December 2003 - cypherpunks-legacy

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Here is your friendly reminder of the Austin Cypherpunks meeting tomorrow, Saturday the 2nd. We'll meet at the Central Market Cafe at 38th and Lamar at 6PM. Topics include the video (I'll have a camera!), ITAR relaxation, RC4 now being called PC1, how to duck the CDA using crypto, hardware random number generators, and stuff like that. The meeting should go around 2 hours depending on the crowd, and there is a Bookstop next door if you want to browse some reading material later. Look for the people with technical books and/or crypto-related shirts. They will be us. (I'm sending this to both austin-cpunks and cypherpunks.) -- Ben Combee, CAD Software Developer, small language enthusiast, HTML dude Motorola, Paging Products Group, Strategic Semiconductor Operation--Austin E-mail: combee(a)sso-austin.sps.mot.com Phone: (512) 891-7141

1 0

Re: PGP to PC mail integration
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: lmccarth(a)cs.umass.edu >Mike Ingle writes: >> Instead of messing with user interfaces, you set the POP and SMTP >> addresses of your mail program to "localhost". You run locally a Visual >> Basic program that sits on ports 110 (POP) and 25 (SMTP) listening for >> connections. The VB program is configured with the addresses of your >> real SMTP and POP servers, and acts as a proxy. > >> When your mail program retrieves POP mail, it goes through the VB >> program, and the VB program decrypts any PGP mail it sees. When it >> sends mail, the VB program encrypts any mail it has a PGP key for the >> recipient of. >Would you be stuck if you wanted to send something unsigned and/or >unencrypted ? You'd put something into the mail message itself that would tell it "don't encrypt this" and/or "don't sign this". Hmm... you'd need to put in messages to be signed and/or encrypted your passphrase, or have it gotten some other way... which doesn't look very safe. Of course, if you're just encrypting it to the person's public key off of your keyring, and for stuff that's coming in encrypted to someone else's private key or signed with someone else's private key on your keyring, that wouldn't be so much of a problem. For the stuff coming in with the verification message (could be spoofed), looking for such strings already in an incoming message would be good. An attacker could still potentially slip something in between the mail program and the proxy program, though - the same problem as with the passphrase in the message. -Allen

2 1

Seeking Position
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Long time cypherpunk reader seeks position. Class of 1996/J.D.: Top 10 U.S. Law School. B.A. International Affairs: Top 25 U.S. University. Highly proficent in modern fieldcraft, intelligence operations and communications security. Will sit for bar exam of employer's choice. Expert pistol, advanced tactical carbine, master level tactical driving abilities. Significant previous international clandestine fieldwork experience in developing and Eastern European countries pursuant to political risk analysis projects. Extensive legal expertise in white collar criminal investigation, national security law, bankrupcy, U.S. taxation of international and expatriot income, corporate governence, antitrust, 10(b), 10b-5 and misappropriation insider trading issues. Ideal canidate for high level position in emerging or existing security/economic/political risk analysis department of international firm, field agent for political risk consultant or to address the discrete needs of private client. Most rigorous international travel regime welcome. Serious inquiries only. TLA's need not apply. No wet work. Illegal proposals will be ignored. Borderline proposals considered with interest. Submit position description along with firm/client CV to: an436533(a)anon.penet.fi -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCPAzE3Z7oAAAEEAMClYX8ZIZ/3iwlH96s/JssxRPdmoh6fQcpBLFL8kLkthgkr bXo+Hh/gAKYmYYgDgT/SKfbpAE7qIMg+Ra8WvpMoBuhKNcCt7D7aruxGvId+l7nq KFfSLy6lVviQyVSPjCNxnCvbACIpEtXC1NnyxlShE+l6RvuVA/HuoJlH4LbVABEB AAG0FmFuNDM2NTMzQGFub24ucGVuZXQuZmk= =D7tQ -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Certificate validity issues
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

some hairboy ;) writes: > I don't see any that there could be any sort of automatic way to > distinguish between the necessity for recipient-signed vs. > recipient-unsigned certificates; One would assume that recipient-unsigned > certificates would be effective only when issued from a high-reputation > source. > > Some method should be required to allow user decisions as to this, but > whatever system is designed should definitely allow for both types, and > *require* relevant software to handle both types. I think this is a policy issue, not a technology issue. In general, key owners should be able to sign certificates that say arbitrary things, regardless of whether or not some third party agrees that the statement being signed is "true". Unless you believe in libel, slander, etc., which raises policy issues of a different sort entirely. The John Birch Society can sign something claiming that I'm a member. A policy that says that's sufficient information to conclude that I *am* a John Bircher is a broken policy. A policy that requires both the above and a signature by me on the same certificate, among other things, is viable. > There's actually a third sort of important certificate the system should > handle: > > (3) I might be a member of a secret society; I might need a membership > certificate to get access, say, to certain web sites. The system > should allow a "secret certificate," readable only by the issuer. Your description is a bit ambiguous. Do you really mean "readable", or do you mean "verifiable" ? If the former, it sounds like this could be handled by distributing signed certificates encrypted with the issuer's public key. If the latter, you could distribute signed certificates but not the public key needed to verify the signatures on the certs. It might be handy to use a hybrid approach, such as distributing signed certificates that refer to encrypted entity names (suitably padded with random bytes to avert trial encryption of plaintext guesses). -Lewis "You're always disappointed, nothing seems to keep you high -- drive your bargains, push your papers, win your medals, fuck your strangers; don't it leave you on the empty side ?" (Joni Mitchell, 1972)

1 0

Re: Paint Your Own Scarlet Letter (Was: Edited Edupage, 29 Feb 1996)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

>From EduPage via E. ALLEN SMITH: >SELF-PATROLLING THE WEB >The World Wide Web Consortium is pushing the Web page rating system that it >developed in cooperation with the Platform for Internet Content Selection, a >group of 22 online firms. >From SafeSurf Rating Page via lmccarth(a)cs.umass.edu wrote: >Thank you for making the Internet a safer place without censorship. >Until later, SafeSurfing to you! Remember, my goal is to convince the congress, president, courts, and Americans in general that the government should not be in the censorship business, not to have a system that actually works. I really hope this self rating system works in practice because (1) it is in line with current Internet practice, and (2) having it work makes a one hell of a fine argument. For many years people on the Internet have been encouraged to provide warnings on things they think others may find offensive. The the use of rot13 "encryption" is one example, another is the practice of putting warning labels (advertisements?) on material. Killfiles (in their most general sense) are analogous to the censoring browsers in this system. (I know it doesn't work for ftp/gopher/email/usenet newsgroups. I hope that the censors think that the web is the net.) (I think I want to start a web search engine looking for pages rated SS~~002 9, SS~~004 9, SS~~005 <5, and all the others don't care.) Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: Seeking Position
by Frank Willoughby 17 Dec '03

17 Dec '03

Those interested in an Information Security-related position might be interested in checking out: Cameron Carey Computer Security Placement Service (508) 393-7803 He specializes in placing InfoSec persons (only). His contacts are numerous and last time I checked, he knew of about a dozen or so openings. I have used him in the past. He's one of very few headhunters I have met who will actually work your resume & call you frequently with the status (where your resume is, the type of company, etc.). FWIW, it doesn't matter if you mention my name or not - I have no vested interest in recommending him other than I believe that people who do a good job ought to be recommended to others. Best Regards, Frank <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc. Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified Home of the Free Internet Firewall Evaluation Checklist

1 0

Anyone else getting duplicate ACKs sending alpha.c2.org messages?
by platypus＠alpha.c2.org 17 Dec '03

17 Dec '03

I just started a couple days ago, so it's entirely possible that I'm doing something wrong, but I seem to be getting two acknowledgement messages, about 5 minutes apart, for the last four messages (which happen to be my first four messages) sent through alias(a)alpha.c2.org. The recipient only seems to be getting one copy of the message. I happen to be using Private Idaho (thanks Joel!), but I don't think it should matter. Just wanted to check whether this was a common experience before troubleshooting more or bugging Sameer (yeah, so I go and bug EVERYBODY instead). I was going to figure it out myself, but since I'm bugging you anyway, is there a decent newbie guide on the web for using the mail-news gateways that parse the Newsgroups: header? I gather you just add the header after a ::, but do you just add headers, or repeat them all? I am mostly just educating myself and playing around with this stuff at the moment, so don't waste your time giving me a detailed reply on the assumption that I'm an Australian political dissident or anything. -- platypus(a)alpha.c2.org

1 0

RE: Nortel "Entrust"
by Stephen A. Gutknecht 17 Dec '03

17 Dec '03

I too would like to see an open discussion on this. Microsoft uses this for their new Exchange Server client/server email product.... ---------- From: Jonathon Fletcher[SMTP:jonathon@japan.sbi.com] Sent: Friday, March 01, 1996 10:17 AM To: cypherpunks(a)toad.com Subject: Nortel "Entrust" Can anyone tell me anything about a product called "Entrust", by Nortel (Northern Telecom). The notes talk about the software using DES ("which employs a 56-bit key") so I guess it's single DES, not triple DES. It also mentions a proprietary algorithm called CAST. Is this worthy of further investigation, or is it suspect ? What is CAST, and would it be classed as snake oil ?

1 0

Anonymous Web Browsing
by dwhite＠pris.bc.ca 17 Dec '03

17 Dec '03

Hi guys..... I'm new here and I don't have the same technical expertise as I am witnessing with most of the other posters here. I do have a question and I hope that it is not too technically naive. I have followed the ongoing discussion on PGP security, remailers and the like. I am wondering if the current trend with interactive Web browsing, Java, etc, is not going to create a privacy problem every bit as significant as insecure e-mail. As these "applets" become more sophisticated are we not going to have to face up to the issue of dynamic links to web sites that gather a lot of info from your computer as you interact with it? The recent controversy at Microsoft indicates to me that interactive Web applets could easily be programmed with hidden "siphon hoses" that are quitely sucking data from you while you look at the latest Baywatch poses. I am not a programer so I don't know how it would work. It just seems to me that it would not be that tall an order to accomplish. Correct me if I am wrong. My question is this: Would it be possible to create a web site that would function along the same lines as remailers do? Something that would allow a person to browse anonymously. So lets say I surfed into a Interactive Web site that has some kind of Java applet for......say portfolio projections..... Any personal financial info I dumped into it for analysis sake could be collected by the server for some kind of customer profile. Lets say that I didn't want sensitive financial info exposed to someone else without my knowledge. So then I would log into a "Re-Webber" that would allow me to continue on to the subject site with any electronic signature following back to the anonymous Web, not back to me. Another example that this would be a concern would be in the coming explosion of Bank oriented services that are coming available. A "Re-Web" would let you use applets on a Bank server without the concern that the Bank is gathering MORE sensitive info on you. Forgive me if this technically naive. I admit I don't know what I am talking about. It was something that piqued my curiosity as I was reading various posts about e-mail security. Doug dwhite(a)pris.bc.ca

1 0

Re: Cryptanalysis
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:52 AM 3/2/96, Alan Olsen wrote: >The author has failed to call me back. I do have some serious concerns >about the code. (There is not a single XOR used, except to clear >registers!) I am starting to suspect that it is based on a mathematical >progression based on the numbers 40, 28, 36. I need to spend a bit of time ^^^^^^^^^^ Ah, note that the magic key, 42, is not included. Coincidence, or stupidity? Alan, there is not enough time in the universe to waste it on those who will not learn even the basics. The "author," who I had understood to be a friend of yours (though apparently a more distant relationship is involved), is apparently developing something John Dee would have been proud of. Fortunately for the rest of us, cryptology has moved on in the last several hundred years. I again urge you not to waste your time on this. Or our time. (Trust me, in five or six years, if your friend sticks to his current course, he will announce to the world his "discovery" of the "virtual one time pad" and will be preparing a public stock offering in Silicon Snakeoiltronics.) A few other minor points: >>* The journal "Cryptologia" is largely devoted to amateur cryptanalysis. > >The web info for back issues listed a web page from a publisher that had no >listing for them on the server. I will be sending mail to get more info... Last I checked, Tony Patti was still the editor. Not all things are on the Web in serious ways, obviously. I had no problems finding copies in my local university library (UC Santa Cruz), but it was several years ago that I last checked (conventional cryptanalysis not being very germane and all). Reed College might have copies. >>There are very good reasons to say little about "conventional >>cryptanalysis": it just doesn't matter much with modern ciphers, such as >>public key systems. Modern ciphers don't fall to conventional attacks based >>on word frequency, pattern analysis, etc. > >Still an interesting topic... Perhaps as a hobby, for those who find the NYT crosswords exciting. But of little significance for modern cryptology, except as a cautionary tale. --Tim May THE X-ON CONGRESS: INDECENT COMMENT ON AN INDECENT SUBJECT, by Steve Russell, American Reporter Correspondent....You motherfuckers in Congress have dropped over the edge of the earth this time... "the sorriest bunch of cocksuckers ever to sell out the First Amendment" or suggesting that "the only reason to run for Congress these days is to suck the lobbyists' dicks and fuck the people who sent you there," ....any more than I care for the language you shitheads have forced me to use in this essay...Let's talk about this fucking indecent language bullshit.

1 0