December 2003 - cypherpunks-legacy

Re: USA Today on Fear of Credit Cards over Net
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- <snip> > How much do PC users trust: > > Automatic teller machines 77% > Banking by phone 62% > Banking by computer 57% > Using a credit card or calling > card at a public phone 57% > Writing a credit-card number on > a catalog order form 43% > Sending a credit-card number to > a commercial on-line service 34% > Giving a credit-card number > over the phone 31% > Sending a credit-card number > over the Internet 5% > > (margin of error = +/- 4.7%) <snip> Pity they didn't ask about, "Tossing a credit card slip/carbon in the garbage." Dumpster-diving is still an effective, lo-tech attack. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMGAxQW1lp8bpvW01AQEfmwP9GfEzhoBWuTNHvxZ7dMvMV7K/cypT0XmO kLqAAtPHyhS3PxmwNiT0G4tquU9QHw2cQ5Rj6IAqR7Fbuvtt1TW2Kora9RsXLp5L 75Zw63/wrsnI20qe+Pnf6FEG0IcjLg4vrezhAGYAC3zSdTpSW4cuqdzId6qeTlvM 4gg2Z9UGOrA= =ReYK -----END PGP SIGNATURE----- Regards, Jim Ray "Not everything that is faced can be changed, but nothing can be changed until it is faced." -- James Baldwin ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James Milton Ray <liberty(a)gate.net> ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

3 2

Re: Encryption algorithms used in PrivaSoft (fwd)
by David Van Wie 17 Dec '03

17 Dec '03

David Clavadetscher of PrivaSoft writes: > At this time our crypto engine is patented and proprietary. Ian Goldberg writes: > Waitasec... I was under the impression that if you patented it, you had to > reveal it. That's why RC4 isn't patented (it used to be a trade secret). Many technologies have both patented parts and trade secret parts. Often, companies will maintain information that is in patent applications as trade secret until they are granted. I guess I should say _if_ they are granted! After a patent is granted, it is usually a good idea to also maintain some trade secrets in your products -- since trade secrets never "expire," unlike patents. If the patent isn't granted, you still have the option of treating the contents as an intellectual property under trade secret protection. dvw

2 1

netscape bug
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

clearly the netscape engineers did not practice "safe crypto programming", but I question the seriousness of the crack. none of the articles mention that the cracker must have login access to the computer that the random numbers are generated on. is this true? does the code require knowledge of the PID etc. that can only be obtained by a login to the system that the netscape session is running on? if this is true (i.e. login access required) this bug is by far not as serious as some of the hyperbole is suggesting. I agree it is still very insecure but the most dangerous crypto bugs are those where you can determine keys from data alone.. physical penetration into a machine is another level of security.. furthermore, I would like to commend Netscape for their fast response to the problem and apparent commitment to establishing safeguards that avoid it in the future. cypherpunks have an easy time ridiculing someone who slit their throat on writing some crypto functions, but geez, cut them some slack: crypto stuff has so many pitfalls and bugaboos that even the world-class experts make mistakes. where else can not properly "burning" stack registers (function parameters) and environment variables be considered "lethal"??? PGP errors have been reported on numerous occasions, some in the randomizer code. do people call for Zimmermann's head on a stick and call him "incompetent"? often when cryptographers say something is "broken" it can still mean that it is not necessarily unsafe in practice. there are many shades of "broken", some requiring a Cray and other's requiring a PC. I am really surprised how much people here consider "broken is broken". this is only the extreme theoretical perspective. granted I am not advocating that people *not*fix* bad crypto functions, I'm only saying that maybe its not in everyone's best interest to run around and say "the sky is falling" and lambaste companies for minor difficulties.. Netscape is a world class product, and it's *free*. on this cypherpunks list, I have seen no end to the venemous criticisms that people level at *free* products, which IMHO is quite tasteless at times. Netscape has done far more for the cypherpunk cause than many, many companies just by including RC4 in their product. they have taken some heat for their decisions & code, but they are on the front lines of battle. now instead of our vague claims about how the world can benefit from good crypto, how it is immensely valuable and important to cyberspatial financial transactions, to promote the cypherpunk cause, we now have something *popular*, *physical*, and *tangible* to point to: netscape!! this is *not* vaporware. this is not some cpunk saying, "all one needs is [x] algorithm running on [y] network and you have a world class infrastructure". the amount of work to get something like Netscape into the world is quite daunting and herculean. we owe a great debt to netscape and their accomplishments for furthering our own agenda!!! please do not trivialize what they have accomplished!! Netscape is here, it works, and it is cyberspatial crypto that Joe Sixpack can understand and *use*!! it is not a toy remailer, it is not some PGP front end, it is not some mailer script, *this* is the format in which Joe Sixpack will be using crypto in the future, the format which will bring "crypto to the unwashed masses"!! Netscape may very well be the chief vehicle that puts on *concrete pressure* on our government to relax crypto export laws. I see this happening *right now* with them going to a 64 bit key from a 40 bit one, and the world starting to realize the importance of crypto and the idiocy of the export laws. I am really amazed at how few seem to be supporting Netscape here and considering them the *premiere ally* in our current battle. it reminds me of how much people here rant at Microsoft when virtually no other company on the planet could pull off what they make look easy (ah, that's another story I've filled up other posts with). please do *not* take an adversarial relationship with the companies who are helping advance the cutting edge of cyberspace!! do *not* ridicule them. rather, help them to understand their problems. I think you will find that most companies are *not* hostile to improving their software, and will readily admit it when it needs fixing (intel has been humbled by their pentium glitch, and I doubt any company again will ever be so obstinate and belligerent..) . I am willing to bet that the netscape bug would have been fixed quickly if it had been quietly brought to their attention, without the blaring media lights (I enjoy the media circus as much as the next guy, but on the other hand, doing some things quietly may actually advance the cypherpunk cause further than by making a noisy hullaballoo in cyberspace). once again I commend Netscape for their fine software and willingness to perfect it. netscape is at the cutting edge of advancing key cyberspace technologies and it is not surprising that they make some minor mistakes with the code in these early phases. cyberspace is very young!! give designers a bit of time to get it right. be patient!! do not accuse them of incompetence!! netscape is tens of thousands of lines of world-class code. only in programming can a few moments of total, rapt attention lead to bugs that get blared on the front page of new york times and affect your stock price!! good lord, give the guys a break. cpunks: when Netscape has some serious competitors, they will get their act together. but at the moment they are the only game in town, and it will pay off to be nice to them, and try to support them, instead of kicking them in the teeth and wringing them every time they make a mistake. few in the world are as knowledgeable or paranoid as we are about security, and its going to be a gradual process to get to even a fraction of the expertise here penetrating the mainstream software industry. be patient!! -- P.M. notes that anywhere there is a data-driven buffer overflow (which he suspects are all over netscape) he can get code to execute anything he wants. this reminds me of the Morris internet worm that ran exactly the same way. it used a bug in the finger demon that caused a string buffer overwrite (via strcpy, instead of strncpy) to execute customized code. my question: I have not seen the specifics of how this works. does this require specialized knowledge of the native machine language on the host machine? or is it just used to cause something like a core dump to get a command line or something like that? --Vlad Nuri

3 2

No Subject
by Mix 17 Dec '03

17 Dec '03

Jesus had 3 nipples. (this has been proven to be true)

1 0

Netscape Servers too ? (forwarded message from Marc VanHeyningen)
by Laurent Demailly 17 Dec '03

17 Dec '03

------- start of forwarded message (RFC 934 encapsulation) ------- From: marcvh(a)spry.com (Marc VanHeyningen) To: Wayne Wilson <wwilson(a)umich.edu> Cc: Kazuma Andoh <andoh(a)nikkeibp.co.jp>, www-security(a)ns2.rutgers.edu Subject: Re: What's the netscape problem Date: Wed, 20 Sep 1995 07:51:47 -0700 [...] > http://home.netscape.com/newsref/std/random_seed_security.html The interesting part of this article is the discussion of random seed weaknesses on the *server* side. If true, this means anybody could use the random-seed hole to reverse engineer the process by which the server's private key information was generated and break that keypair with much, much much less effort than would normally be needed to factor a 512-bit RSA key. (Note that I'm not entirely sure Netscape's server uses 512 bit RSA keys, since the documentation, technical data sheets, and generation process don't give any clue about what key size is being used. Guess they don't want customers worrying their pretty little heads about it.) This would mean merely getting a fixed server would be insufficient; every Netscape server user would need to generate a new keypair, get a new Verisign certificate, and revoke the old one. (Oops, wait, there's no way to revoke the old one. I guess you just have to hope nobody does this before all those certificates expire.) - - Marc ------- end ------- dl -- Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|... Freedom Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept smuggle nuclear North Korea SDI cracking Mossad DES

1 0

Re: Java Source for Encryption...
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:34 PM 9/8/97 -0400, Peter Wayner wrote, to coderpunks: >Is anyone giving away Java source code for public-key encryption? What evil lurks in the heart of the Internet? AltaVista Knows.... Besides www.systemics.com, which has free Java crypto there's also www.baltimore.ie which has commercial Java crypto as well as some free downloadware. However, Baltimore's web pages also talk about how they're the winner of the EuroTrust TTP/CA development contract. Sigh.

1 0

netscape's response
by sameer 17 Dec '03

17 Dec '03

" With this knowledge, an experienced computer programmer could decrypt messages sent by Netscape Navigator to other computers in a few hours of computation time." Excuse me? A few hours? Try 25 seconds?? "Netscape has also begun to engage an external group of world-class security experts who will review our solution to this problem before it is sent to customers." A group which offered to review the first version, but Netscape refused. From their release it looks like they aren't finding a better source of entropy, but just using *more* sources of entropy. Doesn't mean that the entropy is good. A T-shirt to the first person to decompile the new Seed code and post the sources of "entropy" used. (See http://www.c2.org/hacknetscape for general [not written in stone] guidelines regarding t-shirt awards) -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 An Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

8 12

AOL monitoring
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

hello, apparently the recent FBI sting happened with the cooperation of AOL, which allowed the FBI to monitor downloads.. here's some info to test if you are being monitored on AOL ------- Forwarded Message Date: Sat, 16 Sep 1995 14:47:38 -0400 To: snet-l(a)world.std.com From: Charles Zeps <czeps(a)icis.on.ca> Subject: How to find out if you are sniffed at AOL > America Online Opens Private E-mail to Federal Sting > (c) 1995 N.Y. Times News Service > >(14 Sept. 1995 ) Responding to court orders related to a >nationwide crackdown on the electronic transmission of child pornography, >America Online, the nation's largest information service, gave law >enforcement agents access to the private electronic mailboxes of an unknown >number of its subscribers, company officials confirmed Thursday. From: Eric Muetterties <ericm3(a)ix.netcom.com> All you America online users would be wise to check out your software...(WINDOWS) Use a file viewer that will allow you to view in hexadecimal.Or use the DOSSHELL.EXE program in your DOS directory and use the menu to VIEW file contents Find your Aonline directory and find the directory marked IDB. This should have two files marked with your screen name and a suffix of either .arh or .pnd (eg. ericmuette.arh) With the file loaded in the viewer you will see the hex dump of these files. In the side pane will be the equivalent ascII of the hexadecimal dump (in laymans terms... if there is text you will recognize it...) Use PAGE DOWN to move down through the files.... soon you will recognize the first files you downloaded and references to where you were on the internet and what directory you saved the file to. Make these files READ ONLY with the file attributes menu in your file manager and they can not use this facility../ You will get an error message when you first start up ("XFER ERROR - - - could not create database") Click on "OK" and program will continue. Then when program gives you messages when you try to save to disk or download something just click on "IGNORE" till program continues (usually 3 times). When they realize everyone is defeating this they can easily come up with a more covert way of tracking you but in the meantime... ... better to change to another provider... You will be amazed at your freinds expressions when you get on their computer and tell them what they have downloaded. If you view the files in the TOOLS directory , at the end of the files you will find the internal names for these programs such as "Internal DAtabase" , ETC. !!! Have fun... Big Bro is here in a BIG WAY... MIND YOUR P's and Q's on the NET !!! E. Muetterties If you can't figure out how to do this email me with what is in your "IDB" directory and I'll tell you which files to view. ericm3(a)ix.netcom.com Linda Thompson American Justice Federation Home of AEN News and "Waco, the Big Lie" "America Under Siege" 3850 S. Emerson Ave. Indianapolis, IN 46203 Telephone: (317) 780-5200 Fax: (317) 780-5209 Internet: lindat(a)iquest.net "When even one American -- who has done nothing wrong -- is forced by fear to shut his mind and close his mouth, then all Americans are in peril." Harry Truman

5 5

Info please
by davewww 17 Dec '03

17 Dec '03

davewww(a)fastlane.net

2 1

Re: Silly NetScape RND tricks...
by James A. Donald 17 Dec '03

17 Dec '03

At 12:05 PM 9/20/95 -0400, Deranged Mutant wrote: > >I've only been skimming the NetScape-related posts lately, but I've yet >to see anyone mention using a keyboard-timing sampler as a source for >some random bits Under windows, you get a lot more entropy from mouse timing and position than keyboard hits. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0