December 2003 - cypherpunks-legacy

PGP replay attack
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There has been some discussion on using replay attacks against PGP recently. However, a timestamp is stored in the signature packet and is signed along with the plaintext intended to be signed. This eliminates the need to include a timestamp in clear-signed data. Someone can still send a signed e-mail to a third party that was not the original recipient and make it appear as though the sender did actually send the message to the third party (e.g. Alice sends signed message to Bob Bob sends message with faked headers signed by Alice to Carol Carol believes Alice actually sent the message to her) Such an attack would have to executed shortly after the message was originally clear-signed. However, including timestamps in text to be signed is not necessary. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPhourZc+sv5siulAQHTTAP/XBlrV7nHd5pR9aTXr2Uk0M0fw4I6IjZZ xeCx++vuIjcQuo/k8xH9YvBbn+MuoE11xbVLD58xYbELuVSdMUzCQ1mpQMho8mzs O0ALr8dahq0N0Gl5kLwb97MzgJOgTwy6NSIK6883NCktAWJMsFoADpdzmDGWQbTc ZzXJ3w5OiAQ= =fWJb -----END PGP SIGNATURE----- -- finger -l markm(a)voicenet.com for PGP key http://www.voicenet.com/~markm/ Fingerprint: bd24d08e3cbb53472054fa56002258d5 Key-ID: 0xf9b22ba5 "The NSA can have my private key when they pry it from my cold, dead neurons." Unknown

1 0

Crypto anarchist getting through customs
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:21 PM 1/15/96, Simon Spero wrote: >When I was a student and had long hair, I used to always get questioned >when going throught customs. After graduating, and having normal length >hair, I had a lot less trouble. Long serving customs officers develop >models of characteristics that in the past have been indicative of >smuggling or wrong doing. Given that most points of entry are >under-staffed, there's not much else they can do. I was returning from France and Monte Carlo, where I'd given a talk about crypto anarchy, through U.S. Customs at San Francisco. Having just heard of Matt Blaze's experiences, I figured I'd be truthful and see what happened. (I can't recall the exact words, naturally, so this is just a rough version. Things were uncrowded at the Customs gate, and I was the only one in his line, in case it matters.) Young Customs Officer (YCO): "Where are you coming from?" Me: "Monte Carlo. And France." YCO: "Business or pleasure?" Me: "Business." YCO: "What was the business?" Me: "I met with cryptographers and bankers to discuss cryptography and political implications." YCO: " 'Cryptography'? " (A look of no comprehension.) Me: "Yes, cryptography. You know, secret codes, ciphers, stuff like that." YCO: "Were there any foreigners present?" Me: "Yes, it was in Monte Carlo. There were some Russians there, and lots of others." YCO: [brief pause] "Did you bring anything back with you?" Me: "No." YCO: [waved me through] In my carry-on luggage I had half a dozen magneto-optical disks, carring about a gigabyte of stuff. (As props to use during my talk on the France/Monte Carlo side, ironically, to show that borders are fully transparent.) By the way, there were no outgoing checks [unlike Matt, I didn't seek out permission to export anything], of course, and no checks at my entry point at De Gaulle Airport in Paris. [Though there were lots of cops with machine guns, and lots of dire warnings that bags left unattended might be destroyed, a precaution against bombs.] No checks into Monte Carlo, of course (I lived for a year near Monaco, so I knew this would be the case). Frequent travellers to Europe will no doubt confirm what I'm saying. I travelled to dozens of countries in Europe a while back, and never was checked at any borders, save for a quick glance at my passport. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

7 13

DEC AltaVista Closer To Commercialization [NOISE]
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Digital's Samuel H. Fuller, VP of corporate research for Digital, and Alan Jennings, Digital's manager of advanced technology business development, also told Newsbytes that Alta Vista has "re-started its Web crawling," to add even more pages to the total of 60 million Web pages -- representing half of all pages on the Web -- that were already indexed by December 15, when the new "super spider" Web facility opened to the public. "And as Alta Vista took off as the fastest growing Web site, we have quadrupled the capacity of our AlphaServer 8400 system from two to eight processors, and doubled the memory," noted Fuller. This leaves a "factor of two headroom" in terms of both processing power and memory, meaning that a single 8400 system should be able to host and accommodate an index for the entire Web, the VP added. The Alta Vista site also uses a smaller Alpha server to house the "super spider" itself. As reported in Newsbytes on December 15, Jennings previously said that Alta Vista is able to search up to 2.5 million Web pages a day. Lycos, Alta Vista's closest competitor, had searched only 7 million Web pages up to that time, and the World Wide Web Worm about 3 million Web pages, in comparison to Alta Vista's 60 million pages, Newsbytes was told. Alta Vista's high search speeds are made possible by the ability of the super spider to algorithmically "breed" batches of smaller Web crawlers, together with the use of Alpha processing power and high-speed ATM (asynchronous transfer mode) networks, according to Jennings. Fuller and Jennings told Newsbytes this week that Digital is currently assessing Alta Vista usage patterns and the half dozen- or-so "business inquiries" received each day to decide where to take Alta Vista on a commercial basis. On Friday, December 15, Alta Vista received 300,000 hits, a number that grew to 600,000 on Monday, December 18, 1.5 million by Wednesday, December 20, and 2 million per day following the December holidays, according to Fuller. In earlier beta testing, some 10,000 users employed Alta Vista to look up references to themselves and their families, to locate old friends and college roommates, and to access market research, information about the Web, and facts about corporate travel destinations. Like their counterparts within Digital, many Web users among the public at large have been employing Alta Vista for genealogically search purposes, Jennings said. Alta Vista is also emerging as "a real solid research tool covering the breadth of the Web," he asserted. In addition to obtaining an index of all Web sites containing a specified search term, and being able to move to those sites through hotlinks, users can obtain "reasonably good information regarding the characteristics of Web sites," such as "how frequently (the sites) are referenced, and the number of pointers." You can also employ can also employ case-sensitive matches, and limit searches to titles or other specified sections of a document. Digital officials have been impressed by Web users' "ingenuity" in inventing applications for Alta Vista. One company, for example, wanted to get in touch with all other firms with links to its site, he illustrated. Upon learning that Alta Vista is able to search for URLs (user resource locators), or pointers, the user conducted a URL search, and then proceeded to send out a broadcast e-mail message over the Internet to all linked sites. Business inquiries, he reported, have fallen into three main categories: users who want to use Alta Vista internally, license the search engine, or advertise their goods and services on the Alta Vista home page. "We'll start to make decisions on these within the next 30 days, and by the end of the quarter, (the decisions) will be part of our general business plans," Jennings told Newsbytes. "Digital is inching toward decisions on what they're going to do," pointed out Jim Green, an analyst at Summit Strategies. "Clearly, this Web site has met with astounding success. Alta Vista lets you start to make sense of the Internet. It makes you think about exactly what you want, because it will give you everything," the analyst told Newsbytes. "I see Alta Vista as a very useful tool for competitive analysis," observed Greg Kline, director, Network Integration and Management Research, at the Business Research Group (BRG). "I think that as Digital gets closer to finalizing their plans, they'll be speaking more about Alta Vista's most sophisticated search capabilities. And as Web servers become the corporate infrastructure through the "IntraNet,' users will be seeing the need for a tool to index their information assets," Kline told Newsbytes. You can access the Alta Vista home page on the Web at http://www.digital.com . A.E.N.

1 0

Mail to news gateways
by kolivet＠alpha.c2.org 17 Dec '03

17 Dec '03

Could someone point me to a _current_ list of mail to news gateways? - Kay Olivetti

1 0

Re: (none) [httpd finding your identity]
by James A. Donald 17 Dec '03

17 Dec '03

At 05:16 PM 1/13/96 -0800, Jeff Weinstein wrote: > I've removed the code that uses the e-mail address as the > FTP password for anonymous FTPs. You can still enter it by > hand by using a URL of this form 'ftp://anonymous@ftp.netscape.com'. > > [...] > > The fix for this will be in the next [netscape] beta, and the final > version of 2.0. Thank you. This excellent new feature is more important than you know. The FTC is threatening to regulate the net, and is using as its excuse the claim that advertisers will or are threatening to send junk email to be people who browse their web pages. To protect the internet from this terrible threat they wish to regulate every computer that puts up a web page in a similar fashion to their regulation of TV and radio. This simple technical fix deprives the FTC of that excuse. It will have to concoct a new excuse. Unless someone deliberately configures their netscape browser to provide the information, no one can send them junk mail. > Jeff Weinstein - Electronic Munitions Specialist > Netscape Communication Corporation > jsw(a)netscape.com - http://home.netscape.com/people/jsw > Any opinions expressed above are mine. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Respect for privacy != Re: exposure=deterence?
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

> From: s1018954(a)aix2.uottawa.ca > > My apologies for responding to a political post. > > On Sat, 13 Jan 1996, Charlie Merritt wrote: > > > I feel that public exposure > > is enough to put fear into these anonymous government employees. > > You will note that when they get the mad_bomber > > some FBI guy jumps right up and takes credit, live, on TV. > > But when the Air Force orders a $300 toilet seat NO ONE is credited. > > It's interesting how we advocate anonymity for ourselves but not for our > opponents. Feeling righteous? There is a *big* difference between anonymity for individuals, and anonymity for government officials acting in the name of the government. Government has no right to privacy. Individuals do. > Reminds me of the bit from True Names about all the warlocks trying to > crack each other's nyms to enslave each other. Sad? > ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

ITAR Re-write ?
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, Bloomberg, the business news agency, reports 01 12 96: The U.S. Commerce Department will recommend easing export controls on encryption software after a study by the department and the National Security Agency found that American firms are being hurt.... The report's release came on the same day federal pro- secutors dropped a three-year investigation...of...Philip Zimmerman.... The government study comes a week after [the Computer Systems Policy Project] released [its] own study showing ...American companies will lose [maybe $60 billion] in U.S. computer system sales expected in 2000.... The 13-member Project ...includes International Business Machines...and AT&T.... Perhaps the let-go of Zimmerman is less a triumph of right than of might? But economic might is not the only kind of might: [Easing export controls] may pit Brown's department a- gainst U.S. defense and spy agencies.... So... [Commerce Secretary] Brown said his department will pre- pare recommendations for easing [ITAR] controls that should be forwarded to the president "within a few months." Meaning: the 13 Project members should be prepared to pay through the nose in the runup to the '96 gala. And just so they get the big picture: It's unclear if the NSA, the super-secret eavesdropping agency, endorsed the Commerce Department's conclusions in the report it jointly prepared. The newsstory reports ...federal prosecutors dropped [the Zimmerman] investiga- tion without explanation.... No explanation's required. One hostage was released. 13 others were taken. But the one release does afford the new hostages, who have deep pockets, some hope... Cordially, Jim NOTE. The newsstory's headline? COMMERCE'S BROWN PROPOSES REWRITE OF ENCRYPTION EXPORT CONTROLS. Its dateline? WASHINGTON (Jan 12, 1996 5:34 p.m. EST). Its Nando News online filename? biz6_1893.html

1 0

Re: Reach out! Update 01 (CypherPurists trash this)
by dan＠milliways.org 17 Dec '03

17 Dec '03

Regarding the *67 feature to disable Caller ID: This does not stop your ANI information from travelling with your call. It just sets the "privacy bit" to on. So standard consumer-grade Caller ID systems won't see your number. But if the user on the other end is receiving your call over a T1, they can use a Dialogic voice processing card to yield your ANI, even with the privacy bit set. A *much* better way to do this is the following: Dial the Operator. Ask him/her to dial the 800 number for you. This will result in your ANI being (000) 000-5555 (or at least that's what it does in Bell Atlantic land). I tested this a couple months ago using AT&T's 1-800-MY-ANI-IS service. I directly dialed 1-800-MY-ANI-IS and it read back my phone number. Then I had the operator dial it for me and got (000) 000-5555. This service doesn't work anymore, YMMV. Dan *************************************************************** #define private public dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ***************************************************************

1 0

Fwd: Scrambled software gets an OK
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

This was printed in the San Jose Mercury News this morning. I'd have just posted a pointer to it, except that it was in the "private" part of their web pages... Scrambled software gets an OK -- Exports: Foreign encoding unfair to U.S. firms, Commerce Department says. Bloomberg Business News WASHINGTON -- The Commerce Department will recommend easing export controls on encryption software after a study by the department and the National Security Agency found the restrictions are hurting U.S. firms, Commerce Secretary Ron Brown said. Such a move may pit Brown's department against U.S. defense and spy agencies, however, setting the stage for a White House battle over one of the last computer technologies still covered by export controls. ``I'm interested in promoting American exports,'' Brown said. ``If your foreign competitors are exporting products with encryption capability and you are not, that puts you at a tremendous competitive disadvantage,'' he said. Encryption software turns information, such as files and credit card numbers, into indecipherable material that can be sent across networks without fear of tampering to the recipient, who can then unscramble it. Under current U.S. law, encryption technology that exceeds certain technical thresholds is considered a ``munition.'' Those who would export such technology need explicit permission from the government. The United States justifies the export restrictions by saying law-enforcement agencies would be hamstrung in their efforts to stop terrorists, spies and criminals without them. The computer industry counters that encryption software is available from other countries, and the restrictions simply rob U.S. companies of business. The Computer Systems Policy Project, a joint effort of 13 top technology companies released its own study showing that U.S. companies will lose as much as 30 percent of the $200 billion in U.S. computer system sales expected in 2000 because of federal laws limiting exports of encryption products. Brown said his department will prepare recommendations for easing those controls that should be forwarded to the president ``within a few months.'' It's unclear if the NSA endorsed the Commerce Department's conclusions in the report it jointly prepared. Representatives of the NSA were unavailable for comment. Brown's assertion comes a day after federal prosecutors dropped a three-year investigation of Boulder, Colo., software designer Philip Zimmermann, whose encryption program called Pretty Good Privacy was posted on the Internet, the worldwide computer network. Published 1/13/96 in the San Jose Mercury News. -- Thaddeus Beier thad(a)hammerhead.com Technology Development 408) 286-3376 Hammerhead Productions http://www.got.net/~thad

1 0

Mailing List
by Joseph Halstead 17 Dec '03

17 Dec '03

I would like to be included in your mailing list. jhdeval(a)soho.ios.com

1 0