December 2003 - cypherpunks-legacy

Re: 50 attacks... [NOISE]
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DGpCsv.9r5(a)sgi.sgi.com>, fc(a)all.net (Dr. Frederick B. Cohen) writes: > And how secure is the hash? It it possible to create values that will > hash to each prime (or something else that does the job)? Is the hash > something we can figure a way to precompute using massively parallel > processing so that we can then provide a set of codes which will produce > the desired results? (etc.) Perhaps you should consider learning something about cryptography before you cast aspersions on someone else's cryptographic protocols. To date, MD5 appears to be a secure hash. If you manage to find a way to reverse it, please let us all know. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

1 0

Re: Netscape rewards are an insult
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DGq01x.ADx(a)sgi.sgi.com>, Aleph One <aleph1(a)dfw.net> writes: > On Thu, 19 Oct 1995 anonymous-remailer(a)shell.portal.com wrote: >> > NETSCAPE CLIENT APIS (NCAPIS) 2.0 >> Generally, we don't routinely trust every other computer, foreign or >> domestic on the Internet to manipulate us by remote control. This is >> as basic as the idea that we don't give out our PIN numbers with our >> banking cards to anyone who asks us. > Have you actually read the stuff? The NCAPIS is not on by default. > You *must* enable it by tellling it to which port to listen on. > Further more Mosaic had a remote control API before Netscape did. They can also be used only from the local machine on Windows or from any machine your X server trusts on Unix. Unless the attacker can control what software is installed on the target system, there's no way for him to use this to his advantage. Of course, there's always the possibility of exploting bugs, but that's not a "flawed algorithm". -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

1 0

Dr. Fred
by rah＠shipwright.com 17 Dec '03

17 Dec '03

While Dr. Fred may have a (diminishing) few defenders left on this list, I have found that <Plonk!>ing him was useful, at least until his latest series of trolls stirred up the unaware. I agree with the people who say that if he's ignored, he'll go away. After all, it has worked before, yes? Prove to me it won't work. ;-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: 1(800)MY-ANI-IS
by amp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Date: Friday, 20-Oct-95 07:58 AM From: John McGough \ Internet: (john.mcgough(a)mail.industry.net) To: amp \ Internet: (alan.pugh(a)internetmci.com) Subject: 1(800)MY-ANI-IS JM> Looks like MCI is looking for a authorization code during that JM> tone. Do you have any idea how many digits is standard on their JM> stuff? Or better yet, if you figure it out, please let me know. JM> I'll do the same. while i wouldn't be at liberty to get you a valid code, (i'm not sure of the number of digits it wants as i haven't gotten mine yet), i would suggest you call one of mci's customer service centers and _politely_ request that they allow access to this service to non-mci employees. i would suggest that they put some kind of message on the number before they give you the ani like "this service provided by mci." i would see this as a good public relations tactic for the company for telecom-type folx who would be using it. my 2 cents. unfortunately, i don't speak for my company. amp <0003701548(a)mcimail.com> <alan.pugh(a)internetmci.com> PGP Key = 4A2683C1 PGP FP = A7 97 70 0F E2 5B 95 7C DB 7C 2B BF 0F E1 69 1D October 20, 1995 10:11 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMIeuJCgP1O9KJoPBAQEEqAf8DAWR7BJ3SmuPNlXLpgdSmx/lPHFEQlU0 y71SR2D9h5S8cVlhWxpG/vPutCOVRwriLZD4/CP0AwOftm6LuqXY1O6o8B4us8OC BeqAvm5iQRDZ1xyPHofT0vjxytUp40SQ08mvYsCYxDTFZIvlgx8dk4O/Pt8Kt0Ka kDzkKHG3t/cJbr5oDjPtLNqUz4GrQY75qemxb1j/GvwEauC5+/pDaaqrzuQiwgB3 sMqBiyCqNflL/IxhKvxA5gKBXAzQoUuX7JZm5E52gWKPHEmx1OuceTPxYupcqmnv 6s2pBpXrE8WvpKAyrFkBxhv0EUhdu2FqSOns4VMPAqk8lHlAsxTh3w== =D7Uw -----END PGP SIGNATURE-----

1 0

Denver area meeting, SUNDAY, 10/22, 2 pm
by adwestro＠ouray.cudenver.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- As usual, we'll congregate in the food court in the basement of the Tivoli, and probably wander to a nearby restaurant when we have a quorum. I'll try to remember to bring my newly acquired copy of _SOLVING CIPHER PROBLEMS, Cryptanalysis, Probabilities, and Diagnostics_, by Frank W. Lewis, for perusal by anyone interested in classical cryptanalysis. Email for directions, additional info, etc. Alan Westrope <awestrop(a)nyx10.cs.du.edu> __________/|-, <adwestro(a)ouray.cudenver.edu> (_) \|-' 2.6.2 public key: finger / servers PGP 0xB8359639: D6 89 74 03 77 C8 2D 43 7C CA 6D 57 29 25 69 23 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIexV1RRFMq4NZY5AQFk0gP/YJpNdaD9LP0/u+fkkGHV1DdQ2X0Zxb/U 263M6fn3aoe0voEjfgH791SeHuhbQcuK30SaeVbn59tZDbbMmiZi9qFp5wUwFxVZ c27pkR9cCs0jKwPSuuofMWqKCMuWjuQdHRFtpAUSSq0QG8VUCnKh7Imda2TXGI4D t0pRiz2JGe4= =X3HL -----END PGP SIGNATURE-----

1 0

Verisign and MITM
by sameer 17 Dec '03

17 Dec '03

I recently submitted a certificate request to Verisign for my SSL web server. Looking over the process, I don't see how it avoids MITM in any way. The process: A) I send to netscape-cert(a)versign.com the email address and phone number of my webmaster (me) along with the cert request, generated using SSLeay's 'req' utility. B) I fax to Verisign a request letter saying "I have a right to use the name Commmunity ConneXion, etc." and proof of right to use name. (Berkeley biz liscense and Alameda Cty. fictitious bizname statement, in my case.) C) I snail mail them the same thing. I don't see any mechanism in place to avoid an MITM subverting step (A), and putting in his cert request in there. There isn't a strong cryptographic unforgeable relationship between my usmail/fax/proof request and the emailed kx509 cert request. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 1

Re: digital cash and identity disclosure
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DGqtsp.1L(a)sgi.sgi.com>, Holger.Reif(a)PrakInf.TU-Ilmenau.DE (Holger Reif ) writes: > Scott Brickner writes: >> Andreas Bogk writes: >>> But as far as I got Chaums idea, Alice would not reveal Bobs identity, >>> but rather her own. Am I missing a point here? >> >> You're right. Tim's wrong. Bob can't spend the money Alice gave him >> without depositing it in the bank and getting new money issued. Each >> coin has "This money was issued to Alice" as an invisible imprint which >> only shows up when two coins with the same serial number are together. > I don't understand how this could happen? The two coins are identical > (as I understood it from the tech backgound of ecash). what has a double- > spended coin what a copied single-spended coin not has? > Forgive if I missed relevant postings to this subject since I only read > parts from the list offline. The process of spending a coin is not simply that of transfering data. There is a complicated protocol in which Alice decrypts some of the identity information in the coin. Let's say that Alice spends the coin twice, once with Bob and again with Chuck. Bob and Chuck can pool the information they got from Alice and reconstruct her identity. Alice can't just give them both the same information because the receiver is the one who determines what information is decrypted. For a more detailed explanation, check out Schneier's book. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

1 0

Re: Postscript and 50 ways [MAJOR NOISE] [long]
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

I too had to put up with Dr. Fred on the firewalls list. I don't see what you hoped to accomplish by posting this off-topic mean spirited stuff to cypherpunks though. There are many others here that are also on firewalls, and we've let Dr. Fred speak for himself. Everyone has already formed the opinions they'll likely have, and it seems the only purpose of your tirade is to mean-spiritedly kick a man when he's down. It doesn't reflect well on you, it wastes our time, and is a bit sickening. Were you one of the people making the geek dance in high school too? I really wish you'd apologise to the list for this crap. We're here to discuss cypercoolness, not flame people, (whether they might seem to invite it or not). Lately this list has turned into a flame the geek list. It's not quite the fun it once was, and it's embarassing to watch. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: Postscript in Netscape
by James A. Donald 17 Dec '03

17 Dec '03

At 07:56 AM 10/18/95 -0400, Dr. Frederick B. Cohen wrote: > WRONG!!! Netscape claims to be "secure" - hence it is Netscape's job to > be secure - regardless of the user's use of their product. Otherwise, > the ads should read: Warning: This bullet proof vest will not protect you if you take it off and stand in front of a gun. If you download a virus infested executable using netscape and execute it, what do you expect? --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

"power one time pad"
by Paul Koning 1695 17 Dec '03

17 Dec '03

I'd be interested in reactions to the article in Network World, 10/16/95 issue, page 53. It describes a supposed cryptosystem that sounds bogus, but I can't make up my mind about how much is the system and how much is the confusion of the author. Among other things, it says that POTP "doesn't use an encryption algorithm; instead it synchronizes random processes on two computers as they communicate". (I wonder if the author understands that that's just another way to describe encryption algorithms...) The other claim is that it eliminates the need to manage keys. "... there is no need for central servers where PGP keys ... are kept". This seems like a strange claim because of course PGP doesn't require central servers, but more importantly, you can't do authentication without at least one piece of keying data being established out of band. That could be a certification authority public key, but you need something to get started. Supposedly this thing was shown at Interop. Did anyone see it, and does the product make sense even if the article didn't? (One thing that disturbes me about the product name is the use of the phrase "one time pad". Since the "random" processes are presumably not random but rather pseudo-random, there is no one time pad involved at all, but rather a plain old stream cypher of some sort, which may or may not be secure in practice but cannot have the "secure from first principles" property that real one time pad has.) paul (pkoning(a)chipcom.com)

4 3