December 2003 - cypherpunks-legacy

"The Observer" calls the internet a child pornography ring
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

Banner Front page headline in the British Observer, Sunday 25th "The Peddlers of child abuse" see http://scallywag.com/ The internet is presented as a conspiracy by child molesters. There is a picture of Johan Helsingius, the man who free of charge provides an anonymous remailer service: The picture is captioned "The internet middle man who handles 90% of all child pornography" He is represented as personally profiting from the distribution of child pornography, though in fact no posts to binary newsgroups can go through his system, and no large binaries can go through his system, and he provides the anonymising service free of charge. There is a picture of Clive Feather, the man who runs the largest internet service provider in Britain, captioned "The school governor who sells access to photos of child rape"]] The observer article savagely demonizes all who use the internet, presenting it as primarily existing for the purpose of distributing child pornography, and demonizes and libels by name those who have sought to defend the liberty of netizens. I urge you all to check out this article, and send snail mail letters to the observer condemning (since they are obviously too low tech to read email) and email letters of support to those netizens who have been savagely libeled for their defence of liberty. --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from the arbitrary power of the omnipotent state. http://www.jim.com/jamesd/ James A. Donald jamesd(a)echeque.com

1 0

Real-time key server
by Osborne, Rick 17 Dec '03

17 Dec '03

Okay, I was told to not post to the list until I'd: 1. Lurked for a month, 2. Figured out who Detweiler was, 3. Found out about BlackNet and DC Nets, 4. Learned of at least three of David Chaum's innovations. And at that point "[I] may be ready to post [my] first comments." Well, dammit, I can't wait that long. I need help now. I've only been on for 2 weeks, I have no clue who Detweiler is (other than the welcome message I haven't heard two words about him/her/it), and I know enough to sound stupid about the other stuff. But if you still think I'm worthy of listeneing to, then read on. I work for Northrop Grumman Corp (SBMS division) when I have been tasked to create a program for reciept of online forms. The entire division is wanting to go paperless, and I am the sole person doing it. (Yes, I'm going for pity here.) I am writing my own CGI remailer for insecure forms, but some of them have to be secure. I think the best way to go about this is a public-key system with both keys stored locally and the public keys stored on a networked database (for routing purposes; ie, it has to go through managers and admin and will be verified and digitally signed with each hop). Now, of course, acces to the public keys will be through a key server. This is where I come into my problem. In my research into keyservers, I find that none of them are realtime. Sure, there are CGI interfaces to them, but that's not what I mean. I was hoping for something along the line of a Finger or SMTP protocol, such that a client connects to a host (say, keyserv.northgrum.com) on a certain port (say, 5397) and goes through a realtime version of what is accomplished via email. Something like: [connect] client>GET osborri server>200 OK server>-----Begin . . . and so forth. Now. Yes, I am intelligent enough to implement something like this. (Actually, that's debatable, but it's also besides the point.) What I want to know is this: Is there a realtime implementation out there already? Why? Because: 1. I do not want to reinvent the wheel. 2. I would like to conform to existing standards. Now, if the answer is a 'no', then who wants to draft a quickie RFC? -oz

1 0

Re: Sen. Leahy's "impeccable cyberspace credentials"
by raffetto＠podesta.com 17 Dec '03

17 Dec '03

Josh Crockett is exactly right here... > It would seem >that we need to hunt down our issues and support them, seeing as that >politicians are notoriously unreliable on supporting every single issue >we would like them to support. And that's why Declan's message about Leahy is foolish. When you find a champion on the Hill for one issue, you rally around him/her. And when they won't support you on another issue, you find another champion. If your policy is to disown Hill allies (in this case, Leahy) who break ranks with you from time to time, you'll quickly run out of allies. And when you have no allies on the Hill, you're really screwed. John Raffetto

1 0

Re: $10K offer if you can break the code
by Michael T. Babcock 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: mpd(a)netcom.com, cypherpunks(a)toad.com Date: Tue Aug 27 17:17:57 1996 Date: 23 Aug 96 13:59:38 EDT From: "JOHN E. HOLT" <76473.1732(a)CompuServe.COM> Subject: secret message To: <mbabcock(a)tyenet.com> Date: 01-Aug-96 14:50 EDT From: JOHN E. HOLT [76473,1732] Subj: puzzle ^%}{{ ZZ VVPAGMIGJEKMCCHIAKKPEHJDDDLOABGAMMJOCDFNOLNOKKKNIADPBGPPOEPIDCEMPGWW VVFCMOPKLKPJOHCNCJBDGOOJKFANCJJBDBMDIFIEKEDPLKDDGMPLHMIIPIJFMKOLENWW VVCAKJGJCKPAEOOMLJPNFJEKEINIHFKHNOLPCAHLEKHHLMHJFCOEKAFAGPHJBCPBHBWW VVOKLAENICAFDHEOEODMHMFGIONMAACAOHEOHDAJDNENGAHABNHGOCCPJNFDMAMKADWW VVMGDHKGPKBEIDBNLOCMLFMEIOKBFBFKJIMIIIFKJDFENCBPAPFBAOFMHEDODBFFPDWW VVOMFFJBNGEJPLGHJLFOBLFOGCBKAACEICLBIKHGILKCLMHPFIAHPDEOOODPPMLGDNWW VVGLDNEBDINMILDJDOJOJNKCLIBBKBCBEJPBJCFHGKMFLLEPGLGOOIIGAKJEGNPFHDWW VVIJBMFLALHPEHHGEGPCLGILBDBMEGMOGOIFBPPONGEDJPNFNMPCJFJPAEMIDOEMBLWW ZZ ZZ Distribution: To: ME > [76473,1732] Message Copyright 1996, Michael T. Babcock http://www.cyberbeach.net/~mbabcock Send a message with the subject "Send public key" to receive an automatic reply with my public key. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: ascii Comment: http://www.cyberbeach.net/~mbabcock/PGP/ iQC1AgUBMiNmCttTCwP6TF2xAQG65AT9GW2JbpaAo26USWptnLhhdaHWXbvDEi2i 35KWFHPWnlfJmj7NiUz+YKAV1aoHJssbGGUKIGoU1R0AV9NepGcODRwamrpZMXZ2 2TWIjgc0NbI+G9PNJrtc9h0XhsWV+w9upF0Yr1uCdCMtsdQtMKGguPzfd3+CfOkq X5kSv4WIhi22WYwHHlyEyEMPrxMo60ey1EFUUctBYLqgl91omsR+qg== =wEv6 -----END PGP SIGNATURE-----

2 1

Re: Microsoft Explorer security hole (fwd) MSoft's reply...
by Joel McNamara 17 Dec '03

17 Dec '03

Displaying warning dialogs in browsers and using default settings so as not to auto run macros are only bandages to this problem. Consider the following: By using API routines to access the Win95 registry, someone writes a macro virus (or even just a garden variety trojan) that turns off the warning levels for MSIE which are stored in the registry (I haven't had time to look, but I'm assuming they're there). The user has no idea the setting has been changed, and is never warned when evil, malicious, unsigned code is executed. Until too late. The registry, or whatever file you're saving state values to, should have some form of write authorization associated with it. Encryption would also be extremely nice for privacy's sake (check out a Windows .INI file or registry entry some time, and see what little tidbits of information are being stored there). In my experience, one of Microsoft's main problems when it comes to security has been its developers and program/product managers don't think like "bad guys" when it comes to design and subsequent exploits and holes. Unfortunately, the user is the ultimate loser. Joel BTW - The paranoid side of me wouldn't be surprised to see PC "espionage-enabled" viruses and trojans within the next few years. Their main purpose would be to either disable or patch various security features for later attacks, or directly snatch information off of hard drives and send it out over the Net. I know of a few lab projects of a similar nature, that were very easy to implement. >Date: Thu, 22 Aug 1996 15:49:33 -0700 >From: Thomas Reardon <thomasre(a)MICROSOFT.com> >Subject: Re: Internet Explorer security problem (Felten, RISKS-18.36) > > >We have discovered a security flaw in the current version (3.0) of > >Microsoft's Internet Explorer browser running under Windows 95. An > >attacker could exploit the flaw to run any DOS command on the machine > >of an Explorer user who visits the attacker's page. > >We now post the virus warning dialog on local files (file: urls). We have >always posted it on remote files (http: urls). Note that the root of the >problem is not Java or the browser, but in macro-enabled applications. IE3 >has a mechanism to warn users about safety of documents when used with >common macro-enabled applications. We are have updated Microsoft Word such >that by default it will not run macros embedded in documents. > >-Thomas

1 0

Re: (NOISE) Re: Free Pronto Secure Offer
by Michael T. Babcock 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: unicorn(a)schloss.li, cypherpunks(a)toad.com Date: Tue Aug 27 17:33:42 1996 > So would I, however, the assumption that "cypherpunk crypto review > services" are to be had for nothing is the height of arrogance. They've already got a lot of us reviewing it... sorry, it's not arrogance - -- they were right. > If you were sincere, you'd thank them with cash. Afterall, you seem > to suggest that you have a good deal of liquidity eh? Actually, they lose $99 each time they give us a free copy of the software ... in case you're not as good in accounting as you think you are in crypto. I have no idea what your rep. is ... but I know one thing, they're offering an exchange of valuable software (market value: $99) for valuable services (crypto-rebel review) > Uh, the kiss ass paragraphs were the reviewers comments, not your code. I aggreed with the reviewers comments, they're mine too ... I've sent many long E-mails to people I do computer service for endorsing Pronto Secure. I have lined up 6 people who wish to purchase it. This is for real pal. If you don't like it, get out of the ring. Some of us want our PGP to be nice and easy like E-mail used to be. Message Copyright 1996, Michael T. Babcock http://www.cyberbeach.net/~mbabcock Send a message with the subject "Send public key" to receive an automatic reply with my public key. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: ascii Comment: http://www.cyberbeach.net/~mbabcock/PGP/ iQC1AgUBMiNpvNtTCwP6TF2xAQGKSwT+Lg+uEKBX9yUfZvkZ6tO32fhilvb65sgJ lpH2MPIArTKIYw/nD4UGQbQPTtx/9+1ASx5V+uqmquy7t/yfbuajrmsuLjnGBc/D tYxAxRl31+sU3N8X2ie54X1VWcLzgqfXCByuTYIHPPkeHjk7kWJfwTqXZsLV/ZZp NYGaL6OWq+DXWN3IYxd43fVdfi6qzCxDjseIdAdoV4J7TCjOUCNXbg== =WqpJ -----END PGP SIGNATURE-----

1 0

Re: (NOISE) Re: Free Pronto Secure Offer
by Michael T. Babcock 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: geoff(a)commtouch.co.il, cypherpunks(a)toad.com Date: Tue Aug 27 17:29:43 1996 > To: unicorn(a)schloss.li, cypherpunks(a)toad.com > Date: Fri Aug 16 02:41:34 1996 > Unicorn, > > > No, I was merely pointing out that if the review revealed that it > > had problems (one assumed that the intent of peer review is to reveal > > such problems in the first place, but perhaps you just like giving > > software away?) then the offered reward was valueless. No, actually, after having pointed out one (and found another) bug in Pronto Secure, I find it to be an amazing piece of software! It does everything with PGP and although it's slow at adding new keys (I presume it always checks the signatures down a few levels every time it adds one, and thus justifiably slower then straight adding a key) it's fast, efficient, and fairly easy to use. I must admit that of the "View/Save/Inspect" options, only "Save" is very clear and the rest are (excuse the pun in advance) cryptic at best. However, the methods used for the cryptography seem to be sound and after monitoring my COM transmissions, I haven't had it sending my secret key ring out ... ;) ... (unless they're hiding it in tiny packets ;) > Peer review seems to have voted that their risk paid off. My vote's in. Thanks for the software! > > Cypherpunks is always getting the cash poor developer who thinks he > > very clever because he has to pay testers no money if he offers his > > new product free to the person who discovers a flaw, or writes a > > review. I actually think that Commtouch will not be cash poor in a few months ... > > From your home page, I would guess that you request that reviewers > > allow you to make their comments public. That's called an > > endorsement, and, by the way, people are usually paid for them. > > Sometimes in the millions. Think Michael Jordan is getting a deal > > when you use his name to promote your product and then give him a > > $99.00 piece of software (which is effectively worth the amount of > > time it takes to write a few kiss ass paragraphs on the software, not > > $99.00)? That's because they're famous and their opinion is considered to be very good. I could see them paying Phil Zimmerman to endorse it publicly, but it wouldn't matter much because the mainstream people (the ones they're targetting with Pronto Secure) don't know who Zimmerman is ... so it's not worth they're money ...! > I venture that most c'punks would agree that moving strong e-mail > security into mainstream is a good thing. This is not going to happen > without people making money from it. Definately... Message Copyright 1996, Michael T. Babcock http://www.cyberbeach.net/~mbabcock Send a message with the subject "Send public key" to receive an automatic reply with my public key. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: ascii Comment: http://www.cyberbeach.net/~mbabcock/PGP/ iQC1AgUBMiNo19tTCwP6TF2xAQHwUgUAlJGE5ZU0xV7Hx3u7+/MRv+n83Kn9ZxsE 8igHrEjLwVbfBC9ivoZ7aonm/misAdy2jr77oowPcvuE3t750oCMCfb+AdhUPQGx Knu29L4XNbgpUH+t5rCCqUiSM7EHIYtmURBjrmDSAADIH3vcd8b9Cc6T5soNIQK+ Nsy9hve+ly+4nVwujNKqAhOCvIMBn+wK/K+ifbAvGbXP65YQFktp4Q== =AF5P -----END PGP SIGNATURE-----

1 0

RE: File System Encryption
by Wayne Clerke 17 Dec '03

17 Dec '03

---------- From: Drifter[SMTP:drifter@c2.net] Sent: Monday, 26 August 1996 16:19 To: cypherpunks(a)toad.com Subject: File System Encryption I'm aware of the three main disk encryption programs SFS, SECDRV, and SECDEV, but I need to find a solution that works with Windows 95 32bit or Windows NT 4.0. I'm currently using SFS 1.17 and Secure Drive under Win-95, but am unable to continue to work in dos compatability mode due to severe performance hits. I am open to commercial products that have passed peer review, but know of none. If anyone could suggest a solution (outside of switching OS's), I would be *most* gratefull. Please respond to the list, as I am a subscriber under another account. Tried secdev? Edgar Swank (author of secdrv) recently posted that secdev (note, not secdrv) does, in fact, uses 32 bit disk access with win95. Win95 reports that the secure device is in compatibility mode, but the host disk (and therefore the secure volume file) is being accessed in 32 bit (disk) mode. Not sure what issues there are with '32 bit FILE access' mode here. Sounds worth a try though. Please post the results if you try this. The Drifter EMail: wclerke(a)emirates.net.ae PGP key ID: AEB2546D FP: D663D11E DA19D74F 5032DC7E E001B702 PGP mail welcome. Voice: +971 506 43 48 53 <a href=mailto:wclerke@emirates.net.ae>Wayne Clerke</a> If you're not living on the edge, you're taking up too much space.

1 0

a question please
by Charley Sparks 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Tue Aug 27 19:39:45 1996 I have been lurking for some time, the occasional quip of a post, perhaps a comment on a "shrink wrap" - I still haven't figured out "Black Net" Done searches, ( the usual ) and no luck... can I get a break ? Would someone please explain it to me ? Thanks, and my PSecure is registered ! - -------------------------------- Charley Sparks <sparks(a)bah.com> Booz Allen & Hamilton - -------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCXAwUBMiOHQuJ+JZd/Y4yVAQGMcwQMDs5Owwd5XH6+XPUVZow4NMq1rV+QXp6W dLeF0vGT9rg5n6NZJKuAxSFuiXjJLKpv1JePSI2y2mmqMKncajhl2NvvtNPtnK/z dYF8D2sDvdPVffbxBO7QfjDwV9k5LmEVk24sOjbIk+j6zIZW899OAvT6CadoCmRS 1dQ9VWMyI0vunw== =tfni -----END PGP SIGNATURE-----

1 0

Re: Net Politics
by baby-x＠cyberpolis.org 17 Dec '03

17 Dec '03

At 10:23 AM 8/27/96, Jonah Seiger wrote: >This is an important debate that unfortunately seems to be dividing the >net.community when we most need to be united. All of us working on >net-policy issues share a common vision and goals - promoting the free flow >of information, preserving and enhancing First Amendment values and >protecting individual privacy. There are, for better or worse, many >different views on the best way to accomplish those objectives, and the >debate over who has the right tactics seems to frequently escalate in to >religious war. Not an unusual thing online (Windows! Mac! Windows! Mac! Linux!). >Meanwhile, our opponents are well organized, determined, and do a much >better job of keeping their internal strategic differences to themselves. >Perhaps this is part of the reason they keep kicking our butts all over >town. I swer I had this conversation somewhere recently, and those of us involved in it came up with one reason this rift seems to come up so often and get discussed so publically, especially in comparison to our "organized, determined" opponents. I would hazard a guess that those people working within the cause of electronic freedoms tend not to be the simple order-following, authority-heeding sort (compared to, say, followers of the Religious Right). It's easy if you're Ralph Reed to send out a flyer or get the telemarketters working and tell the troops what to do. It's not as easy if you're, say, Jonah Seiger. Not because of Jonah (or Shabbir, or Declan, or whoever), but because of his audience. It's not a push-button response with us. And I'm still not convinced (as I wasn't last year when I was more heavily involved in some of this) that these differences of opinion have to somehow be kept behind-closed-doors. That has always stuck me as the way -they- do it (if I can stoop to using a Them for a moment), and never as a way that was inherently required. It's like the Gulf War or something. "Hey, we're at war, stop criticising, we need to be united!" Hogwash. -----------------------------------------------[ Christopher D. Frankonis ]--- --------------------------------------------------[ baby-x(a)cyberpolis.org ]---

2 1