December 2003 - cypherpunks-legacy

Re: key for Alice as promised (not)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 28 Nov 1995, Adam Hupp wrote: > >Can you imagine?? I'm simply not willing to fool myself into thinking > >that I ahve security by posting a key and using PGP. > > Unless you can post some proof that PGP is insecure, stop insisting it is. PGP is really not the issue. The issue is more my security and the environment that I use PGP in. I don't have a trusted machine to run PGP on. Anyone who wants to can come up to machine and copy my secret keyring or they can even watch me typing my password in. So, I don't fool myself, and I don't use PGP, except for things like exchanging a one-time pad with someone when I've already sent the message out across another delivery mechanism, like on a floppy delivered my courier. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Microsoft weak encryption
by Joel McNamara 17 Dec '03

17 Dec '03

Peter Gutmann has an interesting article in sci.crypt, demonstrating how weak Microsoft's encryption is with basic access control in Windows for Workgroups (I'm assuming Win95 uses the same algorithm). Essentially, he shows how a 32-bit key is created to be passed to RC4 for encrypting .PWL files. I think a t-shirt is definitely in order for this. Anyone up for writing some bruting code? Joel

4 3

Diskless "Eunuchs" Machines Likely to Fail
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:17 AM 11/28/95, Steven Weller wrote: >The same sort of things could be said of the telephone compared with >written correspondence. Why would anyone have one in their business or >home? Anyone can overhear a conversation, people will just chat, the only >thing you can do with it is talk, there is no record of the correspondence, >why would anyone want to talk to people on the other side of town? etc. > >Think telephone, not computer. Think people over 40 who want a >communication tool with zero maintenance and zero learning curve. I'm skeptical of the "Diskless Internet Box = Telephone" analogy. Folks I know who are not computer-savvy, or who have other things they'd rather be doing, are not likely, as I see it, to buy boxes that still require them to type messages to other people but that don't allow them to download and save the interesting stuff they find. The telephone appealed to those who truly wanted to "just keep talking"...that was the beauty of it. Most people don't know how to touch-type, and typing by hunting-and-pecking is painful and unnatural for most people. A couple of years ago "the computer for the rest of us" was said to be a pen-based Newton-type machine, now it is said to be a diskless, memory-limited "Eunuchs" machine. (The diskless--and disketteless--systems I've seen described recently would make it impossible for me to interact as I currently do. To be sure, maybe "data storage services" will spring up to temporarily store stuff one has snarfed, but the download to one's home terminal still must be done again. Faster modems, and cable modems, will change things somewhat, but then this is a huge change in a lot of ways, in any case. Even the stereotypcial "chatters" at AOL are heavy users of local storage: witness the massive number of "me too!" posts from AOLers whenever a nude GIF or JPEG of Sandra Bullock or Jennifer Anniston is mentioned...they clearly are downloading a lot of images and whatnot to home machines...that measly 4 MB of flash memory is going to get filled up mighty fast.) By the way, Intel builds a lot of the motherboards for use by various companies. Someone at Intel claimed recently that even if the CPU was completely free (as some 486s effectively are already), Intel could not see how a system could be consistently built for under $500, including monitor, small disk, memory, etc. (The Oracle folks are muttering about a Newton-like OS which would load objects or applets or whatever in a more efficient way...this might work, but I'm still skeptical that user's needs can be met. Those folks wanting local access to the JPEGs of Sandra Bullock will still be out of luck....) I see a greater chance that home game machines, such as the 3DO and Sony PlayStation machines will get Web browsers done for them than I do that people will buy machines that are so limited. The only relevance of this whole topic to Cypherpunks is....is....minimal. --Tim May, who plans to find a way to use this boondoggle idea by Oracle to make money. (Right now I'm long Oracle, but this may soon change.) Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: GOST for sale
by fluffy＠shout.net 17 Dec '03

17 Dec '03

What I wonder about is why anyone would use the Algorithm that the NSA is probably best at breaking. Breaking GOST was probably their number one project for years, and I would suspect that they have done it. chris

2 1

re: SKIP source release is out
by markson＠osmosys.incog.com 17 Dec '03

17 Dec '03

> Doug Hughes writes: [ Perry Metzger writes: ] > > >SKIP is a non-standard being pushed by Sun. > > > > Correct me if I'm wrong, but isn't sun trying to make it a standard > > (in competetion with Photuris) ? Doug, you are correct. SKIP is an IPSEC internet draft. Photuris is an IPSEC internet draft. Perry is incorrect in saying that SKIP is a non-standard. Both of the chairs of the IPSEC group have said SKIP is part of the IPSEC working group. Phil Karn (author of Photuris) has also said this. Both SKIP and Photuris are on the standards track. They are, as you indicated, "competing" protocols. > The IETF has many sorts of standards. It explicitly has a way to > standardize things that the IETF doesn't think are a good idea but > which should have the ability to interoperate if you do them. That's true, but SKIP is not in that category. I believe neither SKIP nor Photuris have been declared "mandatory" as of this point. They both have the same status in IPSEC. > My opinion is that it is fairly clear that Photuris is the key > management system people will be using, although it is going to have > to evolve to work with a real network wide certificate database > infrastructure. SKIP isn't going to be the standard. Again, in *your* opinion. No determination has been made that I know of. --tom

2 1

No Privacy Right in UK ? - Part 3
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, A 12 01 95 The Electronic Telegraph newsstory headlined Policeman bugs own station by mistake reports: ...a listening device was found at the headquarters of Lothian and Borders Police in Edinburgh. The "bug", disguised to look like a plug adaptor, picked up the day-to-day business of the operations room, including radio and telephone messages and conservations between staff. Conservations between staff? Conversations in which not a word is wasted? Its presence was discovered when staff in a rest area tried to tune a radio to a different station and picked up the voices of their colleagues. I used to despise those who couldn't keep their hands off the dial for 5 minutes, but since reading this story my attitude's been adjusted. Concerned that secrets were being transmitted abroad, the force "swept" the control room with anti-bugging technology, only to find that the device belonged to them. It had been "planted" by an officer who thought it was a real adaptor. Of course I believe that! For what comes around...goes around. Cordially, Jim NOTE. The Electronic Telegraph website's URL: http://www.telegraph.co.uk The newsstory's by: AUSLAN CRAMB, SCOTTISH CORRESPONDENT Its online filename: 1bugs01.html

1 0

Barring access to Netscape
by Ed Carp 17 Dec '03

17 Dec '03

If you want to bar access to your site from a Netscape browser, such can easily be accomplished. If memory serves, every browser, when connecting to a site, exchanges certain information about the client with the server. One can gain access easily to that information. I believe that Netscape uses "Mozilla" as their keyword when exchanging browser-specific information.

4 3

Re: DigiCash releases protocol specs!
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"support(a)marktwain.com" 1-DEC-1995 18:56:11.57 By popular request, DigiCash is releasing the protocol specs. The specs are available at http://www.digicash.com/ecash/protocol.html Please be aware that the doccument is work in progess. More specifications, including byte level descriptions of the message format will be added throughout the weekend. --Lucky Green at ---------------------- Thank you. This raises my likelhood of using DigiCash's electronic currency from about none to above that. -Allen

1 0

A challenge ...
by jmhayes＠netcom.com 17 Dec '03

17 Dec '03

I've been challenged to try to find a bank account; I win the challenge if I can wire in $100 to the hidden account. Anyone have any good ideas about how to find an ABA number?

3 2

[NOISE] Fun quote
by Charles Gimon 17 Dec '03

17 Dec '03

Just heard on tonight's "X-Files"... "The NSA?? Since when did they start issuing you guys piano wire instead of guns??" I can hear the clatter of .sig files being updated all over the net.

1 0