December 2003 - cypherpunks-legacy

WinSock Remailer
by Joey Grasty 17 Dec '03

17 Dec '03

C-punks: You can now check out the features of the WinSock Remailer at: http://www.c2.org/~winsock/ The remailer is now scheduled to be operational about March 21, 1996. After a one month alpha test, the executable will be available for download for beta testing by anyone who wants to run a remailer. Regards, -- Joey Grasty jgrasty(a)gate.net [home -- encryption, privacy, RKBA and other hopeless causes] jgrasty(a)pts.mot.com [work -- designing pagers] "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin." -- John Von Neumann PGP = A7 CC 31 E4 7E A3 36 13 93 F4 C9 06 89 51 F5 A7

1 0

Re: DNS-related problem, and, motherhood 'n apple pie, etc
by mrm＠netcom.com 17 Dec '03

17 Dec '03

I hope people evaluate Java (and all software) based on technical issues, and not based on whether or not you think I'm clueless, brain damanged or a liar. We take the DNS-related problem very seriously; we do understand how DNS works (I did say "apologies for the oversimplifiation"); we never have put our heads in the sand. I do think it's a bit unfair to the Java team to say we put our heads in the sand, since we are deliberately trying to be as open and honest and forthcoming as we can. I mean, we are publishing full source code, which I'm not sure is the case for lots of software that people place a lot of trust in, implicitly or explicitly. As I've said every time I've said anything, every time security awareness on the net is raised, I think it's good for the net. I personally don't regard the internet as secure, and any information I care about I have encrypted on disk. Any information I really, really care about I don't even have on the internet. I do regular backups. I'm not saying this is what everyone has to do. But it's not that hard or time-consuming, and it wouldn't hurt. But people who are in charge of corporate security for their company, or people who have very sensitive or very valuable information on their disks, should consider the many ways that the internt is insecure, not just how some applet could be exploited. Having said that, does that imply that I think it's OK for a Java application to have security holes? Of course not! I hope we can use Java-the-language to build more secure systems than we've gotten used to surviving in the past. Does that mean I'm downplaying the importance or seriousness of any applet-related hole? Of course not! I think it's possible simultaneously to understand the seriousness of a security hole, AND still to say it's a good idea for people to practice safe internet. Marianne Mueller I work for Sun, on the Java team. mrm(a)netcom.com mrm(a)eng.sun.com http://java.sun.com/people/mrm/

1 0

RE: REM_ote
by Robichaux, Paul E 17 Dec '03

17 Dec '03

Alex Strasheim said: >(A useful feature for Netscape might be a facility that checks >periodically to see if a security patch is in order, and displays a >warning if it is.) The Simple Internet Version Control (SIVC, pronounced "civic") protocol does just this. See http://wwwhost.ots.utexas.edu/sivc/spec.html for details. SIVC is popular on the Mac, but I don't know if it's been put up as an RFC. -Paul

1 0

Hack attempt? "12 days" from anon.com
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

Regarding the mysterious mail from mailer-daemon(a)anon.com that many people have received: 1. The mail was apparently sent by a daemon bouncing an undeliverable mail. anon.com is a "virtual domain" hosted at io.com, so it's unlikely that the daemon would have an anon.com address. 2. Headers show it was routed through 38.10.221.81 and smtp1.interramp.com. That IP address showed up as ip81.la.ca.interramp.com the first time I tried a traceroute. The second time it showed up as ip81.syracuse.ny.interramp.com. In any case, traceroute went recursive between los-angeles.ca.isdn.psi.net (38.145.221.110) and lan.losangeles.ca.psi.net (38.145.221.1). This indicates the target could not be reached - perhaps it's a PPP address, or disconnected. 3. There is an X-Sender: (Unverified) header entry. So the mail was SMTP faked without the HELO protocol. 4. The error purpoting to originate from mailer-daemon(a)anon.com says the mail was addressed to PeppermintPty(a)loacst.org. loacst.org is not a registered domain. 5. PeppermintPty is obviously Peppermint Patty; the "original message" is signed Marcie. Peanut fans will recognise these characters. So - what was it all about? An elaborate prank? A convoluted NSA plot? I would lean towards the first, but perhaps we'll know on March 1st, the date to "gain access to target". Rishab ps. the copy I received follows: >From mailer-daemon(a)anon.com Fri Feb 23 20:08:00 1996 Received: from m-net148.arbornet.org (m-net.arbornet.org [148.59.250.2]) by shellx.best.com (8.6.12/8.6.5) with SMTP id UAA20969 for <rishab(a)best.com>; Fri, 23 Feb 1996 20:07:44 -0800 Received: from smtp1.interramp.com by m-net148.arbornet.org with smtp (Smail3.1.29.1 #4) id m0tqBGv-0009SHC; Fri, 23 Feb 96 23:07 WET Received: from [38.10.221.81] by smtp1.interramp.com (8.6.12/SMI-4.1.3-PSI-irsmtp) id XAA24970; Fri, 23 Feb 1996 23:06:42 -0500 X-Sender: (Unverified) Message-Id: <v01520db9ad53979e9858(a)[38.10.221.81]> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Fri, 23 Feb 1996 08:11:33 -0800 To: (Recipient list suppressed) From: mailer-daemon(a)anon.com (System Mail Manager) Subject: Twelve Days of Christmas Status: RO -- <System Report> -- UNDELIVERABLE MAIL: Unknown Host("PeppermintPty(a)loacst.org") UNDELIVERABLE MAIL: Bad Key -- <Original Message Follows> -- *** TOP LEVEL: DESTROY IMMEDIATELY UPON READING *** *** DO NOT PRINT OR SAVE. Code1.8 Table2Hex6 *** DAY 10: DR. BLACK located a promising entry point at the target site. DR. BLACK recovered four of the six password tokens before his position was compromised. DR. BLACK will be replaced by DR. ORANGE. Estimated time to recover the remaining two password tokens and gain access to target: EIGHT DAYS (03.01.96) Confidence is HIGH. My team has been working around the clock for a month now. Please tell your people to be more tolerant. Yelling doesn't help anything. Marcie

2 1

PGP
by Chris Grantham 17 Dec '03

17 Dec '03

R U aware of a PGP mailing list? Chris P.S. How do I attach a sig to a Microsoft Exchange message? FOR BEST SECURITY -STEAM ALL PGP MESSAGES! -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzEvXtUAAAEEALtwrsq7zqQdTDRRpgJeCXYCuA6M49Yp93IE3ScaMwPPi297 EIEbpSyv3ZB9UBjTNHcsPADhfwDs8/yBS4SWW+NF1BwnRLUbNpZ5E6BGxGojQnF4 yC5MKNIuxDgY8FYYpsXWpxWIOJZOf5LY6E4BhZ9fGK/MfuhSvUFD9HN4zM2hAAUR tC1DaHJpcyBXLiBHcmFudGhhbSA8Y2FzcGVyQG9wdGltYS5tbWUud3N1LmVkdT4= =xznQ -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Encryption Chips
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:52 AM 2/25/96 -0800, Timothy C. May wrote: >At 4:47 PM 2/25/96, "A. Padgett Peterson P.E. Information Security" > >>The nice thing about am implimentation in software is that the code can be >>examined for just this sort of thing *on a randomly selected operating unit*. >>- hard to do with a chip. > >But of course one's compiler may have been subverted, as Ken Thompson >showed some years back. Software implementations are sensitive to different >sorts of attacks than hardware implementations are. These things do not need to be verified at the source level. One could verify the output of the compiler and then publish a secure hash of it. (What an tedious job.) There is infinite regress in these things, but I would tend to trust a program which verified the secure hash of the crypto system if that program was written after I received the release of the compiler I am compiling it with. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: Cypherpunks vs. Coderpunks
by Chris Claborne 17 Dec '03

17 Dec '03

At 09:49 PM 2/24/96 GMT, attila wrote: >** Reply to note from Perry E. Metzger <perry(a)piermont.com> 02/13/96 1:29pm -0500 > > [snip] >= The thing that makes Cypherpunks worthwhile is that its a place where >= you could, once, get news updates about GAK, information on the latest >= research into cryptography, organize mass key crackings, discuss APIs, >= talk a bit about the politics of cryptography, etc. >= > sounds like we're having the sme problems as "democracy" --it soon becomes >irrelevant! example: > > I was out of town for 6 days: I returned to find 1056 messages in the sorted > mailbox! yes: 1056 messages which it took close to an hour to delete almost 800 > of them as irrelevant. some you can discard automatically depending on the > author, some by content, etc. but I agree: it is clutter. I spend most of my time here as a lurker but I must chime in now. :) I filter to an unread area and then try to read once per week. I know that I trim off good articles while trying to trim the fat off. If you can't exercise restraint, how about putting "junk" as the first word in your subject. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = 7E BF 38 3F 24 A7 D1 B0 54 44 96 AA 10 D0 5D 51 Avail on Pub Key server. PGP-encrypted e-mail welcome! Dreams. They are just a "screen saver" for the brain.

2 1

mismaster
by Black Unicorn 17 Dec '03

17 Dec '03

Where is the latest version of mixmaster available? I can't seem to get hold of obscura for lance's homepage and * http://nately.ucsd.edu/~loki/ * ftp://nately.ucsd.edu/pub/remail/ seem to be down. Any ideas? --- My prefered and soon to be permanent e-mail address: unicorn(a)schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information

4 3

Re: Cypherpunks vs. Coderpunks
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:41 PM 2/25/96, Chris Claborne wrote: > I filter to an unread area and then try to read once per week. I know >that I trim off good articles while trying to trim the fat off. If you >can't exercise restraint, how about putting "junk" as the first word in your >subject. Ah, but where was the "junk" as the first word of your post? You see, therein lies the reason these labelling schemes almost never work. Few people think there own stuff is "junk," else presumably they wouldn't post it. You can bet your bottom e-dollar that Jim Bell won't label his posts about assassination politics or nuclear bomb high explosive triggers as "junk." Nor that I will label my own stuff as "junk." About like asking people to label themselves as "turkeys" just so we can deal with crowds better. Frankly, I think we waste more time arguing about how to improve the "signal to noise ratio," ephemeral a concept at this is, than it takes to simply delete posts each of us various dislikes. The notion that we can "nudge" other people into only posting the kinds of articles we all want to see is flawed: there is no single type of good article, and one man's "junk" is another man's "gold." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RE: PGP
by Chris Grantham 17 Dec '03

17 Dec '03

Sorry, that wasn't suppose to be sent there too. Chris ---------- From: Chris Grantham[SMTP:casper@optima.mme.wsu.edu] Sent: Sunday, February 25, 1996 1:38 PM To: 'Thaddeus J. Beier' Cc: 'Cypherpunks' Subject: PGP R U aware of a PGP mailing list? Chris P.S. How do I attach a sig to a Microsoft Exchange message? FOR BEST SECURITY -STEAM ALL PGP MESSAGES! -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzEvXtUAAAEEALtwrsq7zqQdTDRRpgJeCXYCuA6M49Yp93IE3ScaMwPPi297 EIEbpSyv3ZB9UBjTNHcsPADhfwDs8/yBS4SWW+NF1BwnRLUbNpZ5E6BGxGojQnF4 yC5MKNIuxDgY8FYYpsXWpxWIOJZOf5LY6E4BhZ9fGK/MfuhSvUFD9HN4zM2hAAUR tC1DaHJpcyBXLiBHcmFudGhhbSA8Y2FzcGVyQG9wdGltYS5tbWUud3N1LmVkdT4= =xznQ -----END PGP PUBLIC KEY BLOCK-----

1 0