December 2003 - cypherpunks-legacy

Locked out of Quicken - HELP!
by Patrick Lear 17 Dec '03

17 Dec '03

I recently created a new file in Quicken and used a password to protect it from prying eyes (I know ... it isn't very strong encryption ... and I hope it isn't) but now I can't remember the @#$%^!!@#$#@$% password. Does anyone have any suggestions regarding how to break in? Thanks, Patrick Lear, Sui Juris

1 0

Re: Diffie-Hellman
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Timothy Maypole styles his facial hair to look more like pubic hair. _ O O _ \-|-\_/-|-/ Timothy Maypole /^\ /^\ ^^ ^^ ^^ ^^

1 0

Colorado Catacombs BBS: 303-772-1062
by Michael Johnson 17 Dec '03

17 Dec '03

Please note that the correct number for the Colorado Catacombs BBS is 303-772-1062. I have been getting a lot of people calling my home voice phone number with a modem, and this is not fun, especially with those who do so at wierd times and without their speaker engaged. Also, note that the old number for the Colorado Catacombs, 303-938-9654, has been disconnected due to lack of funds for the BBS. Sorry about that, but in true cypherpunk style, I want to keep the BBS up and running with free service for fellow cypherpunks, so I rely on donations instead of subscriptions. Colorado Catacombs BBS - 303-772-1062 (2 lines, same number) 8 data bits, 1 stop bit, no parity, up to 28,800 bps (one modem is 28,800, the other is 14,400), ANSI terminal emulation. Access for all crypto files is free (in the USA and Canada), and you may use a psuedonym to log in if you like. (I do ask for your real name, but that is for my own reference in evaluating uploads). By the way, web lovers try http://www.csn.net/~mpj for pgp info. Enjoy! ___________________________________________________________ | | |\ /| | | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | \/ |o| | PO Box 1151, Longmont CO 80502-1151 USA Jesus is alive! | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | ftp://ftp.netcom.com/pub/mp/mpj/README -. --- ----- .... | | ||| \ \_/ | PGPprint=F2 5E A1 C1 A6 CF EF 71 12 1F 91 92 6A ED AE A9 | |___________________________________________________________|

1 0

journalism, travel and manufacturing
by Zooko Journeyman 17 Dec '03

17 Dec '03

A million monkeys operating under the pseudonym "Dr. Dmitri Vulis, KOTM <dlv(a)bwalk.dm.com>" typed: > Do drop by whenever you're in NYC. :-) I appreciate the invitation. I'll be sure to do so when I'm in NYC. In other news, I made some t-shirts at HIP. On the front they have an excerpt of an e-mail message looking something like this: From: Stan <wallace(a)netvertisement.com> To: Winston <1072SmithW(a)citizenunits.org> Subject: MAKE FREEDOM FAST!!! "I may disagree with every spam you send, but I will defend to the death your right to send it." -- Voltaire On the back they have the following slogans: MAKE FREEDOM FAST!!! Spam is Speech. Censorship is Censorship. And at the hem there is the legend: This is: AN OFFICIAL SPAM DEFENSE T-SHIRT Manufactured at: HIP, 1997 By: Zooko Industries I gave one shirt to Alex de Joode and one to Joichi Ito, and I kept one for myself. That leaves one, which I originally intended to snail mail to Dr. Dmitri M. Vulis, KOTM. But if you don't want it then I'll auction it off via cypherpunks. (Currencies accepted will include PGP-signed letters stating your undying adoration of and loyalty to Zooko.) Regards, Zooko

3 2

(no subject)
by ILSI 17 Dec '03

17 Dec '03

We would like to ask you to place a link from your site to our homepage. Please check out our homepage and let us know what you think. We have created a database to assist people that want to advertise on the internet. Using this database, people with homepages will now be able to easily find appropriate sites for links to their homepage. We are Internet List Services Inc. and we would appreciate your help. Please visit us at: http://www.ilsi.com/ilsi5.html Thank you, Gene

1 0

SSL brute/ng
by P.J. Ponder 17 Dec '03

17 Dec '03

If anyone is putting together a wish list of features for the next iteration of the distributed brute would they like to consider some sort of mirroring approach for the server (at least on stats or updates/ software ) so that some of that traffic could be reduced? I'm afraid I am one of the guilty trying to log on to check on the stats at least once and I probably contributed to choking it just by doing that. If a local server could have been updated, it would save bandwidth on the server doing real work. Could a trusted group of segemnt dolers be put together? I like the idea of running a benchmark type of program so that I could multiply keys/sec times the amount of time I had to donate, and only get a reasonable for me number of segments. I would hope that statistics be gathered on the number of keys tested, elapsed time, etc. so that we all got some more or less real world insight into key lengths and strengths, effort required to break, that we have all heard so many projections about... especially as the doling gets more sophisticated and the number of participants/cycle pool increases. Will there be Hal3? Just to ask a really dumb question, how do you know when you get the key? Is there some plaintext header string you're looking for? --pjp

2 1

Mail Program is screwey, sorry
by David D.W. Downey 17 Dec '03

17 Dec '03

I apologize for the remail of the Eternity uncensorable post. I have recently switched Linux versions and the mail program is a little bit screwy. This one was mailed via Netscape for Linux. (Which itself is a little screwy.) It does not send the message in the same format that it displays on screen, as well as reposting the replied to message. I will fix it as soon as possible. For now there may be one or two thers that come through like this. Plese forgive them.

1 0

Re: SSL trouble
by Will French 17 Dec '03

17 Dec '03

Scott Brickner writes: > We've identified several forms of "real-world retaliation:" > 1) "Result hoarding" - failure to report a found key > 2) "Segment hoarding" - requesting more segments than one can hope to search > 3) Denial of service - preventing access to the server Perhaps I wasn't clear... by real-world retaliation, I'm referring to being sued, thrown in jail, belabored about the head with blunt objects, etc. The three basic defenses I have are: (a) not getting people angry, (b) not letting them know who to be angry at, or (c) the threat of counter-retaliation. The "random" method is of type (b). I think you are focusing a bit too much on theoretical efficiency and not enough on bottom-line practicality. A 37% waste factor is better than staying in bed and wasting it all. >> I _don't_ care about the procedures, as long as I can get >> the information I need to go my own way. > So what information wouldn't you be getting? To "go your own > way", you need exactly the same information that the client > workstations use to test one key. The difference in your code > and the clients exists solely in how they determine the next > key to try. Yes, this is currently true, but there was a suggestion of witholding part of the challenge in order to keep people honest, or something like that. I didn't quite understand it, but I didn't like it. Will French <wfrench(a)interport.net>

1 0

Netscape's RNG
by Ian Goldberg 17 Dec '03

17 Dec '03

Someone on the list (sorry, I forget who), suggested that Netscape's RNG be looked at to see if the secret part of the SSL RC4/40 master key could be determined more directly. I used gdb on the Solaris version. SSL_GenerateRandomBytes() is called when random bytes are needed. It initializes the RNG, if necessary, and then calls RNG_GenerateRandomBytes. When I run "netscape https://banking.wellsfargo.com/", SSL_GenerateRandomBytes() is called 3 times; the first time, 32 bytes are produced (I don't know what they're for); the second time, 16 bytes are produced (the Challenge data); the third time, 64 bytes are produced, the first 16 of which are the master key (the first 11 of which are sent in the clear, and the next 5 are our goal). Here's my own hand-reverse-assembly of RNG_GenerateRandomBytes: (Correctness not actually guaranteed in any way...) -----8<-----8<----- struct RNG { unsigned char md5bytes[0x10]; unsigned char randbytes[0x10]; int size; void *md5data; }; RNG_GenerateRandomBytes(struct RNG *i0, char *i1, int i2) { char buf[0x20]; int o1,o2; while (i2 > i0->size) { memcpy(i1, &(i0->randbytes)+0x10-i0->size, i0->size); i1 += i0->size; i2 -= io->size; if (err = MD5_Begin(i0->md5data)) return err; if (err = MD5_Update(i0->md5data, &(i0->md5bytes), 0x10)) return err; if (err = MD5_End(i0->md5data, &(i0->randbytes), buf, 0x10)) return err; i0->size = 0x10; o2 = 0; o1 = &(i0->md5bytes[0x0f]); do { if ((*o1)++) break; --o1; } while (++o2 <= 0x0f); } /* i2 <= i0->size */ memcpy(i1, &(i0->randbytes)+0x10-i0->size, i2); i0->size -= i2; return 0; } -----8<-----8<----- It looks like that Compilers course came in handy... So it's not linear congruential. I guess the next step is to figure out how it's seeded, but that not for me to do (at least not tonight...). Here's another question about a more direct method: The 5 secret bytes are encrypted with the server's public (RSA?) key. Does the server use the same public key every time? How do you read the public key, given the Certificate Data (what's the format of the certificate)? Is it feasible to try to attack the public key with a massively parallel (Internet) factoring program (a la RSA-129)? Assuming that the modulus is _big_, it still is worthy to note that, unlike cracking individual challenges, cracking the public key will compromise _all_ communications with that server (until they catch on and pay $$$ for another key (I think?)). Just some thoughts, - Ian "it's only 10pm _here_, but it's 2am in Nova Scotia!"

1 0

Re: The BIG Lie (Jesus Confesses)
by nobody＠neva.org 17 Dec '03

17 Dec '03

Patrick Oonk wrote: > > Is this what the cypherpunks list has become ? Discussions about religion ? We killed this thread but after three days it rose again. > If so, I am out of here... Don't let lightning strike you in the ass on your way out.

2 1