December 2003 - cypherpunks-legacy

Re: Microsoft Explorer security hole (fwd) MSoft's reply...
by Joel McNamara 17 Dec '03

17 Dec '03

Displaying warning dialogs in browsers and using default settings so as not to auto run macros are only bandages to this problem. Consider the following: By using API routines to access the Win95 registry, someone writes a macro virus (or even just a garden variety trojan) that turns off the warning levels for MSIE which are stored in the registry (I haven't had time to look, but I'm assuming they're there). The user has no idea the setting has been changed, and is never warned when evil, malicious, unsigned code is executed. Until too late. The registry, or whatever file you're saving state values to, should have some form of write authorization associated with it. Encryption would also be extremely nice for privacy's sake (check out a Windows .INI file or registry entry some time, and see what little tidbits of information are being stored there). In my experience, one of Microsoft's main problems when it comes to security has been its developers and program/product managers don't think like "bad guys" when it comes to design and subsequent exploits and holes. Unfortunately, the user is the ultimate loser. Joel BTW - The paranoid side of me wouldn't be surprised to see PC "espionage-enabled" viruses and trojans within the next few years. Their main purpose would be to either disable or patch various security features for later attacks, or directly snatch information off of hard drives and send it out over the Net. I know of a few lab projects of a similar nature, that were very easy to implement. >Date: Thu, 22 Aug 1996 15:49:33 -0700 >From: Thomas Reardon <thomasre(a)MICROSOFT.com> >Subject: Re: Internet Explorer security problem (Felten, RISKS-18.36) > > >We have discovered a security flaw in the current version (3.0) of > >Microsoft's Internet Explorer browser running under Windows 95. An > >attacker could exploit the flaw to run any DOS command on the machine > >of an Explorer user who visits the attacker's page. > >We now post the virus warning dialog on local files (file: urls). We have >always posted it on remote files (http: urls). Note that the root of the >problem is not Java or the browser, but in macro-enabled applications. IE3 >has a mechanism to warn users about safety of documents when used with >common macro-enabled applications. We are have updated Microsoft Word such >that by default it will not run macros embedded in documents. > >-Thomas

1 0

Re: (NOISE) Re: Free Pronto Secure Offer
by Michael T. Babcock 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: unicorn(a)schloss.li, cypherpunks(a)toad.com Date: Tue Aug 27 17:33:42 1996 > So would I, however, the assumption that "cypherpunk crypto review > services" are to be had for nothing is the height of arrogance. They've already got a lot of us reviewing it... sorry, it's not arrogance - -- they were right. > If you were sincere, you'd thank them with cash. Afterall, you seem > to suggest that you have a good deal of liquidity eh? Actually, they lose $99 each time they give us a free copy of the software ... in case you're not as good in accounting as you think you are in crypto. I have no idea what your rep. is ... but I know one thing, they're offering an exchange of valuable software (market value: $99) for valuable services (crypto-rebel review) > Uh, the kiss ass paragraphs were the reviewers comments, not your code. I aggreed with the reviewers comments, they're mine too ... I've sent many long E-mails to people I do computer service for endorsing Pronto Secure. I have lined up 6 people who wish to purchase it. This is for real pal. If you don't like it, get out of the ring. Some of us want our PGP to be nice and easy like E-mail used to be. Message Copyright 1996, Michael T. Babcock http://www.cyberbeach.net/~mbabcock Send a message with the subject "Send public key" to receive an automatic reply with my public key. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: ascii Comment: http://www.cyberbeach.net/~mbabcock/PGP/ iQC1AgUBMiNpvNtTCwP6TF2xAQGKSwT+Lg+uEKBX9yUfZvkZ6tO32fhilvb65sgJ lpH2MPIArTKIYw/nD4UGQbQPTtx/9+1ASx5V+uqmquy7t/yfbuajrmsuLjnGBc/D tYxAxRl31+sU3N8X2ie54X1VWcLzgqfXCByuTYIHPPkeHjk7kWJfwTqXZsLV/ZZp NYGaL6OWq+DXWN3IYxd43fVdfi6qzCxDjseIdAdoV4J7TCjOUCNXbg== =WqpJ -----END PGP SIGNATURE-----

1 0

Re: (NOISE) Re: Free Pronto Secure Offer
by Michael T. Babcock 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: geoff(a)commtouch.co.il, cypherpunks(a)toad.com Date: Tue Aug 27 17:29:43 1996 > To: unicorn(a)schloss.li, cypherpunks(a)toad.com > Date: Fri Aug 16 02:41:34 1996 > Unicorn, > > > No, I was merely pointing out that if the review revealed that it > > had problems (one assumed that the intent of peer review is to reveal > > such problems in the first place, but perhaps you just like giving > > software away?) then the offered reward was valueless. No, actually, after having pointed out one (and found another) bug in Pronto Secure, I find it to be an amazing piece of software! It does everything with PGP and although it's slow at adding new keys (I presume it always checks the signatures down a few levels every time it adds one, and thus justifiably slower then straight adding a key) it's fast, efficient, and fairly easy to use. I must admit that of the "View/Save/Inspect" options, only "Save" is very clear and the rest are (excuse the pun in advance) cryptic at best. However, the methods used for the cryptography seem to be sound and after monitoring my COM transmissions, I haven't had it sending my secret key ring out ... ;) ... (unless they're hiding it in tiny packets ;) > Peer review seems to have voted that their risk paid off. My vote's in. Thanks for the software! > > Cypherpunks is always getting the cash poor developer who thinks he > > very clever because he has to pay testers no money if he offers his > > new product free to the person who discovers a flaw, or writes a > > review. I actually think that Commtouch will not be cash poor in a few months ... > > From your home page, I would guess that you request that reviewers > > allow you to make their comments public. That's called an > > endorsement, and, by the way, people are usually paid for them. > > Sometimes in the millions. Think Michael Jordan is getting a deal > > when you use his name to promote your product and then give him a > > $99.00 piece of software (which is effectively worth the amount of > > time it takes to write a few kiss ass paragraphs on the software, not > > $99.00)? That's because they're famous and their opinion is considered to be very good. I could see them paying Phil Zimmerman to endorse it publicly, but it wouldn't matter much because the mainstream people (the ones they're targetting with Pronto Secure) don't know who Zimmerman is ... so it's not worth they're money ...! > I venture that most c'punks would agree that moving strong e-mail > security into mainstream is a good thing. This is not going to happen > without people making money from it. Definately... Message Copyright 1996, Michael T. Babcock http://www.cyberbeach.net/~mbabcock Send a message with the subject "Send public key" to receive an automatic reply with my public key. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: ascii Comment: http://www.cyberbeach.net/~mbabcock/PGP/ iQC1AgUBMiNo19tTCwP6TF2xAQHwUgUAlJGE5ZU0xV7Hx3u7+/MRv+n83Kn9ZxsE 8igHrEjLwVbfBC9ivoZ7aonm/misAdy2jr77oowPcvuE3t750oCMCfb+AdhUPQGx Knu29L4XNbgpUH+t5rCCqUiSM7EHIYtmURBjrmDSAADIH3vcd8b9Cc6T5soNIQK+ Nsy9hve+ly+4nVwujNKqAhOCvIMBn+wK/K+ifbAvGbXP65YQFktp4Q== =AF5P -----END PGP SIGNATURE-----

1 0

RE: File System Encryption
by Wayne Clerke 17 Dec '03

17 Dec '03

---------- From: Drifter[SMTP:drifter@c2.net] Sent: Monday, 26 August 1996 16:19 To: cypherpunks(a)toad.com Subject: File System Encryption I'm aware of the three main disk encryption programs SFS, SECDRV, and SECDEV, but I need to find a solution that works with Windows 95 32bit or Windows NT 4.0. I'm currently using SFS 1.17 and Secure Drive under Win-95, but am unable to continue to work in dos compatability mode due to severe performance hits. I am open to commercial products that have passed peer review, but know of none. If anyone could suggest a solution (outside of switching OS's), I would be *most* gratefull. Please respond to the list, as I am a subscriber under another account. Tried secdev? Edgar Swank (author of secdrv) recently posted that secdev (note, not secdrv) does, in fact, uses 32 bit disk access with win95. Win95 reports that the secure device is in compatibility mode, but the host disk (and therefore the secure volume file) is being accessed in 32 bit (disk) mode. Not sure what issues there are with '32 bit FILE access' mode here. Sounds worth a try though. Please post the results if you try this. The Drifter EMail: wclerke(a)emirates.net.ae PGP key ID: AEB2546D FP: D663D11E DA19D74F 5032DC7E E001B702 PGP mail welcome. Voice: +971 506 43 48 53 <a href=mailto:wclerke@emirates.net.ae>Wayne Clerke</a> If you're not living on the edge, you're taking up too much space.

1 0

a question please
by Charley Sparks 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Tue Aug 27 19:39:45 1996 I have been lurking for some time, the occasional quip of a post, perhaps a comment on a "shrink wrap" - I still haven't figured out "Black Net" Done searches, ( the usual ) and no luck... can I get a break ? Would someone please explain it to me ? Thanks, and my PSecure is registered ! - -------------------------------- Charley Sparks <sparks(a)bah.com> Booz Allen & Hamilton - -------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCXAwUBMiOHQuJ+JZd/Y4yVAQGMcwQMDs5Owwd5XH6+XPUVZow4NMq1rV+QXp6W dLeF0vGT9rg5n6NZJKuAxSFuiXjJLKpv1JePSI2y2mmqMKncajhl2NvvtNPtnK/z dYF8D2sDvdPVffbxBO7QfjDwV9k5LmEVk24sOjbIk+j6zIZW899OAvT6CadoCmRS 1dQ9VWMyI0vunw== =tfni -----END PGP SIGNATURE-----

1 0

Re: Net Politics
by baby-x＠cyberpolis.org 17 Dec '03

17 Dec '03

At 10:23 AM 8/27/96, Jonah Seiger wrote: >This is an important debate that unfortunately seems to be dividing the >net.community when we most need to be united. All of us working on >net-policy issues share a common vision and goals - promoting the free flow >of information, preserving and enhancing First Amendment values and >protecting individual privacy. There are, for better or worse, many >different views on the best way to accomplish those objectives, and the >debate over who has the right tactics seems to frequently escalate in to >religious war. Not an unusual thing online (Windows! Mac! Windows! Mac! Linux!). >Meanwhile, our opponents are well organized, determined, and do a much >better job of keeping their internal strategic differences to themselves. >Perhaps this is part of the reason they keep kicking our butts all over >town. I swer I had this conversation somewhere recently, and those of us involved in it came up with one reason this rift seems to come up so often and get discussed so publically, especially in comparison to our "organized, determined" opponents. I would hazard a guess that those people working within the cause of electronic freedoms tend not to be the simple order-following, authority-heeding sort (compared to, say, followers of the Religious Right). It's easy if you're Ralph Reed to send out a flyer or get the telemarketters working and tell the troops what to do. It's not as easy if you're, say, Jonah Seiger. Not because of Jonah (or Shabbir, or Declan, or whoever), but because of his audience. It's not a push-button response with us. And I'm still not convinced (as I wasn't last year when I was more heavily involved in some of this) that these differences of opinion have to somehow be kept behind-closed-doors. That has always stuck me as the way -they- do it (if I can stoop to using a Them for a moment), and never as a way that was inherently required. It's like the Gulf War or something. "Hey, we're at war, stop criticising, we need to be united!" Hogwash. -----------------------------------------------[ Christopher D. Frankonis ]--- --------------------------------------------------[ baby-x(a)cyberpolis.org ]---

2 1

DEF_con
by jya＠pipeline.com 17 Dec '03

17 Dec '03

8-26-96. EeTi: "Unix gives hackers a crack at systems." Las Vegas: Many of the hacking elite were on the Internet long before the World Wide Web was a gleam in the eye of inventor Tim Berners Lee. And these folks know the best-kept secret of gaining access to-and control of-someone else's electronic property: Unix. An expert underground Web cracker who goes by the handle +ORC noted with apparent glee: "With each company that connects to the Net, new frontiers are created for crackers to explore." Indeed, even as many old-line hackers of the sort who gathered here recently for the DefCon convention go legit, some starting cyber-security companies of their own, Internet-security experts look with trepidation to the next, more threatening wave of cybercrime. Perhaps the legendary hacker group l0pht is the best example of the thin line between cybercriminal and corporate comer. Several members spoke at DefCon, notably Death Vegetable, administrator of the Cult of the Dead Cow; and Mudge, the brilliant encryption cracker who devised the S/Key Cracker's Toolkit and posted it on the Net, much to the chagrin of Bellcore, S/Key's owners. ----- http://jya.com/defcon.txt (9 kb) DEF_con

1 0

No Subject
by Wayne Lambert 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Tue Aug 27 21:06:05 1996 - --- Wayne Lambert -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQC1AwUBMiObgojTYwU2UXOVAQHNtwT9Gt9WFfG5WNWwfiqNKU/mOQdzVAY17108 E9h5kVZOuTmA64RIbtwDwD8ehfdJBYguaxIY5Iwm6no9R7YlS5JfyPZ1a1LdnUkp nA/Le0Ru2pnb4jDLt2fvYDox9NatBH18nIKNWkDo7l3nxf8y4gur/WS2OHlNsiw+ otNsi993lNuIieYgJ4ZZ3qp0vBhMjvOsUgNZ0RaSpHAei65lcpAInw== =/+Dx -----END PGP SIGNATURE-----

1 0

Hayek (was: Cato Institute conference on Net-regulation)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:05 PM 8/27/96, Declan McCullagh wrote: >This should be a good half-day conference, with some interesting >speakers. I'll probably show up for Charles Platt's keynote. > >Naturally, it's being held in the building's Hayek Auditorium. Hayek has >some relevance to cypherpunks, I think -- he warned early on that the >loss of economic freedom inevitably leads to the loss of civil liberties >as well. > >He also described the phenomenon of spontaneous order (admittedly in the >context of markets), which speaks to the way the Net has ordered itself. Indeed, Hayek has had a _lot_ to do with the Cypherpunks! From "The Road to Serfdom" to "Law, Legislation, and Liberty," his works have exerted a profound influence on me, and on many others. Lots of connections, from ur-Cypherpunk Phil Salin having worked with him, to special Hayek issues of magazines also featuring Cypherpunk fellow travellers like Mark Miller, and so on. I described to Kevin Kelly the "emergent order" work Hayek did, for Kevin's development of his ideas which later became "Out of Control." (I'm sure Kelly was generally aware of Hayek, but I emphasized to him the importance of his emergent order ideas as the underpinnings of anarcho-capitalism.) (In fact, I would say Hayek would've been a candidate for being a cover boy for "Wired"...assuming of course he was 60 years younger, had some of his body parts peirced, and, even better, was a Netchick. Being instead a dead white European male, he'll never be mentioned in "Wired.") "Hayek -- Tired (Dead tired, in fact), Beavis -- Wired" ("Uh, like, economics like really sucks.") We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

SUN_pak
by jya＠pipeline.com 17 Dec '03

17 Dec '03

08-26-96. MiPa: System for signatureless transmission and reception of data packets between computer networks (Assignee -- Sun Microsystems, Inc.) Abstract: A system for automatically encrypting and decrypting data packet sent from a source host to a destination host across a public internetwork. Inventors: Aziz; Mulligan; Patterson; Scott. ----- http://jya.com/sunpak.txt (6 kb) SUN_pak

1 0