December 2003 - cypherpunks-legacy

Re: Netscape 2.0 beta
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Steven Champeon said: > One thing that I found with the newsreader was that it doesn't > do POP correctly. No matter what you do with your mail, it still > doesn't check for read vs. unread articles. This is fine when you > have a mailbox with one message. It can be annoying when you have > 110 messages in your mailbox and don't want to 1) delete them or > 2) download them twice. Neither pop 2 nor pop 3 tell you whether you've read a message or not. pop 2 does bump up the current number with an ACKS, but if you move around with READ n, then that's useless. pop 3 doesn't do that. I just reread the rfcs to make sure that I wasn't missing anything, (RFC 1725: Post Office Protocol - Version 3, RFC 937: Post Office Protocol - Version 2). Am I missing something? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

2 1

PGP Moose anti-spam authentication ready to go
by Greg_Rose＠sibelius.sydney.sterling.com 17 Dec '03

17 Dec '03

Yesterday the PGP Moose Checking Daemon did its first automatic cancellation. The offending message lasted less than a second. For some months I've been working on some scripts collectively called "the PGP Moose", which are intended to cryptographically authenticate news postings, and send notifications or cancellations when postings fail the authentication. This message is to announce that the moderators' and users' end of the software seems to be ready to go, and I'm looking for testers who have a better and more complete newsfeed than I to cooperate with running the cancelling daemon part of it. Both parts are tested to the best of my ability. The aim of this software is to monitor the news postings of moderators of USENET newsgroups, and to automatically cancel forged messages purporting to be approved. This can be extended to the approvals of individual users to automatically cancel messages that appear without having been authorised by the user. This has (obviously) been prompted by the recent spammings and other events. This software and protocol is designed around cryptographic signatures. The protocol is designed to allow the use of different signature techniques. This implemention assumes the use of PGP signatures, but can be easily modified to use others, such as the Digital Signature Standard. PGP was chosen for its widespread availability around the world. Basically, there is a script you run which inserts a special header based on a PGP signature of the important parts of the article. When an article arrives at a site running the PGP Moose Checking Daemon, the existence and correctness of this special header are checked, and either someone is notified or the article is cancelled. PGP, the crux of the cryptographic software, was written by Phil Zimmermann <prz(a)acm.org>, who otherwise has nothing to do with this. The cryptographic framework was written by me <Greg_Rose(a)sydney.sterling.com>, as were the INN news system hooks. The <A HREF=http://www.sydney.sterling.com:8080/~ggr/pgpmoose.html>README</A> is available for browsing, so I won't post it here, but I will happily send it (or the scripts) to people who can't get it easily on the Web. -- Greg Rose INTERNET: greg_rose(a)sydney.sterling.com Sterling Software VOICE: +61-2-9975 4777 FAX: +61-2-9975 2921 28 Rodborough Rd. http://www.sydney.sterling.com:8080/~ggr French's Forest 35 0A 79 7D 5E 21 8D 47 E3 53 75 66 AC FB D9 45 NSW 2086 Australia. co-mod sci.crypt.research, USENIX Director.

1 0

Re: Netscape 2.0 beta
by P.Peterson＠itd.uts.edu.au 17 Dec '03

17 Dec '03

Patrick J. Horgan <patrick(a)verity.com> wrote: >Steven Champeon said: > >> One thing that I found with the newsreader was that it doesn't >> do POP correctly. No matter what you do with your mail, it still >> doesn't check for read vs. unread articles. This is fine when you >> have a mailbox with one message. It can be annoying when you have >> 110 messages in your mailbox and don't want to 1) delete them or >> 2) download them twice. > >Neither pop 2 nor pop 3 tell you whether you've read a message or not. Eudora can tell whether you've read a message or not by reading the 'status' line of a message. The status line contains an "R" if the message has been previously read. Eudora uses POP 3 I believe. Elm also uses the 'status' line. The upshot of this is that you can configure Eudora to leave your mail on the server and next time Eudora goes to read your mail, it ignores all previously read messages and only downloads the new ones. >pop 2 does bump up the current number with an ACKS, but if you move around >with READ n, then that's useless. pop 3 doesn't do that. > >I just reread the rfcs to make sure that I wasn't missing anything, >(RFC 1725: Post Office Protocol - Version 3, RFC 937: Post Office Protocol - >Version 2). Am I missing something? This may or may not be a part of the RFC's (I haven't read them) but this is the way I've always seen it work. So there's no reason that Netscape couldn't do the same if it can't already. I can't tell yet whether it's capable or not as I'm still down loading version 2.0b as I type. :-) Cheers, Paul P. -- _--_|\ Paul Peterson, P.Peterson(a)itd.uts.edu.au / \ Systems Programmer, Ph: +61 2 330 2131 \_.--._/ University of Technology, Sydney, (Internal: x2131) v PO Box 123, Broadway, NSW, 2007, Australia. Fax: +61 2 330 1994

1 0

The problem with Java
by fc＠all.net 17 Dec '03

17 Dec '03

The way I see it, the real problem with Java is that there is no clear statement of the "security" goals it is supposed to attain. It's one thing to declare a concept or an implementation "secure" but it's quite another to tell us what the security claims are and demonstrate that they are met. Specifically: Do the makers of Java claim it can authenticate the source of programs it runs? Do the makers of Java claim it can prevent someone from using your client to attack other servers? Do the makers of Java claim it can prevent denial of services or consumption of all available resources on the client machine? Do the makers of Java claim it can maintain integrity or confidentiality of something? I have read the white paper on Java and I still don't know the answer to these questions. Until I do, it's hard to assess the "security" of Java, but I can tell you this. I bet that at least two, probably three, and maybe even all four of these are not accomplished by Java. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

2 1

Question on Galois Fields
by Usuario Acceso2 17 Dec '03

17 Dec '03

Hi C'Punks. Here's a rather mathematical question. Can anyone explain or give an example of how to use arithmetic in GF(q^n)? Often in cryptography we work in GF(p). I knew the existence of other fields, like elliptic curves and so, but I found a short comment in Applied Cryptography page 210 that I couldn't understand. Thanks in advance for your help. Jaime acceso2(a)diatel.upm.es

1 0

Re: LACC: Account sharing leads to false imprisonment
by fc＠all.net 17 Dec '03

17 Dec '03

Thought you might like another perspective: ... > A GORRIE STORY > > Here's the background: in October of 1994, Hirsh's stepbrother, a U of > T grad student, said Hirsh could use his school-provided net account. Almost certainly unauthorized use. The us of another person's account is almost always against school policy, and hence is likely to be a voilation of the law. > Hirsh used it to read news. He thought the net fascinating so began > uploading copies of The Anarchives. Hirsh never tried to hide who he > was -- he even included his home phone number, which is how the Super- > Sleuth Sysadmins "found" him. Hirsh made similar use of an account > belonging to "Ms X" -- a female Ph.D. student and friend of Stepbro's. Ignorance of the law is no excuse, and being easy to catch doesn't make you innocent of a crime. > This would have been a happy and otherwise normal arrangement except > that in January, 1995, U of T engineering prof Jack Gorrie > (gorrie(a)ecf.utoronto.ca) bossman of U of T's engineering computing > facility computer, received a complaint from someone at the University > of British Columbia about The Anarchives being posted to net news. The > person wanted it stopped. Interstate transport of stolen (presumably copyrighted) property, possible violation of national laws of both nations. Unauthorized use of the computers at the University of British Columbia. > Gorrie came to notice Ms X wasn't signing these documents, a Jesse > Hirsch was. He also noticed Hirsh and another U of T student (the > stepbro) exchanged email about the accounts. As Hirsh and his stepbro > have different last names, Gorrie concluded a larger hacker conspiracy > was afoot. Reasonable assumption. The only way to find out different would be to violate the users' privacy by reading their mail, etc. > Gorrie launched into his Canadian rendition of Cliff Stoll, author of > compu-crime-thriller _The Cuckoo's Egg_ -- in Gorrie's case, _The > Loonie's Egg_. He "tracked" Hirsh for two months, recording every > keystroke -- even though he had all three students' phone numbers. Collected possible evidence. A good idea. Allerting potential criminals is a poor way to catch them and potentially dangerous. May not stand up in court as it is heresay - not exempt under the normal business record exception. > On March 8, 1995, he asked the cops to intervene. "I checked and found > that the account was indeed being used to broadcast information on > behalf of The Anarchist Organization," he wrote Detective Hugh > Ferguson. Sounds wise. > Thus it came to be that Jesse Hirsh was forced to model nude for > Toronto's finest, with the blessing of U of T. If he turned out to be a terrorist who was planning to blow up a building, you would have called this a tremendous piece of police work, they could have written a million-selling book, and you would hail the sysadmin as a computer age hero. > Stepbro got his own taste of U of T six-gun justice. Off in a > Washington, D.C., engineering lab, he came under FBI investigation. > Naturally, the FBI found nothing wrong because there was nothing wrong > -- except for an over-zealous sysadmin using a meat cleaver to scratch > an itch. Try again. I assume that they found this was not a "real" terrorist. But to call it over-zealous is not right. S/he was doing the job and should be commended for trying to do it as well as s/he could. > CHARGES DROPPED > > On Sept. 7, minutes before the case was to go to court, the > prosecution dropped all charges. Hirsh agreed to pay a token > settlement of $400 for four months of university computer use. U of T > first claimed it was owed $1,560. Hirsh places the real cost at $60. So Hirsh agreed that he had been illegally using the computer system and the case was settled with a monetary fine. > Hirsh devoted an issue of The Anarchives to the case. It spread around > cyberspace. In it, Hirsh includes Gorrie's email address and asks > people to send him their opinions. Quite a few did. They were rather > unpleasant. Gorrie, miffed, used the U of T pipeline to have the > stepbro make Hirsh shut up. So what's fair for Hirsh is not fair for the Sysadmin? Sounds to me like you think it's OK for Hirsh to have people write nasty letters to the admin but not OK for the admin to respond via the step-brother. > After subjecting Hirsh to complete and devastating public humiliation, > U of T was now pleading for discretion. After Hirsh broke the law, he is trying to get even for being caught by harassing the people who caught him. ... > Hirsh wrote Gorrie privately, saying he was sorry Gorrie was getting nasty > mail. Gorrie replied the whole affair was a "big misunderstanding." As > they were _both_ misled, they were _both_ victims: Victim Hirsh was > dragged down the street in handcuffs, fingerprinted, mugshotted, > strip-searched and jailed for hours; Victim Gorrie received email that was > mean to him. Hirsh realized he was wrong to harass Gorrie and appologized for creating the situation. Gorrie gracefully called it a "big misunderstanding" and accepted the abuse as part of doing a tough job. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

Re: (cpx) Netscape 2.0 beta
by Wolfgang Roeckelein 17 Dec '03

17 Dec '03

Hi, > The good news is that someone finally, after years, has implemented >Progressive JPEG (I've been yelling about it for a while myself), and >it is simply *light years* better than interlaced GIFs. How do I create Progressive JPEG pictures? Note to Cypherpunks: Please answer via email, I receive only selected material from your list! Thank you very much in adance, Wolfgang --- Dipl.-Wirtsch.-Inf. Voice: +49 261 6509 173 Wolfgang Roeckelein Fax: +49 261 6509 179 WHU Koblenz E-Mail: roeckelein(a)wi.whu-koblenz.de Burgplatz 2 (MIME and NeXTmail ok) D-56179 Vallendar WWW: http://www.whu-koblenz.de/~wolfgang/ Germany GCM/B d-- s: a- C++ US+++$ UX+++ P+ L E? W++ N++ w-- O-(++) M+ !V PS++ PE Y+ PGP(++) t+ 5? X? R+ tv b++ DI D++ G e+++>++++ h+ r++>% y? (Geek Code V3.x) --rsa--------------------------------8<------------------------------------- #!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL ($k,$n)=(a)ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2% Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*' ,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2) -------------------------------------8<------------------------------------- TRY: echo squeamish ossifrage | rsa -e 3 7537d365 | rsa -d 4e243e33 7537d365 Residents of the USA & France *MUST NOT* include this .sig if following up! *** Residents of France & Russia *MUST NOT* make any use of this -sig ! ***

1 0

GOB_ble
by John Young 17 Dec '03

17 Dec '03

10-9-95. NYPaper: "Is the top priority in computing shifting from speed to how easily you can interact? How fast will the Microsoft-Intel duopoly fade?" Denise Caruso's column When the Internet's original creators decided to publish their networking standards so that any computer could connect to the network, they certainly had no idea that almost 30 years later, their decision would provide the first real lever to pry the Microsoft-Intel duopoly from its leadership role. But this very prospect is why one well-known technology investor made a speech last week called, "Why Microsoft and Intel Don't Matter Anymore." "Haves and Have-Nots Revisited. Rich Nations Talk High-Tech, but the Poor Live No-Tech." Digital technology is revolutionizing telecommunications and erasing the boundaries that separate the telephone, computer and media industries. But the revolution's inequality takes the shine off a business that has celebrated itself as both a one-stop shop for the Information Age and a force for positive political change in the world. "The present reality is that the technology gap between developed and developing nations is actually widening," said Nelson Mandela, who spoke at Telecomm 95's opening. "A software gift service, by lawsuit and negotiation, tries to demonstrate that it takes its claim seriously." Sandra Chartrand's Patents column. One controversy is a patent issued in 1985 for selling software to individuals through the Internet and some CD-ROM's. Its owner, Interactive Gift Express Inc. says the patent covers the selling and downloading of digital information. There are those who disagree. "I've read the patent and can actually say that there is no invention there at all," said Richard Stallman at MIT. Trio: GOB_ble (16 kb)

2 1

PC Tools' PC Secure
by Alan Green 17 Dec '03

17 Dec '03

Does anyone know of a utility which can decode files encoded with PC Tools' PC Secure package (version 5, if my memory serves me correctly). The package came out some 6 years ago. Thanks Alan alang(a)rrs.co.za

1 0

PC disk wipe software
by Perry E. Metzger 17 Dec '03

17 Dec '03

I thought I'd ask here, since its related to a lot of the stuff people have written for the PC platform in these parts. I need to securely wipe a bunch of data from an MS-DOS hard drive, so that it can't be recovered. Are there any readily available utilities for this? Will any of them selectively erase only data that isn't allocated to existing files? Perry

5 4