December 2003 - cypherpunks-legacy

Re: The future will be easy to use
by James A. Donald 17 Dec '03

17 Dec '03

At 08:38 PM 11/27/95 -0500, James Black wrote: > As soon as PGP 3.0 is released I am planning on incorporating PGP into >Pine, and start putting it into more programs, to increase the usage of >encryption things before they go out. Is there any public spec for PGP 3.0? --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: The future will be easy to use (fwd)
by stevenw＠best.com 17 Dec '03

17 Dec '03

>> One thing that David didn't mention is security add-ons to the "network >> computers" that are supposed to be rolled out within the next few months -- >> the successors to X terminals, $500 boxes with a good screen/sound, >> cheap cpu, and a few megs of ram and flash memory to hold a web browser. >> I expect some folks to make a good living by writing add-ons (including >> crypto add-ons) to these gizmos. >> > >Don't hold your breath. The current market surveys say that there is no >market for them. Check out this weeks PC Week or Mac Week, as they both >have several articles discussing this. Bottem line is that the under $1000 >computer seems to have no future either in industry or the home. > >Realisticaly, who in their right mind would buy a diskless workstation to >connect to Internet? You certainly wouldn't do crypto on it because it has >to boot from somewhere else and this leaves all kinds of security holes. >Also, there is the fact that at the current time there are no generaly >useable apps on Internet beyond the web and most companies would rather have >their employees doeing something more productive than hanging ten. > >Anyone who bases their business on this technology won't have a business. The same sort of things could be said of the telephone compared with written correspondence. Why would anyone have one in their business or home? Anyone can overhear a conversation, people will just chat, the only thing you can do with it is talk, there is no record of the correspondence, why would anyone want to talk to people on the other side of town? etc. Think telephone, not computer. Think people over 40 who want a communication tool with zero maintenance and zero learning curve. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more +1 415 390 9732 | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

2 1

Re: Directed Hamiltonian Path Problem
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:04 AM 11/28/95, Thaddeus J. Beier wrote: >> I am curious on whether there are any applications of the directed >> Hamiltonian path problem to cryptography, zero-knowledge proofs, etcetera. My >> reaosn for asking is that I've come across something in my field (molecular >> genetics) that can be used to solve such problems in a couple of weeks or so. >> -Allen >> >> >Secret sharing can be done by Hamiltonian paths. No public key code has been >found to take advantage of those, or any other NP complete problem, so far as >I know. DNA computing really doesn't solve the Hamiltonian graph problem, it >just makes the biggest one that you can solve a little bit bigger. 500 point >graphs remain insoluble (pun unitended) for earth-sized vats of DNA. > >Really. Thaddeus beat me to the punch, as I was going to say just about the same thing. The work by Adleman on "vats of computers" is intriguing, but is no real solution to the problem of exponential or superexponential growth: a problem that Adleman's vat could solve with a fish tank full of DNA computers in a day could be easily outpaced by a key length "only" a bit longer. Check the archives for many articles on this topic. Also, check the Web search engines for conferences, papers, etc. on this. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: The future will be easy to use (fwd)
by John Young 17 Dec '03

17 Dec '03

Responding to msg by ravage(a)einstein.ssz.com (Jim Choate) on Mon, 27 Nov 8:54 PM >Don't hold your breath. The current market surveys say >that there is no market for them. Check out this weeks >PC Week or Mac Week, as they both have several >articles discussing this. Bottem line is that the under >$1000 computer seems to have no future either in >industry or the home. Peter Lewis reports in today's NYT on "doubts about the fantasy of a $500 'Network PC' " but quotes Eric Schmidt of Sun saying, "They will exist and they will be very successful, and not just from Sun and Oracle. The price points are going to be pretty low, and they'll look more like consumer electronics." Anybody want this mixed review send us a BOX_top.

2 1

Inexpensive Crypto Boxes...
by Jim Choate 17 Dec '03

17 Dec '03

Hi all, The recent discussion on the <$1000 computer/appliance/digital-widget got me to thinking and I had a spasm... The new Sony Play Station is operating under a stripped down Unix. Considering the speed that these boxes are designed to run at it seems a natural for somebody to come up with a crypto workbench on ROM to install in one of these babies. Could program one of the game controller ports as a serial port and hook it to a Linux box (for example). Ta ta

3 2

Re: The future will be easy to use
by Jonathan Zamick 17 Dec '03

17 Dec '03

>* Clear goals. > >* A leader, someone who would call the shots, and would also serve as the >person you'd have to convince. > >* Open communications. Shrouding a project in secrecy is a good way to >kill it. This is one potential advantage we have over the spooks. > >It _is_ doable. I know the skill is out there. Wei Dai, Eric Young, Peter >Gutmann, and others have proved themselves quit capable of writing good >solid code. Sameer Parekh has done an incredible job with PR. Phil Karn, >Dan Bernstein, and some others (who I'm not sure want to be named) are >talking to the government. GUI I'm less sure about, but I'd hope that some >cpunks would come out of the woodwork. > >It is not a matter of ability, but of will. It is also a matter of funding of course. While development can be donated time, the rest often takes money. Still, its something to look into. Handling RSAREF is sapping much of my time, otherwise I'd jump right in, however I like to always pause before committing my time to endeavors. I wouldn't mind helping out though. Certainly Consensus probably has some resources with its own contacts to contribute. I agree with your points though. Another thing to consider, are some alternate methods of enterprise design that involve better communication, iteration of goals vs product, etc. (Actually I need to work on a speech about this that is coming up soon. Yet another project. :) Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

3 2

Judge won't drop Netcom from suit
by Joey Grasty X3697 P6611 17 Dec '03

17 Dec '03

Check out the story on the Scientology suit. http://www.sjmercury.com/scie1127.htm

2 1

Netscape 2.0b2 allows for invasion of privacy (fwd)
by Graeme Cross 17 Dec '03

17 Dec '03

Talking of Netscape - this posting prompted me to forward it given the security and privacy implications inherent in the problem. Cheers Graeme ------- Start of forwarded message ------- >From: Scott Weston <scott(a)tripleg.com.au> >Subject: Netscape 2.0b2 allows for invasion of privacy >Newsgroups: aus.net.announce,comp.privacy >Date: Fri, 01 Dec 1995 11:09:06 +1100 Hi 'Net Dwellers, First off - I've posted this before (however not to this group) and only got a response from the Netscape Corp. They were glad I found the problem and said that they would fix it, however I feel that people should know about it. Also I would like people to help me spread this document around, i.e. if you know of a newsgroup (or people) that would find this interesting then please re-postit. On with the problem... I've recently got hold of the latest netscape, and was (at first) very excited about the new "LiveScripts" that it supports. If people don't yet know - these "LiveScripts" allow you to put small programs into your web page that is then executed by the Netscape client. There is no DIRECT way for these programs to send information back to the owner of the web page, however I was able to do it in a not-so-direct way. The "LiveScript" that I wrote extracts ALL the history of the current netscape window. By history I mean ALL the pages that you have visited to get to my page, it then generates a string of these and forces the Netscape client to load a URL that is a CGI script with the QUERY_STRING set to the users History. The CGI script then adds this information to a log file. Now if this hasn't quite CLICKED yet lets do a little example. Johnny Mnemonic starts up his newly acquired version of Netscape2.0b2 to start his daily "surf" session. First he decides to check his CD-NOW purchase and uses the handy Auto-Login URL. Then he decides to go to Lycos and do a search. In his search he find my page, which he decides to visit. Suddenly he is transported, not to my main page but to one of my CGI scripts, which in turn happens to have ALL the URL's he just been to in it. This means that in my log will be: - the URL to use to get into CD-NOW as Johnny Mnemonic, including username and password. - The exact search params he used on Lycos (i.e. exactly what he searched for) - plus any other places he happened to visit. I do this in a way that the user will KNOW that it has happened and will _hopefully_ email Netscape and tell them they are NOT impressed. But it would be EASY for me to change the CGI script so that the user is unaware that it has actually happened, unless they closely examine their URL history (in fact they'll probably just think its a netscape bug). If you're skeptical about this then do the test yourself. Get netscape 2.0b2 and do some normal surfing, and then go to Lycos. Do a search for: scotts car boot sale which should return the URL - http://www.tripleg.com.au/staff/scott Click on the URL and sit back an watch. First my main page will show up but a little while later you should be transported to a CGI bin script that will show you your URL history. I have tested this with both the Linux 2.0b2, and Solaris 2.0b2 versions and both have done the same thing. I would be interested in knowing if it happens for ALL versions of Netscape2.0b2. The log file does log the User Agent (i.e. the name of the platform you are using) so by simply going to the page I will know that your version of Netscape is also open to this form of attack. Currently I can find no way to configure Netscape2.0b2 to NOT run LiveScripts - and at the very least this option should be quickly added to the next version of netscape to be released. But a far better solution (IMHO) would be for netscape to pop up a window before running the LiveScript and let you know what the LiveScript wants access to, e.g. if it only wants to print out the current time then that's OK, but if it wants to read my history list and then transport me to a CGI script and add me to a logfile then maybe I would say NO. I think I've said enough.... If you've got any further questions, or want some more information just email me : scott(a)tripleg.com.au -- Scott. Quote from a car accident insurance claim: "I told the police that I was not injured, but on removing my hat, I found that I had a skull fracture." ------- End of forwarded message -------

6 6

Q: Legal liability for Certification Authority
by Greg Rose 17 Dec '03

17 Dec '03

In the last few weeks, mostly under the subject of creating a Cypherpunks Certification Authority, someone mentioned legal liability of a CA if a certified identity was misused. I am looking for material to pass on to a REAL, PAID net-savvy lawyer relating to this question. In return for the money we pay him, he will return an opinion on just what liability exposure would be for, say, a large technical users group who got into the CA business for PGP keys. And/or what disclaimers or indemnities would be needed. I would be happy to make his legal opinion available to the list. IANAL, so I don't know just what precedents, decisions, regulations, and so on might be relevent. More information is always a good thing. Please: 1. reply to me by mail, not the list, unless there is more general relevence to Cypherpunks. I'll summarise. 2. Speculation is not useful. thanks, Greg. -- Greg Rose INTERNET: greg_rose(a)sydney.sterling.com Sterling Software VOICE: +61-2-9975 4777 FAX: +61-2-9975 2921 28 Rodborough Rd. http://www.sydney.sterling.com:8080/~ggr/ French's Forest 35 0A 79 7D 5E 21 8D 47 E3 53 75 66 AC FB D9 45 NSW 2086 Australia. co-mod sci.crypt.research, USENIX Director.

1 0

META: Lycos & Searchable archives
by Leslie Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Someone has expressed concern to me that the cypherpunks archives are searchable via Lycos. Said person doesn't mind having the archives searchable to the smaller audience of people who go to the we-site, but is unhappy about net-wide searches turning up cypherpunks articles. Can we try to find a consensus on this? My initial inclination was to shrug the concern off (properties of information, etc, as well as c'punks being a more-or-less anarchy and the express desire for some sort of searching mechanism for c'punks), but I thought I'd double check as I've been mostly out of touch for the better part of a year. - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBML1HiCoZzwIn1bdtAQEtjgF/d7GBzgELk41OE+/pZxnZkzn+qYLRHmTn 8mbScBdkko83n4sxGjwFRQJyN5IlPCJQ =nFDi -----END PGP SIGNATURE-----

2 1