December 2003 - cypherpunks-legacy

A WfW security curiosity (possibly another security hole)
by pgut01＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

When WfW is installed, it creates a file in the Windows directory called WFWSYS.CFG. This is a standard Windows password file and may be decrypted with the password "23skidoo" (note that this is lowercase, since it's passed to the .PWL-handling code at a level which bypasses the usual password case smashing. The mangled 32-bit form which is passed to the RC4 key setup routine is { 0x67, 0x6F, 0xE3, 0x81 }). WFWSYS.CFG seems to be mostly identical for the few copies I could get to, and WfW networking won't work without it. Decrypting the file doesn't seem to give anything useful, the string "SYSTEM" and what looks like a few 8 or 16-numbers. I don't know enough about how WfW networking works, but my (very vague) guess is that it contains some sort of cookie to uniquely ID each machine for resource sharing over a network. If it does then it it's (yet another) pretty serious security hole, since it's encrypted with a fixed password and seems to be mostly identical over multiple machines. OTOH it may be something to do with serial numbers so you can't install the same copy of WfW on multiple machines on a LAN. Can anyone shed more light on it? Peter.

2 1

Re: Alta Vista, Great Stuff!
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:26 PM 1/16/96, Beethoven wrote: >Imagine your nym is related to something common-place at >the time of posting. Even though you may be well known >under that nym, simple searches for that name will turn up >loads of crapola, or at least some light entertainment >for someone searching for oyur past posts. My name is rare and matched mostly by lists of the highest points of elevation in each state (Mt. Frissell in Connecticut) and museum shows of the work of a distant cousin Toni Frissell who was a fashion photographer in NYC. Most of the rest is mine. If you have a common name/nym it would be harder to track (except by searching for email address rather than name). DCF "Now everyone knows that Mohammed and Lee are the most common names in the world. Maybe I should change my name to Mohammed Lee."

2 1

Re: remarkable recent stories
by Rich Salz 17 Dec '03

17 Dec '03

>odiferous entrails, I'd be interested to here what others think. Several times I have heard NSA staffers talk about securing our secrets vs. reading theirs. It seems that right now the first side is "winning."

2 1

Crypto-related Pointers
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, Below are pointers to crypto-related items in 01 16 94 Edupage: CREDIT CARD SOFTWARE FOR INTERNET SPY AGENCY WARNS OF CORPORATE SPIES To subscribe to Edupage: send a message to: listproc(a)educom.unc.edu and in the body of the message type: subscribe edupage Andrew Sullivan (assuming that your name is Andrew Sullivan; if it's not, substitute your own name). For archive copies of Edupage, ftp or gopher to educom.edu or see URL: http://www.educom.edu Cordially, Jim

1 0

Re: Spiderspace
by Bill Stewart 17 Dec '03

17 Dec '03

>... I was under the impression that the only documents that most web crawlers >will search are documents that are link-accessible. Are you saying that this >isn't true? Are you saying that Alta-Vista will search EVERYTHING that's >publicly accessible, whether by anonymous FTP or web? Don't archie servers already pick up the anonymous ftp fairly well? Also, aside from no-robots conventions, you can build a cgi program for access to files that might be more effective at blocking searches while still preserving access. Also, it wouldn't be hard for a web-crawler to follow ftp links, as long as the root of an anon-ftp site is pointed to by a URL somewhere. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

3 2

on being elitist...
by Ed Carp, KHIJOL SysAdmin 17 Dec '03

17 Dec '03

Tim May said in a recent missive, of which I've deleted (unfortunately) that "most of us on the list are elitist" because we don't believe that most people will make it, or some such (please correct or clarify, Tim?) I would say that an "elitist" is one who believes that the masses (or the great unwashed, depending on your point of view) are somehow "not deserving" of surviving or "not worth it", and I would say that that definition would *not* fit a great many people here. I think that most people here are *for* getting crypto out in the hands of *everyone* - good, easy-to-use, cheap, uunbreakable (for all practical purposes, anyway) crypto, to use for everything, ranging from telnet sessions to email. True, there will be some who will *not* make it into the future, and those numbers vary (depending on whose vision of the future you subscribe to), but the point is, those who do survive aren't somehow *better* that those who do not - it may simply be that they are in the right place at the right time. Whether or not that place includes the Bay Area is a subject of debate. -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/digital pager 800/558-3408 SkyPager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi "Past the wounds of childhood, past the fallen dreams and the broken families, through the hurt and the loss and the agony only the night ever hears, is a waiting soul. Patient, permanent, abundant, it opens its infinite heart and asks only one thing of you ... 'Remember who it is you really are.'" -- "Losing Your Mind", Karen Alexander and Rick Boyes

1 0

[NOISE] Re: [NOISE] Re: Eggs at Customs (fwd)
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:02 PM 1/15/96 -0800, you wrote: >Morality has nothing to do with it. It's the speed of the evolution. If >you walk across the straits, the system has the time to react and restore >a dynamic equilibrium. If you immediately release a new species with no >natural predators, the system is shattered, and it might not survive. >This is not to say that ecosystems and societies are static -- they evolve >constantly, displaying unpredictable punctuated equilibrium (Steven J. >Gould was right, Edmund Burke and Karl Marx were wrong). This appears to have happened in North America about 12000 years ago; a highly competitive omnivorous predator/scavenger species appeared, and either out-competed or killed off a number of other large predator species, as well as some of the large grazing species. Seen any dire-wolves looking through your windows lately? >Politically and morally, I'm a follower of the realist school (Morgenthau >et al). It is right for the US to dominate the world because it has the >most power. Please don't abuse words like "right" for that sort of thing; it's as tacky as abusing "one-time pad", and there are other words that will do perfectly well, such as "unsurprising".... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

1 0

<fwd> Prejudice on the Internet: freedom and a whiff of danger
by vin＠shore.net 17 Dec '03

17 Dec '03

Replayed (w/out permission) from Netfuture #4, the 1/15 issue of a new and unusually thoughtful mailing list Digest from O'Reilly & Associates. Moderator and editor: Stephen L. Talbot. Check it out at: <http://www.ora.com/staff/stevet/netfuture/> The signal/noise ratio is delightful, and there were several mini-essays that many here might enjoy and might wish to respond to. Recommended by one stimulated reader. _Vin -------------------------------------------------------------------------- Response to "The Internet As Terminator" (Netfuture-3) >From Mark Grundy <Mark.Grundy(a)cisr.anu.edu.au> Give us inkblots on a page, and we'll read into them creatures of our fantasy. In the shapes of clouds we see the images of our lives, our dreams, and our hopes and fears. We've always made myths out of our jumbled and incomplete experiences. We've done it with weather, we've learned to do it with newspapers and tv bites, and we're starting to do it with the internet. We judge our world before we experience it. Our judgement is creative. It fills in the gaps where our knowledge fails. It focuses our efforts, clarifying our visions, identifying our opportunities and threats. Prejudice -- to judge before experiencing -- is not limited to just one culture, and it's not a blight on humanity as a species. Every mammal has prejudice as part of its survival training. The trick to mastering our prejudice is not to purge it and cripple our efficacy, but to accept its value in the moment, and to rise to the need to change it as imagination yields to experience. The main difference between the internet and other social experiences is not its diversity or complexity, because we can find diversity and complexity in every community. What distinguishes the internet most from other social experiences is how well we can control the experience itself. We can walk down a crowded city street and see plenty to challenge us, but we cannot control the bandwidth of that street. We cannot choose to encounter people wearing only yellow shirts, or remove anyone from the street who wears a green shirt. Yet these facilities come free on the internet. Our right to censor our environment no longer wars with our desire for society and community. We can have our cake and eat it too. This heady power -- to give ourselves just the world we want to see, appeals very strongly to our self-determination. Ideally, it could help us make great leaps between who we think we are, and who we believe we could be. It can surround us with saints, and screen us from sinners. But it brings with it some whiff of danger. If all we see of the internet is the community we've created for ourselves, then will the internet make us more or less parochial in our views? Will our society become more or less divisive? Will we see more or less conflict in our community? Moreover, the internet is not just a passive world of data sops, as television has been. Through the internet, we can not only dream our lotus dreams, but also act on them remotely, screening ourselves from direct consequence by distance and anonymity, taking action while preserving our little myths. It's not just that we can engage in infantile flamefests with people we've never met, cackling over our own supposed cleverness, and ignorant of whatever harm we might have done their feelings. Sitting in our comfy chairs at home and armed with a mouse and credit card, we could contribute money and ideas to the liberation of political prisoners in Turkey, or to the bombing of a bank in London -- all without changing our current, perhaps quite sedentary, lifestyles. We can wreak change on the world without being changed by our acts ourselves. What I would like to ask this group is twofold: Firstly as we're forced by the growing volume of internet traffic to make balder value judgements on what we expose ourselves to, how do we keep from becoming social ostriches? How do we balance tolerance against efficiency and purpose? Secondly, how can we make ourselves accountable for the material consequences of our broadcasts? What support, infrastructure and personal code is necessary before our global internet citizenship becomes at least as responsible as our national citizenships? On a cheerier note, can anyone think of ways that internet citizenship is already more responsible than national citizenship? Dr Mark Grundy, | Phone: +61-6-249 0159 Education Co-ordinator, | Fax: +61-6-249 0747 CRC for Advanced Computational Systems,| Web: http://cs.anu.edu.au/~Mark.Grundy The Australian National University, | ACSys: 0200 Australia -------------------------------------------------------------------------- Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

[NOISE] Re: Better diversity through Perrymoose.
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 16, 1996 18:09:44, 'Ray Arachelian <sunder(a)amanda.dorsai.org>' wrote: > >On Tue, 16 Jan 1996, David Lesher wrote: > >> Can't we just solve the problem by making it a moderated list; >> and make Perry the moderator? >> > >SHIT NO! NO NO NO NO NO! NO WAY IN HELL NO! :) Cypherpunks will NOT >be moderated. Filtered, spindled and stapled, but never moderated. > Why not two cypherpunk lists: AM & FM. AM = Attitude Moderated FM = Frequency Moderated -- tallpaul

1 0

Re: remarkable recent stories
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 16, 1996 18:16:09, 'Jonathon Blake <grafolog(a)netcom.com>' wrote: > Suppose the NSA was simply being used as a cutout > for its replacement, which is even more sub rosa? > Paranoid, but not, I think, paranoid enough to be true. -- tallpaul

1 0