December 2003 - cypherpunks-legacy

Re: A Global Village, or the future of porn on the net
by Alex F 17 Dec '03

17 Dec '03

> At 10:00 24/07/96 +0000, Alex F wrote: > Java classes for males and females corresponding to VRML > objects. The class methods might include kissing, hugging, > spanking, restraining... > > A female object might be initialized with Hillary Clinton's face, Evangelista's > body... The thing is that most people who are into this stuff would probably view VRML graphics as too primitive to hold their interest for the sake of "stimulation." I would suspect that the people who would end up getting involved in putting Hillary/Evangelista in, ummm, compromising positions would probably do it for the humor value (not that the censor mongers won't have a fit over this anyway). When your CPU becomes the bottleneck in net connections and not the actual bandwidth, *then* some people might decide to spend the time rendering such things. However, w/ the state of things today I have yet to see a totally realistic looking rendering. You can usually tell a photo from a rendering. > many pornographic stories on Usenet, it won't be long before > famous personalities > routinely get violated in cyberspace. Talk about copyright: do > you have the right > to prevent someone from doing this to you? > I suppose slander would be some recourse, or you could copyright your likeness and use copyright violations as well. Many TV/Movie stars do this. Alex F =-=-=-=-=-=-=-=-=-=-=-=-=- Alex F alexf(a)iss.net Marketing Specialist Internet Security Systems =-=-=-=-=-=-=-=-=-=-=-=-=-

1 0

Re: PGP public key servers are NOT useful!
by Perry E. Metzger 17 Dec '03

17 Dec '03

Amnesia Anonymous Remailer writes: > The web of trust just certifies that the key belongs to someone. If > you'd read to the end of the message, you would have seen that I was > not complaining about the key certification process in PGP. At issue is > NOT whether a key can be trusted to belong to someone, but whether or > not random people should be able to tag others' PGP keys with crap. You still don't get it, do you? It doesn't matter what random idiots tag onto your key so long as there is no trust path between the user of the key and the idiot who tagged stuff on. If someone signs "grand wizard of the KKK" onto your key, what do you care if no one trusts the signator who attached the crap? > What I want to prevent is some person I dislike uploading his > signature on my key (particularly if he adds another ID to my key and > signs that). Why do you care? > How would you like it if I added a new ID to your key containing sort > of insult, certified that ID, and uploaded the new signature to the > key servers. I wouldn't give a flying rat's buttocks, because unless the signatures are widely trusted the information is noise. Perry

1 0

Re: Oregon License Plate Site in the News Tonight!
by jfricker＠vertexgroup.com 17 Dec '03

17 Dec '03

My main concern regarding access to this information rests in the fact that this database has always been available to anyone who understood how to get it and use it. Recently I received a letter from some credit card company offering to provide me with my credit report, social security history, and insurance related records on a regular basis (for a fee of course). How about my police, fbi, school, and dating records while we're at it. How much is already available only to those that know the ropes. Well today AP ran another story about the reaction surrounding Aaron's actions. Nice picture of the back of Aaron's head. They didn't print is lisense plate number either. ObCypherpunks: How many people do you know that are working on a day to day basis with medical records systems, the District Attorney's computers, your doctor's computers, state Department of Health, and so on. I'm sure it's come up before but isn't this an obvious of application of encryption and PAK (Public Access to Keys)? Any legislation currently to _require_ that medical records and such be encrypted with access restricted. Something like: Alice (my primary care giver) and I each have the key to the records that Alice stores. Bob (my dentist) has a legitimate need to these records so I issue Alice and Bob a new key. With that key, the software allows Alice to make a replicate (synchonizable at that) of the record and transfer it to Bob who uses his key to access the data. It may even be that _any_ time, any of the replicas are to be accessed _my_ private key must be employed although one may argue that in times of tragedy it would be prudent to get my medical history immediately. I would say there is little in those records that would help an emergency room doctor make life saving desisions. That anything that the ER should know about me to save my life should be on a Medical Emergency Bracelet. I guess it would not matter if you encrypted with a key short enough to mumble from the back of an ambulance. The market for encryption enabled applications is just about to take off. --j At 03:25 PM 8/8/96 -0700, Rich Graves wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >I agree that this project needed to be done to educate the public, but I >must say I'm glad my name isn't attached to it. > >To answer legitimate concerns about abuse, perhaps version 2 could make the >relevant http logs publicly available? So in addition to checking the >governor's son's driving record, you could check which other IP addresses >have been looking at the governor's son's driving record. Spider detection >and retaliation would also be nice. > >(Of course this would have the side effect of increasing the visibility of >the anonymizer/canadianizer/exonizer services, which would not be a bad >thing.) > >- -rich > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 > >iQBVAwUBMgppM5NcNyVVy0jxAQFjFwIAyio1QMkAC7/sH3PdVbGXuTImey+1ewg2 >Nxl7bZlZe/YvYlk2yomKW24bgZJ5Vjiecc7g35SM+jveLRWA0xgbkg== >=yDFP >-----END PGP SIGNATURE----- > >

2 1

Re: F2 hash?
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

At 01:27 AM 8/8/96 +0300, you wrote: >As I have to deal with SecurID tokens in the nearest future, I would like >to hear more opinions about these cards. IMHO a proprietary algorithm like >used in those cards is a bad thing and I would like an open approach much >more, I still believe SecurID OTP cards are much better then usual >passwords. > >At Defcon this year they promised to tell about some security flaws in >SecurID tokens, anyone know more about that? > >Personally I believe that Security Dynamics should come out with some kind >of new systems in the nearest future, now that they own RSA. Have you seen Mudge's white paper on S/Key? It isn't specifically regarding SecurID, but many of the flaws he discusses are fundamental to the nature of both S/Key and SecurID (and other OTP schemes), so apply to SecurID as well... //cerridwyn//

3 2

Re: Oregon License Plate Site in the News Tonight!
by jfricker＠vertexgroup.com 17 Dec '03

17 Dec '03

Have bandwidth, will travel. Server space available here. www.vertexgroup.com/dmv/ is good to go. Database front ends a speciality. At 05:57 AM 8/8/96 -0700, Declan McCullagh wrote: >Looks like we're a little late. However, we can still grab the tape from >Oregon's DMV for $220. It would be an interesting excercise to try to get >these tapes from each state with similar provisions and put them all >online. > >Anyone want to donate server space? > >-Declan > > >http://www.spiritone.com/cgi-bin/plates > > Service has been temporarily suspended. > Don't panic, I just want to think about the situation for a while. > Stay tuned. --Aaron > >--- > > There is a very real chance that it will be turned off. That's becuase > all of the people who hate it call the TV and Radio stations, the DMV, > and their elected representitives. All of the people who love it send > me email. As much as I appreciate hearing from all of you, sending me > email doesn't let anyone else know how you feel. If you want to keep > this service going, make your voices heard. > > > >On Wed, 7 Aug 1996, Timothy C. May wrote: > >> >> Cypherpunks make the news again. >> >> I'm watching the LA NBC news channel, and they report that the Oregon "look >> up any license plate" Web site is causing a flap. Though apparently legal, >> the critics admit, the Governor wants the material removed. >> >> (Sounds like a good time to mirror it on some other sites, pronto!) >> >> --Tim May >> >> Boycott "Big Brother Inside" software! >> We got computers, we're tapping phone lines, we know that that ain't allowed. >> ---------:---------:---------:---------:---------:---------:---------:---- >> Timothy C. May | Crypto Anarchy: encryption, digital money, >> tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >> W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >> Licensed Ontologist | black markets, collapse of governments. >> "National borders aren't even speed bumps on the information superhighway." >> >> >> >> > > >// declan(a)eff.org // I do not represent the EFF // declan(a)well.com // > > >

3 3

Re: Oregon License Plate Site in the News Tonight!
by Jim Byrd 17 Dec '03

17 Dec '03

This appeared on AP today: ------- PORTLAND, Ore. (AP) - A computer consultant who put a state list of motor vehicle records on the Internet suspended access to the site today after he was bombarded by complaints the service invaded people's privacy.

1 0

An SSL implementation weakness?
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

The following weakness seems very obvious, I've got a partial writeup of this but before I turn it into a paper or something and arrange a demonstration of how it would work I thought I'd check to make sure (a) someone else hasn't mentioned it before, and (b) it is actually possible (it seems too simple to be true): 1. Using DNS spoofing, stage a hostile takeover of an address (for example using bogus referrals set yourself up as the delegated server for a DNS subtree). 2. Get a Verisign certificate for an arbitrary company and set up a bogus site at the stolen address. Lets say you steal www.megafoobarcorp.com. People connect to this site (which is actually your bogus site), Netscape (for example) displays the blue line and non-broken key (which is actually for your J.Random certificate rather than the real megafoobarcorp one) to show the connection is secure, and you've just subverted their site. The problem is that unless the user on the client side checks their certificates (which noone does), all they're told is "A secure link is established", not who the secure link is established to. Even if browsers did pop up a dialog to tell them who the secured connection was to, after about the third time people would click on the "Never show this incredibly annoying dialog again" option and never look at it again. This effectively reduces an attack on an SSL-enabled server to an attack on the DNS. Is this as simple as it seems, and is it worth doing a writeup on? Peter.

5 4

AOL crashes and burns
by Warrior 17 Dec '03

17 Dec '03

Great news, eh?

1 0

Freedom vs. US-Citizens
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

http://www.yahoo.com/headlines/960808/news/stories/crashpoll_1.html Thursday August 8 1:14 PM EDT Terrorism Fears Prompt Support for Limits LOS ANGELES (Reuter) - Most U.S. citizens are willing to give up some civil liberties in order to fight terrorism, according to a poll published Thursday. A nationwide survey conducted by the Los Angeles Times after the explosion of TWA Flight 800 and the bombing at Atlanta's Centennial Olympic Park also showed that Americans favored economic sanctions over military action against countries involved in terrorism. It found that 65 percent of those surveyed were somewhat or very concerned that the fight against terrorism could bring restrictions on civil liberties but 58 percent said they would be willing to give up some liberties to help curb terrorism. Government and aviation officials have indicated that increased security measures at airports around the country could mean more thorough and time-consuming inspections of luggage, questioning of travelers and higher fares. Of those polled, 66 percent said they strongly favoured more secure airports, even at such costs, while 17 percent said they ``somewhat favoured'' such measures. Asked what action, in addition to trying those individuals responsible, the United States should take if the TWA crash is linked to another country, 40 percent favoured economic sanctions against that nation, 14 percent opted for military action, 10 percent thought both should be used and 8 percent thought no action should be taken apart from a trial. The telephone survey of 1,572 adults was conducted from Aug. 3 through Aug. 6 and had a margin of error of plus or minus three percentage points.

1 0

Re: Anonymous Remailers at work
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

I've been trying to encourage the scientific ethics people to have an email address for tips + information about using anonymous remailers. As can be seen by the first part (lack of an email address), I haven't gotten very far as yet... -Allen

1 0