. regards, -- PAP _________________________________________________________________________ PAP: paul-andre.pays(a)gctech.edelWeb.fr tel: +33 1 34 52 00 88 fax: +33 1 34 52 25 26 GC Tech "The Globe Online and Globe ID Technology Company" http://www.globeonline.fr/ http://www.gctech.fr/

1 0

Netscape Stock Prices
by Jeff Simmons 17 Dec '03

17 Dec '03

Here's the history of Netscape's stock price to date, with the dates of some Cypherpunk exploits, the Wall Street Journal Articles about them, and major Netscape press releases. Date High Low Close Volume 950809 75.000 53.750 55.500 3851.8 950810 56.500 51.375 51.375 2795.9 950811 53.000 48.750 51.500 1907.4 950814 51.750 50.250 51.250 530.9 950815 55.250 51.250 54.625 1040.6 Damien's Crack - AT&T deal 950816 56.500 55.250 55.625 997.6 Developer's Partnership announced 950817 55.250 52.500 54.875 562.5 WSJ article re: Damien 950818 55.250 52.250 52.625 409.5 950821 52.750 51.000 51.000 290.0 950822 51.500 50.500 50.625 258.5 Win95 Navigator released 950823 53.500 50.500 52.000 414.2 950824 52.000 51.250 51.250 119.7 950825 52.000 51.250 51.250 89.2 950826 Brute Crack 950828 51.750 51.000 51.000 210.2 950829 51.250 46.750 48.250 1037.9 950830 48.500 46.000 46.625 319.3 950831 49.500 45.750 49.500 423.0 950901 49.500 47.750 48.750 164.4 950905 49.250 46.000 46.250 277.8 950906 49.500 47.250 48.750 351.9 950907 50.750 48.750 50.250 499.1 950908 51.000 50.000 50.250 147.6 950911 54.750 50.250 53.250 533.7 950912 54.500 51.000 52.250 211.5 950913 52.750 50.000 50.750 150.8 950914 51.250 50.250 50.250 79.9 950915 53.750 50.250 53.250 242.1 950917 Ian & Dave's Crack 950918 55.250 51.750 52.500 350.1 New Software Announced 950919 53.250 49.000 53.375 373.5 WSJ article re: Ian & Dave 950920 56.250 53.250 54.750 302.5 950921 59.125 54.250 58.750 436.9 Collabra Purchase Announced 950922 63.250 59.750 62.750 807.7 Ray's overflow bug 950925 69.000 62.250 67.000 684.0 WSJ article re: overflow bug Stock prices from MIT's stock price history server and the Wall Street Journal. Cypherpunk dates from Sameer's Hack Netscape Page (not sure when Ray posted). Press anouncement dates from Netscape's home page. Any typos or mistakes from me. -- Jeff Simmons jsimmons(a)goblin.punk.net

1 0