December 2003 - cypherpunks-legacy

Setting up Internet wave
by support＠vocaltec.com 17 Dec '03

17 Dec '03

Dear Steve Cypherpunk, Thank you for your interest in the Internet Wave technology from VocalTec. As the Internet Wave is currently in beta-testing, we will keep you informed about new releases of the server utilities and client application. If you don't want to get such information, then send us an Email. In order to get the Internet Wave Encoder utility and server CGI you should follow these steps: 1. Go to the url http://www.vocaltec.com/server.htm (This is the same URL of the form you filled in order to get this Email reply) 2. Click the download reference. 3. You will be be asked for a username and password. enter: username: iwave password: 7365583 4. You will now start downloading the package. 5. Unzip the file, and read the readme.txt file for information on using the CGI utility and encoder. Yours, VocalTec Staff.

1 0

Re: A case for 2560 bit keys
by Deranged Mutant 17 Dec '03

17 Dec '03

On 8 Jul 96 at 23:09, David F. Ogren wrote: [..] > Despite the above, there are convincing arguments for longer RSA keys. > Instead of asking "Why should we have longer keys?", perhaps we should be > asking "Why _shouldn't_ we have longer keys?" > In a hybrid cryptosystem such as PGP, very little of the computational > process is consumed by RSA encryption. Only a tiny fraction of the message > is RSA encrypted (the session key), and thus the time-critical operation is > the symmetric crypto system (IDEA for PGP). > > As an experiment generate a 2047 bit PGP key and a 512 bit PGP key. > Encrypt a file (preferably of a reasonable size) using both keys. > Depending on the computer you are using, the time difference between the > two keys will be a matter of few seconds or even a fraction of a second. Depends on the computers one uses, and who you are computing with. I've heard some horror stories of people using PGP modified to handle 4kbit or 8kbit keys on 286s that waited <i>days</i> to generate keys and hours to sign or decrypt messages. If you're exchanging messages with people using fast computers, lerger key sizes are practical. Otherwise you need to take the issue of key-size/speed tradoff seriously. > It seems foolish that we use RSA keys that are less secure than our IDEA > session keys. Our RSA keys are much more valuable than our session keys. [..] If very improved factoring methods are discovered, it might not matter. If a new method of cryptanalysis against IDEA comes out, that might make RSA key-sizes a non-issue. AFAIK, PGPlib will support multiple public key and private key algorithms. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: CWD -- Jacking in from the "Keys to the Kingdo
by Chris Adams 17 Dec '03

17 Dec '03

On 5 Jul 96 12:41:54 -0800, wendigo(a)gti.net wrote: >: It would actually take less creativity to do the other things, bypass the >: config.sys, etc. The child would thus be perhaps a little TOO creative. :) >B) Forget the CONFIG.SYS ... what about kids using Macs or some future > "Kid Safe" system that has the filters in an eeprom? I'm talking > about bypassing the censorship on the client-server level. Relatively > platform independent. I doubt it will ever happen, for two reasons: 1) people always forget passwords and/or have system problems. There will always be a need for system disks or CDs. If parents don't trust their kids (and the ones most worred don't; if they trust their kids, they're not going to worry about what they're doing in the first place) chances are they're still not going to lock up the CD and keep the kid from borrowing one from a friend, etc. Also, most parents tend to be sloppy with passwords - it's easy to observe them entering it, etc. 2) Most parents need the kid to keep the computer working. They a) don't have the knowledge/skill to keep the kid out and b) need to give him access to repair things. If their kid is in fixing a problem, dropping the security software is trivial (better yet: "Mom. Guess what! The bug was in NetNanny"). // Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! // Automatically receive my resume or PGPKEY by sending email with a subject // of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful!

1 0

Junk E-Mail
by sdirge＠mail.concentric.net 17 Dec '03

17 Dec '03

I know that this is off topic but.. How can I stop these idiot's sending me junk E-mail. I am posting this here because this group sounds like one of the only intelligent groups of people on the internet. Whatever mailing list I got on is sure working I am getting 2-3 junk e-mail's per day. Thanks Steve

1 0

Edited Edupage, 9 July 1996
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)educom.unc.edu" 9-JUL-1996 18:15:10.81 ***************************************************************** Edupage, 9 July 1996. Edupage, a summary of news items on information technology, is provided three times each week as a service by Educom, a Washington, D.C.-based consortium of leading colleges and universities seeking to transform education through the use of information technology. ***************************************************************** >ISLAM AND THE INTERNET >Seven private Internet providers are now offering their services in Egypt, >and in Jordan an online service offers a forum where local residents can >talk to senior government officials; however, a number of government >officials, religious conservatives, and intellectuals in those countries do >not wish to the public to be exposed by the Internet to pornographic >materials or subjected to an invasion of ideas that could threaten >political stability and undermine Islamic culture. "If you have certain >values you don't want them to be neglected," says the secretary-general of >Egypt's Labor Party. "Our society is Islamic, and we have our own values, >which may not be the same as the West." (Christian Science Monitor 9 Jul >96) The Monitor's new web site is at < http://www.csmonitor.com >. Like China, various other countries are trying to get the Internet's benefits (such as technical information) without its other consequences (extension of civil liberties into countries that want to deny them). One idea that I've had for preventing such problems is to look for addresses from such countries that are posting to technical newsgroups, to technical mailing lists, or that are attempting to get access to web pages on technical subjects (which access they will hopefully be denied, although an alternate possibility). Then mail information to those addresses that those countries don't want getting into their countries, such as on human rights abuses (or well-written pornography...). One interesting (and somewhat cypherpunk) matter in this is making sure that the email in question can't be blocked by simple means such as who it appears to be from; faked email addresses, which wouldn't need to be unbreakable in this country - a definite advantage - would be necessary. One difficulty is that they might start searching on keywords for text. An extension of this for web sites, which I understand as possible but difficult, would be to swap anyone from such a country trying to get access to a technical web site to instead receive "subversive" information or pictures. (The pornography mentioned above would probably be more effective in picture format; other pictures might include information on human rights abuses). One attractive matter on the above is that it can be pretty easily done by individuals. TCMay, for instance, might want to set up a bot that would mail people in Sudan information on female castration/"circumcision". -Allen >Edupage is written by John Gehl <gehl(a)educom.edu> & Suzanne Douglas ><douglas(a)educom.edu>. Voice: 404-371-1853, Fax: 404-371-8057. >*************************************************************** >Edupage ... is what you've just finished reading. To subscribe to Edupage: >send mail to: listproc(a)educom.unc.edu with the message: subscribe edupage >Gabriel Daniel Fahrenheit (if your name is Gabriel Daniel Fahrenheit; >otherwise, substitute your own name). ... To cancel, send a message to: >listproc(a)educom.unc.edu with the message: unsubscribe edupage. (If you >have subscription problems, send mail to manager(a)educom.unc.edu.)

1 0

Re: Word lists for passphrases [vocabularypunks]
by Erle Greer 17 Dec '03

17 Dec '03

At 01:18 PM 7/9/96 -0700, you wrote: >>>>>> "Mark" == Mark M <markm(a)voicenet.com> writes: > >Mark> According to Altavista: > >Mark> nethermost - 45 >Mark> insatiable - 200 >Mark> insufferable - 200 > >Mark> I know I have too much free time. > >According to Dejanews: > Individual word hit counts > * nethermost: 185 > * insatiable: 1191 > * insufferable: 752 > * antidisestablishmentarianism: 142 :-) > >-- >steve(a)miranova.com baur >Unsolicited commercial e-mail will be proofread for $250/hour. >Andrea Seastrand: For your vote on the Telecom bill, I will vote for anyone >except you in November. Ok fellas, I am usually against senseless arguing. Especially over a subject that certain individuals shouldn't even had wasted the time to reply to if they couldn't give a sh*t about it in the first place. Therefore, I assume that they are arguing JUST to argue, but they wait until a topic pops up that they have some background in, therefore standing a chance of winning. Well, you already lost when you assumed that something worthwhile or useful would come of your negative responses. Oh, excuse me; you did get replies to your responses, so I guess your investment did turn a profit. Well, stooping even further into your realm, I too visited my trusty search utility, MetaCrawler. It too found all four of your words. I decided to pluck five odd-looking words from my MAINLIST.TXT produced by Word-List Builder. The list is COMPLETELY untouched or altered by human hands. I ran all five of them through MetaCrawler and your DejaNews (ultra list source) and here are the results: Word MetaCrawler DejaNews -------------------- ----------- -------- DisplayWorkstationSe 0 0 SETUPPP 0 0 TmpDirPad 0 0 dsRegSetPads 0 0 TotalSwapReqdFromINF 0 0 (These words were all found in the first 1% of my list and then I got bored.) Logic tells me that a word that can be found ANYWHERE with a publicly-available search utility would not be the IDEAL passphrase to lock up my secrets. Well, now that I know where YOU will be assembling your list from, I can rest assured to pull one from my list instead. -fin

1 0

Re: [RANT] Giving Mind Control Drugs to Children
by Deranged Mutant 17 Dec '03

17 Dec '03

On 9 Jul 96 at 0:19, Perry E. Metzger wrote: [..] > Has it occurred to you that many of the children in question are happy > being medicated, as are many adults? In any case, who are you to tell > other people what's good for them? Whether or not the medication works for some (or all) people, whether or not it ruins or improves their lives, etc. etc, is not really the issue. A problem is in giving children medication when they lack the legal freedom (and possibly emotional or mental maturity) to make their own decisions to take it or not. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

FW: MSoft crypto API's
by geeman＠best.com 17 Dec '03

17 Dec '03

---------- From: George Kuzmowycz[SMTP:gkuzmo@ix.netcom.com] Sent: Tuesday, July 09, 1996 4:19 PM To: cypherpunks(a)toad.com Subject: MSoft crypto API's ...... The June 10, 1996 Network World carried a story on page 8 under the title "Microsoft breaks crypto barrier", which starts off as follows: " Microsoft Corp. last week said it will include cryptography-based security technology in its operating systems, messaging product and Web browser through a new set of APIs that will be available both in the U.S. and overseas. They said this quite some time ago! Later on, it says: " Microsoft's Crypto APIs will be available to third-party vendors writing applications with embedded security. But the hardware or software Crypto-engines for these applications will need to be digitally signed by Microsoft before they will work with the APIs. Under an unusual arrangement with the NSA, Microsoft will act as a front man for the powerful U.S. spy agency, checking on whether the vendors' products comply with U.S. export rules." > They got it wrong, no big surprise. MSFT explicitly says export compliance is the developer's responsibility, and any notion that MSFT is going to front for NSA in somehow validating crypto code is ludicrous. The signature function is so the OS can validate the code and make sure it's not been tampered with. Period. Excuse me, er, NW, how is MSFT going to sign hardware? heheheheh. I was a bit surprised not to see any discussion of this here. Is it just old news? Or maybe people here don't read Network World? > Both. An MS/NSA alliance? > Perhaps, but this ain't it.

1 0

Re: Contracts, Responsibilities, and Drug-Dispensing
by jim bell 17 Dec '03

17 Dec '03

At 05:33 PM 7/9/96 -0700, Wei Dai wrote: >On Tue, 9 Jul 1996, Bill Frantz wrote: > >> ObCrypto: When may a minor child say no to PAK (Parental Access to Keys)? > >Interesting threat model... What can one do in the total absense of >physical security? We've talked about mental cryptography before, but I >think we agreed that it isn't very practical. Perhaps security through >obscurity is a better solution here, since many parents are less computer >literate than their children. All the kids need to do is to put their secrets in a file named "README.TXT" and put it in the root directory! Jim Bell jimbell(a)pacifier.com

1 0

Important UK court case
by Robert Hettinga 17 Dec '03

17 Dec '03

>From the strong-network/weak-transaction model hits the wall dept.... Cheers, Bob Hettinga --- begin forwarded text To: set-discuss(a)commerce.net Subject: Important UK court case Date: Tue, 09 Jul 1996 12:13:28 +0100 From: Ross Anderson <Ross.Anderson(a)cl.cam.ac.uk> Sender: owner-set-talk(a)commerce.NET Precedence: bulk +----------------------------------------------------+ Addressed to: set-discuss(a)commerce.net +----------------------------------------------------+ At a trial in England yesterday, a judge decided that if a bank was not prepared to let their computer systems be examined by a hostile expert witness, then they could not even present bank statements in evidence. At least SET has been done right - I believe it is the first significant banking protocol to have undergone an open design review. I hope that there will be implementations that have also undergone credible scrutiny. I append a note of the case that I posted to our supporters. Ross Anderson ********************************************************************* John Munden is acquitted at last! At twenty past two today, John Munden walked free from Bury Crown Court. This resolved a serious miscarriage of justice, and ended an ordeal for John and his family that has lasted almost four years. In a judgment loaded with significance for the evidential value of cryptography and secure systems generally, His Honour Justice John Turner, sitting with two assessors, said that when a case turns on computers or similar equipment then, as a matter of common justice, the defence must have access to test and see whether there is anything making the computers fallible. In the absence of such access, the court would not allow any evidence emanating from computers. As a result of this ruling, the prosecution was not in a position to proceed, and John Munden was acquitted. John was one of our local policemen, stationed at Bottisham in the Cambridge fenland, with nineteen years' service and a number of commendations. His ordeal started in September 1992 when he returned from holiday in Greece and found his account at the Halifax empty. He complained and was told that since the Halifax had comfidence in the security of its computer system, he must be mistaken or lying. When he persisted, the Halifax reported him to the police complaints authority for attempted fraud; and in a trial whose verdict caused great surprise, he was convicted at Mildenhall Magistrates' Court on the 12th February 1994. I told the story of this trial in a post to comp.risks (see number 15.54 or get ftp.cl.cam.ac.uk/users/rja14/post.munden1). It turned out that almost none of the Halifax's `unresolved' transactions were investigated; they had no security manager or formal quality assurance programme; they had never heard of ITSEC; PIN encryption was done in software on their mainframe rather than using the industry-standard encryption hardware, and their technical manager persisted in claiming (despite being challenged) that their system programmers were unable to get at the keys. Having heard all this, I closed my own account at the Halifax forthwith and moved my money somewhere I hope is safer. But their worships saw fit to convict John. An appeal was lodged, but just before it was due to be heard - in December 1994 - the prosecution handed us a lengthy `expert' report by the Halifax's accountants claiming that their systems were secure. This was confused, even over basic cryptology, but it was a fat and glossy book written by a `big six' firm with complete access to the Halifax's systems - so it might have made an impression on the court. We therefore applied for, and got, an adjournment and an order giving me - as the defence expert witness - `access to the Halifax Building Society's computer systems, records and operational procedures'. We tried for nine months to enforce this but got nowhere. We complained, and the judge ordered that all prosecution computer evidence be barred from the appeal. The Crown Prosecution Service nonetheless refused to throw in the towel, and they tried to present output such as bank statements when the appeal was finally heard today. However, the judge would have none of it. For the computer security community, the moral is clear: if you are designing a system whose functions include providing evidence, it had better be able to withstand hostile review. Ross ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This message was sent by set-discuss(a)commerce.net. For a complete listing of available commands, please send mail to 'majordomo(a)commerce.net' with 'help' (no quotations) contained within the body of your message. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0