December 2003 - cypherpunks-legacy

Re: Need PGP-awareness in common utilities
by Remo Pini 17 Dec '03

17 Dec '03

At 02:30 AM 7/7/96 +0200, you wrote: > >Which is where the small payments to ratings producers from >ratings consumers comes in. Again this is just the >quantification of a phenomena that we all take for granted. >(Namely, that people who produce quality ratings are producing a >value and trading/contributing it to others.) It sure sounds like I'll have to pay, so someone decides for me, wether some piece of info is important to me. Now, if that isn't the first step to censorship! That kind of reminds me of an insurance company where I can call a toll-intensive number to talk to a salesman who tries to sell my something I don't really need. ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

1 0

Re: Word lists for passphrases
by Remo Pini 17 Dec '03

17 Dec '03

At 03:51 PM 7/6/96 -0400, you wrote: > > AwakenToMe(a)aol.com writes: > > > I have a util that will create a word list starting from > > > aaaaaaaaaaa on up to anythingggggggg basically you could do every > > > combination. Let me know if ya want it. > > > > That would really be of great use for doing wordlist crack runs. It > > must have taken you a long time to write -- generous of you to offer > > it. I don't think any decent programmer has never tried such an aproach to crack for example PKZIP archives (the one on CD-ROMs, where you have to pay to get the passwords). I certainly did back in 1991. I don't want to put down the usefullness of such a program, but since probably more than 50% of all passwords are vulnerable to dictionary attacks, such a utility has not too much value. (have you ever tried all combinations from "aaaaaa" to "zzzzzz" (there are around 2'176'782'336 <36^6> if you concider all umlauts like the German auml;, uuml;, ouml;, ...). On the other hand, there won't be much more than 10'000 6-letter words in any dictionary. So it seems, a wordlist generator and a wordlist using cracker works a lot better (and is almost as trivial to do - if you keep aside nice features) ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

1 0

Re: DoD and IRS tax systems (fwd)
by Jeff Barber 17 Dec '03

17 Dec '03

I'm taking the liberty of forwarding this excellent RISKS posting. There are a couple of other related ones in the latest RISKS digest -- see comp.risks. -- Jeff oo -----------------------------cut /\ here------------------------------ Date: Thu, 27 Jun 1996 14:12:51 -0400 From: Carl Minie <CarlM(a)qsc1po.qstr.com> Subject: Re: DoD and IRS tax systems (Wexelblat, RISKS-18.23) As an ex-liberal and small-l libertarian, I submit that the true danger to privacy in the Republic is the practice of gathering detailed financial information from all (law-abiding) Americans under threat of asset confiscation and jail terms, and then giving tens of thousands of government employees access to this information in the course of their employment. I further submit that passing a few wimpy privacy laws and expecting them to prevent this information from being used for personal and political purposes is magical thinking. It doesn't take a genius to surmise that IRS data is used regularly for illegal purposes by everyone from the sitting President (of either party) down to grudge-bearing neighbors and ex-spouses. I believe the IRS attempted to assess the depth of the problem in their Southeastern Region (where my mother worked) at one time, and stopped at well over 300 violations. You or I would have ended up at Leavenworth, but all but a few of the most egregious violators were simply warned not to do it again. You can take voluntary action to keep yourself out of the TRW/ Equifax/TransUnion food chain and off junk mail lists...but Federal law requires you to remain in the IRS's gunsights for your entire productive lifespan. Neither party supports privacy when it means privacy from the government; it is a Democratic president who is enthusiastically supporting the FBI and NSA in their efforts to prevent American citizens from using encryption that they can't break, and to require that every phone, fax, and modem in the United States contain a chip that would allow government agencies to tap in at will. Do I need to add here that the very concept of economic privacy is anathema to those who believe that a portion of everything you earn, keep, spend, or invest belongs to them, and that not handing over the fraction they demand is stealing from them? > Is the Department of Star Wars and the $700 toilet seat > really so excellent a contracting agency that they are the > clear choice to handle IRS business? I don't expect the IRS to be abolished anytime soon...but letting the DoD design its computer systems would be an acceptable second choice. The DoD may be expensive, but they're not very good. My fondest hope is that with a spanking new Government Issue computer system, the IRS that the GSA says can't figure out where 60% of its own budget goes won't be able to find 60% of mine. I don't like paying for $700 toilet seats (or $320,000 spotted owls) any more than you do. The solution which provides the smallest RISK to privacy is not to gather the data in the first place. If tax compliance is truly voluntary, then the IRS should trust that we are reading 21,000 pages of IRS rules and case law and sending in the correct amount. Long Pig ------------------------------

1 0

Re: CCC Crypto Lock
by Remo Pini 17 Dec '03

17 Dec '03

At 04:10 AM 7/6/96 -0700, you wrote: >MicroPatent, 4 July 96 > > >Systems and methods for protecting software from >unlicensed copying and use (Assignee -- Convex Computer >Corporation) > >... > >Assignee: Convex Computer Corporation > >Patent Number: 5530752 > >Issue Date: 1996 06 25 > >Inventor(s): Rubin, Robert J. > >If you would like to purchase a copy of this patent, >please call MicroPatent at 800-984-9800. > >Copyright 1996, MicroPatent I think there are already such algorithms in use in Europe. (Why buy the patent, if it's already around?) ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

1 0

Reasonable validation of a software package
by Anonymous User 17 Dec '03

17 Dec '03

Fellow cpunks: I am working on various software packages for UNIX and Windows and since this is commercial work and prior NDA's are involved, I can't include the source code for absolute validation. What would assure one that a package has not been tampered with from the company to the user? (Currently, I am using PKZIP's rather anemic AV protection, as well as signing the archive with my PGP key. I am wondering if there are any other steps I need to take to assure that a package came from me, and wasn't damaged/altered/tampered with in transit.) Thanks in advance.

4 3

Can't block caller ID in Massachusetts?
by David Mazieres 17 Dec '03

17 Dec '03

My last phone bill said that Nynex is now giving out people's names in addidtion to their phone numbers over caller-id. I therefore called Nynex and told them to block caller-id on my phone line. They said no problem, but... They said nothing I can do will block it when I call 800 numbers. "The people with 800 numbers have special software, and there is nothing you can do to block your identity when calling them. Not even *67." Wow. Maybe I'm not paranoid enough, but I never expected this. I can never again call an 800 number anonymously to get information about something unless I go out to a pay phone. What an incredible inconvenience, and how truly depressing. I know 800 number owners probably used to be able to get lists of calling phone numbers on their phone bills, but this is less disturbing as it would take significant effort to match up the lists after the fact. I just want to be able to call up companies and say, for instance, "If I buy your product, can it do X?" as opposed to, for instance, "I'm stuck with your product, can it do X?". People are often more helpful in the former case. Now, though, they'll know exactly who I am before they even say hello. David

19 31

Re: Destabilizing China's Government with Strong Crypto
by Deranged Mutant 17 Dec '03

17 Dec '03

On 12 Jul 96 at 0:04, Timothy C. May wrote: [..] > And this is yet another example of the negative effects of the U.S. > restrictions on crypto export: where widespread crypto tools might be used > to destabilize repressive governments, the lack of these tools integrated > into common applications makes it harder for freedom-fighters in China, > Burma, Iran, France, etc., to use them. The US has a sad history of supporting its own 'friendly dictators' though. Makes it hard to support flow of decentralizing tech to destabalize countries like Iraq but keep countries like El Salvador in the fold. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download
by Arun Mehta 17 Dec '03

17 Dec '03

At 23:38 10/07/96 -0700, Will Price wrote: >ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download Sorry if this has been discussed before (please point me in the right direction if that is the case), but VSNL, my government-owned ISP (which also has a monopoly on all international traffic) made me sign that I will not use my Internet connection for voice traffic. Is there any way they could find out if I were using PGPfone, or rather, could I prevent them from finding out? Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://mahavir.doe.ernet.in/~pinaward/arun.htm The protestors of Tiananmen Square will be back. Next time, the battle will be fought in cyberspace, where the students have the more powerful tanks...

1 0

Re: Minitel "saved" by hackers?
by Arun Mehta 17 Dec '03

17 Dec '03

At 05:51 12/07/96 +0200, Daniel Salber wrote: >At 2:37 AM +0500 on 7/11/96, Arun Mehta wrote: > >> I'd love to find out exactly what happened. > >"Hacking" is inaccurate: the users >were not necessarily computer-litterate but just found another way to use >the help feature of the server. Rheingold's Virtual Community has a pretty >accurate account of the facts (see chapter 8, also online as ><http://www.well.com/user/hlr/vcbook/vcbook8.html>). Thank you for the correction. I checked Andre Lemos' original, and he uses both terms. To quote, "Through thie detournement -- literally, a 'hijacking' was born the messagerie. By hacking and then making available the bulletin board software, a counter-current to the French technocratic approach produced a usage of the system which was never a planned objective." Slightly inaccurate. >In a previous post, you said: > >> So, shocked by this, what does the government do? Being unable to >> distinguish between different kinds of messageries, the government put a 30% >> tax in 1989 on all, and raised it to 50% in 1991! No wonder the Internet is >> gaining rapid popularity in France. > >I think this is wrong. These taxes were only for sex messageries and the >30% tax didn't actually stop most of them from making money. I think the >50% tax wasn't actually enforced and the tax rate remains at 30% (see >http://www.univ-paris8.fr/~babelweb/voltaire/v_no23.htm -- this is in >french, sorry). > >You must realize that the government has no interest in stopping all >messageries: France Telecom is (at least for the coming few months) a >government agency and makes a lot of money from the messageries. Once again going back to the original: "In 1986 the first roadside billboards for the messaggeries rose appeared (picturing, for example, a robust male or a woman with slogan '3515 BUSTY', the online address of a Mintel rose chat service). French traditionalists were outraged and Charles Pasqua, acting Minister of the Interior, attacked the gay messagerie Gay Pied. Worse, the French state gains 36% of the total charges paid. Taxes on all the messagerie services became the order of the day. France Telecom has no way of distinguishing between the messagerie rose and any other board or messagerie. In 1989 the government tax was 30% and in 1991 a 50% tax was imposed in the hope of eliminating all messageries." That's seriously innacurate, it seems to me: but I would appreciate some confirmation before I attack the guy in my review. Will check out the urls you suggested, problem is during the monsoons the phone connection to my ISP keeps dropping. > >The Minitel is no more "centralized and bureaucratic" than the Internet was >only a while ago (ie, when NSF was in charge of most of the core >infrastructure). >The Minitel may look centralized and bureaucratic because anyone who wishes >to open a server has to go through France Telecom (which delivers unique >names like Internic). Has FT ever denied permission (to hard-core sex servers or neo-Nazis, for example)? That, the tax they charge and the prohibition of encryption make it too centralized for my taste. And will ultimately kill it. The longer the French take to migrate to the Internet, the worse for them (IMHO). >There were even some experiments of a european Minitel system linking >several european videotex services a few years ago. I think they fell short >because the videotex technology has been so quickly outdated. Why not link up videotex in every country with the Internet? Let people surf the Web using their TVs and remotes (and maybe a keyboard with an infra-red link). That's what I'm trying to tell our utter failure of a videotex service in India. Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://mahavir.doe.ernet.in/~pinaward/arun.htm The protestors of Tiananmen Square will be back. Next time, the battle will be fought in cyberspace, where the students have the more powerful tanks...

2 1

Re: A case for 2560 bit keys
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Thu, 11 Jul 1996, Chris Adams wrote: > check your setup. I used to run a 386-20 (5MB RAM) and it took about 3 > seconds for a 1024 bit key. Given it didn't even have a copro (not sure > when/if PGP uses one) and that it was off of a Stackered drive, I'd > expect you to have much better times. That's consistent with the timings I've been getting. It should take about 9 seconds to decrypt an arbitrary message with a 2048-bit key with the setup you describe. Of course, I usually use X, so that probably does throw off the timings a bit. - -- Mark =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= markm(a)voicenet.com | finger -l for PGP key 0xe3bf2169 http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348 "Freedom is the freedom to say that two plus two make four. If that is granted, all else follows." --George Orwell, _1984_ -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQCVAwUBMeXTXLZc+sv5siulAQEnAAP8Dbr/WWFKDhD0CRPePVtF2o7386Na89Xd GUC7D2x9hFAcMS+YynQnLpNULHWY4e/ziY3GkpFVydSYrQfIZ7Xj8P7RPgFUmWnz 4Zo5zTIJif1jigWEmMqAr7nMBtDCFTJrB0ogD7ZlGcALHxjUKW7j20QtHyIg5/sr nS7OAI2gZgc= =/LMb -----END PGP SIGNATURE-----

1 0