December 2003 - cypherpunks-legacy

Hack MSN anyone?
by gorkab＠sanchez.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The names have been changed to protect the innocent... I need say no more I'm sure. - ---------- From: MSN Support JosephB Sent: Sunday, April 07, 1996 4:05 PM To: xxxxxxxxxx Subject: RE: Connection, Member ID: xxxxxxxxxx, Country: United States (1), Locale: English (United States) Yes, windows95 dialup networking uses compression to send the password when connecting. Thanks for using the Microsoft Network Joseph Beasley msn Member Support - ---------- From: xxxxxxxxxx Sent: Friday, April 05, 1996 5:57 PM To: MSN Member Communications Subject: Connection, Member ID: xxxxxxxxxx, Country: United States (1), Locale: English (United States) Ye[Ask Member Support] MemberID=xxxxxxxxxx Problem Description= Microsoft being security conscious and all, I would hope that when I connect to MSN over the Internet, that my MSN client has the decency to ENCRYPT my password when it sends it over the net, yes? This is the first time I couldn't get through to a dial-up connection and had to access MSN using my ISP. Having done so, I find it extrememly convenient, and would like to continue to do so. Thanks. xxxxxxxxxx -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMW18MRhOHC4UmUYJAQHxvAf+NXAoqm8RUIskjtODUE9MYA+0JRs6x8f9 SMD70zWDRpF7mSPB6QaJcWfnufK5VqynrQ6iHfoNO9rC2yRlmkV04Ce3QW2m1z6P NVgAayVofN0Cjd1vITgdrB1XB9u3PnjXUggyTBLnAprTy79dCQsiTgen/2YujsaV Tzx6Xt87CFS8GwQcKWj5VonTkFQVjOuQIa6GbcVwEFiqVaXp2tLf3RUHXBtJ8B0H nC4wecTyra6CW2AAqFVXXmwVGeDh87caSy4Y3oFEQ8mxgZHFxOZLUeLo3MdaE+nx 33Yl2VdsjxTIlkog1R8d+6A1VDqpVqAJzcdjKnPLm8Sivm9wdGgsag== =TSTX -----END PGP SIGNATURE-----

1 0

Re: On computer face recognition:
by David Loysen 17 Dec '03

17 Dec '03

At 10:02 PM 4/10/96 -0700, you wrote: > >On computer face recognition: > > >>> Shaving probably will not be a problem, but holding your head at a >>> slightly different angle... will screw up the system totally, >>> unless the system has radically improved since the last time I read >>> up on it. > >At 11:45 AM 4/9/96 -0500, K00l Secrets wrote: >> Well, the systems I have seen are quite good at finding people's eyes. >> Scaling (for distance), and rotation (for the angle of your head) >> therefore don't really confuse the system once it has your eyes. > >Finding the eyes can only control for rotations in the plane of >the image, when you tilt your head to one side. They cannot >handle the much more common case of 3D rotations, where you >look slightly to the right or slightly to the left of camera. >Facial expressions also throw them badly. > Take a peak at http://www.neci.nj.nec.com/homepages/lawrence/papers. One of Lawences papers is on using Neural networks to recognize faces. Methinks that the state of the art is advancing rapidly and such problems as not looking at the camera or changing your expression are rapidly being overcome. ===================================== dwl(a)hnc.com Zippity do da, zippity ah, my oh my what a wonderful day. Ya right, and hear I am without time to finish a cup of coffee.

1 0

Re: (political) Privacy, Regulatory Arbitrage, Free Speech
by Michael Froomkin 17 Dec '03

17 Dec '03

Thank you for the thoughtful comments. On Tue, 11 Apr 2000, Joseph M. Reagle Jr. wrote: > I just read your paper and had a couple quick comments, I used to think that > the Internet would be an ultimate promoter of liberal democratic values, > however given recent events in asian countries (which you mention) > particularly actions of China (which you didn't) I am not at all sure that > this will be the case -- of course, one can't prove these things, but I tend > to believe that China could actually clamp down on the freedom of speech > with respect to the following: I agree that the next draft should discuss China more. I think China could probably clamp down very effectively. I am not persuaded it could do so without giving up a very large share of the benefits of access. > > "Like it or not, we live now in an age of completely free speech..." I think > it would be very worthwhile to examine what is meant by "free speech." I > don't think free speech means, if I want, I could say what I want and no one alas, this is beyond the scope of this essay. There's a huge literature on this in the law reviews, though. [...] > > So perhaps the Internet shall provide a mechanism for practical free speech > (allowing some to speak their minds, and the others that get trapped will > get crushed) but it shouldn't be considered a subsitute for political free > speech (in which no one gets crushed). In the case of countries like China, I agree. It's not a substitute. Just an enabler in places that don't choose to practice draconian access control. > the hope is that the practical free speech will enable political free > speech, but based on news reports I am seeing this is less likely than I > used to think, and as you mention in the section of "Mobility of Personal > Data" the capability of this technology to abuse the citizens' and > customers' rights are also increasing, but their isn't an open mailing list > on which everyone can examine the conversation between the organizations > which wish to accomplish this. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

Re: Bank transactions on Internet
by stevenw＠best.com 17 Dec '03

17 Dec '03

On FPGAs: > And it is rather unlikely that one could make a high clock speed >high performance hardware based key cracker work without traditional >high speed logic debugging tools such as a fast logic analyzer (if we >are talking 5-10 ns clock especially) and a 1 ghz or so digital scope. >These kinds of gear, though sometimes available after hours to engineers >working for more liberal companies or schools, cost many thousands >of dollars and are not garden variety items available to any hacker. Probably not necessary. Simulators do just fine. And the FPGAs themselves top out at 50 to 80 MHz. > And finally, depending on the technology of the part being >used, there may be a significant cost in the order of at least hundreds >if not thousands of dollars for a specialized programmer capable of >programming ("burning") the FPGA with the interconnect patterns generated >by the software. These tend to either be specialized to one kind of >part and maybe modestly cheap (hundreds of dollars) or universal and >several thousands of dollars (such as DataIO gear). Easy to access. They are everywhere. The EPROMs are about $6 each and are serial. You could build a programmer at home. > And at least in my experiance (I may be unusually stupid and >careless and clumsy or may not be) even if the parts are a few times >reprogrammable (as CMOS FPGAs often are these days) one can assume >that one will fry, or break the pins off, or reprogram one time too >many the FPGA or FPGA's before one gets the design working. This >means that it would be realistic to assume several parts would be >consumed by the prototyping effort, they may not be cheap and this >adds up too. While there are OTP FPGAs out there (typocally Altera), many are in-circuit programmable *any* number of times since they use SRAM internally not EPROM cells to program the configuration. The latest twist on FPGAs is to add more RAM internally and have them reprogram themselves on the fly, hundreds of thousands of times a second. This cuts the logic requirements down for desidhns that don't need all of the logic all of the time. > So whilst someone working with these parts as part of their job >or schooling might well have access to all the required resources on an >informal basis and be able to build a key cracker in evenings or >weekends for little more than the cost of the chip and a PC board to >hold it, it should be realistically noted that the actual cost of >equiping a lab from scratch with the required resources is more on the >order of tens to hundreds of thousands of dollars rather than $400. True, but $400 is probably not far low. > I must hasten to add that high density FPGAs have many many >legitimate uses in prototyping logic and producing products in small >volumes too small to justify the tooling costs of doing mask programmed >gate arrays (which tend to be significantly faster and easier to design, >but cost $5-100K NRE to set up custom masks for fabrication). The >current generation of them make it possible to build logic systems in >one small chip that a few years ago would have been large PC boards >full of PALs and other logic. My employer uses FPGAs in all new designs for production. They are *very* common for products that sell into the thousands per year. Mask-programmed gate arrays have the major disadvantage of very long lead times, usually a more pressing requirement than saving $30 per board over several thousand boards. Companies now make boards that contain just FPGAs wired in a grid. They are sold as general-purpose logic engines with software to implement circuits as hardware simulations. I'm sure that these would do just fine, though they are costly. ------------------------------------------------------------------------- Steven Weller | Weller's three steps to Greatness: | 1. See what others cannot | 2. Think what others cannot stevenw(a)best.com | 3. Express what others cannot

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 02:51 PM 4/12/96 -0700, Alan Olsen wrote: >At 11:34 AM 4/12/96 -0500, Doug Hughes wrote: >> >>On Apr 12 at 8:07 >>jim bell wrote: >>> >>>Are you sure they're not referring to 8 bits of data and a parity bit? In >>>any case, please give the address to the list so that it can be checked out. >> >>Come on, give it up already and admit you were wrong. At least 8 different >>people have cited examples of machines that supported non 8bit bytes. Your >>pride is getting the best of you. > >Jim is unwilling to admit his errors, even in things he has little or no >training in. (I remember him claiming at one point that he was not a >programmer or did any coding for that matter. Why he continues to persist >in such things I will not speculate on...) What I meant was the most honest answer I could give: I am not a professional programmer. I have programmed, in APL, Fortran, Algol, PL/1, Pascal, and I can read BASIC's well enough, but not recently.

1 0

Re: PEP Announcement (fwd)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 2:28 PM 4/10/96, Black Unicorn wrote: > This showed up in my mailbox: <snip> > PEP: Pretty Easy Privacy, a set of scripts for OneClick that integrate > Eudora and MacPGP are now available in the latest Button Circle release >at: > ><ftp://ftp.westcodesoft.com/pub/westcode/Contributions/OCButtonCircleMarch9 >6.sit > .hqx> I'm using it. I actually went out and bought OneClick to do so, mostly because I wanted to mess around with scripts for other things and OneClick looks pretty painless to use. PEP works pretty much as advertised, except that the finger operations take too long for my ISP to execute sometimes, and evidently the finger events in Eudora aren't robust enough to wait for the operations to complete, so a "wait" has to run. The work-around is to manually do the finger instensive "get cypherpunks remailer names" and "get remailer-keys" operations with eudora, copy the results, and then run the scripts. Anyway, I bashed on it, and PGP, a bit, and now there's a palette when I use Eudora which I can click to do chained remails, which I was never really able to do before. It also does signs, which are fine, and encrypts, which are also fine, but the decrypts come up in the PGP window, which is crypto-correct, I suppose, but I like the dump-it-into-it's-own-mail-window result of the original OSA scripts which come with MacPGP. This is useful if you actually want to reply to an encrypted mail message. One of the other things that is nice about the original MacPGP scripts is that they automatically verify signatures on decryption, and, at the same time, they also automagically add any attached keys to your keyring, pending certification, etc. Anyway, if you have OneClick already, then PEP is a way cool thing to have. Here. I'll sign this message with it. Cheers, Bob Hettinga -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMWwYUvgyLN8bw6ZVAQEUKgP/eXQsCS/AaAj07s9PAX07j5WcXCXDGvpF RxDSLqJNA3wOcU3QKrDc/T0HfzQELM/RbjOvDy7XPWUwxEN/SUTfRzAekYtJ6RbM 2w3CDYtNsdXyv4yyrgNF1eIjs+IecYYrCBeXJcvHn6fRwEbVBr+yFgXIprjfeEZ9 of/IGHDE0Qc= =bshY -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Lotus Notes 24-bit sellout
by Jerry Whiting 17 Dec '03

17 Dec '03

When Ray Ozzie announced the work reduction sellout at the RSA conference, both he and Ms Denning (whom I spoke with about it later) mentioned that there was something else in Lotus Notes 4 besides the 40+24 bit compromise. My thought is that the NSA gave them something else in exchange for the mandatory escrow scheme they're all talking about publicly. Perhaps some other crypto code the NSA had lying around unused. So looking for a common 24-bit subkey may reduce Notes' key to a 40-bit brute force exercise but the 40+24 is probably not ALL that's in Notes 4. Definitely a deal with the Devil. Given that we're talking about IBM, not Lotus none of this surprises me given IBM's Lucifer/DES history with spook input years ago. Then again to be fair, I don't know if the 40+24 deal was cooked up before or after the IBM/Lotus merger. Jerry Whiting Azalea Software, Inc. P.S. Yes, I'm the one doing carrick "Encryption software so good, the Feds won't let us export it." In fact, we schedule for a visit from the NSA next month regarding our desire to export carrick to Australia. The mere mention of a Blowfish-based crypto product left my assigned spook momentarly speechless. Something tells me they ain't gonna let carrick out of the country with a key length worth using. AND I DEFINITELY AIN'T INTERSTED IN MAKING A DEAL WITH THE DEVIL.

2 1

Re: "Contempt" charges likely to increase
by jim bell 17 Dec '03

17 Dec '03

At 07:59 PM 4/12/96 -0400, Black Unicorn wrote: >On Fri, 12 Apr 1996, E. ALLEN SMITH wrote: >> >I might add that the Cayman Islands are full of trust companies with >> >provisions which forbid the disclosure of data to a client who is >> >coerced. A law on the books refuses to recognize "consent" orders made >> >under judicial compulsion. This would give the appearance of total >> >unavailability of evidence and suggest the futility of contempt >> >charges. Yet courts have still, and with no small measure of success, >> >imposed sanctions on witnesses so protected. >> >> What measure of success? Getting the data, or locking up the witness? >> -Allen > >Getting the data. If the IRS or a private plaintiff wants it bad enough, >they can usually get their hands on it, or at least find out where it is. > >The government of the United States doesn't play "fair" when they want >something. But if the government of the United States does play "fair," then why can we not play "fair" and kill their agents who violate what we feel is our rights? After all, the government is merely the representative of the people (at least in theory!) and it 'must' follow the rules (laws, Constitution, etc). To whatever extent it exceeds those limits, and to whatever extent the public can't get justice to prevent those violations, why would the public be obligated to accept them? To believe otherwise is to believe that the government has some sort of special dispensation to violate the law. I don't believe this; it wouldn't surprise me to hear that you do, however. Which is it? Jim Bell

2 1

Re: No matter where you go, there they are.
by David Lesher 17 Dec '03

17 Dec '03

I asked a friend charged with spending money in this area. Here's his reactions, and those of someone he consulted: ================== ..There is a business case flaw in the proposal. The scheme as laid out only provides a high confidence factor on the users location (+- 10M), NOT on the actual identity of the user. Thus it would have to be coupled with some other form of I&A. The business question then arises, is the confidence delta provided by this scheme consistent with the cost delta? My first take is that the answer is no. =================== Re spoofing the system. If you think about the geometry of the problem, the delay to be induced for each satellite is a time varying function of the satellite's position, the reference site, and the target. It will vary from positive to negative values for many satellite passes. It can be precomputed, but the precomputed adjustment will be in error by some amount due to the orbital perturbations mentioned in the original article. The most common prediction error is the in-track postion, which inconveniently for the predictor has the greatest effect on one's ability to calculate the right delays. Anyone with access to a decent orbital prediction code and access to the statistics on orbital perturbations should be able to calculate the expected delay prediction error as a result of the orbital uncertainties. If the delay prediction errors are detectable, then it seems the system is secure after all, allthough other reservations on operational suitability might still apply. Note that the sensitivity is a function of the distance between the reference site and the target. If you could collect your reference signal across the street from the target, it would make spoofing a lot easier. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: washington post notices archives
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:39 PM 4/11/96, Andrew K. Bressen wrote: >we here at HKS.net have today received a cease and desist >letter from the washington post regarding editorial copy >of theirs that was evidently posted to c'punks and then >abosrbed into our c'punk archives. > >Once the archives are restored (RSN) we'll probably manually edit out >the messages from the archive. We're trying to get the post to give us Several relevant points for lists like ours: 1. Expect more and more of these sorts of copyright "cease and desist" (or, as I like to say, "decease and cyst") orders, as newspapers and magazines use search engines to find their stuff. Expect some "automated searches" to be done routinely, even offered as services by third parties. ("Find infringing copies...make $1000 a week in your spare time.") 2. What does removal of infringing articles mean for follow-ups? If I reference a WSJ or NYT article that someone has quoted or forwarded, is my follow-up expunged also? 3. And what of the "Cypherpunks Archives on CD-ROM"? Too late to simply remove a single article...does the entire production run go into the landfill? (I haven't heard much about the "enthusiasm du jour" of the "Cypherpunks CD-ROM," but this always been a concern, that legal issues would have to be resolved, including the getting of releases from several hundred or more parties.) 4. Suppose the HKS archives were actually offshore, in the Cayman Islands or in some place that doesn't recognize copyright law in the same way most Western or Berne Convention countries do? 5. Suppose access to such archives is done via Web remailers, and the location is not easily determinable? (To be sure, lots of hits means traffic analysis will reveal the location....the same general problem with "reply-blocks," of course.) It sounds like the Washington Post is discovering the brave new world. Expect an article or two on this. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0