December 2003 - cypherpunks-legacy

Re: BoS: Can you trust your ISP ??
by Ben Camp 17 Dec '03

17 Dec '03

Any sort of Certificate authority based protocol is dumb. It's like RSAC charging 500 bucks for rating a web site. Nothing anyone does on the web is important enough to encrypt. Anyway, as far as SSL goes...we've all heard about how proactive Netscape is in preventing key comprimise. Its too late. Ben Camp At 06:49 PM 9/9/96 -0700, Eric Murray wrote: >I~nigo Gonzalez writes: >> >> Hello, >> I'm thinking about how can I get rid off this kind of attack *before* it >> happens. Can you please send me your comments about this? I don't know so >> much about the how SSL works, but I think this is something that can >> happen... > >[classic Man-in-the-Middle attack] > > >What you described is the Man In The Middle attack, often >abbreviated on these lists as MITM. The fact that there's >an abbreviation for it should indicate to you how often >it is discussed. However it's also one of the first >problems (besides the basic encryption) that protocol >designers think of. > >It's been taken care of in SSL3- the server's certificate >must be signed by a CA that the client trusts. Unless >the digital signature can be spoofed, and it probably >can't be, the client can be certain that the server certificate it got >is really from the server that it claims to be from. > >Assuming that RSA still can't be broken, the client can be sure >that the pre-master-key material that it sends to the server >(and which is the basis for the symmetric crypto session keys) >will not be compromised. > > >If you grab a copy of the SSL3 spec (from netscape's web site) >and read the appendicies there's more good stuff about possible >attacks and what's been done to counter them. > > > > >-- >Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm >Principal, LNE Consulting: SSL, crypto applications, Internet security. >PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF > > >

2 1

Re: Test...sorry about this - Reply - Reply
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:07 PM 9/9/96 -0500, you wrote: >I subscribed just once, real name. Yep, the Welcome msg is ReallyTrulyFine[M]. > I reallytrulyread it. High-traffic, though, is relative. In light of >Z.B.'s post , I thought that maybe I , too, had a mail probem. Seriously, >thanks for the info. BTW, if it's too much of a flood, you can read it with a newsreader at nntp.hks.net # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: China joins Singapore, Germany, ....
by jim bell 17 Dec '03

17 Dec '03

At 08:13 AM 9/10/96 -0500, Mike McNally wrote: >Declan McCullagh wrote: >> >> The revised Hatch "child porn" legislation criminalizes even >> *attempting* to download the forbidden data. > >What would it look like, exactly, when they went in to arrest the >AltaVista search engine? "Drop those bits! We've got you delimited!" Jim Bell jimbell(a)pacifier.com

1 0

Re: What is the EFF doing exactly?
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Mon, 9 Sep 1996 10:51:04 -0400, kamml(a)secret.org wrote: >>> Try and pay cash in most Fedex offices. >>I always do and as long as I have exact change I have never been >>hassled. >Fedex will not accept cash in New York City. I have tried to pay cash and >been refused. I have talked to customer service and confirmed that they >will not accept cash in NYC although they will elsewhere. You could try the "Really? Could I borrow a phone book for a minute? I need to get UPS's number." approach. It has been known to work... <g> - "'Anonymity is bad,' says a source who wishes to remain anonymous." - Nuff' said. * Home: Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp * Autoresponder: send email w/subject of "send resume" or "send PGPKEY" * Work: cadams(a)acucobol.com | V.M. (619)515-4894 | (619)689-6579 * Member in good standing of the GNU whirled hors d'oeuvre

1 0

Re: Crypto Num Mum, Hmm
by red 17 Dec '03

17 Dec '03

Are perfect numbers of any use in cryptography? I have yet to come across the usage or application, let alone heard of it, but has there been any proposals? Thanks. -rednax- red_naxela(a)geocites.com "smile and the mirror smiles"

1 0

Re: China joins Singapore, Germany, ....
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:41 AM 9/9/96 -0700, Timothy C. May wrote: >Prison sentences in Germany for those who reveal forbidden information >about "the Holocaust," In a country where you get 10 months for stabbing a famous tennis star in the back, prison isn't much of a penalty. >prison terms (or worse) for dissidents in Burma, >China, and, of course, various other nations and "democratic people's >republics." > >Even here in the United States, connecting to an illegal site may mean >imprisonment. (The charge: trafficking in child pornography, for example.) The percentage of total hits that will end in jail terms or executions is meaninglessly small as a percentage of total hits, though. You must admit that a ban on 100 sites out of all the sites in the world is pretty insignificant. The swamping effects of thousands and soon millions of sites means the governments of the world won't even be able to evaluate a significant percentage even if they want to. And all this *before* we apply any of our technical fixes. DCF

3 3

Re: [WAS xs4all.nl] Terrorists
by Duncan Frissell 17 Dec '03

17 Dec '03

At 05:54 PM 9/9/96 -0700, Timothy C. May wrote: >Given the mounting hysteria about terrorism (by the government, at least), >and given the various laws on the books, I would not be surprised to see >some Web sites prosecuted as "harboring" terrorists terrorist-symps. > >If any of you are not citizens of the U.S., and are here on visas, I would >give this some real serious thought. Of course, maybe deportation is a >blessing in disguise. > Course in 1951 they tried the same thing against Commies with the Smith Act. Even authorized concentration camps for 'em and everything. But it didn't work. We were still up to our asses in Commies even with the Act. They even captured the White House eventually. I don't think the anit-terroism act will be any more effective. DCF

1 0

Re: [WAS xs4all.nl] Terrorists (fwd)
by Stephan Schmidt 17 Dec '03

17 Dec '03

Stephan Schmidt wrote: > > Perhaps my connection is only disrupted accidently, but > I can't access www.xs4all.nl from one account > (the two others still work). > IP tried : 194.109.6.100 > > SPG: What is the 'new' IP ? The numbers are rotating every hour, so i can send you a the ip-number every hour to trace to :) > (I hope you don't think I'm a spy for > the German Government :) spy's are not interrested in ip-numbers i think. > Perhaps this time we have to > proove that it's impossible to > block an IP/Web site, so that all govs > get a clue about who inet works. i think they have already or will be informed by the ICTF in some day's. Look at: http://www.anwalt.de/ictf/_960910d.htm Also note one of the first lines: ACHTUNG: Dieses Dokument (einschließlich aller Anlagen) darf bis zu seiner Vervollständigung und Freigabe weder zitiert, in WWW-Server eingestellt, noch abgedruckt werden. :) Henk ps. stephan, can you forward this to the list. I'm reading this list on a server with mail2news, also as a newsgroup i cant reply to ;(

1 0

FW: RRE: Lexis-Nexis personal information database
by Mullen Patrick 17 Dec '03

17 Dec '03

Okay, here's the story. The below is true, except they do NOT have your mother's maiden name. The have your name, SSN, current addy, two previous addys, and date of birth. They also have aliases, if available. Their main customers are attorneys who use this _online_ service to search for people. They've been in business for 20 years, but this list has only been run for a few months. Their customer base (I assume including all databases, which includes lists of ALL legal actions (traffic tickets??)) is 750,000. Hm. Oh, and the SSN isn't given out, but it can be used to search for someone more easily. So, when you do a query, all you'll get is Name, address, phone number, and date of birth, as well as two previous addresses, for what it's worth. The only thing you get that you wouldn't find out by looking in the White Pages is the DOB, and that you could make up. Another case of mass-hysteria (but, of course, *I'm* no longer on the list... ;-) BTW, they're very nice as you get taken off the computer. LONG time on hold, though... Spyjure _______________________________________________________________________________ From: E. Allen Smith on Tue, Sep 10, 1996 3:14 Subject: RRE: Lexis-Nexis personal information database To: cypherpunks(a)toad.com One wonders exactly how much of this information is compiled from government-generated sources? The SSN is automatically originally government-derived, of course... -Allen From: IN%"rre(a)weber.ucsd.edu" 7-SEP-1996 02:02:07.36 [Excerpt from Privacy Forum 5.17.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Tue, 3 Sep 96 12:01 PDT From: privacy(a)vortex.com (PRIVACY Forum) Subject: PRIVACY Forum Digest V05 #17 PRIVACY Forum Digest Tuesday, 3 September 1996 Volume 05 : Issue 17 ----------------------------------------------------------------------------- Date: Tue, 3 Sep 1996 11:22:15 -0400 (EDT) From: Larry Hunter <hunter(a)intr.net> Subject: Lexis-Nexis personal information database Lexis-Nexis sells a commercial database called "Ptrax" which holds detailed personal information on nearly all Americans (L-N claims it contains 300 million names). This database includes name, current address, up to two previous addresses, phone number, birth-date, social security number, mother's maiden name and possible other personal information. This database is kept quite current. Through the Nexis Express service, this information could be available to any individual with a credit card. As most readers will are aware, such information could easily be used for theft of identity and other frauds. It is possible to have one's name removed from this database by making a telephone request. Call (800)543-6862, select option 4 ("all other questions") and tell the representative answering that you wish to remove your name from the Ptrax database. You may also send a fax to (513)865-7360, or physical mail to LEXIS-NEXIS / P.O. Box 933 / Dayton, Ohio 45401-0933. Sending physical mail to confirm your name has been removed is always a good idea. As word of the existence of this database has spread on the net, Lexis-Nexis has been inundated with calls, and has set up a special set of operators to handle the volume. In addition, Andrew Bleh (rhymes with "Play") is a manager responsible for this product, and is the person to whom complaints about the service could be directed. He can be reached at the above 800 number, selection option 4 and then ask for extension 3385. The information in this note has been been confirmed by me, and was originally provided in forwarded messages from Russell Whitaker, Jason Werner, Vern Winters, Katherine Florman and Reuben Snipper. Larry Hunter hunter(a)intr.net ------------------------------ End of PRIVACY Forum Digest 05.17 ************************ ------------------ RFC822 Header Follows ------------------ Received: by mail.ndhm.gtegsc.com with SMTP;10 Sep 1996 03:14:49 -0400 Received: from toad.com by delphi.ndhm.gtegsc.com with SMTP; Tue, 10 Sep 1996 7:12:48 GMT Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id UAA22945 for cypherpunks-outgoing; Mon, 9 Sep 1996 20:08:38 -0700 (PDT) Received: from OCELOT.RUTGERS.EDU (ocelot.rutgers.edu [128.6.11.33]) by toad.com (8.7.5/8.7.3) with SMTP id UAA22938 for <cypherpunks(a)toad.com>; Mon, 9 Sep 1996 20:08:25 -0700 (PDT) Received: from mbcl.rutgers.edu by mbcl.rutgers.edu (PMDF #12194) id <01I9AIVKYUFO9ULM12(a)mbcl.rutgers.edu>; Mon, 9 Sep 1996 23:03 EDT Date: Mon, 9 Sep 1996 23:03 EDT From: "E. Allen Smith" <EALLENSMITH(a)ocelot.Rutgers.EDU> Subject: RRE: Lexis-Nexis personal information database To: cypherpunks(a)toad.com Message-id: <01I9AIVKYUFO9ULM12(a)mbcl.rutgers.edu> X-Envelope-to: cypherpunks(a)toad.com X-VMS-To: IN%"cypherpunks(a)toad.com" Sender: owner-cypherpunks(a)toad.com Precedence: bulk

1 0

Re: ALPHACIPHER - An unbreakable encryption program.
by roy＠sendai.scytale.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In alt.security, survival(a)aa.net writes: [ attribution scrambled ] >> True, but somehow I have a feeling that Alphacipher is not a one-time >> pad, and thus is breakable. > > This assumption is not true. ALPHACIPHER is, indeed, based upon an OTP. > We've solved all of the problems associated with pad creation, > distribution, packaging and many other concerns that have previously > limited the use of a cipher in this class. Their web page alludes to a OTP-like operation where you have to purchase key "refills". It doesn't say where they store the escrowed copies of the key material. > Visit our net page at http://www.aa.net/cyber-survival-hq for more > information, and read the reply in response to the unfounded attack by > Curtin, posted above. I recommend this page, if only for the great conspiracy theory about automated telephone line scanning. - -- Roy M. Silvernail [ ] roy(a)scytale.com PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMjVcuRvikii9febJAQG1wQP+PPevphnwFiUnhwfHfi9eSLI/lJz++eaw X4Xo6Oa343rpnNoNw0D51aIRZbRmh9QRt1nhNbD3fPvNPjjvzxW58zgAtX5+kxfk b54pBzlVTEYcPBFXatfQuCjhhd95gjaMXYsKAx6rUNt02QFihGWqID48huN9nFOZ 0MlhN5IxIBk= =y4kc -----END PGP SIGNATURE-----

2 1