December 2003 - cypherpunks-legacy

Re: NSA says strong crypto to China?
by James A. Donald 17 Dec '03

17 Dec '03

At 11:05 PM 1/7/96 -0800, Rich Graves wrote: >The NSA is logically allied with other organizations of greater >repressiveness, inasmuch as it is not really in the interest of the NSA to >pursue absolute freedom anywhere. Certainly they have no desire for anyone >in the world to enjoy privacy. However, this logical symmetry does not >translate to practical collaboration. You think the NSA and the Chinese >government trust each other at all? They're spying on each other. They have common interests and conflicting interests. They have a common interest in repressing Chinese dissidents, to keep the world safe for National Security Agencies. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Cite for Toad Hop
by John Young 17 Dec '03

17 Dec '03

There have been inquiries on the source of the "Toad Hop" material, some from places to which it was forwarded. As noted on cypherpunks earlier, the material is directly from: Jonathan Littman, an investigative reporter, has published "The Fugitive Game: Online With Kevin Mitnick," Little Brown, 1996. 381 pp. $23.95. ISBN 0-316-52858-7. It is a dramatic recount of Mitnick's exploits; the pursuit by Shimomura, Markoff, telcos and Feds; the bust and Markoff's tales; The Well controversies and disputes about what really happened; suspicions of Shimomura and Markoff - their complicity with TLAs, their movie and book dealings, their disputes with hackers and journalists. What Mitnick was telling Littman while a fugitive.

1 0

Key Expiration (was: Revoking Old Lost Keys)
by olbon＠dynetics.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Numerous people over that last few days have suggested key expiration dates. Viacrypt advertises this for their commercial version of pgp. Has anyone used this feature or know how it works (i.e. how does it remain interoperable with other versions of pgp, or does the expiration feature only work with other viacrypt users?) Clay - ------------------------------------------------------------------------ Clay Olbon II | olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: finger olbon(a)mgr.dynetics.com Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 "To escape the evil curse, you must quote a bible verse; thou shalt not ... Doooh" - Homer (Simpson, not the other one) - ------------------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPFTWAS4mEMx6xUNAQFn+AP+KANJoiLTbbeuqvkHsrnHm1o7vVeXYmXr 9Rjnr6HAuOLL1JJRqd2D2csKC6MaWXkwWbfihdqiPbQJT8MfNwevYBzVVXEmALRI Ic2uFkESHnHdcht7IVNInCiqlt6Bm17t9ZGlPWSk8aeENaP5bKI3AqJ8AqLROovx 8EK2NHvNPjo= =VCui -----END PGP SIGNATURE-----

2 1

Re: Microsoft continues to mislead public about Windows security bugs (a bitlong, with references)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 12:01 1/8/96, James A. Donald wrote: >At 07:15 PM 1/8/96 -0800, Rich Graves wrote: >>As Microsoft well knows, this is completely untrue. [...] >> >> [...] >> >>Microsoft has not even admitted that this bug in both Windows 95 and >>Windows for Workgroups affects Windows for Workgroups, apparently because >>they have decided not to fix it. >> >> [...] >> >> We believe that it would be highly irresponsible to release the full >> version of this hack, but we will soon release a crippled >> demonstration-only version >> >> Is anybody listening? > >They will listen if you start to release full uncrippled exploits, after >a reasonable delay. Very true. But why does it always seem to take an exploitable crack before companies pay attention to security flaws? Is it because they are unable to admit that they have made a mistake? Everybody makes mistakes. What's the big deal? I really don't understand it. Any psychologists on this list? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

[Fwd: Re: ABOI: Desperate User Support]
by Shri 17 Dec '03

17 Dec '03

Seen on Alt.best.of.internet. Would love to find out if this is true! Shri > > Origination: alt.sysadmin.recovery > > Originator: jerry(a)worf.tcs.com (Jerry Carlin) > >Original Subject: support call - urban legand or fact? > > Date: 27 Jul 1995 16:44:18 -0700 > >... (many forwards deleted)... > > >This falls into the "Why did it have to happen on *MY* shift?" category. > > >A friend of mine is a chief engineer at SuperMac, and he related this > >story to me. > > >SuperMac records a certain number of technical support calls at random, > >to keep tabs on customer satisfaction. By wild "luck", they managed to > >catch the following conversation on tape. > > >Some poor SuperMac TechSport got a call from some middle level official... > >from the legitimate government of Trinidad. The fellow spoke very good > >English, and fairly calmly described the problem. > > >It seemed there was a coup attempt in progress at that moment. However, > >the national armoury for that city was kept in the same building as the > >Legislature, and it seems that there was a combination lock on the door > >to the armoury. Of the people in the capitol city that day, only the > >Chief of the Capitol Guard and the Chief Armourer knew the combination to > >the lock, and they had already been killed. > > >So, this officer of the government of Trinidad continued, the problem is > >this. The combination to the lock is stored in a file on the Macintosh, > >but the file has been encrypted with the SuperMac product called Sentinel. > >Was there any chance, he asked, that there was a "back door" to the > >application, so they could get the combination, open the armoury door, > >and defend the Capitol Building and the legitimately elected government > >of Trinidad against the insurgents? > > >All the while he is asking this in a very calm voice, there is the sound > >of gunfire in the background. The Technical Support guy put the person on > >hold. A phone call to the phone company verified that the origin of the > >call was in fact Trinidad. Meanwhile, there was this mad scramble to see > >if anybody knew of any "back doors" in the Sentinel program. > > >As it turned out, Sentinel uses DES to encrypt the files, and there was > >no known back door. The Tech Support fellow told the customer that aside > >from trying to guess the password, there was no way through Sentinel, and > >that they'd be better off trying to physically destroy the lock. > > >The official was very polite, thanked him for the effort, and hung up. > >That night, the legitimate government of Trinidad fell. One of the BBC > >reporters mentioned that the casualties seemed heaviest in the capitol, > >where for some reason, there seemed to be little return fire from the > >government forces. > > >O.K., so they shouldn't have kept the combination in so precarious a > >fashion. But it does place, "I can't see my Microsoft Mail server" > >complaints in a different sort of perspective, does it not?

5 8

PLAYBOY Magazine, Raph Levien & Remailers
by Andre Bacard 17 Dec '03

17 Dec '03

Hello Remailer Users, The current PLAYBOY magazine refers readers to the web site of Raph Levien, "The Remailer Guru." Raph's site focuses upon remailers. See the February 1996 PLAYBOY Forum (pages 33-35) interview with yours truly, Andre Bacard, entitled "The Computers Have Eyes." See you in the future, Andre Bacard ====================================================================== abacard(a)well.com Bacard wrote "The Computer Privacy Stanford, California Handbook" [Intro by Mitchell Kapor]. http://www.well.com/user/abacard Published by Peachpit Press, (800) Enjoy your privacy... 283-9444, ISBN # 1-56609-171-3. =======================================================================

3 2

Microsoft white paper on Access "security"
by Richard Charles Graves 17 Dec '03

17 Dec '03

Apparently the file name of the official position on Access security is wx1051.exe. It should be on CompuServe and www/ftp.microsoft.com. Among other wondrous things, Peter Miller writes in article <4crdu2$gua(a)news-e1a.megaweb.com> in comp.databases.ms-access: BTW, there's a typo in the White Paper. Where it says Access security relies upon 'RSA4 data encryption', they meant to say 'you not knowing the difference between a secure database application, and one that just contains a bunch of security dialogs that confuses the average user, but fails to protect either your code or your data'. I bet someone's going to have a lot of fun with this one!!! -rich

1 0

Re: phone calls from hell
by Duncan Frissell 17 Dec '03

17 Dec '03

At 12:48 AM 1/9/96 +0100, Anonymous wrote: >Media reports said that the explosion was set off by >remote control when Ayyash answered a call to him. It is >not known how the identity of Ayyash was ascertained. NBC News reported Monday that it was a Motorola phone, that Israel cut the landlines to the house to encourage cellular use, that *the* call came from the Engineer's *father*, and that an Israeli aircraft overhead triggered the blast after assuring itself (by voice info) that the Engineer was using the phone. DCF

1 0

Re: "Microsoft.com" added to my KILL file
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

Tim and Lucky were talking.... >>embedded spreadsheets and embedded graphics. And as for attachments, such >>as attaching programs for running on a machine, mailing list messages are a >>very poor way to distribute such programs, for many reasons. To say nothing of the risk of some nasty Word virus or other malicious executable. _______________________ Regards, Truth can never be told so as to be understood, and not be believed. -William Blake Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu 0C 69 D4 E8 F2 70 24 33 B4 5E 5E EC 35 E6 FB 88

1 0

Re: get mix-installer. (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From adam(a)lighthouse.homeport.org Fri Jan 5 19:52:45 1996 > Date: Fri, 5 Jan 1996 20:55:25 -0500 > From: Adam Shostack <adam(a)lighthouse.homeport.org> > Message-Id: <199601060155.UAA21106(a)homeport.org> > To: ravage(a)ssz.com > Subject: Re: get mix-installer. > References: <199601060152.TAA04065(a)einstein.ssz.com> > In-Reply-To: <199601060152.TAA04065(a)einstein.ssz.com> > Precedence: junk > > I followed the request information per the original posting by Adam and received this in reply. This leads me to believe that Mr. Shostack is basicaly unwilling to fulfill his own promises. My advice, avoid like the plague. Caviat emptor.

5 5