December 2003 - cypherpunks-legacy

Re: Microsoft continues to mislead public about Windows securitybugs (a bit long, with references)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 0:37 1/9/96 -0800, Lucky Green wrote: > >Very true. But why does it always seem to take an exploitable crack before >companies pay attention to security flaws? Is it because they are unable to >admit that they have made a mistake? Everybody makes mistakes. What's the >big deal? I really don't understand it. Any psychologists on this list? Having, in the past, attempted to sell an Operating System with high security features, and failed, I think I can give you some insight. Security does not sell an OS to anyone, even the Department of Defense. People buy OSs to run applications. The only thing a lack of security in an OS will do is allow someone in an obscure department (perhaps called Corporate Security) to say no. Security is a checkoff item, and if you can convince a retired major that the OS is secure, then he will approve it. He is not going to check the details. His expertise is in guard stations and chain link fences. However, if someone, e.g. the trade press, rubs his nose in the fact that an OS's security can be breached, then he will take action. He will pressure the publisher to release a fix that they say will fix the problem. When they do, he will be happy. Microsoft particulary, is oriented to selling product, not pride in workmanship. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

2 1

Why I think the NSA should love Strong Crypto
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

Perry writes: >Once SIGINT becomes much harder regardless of their previous attempts >to stop it, I suspect that the NSA will become a friend and not an >impediment. Well, I often think that institutions and their desire to maintain their funding can lead to strange decisions. On one hand, doing everything to slow the emergence of strong crypto allows the NSA to continue to vaccuum up signals from the world. That would seem to justify their existence. But there are many people who can do this without the assistance of the NSA. The FBI has a crack team. I'm sure every agency can learn to snoop on phone calls. The US Forest Service, for instance, is meeting plenty of resistence out in the American West. I wouldn't be surprised if they have their own internal security unit that has developed the ability to do this. Now, imagine a world with plenty of strong crypto everywhere. Suddenly, cracking messages is a very tough job that requires plenty of computer power and high-powered mathematicians. The Forest Service can't order that up from the Police version of Toys-R-Us. Even the FBI's relatively sophisticated team isn't ready for it. It just takes plenty of investment of time and education. That's why I say that Strong Crypto is really in the NSA's best interest. They haven't had a worthy adversary since the Soviet Union fell apart. But I'm just a wise guy. -Peter

1 0

Re: DNow2> Re: DNow2 Re: Hammill 1987 speech
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Greetings to all from someone on the cypherpunks list. Please don't crosspost threads on cypherpunks + other mailing lists. This thread, in particular, has essentially nothing to do with cypherpunks at this point. Please eliminate cypherpunks(a)toad.com from the cc: on future responses. Thanks. Futplex <futplex(a)pseudonym.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMPKyuinaAKQPVHDZAQFoYQf+PKbtkD4P5SmV0JchrkMNvKWfGXLik1mW /0WkUXTZ8rENwozWkrh3cUmzmR0YoMJBLAlJvmcJuzPVIpz8rjTLMhbp2VPeuQct 9/eTT7DOUqrekL0QWzlZP24wMYiHhTQEsMtbKlI3PT55ZMu95L4PJscZsdVG6OQY cX7rJD2xbLYcaxRF04KKm8ajltieDmTmH3/Lk3AOnnB/HFn5ZArCam5PJcWvXFWg kdPQjlW+iUFT+5kuXny5Jug9PTXL37zW8z9OBsKXMGARdeV8vDFiV8HX/ge4SAie qWpgPfuMqHXZbCc1doQdOMv1iuWCUhQH0f2azkNG6UiPurVxqwnCYg== =JcyK -----END PGP SIGNATURE-----

1 0

NSA and NT security
by Corey Bridges 17 Dec '03

17 Dec '03

PALO ALTO, Calif., Jan. 8 /PRNewswire/ via Individual Inc. -- Global Internet today announced that the National Security Agency has awarded them a contract to conduct a feasibility study on raising the security level of Windows NT 3.51 to B-level. Global Internet will analyze Windows NT's ability to meet B-level security requirements, as well as develop a software prototype that demonstrates a Fortezza-based cryptocard access control mechanism. The contract was granted by the NSA under the Multilevel Information System Security Initiative (MISSI), which has the charter to provide security services for information ranging from Unclassified but Sensitive up to and including Top Secret. Windows NT was originally designed with security in mind. A NSA evaluation team has determined that Windows NT 3.5 with Service Pack 3 satisfies all class C-2 security requirements. B-level of security strengthens the C2 level security features while providing stricter system assurances. Global Internet has a proven expertise with Windows NT. Centri TNT is the only network security solution that is fully integrated into Windows NT TCP/IP networks by complementing and extending Windows NT's inherent strengths, while maintaining 100% compatibility with existing applications. Global Internet also has extensive experience architecting, designing and developing high level secure operating systems. "This project addresses anticipated security requirements for DOD, as well as commercial customers using Windows NT," said Michelle Ruppel, a director of the Global Internet Software Group. "Our analysis will address compatibility issues with B-level security requirements and identify the changes necessary to provide this level of support." According to Outlink, Inc., a New York-based research and publishing firm focusing on the information security market, about 80% of the PC hardware market supports Microsoft's DOS and Windows 3.1. This combination, though popular, does not provide inherent security features such as secure login, access control, auditing and self-protection. Strong access control is a highly desirable function of the MISSI architecture. Trusted Operating Systems will play a role in the MISSI success. Windows NT is a modular OS and combined with its current security features that are based on the Trusted Products Evaluation Program (TPEP) C2 level of security and it's ability to operate on the majority of customer platforms while supporting DOS and Windows applications, the architecture lends itself to support B-level requirements. An operating system with few security features allows anyone to use the machine without validating their identity, while allowing access to all files, objects and resources. C2 level security includes: auditing to allow security-relevant events to be recorded and monitored, discretionary (need-to-know) access controls to mediate who can access (read or write) files and other objects and identification and authentication (login) to require users to identify themselves to the system before they are allowed to use the system. B-level security additionally includes: labeling of users, files and other objects with a sensitivity label, mandatory access controls to enforce a security policy based on the labels of the users and objects and trusted path that ensures users they are using the actual programs provided with the system. The Global Internet Software Group specializes in security software for Windows NT networks and other operating environments. The Software Group is a division of Global Internet, a full-service internetworking solutions company focusing on secure, reliable internetworking software and services. Located in Palo Alto, California, Global Internet is privately held and was founded in 1993. Global Internet Home Page: http://www.gi.net. /CONTACT: Jim Adams of Adams And Associates, 408-370-5390, or E-mail: jaadams(a)ix.netcom.com, for Global Internet; or Mark R. Kriss of Global Internet, 415-855-1700, or E-mail: mkriss(a)gi.net/

1 0

Re: The LOGIC of Navigator 2.0 ?
by James M. Cobb 17 Dec '03

17 Dec '03

Steve, I posted a message, The LOGIC of Navigator 2.0 ?, to the list on 01 08 96. That message quoted a couple of paragraphs from a Bloomberg news agency newsstory. The story is headlined, Netscape Will Release an Updated Internet Browser in Two Weeks. The story's datelined Mountain View CA. Your 01 08 96 followup message characterized my original message as "garbage." You posted your message via Best Internet Communications Inc in Mountain View CA... Whatever the significance of that may be, there's the additional matter that you may not understand the significance of the phrase GOVERNMENT LOGIC which I used in my original message. I hope the following provides you sufficient context-- In 02 96 Internet World, science fiction writer Vernor Vinge is interviewed: Suddenly [about 1984] people realized that if a 100 million people each had computers that were one-tenth of one percent as smart as the government's computers, they had much less to fear about government. Now we've entered an era where the government understands this. On the one hand, police forces are legitimately [?] frightened; law enforcement could become much more difficult. But at the same time --with some new laws and technology-- police powers could be much greater than before.... You've heard of ubiquitous computing, but how about UBIQUITOUS LAW ENFORCEMENT? Developing that line of thought, Vinge says: ...the old Clipper chip proposal recommended that GOVERNMENT LOGIC be present in certain communications equipment. For the future I think this aspect of Clipper was as significant as the crypto issues. What would it be like if a certain amount of GOVERNMENT LOGIC were mandated in the design of every host in a country? And Vinge concludes: WE COULD HAVE REAL-TIME TAXATION. and ...very fine-grain CONTROL would be possible. Capitalization in the above excerpts is mine. The whole interview is worth reading. Its title is: Reality & Fiction. It starts at page 82. Jeff Ubois asked the questions. Every HOST in a country? As Larry Ellison says in 12 26 95 / 01 02 96 Computerworld 41: The ideal operating system arrives across a network when you turn your computer on. The GOVERNMENT LOGIC arrives too... Cordially, Jim INCLOSURE: Date: Mon, 8 Jan 1996 16:03:06 -0800 (PST) From: Steven Weller <stevenw(a)best.com> To: "James M. Cobb" <jcobb(a)ahcbsd1.ovnet.com> Subject: Re: The LOGIC of Navigator 2.0 ? Please refrain from posting such garbage on the cypherpunks mailing list. You are not a friend, you are a pest. On Mon, 8 Jan 1996, James M. Cobb wrote: > > > Friend, > > > 01 07 96 the business news agency Bloomberg reports: > > Netscape Communications Corp. said it will release in two > weeks a new version of its popular browsing software, de- > signed to keep the Internet software company ahead of rival > Microsoft Corp. > ... > > The [new] browser can use programs that are stored on cen- > tral computers on the Internet, making a personal computer's > operating system less important. > > > And thereby making GOVERNMENT LOGIC more important? > > > Cordially, > > Jim > > > > > NOTE: The newsstory's headline? NETSCAPE WILL RELEASE AN > UPDATED INTERNET BROWSER IN TWO WEEKS. Its dateline? > MOUNTAIN VIEW, Calif. (Jan 7, 1996 4:16 p.m. EST). Its > Nando News online filename? biz7_1087.html > > >

2 1

Re: SSH for Windows
by Alex de Joode 17 Dec '03

17 Dec '03

: ...can be found at URL http://public.srce.hr/~cigaly/ssh/. FYI. also on ftp.hacktic.nl/pub/replay/pub/incoming/ssh-1-2.zip (the .hr link is _very_ slow) -AJ-

4 3

Don't type: "g**d t*m*s v*r*s"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:35 PM 1/9/96, Kent Dahlgren wrote: >God...are we going to have to endure this like we have had to endure that >stupid g**d t*m*s v*r*s e-mail crap? Let it die. Let it die. I have edited the name of this virus so as to minimized its damage. I read that even _typing_ the phrase "g**d t*m*s v*r*s" in its full form can cause the information stored in the phrease "g**d t*m*s v*r*s" to unpack itself, install itself on all types of disk drives, and then initialize the disks. I hope we caught it in time! (More seriously, I notice that "alt.folklore.suburban(a)c2.org" was in the distribution list for the message I'm replying to (pared out by me on this message). I really hope that this does not mean what I think it means, that "alt.folklore.suburban" is not being copied! The cross-contamination of many mailing lists is one thing, but cross-contaminating our mailing list and Usenet groups would truly be the work of the Army of the Twelve Monkeys.) --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3

RE: S.652 (H.R. 1555) (\"obscene, lewd, lascivious, filthy, or indecent...et al\")
by John Young 17 Dec '03

17 Dec '03

Responding to msg by blancw(a)accessone.com (blanc) on Tue, 9 Jan 8:41 PM >What needs to do is to learn to speak like politicians. > Learn to go around the subject, make indirect >reference, make vague allusions, be indirect & >wavering, ambiguous & obfuscating, evasive & >hypocritical; never openly offending, never possible >to be held liable for having said anything of >consequence. > >Of course it will still be annoying, but how can they >criticize their own style & manner. Ah, you've godiva'd le roy, and guttered moi.

1 0

Re: PRIVACY: Private traces in public places
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Responding to msg by tcmay(a)got.net (Timothy C. May) on Wed, 10 Jan 0:9 AM >I'm not trivializing the issue of search engines and >archiving systems turning up articles written, old >posts, etc. Every couple of weeks, sometimes more >often, someone sends me a copy of one of my postings >and claims that someone else must be forging my name >(recent posts on racial issues, for example--while I'm >not a racist, I despise quotas, setasides, and >preferential treatment for lazy people, of any >race...this obviously makes some people "ashamed for >me" :-}). http://nytsyn.com/live/News3/006_010696_101827_2723.html Last summer the first case in Britain of a libel on the Internet was settled out of court when Laurence Godfrey accepted undisclosed damages from another nuclear physicist, Philip Hallam-Baker, over remarks made in 1993 on Usenet, an electronic conference with 16 million users. And Peter Lilley, the Social Security Secretary, sent a stiff letter to the vice-chancellor of Leeds University after one of its students used a faculty computer to make defamatory allegations about him.

1 0

Re: The LOGIC of Navigator 2.0 ?
by Alan Olsen 17 Dec '03

17 Dec '03

At 06:12 PM 1/8/96 -0500, you wrote: > The [new] browser can use programs that are stored on cen- > tral computers on the Internet, making a personal computer's > operating system less important. > > > And thereby making GOVERNMENT LOGIC more important? I think they are refering to Java scripting in this article. (You have to remember that such articles are phrased for those who have little or no technical knowledge.) I find it amazing though that they claim a two week release date when I have not heard of a Java version for the Mac as of yet. I would think that they would have put it through at least one beta first. (But then again, this is netscape we are talking about...) [Note to Jeff and other Netscape employees: I realize you have gotten better. Lets hope it stays that way. (And I won't make *any* comments about "tech support".] Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Governments are potholes on the Information Superhighway." - Not TCMay

1 0