December 2003 - cypherpunks-legacy

RSA
by amnesia＠chardos.connix.com 17 Dec '03

17 Dec '03

Timmy C. Mayflower was born when his mother was on the toilet.

1 0

SUN_syn
by John Young 17 Dec '03

17 Dec '03

CIAC Bulletin H-02 issues Sun's thumb-busting god-dam-its for SYN flooding: ============================================================================= SUN MICROSYSTEMS SECURITY BULLETIN: #00136, 9 Oct 1996 ============================================================================= BULLETIN TOPICS In this bulletin Sun discusses the TCP-based "SYN flood" denial- of-service attack. We suggest ways to tune most Solaris/SunOS systems to make them more resistant, and explain which releases and configurations stand up best. We also discuss which customers are most likely to be affected, and the degree to which firewalls and similar insulating arrangements can protect an enterprise from this attack. This Bulletin also describes the patches and other changes Sun commits to making in the future in response to the emergence of such attacks. This denial-of-service attack, which affects all operating systems which implement the TCP protocol, has previously been discussed in CERT(sm) Advisory CA-96.21, issued on 19 September 96. Attacks against several prominent service providers have been well documented in the last several weeks in Time magazine, the Wall Street Journal, and many other national and international periodicals. I. What has Happened, Who is Affected, What to Do II. Understanding the Vulnerability III. Technical Recommendations IV. Plans and Schedules APPENDICES A. Queuing Capacity Vs. Attack Rates B. How to obtain Sun security patches C. How to report or inquire about Sun security problems D. How to obtain Sun security bulletins or short status updates ----- http://jya.com/sunsyn.txt (48 kb) ftp://jya.com/pub/incoming/sunsyn.txt SUN_syn

1 0

[POINTERS] On Vulis' net background
by Douglas B. Renner 17 Dec '03

17 Dec '03

Some *very* informative background data may be found at: http://www.math.harvard.edu/~verbit/scs/cranks/from-Schlomo.html#vulis Of course the title KOTM may also have been fraudulently obtained (if USENET vote forgery bears any relevance...) see: "Fraudulent votes from bwalk.dm.com cited" in (are we surprised?) news.admin.net-abuse.misc Here's a pointer to one archive: http://www2.altavista.digital.com/cgi-bin/news?msg@3945@misc%2enews%2einter… Doug

3 4

mail software for multiple addrs
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

hi everyone. I'm asking this here because I know that cpunks spend a lot of time in email. I'm looking for some GUI software that can deal well with 1. multiple internet providers - i.e., if I have multiple providers, I would like the software to be able to easily deal with them all, without having to retype IP addresses etc. into dialog boxes 2. multiple email accounts - i.e. the mail software is not going to use merely one POP account, but should be able to have different email addrs and passwords over POP 3. multiple mailing lists - I'd like a way to sort incoming mail into separate folders/directories based on header fields, and a way to automate this. (i.e. not have to go through the same procedure each time of typing the fields etc.) I am aware of Netscape's mail features, which don't really handle much of the above. also, I suspect many people require some combination of the above, so there is probably software out there to do it.. at least there is a demand. also, I'm aware of procmail but would prefer something that supports a GUI interface. also, if you know of a better place to post this query, please tell me. thanks much;

2 1

More threats from FOTM (Friends of Timmy May)
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I'm receiving more harrassing e-mail from the asshole who threatened to sue me for libeling Timmy May (fart). Since this asshole has never been heard from before, I suspect it's just another of Timmy May's tentacles. Anyway, if you want a videotape, I'll put one together. If not, I won't. >Date: Tue, 15 Oct 1996 20:36:36 -0500 >From: "Douglas B. Renner" <dougr(a)skypoint-gw.globelle.com> >Subject: Re: Threats from FOTM (Friends of Timmy May) >To: "Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> >In-Reply-To: <Vi7TVD1w165w(a)bwalk.dm.com> >Message-Id: <Pine.3.89.9610152025.C3275-0100000(a)skypoint-gw.globelle.com> >Mime-Version: 1.0 >Content-Type: TEXT/PLAIN; charset=US-ASCII > > >> I've been receiving multiples copies of threats of frivolous lawsuits in >> connection with Sandy Sanford's kind offer to address the San Francisco > >Well then obviously your hands are tied then, aren't they? That was easy.

3 3

Re: Killing Mr. Wallace of "Savetrees"?
by azur＠netcom.com 17 Dec '03

17 Dec '03

> Tim May wrote: >I'm not a lawyer, but this is getting real close to the line. I doubt many >DAs would take it seriously, but I rather expect Mr. Wallace of >savetrees.com might discover this message and draw the reasonable inference >that his life is being threatened. Do you think this approach might stop the SPAM? PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

1 0

Comments on binding cryptography (1)
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

Apologies for not reacting earlier; I have been away for six days. I found many reactions to the posting on binding cryptograhpy in my mail box, which I have read with interest. Here are my comments, excuse me if they are lengthy. First and foremost, I want to stress that the proposal primarily addresses the issue of providing information security. It does not want to solve the problem of criminals using encryption. I hope the following analogy may clear this (but please don't stretch the analogy too far). The government wants to offer citizens good transport, so they make public roads. Because some citizens endanger others through drunk driving, the government makes the rule that if you want to drive a car, you must be sober. If you want to drive on the public road, fine, don't drink. If you want to drink, fine, take a bike or cab or use public transport. Now, the binding cryptography proposal wants to provide law-abiding citizens with good crypto. (I'm currently not using any, because I don't have an easy to use and reliable system.) A government may establish an infrastructure for good crypto (like the public roads), with the requirement that you keep to the "binding" rule (like "don't drive drunk"). If you don't want to use the binding cryptography, fine, use another system (take a bike or cab). The system will not prevent criminals from using cryptography - it isn't meant to. Yes, criminals can use superencryption or other (mutually agreed upon) ways to use the system and yet be out of law-enforcement's reach, but they might as well use PGP in the first place. I do not want to see PGP outlawed, and I do not want to have PGP use be regarded as suspicious (just as I don't think it is suspicious if you take a cab late at night). Setting up a good information security structure can very well be compatible with having other means of information security. You ask why should the government offer good crypto, when it's already available? I think that cypherpunks are not average - they know about crypto and they can use it. The majority of the citizens, however, do not use crypto, because they don't understand it and because there's no easy-to-use and reliable standard. If the government were to offer this, it would make a difference to many people. Then, you say, it affects my privacy. As far as I see it, it does not. The binding cryptography system allows regular monitoring for compliance (like road police checking whether people are sober). It does not involve reading of messages. The only time messages are read is when law-enforcement agencies (LEAs) have a warrant and ask a TRP to hand over a session key. This is not fundamentally different from the present situation, where LEAs can wiretap with a warrant. Privacy will be protected more or less to the same extent as presently. If you don't agree with governments having the possibility of intercepting communications anyway, OK, that's your opinion. I have another opinion, and we needn't discuss further - this is not the issue. Then, if you say you don't trust your government, OK, I can see a point. Generally, I notice a difference between US and Europe in our views on the role of governments. That is legitimate, and something for each to discuss domestically. (Yes, Alex, IRT-gate is a good point, but at least it has led to a critical investigation by parliament and a more critical attitude with our judges in judging investigation methods.) (And Allen, if binding cryptography helps totalitarian governments in arbitrarily monitoring all communications, I oppose this. China uses video cameras in Lhasa to monitor potential demonstrations of Tibetans. I oppose this, and I blame the Chinese government for it, not the inventor of video cameras.) I feel at least that allowing TRPs to decrypt single communications if the LEA has a court warrant is better protection than escrowing my private key with the government. Also, choosing your own TRP allows you better protection than having to use a government-chosen one. On the other hand, I think there should be some regulation on TRPs, if only to address liability issues. I think a government certification of TRPs would not be a bad thing, if this is done in an open, flexible and preferably independent way - for instance a semi-govenmental "TRP approving authority" (the same way we have data protection authorities who monitor compliance with data protection legislation). Again, we may have different opinions on this given the difference between US and Europe. Someone pointed out that a TRP could be corrupted and collaborate with the law-enforcement agencies. Then, all sessions would be read by the LEA. Indeed, this is a threat to be taken into account. At least the binding alternative is better protection against collaborating TRPs than key-escrow, as at least it leaves communications from before the corruption unharmed. Moreover, the system allow easy change of TRP, so the moment you notice something weird about this TRP, you choose another one. It's really a matter of trust. Finally, I get the impression that some cypherpunks feel the law-enforcement problem to be a problem of "them" as opposed to us. I - and this is my personal opinion - feel it is "my" problem as well. I live in a society with which I am generally satisfied, not the least because we have a rule of law. Tracing criminals is my concern as well. I am not happy that, in some ways, I have to give up some freedom, but I think it is worth while. I would not mind using a government-offered crypto system that uses binding cryptography. All I want is that it is a good system and I want to be sure I trust my TRP. I would prefer it if no such system were needed, but if it helps in protecting me from criminals, I can live with it. Bert-Jaap --------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 466 8101 Center for Law, Administration and facs +31 13 466 8149 Informatization, Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------------------- Postbus 90153 | This world's just mad enough to have been made | 5000 LE Tilburg | by the Being his beings into being prayed. | The Netherlands | (Howard Nemerov) | --------------------------------------------------------------------- http://cwis.kub.nl/~frw/people/koops/bertjaap.htm ---------------------------------------------------------------------

2 1

Your Papers Please!!! (fwd)
by Lucky Green 17 Dec '03

17 Dec '03

[Hmm, why the hell does pine add the .sig at the beginning of the message?] -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President. ---------- Forwarded message ---------- Date: 15 Oct 1996 07:57:21 -0700 From: Johann Opitz <Johann_Opitz(a)smtp.svl.trw.com> To: ca-firearms(a)lists.best.com Subject: Your Papers Please!!! WASHINGTON (Reuters) - The Supreme Court Monday (10-7-96) let stand a precedent-setting ruling that states may establish roadblocks for the chief purpose of intercepting illegal drugs. [...] The case arose out of roadblocks Florida law enforcement officials set up on four state highways near the Georgia border in January 1984. [...] About 2,100 vehicles passed through the roadblocks, of which approximately 1,300 were stopped. In all, one person was arrested for the possession of illegal drugs while 61 traffic-related citations were also issued. [...] A federal judge dismissed the lawsuit and a U.S. Court of Appeals in Atlanta agreed. It said the chief purpose of the operation was to intercept drugs, but ruled the state does have the power to conduct roadblocks to check drivers' licenses and vehicle registrations. [...] The attorneys for the motorists urged the Supreme Court to hear the case, saying law enforcement officials around the country were likely to adopt similar temporary, unannounced roadblocks for drugs. But the high court sided with the state of Florida, denying the appeal without any comment or dissent. ======================== Speaking of roadblocks >>>> [ The police officer who wrote the following shows what we have to look forward to. I guess the Supreme Court has decided it is OK to violate our rights just as long as we are all _equally_ violated. -- lk ] Posted to texas-gun-owners by Joe Horn <6mysmesa(a)1eagle1.com> ------------------------------------------------------------------------ Speaking of roadblocks, Saturday, the New Mexico State Police had one set up on NM#404, (14 officers and one Sgt.) stopping all traffic both ways on a desert mountain pass between El Paso and White Sands. When I was stopped, a courteous automaton approached, hand on pistol and asked for my DL and insurance card, and did a visual search of my car. Immediately angered and resentful of this State intrusion and violation of my rights, I handed him the requested documents, and having checked my paperwork, he looks through the window at the back seat area and asks me "what's under the blanket?" I told him his search was going to have to be limited to what he could see as I was not granting a consent search beyond what he could see through the windows of my vehicle after illegally stopping me at this roadblock. Illegal? Pull over there and talk to the nice officers, says he. Yes I said, stopping people for searches in the pretext of seeing their paperwork. Says he: the court said it's OK (in limited roadblocks )as long as we stop everyone. Says I, the court is wrong and it's still unconstitutional, you do not have a warrant and I have broken no law. To me, the fact they did NOT ask for vehicle registration indicated they were fishing. The robot calls his Sgt. over, who takes over and warns me that this can become very unpleasant, and at this point, I show him my retired badge and ID, asking how unpleasant is that? He then says, why didn't you say something, you coulda been gone by now? I told him that I am a plain citizen and suggest he knows what he's doing is wrong and that it's a pure fishing expedition. He angrily said:(and he really surprised me) "Hey, I'm just doing what I'm told, now get outta here before I decide to ruin your day". They cut me loose and drove off, keeping my Ithaca 37 which was under the blanket and 1911A1 under the center console. My point is that this is out of control, and folks are going to start getting hurt in these little European-like (where are your papers?) roadblocks, fishing for whatever they can find. If I didn't have masterbadge and I.D., I would have been illegally and unconstitutionally searched against my will. Very few people have a badge to get them out of something like this, and deferring to intimidation by armed authority, most will have their rights violated. My sense of the roadblock personnel was that excepting the Sgt., they didn't know they were wrong or didn't care. The average age of the officers was late 20's early 30's. Now that they're going to start these around schools, and I assure you that it will be in as high handed a manner as they can manage. Many people don't see or don't want to see what's happening to the Constitution or our human rights recognized by that Constitution, or the Police State being assembled right around the Constitution, in the name of the "drug war" or the "chirrun". It's here and it's here now and if you don't strenuously object to these searches and roadblocks whether for DUI, Drivers License/Insurance/ guns/drugs, and drive your political reps nuts about it, sooner or later you will get the anal probe of an illegal search in the name of the "drug war" or for guns near schools. Of course those that like and feel safer with more unenforceable, useless law and more intrusion (with no effect on criminals, just the violation of honest citizens rights) may you be hoisted on your own petard, and soon. As I waited in line to be searched in this desolate and remote desert location, I reflected on my extensive police and military training and experience and thought that these roadblocks are really quite vulnerable out there in the desert so far from backup. Quite vulnerable......It's going to get ugly one day when folks decide they've had enough. And if statists don't think it can happen here, just visualize a larger scale resentment of the "man" beyond Watts. Like the black minority, the white minority within the white majority has it's limits in absorbing the abuses and effects of the ever intrusive Police State. What really bothered me, (in spite of my training and familiarity with police operations) was my own barely repressible reaction of fear, being trapped, resentment, mistrust, disrespect and intense dislike and the powerful urge to immediately, actively and physically resist this infringement of my right of unrestricted and peaceful travel. Fortunately, I didn't have to act because unlike most of my fellow citizens, I had a retired peace officer's badge. What about those that feel like that and do not have a get-outta jail/roadblock exit badge? I guess we'll soon find out when some get stopped and fight rather than have their rights violated. It's no longer a matter of if this is going to happen, just when. regards Joe Horn List retired cop and no longer proud of it. ======================== The War on Drugs is so wonderful -- I know that it is only a few more years before the "swastika" or the "hammer & sickle" will be flying from the government's flag poles from the East Coast to the West Coast. And in the name of saving all the children from the gun crimes - we'll all have been so disarmed by the War on Guns, which was born out of the War on Drugs, that we won't be able to stop the tyrants. But to use the words of socialists, of social engineers -- "it's for the better good of the community, the state, the nation, the people". Yes, being the good socialists and social engineers that the Drug Warriors are, the better good of the collective always takes precedence over individual rights, over freedom and liberty. I truly wish Hayek was wrong -- but if wishes were horses, beggers would ride. -Johann A Classical Liberal == Johann Opitz (w) johann_opitz(a)smtp.svl.trw.com == (h) johannp(a)aimnet.com == All Disclaimers Apply (to protect my employer) ==

1 0

Re: Crypto: Systems & Application Developers Wanted
by Greg Broiles 17 Dec '03

17 Dec '03

At 07:11 PM 10/15/96 -0400, Mark Aldrich wrote: >On Sat, 12 Oct 1996, SPYRUS wrote: > >> SPYRUS, the leading provider of cryptographic tokens (PC cards & >> Smart Cards), with associated systems and applications software, is >> looking for engineers with the following qualifications to work >> with >> our Secure Applications Group in San Jose, CA: >Uh, excuse me, but doesn't SPYRUS in fact market a Fortezza card? The >very same card being used by the Evil Empire to spread diseased and impure >so-called "cryptography" (with GAK permanently embedded into it) to the >uninformed minions? Uninformed? It's right in their name: SPY-R-US. Just don't tell Toys 'R Us, they've been on a trademark litigation jag lately. (but it might save everyone some time if they added "Not concerned about the long-term effect your work has on the quality of human life & freedom" to the list of qualifications required.) -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

Japan imposing crypto export restrictions!
by nobody＠replay.com 17 Dec '03

17 Dec '03

Another Cypherpunks exclusive! Bowing to US pressure, the Japanese Ministry of International Trade and Industry (MITI) has quietly made changes to Japanese crypto export regulations. In the past, export of crypto products from Japan was unregulated. The exporter had to file a pro-forma export declaration with MITI. The new regulations, imposed in recent weeks without public announcement, require the exporter to state the ultimate recipient of the crypto product. MITI then conducts a lengthy approval process that can take many weeks. It is widely assumed that the US used the thread of trade sanctions to bring about this 180 degree turn in the attitude of the Japanese government. The new regulations apply to exports from Japan to all countries, including the US. --anon

3 2