December 2003 - cypherpunks-legacy

Re:unSAFE won't pass
by Peter Swire 17 Dec '03

17 Dec '03

At 10:31 PM 9/14/97 -0400, Will Rodger explained his view that: >>It may make for good copy, but I think it's just fantasy to think >the >>>administration or their opponents, for that matter, will get what >>>they want this year. Let them swarm. Who cares. >>> >>>At earliest, August of 1998 before anything passes - and even that >is >>>highly optimistic. In politics, unfortunately, you often have to act *as if* the other side is going to win soon. If you don't, they might. A great example was the 1986 Tax Reform Act. Everyone knew that it was too complicated for Congress to understand. Everyone knew that there were lots of powerful opponents to its elimination of many tax loopholes. But the darn thing passed anyways. Even supporters were shocked. The story is told in a very well-written book, "Showdown in Gucci Gulch." When considering what Congress will do, remember that there are 12,000 bills a year introduced in each chamber. Crypto is only one of many, many issues the Members of Congress need to consider. When things get too complicated, a politician might think it's just easier to go along with law enforcement. How many politicians lose by being tough on crime? As for the 1996 Telecomm Act, it's a bad example of what's likely to happen with crypto. That Act was fought between truly enormous companies -- RBOCS, AT&T, cable, etc. Those companies had enormous Washington offices fighting a life and death lobbying battle for years. In crypto, the good guys have nothing like the same lobbying resources. Unlike Telecomm, the very largest existing companies in the country will not lose billions next year if a bad crypto bill is passed. In short, it is quite possible that nothing will pass before August, 1998. It is quite possible by then that the issue will seem politically hot, and thus be dropped so close to an election. But the FBI position might win if we don't act *as if* mandatory key escrow is a real possibility. Peter Prof. Peter Swire Ohio State University College of Law mailto:swire.1@osu.edu http://www.osu.edu/units/law/swire.htm (revised site now includes publications and Internet Privacy Page)

1 0

New remailer now active.
by wmono＠Direct.CA 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have an anonymous remailer running at wmono(a)spook.alias.net - the domain may or may not change (anybody have any suggestions?). It runs Mixmaster 2.0.1 and Ghio2 to give both Type I and Type II support. In the near future, when I have some time on my hands, I will upgrade to Mix2.0.2. This remailer is going public as of now. I have sent this message to cypherpunks, remailer-operators, and rops, so my appologies in advance if you receive multiple copies. Please add it to your pingers and cover-traffic generators. Although I have tested this remailer a lot, I have only done so from two accounts, therefore I am not certain of its reliability. Hopefully any such problems will be ironed out over the next few days. For this reason, I would advise against using it for sensitive materials for a week or so. If you encounter any difficulties, please contact me at the remailer's address. Mail sent regarding the remailer to wmono(a)direct.ca (my main addreess) will be ignored and/or deleted. Type I remailer's default latency is set to 900 seconds (15 minutes) so add a Latent-Time: +0:00 header if you want an immediate response. The keys are below. From: wmono(a)spook.alias.net (Anonymous Remailer) Subject: Remailer keys (as requested) Type I (ghio2) remailer key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQBtAzBeRcEAAAEDAMBA+IsCBBGwlCOpfsb0mqL6EiJGu/vnTjTcUPkz9yd8roz7 ym9qLpE9CVL0ND7kh8ctjmPfuvagt8VWhsvfo0cjpBY4J/1CtJelgTXCROyFsJGi 88V/fihQeq3u6De5iQAFEbQqQW5vbnltb3VzIFJlbWFpbGVyIDx3bW9ub0BzcG9v ay5hbGlhcy5uZXQ+iQCVAwUQMF5GJjncl2jz9xa9AQGXHAP7BaO5SDFkSGnhB0vZ UzPfC60WUhgq5mPHzmOYfrjiPPDz+MGmLs95zgAgkwNekYSBo9CQ9V9GIC+ZKV/R CWyfkJEQsY7q4kku6BPYnkXhKuelt/vdLmyguEVbwsUrrLwFKNAGg2RiCZUrk/ej 6l7vIQpPuIZ2uKrteM8Opk3WK9SJAHUDBRAwXkclUHqt7ug3uYkBAXLpAv9BbjrL RQe1m97hdE1J+nKWh+hUPILQa2U57LoFG18KRYsQcnrRjeYcIDN6Skc7AOOK21Ie j44dn6T+9hXCokys7V09xRWpNamKbb6CpsVzM/T5OolXVq7LrkB5gV7VlJE= =a8ZW - -----END PGP PUBLIC KEY BLOCK----- Type II (Mixmaster 2.0.1) remailer key: =-=-=-=-=-=-=-=-=-=-=-= wmono wmono(a)spook.alias.net f68e6add16880b60eb48a4a4330e2e36 2.0.1 - -----Begin Mix Key----- f68e6add16880b60eb48a4a4330e2e36 258 AASe+l+eIE1GYugbIPDG87h9wIFD0KqLWrMiN0PN RBCmRwsHOu1mZDnJTPlg7RXI17+DJMkk+huGPTuA T+KilAv8WFKWmvHuOpIBwxVBMXFKHsrQYHES63t0 UMQvRCv9LXZZvmiBWKrZp5vQaSOZKYLf4v3pQw7U SsbB5geSP9fQ2wAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- - -- ** NOTE NEW KEY ** As of 08/28/95! Old key 0x2902B621 COMPROMISED! William Ono <wmono(a)direct.ca> PGP Key: F3F716BD fingerprint = A8 0D B9 0F 40 A7 D6 64 B3 00 04 74 FD A7 12 C9 = fingerprint PGP-encrypted mail welcome! "640k ought to be enough for everybody." -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGbDUjncl2jz9xa9AQH4RAP+PKHtLC4m3yNH2jZB2VK/Omod+lAqTfVZ fQkmB6zTCi4y0++8zOLyhyzOZJaG3mwDe++DsW5qf3N7KSfcGlwdwChukyAvnzUC 9YxGODMj0x0a8cj/6XvClMsFtB99clzSfhy8IcTdSQDJOv5PoeHo1GkTuXvgjIyY 2YCDG/pdQpg= =L3cw -----END PGP SIGNATURE----- -- ** NOTE NEW KEY ** As of 08/28/95! Old key 0x2902B621 COMPROMISED! William Ono <wmono(a)direct.ca> PGP Key: F3F716BD fingerprint = A8 0D B9 0F 40 A7 D6 64 B3 00 04 74 FD A7 12 C9 = fingerprint PGP-encrypted mail welcome! "640k ought to be enough for everybody."

1 0

Re: Patents and trade secrets was: Encryption algorithms used in PrivaSoft
by David Van Wie 17 Dec '03

17 Dec '03

Perry E. Metzger at Sep 22, 95 01:19:37 am wrote: >David Van Wie writes: >> It just moves the prior art date from the date of invention to the date >> of filing the patent application. >What happens if the chronology goes like this ? > >(0) Alice invents a snaffleblort. >(1) Bob invents a snaffleblort. >(2) Bob files for a patent on a snaffleblort. > >From what you said, it would appear that Alice's prior art won't count when >it comes to considering the validity of Bob's patent claim. Is that correct ? Unless Alice made public statements about her invention, you are right. Something becomes prior art when it is made public. If she (like most patent lawyers will advise) kept her mouth shut about what she had invented until her patent application was filed, she would lose under first to file rules (assuming step three is that Alice files a patent application). A quick trip to the soapbox: First to files rules are good for big companies, and bad for small inventors. Big companies have many lawyers, and know exactly how each step of the process works. Small inventors usually don't know the process as well, usually have to scrape together the thousands of dollars necessary to pursue a patent, and then find a good lawyer that they can trust -- all while ensuring that they don't break one of the rules about how you must treat your invention before filing. Moral: First to invent rules, like "natural copyright," are good for the little guy because they base patent decisions on when the important things (i.e. invention and reduction to practice) happened, not administrative things (i.e. complex documents filed with dotted i's and crossed t's).

3 2

Some anti-GAK reverse-FUD ?
by Lou Poppler 17 Dec '03

17 Dec '03

Today's NY Times has a long article about how easily personal information can be extracted from various kinds of computers and networks. (URL below) This snippet illustrates nicely one of the dangers of trusting information to "legitimate" law enforcement. -- Begin quoted text: -- [...] In a 1997 New Year's letter to "friends and clients" of Investigative Group International Inc., one of the best-connected Washington investigative agencies, the chairman, Terry Lenzner, noted "increasing interest by clients seeking to protect themselves from negative campaigns," including those by "so-called 'whistle-blowers,"' unions and regulatory agencies. [...] The promotion brochure features veteran investigative reporters who now work for IGI. Their role adds a new dimension to the long-revolving door between law enforcement and private investigations. IGI's staff, for example, includes former top officials of the Drug Enforcement Administration, the FBI and Germany's national police force. Meanwhile, Ray Kelly, who had been chief of police in New York City before joining IGI to run its New York operations, now heads the Secret Service, the Bureau of Customs and the Bureau of Alcohol, Tobacco and Firearms. Such ties, along with IGI's assignment from the Democratic National Committee to probe its campaign-finance mess, inspire some critics to liken it to President Clinton's private CIA -- a characterization that Lenzner, who was a lawyer for the Senate Watergate committee, vigorously rejects. [...] full article is at: http://www.nytimes.com/library/cyber/week/091597privacy.html

1 0

RSA/Cylink arbitration agreement on-line
by Brian A. LaMacchia 17 Dec '03

17 Dec '03

[I haven't seen this mentioned yet on the list...] Cylink has been kind enough to put a copy of the arbitration panel's decision on their web page. Cylink's home page is www.cylink.com. The URL for the actual agreement is: http://www.cylink.com/arbtrn_1.html Spin doctors aside, it doesn't look like either company gained much over the other. I'm not an attorney, but the way I read the agreement RSAREF can continue to be used without violating the Stanford patents. RSA DSI cannot *sublicense* the Stanford patents to third parties, but can *sell code* that practices the methods claimed in the Stanford patents. That code can then be incorporated into other products, which is exactly what PGP 2.6.2 does (it's linked against a copy of the RSAREF library, which is covered by the RSAREF license agreement). --bal

1 0

New Netscape RNG
by Ray Cromwell 17 Dec '03

17 Dec '03

I just glanced at the new Netscape RNG source. I don't really see anything bad, but I haven't analyzed it. However, I'm curious as to why variables like the username or the language locality are used as sources of entropy. These seem to provide almost nil. The username is going to be pretty much constant. In fact, even the current directory which is used as a seed can't provide more than a few bits of entropy. In all probability, the user name will usually be the same, and so will the current directory (and how many directories are there? 65,000 would only give you 16 bits of entropy, assuming you get a directory listing from the machine) I'm thinking from the standpoint of someone gathering data on someone or some server to mount a specific attack. a "most common directories on the macintosh" file for instance could be used to attack the current directory method. Using those sources probably can't hurt, they just seemed like odd choices, "grasping for straws" so to speak. Nevertheless, I would like to commend Netscape for releasing the source code for public review. You guys are clearly an intelligent company, in both your current developments, but also the way you have handled this bad press. -Ray p.s. i hope you guys do a good internal review of your code to remove buffer overflow bugs

3 3

Netscape flaw hits the big time
by Ed Carp [khijol SysAdmin] 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just heard on the CBS hourly radio news that Netscape will release a new version on Wednesday correcting a flaw that would "allow hackers access credit card numbers." As usual, they got it all wrong, but what do you expect? - -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/pager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi Q. What's the trouble with writing an MS-DOS program to emulate Clinton? A. Figuring out what to do with the other 639K of memory. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGa29CS9AwzY9LDxAQHJwAQAlCcmPauUPnBIpBx5e5ZZpdnQZk5dhEMe BMZe+aA+A0mZ6aqgiA8wzZyjbSkYMuzoUM+IQi4c4MraoWNXGAFfO+9dL4WMmdqI AMBk6WaIoiYjCjCd7SNxETlh4+BaWICul/04isiiLE345j6VgU2xGtJZT4UJMurf 6/dy7ztSYEQ= =P3jw -----END PGP SIGNATURE-----

1 0

Make Money With Your PC
by mailhost＠aol.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> ***************COMPUTER USERS NEEDED*************** $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Set Your Own Hours. Earn $20,000 to $50,000 per year. $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ If you presently own your own Macintosh or IBM compatible personal computer, this amazing work-at home program may be just for you. First, please understand this is not a get-rich-quick scheme, chain letter scam or anything else that makes the promise of getting something for nothing. However, this is a legitimate program that will reward those who do not mind hard work, with a substantial source of extra income. Our manual, 'Work at Home Using Your Personal Computer (c 1995)' will outline the 27 different areas that are the most needed and requested services. We then put you in direct contact with the actual companies in your local area that are downsizing and offering work. Today, many, many companies are streamlining due to economic pressure and the need for home-based workers is at an all-time high. Basic skills such as typing, data entry or word processing will allow you to earn between $10 and $15 an hour. More advanced skills such as medical billing, database management and bookkeeping earn $20 to $30 per hour and are a common occurence. Those with even greater technical skills, graphic design, desktop publishing, basic programming or web site design can earn between $30 and $45 per hour. This program comes to you with a 100% money-back guarantee. The package we send to you contains everything in writing. You will recieve the easy-to-follow, fact filled manual and software package only if you act now! This program is the perfect solution for housewives, students, the home-bound, as well as those seeking a solid second career. The easy-to-follow manual and software package comes to your for only $49.95 ---------------------------------------------------------------------- Look below to see how you can save $15 today! ---------------------------------------------------------------------- IMS 5201 Kingston Pike Suite 6-216 Knoxville, Tennessee 37919 YES, please rush the 'Work at Home Using My Personal Computer (c 1995) manual! ___________ I have enclosed $49.95 plus $4.95 shipping and handling. ($54.90 total) ___________ I want to save $10.00! I am ordering within 24 hours - I have enclosed $39.95 plus $4.95 shipping and handling. ($44.90 total) ___________ Please RUSH my order - add an additional $15.00 (OPTIONAL) I have enclosed (Check One): _____ Cashiers Check _____ Money Order _____ Personal Check SHIPPING INFORMATION Name:__________________________________________________ Telephone:_______-______-____________ Physical Street Address (NO PO BOXES please)__________________ _______________________________________________________ City:___________________________________________________ State:_________ ZIP:____________________________________ Your E-Mail Address (Needed for order confirmation)____________________________ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ SAVE AN ADDITIONAL $5.00!!! FAX YOUR ORDER NOW! Please tape your completed and signed check in the space below and fax to IMS. That facsimile number is 1-423-681-6520. ************************************* FAX: 1-423-681-6520 PLEASE TAPE YOUR CHECK HERE Please SIGN you check ************************************* Thank You For Your Order 2156887000908001546877 </FONT><FONT COLOR="#000000" SIZE=3>

1 0

WSJ on Netscape Hole 3
by John Young 17 Dec '03

17 Dec '03

The Wall Street Journal, September 25, 1995, p. B12. Netscape Software for Cruising Internet Is Found to Have Another Security Flaw By Jared Sandberg Another security flaw that has long plagued the Internet has been found in software by Netscape Communications Corp. and others, raising concerns for the privacy and safety of information on the global computer network. The flaw in Netscape's popular Navigator software, which helps users cruise the multimedia portion of the Internet known as the World Wide Web, is the third defect in the software discovered by the "Cypherpunks" discussion group in little over a month. Members of the Cypherpunk group, which includes mathematicians and hackers who discuss the security method of cryptography, last month broke Netscape's "key" that protects sensitive data by "brute force" -- the use of massive computing power. Last week, other members found a flaw that could let hackers essentially pick the lock in Netscape's software. Unlike the prior glitches, however, the latest flaw doesn't lend itself to the theft of multiple credit-card numbers. Instead, it could allow a savvy hacker to damage an Internet user's computer, such as crashing the computer or deleting files. "This is just another indication that Netscape isn't being careful," said William Cheswick, a security researcher at AT&T Corp.'s Bell Laboratories. Still, he said, the flaw goes well beyond Netscape. It first reared its head seven years ago when Cornell graduate student Robert Morris used it to create a "worm" that crippled thousands of computers on the Internet. Last February, the same kind of flaw was found in the popular Mosaic program created by the University of Illinois. But that strain of the flaw was more serious than its latest appearance because it affected the computers that store many users' credit-card numbers. Now experts are discovering that the flaw shows up in other so-called Web browsers such as Links and Arena. "We're so glad that the network dog dances, we don't realize that it's rabid," Mr. Cheswick said of the programming quality of many software packages. Marc Andreessen, vice president of technology at Netscape, said the company will issue fixes for the recent glitches later this week. He added that it's unclear whether anything other than temporarily crashing a user's computer could result trom the recent flaw. But, he said, once users adopt the modified software, "this won't be around long enough to cause a problem." Some, however, worry that another variation of the flaw will prove more difficult to cope with in the coming months. Bruce Fancher, president of Phantom Access Technologies Inc., operator of the Mindvox Internet access service, said a variation of the security hole has been found in several Unix software packages, which run on thousands of Internet computers that contain user's credit-card numbers and other personal information. It could cause far more damage than the Netscape flaw, he said. "This is going to be a big problem," warned Mr. Fancher, adding that he's been told that hackers are already devising software toolkits to exploit the hole. "This flaw is an easy mistake to make, but it's also easy to fix," he said. The latest flaw came to light early Friday morning when a reader of the Cypherpunk mailing list discovered the glitch and posted a message to the Internet. Basically, the software on an end-user's machine allows for commands that are too long, letting an intruder tack on an extra line of damaging code that could crash the computer. Instead, the software should verify the length of the commands that computers accept. Security buffs concede that the recent round of security glitches found in several pieces of software, including a virus found in Microsoft Corp.'s Word program and security problems at Amefica Online Inc., has shaken confidence in electronic commerce. But they say the publicity brings to light problems that will ultimately make software more secure. Richard Lethin, a graduate student at Massachusettes Institute of Technology who participates in the Cypherpunk discussion, said: "This technology for electronic commerce is ultimately going to be real important, but there might be some hiccups at the start." [End]

1 0

(Another) WSJ article
by dmandl＠panix.com 17 Dec '03

17 Dec '03

Netscape Software for Cruising Internet Is Found to Have Another Security Flaw Another security flaw that has long plagued the Internet has been found in software by Netscape Communications Corp. and others, raising concerns for the privacy and safety of information on the global computer network. The flaw in Netscape's popular Navigator software, which helps users cruise the multimedia portion of the Internet known as the World Wide Web, is the third defect in the software discovered by the "Cypherpunks" discussion group in little over a month. [end of excerpt--it's a long article] The article quotes William Cheswick and Rich Lethin, and mentions the cypherpunks several times. --Dave. -- Dave Mandl dmandl(a)panix.com http://wfmu.org/~davem

1 0