December 2003 - cypherpunks-legacy

Know Your Net.Enemies Project [noise]
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Rich Graves <llurch(a)networking.stanford.edu> ambiguously wrote: >definitely be added. I'll write the FUCKING STATIST section. Do you use 'FUCKIN' as an adjective or as an active verb? :) Sorry, couldn't resist :-> JFA

1 0

Re: Scientologists may subpoena
by SBinkley＠atitech.ca 17 Dec '03

17 Dec '03

>with bated breath to see whether or not the subpoena is issued. But if >chaning outside the US won't even work, then the remailers aren't going >to do a whole lot of good. What if we set up a chaining remailing system in as many countries as possible, all working in double blind mode. You could have it randomly pick 20 or so remailers before actually sending the message to its destination. That isn't a very clean method, but would sure slow down the process of obtaining court orders in each respective country. I have this other idea, but it would be difficult to set up. Again, with many many remailers, you could set it up, so that any message you send is sent to a random FTP site of the day. Each of the remailers randomly picks messages out of the pool at the FTP site, and sends it on its way (all is encrypted of course). At the end of the day, the FTP site is erased, and a new one is set up somewhere else (all remailers would then scan there). The beauty is that when a remailer pulls a message out of the FTP site, it has no idea where the message came from, nor which remailer (country) sent it there (providing the pooled messages have had the return addresses removed). This would make it very difficult to track down to the source. The disadvantage is that it requires cooperation between remailers, and that a message cannot be replied to. Anyway, just my $0.02 /sb

1 0

No Subject
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

e. > However, since the protocol requires that Alice send out location data, >once >she starts using it she reveals her physical location to Eve, Mallory, and >anyone ese > who can see the packets. Since the nature of the protocol is that Alice's >location does >not change frequently (and needs to transmitted via a trusted channel to >Bob when it >does), after the first usage Mallory *knows* the physical location he is >trying to >simulate, and can use this information for future spoofing. > > The upshot of this is that Denning's scheme not only provides no >security against >spoofing, and leaks potentially sensitive data about locations. > > If Sadaam Huissain (sp?) had used this scheme during the Gulf War, we'd >have been >able to send a cruise missile directly to his keyboard. This could be prevented by encrypting the data packets, but that would introduce more delay into the protocol, and make it easier to spoof distant locations. >[These flaws in the protocol seem so obvious that I can't help but wonder if >we're >missing something - Dorothy isn't *that* stupid.] Isn't she about the age where Alzheimer's starts kicking in? Jonathan Wienke

1 0

Re: WWW User authentication
by stillson＠ashd.com 17 Dec '03

17 Dec '03

>> >Well, if you use SSL, it's useable by a "large number of browsers" since >> >Netscape has such a large share of the browser market. And then all of >> >the things you're doing w.r.t. authentication are hidden, at least from >> >casual eavesdroppers and others too if you use more than the 40-bit option. >> >There's really no other choice to reach a large number of browsers. > >> Once again mister barber is being an idiot. netscape is not a "large number >> of browsers". > I have to apologize for this. Me having a bad day is not a good reason to call Jeff Barber an idiot. My aplogies. >> He is right that ssl is probably a good way to go. (shttp would >> be better :) ) > >SHTTP might be better if it didn't have to be "useable by a large number >of browsers" -- since Netscape doesn't support SHTTP. (I'm sorry that you >apparently find Netscape's success so frustrating, but it is a fact.) Again, I probably went a little overboard. I just get worried when any one company has as much control over the technology (in this case net based encryption) as netscape has. That, and I used to work for one of their competitors and I get tired of people telling me that netscape is the only company out there. Sorry to be a jerk

1 0

Re: No matter where you go, there they are.
by Paul_Koning/US/3Com%3COM＠smtp1.isd.3com.com 17 Dec '03

17 Dec '03

>From: perry @ piermont.com ("Perry E. Metzger") >Aren't things even worse? Since the satelite signals are not >authenticated with anything like public key methods, couldn't I just >synthesize a signal appropriate to any spot on the planet, knowing the >positions of the satelites relative to that spot? In the case of the C/A (civilian) code, absolutely. In the case of the P code (military) only if you have the key, but in that case, yes. As Jim Bell pointed out, there are boxes you can buy for suitable amounts of money that are "GPS simulators" -- they construct out of whole cloth the signals you would receive if you were at location X with satellites {Y1, Y2, ...} overhead. However, if all you set out to do is fool a location authenticator, deriving shifted location data from the actual satellites is far easier and bound to be much cheaper. There is one limitation this has that the simulator approach doesn't -- delaying real signals requires having access to the same satellites (or a large enough subset, i.e., 3-4 of them) that the checking station has overhead. paul

1 0

Re: Protocols at the Point of a Gun
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:50 PM 4/10/96 -0700, Jeff Weinstein wrote: > Given that the IETF has no "official" (whatever that means) sanction, >what would prevent any other organization from coming in and trying to >take over their turf? ... It seems to me that this question represents a classic case of the costs of market entry. IETF has a pretty good reputation as a standards body. If another body were to take over its function, they would have to have superior reputation in the relevant market (i.e. IP protocol suite implementors and their customers). Superior reputation could come from: (1) Better response to proposals. (Hard to imagine in the current climate.) (2) Government coercion. (We will throw you in jail if you don't ...) (3) Government coercion. (We won't buy equipment that doesn't meet x standard.) (4) Large User coercion. (We won't buy equipment that doesn't meet x standard. Probably no user is currently big enough to force standards in this way, not even Microsoft.) Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

RE: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 11:36 AM 4/11/96 -0400, Blake Coverett wrote: >> At 06:29 PM 4/10/96 -0700, Simon Spero wrote: >> >No, bytes are no always 8 bits - some machines use(d) 9-bit bytes. >> >> I notice you gave no examples. Why is that? >> >> Jim Bell >> jimbell(a)pacifier.com > >In a past life I worked on a Honeywell DPS8 box that had >36 bit words and 9 bit bytes. I'm seeing a few notes of this sort which make such claims, but there is not enough information included to establish that anybody _originally_ called those 9-bit data items "bytes" or not. It appears to me that after the fact, 20+ years later, there is a tendency to call ANYTHING other than a single bit a byte, at least during that time frame. What I'm looking for, however, is an indication that this was actually the term used, THEN, for that data structure.

1 0

washington post notices archives
by Andrew K. Bressen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi-- we here at HKS.net have today received a cease and desist letter from the washington post regarding editorial copy of theirs that was evidently posted to c'punks and then abosrbed into our c'punk archives. Once the archives are restored (RSN) we'll probably manually edit out the messages from the archive. We're trying to get the post to give us URLs for their copies of the content in question so that we can point to their archives, but their legal dept wasn't sure whether or not their archives were on the web. The posts in question date back some time (archive volume 1); I'm not too concerned about a recurrance (though it would make an interesting attack), but thought it was interesting enough to warrent mention, since it seems likely that the washington post was grepping the net looking for themselves. I wonder if robot exclusion on our site would have prevented this? Although the legal staffer who sent the letter did come up with a URL for the offending messages, she seemed unaware of the concepts of "mailing list" and (semi-automated) archives according to the person here who spoke to her. - --andrew k bressen bressen(a)hks.net -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMW17+1u2h42ZEVfZAQFslQP/avVguGOK/hRz/1SmZtZpld79edoDyJnf yeBkX7WdrfVt1/xSkOdD4xtVHf1FENfeFr50xnt2PPVb8g0E0DQqMv6Cz4ZNy5Su bXzsmvK/zCvLKPn7gueeRjk3jQKohGRf7R9Y6rr6N6jNbCS4zZQQ/nwN7sWdhZA2 epRRPjbH52A= =8d5T -----END PGP SIGNATURE-----

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 09:50 AM 4/11/96 -0400, Richard Martin wrote: > >-----BEGIN PGP SIGNED MESSAGE----- > >On Apr 10, 6:57pm, jim bell wrote: >> At 06:29 PM 4/10/96 -0700, Simon Spero wrote: >> >No, bytes are no always 8 bits - some machines use(d) 9-bit bytes. >> I notice you gave no examples. Why is that? >Perhaps he thought that most people who were interested could go look >it up themselves. > >- From a really quick web search, we find that the SGI Impact jams 9-bit >bytes [that's what it says] across the Rambus internally. I'm not sure >if the memory itself is 9-bit. Are you sure they're not referring to 8 bits of data and a parity bit? In any case, please give the address to the list so that it can be checked out.

2 1

Hack MSN anyone?
by gorkab＠sanchez.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The names have been changed to protect the innocent... I need say no more I'm sure. - ---------- From: MSN Support JosephB Sent: Sunday, April 07, 1996 4:05 PM To: xxxxxxxxxx Subject: RE: Connection, Member ID: xxxxxxxxxx, Country: United States (1), Locale: English (United States) Yes, windows95 dialup networking uses compression to send the password when connecting. Thanks for using the Microsoft Network Joseph Beasley msn Member Support - ---------- From: xxxxxxxxxx Sent: Friday, April 05, 1996 5:57 PM To: MSN Member Communications Subject: Connection, Member ID: xxxxxxxxxx, Country: United States (1), Locale: English (United States) Ye[Ask Member Support] MemberID=xxxxxxxxxx Problem Description= Microsoft being security conscious and all, I would hope that when I connect to MSN over the Internet, that my MSN client has the decency to ENCRYPT my password when it sends it over the net, yes? This is the first time I couldn't get through to a dial-up connection and had to access MSN using my ISP. Having done so, I find it extrememly convenient, and would like to continue to do so. Thanks. xxxxxxxxxx -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMW18MRhOHC4UmUYJAQHxvAf+NXAoqm8RUIskjtODUE9MYA+0JRs6x8f9 SMD70zWDRpF7mSPB6QaJcWfnufK5VqynrQ6iHfoNO9rC2yRlmkV04Ce3QW2m1z6P NVgAayVofN0Cjd1vITgdrB1XB9u3PnjXUggyTBLnAprTy79dCQsiTgen/2YujsaV Tzx6Xt87CFS8GwQcKWj5VonTkFQVjOuQIa6GbcVwEFiqVaXp2tLf3RUHXBtJ8B0H nC4wecTyra6CW2AAqFVXXmwVGeDh87caSy4Y3oFEQ8mxgZHFxOZLUeLo3MdaE+nx 33Yl2VdsjxTIlkog1R8d+6A1VDqpVqAJzcdjKnPLm8Sivm9wdGgsag== =TSTX -----END PGP SIGNATURE-----

1 0