December 2003 - cypherpunks-legacy

Re: Fingerprinting annoyance
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"unicorn(a)schloss.li" "Black Unicorn" 15-MAY-1996 19:40:34.88 >It means essentially the IRS and banks. Even banks have little recourse. >They make you sign a piece of paper that says you gave them the right SSN, >but practically speaking no one cares. >Equifax (a credit reporting agency) refuses to take bank records as >evidence of SSN's because they KNOW the banks don't care or enforce and >that people lie to or make mistakes to the bank on a daily basis. Fascinating. I would think the IRS would care - that's how they know how to tax interest. They don't put any pressure on the banks to get the right one? I seem to recall showing the bank a driver's license or some such with a SSN on it the last time I opened an interest-bearing account. As I recall, government branches are authorized to get SSNs - if they show you the privacy act paperwork. If they forget, I would suppose that lying to them is perfectly permissible. What about if they do? -Allen

1 0

Re: Any DLL's that handle Public Key Encryption or Key Exchange?
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Tall men in dark suits made draven(a)infi.net (Greg Morgan) write: >I'm in the process of writing a freeware IRC client in Visual Basic 3 and >wanted to encorporate a secure variant of DCC chat. Trouble is I can't find a >precompiled library that has either RSA or DH in it. This doesn't do me much >good as I don't even own a Windows C compiler... (is that a crime in some >countries? :) ) The next release of my encryption library (currently available as ftp://garbo.uwasa.fi/pc/security/crypl110.zip) will contain a nice fast RSA implementation. It includes 16 and 32-bit DLL's. Actually the current version has support for it, but I took out the code because the key management routines weren't ready yet. There are two things worth noting, the first is that RSA itself isn't much use without a *lot* of key management code (which is what's holding up the RSA-enabled version). The second is that if you're in the US you're probably going to run into legal hassles using this code unless someone wants to do an alternative RSAREF implementation which you can plug in in place of the existing RSA code. Peter.

1 0

Re: The Crisis with Remailers
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:37 PM 5/15/96 -0700, Timothy C. May wrote: >A much richer ecology of remailers is sorely needed. A factor of at least >10 or 20 more (100-300 remailer sites), less reliance on specific sites, an >"everyone a remailer" capability (which has many elegant advantages!), more >traffic, temporarily instantiated sites, digital postage, greater ease of >use (especially with crypto and chaining), and such things as nominal >terminal remailers choosing to add their own hops (so as to lessen their >own target potential). Having some of these improvements will be a big >help. Perhaps what is needed is a non-profit, charitable 501c foundation to encourage anonymous communication. Those who support the idea could make tax deductible contributions which would be used for grants, public education etc. etc. to encourage anonymous communication. It could be called, "The Federalist Foundation" because the Federalist Papers were published anonymously. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Defeating fingerprints
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > With regards to filling in your own card, what about using a disappearing > ink?? Then your prints would disappear! You could even do your name, > right infront of them, and it would disappear, leaving these anynonomous > prints behind!! While the ink does become transparent/translucent I am shure the FBI chem lab won't have a problem finding traces of the chemical. This would make for jim dandy evidence in court. > Or you could make an inkpad that is damp with sodium hydroxide (lye) > instead of ink. That way, you could lightly roll your fingers in it, > like it was ink, and then wait a minute, and wipe it off. That way, the > only skin being eaten away, would be the ridges of the fingerprints. Do > this enought times, and the rigdes will end up the same height as the > valleys, and will then essentially be flat. Burglars and safecrackers sand the ridges off. Jim Choate

5 5

(Fwd) New Anonymous Remailer
by David E. Smith 17 Dec '03

17 Dec '03

------- Forwarded Message Follows ------- From: privacy(a)interlink-bbs.com Subject: New Anonymous Remailer Date: Wed, 15 May 1996 06:34:02 GMT To: info-pascal(a)ARL.MIL You may be familiar with anon.penet.fi, which give you an anonymous account. Our service allows YOU to choose what the return address will be! Please write for more info.

4 3

Re: Past one terabit/second on fiber
by jim bell 17 Dec '03

17 Dec '03

At 11:10 AM 5/15/96 -0400, brian dodds wrote: >On Tue, 14 May 1996, jim bell wrote: > >> But with >> fiber transmission probably less than 1/100th the cost of older coaxial >> transmission systems, per connection, it is unclear why they're even >> continuing to meter LD phone calls. > >especially when 1Tb fiber is in practice - our phone calls will take only >nanoseconds! :) Reminds me of an old joke: "This computer's so fast it does an infinite loop in 5 seconds!" >anything included in that as to why they used a dfb laser for channel 16? >or is it something obvious i'm missing? They probably just wanted to establish that it could be done, to show that this wasn't dependant on high-cost laser systems. External cavity lasers raise cost and size substantially, but in a laboratory setting they're the most convenient to use. >i notice they're still using the encyclopedia/second benchmark.. It's an old habit, I suppose. It's hard to explain "one trillion", at least to non-tech types. A good modern replacement might be to say, "200 CDROM's per second", except that even today most people don't know how much storage a CDROM represents. "16 million one-way phone calls" is also helpful as a benchmark. Jim Bell jimbell(a)pacifier.com

2 1

Java & signed applets
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

This has some mention of signed applets et al, so I thought it was applicable. -Allen From: IN%"rre(a)weber.ucsd.edu" 11-MAY-1996 23:06:27.24 From: Phil Agre <pagre(a)weber.ucsd.edu> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Sat, 11 May 1996 15:59:13 -0400 (EDT) From: "Home Page Press, Inc." <staff(a)hpp.com> To: staff(a)hpp.com Subject: JAVA BLACK WIDOWS - SUN DECLARES WAR JAVA BLACK WIDOWS - SUN DECLARES WAR Sun Microsystems' has declared war on Black Widow Java applets on the Web. This is the message from Sun in response to an extensive Online Business Consultant (OBC/May 96) investigation into Java security. OBC's investigation and report was prompted after renowned academics, scientists and hackers announced Java applets downloaded from the WWW presented grave security risks for users. Java Black Widow applets are hostile, malicious traps set by cyberthugs out to snare surfing prey, using Java as their technology. OBC received a deluge of letters asking for facts after OBC announced a group of scientists from Princeton University, Drew Dean, Edward Felten and Dan Wallach, published a paper declaring "The Java system in its current form cannot easily be made secure." The paper can be retrieved at http://www.cs.princeton.edu/sip/pub/secure96.html. Further probing by OBC found that innocent surfers on the Web who download Java applets into Netscape's Navigator and Sun's HotJava browser, risk having "hostile" applets interfere with their computers (consuming RAM and CPU cycles). It was also discovered applets could connect to a third party on the Internet and, without the PC owner's knowledge, upload sensitive information from the user's computer. Even the most sophisticated firewalls can be penetrated . . . "because the attack is launched from behind the firewall," said the Princeton scientists. One reader said, "I had no idea that it was possible to stumble on Web sites that could launch an attack on a browser." Another said, "If this is allowed to get out of hand it will drive people away from the Web. Sun must allay fears." The response to the Home Page Press hostile applet survey led to the analogy of Black Widow; that the Web was a dangerous place where "black widows" lurked to snare innocent surfers. As a result the Princeton group and OBC recommended users should "switch off" Java support in their Netscape Navigator browsers. OBC felt that Sun and Netscape had still to come clean on the security issues. But according to Netscape's Product Manager, Platform, Steve Thomas, "Netscape wishes to make it clear that all known security problems with the Navigator Java and JavaScript environment are fixed in Navigator version 2.02." However, to date, Netscape has not answered OBC's direct questions regarding a patch for its earlier versions of Navigator that supported Java . . . the equivalent of a product recall in the 3D world. Netscape admits that flaws in its browsers from version 2.00 upwards were related to the Java security problems, but these browsers are still in use and can be bought from stores such as CompUSA and Cosco. A floor manager at CompUSA, who asked not to be named, said "its news to him that we are selling defective software. The Navigator walks off our floor at $34 a pop." OBC advised Netscape the defective software was still selling at software outlets around the world and asked Netscape what action was going to be taken in this regard. Netscape has come under fire recently for its policy of not releasing patches to software defects; but rather forcing users to download new versions. Users report this task to be a huge waste of time and resources because each download consists of several Mbytes. As such defective Navigators don't get patched. OBC also interviewed Sun's JavaSoft security guru, Ms. Marianne Mueller, who said "we are taking security very seriously and working on it very hard." Mueller said the tenet that Java had to be re-written from scratch or scrapped "is an oversimplification of the challenge of running executable content safely on the web. Security is hard and subtle, and trying to build a secure "sandbox" [paradigm] for running untrusted downloaded applets on the web is hard." Ms. Mueller says Sun, together with their JavaSoft (Sun's Java division) partners, have proposed a "sandbox model" for security in which "we define a set of policies that restrict what applets can and cannot do---these are the boundaries of the sandbox. We implement boundary checks---when an applet tries to cross the boundary, we check whether or not it's allowed to. If it's allowed to, then the applet is allowed on its way. If not, the system throws a security exception. "The 'deciding whether or not to allow the boundary to be crossed' is the research area that I believe the Princeton people are working on," said Mueller. "One way to allow applets additional flexibility is if the applet is signed (for example, has a digital signature so that the identity of the applet's distributor can be verified via a Certificate Authority) then allow the applet more flexibility. "There are two approaches: One approach is to let the signed applet do anything. A second approach is to do something more complex and more subtle, and only allow the applet particular specified capabilities. Expressing and granting capabilities can be done in a variety of ways. "Denial of service is traditionally considered one of the hardest security problems, from a practical point of view. As [Java's creator] James Gosling says, it's hard to tell the difference between an MPEG decompressor and a hostile applet that consumes too many resources! But recognizing the difficulty of the problem is not the same as 'passing the buck.' We are working on ways to better monitor and control the use (or abuse) of resources by Java classes. We could try to enforce some resource limits, for example. These are things we are investigating. "In addition, we could put mechanisms in place so that user interface people (like people who do Web browsers) could add 'applet monitors' so that browser users could at least see what is running in their browser, and kill off stray applets. This kind of user interface friendliness (letting a user kill of an applet) is only useful if the applet hasn't already grabbed all the resources, of course." The experts don't believe that the problem of black widows and hostile applets is going to go away in a hurry. In fact it may get worse. The hackers believe that when Microsoft releases Internet Explorer 3.00 with support for Java, Visual Basic scripting and the added power of its ActiveX technology, the security problem will become worse. "There is opportunity for abuse, and it will become an enormous problem," said Stephen Cobb, Director of Special Projects for the National Computer Security Association (NCSA). "For example, OLE technology from Microsoft [ActiveX] has even deeper access to a computer than Java does." JavaSoft's security guru Mueller agreed on the abuse issue: "It's going to be a process of education for people to understand the difference between a rude applet, and a serious security bug, and a theoretical security bug, and an inconsequential security-related bug. In the case of hostile applets, people will learn about nasty/rude applet pages, and those pages won't be visited. I understand that new users of the Web often feel they don't know where they're going when they point and click, but people do get a good feel for how it works, pretty quickly, and I actually think most users of the Web can deal with the knowledge that not every page on the web is necessarily one they'd want to visit. Security on the web in some sense isn't all that different from security in ordinary life. At some level, common sense does come into play. "Many people feel that Java is a good tool for building more secure applications. I like to say that Java raises the bar for security on the Internet. We're trying to do something that is not necessarily easy, but that doesn't mean it isn't worth trying to do. In fact it may be worth trying to do because it isn't easy. People are interested in seeing the software industry evolve towards more robust software---that's the feedback I get from folks on the Net." # # # The report above may be reprinted with credit provided as follows: Home Page Press, Inc., http://www.hpp.com and Online Business Consultant Please refer to the HPP Web site for additional information about Java and OBC. =========================================================== ............Home Page Press, Inc. http://www.hpp.com home of Go.Fetch ........Free TEXT version - Online Business Today email: obt.text(a)hpp.com ....Free PDF version - Online Business Today email: obt.pdf(a)hpp.com OBC / Online Business Consultant, $595/year email: obc(a)hpp.com

3 2

Securing CDROM from piracy
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

We have developed a multimedia resource that will be cut on a CD-ROM for retailling. Since we don't have our own distributers newtwork we will be collobarating with another firm for distribution. Is there any way of making sure that the guy doesnt pull a fast on on us? Can we ensure that he cannot duplicate the thing and start selling it without sharing the profit. Or alternatively is there any protocol we could follow that will ensure a fair game? Vipul -- .od8888bo. \|/ .d%::::88::888b. (@ @) .d888::::::::8:888%. ------------------oOO-(_)-OOo----------------- 88888:::::::88888::%. You walk across with your flowers in your hand d888888:::88;888888::b Trying to tell me no one understands 888888888:888888888888 Trade in your hours for a hand full of dimes Y8888888::::::888888%P Gonna make it baby in our prime. '8888888:::::::8888:%' ---------------------------------------------- '88888888:::888888%' Vipul Ved Prakash Fax : +91-11-3328849 '8888888::88888%' Positive Ideas. Internet : vipul(a)pobox.com '"Y88%B8P"' ----------------------------------------------

4 3

Re: crosspost re remailers
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 10:30 PM 5/14/96 -0700, Rich Graves wrote: > > I'd have thought that a remailer going down > > because of political/legal pressure would raise more of a ruckus. At 11:02 AM 5/15/96 -0700, Bill Frantz wrote: > I thought the statement that remailers are supposed to be ephemeral > and common was the answer. Exactly so: Some nyms are valuable, most are valueless by design. All remailers should be valueless by design. The penet.fi remailer design is unsatisfactory precisely because it penet.fi is valuable, hence a target. If it gets shut down a lot of people lose their nyms, causing much inconvenience. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

RE: Why does the state still stand:
by blanc 17 Dec '03

17 Dec '03

From: Hal [on the idea of companies operating fully anonymously] It might be interesting to make a list of all the problems people can think of why this idea won't work, paired with proposed solutions and workarounds - sort of a mini FAQ for this important (some might say ultimate) cypherpunk model. ..................................................................... I think this is a much needed discussion - in particular as it comes at a time when Uni is is "somewhat disconcerted" at the defeatist attitude of some cypherpunks and since TCMay is getting ready to read us the Cypherpunks Bill of Rights regarding the subsidizatoin of other's people's cyber existence (heh). 3 problems which immediately come to mind: . What if someone, hired on one occasion but fired at another, decides in anger to "turn coat" and report everyone to the IRS (or other fine government agency)? . What if a company does not pay as expected - other than adopting Assassination Politics, what method could an employee use towards getting their expected remuneration for work done? . Wouldn't everyone need to have two jobs (or source of regularly accepted cash), in order to be able to pay for services where suppliers do not accept virtual cash transactions? (TCM has mentioned before about the need to pay for some things in tiny quantities - like quarters for a phone call, etc.) .. Blanc

4 3