December 2003 - cypherpunks-legacy

articles
by sameer 17 Dec '03

17 Dec '03

If you could, please send me the name of the reporter and contact information for any articles you see regarding the netscape hack. Thanks, -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 An Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

3 2

Re: Caribbean Internet Services?
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> (Yes, there have been more hurricanes this year than in most years...not > clear if it's just a Poisson fluctuation, or symptomatic of deeper weather > pattern changes.) > See September 95 Popular Science, article, "Hurricane Alert" in which the worlds leading hurricane scientist says that we're only just seeing the beginning of several years of large numbers of large hurricanes. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Fundamental Netscape hack
by Bill Stewart 17 Dec '03

17 Dec '03

Of course, one of the most serious security problems with Netscape servers is that they run on machines sitting out there on the Internet where anybody who can browse their services can attack them - that 128-bit bullet-proof iron-clad front door isn't much help if the garage door is unlocked because of some sendmail bug. For most web applications, the big security need is to send a chunk of encrypted data to some server that will decrypt it and get you credit-card number or whatever, but the standard SSL and S/HTTP protocols want to decrypt the data to plaintext on the Web server before it can do anything like that. (OK, I guess this doesn't win me a T-Shirt, since enough other people have said similar things, but do I at least get a gif of the shirt and a crayon so I can roll my own? :-) Good work, folks! #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

3 2

Re: Intellectual Property and Crypto collision
by cme＠acm.org 17 Dec '03

17 Dec '03

>Date: Sun, 17 Sep 1995 13:20:06 -0700 >From: John Gilmore <gnu(a)toad.com> > >> ELECTRONIC MEDIA PROTECTED UNDER COPYRIGHT LAW >> A presidential task force has recommended that electronic transmission of [...] > >Would this make it illegal to produce tools for decrypting key-escrowed >software? :-) Yup -- except you will have volunteered. See the Feynman account (citation in http://www.clark.net/pub/cme/html/censor.html ) - Carl

1 0

Cypherpunks Hold a Cracking Party
by Duncan Frissell 17 Dec '03

17 Dec '03

Just to let everyone know that I've got an assignment from Wired to do a story with the above working title. Since Wired is monthly it will be feature rather than news but will give a bit of an inside look at the process. I will be hitting various people up for help and would appreciate it if you send any URLs on the SSL and other such cracks to me. DCF "The freedom of the press belongs to the man who owns one."

1 0

Re: (Yet Another?) Netscape Crack Web page
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:31 PM 9/19/95 +0200, Laurent Demailly wrote: > >I've been waiting to see here an annoucement of some web page toward >which direct ppl that want more infos on the great (congrats) job Here are some URLs I've collected: http://pauillac.inria.fr/~doligez/ssl/press-conf.html SSL challenge virtual press conference http://www.brute.cl.cam.ac.uk/users/pb/ Piete Brooks home page http://dcs.ex.ac.uk/~aba/ Adam Back's home page http://dcs.ex.ac.uk/~aba/brutessl/ Index of /~aba/brutessl/ http://www.brute.cl.cam.ac.uk/brute/ brute page DCF

1 0

Re: NYT on Netscape Crack
by Andrew Loewenstern 17 Dec '03

17 Dec '03

John Markoff in the NYT said: > The company said it would release a repaired version of the > software within a week. Does this sound to anyone else like a pretty short amount of time to code and test a decent source of entropy for the PRNG? <...and someone else said it should be out in a day or so!> Jeff Weinstein writes: > Regardless of what Markoff implies, we do not intend to depend > on security through obscurity. Oh, can we now expect to see source to at least the security portions of Navigator and the Commerce server? andrew

1 0

WebSTAR "challenge"
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

>From TidBITS#295/18-Sep-95 >**This is a test. This is only a test.** The folks behind the book > _WebMaster_Macintosh_ have set up a contest to determine how > secure Macintosh web servers really are. They've put up a Web site > running WebSTAR with a "target" file that contestants must try to > retrieve. The first person to retrieve the file wins a year's > subscription to MacTech Magazine and a free pass to the next > WebEdge conference, and the next two people receive free WebEdge > passes. If the challenge of breaking WebSTAR's security isn't > sufficient, there's a second Mac connected to the first via > Ethernet. This second Mac doesn't run TCP/IP, only AppleTalk, and > holds a second target file; retrieving it wins you three free > WebEdge passes. The hope is that these tasks will prove > impossible, however, should someone break in, that's also useful > since it will help StarNine and Apple plug security holes. Contest > rules and details are at: [ACE] > >http://www.webmastermac.com/security/

1 0

SFChron
by sameer 17 Dec '03

17 Dec '03

'Security Hole Found in Netscape Software' C1.4 C4.1 Choice quotes: "But the breach raises the issue whether Netscape's software...will ever be safe enough..." "Mike Homer, vice president of marketing for Netscpae, said that recent breaches do not mean the products are flawed" "But if Netscape thinks one patch is all it will take, they are mistaken, said Sameer Parekh" -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 An Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

Verification of Random Number Generators
by Erik E. Fair 17 Dec '03

17 Dec '03

At 2:20 9/19/95, Eric Young wrote: >Now I had not noticed this, my library runs like a charm and things >appear random from the random number generator. This sort of error can >only be checked by reading the code and specifically looking at critical >routines like this the RNG seeding routines. The advantage of my code >being public is that some-one like Mike can have a look and pick up >problems like this. >The moral of the story I suppose is to be >paranoid about checking routines relating to RNG. Just an idle thought: it might be possible to do a probabalistic verification of a RNG by sampling it over some number of samples, and statistically analyzing the sample space. This would be analysis under the model of "RNG as black box" as opposed to (or rather, if you're smart, in addition to) code inspection & review. Any statisticians among us? Erik Fair

2 1