December 2003 - cypherpunks-legacy

re: chaos cryptography
by Sherry Mayo 17 Dec '03

17 Dec '03

Duh! As someone pointed out to me in email I wrote "stenography" when I meant "steganography" in the intro to the New Scientist article. (Well I'm sure ou all knew what I meant) Sherry

1 0

Re: First Payments WG Meeting Announcement
by todd＠lgt.com 17 Dec '03

17 Dec '03

FYI- the FSTC E-payment Working Group meeting is happening at the W3 meeting on the day before the meeting itself. The meeting is being held at the OSF facilities. >The World Wide Web Consortium is holding a Workshop on payments. The workshop >is intended to be a small, technically oriented meeting of its payments working >group. Although it is a members only event I am willing to listen to special >pleading, alternatively companies may wish to join the consortium at our >extreemely reasonable rates. See http://www.w3.org/pub/WWW/Consortium/ for >details. > >-- >Phillip M. Hallam-Baker Not speaking for anoyone else >hallam(a)w3.org http://www.w3.org/hypertext/WWW/People/hallam.html >Information Superhighway -----> Hi-ho! Yow! I'm surfing Arpanet! > >ANNOUNCE: First W3C Payments WG Meeting, October 11 > >---------------------------------------------------------------------------- > >What: 1st W3C Payment WG Meeting > >Where: MIT EECS, Grier Room 34-401 (subject to change) > >When: Wednesday October 11, 9am - 5pm > >Who: W3C Member Representatives ONLY > >URL: First W3C Payments WG Meeting > >W3C is making progress on supporting electronic payments on the web. This WG >Meeting has been called to foster discussion and feedback between W3C and >its members. Discussion will focus on proposals to the W3C for payment >protocols, interfaces, and e-commerce support. > >The agenda for the electronic payment workshop is still being settled. At >the current time we have confirmed presentations by VISA, IBM, W3C, and the >Financial Services Technical Consortium (FSTC). Additional invitations have >been issued, and suggestions for additional presentations would be welcome. >Contact Phillip Hallam-Baker (hallam(a)w3.org) or Jim Miller (JMiller(a)w3.org) >with suggestions. > >There is a separate W3C Security WG Meeting at MIT on Tuesday, October 10th. >Contact Rohit Khare for details (khare(a)w3.org) > >To RSVP for the Payments WG Meeting, email the coordinator, Phillip >Hallam-Baker (hallam(a)w3.org) or call 617/258-5967 by 5 October. This >workshop is aimed at technologists; please include a brief description of >any relevant payments work you or your organization are involved in. > >This is a preliminary announcement of the date and time only. We have >arranged for hotel rooms at the Kendall Square Mariott. To qualify for the >MIT discount, notify Susan Hardy (susan(a)w3.org) > >For a review of the Consortium's plans, see W3C's report on Electronic >Payment Schemes and the Third W3C Security Workshop. Regards, T. S. Glassey Chief Technologist Looking Glass Technologies todd(a)lgt.com -----BEGIN PGP SIGNATURE----- Version: 2.6 iQB1AwUBMFu5E6gNRnWhagU5AQHI+gL+Mwpcd3lAWd8FF06qcG6rnLhIYveHW71a XC7xh1T0uu8qnYX31yMp17OG28jWpKUbWec1IM9/eXOi+gInA7rKICWczV8zo9Z0 0puxjRRN7yO4KfRb3cPpk+r0p6pDg01Y =bTYb -----END PGP SIGNATURE-----

1 0

weak links in the cyberbucks demo (was: weak links in DigiCash system)
by Bryce Wilcox 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Originally to Marcel van der Peijl at DigiCash. - ------- Forwarded Message To: "Marcel van der Peijl" <bigmac(a)digicash.com> Subject: weak links in the cyberbucks demo (was: weak links in DigiCash system) Date: Wed, 27 Sep 1995 19:20:16 -0600 From: Bryce Wilcox <bryce(a)colorado.edu> - -----BEGIN PGP SIGNED MESSAGE----- Marcel-- I'm sorry that my comments upset you so much, but I do not believe that they were unwarranted. It is true that the cyberbucks demo is insecure in some ways, such as using insecure e-mail. On the other hand your response that the demo is not about e-mail, it is about E-cash, and that you don't have the manpower to invest in making those extraneous things secure, is a good one and I am satisfied. The only thing I wish I had done differently was to make the title of the message "weak links in cyberbucks demo". There are, as far as I am aware, no weak links in the DigiCash system. I sincerely wish your company the best success, although I fear that MicroSoft and Visa and the like will successfully market inferior systems by use of their money and mindshare. In fact, a large part of the reason that I chose to sell BAP via a cybershop was to draw more attention to Ecash. I hope it is working. I guess if you have about a two-week queue for free cyberbucks, then maybe in a week I will get a whole lot of BAP purchases. :-) Regards, Bryce signatures follow To strive, to seek, to find and not to yield. bryce(a)colorado.edu http://ugrad-www.cs.colorado.edu/~wilcoxb/Niche.html - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Automatic PGP clearsigning under Unix with Bryce's Auto-PGP v1.0 iQCVAwUBMGn3/fWZSllhfG25AQEZegP/XMmoGuATQpfhBtNuIT/yUwFv9IL0+OXe auH1eMJ8d1PoWPJthrou7THpxkkOzJ0iV+GrTKS0n1dSQ2REbwk27SHsXce3LAEX JIy3rsKywTYuswH6aS361uaymPWusMr6ZhAeaegxnoSWnY3/Z2RlPCxDnhpROBsk vKgIf1mt8ww= =TRMS - -----END PGP SIGNATURE----- - ------- End of Forwarded Message -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Automatic PGP clearsigning under Unix with Bryce's Auto-PGP v1.0 iQCVAwUBMGn6PfWZSllhfG25AQHuUQQAtwozCJKKxq4dlOn6SpDHs5tGbhxRWozd NUjDxffgCL2FAINsrfKR9hOXqXztYD1hQGJ4jBE+uw6sD5gGYrGct5RVuG9X51Ua HTceFbqJHd6mc3ISTMusQwQDt9kJ2DmGXqV8nt4yI20uiPKZKDVizhAqg900xqGs 78NeZuvZ5cg= =3SxM -----END PGP SIGNATURE-----

1 0

Information, We want information
by todd＠lgt.com 17 Dec '03

17 Dec '03

I an immediate need of info on the liabilities of BSD type systems, and in particular the BorderWare products. I heard that in the BorderWare product itself, there are several recently discovered potential "holes"... I have a particular interest in both the Attack MO against the BSD platforms in general and the Border products in particular... Please do not send the reply to the lists but to me personally (todd(a)lgt.com) I will summarize if I get enough info to be worth the effort. Any comments? Thanks In Advance... Todd Glassey todd(a)lgt.com

1 0

Re: Microsoft & new Internet Security specs
by Marshall Clow 17 Dec '03

17 Dec '03

> [Company News on Call] [Return to Company Listing] > [Return to Headlines] > > MICROSOFT PUBLISHES SPECIFICATIONS DESIGNED TO HELP > IMPROVE SECURITY ON THE INTERNET > > ATLANTA, Sept. 27 /PRNewswire/ -- Microsoft Corp. (Nasdaq: MSFT) > today announced the publication of two specifications that address key > Internet security issues. [ blah, blah, blah ] > Both can be found on the Microsoft home page (http//:www.microsoft.com). > I command-clicked on that URL, and my mail program asked me what program I wanted to use to resolve "http//" URLs :-) The correct URL is, of course, <http://www.microsoft.com> -- Marshall Marshall Clow mclow(a)coyote.csusm.edu I'm an engineer. I make slides no one can read. Sometimes I eat donuts.

1 0

Re: Timothy C. May: Mini-mailbombs and Warning Letters
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:33 PM 9/27/95, Travis Corcoran wrote: >I'm not sure whether you're objecting to someone asked for your key, >or the fact that they did it through a semi-automated process. If you go back to my original message you'll see that I was discussing the rising number of spams, advertisements, and "automatically-generated" posts. What I call a robo-warning was this: " P.S. This mail was composed by my mailreading sftwr, which automatically scans incoming mail, looking for failed keyserver requests, and prompts me whether it should automatically send this msg on my behalf. If there is a bug w this sftwr (for example, you never PGP sign your msgs, so this entire msg makes no sense), or if you're interested in the software itself (mail-secure.el: a package in lisp for emacs; this is just one of the many crypto/privacy related things it does) please mail the author of this package ( tjic(a)openmarket.com) for details. As to whether I needed to respond to your robo-warning about how your automatic scan of incoming mail produced some kind of Signature Failure Condition Red at your end, I just ignored your message. (As others will attest, when people ask me for my key in a non-automated way, I usually send it to them. I often regret this, as they then send me PGP-encrypted mail with innocuous contents---the same reason PRZ hates to get PGP mail.) My _overall_ point was not to attack Travis C., who I don't think I even mentioned by name, but to point out that great care must be taken in running automated mail-response programs (including "vacation" programs, "I'm away from my terminal" messages, and these kinds of automated PGP messages). Finally, since Travis is making a fairly big deal over my citing of his post (though anonymously, as I recall), I'd like to see the post he claims I signed. If it has a PGP signature, it's probably an obvious spoof or satire. >If anyone has a constructive suggestion as to how this mail could be >changed to convey more information or to be less "threatening", please >mail me. Simple, don't bother to ask in the first place. Or ask informally, in ordinary English. Skip the "This mail was composed by my mailreading sftwr, which automatically scans incoming mail, looking for failed keyserver requests..." nonsense. On a list with well over 1000 people, I don't need some fraction of them running their own "key etiquette agents" inspecting my posts for conformance to their preferences. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

25 Crays a Year to Break STT
by John Young 17 Dec '03

17 Dec '03

Financial Times, September 28, 1995, p.1. Rivalry for Internet Security Grows By Louise Kehoe in San Francisco The Internet rivalry between Microsoft, the world's largest software company, and Netscape Communications increased yesterday when they announced competing encryption technology intended to ensure the security of financial transactions over the global computer network. Mr James Clark chairman of Netscape, the leading supplier of browser software that enables personal computer users to "surf" the Internet, also revealed the company had turned down a move by Microsoft to take a minority stake in Netscape earlier this year, before Netscape's public offering. Microsoft's encryption technology, developed with Visa International the credit card processing organisation, is intended to solve Internet security problems which have become a serious barrier to electronic commerce. Recent incidents, including the hacking of supposedly secure Internet software developed by Netscape, have heightened concerns about sending sensitive data such as credit card numbers over the Internet. Microsoft said its Secure Transaction Technology (STT), was designed to provide a much higher level of security for credit card transactions on the Internet. Netscape's general purpose encryption system uses a 40 or 128-bit electronic "key", while STT will use 2,000-bit keys. "By Christmas of 1996 you will be able to shop on the Internet to your heart's content, without even thinking about security," said Mr Warren Dent, Microsoft director of business development for consumer systems. Although no encryption system was totally secure, Mr Dent estimated it would take "25 Cray supercomputers a year" to break the STT codes. Netscape, however, said a new version of its Navigator software, which will become available next week will provide the same level of security. Netscape's "Secure Courier" technology has been developed in conjunction with MasterCard, Visa's credit card rival. To encourage widespread adoption of STT, Microsoft and Visa are making its technical specifications available at no charge to third parties to allow them to develop software. Netscape said Microsoft is expecting to charge transaction fees each time the STT technology is used. Commercial software products incorporating STT are expected to be available by April, Microsoft said. Netscape says Secure Courier will be available sooner. [End]

1 0

Patch release of Netscape available
by Phil Karlton 17 Dec '03

17 Dec '03

On ftp://ftp.netscape.com/pub/netscape, you can find the new UNIX, Macintosh and Windows executables. Note that these executables only support 40-bit RC4. We are working out a mechanism to be able to upgrade the 128-bit versions that is acceptable to the U.S. government. PK -- Philip L. Karlton karlton(a)netscape.com Principal Curmudgeon http://www.netscape.com/people/karlton Netscape Communications Corporation

2 2

Re: [ PROPOSED NEW STANDARD ] "I-like-encrypted-mail" tag
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:21 PM 9/27/95, Travis Corcoran wrote: >Summary: > > This message tosses out an idea for conveying within an { email | > usenet } message the datum "the author of this message prefers to > receive PGP encrypted communications" in a standard machine-readable > form. I don't dislike this idea, so my comments here are only possible routes for those who want to get PGP-encrypted mail. First, I think Hal Finney was offering at one time to remail the list to anyone in encrypted form (encrypted on his machine(s) to their PGP key, of course). This would increase the volume of PGP mail, of course. Second, others could make the same offer. Third, remailers could be used. Now encrypting a public list doesn't do much, of course, but it does increase the amount of encrypted traffic. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

NIS library code exposure
by Phil Karlton 17 Dec '03

17 Dec '03

Once again I speak for myself and not Netscape. While investigating one of the crashes we ended up decompling some of the code in the C library. It turns out that in some UNIX systems, the code in gethostbyname_yp will copy the hostname argument onto a stack local buffer. That buffer appears to be of size MAXHOSTNAMELEN. [This is very efficient code at destroying the stack: it does not use strcpy or sprintf; there is an inline loop copying characters until it finds a NUL.] An unstated (in any documentaton I could find) limitation on calls to gethostbyname is that the "name" parameter must be a limited size string for it to work at all. I suspect this bug has been in the NIS (nee YP) code for some time. Do you have any daemons that run as root and do networking? Are you sure that all of them check the length of the host name before passing it to gethostbyname? [Avoid the fencepost error: MAXHOSTNAMELEN is really the size of the buffer and not the maximal string length. You need room for the trailing NUL.] We have not looked into the networking libraries that are typically found on a PC or Macintosh. The exposure may also be present there. PK -- Philip L. Karlton karlton(a)netscape.com Principal Curmudgeon http://www.netscape.com/people/karlton Netscape Communications Corporation

2 2