December 2003 - cypherpunks-legacy

WSJ on Netscape Hole 3
by John Young 17 Dec '03

17 Dec '03

The Wall Street Journal, September 25, 1995, p. B12. Netscape Software for Cruising Internet Is Found to Have Another Security Flaw By Jared Sandberg Another security flaw that has long plagued the Internet has been found in software by Netscape Communications Corp. and others, raising concerns for the privacy and safety of information on the global computer network. The flaw in Netscape's popular Navigator software, which helps users cruise the multimedia portion of the Internet known as the World Wide Web, is the third defect in the software discovered by the "Cypherpunks" discussion group in little over a month. Members of the Cypherpunk group, which includes mathematicians and hackers who discuss the security method of cryptography, last month broke Netscape's "key" that protects sensitive data by "brute force" -- the use of massive computing power. Last week, other members found a flaw that could let hackers essentially pick the lock in Netscape's software. Unlike the prior glitches, however, the latest flaw doesn't lend itself to the theft of multiple credit-card numbers. Instead, it could allow a savvy hacker to damage an Internet user's computer, such as crashing the computer or deleting files. "This is just another indication that Netscape isn't being careful," said William Cheswick, a security researcher at AT&T Corp.'s Bell Laboratories. Still, he said, the flaw goes well beyond Netscape. It first reared its head seven years ago when Cornell graduate student Robert Morris used it to create a "worm" that crippled thousands of computers on the Internet. Last February, the same kind of flaw was found in the popular Mosaic program created by the University of Illinois. But that strain of the flaw was more serious than its latest appearance because it affected the computers that store many users' credit-card numbers. Now experts are discovering that the flaw shows up in other so-called Web browsers such as Links and Arena. "We're so glad that the network dog dances, we don't realize that it's rabid," Mr. Cheswick said of the programming quality of many software packages. Marc Andreessen, vice president of technology at Netscape, said the company will issue fixes for the recent glitches later this week. He added that it's unclear whether anything other than temporarily crashing a user's computer could result trom the recent flaw. But, he said, once users adopt the modified software, "this won't be around long enough to cause a problem." Some, however, worry that another variation of the flaw will prove more difficult to cope with in the coming months. Bruce Fancher, president of Phantom Access Technologies Inc., operator of the Mindvox Internet access service, said a variation of the security hole has been found in several Unix software packages, which run on thousands of Internet computers that contain user's credit-card numbers and other personal information. It could cause far more damage than the Netscape flaw, he said. "This is going to be a big problem," warned Mr. Fancher, adding that he's been told that hackers are already devising software toolkits to exploit the hole. "This flaw is an easy mistake to make, but it's also easy to fix," he said. The latest flaw came to light early Friday morning when a reader of the Cypherpunk mailing list discovered the glitch and posted a message to the Internet. Basically, the software on an end-user's machine allows for commands that are too long, letting an intruder tack on an extra line of damaging code that could crash the computer. Instead, the software should verify the length of the commands that computers accept. Security buffs concede that the recent round of security glitches found in several pieces of software, including a virus found in Microsoft Corp.'s Word program and security problems at Amefica Online Inc., has shaken confidence in electronic commerce. But they say the publicity brings to light problems that will ultimately make software more secure. Richard Lethin, a graduate student at Massachusettes Institute of Technology who participates in the Cypherpunk discussion, said: "This technology for electronic commerce is ultimately going to be real important, but there might be some hiccups at the start." [End]

1 0

(Another) WSJ article
by dmandl＠panix.com 17 Dec '03

17 Dec '03

Netscape Software for Cruising Internet Is Found to Have Another Security Flaw Another security flaw that has long plagued the Internet has been found in software by Netscape Communications Corp. and others, raising concerns for the privacy and safety of information on the global computer network. The flaw in Netscape's popular Navigator software, which helps users cruise the multimedia portion of the Internet known as the World Wide Web, is the third defect in the software discovered by the "Cypherpunks" discussion group in little over a month. [end of excerpt--it's a long article] The article quotes William Cheswick and Rich Lethin, and mentions the cypherpunks several times. --Dave. -- Dave Mandl dmandl(a)panix.com http://wfmu.org/~davem

1 0

Re: Real issue of crypto controls: security or taxation loss?
by Dan Geer 17 Dec '03

17 Dec '03

as you say, Sun Tsu (from memory): select the battleground where you are strongest and the enemy is weakest. which is good advice. i recall Tzu also saying that you need to use the enemy's momentum to your advantage, the principle of judo if you will. in parallel, revolutionaries of many stripes have found that "heightening the contrast" is necessary if you mean for real change to occur. which brings me to ask, rhetorically i suspect, how we might heighten the contrast. i'd suggest delegating to some of us a support-the-bill effort complete with a detailed description of how the transmorgrified proposal that makes illegal all sorts of now ordinary acts. * you can't talk on the phone in a language the surveillance folk don't know (witness Compuserve's prohibition of Welsh on their otherwise monitored bulletin boards) * cryptographic door locks are now illegal without escrow (witness the SecurID-equipped door knob) * contracts that are transmitted over electronic means including facsimile must not be encrypted unless the keys are made available (witness the proliferation of safe fax machines) * no end-to-end encrypting cellular telephones may be used even if you are talking to someone in an otherwise hostile country (witness the formal industrial espionage of some countries) * passwords that map directly to encryption keys must therefore be escrowed (witness nearly everything but start with all the Kerberos derivatives including new NT stuff) * banks have to ensure that encrypted materials put into their safety deposit boxes are escrowed (sue somebody for the keys in their box naming the bank co-defendant for failure to escrow) * the attorney client privilege will not apply to my whispering my key to him/her, i.e., if i tell my attorney my key they are now my escrow agent even if it means violating the sanctity of the private conversation (witness i-don't-know-what but call Kevorkian to enlist him) * outlaw anonymous trading and the firms that provide it on the grounds that these represent encryption-of-names (witness the rules requiring such trading under some circumstances and the convention for others) in other words, shift the weight of who is radical to them. wrap ourselves in the flag deep within the big-government-sucks camp. march on the capital dressed as skin heads demanding the end of privacy for some sorrowful group or other. send the kind of letters that get you into trouble with the Secret Service but send them encrypted in Bill's private key (which you can issue him whether he likes it or not). mau-mau the flak catchers... --dan

3 2

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp hash cut reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"crown"} = "<mixmaster(a)kether.alias.net> cpunk pgp hash latent cut mix ek reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)spook.alias.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"gondolin"} = "<mixmaster(a)gondolin.org> cpunk mix hash latent cut ek ksub reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; $remailer{"ncognito"} = "<ncognito(a)gate.net> cpunk"; $remailer{"precip"} = "<mixmaster(a)mix.precipice.com> cpunk mix pgp hash latent cut ek reord"; $remailer{"ecafe"} = "<remail(a)ecafe.org> cpunk"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. News: the remailer list has been rewritten, and the new version is live! It should be more accurate, reliable, and faster than before. Penet is back up! Enjoy. remailer email address history latency uptime ----------------------------------------------------------------------- robo robo(a)c2.org ##*#####+### 1:51 99.99% hroller hroller(a)c2.org ########+### 1:47 99.99% syrinx syrinx(a)c2.org -+++--+--+-+ 51:38 99.98% ford remailer(a)bi-node.zerberus.de +*--*++**+*# 16:30 99.98% mix mixmaster(a)remail.obscura.com ._..-+.-++- 4:38:15 99.98% crown mixmaster(a)kether.alias.net --++------++ 1:51:07 99.97% alumni hal(a)alumni.caltech.edu *+##+*-*##*# 6:32 99.97% gondolin mixmaster(a)gondolin.org --_.-+---+** 3:26:27 99.96% hacktic remailer(a)utopia.hacktic.nl ++****+***** 9:35 99.95% ecafe remail(a)ecafe.org *--** 35:01 99.95% bsu-cs nowhere(a)bsu-cs.bsu.edu **#+*# #*#+# 7:02 99.83% replay remailer(a)replay.com ++***- +**+* 10:10 99.75% flame remailer(a)flame.alias.net ++**++ ***** 25:42 99.74% extropia remail(a)extropia.wimsey.com ----.-.-.-- 12:36:15 99.63% rmadillo remailer(a)armadillo.com +++ + ++ ++ 51:06 99.29% spook remailer(a)spook.alias.net ----------- 2:55:48 99.14% portal hfinney(a)shell.portal.com #+####-## # 5:37 98.89% ideath remailer(a)ideath.goldenbear.com ---+__.-.- 12:16:28 98.18% penet anon(a)anon.penet.fi * + - - ++ 3:46:46 94.95% c2 remail(a)c2.org *+ * +- +++ 49:41 94.46% vishnu mixmaster(a)vishnu.alias.net +++-+++ *+* 23:25 93.99% rahul homer(a)rahul.net *#+#*****#*# 1:21 99.99% ncognito ncognito(a)gate.net ++ 6:59 9.32% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Key signing at Miami Convention
by Michael Taht 17 Dec '03

17 Dec '03

I am giving an internet security seminar at the "The Internet and World Wide Web" Conference at the Miami Hyatt Regency, tomorrow, tuesday, Sept 26, all day. I'll be armed with a laptop if there are folk attending that want to sign and exchange PGP keys. ________________ Michael -- Michael Taht | "You got me hummin" - B. Joel VP, Technical Stuff | "Ain't nobody's bizness" - Taj Mahal mike(a)icanect.net | "I'm from the government, http://www.icanect.net | I'm here to help" - Anon

1 0

Feinstein for governor! Good news for the US, bad news for CA
by Declan McCullagh 17 Dec '03

17 Dec '03

*26 CALIFORNIA: LAYING THE GROUNDWORK FOR NOT RUNNING? Sen. Dianne Feinstein (D), in a "rare interview regarding her political future, spoke glowingly of the chance to return home" as the state's next gov., calling it a "very attractive" possibility. "At the same time, Feinstein said she enjoys her work in the Senate more than ever before and that her 'effectiveness can grow on a national level'" if she remains in DC. Throughout the 45-minute interview with the San Francisco Chronicle, Feinstein "appeared deeply torn over her choice. Despite the urgings of some fellow Democrats to speed her decision, Feinstein said it may be several months before she declares her intentions. ... The key conflict appears to be Feinstein's interest in becoming governor versus her reluctance to endure a grueling campaign." Were she to run, Feinstein said the "cornerstone of her campaign would be a plan to fundamentally restructure elementary education." At the same time, Feinstein "sees her effectiveness building in the Senate": "I actually like the Senate much more now than I did initially. I'm more accustomed to its eclectic proceedings and rules and think I can work on both sides of the aisle." The legal filing deadline to enter the 6/2/98 primary is 2/9/98, "and Feinstein said that if she chooses to run, she could wait until the last moment to file." Feinstein "brushed aside the notion that uncertainty surrounding her candidacy is freezing the field": "It's unrelated to me. There's plenty of time. ... It is important at this stage that there be a strong Democratic governor with a sense of where this state needs to go. And it doesn't necessarily have to be me" (Sandalow, 9/12).

1 0

JAV_jiv
by John Young 17 Dec '03

17 Dec '03

9-25-95. NYPaper: "Making the PC Come Alive. A Software Language That Puts You in the Picture." By John Markoff A new computer language known as Java is an emerging technology that many industry experts expect to be the next big thing in computing. Just as popular World Wide Web "browser" software like Netscape has transformed the Web from a scientist's research tool into a consumer medium over the last two years, many computer industry researchers and executives predict that the Java programming language will transport the Web to the next level. JAV_jiv (17 kb)

1 0

Re: unSAFE won't pass?
by Will Rodger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Peter asked me to forward this. Here he makes a valuable point on political organization - something which helps explain why some people are more dire in their tone regarding the state of things here in Washington. Below's what he wrote. W. At 10:31 PM 9/14/97 -0400, Will Rodger explained his view that: >>It may make for good copy, but I think it's just fantasy to think >the >>>administration or their opponents, for that matter, will get what >>>they want this year. Let them swarm. Who cares. >>> >>>At earliest, August of 1998 before anything passes - and even that >is >>>highly optimistic. In politics, unfortunately, you often have to act *as if* the other side is going to win soon. If you don't, they might. A great example was the 1986 Tax Reform Act. Everyone knew that it was too complicated for Congress to understand. Everyone knew that there were lots of powerful opponents to its elimination of many tax loopholes. But the darn thing passed anyways. Even supporters were shocked. The story is told in a very well-written book, "Showdown in Gucci Gulch." When considering what Congress will do, remember that there are 12,000 bills a year introduced in each chamber. Crypto is only one of many, many issues the Members of Congress need to consider. When things get too complicated, a politician might think it's just easier to go along with law enforcement. How many politicians lose by being tough on crime? As for the 1996 Telecomm Act, it's a bad example of what's likely to happen with crypto. That Act was fought between truly enormous companies -- RBOCS, AT&T, cable, etc. Those companies had enormous Washington offices fighting a life and death lobbying battle for years. In crypto, the good guys have nothing like the same lobbying resources. Unlike Telecomm, the very largest existing companies in the country will not lose billions next year if a bad crypto bill is passed. In short, it is quite possible that nothing will pass before August, 1998. It is quite possible by then that the issue will seem politically hot, and thus be dropped so close to an election. But the FBI position might win if we don't act *as if* mandatory key escrow is a real possibility. Peter Prof. Peter Swire Ohio State University College of Law mailto:swire.1@osu.edu http://www.osu.edu/units/law/swire.htm (revised site now includes publications and Internet Privacy Page) -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNB1kfNZgKT/Hvj9iEQK7AgCePoF1G6fB1GhTTinh5U5pa1Q+t48An2gk RFszr9K29WkugUzhmyitgTG1 =Y4HO -----END PGP SIGNATURE----- Will Rodger Voice: +1 202-408-7027 Washington Bureau Chief Fax: +1 202-789-2036 Inter@ctive Week http://www.interactiveweek.com A Ziff-Davis Publication PGP 5.0: 584D FD11 3035 0EC2 B35C AB16 D660 293F C7BE 3F62 PGP 2.6.2: D83D 0095 299C 2505 25FA 93FE DDF6 9B5F

1 0

New Developments in Fascist Mind Control
by The Real Guy 17 Dec '03

17 Dec '03

I have some amazing news to report! After considerable research, I have developed two technological tools which can be used to manipulate and control the minds of practically all living humans. One tool serves the purpose of seizing control of the individual's attention and putting them into a hypnotic state of consiousness where they can be manipulated into a narrow mind-set. The other tool is designed to store and analyze a wide range of data about every aspect of an individual's life, in order to enhance the effectiveness of the first tool. While I initially had worries that these two tools might possibly be used by people with bad intentions to seize control of mankind and enrich themselves beyound belief, I found, after closer study, that the two tools I have invented already exist, and have not been used for these evil ends, to date. Since TV's and Computers have not been abused, so far, in an attempt by those greedy for power and money to manipulate the people into a position where they can be enslaved and oppressed, I feel that there is no possibility of this happening in the future, despite the ravings of a few wild-eyed conspiracy theorists. I mean, get real, eh? The Real Guy

1 0

`Random' seed.
by Richard Martin 17 Dec '03

17 Dec '03

Vaporware which I heard around CFP '95, and have been sort of wondering about ever since... Some one told me that some one else [possibly Matt Blaze] had been looking at how much randomness could be got by forking two child processes which would just run as asynchronous clocks: whenever the parent program needs a little `random' bit, it queries both and gives (clock(A) + clock(B) % 2) or something. Questions about this [to the list]: * who has done any [the?] work on this? * was it found to be useful/good or not? * what would be the drawbacks to adding this [Yet Another Source Of Entropy] to the Netscape scheme? frodo =) -- Richard Martin Alias|Wavefront - Toronto Office [Co-op Software Developer, Games Team] rmartin@aw.sgi.com/g4frodo@cdf.toronto.edu http://www.io.org/~samwise Trinity College UofT ChemPhysCompSci 9T7+PEY=9T8 Shad Valley Waterloo 1992

3 4