December 2003 - cypherpunks-legacy

Elitism on Cypherpunks
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have seen a number of posts on "Cypherpunk Elitism". I have seen more examples of it here on the list. I think that this attitude will be more destructive to the list than noise in the long run. It has been said that "Cypherpunks write code". They must do more than that. Cypherpunks need to teach. All the cryptotools in the world are of no use if no one knows how to use them. (Or know how to use them correctly.) All of the protocols are of no use if no one knows how to impliment them correctly or WHY they need them in the first place. There are alot of bogus security methods. Many of them exist because people do not know better. Without someone to instruct them in the ways of these things, they will continue to go on with bad crypto, not knowing any better. Not all of the non-cypherpunks are beyond hope. Many of them are teachable. If we leave them to flounder on their own, cryptography will be something used only by an elite. It will be of little or no threat to the powers that be because only a small amount of people will have the ability to use it. The TLAs will have less encrypted trafic to sort through. They will have won a big battle, not through force of arms but force of egos. What can be done? Alot. Teach people how to use PGP. Help them generate keys. Help them get them signed. Show them how to use remailers. Teach them the secret of nyms. Friends teach friends how to use crypto. Adopt a BBS. They may be young, but they may also become the cypherpunks of tommorow. Upload current versions of programs. Keep them current. Organize keysignings on the board. Host crypto discussions. Help stamp out the misinformation that breeds on such systems. Instilling the interest in the field and teaching will do more for the cause than all of the "this is noise" postings in the world. Helping those who have questions will help the newbies no longer be newbies. There are some on the list who have already taken this tact and must be commended. There are others who have taken the "fuck you" attitude to anyone they do not find worthy opon first contact. Bad attitudes are counter productive. To prevent the fall of a new dark ages, we must make sure that the information is spread far and wide. I think the statement that descibes it best is: "UN-altered REPRODUCTION and DISSEMINATION of this IMPORTANT information is ENCOURAGED." There is alot that cypherpunks can do to encourage the use of cryptography by "the common man". Elitism is not one of them. In the long run it will be counterproductive. And maybe in the short run as well... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMP8jQeQCP3v30CeZAQHtjAf9FfJWRAe0ZDLNOLsFDMBGQvi9kXKZR3sw WDmOb3K/y8syCdADqqC4UjqoZ0pQ/XHEt6qKd8A7qx6D1FVQauTocEp1vqwE645h zGirsApDjiCYFmV/+Lbpor5Uf9F2rFbjya64lOTbiKW+XEGukpI3ghgbGxGPqPGF fIIT2QxqMl1MDd1sSGIXzvpniOsHI6HoVbPwUx8S2tbMR0dqh5AQObOKdna0D4x4 beAxEVyNd6atqdkZPEZy2XaSO6Y4hmRZx3I4CuqCM2wqbsboETQLpELBSn/dnxet 0Fe82xHHZQSuh0gMXEP+znaKYOq/38mijwjF3zpX+5RRHIVrjMu2+w== =ojHr -----END PGP SIGNATURE----- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

What's a good math text?
by phorgan＠broadvision.com 17 Dec '03

17 Dec '03

I'm not on the list just now, my work won't allow me the time to follow it. I'm still just as interested in cryptography though, and would like y'all to email me recommendations on good math books that will give me the background to understand the papers in the field. I'm sure that will include a good numbers theory text. If a beginner at number theory would have a hard time understanding it, please recommend background texts as well:) What else would I need? My computer science texts explain complexity theory well, what would I need in information theory. What would I have to read to understand factoring complexity? Are there any new texts that cover the recent breakthroughs in factoring? Thanks:) Patrick Patrick J. Horgan Broadvision Inc. phorgan(a)broadvision.com 333 Distel Circle Have horse Phone : (415)943-3677 Los Altos, CA 94022-1404 will ride. FAX : (415)934-3701 Opinions mine, not my employers except by coincidence.

1 0

Re: remarkable recent stories
by James M. Cobb 17 Dec '03

17 Dec '03

Vladimir, On 01 16 96 you wrote: I haven't seen much dialogue on...key things that have popped up recently.... Among those key things: the absolute biggest blockbuster of them all: the NSA... did a study about how crypto regulations affect US com- petitiveness in the international marketplace.... And you ask: why would they release *this* one? meaning the NSA study on how crypto regulations affect US competitiveness abroad. On 01 13 96 I wrote a message to the list headed "ITAR Re-write?" In it I attempt to answer your question. I include it below for your convenience. Cordially, Jim INCLOSURE: Date: Sat, 13 Jan 1996 05:04:52 -0500 (EST) From: "James M. Cobb" <jcobb(a)ahcbsd1.ovnet.com> To: cypherpunks(a)toad.com Subject: ITAR Re-write ? Friend, Bloomberg, the business news agency, reports 01 12 96: The U.S. Commerce Department will recommend easing export controls on encryption software after a study by the department and the National Security Agency found that American firms are being hurt.... The report's release came on the same day federal pro- secutors dropped a three-year investigation...of...Philip Zimmerman.... The government study comes a week after [the Computer Systems Policy Project] released [its] own study showing ...American companies will lose [maybe $60 billion] in U.S. computer system sales expected in 2000.... The 13-member Project ...includes International Business Machines...and AT&T.... Perhaps the let-go of Zimmerman is less a triumph of right than of might? But economic might is not the only kind of might: [Easing export controls] may pit Brown's department a- gainst U.S. defense and spy agencies.... So... [Commerce Secretary] Brown said his department will pre- pare recommendations for easing [ITAR] controls that should be forwarded to the president "within a few months." Meaning: the 13 Project members should be prepared to pay through the nose in the runup to the '96 gala. And just so they get the big picture: It's unclear if the NSA, the super-secret eavesdropping agency, endorsed the Commerce Department's conclusions in the report it jointly prepared. The newsstory reports ...federal prosecutors dropped [the Zimmerman] investiga- tion without explanation.... No explanation's required. One hostage was released. 13 others were taken. But the one release does afford the new hostages, who have deep pockets, some hope... Cordially, Jim NOTE. The newsstory's headline? COMMERCE'S BROWN PROPOSES REWRITE OF ENCRYPTION EXPORT CONTROLS. Its dateline? WASHINGTON (Jan 12, 1996 5:34 p.m. EST). Its Nando News online filename? biz6_1893.html

1 0

WSJ: IBM Corp. Compromises On Encryption Keys (fwd)
by mixmaster＠obscura.com 17 Dec '03

17 Dec '03

You might want to disregard the paranoid, irrelevant head and tail, but the included article is very good, especially considering the establishment source. Nice headline, for the WSJ. Forwarded message: > Have you heard of problems with the equations that Excel 95 generates when > using the trendline analysis function in a chart? I haven't seen this, but because of all the math stuff on my web, I'm getting both phone calls and a lot of odd math feed back. We think we do have a real carry bit error between the Win 3.x and Win95. Some of the data I've reviewed is pretty scarry. Microsoft lost a lot of their older programmers over the past 3 years. It was literally an Exodis out. Now they have a lot of people that can't read the old code and this is a real mess. They also can't get anyone with much experience to work there. Here in Redmond good people just stay away. I saw this article today in Dow Jones and thought it might shed some light on the security issues. I know what MS's 10 year strategy was from 1990. Steve Ballmer is the one making all the decisions on international markets. It's his baby. When I read this about IBM and Lotus all I could think of was Steve ordering the guys to make something exceptable for their license by the FED so they could gain market share over their competitors. This is just who he is. He doesn't understand the techincal issues and hasn't listened to Gates in years. MS is pretty thick with DC and must pay off lots of people there. That is what they were doing when I worked for their government group. It's weird working with the FED. They are all into their power groups. AND they are very low tech. I swear the FED is scrapping the bottom of the technical pool. The FBI is the worse. ------------------------------------ 1/18/96 IBM Corp. Compromises On Encryption Keys By Thomas E. Weber Staff Reporter of The Wall Street Journal NEW YORK -- International Business Machines Corp., caving in to intense government pressure, agreed to include a special key that helps investigators tap into data messages in return for permission to export a more-secure version of its Lotus Notes software. The U.S. has prevented software makers from exporting sophisticated encryption technology for fear that terrorists and other criminals would gain access to a snoop-proof communications system. Industry observers said IBM's move marked the first time a supplier agreed to give the government special access to its software's security code. But other companies also are negotiating with the government to find ways around export restrictions. Microsoft Corp., for example, has been seeking industry support for a new scheme that separates encryption technology from application programs so that those products don't need export licenses. Encryption keys have stirred the concern of privacy experts in the past. While IBM's Lotus Development Corp. software unit defended the move as a stopgap compromise until a broader agreement on data security can be reached, Notes creator Ray Ozzie clearly found the controversial plan somewhat distasteful. "We were desperate enough to try to negotiate a short-term, pragmatic solution," Mr. Ozzie said. "But we do not believe this is the right long-term solution." One privacy advocate would agree. "The irreducible fact is that foreign customers are reluctant to rely on security products that have been compromised in some way" by federal intelligence agencies, said Mike Godwin, staff counsel for the Electronic Frontier Foundation. Several years ago the government proposed the "Clipper" computer chip that was programmed to let investigators tap into phone calls and data messages transmitted digitally. While that plan died after privacy advocates accused the government of trying to spy on users, the idea of leaving a back door open for government agents has remained alive. Under the Lotus plan, government investigators would still need to employ sophisticated code breaking to read messages sent via Notes software, which lets users at different computers collaborate. Security software encrypts information by using a unique key of software code. The length of a key is measured in computer bits, and longer keys are better -- they're more complex and more difficult for wouldbe spies, not to mention government agents, to unravel. Until now, to obtain an export license for Notes, Lotus has been restricted to an encryption system of 40 bits in its international version. Domestic users have been permitted to use a higher-level, more-secure 64-bit system. The new overseas version of Notes, tagged Release 4, will give foreign users 64-bit security. But to get permission to export the software, Lotus agreed to give the government access to 24 of those bits by using a special 24-bit key supplied by the National Security Agency. (END) DOW JONES NEWS 01-18-96 6 02 A ---------------------------- Gates is the kind of person who will do just what they want if he gets dicked with. He'll have a ranting fit (Gates is a functional autist) about how stupid it is and then he will just get eccentric and say, give them what they want with a grin. He is still a hacker at the core. You understand the problem here. The FED is making them use lower security and then patting them on the back and buying their products for our own government and militery. Gates use to brag that he would crash the fed. I really believe he is still trying. NO ONE hates the FED more than GATES! He was a page in DC at 17 and got a good taste of our government. I've had it with these people too. DC is so discusting. All these attorneys who don't know shit about anything but words and lying... Hey, I updated my web... : ) To day I filed an appearance in court and fired my attorney. I'm still being dicked with here. If I don't look both way when I cross the street, I get busted. This week it was an unwanted touch. I touched someone's shopping bag getting into my car. Next week its an non-contact order by my daughter's guidence counselor. She considers a phone call from me about my daughter's possible college programs a threat! When I got the complaint it was totally nuts. Everything she knows about me is based on gossip. It reads like total hysteria. The way Microsoft has attempted to play me locally is really amazing. I was 40 when this started. Never had a problem before that. So when I say, 'Watch your back!' I mean it. : ) J~ http://www.halcyon.com/redrose/

1 0

Re: Hack Lotus?
by daw＠quito.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199601190610.RAA17232(a)sweeney.cs.monash.edu.au>, Jiri Baum <jirib(a)sweeney.cs.monash.edu.au> wrote: > > Hack Lotus? Please do. > > I have no idea how Lotus actually does this, but: > > How about a salt determined by the forty bit part? > > Ie if the key is s.g (s=secret, g=gaked), the BARF (="Big-brother Access > Required Field") could contain Encrypt(Hash(s).g,BigBrother). > > The receiving end, knowing both s and g, could re-calculate the > BARF and only function when it's correct. Unless it's been hacked too, > in which case it could barf when the BARF is correct :-) Looks good to me -- I think that should work. I guess that goes to show my lack of creativity. :-) I was talking to Avi Rubin from Bellcore last night, and he speculated that maybe the 64 bit key was a fixed one, generated once at installation time and escrowed with the government then. With a fixed pre-escrowed key, the receiver wouldn't have to do any checking; and it would obviate the need for a LEEF/BARF/... field. On the other hand, it seems to me like one should be able to disable this fixed pre-escrowed key mechanism with a little binary patch. I guess we need hard technical details. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQAXySoZzwIn1bdtAQFQxgF/d72pj3qiRVIxCBPvhBEsLwWtTiO9tibv HEa8VbFTwMWoWY70XAMd8meFG5ktMRob =8JMW -----END PGP SIGNATURE-----

3 2

Re: Keyboard emulation
by Martin Diehl 17 Dec '03

17 Dec '03

Steve, Yes, it's called PC Anywhere by Symantic MGD ______________________________ Reply Separator _________________________________ Subject: Keyboard emulation Author: "Steve Makrecky" <Steve_Makrecky(a)msn.com> at Internet-USA Date: 1/18/96 7:21 PM Looking for a design of a keyboard & mouse emulator. What I would like to do is control a main computer's keyboard and mouse functions by a second RS232 remote IBM PC. Has anybody tried this? Do you foresee any problems?

1 0

Code demonstrating Microsoft Windows insecurity on networks (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

What "anonymous" said (below). I had permission to forward this, but I figured it might attract more interest if it were "anonymous" to people who can't read headers. Almost two months after Peter and Frank demonstrated that it was untrue, and one month and five days after Microsoft "significantly improved" Windows 95 by providing a patch for the exact same algorithm, Microsoft this very second still says that the .PWL algorithm as used in Windows for Workgroups is secure. http://www.microsoft.com/kb/peropsys/windows/q90271.htm This article will also be included on thousands of copies of the February TechNet CD-ROM. Other Knowledge Base articles have been corrected in less than a day. Yusuf's statement that my January 16th email is the first that he had heard of the .PWL problem is both patently ridiculous and directly contradicted by private email from anonymous sources on this list whom T. C. May has killfiled. In other news, the international versions of the SMB and C$ bug fixes exploited by Samba and Paul Brainard were finally posted today (as usual, they're dated yesterday). So the non-US public shares listed on, for example, www.winserve.com no longer have to be completely open to everyone on the Internet. Yusuf Mehdi, the Windows 95 Product Manager, had told me on November 9th that these internationalized patches would be posted "within two weeks." No excuse for this two-month delay has been offered. Yusuf also, well, lied on November 9th when he said that Microsoft had "sent mail to the newsgroups" retracting their statement that the SMB bug was caused by Samba sending "illegal network commands," and clarifying that the patches dated October 20th only work on US/English versions of Windows 95. The original Microsoft announcement as released to the media and WinNews is at: gopher://quixote.stanford.edu/0R593020-600291-/win95netbugs The current version, which contrary to Yusuf's statements on November 9th does not indicate that there has been any change, is at: http://www.microsoft.com/windows/software/w95fpup.htm By the way, MSN is going to allow access via TCP/IP soon. Let's make sure they do it securely. -rich ---------- Forwarded message ---------- Newsgroups: comp.security.misc,comp.os.ms-windows.nt.admin.networking,alt.security,comp.os.ms-windows.networking.windows,comp.os.ms-windows.programmer.networks Path: nntp.Stanford.EDU!news.Stanford.EDU!nntp-hub2.barrnet.net!newsfeed.internetmci.com!nuclear.microserve.net!luzskru.cpcnet.com!not-for-mail From: anonymous(a)alpha.c2.org Subject: Code demonstrating Microsoft Windows insecurity on networks Sender: rich(a)infinity.c2.org Message-ID: <4dnmcu$pt4(a)infinity.c2.org> Date: 19 Jan 1996 00:57:02 -0800 Organization: http://www.c2.org/hackmsoft/ Summary: Cypherpunks share code Lines: 210 Just a little something to hurry this liar up: Received: from tide10.microsoft.com (firewall-user(a)tide10.microsoft.com [131.107.3.20]) by infinity.c2.org (8.7.1/8.6.9) with SMTP id JAA14902 for <hackmsoft(a)c2.org>; Tue, 16 Jan 1996 09:07:26 -0800 (PST) Community ConneXion: Privacy & Community: <URL:http://www.c2.org> Received: by tide10.microsoft.com; id JAA00999; Tue, 16 Jan 1996 09:28:16 -0800 Received: from unknown(157.54.17.74) by tide10.microsoft.com via smap (g3.0.3) id xma000913; Tue, 16 Jan 96 09:27:48 -0800 Received: from xnet2 (xnet2.microsoft.com [157.54.17.205]) by imail2.microsoft.com (8.7.1/8.7.1) with SMTP id JAA02991 for <hackmsoft(a)c2.org>; Tue, 16 Jan 1996 09:15:28 -0800 (PST) X-Received: from xmtp4 by xnet2 with receive; Tue, 16 Jan 1996 09:12:22 -0800 X-Received: from RED-02-IMC by xmtp4 with recvsmtp; Tue, 16 Jan 1996 09:08:41 -0800 Received: by red-02-imc.itg.microsoft.com with Microsoft Exchange (IMC 4.22.611) id <01BAE3F2.39A25280(a)red-02-imc.itg.microsoft.com>; Tue, 16 Jan 1996 09:08:39 -0800 Message-ID: <c=US%a=_%p=msft%l=RED-72-MSG-960116170828Z-11006(a)red-02-imc.itg.microsoft.com> From: Yusuf Mehdi <yusufm(a)microsoft.com> To: Rich Graves <llurch(a)networking.stanford.edu>, Yves Michali <yvesm(a)msg.microsoft.com> Cc: "pgut01(a)cs.auckland.ac.nz" <pgut01(a)cs.auckland.ac.nz>, "hackmsoft(a)c2.org" <hackmsoft(a)c2.org>, Robert Bennett <rbennett(a)msg.microsoft.com>, Michael Ahern <mikeah(a)msg.microsoft.com>, Russell Stockdale <rust(a)msg.microsoft.com> Subject: RE: Need confirmation of Win95 password encryption back door (fwd) Date: Tue, 16 Jan 1996 09:08:30 -0800 X-Mailer: Microsoft Exchange Server Internet Mail Connector Version 4.22.611 Encoding: 204 TEXT X-MsXMTID: xmtp4960116170841RECVSMTP[01.52.00]000000fb-49231 Rich, Thanks for your email. This is the first I've seen of your email. I'm forwarding to Mike Ahearn who will handle any issues. If we have outdated information in the knowledge base, I apologize and we will certainly correct asap. Mike will investigate and let you know the outcome. As always we appreciate your feedback. Yusuf ---------- From: Rich Graves[SMTP:llurch@networking.stanford.edu] Sent: Tuesday, January 16, 1996 5:06 AM To: Yusuf Mehdi; Yves Michali Cc: pgut01(a)cs.auckland.ac.nz; hackmsoft(a)c2.org Subject: Re: Need confirmation of Win95 password encryption back door (fwd) [A reply to a cypherpunks post] Peter, I'm forwarding this to the Windows 95 Product Manager, who does not seem to be taking this at all seriously, and Bcc'ing it to the technically knowledgeable reporters I mentioned in my other message and to four Microsoft engineers who have sent me mail, two of them on condition of anonymity (at least one of whom fears management reprisals). I don't see any particular reason to tell Microsoft everyone I am talking to, especially since they have been less than completely honest with me. Yusuf, please ask the Windows for Workgroups group to at least acknowledge the .PWL encryption bugs they have known about since at least November 29th, correct the Knowledge Base articles that explain how secure .PWL files are, and let the public know whether they have any plans to fix these bugs and fundamental architectural weaknesses. To put this more succinctly, the below, from Q90271, is complete bullshit, and you know it. The password list file is encrypted with an algorithm that meets the U.S. government Data Encryption Standard (DES). This encryption technology is the highest security allowed in software exported from the United States. The odds of breaking the encryption algorithm are less than those for random guesses of what the password might be. If you don't spread the word, we will. All it takes is a couple of free hours on CompuServe, America Online, Prodigy, Delphi, and the Microsoft Network, not to mention the Internet itself. Right now, my mailing list has 600 serious network managers in 20 countries, and my Web site gets about 1,000 hits per day (that's the main site; there are also mirrors in Russia, the UK, and Australia). -rich ---------- Forwarded message ---------- Date: Wed, 17 Jan 1996 01:15:20 +1300 (NZDT) From: pgut01(a)cs.auckland.ac.nz To: llurch(a)networking.stanford.edu Subject: Re: Need confirmation of Win95 password encryption back door >A Major Media Outlet requires confirmation that Windows 95, to facilitate its >automatic reconnect feature for sleeping laptops and temporary network >outages, caches all network passwords (NetWare, NT, UNIX running Samba, >SLIP/PPP dialup) in unprotected memory in clear text, whether you've disabled >persistent "password caching" to disk and applied the December 14th 128-bit >RC4 .PWL patch, or not. There seems to be no way to turn this off. Would you like me to confirm it for WfW? Actually you can problably do it for Win95 by removing the password file after the initial connect. If Win95 can reconnect with the password file missing, then the passwords are still in memory. You'll have to be careful though to make sure they're not being read from the Windows disk cache, loading Word in between killing the connection and trying to reconnect should clear the password file from the cache. >So, anyone have Win95 and some time to kill, or can anyone recommend a good >DOS/Windows RAM grepper? Given that the descriptor tables are apparently unprotected in Win95 (which is pretty incredible), it shouldn't be too hard to get access to all of memory >from a user process. In any case a VxD should be able to grep all of memory in the background without the user even being aware of it. >We know that this vulnerability exists in Windows for Workgroups, and Peter >wrote a little demo (on hackmsoft page below, without source), but the APIs >appear to have changed in Win95. Sorry about the delay in getting this to you, as I mentioned before it was on a machine a fair way away, stuck behind a firewall. I haven't included all the SMTP stuff and whatnot because there's quite a bit of it and it's boring, the routines which do all the work are the following... This is the function called by WNetEnumCachedPasswords() to enumerate each password: [*CODE DELETED*] /* Record the password information */ [*CODE DELETED*] /* Signify that we want to move to the next entry */ [*CODE DELETED*] This is the function which actually does the enumeration. The for() loop defines what resources you want to get passwords for. [*CODE DELETED*] /* Get the proc. address of the password manipulation function */ [*CODE DELETED*] /* Enumerate the passwords */ [*CODE DELETED*] To find out (for example) what disk drive resources you're using: /* Check each drive to see if it's a network resource */ for( driveNo = 2; driveNo < 26; driveNo++ ) if( GetDriveType( driveNo ) == DRIVE_REMOTE ) { char password[ 100 ], resource[ 100 ]; char *driveName = "x:"; WORD passwordLength = 100, resourceLength = 100; BYTE resourceNo; int i; /* Find the name of the network resource for this drive number */ *driveName = 'A' + driveNo; WNetGetConnection( driveName, resource, &resourceLength ); } This code should be modifiable by anyone to get any password for any resource. I'll leave it to you to decide how much to publish, the worry is that if you publish all of it people will whine about it helping hackers. Might I suggest something like: /* Get the proc. address of the password manipulation function */ WNetEnumCachedPasswords = ( LPWNETENUMCACHEDPASSWORDS ) \ GetProcAddress( WNetGetCaps( 0xFFFF ), \ MAKEINTRESOURCE( ORD_WNETENUMCACHEDPASSWORDS ) ); if( WNetEnumCachedPasswords == NULL ) exit( EXIT_FAILURE ); /* Enumerate the passwords for the resources we want. This only gets the first password, in practice we'd keep calling WNetEnumCachedPasswords() until the enumPasswordProc() tells us (via the returned status) to stop, then move on to the next resource */ for( resourceNo = START_RESOURCE; resourceNo <= END_RESOURCE; resourceNo++ ) status = ( *WNetEnumCachedPasswords )( "", 0, ( BYTE ) resourceNo, \ enumPasswordProc ); This shows how simple it is, but doesn't give people something they can just cut and paste into their own code to get something which will give them all passwords. You may want to include the "find drive resources" code fragment as well as an example of how to do this, although it's not really necessary. Feel free to forward this to whoever you think is appropriate, although it's probably best not to give the get-any-password capable version to the masses. Peter.

1 0

Re: Respect for privacy != Re: exposure=deterence?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 15 Jan 96, Rich Graves wrote: > But government employees should only be held accountable for > their actions as government employees. If the situation > warrants, go ahead and tap their offices, break into their work > computers, etc. But don't fuck with their personal lives. Oh, my! A little sensitive, are we? Aren't you even a *little* struck by the fact that fucking with people's personal lives is *precisely* what errant government officials *do*??? > Lots of people on this list have the power to carry out their > own tyranny over both individuals and groups. All it takes in > today's fragile online world is a little specialized knowledge. > I don't think it's ethical to use this power without serious > thought. Some might opine that the reason we have so many abuses is that so *few* people use the power they hold in their hands to set things right. Even the well-intentioned seem to expect someone *else* to do their maintenance of the republic for them. > The line between government and non-government is increasingly > blurry anyway. That's part of The Game, Rich. It makes it all that much easier for people to dismiss attempts at delineation by saying things like, oh, "The line between government and non-government is increasingly blurry anyway." > Everybody gets something from the government, be it roads or an > education. Oh. Okay, then. That makes it OK for them to indict you to keep their statistics up. Works for me! > Why should you be more suspicious of the guy getting paid > $10/hour to deliver your mail by the government than the > private businessman getting millions of dollars in government > subsidies? I'm not. Maybe *you* should be more suspicious of the guy getting paid $100K of direct government money to manage a national campaign of low-key terror than you should of the private businessman unable to pay himself because he *must* pay his employees and the government doesn't leave him enough for his own paycheck. This last is a *lot* more common than the "private businessman getting millions of dollars in government subsidies." > I think we're fundamentally asking the wrong question. I only > see relative power. I'd estimate that Bill Gates is more > powerful than Fidel Castro in many respects. He's certainly a > lot more powerful than your average postal clerk. "Looking for pow'r... in all the wrong places, (la-tee-dah)..." Admit it, Rich, you only see harmful power where you want to see it, and that isn't in government -- it is in private hands, particularly *corporate* hands. Geez, but you'd think that left-handed university cookie cutter would have gotten dulled and broken by now, and that they'd have fashioned a new one. I'd estimate that the Postmaster General is more powerful than Fidel Castro in many respects. He's certainly a lot more powerful than your average private businessman. > P.S. For the Good of the Order, I'm temporarily ignoring > jimbell That's quite all right. We can be sure he won't ignore *you*. We Jurgar Din (that will have to suffice: I do not yet live in a free country) +"The battle, Sir, is not to the strong alone. It is to the+ +vigilant, the active, the brave. Besides, Sir, we have no + +election. If we were base enough to desire it, it is now + +too late to retire from the contest." -Patrick Henry 1775 + -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMP9aREjw99YhtpnhAQG1ggIAhKmRWWIAIxCrmBemK79MDnnvko2Y+ooj i2GoxrHhDC9cr98O45iEdo+spcVETbMryvVgf3i4MCRr7t2iRwoRxQ== =nMvR -----END PGP SIGNATURE-----

2 1

NSA vacuuming down Internet traffic
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- WRT: "...the same article had Madsen stating that the NSA is vacuuming down Internet traffic. he gave the likely entry points that they are doing this." It's a virtual lead-pipe cinch that this is being done and probably has been going on for longer than anyone would like to think. In the 1960's - 1970's when international cable traffic was in its computer infancy, access was had to EVERY CABLE MESSAGE passing through the message switches of U.S. common carriers. This means no only every international cable message originating from or destined to a U.S. point, but also included every message ROUTED THROUGH the U.S., such as Europe <--> South America. There was no great skullduggery involved -- the common carriers simply made copies of their own log tapes and handed them to messengers from the, ah, FCC (ahem). It was on the operations checklist and no one thought twice about it. It may be urban legend to some, but I've seen it with my own eyes, handled the tapes with my own hands. If anyone else wishes to move this from the status of urban legend to something more solid, all they have to do is locate and ask people who worked in message switch operations at RCA Global Communications, ITT World Communications, or Western Union International, the three common carriers of that time. Knowing this, I would assume something similar was done at overseas locations of the same carriers and at such other access points as could be compromised. An organization such as NSA that viewed this as SOP would have to be brain dead not to be doing the same thing with the Internet. The only question in my mind is how far they have gone beyond USENET and the newer, fertile ground of web sites. Are they vacuuming packets and reassembling email? Just how many laser discs have been filled with coherent traffic? Time to exercise those plain, brown envelopes. We Jurgar Din (that will have to suffice: I do not yet live in a free country) +"The battle, Sir, is not to the strong alone. It is to the+ +vigilant, the active, the brave. Besides, Sir, we have no + +election. If we were base enough to desire it, it is now + +too late to retire from the contest." -Patrick Henry 1775 + -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMP9XX0jw99YhtpnhAQEH1gH+KiIxJ3eXZCNGq5mG9UB1A68+TOLe9tCk NG170tzIBtwjlXw09B83Oxx16WineBqlZ7NJJiRazssBpFqDnWEh4A== =tUWW -----END PGP SIGNATURE-----

4 3

authenticating intrahost crypto providers
by jleppek＠suw2k.hisd.harris.com 17 Dec '03

17 Dec '03

I have been doing some research on the development of an abstract security services API(not just a CAPI) and have hit a road block. The problem revolves around the need to authenticate a security service provider to an application. I noticed that microsoft has followed a path of providing a signature in each external provider but the feeling is that this is not that difficult to circumvent. I have the same misgivings but cannot come up with anything else. Are my misgivings unfounded??? What are some other possibilities to allow intrahost (application) authentication of services. Do you need to actually have a cryptographic binding of services? Comments.... Jim Leppek jleppek(a)suw2k.hisd.harris.com Harris Corporation

1 0