December 2003 - cypherpunks-legacy

Re: "Notes" to be Eclipsed by "Netscape"
by Bill Stewart 17 Dec '03

17 Dec '03

>> I've never even _seen_ a copy of Notes running on any machine, nor do I >> know directly of _any_ of my colleagues who has. (Not saying nobody has, of >> course, just that I can't find anyone I know well who has.) Notes was a PC network reimplementation of PLATO, the system that also inspired notesfiles, a distant cousin of Netnews (though I'm not sure if netnews was originally inspired by PLATO or not...) Netnews assumes that articles are going to propagate for a while and then be trashed; notesfiles assumes you're building a knowledge bases that sticks around. (This transitoriness has allowed netnews to scale to its current N*100MB/day of trash :-) Notes is oriented more toward business kinds of collaboration, though it would work fine with university research projects. It's got all the PCish things you'd expect, with GUIs and menus and icons that let you include various sorts of documents and pictures as well as text; it seemed to be done reasonably well, and there's a growing market for Notes administrators. One definition of "business" is "customers who want this stuff enough that we can charge them big bucks for the servers"; client software has come down in price due to market resistance. One difficulty with Notes is that the earlier versions liked to run on Novell IPX instead of TCP/IP, so it didn't immediately jump onto companies' internal IP nets, or onto the global net for those brave souls willing to expose their business communications systems to the world. I do know companies who run multiple Notes systems so that Project X can communicate with its teaming partners at Company Y; I don't know how much integration they have with their internal Notes systems. AT&T Network Notes is a joint AT&T/Lotus project that uses AT&T's public IPX network to support Notes on; I think it's now rolled out an accepting customers, but it was mostly in press-release stage while I was at AT&T. Notes does have encryption, using RSA and I think RC4; I'm not sure if they do the 40 bits exportable/ 128 domestic bit or just use 40 bits. Don't know about overflow kinds of bugs; the bugs I've heard about were more problems integrating with Cc:Mail :-) #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: Security Update news release
by David E. Smith 17 Dec '03

17 Dec '03

-- [ From: David E. Smith * EMC.Ver #2.5.02 ] -- -----BEGIN PGP SIGNED MESSAGE----- > >Do the new versions use PGP's randseed.bin? If Netscape even only looks at > >data used to keep PGP secure, Netscape will be banned from my computer > >and every computer I am responsible for. -- For good. > > This is the second person who has expressed this sentiment. I don't > understand it. If you believe that the possibility of randseed.bin > getting out is dangerous, then why do you leave it online? Do you > really trust every piece of software you run, every piece of software > that can possibly access your machine over the net, to not look at > that file? I'm still running MSDOS, so I suppose net connectivity isn't much of an issue :) At any rate, I set my randseed.bin to a length of 0 and then made in un-writable, so that new random bits have to be generated every time. It's not too much of a trouble for me; most of my PGP use is just signing messages to certain interested parties. How would Netscape handle the fact that there aren't any random bits here? Dave "old bits, new bits, red bits, blue bits" - -- David E. Smith, c/o Southeast Missouri State University 1210 Towers South, Cape Girardeau MO USA 63701-4745 +1(314)339-3814, "dsmith(a)midwest.net", PGP ID 0x92732139 Opinions this ludicrous are mine. Rational ones will cost you. Heh -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGnQnwwyfvCScyE5AQHzIQQAklOHwzKJY9P2DqAvdf4Rn1aZUNcqW3bz rk/FCrQP19WxqyTsO7RcRQ6q5ziwqU4qbMu+Xyci2qT0wEnOKFYhauLgLd0xxttA 7sqX9pEQVbLN9KCGz5AqFwDNlqVcdMqu0yo8s5gprmCFxDh0hXzt880rNn8tP6Id ErrhJ2NToZo= =0KRe -----END PGP SIGNATURE-----

1 0

re: chaos cryptography
by Sherry Mayo 17 Dec '03

17 Dec '03

Duh! As someone pointed out to me in email I wrote "stenography" when I meant "steganography" in the intro to the New Scientist article. (Well I'm sure ou all knew what I meant) Sherry

1 0

Re: First Payments WG Meeting Announcement
by todd＠lgt.com 17 Dec '03

17 Dec '03

FYI- the FSTC E-payment Working Group meeting is happening at the W3 meeting on the day before the meeting itself. The meeting is being held at the OSF facilities. >The World Wide Web Consortium is holding a Workshop on payments. The workshop >is intended to be a small, technically oriented meeting of its payments working >group. Although it is a members only event I am willing to listen to special >pleading, alternatively companies may wish to join the consortium at our >extreemely reasonable rates. See http://www.w3.org/pub/WWW/Consortium/ for >details. > >-- >Phillip M. Hallam-Baker Not speaking for anoyone else >hallam(a)w3.org http://www.w3.org/hypertext/WWW/People/hallam.html >Information Superhighway -----> Hi-ho! Yow! I'm surfing Arpanet! > >ANNOUNCE: First W3C Payments WG Meeting, October 11 > >---------------------------------------------------------------------------- > >What: 1st W3C Payment WG Meeting > >Where: MIT EECS, Grier Room 34-401 (subject to change) > >When: Wednesday October 11, 9am - 5pm > >Who: W3C Member Representatives ONLY > >URL: First W3C Payments WG Meeting > >W3C is making progress on supporting electronic payments on the web. This WG >Meeting has been called to foster discussion and feedback between W3C and >its members. Discussion will focus on proposals to the W3C for payment >protocols, interfaces, and e-commerce support. > >The agenda for the electronic payment workshop is still being settled. At >the current time we have confirmed presentations by VISA, IBM, W3C, and the >Financial Services Technical Consortium (FSTC). Additional invitations have >been issued, and suggestions for additional presentations would be welcome. >Contact Phillip Hallam-Baker (hallam(a)w3.org) or Jim Miller (JMiller(a)w3.org) >with suggestions. > >There is a separate W3C Security WG Meeting at MIT on Tuesday, October 10th. >Contact Rohit Khare for details (khare(a)w3.org) > >To RSVP for the Payments WG Meeting, email the coordinator, Phillip >Hallam-Baker (hallam(a)w3.org) or call 617/258-5967 by 5 October. This >workshop is aimed at technologists; please include a brief description of >any relevant payments work you or your organization are involved in. > >This is a preliminary announcement of the date and time only. We have >arranged for hotel rooms at the Kendall Square Mariott. To qualify for the >MIT discount, notify Susan Hardy (susan(a)w3.org) > >For a review of the Consortium's plans, see W3C's report on Electronic >Payment Schemes and the Third W3C Security Workshop. Regards, T. S. Glassey Chief Technologist Looking Glass Technologies todd(a)lgt.com -----BEGIN PGP SIGNATURE----- Version: 2.6 iQB1AwUBMFu5E6gNRnWhagU5AQHI+gL+Mwpcd3lAWd8FF06qcG6rnLhIYveHW71a XC7xh1T0uu8qnYX31yMp17OG28jWpKUbWec1IM9/eXOi+gInA7rKICWczV8zo9Z0 0puxjRRN7yO4KfRb3cPpk+r0p6pDg01Y =bTYb -----END PGP SIGNATURE-----

1 0

weak links in the cyberbucks demo (was: weak links in DigiCash system)
by Bryce Wilcox 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Originally to Marcel van der Peijl at DigiCash. - ------- Forwarded Message To: "Marcel van der Peijl" <bigmac(a)digicash.com> Subject: weak links in the cyberbucks demo (was: weak links in DigiCash system) Date: Wed, 27 Sep 1995 19:20:16 -0600 From: Bryce Wilcox <bryce(a)colorado.edu> - -----BEGIN PGP SIGNED MESSAGE----- Marcel-- I'm sorry that my comments upset you so much, but I do not believe that they were unwarranted. It is true that the cyberbucks demo is insecure in some ways, such as using insecure e-mail. On the other hand your response that the demo is not about e-mail, it is about E-cash, and that you don't have the manpower to invest in making those extraneous things secure, is a good one and I am satisfied. The only thing I wish I had done differently was to make the title of the message "weak links in cyberbucks demo". There are, as far as I am aware, no weak links in the DigiCash system. I sincerely wish your company the best success, although I fear that MicroSoft and Visa and the like will successfully market inferior systems by use of their money and mindshare. In fact, a large part of the reason that I chose to sell BAP via a cybershop was to draw more attention to Ecash. I hope it is working. I guess if you have about a two-week queue for free cyberbucks, then maybe in a week I will get a whole lot of BAP purchases. :-) Regards, Bryce signatures follow To strive, to seek, to find and not to yield. bryce(a)colorado.edu http://ugrad-www.cs.colorado.edu/~wilcoxb/Niche.html - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Automatic PGP clearsigning under Unix with Bryce's Auto-PGP v1.0 iQCVAwUBMGn3/fWZSllhfG25AQEZegP/XMmoGuATQpfhBtNuIT/yUwFv9IL0+OXe auH1eMJ8d1PoWPJthrou7THpxkkOzJ0iV+GrTKS0n1dSQ2REbwk27SHsXce3LAEX JIy3rsKywTYuswH6aS361uaymPWusMr6ZhAeaegxnoSWnY3/Z2RlPCxDnhpROBsk vKgIf1mt8ww= =TRMS - -----END PGP SIGNATURE----- - ------- End of Forwarded Message -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Automatic PGP clearsigning under Unix with Bryce's Auto-PGP v1.0 iQCVAwUBMGn6PfWZSllhfG25AQHuUQQAtwozCJKKxq4dlOn6SpDHs5tGbhxRWozd NUjDxffgCL2FAINsrfKR9hOXqXztYD1hQGJ4jBE+uw6sD5gGYrGct5RVuG9X51Ua HTceFbqJHd6mc3ISTMusQwQDt9kJ2DmGXqV8nt4yI20uiPKZKDVizhAqg900xqGs 78NeZuvZ5cg= =3SxM -----END PGP SIGNATURE-----

1 0

Information, We want information
by todd＠lgt.com 17 Dec '03

17 Dec '03

I an immediate need of info on the liabilities of BSD type systems, and in particular the BorderWare products. I heard that in the BorderWare product itself, there are several recently discovered potential "holes"... I have a particular interest in both the Attack MO against the BSD platforms in general and the Border products in particular... Please do not send the reply to the lists but to me personally (todd(a)lgt.com) I will summarize if I get enough info to be worth the effort. Any comments? Thanks In Advance... Todd Glassey todd(a)lgt.com

1 0

Re: Microsoft & new Internet Security specs
by Marshall Clow 17 Dec '03

17 Dec '03

> [Company News on Call] [Return to Company Listing] > [Return to Headlines] > > MICROSOFT PUBLISHES SPECIFICATIONS DESIGNED TO HELP > IMPROVE SECURITY ON THE INTERNET > > ATLANTA, Sept. 27 /PRNewswire/ -- Microsoft Corp. (Nasdaq: MSFT) > today announced the publication of two specifications that address key > Internet security issues. [ blah, blah, blah ] > Both can be found on the Microsoft home page (http//:www.microsoft.com). > I command-clicked on that URL, and my mail program asked me what program I wanted to use to resolve "http//" URLs :-) The correct URL is, of course, <http://www.microsoft.com> -- Marshall Marshall Clow mclow(a)coyote.csusm.edu I'm an engineer. I make slides no one can read. Sometimes I eat donuts.

1 0

Re: Timothy C. May: Mini-mailbombs and Warning Letters
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:33 PM 9/27/95, Travis Corcoran wrote: >I'm not sure whether you're objecting to someone asked for your key, >or the fact that they did it through a semi-automated process. If you go back to my original message you'll see that I was discussing the rising number of spams, advertisements, and "automatically-generated" posts. What I call a robo-warning was this: " P.S. This mail was composed by my mailreading sftwr, which automatically scans incoming mail, looking for failed keyserver requests, and prompts me whether it should automatically send this msg on my behalf. If there is a bug w this sftwr (for example, you never PGP sign your msgs, so this entire msg makes no sense), or if you're interested in the software itself (mail-secure.el: a package in lisp for emacs; this is just one of the many crypto/privacy related things it does) please mail the author of this package ( tjic(a)openmarket.com) for details. As to whether I needed to respond to your robo-warning about how your automatic scan of incoming mail produced some kind of Signature Failure Condition Red at your end, I just ignored your message. (As others will attest, when people ask me for my key in a non-automated way, I usually send it to them. I often regret this, as they then send me PGP-encrypted mail with innocuous contents---the same reason PRZ hates to get PGP mail.) My _overall_ point was not to attack Travis C., who I don't think I even mentioned by name, but to point out that great care must be taken in running automated mail-response programs (including "vacation" programs, "I'm away from my terminal" messages, and these kinds of automated PGP messages). Finally, since Travis is making a fairly big deal over my citing of his post (though anonymously, as I recall), I'd like to see the post he claims I signed. If it has a PGP signature, it's probably an obvious spoof or satire. >If anyone has a constructive suggestion as to how this mail could be >changed to convey more information or to be less "threatening", please >mail me. Simple, don't bother to ask in the first place. Or ask informally, in ordinary English. Skip the "This mail was composed by my mailreading sftwr, which automatically scans incoming mail, looking for failed keyserver requests..." nonsense. On a list with well over 1000 people, I don't need some fraction of them running their own "key etiquette agents" inspecting my posts for conformance to their preferences. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

25 Crays a Year to Break STT
by John Young 17 Dec '03

17 Dec '03

Financial Times, September 28, 1995, p.1. Rivalry for Internet Security Grows By Louise Kehoe in San Francisco The Internet rivalry between Microsoft, the world's largest software company, and Netscape Communications increased yesterday when they announced competing encryption technology intended to ensure the security of financial transactions over the global computer network. Mr James Clark chairman of Netscape, the leading supplier of browser software that enables personal computer users to "surf" the Internet, also revealed the company had turned down a move by Microsoft to take a minority stake in Netscape earlier this year, before Netscape's public offering. Microsoft's encryption technology, developed with Visa International the credit card processing organisation, is intended to solve Internet security problems which have become a serious barrier to electronic commerce. Recent incidents, including the hacking of supposedly secure Internet software developed by Netscape, have heightened concerns about sending sensitive data such as credit card numbers over the Internet. Microsoft said its Secure Transaction Technology (STT), was designed to provide a much higher level of security for credit card transactions on the Internet. Netscape's general purpose encryption system uses a 40 or 128-bit electronic "key", while STT will use 2,000-bit keys. "By Christmas of 1996 you will be able to shop on the Internet to your heart's content, without even thinking about security," said Mr Warren Dent, Microsoft director of business development for consumer systems. Although no encryption system was totally secure, Mr Dent estimated it would take "25 Cray supercomputers a year" to break the STT codes. Netscape, however, said a new version of its Navigator software, which will become available next week will provide the same level of security. Netscape's "Secure Courier" technology has been developed in conjunction with MasterCard, Visa's credit card rival. To encourage widespread adoption of STT, Microsoft and Visa are making its technical specifications available at no charge to third parties to allow them to develop software. Netscape said Microsoft is expecting to charge transaction fees each time the STT technology is used. Commercial software products incorporating STT are expected to be available by April, Microsoft said. Netscape says Secure Courier will be available sooner. [End]

1 0

Patch release of Netscape available
by Phil Karlton 17 Dec '03

17 Dec '03

On ftp://ftp.netscape.com/pub/netscape, you can find the new UNIX, Macintosh and Windows executables. Note that these executables only support 40-bit RC4. We are working out a mechanism to be able to upgrade the 128-bit versions that is acceptable to the U.S. government. PK -- Philip L. Karlton karlton(a)netscape.com Principal Curmudgeon http://www.netscape.com/people/karlton Netscape Communications Corporation

2 2