December 2003 - cypherpunks-legacy

US Govt., Hackers, & security - Cable TV
by Jim Choate 17 Dec '03

17 Dec '03

Hi, There is some show on TDC about the Internet and how it can be used as a threat to national security. It is 9:41pm Ctl. so check your schedule. Looks like good advertising... ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

FREE Trial offer for Computer Magazine Archives
by announce＠lists.zdnet.com 17 Dec '03

17 Dec '03

---------------------------------------------------------------- ZDNET ANNOUNCEMENT 9/10/97 ---------------------------------------------------------------- Two-week FREE trial offer on Computer Magazine Archive. ============================================================ http://www4.zdnet.com/chkpt/zdna970910001/cma.zdnet.com ============================================================ Make your Web research more productive with ZDNet's Computer Magazine Archive--an extensive collection of computing articles online. CMA is a powerful database of over 100,000 full-text articles and abstracts from the industry's leading publications. Find articles related to product reviews, your competitors, the latest IPO, acquisition, or merger and just about anything else related to high-tech. With informative articles from over 80 of the industry's leading publications, everything you need for researching the computer industry can be found in Computer Magazine Archive. Now your research on the Web can be quicker, easier, and more focused. Now you can try Computer Magazine Archive FREE for two weeks. Simply point your Web browser to: http://www4.zdnet.com/chkpt/zdna970910001/cma.zdnet.com to start your search right now. ============================================================ http://www4.zdnet.com/chkpt/zdna970910001/cma.zdnet.com ============================================================ _______________________________________________________________ ZDNet Announcements are periodic notices of new features, special events and free offers available to members of ZDNet. --To subscribe to ZDNet Announcements, please send mail to: announce-on(a)lists.zdnet.com You can leave the subject and body blank. --To unsubscribe to ZDNet Announcements, please send mail to: announce-off(a)lists.zdnet.com You can leave the subject and body blank. _______________________________________________________________ Powered by InfoBeat: http://www.infobeat.com ===============================================================

1 0

Re: NSA and Netscape Crack
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:46 PM 9/19/95, Jim Ray wrote: >In the relatively short time I've been on this list, Cypherpunks >have bruted, and then found a weakness in, two kinds of Netscape >software. >[A fine public service, IMO. Congrats to all involved.] > >I don't expect to know NSA's specific brute-force capability, but >does anyone know if the NSA has *ever* found a glaring weakness in >software and then told its author(s) or owner(s) about it? Do "we" >perform the "COMSEC" role Tim was speaking of better than the NSA? Indeed, Jim is underscoring the point I was making, facetiously, that the NSA has abandoned all pretense of helping to actually secure commercial transactions (and no, I wasn't referring to Clipper...rather, I was facetiously referring to the short-lived Commercial COMSEC Endorsement Program, circa 1988-89). As I said in my message, I don't _want_ the NSA or NIST (the same, really) to be vetting commercial encryption. But I also don't want them claiming a role in securing commercial encryption when they clearly are not even doing as much as the Cypherpunks are doing. By the way, if we count our own Matt Blaze's work on exposing weaknesses of the Tessera/Skipjack/Clipper (they blur together) card as a "Cypherpunks achievement," then the Cypherpunks have actually played a dominant role in cracking these recent standards. (Not to mention the RC4 code postings, the various Cypherpunks involved in the RSA-129 and "BlackNet" factorizations, etc.) Well done, of course! --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Please send me SSL prob
by Joe Tardo 17 Dec '03

17 Dec '03

Reply to: RE>>Please send me SSL problems... Jeff: The name chosen for SSL was, perhaps, unfortunate and misleading, but should not get in the way of the kind of service it provides. I keep combing the spec looking for socket-like api's, and so far have not found any :-). > I've looked at >what it takes to make some existing protocols work with SSL, and I'm not >convinced that its always appropriate. For example FTP and RCMD use >multiple connections, which is a royal pain. Doesn't HTTP use a new connection for every GET? > If a secure IP standard emerges that is widely deployed and provides >similar services, I don't see why SSL couldn't just go away (this is my >opinion, not an official position of netscape). The ipsec people are currently debating what it means to do replay detection on an unreliable datagram service, what it means to authenticate individual users in a layer that only knows how to name host endpoints, how a protocol specification deals with how policy would be set for mixed encryption service requirements, etc. This is not the first time these points have been debated in the history of the universe, nor the first attempt at a 'one size fits all' security protocol. I, personally, would not be too quick to expect IP security to solve all of your problems, but it will do a better job on, say, host-to-host disclosure protection. It will, however, require new kernel code or low-level driver or hardware hacks, which simultaneously provide the better protection and a barrier to security deployment for a product like Netscape's. Now, how about fixing SSL's keying so it has perfect forward secrecy? -Joe

1 0

Re: FidoNet Remailer
by RobL 17 Dec '03

17 Dec '03

At 04:34 PM 10/20/95 -0400, Jim Cannell wrote: > >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > >-----BEGIN PGP SIGNED MESSAGE----- > >I have been a long time lurker on this list, as well as having a long time >interest in crypto. Most of my activity in this area has been on FidoNet >rather than the internet. Due to the control phreak nature of much of >FidoNet, I've spent a lot of time and effort in an attempt to just simply >route around the bastards. I created the SecureMail system, which is a >network of FidoNet nodes that agree to route any and all traffic without >monitoring or censorship. Within SecureMail, encrypted traffic is not >only permitted, it is encouraged. At the end of the month, I will be putting my BBS back online with new software which is more Fido friendly than what I had been using.. I would be interested in your SecureMail system as an alternative to the mind-numbing strickness normally associated with FidoNet.. Any chance I can get more info? Thanks- RobL

1 0

Re: require for new remailer list tag?
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

sameer suggests the creation of a new remailer list property, "permanent", to denote a remailer expected by its operator(s) to persist indefinitely. I'm curious about the potential sociological effects of such a move. I imagine that pseudonyms would be attracted to "permanent" remailers for use in their reply chains. But this phenomenon could/should be mitigated by the possibility that sting remailers would tend to advertise themselves as "permanent" (truthfully, even !), in anticipation of the bias in pseudonym remailer chain inclusion. Enemies of anonymity might specially target remailers claiming to be "permanent" for antisocial uses. This is all similar to the effects (observed and supposed) of the existing reliability ratings for remailers. But the sharp contrast of a binary property might make the effects more pronounced. Perhaps it would be useful/meaningful to note the duration (or starting date) of each remailer's term of operation, on the theory that past survival is some indicator of the chances for continued existence. Anyway, I think it would be an interesting experiment to try. -Futplex <futplex(a)pseudonym.com>

2 1

Re: Netscape rewards are an insult
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

>> The idea that Netscape (like Microsoft) thinks they can get free >> testing services from all over the net by real experts just by offerring >> a tee shirt is down right offensive. > > >THE NETSCAPE BUGS BOUNTY > >(major snip) > > And if the security bug you find is severe as defined by Netscape, and > hasn't been previously found, and can be reproduced by us, we'll write > you a check for $1000. Ha! I reported a serious problem to Netscape ten days ago, on Thursday the twelfth. They haven't even returned an answer to my email yet nor even acknowledged its receipt. Yep, I guess that their check is in the mail .... Has anyone else seen or heard anything?? T-shirt's, mugs, checks, or email being returned or answered?? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

CSP
by Frosty 17 Dec '03

17 Dec '03

Frosty ::: AT&T ACCUSED OF DEFRAUDING !!! New York - AT&T Corp. is accused in a lawsuit of cheating millions of residential long-distance customers out of billions of dollars by rounding off calls to the next full minute. The Lawsuit, filed Thursday in state Supreme Court, claims AT&T residential calls are billed in full minutes, meaning a call lasting one minute and one second would be billed as a two-minute call. Business customers, on the other hand, are billed in six-second intervals, meaning a one-minute, one-second call would be billed as one minute, six seconds, the lawsuit claims. -The Associated Press -The Sun Herlad - 21 Oct 1995 * sotmesc(a)datasync.com aka ---* Frosty, ilKhan of the SotMESC * To send a submission, use this address with 'CSP' in the Subject line * Thanks to: Voyager, 2600, LOD, Knight Lightning for supporting us * Finger SotMESC or http://www.datasync.com/~sotmesc/sotmesc.html

3 2

Re: crypto export from the UK
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Jon Baber <jbaber(a)mi.leeds.ac.uk> writes: > sameer <sameer(a)c2.org> wrote: > > Could people in the UK please tell me what the crypto export > > laws are like there? I know someone who wrote some really great crypto > > code in the UK but isn't willing to distribute it because of crypto > > export laws... I was under the impression that it was legal to export > > crypto from the UK. > > I believe that the laws regarding the export of crypto from the UK are > very similar to the ITAR regs in the US. I thought they were markedly different! I always understood there were NO restrictions on crypto export, import or use to western countries. There used to be COCOM agreements which said that you should get approval to send commercially produced crypto to some blacklisted countries (Iraq, etc). I also read that the COCOM restrictions did not claim to apply to free software. Anyway, I read that the COCOM agreement has expired, so none of this applies anymore, even. There are a number of surveys around, and the above is my understanding from reading those. If you have any thing else I should be reading I'd like to see it. > However our Government seems to take the view that putting crypto > software on the net is not exporting it, the exporting is done > whenever anyone from an export restricted country downloads the > software and is done by them rather than by the person who made the > software available. I also have heard this. > Strong crypto is therefore openly available from a number of places in > this country, particually sable.ox.ac.uk at the university of Oxford. Indeed. > Of course IANAL and the government may change it's mind about the > interpretation of these things but I would expect that your > acquaintance would be perfectly safe distributing his software via > sable (the ftp site (and its predicessor) have been distributing > crypto software for a number of years and I have not heard of any > problems). I think he would be safe emailing it, putting it on the WWW, or posting it to USENET. There are no selective access restrictions on *any* crypto ftp/http sites that I know of in the UK (like various ones in the US which make a sho of enforcing the export restriction by not allowing export to non-US domain names.) Adam

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33a.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp hash cut reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp. hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)valhalla.phoenix.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"gondolin"} = "<mixmaster(a)gondolin.org> cpunk mix hash latent cut ek ksub reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; $remailer{"ncognito"} = "<ncognito(a)gate.net> cpunk"; $remailer{"precip"} = "<mixmaster(a)mix.precipice.com> cpunk mix pgp hash latent cut ek reord"; $remailer{"ecafe"} = "<remail(a)ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. remailer email address history latency uptime ----------------------------------------------------------------------- replay remailer(a)replay.com ******+***** 7:15 99.99% mix mixmaster(a)remail.obscura.com + --------- 1:36:59 99.84% hacktic remailer(a)utopia.hacktic.nl * ******** 10:05 99.80% portal hfinney(a)shell.portal.com ******### 1:52 99.78% alumni hal(a)alumni.caltech.edu + ++-*+++#* 6:28 99.71% rmadillo remailer(a)armadillo.com + ++++++++++ 43:31 99.67% ecafe remail(a)ecafe.org - ****### 3:31 99.67% spook remailer(a)valhalla.phoenix.net ** ********* 16:56 99.60% wmono wmono(a)valhalla.phoenix.net * ********** 13:16 99.58% penet anon(a)anon.penet.fi -+-- ----+ 5:07:54 99.03% ideath remailer(a)ideath.goldenbear.com --------.- 4:44:16 96.61% c2 remail(a)c2.org + +++++ 57:02 96.35% flame remailer(a)flame.alias.net + ****+ * * 26:48 94.29% vishnu mixmaster(a)vishnu.alias.net * **** * * 9:26 93.72% bsu-cs nowhere(a)bsu-cs.bsu.edu # ** *** 1:20:32 92.71% rahul homer(a)rahul.net *# ** ****## 2:20 99.71% ford remailer(a)bi-node.zerberus.de . ----._ 22:58:20 73.77% syrinx syrinx(a)c2.org - ---+-- 1:30:08 57.37% extropia remail(a)extropia.wimsey.com - ------ 4:48:34 50.13% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0