December 2003 - cypherpunks-legacy

Re: Golden Coy Freeh
by mkj＠october.ducktown.org 17 Dec '03

17 Dec '03

PGP message

1 0

Re: cypherpunks press releases/contact list
by mkj＠october.ducktown.org 17 Dec '03

17 Dec '03

PGP message

3 2

"Notes" to be Eclipsed by "Netscape"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:52 PM 9/25/95, Jon Lasser wrote: >Perhaps the Notes pricing scheme is sooo outrageous (by the standards of >a student like myself, and probably most others, if it's still anything >like it was at the 1.0 release) that mostpeople have had zero opportunity >to examine the program, let alone really have time to play with it? I've never even _seen_ a copy of Notes running on any machine, nor do I know directly of _any_ of my colleagues who has. (Not saying nobody has, of course, just that I can't find anyone I know well who has.) I've been following the news on Notes for at least several years, even to the point of buying some Lotus stock several years ago on the strength of what I had read about Notes. (Alas, I sold it soon thereafter, before a run-up in price.) My point? Notes is nearly invisible in the non-corporate community I now hang out in. Who knows what weaknesses or bugs it has in it. Folks on our list probably don't have much familiarity with it. My hunch is that, as the "Wall Street Journal" reported yesterday, that IBM overpaid for Lotus, that the notion of Notes becoming the universal collaboration/communication option is flawed. (I've been saying for a while that the Web serves that purpose better, and that Web browsers will likely edge out Notes. Apparently I was hardly prescient, as Netscape recently bought Collabra, which is pushing that point exactly.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

SpokesPunking...
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 3:03 AM 9/26/95, Craig Hubley wrote: >"Consensus on cypherpunks seems to be that 40 bit encryption is not viable > for commercial applications, and that Netscape seems to have taken less > than due care to choose an appropriate random seed for its session keys." No offense offered Craig, 'cause I like reading your stuff here, but the concensus opinion on cypherpunks is "We don' need no steeenking spokespunk!". It seems to me that you can say that without any title, and the mouthier amongst us will be tapped for quotes as individuals anyway... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

Re: Hack Microsoft NT C2 Rating?
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:27 AM 9/26/95 -0700, todd(a)lgt.com (Todd Glassey) replied to Ray: >>So, if one can find bugs in NT's security, one can >>toss a little more egg on the NSA's face and the sham that part of >>their activies to *help* to secure american computers. A simple >>violation of NT's C2 status would be to demostrate a flaw in it's >>memory protection implementation. One of the bigger cracks on VMS was after it got its C2 rating; a strong system doesn't do you much good if you don't change the default passwords for the SYSTEM and FIELD service accounts :-) I'm more surprised by the rating since the Orange Book is basically for non-networked systems; Red Book rating is _much_ harder, unless the NSA's taking a different view of trustability of software encryption for authentication purposes than they used to. >As per NT's orange book C2 Rating... C2 is about the lowest level of Secure >that you can get. In fact I personally am unimpressed, rather it is a box >on an RFQ that gets checked. Very few people run C anything sites in reality. A C2 rating says that most of the obvious bugs have been found, access to the system and individual files requires authentication, and you can do an audit trail to find out who accessed what data when. Ignoring networks, that's not too bad. But, yeah, one of the big reasons for C2 rating is that government RFPs generally require C2 security, at least for military or sensitive non-military purchases. B-level ratings give you multi-level security, so you can run SECRET and CONFIDENTIAL on the same box; it's not a very useful security model for non-military applications, but does let you do a better-trusted job of system integrity. >IMHO - Military sites passing real classified data usually are not run on >anything as low as C2. If you want a secure os, look at the Harris Computer >Corp's B1-Certified version of ES/MP UNIX (they call it CX/SX). Hah. Maybe it's changed since I was working with the AT&T System V/MLS folks, but the vast majority of classified processing back then was done on unrated or C2 systems running System High - everybody's cleared, and the boxes with the classified stuff aren't connected to the outside except by limited sneakernet. You can get a _lot_ of security by keeping your computers in locked rooms, and the average PC of those days could fit in a big safe at night even if it couldn't fit in a locked file cabinet. (And floppy disks or external shoeboxes were easy to lock up.) Dan B. wrote >For fun ways to hack NT, check out http://www.somar.com/security.html. >Some of these are really laughable. You can use NT's LogonUser API >call to repeatedly guess passwords until you hit it, since NT offers >no way to limit number of login attempts. That's the kind of thing that would get changed for a C2 version, just as the Unix login program had to be souped up for C2 and B1. Even adding a constant delay, or an increasing delay after bad attempts, is a good start for systems like that. (It turns out that logging user names on bad attempts has to be done carefully to avoid increasing risk - if users get out of sync on typeahead when entering their login and password, you can end up logging passwords, which was especially bad when that sort of data got printed on the paper console...) #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

3 2

Re: Security Update news release
by Bill Stewart 17 Dec '03

17 Dec '03

>>Do the new versions use PGP's randseed.bin? If Netscape even only looks at >>data used to keep PGP secure, Netscape will be banned from my computer >>and every computer I am responsible for. -- For good. > >This is the second person who has expressed this sentiment. I don't >understand it. If you believe that the possibility of randseed.bin >getting out is dangerous, then why do you leave it online? Do you >really trust every piece of software you run, every piece of software >that can possibly access your machine over the net, to not look at >that file? It makes a little bit of sense - I'm not aware of any software, other than PGP and now Netscape, that _explicitly_ goes after randseed.bin, though of course just about anything can try. Assuming the code is inspectable (which it currently is), if I can see that all it's going to do with the file is crunch it into MD5 along with a bunch of other stuff, I'm not too worried, even though it is stealing slack(entropy) from PGP. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

2 1

First Payments WG Meeting Announcement
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

The World Wide Web Consortium is holding a Workshop on payments. The workshop is intended to be a small, technically oriented meeting of its payments working group. Although it is a members only event I am willing to listen to special pleading, alternatively companies may wish to join the consortium at our extreemely reasonable rates. See http://www.w3.org/pub/WWW/Consortium/ for details. -- Phillip M. Hallam-Baker Not speaking for anoyone else hallam(a)w3.org http://www.w3.org/hypertext/WWW/People/hallam.html Information Superhighway -----> Hi-ho! Yow! I'm surfing Arpanet! ANNOUNCE: First W3C Payments WG Meeting, October 11 ---------------------------------------------------------------------------- What: 1st W3C Payment WG Meeting Where: MIT EECS, Grier Room 34-401 (subject to change) When: Wednesday October 11, 9am - 5pm Who: W3C Member Representatives ONLY URL: First W3C Payments WG Meeting W3C is making progress on supporting electronic payments on the web. This WG Meeting has been called to foster discussion and feedback between W3C and its members. Discussion will focus on proposals to the W3C for payment protocols, interfaces, and e-commerce support. The agenda for the electronic payment workshop is still being settled. At the current time we have confirmed presentations by VISA, IBM, W3C, and the Financial Services Technical Consortium (FSTC). Additional invitations have been issued, and suggestions for additional presentations would be welcome. Contact Phillip Hallam-Baker (hallam(a)w3.org) or Jim Miller (JMiller(a)w3.org) with suggestions. There is a separate W3C Security WG Meeting at MIT on Tuesday, October 10th. Contact Rohit Khare for details (khare(a)w3.org) To RSVP for the Payments WG Meeting, email the coordinator, Phillip Hallam-Baker (hallam(a)w3.org) or call 617/258-5967 by 5 October. This workshop is aimed at technologists; please include a brief description of any relevant payments work you or your organization are involved in. This is a preliminary announcement of the date and time only. We have arranged for hotel rooms at the Kendall Square Mariott. To qualify for the MIT discount, notify Susan Hardy (susan(a)w3.org) For a review of the Consortium's plans, see W3C's report on Electronic Payment Schemes and the Third W3C Security Workshop.

1 0

Re: getting netscape to support the remailers
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> I started thinking about what it would take to get Netscape > to support sending mail through the remailers, after having > read the S/MIME specs which Netscape 2.0 is apparently going to > support. Perhaps with enough browbeating Netscape 3.0 will support > the remailers. Netscape doesn't need to support remailers explicitly since Netscape will be supporting Java. I think a remailer client is within Java's capabilities... Anyone disagree? andrew

4 3

[NOISE] Re: Easter Eggs
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:21 AM 9/26/95 -0400, you wrote: >I also think that in Netscape their existance is an >indication that the managment at Netscape is a bit less uptight than >management at some other places. Depends on the department. They have at least one manager at Netscape with a permenent case of high blood preasure. (He happens to be in charge of the support department.) >I didn't know about the FishCam Easter Egg, but I know that Netscape >has a couple of Easter Eggs related to the activity indicator in the >top right of the display. Typically this is the Big N logo with >animated meteors, etc. flying by when the window is active. One >Easter Egg temporarily turns this into a compass which spins to >indicate activity. Another causes the animation to show a dragon >(Mozilla) breathing fire for the remainder of the session. I won't >spoil your fun by telling how to find them. If he is not running X Windows, he is going to be searching along time for the Compass easter egg. You also need X windows to find the Mozilla animated icon hack on Jammie Zawinski's page. Which easter eggs that are available is dependant on which client you are running. obNetscapeHack: There is a feature called a "cookie file" in Netscape that is ripe for exploitation as a security leak. If you are using a Netscape server (and you may not even need that), you can feed all sorts of information into it without the user's knowlege. I have heard of one page that overloads the cookie file until the machine runs out of drive space. I am sure that there are other exploitable holes there... Any takers? | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

3 2

IBE_dam
by John Young 17 Dec '03

17 Dec '03

9-26-95. W$Japer: "On-Line Service to Assist Global Trade." A group of multinational companies is expected to unveil today an on-line service to businesses to engage in international trade. Dubbed IBEX, it is a joint effort of AT&T, Dun & Bradstreet, General Electric and the U.S. Chamber of Commerce to let businesses use on-line traffic to line up suppliers, negotiate contracts, make and receive bids, and arrange the delivery of goods and services around the world. IBEX expects the backing of Chase Manhattan, Microsoft, DEC and Simon & Schuster. The IBEX software allows companies to sign on and submit a request for goods or services, which is posted anonymously. The request could be styled using an array of categories offered by the service, including location, product category, payment and shipping terms. The customer would then receive bids from businesses hoping to land the contract. Once a bid is chosen, the identities of the businesses are disclosed and negotiations begin. IBEX allows them to attach documents such as confidentiality agreements, contracts and purchase orders. IBE_dam (5 kb)

1 0