December 2003 - cypherpunks-legacy

Re: An interesting instance of poltical anonymnity, now revealed
by jim bell 17 Dec '03

17 Dec '03

At 11:09 PM 7/17/96 EDT, E. ALLEN SMITH wrote: > I find the CBS News response unfortunate. There's also the simple >question on lying to maintain the identity: what's so bad about lying? Why >he revealed himself is somewhat of lesson also. > -Allen > > _ Wednesday July 17 9:12 PM EDT _ > >'Primary Colors' Author Steps Forward > > NEW YORK (Reuter) - One of the best kept secrets in political, > journalistic and publishing circles was revealed Wednesday when > Newsweek journalist Joe Klein admitted he was ''Anonymous'', the > mysterious author of a novel based on President Clinton's 1992 > presidential campaign. If they really wanted to know who did it, why didn't they do a word analysis of the book, and compare it to known writers? Jim Bell jimbell(a)pacifier.com

2 1

FTP SW to support PGP in OnNet
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Seems the demise of PGP in favor of S/MIME has been somewhat exaggerated. Blurb in this week's InfoWorld led me to http://www.ftp.com/mkt_info/onnet32/tr-pgp.htm It would be a mistake, though, to say that they have a clue: E-mail compatibility Most e-mail systems can send and receive only plain text (technically, 7-bit ASCII characters). So PGP converts the encrypted information (which is 8-bit) into plain ASCII text using the radix-64 algorithm. This has a side effect that enhances security even when you don't use encryption. If you merely add authentication to the message, radix-64 still converts the whole message using its own algorithm. The resulting message -- even though it's not securely encrypted -- looks garbled to the casual snoop. D'Oh! - -rich censor the internet! http://www.stanford.edu/~llurch/potw2/ boycott fadetoblack! http://www.fadetoblack.com/prquest.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMe1rFJNcNyVVy0jxAQEZHQH/aDm0unOzogxpzm+Cj/XozLvLIhrwnTt8 JZR+KH1CVONifOhwCdQsEn7aoH4YbhbolaWZBH0FG99g2KHbGhmbMA== =QSLW -----END PGP SIGNATURE-----

1 0

Re: US versions of Netscape now available
by Duncan Frissell 17 Dec '03

17 Dec '03

At 03:40 PM 7/16/96 -0700, David Sternlight wrote: >It doesn't "leak overseas" as if there were some regrettable lapse in the >plumbing. Someone has to commit a felony violation of Federal law. > >David It's not a felony without a felon. Unless and until the feds prosecute someone, they may claim it's a felony but they have yet to prove it in a court of law. It's just a matter of opinion. If a law is overturned on Constitutional grounds it is void ab initio. When I handed a copy of a label with RSA in four lines of Perl (as it then was) on a sticker to the correspondent for the Independent (of London) at CFP'95 in the presence of the NSA counsel, nothing happened. DCF

1 0

Re: Opiated file systems
by Steve Reid 17 Dec '03

17 Dec '03

> But, on the other hand, it wouldn't be to hard to have the user set both > keys (yeah, so that didn't actually say anything, so what...), and then do > an every-other-byte type thing (although that would be slow... every other > block would be more efficient), and have 2 EFS's in one file, and make it > so that on the "duress" one the extra space appears to be "free". > One could make it a real file system, and add a fake disk error to prevent > over-writing of the "non-duress" filesystem. This sounds a lot like security through obscurity... What happens when someone reverse-engineers the software and sees that it's carefully skipping over blocks? If you don't want people to know about your encrypted data, use stego. Even if They find the stego software, you can always produce the keys to unlock the duress data from two or three .gif files, and say "that's all there is." Use stego to hide data. Use encrypted filesystems for convenience. If you try to put the two together, you'll probably end up with feature-bloat. The idea of an encrypted filesystems being accessable over the internet sounds interesting, though. Sort of a cross between NFS and CFS. Would be great for backup purposes. ===================================================================== | Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/) | | Email: steve(a)edmweb.com Home Page: http://www.edmweb.com/steve/ | | PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E68C09EC52443F8830 | | -- Disclaimer: JMHO, YMMV, TANSTAAFL, IANAL. -- | ===================================================================:)

1 0

Re: Stuffs used for detection
by Chris Adams 17 Dec '03

17 Dec '03

On 14 Jul 96 06:32:40 -0800, jti(a)i-manila.com.ph wrote: > >In our school library, there is a depository area wherein you deposit your things and get the tag. >Since the library doesn't allow those tags to be brought out from the library, everytime you >brought it out and pass by the door, it will alarm. Does anyone know what stuff is that? How come >it is alarmed? I brought some metals but it wouldn't alarm... Why those tag would alarm them??? Usually they're magnetic... // Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! // Automatically receive my resume or PGPKEY by sending email with a subject // of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful!

1 0

Re: random numbers reverse-engineering
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:28 PM 7/15/96 +0300, Juri wrote: >Is there somewhere where I could find more information on finding out RNG >algorithms or reverse-engineering RNG's, once you have some quantity of >random numbers generated by some RNG? > >For example a local bank is giving each customer a list with 600 one-time >passwords (6-digit decimal numbers), and I believe they use the account >number as (one of the) seeds for the RNG. Is there some program that I >could use, together with the numbers and possible seed, to try to break >the RNG? If you have some guess about the algorithm being used, you can try it, and if they've chosen a weak algorithm, you may be successful. For instance, if they use a simple Linear Congruential Multiplicative PRNG, X[n+1] = ( a * X[n] + c ) mod m and if you've got a list of 600 one-time passwords, you can get a good approximation to m by taking the largest password and looking for prime numbers slightly higher than it. You can then try solving for a and c. On the other hand, if the account number is large, and each X[n+1] is the low-order 6 digits of Y'[n+1] = MD5(Y[n]) and Y[0] = account number, then it'll be much harder to reverse-engineer. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

Re: Defend Mail Bomb
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:25 PM 7/14/96 +0800, you wrote: >Is it possible to defend mail bomb? If not, detect who they are? Mail bombs are hard to defend against. If your company or ISP has a firewall or mail server that handles their incoming email, it can potentially be configured to block mail from known harassers, but it's much harder to do if automatically - ten megabytes of binary data might be mailbombs, or might be the CAD/CAM file that your engineering department wanted. If the mailbombs are all coming from one place, over a period of time, you can often look at the headers and track down where they came from, and contact the administrators of the machines the mail came from to ask them to stop the problem. But if the attacker is good, this requires looking at large numbers of log-files, and many administrators aren't willing to do this except for serious on-going problems. If the mailbombs are coming from anonymous remailers, most remailer operators are happy to put you on their block list, to block further anonymous mailbombs. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

Re: Sternlight on C'punks
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 14:42 7/16/96, Peter D. Junger wrote: >How does one set up a kill-file for a mailing list? I run a Linux box >with sendmail and use the MH mail system. > >My best guess is that I will have to install procmail, but would like >your advice before going to a lot of labor. Procmail is the way to go. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

2 1

Re: Banning Anonymity As Well (was Re: How I Would Ban Strong Crypto
by Bill Stewart 17 Dec '03

17 Dec '03

>> Also, the key which decodes the GAKed data is just too valuable and too >> easy to steal. > >Assuming the info is encrypted with one GAK key, yes. There might be >a series of keys, perhaps for each escrow agency, or an id-number >that identifies the key. I predict that the "Access requires two master key agents" feature that Clipper I pretended to have* gets lost along the way. It wasn't in Steve Walker's software key-gakking system that he and Dorothy were touting a year or so ago, and it's a bit of work to actually implement in software depending on the encryption methods used. [* The Clipper I chip didn't actually implement dual GAK agents, though it could have without much extra effort; that was all part of the process of loading the chip's master-key in the vault charade, and could therefore be easily changed later... ] # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

Re: Message pools _are_ in use today!
by Bill Stewart 17 Dec '03

17 Dec '03

>>receive message pools by satellite dish-- hurray for true broadcasting! tcmay(a)got.net (Timothy C. May) wrote: >Yeah, and I should have mentioned the "PageSat" Usenet distribution model, >too. (It was a really hot topic 3-4 years ago, but I've heard little of it >in the past couple of years...the rise of the Web has made passive >downloads of Usenet a lot less interesting.) Volume has been a real problem. Usenet is probably close to 10MB/hour these days, which is 30 kbps if you don't compress it, or 10-15 kbps compressed (since the binary newsgroups are a good chunk of the volume and are already mostly compressed.) That's pushing what you can do with really-low-end satellites, and as Tim says, the Web has affected the size of the market for that kind of service. I don't know how easy it is to get one of these pseudonymously, and they do cost a bit, but an amusing transmission medium for message pools is alphanumeric pagers; you can get pager cards for PCs, or just limit your messages to 250-byte blocks.... Bay Area alphanumeric service probably costs $25/month, though nationwide is $60-100. >2. The authorities already have identified a suspect, call him "Bob," and >wish to know if he reading (and perhaps decrypting) messages to "Alice." > >As several of us have noted, #1 is tough--real tough. The authorities would >have to contact 10,000 or more ISPs who have local newsfeeds and subpoena >their logs of who read which newsgroups...assuming such logs are even kept Getting everybody is tough. Getting a lot of the potential suspects, however, isn't as tough as it looks - the vast majority of home Internet users are on AOL, Compuserve, Prodigy, UUNet, Netcom, or (RSN) AT&T. Anonymous Message Pool users are a bit more likely to use niche-market ISPs, especially under pseudonyms, but if the number of users increases significantly there'll still be a reasonable proportion on the big carriers, which are probably more cooperative and probably keep more complete logs. On the other hand, several of the big players are good places to get disposable accounts charged to that secured Visa debit card you opened under a pseudonym.... # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0