December 2003 - cypherpunks-legacy

Re: New Netscape bug (in version 1.12)
by Arve Kjoelen 17 Dec '03

17 Dec '03

It doesn't crash Solaris 2.4 running X11R5 (Netscape 1.1N) > I need help testing this bug on other platforms. I have created > a test page. Go to http://www.gl.umbc.edu/~rcromw1/crash.html > to test. -Arve

2 1

Telco Blob
by John Young 17 Dec '03

17 Dec '03

Financial Times of October 3 has a humongous 40-page insert on international telecommunications -- markets, business, technology, and, to be sure, the tele-players lying, cheating, fearing the "computer hacking industry," whimpering with delirious greed at the bountiful, multicultured consumer's mindless credulity of tekkie- gadgets. For the mil-beguiled Colin Powells there's even a colored global map of Big Blob telco strategic rapacity. A tiny cheering blip of machine-wash-n-readable T-stupidity on p. 34: Sutton dismisses worries out security -- despite a recent successful attempt to break the security on Internet financial transactions. An incident in August, when a researcher at the French National Institute of Computer Science and Control (INRIA) broke into the Internet security system, raised concerns about security. "A lot of security is about perception -- after all, every code can be broken. The INRIA incident only involved breaking a single code and needed massive computer resources to do it," says Mr Sutton.

1 0

ZIT_pus
by John Young 17 Dec '03

17 Dec '03

10-3-95. Wash Rag: "Employment Database Proposal Raises Cries of 'Big Brother'." Critics say that in its zeal to combat illegal immigration, Congress is steering the nation toward an "Orwellian nightmare," an era of all-knowing federal oversight whereby officials will be able to verify citizenship by using high-tech national identification cards. So far, no member of Congress has openly called for a national ID card, at least by that name. Rep. Bill McCollurn (R-Fla.) said he intends to offer an amendment on the House floor to create a "more secure" Social Security card with a photo, a hologram and "perhaps a biometric identifier." Microchip technology can make ID cards especially intrusive. According to an analysis by the Cato Institute, one newly patented ID card can hold a photo and 1,600 pages of text. Another identification system developed by a major defense contractor consists of a microchip the size of a grain of rice that can be implanted under the skin with a syringe and read with a scanner. ZIT_pus (7 kb)

1 0

Re: New Netscape bug (in version 1.12)
by Steven Champeon - Imonics Development 17 Dec '03

17 Dec '03

| From owner-cypherpunks(a)toad.com Tue Oct 3 04:39:23 1995 | Subject: New Netscape bug (in version 1.12) | X-Mailer: ELM [version 2.4 PL24alpha3] | Content-Transfer-Encoding: 8bit | Sender: owner-cypherpunks(a)toad.com | X-Status: | | | C'punks, | I just got back from a vacation in Raleigh, and downloaded the | new "fixed" Netscape 1.12. It took me about an hour, but I've | discovered another bug and potential security hole. This one relates | to mailto:. Well, I'm still in Raleigh :-) but this doesn't do much of anything to my Macintosh, Netscape 1.1N, under System 7.5. Looks like a bug in your X server. However, Netscape 1.1N for Solaris, running under X11R6 X server, dumps core fairly quickly. I haven't had a chance to try out the 1.12 version on UNIX or Mac, but the 1.22 32-bit Windoze version handles it fine under NT 3.5.1. Steve -- Steven Champeon (919) 469-7833 Technical Lead, schampeo(a)imonics.com Imonics Web Services webmaster(a)imonics.com

2 1

Re: New Netscape bug (in version 1.12)
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ray Cromwell wrote: > The bug is as follows. Create a HTML file with a hyperlink containing >the following URL > > foo > >This bug doesn't seem to crash Netscape, instead, it crashes my XServer >as soon as the mail window pops op. I'm too tired right now to try to >analyze it, but it might be another stack bug, this time, in the X >libraries because Netscape isn't doing any sanity checking. > >I need help testing this bug on other platforms. I have created >a test page. Go to http://www.gl.umbc.edu/~rcromw1/crash.html >to test. Nothing on Mac Netscape 1.12 nor on the latest Windows 3.x Netscape. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBgAwUBMHFRwHIf3YegbdiBAQGR6wJXTcCiqgHeunkdLyd1kGUhRTx2JP0p1PN3 UKdThUKLTL7utPDFevRORjF/3B/ziVszJlk+5PASfQeF6DlKYG8ib9Fr0OdW1E0p CPRK =6T18 -----END PGP SIGNATURE----- Dietrich Kappe | Red Planet http://www.redweb.com Red Planet, LLC| "Chess Space" | "MS Access Products" | PGP Public Key 1-800-RED 0 WEB| /chess | /cobre | /goedel/key.txt Web Publishing | Key fingerprint: 8C2983E66AB723F9 A014A0417D268B84

1 0

Re: CISS TSP MISSI
by Rich Salz 17 Dec '03

17 Dec '03

I don't know which is more annoying: The silly 3/4K of Comments that the freezone remailer puts out. (The use constraints are useless to email recipients, after all); or That some anonymous bozo is posting open WWW data to cypherpunks. I hope that the first, at least, can be fixed. Avoid clutter; note the reply-to. /r$

1 0

Re: economic espionage (@#$%^&*) (fwd)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

NY Times, Oct 3, 1995, Business Employment Ad. 1984 Sarajevo, Olympics; 1995 Sarajevo, Battleground Every day in our world, new threats, new challenges, new missions emerge. The people of the Central Intelligence Agency are dedicated to meeting the missions of the day, providing information and resources that aid decision makers in solving the problems and responding to issues that affect us all. You can play an integral role in our mission, while advancing your own career. The Central Intelligence Agency is currently seeking professional men and women who will be comfortable living and working abroad. These positions entail extended overseas assignments in various parts of the world. Previous service in long-term foreign assignments, in either business or government positions, is a definite advantage. Changing international economic, political and social conditions make a broad range of professional backgrounds suitable for these positions. Your experience may be in economics finance, marketing, or general business. Scientific or technical experience in engineering disciplines, physical sclences, biological sciences, or any area of high technology research and development is of particular interest. These overseas positions require more than appropriate professional experience. Successful candidates must also demonstrate a high degree of individual initiative, self reliance and personal integrity. Naturally, the ability to speak or learn a foreign language is expected along with above average communications skills, both oral and written. A Bachelor's degree is a minimum requirement. Advanced degree or military service is a plus. All applicants must successfully complete a thorough medical and psychiatric exam, a polygraph interview, and an extensive background investigation. U.S. citizenship, or eligibility for citizenship, is required. CIA encourages applications from men and women of every racial and ethnic background from all parts of the nation -- we represent America and we want to be representative of America. We will respond within 30 days if your application is evaluated as being of interest. Central Intelligence Agency Dept. 15FS P.O. Box 12002 Arlington, VA 22209-8727 Fax: 703-482-7395 CIA is an equal opportunity employer [CIA eagle-headed all-points shield logo] [Motto] Meet the Challenge of a Changing World -----

2 1

Re: New Netscape bug (in version 1.12)
by Steven Champeon - Imonics Development 17 Dec '03

17 Dec '03

| From owner-cypherpunks(a)toad.com Tue Oct 3 11:07:33 1995 | Subject: Re: New Netscape bug (in version 1.12) | Cc: rjc(a)clark.net, cypherpunks(a)toad.com | X-Mailer: ELM [version 2.4 PL24alpha3] | Content-Transfer-Encoding: 8bit | Sender: owner-cypherpunks(a)toad.com Ray wrote, in reply to my message: | > | > Well, I'm still in Raleigh :-) but this doesn't do much of anything | > to my Macintosh, Netscape 1.1N, under System 7.5. Looks like a bug | > in your X server. However, Netscape 1.1N for Solaris, running under | > X11R6 X server, dumps core fairly quickly. I haven't had a chance | > to try out the 1.12 version on UNIX or Mac, but the 1.22 32-bit | > Windoze version handles it fine under NT 3.5.1. | | Could someone try this on Solaris using 1.12? Just tried it, with two different mailhosts - the first gave the following error: An error occurred sending mail: The "To:" header was invalid. Please check the email address(es) and try again. The second accepted the mail. (?) Neither caused it to core dump, under the X11R6 X server, Solaris 2.4, running Openwindows. Cheers, Steve -- Steven Champeon (919) 469-7833 Technical Lead, schampeo(a)imonics.com Imonics Web Services webmaster(a)imonics.com

1 0

STT Authentication
by Andrew Roos 17 Dec '03

17 Dec '03

Hi All Ramblings from a disturbed mind... I've had a look at Microsoft's Secure Transaction Technology (STT) protocol. The purchase order/authorization/receipt phase is authenticated using the card holder's credential ("cred", in MS speak). The credential is similar to a certificate except the binding is between a credit card and a public key, rather than between an identity and a public key. What interests me is the procedure for issuing cred's to cardholders. If I'm reading the spec right, this is done in response to a "Cardholder Credential Request" message which includes card details and the public keys to be associated with the card. This data, along with a SHA hash of the data, is encrypted and sent to the issuing bank, which then responds with a "Cardholder Credential Response" containing the signature and key-exchange creds, also encrypted. However there does not appear to be any authentication whatsoever on the credential request message, presumably becuase the cardholder does not have a published public key at the time when this message is issued. It may be that authentication is out-of-band - e.g. the bank may phone the registered owner of the card # before issuing a cred response message - but there is no mention of this in the spec. If there isn't OOB authentication, then this is a major hole in the protocol, since anyone who knew a credit card no, name and expiry date could request a cred for that card, and then go shopping... If someone will just tell me what I'm missing (because this is too obviously f'd up for even Uncle Bill) then I'll go sit on top of my mountain again and hum softly to myself. Andrew BTW, same apears to be true for Merchant creds. ________________________________________________________________ Andrew Roos <andrewr(a)vironix.co.za> // C++ programmers have class (but not much inheritance) PGP Fingerprint: F6 D4 04 6E 4E 16 80 59 3A F2 27 94 8B 9F 40 26 Full key: ftp.vironix.co.za/PGP-keys/AndrewRoos (or key servers)

1 0

Re: X.509, S/MIME, and evolution of PGP
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Tue, 03 Oct 1995 11:37:22 -0700 >From: Bill Stewart <stewarts(a)ix.netcom.com> >At 10:24 AM 10/3/95 EDT, Carl Ellison <cme(a)TIS.COM> wrote: >>I hear you but I object. >>Going along with the majority may be the fastest way to get a result out >>but it's morally wrong. > >A zillion and a half people are about to get the next version of Netscape, >which uses X.509 certificates, and they can get free Verisign personna >certificates to go with them; stores can get inexpensive ones. >They will use this for secure email, like it or not, >and as they discover the need for better certification (when there's >money involved), they'll go get it. Wherever they can. Yup. Verisign is probably going to fight hard to keep their certificate model. On top of them, there's the US Postal Service and a few others, fighting over the chance to set up a certificate hierarchy. The whole world is thinking of physical people and of tying things to those people. They think of names as the only handle on (pointer to) people. ...so they see certificates as right and proper. We need to show them a better way. (Tie attributes through the key to the person -- not through the person to the key.) >The question is, will they get a Web of Trust model from us, >or will they stick to the hierarchical model? As several have pointed out, a certificate structure (X.509, PGP or mine) can be used in a hierarchy, if you want it, or not if you don't. We don't care. What I care about is that a signed thing (one link in a chain of assertions) speak directly to what it is signing ("this key is good for _________") or ("the person who demonstrated to me that he knew the private key for this key has red hair and wore glasses") -- rather than try to sidle up to existing people structures (by tying to names of people) and then, on discovering that the people-structures aren't as strong as the digital signatures, make the people structures stronger (e.g., by unique ID number on a national ID card, with thumbprints for verification). > If we get something >halfway decent out there, fast enough, ideally with support >or toleration from Netscape, people will at least have distributed trust >models in their worldview, and will insist that the tools they use and >build around it be compatible. Otherwise, almost all of them _will_ be >using the hierarchical-only structure, and the next big Internet application >that >needs security will latch onto the now-big software base, and may not >be as decent as Netscape about the trust models they accept. Yes -- I agree. We should get cracking on this. >If you can define a better relational trust model than the Web stuff, >fast enough to avoid this, great! Go for it. But it'll be much easier >to get something like that adopted in a non-hierarchical world than in >a world of Drivers' Licenses on the Information Superhypeway. I'm still talking web of trust -- only I'm removing the person's name (or e-mail address) as a link between the assertion and the key. Haven't I described this well enough? Do I need to write it up in more detail? How about some analogies? I could have a driver's license (giving my name and address), a piece of paper saying that I (at my address) own bank account number 01732 at First Security Bank, and a certificate from Verisign also giving my name and address. This ties my public key to my driver's license (assuming I'm the only Carl Ellison at my address (which I wasn't, as a kid) and that I don't move). Alternatively, I can have First Security Bank open account 01732 for me and create a certificate binding my public key to that account number. Now, I can use that key to sign anonymous checks. (The bank knows me, perhaps, but the payee doesn't need to.) To tie my name to the public key, I sign my own certificate saying ``The person who knows the private key for 61E2DE7FCB9D7984E9C8048BA63221A2 goes by the name "Carl Ellison" and receives mail at "cme(a)acm.org".'' I don't need anyone else to attest to the validity of that statement because it's uni-directional (from key to my name), not the other way. It's only the other assertion direction which requires some witnesses to attest to validity, because the name is not capable of doing a digital signature without a key. [That is, if you were to go the other direction (which is what X.509 or PGP try to do), you need to sign a key with a name (DN or UserID). You can't sign with a DN or UserID. You can sign with a key. So, you have to fall back on human witnesses to use their keys to sign in place of the name (DN or UserID) and you have to decide how to trust those witnesses. If you reverse the arrow of assertion, this particular problem goes away.] - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)tis.com http://www.clark.net/pub/cme | |Trusted Information Systems, Inc. http://www.tis.com/ | |3060 Washington Road PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2| |Glenwood MD 21738 Tel:(301)854-6889 FAX:(301)854-5363 | +--------------------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHGLpVQXJENzYr45AQFS2QQAidMwZMBbv2ap2S4ZNVIWfZO6/W1FHOaw GZYHQk38o0qD5YOrth1Hab2IiyuvLtBG38hHJ8aZf3NsvzswSvNExuBQy+eLns8m ZcM2B4qPMRWOP1XMmAPaoaknRTmonKP/acO4KcKIR0K+x+n1DNwTwyDx4LbRjOnn hHp3fFfD7iI= =Fccl -----END PGP SIGNATURE-----

1 0