December 2003 - cypherpunks-legacy

Re: CIA Fears UmpTeen InfoNukes
by vin＠shore.net 17 Dec '03

17 Dec '03

On Cypherpunks-L, Vin McLellan wrote: >>... The real threat is incompetent, poor-trained DoD >>system administrators -- and a class of computer-illiterate senior managers >>who define "system security" and routine administration as a marginal >>expenses and scorn readily available options like one-time passwords as too >>complex for the military mind. Bill Frantz <frantz(a)netcom.com> responded: >Public key authentication could go a long way toward solving the military >and contractor's security problems. However, they won't use public key >authentication for unclassified systems until it is available in "COTS" >(Commercial, Off The Shelf) software. And it won't be available there >until it can be exported as well as sold domestically. Catch-22 I love PKC with all its promise, but you overstate (and IMHO, attribute inappropriately) the barriers that slow the adoption of one-time password authentication in the military... and many other more highly regarded IS environments. Security Dynamics (a client of mine) has sold a million SecurID two-factor OTP tokens internationally -- and its ACE/Server installations are freely exported to 20-odd nations, even with its embedded DES code. There is no barrier against exporting OTP authentication systems, either two-factor tokens or software! Bellcore's s/key is available world-wide in both the popular freeware versions and Bellcore's commercial client/server version -- and the US Navy developed and circulates widely its own freeware rewrite of the s/key OTP code: OPIE. Free and commercial OTP code has been effectively COTS for years! I would be greatly surprised if there has been a published report on the state of security in the US computer or communications infrastructure anytime in the past five years which has not highlighted the promise of OTPs to plug the single most eggregious systemic vulnerability in the installed base of networked computer systems: static, unchanging, user passwords vulnerable to anyone with a wayward sniffer utility or (to collect them by the bushel) able to logon to a target site with one of those stolen passwords to drop a trojan. Without trustworthy user authentication there is no meaningful computer security, period! Sen. Sam Nunn, who is now chairing the Congressional hearings on Security in Cyberspace, is a bright guy -- although he is reputed to be utterly innocent of basic computer skills. Yet Sam Nunn could have pulled off the total penetration of the 30 USAF computer systems at Rome Labs -- the tale of incompetence witnesses described so luridly at his recent hearings -- with a couple of hours of simple tutorials from anyone on this List. The British 16 year-old who did it just religiously collected passwords -- working the Net from his 25 MHz 486 SX pc with a 170 Megabyte hard drive. The "Datastream Cowboy" liked to hack .MIL systems because -- as he was quoted explaning, in an analysis by the Nunn's subcommittee staff -- they are "so insecure." CERT, DISA, NIST, OTA, GAO, even NSA -- they've all issued stacks of reports with the same redundant recommendations. Even CERT, fer cripes sake! Reusable passwords are the hole in the dyke! It's a mantra among the security pros; has been for years: "Shift to OTPs for meaningful security in networked systems." Yes, there are still threats to the communication links without network encryption -- but with OTPs, even those vulnerabilities become vastly more managable. With universal adoption of OTPs for multi-user systems, 80 percent (??) of the problem would disappear and we could worry (as we must) about bad code in Sendmail and other widely-used apps and system products. Then, we could blame our sense of vulnerability on the self-interested spooks and the short-sighted politicians who deny us and our culture the personal security of widespread quality encryption. But it's not that simple. Access to encryption is one issue; separate and distinct from the issue of the adoption of one-time password technologies. OTP user authentication -- and the vast increase in the security and integrity of our computers and networks it could bring to our government and private sector information systems -- is _Not_ dependent upon the government releasing encryption (PKC or other) from its spooky bondage. You don't need PKC for quality authentication. They are complementary technologies (thus, the proposed merger of Security Dynamics and RSA) but they are not the same. They are not even necessarily interdependent. You can have weak authentication with utterly secure network encryption. No, in this case, the blame is spread far more widely. Yes, DoD and other meta-institutions have been slow to acknowledge and act upon the obvious solution to their biggest and most obvious vulnerability. Security is still seen as a marginal item in the budget -- not something that must be designed into both the technology or implicit in its responsible management. But they've been able to get away with it because the hardware vendors and big software companies -- the very firms which now harp on ITAR denying them the international market -- have been so hesitant to risk their margins by designing security into their number crunchers. And they've been able to get away with that because the whimpy class of professionals who design, impliment, and manage the computer installations upon which our nation (many nations!) and our industrial culture depend has been unable to get it together to define or condemn irresponsible, unprofessional stewardship of these assets. People carp about soul-less lawyers. Money-grubbing MDs. Sell-out CPAs. But has there ever been a class of technical professionals so adept at denying all responsibility for the proper and responsible management of the power and assets they control as we professional technocrats of the computer culture? By contrast, lawyers, MDs, etc., are bastions of probity and social and professional responsibility! How low do you have to sink to find some unacceptable level -- some level of incompetent system administration that carries the burden of liability? A standard beneath which a professional's peers would judge him or her reckless and irresponsible, lacking due care, unprofessional? Frankly, I've never been able to find out. (And, to judge by the lack of judicial condemnation of corporate and public managers for mismanagement of other people's electronic assets, neither have the Courts.) Think of it: our culture could be about to be irretrievably transformed by a series of laws drafted by the American subculture of spys (both the police and the real spooks) and passed by legislators stampeded into reckless action by a heartfelt but hysterical sense that our computer-based national infrastructure is vulnerable to bored teanagers just bright enough to scoop up the static passwords that circulate unprotected on our networks; to run CRACK against readily-available "secured" password files full of what everybody knows are guessable passwords; or to slip through system backdoors announced world-wide by CERT and FIRST alerts... but never patched, closed, or fixed. Sad. No -- it's absurdly tragic! Nunn's subcommittee will leap from considering poor Datastream's vaunted outlaw prowess to offer, in the weeks to come, yet another proposal for guaranteed government access to private sector crypto keys. (And this one might fly with the Nation -- all those Nations -- At Risk.) Somehow, firing, fining, demoting, or making liable for damages, any designated system administrator who can't find the time (within, say, a week) to apply vendor-circulated patches for vulnerabilities announced by CERT is too extreme a proposal. OTPs are too simple a solution. Better to toy with the potential for repression than risk the revolutionary idea of personal and professional responsibility. They say People ultimately get what they deserve. Computer professionals better pray that this is not the case. _Vin (Zounds! This was to be merely my two cents, but then the wind caught my sails. Apologies for the overheated bandwidth.) Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

Re: CIA Fears UmpTeen InfoNukes
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:38 PM 6/27/96 -0400, Vin McLellan wrote: > On Cypherpunks-L, Vin McLellan wrote: > >>>... The real threat is incompetent, poor-trained DoD >>>system administrators -- and a class of computer-illiterate senior managers >>>who define "system security" and routine administration as a marginal >>>expenses and scorn readily available options like one-time passwords as too >>>complex for the military mind. > > Bill Frantz <frantz(a)netcom.com> responded: > >>Public key authentication could go a long way toward solving the military >>and contractor's security problems. However, they won't use public key >>authentication for unclassified systems until it is available in "COTS" >>(Commercial, Off The Shelf) software. And it won't be available there >>until it can be exported as well as sold domestically. Catch-22 > > I love PKC with all its promise, but you overstate (and IMHO, >attribute inappropriately) the barriers that slow the adoption of one-time >password authentication in the military... and many other more highly >regarded IS environments. On thinking about your rant, I think you have a valid point. What our venture capitalists said to us was, "There is no market for security." Now perhaps the ITAR helps suppress that market on the basis of, "If I'm going to have to wander the information superhighway naked, why should I shut the blinds on my house." Given no market, and the requirement to support everything you ever supported, it is hard to justify building in security features. > No, in this case, the blame is spread far more widely. Yes, DoD >and other meta-institutions have been slow to acknowledge and act upon the >obvious solution to their biggest and most obvious vulnerability. [One >Time Passwords - WSF] Security >is still seen as a marginal item in the budget -- not something that must >be designed into both the technology or implicit in its responsible >management. I have a client who provides services to part of the DOD. (My contract prevents me from being more specific.) Their only saving grace is they don't use the Internet or Unix. (Making them vulnerable to a much smaller group of hackers.) The ideal situation for them would be to use public key authentication because it would be entirely user-transparent. Doing OTP's the way Apple does them (see below) would also work well. However, to implement one of these systems requires modifying a bunch of terminal emulator programs from different vendors (some of whom are no longer in business). Without widely adopted standards for OTP logon, these modifications are not likely to happen. > But they've been able to get away with it because the hardware >vendors and big software companies -- the very firms which now harp on ITAR >denying them the international market -- have been so hesitant to risk >their margins by designing security into their number crunchers... I think that backward compatibility requirements are a significant part of the reason we see this problem. The other part is, of course, that there is no market for security. Apple has a form of one time passwords in their file sharing system. When you enter your password, it is used as a key to encrypt a challenge sent by the file server (Using a symmetric cypher). The result is returned, decrypted and compared with the original challenge. But this system didn't have to be compatible with a hardware VT100 or TTY-33. > Somehow, firing, fining, demoting, or making liable for damages, >any designated system administrator who can't find the time (within, say, a >week) to apply vendor-circulated patches for vulnerabilities announced by >CERT is too extreme a proposal... The problem, in general, isn't the system administrators. If management gave the same priority to security that it does to joining new users or installing new hardware, sysadmins would have the time to install the patches. Most sysadmins are up to their asses in alligators. Security is something to put off. If the managers were judged on the security of their systems (perhaps via independent audit), then they might give the problem some priority. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

New mixmaster up: jammix
by iang＠cs.berkeley.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've finally gotten around to installing mixmaster. I'll install a Type 1 tomorrow or next week. Any suggestions on which (I hope this isn't a religious war...)? jammix mix(a)cypherpunks.ca c2178bf3018c062a8d0fabd066e50ed9 2.0.3 - -----Begin Mix Key----- c2178bf3018c062a8d0fabd066e50ed9 258 AATgExB26IdURw+itvFEQsWjv/mQFgg3Tu2avLU2 fdW55aqKqKDeiIWf8nY24HG+i08s65cp8zCm2w7E ZvzgcBxLQu91Sg1UbQlkYMYqx8NpeKjxnkU+5KqC mswqrAbOn0qqcmNz7/3TsGS0p22+Dsw9rLjwDk4o udzR2maCUTuDvwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- - Ian -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMdMvBUZRiTErSPb1AQEOFwQAlseh5bV8OaBgH/eIqNbxm7whFoOfjdDN 2AjcX17G1VsX/T/qMVXLle0KJ7Ac+e4f5RMcU5iAjEueU06jor4xEJOqDDQsIn2w 56niRMFICStAm2babEu1RSbgwLIZ35lA0l3ybO/g9AijDTFD9PD+lIyKX+vH7fXB ey4TQOAC1XM= =ZdGA -----END PGP SIGNATURE-----

1 0

crypto and bagpipes [NOISE]
by vinnie moscaritolo 17 Dec '03

17 Dec '03

>>>A Missive From: David Kovar (kovar(a)nda.com) >>> >>>What is the connection between crypto and bagpipes? Well >>>crypto is regarded as an armament by the US ITAR regulations. >>>Later this month a British court is to rule as to whether >>>bagpipes are still classified as "instruments of war"! >>>The story is in today's Times newspaper (The British one) >>>It seems that a piper is being taken to court for practising >>>on Hampstead Heath, which has a bye-law forbidding music. >>>Mr Brooks, the piper, has denied the charge, citing a case in 1746, >>>where bagpipes were declared to be instruments of war, not musical >>>instruments, and a subsequent Act of Parliament which specifically >>>stated that they were weapons. He claims he wasn't playing a musical >>>instrument, but practising with a weapon! >>> >>>The imagination boggles if his claim is successful! Will it >>>be possible to sue pipers for assault with a deadly weapon? >>>Will airports be equipped with bagpipe detectors? >>> >>>David Wadsworth | Wohin der Weg? Kein Weg! >>>dwadsw(a)etna.demon.co.uk | Ins Unbetretene. (Faust) Vinnie Moscaritolo ------------------ "friends come and friends go..but enemies accumulate." http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

5 4

Crack for DOS
by Steve O 17 Dec '03

17 Dec '03

Guys, 1. A colleague of mine was interseted in in demonstrating the unix password cracking program Crack on a windoze system. Where can one be found if one exists? 2. If you were looking to compare single key block ciphers like Blowfish, DES, 3xDES etc. Which one would be considered the best for implementation in a software security package, assuming maximal key lengths irreverant of the governmental restrictions. 3. Does anyone have info re: S/MIME implementation time table into the Netscape browser? Thanks SO Steve O. "True Utopia can only be reached by an uncensored and secure Internet, True Chaos can only be reached by the government, True love can only be reached in the movies." S.O. "Bang your head, Metal Health will drive you mad!" Quiet Riot "Welcome my friend, Welcome to The Machine" Pink Floyd "Lonelyness and Emptiness; Love and Fulfillment; Are all but flashes in the eye of the storm of our tormented soul." S.O.

1 0

Fight-Censorship Dispatch #15: Government Appeals CDA!
by declan＠well.com 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- Fight-Censorship Dispatch #15 ----------------------------------------------------------------------------- Justice Department Appeals! ----------------------------------------------------------------------------- By Declan McCullagh / declan(a)well.com / Redistribute freely ----------------------------------------------------------------------------- June 27, 1996 WASHINGTON, DC -- With no fanfare and no hype, the Justice Department yesterday faxed a 39-word statement to Senator Exon saying they will appeal their loss in the Philadelphia case. The consolidated lawsuits of ACLU v. Reno and ALA v. DoJ resulted in a victory for the plaintiffs earlier this month after a three-judge panel granted a preliminary injunction preventing the DoJ from enforcing the Communications Decency Act. I didn't know about this letter until about 15 minutes ago, when Bruce "I wrote the CDA" Taylor showed up outside my office for a HotWired Club Wired chat at 9 pm this evening. Taylor was grinning. "I got a scoop for you guys. You owe me. Nobody but Senator Exon would have gotten this letter out of the department." For a while, netizens were worrying that the DoJ might appeal the New York American Reporter v. Reno case, a narrower and weaker appeal that only challenged part of the CDA. This letter means that the ACLU/ALA case is definitely going to the Supremes, which will likely result in a decision a year from now. Stay tuned for more reports, and check in at Club Wired for the Taylor transcript. He says it'll be a "roast." We'll see... ----------------------------------------------------------------------------- Office of the Deputy Attorney General Washington, DC 20530 June 26, 1996 The Honorable J. James Exon United States Senate Washington, DC 20510 Dear Senator Exon: With regard to your request as to the status of the appeal on ACLU v. Reno, this letter is to inform you that the Department of Justice will file a Notice of Appeal on or before the July 2 deadline. Sincerely [signed] Jamie S. Gorelick Deputy Attorney General ----------------------------------------------------------------------------- Mentioned in this CDA update: HotWired Club Wired: http://www.hotwired.com/eff/ Deputy Atty Gen Jamie Gorelick's speech slamming Net, calling for controls: http://fight-censorship.dementia.org/dl?num=2733 Bruce Taylor's amicus "finger" brief in NYC CDA lawsuit: http://fight-censorship.dementia.org/dl?num=2736 Fight-Censorship list <http://fight-censorship.dementia.org/top/> Rimm ethics critique <http://www.cs.cmu.edu/~declan/rimm/> Int'l Net-Censorship <http://www.cs.cmu.edu/~declan/international/> Justice on Campus <http://joc.mit.edu/> This document and previous Fight-Censorship Dispatches are archived at: <http://fight-censorship.dementia.org/top/> To subscribe to future Fight-Censorship Dispatches and related announcements, send "subscribe fight-censorship-announce" in the body of a message addressed to: majordomo(a)vorlon.mit.edu Other relevant web sites: <http://www.vtw.org/> <http://www.cpsr.org/> <http://www.epic.org/> <http://www.aclu.org/> <http://www.cdt.org/> <http://www.ala.org/> <http://www.eff.org/> -----------------------------------------------------------------------------

1 0

John Grubor and me
by Lucifer Remailer Operator 17 Dec '03

17 Dec '03

Just for the record, I am not John Grubor and had never even heard of him before I did an Altavista search on his name earlier today. The concept that some net.loon like Grubor would get another account with DHP to run an anonymous remailer for whatever reason is laughable. From what I have read, Grubor spams newsgroups quite often, something I have not done nor plan on doing. I was expecting people to be posting paranoid rantings about how I am obviously a spook...

1 0

ALERT - DOJ TO APPEAL CDA says Interactive Week
by rodger＠interramp.com 17 Dec '03

17 Dec '03

From a draft to be posted shortly at http://www.zdnet.com/intweek By Will Rodger Wahington Bureau Chief Inte@active Week The Department of Justice will appeal to the Supreme Court a federal court decision that stayed enforcement of a controversial Internet indecency law, sources close to the court challenge told Inter@ctive Week Thursday. Department of Justice lawyers gave Sen. J. James Exon, D-Nebr. news of the appeal in a three-line letter delivered to the law's chief sponsor Wednesday. A copy of the letter was obtained by Inter@ctive Week. Exon welcomed the news. "We needed the Justice Department to make a final decision on the appeal, which I am pleased that they have done with the full support of the White House," Exon said. "This will now go to the Supreme court and I believe we will get a more thoughtful decision out of the top court than what the court in Philadelphia ruled." Attorneys on the other side seemed equally pleased. "This is wonderful news because it means the Supreme Court will have a chance to speak on these issues," said Mike Godwin, staff counsel of the Electronic Frontier Foundation. "We feel certain the Supreme Court will uphold the lower court's finding that the statute is unconstitutional." The Communications Decency Act, passed as part of telecommunications reform legislation last February, would have banned indecent images and speech from any areas open to minors on the Internet. Under the law, operators of Internet sites would have been required to segregate indecent content into adults-only areas that required a credit card or other form of positive identification for access. Drafters based their restrictions in large part on regulations governing broadcast media which still prohibit indecency over the airwaves, as well as some local ordinances which require segregation of indecent materials from others. But a coalition of civil liberties groups, for-profit and non-profit organizations challenged the Act in a consolidated suit before a federal court in Philadelphia. The law, plaintiffs claimed, was unconstitutional since it set up restrictions on indecent but constitutionally protected speech. The CDA, moreover, would place a "chilling effect" on free speech as Internet users unnecessarily limited their speech in order to comply with an impermissibly vague law, plaintiffs claimed. In place of the CDA, plaintiffs suggested evolving technologies in the hands of responsible parents would better protect children while preserving adults' First Amendment rights. The Philadelphia Court agreed with the plaintiffs on all counts, striking down the law June 12. In a unanimous decision, a three-judge panel found that the democratic nature of the Internet entitled it to at least as much protection as print, traditionally the least regulated of all media. The court also found that the statue was impermissibly vague and would thus unnecessarily restrict speech. The court also ruled the government had failed to show the law was enforceable with current technology. Cheers. Will

1 0

FTS2000 and Encryption?
by nson＠kpmg.com 17 Dec '03

17 Dec '03

I trying to find out if there are any talks, decisions or even standards being discussed for encryption and FTS2000? Anything will be helpful.

4 3

New mix/ghio.remailer.2 remailer up: jam
by Ian Goldberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- As anticipated, I've put up a ghio.remailer.2. The email address is <remailer(a)cypherpunks.ca>. Here's the public key: Type bits/keyID Date User ID pub 1024/734C3A3D 1996/06/28 John Anonymous MacDonald Remailer <remailer(a)cypherpunks.ca> sig 734C3A3D John Anonymous MacDonald Remailer <remailer(a)cypherpunks.ca> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzHUH7sAAAEEAKi9dAsHtUYzWu8u/0O3HKfWMYYfuwlo9y5W1x+lvNdZ9RL0 T1znvGaaoGmVF76qzl3aAabuoiKTdeGyUtZ5kZ/Ka+DpMaRQUaTY7i4wf3vD8u1I y2mTGYv945BwBdhcpDeTVCK81J6krnY1iAi6o8GqtATQHeJskDz5wkNzTDo9AAUR tDtKb2huIEFub255bW91cyBNYWNEb25hbGQgUmVtYWlsZXIgPHJlbWFpbGVyQGN5 cGhlcnB1bmtzLmNhPokAlQMFEDHUH+c8+cJDc0w6PQEBIC0D/jMBXNlMBSokNveZ 7LvWpWKfOlHwNSNGT3p403o21bIG9txsPk9e/wDurG310hJglKBuovoenqwClxy/ m6lldAe+11VMpLimzUCE0W4LeJxW84N+Jg/SGmP7YF1N0OmAc0snfvJhhgI0kWHl DMu+pWAc6UXLEPln0wtb936TFxbA =WL1j - -----END PGP PUBLIC KEY BLOCK----- It also accepts Mixmaster messages: jam remailer(a)cypherpunks.ca c2178bf3018c062a8d0fabd066e50ed9 2.0.3 - -----Begin Mix Key----- c2178bf3018c062a8d0fabd066e50ed9 258 AATgExB26IdURw+itvFEQsWjv/mQFgg3Tu2avLU2 fdW55aqKqKDeiIWf8nY24HG+i08s65cp8zCm2w7E ZvzgcBxLQu91Sg1UbQlkYMYqx8NpeKjxnkU+5KqC mswqrAbOn0qqcmNz7/3TsGS0p22+Dsw9rLjwDk4o udzR2maCUTuDvwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- Note that the above mix line should be used instead of the one (called "jammix") I posted yesterday. For Raph's remailers file: $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; - Ian -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMdQs3UZRiTErSPb1AQHC9gP+KT5KfwsHdK6S7Urg2iVxbLAqci5+gZhi E6UKqsolDv8BMCr5nJuMClEHfdJBGrGeyrazgcxESmOzAoj/TfHbIU6seg46/q9c pSpASazX39YE8Os5hMomgcEfFBVFE8+m9XUWGNnpCvyO8ZtlfVyQS+vG0aS2o0hE /59pTd0iTAM= =J5Hd -----END PGP SIGNATURE-----

1 0