December 2003 - cypherpunks-legacy

Re: ADDRESS DATABASE?
by John Pettitt 17 Dec '03

17 Dec '03

At 01:32 PM 12/14/95 -0600, turner(a)TeleCheck.com wrote: > >Just think, with new and improved "interactive TV" you will be able to >get commercials tailored to your purchasing habits (A doctor would get >an commercial for an expensive car, while Joe Sixpacks would get the Ford >Fiestiva). > > I'm doing it now - software.net serves distinct ads to Mac, Windows, Text and Unix based browsers. On the name database side the PO runs somthing called National Change of Address which tracks who moved where and allows direct marketing companys to clean their lists. Almost everybody sells address change data (utilities, the PO, credit companys) - I'm getting tons of "welcome to the neighbourhood" mail since I moved. John Pettitt jpp(a)software.net "why not, and who said so?"

2 1

Re: ADDRESS DATABASE?
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:32 PM 12/14/95 -0600, you wrote: >sandfort(a)crl.com said: >> Something of privacy interest happened to me yesterday. I phoned a >> company to ask for a copy of their catalog. The phone clerk asked >> for my last name and zip code. After receiving that info, the clerk >> asked me, "Is this your full name and address?" and then gave them >> both correctly. I was taken aback. > > Taken aback? Its only going to get worse in the future. As Telcos, credit >card companies, etc., start looking for new ways to make money I think >selling information about you will increase dramatically. I'm in the process of moving and getting new phones, and Pac Bell asked me if it was ok to send my Social Security Number to my long-distance carrier. I told them "no, but you don't have my SSN anyway" "Oh, you're right, we don't; can we have it" "No" "OK. Would you be willing to give us your driver's license number or another form of ID? We've just started asking for this recently." "Is it required?" "No, it's optional, but I have to ask" "No, thanks" Sounds like you're right about them getting into the info-selling business. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Re: Jim Quinn interview of James Norman
by Ed Carp (ecarp＠netcom.com) 17 Dec '03

17 Dec '03

> Date: Wed, 13 Dec 1995 09:49:56 -0800 > From: Martin Janzen <janzen(a)idacom.hp.com> > To: ecarp(a)netcom.com > Subject: Re: Jim Quinn interview of James Norman > > This is the third time you've cross-posted this long and completely > irrelevant message to Cypherpunks. Please stop it! No, sorry, I only ACCIDENTALLY cross-posted it *ONCE*. Any other posts you are seeing are NOT MY DOING.

1 0

Potential defense against timing attack on Diffie-Hellman
by Bill Stewart 17 Dec '03

17 Dec '03

The timing attack on Diffie-Hellman depends on assumptions about what multiplications are being made, and in what order. But you don't need to do them in order. The standard approach to calculating Y**x mod m is to calculate Y[1] = Y, Y[2] = Y**2, Y[3] = Y**4, .... Y[logx] = Y**(logx), and while you're doing this keep a running total r[i], where r[i] = (bit[x,i]) ? (r[i-1]*Y[i]) : r[i-1] all arithmetic modulo m (and all indices possibly off by one :-) This may be a bit memory-intensive for a smartcard, but there's no need to calculate these partial products in order; precompute the Y[i], pick a random permutation of 1..(logx), and compute the partial products in that order. This still leaks the number of 0 and 1 bits in x, but it doesn't say what they are. You probably still should multiply r[i-1]*Y[i] whether you're going to need it or not; I don't think the method hides enough information otherwise, but that needs more analysis. Cost - mostly administrative, plus the memory, since keeping track of permutations of small integers is cheap relative to bignum multiplication and modulo calculations. You also need a random number generator of some sort; LFSRs seem to be an easy way to do permutations on the fly, so seed them with something decent. How effective is it? I'm not sure - I'd need to do a lot more analysis than I've done so far, and the long version of Paul's paper would help :-) But at first glance it looks like it makes it much harder; no two calculations are in the same order, so feeding the system related Y = g**y mod m each time doesn't tell you much. As a further annoyance to the listener, split the permutation at random into two or three pieces, compute their products separately, and then multiply those partial products together. (Don't try this at home without analyzing whether it may leak more information than it conceals...) At very minimum, take two numbers you've got lying around and multiply them every once in a while :-) #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Re: e-mail forwarding, for-pay remailers
by John Pettitt 17 Dec '03

17 Dec '03

Rich Graves wrote: [ about AOL ] > >They didn't check it very thoroughly last week. I think they just do some >kind of checksum or maybe an assigned-numbers list lookup; it's too fast >to be anything else. It takes 6 seconds to to pre approve a card for $1 and do an AVS (Address Verification). If you don't have a dedicated line to your accepting bank it takes ~25 secods with the dial up. Well within the time it take AOL to validate an account. John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 Favorite quote: "Security is mostly a superstition. It does not exist in nature, nor do the children of man as a whole experience it. Avoiding danger is no safer in the long run than outright exposure. Life is either a daring adventure, or nothing." - Helen Keller

1 0

Re: ADDRESS DATABASE?
by Lynne L. Harrison 17 Dec '03

17 Dec '03

The best way to circumvent something like the below occurring is to have your home phone number listed under a pseudonym with no street address listed - and block out *69 and caller-id. If some entity wants your phone number, give them your business number. >>Something of privacy interest happened to me yesterday. I phoned >>a company to ask for a copy of their catalog. The phone clerk >>asked for my last name and zip code. After receiving that info, >>the clerk asked me, "Is this your full name and address?" and >>then gave them both correctly. I was taken aback. >>Does anyone know how this trick was done? > > What trick? For ~$150, you can buy a CD-ROM-set DB with every listed >>phone number in the U.S. on it, faxes too; > ******************************************************* Lynne L. Harrison, Esq. | "The key to life: Poughkeepsie, New York | - Get up; E-mail: | - Survive; lharrison(a)mhv.net | - Go to bed." *******************************************************

1 0

Re: ADDRESS DATABASE?
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

>On Thu, 14 Dec 1995, Sandy Sandfort wrote: >> Yeah, maybe, but my original question was, "does anyone KNOW how >> the trick was done? ^^^^ Sandy, The phone companies sold the information as soon as you moved. ^^^ ^^^^^ ^^^^^^^^^^ ^^^^ ^^^^ ^^^^^^^^^^^ ^^ ^^^^ ^^ ^^^ ^^^^^^ It's called the Blue Book, any library has one for your area. Welcome Wagons and the like buy them. You can buy lists by address, sequential phone #'s, types of services people order, etc. A recent real-life example is this: I ordered caller-id on my phone in Nov. I already have had three direct mailings for security devices. It is assumed by being a girl, and ordering caller ID I am in fear. -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

And the standard continues to lower...
by The user formerly known as Leslie Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- If the misuse of "One Time Pad" wasn't enough for ya, check out this ad that I was e-mailed. And the chair of a CS department, no less. - ------- start of forwarded message (RFC 934 encapsulation) ------- Subject: Secure No-overhead Online Order System for Publishers Date: Wed, 13 Dec 1995 12:24:03 -0800 (PST) A secure no-overhead online title-ordering system is now available. It may be viewed in operation at the home page for Blue Water Publishing, a publisher, software developer and distribution company, at http://www.bluewaterp.com/~bcrissey/ or from the online bookstore area of ISCNI, the Institute for the Study of Contact with Non-Human Intelligence at http://www.iscni.com Blue Water's innovative online ordering system is called SimplySafe. It is a needle-in-the-haystack approach to online security. It requires no encryption or secure servers, yet the probability that a dedicated hacker scanning 100 internet messages a second will intercept a usable credit card number sent via SimplySafe is less than the probability of picking our Sun out of the Milky Way. That is less than 1 in 200 billion. Safe enough for most folks. There are easier ways for a hacker to pick up credit card numbers than to waste time with SimplySafe transactions. Try it out! SimplySafe currently supports secure online orders from Blue Water Publishing, Wild Flower Press, Swan-Raven & Co., and ISCNI. Direct inquiries to SimpleSafe(a)aol.com ***Dr. Brian L. Crissey, Chair CS Dpt, Linfield Col., McMinnville, OR 97128 (503)-434-2426 brianc(a)linfield.edu Professionals built the Titanic, amateurs built the Ark... - ------- end ------- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMM9LGSoZzwIn1bdtAQEtqwGAnH6mMxeUPhVn/js6zJKocvMwKnN5+VHv 95Zwe2qL3cZOycluLA4Qxl20buL8PApy =VS5o -----END PGP SIGNATURE-----

2 1

Re: Secured RM ? (source) (bounce-fwd)
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

Forwarded message: > From MAILER-DAEMON Thu Dec 14 21:05:20 1995 > > ----- Transcript of session follows ----- > 550 hellspawn.gate.net (tcp)... 550 Host unknown > 554 <root(a)HellSpawn.gate.net>... 550 Host unknown (Authoritative answer from name server) > > ----- Unsent message follows ----- > Subject: Re: Secured RM ? (source) > To: root(a)HellSpawn.gate.net (root) > > Have you considered using "pgp -w filename" ? It doesn't take wildcards, > but that's arguably a feature :) -Futplex <futplex(a)pseudonym.com>

1 0

PAY-OFF TIME FOR BUG-BUSTERS, NETSCAPE PLEDGES "DOGFIGHT"
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Fri, 15 Dec 1995, Alice de 'nonymous wrote: > Can anyone tell me whether Ian Goldberg and David Wagner got their $25,000 > from Netscape for finding the HUGE security flaws in Netscape's existing > product line?? > > Alice de 'nonymous ... <an455120(a)anon.penet.fi> ^^^^^^^^^^^^^^^^^^^^^^^^ Heh, hey Alice, you know this discussion a short time ago where you claimed that you wouldn't use PGP for signing because it wasn't secure or something, what's with the use of the penet address? Surely a penet address offers even less protection for your id? Or have you done something nifty like create the penet address with a nymserver address? (the real) Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMNHFeIbu8OQjKS7RAQFsmAP/SKKz7XCVmTxUQhLL+IEQaleMaTgp+rCO GAsCDcESY6DBDd3NLR07fkNxZufGxyTFqOeL8SFlH5fMGYvwuLrytLwc9guqkr5I aAXiq+hz13GHhoCkr0SnK+ti1M8ERj8EwTvyUWHnUy4b3Nb4K8oD0OzgZwcHVMkP jvdsCUnQQfo= =z2td -----END PGP SIGNATURE-----

1 0