December 2003 - cypherpunks-legacy

Re: key for Alice as promised (not)
by ahupp＠primenet.com 17 Dec '03

17 Dec '03

>On Tue, 28 Nov 1995, Adam Hupp wrote: > >> >Can you imagine?? I'm simply not willing to fool myself into thinking >> >that I ahve security by posting a key and using PGP. >> >> Unless you can post some proof that PGP is insecure, stop insisting it is. > >Hold on a minute. Alice is, here, 100% correct. > >If I use PGP to read messages and there's a videocamera trained on the >keyboard, and other people have access to the machine, PGP is not >secure. Similarly, if PGP is on a computer which other people may use >without my supervision, they can monitor keystrokes, etc. and PGP is not >secure. > >A chain is only as strong as its weakest link; Alice recognizes this, and >makes no claim that PGP itself is the weak link. The weak link is the >physical security of the system which Alice claims to use. > >Jon >------------------------------------------------------------------------------ >Jon Lasser <jlasser(a)rwd.goucher.edu> (410)494-3072 > Visit my home page at http://www.goucher.edu/~jlasser/ > You have a friend at the NSA: Big Brother is watching. Finger for PGP key. > > I guess I missed Alice's point, but I gave it more thought and Alice is still wrong: 1) If someone DID monitor Alice, that almost defanitly means the remailer chain was compromised. The weakest link here is the remailer chain, not Alice's computer's physical security.* If Alice's true address is not known, there cannot be any monitoring of his/her computer (unless it for some other reason than "Alice"). 2) This whole deal is about Alice signing his/her messages, not encrypting them. What Alice would be giving up if his/her computer were compromised would not be security, but identity. The most Alice could lose, IF the remailer chain were compromised and IF his/her computer's physical security were compromised is his/her's reputation by spoofing (loss of pseudo-anonaminity is a given if the attacker gets that far). Those are some really big Ifs. *BTW, the chain is NOT as strong as it's weakest link. If I send mail to a remailer, and it strips the headers like it's supposed to, but sends the mail to a compromised remailer (the weak link), I am just as secure as before. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQBtAzCNppQAAAEDALhWZl7IuGZ9zZT5bACo0b/1L0Nv0C72vKHIO3IHh+cwpHHa 2Ozb9aeO0UvXGwkkZIYgUm0EvmzKh7yb1GTLvBp5kXpR3I9w+Yj4LGlBDERpUWw6 x4ED49pwDnz1Hl5FBQAFEbQYYXNoIDxhaHVwcEBwcmltZW5ldC5jb20+ =PtJK -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Preparing the Remnant for the far side of the crisis
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: >The notion of privatizing the system will not really help much, not >in the handful of months before the impact hits. And there are >worrisome aspects to this privatization. Recall that previous regimes >had problems collecting taxes, and issued "letters of marque and >reprisal" for "privateers" to stop ships on the high seas to collect >taxes for the crown. Sir Francis Drake made his fortune this way, >collecting taxes for Elizabeth I. Letters of marque and reprisal are not generally considered to be tax collection instruments as the targets were not usually considered legitimate sources of tax revenue in time of peace. (Still, Tim would probably argue that there is no meaningful distinction.) A stronger analogy could be made to tax collection groups such as the Farmers General in pre-revolutionary France. Entrepreneurs could obtain a franchise to collect taxes for the King, receiving a fraction of the taxes collected. My guess is that these franchises were both purchased and granted outright. The Farmers General were unpopular and they didn't fare well during the Revolution. On May 8, 1794 (Floreal 19, Year II), 27 of these scoundrels were executed in Revolution Square, including one Antoine Lavoisier. The IRS does privatize some of its work in the sense that bounties are available for informants. They get a percentage (~10%) of the tax revenue "recovered". The percentage drops rapidly as the total take increases. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNCIfy5aWtjSmRH/5AQHJ/gf+MzKYDpXrt4dz576vOuYmI0Z3WkCBF/5T j7poVbfoTWYyl8m1ThnY2SR1OcbM2JXebN7vwG9PEYQ8AWsP1k/SO55MdJ6jXoXF H/9Tl5g1gBGuqbTXHVWQS7AGY5uHKhU3vUyUODJ8qfIaJNVuPbBDjfHCtbitPObj DEZjn2cH0AiaGgDe2wmZtXFzZhXZoz0g+i8MVFCLHVNveiZQzC+ihNQtD7HLKtVl uHk86V2Dp1yF/bzW46342ED/48H0esR+8KhuLg2CGplPkj8Ie0w+EySSX5Jd7dLL zM9QJ/rbe+Vpu2qnDTYy5xmJMv1VGtsw4I21G0mbIw/+CUErnnZuSA== =fkiJ -----END PGP SIGNATURE-----

1 0

Re: Getting a copy of the Jim Clark speech
by Ed Carp 17 Dec '03

17 Dec '03

> Date: Thu, 30 Nov 1995 21:43:57 -0600 (CST) > From: Frank Stuart <fstuart(a)vetmed.auburn.edu> > To: loki(a)obscura.com, cypherpunks(a)toad.com > Subject: Re: Getting a copy of the Jim Clark speech > >If he has not clarified his position by tomorrow evening, I will set up some > >web pages explaining the situation and decrying Netscape's apparent > >position on key escrow (GAK). I have the quotes that L. McCarthy posted, > >and Jeff Weinstein's response. I have not been able to get the article off > >the server yet (possible all the cypherpunks downloading it?). Any other > >documents I should include? > > I'm working on an "obnoxify" program to convert normal html documents into > documents that look normal to non-netscape browsers, but are too painful to > read with netscape (</BLINK>, <FONT SIZE=1>, etc.). I think tomorrow evening > would be a good time to decide whether or not to distribute it. The only problem with this approach is that this will bite other browsers that have started supporting the so-called "Netscape extensions". More than one person has coded the Netscape stuff into their pages because it gives the author more flexibility than the standard 1.0/2.0 standards. And there aren't many browsers out there yet that support 3.0.

1 0

Knapsack-based cryptosystems
by Eamon Daly 17 Dec '03

17 Dec '03

Some convoluted questions for knowledgeable c'punks: What's the state-of-the-art in cryptanalysis of knapsack-based cryptosystems? I know the fate of Merkle-Hellman, Graham- Shamir etc. as written by Brickell and Odlyzko in _Contemporary Cryptology_ (edited by Simmons). What of the Chor-Rivest cryptosystem (I'm aware of the attack in Eurocrypt 95)? Finally, has any work been done on cryptanalysis of the dense compact knapsack-based cryptosystem of Glenn Orton? ("A Multiple-Iterated Trapdoor for Dense Compact Knapsacks" in _Eurocrypt 94_) Thanks for any information. Eamon Daly

1 0

Re: A challenge ...
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

>I've been challenged to try to find a bank account; I win the challenge >if I can wire in $100 to the hidden account. Anyone have any good >ideas about how to find an ABA number? This sounds like the "this is your last chance to send me $1!" ad: Announcing the 'Bank Account' Hack. Rules: Wire me $100. Reward: I'll give you a T-shirt. The *real* challenge will be getting your $100 back.

1 0

Re: Because they want to be "players"
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: > (The ACLU is far from perfect, but I am gaining new respect for > their absolutist stance on most civil liberties issues. I am > assuming that the ACLU will not support the "speak in Spanish while > committing a crime and get an extra 10 years" language? This, by the > way, is what the "use a cipher" language is exactly parallel to.) The ACLU does have some peculiar ideas about English, however. A few years ago your local Northern California chapter sued an aspirin company because their label, including warnings, was entirely in English. They argued that because the company was selling aspirin in a Spanish speaking market, the label should have been in Spanish. (The grandmother of a child did not speak English. The child became seriously ill and may have died.) Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNCIX95aWtjSmRH/5AQFjOgf/V5iWS+taWP3GjmGzsRaXkh3bLFO2vfn0 CIVN3Tsczr9BhsyNNv6iAdR6sh1vJFQraFFqbtKIDhU58X+mqU/Ypv5wXhw5q2AN Iu76LG1ILpPwqNCV/fk3d0J/S2yF2pD6a/1zMdD85U3/cxvItM4Q6mMywryCdHU5 K0cP4NuhWMKhwFtTVt/v1r0u4ILI3k3zp5On2lSzVexkjXBfV86YCx/x+5OxDTAz Z8ZAi4ksDXmhSrFUzGAwpkTyBqP7R5/sZ/NdsA3xT5lKVNK0iiBVH9j572T7oIPN 99FlC6V1tytPYlpxFr2/VqTjf8mnvDUv93pnCOYR87Vjp8nE4R6+2w== =92gX -----END PGP SIGNATURE-----

1 0

Re: Netscape 2.0b2 allows for invasion of privacy (fwd)
by loki＠obscura.com 17 Dec '03

17 Dec '03

At 7:52 PM 12/28/95, Graeme Cross wrote: >Talking of Netscape - this posting prompted me to forward it given the >security and privacy implications inherent in the problem. > >Cheers >Graeme > <SNIP> YOW! It is beginning to look like "At Netscape, Security is Job NONE." Something to put with the Netscape pro-GAK pages I am putting together. -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

No Subject
by Mix 17 Dec '03

17 Dec '03

Timothy C[ocksucker] Mayhem's reheated, refurbished, and regurgitated cud is completely inappropriate for the mailing lists into which it is cross-ruminated. _ O Timothy C[ocksucker] Mayhem (_ | -'_/ X-

1 0

Re: Barring access to Netscape
by cactus＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- James A. Donald <jamesd(a)echeque.com> wrote: >This would not be satisfactory in itself: Ideally one would like to bring >up a page saying "Sorry, you cannot access that page because you >are using a netscape browser: Click *here* for the sad tale of >Netscape. If Netscape really does go the GAK route, I will unilaterally do this to the Cypherpunk Archives (or something similar, like every request flashing up briefly and then client-pulling the GAK pages). I've been told that many media-types go to the archives whenever c'punks make the news. How much of an effect do y'all think it'll have if they can't do it with Netscape? Shouldn't be too hard to hack this into Apache. - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBML7AKCoZzwIn1bdtAQEPhAF9HY/ARaVLTFcvyQ1utx94uZ+ZmeXOemmO 2jnX4y/gDelAEO+C7kBAprm8GDyLhgJQ =G5jT -----END PGP SIGNATURE-----

1 0

Re: Barring access to Netscape
by Frank Stuart 17 Dec '03

17 Dec '03

>If Netscape really does go the GAK route, I will unilaterally >do this to the Cypherpunk Archives (or something similar, like every >request flashing up briefly and then client-pulling the GAK pages). After talking to a couple of people, and playing around some, this seems to be a better choice. That way, you can actually send information (including a list of where to get other browsers) instead of just garbage to netscape users. Is anyone aware of browsers other than Netscape that do client pulls? A simple filter to do (and undo) this would still be useful, I think so that users can easily fix all their documents. Fortunately, that would be very easy to write. >I've been told that many media-types go to the archives whenever c'punks >make the news. How much of an effect do y'all think it'll have if they >can't do it with Netscape? > >Shouldn't be too hard to hack this into Apache. That's not a bad idea either. Hopefully, Netscape will post a retraction (soon!) and none of this will be necessary. Frank Stuart | (Admiral Grace) Hopper's Law: fstuart(a)vetmed.auburn.edu | It's easier to get forgiveness than permission.

3 2