December 2003 - cypherpunks-legacy

Re: NYT on MS Java, Net Radio
by Hal 17 Dec '03

17 Dec '03

From: John Young <jya(a)pipeline.com> > "Edge for Sun as Microsoft Embraces Java." > > By John Markoff > > http://www.nytimes.com/library/cyber/week/0425license.html >From the article: > SAN FRANCISCO -- Sun Microsystems Inc., already a stock-market favorite > on the strength of its Internet products, has secured a significant > endorsement from Microsoft Corp., which plans to announce next week > that it will incorporate Sun's Java software programming language into > the Microsoft Windows 95 personal computer operating system. > The companies would not comment, but industry executives said > Microsoft, whose Windows operating system is used on some 80 percent of > the world's PCs, will join IBM and Novell, among other companies, in > announcing plans to embed Java into their software operating systems. > Those moves, and the possibility of a similar endorsement by Apple > Computer Inc., should go a long way toward making Java an industry > software standard in the rapidly expanding Internet market. In other Java news, the report from the Princeton scientists who have found many security weaknesses in Java is now available at <URL: http://www.cs.princeton.edu/sip/pub/secure96.html >. It is very critical of the language design and implementation. I don't fully agree with the thrust of their criticisms, because I don't think provability is a practical matter with programs complex enough to be useful. But they have certainly identified an alarming number of problems. I will post later today a list of the issues they have identified. Hal

1 0

Re: Golden Key Campaign
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:22 PM 4/24/96 -0700, Wei Dai <weidai(a)eskimo.com> wrote: >On Wed, 24 Apr 1996, Hal wrote: >You can do signatures with Rabin too. I have a version of it in >Crypto++ 2.0. It's been out for a while and RSA hasn't bothered me about >it. >Does anyone want to explain why, given the alternatives, people continue >to use RSA and pay for it? Sure. Because 1) it's a good algorithm for the job, 2) we've learned it, and have a PGP base behind our inertia, 3) The legalities of RSA are well-defined, 4) the Stanford patents mostly run out in 1997, unless Roger's suit succeeds first, 5) the price of RSA is fairly low, once free RSAREF came out 6) the price of licensing Cylink patents is high and/or unpredictable # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

2 1

[PASSWD] good MCI password..."1234"?
by Dave Del Torto 17 Dec '03

17 Dec '03

[from RISKS 18.06] ................................. cut here ................................. Date: 19 Apr 1996 21:07:06 GMT From: chadm(a)unhinged.engr.sgi.com (Chad Ray McDaniel) Subject: MCI recommending bad security practices Taking advantage of yet another incentive offer, I recently switched my long distance carrier to MCI. They sent me the standard yet-another-piece-of-plastic-to-stick-in-my-wallet calling cards. The way these cards work is that you call an 1-800 number and type in your code consisting of your phone number followed by your PIN (Personal Identification Number) which happens to be printed on the card. Enclosed with the cards was a piece of paper in which MCI wisely suggests that you change your PIN to something other than what they assigned to you and printed on the card: Customizing your PIN Choosing your own four-digit number is the best way to assure you'll never forget your PIN. Make it the month and year of a loved one's birthday or use the same password you have for your voice mail or computer. We'll quickly replace the PIN we assigned you with any four digits you choose - just call 1-800-476-7306 For some strange reason MCI is recommending you to do exactly the opposite of what good security practices would proscribe! Not only do they suggest that you use an easily-breakable password such as an important date, but they recommend a practice that would weaken the security of potentially more sensitive information in a voice-mail or computer system. Of course, what probably prompted note from MCI was a desire to prevent MCI's customer service department from being inundated with calls from people who forgot their PINs. This alludes to the associated risk of requiring people to remember Yet Another Password (YAP). -chad

1 0

NYT on MS Java, Net Radio
by John Young 17 Dec '03

17 Dec '03

April 25, 1996 "Edge for Sun as Microsoft Embraces Java." By John Markoff http://www.nytimes.com/library/cyber/week/0425license.html ---------- "FCC Backs Cheap Link to Internet by Radio." By Edmund L. Andrews http://www.nytimes.com/library/cyber/week/0425radio.html

1 0

Re: [NOISE] Re: Nazis on the Net
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

EALLENSMITH(a)ocelot.Rutgers.EDU writes: | Abraham Lincoln is one reason I _don't_ use the above definition; by mine, | he'd be a separatist (wanted to move Blacks to Liberia, if I recall correctly). | I trust that everyone involved in this discussion (with the exception of the | neo-Nazi) would agree that Abraham Lincoln was better than those in the South | who wanted to keep blacks enslaved? Do we have a neo-Nazi in this discussion?? Are you implying that any sceptic of a few Holocaust `facts' is a neo-Nazi?? Do you infer that all pro-lifers are Republicans?? It is because of such baseless inferences, I have to remain anonymous. I would dearly love to debate under my real name, but am prevented from doing so by the neo-Nazi name-calling. Yes you are correct, I disagree that Abraham Lincoln was better than those in the South, not for racial reasons (remember, the Civil War was *not* about slavery, because the slavery issue only arised *after* the war started), but because I believe that a diverse set of countries is `better' than one. I believe that countries that want independence (such as Chechnya) should have it. (Yes, I am likening Abe Lincoln to Boris Yeltsin). [ You may also like to consider that blacks as well as whites fought for the South. ] --- ``The believer is happy. The doubter is wise''. - Hungarian proverb

3 2

International Capital Flows Called Criminal
by Duncan Frissell 17 Dec '03

17 Dec '03

Financial Times, April 24, 1996, p. 8. US prosecutor attacks bank secrecy laws By Clay Harris Mr John Moscow, assistant district attorney for Manhattan: "Bank secrecy statutes in international finance are used by crooks, tax evaders, securities fraudsters, and capital flight fellows; they are used by narcotics dealers. But they are not needed by honest folks engaged in honest transactions." Now the last time I looked, 'Capital Flight' was as legal as church on a Sunday. Or is this a proposal for exchange controls. Is this guy a state or federal prosecutor? He was also unable to come up with legitimate reasons for $3 Billion to go from Egypt to the Bahamas. I can think of any one of a number of legal reasons, one being "International Tax Planning." DCF

1 0

RE: Mindshare and Java
by Blake Coverett 17 Dec '03

17 Dec '03

> I agree that the major innovation, and cypherpunk opportunity, of Java is > in its cross-platform nature, not its vaunted ability to run untrusted > code safely. I'm sorry, I'm just not interested in running untrusted code. > Give me digitally signed code that I can trust, or for which the author > can at least be held accountable, and I'll be happy. Absolutely! > As cool as many of the people on the Java team are, though, I am dubious > that Java is going to live up to the hype. It is still not clear to me > that Microsoft is going to support it seriously in their browser, which by > mid-1997 will be so tightly integrated with the lowest-common-denominator > operating system that there will be no room for Netscape. There was an official announcement at their Professional Developers Conference a few weeks back. In short, full support in the browsers (and apparently MS is now the keeper of the reference implementation on Win32) and also a full blown Java development environment code-named 'Jakarta'. -Blake

2 1

Re: arbiter/escrow agent for hire
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 0:23 4/25/96, Rich Graves wrote [paraphrased] >So are there any arbiters out there who would deal in non-digital cash? Or >someone who would convert US$ to Ecash for a smalle fee? I will be happy to do USD to Ecash conversions for a nominal fee. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

An idea for refining penet-style anonymous servers
by abostick＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Does the world need to have the anon.penet.fi model of anonymous email and news posting refined, given the existence of Cypherpunks remailers and Mixmaster digital mixes, not to mention nymservers? I will listen respectfully to the arguments of the people who say "no", and they're very likely right. But penet *is* the most widely used means of anonymous communication on the Internet - largely because of its ease of use compared to genuinely secure remailers and mixes. The other night, while sick and feverish with the flu, a scheme popped into my head that would seem to make penet-style anonymous servers less vulnerable to compromise through seizure of the remailer equipment or of the address database. In the cold light of day and normal temperature, it still seems like a sound idea to me, and I wondered what other people would think of it. My scheme is the design of the address database. It consists of two hash tables, one for sending messages (which maps anonymous IDs onto sender's addresses), and one for receiving them (mapping recipient's addresses onto anonymous IDs). A cryptographically secure hash (say, MD5) is used for the index of both tables. The index of the sending message table is the MD5 hash of the sender's address. The table entry the index points to is the sender's anonymous ID, encrypted by a symmetric algorithm (maybe IDEA). The encryption key would be a different hash, by another algorithm (let's suppose it's SHA), of that same address. In forwarding a message, the server MD5-hashes the sender's address and looks at the table. If it doesn't find a corresponding entry, it creates one. If it *does* find an entry, it SHA-hashes the sender's address and uses this key to decrypt the anonymous ID. In the unlikely event of collision the decrypted ID will be gibberish and the server does something sensible (like appending padding to the address and trying again). The header information is filtered and the anonymous ID inserted in the From: line. The receiving message hash table is designed similarly, in reverse. The index of the hash table is the MD5 hash of the anonymous ID; the entry in the table is the recipient's email address, encrypted with the SHA hash of the anonymous ID. When a message comes in, the anon ID is hashed and looked up in the table. If nothing is found, the message is bounced. If an entry is found, the anon ID is SHA hashed and the table entry decrypted. If it is gibberish, a collision has taken place and handled appropriately. The message is then forwarded to its intended recipient. What all this accomplishes is to obscure more information from attackers and from honest operators. In the event of abuse it is a simple matter to find out who the abusers are and block them out. If the operator is subject to subpoena, anyone named in the subpoena can be easily identified . . . *but nobody else can!* Authorities cannot use a search for one identity as an excuse for a fishing expedition in the address database. (Obscuring information from honest operators can protect the operator when questions of liability or even conspiracy come up.) There is a way that attackers who have seized or copied the database can search it - by trying it out on anonymous IDs, or user addresses, until they hit paydirt. And of course such an anonymous server can be no more trustworthy than its operator; and the fundamental security limitations of the penet-style anonymous server are well-understood. So what do people think of this scheme of mine? Are there drawbacks or weaknesses that I'm not seeing? Is it a good idea? I'd really like it if *something* good came out of being laid up with the flu. - -- Alan Bostick | They say in online country there is no middle way mailto:abostick@netcom.com | You'll either be a Usenet man or a thug for the CDA news:alt.grelb | Simon Spero (after Tom Glazer) http://www.alumni.caltech.edu/~abostick -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMX+n0OVevBgtmhnpAQFkrwL+N+CklsLNsqHXNPnCOs1mogNydNnCtvGs cUqK9rG3xpTYFsPMH6lhWq8wfPfKtQ88xs3RC/JE8ypcDZBugifNDf7hTuGeLZ8n Q8RDvnAq0qNz9rxqHiMuyOQ3kf6YEVys =g5SU -----END PGP SIGNATURE-----

5 4

Re: Anonymous banking
by rkmoore＠iol.ie 17 Dec '03

17 Dec '03

4/24/96, E. ALLEN SMITH wrote: >>But Washington last year ranked Austria alongside Colombia, Venezuela and >>Thailand in a league table of nations that tolerate money laundering. Ha ha! The U.S. and Panama probably exceed all of the above in laundering, but of course the USA/CIA doesn't notice those, since they're "in the family". -rkm

1 0