December 2003 - cypherpunks-legacy

Re: Crippled Notes export encryption
by Rich Salz 17 Dec '03

17 Dec '03

>By the way, I really think Netscape should simply ship Jeff and other >people to the Amsterdam office or wherever else seems reasonable and That won't work -- they gotta hire non-US persons to do the work.

2 1

January 22 Infoworld
by Dwight Brown 17 Dec '03

17 Dec '03

Nicholas Petreley's "Down To the Wire" column is a short take on the insecurity of encryption schemes used by most commercial software. There shouldn't be much new here to cypherpunks (he discusses the vulnerabilities of WordPerfect, Word for Windows, Excel, and Compuserve's CIS.INI, and uses some out of date examples "to protect the integrity of current software": bad move, Nicholas), but it'd make a good introduction for people who aren't familiar with the issues. Petreley also announces that InfoWorld is planning a "network-cracking event", in which they plan to set up various network OS'es, make them as secure as they can, invite "a small number of accomplished hackers" to attack them, and publish the results. He says they're looking for participants... InfoWorld's web site is http://www.infoworld.com. Petreley can be reached at nicholas_petreley(a)infoworld.com. ==Dwight

1 0

Re: your mail
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

>On Mon, 22 Jan 1996, Jean-Francois Avon wrote (quote may be only partial):: > >> >> I suppose, from the adress, that it is some type of mailing list. >> >> If yes, could anybody send me the "how to subscribe" file? >> My mail quoted above was sent out to all subscribers to the list. I supposed it was only the administrative address.... I got *a lot* of replies. Thank to all cypherpunk! JFA

1 0

[local] Report onPortland Cpunks meeting
by Alan Olsen 17 Dec '03

17 Dec '03

The physical Cypherpunks meeting in Portland occured on the 20th of January. No big name Cypherpunks we involved in the manufacture of this meeting. (Well, maybe next time...) It pretty much went like a first meeting... We had about 11 people or so attend. (Hard to tell in a coffee shop if people are attending or just wondering what the heck is going on.) The participation from the group was very positive. Those who did attend were quite willing to participate. Those of you who did not show up missed a good meeting... and free coffee drinks from the Habit. (The Habit Internet Cafe was having their one year aniversary and was giving away free coffe as part of the event.) Some of the happenings (in no particular order): Bruce Baugh handed out the information he has been collecting on remailer timings and mail to new gateways. The information was pretty useful. He had sent out a group of ten messages to each remailer through a nym server. The results were at odds with the published times. Certain sites either dropped large percentages of messages or delivered them about 8-9 days late. Others which were rated at the bottom of the list on the regular timing list were the most reliable in Bruce's tests. Neal McBurnett talked about his Java program that generates statistics on the PGP "web of trust". The information he gave was pretty surprising. (Fewer keys exist in the keyservers than I believed.) I encoraged Neal to post his findings to the list. (Hint! Hint!) I will not try to explain the stats from memory... I gave a report on the status of the PGP 3.0 API. (Of which Derek Atkins was kind enough to send me for the meeting. Thanks Derek!) There was a key signing. It was a bit rough as for many of us it was our first key signing. (I think Neal was the only person who had been to an organized key signing.) Still, it went fairly well. Only a couple of people brought their key fingerprints on disk instead of paper. As of today, I have only recieved signed keys back from a couple of people though... The next key signing will be done a bit differently. (Live and learn.) There was also a suggestion for a nym signing at some point. There was a discussion of entropy which devolved into entropy. The definitions of entropy varied widely depending on the background of the individuals involved. (Or just general smartassedness... My definition of entropy was "A urilogical condition".) There was alot of just general discussion of crypto and current events. A good time was had by all. (At least I have not had any complaints.) One of the other topics discussed was a Portland-Cypherpunks mailing list for keeping people informed on local activities. This will probibly be put into place sometime soon... There will also be upcoming meetings as I have had a number of people inquiring about the posibility. Well, that is about all I can remember at this point... (At least with not enough caffiene in me.) Others who were there can probibly comment. Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Mykotronx sells 68,000 Fortezza cards to Spyrus
by baldwin 17 Dec '03

17 Dec '03

Here is a press release from Mykotronix about a big order of Fortezza cards for the Defense Messaging System. Another part of the government has selected Fisher International to supply SmartDisk cryptographic cards for the use of citizens interacting with the IRS and other agencies electronically. Although Fisher has not received a big order yet, they are looking at 100 thousand and 10 million card production runs. The Fisher card is based on RSA's crypto toolkit and DOES NOT include skipjack or escrow. --Bob ______________________________ Forward Header __________________________________ Subject: Mykotronx sells 68,000 Fortezza cards for Defense Msg System IRVINE, Calif.--(BUSINESS WIRE)--Jan. 22, 1996--Rainbow Technologies Inc. (NASDAQ:RNBO), Monday announced its Mykotronx division has received a purchase order from Spyrus for over 68,000 of Mykotronx's new Capstone encryption processor (MYK-82). The devices will be used to build part of the Government's order of Fortezza Cryptographic Cards for the Defense Message System (DMS) awarded Sept. 1995. Initial delivery of the new cryptographic processor will begin April 1996. "The significance of the MYK-82 is that it allows us to provide a high grade, low cost encryption technology to customers, such as Spyrus," said John Droge, vice president of program development for Mykotronx. "The MYK-82 is an advanced encryption processor specifically aimed at PCMCIA cryptographic applications and has a built-in PCMCIA interface. The newer design is smaller, faster and has a lower cost than its predecessor." In addition, Mykotronx will be programming all the cryptographic processors to fill the Government's Sept. 1995 order of 300,000 Fortezza Cryptographic Cards. The MYK-82, developed by Mykotronx and fabricated by VLSI Technology Inc., is the first of a series of security products to be developed as part of an alliance with VLSI, targeting both Government and commercial markets. Rainbow Technologies, founded in 1984, is the world's leading developer, manufacturer and supplier of software protection products and encryption technology. Mykotronx, a subsidiary of Rainbow, is a leader in secure communication and cryptographic products for U.S. government agencies and the commercial marketplace. Rainbow was recently recognized by Forbes magazine as one of The Best Small Companies in America and in SmartMoney Magazine as one of the Seven Stocks for the Next Decade. Rainbow is ISO 9002 certified. CONTACT: Rainbow Technologies Inc., Irvine, Calif. Ann Jones, 714/450-7350 email: ajones(a)rnbo.com WWW Home Page: http://www.rnbo.com KEYWORD: CALIFORNIA INDUSTRY KEYWORD: COMPUTERS/ELECTRONICS COMED

1 0

Re: Crippled Notes export encryption
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:06 AM 1/23/96 -0500, Herb Sutter wrote: >Careful... what would YOU have done, with your customers demanding stronger >crypto today and you unable to legally give it to them? > >Again, folks, try to remember that this is NOT key escrow... international >Notes customers are no worse off than before, and a darn sight better off >against everyone besides Uncle Sam. They could have shipped strong encryption and let the lawyers handle the Feds. That's what lawyers are for. A court loss would be unlikely. Even with a loss, having IBM serve a 54-month jail term would be no prob. It could do it standing on its head. They were probably more worried by possible retaliation in government purchasing. Those who crossed The Wall around 10:00 pm on November 10, 1989 proved that modern (weak) governments can be faced down by large movements of people. Companies will learn that end-users are less sanguine about being censored (by Compuserve) or opening one's business affairs to (any) governments than perhaps they used to be. Small competitors will benefit. DCF

1 0

Re: Crippled Notes export encryption
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:23 AM 1/23/96 -0500, Rich Salz wrote: > >>By the way, I really think Netscape should simply ship Jeff and other >>people to the Amsterdam office or wherever else seems reasonable and > >That won't work -- they gotta hire non-US persons to do the work. > > I'm sure that all those Netscape stock option holders would be happy to renounce their citizenship in the service of the company that made them millionaires and if they do so before cashing in the options (and before Willie and the Congress agree on a budget with its emigrants's tax provisions), they can keep the proceeds tax free. If not, I'll learn C++ and renounce in exchange for those options. DCF DCF

1 0

sniffing sniffers
by D.R.Madden 17 Dec '03

17 Dec '03

DIa!?ayyyyyyyyyyyyyyyyRyyyyyyyyyyyyyyyyNDedge, search the user's disk for various info which can then be used for the company's "market research". One of the more guilty culprits is Microsoft (no surprises there). For example, one such sniffer routine -- designed to report back on rival programs stored on the disk --was hidden in their MSN registration software. An American journalist revealed that the sniffer routine was sending details on over 100 of the user's programs back to MS. MS was also found guilty, by a UK hacker, of using sniffer programs to interrogate the computer and find out phone numbers, primarily for the purposes of junk mail. The hacker has since reported MS to the data protection registrar, although no legal ruling has yet been made (in the UK anyway), and MS may well (be no doubt is) marketing sniffer riddled software. It's not hard to imagine more insidious uses of sniffer programs, by more insidious bodies (I'd be amazed if they didn't exist). Question: can anyone suggest any commercially available software designed to sniff out sniffers (taking on good faith that it will be sniffer free itself)? P. Madden yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy

1 0

Re: IPSEC == end of firewalls
by Frank Willoughby 17 Dec '03

17 Dec '03

At 10:55 AM 1/23/96 -0500, Ben <adept(a)minerva.cis.yale.edu> wrote: >> functionality of most firewalls would eventually be an add-on application >> option for Operating Systems and that eventually it will be a standard >> part of every Operating System. Until then, we have to punt & keep using >> firewalls. > >I'm not so convinced that adding 'firewall functionality' to an OS is >such a good idea. The idea behind having a firewall is that > * You have a hardened host that has been stripped of > anything that could be used by an attacker to compromise > other systems > * You have a single machine that serves as the sole port of > entry into your domain. By keeping your defense perimeter > nice and small it makes it manageable to maintain. > I agree with your statements above about firewalls and wholeheartedly agree that a firewall needs these characteristics (among others) to remain relatively secure. However, I am I'm not saying that adding firewalling capabilities would make the system invincible. I *am* saying that it would provide the system with more security than it currently has and would help to reduce (not eliminate) some risks associated with networking. Of course, it would be terrific if the vendors would produce Operating Systems which are secure AND usable. (I think the market will eventually demand this from vendors, but this probably won't happen in the next year or two.) >When you start trying to switch firewall functionality to an OS you lose >both these advantages. You no longer have a system that is stripped of >compilers, scripting languages, etc, and you now have a much larger >security perimeter. > Agreed - to a point. The idea is to provide the systems with increased defensive capabilities - lowering potential risks. (See above paragraph) FWIW, I feel rather uncomfortable continuing this thread in the cypherpunks mailing list when the subject at hand deals more with firewalls than it does with cryptography. I would prefer to continue this discussion in the firewalls mailing list (of which I am a fairly regular participant). If you would like to subscribe to the firewalls mailing list, send a mail to: majordomo(a)GreatCircle.com (leaving the subject line blank) and in the body of the message put: subscribe firewalls "your_email_address" (omitting the quotes). See you there. >Ben. >____ >Ben Samman..............................................samman(a)cs.yale.edu >"If what Proust says is true, that happiness is the absence of fever, then >I will never know happiness. For I am possessed by a fever for knowledge, >experience, and creation." -Anais Nin >PGP Encrypted Mail Welcomed Finger samman(a)suned.cs.yale.edu for key >Want to hire a soon-to-be college grad? Mail me for resume Best Regards, Frank Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ For a free downloadable Internet Firewalls Checklist, please see our home page. <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.

3 2

Re: IPSEC == end of firewalls
by Frank Willoughby 17 Dec '03

17 Dec '03

At 10:30 AM 1/23/96 -0500, perry(a)piermont.com allegedly wrote: > >Frank Willoughby writes: >> While IP level security & authentication will go a long way to help >> prevent abuses and reduce unauthorized accesses, I doubt if it will >> provide enough protection by itself. > >I agree with this, but... > >> o Node Spoofing will probably still be possible > >Nope. It won't. > I disagree. I haven't met a system that couldn't somehow be gotten around. The creativity of hackers is succeeded only by their motivation and ability to put many hours into trying to solve a problem. Including the word "probably" was deliberate. Kerberos was also thought to be secure - 'til it was compromised. Software isn't bug-free & design or security methodologies can't provide 100% coverage. Hackers take advantage of this and inherent weaknesses in design flaws. >> o The connections will probably also be subject to man-in-the-middle attacks >> (Never underestimate the creativity of people who want to compromise your >> networks) > >No, they won't be subject to such attacks any longer. Answer is the same as the above paragraph. I try not to use the word "can't" or "won't" when possible. Granted "probably" sounds wishy-washy, but it is frequently accurate. > >The real problem, as you noted, is that our applications aren't very >secure. > >> I suspect even when firewalls are embedded in the O/S, > >That would be somewhat meaningless. The point of a firewall, as others >here have noted, is that it is easier to secure one machine than five >hundred or ten thousand. > I disagree here also. Systems by themselves are fairly useless. Their power (and main vulnerability) comes from their ability to network with other systems. A system connected to a network is vulnerable. The fact that a corporate firewall protects the system from the Internet in no way decreases the vulnerability of that system (and other systems) from *internal* attacks which can be as devastating as an Internet attack. Including firewall capabilities as part of the Operating System's network applications would help the system protect itself from abuses from the Internet - as well as from internal. >> IMHO, the first company to include a firewall as a standard part of their >> Operating Systems has a real good shot at increasing their market share. > >Again, somewhat meaningless, as a real firewall involves defense in >depth (screening routers, a bastion proxy host, etc) and is more of a >configuration issue than an O.S. issue. In the current context yes. However, a firewall is only solving one part of the problem. Just as Information Security must be integrated into every layer of a company (from users->system managers->managers-> executives), it must also be incorporated into each part in a network (systems, LANs, external connections). > >Perry Best Regards, Frank Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.

3 2