December 2003 - cypherpunks-legacy

PGP integrated into Z-Mail
by daw＠orodruin.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

NCD/Z-Mail announces that they've integrated PGP support into their popular email client. This is good news, folks. A chicken in every pot, and PGP on every desktop! ObDisclaimer: I've not tried their PGP interface; I'm not associated with Z-Mail; I know no history; I always misquote everyone. -- Press Contacts: Mike Harrigan Richard Burger/Shari Dupart NCD Software Corporation Miller/Shandwick Technologies (415) 919-2886 415/962-9550 mikeh(a)ncd.com rburger(a)millerwest.com sdupart(a)millerwest.com FOR IMMEDIATE RELEASE NCD Software Unveils New Integrated Security Solution for Z-Mail for Windows, Optimizing Internet Mail Protection New ViaCrypt PGP Solution, Customized for Z-Mail, Brings Users Special Encryption, Decryption and Digital Signature Capabilities E-MAIL WORLD, San Jose, Calif., February 20, 1996 - NCD Software Corporation today unveiled a new optional security feature for its Z-Mail for Windows electronic messaging client, offering users the best integrated point-to-point security now available for Internet e-mail. ViaCrypt, a division of Lemcom Systems, Inc., worked with NCD Software to develop and customize the integration of Z-Mail for Windows and ViaCrypt(TM) PGP(TM) software. With just a few clicks of the mouse, Z-Mail customers using ViaCrypt PGP can now encrypt the e-mail message bodies and arbitrary data file attachments they send, as well as apply digital signatures. Receivers can use ViaCrypt PGP to decrypt the messages and files and to verify the signatures. NCD Software unveiled the new person-to-person security feature today at E-Mail World, Booth 434, in San Jose, CA. Z-Mail is NCD Software's award-winning cross-platform e-mail software. Based on Internet-standard protocols that include POP, SMTP and MIME, Z-Mail has been acclaimed for its ease of use and highly integrated features, including a powerful scripting language, Z-Script, for enhanced customization capabilities. ViaCrypt PGP allows Z-Mail users to create, send and read secure messages by simple menu selection. The integration of ViaCrypt PGP into Z-Mail was achieved through Z-Mail's exclusive scripting capabilities and a front-end built specifically for by ViaCrypt. Message bodies as well as arbitrary file attachments are secured through public-key cryptography: only the person with the corresponding private key can unlock the encrypted file. Digital signatures, another valuable security application provided by ViaCrypt PGP, allow users to verify that the message they received was sent by a specific person and that the message was not altered. "Security has become our customers' primary consideration when it comes to Internet mail," said Mike Harrigan, vice president of marketing at NCD Software. "The integrated solution of Z-Mail and ViaCrypt PGP reflects our commitment to provide our corporate customers with an easy, secure e-mail system." Dave Barnhart, product manager at ViaCrypt, commented, "Combined with the new ViaCrypt PGP encryption and decryption features, Z-Mail now gives users a simple point-and click solution for assuring security when conducting critical business transactions via the Internet." Z-Mail for Windows is available from NCD Software, and is priced at $165 for single users and $95 per user for 200-user licenses. ViaCrypt PGP, which includes the front end that integrates it with Z-Mail for Windows, is priced at $169.00 for single users and $50 per user for 200 to 499 user licenses. It is available now from ViaCrypt and will be available from NCD in March. A full review of Z-Mail for Windows and other Z-Mail products is available over NCD Software's site on the World Wide Web at http://www.ncd.com/Z-Code/zcode.html, or via e-mail at info(a)z-code.com. ViaCrypt information is available over the Web at http://www.viacrypt.com. NCD Software Corporation is a wholly owned subsidiary of Network Computing Devices, Inc. (NASDAQ: NCDI). The company provides desktop information access solutions for network computing environments. NCD Software Corporations is a major supplier of network software products, including PC-Xware software integrating Microsoft Windows and DOS-based PCs into X/UNIX networks, Marathon, a TCP/IP network foundation, and Z-Mail, a cross-platform electronic-mail and messaging system for open systems environments.

1 0

New remailer (vegas) now operational.
by Alan B. Clegg 17 Dec '03

17 Dec '03

Greetings, all. remailer(a)vegas.gateway.com is now on-line. It is a type 1 cpunk remailer running standard ghio code. The following is vegas's PGP key: --SNIP-- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzD9XEQAAAEEALrf7ZZV9ECB6jT0C7uVXByVa5332+yl1QIbx72FI+xWoyWF 5+MQkm803NaLyBabTrDyqJ6xkMLDu8acbH8OaATrAfUBM2qTZIVzlsgpynLkvCRv OOJfV6fHkaNzbHnYKF3JuLPiyPpXTgJDESIEyqEh9bm34YT711XZZ6mRHzrtAAUR tCtWZWdhcyBSZW1haWxlciA8cmVtYWlsZXJAdmVnYXMuZ2F0ZXdheS5jb20+iQB1 AwUQMP1xfZBA6uEVwDr9AQGibwL/adSqV5/12G+cH5cd5VDupuN570qS7dZdr6BI W9msl+TV7Y9KQUVcKqJ2AAZ6Ng0164WD4JgmYqeDqni0oYyk+Rm9IBmddJ/b0g9Z 7XbWH9w7/J8Zbbdx3mi4IpmwPAZe =9SYZ -----END PGP PUBLIC KEY BLOCK----- --SNIP-- which can be verified against ftp://ftp.gateway.com/pgpkeys/remailer.pgp Enjoy, & watch for the anouncement of a new nym server soon..... -abc \ Alan B. Clegg Just because I can \ Internet Staff does not mean I will. \ gateway.com, inc. \ <http://www.gateway.com/>

1 0

Re: Chaotic physical systems as random number sources (fwd)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 4:24 PM 2/20/96 -0600, Jim Choate wrote: >I have used magnetic pendulums for this as well as chaotic dripping (both >with an old C64). On problem I can think of with pendulums would be a low bit rate. What kind or rate do you get from your setup. (Of course with nano-technology pendulums ...) ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Secure Split
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi! this is the second time I post this to CP. Where can I get Secure Split? Apparently, it is a program to split a key in m parts, where n (<m) parts could rebuild the key. I saw that name in Nautilus manual (a pgpphone lookalike for dos). I looked through Alta Vista and the only thing I found was a post on CP by somebody else looking for it, in 1994 (?) Does such a program exists? If yes, where can I get it? Regards JFA **** NEW PGP 2.6.2 KEY ********* This key is actually suspended, as of Feb, 16 1996, was never distributed, and might be subject to deletion. Sorry for the trouble my mis-management might have caused. 2048 bits Key ID:24201BA1 1996/02/13 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 23 B6 24 31 86 67 FB 35 C7 A7 AF 12 A1 61 E9 3D **** OLD KEY: DO NOT USE ANYMORE UNLESS FOR VERIFYING SIGNATURES **** 1024 bits Key ID:57214AED 1995/10/04 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 84 96 76 AE EB 7C AB 15 88 47 87 B0 18 31 74 9F

2 1

Re: JavaScript to grab email
by Sean A. Walberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- If you don't have a mail server set up, it won't send (PC version at least). Fine by me, cuz I just copy the address into Pegasus to send mail. YMMV. Sean > Another annoying feature in JavaScript and Netscape. Have a look at > <http://www.popco.com/grabtest.html> > > The page uses JavaScript to steal your e-mail address and sends a test > e-mail message to the address it grabbed. It works with Netscape, which > is probably only browser supporting JavaScript. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMSqKGd82JgvRKzQZAQGyTwQAiKo1XUGZHPCgrwJU2ZWM/aREb/LHAebi kGDWNyC4qFrDkB//A2jN6ZWckdEuuCvX+OKLyYZHWTZ/sTjvi7WDsTprrXt96mZV ho1TB3nzemzRVZVO9aWUW/Zhpa+fi0MoSAlZC5ZFsdvnrEZUJSEbd5S1aubPA/gc 2/Zf6v1rbNw= =W/Fp -----END PGP SIGNATURE----- =================] Will work for RAM [================== | Sean A. Walberg | PGP key | C programmers | | Computer Engineering ][ | on | do it in | | umwalber(a)cc.umanitoba.ca | servers | libraries! | =============] http://www.escape.ca/~sean [=============

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 6:46 PM 2/20/96, IPG Sales wrote: >Hedging, hedging, hedging - why? I did not noitice this <...> IPG, why don't you sit down and draw up the terms of a challenge? Specify: * what information and/or materials IPG will release * to whom it will release them and when * who is or isn't elligible * what you will and won't accept as "breaking your system" * the arbitrating body * a starting time and a deadline * the award You'd do well to be _very_ thorough in these terms, since any perception that IPG was trying to throw the game would draw that much more fire. You'd also do well to make terms terms conform to real-world circumstances: for example, if someone hacking the office machines on which which you generate, store, and/or disseminate RNs is a practical threat to your product, then admit that as an acceptable part of a "break." Ted

5 7

Re: NSA net trolling
by Eric Murray 17 Dec '03

17 Dec '03

Here's a copy of your message back to you as you requested: lmccarth(a)cs.umass.edu writes: > > Wayne Madsen wrote somewhere: > > A knowledgeable government source claims that > > the NSA has concluded agreements with [...] Netscape to > > permit the introduction of the means to prevent the anonymity of > > Internet electronic mail, [...] > > I suspect this may actually mean that they're pushing Netscape to > incorporate cryptographic authentication into browser email, which I think is > a useful development. (Hey, I read that Netscape employees get fined $1 for > referring to Navigator as a "browser".) > > At any rate, it's an excuse for me to ask some questions: > > (0) > I'm not aware of any class library objects or methods in stand-alone Java > for calling the local mail transport agent. Is there any class library > support in Java+{Navigator, HotJava, Mosaic, NetCruiser, the AOL web tool, > etc.} for calls to the local mail agent configured in the browser ? > > I would prefer not to reinvent SMTP using the Socket class in my own applets. > Ideally I'd like to have an applet that presents a form with some entry boxes > and check boxes, quantizes and encrypts the input according to the check box > settings, and spews the resulting byte streams to the MTA. > > (1) > As I recall, I used to be able to set (as an Option) the path and name of the > local MTA (e.g. /usr/lib/sendmail) in an earlier version of Netscape. That > seems to have disappeared in Navigator 2.0. Is there indeed no longer a way > to set that ? > > It occurs to me that we could have achieved partial integration of > remailing into Navigator quite cheaply with that option. > > Comments from Sun and/or Netscape and/or anyone else would be welcome. > Thanks :) > > -Lewis "You're always disappointed, nothing seems to keep you high -- drive > your bargains, push your papers, win your medals, fuck your strangers; > don't it leave you on the empty side ?" (Joni Mitchell, 1972) > > -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

1 0

Kerberos vulnerability
by an5877＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A Kerberos V4 session key is chosen by calling random() repeatedly. THe PRNG is seeded with srandom(time.tv_usec ^ time.tv_sec ^ p ^ n++), where p is a static integer set to getpid() ^ gethostid() on the first call and n is a static counter. Is there any entropy here??? Most, if not all, Kerberos servers run one time synchronization protocol or another, which reduces the entropy to a few bits at most. DEADBEAT <na5877(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.4 iQBFAgUBMSnfhvFZTpBW/B35AQFNqgGApyXhHKIstdDvNaCuJY/fWfRZ16BvK60A Qde5VxuTsFdZsm69rrTtGxpdyplBxso6 =jHUm -----END PGP SIGNATURE----- --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

2 1

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 18:46 2/20/96, IPG Sales wrote: >Hedging, hedging, hedging - why? I did not noitice this in my first >reply - in addition to giving you the company if you can break the >system, we will give you the company if you can establish, through our >employees or any other method, that we retain any Ocopies of the TPs, >any! - for very large systems, we maintain a temporary copy to insure >safe arrival, by excuting the check system menu item - >it is immediate destroyed upon system notification. Anyone that wants to >audit us cazn do so, unannounced at any time - subject to payment ofd >expenses! We do not keep copies, we would not be in business 30 days if >we did. It is irrelevant if you keep copies of the OTPs or not. The point is that you might. There is no way to prove to me or anyone else that you don't keep copies. [why this is true is left as an exercise to the reader]. I would not trust anyone outside my company to create keys for us. I would urge any others interested in keeping their data inaccessible to outsiders to exercise the same fundamental caution. There is no further need to look at IPG's source code or algorithms. As I said, end of story. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

CoFR Report Site
by John Young 17 Dec '03

17 Dec '03

Thanks to KLP, the Council on Foreign Relations report on the future of US intelligence: http://www.tc.umn.edu/~klp/CoFR.txt (text) and http://www.tc.umn.edu/~klp/CoFR.gz

1 0