December 2003 - cypherpunks-legacy

Re: Noise and the Nature of Mailing Lists
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 22:56 1/30/96, Timothy C. May wrote: >And remember, it's a whole lot easier using filters and reading tools to >reduce the volume of messages on an active group than it is to get an >inactive group up to critical mass! That is true. There is a lot of noise on this list, but there also is a lot of signal. My growing killfile is doing a rather fine job of separating the two. The rest can be weeded out manually in very little time. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

[NOISE] Re: FYR_wal
by Marshall Clow 17 Dec '03

17 Dec '03

>ok, who wants to help me market my new tunneling router software >called "Chinese Firedrill". I believe it would sell well in China's >black market. > Shouldn't it be called: "The Great Firewall of China"? ;-) -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "Eternal vigilance is the price of PostScript" -- MacUser Jan 96 DTP and Graphics column

1 0

re: Netscape "secure E-Mail"
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

Vince rites: >Anyway, it should be much easier to use than PGP. Can send PGP encrypted E-Mail from inside Netscape now - highlight/cut/punch Enclyptor "crypt" button/paste. This is difficult ? Read is same except punch "Dec" and notepad pops up with cleartext. Have even read encrypted mail on the VAX with Telnet that way (no, Virginia, the cleartext does not pass on the net). > * Integrated email - Netscape Navigator 2.0 offers full-featured and rich > email capabilities, allowing you to both read and send secure email > messages without launching an external email application. Could do that now with a commerce server - didn't say "encrypted" email, said "secure". Prolly just sends it to port 443 on the secure channel and the server does the SMTP to the internal net. Warmly, Padgett

2 1

Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards
by Weld Pond 17 Dec '03

17 Dec '03

Nathaniel Borenstein <nsb(a)nsb.fv.com> wrote: >> Programs needing secure entry create a "secure entry field" which is >> really just an imagemap with the digits (and alphas if required) placed >> randomly about. The user then uses the mouse to click on these numerals. >> Ideally the graphics that represent the numerals would be drawn from a >> random pool and are misformed to thwart any OCR attempts. The graphics could >> be made even more difficult to OCR by mixing in words and pictures to >> represent the numbers. >If any particular program for doing this came into widespread use, we >could engineer an attack, similar to our keystroke attack, based on the > specific properties of the approach used. You could try but I don't think you would succeed. I have problems doing OCR on faxes with a top of the line OCR program. Don't tell me your trojan horse is going to be able to OCR images that are designed to be hard to OCR. Here is an example of an imagemap for secure number entry. http://www.l0pht.com/~weld/numbers.html Since this is inherently a visual thing, I thought I would cook up a graphic on the web siince you cannot do this via email easily. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/ L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio L0pht Open House 2/3/96 at 8:00pm - Live on irc #l0pht - write root(a)l0pht.com for details.

4 3

re: alleged RC2
by m5＠dev.tivoli.com 17 Dec '03

17 Dec '03

Not like I have the time or anything, but is there any value in attempting something like "bruterc2"? (IANARC (I am not a real cryptographer), but it looks like one trick to that would be to somehow short-circuit the key setup stage. I suppose you could just start after it's mapped the user key into the "xkey" array, but I might be missing something.) ______c_____________________________________________________________________ Mike M Nally * Tivoli Systems * Austin TX * I want more, I want more, m5(a)tivoli.com * m101(a)io.com * I want more, I want more ... <URL:http://www.io.com/~m101> *_______________________________

1 0

RE: [NOISE] Re: FYR_wal
by Kurt Buff (Volt Comp) 17 Dec '03

17 Dec '03

perhaps it should, given that it will do about as well for its intended purpose... Kurt ---------- From: Marshall Clow[SMTP:mclow@owl.csusm.edu] Sent: Wednesday, January 31, 1996 14:58 To: Corey Minter Cc: cypherpunks(a)toad.com Subject: [NOISE] Re: FYR_wal >ok, who wants to help me market my new tunneling router software >called "Chinese Firedrill". I believe it would sell well in China's >black market. > Shouldn't it be called: "The Great Firewall of China"? ;-) -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "Eternal vigilance is the price of PostScript" -- MacUser Jan 96 DTP and Graphics column

1 0

Re: The FV Problem = A Press Problem
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:05 AM 1/31/96, sameer wrote: > I agree with your points that the press should write real >articles, and not just swallow press releases. The fact of the matter >though, is that that's what they do, swallow press releases. It's a >said state of affairs, but that is the state of affairs. > I wouldn't say *all* news is PR controlled, but most of it >is. It's much less work for the reporter when an article just shows up >on their desk and all they have to do is call one or two people for >some fresh quotes. And I agree with your points, too, Sameer. Like I said, I mean no disrespect to you that you issue press releases in which you interview yourself...it's the form that press releases take, and it's the form that "slides down easily" into a newspaper story. (The form makes it look as though the journalist has conducted the interview and gotten the quotes.) And at least most of Community Connexion's press releases have been about new services being offered, or rewards, etc. And not given vastly more attention than they deserve (as was the case with the FV "discovery"). I really hope this media frenzy with all things related to the Internet will burn itself out. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Flaw in FV process (was FV and Netscape slagging each other off :-)
by John Pettitt 17 Dec '03

17 Dec '03

At 05:56 PM 1/31/96 -0500, Nathaniel Borenstein wrote about Jeffs attack: >Your attack would be caught by us relatively quickly because our model >is based not on a single fail-safe piece of security software, but on >*process* security. The overall process is multifaceted, with many >checks and balances. Yes this is all fine and good - but your process does not allow for real time delivery of goods. For example: Somebody wants to buy say micrsoft office from me for electronic delivery (yes they have a lot of bandwidth :-). I can authorize a credit card, fun it by my fraud screen and start shipping in less than 30 seconds. At this point the transaction is done. In the FV model as I understand it I'd have to ship the software and wait for an approve/deny/fraud from the user. If it's anything but approved I'm SOL, I still have to pay Microsoft for the product but I didn't get paid. Solve that process flaw and I'll add FV support to software.net. John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch

3 2

[NOISE][CONTEST][FACTS] don't help much, do they?
by tcmay＠got.net 17 Dec '03

17 Dec '03

Ontogeny recapitulates phylogeny, as the saying goes. I notice a recent surge in posts that have one or more of the bracketed labels above, presumably in an effort to make the filtering job easier for others. However, this rarely works. For one thing, many of the most noisome posts, in my estimation, lack the [NOISE] label. And many of the posts labelled [NOISE] are actually pretty interesting, to me. Some people go overboard in labelling their own stuff as [NOISE], out of some kind of false modesty. And needless to say, the labels usually propagate into later followups. (And, shockingly, some people even prepend the followups they make with the [NOISE] label, thus screwing up threading. I saw this fad for labelling over on the Extropians list. It failed then, and will fail now. For one thing, the labels take up valuable "namespace." It is far better that the 30 to 50 characters of namespace be taken up with good, descriptive thread titles. Use labels if you must, but give some thought to how they just become more roadside clutter, conveying no meaning. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

No Subject
by Hroller Anonymous Remailer 17 Dec '03

17 Dec '03

At 07:25 PM 1/30/96 -0800, Lucky Green wrote: >>I take it its completely legal to set up a Virus ftp site then? > >AFIK, in the US it is legal to set up a virus ftp site. I don't know if >someone has actually done it. Don't count on it lasting. Some European >countries have already outlawed virus (read knowledge) distribution. Anyone interested in visiting a good virus site should point their browsers to: http://www.xcitement.com/virus/ Quite a good site, really. It hasn't been "Netscape Enhanced" yet, so there are no frames and tables and inline A/V, but it gets the job done. They offer a *lot* of virus source code (almost all of it in x86 assembler) and many related resources. Some highlights of the home page are included below. I would recommend the use of something like WebWhacker, which automagically downloads the contents of a web site to your local system and edits the html files to work correctly from your local web browser. It will allow you to replicate the site quickly and easily, instead of clicking on each of the more than 2500 links one at a time. Hope this helps. If you're interested, better get there quickly. (Of course, it's been up for six months now, so it's likely already withstood a substantial amount of negative response. It may be there to stay.) ---- 8< ---- Welcome to the VIRUS Source Homepage! This page contains several virus code generators, a few mutation engines, over 500 virus source files and over 2,100 executable virus files. This material is being submitted for educational purposes only. Play at you own risk. But have fun! The purpose of this page is not to inflame, but to educate, stimulate and confront you with alternative information on the sensitive issue of virus creation and propagation. The only way in which to know the whole of a subject, is by gaining knowledge from every variety of opinion on the subject, and studying all modes in which it can be looked at. Inform yourself by analyzing and studying the source code of actual viruses, read the virus writing & assembly language tutorials. Then consider and examine every variety of opinion on the subject; the anti-virus folks, mainstream society, and most importantly ideas and opinions that are considered radical, reactionary, minority or stigmatized by some other uncomplimentary label. No wise person ever acquired wisdom in any other way... A special note to those of you who would like to see an end to this page: If all humankind minus one were of one opinion, and only one person were of the contrary opinion, humankind would be no more justified in silencing that one person than it, if it had the power, would be justified in silencing humankind... What's New? Last updated on 12/26/95. Message Board Code Generators The 2nd Generation in Virus Creation (46k) Virus Creation Lab (164k) Password: Chiba City Mass-Produced Code Generator (45k) Instant Virus Production Kit (39k) Trojan Horse Construction Kit (18k) German Virus Construction Kit (12k) Mutation Engines Mutation Engine (13k) Mutation Engine Tests (18k) Polymorphic Engine (8k) Visible Mutation Engine (20k) Source Code [A-Z] Executable Files [A-Z] Debug Scripts Over 33 debug script files (184k) Miscellanous Debug.com based interrupt stripper (3k) V-86 based interrupt stripper (13k) VSUMX507.ZIP (96k) - database of viruses. Assembly Language (resources) Virus Writing Tutorials ---- 8< ----

2 1