December 2003 - cypherpunks-legacy

Re: Unix passwd-cracker online?
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

I've given this some thought before, and there are some optimizations required... First of all, assuming you have one plaintext password for every crypt()'d combo and salt (I think there are actually a bunch of possible plaintexts for each encryption, but I'll assume that we'll save the one that looks most like an english somethingorother as any of them should work.) If you just sort them, you only need to store the 8 char plaintext, which helps with the storage, and halves it approximatly (a little more, actually.) Now...Still too much sotrage for one system, but if we had a network of machines around the Internet, with multi-gig tape changers (i've seen 40GB changer things a discount places for $1000) I figure DNS could server as a way of reaching the system that has the range you want..say we have maxhines named xJG*a.crackcrypt.com, with a leading letter on each hostname, followed by enough characters to represent how much of a range that system holds. I don't have a back of the envelop handy, and it's too early in the morning...so I'll do the calc later. But, for a small fee, anything can be arranged :) Ryan The real problem becomes regeneration when someone's tape goes corrupt.... ---------- Previous Message ---------- To: al177820 cc: cypherpunks From: wmono @ Direct.CA (William Ono) @ smtp Date: 08/17/96 01:27:53 AM Subject: Re: Unix passwd-cracker online? On Fri, 16 Aug 1996, Carlos L. Mariscal may have written: > person has obtained a specific password by entering the desired > adresses'passord on a submnit form in a Web page. [deletia] > never have it if there really is such, but this came to my mind when i read > the posts on the plate-numbers-in-Oregon polemica. I would appreciate Somehow I have a hard time believing this to be true. I run crack, a password searching program that uses a dictionary as its base, on my /etc/passwd regularly to locate any users with easily guessed entries. With ultra fast crypt (UFC), the fastest crypt() replacement I can find, I can run through about 9700 passwords per second on this P6-150. Now, this is a back-of-the-envelope calculation: Assuming that the password can be one to eight characters of the following: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*() we find that we have a set of 72 characters. That gives us 72^8 + 72^7 + 72^6 + 72^5 + 72^4 + 72^3 + 72^2 + 72^1 or 732376025552520 possible combinations. At 9700 encryptions per second, it would take my system 2401 years to brute force -one- password to completion. That means that, most likely, if this 'locate password on demand' system existed, it would not work in real time, or in any time during any person's life. Moore's Law might shorten this timeframe considerably, but still not to any reasonable time frame. Continuing with my back-of-the-envelope estimate, we have the length of a crypt()'d password as being 13 characters. The password in plaintext has to follow, with a length of 8 characters. At a size of 732376025552520 * 21 characters, we would have a database of 15379896536602920 bytes, or 22565249 650mb CD-ROMs. That's for the passwords of one salt, without any formatting. Even if we could achieve a 95% compression rate on this data (it is text, after all) we would end up with 237528 CD-ROMs. Most likely my set of characters will be found to be incorrect, but anything that includes even a-z, A-Z, and 0-9 in one to eight character combinations most likely will not be a favourable crack target. Sorry, I don't think this is feasable, or possible. (Please do correct my calculations if errors are detected, especially if the corrected numbers make this possible.. it's getting late at night, and my mind is fogging up, so these calculations/estimates/wild guesses may be off more than usual. It does sound like an interesting project to undertake, if it were possible, but not on my equipment!) -- ** NOTE NEW KEY ** As of 08/28/95! Old key 0x2902B621 COMPROMISED! William Ono <wmono(a)direct.ca> PGP Key: F3F716BD fingerprint = A8 0D B9 0F 40 A7 D6 64 B3 00 04 74 FD A7 12 C9 = fingerprint PGP-encrypted mail welcome! "640k ought to be enough for everybody."

1 0

Re: Unix passwd-cracker online?
by ScottMorris 17 Dec '03

17 Dec '03

At 01:27 AM 8/17/96 -0700, you wrote: >On Fri, 16 Aug 1996, Carlos L. Mariscal may have written: > >> person has obtained a specific password by entering the desired >> adresses'passord on a submnit form in a Web page. >[deletia] >> never have it if there really is such, but this came to my mind when i read >> the posts on the plate-numbers-in-Oregon polemica. I would appreciate > >Somehow I have a hard time believing this to be true. I run crack, a >password searching program that uses a dictionary as its base, on my >/etc/passwd regularly to locate any users with easily guessed entries. >With ultra fast crypt (UFC), the fastest crypt() replacement I can find, I >can run through about 9700 passwords per second on this P6-150. >[snip] You of course are assuming they are using a Unix box. I commonly offload the etc/passwd file to my pc (p-100) and run Crackerjack against the file. With a single username a 5 meg wordlist will run in about 30 seconds (mileage will vary). The concept is certainly interesting and is another case for good passwords. Of course you need to get the password file first which is another story for another group. >Sorry, I don't think this is feasable, or possible. While I believe this is possible feasable is another story. >(Please do correct my calculations if errors are detected, especially if >the corrected numbers make this possible.. it's getting late at night, and >my mind is fogging up, so these calculations/estimates/wild guesses may be >off more than usual. It does sound like an interesting project to >undertake, if it were possible, but not on my equipment!) > > >-- ** NOTE NEW KEY ** As of 08/28/95! Old key 0x2902B621 COMPROMISED! >William Ono <wmono(a)direct.ca> PGP Key: F3F716BD > fingerprint = A8 0D B9 0F 40 A7 D6 64 B3 00 04 74 FD A7 12 C9 = fingerprint >PGP-encrypted mail welcome! "640k ought to be enough ----- Scott L. Morris Systems Security Consultant smorri59(a)icubed.net Data Forensics Finger smorri59(a)ally.ios.com for my pgp public key.

2 1

No Subject
by Jeremy Mineweaser 17 Dec '03

17 Dec '03

At 09:08 PM 8/16/96 +0800, rednax wrote: >Speaking of NT, I downloaded the full version of msie 3.0 the other day but >when I tried installing it, an error message came up saying that it requires >a Win95 or WinNT4.0 build of 1381 or higher. I am currently running NT 4.0b >that has a build of 1314, does anyone know of where is the upgrade or >service packs(if available)? I have tried looking around microsoft.com, but >they neither provided any detail nor did they provide an e-mail. Build 1381 is the final release of NT 4.0, not a beta version. Build 1381 was released to OEMs about a week and a half ago. It should reach a retail outlet near you before September. There is no free upgrade from the beta version of NT 4.0 to the final version. You may want to purchase a copy from Microsoft, or sit in IRC for a while and wait for someone to hand it to you. --- Jeremy L. Mineweaser | GCS/E d->-- s:- a--- C++(+++)$ ULC++(++++)>$ P+>++$ gt4436c(a)prism.gatech.edu | L+>++ E-(---) W++ N+ !o-- K+>++ w+(++++) O- M-- | V-(--) PS+(--) PE++ Y++>$ PGP++>+++$ t+() 5 X+ R+() *ai*vr*vx*crypto* | tv(+) b++>+++ DI+(++) D+ G++ e>+++ h-() r-@ !y-

1 0

Re: "world communications being monitored"
by Wayne H. Allen 17 Dec '03

17 Dec '03

At 08:44 PM 8/16/96 -0700, Vladimir Z. Nuri wrote: > >------- Forwarded Message >From: "Mat Guthrie" <matguthrie(a)enterprise.net> >To: mmlist-l(a)newciv.org >Date: Wed, 14 Aug 1996 20:14:39 +0000 >Subject: All Int' Communications Are Monitored > > >- - -> SearchNet's snetnews Mailing List > >Hi there all, > >I heard an amazing news report on the radio today, that confirmed >what I've heard and suspected for a long time - all international >communications *are* continually being monitored!! No, what this guy heard was a book report. I don't know how well a writer Mr. Hager is but if he doesn't have proper documentation then he confirms nothing. > >The report was on "The World at One" news report on BBC Radio 4 - >about as respected, reliable and informative a source as any >mainstream media is ever likely to be. The feature spoke about a >book that's come out in New Zealand called "Secret Power" by Nicky >Hager, that has been endorsed by the former (?) Prime Minister of New >Zealand himself. It supposedly goes into great detail about an >international agreement called "Echelon" of which the US, UK, >France, New Zealand, Australia and several other nations are all >participants. According to Nicky Hager - who was interviewed on the >program - a system of monitoring stations have been set up in various >countries in the world that continually monitor ALL fax, email, >telephone and satellite communications etc, "sniffing" for keywords >using super computers. When these key words are identified the >information is automatically logged and according to Hager, sent >directly to the US intelligence services. > >Now whilst many of us have undoubtedly come across this sort of >information before and undoubtedly many of us have probably scoffed >at such ascertions as merely impossible and blatantly paranoid, >something very significant sets this report apart. Before the book >was published, Hager went with his manuscript to the New Zealand >Prime Minister who had been responsible for signing NZ up to the >agreement (I got the impression that he is no longer in power). If anyone cares to look up the political history of the western Pacific rim, it would seem very suspicious that N.Z and Australia would have any intelligence commitment with France at all. >Anyway, the PM was so shocked by the revelations that the book >contained, that he has written the forward to the book. Supposedly he >says that he had no idea of the true nature of the agreement and the >powers which it bestowed on the intelligence services and is >obviously trying to distance himself from the storm that's beginning >to brew up about it. Maybe he's just covering his arse or maybe he >was just another puppet head of government who wasn't properly >informed about what was really taking place in his own country, but >either way, the fact that he has got involved with the book adds >considerable credibility to it's claims. If the PM has no credibility (his saying he knew nothing) how does his input add credibility to the book? Those of you who have often >said that such wide-scale monitoring is "obviously impossible" might >be wise to re-evaluate your positions! > Those of us in-the-know won't be reevaluating anything. Save your money and wait for the book to get into the local library. Better to spend your money on David's book on Enigma. Wayne H.Allen whallen(a)capitalnet.com Pgp key at www.capitalnet.com/~whallen

1 0

Re: Imprisoned Capital
by James A. Donald 17 Dec '03

17 Dec '03

[In response the argument that attempts to imprison capital will cause capital flight] At 10:50 PM 8/16/96 +-200, Bart Croughs wrote: > This is a good point when you talk about governments that will > prevent *all* capital from flowing out. But a government could > prevent the outflow of capital of it's own citizens, and still > allow capital of foreigners to leave the country. As long as > foreign capital isn't imprisoned, foreign capital could be > attracted. Been tried. Does not work. 1. If foreign capital is allowed to freely enter and leave, internal players find ways to sneak their capital out. This forces the government to start regulating and supervising foreign businessmen in ways that at best terrify them (such controls look very much like creeping confiscation), and at worst cause them huge harm with no real benefits to anyone. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: National Socio-Economic Security Need for Encryption Technology
by Bart Croughs 17 Dec '03

17 Dec '03

Timothy May wrote: >Others have shown how meaningless your repeated calls for a proof are, as >so many assumptions must be carefully spelled out. >To give an example of how hard the situation is to analyze, consider the >computer and chip industries. (If you argue that your "theorem" is for >nations in the aggregate, and not any particular companies or even >industries, then I will maintain that my example holds pretty much true for >automobiles, pharmaceuticals, chemicals, and so on._ >The computer and chip industries move certain investments abroad, to >Malaysia, the Phillipines, Indonesia, Mexico, and so forth. But by moving >these investments abroad, they believe their net market size, >profitability, shareholder value, etc., will be enhanced. Else they >wouldn't do it. >Multiply this by all the industries.... >Now, would "the economy" be "better off" if Intel, say, had not moved >assembly operations to Malaysia in the 1970s? Perhaps Intel would now be >bankrupt and gone, as so many of its rivals of the time are now gone and >barely remembered. >You see the problem? Who can say what "better off" is, given that we can't >run history down alternate paths as an experiment. >Your one-track mind is truly astounding. We've had kooks and oddballs on >the list before, but never one who has written a dozen or more posts asking >the same ill-phrased question over and over again. So you say that my question can't be answered because the situation is too difficult to analyze, "given that we can't run history down alternate paths as an experiment." The situation is indeed hopelessly difficult if you think that economics is an empirical (experimental) science. But, as an Austrian, you should know that economics isn't an empirical science; it's a science that deals with the logic of human action. It starts from the axiom of human action, and all the other axioms of economics follow from this axiom by deductive reasoning. This is called the praxeological method. The answer to economic problems can only be given by reasoning, not by running experiments in the real world. Read Mises (Human action), Rothbard (Man, economy and state) etc. for further information. To prevent you from claiming this isn't true, I will quote Rothbard (in 'The foundations of modern Austrian economics', p. 19, ed. E. Dolan): "Praxeology rests on the fundamental axiom that individual human beings act(...) The praxeological method spins out by verbal deduction the logical implications of that primordial fact." etc. So, it really doesn't matter at all that we can't run history down alternate paths as an experiment, because the kind of empirical 'data' that such experiments would generate are not very helpful in the first place. Fortunately, situations that are at first sight hopelessly difficult can sometimes be analyzed and simplified by performing a thought experiment. That's what I did when I offered my 'reductio ad absurdum' proof. I didn't use empirical data, I used logic and reasoning; that's the way it should be done in economics. So far, you didn't rebut the proof I offered. You only argue that my proof must be wrong because the situation is too difficult to analyze because of all the empirical data that are lacking. That argument is, as I explained above, not to the point. And the fact that you take refuge in name-calling makes me suspect that subconsciously you don't find it very to the point yourself either. I understand it's not pleasant to be rebutted every time you answer my posts, but I fear it's something you will have to get used to. Of course, you could also consider making better arguments (after reading the books I suggested), or else stop posting on the subject. Bart Croughs

2 1

Re: Ad Hoc Bay Area Cypherpunks Thing--Sat., 24 Aug, 3 pm, Menlo Park
by mccoy＠communities.com 17 Dec '03

17 Dec '03

> On Sat, 17 Aug 1996, Timothy C. May wrote: > > > There is no Cypherpunks event scheduled for that Saturday, but we can have > > an ad hoc gathering, informally arranged. I suggest meeting at 3 p.m. at > > Cody's Bookstore, on El Camino Real in Menlo Park (hard to miss). Or at the > > coffee shop next to it...either should be sufficient Schelling points to > > Do you mean Kepler's? That's the one right near Menlo Park caltrain > station; the coffee shop next to it is Cafe Borone. Get the Mocha. [Typing from the courtyard outside Cafe Barone (love that Ricochet...)] For those needing better directions, Cafe Barone/Keplers is at the Menlo Park Center, at the corner of El Camino and Ravenswood in Menlo Park... jim

1 0

Re: Software manpower exports and the power of governments
by Vincent L. Diaz 17 Dec '03

17 Dec '03

At 06:17 PM 8/17/96 +0600, you wrote: >In the case >of Coke, I can understand the government not wanting to spend >precious foreign exchange on sugared water in a country where >there is a serious shortage of drinking water. Tim made the >perfectly valid point that such decisions cost the country in >reputation, but the Indian government doesn't mind loss of >reputation in matters it firmly believes in, as in the current CTBT discussion. There is a central point here that you are missing. Many of us here believe in the absolute, sovereign freedom of the individual. Governments should only be minimally involved with the earning of individuals. Control over the distribution of currency abroad, (i.e. foreign exchange controls) is definitely not one of them. As I understand the story of Coke in India, New Delhi was bent, among other things, on stealing proprietary information, (i.e. the formula for Coke) from the company. In short, they told Coke that they could stay only on condition that the formula was turned over to New Delhi. Yes, they cloaked their proposed theft in high sound nationalistic tripe, however it was nothing but a blatant attempt to steal what was not theirs. I do not claim a complete knowledge about the availability of fresh water on the Indian Sub-Continent. But I would be willing to wager that lack of progress in this area was severely hampered due to the typical, Statist meddling of the Indian government in the lives of its own people. It is immoral for any government to interfere in the personal choices of free men and women. If any person wishes to partake of a high quality, and probably locally expensive soft drink in preference to either local brands or water, scare or not, such a choice should be left to them, not to an Collectivist cabal of bureaucrats. What the Socialist Governments of India have never comprehended is that a government intent on doing you good is capable of doing you out of everything you own! Simplistic? Yes......simplicity is one of freedom's chief virtues. Regards, VINCENT L. DIAZ U-SAVE COMMUNICATIONS Business Line: 619-277-2411 Fax Line: 619-277-0298 http://www.cognigen.com/agencies/

1 0

CS8191 data sheet and ordering info...
by Eric Blossom 17 Dec '03

17 Dec '03

Attached is the ascii version of the data sheet, followed by ordering information. Full protocol specifications will be available in about 2 weeks. Eric ---------------------------------------------------------------- Communication Security Corporation CS8191 Triple-DES Telephone Privacy Device With the growing number of tools available to assist in wiretapping, anyone using a telephone in the '90's is vulnerable to unwanted eavesdropping. With many of today's standard technologies, anyone can gain access to our most private of conversations. As a result, the telecommunications industry has an increasing need for private, secure voice communication devices. The Communication Security Corporation has dedicated its resources to addressing this need by designing the CS8191, our flagship product and the most secure telephone privacy protection available. Unsurpassed Security Truly open, encryption technology is at the heart of the CS8191 telephone security unit. With the press of a button, the CS8191 is activated. Within seconds your conversation is kept secure from the intrusion of any type of wiretapping. Open-Standard Encryption How are you assured that your tele-security unit is really working to protect your telecommunications? In truth, the "trust-us" proprietary solutions used by competing products are an indication of weak privacy protection. They "hide" from the user, the ability to verify proper functioning of the unit. Communication Security provides users with the best privacy protection by incorporating leading-edge encryption technology that utilizes the power of truly open standards. Our commitment to an open specification allows sophisticated users the ability to "check under the hood" and evaluate the security attributes of the system. Portable And Easy To Use The CS8191 has been designed to work with conventional analog telephone systems (POTS). The unit connects between your telephone and the wall, much like a telephone answering machine. Plug in the power, and that's it. In "clear mode" your telephone continues to work as it normally does. To begin an encrypted conversation, simply press the 'go secure' button and wait for the green light to come on. The system is easy to use and compact, making it the perfect telephone security solution for home, travel or office use. Superior Performance * As a standard component, Communication Security has incorporated a leading-edge speech coder for clarity unsurpassed in secure telephone devices, to date. * Voice clarity is virtually undisturbed whether the system is in secure or clear mode. * LED indicators on the unit let you know instantly that your call is being transmitted securely. Service And Support The Communication Security Corporation provides a one year warranty for all parts and labor. Upgrades are included in the price of the CS8191 and are available under the terms of the warranty. For More Information To get more information on securing your phone communications, send email to info(a)comsec.com or call (707) 577-0409, fax (707) 577-0413. Features Benefits * Open standard encryption Allows independent evaluation and verification of protocol and behavior * Excellent speech quality Superior clarity is assured with leading-edge speech coder as a standard component * Auto Secure Allows for secure, unattended operation for all-hours data protection * Small size and weight Makes the CS8191 the perfect solution for secure home, office or travel telephone communications Specifications: Modem * ITU V.32bis (14,400 bits/sec) Interfaces * Two buttons (Go Secure, Go Clear) * Two LEDs (Secure, Clear) * External power supply * Two modular phone jacks Power * Input voltage: 110 volts AC, 50-60 Hz. Approvals * FCC, part 15 and 68 Warranty * 12 months parts and labor Software Upgrades * One year of upgrades included in purchase price Voice Nodes * Clear voice * Secure voice Secure Mode Speech Compression * International standard GSM 06.10 full rate speech transcoding (13,000 bits/sec) Notes: * Specifications subject to change without notice. * Government regulations apply for export license. * Completing the circle of secure communication requires the receiving end of your call to also have a CS8191 unit connected to their phone. Cryptographic Details: * Unique session key generated for each conversation using Diffie-Hellman exponential key exchange (2048 bit modulus) (U.S. Patent No. 4,200,770 licensed by Cylink Corporation) * Defense against "man in the middle" active attack using interleave protocol combined with voice verification of six digit key name derived from the public exponentials * Hardware Random number generator based on Johnson noise * Three Key Triple-DES (168 bit key), operating in modified counter mode. * No back door, "Key-Escrow" or GAK * Open standard. Full protocol specifications available. Communication Security Corporation 1275 Fourth St. Suite 194 Santa Rosa, CA 95404 Tel: 707-577-0409 Fax: 707-577-0413 info(a)comsec.com ---------------------------------------------------------------- Yes, I want real telephone privacy protection! Send me ________ CS8191's at $995.00 each: $____________ Shipping and Handling: $_______10.00 California residents add sales tax: $____________ Total: $____________ I'm paying with Check or M/O ____ Visa / MC ____ Name on Card:______________________________ Card Number:_______________________________ Exp. Date:__________ Ship To: _________________________________________ _________________________________________ _________________________________________ __________________________________________ Allow 6-8 weeks for delivery. I am a US citizen or "Lawful Permanent Resident" Yes____ No____ Make checks payable to: Communication Security Corp. Mail or fax this order form to: Communication Security Corp. 1275 Fourth St., Suite 194 Santa Rosa, CA 95404 v: 707-577-0409 f: 707-577-0413

2 1

US Taxes on X-Pats
by Vincent Cate 17 Dec '03

17 Dec '03

Robert Hettinga <rah(a)shipwright.com> > However, as Black Unicorn has noted here before, the Phillipenes are the >only other country besides the USofA where citizens are taxed any income >you get, no matter where on earth you actually earn it. It is not exactly that bad if you are outside the USA. I got ahold of the IRS codes on this before I left the USA (so about 2 years ago). The rule then was that the first $70,000 you earned was tax free if you were outside the USA for 330 days or more of the year. From another x-pat in Anguilla I heard that the $70 K had been increased. If you live outside the USA and have a corporation outside the USA, you might prefer that the corporation buy a company yacht rather than pay you more than $70 K. And at least on this tropical island, $70,000 tax free would go a very long way. It is true that if you are getting dividends and interest on your fortune that moving outside the USA won't help, unless you get rid of your US citizenship. And the USA wants you to pay capital gains on your fortune as if you sold everything for cash right before you got rid of your US citizenship. So it seems best to get rid of it before you are really rich. :-) -- Vince ----------------------------------------------------------------------- Vincent Cate vince(a)offshore.com.ai http://www.offshore.com.ai/vince/ Offshore Information Services http://www.offshore.com.ai/

2 2