December 2003 - cypherpunks-legacy

Re: Oregon License Plate Site in the News Tonight!
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:26 AM 8/9/96 -0700, daw(a)cs.berkeley.edu (David Wagner) wrote: >I say, what we need is a little more abuse. I say, a well-publicized >incident of abuse of the driver's license database can do more to >help the cause of privacy than any amount of intellectually compelling >debate. Perhaps one horrible incident of abuse would ignite enough >public backlash to stop states from selling their databases at the >drop of a hat. Judge Bork doesn't happen to live in Oregon, does he? Publishing his video rental records got Congress to pass a law against private businesses selling that kind of data; perhaps we can embarass the state of Oregon into not selling data that the state forces you to provide. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Defuse Authority!

1 0

Re: anarchy cookbook???
by pjn＠nworks.com 17 Dec '03

17 Dec '03

In> He blew himself up cooking napalm according to his directions. ^^ ^^^^ ^^^^^^^ ^^ ^^^^^^^^^ ^^ ^^^ ^^^^^^^^^^ I hope this was a joke, or you mean: He blew himself up while following his directions to cook napalm. P.J. pjn(a)nworks.com ... Letterman of Borg - "Ok, Top 10 reasons why resistance is futile:" ___ Blue Wave/QWK v2.20 [NR]

1 0

Re: Drive the SF Central Freeway, have your license plate photo'ed.
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:45 PM 8/8/96 -0700, Lucky wrote: >At 21:55 8/8/96, i am not a number! wrote: >>CBS radio news this morning: 80,000 commuters traveling the central >>f'way in SF will have information mailed to them regarding the quake retrofit >>How? Their license plates have been photographed. >You *are* making this up, right? Please say you did. It's possible today, and probably affordable. If not, it will be in 1-2 years, as Moore's law cranks down processing costs and video technology improves. For this application, they don't have to photograph every car, or read every plate successfully, or do it in real time. The objective is to get lots of drivers to take other routes or mass transit so they don't have to dump all the traffic onto surface streets right around the construction. Besides, this is nice friendly San Francisco. Imagine New York City doing it: Yo! Mr. E. Koch, 1234 E. 89th St. - We saw you takin' the West Side Highway last week. You better stop that as of next Friday. We know where you live. You got a problem wit' that? Rudy. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Defuse Authority!

2 1

cybergangs?
by S Zaid Hassan 17 Dec '03

17 Dec '03

Okay, so this is a bit Gibsonish but after reading that piece on cybergangs and some of the ecash issues what I wanna know is this: There are no laws in cyberspace right? No one to enforce them as such shall we say? What happens if a group of hackers/crackers/cypherpunks set up shop and started offering their services to the highest bidder? Let's say that the US Government bans strong crypto and attempts to enforce is using the many, conventional, means at its disposal... what happens if the cypherpunks group raises the money to pay a group or individual to hack/destroy/grind to a halt milnet? Or some such government network? Or all of them? How come this hasn't happened yet? Okay maybe not at such a grand scale, but ya know? Hey it's just an idea, Zaid "The wave is already gathering; one day it will wash us away." - Hermann Hesse

1 0

Re: Oregon License Plate Site in the News Tonight!
by jim bell 17 Dec '03

17 Dec '03

At 08:48 AM 8/9/96 -0700, John F. Fricker wrote: >I am not a great fan of social engineering and regulations. Yet the >legisture in Oregon may get called for a special session to address this >issue and I see this an opportunity for a grander arguement than merely >acccess to the DMV data. And as much as we dislike the presence of the >governments they do indeed exist. Living within their domain limits our >choices to either: complacency through inaction (cynicism et al), attempts >at isolation (back to the land), or taking an active role through voting, >education, civil disobedience or participation in the process (a pox on >party politics! the latter choice is easily the least enticing while civil >disobedience can be truly fun! >g<). Ok so call me a statist and shove me >out the door, but I am not argueing for the existance of a state. It does >currently exist and I am not self-sufficient. But I digress. Of course, in my opinion the "The State currently exists" observation is a problem, but I believe it's a solvable one! >#2) The records industry (for lack of a better term to encompass all >companies that accumulate data on individuals) needs some standards and >guidelines. Or walls and fences. Maybe even bars and a moat! And the sooner >the better. Federally imposed software requirements are not uncommon in >certain industries. It is time for standards for the personal data >maintained by co-operating entities (ie agencies the public co-operates with >such as doctors, the DMV, and so on). Even better would be to simply stop the state from collecting the records in the first place, right? > >#3) The goal is the anonymous citizen. The first step it to secure the data >currently exposed. Can this be done _without_ legislation? Perhaps the better question is, "Can this be done _WITH_ legislation?!?" Legislation, by its very nature, tends to serve the interests of the government first, and possibly some of the citizenry trailing a bit behind. Remember the saying, "When the only tool you have is a hammer, you treat every problem as if it were a nail." "Solving" the problem by legislation inherently tries to convert actions into crimes, or at least punishable activities. Needless to say, it won't be GOVERNMENT people who get jailed or dissuaded. A market and technology-based solution to the problem inherently involves cooperation, rather than confrontation, because the market has no inherent way to coerce people into acting

1 0

Re: F2 hash?
by vin＠shore.net 17 Dec '03

17 Dec '03

. Jüri Kaljundi <jk(a)stallion.ee> noted that "Mudge," a fabled hacker long associated with the elite clique "Cult of the Dead Cow," (honest!) had been scheduled to speak on SecurID vulnerabilities at DefCon in Vegas two weeks ago. >>| At Defcon this year they promised to tell about some security >>| flaws in SecurID tokens, anyone know more about that? Adam Shostack <adam(a)homeport.org> primed the pump: >> My understanding is that the guy who was going to give the >>talk had nda difficulties. Vin? Did you make it out? The talk was >>going to be on race conditions, denial of service attacks, and the >>like. Yup. SDTI asked me and their Principal Engineer, John Brainard, to wallow in the delights of Vegas and attend Mudge's scheduled speech at the DefCon hackers' convention. Not knowing that half of the people over 30 attending DefCon would be FBI agents (not undercover; wearing FBI/DefCon IV-embazoned polo shirts, and passing out _lots_ of G-man recruiting literature! No kidding!) the Powers That Be at SDTI selected John and I, from the girded ranks of their employees and sundry consultants, as either the least likely to squander our personal fortunes at craps, or the most likely to fit in among the (little)bit-perverted odd-balls who gather at DefCons. I refuse to speculate as to which (but I think I've finally got the knack of card-counting at blackjack;-) As Cerridwyn Llewyellyn <ceridwyn(a)wolfenet.com> reported, Mudge -- posed and celebrated on page 40-something of last month's WiRed -- told the DefCon audience that SDTI's lawyers were after him, threatening something dire, so he was not going to release his "white paper" on weaknesses in the ACE/SecurID system for several months. Instead, he delivered a talk on s/key vulnerabilities. This was weird, because I *knew* Security Dynamics had neither consulted nor asked their lawyers to do anything about Mudge's speech on SecurID vulnerabilities. It would have been a fool's ploy: silly and counterproductive. John and I took Mudge out for dinner right after that speech. He told us then that he had inadvertently misspoken when he blamed his temporary silence on SDTI's lawyers. The real problem, he said, was with bullying lawyers from two corporate clients he is now under contract to in his day job. (He didn't explain this further, but I understood that Mudge is working for two firms which have access to SDTI plans and trade secrets under non-disclosure agreements. The firms were apparently worried about their liability -- given their promises to SDTI and Mudge's work in their employ. Mudge may want to elaborate on this. Or not.) Mudge is a very sharp guy; a hacker in the old sense of a system maven -- despite his beer-swillin' Dead Cow Cult role-playing. Off stage, he spoke freely about which attack vectors he's been working on, but offered limited detail. (My impression was that when the conflict-of-interest stuff came up, Mudge put aside his analysis of SecurID authentication for awhile... but intends to work on it further, once free of other obligations.) He and SDTI's John Brainard got along well, nattering to each other in machine code (which another DefCon luminary who joined us, *Hobbit*, would ocassionally translate for me.) Mudge is deeply involved in analyzing the ACE client/server code for weakness; he too is also very interested in the F2 algorithm -- which he felt involves too much knowable information as input to the hash -- and, of course (like Shimomura, the self-styled Threat of the West,) Mudge is stolidly pounding away at the SecurID itself to retrieve and cryptoanalyze the algorithm that hashes Current Time and the token's secret key to generate a SecurID token-code. John Brainard -- who wrote the SecurID hash ten years ago -- openly admired Mudge's ingenuity but didn't seem to feel particularly threatened. Mudge and John also talked about various potential high-level protocol attacks on the network infrastructure and how they could possibly be used to isolate a Master ACE/Server from a (backup) Slave -- with an attacker able to both sniff incoming traffic to the Master and replay it to the Slave (after the Slave had been artificially trapped on an isolated subnet by the attacker.) The discussion was out of my league, but I enjoyed watching the vollying back and forth. The whole exchange was fun and reminded me of the healthy relationship hackers in the user community used to have with product designers. My beard is gray. I remember when the lead programmers for the best time-sharing companies used to send a bottle of good booze to anyone who alerted them to security problems in their systems. A good tradition, IMNSHO -- and one which I tried to continue when I picked up the check for our dinner and Mudge's choice of wine. (I'll bill SDTI;-) All the recent effort to bust the decade-old SecurID algorithm and the ACE network protocol seem a little anachronistic, of course. I suppose it's kind of a grand salute to an old security warhorse (and SecurIDs are still the first line of defense in most Fortune 500 companies.) There has been no formal announcement, but -- as Jüri suggested -- I think most of the ACE/SecurID user community expects that both the network protocol and the token's internal algorithm will be upgraded sometime in the very near future. (On a timeline SDTI established several years ago.) And any new ACE protocol will inevitably establish a stateful session for the authentication exchange -- which will make the current generation of race attacks historical novelties. SDTI Engineering (and most likely RSA Labs) have probably been banging away at the new design for a long time. RSA was deeply involved with SDTI long before their recent merger; RSA helped develop the F2 hash that is used in the ACE client/server security protocol. (It's this F2 hash that "Anonymous" is begging some Cypherpunk to steal, reverse-engineer, and publish for everyone to play with. Bad, bad, commercial crypto! Wouldn't want anyone to make money off strong cryptography, would we??) It remains to be seen where the merger of the top OTP firm and the top commercial crypto firm leads us -- but I, among many, hope the widely-installed ACE/Server (with its potent RDBS) will provide the key-management infrastructure that will allow the introduction of enterprise-wide crypto on a scale seen only in the nightmares of the NSA's congressional lobbyists. Mr. Gilmore is not the only one who has been plotting to vastly expand the installed base of strong crypto in the coming year. Suerte, _Vin Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

3 2

John Gilmore on the Radio!
by P. J. Ponder 17 Dec '03

17 Dec '03

Today at lunchtime in the Eastern Time Zone, the radio show Real Computing with John C. Dvorak had John Gilmore as a guest, and Dvorak asked several questions about the US federal case against Phil Zimmerman. Surprising how little Dvorak knew about the issues, especially considering he's a pretty bright guy and up-to-speed with the technology. He asked JG [paraphrasing] - now that the government case against PRZ is dropped, what else is the Electronic Frontier Foundation (of which Gilmore is a board member) taking up as its next 'cause'? The implication was that the 'crypto thing' is settled and we can move on to other issues. This may have been a rebroadcast of an earlier show, I don't know. Gilmore was referred to by Dvorak as the head of the cypherpunks a few times.

4 3

Fw: The Ostrich Security Principle
by Charley Sparks 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Fri Aug 09 17:42:15 1996 OK Tim, I looked up Ontology.. how did you get your license ? - -----Begin Included Message ----- - ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway." - ---- End of forwarded message ---- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCXAwUBMguwuOJ+JZd/Y4yVAQE+/wQMDMNJ7XIrI+VkTaNKQDdLkzUT9v8aEQzG x9/8aFFbw5/jVJQjd3TwWjuRut3L+mc+/2GOqJwQHf1z9vakVDSdnMzIKKB68FfP NtzU92MoqHip5D/R37cVACcAnXkoaSKvwy+m+V6Rxk2ffOlLoKLEUd9xK91hNFvs 2WymcjvaLC+MLQ== =owbR -----END PGP SIGNATURE-----

1 0

Pronto Mailer
by Charley Sparks 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: provos(a)wserver.physnet.uni-hamburg.de, cypherpunks(a)toad.com Date: Fri Aug 09 17:42:06 1996 I use Pronto Mail also. I just started using it yesterday. I can honestly say that it makes things simpler... no cutting, pasting, decrypting, encrypting...and on and on. It is the sweetest mailer since Ishmail ( UNIX / Linux ). Not even Ishmail did key management and fetching, sending, etc.... I will be able to use Pronto in my effort to proselytize the cause. The only thing I see that will prevent a lot of folks from getting it ( and paying for it ) is the price. $300 US seems a bit steep to some. I am going to pay for it because of the time it saves me. I would like to see a few things added, though. Multiple address books, keyed and non-keyed ( this might speed up the address book or add a search ( I have several hundred members of my firm listed in my Eudora mailer ). I'd also like to see some sort of IMAP address book support ( like Simeon or Z Mail ), These would also be accessable seperately in the interest of spped, since the pubring would be on each users machine. With the C2 option in the NT Resource kit, I'd like an explanation on using Pronto with NT 4. I tried all sorts of things and had no luck after installing.. Pronto kept telling me the pifs were no good, couldn't find keys, etc... None the less, I love it so far.. Just have to get the MC down a bit to pay for it (<GRIN> That;s why it's a 60 day demo ) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCXAwUBMguwsOJ+JZd/Y4yVAQGeJgQJAU+SB/cl48Jhmu1khb/7p0xG24ruL4cI av4myCELKV2GgOFfX+u48BLwCkTwRNaMIMdzBkNrQYQdofeSO0WrKJoDQVzMLeas IK6OUCI3uELqMjtJs1TK2qrDcSKue9COpbPe4D9MzyieuObZ0CDLXhWgWGmA72Up zFUPMrvd7swEIQ== =c/6c -----END PGP SIGNATURE-----

1 0

Fun with M$
by Jeremey Barrett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Some guy has written an ActiveX control which crashes windoze95... I don't use windoze so can't try it, but if someone else is brave, I'd love to know if it works... Information page with a link to a page which loads the control: http://www.halcyon.com/mclain/ActiveX/ Quote from the page: Exploder is an Active X control which demonstrates security problems with Microsoft's Internet Explorer. Exploder performs a clean shutdown of Win95 and will turn off the power on machines that have a power conservation BIOS (green machines). - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Jeremey Barrett Senior Software Engineer jeremey(a)forequest.com The ForeQuest Company http://www.forequest.com/ "less is more." -- Mies van de Rohe. Ken Thompson has an automobile which he helped design. Unlike most automobiles, it has neither speedometer, nor gas gage, nor any of the numerous idiot lights which plague the modern driver. Rather, if the driver makes any mistake, a giant "?" lights up in the center of the dashboard. "The experienced driver", he says, "will usually know what's wrong." -- 'fortune` output -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMgujTi/fy+vkqMxNAQFikwP+LbLwibqKcp4FcLncenF44ptcp01j02M8 QwVbx0R+ept5jFea+R5Jhbypy+C2wvLh1hs4fjC0d2lrAQkfqiJxDAu8dblXYejy hS1hmuzflIEcat2p0qbomKDf+Iba2fz2kXtcu5CSsmwvqWwZf9XSFiC0Gx9JJ0Nh c/zVv9GcMIs= =1j1L -----END PGP SIGNATURE-----

2 1