December 2003 - cypherpunks-legacy

Re: java security
by Mike Fletcher 17 Dec '03

17 Dec '03

> >A couple of glitches I've gotten from Javascripts are poorly > >(purposely?) written applets that crash. One kept printing a modal > >dialog box continuously, the result being a need to reboot the > >computer because there was no way to exit Netscape or Windows. > > I can confirm this. Under Win95, I have seen applets that keep running > after the browswer instance that loaded has been closed. Even run over > other applications windows, leaving aninmated artifacts on the screen. > Sometimes only the power switch will do. I thought that the applets weren't > supposed to be able to wander out of their memory space... Applets (let alone javascript) should have no way to exist once you kill the Netscape that is running the Java interpreter. It is possible for applets to keep running in their own thread even after you've left the page they're loaded from, but once you kill the browser the VM should get shut down (the whole browser, not just a particular window). I can't think of any way that an applet could keep going once the VM stops. As for the original dialog thing, couldn't you C-A-Del it to get the task window up and then shutdown the offending NS task? --- Fletch __`'/| fletch(a)ain.bls.com "Lisa, in this house we obey the \ o.O' ______ 404 713-0414(w) Laws of Thermodynamics!" H. Simpson =(___)= -| Ack. | 404 315-7264(h) PGP Print: 8D8736A8FC59B2E6 8E675B341E378E43 U ------

1 0

Re: Add-in encryption module to Netscape
by Peter Trei 17 Dec '03

17 Dec '03

runner(a)asiapac.net > Hi, > > Lurking here for quite some time until now a real problem has come up and I > need help here. > > I'm not in the US of A and the Netscape commerce server that my employer > recently purchased has only 48bit key (as told by the salesman). My question is > whether it is possible to add-in my own security module (RSA) and secondly, how > difficult is it? The salesman cannot answer me. > > Thanks a lot. Funny, this looks an awful lot like a query (with an apparently real name attached) which appeared in www-security last week from Malaysia. I'm aware of the following servers, available outside the US, which claim to offer 128 bit SSL encryption: Apache-SSL Unix see http://www.algroup.co.uk/Apache-SSL free, commercial support available. supports client authentication Available from British sites Sioux Unix (solaris) see ftp://ftp.inect.co.za/pub/products/sioux/ANNOUNCE support client authentication Based on Apache 2500 Rand Available from South Africa Alibaba NT/Win95 see http://alibaba.austria.eu.net/ Available from Austria US $599 Zeus Very nice website at http://www.zeus.co.uk/ Unix 999 UK # Available from Britain COSMOS Unix Nice site at http://www.ristech.com/SOMMAIRE/B_PRODUITS/INTERNET/ WebCompare claims this has SSL2, but I can't find a mention of their Website. US $2000 and up. Available from France. For a survey of web servers, I strongly recommend WebCompare: http://www.webcompare.com Peter Trei

1 0

Micro$oft Crypto API
by Eric Anderson 17 Dec '03

17 Dec '03

Has anyone heard anything about the crypto API M$ is working on? Will it work W/ RSA? and will it support GAK? Sorry if this ?? is redundant, I havent' read my mail for a week.

1 0

Entropy
by Jed Liu 17 Dec '03

17 Dec '03

I've heard a lot of discussion here about "entropy tests" and "tests for randomness". Could somebody please explain to me one of these tests (or would that take too long?) ? Thanks. -=[###########################]=- -=[## Jed Liu ##]=- -=[## ljt(a)fs3.ucc.on.ca ##]=- -=[###########################]=- Things are entirely what they appear to be--and behind them...there is nothing. --Jean-Paul Sartre, "Nausea" SignaQuote v1.00 by Jed Liu

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub ek"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut"; $remailer{"shinobi"} = "<remailer(a)shinobi.alias.net> cpunk mix hash latent cut ek reord"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{"gondolin"} = "<mix(a)remail.gondolin.org> cpunk mix pgp hash latent cut ek reord"; $remailer{"tjava"} = "<remailer(a)tjava.com> cpunk mix pgp hash latent cut"; $remailer{"pamphlet"} = "<pamphlet(a)idiom.com> cpunk pgp hash latent cut ?"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'gondonym'} = '<alias(a)nym.gondolin.org> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"treehole"} = "<remailer(a)mockingbird.alias.net> cpunk pgp hash latent cut ek"; $remailer{"nemesis"} = "<remailer(a)meaning.com> cpunk pgp hash latent cut"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)gate.net> mix cpunk latent"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 robo alpha) (gondolin gondonym) (flame hacktic replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: The remailer list now includes information for the alpha nymserver. Last update: Mon 22 Apr 96 6:46:30 PDT remailer email address history latency uptime ----------------------------------------------------------------------- exon remailer(a)remailer.nl.com ++****+****# 3:56 99.98% shinobi remailer(a)shinobi.alias.net +*#-+-*+*--* 1:21:52 99.97% alpha alias(a)alpha.c2.org + *+*+++-*++ 44:07 99.88% portal hfinney(a)shell.portal.com ###*#-# *### 2:35 99.80% hacktic remailer(a)utopia.hacktic.nl *+* +*****+* 9:33 99.73% amnesia amnesia(a)chardos.connix.com -+---+----- 2:41:12 99.60% treehole remailer(a)mockingbird.alias.net --+-+ --.--+ 5:09:41 99.40% alumni hal(a)alumni.caltech.edu ## * * *### 3:58 99.38% replay remailer(a)replay.com *+* ****** 6:37 99.36% extropia remail(a)miron.vip.best.com --- --.---- 6:42:44 99.09% haystack haystack(a)holy.cow.net #*#++#*#*#++ 4:30 99.08% lead mix(a)zifi.genetics.utah.edu ++++++++++++ 42:08 98.55% c2 remail(a)c2.org ++++++ +-*** 36:14 98.49% ecafe cpunk(a)remail.ecafe.org *+---+*-#*+ 22:24 98.25% flame remailer(a)flame.alias.net --- _.----- 7:26:44 97.13% penet anon(a)anon.penet.fi -__...__ -- 32:56:37 96.98% vegas remailer(a)vegas.gateway.com +*##*+*+ 1:03:31 57.66% ncognito ncognito(a)gate.net *## :58 24.27% mix mixmaster(a)remail.obscura.com ----+ 2:24:40 22.82% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: Nazis on the Net
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Apr 21, 1996 17:23:00, '"E. ALLEN SMITH" <EALLENSMITH(a)ocelot.Rutgers.EDU>' wrote: > In view of the Zundelsite business, I thought people might find the >following of interest. Unfortunately, the author is either leaving >some critical information out or is misinformed. Specifically, the actual >history on the Zundelsite business, and the actual circumstances at Ruby Ridge; > >on the latter, Randy Weaver was neither a neo-Nazi nor a racist. He was (and, >so far as I know, still is) a white separatist. (One would think liberals >would >tolerate this - they tolerate the equally offensive black separatists, after >all...). The Zundelsite reference is incomplete in that it fails to describe >the motivations of the mirrorsites. > -Allen Since E.A. Smith wants completeness re the Zundelsite issue, I am curious about his assertion about Weaver. Might we know the source of his complete info on Weaver's political and racial beliefs. I see, in essence, three hypothesis: 1) Cover the ass of a potential neo-Nazi or racist (or both) without any reference to what is really true; 2) Get information from outer space; 3) Base the conclusion on hard evidence. If the answer is 3) I'd like to get a real pointer to the real evidence. By real evidence I mean just that, not wishful thinking or advertising jingles for points 1) or 2). --tallpaul PS: Cypherpunks seems to be getting very wiggy these days.

1 0

OFF Topic: MS-Exchange bug (winmail.dat)
by Sentiono Leowinata 17 Dec '03

17 Dec '03

I need help to disable the long-trailer from MS-Exchange. Everytime my friend sends me an e-mail, the "trailer" (winmail.dat) always there. How to disable it or turn it off? I believe someone mention about this "feature" in this mailing list long time ago, but I can't find it in my archive. Thank you. Sent. ps. can Winmail.Dat be considered as cryto-useless? <grin>

1 0

Re: OS/2 encryption
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-04-21 22:11:06 EDT, Lucky Green wrote: >Back up the HD to tape (encrypt the data on the tape). Move the tape out of >reach. And don't tell anyone, especially not this list, that you did that. Personally, I recommend the Syquest EZdrive over tape. The EZ is a fully functional (bootable, too) 130 MB hard drive ($200 for an IDE internal model, also available in SCSI and parallel port versions) that uses removable cartridges ($20 each) for storage. Most backup programs let you back up to a hard drive, which is much faster than tape, and more reliable as well. Ditto the bit about storing the backups (whatever media) somewhere the CO$ will never find them, and keeping your mouth shut about it.

1 0

Draft paper on law of digital signatures, CAs
by Michael Froomkin 17 Dec '03

17 Dec '03

[cross-posted to Cyberia-L, Cypherpunks & Cyberprof; apologies for duplication] A preliminary draft of my paper on Digital Signatures, Certification Authorities, and a few of the legal problems they (may) create can be found under the title, "The Essential Role of Trusted Third Parties in Electronic Commerce" at this URL: http://www.law.miami.edu/~froomkin/articles/trusted.htm A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

Re: java security
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:35 4/21/96, Bill Stewart wrote: >Were they Java, or JavaScript? Much different. Among other things, >JavaScript runs on Win3.1, and Netscape doesn't let you turn it off. >I've had at least one event of JavaScript crashing Netscape; the part >of the script I noticed was scrolling lots of stuff along the bottom Javascript started the new browser. The renegade applet was Animator, which is Java, I believe. I didn't spend much effort investigating it, since I try to stay away from doing things over that have hosed my system twice in a row. Win95, Atlas beta. The offending page was http://www.dippybird.com/java.html Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0