December 2003 - cypherpunks-legacy

Re: How to fight GAK by obeying the law
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Fri, 04 Oct 1996 08:02:04 -0500, Mike McNally wrote: >> First thing we definitely need is a way to determine with fairly good >> accuracy, whether a host is in the U.S. >I really don't see how that's possible, given the possibility of me >taking my laptop to Ecuador, dialing into a stateside ISP, and being >issued an IP address in the ISP's domain. In other words, anything >that bases a decision on host location by inference on the domain >will inherently be rooted in the notion that hosts in that domain are >stuck to the ground "nearby". Maybe have the option of identifying host mobility? # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: Can we kill single DES?
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Fri, 4 Oct 1996 09:14:02 -0500 (CDT), Bruce M. wrote: >> A Linux port (Pentium) would be *very* good - lots of Linux people tend to by >> pro-cpunk. Ditto for OS/2. And who knows, if you hyped the business >> aspects enough you might even find IBM or some other large corp willing to >> donate some time on large system. > Maybe Deep Blue gets bored in between its chess matches. :) Or maybe they need something to test that HUGE massively parallel supercomputer they're building for DOE! # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: WINDOWS NT ????
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Fri, 04 Oct 1996 05:41:42 -0700, Bill Stewart wrote: >> is Windows NT secured system ? >Windows NT 3.51 is a real operating system. It is not as secure >as I would like, but it is much better than Windows 3.1, which was >totally insecure. It has some good security techniques, >but I don't know how secure the networking is, and networking >is the big technical insecurity on most machines today. >(Well, bad administration is the biggest insecurity on almost all >machines for almost all time. And physical security is also big.) >Windows 4.x moves the graphics/windowing system into Ring 0, >where the "secure" parts of the kernel are. Bad. >This means graphics bugs can make the kernel insecure or crash. I must say I like the way OS/2's Workplace Shell can crash entirely (doesn't happen here anymore; did with some really crappy video drivers for an old Trident 8900) and you can watch while it restarts it (takes about 10 seconds and didn't bother open apps). NT's shell seems to be a *little* harder to screw up, but when it does it goes bigtime. >I don't trust it, especially because Windows 3.1 crashes all the time >for me, and stupid bugs make Windows 3.1 behave badly for me. >So if they put the window system in the kernel, I don't trust it. You lose speed but gain security and stability - the continual operating sytem tradeoff. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: Can we kill single DES?
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Fri, 4 Oct 1996 06:16:44 -0700 (PDT), Lucky Green wrote: >> >1. Is this a good idea? What will happen if DES becomes perceived >> > as insecure? >> >> That's Declan's department (and other non-clueless journalists - declan is >> just the most visible). If it get's widespread and the target is something >> like Digicash, it'd get picked up by the Crime/Snoozeweek crowd. >Sorry, not a chance. The symmetric cipher used in Ecash is 3DES. Since >DigiCash has the good fortune to be located in The Netherlands, full >strength crypto can be (and is) used in all their products. I guess that was kind of ambigous. What I meant was any protocal/system where money is changing hands protected only by DES. That's what I meant by "like digicash". I don't even know if such a beast exists, but was suggesting that anything involving weakly protected money would be a good target because it highlights the vulnerability and would get media attention. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: Can we kill single DES?
by ratak 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: shamrock(a)netcom.com, cypherpunks(a)toad.com Date: Sat Oct 05 10:00:15 1996 > Sorry, not a chance. The symmetric cipher used in Ecash is 3DES. Since > DigiCash has the good fortune to be located in The Netherlands, full > strength crypto can be (and is) used in all their products. > > I would advise any company suffering from a loss of competitiveness due > to > US export regulations to do the logical thing and move their operation > to a more suitable location. > > --Lucky > > And which Countries would that be? I haven't seen list of what Crypto is allowed in which countries... Does anyone know for sure... And companies will be hurt by this whole situation, and I can imagine the crap that will sneak into Firewall-1's code when Sun brings it up to GAK standards.... ___________________________________________________________________ GarGoyle Securities - -Intrusion Assessment Systems - -Security Consultation/Education/Curriculum Development - -Project Management/Research/Analysis World Wide... - -Member of CITDC (Canadian International Trade Development Council) - -Email 1: <ratak(a)escape.ca> Jason E.J. Manaigre - -Email 2: <ratak(a)GargSec.mb.ca> - -Email for PGP key with phrase 'Get Public Key' as Subject - -2048 PGPKey iD E2 FA 30 E5 F5 AD EC F3 00 9A 9D 33 59 FC DF AD ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMlZ4BvqtmO8M92GRAQFRDwgA1zWSKNo9wNLI7AMguNWWC/QzDkRKJpx6 a2qZZ/AwbKCh1xClg0ZOVO0PlpRm4uH7A/fJEjh+Yp+S3YkYSge7kdOOwmUhWTYG cJYf580dNWcIBPAUkMEljXRXdVlFpTX9N0ktnvzirNLd4+KtcqU4tuluoH2a9dDq 6SV42v9P3v9P57UqxrSz7GlEoYI4NJtVmArhI486p8D4yhqVBwIGcxWGw48VArzc JT20uLZU8abqYEDR4siRBUKbey95NTuRK8GgnFTK6K5LFKpTsjcRs+Ye4NtR1+xF CzHUelzPB57FXkN8fXkVwwLnFGDF6nHlhdpULytLY70z8coq9sTLpQ== =mAmF -----END PGP SIGNATURE-----

1 0

RE: WINDOWS NT ????
by John Fricker 17 Dec '03

17 Dec '03

>Adamsc (Adamsc(a)io-online.com) said something about Re: WINDOWS NT ???? on or about 10/5/96 1:00 AM > >Microsoft claims C2 or higher for NT and deserves any ragging they get if >it's not. Ditto for any other vendor who claims one thing and sells >another. You ought to read about C2. DIdn't Steve Martin say something like "criticize things you don't know about". >BTW: Bizarre NT Quirk #15413 - The Administrator account does not have >access to the entire disk. You got it - if you're the administrator you >still cannot look into certain directories belonging to another user - even >if you've given all access privileges to the Admin account. Got a few >chuckles at work. > It's not rocket science to defeat this. The administrator is prevented from casually peering into user owned directories but any administrator worth a nickle can tap tap click and have access to any directory.

1 0

Re: Who the heck is "CYBERPROMO" and why are they spamming me?
by travel23＠juno.com 17 Dec '03

17 Dec '03

Ernest Hua wrote: > >I keep getting mail from an "abusebot(a)savetrees.com" ... > >This is getting very very annoying. They're a company involved in mass emailing ads on behalf of their clients. They have also sued AOL because of the latter's trying to protect their subscribers by blocking Cyberpromo's ads. Cyberpromo obtained a TRO stopping AOL's block, but the TRO was set aside on appeal. Dale Thorn posted the following on this list in response to ads he was receiving from Cyberpromo, specifically: > If you would like to send a complaint about any account @cyberpromo.com > @answerme.com or @omni.cyberpromo.com that has not been terminated, >please send email to: wallace(a)cyberpromo.com I believe Cyberpromo is run by Sanford Wallace. Think he was also on 60 Minutes raising First Amendment rights along with Free Enterprise concepts. So, is it a spam or someone legitimately using the net in the ordinary course of business? T.T. ................................................................................. Just consider me an acorn who is trying to deal with the rest of the nuts .................................................................................

1 0

Re: Who the heck is "CYBERPROMO" and why are they spamming me?
by ! Drive 17 Dec '03

17 Dec '03

Here's a note I got when trying to reply to some JUNK mail I got... Version 9-30-96: Cyber Promotions has started to implement stricter Terms of Service policies WITH TEETH. We have just recently terminated several accounts for abuse of our policies. (Updated TOS at end of message). The following email accounts have been *recently TERMINATED... *changes(a)answerme.com 9-30-96: Unsolicited ads to INTERNET addresses *changes(a)cyberpromo.com 9-30-96: Unsolicited ads to INTERNET addresses *changes(a)savetrees.com 9-30-96: Unsolicited ads to INTERNET addresses *catalog(a)savetrees.com 9-30-96: Unsolicited ads to INTERNET addresses *catalog(a)cyberpromo.com 9-30-96: Unsolicited ads to INTERNET addresses *catalog(a)answerme.com 9-30-96: Unsolicited ads to INTERNET addresses *eleven(a)answerme.com 9-28-96: Forgeries *eleven(a)savetrees.com 9-28-96: Forgeries *eleven(a)answerme.com 9-28-96: Forgeries *tsahk(a)cyberpromo.com 9-27-96: Unsolicited ads to INTERNET addresses *tsahk(a)answerme.com 9-27-96: Unsolicited ads to INTERNET addresses *icssender(a)omni.cyberpromo.com 9-19-96: FORGED unsolicited email, making it appear that Cyberpromo's auto-sender was responsible. If you are in receipt of the message, please look through the headers and complain to the appropriate postmasters. networkes(a)answerme.com 9-17-96: Ignored remove requests networkes(a)cyberpromo.com 9-17-96: Ignored remove requests networkes(a)savetrees.com 9-17-96: Ignored remove requests reminders(a)answerme.com 9-17-96: Unsolicited ads to INTERNET addresses reminders(a)savetrees.com 9-17-96: Unsolicited ads to INTERNET addresses reminders(a)cyberpromo.com 9-17-96: Unsolicited ads to INTERNET addresses salespromo(a)answerme.com 9-16-96: Unsolicited ads to INTERNET addresses salespromo(a)savetrees.com "" "" "" "" salespromo(a)cyberpromo.com "" "" "" "" promo(a)answerme.com "" "" "" "" promo(a)savetrees.com "" "" "" "" promo(a)cyberpromo.com "" "" "" "" info4free(a)answerme.com "" "" "" "" info4free(a)savetrees.com "" "" "" "" info4free(a)cyberpromo.com "" "" "" "" manda(a)cyberpromo.com 8-28: Massive abuse to INTERNET addresses / FORGERY manda(a)answerme.com 8-28: Massive abuse to INTERNET addresses / FORGERY website(a)cyberpromo.com 8-27: excessive abuse to AOL / removals ignored sevenmil(a)cyberpromo.com 8-27: excessive abuse / all removals ignored sevenmil(a)answerme.com 8-27: "" "" "" "" "" "" vera(a)cyberpromo.com vera(a)answerme.com zol(a)answerme.com website(a)answerme.com allied(a)cyberpromo.com allied(a)answerme.com lists(a)cyberpromo.com lists(a)answerme.com If you have a complaint about an account that was not listed above, please forward it to our President's personal account: wallace(a)cyberpromo.com We currently operate the following servers: answerme.com cyberpromo.com omni.cyberpromo.com gamut.cyberpromo.com We DO NOT operate the following servers: uunet interramp athens.servint cais postman.com powernet pwrsite Cyber Promotions is *not* in business to annoy people. We are in the business of sending (and assisting in sending) commercial (and noncommercial) email to people who are *not* offended by the receipt of these messages. Unfortunately, due to many experiences (many of which were out of our control) we have had some problems accomplishing our goals without upsetting some people. We are truly sorry about that fact, and we plan to "clean up the streets" as best as we can. Some people have been under the impression that all email that appears to come from cyberpromo.com, is from Cyber Promotions. That is not true. Most of the complaints that we have recently received have been in reaction to people who have "autoresponders" and "virtual email addresses" on our system. In that case, their mail would have referenced an account on our system, but originated from a different site. Unfortunately, software like Pegasus enables their mail to appear as if it came from us, driectly. But, their true origination is still evident in the headers. You can determine where it originated if you know how to decode headers. But when doing so, remember that Pegasus, for example, actually logs into *our* sendmail. At this time, the only messages that originate from Cyber Promotions, use our proprietary Cyber Sender 2.1+ protocol which will always be indicated in the organization: header. Due to these "look alikes," it could appear that recipients' remove request were being ignored. WE DO NOT IGNORE REMOVE REQUESTS. We now also maintain a "master" remove list of people who have asked to be removed from all commercial mailing lists. If you have received an email from "Cyber Sender 2.1+", our new proprietary transport agent protocol, then the remove features *do* work properly, now that all of the bugs have been fixed (uppercase and lowercase now match, too). No mail is allowed out of our system, if the recipient's address is in our master remove list. We currently have over 1.1 million email addresses in that file. If you wish to add your address to that master remove list, you can do so in two different ways. 1. You can send an email to remove(a)cyberpromo.com and type "REMOVE ALL" in the subject or message field. Our systems will automatically permanently remove from our system the email address from which you sent your request. 2. You may also send an email to manremove(a)cyberpromo.com and type as many email addresses as you wish in the body of the message, each on its own line, without any comments. The subject line is ignored. That address will also permanently remove the addresses. Please note: we have no control over mail that originates from other sites, that travel through our SMTP (relay-host) servers. We will simply terminate any accounts that we maintain, that is referred to in their abusive mail. ATTENTION PRODIGY MEMBERS: It has come to Cyber Promotions' attention, that some of you are having a major problem removing yourselves from our lists. This can be attributed to the "alias" that your outgoing mail may contain. If you are having problems, please send an email to manremove(a)cyberpromo.com and type both of your email addresses in the body of the message, each on its own line, without any comments. The subject line is ignored. You probably have one address like xazd35r(a)prodigy.com and another address like sanford(a)prodigy.com. ATTENTION PIPELINE MEMBERS: It has come to Cyber Promotions' attention, that some of you are having a major problem removing yourselves from our lists. This can be attributed to the "alias" that your outgoing mail may contain. If you are having problems, please send an email to manremove(a)cyberpromo.com and type your email addresses in the body of the message, each on its own line, without any comments. The subject line is ignored. You should type your email id followed by the following THREE domains. @usa.pipeline.com, @pipeline.com, @nyc.pipeline.com. Even if you feel that your address is definately only one of the three possibilities, you should still remove all three addresses (each on its own line). ATTENTION INTERNET USERS: It has come to Cyber Promotions' attention, that some of you are having a major problem removing yourselves from our lists. This can be attributed to the "alias" that your outgoing mail may contain. If you are having problems, please send an email to manremove(a)cyberpromo.com and type your email addresses in the body of the message, each on its own line, without any comments. The subject line is ignored. If your email address could contain an alias like mail.domain.com or if you may have more that one email address that points to another email address, you should remove them all. If you wish to remove *every* email address in your domain, please contact us, and we will "grep" out every possibility. REVISED TERMS OF SERVICE: (We are also looking into the possibility that we may be forced to adopt the policies of our backbone providers. For the time being, we are emulating their policies as best as we can while matching the needs of our operations.) 1. We do not allow postings to inappropriate newsgroups with reference to your account because such postings result in *MUCH* more negative response than positive. 2. We prohibit the advertising of offensive material (ie. pornography, weapons, etc). 3. You may not use the account to participate in illegal activities. 4. Our TOS strictly prohibits the sending of mass commercial emails to INTERNET addresses, unless expressed permission has been granted to you by the recipient. In addition, you *must* honor all requests for removal from your mailing list in a diligent manner. Our service can be used in conjunction with advertisements that you place with a bulk email company other than your own or us, as long as they follow the same guidelines. 5. Cyber Promotions reserves the right to terminate any account for any reason at any time, without notice. If you would like to send a complaint about any account @cyberpromo.com or @answerme.com or @omni.cyberpromo.com that has not been terminated, please send email to: wallace(a)cyberpromo.com ---------- : From: Ernest Hua <hua(a)chromatic.com> : To: cypherpunks(a)toad.com : Cc: hua(a)chromatic.com : Subject: Who the heck is "CYBERPROMO" and why are they spamming me? : Date: Saturday, October 05, 1996 12:25 AM : : I keep getting mail from an "abusebot(a)savetrees.com" ... : : This is getting very very annoying. : : Ern

1 0

Paths of trust in PGP
by Aviel Rubin 17 Dec '03

17 Dec '03

There is a really cool service being offered on the web. It allows users to trace the paths of trust between two keys in the PGP world. It is worth checking out: http://www.research.att.com/~reiter/PathServer/ This is a good way to find the paths you want in the web of trust. For example, you can type in your key id, and the key id of a new, candidate key, and you will find all of the signature paths from your key to the new key. You'll be surprized at how connected the graph is. Avi

2 1

Re: Paths of trust in PGP
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

On .cypherpunks, <rubin(a)usenix.ORG> writes: >There is a really cool service being offered on the web. It allows >users to trace the paths of trust between two keys in the PGP world. >It is worth checking out: > > http://www.research.att.com/~reiter/PathServer/ ^^^^^^^ Use it and help AT&T bring key escrow to your door. No thanks.

1 0