December 2003 - cypherpunks-legacy

Re: <none>
by pjn＠nworks.com 17 Dec '03

17 Dec '03

-=> Quoting Int:snow@smoke.suba.com to P.j. <=- In> On Thu, 5 Sep 1996 pjn(a)nworks.com wrote: > In> what do you know about hackers > > More than you appariently... > In> Which isn't necessarily all that much. Not for him... P.J. pjn(a)nworks.com ... Be wary of strong drink. It can make you shoot at tax collectors and m ___ Blue Wave/QWK v2.20 [NR]

1 0

/\/\/\/\/HELP\/\/\/\/\ !
by pjn＠nworks.com 17 Dec '03

17 Dec '03

In> I really need help unsubscribing from the Cypherpunks list! it is In> imperative! Just shoot yourself and it will all go away. . . P.J. pjn(a)nworks.com ... Exercise your right to arm and keep bears! ___ Blue Wave/QWK v2.20 [NR]

1 0

Re: [WAS xs4all.nl] Terrorists
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:16 PM 9/9/96, snow wrote: > Then again, the only reason I am not a terrorist is that the government >hasn't YET defined hate speach directed against the government to be >terrorism. Don't be so hasty in saying this. A couple of months ago Clinton signed some sort of bill having to do with terrorism, terrorist organizations, funding of same, and deportation of alien-units suspected of being allied with terrorist organizations. (I seem to recall another such act being passed in early 1995, so there may be more than one of these things...) Given the mounting hysteria about terrorism (by the government, at least), and given the various laws on the books, I would not be surprised to see some Web sites prosecuted as "harboring" terrorists terrorist-symps. If any of you are not citizens of the U.S., and are here on visas, I would give this some real serious thought. Of course, maybe deportation is a blessing in disguise. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Yahoo!'s Picks of the Week (September 9, 1996)
by William Knowles 17 Dec '03

17 Dec '03

Did anyone else catch this one? > Welcome to this week's selection of Picks, declassified and hot off > the press thanks to the Freedom of Information Act. Well, okay, not > really. But we like to pretend. On the other hand, if you would like > to peruse what once was private but now is public (in a federal > government sense of the word), head on over to The National Security > Archive. An independent, non-governmental research institute and > library, the NSArchive is where you'll find declassified > U.S. documents that shed light on anything from the Nixon-Presley > Meeting (Elvis wanted to be a Federal Agent at Large!) to the Cuban > Missile Crisis and a handful of White House e-mail in-between. > > http://www.seas.gwu.edu/nsarchive/ William Knowles erehwon(a)c2.net -- William Knowles <erehwon(a)c2.net> PGP mail welcome & prefered / KeyID 1024/2C34BCF9 PGP Fingerprint 55 0C 78 3C C9 C4 44 DE 5A 3C B4 60 9C 00 FB BD Finger for public key -- Vote Harry Browne for President -- http://www.HarryBrowne96.org

1 0

Can you trust your ISP ??
by I~nigo Gonzalez 17 Dec '03

17 Dec '03

Hello, I'm thinking about how can I get rid off this kind of attack *before* it happens. Can you please send me your comments about this? I don't know so much about the how SSL works, but I think this is something that can happen... SCENARIO -------- 1) Suppose We have a host with https protocol enabled, and someone outside wish to access the information we have on the server via https; but (for some reason wich we don't know), the connection has to be made through the Gateway named X (see plain diagram below): Outside <-------------> Gateway X <---------------> Our Server 2) I think that when a Secure Socket Layer connection begin this is what it happens: a) Outside generates a private/public key pair and he send us his public key, wich has to go through Gateway X, who send it to Our Server. b) Our Server generates his own private/public key pair and send his public key (whether it's sent ciphered or not doesn't matter... yet). c) Now both parts have their response public keys, ciphered transaction begins. All seems to be fine, but... 3) Suppose that We don't trust on what's going on through the line, and that IN FACT, someone in Gateway X is disturbing our communications like this: a) When Outside's public key comes to the gateway, Gateway X generates a public/private key pair (wich we will call spoofed keys), and it send a spoofed IP header marked as from "Outside" in order to act as "Outside" for "Our Server". b) Once "Our server" send his public key, "Gateway X" intercept the packet, decrypts it if necessary (because it has the private key needed to decrypt it), and it send "Outside" the public spoofed key (remember what it did on stpe a?). c) Now transaction takes place through "Gateway X", wich can read modify, and fake any data because it has now the ability to act as the other side to both "Outside" and "Our Server"... Avoid the problem: - The *only* think I can figure out to avoid the menace is to have a certified (Verisign and others) public key with a short expiration date. Of course this approach has a little problem: *how* can I verify that once expired "Our Server's" public key is really "Our Server's" key... a Certification Authority is something worth of spoofing... ;-) Maybe the best thing could be becoming my own certification authority... but how!? If for *some* reason the above cannot be done, the a simple way to avoid too much trouble is to limit transactions to just *atomic* transactions (checking account and getting some money are two different transactions). This can still be spoofed if "Gateway X" makes its own transaction with faked Outside's keys. Of course, We must limit the tansactions we accept in "Our Server". Notice that a password and challenges are useless in this kind of situations. ¿Any other way? maybe we can get somethig a bit safer if we found something fixed, inmutable and rely on it (acting like some kind of virtual communication channel between Outside and Our Server: Untrusted Outside <-------------> Gateway X <---------------> Our Server ^ ^ | | \-------- Virtual secure communication channel -------/ If every message "Outside" send to "Our Server" must have a response, then we could make "Our Server" send responses with some good (well tought) cryptographic technique wich will refer somehow to "Outside's" message fingerprint. I mean, every message from the Outside must have a message signature (i.e message must pass through MD5); and its response must have a valid "Response to: <query's MD5 signature>" and (of course) that response must be signed somehow. I still don't know how to do it well; but I will tell you how as soon as I will know. Thank you for wasting your time reading this. -- Iñigo González - ADV Internet Technical Advisor <nexus(a)adv.es> "Never say anything online that you wouldn't want to see on the front page of The New York Times." - alt.2600.moderated Posting

2 1

Re: Conservation Laws, Money, Engines, and Ontology
by Rick Smith 17 Dec '03

17 Dec '03

Wouldn't the model fit reality better if it were based on biological analogies instead of the raw physics of energy? I recognize there's a desire here to put some controls on one's own equipment ("I don't want to receive spam if I don't want to") and that physics provides the conceptual lever to argue in favor of the desired controls. Biological systems are a poor choice for grained control by people who like to change their minds. But the Internet really is more like an ecology with its own complex notion of "emergent order" than a simple physical process that must obey conservation laws in some narrow fashion. Trees obey physical conservation laws, but they don't exchange micropayments with soil, air, and Sun to ensure the balance is preserved. As things get out of balance, trees die. Other entities flourish. I can't imagine the mechanism by which very precise access charging and cost recovery mechanisms would replace the current "free" model. As we all know, it's not really "free." Information is published and made available because the vendor needs to distribute it and finds the Internet to be a cheap way to make it available. Many vendors exchange information and entertainment for your attention to a commercial message. As long as there are unmetered 'Net resources (and they're unmetered for a plethora of reasons) you'll never get rid of free riders. I think you have to choose between the relatively lawless open world or an enclave where you bar the door with your favorite security measures. You allow spam as long as you allow uninvited guests. And what is cypherpunks but a continuous party of uninvited guests? Regarding these micropayment machines, I think it would be interesting to identify some existing, widely used, real world analogues to them: how big/small are individual transactions, how much money can you securely collect, how much does the mechanism cost to deploy and maintain, how hard is it to attack, etc. Gumball machines? Pop machines? Pay phones? I'm not sure there *is* a real world analogue. Rick. smith(a)sctc.com secure computing corporation

1 0

Re: Conservation Laws, Money, Engines, and Ontology
by Greg Kucharo 17 Dec '03

17 Dec '03

>The most basic principle is this: those with resources they control (and >"own") set the rates and policies. I assume you mean this applies to both parties. The ISP has resources that I want to purchase. I have monetary resources it wants in return. Here's an idea; a contract socket. This socket negotiates a info exchange deal based on a base of variables that you have programmed it with. The exchange is made and money changes hands. Build in the usual things like reputation checking and what not to verify that the other guy meets the variables outlined(or at least can be trusted to). ??????????????????????????????????????? Greg Kucharo sophi(a)best.com "Eppur si moeve" -Galileo ???????????????????????????????????????

1 0

Re: Yahoo!'s Picks of the Week (September 9, 1996)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:08 AM 9/10/96, William Knowles wrote: >Did anyone else catch this one? > >> Welcome to this week's selection of Picks, declassified and hot off >> the press thanks to the Freedom of Information Act. Well, okay, not >> really. But we like to pretend. On the other hand, if you would like >> to peruse what once was private but now is public (in a federal >> government sense of the word), head on over to The National Security >> Archive. An independent, non-governmental research institute and >> library, the NSArchive is where you'll find declassified >> U.S. documents that shed light on anything from the Nixon-Presley >> Meeting (Elvis wanted to be a Federal Agent at Large!) to the Cuban >> Missile Crisis and a handful of White House e-mail in-between. >> >> http://www.seas.gwu.edu/nsarchive/ The National Security Archive has been around for many years, and has no connection (insofar as I know or suspect) with the NSA. They have regularly supplied talking heads to various talk shows, especially six years ago during the Gulf War. (In fact, they have a leftist bias.) --Tim We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: ... subversive leftists
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:57 PM 9/9/96, William H. Geiger III wrote: >In <Pine.LNX.3.94.960909125148.16761A-100000(a)blau.pin.de>, on 09/09/96 at >12:53 PM, > Stephan Schmidt <schmidt(a)pin.de> said: > > >>I hope this one was ironic. > >>> The Democratic People's German Reich is fully justified in cutting off >>> contacts with subversive radical publications in Jew-dominated nations like >>> Holland. >>> >>> As Reichskommander Schmidt points out: "The citizen-units who access >> ^^^^^^^^^^^^^^^^^^^^^^^ >>But this one is tasteless and insulting even if it was >>meant ironic. > >If the boot fits....... > I don't know why Stephan waited so many days to make his comment. It was my noticing that I had "collided" with his name, Schmidt, when I made my facetious post that caused me to almost immediately issue a clarification that I was not thinking of him when I made my first post. To be clear, again, I was not basing my "Reichskommander Schmidt" line on Stephan Schmidt. That was just a coincidence. As to the "Reichskommander," in our country, and on the Net, such jokes are not illegal. I rather suspect they are in Germany, either the DDR or the Western side. As to "tasteless and insulting," a matter of personal perspective. I find it helpful to call a spade a spade, and others apparently do as well. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

RRE: Lexis-Nexis personal information database
by E. Allen Smith 17 Dec '03

17 Dec '03

One wonders exactly how much of this information is compiled from government-generated sources? The SSN is automatically originally government-derived, of course... -Allen From: IN%"rre(a)weber.ucsd.edu" 7-SEP-1996 02:02:07.36 [Excerpt from Privacy Forum 5.17.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Tue, 3 Sep 96 12:01 PDT From: privacy(a)vortex.com (PRIVACY Forum) Subject: PRIVACY Forum Digest V05 #17 PRIVACY Forum Digest Tuesday, 3 September 1996 Volume 05 : Issue 17 ----------------------------------------------------------------------------- Date: Tue, 3 Sep 1996 11:22:15 -0400 (EDT) From: Larry Hunter <hunter(a)intr.net> Subject: Lexis-Nexis personal information database Lexis-Nexis sells a commercial database called "Ptrax" which holds detailed personal information on nearly all Americans (L-N claims it contains 300 million names). This database includes name, current address, up to two previous addresses, phone number, birth-date, social security number, mother's maiden name and possible other personal information. This database is kept quite current. Through the Nexis Express service, this information could be available to any individual with a credit card. As most readers will are aware, such information could easily be used for theft of identity and other frauds. It is possible to have one's name removed from this database by making a telephone request. Call (800)543-6862, select option 4 ("all other questions") and tell the representative answering that you wish to remove your name from the Ptrax database. You may also send a fax to (513)865-7360, or physical mail to LEXIS-NEXIS / P.O. Box 933 / Dayton, Ohio 45401-0933. Sending physical mail to confirm your name has been removed is always a good idea. As word of the existence of this database has spread on the net, Lexis-Nexis has been inundated with calls, and has set up a special set of operators to handle the volume. In addition, Andrew Bleh (rhymes with "Play") is a manager responsible for this product, and is the person to whom complaints about the service could be directed. He can be reached at the above 800 number, selection option 4 and then ask for extension 3385. The information in this note has been been confirmed by me, and was originally provided in forwarded messages from Russell Whitaker, Jason Werner, Vern Winters, Katherine Florman and Reuben Snipper. Larry Hunter hunter(a)intr.net ------------------------------ End of PRIVACY Forum Digest 05.17 ************************

1 0