December 2003 - cypherpunks-legacy

Re: Reducing the Flames, Attacks, and Nit-Pickings
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:25 AM 10/23/95, Todd Glassey wrote: >>At 2:18 AM 10/22/95, Todd Glassey wrote: >> >>>As an aside - What blows my mind is the number of cycles people spend >>>bitching and moaning about Java itself rather than working to create a >>>better solution. > > >My apologies, I should have taken this off-line with Dr. Fred. I did in my >response to him as I had some personal commentary to add which would have >beebn inappropriate to the list in general. Just to make things clear, when I quoted Todd Glassey's point (above), it was because I _agreed_ with his point about the "bitching and moaning" about Java, as an example. I was _not_ quoting it as an example of the flames on the list, per se. My concern is that the Cypherpunks list is evolving into a "bug list," concentrating on attacks on commercial products. As I've said, finding major flaws in protocols is a useful thing to do, but having the list focussed on debating the fine details of languages like Java and browsers like Netscape seems to be less useful. Worse, idle speculation about possible security flaws seems wasteful. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Chaum's cash: backup?
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

(I congratulate Chaum on his ecash trial. this is a milestone.) the recent Chaum press release and information says that cash is "downloaded" to your local computer. here is my question: of course, I'm sure they have some kind of a backup system. would someone care to comment on it? say I download $1000 to my hard drive and it crashes. what to do? if it was like "real" cash, then it really would be lost. if it wasn't like real cash, and the bank was actually tracking it, then they could determine whether it had been "spent" so far or prohibit someone from "cashing it in" like a hold on a check.

2 1

Freeh wants to wiretap millions
by Brad Dolan 17 Dec '03

17 Dec '03

Excerpt from latest CDT bulletin... Mr. (Un)Freeh wants to be able to monitor (perhaps as much as) the most troublesome 1% of the population. This would appear to be a rather large expansion of telephone wiretapping. bd ---------- Forwarded message ---------- [Excerpt] CENTER FOR DEMOCRACY AND TECHNOLOGY ------------------------------------------------------------------------ A briefing on public policy issues affecting civil liberties online ------------------------------------------------------------------------ CDT POLICY POST Number 26 October 20, 1995 CONTENTS: (1) FBI Announces Digital Telephony Surveillance Capacity Request (2) Subcribe To The CDT Policy Post Distribution List (3) About CDT, Contacting Us (1) FBI NOTICE BEGINS DIGITAL TELEPHONY COMPLIANCE PROCESS -- PUBLIC ACCOUNTABILITY FOR FBI REQUEST ESSENTIAL On Monday October 16 1995, the FBI published its initial request for surveillance capacity as required under Section 104 (a) of the Communications Assistance for Law Enforcement Act (PL 104-144, a.k.a. Digital Telephony). As required by law, the FBI will accept public comments on the proposed capacity requirements for 30 days (ending November 15, 1995). The notice, which includes instructions for submitting comments, is attached below. [...] SURVEILLANCE CAPACITY REQUIREMENTS Section 104 of CALEA requires telecommunications carriers to ensure that their systems posses sufficient capacity to accommodate a specified number of simultaneous intercepts, pen register, and trap and trace devices. As required by Section 104 (a)(1), the FBI, after consultation with state and local law enforcement officials and the telecommunications industry, has published an initial notice or capacity requirements. Section 104 (a)(1) requires that the FBI seek public comment and then publish in the federal register and provide to telecommunications carriers: [...] CATEGORY I -- Areas With Heavy Surveillance Activity Large urban areas and other areas the FBI estimates require the greatest surveillance capacity would fall under Category I [page 53646, see below]. ACTUAL CAPACITY: .5% of engineered capacity, or 500 simultaneous surveillance orders for each equipment, facility, or service serving 100,000 subscribers. MAXIMUM CAPACITY: 1% of engineered capacity, or 1000 simultaneous surveillance orders for each equipment, facility, or service serving 100,000 subscribers, by 1998. _______________________________________________________________________ [...] [editor's note -- Appendicies have been deleted to save spae. The entire text of this document can be found at CDT's Digital Telephony Web Page, URL:http://www.cdt.org/digtel.html] Dated: October 10, 1995. Louis J. Freeh, Director. [FR Doc. 95-25562 Filed 10-13-95; 8:45 am] BILLING CODE 4410-02-M --------------------------------------------------------------------------- (3) HOW TO SUBSCRIBE TO THE CDT POLICY POST LIST To subscibe to the policy post distribution list, send mail to "Majordomo(a)cdt.org" with: subscribe policy-posts in the body of the message (leave the subject line blank) [...]

1 0

digicash & unix clients
by sameer 17 Dec '03

17 Dec '03

I haven't seen any listing of the platforms supported by the live digicash system. Does anyone know where that information is available? Thanks. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 1

Re: Chaum's cash: backup?
by James A. Donald 17 Dec '03

17 Dec '03

At 10:04 PM 10/22/95 -0700, Vladimir Z. Nuri wrote: >say I download $1000 to my hard drive and it crashes. what to do? > >if it was like "real" cash, then it really would be lost. It is really lost. Your disk drive contains information the bank *cannot* know. If you do not know that information either, you cannot prove to the bank or anyone else that you rightfully possess a legitimate coin. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Microsoft "Encrypted" Documents Hack FYI
by llurch＠networking.stanford.edu 17 Dec '03

17 Dec '03

I would provide the hack itself, but I'm on a Mac that lacks a proper Base64 handler at the moment. For people who only know how to use Netscape, the URL is news:465l8h$6sa@oznet03.ozemail.com.au. -rich From: lyal collins <lyalc(a)ozemail.com.au> Newsgroups: alt.security,comp.os.ms-windows.apps.misc,comp.os.ms-windows.win95.misc Subject: Re: More Microsoft Security Bugs Date: 19 Oct 1995 13:53:21 GMT Organization: not very, at the moment Lines: 366 Message-ID: <465l8h$6sa(a)oznet03.ozemail.com.au> References: <llurch-1510951157410001(a)tip-mp3-ncs-3.stanford.edu> NNTP-Posting-Host: slsyd3p02.ozemail.com.au Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="-------------------------------297591414826100" X-Mailer: Mozilla 1.22 (Windows; I; 16bit) Further to word document password protection, the attached offer a simple way to recover text in such files with this "protection". The source is included - at least one shwareare developer has taken up on this technique and releases a VB based version. cheers, lyal -rich graves, llurch(a)networking.stanford.edu moderator of the win95netbugs list http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html My old PGP key has been compromised. Please finger this account for the revocation certificate and my new key.

1 0

Re: digicash & unix clients
by Marcel van der Peijl 17 Dec '03

17 Dec '03

sameer <sameer(a)c2.org> wrote: > I haven't seen any listing of the platforms supported by the >live digicash system. Does anyone know where that information is >available? Thanks. It will be the exact same list as ecash trial (but not exactly the same software). It will be available by the time real accounts are issued. Hopefully tomorrow. Working on it. // Marcel van der Peijl, DigiCash bv, http://www.digicash.com/~bigmac/ // "If you had to tell the Whole Truth, you'd never shut up."

1 0

Re: Re: Chaum's cash: backup?
by Marcel van der Peijl 17 Dec '03

17 Dec '03

"James A. Donald" <jamesd(a)echeque.com> wrote: >>if it was like "real" cash, then it really would be lost. >It is really lost. >Your disk drive contains information the bank *cannot* know. >If you do not know that information either, you cannot prove to >the bank or anyone else that you rightfully possess a legitimate coin. You seem to have different information than we have. Strange. Please reread the press release. I could give a hint: your random state initializer is not the too-often used srand( time( NULL ) ) but user-chosen during installation. Write that initializer down and you can re-generate all coins. The bank can check wether these coins were indeed signed, and, after revealing blinding factors, the bank can also check if they were used. The difference must have been on your disk. This system is not completely operational yet but will be used in the future. // Marcel van der Peijl, DigiCash bv, http://www.digicash.com/~bigmac/ // "If you had to tell the Whole Truth, you'd never shut up."

2 1

No Subject
by Anonymous User 17 Dec '03

17 Dec '03

Was at a party Friday night and ended up having a few beers with a friend who works at a medium-large software publisher. Turns out his company recently received a letter from Netscape to the effect that "we've noticed that there are 'x' copies of Navigator active at your site - you should remember that commercial use requires a license fee", etc. The friend didn't know if the count was per IP address or per "magic cookie installation" (see discussion of a few weeks prior) or some other metric. Not that getting paid for your work is evil, but it looks like Netscape's interest in the use of its browser goes beyond simple curiosity or the sales of advertising to third parties. Is the bean counter number sent to every site, or just to .netscape.com sites?

1 0

Re: Netscape question transformed
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Jeff Weinstein writes: >zoetrope(a)infinet.com wrote: >> Why would a compony like Netscape jeapordise themselves by even >> letting out a beta version so hackers have time to find bugs before the >> full version is released. Don't take me wrong I have only been on the net >> fer a little over a year and Love Netscape. And If I knew what I was >> Doing I would love to help them..... > > The reason we do it is that without wide exposure outside the > company, it is virtually impossible to get complete testing coverage. I see. Who has netscape retained to review its software. Can we have some public names who will vouch for the "partial testing coverage" before exposing it to the world?? Firms who will put their name on the line and say that Netscape meets all of the security guidelines say of the IETF -- the Internet Engineering Task Force?? Or does Netscape feel that International judgement will not matter?? > Given the incredible variety of machines, OS's, peripherals, etc. > that are available in the real world, there is no way we could > re-create every possible configuration in the lab. All the more reason I guess to stick to standard. Or don't you agree?? We're not asking you to re-create every possible configuration, but have you benchmarked Netscape against any standards at all?? And which ones?? > We also can't visit every web page, or think of every combination > of features that clever people in the real world come up with every > day. This is true. You can't visit every web page. So what assumptions did you start off with when you first started your code design?? Did you read the appropriate memorandums upon which the Internet is built? Did you assume that every server would be trustworthy?? That would be extremely negligent. That's like a bank trusting everyone who comes in and asks if the bank can cash a check for them. Any comments, Netscape?? Or are you still not making "official" statements. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0