December 2003 - cypherpunks-legacy

Re: Snake-Oil FAQ
by Krenn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: > The reason I recommend anonymous remailer distribution, and pseudonyms, is > because of the litigation issue. Even if reviewers are not sued often, the > threat of a suit influences reviews, which is why most reviews in most mags > are puff pieces (glowing reviews, often strongly correlated with who is > advertising in the mag). One can imagine Matt Blaze, for example, choosing > to say _nothing_ about SnakeTronics' ScrambleMatic, for fear (justified) > that he might get letters from their lawyers, thus taking up his time and > even eventually landing him in court. I agree, hence my original post. I for one would not contribute to such a list without anonymity, tho my critiques might be right. The hassle of dealing with a person or organization bent on causing you legal headache is more than I am willing to deal with. It is obvious, given the current state of the legal system in this country, that a lawsuit against a even a well-respected cryptographer might drag on for some time, costing ennumerable dollars and hours, and _might_ even succeed. Krenn -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMkcaT0nqfwPpt/QVAQHzJwP/VG1E60TeZ8xtomW2VmKO/b/jV+a6orWT ebxhtlCX6CicVYtS0L4NBqcY8rQk8bcbeMXed3o5tY7B4FHwANml9Ubcbg7Wo7yL 2JvWI2E6M/4yfKIPuO0aqId57Qx5v36RiDAjZsozKhOJERTGasFJCOFOu/pMOa6M 36lWaXY0tyg= =PTUE -----END PGP SIGNATURE-----

1 0

Security flaw in Microsft Explorer
by Gary Howland 17 Dec '03

17 Dec '03

Program compromises IE security By Nick Wingfield September 23, 1996, 10:45 a.m. PT A start-up Internet company has posted a program on the Net that could allow Web sites to bypass the security controls in Internet Explorer, CNET has learned. The company, InfoSpace, created a program aimed at Net search engines such as Lycos and Excite that want to become the default search engine in Microsoft's Internet Explorer 3.0. But the program, which is actually featured on the Lycos Web site, manages to circumvent Explorer's security warning window--an action that could let InfoSpace sneak programs onto a user's personal computer without warning. Although the InfoSpace program apparently was not created with malicious intent, it underscores the fragility of Internet Explorer's security defenses, as well as broader security issues related to downloading software over the Internet. The InfoSpace program sidesteps a security feature in Internet Explorer, called Authenticode, which is designed to allow users to verify the origins of a piece of software code, such as an ActiveX control, a script, or a plug-in. The Authenticode system requires a user to entrust the developer of a program, whether it's InfoSpace, Lotus Development, or IBM, not to install viruses or other destructive programs on the user's system. Although Authenticode does not prevent software developers from creating such programs, they can be held legally accountable for bad code. That's because the programs contain "digital signatures," a sort of ID card that allows perpetrators to be tracked down by law enforcement agencies. Microsoft works with VeriSign to provide digital signatures for programs. Last month, VeriSign took matters into its own hands by asking a developer, Fred McLain, to remove an ActiveX control called Exploder from his Web site. The Exploder control was designed to crash a user's computer after downloading. "Code signing is not a guarantee of code quality," Charles Fitzgerald, a product manager at Microsoft said. "It's an accountability trail." As with all digitally signed programs, users are offered the option to accept or to reject the InfoSpace program before installing it on their systems. Users are also offered the option to bypass the Authenticode warning window for all InfoSpace programs in the future. But the company's program registers InfoSpace as a "trusted publisher" in Explorer, effectively opening the browser to intrusions. The operation is akin to inviting a guest over to your house for dinner and having them copy the key to your front door without permission. InfoSpace executives denied that there was any malice intended in its program, adding that it has provided Lycos with an updated version of the code. Lycos plans to post the new program later this evening, according to InfoSpace. "It was a bug that got incorporated into the production code," InfoSpace CEO Naveen Jain said. Lycos CEO Bob Davis said he was not aware of the bug in the InfoSpace program and could not comment on it. The program is identified as Lycos Quick Search on the search engine's site. However, Microsoft officials expressed concern, saying it is hard to defend against once a user has consented to download code from the Net. "Clearly their software is doing something a tad aggressive," said Rob Price, a group program manager for Internet security at Microsoft."[With Authenticode], users are making a one-time trust decision, this is a persistent trust decision." Microsoft argued that Explorer provides better security than Netscape Communications' Navigator, which does not currently allow digital signatures on plug-ins. In Explorer, users are warned before downloading code even if the program does not contain a digital signature, though the source of the program is not identified. In contrast to plug-in software and ActiveX controls, Java applets are prevented from damaging a user's computer through built-in restrictions in the Java Virtual Machine. "Java is the model for dynamic executable content on the Net," said Eric Greenberg, group security manager at Netscape.

1 0

Re: Go away CIA
by Wayne H. Allen 17 Dec '03

17 Dec '03

At 08:45 AM 9/23/96 -0400, Wearen Life wrote: >The CIA has many powers both great and small. If the can cover up findings >of UFO's Has this list sunk that low? Wayne H.Allen whallen(a)capitalnet.com Pgp key at www.capitalnet.com/~whallen

2 1

Re: AP [NOISE]
by jim bell 17 Dec '03

17 Dec '03

At 10:10 PM 9/23/96 -0400, hallam(a)vesuvius.ai.mit.edu wrote: > >Jim, > > I do support the presence of troops in Northern Ireland and >do not consider that to contradict my belief that there should be a >united, autonamous Ireland. I do not believe that the "loyalists" are >in fact loyal to the British way of life, any more than the KKK are >representative of the US south. > > Troops are in Northern Ireland for a very simple and depressing >reason. People like Jim want to impose their will on others by force. Quite the contrary. I want to reduce, as much as possible, the ability of people to impose their will on others by force. Read my essay. Eventually you might figure it out. The difference is, I recognize that if you set up a government to try to minimize non-government violence and coercion, you'll get just that: A minimization of NON-GOVERNMENT violence and coercion, at the expense of vastly increasing the GOVERNMENT kind. And I don't consider that progress at all. >Despite prolonged attempts by each faction to assasinate the leaders of >the other they have been unsuccessful. I suppose it didn't occur to you that this is EXACTLY why this dispute has gone on so long? What if instead of being "unsuccessful," these attempts suddenly became 100% successful. Easy, even. Just push a button and the top guy on the other side dies. And you could do this as often as, say, once an hour, with all of his replacements. And the other side can do the same to your leadership. How long do you think it would be before people decide that maybe, they DON'T want to "step up to the plate" and get killed for the sake of their cause? >If terrorists trained by Lybia >and Syria are unable to assasinate at will then we can be sure thaqt Jim's >band of kooks is not going to get any further. Which means that you clearly don't understand the motivating factor of a large, totally anonymous e-cash payment. And why should a handful of "terrorists" be successful? The "AP gang" will consist of 5 BILLION people who want to collect the reward, including anyone close to the target. It'll put an entirely new, ominous meaning into the phrase, "Friends and Family"! B^) >If the integration of both Irealand and the UK into the European >Union has not ended the situation the complete lack of government >will not either. Hell, the whole reason for this dispute is heirarchical social systems, in this case governments and religions! And adding the European Union merely increases the problem by adding to the heirarchy. My solution eliminates the heirarchy, totally. Why, then, should EU's failure imply a failure by AP? It's the diametrically opposite tactic. > It is suprising that someone from the press has not seized upon Jims >ideas as cause for another cyber-scare. I suspect this is because people >like Markof are somewhat more responsible. No, it's probably because they think, nervously, that I might just be right. Even that won't necessarily want to make them want to associate their names with my ideas. If they truly understand them, they'll recognize that it'll happen regardless of the amount of approval it gets from polite society. >This is not going to stop me >from producing an op-ed piece linkiing the net libertarians to assasination >politics unless I hear a few more repudiations of Bell's ideas. A doubt whether most people feel themselves obligated to repudiate a proposal, particularly if they don't know that it won't constitute an improvement over the status quo. On the other hand, if the world engineers a good, permanent solution to the Northern Ireland problem in the next six months, as well as the Middle East problem, the India/Pakistan problem, the Chechnya problem, the North/South Korea problem and a few other heretofore intractable problems, you can start feeling confident that my "extreme" solution will be avoidable. Until then, don't get your hopes up. >If you >don't very clearly reject his murderous ideas you are going to regret it >just as the left regreted having the USSR or the RAF associated with them. > Phill Time will be the best judge of this, I think. Jim Bell jimbell(a)pacifier.com

1 0

Re: provably hard PK cryptosystems
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:29 PM 9/23/96, Asgaard wrote: >On Sun, 22 Sep 1996, Timothy C. May wrote: > >> Suppose a tile is placed at some place on the grid, and another tile >> (possibly a different tile, possibly the same type of tile) is placed some >> distance away on the grid. The problem is this: Can a "domino snake" be >> found which reaches from the first tile to the second tile, with the >> constraint that edges must match up on all tiles? (And all tiles must be in >> normal grid locations, of course) > >Intuitively (but very well not, I'm not informed enough to know) >this might be a suitable problem for Hellman's DNA computer, the >one used for chaining the shortest route including a defined >number of cities? No, massive parallelism does not help with the _general_ case. (For any specific instance, especially for a finite grid, obviously the amount of CPU power is directly relevant.) Even assuming Adleman's "DNA computer" works and scales relatively well, its CPU power only goes up roughly with the volume of the computer. While it may sound impressive to speak of "moles" of computers, or "swimming pools" of computers, such volumes are utterly inadequate to solve combinatorially-explosive problems. (Remember, it doesn't take a very big RSA product before the 10^75 elementary particles in the Universe are not enough to factor it in a billion times the age of the Universe even if every particle were a Cray! So much for a tank full of DNA computers.) The domino snake or tiling problem is a similarly explosive problem. Try playing around with some tiles on even a 5 x 5 grid, and then contemplate how large 25! is. Then think about a 10 x 10 grid, and 100! Then a 100 x 100 grid. And it may be that the domino snake reaching from tile A to tile B snakes around and about in a far, far larger grid space than this! (Even if one is confined to a 100 x 100 grid, easily displayed on a sheet of graph paper, no intelligence in the universe will ever be able to find a snake reaching from A to B, except in special situations (e.g., the same tile, etc.).) This sort of problem is the essence of some "zero knowledge interactive proof systems" (ZKIPS) sorts of proofs. I present such a snake as proof that I am who I say I am. (Because I just "made up" some random snake, then announced only the starting and stopping points, A and B. Nobody else in the universe could ever find such a snake, but I can display my solution as proof I generated it in the first place. Of course, once shown I have given the proof away to everyone. The ZKIPS trick is in twiddling the grid and/or tiles in such a way that I can give _probabalistic_ information away. I don't know how to do this for the domino snake problem, but it's easy to understand the Hamiltonian cycle version.) --Tim May (Late News: I just heard (12:30 p.m., PDT) that Seymour Cray is in extremely critical condition after suffering head injuries in a car crash. It will be a sad day if he dies, or is permanently disabled. Though he started working for the Agency in the 1950s, in a precursor to Control Data Corporation, and worked for them on various contracts in the next couple of decades, he was a true pioneer. (The CDC 6600, 7600, etc., and the Cray-1 were funded by contracts from the AEC and NSA, and the first few of each were delivered to Fort Meade, Los Alamos, Livermore, etc.)) We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

US Govt. recent involvement in digital money & dig. signature issues
by Stanton McCandlish 17 Dec '03

17 Dec '03

[Excerpted from Edupage.] ALL EYES ON E-MONEY Treasury Secretary Robert Rubin has formed a task force to examine what impact the move toward electronic money transfer and storage technologies will have on consumers. Specifically, the team will look at how these technologies will affect lower-income Americans, and assess standards for consumer protection. The task force also will come up with non-regulatory measures that can be taken to protect consumers while allowing the market to develop. "I want to be certain that we make the right decisions as we begin this new era so that the benefits of these developments are broadly shared and have a positive impact on our economy," says Rubin. (Investor's Business Daily 20 Sep 96 A19) Meanwhile, the Bank of Japan and Nippon Telegraph & Telephone Corp. have jointly developed a very advanced, secure electronic money system, using NTT's high-speed digital signature system and its patented E-sign algorithm. The new system allows a number of banks to issue the same type of e-money to customers, relieving them of the responsibility of developing their own proprietary e-money systems. NTT hopes its new system will become the de facto standard for e-money in the country. (BNA Daily Report for Executives 13 Sep 96 A2) [...] POSTAL SERVICE TESTS ELECTRONIC POSTMARK The U.S. Postal Service is testing a system that would place an electronic postmark on e-mail messages, verifying the date and time the message was sent, and guaranteeing that the content had not been tampered with. The new system would enable more business functions to be conducted electronically, and would also provide an archive service, maintaining copies of "e-postmarked" mail, should any questions arise later. The current test will determine what price people would expect to pay for such a service, and which features work best. (St. Petersburg Times 20 Sep 96 E6) -- <HTML><A HREF="http://www.eff.org/~mech/"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org/"> Electronic Frontier Foundation </A><P> Online Activist </HTML>

1 0

Factoring technique, faster than trial division?
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

just an idea I came up with today, I don`t suggest it is a fast factoring method, but it would be interesting to know if it is faster than say trial division: Calcuate a composite number H such that H has a large number of prime factors (hundreds). now use the euclidean algorithm to try to find a gcd of X (the number being factored) and H, if there is none try a new H, if there is you have found a factor. It is hardly elegant but I would nevertheless be interested to see if it is apreciably faster than other kludge methods like trial division. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

RE: SAK_net
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On Sep 23, 1996 14:16:40, 'John Fricker <jfricker(a)vertexgroup.com>' wrote: >Didn't SAIC buy Network Solutions (registration part of the NIC) as well? Yes. This is part of the Administration's plan for government and industry cooperation to provide a secure information infrastructure for beneficial commerce and education and well-being of the commonweal, as well as joyful, healthy and even-tempered computer-addicted families in beautiful cyber-communities, even a tad of on-line virtual racial and gender justice, not counting assurance of a bountiful food and flowing spirits and languid afternoons of concupiscence and gluttony, overwatched by faith in a SupremeOrderliness, all arrayed along clean-wiped, info-streets and never-sweat GAK-global policies, just quiet, timely and comfortable transportation across speedbumpless borders, and, for the eyes and ears, lots of time left over for staring at the landscape rushing by and enjoying Tesh and Streisand and Julio and Jane's Addiction. Al Gore's office promised straight-jacketly.

1 0

Re: Bernstein hearing: The Press Release
by R. J. Harvey 17 Dec '03

17 Dec '03

At 02:59 PM 9/23/96 -0700, Lucky Green wrote: >Yes, you can be sued for sexual harrasment for trying to pick up a >stranger in a bar, should that stranger still feel bothered by your >advances while at work the next day. > >The courts have ruled, > Let's see some citations. Only if the two people involved are employed by the same employer might such an argument apply, and even then it's a long stretch under a "hostile work environment" argument. Cite a case in which individuals working for DIFFERENT employers successfully brought such a ridiculous suit. There's no way. rj

1 0

Re: We removed radikal 154 from xs4all :(
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:31 PM 9/23/96, tank wrote: >Hi all, > >We have temporary removed radikal 154 from xs4all. > >We did this because the german ICTF and BAW continued to stop IP-traffic >to and from xs4all. They not only blocked the web-server (with more than ... Unfortunately, this means that Germany wins. This will embolden Germany and other nations to apply similar pressures to other ISPs. While I don't fully understand the economic pressures the IP-traffic blockage may have had on your site, it is sad that a user account has been removed because some foreign government doesn't like it. My recommendation is that you restore radikal 154's account immediately, and post a message to all customers and on various Net forums indicating you will not remove user accounts for materials which do not violate your own national laws. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

7 6