December 2003 - cypherpunks-legacy

Re: Cost of brute force decryption
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:44 PM 6/5/96 -0700, you wrote: >> > "For example a 40-bit key takes about $10,000 worth of supercomputer >> > time and two weeks to crack. Although this key may be adequate to >> > protect my checking account, it's probably not large enough for the >> > accounts of a major corporation. >> The figures look familiar. No references around. I'm not sure it would >> require a whole two weeks for 40-bits, though. Possibly less than a >> day? (Or was that why you asked baout the figures?) It was from The Newspapers, of course :-) The "$10,000 of supercomputer time" was in an initial press release description by somebody in Netscape or RSA after the RC4/40 Netscape crack, and was way high. (Check Altavista...) However, it's not too far off for the cost of a DES crack, where "supercomputer" is defined as "a special-purpose cracking machine" rather than "a Cray".. (Maybe an order of magnitude high for that.) And the description of $10,000 as "maybe enough to protect my checking account, but not large enough for the accounts of a major corporation" is about right. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Rescind Authority!

1 0

Re: Class III InfoWar
by Chris Adams 17 Dec '03

17 Dec '03

On 2 Jun 1996 03:06:14 pdt, hal9001(a)panix.com wrote: >At 21:33 -0400 6/1/96, winn(a)Infowar.Com wrote: > > >>The article discussed the advanced information warfare techniques used by the >>perpetrators. "According to the American National Security Agency (NSA), they >>have penetrated computer systems using 'logic bombs' (coded devices that >>can be >>remotely detonated) > >Unless the definition has changed recently, a "logic bomb" is normally a >piece of code in a program that is triggered when a specific event occurs >(such as the programmer's name not appearing in a payroll file for a >designated period of time [which might trigger a salami round off routine >to start cutting checks 2 months after s/he is no longer working for the >company]). I believe that is what they were referring to. However, the press garbled it as usual. It seems like the original was something like 'logic bombs' (bits of code that can be triggered remotely). Probably sounded more impressive the reporter's way... This Message Was Sent With An UNREGISTERED Version Of PMMail. Please Encourage Its Author To Register Their Copy Of PMMail. For More Information About PMMail And SouthSide Software's Other Products, Contact http://www.southsoft.com.

1 0

Fwd: Second email address
by Chris Adams 17 Dec '03

17 Dec '03

==================BEGIN FORWARDED MESSAGE================== >From: "Chris Adams" <adamsc(a)io-online.com> >To: "sysop(a)io-online.com" <sysop(a)io-online.com> >Date: Mon, 03 Jun 96 19:50:50 >Reply-To: "Chris Adams" <adamsc(a)io-online.com> >Priority: Normal >X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE >MIME-Version: 1.0 >Content-Type: text/plain; charset="us-ascii" >Content-Transfer-Encoding: 7bit >Subject: Second email address > How much would it be to get a second email address? (Just POP access. Doesn't even need to be able to send mail) That way I could have an address to send stuff like mailing lists to. Also: Web pages - I believe I saw something that mentioned that some space was included w/the subscription. How much, and how do I access it? This Message Was Sent With An UNREGISTERED Version Of PMMail. Please Encourage Its Author To Register Their Copy Of PMMail. For More Information About PMMail And SouthSide Software's Other Products, Contact http://www.southsoft.com. ===================END FORWARDED MESSAGE=================== /* From Chris Adams <adamsc(a)io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5! The Enigman Group - We do Web Pages! */ This Message Was Sent With An UNREGISTERED Version Of PMMail. Please Encourage Its Author To Register Their Copy Of PMMail. For More Information About PMMail And SouthSide Software's Other Products, Contact http://www.southsoft.com.

1 0

MEETING: SF Bay area Cypherpunks meeting for June 8th
by Hugh Daniel 17 Dec '03

17 Dec '03

What: Monthly meeting of San Francisco area Cypherpunks & Stanford PGP Club When: Saturday June 8th 12:00 noon Where: Turing Auditorium, Stanford University (Directions below) Dinner: Fanny & Alexander's 412 Emerson, Palo Alto, +1 415 326 7183 Topics: Random, PGP Keys siging, More on Crypto GUI's, Random. Directions: If you have a GPS receiver, head for 37.4296875N 122.1783752E. If you have excellent hearing, call 415-853-9080 and follow the ringing. Or, get to Stanford's Campus Drive via 280-Sand Hill or 101-El Camino Real-Embarcadero. From 280, take Campus Drive left (clockwise). From 101, take Campus Drive right (counterclockwise). Turn South (centripetal) at Panama Street and take an immediate left into the Jordan Quad parking lot (empty on weekends). Walk between Pine and Redwood Halls to Polya. Turing is between Polya and Cypress. It doesn't appear on most campus maps, but it's there, honest. Entrance to Turing Auditorium is by the Pac Bell payphone sign. Maps: http://www-leland.stanford.edu/group/Transportation/PGrid4.html (parking) http://www.stanford.edu/gifs/campus.1620-63-4.gif (800K campus map) http://www.stanford.edu/home/visitors/vicinity.html (note: upside down!) Socialized transportation: CalTrain to the Palo Alto station; 20-minute walk or arrange to be picked up by a local. 7F bus. See http://www.stanford.edu/group/Transportation/ Notes: The short notice is my fault, I was hoping to get some folks to talk at the meeting and waited far too long to give up on them. Thanks: Much thanks to Rich Graves and the Stanford PGP Club for the wonderful meeting space.

1 0

Re: WWW servers.
by Bill Stewart 17 Dec '03

17 Dec '03

Black Unicorn: >> Does there currently exist a system which permits webservers to restrict >> access to clients who have a given certification? Sameer: > Yup. .... > =) Stronghold: The Apache-SSL-US, coupled with XCert >Sentry. What else? Of course, there's a simpler approach; restrict access to people who have logins and passwords, and only give those to people who have the certification... # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Rescind Authority!

1 0

Fwd: Re: INteresting tidbit
by Chris Adams 17 Dec '03

17 Dec '03

==================BEGIN FORWARDED MESSAGE================== >From: "Chris Adams" <adamsc(a)io-online.com> >To: "cypherpunks" <cypherpunks(a)toad.com> >Date: Wed, 29 May 96 22:36:17 >Reply-To: "Chris Adams" <adamsc(a)io-online.com> >Priority: Normal >X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE >MIME-Version: 1.0 >Content-Type: text/plain; charset="us-ascii" >Content-Transfer-Encoding: 7bit >Subject: Re: INteresting tidbit > >On the Encryption note, and I swear not along the lines of the 'DOJ' >and 'FBI Snooping' Big-Brother events, I heard another story recently. > ># begin story > >A person working on the MBONE project did an unannounced experiment >across the internet using Triple-DES for MBONE, and the very next day, >'ATF' agents knocked on his door and warned him against exporting >munitions. The experimentor was shaken by the fact that agents >approached him so quickly after the experiment. > ># end story > >Extrapolations of fact: > 1. Internet traffic is monitored. > 2. The ability to snoop for encrypted traffic is present > 3. The ability to identify encryption levels is present > (How else can they differentiate DES-1 from DES-3?) > 4. The ability to crack DES-1 in near real-time mode is present. > (See above). First, this has been loosely confirmed for ages. Someone was mentioning that FBI offices supposedly have software that (on a 486) can crack a DES-1 key in under an hour. Multiply * modern high capacity computers = problem. However, this does not nessesarily follow from #3. First off, you could probably tell the encryption used from a file format; the software on the other end has to know what it's getting. Secondly, you could probably tell quite a lot about what was used by some intense analysis. Finally, if their software cannot read it and analysis suggested it was more than DES-1 then they might go after someone w/o being able to read the document in question. > 5. If above=true, then Feds dropping the Zimmerman PGP case probably > also points to it also being crackable in a similar manner. Not necessarily. This freemen issue shows that the FBI is getting gunshy about bad publicity, which they were getting. > 6. Using encryption only flags traffic for capture and decryption, > using strong encryption makes you all that more interesting. Sounds like the old argument for encrypting everything... >Sorry, couldn't resist. I'll try not to start a threads about >electro-plasma propulsion craft at Area 51, metallic-ceramic skin >and pulse-jets on the Aurora spy plane, heat-imaging video cameras >on satellites and planes that can watch you through your houses' roof, >etc. :) What??? Now you're going to tell us X-Files is just a TV show? <g> This Message Was Sent With An UNREGISTERED Version Of PMMail. Please Encourage Its Author To Register Their Copy Of PMMail. For More Information About PMMail And SouthSide Software's Other Products, Contact http://www.southsoft.com. ===================END FORWARDED MESSAGE=================== /* From Chris Adams <adamsc(a)io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5! The Enigman Group - We do Web Pages! */ This Message Was Sent With An UNREGISTERED Version Of PMMail. Please Encourage Its Author To Register Their Copy Of PMMail. For More Information About PMMail And SouthSide Software's Other Products, Contact http://www.southsoft.com.

1 0

InfoSec Spin
by jya＠pipeline.com 17 Dec '03

17 Dec '03

6-6-96. UST: "Businesses bypass law to fend off hackers." In cyberspace, where hackers are finding commercial computer systems easy prey, businesses are choosing to hire free-lance security teams rather than involve the law. A Senate subcommittee heard Wednesday from experts who described how businesses, concerned over negative publicity, avoid reporting hacker assaults on their networked computer system. "You stop the bad guy and send him to your competitor," said Dan Gelber, the committee's chief counsel. Senator Nunn asked the subcommittee staff to comment on an article in this week's Sunday Times of London that reported, "Cyberterrorists have amassed up to L400 million worldwide by threatening to wipe out computer systems" belonging to banks and brokerage houses if they refuse to pay a ransom. "While we can't confirm the entire story," said Gelber, "it is extremely consistent with what industry insiders tell us." http://pwp.usa.pipeline.com/~jya/fendof.txt ---------- UST had two editorials June 5 on encryption: one criticizing the administration's position, and another defending GAK by Sally Katzen with OMB. http://pwp.usa.pipeline.com/~jya/yeanay.txt

2 1

Fwd: Re: forged addresses
by Chris Adams 17 Dec '03

17 Dec '03

==================BEGIN FORWARDED MESSAGE================== >From: "Chris Adams" <adamsc(a)io-online.com> >To: "cypherpunks" <cypherpunks(a)toad.com> >Date: Thu, 30 May 96 01:32:54 >Reply-To: "Chris Adams" <adamsc(a)io-online.com> >Priority: Normal >X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE >MIME-Version: 1.0 >Content-Type: text/plain; charset="us-ascii" >Content-Transfer-Encoding: 7bit >Subject: Re: forged addresses > On 29 May 1996 19:38:16 pdt, nobody(a)nowher.com wrote: >Hi, I'm not sure if there was ever a thread on this, but I was wondering if >anyone can determine your real email address, if you were to fake it to your >email client. > >I hope that this doesn't offend anyone, since this is a high traffic list, but >I was wondering if this would work. To try it out, I setup my client to think >I was someone else, and sent myself an email. I could only figure out what >ISP it came from. > >What I would like to know is, can any of the experts on this list determine my >address from the header of this post?? I didn't receive anything except your nobody@... address. >again, if this is something that I shouldn't have done, just let me know, and >it won't happen again. > Hmmm... I'm going to have to play around with this. I can get outbound email access through my school district's mailserver simply by filling in the appropriate fields in netscape (we have a WAN hooked up to a T1). It would seem to me that this would be rather secure for several reasons, if for no other than that NO logging is made... In a large district, like mine (probably 10-15 thousand potential users), I doubt they would have the resources to track any of the 100 or so Internet machines on my campus alone, even if they could tell it came from here. This Message Was Sent With An UNREGISTERED Version Of PMMail. Please Encourage Its Author To Register Their Copy Of PMMail. For More Information About PMMail And SouthSide Software's Other Products, Contact http://www.southsoft.com. ===================END FORWARDED MESSAGE=================== /* From Chris Adams <adamsc(a)io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5! The Enigman Group - We do Web Pages! */ This Message Was Sent With An UNREGISTERED Version Of PMMail. Please Encourage Its Author To Register Their Copy Of PMMail. For More Information About PMMail And SouthSide Software's Other Products, Contact http://www.southsoft.com.

1 0

ID this 31173 NCR keyboard
by unknown＠example.com 17 Dec '03

17 Dec '03

! At 05:46 PM 6/3/96 -0700, you wrote: ! >ncr terminals are the most 31173 D0Dz ! ! I'm guessing that "D0Dz" is a variant on "dudes"; ! is "31173" supposed to be an upside-down "ElliE"? ! Having worked at NCR, I like their cash-machines and cash-registers, ! dislike the Microchannels in some of their PCs, ! dislike the terminals they used to make (I think SunRiver ! is the current manufacturer for that product line) ! and like their Teradata descendants. ! # Thanks; Bill ! # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com ! # http://www.idiom.com/~wcs ! # Rescind Authority! Oops. I wrote that just looking at the keyboard. Picked it up at Seattle's Ex-Pc for $3. It's so old, I think it requires a non-PC BIOS. No manual, labels etc. Anyone have a clue as to what this is: NCR F1 F2 [...] F18 F19 F20/RESET| ESC [...] TAB |[five direction keys] CONTROL Q [...] }/] CONTROL |CLR 7 8 9 / CAPS_LOCK A [...] ~/` |NEW | - 4 5 6 * [up] |/\ Z [...] [upup] |LINE | + 1 2 3 |NEW [space] | 0_ 00 . |LINE It was designed for easily customizing your keytable, being an actual flat terminal with square keys easily pulled out and interchanged. The back of the keyboard has three switches for the boolean selection of languages: US English, UK/Int. English, French, German, Swedish/Finnish, Danish/Norwegian, Spanish, Italian. So, where to get a NEW keyboard like this: FLAT, with a full set of SQUARE, EASILY pulled out keys.

1 0

Senate Staff Report...
by Lile Elam 17 Dec '03

17 Dec '03

Hi all, Does anyone know the location on the web of the Senate staff report that was presented on some Wednesday? I read an article about it on the sjmercury that says people with computers do not consider security a high priority... I am curous what else the report says... thanks, -lile

1 0