December 2003 - cypherpunks-legacy

Re: Oklahoma University: Is this legal?...
by jwarren＠well.com 17 Dec '03

17 Dec '03

At 07:09 PM 12/17/95, sethf(a)MIT.EDU wrote: > c) someone decided that everything stored on the University's >computer system was therefore a "public record" (since the computer is >"owned" by the public), and thus had to be accessible by law. Uh, every PRA (public records act) in the nation hase extensive exceptions -- for school records, collective bargaining, various investigative records, etc. NO state PRA or federal FOIA declares blanket access to all public-agency records -- often justifiably; sometimes for agency arse-covering. --jim Jim Warren, GovAccess list-owner/editor (jwarren(a)well.com) Advocate & columnist, MicroTimes, Government Technology, BoardWatch, etc.

1 0

(Fwd) SECURITY ALERT: Password protection bug in Netscape 2.0b
by Peter Trei 17 Dec '03

17 Dec '03

Haven't had time to test this myself. Peter Trei ------- Forwarded Message Follows ------- Date: Mon, 18 Dec 95 17:18:28 From: <lstein(a)genome.wi.mit.edu> Subject: SECURITY ALERT: Password protection bug in Netscape 2.0b3 To: www-security(a)ns2.rutgers.edu, jcarroll(a)redman.canada.dg.com Cc: tara(a)linkage.cpmc.columbia.edu A potentially serious bug has just come to my attention concerning the handling of password-protected pages accessed via Netscape 2.0b3. Apparently when you type in the password to access a protected document Netscape stores the password in a local hidden file (in one of the .db files created in the .netscape directory on UNIX systems, and in the Netscape Preferences file on Macintoshes). This password is then used for accessing the document during subsequent accesses. The problem is that Netscape does not delete the stored password when the program quits. The problem has been reproduced on Unix and Macintosh platforms. I haven't tried the Windows implementation yet, but I suspect the same problem exists. This leads to the following behavior: 1) Open up Netscape and access a password-protected document. 2) Quit Netscape 3) Start Netscape again and try to retrieve the document. When the password-entry dialog comes up, click "Cancel". 4) Try to access the document a second time. Now Netscape lets you in without asking for the password! On Unix systems, this means that if you go over to a associate's machine to show him a protected document, Netscape will record your typed in password for posterity. Your associate now has full access to this page. The situation is particularly dangerous on PCs in a shared "computer lab" environment. Everybody who uses Netscape unwittingly makes his passwords available to all other users. Please let me know if anyone finds out more about this problem. I'm going to add it to the WWW security FAQ. Lincoln ======================================================================== Lincoln Stein, M.D.,Ph.D. lstein(a)genome.wi.mit.edu Director: Informatics Core MIT Genome Center (617) 252-1916 Whitehead Institute for Biomedical Research (617) 252-1902 FAX One Kendall Square Cambridge, MA 02139 =================http://www-genome.wi.mit.edu/~lstein====================

3 2

Re: Java and timing info - second attempt
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Jim Miller (jim_miller(a)bilbo.suite.com) writes: > Would it be possible to create a Java applet that causes the client > machine to sign or encrypt something with their private key, and > then send back timing info? Since access to a private key should always be strictly mediated by the user any Java implementation would probably pop up a panel asking permission for every single private-key encryption operation requested by the applet. The timing attacks require many timed encryptions to get enough information about the key. Even if the user was completely clueless and had no idea what the applet was trying to do I would imagine that they would get tired of clicking "OK" long before sufficient key information was leaked ..... Of course it would be a lot easier for the applet to just try to read the secret key file, encrypt it with an embedded public key, and post it to alt.anonymous.messages. Depending on how security was setup there might be only one or two panels that the user has to dismiss. It would probably get past the same number of clueless users that a more complicated timing attack would fool. andrew

1 0

RSA Data v. Cylink hearing
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

Another hearing in the public-key patent saga. Cylink/CKC is going for a preliminary injunction against RSA Data for contributory infringement of the Stanford patents. RSA Data has a license to the Stanford patents, but has no sublicensing authority. It has been selling RSA & Diffie-Hellman toolkits and telling customers that they don't need PKP or Stanford patent licenses, and even indemnifying those customers against a patent infringement claim. An arbiter has already ruled that RSA Data's license does not cover customers shipping products. Of course I take the position that these patents are invalid, and now that Bidzos has lost control of them, he suddenly agrees with me. (Sorry, no ruling yet in my case. Stay tuned.) But RSA Data lawyers will have to stand up in court and say that after enforcing the Stanford patent against all public-key users for 5 years, RSA Data suddenly had a revelation that the Stanford patents are invalid after all. It should be amusing. 2:00 pm, Thurs., Jan. 4, 1996 RSA Data v. Cylink/CKC, Case C-95-03256 WHO SF Federal Bldg, court #7, Judge Orrick 450 Golden Gate Ave Directions: Take 9th up from Market -- it turns into Larkin and the federal bldg is on the corner with Golden Gate Ave. docket clerk: 415-522-2060 Roger Schlafly phone: 408-476-3550 CompuServe: 76646,323 US Mail: PO Box 1680, Soquel, CA 95073 USA Internet: rschlafly(a)attmail.com

1 0

Re: Political Cleanup program [NOISE]
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"hallam(a)w3.org" 19-DEC-1995 13:48:07.90 >It is very strange the way that "Libertarians" are so able to turn all rights into property rights. Thus freedom of speech become freedom to have influence on the politicial process in direct proportion to wealth. ------------------ Funny, I'm disagreeing with you, and I believe that government ought to be involved with making sure everyone has a chance to make political speech (via subsidies of education). That doesn't mean that those who can make more speech (through money or any other ability) should be handicapped. ------------------ >I began work on the web in '92 because I saw its potential as a political tool which did not have the bias of wealth. It has the potential to create a new kind of political dialogue. When the Web becomes as ubiquitous as the telephone we will still see inequalities of power, the homeless and the poor will still be underrepresented. But that situation must be judged against our own where the political process can be bought and traded as if it were any other form of comodity. ------------------ You're making the classic PC (otherwise known as distorted egalitarian) mistake: you're wanting equality of results instead of equality of opportunity. Freedom of speech and the press doesn't mean that everyone gets a free press subsidized by the government, and no usage of means outside of that. It means that everyone _potentially_ can influence the political process and the marketplace of ideas. ------------------ >It is not simply an issue of money, it is an issue of national security. If a foreigner were to control the majority of the media there would be a significant threat to the national interest. This threat has been realised in the UK with the comming to power of Rupert Murdoch. Fortunately his influence on the US political scene has thus far been minor. In his own country he has brought down the government more than once. ----------------- This argument looks quite similar to those used for Canadian Content restrictions. "We can't let in Hollywood, they might be more demanded by the people than our own culture." "We can't let in Rupert Murdoch, his product might be more demanded by the people than our own products." It all comes down to people not having the courage to let their ideas be tested by what will get the most demand. -Allen

1 0

Re: What ever happened to... Cray Comp/NSA co-development
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:22 AM 12/20/95, Jiri Baum wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >Hello, > >tcmay wrote: >... >> Prime Factoring? Primes are easy to factor, of course. (Hint: Every prime >> has two factors.) >... > >Can someone enlighten me as to what the two factors are? > >With sensible definitions I've heard you either get one (just itself) >or four (itself [p], both units [1,-1] and the co-whatsitsname [-p]). You're looking too deeply. My point was in response to the very common error people make in talking about "factoring a large prime number." A prime is actually easy to factor: itself and 1, which is the point I was making. (One can quibble about whether 1 is a factor...I include it, though 1 is admittedly not considered a prime. But this is a quibble, I think.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

RE: Political Cleanup program [NOISE]
by Kurt Buff (Volt Comp) 17 Dec '03

17 Dec '03

---------- From: hallam@w3.org[SMTP:hallam@w3.org] Sent: Tuesday, December 19, 1995 8:22 To: Bill Stewart; cypherpunks(a)toad.com Cc: hallam(a)w3.org Subject: Re: Political Cleanup program [NOISE] >I happen to believe in freedom of speech, especially political speech, >and if you're not allowed to spend money broadcasting your speech or >printing your messages, you don't have much freedom of press or speech. It is very strange the way that "Libertarians" are so able to turn all rights into property rights. Thus freedom of speech become freedom to have influence on the politicial process in direct proportion to wealth. Not so strange really. All rights, correctly understood, *are* property rights. What most don't understand is that rights are protections from the initiation of force by others. What this means is that you (anyone) don't have the right to the property of others. You have the right to offer mutually satisfactory exchanges, or even solicit outright gifts, but what is yours is yours, and it shouldn't be subject to extortion or theft by others. This includes your time, cash, and any other tangible assets you may own. I began work on the web in '92 because I saw its potential as a political tool which did not have the bias of wealth. It has the potential to create a new kind of political dialogue. When the Web becomes as ubiquitous as the telephone we will still see inequalities of power, the homeless and the poor will still be underrepresented. But that situation must be judged against our own where the political process can be bought and traded as if it were any other form of comodity. The problem with the political process now is that the government and its beneficiaries (which includes both the large corporation and the welfare class) have over time arrogated to themselves the power to steal (via taxes and regulation) our lives and our livelihood from us. The poor and the rich will always be with us, but they shouldn't be special clients of the state at the expense of everyone else. It is not simply an issue of money, it is an issue of national security. If a foreigner were to control the majority of the media there would be a significant threat to the national interest. This threat has been realised in the UK with the comming to power of Rupert Murdoch. Fortunately his influence on the US political scene has thus far been minor. In his own country he has brought down the government more than once. The only reason foreign money might be a threat to us is again that the government arrogated to itself the power to regulate our lives. The reason and interest for lobbying the government, whether through the press or through other, more direct, efforts is that the government *can do something* about whatever happens to be at issue. Take away the ability of the government to act, and there won't be any money spent lobbying it. I submit we'd all be better off. >And as far as "prevent the political process from being owned by the rich" >goes, there have been brief exceptions over the last 5000 years in which >the less-rich have overthrown the rich, but campaign finance laws have almost >never kept the rich or the politicians from helping each other out. In UK politicis the influence of an individual's money is limited to influencing one party. Even that is done behind closed doors. The other major parties both limit the size of individual contributions to a constituency party to a relatively nominal sum. $5000 is a huge sum in UK politics. >I also don't believe freedom of speech should be limited by national >boundaries. Nor do I. But I only vote in one country. If we take the question outside the US it would not on the whole be a good thing if the Prime Minister of Tobago (say) were provided with a campaign contribution of $1M by a foreign company with an interest in strip mining the entire island. similarly it would be a bad thing if Columbian drug lords were to make massive contributions to politicians committed to continuing the prohibition on drugs. See my above comments. Only if the PM of Tobago could steal the land from its owners could he permit the island to be strip-mined. And only if the government has the power to prohibit drug possession would the Cali cartel be interested in making campaign contributions. No power to do something, no money offered to do it. Kurt [speaking only for myself, of course] Phill

1 0

No Subject
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

Submitted for your approval... The recent CryptoLib, offered by the nice folks at AT&T (Written by Jack Lacy and Don Mitchell), has a small problem: folks without RSA licenses are given a crippled version without functional RSA code. It sucks, but they must cover their collective asses. That small problem has now been rectified. Is CryptoLib available overseas yet? ================================CUT HERE=================================== *** - Sun Dec 17 20:05:50 1995 --- rsa.c Sun Dec 17 20:05:36 1995 *************** *** 411,421 **** #endif { BigInt result; ! fprintf(stderr, "RSA encryption not supported without license.\n"); ! result = bigInit(0); return result; } - #ifdef K_AND_R _TYPE( BigInt ) RSADecrypt(message, key) --- 411,420 ---- #endif { BigInt result; ! result = bigInit(0); ! bigPow(message, key->publicExponent, key->modulus, result); return result; } #ifdef K_AND_R _TYPE( BigInt ) RSADecrypt(message, key) *************** *** 427,434 **** #endif { BigInt result; ! fprintf(stderr, "RSA decryption not supported without license.\n"); ! result = bigInit(0); return result; } --- 426,433 ---- #endif { BigInt result; ! result = bigInit(0); ! chineseRemTheorem(message, key, result); return result; }

1 0

Re: Is ths legal?...
by Declan B. McCullagh 17 Dec '03

17 Dec '03

Disclaimer: I'm not a lawyer. Harvey is. (And a pretty damn good one, too.) -Declan ---------- Forwarded message begins here ---------- Date: Sun, 17 Dec 1995 14:38:24 +0001 (EST) From: Harvey A Silverglate <has(a)world.std.com> Subject: Re: Is ths legal?... To: "Declan B. McCullagh" <declan+(a)CMU.EDU> In-Reply-To: <wkoy1Sq00YUvMl2sVN(a)andrew.cmu.edu> Message-Id: <Pine.3.89.9512171444.F10678-0100000(a)world.std.com> Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Declan - The answer to the "is this legal?" question is more complex than simply "private versus public" university. There are fairly strict federal anti-wiretapping laws. It is hardly clear that a private university may eavesdrop on students' phone or computer conversations, even if conducted over the university's network. Furthermore, many states have their own anti-wiretap and anti-eavesdrop laws, which are even stricter than federal standards. I don't have the time nor the inclination to do research into Oklahoma law, but we did some research into this area of state and federal law for the LaMacchia case and concluded that in its investigation of David LaMacchia, MIT very well might have violated federal laws. Harvey Silverglate

2 1

E-cash coin questions (Mark Twain / Digicash)
by David Klur 17 Dec '03

17 Dec '03

1. How many different coins (serial numbers) can the current Mark Twain/Digicash protocol support? 2. Does Mark Twain bank maintain 2 lists: 1 of all the ecash serial numbers for all coins ever produced, and 1 of all the ecash serial numbers for all coins that have been spent before? Or just 1 list of the spent coins (assuming that any coin that is signed w/MT's private key and does not appear on the "spent" list is still valid and is not counterfeit)? 3. The Digicash scheme allows each coin to be used only once and then destroyed. How many coins will it take before all possible coins are minted, used and destroyed thereby requiring banks to issue new coins with "recycled" serial numbers? Remember, each time a "transaction" takes place, an existing coin is destroyed and a new coin is minted. and a transaction can simply be Alice giving her friend Bob a dollar (not necessarily using the ecash for a purchase) 4. What is the probability of guessing a valid serial number, assuming there are 1 million, 1 billion or 1 trillion coins in circulation? 5. Suppose you have a very large number of cash coins signed by the same bank (say, Mark Twain) and you know the record layout of each coin (easy enough since you can decrypt it with the bank's public key), and for each coin the "bank name" field is the same (because it's the same bank!) -- then, would it be possible to hack the RSA encryption and recreate the bank's private key? -----BEGIN PBP SIGNATURE----- Version: 1.0.0, Copyright 1995, Pretty Bad Privacy David Klur dklur(a)dttus.com I am who I am because I say so. So there. -----END PBP SIGNATURE-------

1 0