December 2003 - cypherpunks-legacy

Re: [NOISE] Re: Nazis on the Net
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"richieb(a)teleport.com" "Rich Burroughs" 23-APR-1996 17:19:45.60 >On Tue, 23 Apr 1996, E. ALLEN SMITH wrote: >[snip] >> However, one reference in this report to Weaver's calling for a meeting >> to oppose the "Zionist Occupation Government" does provide an argument for >> calling him a racist of the anti-Semitic variety. On the other hand, the >> only person claiming this is the FBI's informant; the truth of his >> statements has been called into doubt. >I'm sure it has been. That doesn't mean his report is untrue. Is the >standard of proof the same for both of these issues? We need proof to >establish that Weaver is a racist, but not to establish that the FBI >informant is lying? I require a higher standard of proof for worse accusations. I consider calling someone a racist a worse insult than calling them a liar. Furthermore, that this is an FBI _informant_ is a strike against the person to begin with in terms of trustworthiness. >Separatist/supremacist... I don't see much difference between them, and I >believe the former is largely just a cover story for the latter. Weaver >is no hero, IMHO, though I believe the govt. fucked up big at Ruby Ridge. I don't approve of either separatists or supremacists; I just see the former as not quite as evil as the latter. Calling Weaver a supremacist is most common among the organizations that seem to believe that such actions as at Ruby Ridge are just fine, so long as they are against their enemies; it appears to be a public relations ploy (although the evidence is admittedly uncertain). I don't call Weaver a hero, either, but the most evil ones at Ruby Ridge were the governmental types. -Allen

2 1

Re: Nazis on the Net
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"nobody(a)REPLAY.COM" 23-APR-1996 18:33:53.11 [Neo-nazi holocaust revisionist bullshit deleted] My grandfather was among the people collecting the documents used at Nurenburg, and among those organizing the documents in question that were used in the trials. Look in the records for the Paris Documents Center, and you'll see his name - William H. Smith. (He would have been a major or a lieutenant colonel at the time, I believe). Anyone who tries to deny that the Holocaust happened - by which I mean that the Nazi government, probably with the complicity of the German people, comitted mass genocide, rape, and torture - is a fanatic, a moron, an ignoramus, or some combination of the above. It would have been better if the atomic bomb had been ready in time to use against Germany and Stalinist Russia. -Allen

1 0

RISKS: Java security/privacy bug
by stevenw＠best.com 17 Dec '03

17 Dec '03

>From RISKS: ---------------------------------------------------------------------- Date: Mon, 22 Apr 96 17:37:54 +0200 From: goldstei(a)iamexwi.unibe.ch (TERMINATOR) Subject: Java security/privacy bug We have found a privacy/security bug in the Java implementation of the Netscape Navigator. It is very easily possible for an applet to find out the pathname of the directory in which the Netscape Navigator was started. This information could then be sent back to a CGI program for logging. Clearly this information should not be available to an applet, as is indicated by the fact that applets are prevented from reading the "user.home" and "user.dir" system properties. When the Netscape Navigator is run under the Windows 95 OS, the pathname usually does not contain any critical information. However, when the Navigator is run under a multi-user network OS, such as UNIX, the pathname often contains the e-mail and/or login name of the user. In addition, the pathname might reveal details about the topology of the user's network, which an experienced hacker might be able to exploit. There are two ways to protect yourself from this problem: Either start up the Netscape Navigator in a directory whose pathname does not reveal any critical information, or disable Java altogether (Options | Security Preferences | General). A system administrator can protect his network by configuring the HTTP proxy server not to retrieve Java ".class" files. This bug is present in at least the following versions of the Navigator: 2.0 2.01 3.0b2 2.0GoldB1 2.01Gold and in the implementations for at least the following platforms: SunOS 4.1.2, 4.1.3, 4.1.4 SunOS 5.3, 5.4, 5.5 Windows 95, Windows NT IRIX 5.2, 5.3 HP-UX A.0903, A.0905 Linux 1.2.10, 1.2.13 FreeBSD 2.1.0-RELEASE OSF1 V3.2 We have not tested whether this bug also exists in Sun's HotJava browser. We will release full details of the bug as soon as Sun and Netscape have issued patches which fix the problem. Full details have been sent to Sun and Netscape. This announcements has also been posted to the "comp.lang.java" newsgroup and has been sent to CERT. Daniel Abplanalp and Stephan Goldstein (goldstei(a)iamexwi.unibe.ch) Berne, Switzerland ------------------------------ ------------------------------------------------------------------------- Steven Weller | Weller's three steps to Greatness: | 1. See what others cannot | 2. Think what others cannot stevenw(a)best.com | 3. Express what others cannot

1 0

Re: PEP Announcement (fwd)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Hey, Amos! Talk to me about using your spiffy chain-remailing script button with the new Eudora... It asks me for a directory in an open box now, and urps... Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/

2 1

Cashless Society and the Coming Collapse
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

http://www.jcave.com/~whedonr/news2.htm The Cashless Society The October 31 issue of Information Week featured an article on the October 13 acquisition of Intuit Inc. by Microsoft Corporation for 1.5 billion dollars. Their vision is to create a world where all financial transaction are performed electronically. "Microsoft's vision of the future is clearly a world in which the majority of consumer and business transactions will take place online". Other companies are also rushing to enter the electronic transaction market place. Soon, there will simply be no need for cash, everything will be done on line. Automatic debits and credits from your bank and credit accounts will be performed in a few milliseconds. You will be able to purchase nearly anything in the world from your home via the electronic transaction. (Since the original writing of this article, Microsoft did not receive approval to make this merger with Intuit. However, the vision of Microsoft stays the same). America is already now seeing a widespread use of the "intelligent" smart cards. These cards are being used for telecommunications, medical information purchases, identification, and more. Western Union now offers a smartcard that you can purchase to make long distance telephone calls. The military has been issuing smartcards for some time now to all of it's personnel. California is issuing smartcards to all recipients of state benefits, including Social Security and welfare benefits. The federal government is considering plans to implement a smartcard for it's 3.1 million members for payroll purposes. This proliferation of smartcards has not been without it's perceived benefits. However, this new technology has created another problem, namely security. The security offered by the smartcard is not sufficient. Fraud, theft and abuse of smartcard technology has prompted for many officials to call for a more secure and personal means of transactions. A single card, useable anywhere in the world is being considered. But even this presents problems with the issue of security and privacy. An improvement on smartcard technology is now being formulated. For several years, microchips have been tested in animals to learn their effects, efficiencies and drawbacks. This technology is now perfected for use in humans. Instead of carrying several different types of smartcards, credit cards and identification, we are soon to be offered a single implanted chip that can contain information about us that anybody ever needs to know. Not until the last few years, has technology advance to the point where implantation of a microchip was possible within human flesh. This is a fulfillment of prophecy, for the Bible says "And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their forehead" (Rev. 13:16). Only very recently has technology made it possible to make such a mark in human flesh. With the widespread usage of computers and databases, tracking individuals and every financial transaction has now become a reality. These tiny chips are already being produced by the millions and millions today for a variety of electronic devices, including smartcards. We are on the verge of having these chips implanted in every human being. Are you prepared to take your mark? The Coming Collapse Another deceptive lie being propagated by the government and the media is our economy. The rate of unemployed workers in this country is being reported to us at only 3%. However, many private sources of information have this number much higher, closer to 9-10%. Some goes so far as to say unemployement is really 20%! Our government cannot afford the bad publicity of a recession. Statistics prove that nearly every major corporation has been downsizing staff by the thousands and thousands. Nearly 1 million positions have been abolished since the first of the year. Yet in the face of all this, our government continues to tell us that our economy is booming. Our federal deficit is also much higher then is being commonly reported. Deficit spending under President Clinton is at an all time high. Simply put, our nation cannot afford to continue on it's present course of overspending. In a report presented to President Reagan, a commission of 31 Congressmen stated that the United States would experience a financial collapse by the year 2012. Some forecasted that this coming collapse would happen by the year 2005. Consumer debt in America is the highest consumer debt in the history of the world, bar none. Many Americans live off of credit cards, always getting deeper and deeper into debt. The media portrays a fictitious world where we can "afford" anything. And if we don't want to "buy, buy, buy", then we are somehow dysfunctional or inadequate. The average American family has to work two jobs just to make ends meet. While our purchasing power continues to decline for every dollar we earn, there's always something new to buy. We are beset by self centeredness, self grandizement and narcissistic "needs". In a never ending downward spiral, we chase the holy grail of material wealth, urged on by the prophets of the press. Financial ruin, broken families, despair, hopelessness and stress related disease are often the end results. Thousands turn to alternate realities, including drugs, alcohol, adulterous relationships and other means of "release" from these financial pressures. America has been teetering on the brink of a financial disaster, unparalleled in human history. Efforts to avoid this collapse include the establishment of a new monetary system, including the issuing of new money. Currently, entire caravans of this newly minted money are being distributed around the country. A national and international recall of $100 dollar bills was proposed by Senators Patrick Leahy and John Kerry. This recall may quite possibly trigger the greatest financial collapse the world has ever seen. This financial collapse could be triggered overnight when mass panic, fear and distrust in the new monetary system becomes widespread.

1 0

Re: RISKS: Compuserve "secure" login
by Bill Stewart 17 Dec '03

17 Dec '03

>Date: Thu, 04 Apr 1996 19:34:12 +0200 >From: Heinz-Bernd Eggenstein <eggenste(a)noether.informatik.uni-dortmund.de> >Subject: CompuServe's "secure login protocol": two steps forward, one back >Summary: a new CompuServe Information Service (CIS) logon protocol was >designed to prevent passive and active attacks (where the attacker >impersonates a CompuServe node) but a flawed implementation in the >WinCIM 2.0(.1) client software still allows active attacks. ... > .... HR=UR=MD5(S|Z|RA|RB|S) .... >I notified CIS about these weaknesses and I was informed that they are >"fixed" now, no details were given about the fix (source: Britta Herbst, >German customer support (11111.754(a)compuserve.com)) ... >I think this a good example how to half-ruin a good protocol by embedding it >into carelessly written code. In addition to the posted weaknesses (which were mainly implementation issues), there's another major problem with this - it means that the user's passwords have to be stored on the Host machine (or an authentication server) in _plaintext_, rather than storing a hash (e.g. like Unix passwords.) This means that if the host's password file is cracked, the entire system loses. You can do a little better than this by having the password file encrypted with a key which the login process / authentication server has, requiring theft/cracking of that key (difficult) as well as theft of the password file; the encryption could either be a symmetric-key system or public-key if you're willing to spend the decryption time, which CompuServe probably isn't. A couple years ago I found an obvious application of Diffie-Hellman which avoids this problem; unfortunately it turned out to be patented by someone from Siemens (first as a German patent and then a US patent, so it's definitely too much trouble to try to overturn the patent...) The basic approach is to use a commutative hash function, which lets both sides calculate HA(B) == HB(A) ; modular exponentiation worked fine. Of course, if you're allowing active attacks, there's always session hijacking... # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

2 1

Militias, reputation capital, unfounded rumor-mongering, and the DNS
by Rich Graves 17 Dec '03

17 Dec '03

Anatomy of a paranoid troll: http://fight-censorship.dementia.org/fight-censorship/dl?thread=FBI+monitor… Someone sent a message to Declan alleging that the FBI, with the cooperation of ISPs, was reading/disrupting/censoring the email of people interested in "patriot" movements. Declan said hmm, I can see the FBI doing that, and forwarded the message to fight-censorship. I pointed out that the story was complete bullshit, which is easily verified (yvv.com's incompetence in managing their DNS affects all users, including postmaster(a)yvv.com, not just the paranoid), but evidently my reputation capital on the moderated fight-censorship list is so low that instead of my objections, subscribers to the fight-censorship list got to read another, more paranoid rant. I do not expect this story to die, even though it's completely false -- it's too good. The meme in the subject line is awfully strong, lots of people won't take the time to read more than the title, and who really listens to a FUCKING STATIST anyway. Truth is indeed stranger than fiction, but seldom in the way you think. -rich

2 2

Re: You have been deleted
by attila 17 Dec '03

17 Dec '03

To: Black Unicorn <unicorn(a)schloss.li> From: attila <attila(a)primenet.com> Reply-To: attila <attila(a)primenet.com> Subject: Re: "You have been deleted" Addressed to: Black Unicorn <unicorn(a)schloss.li> Tim May <tcmay(a)got.net> ** Reply to note from Black Unicorn <unicorn(a)schloss.li> 04/24/96 03:01am -0400 = On Tue, 23 Apr 1996, Timothy C. May wrote: = = > its route and landed on my hill, abducting me for medical experiments I am = > too embarrassed to describe (except that Chelsea was also involved). I am = > back now, albeit subtly changed (for the better). = = That a medical experiment including Chelsea could improve a man is beyond = the bounds of reason. = = Mr. May, are you making this up? = attila sez: Not necessarily. it may be speculation or wishful thinking on the part of Chelsea, or even Bubba and Hillary. -- Obscenity is a crutch for inarticulate motherfuckers. Fuck the CDA! cc: Tim May <tcmay(a)got.net> Cypherpunks <cypherpunks(a)toad.com>

1 0

Anonymous banking
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Speaking of the below information, what is anonymous banking like in Austria, Colombia, Venezuela, and Thailand? -Allen >Copyright 1996 Nando.net >Copyright 1996 Reuter Information Service >VIENNA (Apr 24, 1996 11:18 a.m. EDT) - The United Nations, fighting a >rearguard action against illegal drugs and money laundering, on Wednesday >turned its fire on sloppy banking laws and called on all states to ban a>nonymous accounts. [...] >Experts say anonymous bank accounts are a safe haven for drugs money and >are an ideal vehicle for laundering cash. >They say the drugs trade must be attacked at its roots by cracking down on >transfers of narcotics-based "dirty money." [...] >Drug barons use a number of ruses including anonymous bank accounts and >specially set up front businesses, such as restaurants, to channel large >sums of money and obscure its origins. The money comes out "clean," or >laundered. >Helmut Butke, who chaired the meeting of the 53-member Commission of >Narcotic Drugs, said the United States was the main sponsor of the >resolution which seeks to streamline and increase international cooperation >against money laundering. >The draft resolution, which was shown to Reuters, "urges states to prohibit >banks and other financial institutions from offering accounts identified >only by a number, anonymous accounts or accounts in obviously false names." >It also urges states "to take all reasonable measures to ensure that such >institutions are informed of the identities of beneficial customers in all >transactions." [...] >Austria, the only country in the EU which allows anonymous bank accounts, >was adamant its current legislation did not run counter to the resolution. [...] >The Vienna government is clinging on to its banking system, saying the >accounts were useless for money laundering as they do not extend to >deposits over 200,000 schillings ($19,000). >But Washington last year ranked Austria alongside Colombia, Venezuela and >Thailand in a league table of nations that tolerate money laundering.

2 1

Re: arbiter/escrow agent for hire
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"bryce(a)digicash.com" 24-APR-1996 10:05:20.14 >1. Acceptable digital signature upon the "bet statement" >from each bettor. (Note that PGP signatures from PGP key >pairs which are not connected to me via the Web of Trust, or >which are not verifiable by me via an out-of-band >connection, are not acceptable digital signatures. This is >because of the MITM attack problem, not because I need True >Names to be connected to the signatures.) IIRC, currently Black Unicorn doesn't have any signatures on his public key of others. Therefore, this requirement, while understandable, could cause a bit of a difficulty in the current situation. >3. Amount of the bet from each bettor. This chunk of money >will be known as the "ante". Note that depending upon the >details of the "bet statement", each bettor may submit a >different ante. (Yes, up front. Yes, I get antes from both >bettors. Yes, I keep them while the bet is being settled. >Why do you think my fee is so low?) Chuckle. -Allen

8 15