December 2003 - cypherpunks-legacy

Your Majordomo request results
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Your request of Majordomo was: >>>> subscribe cypherpunks Succeeded. Your request of Majordomo was: >>>> end END OF COMMANDS

1 0

Re: Crippled Notes export encryption
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:29 AM 1/24/96, Jeff Weinstein wrote: > I suspect that to get around the US government in this way we >would have to develop the entire product outside of the US. That >would be a very drastic move that is not likely to happen any >time soon. We are going to invest some money and effort into >trying to get the current restrictions lifted first. For what it's worth, this is what I've heard several knowledgeable lawyers say is the case, that merely sending the crypto experts abroad is no solution, that the entire product (or some large fraction of it) must be foreign-originated. The usual issue: That if a foreign-originated product even appears to be a standard (so far, none have been), and includes strong crypto, then the NSA and other agencies will simply change the rules. Thus, if extremely strong crypto from "Netscape-Zurich" starts to have a significant market presense in the U.S., then some law will be passed to restrict it. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: Reporting ITAR Violations
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:07 AM 1/24/96 -0500, Futplex wrote: >I would feel a bit more comfortable if violations by non-anonymous entities >were well publicized. Otherwise, we may force the TLAs to cash in the >"weapons export" card against the anonymizers, and hasten a crackdown on >them. Would that the remailer network were significant enough to call forth a legislative response. DCF

1 0

Re: Philip Zimmermann and the Press
by jim bell 17 Dec '03

17 Dec '03

At 08:46 PM 1/23/96 -0500, Perry E. Metzger wrote: > >I contacted Phil about the neo-Nazi attribution in the British >press. He has apparently contacted the newspaper and it appears that >they are probably going to print an article retracting their >statement. I've asked him to comment here but I don't know if he will. > >Perry What _I_ want to see is NOT MERELY an apology and retraction, but ALSO a statement of where the hell this claim came from in the first place. WHY?

1 0

mouse droppings
by joee＠li.net 17 Dec '03

17 Dec '03

In the march '96 issue of macworld there's a "Viewpoint" reporting on the progress of the info superhighway. Privacy and security issues predominate the text, the primary source of which is larry irving --- "a top administration adviser on telecommunications." One issue, "mouse droppings" --- "a trail of every site they visit and for how long [on the www], was highlighted as an example of existing privacy regulations falling short of consumer expectations. Apparently, the amorphous public is shocked, *SHOCKED* I tell you , to discover that their service providers are selling the personal preference information to the highest bidder. More info in article. Would some rocket scientist speak to this terrifying mouse droppings issue? j. ercole <joee(a)li.net> ny, usa pgp public key at: http://www.li.net/~joee/autumn2.html $$$$$$$$$$$$$$$$********************&&&&&&&&&&&&&&&&& Stand By---.sig presently being unearthed in regression therapy.

3 3

Re: IPSEC == end of firewalls
by Frank Willoughby 17 Dec '03

17 Dec '03

While IP level security & authentication will go a long way to help prevent abuses and reduce unauthorized accesses, I doubt if it will provide enough protection by itself. While I would love to be proven wrong, I believe firewalls are here to stay (at least for the next year or two). A couple of reasons why: o Node Spoofing will probably still be possible o The connections will probably also be subject to man-in-the-middle attacks (Never underestimate the creativity of people who want to compromise your networks) o Authentication by itself will *not* provide adequate protection against many abuses o End-to-end encryption by itself won't completely solve the problems either (however, it *does* go a long way to prevent man-in-the-middle attacks o While IP security & authentication helps to secure the pipe between the two systems which want to communicate with each other, it does not provide any security about the applications running over the pipe. (ie - if you and I have a secure pipe between your system and mine & you have a worm running loose on your network, the only thing the secure pipe will do is ensure that other systems (not in the pipe) won't be damaged as the worm propagates out of your network into mine). Also. Which version of sendmail are we up to now? As far as the future of firewalls goes, I would probably guess that the functionality of most firewalls would eventually be an add-on application option for Operating Systems and that eventually it will be a standard part of every Operating System. Until then, we have to punt & keep using firewalls. I suspect even when firewalls are embedded in the O/S, that some type of firewall will still be needed to quasi-isolate a company's network from the Internet (and establish them as one entity) and to contain potential networking problems which arise when someone configures their system with the wrong IP address (or other type of problem). IMHO, the first company to include a firewall as a standard part of their Operating Systems has a real good shot at increasing their market share. Perhaps the O/S vendors are paying attention to this list & will implement this (would be nice). 8^) Of course, it would also help, if their systems were delivered secure - out-of-the-box and we didn't have to spend so much time continually locking them down & keeping up with the latest CERT Advisories. 8^) 8^) Best Regards, Frank Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.

4 3

"PRZ a nazi" to be retracted
by Philip Zimmermann 17 Dec '03

17 Dec '03

The Sunday Telegraph of London printed a story last Sunday about neo-nazis using PGP to encrypt their communications. The story said that PGP was devised by an American neo-nazi sympathizer. As the creator of PGP, and a human rights activist, I was outraged by such a defamation from a major newspaper. I called my lawyer Phil Dubois, who seemed to look forward to having some fun with this newspaper. Not wanting to wait around till the morning, and slow lawyers, I called Robin Gedye, the reporter in Bonn who wrote the story, at 7am Monday morning Bonn time, and woke him up at home. I introduced myself and told him how I felt about it. He had never heard of me, the Clipper chip, the controversies of cryptography, and knew nothing about PGP outside of the couple of sentences in his story that mentioned PGP. He said it wasn't really so bad, because he didn't specifically identify me by name. One can imagine the effectiveness of that excuse with me. I then went into some detail with him to bring him up to speed. I also called his editor in London, who also had never heard of me or PGP. After some checking, they discovered that the Daily Telegraph, a related newspaper, had run an article about my case just a week before. They also found about 20 recent articles on me in the UK press. The editor said that my story "checks out". It was good to know that they now believed that I was not a neo-nazi after all. Anyway, Mr. Gedye says that the Sunday Telegraph will print a retraction next Sunday. Not just a little retraction, but a whole article on the subject, written by Mr. Gedye himself. I'm glad to see that this probably means that he will dig into the subject more, in order to write such an article. I guess this means maybe I'll find some other things to occupy Phil Dubois's time. -Philip Zimmermann 23 Jan 96

1 0

Re: [local] Report on Portland Cpunks meeting
by Alan Olsen 17 Dec '03

17 Dec '03

At 04:40 PM 1/23/96 -0500, Perry E. Metzger wrote: > >Weld Pond writes: >> This begs the question, "How would you conduct an efficient key signing >> given what you have learned?" I am in the process of organizing one and >> would like to get input as to the best way that this should take place. > >The IETF key signing parties are the largest in existance -- about 100 >people exchange signatures. > >The way you handle it is this: {key signing stuff deleted for space] That was the basic format we used. The only difference was that the keys were collected before hand and distributed on disk. The biggest problems were due to unfamiliarity was to what to bring and procedure from an experience point of view. (Lack of key fingerprints were a problem.) The key signing rules were published, but many people attending did not read them. (They were part of an update announcement. Many people read the top part, saw nothing had changed and skipped the rest of it...) Now that we have done it once, it will be alot easier the next time. Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

2 1

Re: SS Obergruppenfuhrer Zimmermann (NOT!)
by Peter Trei 17 Dec '03

17 Dec '03

Patiwat Panurach asks: > On Tue, 23 Jan 1996, Duncan Frissell wrote: > > On the whole, the cypherpunks have gotten very favorable press for a group > > who's actions may render government policies irrelevant and possibly the > > governments themselves. > Would you call cypherpunks (as a group and as a philosophy) to be > influential? Do you think governments listen to us much? Are they forced > to listen to us? Any stuff to support this? Please give me your comments. Yes, I would say the actions of the people active on this list have had significant effectst. To give one example: Last summer, 'we' broke 40-bit RC4. Within a week or two, the US government started to discuss making 64-bit escrowed crypto exportable (not acceptable, but it's a change). In the private sector, the opinion in a lot of US firms was 'yeah, 40 bits may be weak, but marketing wants to have a single "secure version" of the product, so we'll sell the 40 bit version domestically and abroad - after all, 40 bits is only theoretically weak - no one's ever broken it." After the highly publicized SSL crack, it suddenly became a *lot* easier for engineers to argue for separate domestic versions with stronger encryption. I personally know of three firms where this occured, and I'm sure there are more. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

German home banking (fromn RISKS)
by stevenw＠best.com 17 Dec '03

17 Dec '03

---------------------------------------------------------------------- Date: Tue, 23 Jan 1996 17:32:56 +0100 From: Klaus Brunnstein <brunnstein(a)rz.informatik.uni-hamburg.d400.de> Subject: Homebanking NonSecurity demo A German private TV channel (SAT 1) displayed, Monday Jan.22 night (10 pm), a demonstration of how easily homebanking may be attacked in Germany. In this demo, a person used T-Online (a navigation tool similar to CompuServe) to send his ID, PIN, the amount to be transferred (500 DM) and the account to which to transfer, plus a transaction number (TAN) via telephone line. All these data were intercepted on a portable connected to the user's phone line in the basement of the building (indeed, most telephone boxes are rarely locked). Actions of the customer and the "hacker" were shown in parallel, so one could see all data (including PIN which was not displayed on the Customers' screen) on the hackers' display. Before the customer could start the booking process on the bank computer by sending the requestor, the hacker interrupted the telephone connection. As he now possessed all relevant "secret" information of the user, he now started an order to transmit 5,000 DM from his victim's account to another one, successfully (as the customers' vouchers proved. After the demo (about 10 minutes), a short interview (with the author of this report) discussed evident risks; it was made clear that software solutions are available since some time, to replace the old PIN/TAN structure with digital signatures and to encrypt sensitive data using asymmetric encryption. Risks? Presently, there are several risks in telephone-based homebanking. First, ALL sensitive information is transmitted in cleartext. Secondly, interception of line-based communications of German Telekom is easily possible at several sites, from the basement of a customers' house where lines from different customers are collected in a unit, to units collecting lines from several blocks, streets etc. Thirdly, in contracts between banks and customers, the latter will often have difficulties to prove that an order carrying their personal ID, TAN etc was NOT issued from them, esp. when there is evidence that the order came from the customers' telephone line (though not from his telephone :-). Customer protection (both technically and legally) therefore requires immediate action, as Chaos Computer Club commented in press. Interestingly, German banks offer enterprises a secure solution based on RSA-licensed encryption software. So far, this is NOT offered to private customers as it canNOT interoperate with T-Online. Financial institutions are discussing presently a solution (either with a chipcard including sort of DES or a solution using an RSA-implementation with 784 bit key, which may be distributed via diskettes) but it is unclear when this solution will be available. As long as such solution is not available, "every day may become payment day even for the most lousy hackers" as one German newspaper (TAZ) wrote. Klaus Brunnstein (Jan.23,1996) ------------------------------ ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

4 3