December 2003 - cypherpunks-legacy

PGP Shell Integrity
by Michael E. Carboy 17 Dec '03

17 Dec '03

Greetings All, Firstly, if this is viewed as "Noise" rather than "Signal", please accept my apologies. The matter at hand concerns my concern over my inability to check the "integrity" of a PGP windoze shell written by Michael R. Lyman at Aegis Research Corp. I worry that since the shell has access to my secret ring that it might be sending it somewhere without my knowledge. The freeware was, according to Mr.Lyman, developed "Project Manager, Forward Air Missile Defense, United States Army Missile Command". That gvt. affiliation gives me considerable pause as regards back doors and other ways my secret ring and pass phrase could be compromised. Does anyone have any familiarity with this freeware? I do not think I am being paranoid.. just careful. Lastly, if I am not a programmer, what sort of inspection can I perform on the software to make sure it is not "bugged"? Thanks for your thoughts.... and sorry to have disturbed those who see this post as noise Kind regards, Michael E. Carboy carboy(a)hooked.net finger for PGP pub key

1 0

Re: [rant] A thought on filters and the V-Chip
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 10:26 1/29/96, Duncan Frissell wrote: >What parents are attempting to do when they restrain their children's access >to "sex and drugs and rock and roll" (or Republicanism for that matter) is >to mediate their "spiritual" environment to keep them from becoming >hardened. They know the kids will grow up, they just want them to grow up >in a nice way. Another way of looking at it is that the parents want to raise their kids to be mindless types who do not force their parents to actually question their own mindsets. If they can program their kids into brainwashed clones of themselves, there is no need to think about other belief systems. >Note that in spite of what liberals might think, fundamentalist Christians >are less likely to divorce, probably due to the fact that divorce is a null-concept when applied to fundamentalist Christians (ie: It is not something that they "can do" under their mindset). >less likely to report spousal beatings, Is this "less likely to report spousal beatings" or "less likely to HAVE spousal beatings TO REPORT"? - If the former than again it is due to having a mindset that says that it is ok to beat your spouse (or be beaten by him/her) while if it is the later then that is a positive aspect of their mindset/belief-system. >less likely to kill themselves, Again mindset - if you follow the rules and be a good boy/girl you will be rewarded after your death. Killing yourself is a "bad" thing and against the rules thus is not something you do if you want your reward after a "natural" death. >and more likely to measure high personal satisfaction levels on standard >psychological tests than are, say, readers of The Nation. How culturally neutral are these tests and what are they supposed to be measuring. Also are they designed to produce/force a designated result (it is easy to generate a desired result or prevent an undesired result by designing the questions to get specific types of answers). Note: I am not questioning your claim but only asking if the claim has any relevance to the real world as opposed to the world as you want it to be portrayed by the test results.

1 0

Fooling people with Java applets
by br＠scndprsn.Eng.Sun.COM 17 Dec '03

17 Dec '03

|Hmm. Actually, what do Java dialog prompts look like? Is there any |indication that they come from Java, or can they be made to look like any |dialog from any program, or the OS itself? I suppose this is |implementation-dependent. | |One "neat" trick would be an applet that sleeps for several minutes and |then suddenly pops up asking for your system password, or something. |A heck of a lot of people fell for something much more primitive at AOL. All graphical UI elements spawed by an applet, which are the only ones that can get user events, are clearly marked as "untrusted applet window"s. So unless you type your password in a pop-up marked "untrusted applet window", you should be fine. And if you do, you arguably deserve whatever happens to you.... -- Benjamin Renaud Java Products Group

1 0

Re: Lotus Notes
by frantz＠netcom.com 17 Dec '03

17 Dec '03

One other small advantage I can see to using Lotus's crippled encryption. It disguises the fact that a message is actually (double) encrypted with PGP. Attackers have to break the 40 bits before they see the PGP encrypted data. A pecular kind of steganography. (If you leave off the PGP header and trailer, it may be hard to determine which 40 bits are the correct key.) ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

2 1

Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit
by Rich Salz 17 Dec '03

17 Dec '03

>There are many ways to spread it besides a virus. Zillions of 'em. And There are zillions (what, more than one thousand?) ways to get someone to run a random piece of software that will capture their keystrokes? I don't believe you. Name six. /r$

13 19

Re: FL Demonstrates Fatal Flaw in Logins
by joseph＠genome.wi.mit.edu 17 Dec '03

17 Dec '03

Sorry to all, but I'm not seeing what would appear to be obvious. There seems to be a lot of talk about FV "new program" that undermines security of computer login/credit cards over the net and such like that. I don't know about you guys, but I wrote stuff like that in sixth grade on the old apple IIe. It's pretty simple to write a programs that attaches itself to the keyboard driver and logs the text types, or only logs certain parts, what is the large deal? As it applies to internet security, I don't see how it can make a difference. It must be run from the local computer, at system level. If I'm on my home computer, I know what's running, and feel safe that a loging program isn't amung them. What would enable a remote site to pick up my typings. However, I don't know much about Java, would it be possible to make such an applet with Java? --Joseph -------------------------------------------------------------------------------- Joseph Sokol-Margolis joseph(a)genome.wi.mit.edu Assistant Systems Administrator seph(a)mit.edu Whitehead Institute/MIT Center for Genome Research phone: (617) 252-1922 One Kendall Sq. Bldg. 300 fax: (617) 252-1902 Cambridge, MA 02139-1561 ----------------------http://www-genome.wi.mit.edu/~joseph/----------------- ----

2 1

Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards
by Weld Pond 17 Dec '03

17 Dec '03

Nathaniel Borenstein <nsb(a)nsb.fv.com> writes: >The attack we've outlined -- and partially demonstrated -- is based on >the combination of several known flaws: > > -- It's easy to put malicious software on consumer machines > -- It's easy to monitor keystrokes > -- It's trivial to detect credit card numbers in larger data streams > -- It's easy to disseminate small amounts of information tracelessly But take away the inputting of the credit card number via keystroke and the flaw disappears. How would your program deal with a scheme like this? Programs needing secure entry create a "secure entry field" which is really just an imagemap with the digits (and alphas if required) placed randomly about. The user then uses the mouse to click on these numerals. Ideally the graphics that represent the numerals would be drawn from a random pool and are misformed to thwart any OCR attempts. The graphics could be made even more difficult to OCR by mixing in words and pictures to represent the numbers. An even better solution may be to have the imagemap generated by the server and just the mouse clicks sent back to be decoded on the server. That is how server side imagemaps work now over the web. It shouldn't be hard to take credit card numbers this way. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/ L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio L0pht Open House 2/3/96 at 8:00pm - Live on irc #l0pht - write root(a)l0pht.com for details.

3 2

More FUD from the Luddites at FV
by cman＠communities.com 17 Dec '03

17 Dec '03

Once again, FV has decided that it is easier to spread Fear, Uncertainty and Doubt than innovate. This is part of a continuing pattern that has been extensively documented in previous threads on this mailing list. There are a great many problems with the claims that FV are making with respect to their souped-up keyboard sniffer; here is the one I consider to be the clincher: If I can place any program of my design on a user's machine to sniff credit cards, I can easily exert total control over all of the e-mail sent or received from that machine. Since I can do this, it is now trivially easy to circumvent the "security" of FV e-mail confirmations. Furthermore, to do this, all I really need is control over the network traffic to that user's machine, which in many instances is going to be easier than placing a program on someone's machine. I can then set up dummy companies that my "virus" or whatever will buy "information" from -- some of these might get detected when user's get their bills, but this hypothetical program might chose amounts that would disappear into the noise of actual, legitimate purchases. Therefore, the real moral of the story is: DON'T PUT UNTRUSTWORTHY PROGRAMS ON YOUR HARD DISK --doug P.S. a good video camera in the right spot, or a telephone tap of a major mail-order distributor could probably get you more credit cards, faster, than the FV approach. Credit cards are fundamentally insecure; typing your CC# into your computer is no more dangerous than giving it to the minimum-wage clerk at Denny's. This insecurity is factored into the business model of the credit card companies -- end users do not pay one dime for erroneous or fradulent charges that lack a signature along with a card swipe or imprint. ------ ------ Douglas Barnes "The tighter you close your fist, Governor Tarkin, cman(a)communities.com the more systems will slip through your fingers." cman(a)best.com --Princess Leia

1 0

Re: Opinion piece in NYT; responses needed
by Deranged Mutant 17 Dec '03

17 Dec '03

> Mutatis> It's a decentered network (or set of networks) designed > Mutatis> to get information to its addressee. Data flows through [..] > This is unfortunately a wide-spread myth. While it's true for mail and > news, it's not for IP packets. Witness: Duh. You're right. My glitch. --- "Mutant" Rob <wlkngowl(a)unix.asb.com> Send a blank message with the subject "send pgp-key" (not in quotes) for a copy of my PGP key.

1 0

Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Mon, 29 Jan 1996 15:07:46 -0500 (EST), Nathaniel Borenstein wrote: >[My apologies in advance if you see several copies of this message. I >am posting this fairly widely due to the severity and importance of the >problem described.] >As you may already have heard via the popular press, First Virtual >Holdings has developed and demonstrated a program which completely >undermines the security of every known credit-card encryption mechanism >for Internet commerce. This is a very serious matter, and we want to >make sure that the Internet community is properly informed about the [..] All that over keyboard grabbers??? *yawn* This is nothing new at all.

1 0