December 2003 - cypherpunks-legacy

RE: Spiderspace
by Kurt Buff (Volt Comp) 17 Dec '03

17 Dec '03

I think Tim was referring to someone gleaning your private key, which would be a Disastrous Thing (tm). If that's not what he was referring to, I still think it's a possiblity. Kurt ---------- From: Martin Diehl[SMTP:mdiehl@dttus.com] Sent: Tuesday, January 16, 1996 13:59 To: cypherpunks(a)toad.com Subject: Re: Spiderspace On 1/16/96 12:35 PM, tcmay(a)got.net (Timothy C. May) at Internet-USA wrote: > I've been thinking a lot about the problems and opportunities that are > coming up as more and more "spiders" (Web searchers, crawlers) are > indexing directories and files on systems they can find. [snip] > Sure enough, a search of "Cyberia-l" in Alta Vista showed all sorts of > hits, including what appeared to be several _private archives_ of parts > of the traffic. (By "private" I mean in the sense that they were > someone's personal archives, and not necessarily complete or even > semi-officially sanctioned.) [snip] > I've started to look for things like PGP files laying around buried in > subdirectories. I can imagine attacks based on this. [snip] > Fourth...left to your imagination. > --Tim May > We got computers, we're tapping phone lines, we know that that ain't > allowed. > ---------:---------:---------:---------:---------:---------:---------:---- > Timothy C. May | Crypto Anarchy: encryption, digital money, > tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero > W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, > Higher Power: 2^756839 - 1 | black markets, collapse of governments. > "National borders aren't even speed bumps on the information superhighway." I gather that it would be a Bad Thing (TM) to have someone get both the encrypted and clear text forms of your message (from either you or from the recipient) Maybe regularly changing your encryption keys is a Good Thing (TM) Martin G. Diehl

1 0

Re: [NOISE] Re: Eggs at Customs (fwd)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"llurch(a)networking.stanford.edu" "Rich Graves" 16-JAN-1996 00:12:29.92 >Morality has nothing to do with it. It's the speed of the evolution. If you walk across the straits, the system has the time to react and restore a dynamic equilibrium. If you immediately release a new species with no natural predators, the system is shattered, and it might not survive. This is not to say that ecosystems and societies are static -- they evolve constantly, displaying unpredictable punctuated equilibrium (Steven J. Gould was right, Edmund Burke and Karl Marx were wrong). ------------- A few things from the biological point of view (and I _will_ try to bring in a bit of cypherpunks relevance). First, if the ecosystem were as unstable as the Greens in the 1960's and later kept predicting (Silent Spring and all that), it would have collapsed already. Look at how many species we've taken out already. Second, almost all ecosystems that are that vulnerable (to extinction of a keystone species or to import of something that starts eating) are small ones that don't really matter in the long run. For one thing, the more biodiversity _within_ an ecosystem exists, the more likely it is that something from outside (or something removed from within) will have a control (or a replacement). In other words, there are fewer and fewer true keystone species as the internal biodiversity of an ecosystem goes up. ------------- [...] >Cute cuddly seals and frieldly dolphins and teddy bears get "sympathy" among mainstrean "environmentalists," and the Sierra Club and World Wildlife Federation calendars raise a lot of money, but it's the plants and bugs and bacteria that are really important. Elephants and blue whales look big and important to us, but they're really inconsequential in the larger scheme of biodiversity. They could go extinct and the planet doesn't really care. But kill the blue-green algae and the trees, and we're all dead. ------------- The algae? Sure, they're important... they're also thoroughly likely to not be affected significantly. One, they've got so many things acting on them in the first place. Two, there is quite a bit of diversity within the algal group. What takes out one strain (I have always had my doubts about "species" with mitotically reproducing organisms) is unlikely to take out the rest... and they mutate quickly enough to give rise to more strains pretty rapidly when one "niche" is freed up. The trees, on the other hand, are in the classification of "nice to look at but not really neccessary," like the elephants. They're a great carbon _sink_, but they don't really do that much CO2 recycling. And even if they were... we can replant trees very quickly. It's the rain forests and the old growth forests that are hard to replace as such. Cypherpunks relevance? Well, digital cash and encrypted messaging make it a lot easier to do the type of deals you're talking about... they also make it harder for people to place irrelevant prerequisites (like "not from rain forest land") on their purchases. So far, most of the anti-cypherpunks arguments have come from the conservative side. Be prepared for some from the liberal environmentalists (as well as the liberal socialists who want to keep lots of tax dollars flowing). -Allen

1 0

Re: new web security product
by Jeff Hupp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 16 Jan 96 at 14:48, Perry E. Metzger wrote: : : "Ed Carp, KHIJOL SysAdmin" writes: : > I wouldn't pass this along normally, but it seems to allow folks to use : > their credit cards at home securely. Bye-bye, First Virtual... ;) : > : > http://www.cnn.com/TECH/9601/encryption/index.html : : I don't think its going to fly. No one wants to pay for an unneeded : $100 piece of hardware to encrypt the same credit card over and over : again, when a nearly zero marginal cost piece of software can do the : same thing. : I am not even sure it IS an encryption device. They say "Potentially vulnerable personal account information is scrambled or encrypted on the magnetic stripe on the card. It is electronically transferred through the hardware. That eliminates the need to say or "key in" the account number or expiration date. " It may just be a low cost? mag stripe reader... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMPw78DUjeCeeebC9AQFmnAf/Sa/2jeRj/Oe7Vd5JEcIZZOIAhQK9XJI5 LQQGmKI9T2ZrzAeBI5eL+SdVvEs7PFqaW3tRVWaZDmW90uuL7qWcR732pRPOJ39k CL3SuHx0sUrPakjw2S+1JNZjLxQfgJNgMDGWLYVKIFvKPKjgUh2xAl6BagwaLJCa P5U4HwHWdmF8zQgBkFPzBKYYBZBJU7oqz2G9NV2H0cYtkQ2rZJS1sVk5ng8/RsYx b3Sw99WCBk9zVAy37NWKOJGlemk114ktgO4iL4iii23/lZR1zYhZDGJ+47ZPsSy7 Gt6JtQUWHzcnuQBoqwLYOog15GnWF9jIli/RK1K25wsDyCk5mMQsvA== =nW8l -----END PGP SIGNATURE----- -- JHupp(a)gensys.com |For PGP Public Key: http://gensys.com |finger jhupp(a)gensys.com Certainly the game is rigged. Don't let that stop you; If you don't bet, you can't win.

1 0

Ozzie on Notes Crater
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Ozzie Outlines New Feature At RSA Data Security Conference San Francisco, Jan. 17 -- Ray Ozzie, president of Iris Associates, the developer of Lotus Notes, informed an audience at the RSA Data Security Conference here today that Notes Release 4, which began shipping this month, utilizes a new method of security called "differential workfactor cryptography." This new method allows the International Edition of Notes to use an encryption key equal in strength to the 64-bit key in the North American Edition, without the use of "key escrow" technologies. Ozzie explained that in the International Edition of Lotus Notes Release 4, whenever an encrypted 64-bit bulk data key is generated by the product, it is bound to a "workfactor reduction field," giving the U.S. government exclusive access to 24 of the 64 bits. When using the North American Edition of Lotus Notes within the U.S. and Canada, however, full 64-bit encryption is employed without the "workfactor reduction field." The two editions of Notes are fully interoperable. "We are very pleased to have arrived at a pragmatic short-term solution that addresses our international customers' requests for greater security within Notes," Ozzie said. "However, we continue to argue vigorously that, due to clear and present threats to our global information systems, all interests would be well served by widespread use of strong, high-grade cryptography. Without substantial rethinking of U.S. cryptography policy, particularly as it pertains to export controls, our global and national economic security is at risk."

1 0

A WfW security curiosity (possibly another security hole)
by pgut01＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

When WfW is installed, it creates a file in the Windows directory called WFWSYS.CFG. This is a standard Windows password file and may be decrypted with the password "23skidoo" (note that this is lowercase, since it's passed to the .PWL-handling code at a level which bypasses the usual password case smashing. The mangled 32-bit form which is passed to the RC4 key setup routine is { 0x67, 0x6F, 0xE3, 0x81 }). WFWSYS.CFG seems to be mostly identical for the few copies I could get to, and WfW networking won't work without it. Decrypting the file doesn't seem to give anything useful, the string "SYSTEM" and what looks like a few 8 or 16-numbers. I don't know enough about how WfW networking works, but my (very vague) guess is that it contains some sort of cookie to uniquely ID each machine for resource sharing over a network. If it does then it it's (yet another) pretty serious security hole, since it's encrypted with a fixed password and seems to be mostly identical over multiple machines. OTOH it may be something to do with serial numbers so you can't install the same copy of WfW on multiple machines on a LAN. Can anyone shed more light on it? Peter.

2 1

Re: Alta Vista, Great Stuff!
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:26 PM 1/16/96, Beethoven wrote: >Imagine your nym is related to something common-place at >the time of posting. Even though you may be well known >under that nym, simple searches for that name will turn up >loads of crapola, or at least some light entertainment >for someone searching for oyur past posts. My name is rare and matched mostly by lists of the highest points of elevation in each state (Mt. Frissell in Connecticut) and museum shows of the work of a distant cousin Toni Frissell who was a fashion photographer in NYC. Most of the rest is mine. If you have a common name/nym it would be harder to track (except by searching for email address rather than name). DCF "Now everyone knows that Mohammed and Lee are the most common names in the world. Maybe I should change my name to Mohammed Lee."

2 1

Re: remarkable recent stories
by Rich Salz 17 Dec '03

17 Dec '03

>odiferous entrails, I'd be interested to here what others think. Several times I have heard NSA staffers talk about securing our secrets vs. reading theirs. It seems that right now the first side is "winning."

2 1

Crypto-related Pointers
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, Below are pointers to crypto-related items in 01 16 94 Edupage: CREDIT CARD SOFTWARE FOR INTERNET SPY AGENCY WARNS OF CORPORATE SPIES To subscribe to Edupage: send a message to: listproc(a)educom.unc.edu and in the body of the message type: subscribe edupage Andrew Sullivan (assuming that your name is Andrew Sullivan; if it's not, substitute your own name). For archive copies of Edupage, ftp or gopher to educom.edu or see URL: http://www.educom.edu Cordially, Jim

1 0

Re: Spiderspace
by Bill Stewart 17 Dec '03

17 Dec '03

>... I was under the impression that the only documents that most web crawlers >will search are documents that are link-accessible. Are you saying that this >isn't true? Are you saying that Alta-Vista will search EVERYTHING that's >publicly accessible, whether by anonymous FTP or web? Don't archie servers already pick up the anonymous ftp fairly well? Also, aside from no-robots conventions, you can build a cgi program for access to files that might be more effective at blocking searches while still preserving access. Also, it wouldn't be hard for a web-crawler to follow ftp links, as long as the root of an anon-ftp site is pointed to by a URL somewhere. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

3 2

on being elitist...
by Ed Carp, KHIJOL SysAdmin 17 Dec '03

17 Dec '03

Tim May said in a recent missive, of which I've deleted (unfortunately) that "most of us on the list are elitist" because we don't believe that most people will make it, or some such (please correct or clarify, Tim?) I would say that an "elitist" is one who believes that the masses (or the great unwashed, depending on your point of view) are somehow "not deserving" of surviving or "not worth it", and I would say that that definition would *not* fit a great many people here. I think that most people here are *for* getting crypto out in the hands of *everyone* - good, easy-to-use, cheap, uunbreakable (for all practical purposes, anyway) crypto, to use for everything, ranging from telnet sessions to email. True, there will be some who will *not* make it into the future, and those numbers vary (depending on whose vision of the future you subscribe to), but the point is, those who do survive aren't somehow *better* that those who do not - it may simply be that they are in the right place at the right time. Whether or not that place includes the Bay Area is a subject of debate. -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/digital pager 800/558-3408 SkyPager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi "Past the wounds of childhood, past the fallen dreams and the broken families, through the hurt and the loss and the agony only the night ever hears, is a waiting soul. Patient, permanent, abundant, it opens its infinite heart and asks only one thing of you ... 'Remember who it is you really are.'" -- "Losing Your Mind", Karen Alexander and Rick Boyes

1 0