December 2003 - cypherpunks-legacy

FV's Borenstein discovers keystroke capture programs! (pictures at 11!)
by dmacfarlane＠zip.sbi.com 17 Dec '03

17 Dec '03

Is this the most transparent media attention grab or what? FV's "Chief Scientist" writes a killer application to destroy Internet commerce and it is really only a keystroke capture program with a bit of credit card number recognition code tacked on. I don't think this has any "implications for Internet commerce". If you run any number of virus protection programs on your computer, and you get your software from reliable sources, you never need worry about clandestine number snarfing. I readily admit that there is a larger issue about viruses and being able to trust your software, but the presentation from FV of this announcement as a "fatal flaw" in internet commerce is remarkably disingenuous. They are really saying, "We have the only safe approach" quietly between the lines. And before pm. says it, this has very little to do with cryptography. Skeptically yours, David Macfarlane.

5 4

The Big Lie
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

Timothy C. May wrote (with some judicious editing): , I took it as a fact that the >so-called Holocaust actually happened. I saw pictures of death camps, >interviews with survivors, etc. > > It seems more likely that >the pictures were faked, > >, I suspect the >stories are true that the Holocaust was part of Truman's "Big Lie." > Good Lord! We've all enjoyed Tim's rants, but this takes the biscuit. What's next? A denial of the athletic abilities of Negroes? --Dave Rose

3 2

Re: Escrowing Viewing and Reading Habits with the Government
by Ted Garrett 17 Dec '03

17 Dec '03

At 08:54 PM 1/27/96 -0800, you wrote: >According to >Director Freeh, "If we had had this program in place when Timothy McVeigh >was a child, we could have detected his interest in ANFO and picked him up >for reeducation, or at least recruited him for the CIA's Lockerbie team." ^^^^^^^^^^^ Please tell me this was not an actual quote. The term re-education scares me more than anything, as it's the term typically used by authoritarian dictatorships for their tortures and murders.

1 0

Germany, or "Oh no not again"
by Deranged Mutant 17 Dec '03

17 Dec '03

------- Forwarded Message Follows ------- Date: Sun, 28 Jan 1996 19:30:21 -0500 (EST) Reply-to: educom(a)elanor.oit.unc.edu From: Educom <educom(a)elanor.oit.unc.edu> To: "EDUCOM Edupage Mailing List" <edupage(a)elanor.oit.unc.edu> Subject: Edupage, 28 January 1996 [..] GERMAN PROSECUTORS TARGET INTERNET RACIAL HATRED The Mannheim, Germany, prosecutor's office has launched an investigation of CompuServe and Deutsche Telekom's T-Online service for inciting racial hatred, a crime in Germany. At issue is online access to a Web site run by a neo-Nazi extremist in Canada who uses the Internet to distribute anti-Semitic propaganda. The legal reasoning, according to a prosecutor's office spokesman, is that "because it's available over the Internet, it also can be called up in Germany. Then the scene of the crime is all Germany." Although the investigation is now limited to CompuServe and T-Online, there are also several hundred small companies that provide Internet access in Germany. (Wall Street Journal 26 Jan 96 B2) [..] Edupage is written by John Gehl (gehl(a)educom.edu) & Suzanne Douglas (douglas(a)educom.edu) Voice: 404-371-1853, Fax: 404-371-8057. Technical support is provided by the Office of Information Technology, University of North Carolina at Chapel Hill. *************************************************************** EDUPAGE is what you've just finished reading. (Please note that it's "Edupage" and not "EduPage.") To subscribe to Edupage: send a message to: listproc(a)educom.unc.edu and in the body of the message type: subscribe edupage Emmitt Smith (assuming that your name is Emmitt Smith; if it's not, substitute your own name). ... To cancel, send a message to: listproc(a)educom.unc.edu and in the body of the message type: unsubscribe edupage. (Subscription problems? Send mail to educom(a)educom.unc.edu.) --- "Mutant" Rob <wlkngowl(a)unix.asb.com> Send a blank message with the subject "send pgp-key" (not in quotes) for a copy of my PGP key.

1 0

None
by Mr. Nobody 17 Dec '03

17 Dec '03

In article <ad32cd9601021004af4e(a)[132.162.233.188]> jrochkin(a)cs.oberlin.edu (Jonathan Rochkind) writes: > 3) I believe that FV works by assigning the user some sort of id number. > They send the id accross the net, FV has a database with "FV-ID" <-> > credit-card-number correspondences, the merchant sends FV the id, FV bills > your card and pays the merchant. Now, if I'm correct about how FV works, > we could clearly write a program that searches your HD for FVs data files, > extracts your FV-ID from it, and steals it. It could be a virus, it could > send the FV accross the net, whatever. We could then use your FV-ID to > make fraudulently make purchases through the FV system that would be billed > to you. This is essentially the same attack as FV "demonstrates" against > software encrypted credit cards over the net: that is, the "You have an > insecure system and if we can put evil software on it, we can get you." > attack. This sounds like a fatal security flaw in FV's system! We need to publicize this fact widely to prevent innocent people from using their FV accounts from computers or over the network.

1 0

Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit
by Peter Trei 17 Dec '03

17 Dec '03

Someone claiming to be "Nathanial Borenstein" writes: > As you may already have heard via the popular press, First Virtual > Holdings has developed and demonstrated a program which completely > undermines the security of every known credit-card encryption mechanism > for Internet commerce. [...] I started reading this thinking it was actually something important. All it describes is a keyboard monitor, which greps for CC#s, and which could be spread by an (unspecified) virus, and sends the output to a crook over the net by some (unspecified) mechanism. So, what else is new? [...] > Nathaniel Borenstein <nsb(a)fv.com> >Chief Scientist, First Virtual Holdings >FAQ & PGP key: nsb+faq(a)nsb.fv.com It's sort of interesting that "Nathaniel Borenstein" has a PGP key, but failed to clearsign this message, which loudly trumpets it's great import. Considering the lack of actual content, I feel compelled to warn readers that this may be a forgery, designed to make him look like he's scaremongering. strictly speaking for myself Peter Trei ptrei(a)acm.org Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

6 11

Re: Time codes for PCs (fromn German Banking)
by JR＠ns.cnb.uam.es 17 Dec '03

17 Dec '03

From: SMTP%"jimbell(a)pacifier.com" 27-JAN-1996 03:43:05.83 >A peripheral I've long wanted to see, commonly available: ACCURATE time, >broadcast to the millisecond/microsecond/nanosecond, available from sources >as varied as TV VIR's, FM subcarriers, and other sources, available as an >easy input (via a peripheral card) to a computer. > Yup! Do you think it is really possible? If I remember well speed of light is 300.000 Km/s. That means that light takes around 1 ms. to cover 300 Km. If you use a satellite, antenna, whatever to broadcast a timing signal, the accuracy will depend on when do you receive it, and that in turn on your distance from the source. By the time the signal reaches you it may be several milliseconds old (and thousands of microsenconds and millions of nanoseconds). We are so used to think of TV, whatever as an instantaneous broadcast medium that we forget that there are speed limits in the Universe. And you can't exceed them by just paying a ticket. Note that this was a best case scenario: using the speed of light to transfer the information and using the shortest path. In reality most waves won't travel as fast in the air, and will depend on atmospheric circumstances. >I have a 12-year-old Heathkit "Most Accurate Clock" that I assembled myself, >and had the foresight to install it with its computer interface option. >(receives 5, 10, or 15 MHz signals broadcast from Boulder, Colorado, >containing "exact" time.) > Just remember that the best you can get would be microseconds if you're in a 300 meter radius, or milliseconds on a 300 Km. And possibly nanoseconds at 0.3 m. Even then you need to know exactly (i.e. with an accuracy of between centimeters to a few Km depending on the timing you want) your position. And depending on the media you use, possibly the atmospheric conditions in between the emisor and your receptor. Then remains the cypherpunk part on all this: how can you trust the *signal* your receptor receives? How do you know no one is interferring it or sending an inaccurate or false one? So you need a GPS... And a timing source that can be trusted. You'd wantthe signal not to be tamperable or at least to be able to detect when it has been tampered. And that on a broadcast system. A system owned by someone who you may not trust (say a private TV channel, radio or satellite). So you may want to have several sources, and to be able to verify that the signals you receive all come from their respective sources. Yum! a nice problem to think about. One factor is that you wouldn't expect changes in public sources used by sensible systems since those could not pass unnoticed and might raise big protests. But you still have the MITM attack to consider... Oh well, it's too late now. See ya... jr

1 0

Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards
by mka＠pobox.com 17 Dec '03

17 Dec '03

At 15.07 1996-01-29 -0500, Nathaniel Borenstein wrote: >NEVER TYPE YOUR CREDIT CARD NUMBER INTO A COMPUTER. This problem is greatly exagerated. The software simply won't be running in the average users machine. If the program propagates like a virus, it will soon be catched and killed by the anti-virus utilities that any responsible user is already running on a regular basis. If you have to start the program for it to do its magic, then just don't start it. Todays computer users should know that running software you don't trust is generally a bad idea. That's how you get a virus in the machine in the first place... Come on Nathaniel, admit it, it's a scam to sell FV's expensive services! matts

2 1

Re: Here's how you put your key on the keyservers...
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 07:39 AM 1/29/96 -0500, Ted Garrett wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >I got a message in response to a request I made to someone for their public >key. I wanted to check the signatures that they included with their posts >to cypherpunks, but their key was not on the keyservers. The key they >included was completely unsigned, and when I use it to validate their >previous posts as well as the message they sent which included the key, the >signatures come back as bad, the contents of the file changed. Names are >appropriately withheld (I hope). At this point, I think it would be appropriate to declare that I am the person Ted was communicating with, and the one he is referring to and (correctly, as I recall my own posts) quoting. I am, yes, a real newbie, and I appreciate the indirect lesson in "nettiquette" he is showing by not identifying my private email to him. I'm identifying myself for a number of reasons: 1. I REALLY am a newbie (at least to most of Internet, and common usage of PGP, etc.), and haven't learned much of the ways of Internet. (with a strange, short, early exception, which I will relate in another message if anybody has any interest in Internet history.) 2. I want to solve the problems Ted presumably correctly identified in my signing. (I use freebie Eudora, and WPGP, etc.) I only started signing my posts when I got a copy of WPGP by Gostl, and it made things much easier. 3. I did not want to make it difficult for him to fight off a potential MITM attack while, at the same time, complying with "nettiquette", especially seeing as how my key is not (yet) in any keyserver, which is obviously MY fault, not his! I want him to be able to point (and, repost, with my full permission) any messages allegedly from me that he receives by private email, so that others might check the signature too with their own software. This permission to him applies to any prior messages I've sent him, too, ideally so that anyone else can check the signature status against my sig. Ted may be right; there may be a MITM attack. More likely, it's a case of galloping NEWBIE-ITIS on my own part, sorry. Earlier, when I just began using WPGP to sign Eudora stuff, I was told that my signature didn't match. On the other hand, I was told by others that this is a common flaw of signing messages, having to do with line lengths. When I first started sending messages, I didn't use the "Wrap" selection of Eudora (under the EDIT selection), meaning that my lines were as long as the paragraphs were typed. Most people didn't seem to notice, I guess, because it took somebody a few weeks to eventually complain. After that, I RTFM'd and adopted the practice of WRAPping my paragraphs to limit their length to "reasonable" values. (although I would appreciate somebody explaining to me why this DAMN EUDORA can't seem to correctly re-wrap a paragraph after modification. Hell, Wordstar Version 3.0 for CP/M (shows you how long _I've_ been into computers!) reformatted paragraphs just fine back in 1982 on a 12.5 MHz Z-80 (ask me how I did this and I'll tell you a LONG story!) 3. Ted began to suspect a "MITM attack." While I'm a newbie, I'm well aware this is "man in the middle" and am aware of the potential (dangerous!) implications. Needless to say, I can't even say for certain that such an attack isn't happening. Yes, I am on no keyservers, yet, but I will try my best to follow his kind instructions and accomplish this feat. And yes, I am reminded that I need to sign my OWN public key, which (being a f______ newbie), I haven't even done yet! (This message will contain, however, BOTH my 1024-bit and 2047 bit public keys, unsigned, and I will sign the whole message with my 1024-bit key. I'd sign it with BOTH, but I don't know if WPGP will even do this. I'd sign a second copy with the 2047-bit key, except that would be wasting bandwidth. > As I understand the bcc: definition, only >I and the first smtp server this message hits should know who it's to. I >don't know if anyone else reading this mailing list needs this info, but >just in case... here's my reply to the message. > >At 10:03 PM 1/28/96 -0800, you wrote: >>Sorry, I'm a newbie to Internet, and also the Internet usage of PGP. I just >>participated in a local keysigning meeting, so maybe my key will find its >>way to a server. I wrote that. >Don't worry about being a 'newbie'. Everyone starts somewhere. However, >your key will usually not 'find its way' to a server without you >specifically sending it. Thanks; I sorta assumed that, but until recently my usage of PGP was between me and my friends who knew me by face and voice, and who have my keys from hand-carried floppy disks that I gave them myself. > The keyserver I usually use is accessed by sending >a mail message which fits the following format. As far as I know, all the >keyservers use this format to add or update keys in their databases. You >only have to send it to one keyserver, and it will propagate to all the >others. I have indented the text so that no handlers decide to interpret it >as a new message. Okay, thanks for the details. > >- - To: pgp-public-keys(a)pgp.iastate.edu >- - Subject: ADD >- - >- - -----BEGIN PGP PUBLIC KEY BLOCK----- >- - Version: 2.6.2 >- - >- - [key deleted to protect the innocent] >- - >- - -----END PGP PUBLIC KEY BLOCK----- > >>I'm sorry to have to admit that I don't even know how to do this! Newbie >>alert! Again, I wrote that. >If you don't admit you don't know something, nobody will usually tell you >how to do it. Also, you should sign your own key. That will make it harder >to forge, I think. Okay, up until now I've generally given out my key in messages, and signed the entire message with the key. > The reasons were spelled out in a couple of the web >pages I read, but I've forgotten them. It has something to do with either a >denial of service attack or a man in the middle attack, or both. The >command to do this is: Someday I'm gonna understand this stuff! > >pgp -ks 0xHEXKEYID > >Honestly, I've only just begun to use pgp myself. Also, you should add your >e-mail address to the user-id of your key. The command to do so is: > >pgp -ke 0xHEXKEYID > Again, much appreciated. I hate to RTFM. Lazy bum, I. >You will be asked if you wish to add a user id to the key. Say yes, and >give it your e-mail address. What this does is it allows people who are >using pgp-enabled mailers to directly encrypt messages to you without >choosing your key manually. > >The reason that I have not encrypted this message to you using the key you >provided is that when I extracted the key and re-checked your message, the >signature was no good. I've found that (using eudora) I must turn off the >word wrap feature of my mailer to allow for good signed messages out. Of >course, having said this, I'll probably not get a good signature on this >message. Let me know if it signs ok. I didn't check the signature of his message, admittedly. Guess I need to give him some feedback, huh? >Now, I have a question. Which attack(s) is/are a person vulnerable to when >distributing an unsigned public key in the open? Could this actually be a >complex man-in-the-middle attack? Am I paranoid? Unfortunately, the more I learn about encryption, the more "paranoid" I get! Of course, I have a few more reasons than most, but... [I deleted Ted Garrett's signature. My own will follow my own two public keys.] My 1024-bit key. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAi1zvWcAAAEEAKmSqngLWK2N2gOJKPtjF9VCfSkXY+XUZBRCbbFU71uH/dLX C2Uq6wFS8alRgMc3rp90JnnJ/6eJqXwMjCunogwucWOaU7S/w+OwjOG9fUqsXIA6 2j25Wtjce65mbp0TKLAzwMb/P/Qq7BlclqhuKzfVBH7dIHnVAvqHVDBboB2dAAUR tBFKYW1lcyBEYWx0b24gQmVsbA== =G3LA - -----END PGP PUBLIC KEY BLOCK----- My 2047-bit key. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzDCFH4AAAEH/15sMvnnK1BIvLkxQsKwUHP7dKNFbKrQOtOoyLOFTk4/0Zlr gXkKw6NciDYaOKwW9dsIL3N3rjAlWtioQ/gg+5vMNoJOQXpp95mKBzpWYLeaB8MF Km6H/NGWISx5cz06NOGutWcaezO/S4xm8ay7W8HaZ4EmHQdXtSKIAL41PBQyyuhR wIKX+QwsAgKS1LALr9MuW7nXL6/h139QeNRAR+ubXyftoklFHC+HF+jcTTDuNjmU 4p7BEMp9cmYHh6WEYTZyOz5F8/8gtEbPA0IKsQH1LGdf+2APLqMdciuU8ALZA+ZM bbaBaxshqHbYfCQ8+ATCrBjsU0nO8RKjhSx91vkABRG0DUphbWVzIEQuIEJlbGw= =uncA - -----END PGP PUBLIC KEY BLOCK----- James Dalton Bell. Klaatu Burada Nikto Something is going to happen.... Something... Wonderful! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQ1PZ/qHVDBboB2dAQE+AAP+MP5hM2j1Z3z+7cdZ/U12qH/uu6Dq2NEP LgKJ8Nm0idN7oiBZpYD2zuT22mhsIhCJzzmC3XIBiyX1AP4voDqrIwgLmvPgogcp Cr9p75xi2/UqV1mrYIWeHG4KJc+/x5V4PxeYg5iz0jjnLKN1mzmnjPRDqAOaaBhK 08MMgOkqxFs= =jU9M -----END PGP SIGNATURE-----

1 0

Page one, NY Times, 29 January 1996
by Matt Blaze 17 Dec '03

17 Dec '03

One of those microscopic bottom-of-page-one ads from John Young: "BOYCOTT ESPIONAGE-ENABLED SOFTWARE", with phone number and email address to contact for more information. I'd be curious as to what the response has been like. -matt

2 1