December 2003 - cypherpunks-legacy

THE POUCH
by C Matthew Curtin 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Allow me to quote from your web page: http://www.flagler.com/security.html Quote #1: "The POUCH is a secure e-mail terminal program for IBM compatible computers. It uses a secret key phrase, advanced cryptographic techniques and several unpublished algorithms to protect data in the body of e-mail messages. The key phrase, which can be up to 48 bytes long, is easily remembered and communicated. The POUCH is highly resistant to all known forms of cryptographic attack." Quote #2: "We warrant that the product when delivered to you has no short cuts, covert channels or secret solutions of any kind. No other warranty, either expressed or implied is given." These two statements are contradictory; an unpublished algorithm is itself a secret solution, and a covert channel. Why is it that software manufacturers keep popping up and spewing nonsense? Obscurity is not security. Making the algorithm proprietary does extremely little in making it resistant to attack. All of your statements regarding the security of "The Pouch" are worthless, for you have no data with which to substantiate your claims. If it is any good, there's no way for us to know. But your marketing of the product has every indication that it's nothing more than smoke and mirrors. To coin a phrase, "pseudocrypto." Please refrain from your bogus marketing techniques. This kind of stuff, by claiming to be "real cryptography" makes real cryptographers look bad. - -- C Matthew Curtin MEGASOFT, LLC Director, Security Architecture I speak only for myself. Don't whine to anyone but me about anything I say. Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet cmcurtin(a)research.megasoft.com http://research.megasoft.com/people/cmcurtin/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Have you encrypted your data today? iQCVAwUBMhdZaBhyYuO2QvP9AQHaxQP+OvqYc9U/3BTPwnEhL/9ADkzL+ulhILpj 1zbyhktoCB4yMB13WQgm05DM6lolUufo63nkhsX4giMhrQ2XCBeM5/8pxJOD2ThY 3+foxma7e3tUv8r6PjNlnhn2TzVPPgbN+6NdpUCbNtOpG8GsD4EdQ35S+H0Y+aJm 75FfHfaDrNQ= =6Zxy -----END PGP SIGNATURE-----

4 3

Hackers invade DOJ web site
by Mike McNally 17 Dec '03

17 Dec '03

CNN online (http://www.cnn.com) is reporting a "breakin" by "hackers" to the DOJ web site. They don't elaborate exactly how thy did it. ______c_________________________________________________________________ Mike M Nally * Tiv^H^H^H IBM * Austin TX * For the time being, m5(a)tivoli.com * m101(a)io.com * <URL:http://www.io.com/~m101> * three heads and eight arms.

4 3

Re: Final release of Navigator (with strong crypto) now available
by Alex de Joode 17 Dec '03

17 Dec '03

Jeff Weinstein (jsw(a)netscape.com) wrote: : The final release of Navigator 3.0, complete with non-exportable : strong crypto, is now available for download by US citizens. Note : that this is the released version of 3.0, so it will not expire. : You can get it from: Would it be possible to both supply an Linux ELF and a.out binary ? : http://wwwus.netscape.com/eng/US-Current/ : --Jeff -- Alex de Joode | Replay IP Service & Web DZign -- The Netherlands usura(a)replay.com | http://www.replay.com mailto:info@replay.com

6 7

Re: FCC_ups
by jim bell 17 Dec '03

17 Dec '03

At 03:36 AM 8/18/96 +0000, Vipul Ved Prakash wrote: >> >First flat rates would have to go out. >> >If Alice uses her phone for 5 hrs in month and pay _x_ dollars and Bob uses >> >his for 100 hrs and pays _x_ dollars, then Alice is subsidising Bob, which >> >is not really ethical. Everyone should pay for the amount of bandwith >> >one is using. >> >> I'm afraid you're promoting what I consider a rather old (and, now, odd) way >> to look at it. Unlike old mechanical telephone switches, the new hardware >> does not "wear out" and thus a person who uses it more doesn't cost the >> phoneco any more bucks. If that's the case, I don't see the logic in >> charging a person more for greater use. >> >Machinery 'wear and tear' is a small part of Infrastructure maintainance costs. There are tons of other things. Hidden costs, management, laying new pipes,etc. Well, let's consider such costs. Most of which (maintenance, management, rolling stock) are unrelated to amount of telephone usage. So there is no reason that these costs should be unequally attributed to a person who makes local calls 1 hour per day, as opposed to another who only calls 15 minutes per day, for example. As for the "laying new pipes" issue: Years ago in the the US, when inter-central-office trunk connections were all implemented using large bundles of copper pairs, it would have been _correct_ to say that higher telephone usage resulted in larger costs, since more trunk lines were necessary. Today, on the other hand, inter-office trunks (at least the new ones, and I presume that even many of the old ones have been switched over) are implemented in fiber optics. Extra capacity is either automatically available (since the capacity of a given fiber is unlikely to be fully used) or can be fairly simply added by converting old fiber from about 450 megabits per second to 2.4 gigabits, or even faster rates which have become more recently available. >But you miss my point, if a phoneco is not getting a penny for its long distanceservices (which subsidise the flat rate local calls) then the choice would >be to close down. Which would be a severe attack to the local internet usage. That's an entirely unsupported claim. Nobody claims that telephone usage (term used generically) is on the way out. "Closing down" is only going to happen if local phonecos cease to be able to provide a service that people are willing to pay for. And as for the amount of the subsidy, let's look at it. I've read around here recently that the amount of the charge is 3 cents per minute. If we assume an average LD rate of 15 cents per minute, that's 20% of the bill. If an average LD bill is $15 per month, that's only $3 per line, per month. It seems to me that those local phonecos could simply raise their local charges by this and totally compensate for the loss of that subsidy. However, an even more likely outcome is that they will make structural changes which they've been able to avoid after decades as a regulated, monopolized business: Reduce personnel levels, especially in areas other than those in which they are actually providing telephone service. Reduce salaries from "comfy" to "competitive." Before it was broken up in 1983, AT+T was a regulated monopoly and was, more or less, guaranteed a profit. Extra costs, such as higher staffing levels and higher salaries, simply increased the rates, they didn't reduce the profits. This system is still in force with the local phoneco side of the business. Anther thing which could be done, from the government's side (as part of an industry restructuring) is to allow phonecos to greatly accelerate their tax write-off of existing depreciating equipment, perhaps down to as low as 5 years or so. The theory is, these phonecos are going to start competing with companies who are only buying their equipment today, and it would be unfair to saddle the older companies with old, inefficient equipment without allowing them to completely write it off quickly. (This, of course, doesn't mean that they need to actually take it out of service...) Jim Bell jimbell(a)pacifier.com

2 1

Re: Hackers invade DOJ web site
by Frank Stuart 17 Dec '03

17 Dec '03

>CNN online (http://www.cnn.com) is reporting a "breakin" by "hackers" >to the DOJ web site. They don't elaborate exactly how thy did it. I certainly don't support the person or people responsible for this and it may very well end up having an overall negative impact. Since it has happened, however, I think those in a position to do so should start with the spin control. Some suggestions: The fact that even the U.S. Justice Department is unable to adequately protect it's own site from intruders underscores the need for widely- available strong encryption. While this is certainly a major embarrassment for the Justice Department, at least the mandatory "key escrow" program the Clinton administration is insisting upon has not yet been implemented; no private citizens' data appears to have been compromised this time. It's doubtful that a new law or government bureaucracy would have prevented this from happening but it's entirely possible that tools such as strong encryption could have. It's ironic that the U.S. Government is focusing on the former while fighting use of the latter. This event could potentially draw a lot of interest from the general public. Since we're dealing with public perceptions largely created through the main- stream media, it's important to remember that "sound bites" are more important than carefully reasoned arguments. | (Douglas) Hofstadter's Law: | It always takes longer than you expect, even Frank Stuart | when you take into account Hofstadter's Law.

3 2

"----- Message body suppressed -----"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:10 AM 8/21/96, Skip wrote: > ----- Message body suppressed ----- > Sounds good to me. Keep it up. --Tim May -- [This Bible excerpt awaiting review under the U.S. Communications Decency Act of 1996] And then Lot said, "I have some mighty fine young virgin daughters. Why don't you boys just come on in and fuck them right here in my house - I'll just watch!"....Later, up in the mountains, the younger daughter said: "Dad's getting old. I say we should fuck him before he's too old to fuck." So the two daughters got him drunk and screwed him all that night. Sure enough, Dad got them pregnant, and had an incestuous bastard son....Onan really hated the idea of doing his brother's wife and getting her pregnant while his brother got all the credit, so he pulled out before he came....Remember, it's not a good idea to have sex with your sister, your brother, your parents, your pet dog, or the farm animals, unless of course God tells you to. [excerpts from the Old Testament, Modern Vernacular Translation, TCM, 1996]

3 2

Today's Dilbert
by Simon Spero 17 Dec '03

17 Dec '03

I can't believe nobody mentioned wednesday's dilbert cartoon.. Simon --- Cause maybe (maybe) | In my mind I'm going to Carolina you're gonna be the one that saves me | - back in Chapel Hill May 16th. And after all | Email address remains unchanged You're my firewall - | ........First in Usenet.........

1 0

Re: Husband/Wife jailed for saying Clinton Sucks
by Elf 17 Dec '03

17 Dec '03

---------- > From: Rich Graves <rich(a)c2.org> > To: cypherpunks(a)toad.com > Subject: Re: Husband/Wife jailed for saying Clinton Sucks > Date: Wednesday, August 21, 1996 5:12 AM > > On Tue, 20 Aug 1996, Z.B. wrote: > > > Published in Washington, D.C. July 9, 1996 > > Insult to Clinton leads to 2 arrests > > > > ------------------------------------------------------ > > By Ruth Larson > > THE WASHINGTON TIMES > > ------------------------------------------------------ > > I think you should try a more credible paper. Say, Scientology's Freedom > Magazine, rather than the Moonies'. You are of course free to believe > whatever you wish. > > -rich Actually it very well could of happened. I am ex-Navy and for military peronell it is made clear that anyone military or not that slanders, degrades, or in any way threatens or degrades the President (commander in chief) is subject to arrest, imprissionment and/or fines. Of course this usually doesnt happen cause only the real wacked out Clinton rules gov. employees would enforce this. But you never know!

1 0

SSL: The early days
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

I've been trying to find information about the early days of SSL for a paper I'm writing, but I'm finding that someone's comment about the net having a collective memory of about 12 months seems to be true - there doesn't seem to be anything available going back more than a year or so. In particular I'm interested in: - Why/how/when did Netscape decide on SSL? - How long did it take to design the first version? - I've heard a rumour that when it was first presented at a conference, two people independantly broke it before the speaker sat down. Is this true, and what conference was it? The later work on SSL (an open design process, contributions from cryptographers and security experts, IETF standards-track work, etc etc) is well documented, but information on earlier work is hard to find. Does anyone have any pointers to information I could work from? Peter.

1 0

Re: cryptoanalysis 002
by peter.allan＠aeat.co.uk 17 Dec '03

17 Dec '03

> From: Scottauge(a)aol.com > Date: Tue, 20 Aug 1996 18:36:45 -0400 > Subject: cryptoanalysis 002 > For example, if the crypto-alphabet for e is 23, 45, 190, 200, etc, one can > remove some of the frequency for a letter. This definately makes it harder > to attack with the frequency analysis method because the "resolution" of the > distribution for the letter is lessened to a near randomness. (So it looks, > there are still clues, eh?) I think (from memory) this is called "homoalphabetic". Encyclopaedia Brittanica (Cryptology - article by Gus Simmons) says that it is still vulnerable to frequencies of digraphs, trigraphs etc. But even Gauss was keen on it once. I guess it might have value as a part of another system, making a known plaintext into one of many. Whether it's worth the increased cyphertext size in a system you'd hope to be immune to known plaintext attacks anyway is another question. PA

1 0