December 2003 - cypherpunks-legacy

Netscape speaks with a forked tongue:
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

Netscape speaks with a forked tongue: Jim Clark, top guy and owner of netscape, has issued a statement in support of government access to keys: "To secure Net communications, the government will need to have access to private data exchanges using what is known as a key escrow security system " and he has issued a statement that Jeff (a netscape employee) has very generously interpreted as anti GAK. (Government access to keys) The only clear and authoritative statement issued by Netscape on GAK is Jim Clark's speech in support of GAK. Everything else is a cloud of unintelligible fog, or was issued by people with no authority and given a minimum of publicity. Jim Clark's supposedly anti GAK statement was incomprehensible to me. Perhaps he needs a punchier ghostwriter: I offer my services free of charge. :-) If Jim Clark wishes to persuade us that his heart is in the right place, he should put something like the following somewhere on the Netscape web pages: "Our customers do not want government access to their cryptographic keys. Mandatory government access to keys violates the rights of our customers. Therefore we will not foist government access to keys on those customers who have freedom to communicate securely. We will only build government access to keys into our products for those customers whose governments force them to provide such access. " If that really is Netscape's policy, then they should tell the world that that really is Netscape's policy, thus instantly relieving the fear, uncertainty, and doubt created by the unfortunate widespread misinterpretation of Jim Clark's original statements. The only clear and authoritative statement issued by Netscape on GAK is Jim Clark's speech in support of GAK. Everything else is a cloud of unintelligible fog, or was issued by people with no authority and given a minimum of publicity. --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from the arbitrary power of the omnipotent state. http://www.jim.com/jamesd/ James A. Donald jamesd(a)echeque.com

2 1

Re: Still more on the Digicash protocol
by Andrew Loewenstern 17 Dec '03

17 Dec '03

David A Wagner writes: > >Tough!? It's trivial for an active attacker, in the stream cipher case. > >He just xors some bits: no clever cryptanalysis needed. (Or did you mean > >it's tough to mount an active attack? I agree: that requires significant > >knowledge or motivation.) Rev. Mark Grant responds: > Exactly.. once you have an active attack set up, it's trivial, but > setting that up is quite hard. But setting up an active attack is probably a hell of a lot easier than breaking 128-bit RC-4 (or even 64-bit). andrew

1 0

SpeakFree (Internet real-time voice w/encryption?)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Has anybody seen, used or hacked with SpeakFree? Supposedly it's a kind of internet-phone that has IDEA/DES encryption options, plus another option to exchange encryption keys with PGP... The URL is http://www.fourmilab.ch/speakfree/windows/

1 0

Windows .PWL cracker implemented as a Word Basic virus?
by Richard Charles Graves 17 Dec '03

17 Dec '03

Just an idea. It would be huge, but can anyone think of a reason it would not be technically feasible? Also, does NT use the same algorithm for saving network passwords? -rich

1 0

Re: Netscape announces position against GAK
by James A. Donald 17 Dec '03

17 Dec '03

At 04:27 AM 12/9/95 -0800, Timothy C. May wrote: >Credit where credit is due. > >I for one am satisfied--and even pleased--with the Netscape position on GAK. Well I for one, am serious unsatisfied, but it is not so bad as to merit a campaign against Netscape. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: Windows .PWL cracker implemented as a Word Basic virus
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Fri, 8 Dec 1995 19:51:55 -0800 you wrote: > >Also, does NT use the same algorithm for saving network passwords? > No, but they're doing something that makes me very uncomfortable: As I read this, they're hashing the password and some other user information using MD4 then doing some proprietary permutations on that. Given their record with security, I'd rather they used straight MD4, rather than throwing in something that we can't analyze. Dan Bailey >From the Microsoft Knowledge Base article Q102716 Storage of the Passwords in the SAM Database -------------------------------------------- User records are stored in the security accounts manager (SAM) database. Each user has two passwords with which it is associated: the LAN Manager compatible password and the Windows NT password. Each password is stored doubly encrypted in the SAM database. The first encryption is a one-way function (OWF) version of the clear text generally considered to be non-decryptable. The second encryption is an encryption of the user's relative ID (RID). The second encryption is decryptable by anyone who has access to the double-encrypted password, the user's RID, and the algorithm. The second encryption is used for obfuscation purposes. [snip] The Windows NT password is based on the Unicode character set, is case sensitive, and can be up to 128 characters long. The OWF version (called the Windows NT OWF password) is computed using the RSA MD-4 encryption algorithm, which computes a 16-byte "digest" of a variable length string of clear text password bytes. *************************************************************** #define private public dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ***************************************************************

6 6

Re: CP: Mailing List Subjects
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 8 Dec 1995, Michael Handler wrote: > Learn procmail. It'll save you hours upon hours of time. > > :0: > * (^From owner-cypherpunks(a)toad\.com|^Sender: owner-cypherpunks(a)toad\.com) > lists/cypherpunks Would the following work?? :0 * (^From|^Sender).*owner-cypherpunks(a)toad.com |/usr/bin/contrib/procmail -m ~/.punk_rc Does anyone know where the procmail archives are?? That might help some of us out, especially those of use who are lousy at managing our very, very precious resources. Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

[FYI] Corp.Spooks Outed + W3 Proxy Filters
by Dave Del Torto 17 Dec '03

17 Dec '03

PRIVACY INTERNATIONAL's BIG BROTHER INCORPORATED. A Report on the Int'l Trade in Surveillance Technology and its Links to the Arms Industry. <http://www.privacy.org/pi/reports/big_bro/> "WebFilter" (formerly "NoShit") <http://emile.math.ucsb.edu:8000/~boldt/NoShit/index.html> <http://pubs.iworld.com/ww-online/Nov95/news/noshit.html>

1 0

Re: Netscape speaks with a forked tongue:
by Tim Cook 17 Dec '03

17 Dec '03

> > Again, you seem fixated on making Clark's opinions equivelent to the > position of Netscape Communications Corp, this is not a reasonable > assumption. Given Clark's position, I believe it is a reasonable assumption. Unless of course you hold that the Corp. as a legal entity could have a seperate position. In that case then WHO speaks for the corporation? Some lower level PR person? I don't think so...<s>. Tim Cook, Mindsource(tm) Librarian. "The World is a Database - Mindsource is the Search Engine." ______________________________________________________________ M I N D S O U R C E (TM) I N F O R M A T I O N N E T W O R K Send a blank Email to:mindsource@memo.net for full information Visit our W3 Site http://www.ultimate.org/mindsource/main.html D E S T I N E D FOR G L O B A L D I S T R I B U T I O N! Concept:"The Greatest Untapped Resource is Human Resource(TM)" Mindsource is a Reg. Trademark Copyright(c)1995 by Mindsource

2 1

Re: Netscape speaks with a forked tongue:
by James A. Donald 17 Dec '03

17 Dec '03

At 03:11 AM 12/9/95 GMT, Dan Weinstein wrote: > You are quoting a reporter and attributing it to Jim Clark, do you > understand what is wrong with that? Jim Clark has had ample opportunity to clarify his statements. He has not clarified his statements and he has not disowned the reported version of his comments, despite repeated requests to do so. Once again I request him to do so. Once again I ask what he means, once again I complain that if that is not what he meant, he should now say something that is unambiguously different from what he was reported as saying. >It has been reported by those that attended the Clipper II meeting on >Monday(?) that the Netscape representative read an official statement >very much in opposition to GAK. I have not seen this statement, and I have asked for it: Once again I ask for it. In particular I ask that it be placed on their web if it says what they say that it says. > > Jim Clark's supposedly anti GAK statement was incomprehensible to me. > > Perhaps he needs a punchier ghostwriter: > Clark's statement was certainly something less than clearly in > opposition to GAK, but I think at worst he could be said to be resigned > to GAK, not a supporter of it. It was worse than that: he said nothing at all, the "clarification" statement was a cloudy fog. > > If Jim Clark wishes to persuade us that his heart is in the right > > place, he should put something like the following somewhere on the > > Netscape web pages: > > > > "Our customers do not want government access to > > their cryptographic keys. Mandatory government > > access to keys violates the rights of our > > customers. Therefore we will not foist > > government access to keys on those customers > > who have freedom to communicate securely. > > > > We will only build government access to keys > > into our products for those customers whose > > governments force them to provide such access. > > " > > > > If that really is Netscape's policy, then they should tell the world > > that that really is Netscape's policy, thus instantly relieving the > > fear, uncertainty, and doubt created by the unfortunate widespread > > misinterpretation of Jim Clark's original statements. > Jeff Weinstein has promised that when the representative from the > conference returns to Mountain View, they will publish his statement > on web. Still waiting. I am sure that by now Netscape knows what its policy is on government access to keys: I ask them to tell the world, and to tell the world in such a way that they cannot retract their words without some embarrassment. > Again, you seem fixated on making Clark's opinions equivelent to the > position of Netscape Communications Corp, this is not a reasonable > assumption. Clark is not a Netscape employee. Clark owns a controlling interest in Netscape and is chairman of the board. Netscape's policies are whatever he says they are, except in the highly unlikely event that he is opposed by both Jim Barksdale and Kleiner Perkins plus a substantial majority of the lesser shareholders. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0