December 2003 - cypherpunks-legacy

Re: Security technical list
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

You're soaking in it. Ryan ---------- Previous Message ---------- To: cypherpunks cc: From: macgyver @ colphi.edu.ar ("MacGyver") @ smtp Date: 09/06/96 09:12:20 AM Subject: Security technical list [pgp sign clear] Anybody could help me to find a mail list of security,crypto,etc?? Regards

1 0

No Subject
by HipCrime 17 Dec '03

17 Dec '03

Here's a collection of your various threats: > I suspect you may soon be hearing from far worse than I ... > Some punks take their colors seriously. > Congradulations. I had at first thought you were a simple fool. > Now I'm certain you're an idiot. > Sounds to me like every remailer can legally be altered to send a > small message to hipcrime every time it processes any messages. > if anyone's got a T3 handy, you could always take the direct approach. In making these threats, you've mistaken me for someone who cares. Someone who cares what you send to my box. I'm actually, and in fact, homeless in real life. Yes, both an "idiot" and a "simple fool": your compliments in my book. My only equipment is access to friends' computers, and a free dialup that the big-hearted SysOp at V-Site gives me. (By the way, you've been merciless to him). In view of this fact: Do you think that even 1,000,000 messages into my stupid electronic mailbox would matter? Some nights my worries are of a place to sleep, not how many messages will accumulate during my slumber. CypherPunks live so far from real-life, that it's impossible for them to communicate rationally. Never having any danger in their lives, they want to avoid encountering any in "cyberspace". They are trying to craft that new world according to their intellectual guidelines. Trying to make sure real-world annoyances have been removed. This is what HipCrime's real offense was: providing a piece of unexpected (ok,ok "unwanted", if you prefer) stimulus. Only a single one. A tiny-little URL, but sent without warning, anonymously, and pointing to a strange site. Since I've UNSUBSCRIBED from your CypherWimps mailing list, and still receive your messages (two copies, the one you send me, and the one you send the list), my only conclusion is that Email is your only social discourse. Take notice that after this, all future messages from y'all will feel the power of the DELETE button (unread and barely noticed). Think of how easy it is to move around in "cyberspace". Do this math: 1,000,000 messages = 1 new domain + 1 new mailbox. In this argument you win, junk Email is SPAM ... but junk SnailMail is THIN SLICES CUT FROM OUR PRECIOUS FORESTS. -- HTTP://www.HIPCRIME.com

1 0

really undetectable crypto
by jim＠suite.suite.com 17 Dec '03

17 Dec '03

Most everybody on the list is familiar with the technique of hiding encrypted messages in the LSBs of image files. Personally, I would not use such a technique because don't I believe it's really undetectable. I assume, without proof, that the LSBs of images files have statistical properties that are sufficiently different from encrypted data that a clever person could determine whether or not an image file contained an imbedded encrypted message. Fortunately, there are other steganographic techniques that, I believe, are undetectable. The trick is to hide your encrypted bits in other encrypted bits. trick #1) Let's say you want to send a short encrypted message via a communications channel that only allows cleartext messages with optional MD5 message hashes. You can construct cleartext messages, via trial-and-error, such that the first 4 or 8 bits (or more, if you have the time) of the MD5 hash match the first 4 or 8 bits of your encrypted message. You can pre-compute all the required cleartext messages in advance, and then send them one after another. The recipient of the cleartext messages can reconstruct the encrypted message by gathering together the first 4 or 8 bits of each MD5 hash. Since the bits in an MD5 message hash are presumably cryptographically random, there should be no way to tell if some of the bits combine to make an encrypted message. trick #2) Let's say you are allowed to use 40 bit encryption, but nothing stronger. As in trick #1, you can pre-compute plaintext messages such that the first 4 or 8 of the bits in the output of the government-approved 40 bit encrypted data match the first 4 or 8 bits of your hidden encrypted message. trick #n) see above. Any communications channel that allows you to send *any* bits that are cyptographically random can be used to send arbitrary encrypted messages. Jim_Miller(a)suite.com P.S. The pre-computed plaintext messages don't have to be garbage messages. You can probably make an innocent-looking message produce the desired bits by adding extra whitespace or typos.

1 0

Re: Fed appellate judge remarks re anonymity, free speech on the net
by jim bell 17 Dec '03

17 Dec '03

At 05:40 PM 9/12/96 -0700, Greg Broiles wrote: > >The Daily Journal, a LA/SF legal newspaper had an article today (9/12) about >a lunchtime address given by Ninth Circuit Judge Alex Kozinski last Monday >at an Internet Law Symposium in Seattle. > >The article quotes Kozinski as saying "I have a severe problem with >anonymous E-mailers . . . You don't have a right to walk up to somebody's >door and knock with a bag over your head." The article says Kozinski likened >anonymous E-mail to menacing someone. I wish somebody would go up to these guys and point out that since the Internet is, more or less, a huge, worldwide, VOLUNTARY association of people, _we_ don't think these judges have any sort of "right" to regulate its content. Furthermore, it isn't clear that the proper regulators of the Internet shouldn't be an entirely different set of people selected by Internet users, RATHER than the same old government system that's managed to screw up the rest of the world so far. And if you're looking for "menacing," I'd say that describes the government's behavior towards the Internet over the last year or two. >Kozinski also suggested that computer-generated or morphed images of >children involved in sexual acts may not be protected under the Constitution >because of ongoing trauma to the child, Which child? Does he understand what "computer-generated" means? >while computer-generated or morphed images of adults would be protected. What about the "ongoing trauma" to the adults? I smell hypocrisy. >The article says that Kozinski was skeptical that he or other federal judges >necessarily agreed with the 3rd Circuit's ruling in _ACLU v. Reno_ (finding >the CDA unconstitutional). > >Kozinski is considered relatively conservative and relatively libertarian, >as 9th Circuit judges go. Which means that he'll last just a little longer "when the cyber-revolution comes." Jim Bell jimbell(a)pacifier.com

2 1

Re: [Long] A history of Netscape/MSIE problems
by Tom Weinstein 17 Dec '03

17 Dec '03

Hallam-Baker wrote: > > There was a long list of security holes in SSL, PCT plugged a good > number of them and SSL v3 plugged a few. This statement surprises me. It appears to mean that you think PCT has fewer holes than SSL 3.0. If you know of any holes in SSL 3.0, I'd be very interested in hearing about them. -- You should only break rules of style if you can | Tom Weinstein coherently explain what you gain by so doing. | tomw(a)netscape.com

2 1

56 kbps modems
by Asgaard 17 Dec '03

17 Dec '03

>U.S. Robotics and Rockwell International are planning new modems with >speeds up to 56 kbps a second, almost double the speed of the fastest >rate now available. The new devices should be available by the end of >the year, although their top speed initially may be less than 56 kbps. >(Wall Street Journal 12 Sep 96 B11) People who seemed to know used to say that 'the Shannon limit' set an absolute upper limit around 40 kbps. Has Shannon been proven wrong, or what? Asgaard

2 1

260_0it
by jya＠pipeline.com 17 Dec '03

17 Dec '03

9-13-96. WaJo: "Magazine's Recipes For Hackers' Havoc: Warning or Weapon?" Whoever attacked Panix could have found guide in latest issue of 2600. 2600's editor defends the article as a way to point out holes in computer security that need to be fixed. He says similar attacks have occurred before, and that he's not even sure the hacker who attacked Panix used 2600 as a guide, since an on-line publication recently published similar directions. "Internet Censorship in China, Singapore May Affect Law-Abiding Citizens Most" For the underground dissident or hardcore pornography enthusiast, the latest moves in Asia to censor the Internet pose little challenge. The greatest effect will be on normal, law-abiding citizens, experts say. FiTi: "Intelligent machines will take control of our lives" Before long, every vehicle will be fitted with a GPS receiver, making its position known to local area traffic management systems. In the home, a financial and stock control system would automatically order food and groceries when necessary. Intelligent machines might "decide" that it would be more efficient not to order any more food - and shut you out of the house. "It's more or less inevitable. Business and science will drive this to the utmost." ----- http://jya.com/2600it.txt (10 kb for 3) 260_0it

1 0

really (?) undetectable crypto
by peter.allan＠aeat.co.uk 17 Dec '03

17 Dec '03

> Jim_Miller(a)suite.com wrote on CP: > > Most everybody on the list is familiar with the technique of hiding > encrypted messages in the LSBs of image files. Personally, I would not > use such a technique because don't I believe it's really undetectable. I > assume, without proof, that the LSBs of images files have statistical > properties that are sufficiently different from encrypted data that a > clever person could determine whether or not an image file contained an > imbedded encrypted message. > Not to mention 7 out of 8 bits may reveal the image to be a library one your enemy has access to. The changes will betray the stego. Your own scanned snapshots may be safer from this point of view. > Fortunately, there are other steganographic techniques that, I believe, > are undetectable. The trick is to hide your encrypted bits in other > encrypted bits. > > trick #1) Let's say you want to send a short encrypted message via a > communications channel that only allows cleartext messages with optional > MD5 message hashes. You can construct cleartext messages, via > trial-and-error, such that the first 4 or 8 bits (or more, if you have the > time) of the MD5 hash match the first 4 or 8 bits of your encrypted > message. > > Since the bits in an MD5 message hash are presumably cryptographically > random, there should be no way to tell if some of the bits combine to make > an encrypted message. What about Walter making insignificant changes to the cleartext and replacing the hash with the new hash? Because you are using an unkeyed hash (and not a sig) he can do that and foul up the stegomessage (not that he'll yet be sure there is one). > trick #2) Let's say you are allowed to use 40 bit encryption, but nothing > stronger. As in trick #1, you can pre-compute plaintext messages such > that the first 4 or 8 of the bits in the output of the government-approved > 40 bit encrypted data match the first 4 or 8 bits of your hidden encrypted > message. > Walter can still play silly spooks with your stego if he breaks the 40-bit encryption. The cyphertext/plaintext ratio looks like getting really huge too. Your messages must all arrive, and retain the right order. -- Peter Allan peter.allan(a)aeat.co.uk

1 0

Thoughts about Morph Escrow Crimes
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

tcmay(a)got.net (Timothy C. May) wrote: >As the law cannot tell if an image of prurient interest started out as a legal image of Raquel Welch or Jennifer Aniston, or started out as an illegal image of a minor child, morph escrow will force all image possessors and distributors to produce proof that the image started out legal. It is not hard to imagine a future where computer modelling has reached the stage that a real picture is not required. An obvious extension of this is a film with computer generated actors. Now, consider this scenario: 1) The computer generated image is "indistinguishable" from reality. 2) The computer generated image depicts something considered obscene or illegal under present laws (e.g. pedophilia). At some point in the future it would seem possible that the computer generated image will be treated as a real image under the law (and evaluated accordingly) because it is indistinguishable from a real image. Or perhaps we will take the other tack and simply say: What is truth? I'm not quite ready to wash my hands on this issue. James Welcome to MorphSex - Fulfilling your fantasies - Painlessly. Select Gender [M/F/H]: Select Age [2-80]: Options: [Orgasm/Suffocation/Dismemberment/Disembowlment/Ennui]

1 0

Re: PANIX.COM down: denial of service attack
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

> From cypherpunks-errors(a)toad.com Thu Sep 12 18:16:43 1996 > Date: Thu, 12 Sep 1996 09:09:18 -0700 > From: #6 <thevillage(a)void.gov> > X-Mailer: Mozilla 2.01 (Win95; U) > Mime-Version: 1.0 > To: cypherpunks(a)toad.com > Subject: PANIX.COM down: denial of service attack > Content-Type> : > text/plain> ; > charset=us-ascii> > Content-Transfer-Encoding: 7bit > Sender: owner-cypherpunks(a)toad.com > Content-Length: 969 > > WSJ 9/12/96 > > Paraphrasing: > > Panix has been under attack for the last week by someone flooding > their server with bogus "requests for information" [see below] ... > > The attack(s): > > * "Have rendered almost defenseless the small NY company" > * "...began late Friday afternoon ... were still continung yesterday" > * have targeted "computers that control WWW pages, store e-mail, and > still others that link Internet addresses to Panix subscribers." > > "The hacker [sic] has been sending up to 150 requests a second to > Panix's computers, seeking to establish a connection ... the requests, > presumably generated by a malicious computer program, contain fake > Internet addresses, which the computer must sort out before they can > discard them. The computers have choked under the deluge." > > "As to who might be targeting Panix, the firm's Mr. Rosen speculated it ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ It could, of course, also be someone, from a set of several million, that find Mr. Rosen to be such as odious prick that they did it just to drive him out of their misery. Just thinking out loud.. > could be someone upset by the fact that the site hosts, free, the Web > site for Voters Telecommunication Watch...." > -paul

1 0