December 2003 - cypherpunks-legacy

Re: Enforcing the CDA improperly may pervert Internet architecture
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:51 AM 4/9/96 -0400, Declan B. McCullagh wrote: >... >The DoJ and Taylor are going to argue that IP V6 can include such an >adult/minor tag in each datagram! One of their key witnesses is Dan >Olsen, the head of the computer science department at Brigham Young >University and the incoming director of the Human Computer Interaction >Institute at CMU. Declan - One of the migration paths suggested for IPV4 to IPV6 migration is to tunnel IPV4 packets within IPV6 packets. IPV4 packets do not provide for an adult/minor tag, so until the transition to IPV6 is fairly well along, this approach will be ineffective. If the people who are worried about minor's accessing smut want something this century, they should go with PICS. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

2 1

Re: Bank transactions on Internet
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 04:31 PM 4/8/96 -0700, you wrote: >I agree with Jim at SFNB that the encryption made possible by VeriSign >server certificates is an integral part of remote banking on the Web. >However, I would encourage Security First and other banks looking at the Web >to focus increased attention on client certificates AND to migrate away from >their dependence on user passwords. I brought this up with SFNB a month or so ago (when I opened my account) and the word then was that client side certificates would be avaible within a month or so, my time guestimate (based on what they were saying) was half-a-year. >Admittedly, client certificate >functionality has not yet been available but it will probably be standard by >mid-1996. Let's hope so, I am not keeping significant funds in that account until I have a certificate. >Yes---it is true that security is never absolute. I hope Eric Young does attempt to crack a 40-bit SFNB session as he mentioned on cpx today. >As Michael Karlin of SFNB noted and subsequently corrected, Netscape caches >passwords. I suspected this, and was further exposed because of a common problem with using Netscape and the like from student accounts (with a big 10M quota), say on MIT's athena, where I like my disk cache to reside in the workstations /tmp . I wipe(d) it whenever I log out, but I'm sure others sprinkled their passwords in a million "public" cache's before SFNB stuck the tag no-cache tag in. OBJava: do java applets have access to the cache, would it be possible to write one of the little nasties that keep an eye on the cache? >Additionally, people tend to use a single password for 10 or more of their >relationships and one compromise, compromises all. Indeed! How many people use their easily crack "ftp:/etc/passwds" password for SFNB? _______________________ Regards, The best way to have a good idea is to have lots of ideas. - Linus Pauling Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

2 1

RE: NSA Budget - NOT!
by Anton Rager 17 Dec '03

17 Dec '03

Wouldn't it be great if it were true!!!!!!! -- sorry folks -- doesn't seem to exist 1. - No domain of dod.gov -- there is info for nsa.gov...just not dod.gov 2. - No valid URL of http://nsa.dod.gov/~reports/quarterly.txt -- no page returned This must be a joke....I was gullible enough to try anyway. ____________ Original Message Follows _____________________________________ Yes, there are annual and quarterly reports released to the public which describe in meticulous detail expenditures for the agency's program, personnel and equipment: 1. The program of services and information supplied to government and other intelligence organizations, US and foreign, with terms of each client contract. 2. US employees, their organization, skills, duties and longevity of service; their names, ranks, identification codes, secure communication methods and home addresses; the location of workplaces; the continued training each is scheduled to receive; leaves of absence and destinations while absent. 3. Foreign nationals covertly employed worldwide, with information on each as per 2. 4. A comprehensive listing of all types of world-wide equipment operated; its detailed design, function and output; where it is located; its designers, manufacturers and purchase cost; its schedule of amortization; and its schedule for replacement and/or upgrade, with fifteen-year projected procurement. 5. Special short- and long-term contracts with governmental and non-governmental organizations, US and foreign for one-time projects, by goal, personnel and equipment. 6. Special projects with other US and foreign counter- intelligence to issue disinformation about the agency. 7. Special section on world-wide US and foreign cryptology: cryptanalysis, cryptography, steganography, codes, cyphers, glyphs, mimes; each ranked for security and ease of cracking; governmental and non-governmental parties using each; names of cooperative and resistant cryptographers and cooperating pseudo-cryptographers. 8. Sub-section on methods of Internet traffic and language analysis; operation and surveillance of anonymous remailers, bulletin boards and mail lists; lists of cooperative and resistant educational institutions and commercial organizations. 9. Appendices on: black operations; transparent operations; methods for managing cooperative and resistant governmental and non-governmental persons. The public is invited to study and/or download these reports anonymously at: http://nsa.dod.gov/~reports/quarterly.txt

1 0

Re: (Fwd) British Study Claims That Photo Credit Cards Don't Work
by jim bell 17 Dec '03

17 Dec '03

At 07:57 AM 4/9/96 -0500, Mike McNally wrote: >jamesd(a)echeque.com wrote: >There are supposedly some new techniques that look at the infrared >signature of your face (like, I guess, distribution & position of >hot & cold spots), and that's less likely to be fooled by facial >hair and other superficial disguises. It's probably a fairly simple >technology, and could be applied to the credit card ID problem. I think this is based on looking at your face with near-infrared, not the medium and far (thermal) infrared. Near infrared is supposed to penetrate flesh far better, so your blood vessels are visible and form a pattern which can be recognized. Jim Bell jimbell(a)pacifier.com

1 0

Job at C2.NET
by sameer＠c2.org 17 Dec '03

17 Dec '03

See http://www.c2.net/jobs/ JUNIOR SYSTEM ADMINISTRATOR / TECHNICAL SUPPORT Responsibilities: Responsible for day-to-day administration of UNIX servers, network, and dialin modem pool. Configure and install new servers and network connections. Handle account creation, web server maintanence, DNS setup. Maintain newsserver, webserver, nameserver. Communicate with customers and respond to customer inquiries regarding products and services. Perform low-level technical support for basic customer concerns. Maintain website. Requirements: UNIX (SunOS and FreeBSD) administration experience. Experience with BIND, Apache, INN. Strong C, Perl, general programming background. Good communication skills. Experience dealing with customers and related support issues. -- Sameer Parekh Voice: 510-601-9777x3 Community ConneXion, Inc. FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.net/ (or login as "guest") sameer(a)c2.net

2 1

Re: Bank transactions on Internet
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:13 AM 4/9/96 -0700, Steve Reid wrote: >> Is it really that easy to break 40-bit? Don't you need access to a "fair >> amount of cpu power" to brute force crack 40bit? > >I remember reading a recent paper at this URL: > http://theory.lcs.mit.edu/~rivest/bsa-final-report.ascii >They mentioned a Field Programmable Gate Array (FPGA), specifically a >board-mounted AT&T Orca chip available for around $400. They said it could >crack a 40-bit key in 5 hours (average). Sounds like anyone with root >access on a major internet node could make a significant profit stealing >credit card numbers. > >The FPGA sounds like a very interesting device, with quite a few >legitimate uses... Has anyone out there seen one of these? I was hoping a hardware type would answer this question, and give references to manufacture's spec sheets, but not having seen such an answer, here is a software person's answer. Gate arrays are a common part of complex electronics. If you are viewing this answer on a screen, it is quite probable that there is one right before your nose. They come in two basic forms, mask programmed and field programmed. Mask programmed gate arrays are an array of logic gates, which are "programmed" to an application by a final metalization layer. They are quite inexpensive when ordered in quantity. Field Programmed Gate Arrays (FPGAs) are designed for prototyping designs, and can programmed electrically. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

6 6

Re: [NOISE] Federal Bureau of Indigestion
by jim bell 17 Dec '03

17 Dec '03

At 09:15 AM 4/9/96 -0700, Dave Del Torto wrote: >[forwards mercifully elided] > >FBI agents conducted a raid of a psychiatric hospital in San Diego that was >under investigation for medical insurance fraud. After hours of reviewing >thousands of medical records, the dozens of agents had worked up quite an >appetite. The agent in charge of the investigation called a nearby pizza >parlor with delivery service to order a quick dinner for his colleagues. Funny stuff deleted. >PM: And everyone at the psychiatric hospital is an FBI agent? >Agent: That's right. We've been here all day and we're starving. >PM: How are you going to pay for all of this? >Agent: I have my checkbook right here. >PM: And you're _all_ FBI agents? >Agent: That's right. Everyone here is an FBI agent. Can you remember > to bring the pizzas and sodas to the service entrance in the rear? > We have the front doors locked. >Pizza Guy: I don't _think_ so... >click< I'm waiting for Unicorn to claim that the next phone call to the pizza shop was from a judge, who was placing a subpoena on the next 19 pizzas that shop produced, and ordered them delivered to the hospital for psychiatric evaluation. B^) Jim Bell jimbell(a)pacifier.com

1 0

[noise] Re: They're running scared.
by Alan Olsen 17 Dec '03

17 Dec '03

At 06:59 PM 4/9/96 +0200, Asgaard wrote: >On Mon, 8 Apr 1996, Michael C. Peponis wrote: > >> Personally, I love national insecurity such as terrorist attacks and >> random bombings, wish there were more of them by more people. > >A big problem with random bombings is that one self can become part >of the random targets. The question is if they are truly random bombings and how do we determine if they are. And if they are truly random, how can they be adapted as a source for a good cryptosystem? ("We are sorry for the delays in the transmision. We had to let a few more bombs go off.") How many bits of entropy do you get from an explosion anyways? (Depends on how close you are to the blast...) ];> --- | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

2 1

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 03:46 PM 4/8/96 -0400, Black Unicorn wrote: >> Spooner's quote follows: >> >> "Doubtless the most miserable of men, under the most oppressive >> government in the world, if allowed the ballot, would use it, if they >> could see any chance of thereby meliorating their condition. But it >> would not, therefore, be a legitimate inference that the government >> itself, that crushes them, was one which they had voluntarily set up, or >> even consented to." >> >> Lysander Spooner > >I didn't respond to this part originally because I grew tired of typing >"Yadda yadda yadda" everytime Mr. Bell lapsed into another >psycho-political babble session. And the rest of us are tired of seeing those non-responses! >What this has to do with Mr. Bell's position, that citizens as a whole had >grown so discontented in the United States that they were prepared to rebell >actively in large numbers, is unclear. In fact the Spooner quote adds >more to my position than Mr. Bell's: > >"if allowed the ballot, would use it, if they could see any chance of >thereby meliorating their condition." > >Seems that even according to Spooner, the citizens of the U.S. aren't >hopeless yet. Aside from the fact that Lysander Spooner has been dead for a LONG time, and thus has no opinion concerning 1996 America, your "logic" is atrocious. He is saying: "If people think it might help, they might use the ballot." He is _not_ saying: "If people use the ballot, it means they think it might help." Maybe such subtleties of logic are beyond you... >In fact there is ample evidence that citizens who have come to believe >that a sovereign is beyond redemption refuse to participate in the >political process any longer. Iran, Iraq, the former Soviet Union, >Turkey, the Baltic States are all examples. I think that the main reason this observation is hilarious is that one frequent complaint from media types is (and has been, for decades) that there is a nearly steadily-decreasing voter turnout at the polls in the US. It is not my intention to make the same foolish logical error that you did. I won't claim, absolutely, that failure to participate in an election _must_ be evidence that people believe "a sovereign is beyond redemption." But since you've stepped into it, I intend to rub your nose in it as well. To whatever extent you believe your last claim, you should be willing to accept the obvious conclusion that many of the American public don't believe that the government is worth trying to retrieve, and they haven't for years. Which means that, as usual, you've ended up shooting yourself in your own foot. When you said: >>> >Funny, the latest primary has been one of the highest voter turn outs in >>> >quite a while (except in Deleware). Considering those are the law-and-order >>> >types who are most likely to invade personal liberities, I think its a >>> >bit hard to make the case that the temper of the country is anything but >>> >very pro-political process. I pointed out, correctly, that mere participation in the vote doesn't evidence any claim that a person is "very pro-political process." You've done a piss-poor job defending this. And you've forgotten that to whatever extent voter turnout is up with respect to past years, it is only "up" because it has been dramatically down for decades. You need to explain why a citizen, or citizens as a group, should be obligated to tolerate this political situation for decades without doing anything to bypass the political system when they appear to not believe in a reasonable likelihood that it'll fix itself. Jim Bell jimbell(a)pacifier.com

1 0

[reputationpunks] Article on Moody's
by s1113645＠tesla.cc.uottawa.ca 17 Dec '03

17 Dec '03

This week's Economist has a nice tidbit on bond rating agencies and antitrust on page 80. A comment on firms that trade mostly on their reps. Is an unsolicited rating by a for-profit agency an act of free speach or an act of defamation?

2 1