December 2003 - cypherpunks-legacy

Fred Cohen, PhD
by an5877＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Regarding Fred Cohen, PhD: Cohen's haughty and bombastic style do nothing good for his reputation. I assume he advertises his PhD to highlight his early accomplishments; he has done little since. Let's also consider the granting institution, a second-rank school. Cohen's thesis broke new ground, but how many people have read it, or any of his writings, or know anything about his ideas beyond a single word? How far did he carry this work? Where are the conference and journal papers? Cohen's reputation faded into obscurity long ago. Now he is building a new reputation as a pig-headed loudmouth, threatening his "defamers." Shades of Sternlight. DEADBEAT <na5877(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.4 iQBFAgUBMOa9TPFZTpBW/B35AQFLQQGAmzB8o+g5k3mYmzMmk3JiDTBf+P8dSFZY 25IwVISjSV7o95vgbmNWAy/3zVY50AKn =SfU6 -----END PGP SIGNATURE----- --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

4 3

EMail Blockade for Compuserve?
by doc＠intellinet.com 17 Dec '03

17 Dec '03

I dont know if this is a good idea. I think CI$ shut off the newsgroups due to economic presure- from some German officials. Drop them or we ban CI$. Now, if CI$ were to shed excess customers in the rest of the world... they might just turn those newsgroups back on. So if folks turned on twit filters and deleted-before-reading mail from anyone@compuserve - and if folks, newsletters etc refused to SEND mail to accounts@ci$ ... well if enough ci$ customers were to LEAVE. This is not a proposal..some of my best friends are at compuserve.

1 0

Re: Internet wiretap?
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 20:09 12/29/95, Joel McNamara wrote: >This tidbit was posted a few hours ago on c|net (12/29 4:00 PST). > > Thanks to a wiretap on the Internet, three people have been arrested >for illegally > selling and manufacturing cellular phone equipment and electronic >devices over the Internet, > according to Secret Service agent Brian Gimlett. This is the first >time the Secret Service and the > Drug Enforcement Administration were allowed to wiretap via the >Internet, says Gimlett. > >The rest of the story talks about an exchange of e-mail discussing the sale >of various nasty >cellular accessories. There is no information on exactly what "wiretap" >means or any other >technical details. Interesting to note the DEA was in on it. It is not that hard to "tap" a user's account if you are the SMTP server (you just put a Bcc on all outgoing mail and add an extra account to all incoming mail's Envelope). A few lines in the Sendmail parms would do this very simply.

1 0

Massey, CEO of Compuserve, on Internet
by Mark Neely 17 Dec '03

17 Dec '03

>Wow! I am watching the CEO of Compuserve being interviewed on CNBC, >explaining how his company is "taking the high road by complying with the >laws of Germany" in removing access to 200 Usenet groups. >Timothy C. May I assume that C$ is only filtering the newsfeed as it hits German shores? Please tell me they aren't denying access to these "banned" newsgroups for all users worldwide! Mark ___ Mark Neely - accessnt(a)ozemail.com.au Lawyer, Professional Cynic Author: Australian Beginner's Guide to the Internet Work-in-Progress: Australian Business Guide to the Internet WWW: http://www.ozemail.com.au/~accessnt

2 1

Re: Massey, CEO of Compuserve, on Internet
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 13:20 12/31/95, Mark Neely wrote: >I assume that C$ is only filtering the newsfeed as it hits German shores? >Please tell me >they aren't denying access to these "banned" newsgroups for all users >worldwide! I am afraid they are. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Australian "calculatorcard"
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- -----BEGIN PGP SIGNED MESSAGE----- From: Cees de Groot \ Internet: (cg(a)bofh.toad.com) To: cypherpunks \ Internet: (cypherpunks(a)toad.com) Subject: Australian "calculatorcard" Hi everybody, CG> Yesterday, on UK Discovery, there was an item in the programme CG> Beyond 2000 about an Australian card which implements a CG> challenge-response protocol and can be used for banking, etcetera. CG> Basically, you give your card number (over the phone), get a CG> challenge number, enter your pin and the challenge, and then give the CG> response. All in CC format... sounds like the card i use for remote dialup to certain non-public systems i use at work. it has a six digit number on the front that changes every 60 seconds. the card is registered to me. when i enter my username/password i'm prompted for the number. it's Pretty Good (tm) security, but like anything not biometric, it is vulnerable to black-bag attacks. physical possession being all that is required. if you know the algorithm and the serial number of the card and the time, even that isn't necessary. CG> Can anybody provide me with pointers to more in-depth information CG> about this device and the algorithm(s) behind it ? i don't know if there are any net sources for them, but i'd be suprised if not. my card references "security dynamics" of cambridge massachusetts. amp <0003701548(a)mcimail.com> (since 10/31/88) <alan.pugh(a)internetmci.com> PGP Key = 57957C9D PGP FP = FA 02 84 7D 82 57 78 E4 E2 1C 7B 88 62 A6 F9 F7 December 30, 1995 23:29 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMOYRtIdTfgZXlXydAQGengf9EH07ubUAH43THj3l+6kWUjnXDYfe2DFj CvpEKlFoDkxwllDcIX0KfWK+ENr3YzyQp/yuWU+ZAw/ogci3y5r4IF+oJ4ItrVD6 pZ4AzF5NvXb2KWcnSaQoVsfo3yIt0bfRknuQjGyirntNhLpTkObVygbUmSSNeT8S hrpGB85IkEoy/km3pntCMfrfA0BrED3GCnNLxVYupY7jM7AxbD+mjHvS8to63bPv 68xjB93b+78ld/O0FPsOP7GQMbUZyTJMiLoNwiMhbgEi8Y4dFTlZ6mF6NMHsDxDy p/ocbp2dOj0Vy/BFbfbBqCgdjY3FoExRRHpgav8b0Xd4qNydkFDelg== =MSp2 -----END PGP SIGNATURE-----

2 1

Re: Australian "calculatorcard"
by vin＠shore.net 17 Dec '03

17 Dec '03

Cees de Groot (cg(a)bofh.toad.com) tore himself from the tube to tell us: CG> Yesterday, on UK Discovery, there was an item in the programme CG> Beyond 2000 about an Australian card which implements a CG> challenge-response protocol and can be used for banking, etcetera. CG> Basically, you give your card number (over the phone), get a CG> challenge number, enter your pin and the challenge, and then give the CG> response. All in CC format... Could be one of seven or 8 vendors of so-called "challenge/response" tokens or calculators. Most of those sold in the US and Australia use straight DES (and a token-specific key) to encrypt the "random" challenge number in the token -- but it could be any secret-key algorithm. Actually, the particular environment described -- phone authentication -- is often used as the most notable example of a market where so-called "time-synchonous" tokens hold a notable advantage over challenge/response token. A TS token generates its pseudo-random token-codes continuously and automatically: no buttons, no input. With TS tokens, exact time and a token-specific key are used in a keyed hash to generate a token-code displayed on an LCD on the token for 30 or 60 seconds. The authentication server uses its database record of the token-specific key, time, and the hash to generate the same token-code for a match. This allows a PIN and token-code two-factor authentication to be submitted by touch-tone phone, and it avoids a lot of the hassle (listen/tap/calculate/touch-tone) associated with C/R authentication. As amp <Alan.Pugh(a)internetMCI.COM> noted, the most prominent international vendor of time-synch tokens is a US firm called Security Dynamics, Inc. I've done consulting projects for SDI, off and on, for years. >sounds like the card i use for remote dialup to certain non-public >systems i use at work. it has a six digit number on the front that >changes every 60 seconds. the card is registered to me. when i enter >my username/password i'm prompted for the number. SDI's token is called a SecurID. <http://www.securid.com> SDI uses a <sigh> proprietary hash. The most common app uses a SecurID in a protocol which prepends the PIN, in the clear, to the PRN token-code. (In client/server environments, of course, all communication between an SDI ACE/Client and the ACE/Server is fully encrypted.) SecurIDs can also be loaded with up to three different seeds or keys -- with a pressure-point in one corner to switch between each series of key-based PRNs. For greater security in open networks, SDI sells a PinPad token with a keypad that allows a PIN to be "added" to the PRN token-code -- so the LCD displays a 6-8 digit number (or alphanumeric) which still offers two-factor authentication, without exposing a PIN. > it's Pretty Good >(tm) security, but like anything not biometric, it is vulnerable to >black-bag attacks. physical possession being all that is required. Actually, all ACE/Server or ACE software modules _require_ a user-memorized PIN. Physical possession of a stolen token is not enough to gain illicit access. >if >you know the algorithm and the serial number of the card and the >time, even that isn't necessary. Bleep! Earth to amp! Check your voltage, lately? The token's serial number has nothing whatsoever to do with the generation of a SecurID's PRN token-code. Just because SDI ships its SecurIDs pre-loaded (most token vendors ask the buyers to program their authentication tokens) SDI embosses a serial number on the back of the token to manage shipping and distribution. The serial number stuck to the back of a SecurID after it is programmed with its secret key -- a unique PRN "significantly longer" than 56 bits -- but they are not the same thing. The cpu in a SecurID doesn't even "know" the serial number stuck on the back of the token. (It would be Pretty Stupid <TM> to glue or emboss a secret on the back of the damn token, wouldn't it?) I should note that Alan is just regergitating one of the most widely circulated rumors about SecurIDs -- which like any popular crypto device attracts a lot of wiLd & w00ly speculation. Getting the algorithm for SDI's one-way hash is no big deal, given that it sits in software in thousands of SDI customer installations, protected only by contract and trade secret status. (The integrity of the product -- the unpredictability of the token-code PRN series, and the secrecy of a specific token's seed or key -- rightly depends cryptographic strength of the hash, not the secrecy of the algorithm.) Getting a token-specific secret key would hopefully be a much greater challenge. CG> Can anybody provide me with pointers to more in-depth information CG> about this device and the algorithm(s) behind it ? >i don't know if there are any net sources for them, but i'd be >suprised if not. my card references "security dynamics" of cambridge >massachusetts. Suerte & Happy New Year to all, _Vin <*><*>< Vin McLellan + The Privacy Guild + vin(a)shore.net ><*><**> Heed, fellow citizens, Justice Felix Frankfurter (Butler v. Michigan): "The State insists that, by thus quarantining the general reading public against books not too rugged for grown men and women in order to shield juvenile innocence, it is exercising its power to promote the general welfare. Surely this is to burn the house to roast the pig.... The incidence of this enactment is to reduce the adult population of Michigan to reading only what is fit for children."

1 0

Re: [ecash] Re: Multi-issuer questions
by daw＠boston.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have to admit I don't know the ecash concepts well enough to respond very intelligently to everything you talked about, though I'd like to address one of your comments on inter-bank clearing. I wanted to bring up one misconception: you mention that the main worth of ecash is measured by whether merchants will accept it as payment, and that whether a bank will accept it as a deposit is just a secondary issue. From this you conclude that so long as a merchant can validate ecash (via online clearing, to detect double-spending), it doesn't really matter whether that merchant's bank will accept the ecash -- just that other merchants will accept the ecash. This is brought up in the context of "what if Bank B didn't accept [deposits of] ecash from Bank A?". I claim that this is at best misleading, because with Digicash's ecash, when a merchant receives ecash as payment, the ecash is "made out" to that particular merchant, and is non-transferable-- i.e. can't be used as payment to another merchant. When you've been payed Digicash ecash, about the only interesting thing you can do is deposit it with your bank. [ For simplicity, I'm ignoring wildcards in the "pay to" field; but wildcards are insecure on their own. Digicash hasn't really attempted to support wildcards or transferable ecash in general, as far as I can tell. Correct me if I'm wrong. ] - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMOYZwCoZzwIn1bdtAQFvaQGA1f4oy6Z2TF9810fIUEqkktpQN01FPUCb ER/q3WI/kuyjQCBJh/laA0QsU2q8jnP4 =8Mib -----END PGP SIGNATURE-----

1 0

RE: last straw (or Possible Developments re Censorship)
by blanc 17 Dec '03

17 Dec '03

From: Dr. Dimitri Vulis And now comes the *point*: There's much information on CompuServe that cannot be accessed from the outside. One example is the very informative National Computer Security Association's forum. ...[etc.] ................................................................................................... Aside from the obvious implications to liberty, of the backing down from standing up (!) to the demand for self-censorship, I was thinking about other possible developments: Since, as 'Dr. Dimitri' mentions, CompuServe offers some info which is not available from other sources - and this info is often quite useful/valuable to business enterprises, such that they and other individuals would not be too keen on abandoning these immediately just for the principle of the thing - it could develop that those who are willing and can afford it, will end up "supporting", or getting services from, different providers based on the particular services which they offer. This could represent a partial solution (in my mind, at least, not being inclined toward blanket censorship of all things discomfitting to my sensibilities) to the matter of there being free-radical electrons "out there" existing in the form & shape of various degrees of sexual permutations: . Those concerned that their children may innocently surf over to alt.binaries.naughty.nude.x-rated.pictures and see alarming truths about adult behavior, and don't want to purchase the available filtering software, could subscribe to CompuServe and rest assured that their children would only have access to safe, industrial-strength info on that account. . Those wishing want to discuss their sexually-related personal problems, or who are pleased to just look at/talk about sex et al, could continue do so through their subscription to the adult bbs-es or local ISPs providing uncensored access to all newsgroups. It could develop that large companies providing internet access will seek to distinguish/identify themselves (as they are tending to do already) between the pablum-feeding family-types like AOL, or corporate/business-types like CompuServe, or free-for alls like local ISPs. Such developments of course would depend on a tolerance for the existence of those un-specialized carriers which aren't adverse to transmitting controversial, "sensitive" content. These divisions among services might still not be acceptable to States and Nations & other 'busybodies', but the resistance to such developments would only serve to more explicitly define the problem; it could make prominent the real issue of people's attitudes, fears, and expectations concerning sex & human nature, and of the obstacles in the way of achieving personal responsibility regarding these (among other things). .. Blanc

1 0

Re: (fwd) Benchmarks - revs 1.3.50 & 51
by Julian Assange 17 Dec '03

17 Dec '03

> > And the cypherpunk relevance is....<drum roll>...? > >[...] linux kernel stats Absolutely zero. Your's truely pressed the wrong key. --Proff +----------------------------------+-----------------------------------------+ |Julian Assange | "if you think the United States has | |FAX: +61-3-9819-9066 | has stood still, who built the largest | |EMAIL: proff(a)suburbia.net | shopping centre in the world?" - Nixon | +----------------------------------+-----------------------------------------+

1 0