December 2003 - cypherpunks-legacy

Remailer Security
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 11:06 PM 03/04/96, lmccarth(a)cs.umass.edu wrote: >Bottom line: if you can crack (say) the 8-character Unix passphrase for a >remailer account, you have full access to the remailer's secrets and all the >opportunities that presents. Good remailer account passphrases are >important. Um, there's no reason why your remailer's account needs to be logged into interactively, is there? Seems like remailer ops should disable login to remailer accounts, putting '*' into the password field in /etc/passwd, or however unix lets you disable login (I know it does). Obviously, the general security risk of someone gaining unauthorized access to the remailer executable or data files is still there, and important to keep in mind. But this would seem to be a fairly logical security measure.

1 0

I don't think I'm on the mailing list anymore. What's going on?
by Corey Minter 17 Dec '03

17 Dec '03

Hi, I'm not getting any more mail from this list. Does anyone know what could have happened? Maybe it's a CDA crackdown :) If anyone knows could you email me directly?

1 0

Re: hammers, crowbars and remailers & Leahy
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jean-Francois Avon (JFA Technologies, QC, Canada) wrote: > What is the difference between an small hardware store owner > selling a hammer and a crowbar to a guy that will commit burglary and > a remailer owner providing services to , say, the same burglar > who wants to sell his stolen goods.[..] Be wary. There are people who believe gun or ammo manufacturers (and even knife manufacturers) should be held responsible for criminal use of their products. Bartenders or party hosts are already responsible when one of their patrons or guests gets too drunk (though the connection with knowing that the person is wasted is a bit clearer there.) The people who support such liabilities think there is a clear connection and it isn't very good. You may as well argue about religion or how many angels can fit on the head of a pin with such people. They go by emotional arguments, in many cases because they've a personal connection as or with a victim of some crime. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMUDuyCoZzwIn1bdtAQEqoQGAuU6nvataj6gt4VNUVjgyuYaTe8QxQ4Ww tPxTQiEvS/4C3C3vVUQ4QNWQbt5DxXzu =JRj/ -----END PGP SIGNATURE-----

1 0

Re: rhetorical trickery
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Vladimir Z. Nuri wrote: [..] > there is an infamous case of a child pornographer or pedophile in > California that is sometimes cited by law enforcement representatives > as a good example of the evils of encryption: supposedly he encrypted > his diary and it couldn't be unlocked by them. this was mentioned in > the article. > > but I have a question: how did they know it was his diary? If I remember some earlier discussion about that case from a few years ago, the file was called "diary.pgp". What they don't mention is that they were still able to convict him. They were just under the belief that they could figure out who all the victims were they didn't know about from his alleged diary... so they could "help" the other victims or maybe get him ore jail time? Odd thing is he used PGP 1.0, which used Bass-O-Matic. > I've noticed that people tend to often make conceptual leaps like > this that are wholly unjustified. it is easy to get their opposition Yes. This is quite common in political/social discussions and argumentation. A big problem is that people are no longer taught rhetoric and argumentation in schools. Another problem is that it is a clear example the opponents of strong crypto can point to, with lots of emotional strings attached. The best you can do is to note that the case in question was still sucessfully prosecuted, and also to give counter-examples as to why PGP has helped people (cite the usual freedom fighters in Burma, Amnesty International examples, or cite the theft of records from the UN's investigation in Bosnia, noting that it wasn't encrypted....) - --Rob - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMUDtbSoZzwIn1bdtAQGyLwGAu0nRv276K9cAmJslrl6HwW6m0YHWYKw/ mpZvHynKhfdNLRj6ghaHHH8V2DMDYrLO =SpjH -----END PGP SIGNATURE-----

2 1

FCC v. Internet Phone?
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've done a scan of the NYT web site (www.nytimes.com) and the AP and Reuters... no mention of this at all, though there's a new blurb about another company promopting an Internet Phone type technology. - --Rob - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMUDxiSoZzwIn1bdtAQFduAGArzYvmvL26xUQiag6etkyg/ysh8RUhTqX s19MCcxWng+3T3frKu5P8eRju2XYBoF5 =Du5Z -----END PGP SIGNATURE-----

2 1

crash_netscape.html
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Netscape 1.12 core dumped on me while surfing today. Narrowed it down to this. (Don't try this at home, kids). <html> <table width=450 border cellpadding=2> <tr> <td colspan=4 align=center> <table> <tr> <td width=60></td> <td width=330>DIE</td> <td width=60></td> </tr> </table> </td> </tr> </table> </html> Crash! Core dump, sound of breaking code. Tested on HPUX only. Apparently doesn't crash Gold 2.0 on Win95. a

1 0

Re: News on RSA vs. Cylink Injunctions and Patents
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:06 AM 3/8/96 PST, "baldwin" <baldwin(a)RSA.COM (Robert W. Baldwin)> wrote: > The following press release from RSA may be of interest to the >folks on this list. Thanks! It is of interest, but from one or two rounds of previous experience, I'd not want to draw any conclusions from either RSA's or Cylink's press releases about the content or meaning of a given court decision. They seem to inhabit different and not-quite parallel universes. >Cylink contends that RSA's software infringes its Stanford patents and that >licensing required an additional grant from Cylink, despite >the fact that RSA already has a license. After hearing oral arguments on >Feb. 29, Judge Williams denied Cylink's motion from the bench and later >issued a written order explaining that "several factors weigh against >finding that (Cylink) has shown a likelihood of success on >the merits." This sounds a lot like Cylink asked for a temporary restraining order blocking sales of BSAFE until the resolution of a lawsuit, and the judge rejected that request. If the quotations mean the same in context as they do in a press release (:-), they're moderately negative, though not a total rejection of the main case. It is pleasant to have RSA on the side of breaking the D-H patent and limiting the scope of H-M. Maybe this will help free the algorithms even before Roger Schlafly's suit does. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

Re: Another Motivation for the CDA (Federal Sentencing Guid
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:59 PM 3/8/96 -0800, Bill Stewart wrote: >The pizza guy was a thug, but twice as many third-strikers got >their third strike for marijuana as for all violent crimes combined. >I assume most of these had large quantities, possibly intended for sale, >and a number of them had real crimes as their previous felonies >rather than Prohibition-related offenses. But you can get legally >serious quantities of marijuana by just growing a couple of plants. I wonder how many of these drug dealers previous "real crimes" were related to using violence to protect their drug business, defense which would have used the courts and police had drug dealing been legal. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Net Day 96 and AOL
by Bill Stewart 17 Dec '03

17 Dec '03

Heard on the radio today that AOL will be donating service for a year to the first 2000 schools that ask for it, as part of their contribution to Net Day. (For those of you not from California, an industry-led group has been coordinating volunteers and materials to wire up schools to the net; tomorrow's effort will be installing inside wiring so that schools that have computers will be able to get hooked up.) Does anybody know if there's an AOL-friendly version of PGP that we can donate to the schools, to help teach kids about proper encryption? If nothing else, some of the cut&paste interfaces will do, I suppose. AOL is fairly friendly about pseudonyms, and remailer support is a no-brainer except for documentation readily understandable to kids. Bill #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

2 1

Re: News on RSA vs. Cylink Injunctions and Patents
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

Adam, It is absolutely true that RSA has seen the light, and now believe that the DH and HM patents are not valid. I think that they had this realization on the day that they lost control of these patents, with the breakup of PKP. Roger Schlafly has been fighting these patents as well, and it appears to me that DH should be completely dead, it was widely publicized more than a year before the patent was filed. I don't believe RSA's interpretation of the judges ruling, though. Certainly they will twist the words in the most favorable way. RSA had been saying that Hellman-Merkle, not Diffie-Hellman, covered all public key patent ideas; but they were only saying that through PKP (which was a joint venture between themselves and Cylink) thad -- Thaddeus Beier thad(a)hammerhead.com Technology Development 408) 286-3376 Hammerhead Productions http://www.got.net/~thad

1 0