December 2003 - cypherpunks-legacy

NO weak links in DigiCash system!!!
by Marcel van der Peijl 17 Dec '03

17 Dec '03

> I have a couple of problems/complaints with your ecash project. > When I was sent my Acct ID and Passwd they were sent to me plain text > instead of being PGP-encrypted first. This means that some malicious > hacker could have intercepted the e-mail message and stolen the > free cyber-bucks you were so generous as to give me. Second, on the > WWW-page where one downloads the software it does not seem to do a secure > connection between my browser and your server (on netscape there is > a small key in the lower-left hand corner that is supposed to show when > one is securely connected to a secure server). So someone could sniff my > password from the transaction when I GET the software. Also When I'm > buying/selling things it would be smart for all parties involved to > be using PGP, and I think you should stress this point more in your page. > Otherwise this is another vulnerable point in your system IMHO. Let's get this straight before spreading more of these vicious rumours that can easily get misinterpreted. DigiCash is an R&D company developing ecash. We license out our technology to banks. We are running the trial, but only have limited resources to do so. This may result in long waiting time for accounts or no answer on a tech support mail. (We are of course trying to prevent this). In a real-money system, the password can of course not be sent out in plain mail. Either it has to be transferred out-of-band (phone, paper) or PGP'd. But that would require at least ten people answering the phones, sending snailmail, etc. We do not have the resources to do so, so we send out the password plain. A malicious hacker may snatch the password and open the account for you and steal your cb$100. This, however, is not related to the security of the transactions once you open the account! The password is only for starting up the account. And of course downloading on a secure server is not relevant. The software is the same for everyone! It is just not put out for public downloading because it would mean a hundred times more people asking for tech support. It would be more secure if we used different passwords for downloading and for opening the accounts but again, that would give a LOT more problems. PGP does not add any security in the payment system. Ecash is already secure. Feel free to ask us the questions before publicly posting. It will prevent misunderstandings and libel lawsuits. // Marcel van der Peijl, DigiCash bv, http://www.digicash.com/~bigmac/ // "If you had to tell the Whole Truth, you'd never shut up."

2 2

Re: Fax encryption software
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.3.89.9509262116.A7081-0100000@netcom7>, grafolog(a)netcom.com (Jonathan Blake) wrote: > I saw this article in alt.privacy. > > Anybody think the described encryption actually is worth > looking at. [...] >We are talking about a 72 bit engine that is more than >sufficiently strong for time sensitive general business purposes. [...] >>>It is fully licensed, without restriction for export, by the >U.S. >>>Department of Commerce. NO PGP WORRIES. These two statements are mutually exclusive. Snakeoil. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMGmmZyoZzwIn1bdtAQFrsQF/edmKXMashWa+yP9E4N/M0c/Rgwa4I6rm 0g0K8TzPc8hl4dP01Euiqcm1LAgHqbiL =rRO8 -----END PGP SIGNATURE-----

1 0

Sorry or something
by Marcel van der Peijl 17 Dec '03

17 Dec '03

In case it was not clear: my earlier post really was not a lawsuit threat. It seems it was (mis)interpreted this way by some people. Also, the original author did not post the article but someone he sent it to. I'm sure the author did not intend to post the text as is but first give us a fair chance of defending ourselves. #include <stddisclaimer.h> "My opinions and reactions do NOT represent the official DigiCash standpoint." // Marcel van der Peijl, DigiCash bv, http://www.digicash.com/~bigmac/ // "If you had to tell the Whole Truth, you'd never shut up."

1 0

Re: [NOISE] Re: Easter Eggs
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:35 AM 9/27/95 -0400, you wrote: > Date: Tue, 26 Sep 1995 12:59:54 -0700 > From: Alan Olsen <alano(a)teleport.com> > > You also need X windows to find the Mozilla animated icon hack on > Jammie Zawinski's page. > ^^^^^^ > >Just for the record, that's Jamie. Hey! I never said I could type at 1am! Yes, I know. #%#$#%ing spelling flames. Grumble. Grumble. (BTW, the compass egg will show up in any page with /jwz/ in the url. The "anim" tag on his page is bogus.) > obNetscapeHack: There is a feature called a "cookie file" in > Netscape that is ripe for exploitation as a security leak. If you > are using a Netscape server (and you may not even need that), you > can feed all sorts of information into it without the user's > knowlege. I have heard of one page that overloads the cookie file > until the machine runs out of drive space. I am sure that there > are other exploitable holes there... Any takers? > >Yikes! That sounds really bad. Do you have any more information on >this? For example, can the server write to anything other than >$HOME/.netscape-cookies? If I write protect that file, but it's still >owned by me, will Netscape still modify it? The url for the spec is: http://home.netscape.com/newsref/std/cookie_spec.html. The cookie overload probibly only worked under 1.1 and before. The spec claims to have limits on the number of cookies you can have. But between this and the server API, I am sure that a hole or two has to exist. This is an area not explored by many. (For good reason. It is usually poorly documented...) OBParanoia: Want something to really make you worried. Imagine this for a web page... A local law enforcement agency decides that it wants to nab a few of those "computer preverts". They create a web site that has a cgi script that looks for providers from a list. It then has a link that shows up only for people at one of those sites to "get hot porn pics". They then collect enough machine names and other info, then use the collected information to obtain a warrent to seize the ISP's logs to match users with machines. (Most browsers to not report e-mail address.) In the current hysteria I do not see this scenerio too far off. Makes you wonder what constitutes entrapment anymore? | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

Re: JCrypt (was: getting netscape to support the remailers)
by cman＠communities.com 17 Dec '03

17 Dec '03

> That was what I was thinking as well. I am confused by >Netscape's java support though.. I haven't seen very many details. Is >netscape going to only support applets or can you add stuff to the >runtime as well? In order to use jcrypt one needs access to add stuff >to the runtime I beleive. Currently jcrypt is implemented as a glue layer on top of RSAREF. This means it has to be accessed through native methods. Also, in general, one doesn't want to be downloading trusted security code every time one uses it, even if it has strong authentication (and this hasn't been built into Java yet.) So there are two questions: o Will netscape allow local trusted Java code to be invoked by downloaded applets? o Will netscape support native methods in such code? I would _greatly_ prefer to implement the jcrypt code in 100% java, but there are legal barriers to doing this where RSA is patented. JCrypt, however, is designed to allow the native methods to be replaced with Java should someone desire to do that. Also, there are other architectural concerns involving the direct or indirect invocation of local trusted encryption code by untrusted, downloaded software, which will be addressed somewhat in the next release of JCrypt. > >> >> > I started thinking about what it would take to get Netscape >> > to support sending mail through the remailers, after having >> > read the S/MIME specs which Netscape 2.0 is apparently going to >> > support. Perhaps with enough browbeating Netscape 3.0 will support >> > the remailers. >> >> Netscape doesn't need to support remailers explicitly since Netscape >>will be >> supporting Java. I think a remailer client is within Java's >>capabilities... >> Anyone disagree? >> >> andrew >> > > >-- >sameer Voice: 510-601-9777 >Community ConneXion FAX: 510-601-9734 >An Internet Privacy Provider Dialin: 510-658-6376 >http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

Schnorr patent
by peace＠BIX.com 17 Dec '03

17 Dec '03

Now that PKP is dead, does anyone know how to contact C. Schnorr about his patent? Peace ..Tom

1 0

[Q] Checkfree Wallet
by Harry S. Hawk 17 Dec '03

17 Dec '03

I'm writing about security and the Internet and in particular about the Netscape bugs. I'm interested if anyone know technical details about the Checkfree Wallet system. Have they made code publically available, etc. BTW. THe Wallet system is supposed to be using ~768 bit public key system and it is reported to exportable. All decyption is done at Checkfree Corp. Users encode only the credit info, the WWW server signs the file and forwards it to Checkfree who will decrypt and process the credit card data. I've been told no credit card info is kept on any servers except for machines inside of Checkfree's network and that keep credit card numbers on file there. Please let me know if you know anything. Unless other indicate any information will be assume for publication. Background information is welcome as well. /hawk habs(a)panix.com writing for NetGuide Mag. --

1 0

Re: alpha.c2.org nymserver
by Bill Stewart 17 Dec '03

17 Dec '03

>> Also, I am having a LOT of grief trying to get the alpha.c2.org remailer to >> work for me... (yes, I have the help files) >> Could someone walk me through it? > >You mean the nym server at alpha.c2.org? It seems to have about a 1 week >delay on it... > >Be sure the reply block that you give it is your own, and that you tell >alpha which remailer the reply block goes to. If you get a copy of the latest Private Idaho beta, it's got a convenient set of user interfaces for using the nymservers, as well as for PGP, remailers, etc. (Runs on Windows, so some of you may not find it all _that_ convenient :-) PI works with either vanilla PGP or ViaCrypt. The first step is to get the PGP key for alias(a)alpha.c2.org installed in your key ring, and update PI's key tables (a menu item). Then choose the "Create a nym" menu item and follow all the dialog boxes. I found it a little confusing at first, since I didn't realize the nymserver just uses secret-key encryption and not public-key, so you don't need to create a public-key-pair to do it - the only PGP involved is encrypting the message sent to the nymserver. So you can now send mail to the _highly_ anonymous wcs(a)alpha.c2.org :-) #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: Time Keys, Some Secure Ideas (by Alias: Jay Hyden)
by Bill Stewart 17 Dec '03

17 Dec '03

Jay - you wrote: > >> Time Keys, Some Secure Ideas << > The weakest attack on a time key based system is to spoof the >computer that keeps track of time into releasing encryption >keys i.e. change the clock. No, the weakest link is that you have to trust the person _running_ the time key system. Spoofing the clock only matters to a system you trust. Even a system running on a satellite isn't trustable unless you're running it yourself; your good friend and business partner who launched it may have put in a backdoor because the KGB threatened to kill his grandmother if he didn't. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: "Notes" to be Eclipsed by "Netscape"
by Bill Stewart 17 Dec '03

17 Dec '03

>> I've never even _seen_ a copy of Notes running on any machine, nor do I >> know directly of _any_ of my colleagues who has. (Not saying nobody has, of >> course, just that I can't find anyone I know well who has.) Notes was a PC network reimplementation of PLATO, the system that also inspired notesfiles, a distant cousin of Netnews (though I'm not sure if netnews was originally inspired by PLATO or not...) Netnews assumes that articles are going to propagate for a while and then be trashed; notesfiles assumes you're building a knowledge bases that sticks around. (This transitoriness has allowed netnews to scale to its current N*100MB/day of trash :-) Notes is oriented more toward business kinds of collaboration, though it would work fine with university research projects. It's got all the PCish things you'd expect, with GUIs and menus and icons that let you include various sorts of documents and pictures as well as text; it seemed to be done reasonably well, and there's a growing market for Notes administrators. One definition of "business" is "customers who want this stuff enough that we can charge them big bucks for the servers"; client software has come down in price due to market resistance. One difficulty with Notes is that the earlier versions liked to run on Novell IPX instead of TCP/IP, so it didn't immediately jump onto companies' internal IP nets, or onto the global net for those brave souls willing to expose their business communications systems to the world. I do know companies who run multiple Notes systems so that Project X can communicate with its teaming partners at Company Y; I don't know how much integration they have with their internal Notes systems. AT&T Network Notes is a joint AT&T/Lotus project that uses AT&T's public IPX network to support Notes on; I think it's now rolled out an accepting customers, but it was mostly in press-release stage while I was at AT&T. Notes does have encryption, using RSA and I think RC4; I'm not sure if they do the 40 bits exportable/ 128 domestic bit or just use 40 bits. Don't know about overflow kinds of bugs; the bugs I've heard about were more problems integrating with Cc:Mail :-) #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0