December 2003 - cypherpunks-legacy

Some anti-GAK reverse-FUD ?
by Lou Poppler 17 Dec '03

17 Dec '03

Today's NY Times has a long article about how easily personal information can be extracted from various kinds of computers and networks. (URL below) This snippet illustrates nicely one of the dangers of trusting information to "legitimate" law enforcement. -- Begin quoted text: -- [...] In a 1997 New Year's letter to "friends and clients" of Investigative Group International Inc., one of the best-connected Washington investigative agencies, the chairman, Terry Lenzner, noted "increasing interest by clients seeking to protect themselves from negative campaigns," including those by "so-called 'whistle-blowers,"' unions and regulatory agencies. [...] The promotion brochure features veteran investigative reporters who now work for IGI. Their role adds a new dimension to the long-revolving door between law enforcement and private investigations. IGI's staff, for example, includes former top officials of the Drug Enforcement Administration, the FBI and Germany's national police force. Meanwhile, Ray Kelly, who had been chief of police in New York City before joining IGI to run its New York operations, now heads the Secret Service, the Bureau of Customs and the Bureau of Alcohol, Tobacco and Firearms. Such ties, along with IGI's assignment from the Democratic National Committee to probe its campaign-finance mess, inspire some critics to liken it to President Clinton's private CIA -- a characterization that Lenzner, who was a lawyer for the Senate Watergate committee, vigorously rejects. [...] full article is at: http://www.nytimes.com/library/cyber/week/091597privacy.html

1 0

RSA/Cylink arbitration agreement on-line
by Brian A. LaMacchia 17 Dec '03

17 Dec '03

[I haven't seen this mentioned yet on the list...] Cylink has been kind enough to put a copy of the arbitration panel's decision on their web page. Cylink's home page is www.cylink.com. The URL for the actual agreement is: http://www.cylink.com/arbtrn_1.html Spin doctors aside, it doesn't look like either company gained much over the other. I'm not an attorney, but the way I read the agreement RSAREF can continue to be used without violating the Stanford patents. RSA DSI cannot *sublicense* the Stanford patents to third parties, but can *sell code* that practices the methods claimed in the Stanford patents. That code can then be incorporated into other products, which is exactly what PGP 2.6.2 does (it's linked against a copy of the RSAREF library, which is covered by the RSAREF license agreement). --bal

1 0

Netscape flaw hits the big time
by Ed Carp [khijol SysAdmin] 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just heard on the CBS hourly radio news that Netscape will release a new version on Wednesday correcting a flaw that would "allow hackers access credit card numbers." As usual, they got it all wrong, but what do you expect? - -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/pager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi Q. What's the trouble with writing an MS-DOS program to emulate Clinton? A. Figuring out what to do with the other 639K of memory. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGa29CS9AwzY9LDxAQHJwAQAlCcmPauUPnBIpBx5e5ZZpdnQZk5dhEMe BMZe+aA+A0mZ6aqgiA8wzZyjbSkYMuzoUM+IQi4c4MraoWNXGAFfO+9dL4WMmdqI AMBk6WaIoiYjCjCd7SNxETlh4+BaWICul/04isiiLE345j6VgU2xGtJZT4UJMurf 6/dy7ztSYEQ= =P3jw -----END PGP SIGNATURE-----

1 0

Make Money With Your PC
by mailhost＠aol.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> ***************COMPUTER USERS NEEDED*************** $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Set Your Own Hours. Earn $20,000 to $50,000 per year. $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ If you presently own your own Macintosh or IBM compatible personal computer, this amazing work-at home program may be just for you. First, please understand this is not a get-rich-quick scheme, chain letter scam or anything else that makes the promise of getting something for nothing. However, this is a legitimate program that will reward those who do not mind hard work, with a substantial source of extra income. Our manual, 'Work at Home Using Your Personal Computer (c 1995)' will outline the 27 different areas that are the most needed and requested services. We then put you in direct contact with the actual companies in your local area that are downsizing and offering work. Today, many, many companies are streamlining due to economic pressure and the need for home-based workers is at an all-time high. Basic skills such as typing, data entry or word processing will allow you to earn between $10 and $15 an hour. More advanced skills such as medical billing, database management and bookkeeping earn $20 to $30 per hour and are a common occurence. Those with even greater technical skills, graphic design, desktop publishing, basic programming or web site design can earn between $30 and $45 per hour. This program comes to you with a 100% money-back guarantee. The package we send to you contains everything in writing. You will recieve the easy-to-follow, fact filled manual and software package only if you act now! This program is the perfect solution for housewives, students, the home-bound, as well as those seeking a solid second career. The easy-to-follow manual and software package comes to your for only $49.95 ---------------------------------------------------------------------- Look below to see how you can save $15 today! ---------------------------------------------------------------------- IMS 5201 Kingston Pike Suite 6-216 Knoxville, Tennessee 37919 YES, please rush the 'Work at Home Using My Personal Computer (c 1995) manual! ___________ I have enclosed $49.95 plus $4.95 shipping and handling. ($54.90 total) ___________ I want to save $10.00! I am ordering within 24 hours - I have enclosed $39.95 plus $4.95 shipping and handling. ($44.90 total) ___________ Please RUSH my order - add an additional $15.00 (OPTIONAL) I have enclosed (Check One): _____ Cashiers Check _____ Money Order _____ Personal Check SHIPPING INFORMATION Name:__________________________________________________ Telephone:_______-______-____________ Physical Street Address (NO PO BOXES please)__________________ _______________________________________________________ City:___________________________________________________ State:_________ ZIP:____________________________________ Your E-Mail Address (Needed for order confirmation)____________________________ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ SAVE AN ADDITIONAL $5.00!!! FAX YOUR ORDER NOW! Please tape your completed and signed check in the space below and fax to IMS. That facsimile number is 1-423-681-6520. ************************************* FAX: 1-423-681-6520 PLEASE TAPE YOUR CHECK HERE Please SIGN you check ************************************* Thank You For Your Order 2156887000908001546877 </FONT><FONT COLOR="#000000" SIZE=3>

1 0

WSJ on Netscape Hole 3
by John Young 17 Dec '03

17 Dec '03

The Wall Street Journal, September 25, 1995, p. B12. Netscape Software for Cruising Internet Is Found to Have Another Security Flaw By Jared Sandberg Another security flaw that has long plagued the Internet has been found in software by Netscape Communications Corp. and others, raising concerns for the privacy and safety of information on the global computer network. The flaw in Netscape's popular Navigator software, which helps users cruise the multimedia portion of the Internet known as the World Wide Web, is the third defect in the software discovered by the "Cypherpunks" discussion group in little over a month. Members of the Cypherpunk group, which includes mathematicians and hackers who discuss the security method of cryptography, last month broke Netscape's "key" that protects sensitive data by "brute force" -- the use of massive computing power. Last week, other members found a flaw that could let hackers essentially pick the lock in Netscape's software. Unlike the prior glitches, however, the latest flaw doesn't lend itself to the theft of multiple credit-card numbers. Instead, it could allow a savvy hacker to damage an Internet user's computer, such as crashing the computer or deleting files. "This is just another indication that Netscape isn't being careful," said William Cheswick, a security researcher at AT&T Corp.'s Bell Laboratories. Still, he said, the flaw goes well beyond Netscape. It first reared its head seven years ago when Cornell graduate student Robert Morris used it to create a "worm" that crippled thousands of computers on the Internet. Last February, the same kind of flaw was found in the popular Mosaic program created by the University of Illinois. But that strain of the flaw was more serious than its latest appearance because it affected the computers that store many users' credit-card numbers. Now experts are discovering that the flaw shows up in other so-called Web browsers such as Links and Arena. "We're so glad that the network dog dances, we don't realize that it's rabid," Mr. Cheswick said of the programming quality of many software packages. Marc Andreessen, vice president of technology at Netscape, said the company will issue fixes for the recent glitches later this week. He added that it's unclear whether anything other than temporarily crashing a user's computer could result trom the recent flaw. But, he said, once users adopt the modified software, "this won't be around long enough to cause a problem." Some, however, worry that another variation of the flaw will prove more difficult to cope with in the coming months. Bruce Fancher, president of Phantom Access Technologies Inc., operator of the Mindvox Internet access service, said a variation of the security hole has been found in several Unix software packages, which run on thousands of Internet computers that contain user's credit-card numbers and other personal information. It could cause far more damage than the Netscape flaw, he said. "This is going to be a big problem," warned Mr. Fancher, adding that he's been told that hackers are already devising software toolkits to exploit the hole. "This flaw is an easy mistake to make, but it's also easy to fix," he said. The latest flaw came to light early Friday morning when a reader of the Cypherpunk mailing list discovered the glitch and posted a message to the Internet. Basically, the software on an end-user's machine allows for commands that are too long, letting an intruder tack on an extra line of damaging code that could crash the computer. Instead, the software should verify the length of the commands that computers accept. Security buffs concede that the recent round of security glitches found in several pieces of software, including a virus found in Microsoft Corp.'s Word program and security problems at Amefica Online Inc., has shaken confidence in electronic commerce. But they say the publicity brings to light problems that will ultimately make software more secure. Richard Lethin, a graduate student at Massachusettes Institute of Technology who participates in the Cypherpunk discussion, said: "This technology for electronic commerce is ultimately going to be real important, but there might be some hiccups at the start." [End]

1 0

(Another) WSJ article
by dmandl＠panix.com 17 Dec '03

17 Dec '03

Netscape Software for Cruising Internet Is Found to Have Another Security Flaw Another security flaw that has long plagued the Internet has been found in software by Netscape Communications Corp. and others, raising concerns for the privacy and safety of information on the global computer network. The flaw in Netscape's popular Navigator software, which helps users cruise the multimedia portion of the Internet known as the World Wide Web, is the third defect in the software discovered by the "Cypherpunks" discussion group in little over a month. [end of excerpt--it's a long article] The article quotes William Cheswick and Rich Lethin, and mentions the cypherpunks several times. --Dave. -- Dave Mandl dmandl(a)panix.com http://wfmu.org/~davem

1 0

Re: Real issue of crypto controls: security or taxation loss?
by Dan Geer 17 Dec '03

17 Dec '03

as you say, Sun Tsu (from memory): select the battleground where you are strongest and the enemy is weakest. which is good advice. i recall Tzu also saying that you need to use the enemy's momentum to your advantage, the principle of judo if you will. in parallel, revolutionaries of many stripes have found that "heightening the contrast" is necessary if you mean for real change to occur. which brings me to ask, rhetorically i suspect, how we might heighten the contrast. i'd suggest delegating to some of us a support-the-bill effort complete with a detailed description of how the transmorgrified proposal that makes illegal all sorts of now ordinary acts. * you can't talk on the phone in a language the surveillance folk don't know (witness Compuserve's prohibition of Welsh on their otherwise monitored bulletin boards) * cryptographic door locks are now illegal without escrow (witness the SecurID-equipped door knob) * contracts that are transmitted over electronic means including facsimile must not be encrypted unless the keys are made available (witness the proliferation of safe fax machines) * no end-to-end encrypting cellular telephones may be used even if you are talking to someone in an otherwise hostile country (witness the formal industrial espionage of some countries) * passwords that map directly to encryption keys must therefore be escrowed (witness nearly everything but start with all the Kerberos derivatives including new NT stuff) * banks have to ensure that encrypted materials put into their safety deposit boxes are escrowed (sue somebody for the keys in their box naming the bank co-defendant for failure to escrow) * the attorney client privilege will not apply to my whispering my key to him/her, i.e., if i tell my attorney my key they are now my escrow agent even if it means violating the sanctity of the private conversation (witness i-don't-know-what but call Kevorkian to enlist him) * outlaw anonymous trading and the firms that provide it on the grounds that these represent encryption-of-names (witness the rules requiring such trading under some circumstances and the convention for others) in other words, shift the weight of who is radical to them. wrap ourselves in the flag deep within the big-government-sucks camp. march on the capital dressed as skin heads demanding the end of privacy for some sorrowful group or other. send the kind of letters that get you into trouble with the Secret Service but send them encrypted in Bill's private key (which you can issue him whether he likes it or not). mau-mau the flak catchers... --dan

3 2

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp hash cut reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"crown"} = "<mixmaster(a)kether.alias.net> cpunk pgp hash latent cut mix ek reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)spook.alias.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"gondolin"} = "<mixmaster(a)gondolin.org> cpunk mix hash latent cut ek ksub reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; $remailer{"ncognito"} = "<ncognito(a)gate.net> cpunk"; $remailer{"precip"} = "<mixmaster(a)mix.precipice.com> cpunk mix pgp hash latent cut ek reord"; $remailer{"ecafe"} = "<remail(a)ecafe.org> cpunk"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. News: the remailer list has been rewritten, and the new version is live! It should be more accurate, reliable, and faster than before. Penet is back up! Enjoy. remailer email address history latency uptime ----------------------------------------------------------------------- robo robo(a)c2.org ##*#####+### 1:51 99.99% hroller hroller(a)c2.org ########+### 1:47 99.99% syrinx syrinx(a)c2.org -+++--+--+-+ 51:38 99.98% ford remailer(a)bi-node.zerberus.de +*--*++**+*# 16:30 99.98% mix mixmaster(a)remail.obscura.com ._..-+.-++- 4:38:15 99.98% crown mixmaster(a)kether.alias.net --++------++ 1:51:07 99.97% alumni hal(a)alumni.caltech.edu *+##+*-*##*# 6:32 99.97% gondolin mixmaster(a)gondolin.org --_.-+---+** 3:26:27 99.96% hacktic remailer(a)utopia.hacktic.nl ++****+***** 9:35 99.95% ecafe remail(a)ecafe.org *--** 35:01 99.95% bsu-cs nowhere(a)bsu-cs.bsu.edu **#+*# #*#+# 7:02 99.83% replay remailer(a)replay.com ++***- +**+* 10:10 99.75% flame remailer(a)flame.alias.net ++**++ ***** 25:42 99.74% extropia remail(a)extropia.wimsey.com ----.-.-.-- 12:36:15 99.63% rmadillo remailer(a)armadillo.com +++ + ++ ++ 51:06 99.29% spook remailer(a)spook.alias.net ----------- 2:55:48 99.14% portal hfinney(a)shell.portal.com #+####-## # 5:37 98.89% ideath remailer(a)ideath.goldenbear.com ---+__.-.- 12:16:28 98.18% penet anon(a)anon.penet.fi * + - - ++ 3:46:46 94.95% c2 remail(a)c2.org *+ * +- +++ 49:41 94.46% vishnu mixmaster(a)vishnu.alias.net +++-+++ *+* 23:25 93.99% rahul homer(a)rahul.net *#+#*****#*# 1:21 99.99% ncognito ncognito(a)gate.net ++ 6:59 9.32% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Key signing at Miami Convention
by Michael Taht 17 Dec '03

17 Dec '03

I am giving an internet security seminar at the "The Internet and World Wide Web" Conference at the Miami Hyatt Regency, tomorrow, tuesday, Sept 26, all day. I'll be armed with a laptop if there are folk attending that want to sign and exchange PGP keys. ________________ Michael -- Michael Taht | "You got me hummin" - B. Joel VP, Technical Stuff | "Ain't nobody's bizness" - Taj Mahal mike(a)icanect.net | "I'm from the government, http://www.icanect.net | I'm here to help" - Anon

1 0

Feinstein for governor! Good news for the US, bad news for CA
by Declan McCullagh 17 Dec '03

17 Dec '03

*26 CALIFORNIA: LAYING THE GROUNDWORK FOR NOT RUNNING? Sen. Dianne Feinstein (D), in a "rare interview regarding her political future, spoke glowingly of the chance to return home" as the state's next gov., calling it a "very attractive" possibility. "At the same time, Feinstein said she enjoys her work in the Senate more than ever before and that her 'effectiveness can grow on a national level'" if she remains in DC. Throughout the 45-minute interview with the San Francisco Chronicle, Feinstein "appeared deeply torn over her choice. Despite the urgings of some fellow Democrats to speed her decision, Feinstein said it may be several months before she declares her intentions. ... The key conflict appears to be Feinstein's interest in becoming governor versus her reluctance to endure a grueling campaign." Were she to run, Feinstein said the "cornerstone of her campaign would be a plan to fundamentally restructure elementary education." At the same time, Feinstein "sees her effectiveness building in the Senate": "I actually like the Senate much more now than I did initially. I'm more accustomed to its eclectic proceedings and rules and think I can work on both sides of the aisle." The legal filing deadline to enter the 6/2/98 primary is 2/9/98, "and Feinstein said that if she chooses to run, she could wait until the last moment to file." Feinstein "brushed aside the notion that uncertainty surrounding her candidacy is freezing the field": "It's unrelated to me. There's plenty of time. ... It is important at this stage that there be a strong Democratic governor with a sense of where this state needs to go. And it doesn't necessarily have to be me" (Sandalow, 9/12).

1 0