December 2003 - cypherpunks-legacy

Domains, InterNIC, and PGP (and physical locations of hosts, to boot)
by Michael Handler 17 Dec '03

17 Dec '03

The InterNIC (the company responsible for registering .COM, .EDU, .ORG, and .NET domains) has had a great deal of trouble lately, with people submitting malicious CHANGE DOMAIN requests (change admin or technical contact, point root nameserver entries to rival ISPs, etc). In response, the InterNIC has created "the Guardian project" which delineates who has access and authorization to change data in the InterNIC's record. Not much new cpunk relevance, but much of what has been discussed here is very applicable to this project (digital signatures, common access to databases, etc). I'm not completely pleased with their implementation, but it will do for now. They _do_ support PGP as an access controller within the Guardian project, and they have purchased a copy from ViaCrypt for this purpose. A good thing, says I. Check out their proposal: ftp://rs.internic.net/policy/internic/internic-gen-1.txt ObGPS/cpunk/physical-location-of-machines: A recent IETF proposal would create a new DNS record that encoded the physical location of a machine, encoded in latitude and longitude. This would solve the problem MIT has had in distributing PGP, i.e. where exactly is unix5.netaxs.com? However, there's nothing to stop you from adding records that say your machines are at the latitude and longitude of, say, Fort Meade... ;-) ftp://ds.internic.net/rfc/rfc1876.txt Again, I'm not too sure of the viability of this proposal. Not on effectiveness of proving true location -- it is more geared toward "visual 3-D packet tracing" -- but simply because I have _no_ fricking idea where our machines are (in terms of lat and long) to any degree of accuracy. ("They're somewhere in PA." Brilliant, you can find that out via WHOIS.) The document suggests using GPS to locate your true location, but I'll be damned if my boss is going to spend $1,000 just so I can have more DNS entries to maintain... -- Michael Handler <grendel(a)netaxs.com> <URL:http://www.netaxs.com/~grendel> "Hours of frustration punctuated by moments of sheer terror."

2 1

Re: please stop the Mitnick stuff
by John Young 17 Dec '03

17 Dec '03

Littman mentions toad.com twice -- that site, a character says, suspiciously, "run by one of the founders of Sun." Used, allegedly by the perp, to get into the drawers of, Well, you know. BTW, Littman says, and that Markoff agrees, that it was not Mitnick who got into Shimomura's underware, but, more than likely, the "Israeli." Apparently, an incident occurred after Kevin's bust. Agree with Tim that the Markoff/Shimomura book is needed to see both sides. For now, Mitnick seems to be a hapless pawn. Me too, about stuff I only read about.

1 0

Re: Mixmaster On A $20 Floppy?
by jim bell 17 Dec '03

17 Dec '03

At 03:50 PM 1/6/96 -0500, you wrote: >>Someone can get one of those tiny devices that slips on the end of a >>keyboard connector and captures all the scan codes - you're better off >>bringing the whole computer (laptop) along with your floppy. >> > >First, I am not convinced that such devices exist in the real, practical >world. They would require either storage hardware or radio transmitters, >all in a package small enough to be undetectable to the naked eye. As a ham I can tell you that such devices will ALMOST CERTAINLY exist, at least in arbitrarily small quantities against high-value, rare targets. All that's needed is an VHF/UHF/microwave oscillator whose frequency is varied slightly in response to a change in control voltage (which in this case would be the data line voltage). The antenna would be the data line itself. Commercially, they are called VCO's (voltage controlled oscillator) or VCXO's (voltage controlled crystal oscillator). Historically, many were/are built in packages the size of large oscillator modules, with pinouts compatible with 14-bit dips. These are the dinosaurs of the current era. More modern are surface-mount parts substantially smaller than a TO-92 transistor case. It is probably possible to put a VCO in an SOT-23 package, which is so small that unless your vision is good it's hard to see! Embedding these in a custom, one-off cable for a black-bag job would be rather easy, even for an organization far less sophisticated than the NSA/CIA. Another option would be to make the thing look like a surface-mount resistor or capacitor, and replacing an existing bias/decoupling component in an existing keyboard product. I think chances are very good that the NSA/CIA buys at least "one of" EVERYTHING sold (especially keyboards) to plan for just such jobs. >Second, I do not think it practicable that the cosmic-nasties (of one's >chosen social bias) could, in the real, practical world, run black-bag jobs >on tens of thousands of surburban garages as a prophylactic measure against >teenagers "playfully" setting up Mixmaster sites. _THAT_ is probably true, given "tens of thousands." But individual hardware can indeed be attacked.

1 0

RE: Revoking Old Lost Keys
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 15:45 1/6/96, Bill Frantz wrote: >Perhaps if keys could be made with expiration dates (certificates too), >this problem might be reduced to managable proportions. I would very much like to see expiration dates on public keys. Is PGP 3.0 offering this feature? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

carrick demo revisited
by Jerry Whiting 17 Dec '03

17 Dec '03

Please note that the carrick demo that is available on www.encryption.com is just that; a DEMO. As the documentation states, the file format is NOT what is in the full retail product. The files that the demo generates are NOT compatible with the full retail version. The demo is a marketing-driven effort. The shipping version will have a different UI, a different file structure, a different file header, etc. Azalea Software will make full source code available to those who wish to review carrick under nondisclosure agreement. We have written an FAQ that details carrick's API's and file header. It will answer many questions that some cryptographically sophisticated users may have. We apologize for any misunderstanding or inconvenience the demo may have caused. Again, the demo is a marketing piece to accompany the press release that we are distributing. Ver 1.0 should be going out the door any day now and we invite all cypherpunks and other encryption fans to look it over. Azalea Software, Inc. 1 800 ENCRYPT www.encryption.com carrick(a)azalea.com

1 0

Re: Domains, InterNIC, and PGP (and physical locations of hosts, to boot)
by jim bell 17 Dec '03

17 Dec '03

At 11:15 PM 1/6/96 -0500, you wrote: >ObGPS/cpunk/physical-location-of-machines: A recent IETF proposal would >create a new DNS record that encoded the physical location of a >machine, encoded in latitude and longitude. This would solve the >problem MIT has had in distributing PGP, i.e. where exactly is >unix5.netaxs.com? However, there's nothing to stop you from adding >records that say your machines are at the latitude and longitude of, >say, Fort Meade... ;-) > > ftp://ds.internic.net/rfc/rfc1876.txt > >Again, I'm not too sure of the viability of this proposal. Not on >effectiveness of proving true location -- it is more geared toward >"visual 3-D packet tracing" -- but simply because I have _no_ fricking >idea where our machines are (in terms of lat and long) to any degree >of accuracy. Question: Do we really WANT to advertise the location of machines? Especially to an accuracy commensurate with current technology? And if lying is possible, what's the point?!? >("They're somewhere in PA." Brilliant, you can find that >out via WHOIS.) The document suggests using GPS to locate your true >location, but I'll be damned if my boss is going to spend $1,000 just >so I can have more DNS entries to maintain... BTW, the cheapest GPS receivers (Magellan 2000's, as I recall) at $200 at the local marine supply shop. Excellent price. Even so, I won't buy one when I get my first GPS reciever, for two reasons: 1. No differential capability. (will improve accuracy to typically 2 meters) 2. Only two digits past the "minutes" decimal point resolution.

1 0

Re: Revoking Old Lost Keys
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Sat, 6 Jan 1996 03:10:49 +0000, "Michael C. Peponis" <mianigand(a)unique.outlook.net> wrote: >If it's widley distributed, or on a keyserver, that becomes hard. >First you would have to be authenticated as the origional key owner, >ie how do I realy know that you are you, and not somebody saying you >are the orgional key owner? [..] >Good topic. Interesting, yes. Also a possible attack... Alice sends a PGP'd message to Charlie, but gets a reply from "Charlie" saying that they original key was lost due to a hard drive crash, etc.... and that she should coinsider it revoked. Is that message from Charlie or from Mallet (the demonic SysAdmin), who is trying to get in between Alice and Charlie...?

1 0

Re: Revoking Old Lost Keys
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Fri, 05 Jan 1996 23:07:19 -0800, Bruce Baugh <bruceab(a)teleport.com> wrote: >I'd like to bring up a problem I haven't seen addressed much yet, and which >I think is going to come up with increasing frequency as PGP use spreads. >The problem is this: how can one spread the word that an old key is no >longer to be used when one no longer has the pass phrase, and cannot >therefore create a revocation certificate? [..] Keys should have built-in expiration dates (adjustable by the user manually the way one would change their user-id, passphrase, etc.) PGP should give a warning when the key passes the expiration date. It should not prevent you from using it, but should remind you that the key is rather old, and that the owner may have moved, etc. Users who want to extend the life of their keys should send special certificates (at least once a year or every other year?) that tell keyservers and those with copies of their public keys that the key is still being used, and to update the expiration time. Comments? --Rob

2 1

info
by j.miranda3＠genie.com 17 Dec '03

17 Dec '03

Anyone have any connections with the alternative/underground rock scene. I have been reality surfing it here in the L.A. area and am looking for people who are interested in coming along to assorted indsutrial/techno/gothic/rave places. Also, are there any cybernetic developments related to this scene I was thinking of something along a program which would be used when employing the mini-monitors (which you wear like sunglasses).

1 0

Re: Internet & Porno on A&E tonite
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 10:54 1/6/96, Jim Choate wrote: >Hi, > >Just saw an add for a Investigative Reports show tonite on A&E dealing with >the Internet and some of the current issues relating to porno and privacy. > > > Jim Choate I just got done watching it. Heavy on the porno and Light on the privacy. It did cover some of our hot buttons but stayed away from talking about their context (ie: They covered the TN prosecution of the CA BBS owner but ignored the question of if it was a prosecution or a persecution [as well as the question of if the charge/trial was legal in the first case]).

1 0