December 2003 - cypherpunks-legacy

CyberTerrorism Thoughts
by Barry C. Collin 17 Dec '03

17 Dec '03

Dear Mr. Geiger: Thank you for your very well-thought-out presentation. That is precisely the kind of material we need to see more of in this forum. It's tough to write, but it's worth it. >From the feedback I've received, I should make this clear: regardless of criminality issues, I do not consider hacking in to a system to view things an act of terrorism (by classical or other definition). My concern, by far, is the fragility I've found with systems connected to physical processes -- processes that affect the physical world. Your segmentation of motivation and actions was excellent. I look forward to your future commentary and postings. Also, although it is sometimes difficult (myself no exception), I think you'd agree that this factual, non-flame approach gets far more work done. Your response in that manner was appreciated. Regards, Barry C. Collin -- Institute for Security and Intelligence A Non-Profit Research Institution P.O. Box 9877 Stanford, California 94309-9877 USA

1 0

Re: MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

Eric Murray writes: >Peter Trei writes: >> >> John Hemming - CEO MarketNet" <johnhemming(a)mkn.co.uk> writes: > >> > Just downloaded the most recent English Version 2.1 for Windows 3.1. >> > This does appear to do the same in terms of no encryption at all after >> > the server hello. >> Please ensure that the server you are connecting to is not configured for >> authenticate-only. It would be a pity to raise a big ruckus over what may be >> just a mis-configured server. >In addition, encryption isn't performed until after the ClientFinished >and ServerFinished messages, no matter which CipherSuites are negotiated. Actually the server verify message should be encrypted (to verify the key negotiation). Also the server and client finished should be encrypted. I don't actually get the client finished record or client master key record. However, I don't get those all I get is the cleartext data in packets of SSL record format. I have done a little more experimentation and it does appear quite clear that this happens with a non standard (ie not Verisign and a few others) X509 Certificate. In the trace that I have posted it is clear that cypher 02 00 80 has in theory been negotiated.

1 0

Elliptic Curve Y**2 = x**3 + a * x**2 + b
by trollins＠interactive.visa.com 17 Dec '03

17 Dec '03

Hello all, I have a math question concerning implementation of elliptic curve systems. In coding some elliptic curve source, I need to pick a random point on the following elliptic curve in field F_p where p is a prime number. Y**2 = x**3 + a * x**2 + b where 4a**3 + 27b**2 is not equal to 0 mod p In selecting a random point, I pick a random value for x in the range 0 < x < p, compute the right hand side of the equation and find myself needing to take the square root for the two solutions. Questions are: 1: How can I take the suqare root mod p ? 2: How to determine if a solution exists for a selected value of x ? 3: Is the a simpler method than find a square root ? Thanks for any ideas you may have about this... -tom

4 4

RE: Mimic Function Stego Programs?
by Damien Lucifer 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 29 Aug 1996 16:32:40 -0400 (EDT) Subject: RE: Mimic Function Stego Programs? On Thu, 29 Aug 1996, * wrote: > better than the 64 word ones I've used. I'd like to get a hold of these > (or the program, if it's not texto). I mailed DJ about it, but he said > he picked it up from a newsgroup he couldn't remember. If you follow up > please let me know any results. Fascinating stuff ... Donno, the next hop from 64 words per type is 4096 words per type, a very tall order. I've been working on a text steg'ing program for a while that operates under a different premise, however. It keeps a dictionary of word pairs, with each word in the pair being a synonym for the other. It will read through a donor file, swapping words based on whether we need to hide a 1 or a 0. The encoder is working right now but the decoder is not. A quick example: dictionary: 1=sofa 0=couch input: The couch is very comfortable output (0): The sofa is very comfortable. output (1): The couch is very comfortable. The output text is virtually identical to the input text, and would (in most cases) easily fool the average human reader, as well as fooling simple mail filters. The main problem is that very little can be hidden in a text file in this manner. I have one peice of text that is 50k, and can conceal about 64 characters of data. More typical numbers are around 15-25 characters/50k, which is why I never finished the decoder. Once i started encoding things, and realizing how little could be hidden in this manner, I stopped working on it. At the moment the dictionary is very small; nearly all of the words are relevant to only pornographic text (since porno is both predictable, and repetitive, i thought it would be a good place to start). :) I have the source code around, if you care to take a look at it.

1 0

the anonymizer
by bf578＠scn.org 17 Dec '03

17 Dec '03

Does anybody know if there are any other services like the one at http://www.anonymizer.com That anonymize your surfing? -- ------------------------------------------ There are no facts, only interpretations. I always wanted to be somebody,

1 0

Re: Small German bank claims first with online service
by bf578＠scn.org 17 Dec '03

17 Dec '03

> > >> FRANKFURT, Aug 28 (Reuter) - German private bank Gries & >>Heissel Bankiers on Wednesday launched an Internet banking >>service -- the first comprehensive service of its kind in a >>country where online bank options are gradually taking off. >> The small Berlin-based bank linked up with U.S. computer >>firm Hewlett Packard Co to develop the system, which Internet >>users can access using a high-security personal code. Sounds scarey and like a challenge! >> Clients will be able to view detailed balances on their >>deposit, current and securities accounts and transact all normal >>banking business on the World Wide Web. -- ------------------------------------------ There are no facts, only interpretations. I always wanted to be somebody,

1 0

Re: Singapore Global Action Alert (8/29/96)
by Jean-Francois Avon 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: Cypherpunks(a)toad.com 29/08/96 Subject: Re: Singapore Global Action Alert (8/29/96) On 29 Aug 96 at 11:31, Declan McCullagh forwarded: > The application (...in Singapore) of broadcast-inspired, > "one-to-many" regulation to > this new *many-to-many* medium (...the internet) indicates a > fundamental misunderstanding of the nature of the Internet. I completely disagree here! Taking into account the philosophico-political context there, it *obviously* indicate a *complete* understanding of the nature of the net. It is you (the writer of the forwarded article) who did not either dare to state or simply recognize the true nature of a govt pushing such measures. I am fed up of seing net users giving every would-be dictator the benefit of the doubt. There is no tolerance to be applied to that. There is no such thing as being tolerent to poison. Why don't we start naming things by their true names? JFA - -- Jean-Francois Avon DePompadour, Societe d'Importation Ltee Limoges porcelain, silverware and crystal JFA Technologies R&D consultants: physicists technologists and engineers. Montreal, QC, Canada PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQEVAgUBMiWnB8iycyXFit0NAQGvaAf9HHTGYk/MAg/uX3uP87sOd6mWrVLw8J8u 4XFp83YV1MPBkqZ5xIxmxBNR6bF2RyqFIiD/go3x3nbfX5YkdF9jXW4iOnYNK6Ji DzrlWTDNGFwTnbUnUbPraSjULU/0x3YdKAVmcxqr6KYBBLR2NVEtiqzbVQK2exHU DZUG6oamV4sK5QFRA5gj0L+oB+qEdveZJrTK13rZT3UC21GXuOBGRPpHQStfU5nK 3v7ajP4IdlxxHZutL/S1LmPJw1iSf9eDtn76J7Y8UxrgknNavavs9rxte3mUjns1 TneE7zz2g9VMS6cqGttncp/Cwc7AkeURi7nu0tnr7jCvwlo4GhGSoA== =4R7n -----END PGP SIGNATURE-----

1 0

New Microsoft Product! ! ! (fwd)
by Charley Sparks 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 29 Aug 1996 11:11:00 -0400 From: ICSHAB(a)aol.com Subject: New Microsoft Product! ! ! Microsoft Panhandler v1.0 (Beta) Redmond, WA -- Microsoft Corporation chair, CEO and all-around babe magnet Bill Gates announced yesterday the introduction of a new product for Windows 95: Microsoft Panhandling. "The idea came to me the other day when a homeless man asked me for money,"recalls Gates. "I suddenly realized that we were missing a golden opportunity. Here was a chance to make a profit without any initial monetary investment. Naturally, this man then became my competition, so I had my limo driver run over him several times." Microsoft engineers have been working around the clock to complete Gates' vision of panhandling for the 21st century. "We feel that our program designers really understand how the poor and needy situation works," says Microsoft Homeless product leader Bernard Liu. "Except for the fact that they're stinking rich." Microsoft Panhandling will be automatically installed with Windows 95. At random intervals, a dialog box pops up, asking the user if they could spare any change so that Microsoft has enough money to get a hot meal. ("This is a little lie," admits software engineer Adam Miller, "since our diet consists of Coke and Twinkies, but what panhandler doesn't embellish a little?") The user can click Yes, in which case a random amount of change between $.05 and $142.50 is transferred from the user's bank account to Microsoft's. The user can also respond No, in which case the program politely tells the user to have a nice day. The "No" button has not yet been implemented. "We're experiencing a little trouble programming the No button," Bernard Liu says, "but we should definitely have it up and running within the next couple of years. Or at least by the time Windows 2014 comes out. Maybe." Gates says this is just the start of an entire line of products. "Be on the lookout for products like Microsoft Mugging, which either takes $50 or erases your hard drive, and Microsoft Squegee Guy, which will clean up your Windows for a dollar." (When Microsoft Squegee Guy ships, Windows 95 will no longer automatically refresh your windows.) But there are competitors on the horizon. Sun Microsystems and Oracle Corporation are introducing panhandling products of their own. "Gates is a few tacos short of a combination platter, if you get my drift," says Oracle Head Honcho and 3rd degree black belt Larry Ellison. "I mean, in the future, we won't need laptop computers asking you for change. You'll have an entire network of machines asking you for money." Gates responded with, "I know what you are, but what am I?" General pandemonium then ensued.

1 0

The few, the proud, the under-quota'd-mailbox US Marine Corps
by Alan Horowitz 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 29 Aug 96 3:46:15 -24000 From: MAILER-DAEMON(a)mqg-smtp3.usmc.mil To: alanh(a)infi.net Subject: Undeliverable Message To: "Skeeve Stevens" <skeeve(a)skeeve.net> Cc: <cypherpunks(a)toad.com> Subject: Re: DoJ is poking around Message not delivered to recipients below. Press F1 for help with VNM error codes. VNM3043: BANYAN SERVER@MAG26@2DMAW NEW RIVER VNM3043 -- MAILBOX IS FULL The message cannot be delivered because the recipient's mailbox contains the maximum number of messages, as set by the system administrator. The recipient must delete some messages before any other messages can be delivered. The maximum message limit for a user's mailbox is 10,000. The default message limit is 1000 messages. Administrators can set message limits using the Mailbox Settings function available in the Manage User menu (MUSER). When a user's mailbox reaches the limit, the user must delete some of the messages before the mailbox can accept any more incoming messages. UNDEFINEDI have a military account. Not all govt or military accounts belong to black-helicopter pilots.

2 1

www.anonymizer.com
by frantz＠netcom.com 17 Dec '03

17 Dec '03

www.anonymizer.com got a nice plug in David Plotnikoff's column in today's San Jose Mercury News. He quotes Community ConneXion's motto, "Because on today's Internet, people do know you're a dog." He also mentions its similarity to anonymous remailers. His capsule review: "On the upside, it's very easy to use and it supports gopher and FTP transfers as well as Web pages. On the downside, it's predictable slow and pages, bracketed top and bottom with Anonymizer banners, often don't display quite right." ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius libri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

2 1