December 2003 - cypherpunks-legacy

U.S. Presidential Odds Are In
by nobody＠replay.com 17 Dec '03

17 Dec '03

Hello, I am the anonymous oddsman, here with the U.S. presidential odds, kindly provided to me by a person who wishes to remain anonymous. Some of you know who I am, and I would prefer that my true identity remain a mystery, as what I am doing may well be slightly illegal AFAIK. Thank you. Ladbroke's customer service person [number +44 181 8621820 (that's a London area code)] looked up the info. He had to call someone else to get Perot's odds. Next time (if they even have them) Harry Browne odds. Here's what Ladbroke's said today: 1:7 Clinton 4:1 Dole 50:1 Ross Perot That's all for today, this information will be posted aproximately weekly, but more often as the election approaches or major events happen, and certianly more often if my posting it appears to be somehow annoying U.S. authorities. ;) the anonymous oddsman

1 0

Can you trust your ISP ??
by I~nigo Gonzalez 17 Dec '03

17 Dec '03

Hello, I'm thinking about how can I get rid off this kind of attack *before* it happens. Can you please send me your comments about this? I don't know so much about the how SSL works, but I think this is something that can happen... SCENARIO -------- 1) Suppose We have a host with https protocol enabled, and someone outside wish to access the information we have on the server via https; but (for some reason wich we don't know), the connection has to be made through the Gateway named X (see plain diagram below): Outside <-------------> Gateway X <---------------> Our Server 2) I think that when a Secure Socket Layer connection begin this is what it happens: a) Outside generates a private/public key pair and he send us his public key, wich has to go through Gateway X, who send it to Our Server. b) Our Server generates his own private/public key pair and send his public key (whether it's sent ciphered or not doesn't matter... yet). c) Now both parts have their response public keys, ciphered transaction begins. All seems to be fine, but... 3) Suppose that We don't trust on what's going on through the line, and that IN FACT, someone in Gateway X is disturbing our communications like this: a) When Outside's public key comes to the gateway, Gateway X generates a public/private key pair (wich we will call spoofed keys), and it send a spoofed IP header marked as from "Outside" in order to act as "Outside" for "Our Server". b) Once "Our server" send his public key, "Gateway X" intercept the packet, decrypts it if necessary (because it has the private key needed to decrypt it), and it send "Outside" the public spoofed key (remember what it did on stpe a?). c) Now transaction takes place through "Gateway X", wich can read modify, and fake any data because it has now the ability to act as the other side to both "Outside" and "Our Server"... Avoid the problem: - The *only* think I can figure out to avoid the menace is to have a certified (Verisign and others) public key with a short expiration date. Of course this approach has a little problem: *how* can I verify that once expired "Our Server's" public key is really "Our Server's" key... a Certification Authority is something worth of spoofing... ;-) Maybe the best thing could be becoming my own certification authority... but how!? If for *some* reason the above cannot be done, the a simple way to avoid too much trouble is to limit transactions to just *atomic* transactions (checking account and getting some money are two different transactions). This can still be spoofed if "Gateway X" makes its own transaction with faked Outside's keys. Of course, We must limit the tansactions we accept in "Our Server". Notice that a password and challenges are useless in this kind of situations. ¿Any other way? maybe we can get somethig a bit safer if we found something fixed, inmutable and rely on it (acting like some kind of virtual communication channel between Outside and Our Server: Untrusted Outside <-------------> Gateway X <---------------> Our Server ^ ^ | | \-------- Virtual secure communication channel -------/ If every message "Outside" send to "Our Server" must have a response, then we could make "Our Server" send responses with some good (well tought) cryptographic technique wich will refer somehow to "Outside's" message fingerprint. I mean, every message from the Outside must have a message signature (i.e message must pass through MD5); and its response must have a valid "Response to: <query's MD5 signature>" and (of course) that response must be signed somehow. I still don't know how to do it well; but I will tell you how as soon as I will know. Thank you for wasting your time reading this. -- Iñigo González - ADV Internet Technical Advisor <nexus(a)adv.es> "Never say anything online that you wouldn't want to see on the front page of The New York Times." - alt.2600.moderated Posting

2 1

Re: talker [is illiterate
by pjn＠nworks.com 17 Dec '03

17 Dec '03

In> = You know man I am a profesional so don't reply to me In> = as a novice or anything. I have been doing this since I In> = wuz 12. And I'm not young for my age I know alot In> = about hacking and FYI there's alot you could learn from In> = me so don't think 23 is a young age pal. In> = In> = Doom13 In> = Listen you little juno-using twit... I have been hacking (Yes, the Electronic B&E type of hacking) sinse before you were a twinkle in the mailmans eye... YOU want to learn something? Sit on your ass, and read... Dont waste mailbot space with the crap you write... P.J. pjn(a)nworks.com ... Eliminate spare time - buy a modem! ___ Blue Wave/QWK v2.20 [NR]

1 0

Re: talker
by pjn＠nworks.com 17 Dec '03

17 Dec '03

The shitless fake hacker doom13 tried to say: > I am doom13. If there is anyone out there who is a hacker or >would like to be one you can talk to me and find out stuff like cracking. >Just drop a message at doom13(a)juno.com. In> Hmmmm... Want to bet our other friend at juno.com sent him? I might In> just end up killfiling juno.com... Obviously a low-IQ area of the net. Its not low IQ... Its non-existant... It is a free E-Mail group, you dont pay, but you have to look at ads... P.J. pjn(a)nworks.com ... I would rather be judged by twelve then carried by six. ___ Blue Wave/QWK v2.20 [NR]

1 0

Church of Scientology
by pjn＠nworks.com 17 Dec '03

17 Dec '03

In> Scuttlebut is, CoS rolled over on some pesky ultra-right-wingers as a In> favor to Morris Dees and various scumbag associates. For this, CoS got In> their long-awaited (40-plus years!) federal tax-free status. I think, after their part in the closing of anon.penet.fi, some people should RUN over some CoS members... :) P.J. pjn(a)nworks.com ... "Bother," said Pooh, as he was assimilated by the Borg. ___ Blue Wave/QWK v2.20 [NR]

1 0

Followup to 9/1 Observer article printed
by Z.B. 17 Dec '03

17 Dec '03

Found this on alt.privacy today: Zach Babayco zachb(a)netcom.com <----- finger for PGP public key http://www.geocities.com/SiliconValley/Park/4127 --- From: naughty(a)scallywag.com (Naughty Boy) Newsgroups: alt.privacy Subject: READ TODAY'S OBSERVER ARTICLE - THEY SINK TO THEIR TRUE LEVEL! Date: Sun, 08 Sep 1996 20:36:47 GMT Organization: Scallywags of the World Lines: 20 Message-ID: <32332e5c.4219376(a)news.u-net.com> NNTP-Posting-Host: host3.animal.u-net.com X-Newsreader: Forte Agent .99e/32.227 READ TODAY'S OBSERVER ARTICLE - THEY SINK TO THEIR TRUE LEVEL! Today, September 8, the Observer publish a follow-up-follow-up article for their amazing "child porn" expose which so grossly libelled Clive Feather and Johan Helsingius ... a review of the "first" toddler CD-ROM... How have the mighty crusaders fallen ! Sic transit gloria mundi.... Actually, the Observer new technology reporters may have found their true niche at last - it's a bit egotistic for the reporter to print such a large picture of himself, though ! Read it all at http://www.scallywag.com PS: Private Eye published an intelligent and amusing commentary on this whole sorry business recently, and scallywag.com will post it, but, in deference to PE, not until the current issue goes off sale. NAUGHTY BOY (The Scallywag)

1 0

Zimmermann gets CPSR's Wiener Award
by Susan Evoy 17 Dec '03

17 Dec '03

* * NEWS ADVISORY * * FOR IMMEDIATE RELEASE August 22, 1996 --------------------- Contact: Computer Professionals for Social Responsibility Duane Fickeisen, Interim Director Phone: 415-322-3778 E-mail: dfickeisen(a)cpsr.org Phil Zimmermann, controversial inventor of Pretty Good Privacy (PGP), earned the prestigious Norbert Wiener Award of 1996. The Wiener award is for excellence in promoting the responsible use of technology and is given annually by Computer Professionals for Social Responsibility (CPSR). The award will be presented by CPSR board member Nathaniel Borenstein at CPSR's annual meeting on October 19-20, 1996 at Georgetown University in Washington, DC. The award to Zimmermann is related to the theme of the conference, "Communications Unleashed: What's At Stake? Who Benefits? How to Get Involved!," which focuses on the public interest in stewardship of the dazzling array of emerging communications services and issues related to free speech, copyright protection, and privacy online. CPSR is a public-interest alliance of computer scientists and others interested in the impact of computer technology on society. CPSR attempts to direct public attention to difficult choices concerning the applications of computing and how those choices affect society. According to CPSR Interim Director Duane Fickeisen, PGP brings critical privacy issues to public attention, because PGP allows the average person to encode his or her email so only the receiver can read and understand it. Until PGP came along, only governments or large corporations could make their email secure. In computer jargon, PGP is a "public-key encryption software." Zimmermann, 42, created PGP and published it in the U.S.A. as "freeware" (free software) in June of 1991. Since its creation, PGP has spread all over the world, and has since become the de facto worldwide standard for encryption of email. Controversy came with government attempts to control encryption. For three years Zimmermann was the target of a criminal investigation by the US Customs Service, who assumed that laws were broken when PGP spread outside the US. That investigation was closed without indictment in January 1996. Zimmermann wrote PGP from information in the open literature, putting it into a convenient package that everyone can use in a desktop or palmtop computer. "I gave it away for free, for the good of democracy. This technology belongs to everybody," he says. According to Zimmermann, the recent strides in electronic digital communication brought with them a "disturbing erosion of our privacy. In the past, if the government wanted to violate the privacy of ordinary citizens, it had to expend a certain amount of effort to intercept and steam open and read paper mail, and listen to and possibly transcribe spoken telephone conversation. This is analogous to catching fish with a hook and a line, one fish at a time. Fortunately for freedom and democracy, this kind of labor-intensive monitoring is not practical on a large scale." Today, human rights organizations such as Amnesty International are using PGP to protect their people overseas. "PGP has spread like a prairie fire, fanned by countless people who fervently want their privacy restored in the information age," says Zimmermann. Unfortunately, email messages are too easy to intercept and scan for interesting keywords, such as "revolution" or "abortion." This "fishing" can be done routinely and invisibly on a grand scale. When most of the population becomes reliant on email, the government will be able to do "driftnet fishing" -- making a quantitative and qualitative Orwellian difference to the health of democracy, Zimmermann said. Law enforcement and intelligence interests in the government have attempted many times to suppress the availability of strong domestic encryption technology. However, Zimmermann doubts their chances for success. He says, "The rest of the world uses encryption and they laugh at the US because we are railing against nature, trying to stop encoding messages. Trying to stop this is like the buggy whip manufacturers trying to stop the adoption of cars -- even with the NSA and the FBI on the government side, it's still impossible. The information revolution is good for democracy -- good for a free market and trade." "The government has a track record that does not inspire confidence that they will never abuse our civil liberties," says Zimmermann, who is now Chairman of the Board and Chief Technology Officer for Pretty Good Privacy, Inc. (PGP). For more information on the conference or the Wiener Award, contact CPSR at 415-322-3778, 703-739-9320, cpsrannmtg(a)cpsr.org, http://www.cpsr.org/home.html. -- Susan Evoy * Deputy Director http://www.cpsr.org/home.html Computer Professionals for Social Responsibility P.O. Box 717 * Palo Alto * CA * 94302 Phone: (415) 322-3778 * Fax: (415) 322-4748 * Email: evoy(a)cpsr.org *

1 0

Re: <none>
by pjn＠nworks.com 17 Dec '03

17 Dec '03

-=> Quoting Int:snow@smoke.suba.com to P.j. <=- In> On Thu, 5 Sep 1996 pjn(a)nworks.com wrote: > In> what do you know about hackers > > More than you appariently... > In> Which isn't necessarily all that much. Not for him... P.J. pjn(a)nworks.com ... Be wary of strong drink. It can make you shoot at tax collectors and m ___ Blue Wave/QWK v2.20 [NR]

1 0

/\/\/\/\/HELP\/\/\/\/\ !
by pjn＠nworks.com 17 Dec '03

17 Dec '03

In> I really need help unsubscribing from the Cypherpunks list! it is In> imperative! Just shoot yourself and it will all go away. . . P.J. pjn(a)nworks.com ... Exercise your right to arm and keep bears! ___ Blue Wave/QWK v2.20 [NR]

1 0

One Time Reply Blocks (was Re: strengthening remailer protocols)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

On Sun, 8 Sep 1996, Lance Cottrell wrote: > Mixmaster prevents replay, so flooding multiple copies of a single message > will not work. This is the reason Mixmaster has no reply block feature. I > can see two ways in which replies can work safely. To paraphrase John Von Neumann, any system which uses reply blocks is in a state of sin. By this I mean that if there is a chain pointing at you, a sufficiently powerful attacker can walk down that chain and find you. Given that, I will join the state of sin by proposing a mechanism which will allow Alice to receive a reply from Bob, but change her mind at any time. The basic idea is to have a one-time reply block which either Bob or Alice can send to. If Alice thinks that too much time has elapsed, and powerful enemies are walking down her reply block chain, she can send herself a reply and break the chain. (She might send a reply thru each link in the chain to break all the links.) It also occurs to me that since email addresses are about the same size as secure symmetric keys, it would be attractive to use real one time pads instead of symmetric key cyphers for encrypting them. ------------------------------------------------------------------------- Bill Frantz | "Lone Star" - My personal | Periwinkle -- Consulting (408)356-8506 | choice for best movie of | 16345 Englewood Ave. frantz(a)netcom.com | 1996 | Los Gatos, CA 95032, USA

2 1