December 2003 - cypherpunks-legacy

FW: Internet Scam TRUE?
by brianh＠u041.oh.vp.com 17 Dec '03

17 Dec '03

This lexis-nexus is running around again, is this a true statement? Or another hoax going around? I had not seen any comments on this list yet. The person who forward this to me had not provided where this originated from. Thank You b > > > > > > Subject: FW: Internet Scam > > > Date: Thursday, September 26, 1996 > > > > > > FYI > > > > > > More on the Lexis-Nexis connection: > > > > > > Subj: Internet Scam > > > > > > Many of you have probably received a message lately regarding a > > > company called Lexis which is distributing names, social security > > > numbers, etc. to people over the internet for illegal use (i.e. to obtain > > > credit in > > > your name). The message advises you to call a number, give your name and > > > social > > > security number, and they will take you off the list. > > > > > > DON'T DO THIS!! > > > > > > The scam is to have you call and give the info to them. The social > > > security office is advised of this and is investigating the company.

1 0

RE: How to break Netscape's server key encryption - Followup
by Mullen Patrick 17 Dec '03

17 Dec '03

Could someone please repost the code referred to in this posting? I seem to have missed it, and I'm curious to see how it works. Thanks! Patrick _______________________________________________________________________________ From: pgut001(a)cs.auckland.ac.nz on Thu, Sep 26, 1996 9:47 Subject: How to break Netscape's server key encryption - Followup To: cypherpunks(a)toad.com There has been a successful hostile attack on a Netscape server key using the code I posted yesterday. I was contacted earlier today by someone who told me he had in the past obtained Netscape server keys and PGP private keys from Windows NT machines running Microsofts insecure FTP server which allows access to the entire drive (he found some of the PGP keys using archie searches - ouch!). He lives somewhere with nasty anti-hacking laws and definitely doesn't want his identity known, but after some pleading said I could reveal the following: - He used the cracklib dictionary to get the password - The password was found "very quickly" - The password was a female name - He deleted the server key after he'd found the password - He did it merely out of idle curiosity and has no intention of misusing the information. - He definitely doesn't want to be contacted Peter. ------------------ RFC822 Header Follows ------------------ Received: by mail.ndhm.gtegsc.com with SMTP;26 Sep 1996 09:47:35 -0400 Received: from toad.com by delphi.ndhm.gtegsc.com with SMTP; Thu, 26 Sep 1996 13:44:58 GMT Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id CAA12813 for cypherpunks-outgoing; Thu, 26 Sep 1996 02:53:13 -0700 (PDT) Received: from cs20.cs.auckland.ac.nz (root(a)cs20.cs.auckland.ac.nz [130.216.34.10]) by toad.com (8.7.5/8.7.3) with ESMTP id CAA12807 for <cypherpunks(a)toad.com>; Thu, 26 Sep 1996 02:53:09 -0700 (PDT) From: pgut001(a)cs.auckland.ac.nz Received: from cs26.cs.auckland.ac.nz by cs20.cs.auckland.ac.nz (8.7/4.7) id VAA14298; Thu, 26 Sep 1996 21:54:11 +1200 (NZST) Received: by cs26.cs.auckland.ac.nz (relaymail v0.9) id <84373168812186>; Thu, 26 Sep 1996 21:54:48 (NZST) To: cypherpunks(a)toad.com Subject: How to break Netscape's server key encryption - Followup Reply-To: pgut001(a)cs.auckland.ac.nz X-Charge-To: pgut001 X-Authenticated: relaymail v0.9 on cs26.cs.auckland.ac.nz Date: Thu, 26 Sep 1996 21:54:48 (NZST) Message-ID: <84373168812186(a)cs26.cs.auckland.ac.nz> Sender: owner-cypherpunks(a)toad.com Precedence: bulk

1 0

German ICTF stopped blocking xs4all. Radikal back online
by tank 17 Dec '03

17 Dec '03

Hi, On the evening of september 24th ICTF stopped blocking xs4all after we removed the pages. More information about that can be found at http://www.anwalt.de/ictf (although not much). Today we've put the radikal back on xs4all :) For more background information http://www.xs4all.nl/~felipe/germany.html henk (SPG)

1 0

Re: Taking crypto out of the U.S.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:55 AM 9/26/96, Adamsc wrote: >On Wed, 25 Sep 1996 06:26:31 -0500 (EST), Adam Shostack wrote: > >>| >Theres a personal use exemption. Michael Froomkin's web page has a >>| >pointer to it. > >>| What if your laptop gets "stolen"? Or you sell it for a plane ticket home >>| after your wallet gets pinched? > >>You're required to report it to the Feds. RTFU. > >Yeah, but you can't be persecuted. So what happens if Joe-Cryptographer >writes a *great* NSA-stumping crypto program - not for export - and it just >happens to get pinched (The police might even recover it!)? Outside >distribution w/o penalties... This is what judges and juries are for. Interpreting the "spirit of the law." (I feel strange defending the legal system, but in plain English: it ain't this stupid. A defense of "I didn't give secrets to the Koreans, I was just reading these documents outside their embassy, and they blew off the bench and onto their property." won't cut it. Or, at least, I think there's a fair chance a jury would find one guilty of espionage, treason, whatever.) Now I don't think there's any real chance of being prosecuted for having a laptop lost or stolen, regardless of what it contains (unless it was true DOD secret stuff, and then the discipline would be handled internally to one's agency), but don't think for a second that this is a new "loophole" in the export laws! --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Weaknesses in Smart Cards? (Re: FLA_wed)
by tcmay＠got.net 17 Dec '03

17 Dec '03

Thanks, John. I read the full article. I'm skeptical. At 12:08 PM 9/26/96, John Young wrote: > 9-26-96. NYP: > > "Potential Flaw In Cash Card Security Seen. Counterfeiting > a Risk, Say Bellcore Scientists." Markoff. > The Bellcore researchers said that a smart card's > security could be breached by forcing the microchip in > the card to make a calculation error, whether through > sophisticated means like bombarding the card with > radiation or perhaps cruder methods like placing it in > a microwave oven. A mathematical formula they derived > could use this error to extrapolate the secret data that > authenticates the card when it is used. As the researchers note, they haven't actually done this. Having worked on radiation effects on chips, I'm skeptical that this can be done economically. Simple radiation sources won't be penetrating enough (for the high "linear energy transer" (LET) particles needed to deposit enough energy to flip a logic state) and the penetrating stuff (betas and gammas) are low-LET and will only disrupt logic states in very high overall exposures (kilorads). A cyclotron, for example, could get some high-LET particles through the packaging to the chips. Strip-back of the outer packaging is possible, of course. I'd need to know a lot more about the packaging used by VISA and other smartcard makers to know how economical this would be. (Breaking any single card is not necessarily a financial windfall, if the card has a limit, for example. This puts a limit on how much $$$ can be spent on cracking a chip.) Also, there are electrically-erasable PROM (EEPROM) chips which are very difficult to clone, and which would have response properties to radiation which are much different from static RAMs and microprocessors. The "microwave oven" point I won't comment on. Their work on what might be called a kind of "avalanche" algorithm, where a few flaws in operation yield secrets at the output, seems interesting. However, one thing that disturbs me (and their work is not the only example) is the "press release" nature. Especially for _theoretical_ work, rather than actual demonstration! When the cracking of a 40-bit key was done about a year ago (by a couple of Cypherpunks, including the French student), it was a *real* crack, not a press release about a _possible_ attack. Likewise, the Netscape crack by Wagner and Goldberg was a *real* attack. But as the "arms race" for press releases about potential security flaws escalates, it appears people are pre-announcing results, or gussying-up potential flaws in the language of scary press releases. Not a good journalistic trend, in my opinion. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: AP [was: Re: Kiddie porn on the Internet] [NOISE]
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Indeed it may not be practical to try such a program on current >computers. I've had thoughts for some time about an analogy where each >person in a civilization represents a cell in a single brain, and so on, >so perhaps AP is merely a portion of the program for this "brain". As >to what happens when you try to concentrate a disproportionate amount of >the programming task into a few hands, that appears to be the situation >we have now. For an excellent high-level coverage of 'hive' behaviour in man and machine see Kevin Kelly's, "Out of Control: the raise of neo-biological civilization" (also has significant coverage of us cypherpunks), Addison-Wesley, 1994, ISBN 0-201-57793-3. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Voice: 1-702-655-2877 Sacred Cow Meat Co. | Fax: 1-702-658-2673 7075 W. Gowan Road, #2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

1 0

Re: Hallam-Baker demands more repudiations or he'll write!
by jim bell 17 Dec '03

17 Dec '03

At 10:49 AM 9/26/96 -0400, Brian Davis wrote: >On Wed, 25 Sep 1996, Jean-Francois Avon wrote: > >> On 25 Sep 96 at 5:59, Brian Davis wrote: >> >> > I disagree that that will be the response, but you should be willing >> > to allow one group of people to fight fire with fire. >> >> But generally, it has been found a much better solution to fight fire >> with water, and this is why I am not convinced of the ideological >> effectiveness of AP, although I don't doubt it's operationnal >> effectiveness at all. > > >If by "operation effectiveness" you mean some people will be killed, I >agree. I also agree with the fire/water comment (maybe in more ways than >one!); my comment related to my belief that AP-supporters shouldn't >complain about especially draconian measures taken against them by >governments, given their modus operandi. I think you totally missed Jean-Francois' point: Turn your last statement around, and that's how _I_ look at the operation of governments: "Government supporters shouldn't complain about especially draconian measures taken against them by AP, given their modus operandi." I for one would welcome a debate on just such an issue. Remember, to justify the status quo you need to defend not only the comparatively-free governments of a handful of western nations, but in fact each and every government on the face of the earth. Don't think you can just say, "This government is sorta okay," because what I am proposing fixes all the other governments on earth. You can't support the maintenance of an oppressive system most everywhere else, simply because (arguendo) they "sorta" got it right, here. (And I'd argue against that last claim!) Besides, I've long ago given up the idea that the leadership of the US will really, truly attempt to promote freedom around the world. No, they won't. They will continue to support the thugs. The problem they have with overthrowing the thugs is that "what goes around comes around," and they're well aware that they're gonna get kicked off their throne once the precedent is set with a few dozen foreign governments getting replaced. Jim Bell jimbell(a)pacifier.com

1 0

Re: Hallam-Baker demands more repudiations or he'll write!
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 26 Sep 96 at 10:49, Brian Davis wrote: > If by "operation effectiveness" you mean some people will be killed, > I agree. I also agree with the fire/water comment (maybe in more > ways than one!); my comment related to my belief that AP-supporters > shouldn't complain about especially draconian measures taken against > them by governments, given their modus operandi. I don't think that any of them will complain because they understand the nature of it. I think that Jim Bell (forgive me Jim...:) view that there will be only limited retaliation from government is not guaranteed at all. As I said somewhere previously, the whole thing will depend on how the authorities view AP as (non-) attackable. Here is the post I wrote earlier: ------- earlier post ------- jim bell recently wrote: > Local police action against an AP organization would, of course, be > deterred by the prospect of naming anybody who would go after it, > and soliciting donations against them. I don't agree here. It would all be a matter of timing, unless the number of AP servers would be sprouting out faster than police forces would be able to destroy them. You have to realize that if the money is seized, noboby will be willing to make a hit since the odds of being paid are not too good. Just play the game "Command and Conquer" for a while and you'll see. Money is fuel. Don't run off of it! For that reason, I think that any AP server, *at the introduction of the concept* would have to be a covert operation. Servers could come out in public light when their number be large enough to warrant a strike on anybody trying to eliminate them. Same for the publication of the name of the individuals operating the server. To me, this seems obvious. Comments? To go on along that line, I had the idea that a specific piece of software, a bit like Private Idaho, that would chain remailers but that would be specifically designed to handle predictions, would have be designed. (Pardon my ignorance of the net here) The server need not to be a unique address. Actually, the prediction and any accompanying documents could be splitted a la Secure Split, and sent to N differents servers, M (<N) of which would be required to re-assemble the original prediction. This assures that if one gets closed, the other can rebuild the message. If thoses servers were set up on *large* machines servicing tens of thousands of messages a day, preferably located at a busy remailer location, any exchange of information between them to rebuild the prediction at a central location would not be easy to track by any govt. Comments? ----- end of earlier post ----- Jean-Francois Avon, Montreal QC Canada DePompadour, Societe d'Importation Ltee Finest Limoges porcelain and crystal JFA Technologies, R&D consultant physicists and engineers, LabView programming PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891

4 4

Call for Papers: The Economics of Digital Information and Intellectual Property
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text MIME-Version: 1.0 Date: Thu, 26 Sep 1996 00:13:30 -0400 Reply-To: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> Sender: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> From: Alan Lewine <alewine(a)DCEZ.COM> Organization: Representing Myself Subject: Call for Papers: The Economics of Digital Information and Intellectual Property To: CYBERIA-L(a)LISTSERV.AOL.COM John F. Kennedy School of Government Center for Science and International Affairs and Center for Business and Government Harvard Law School Institute for Information Technology Law and Policy Harvard University Library Council on Library Resources Coalition for Networked Information The Economics of Digital Information and Intellectual Property Cambridge, Massachusetts, USA January 23-25, 1997 First Announcement and Call for Papers Harvard University is hosting this symposium to broaden and deepen understanding of emerging economic and business models for global publishing and information access and the attendant transformation of international information markets, institutions, and businesses. The goal is to provide managers in public, private, and nonprofit sectors with a practical framework for developing program strategies and assessing the efficiency and competitiveness of new information markets and institutions. It will address questions such as: --What will be the principal pricing models for information in an advanced global Internet? -- How will pricing models be affected by different technological factors and market environments? -- What will be the relationships between classic production costs, transaction costs, and the economic value of intellectual property? -- How will different pricing practices at lower layers affect the pricing of information? -- What are likely long-term trends and scenarios for different pricing models? What will be the effect of bundling or unbundling of information services? -- How will changing cost structures change the allocation of rights between authors and publishers and other intermediaries? -- How will markets for complementary products and services affect the pricing and use of information? -- What are the policy implications of different pricing models? -- How do these reflect policy values associated with different kinds of information? Background: The rapid growth of the Internet and the World Wide Web is trans- forming the way information is accessed and used in business, education, and the home. New models for distributing, sharing, linking, and enhancing information are appearing, often embodied in software or infrastructure. No change is more dramatic than the shift to user-initiated retrieval for text-based information formerly distributed in the form of physical objects by publisher-initiated manufacturing and delivery. A similar shift may be underway for sound and video. However, the considerable differences in bandwidth and storage requirements between text, images, sound, and video may dictate different cost and pricing models in the near and mid-term. As production and distribution costs decline, transaction costs and the value of intellectual property may assume greater prominence. On the other hand, standards and software may work to substantially reduce transaction costs over the long run. With barriers to entry reduced by technology, information markets may become extremely competitive, reducing margins and possibly lowering the economic value of many forms of intellectual property. The Internet and the World Wide Web are characterized by explosion of information along with an explosion of new tools for navigating information. Competition for attention intensifies as companies extend their marketing, sales, and support functions into the Internet. Useful or entertaining information may have greater value in attracting customer attention in an increasingly competitive marketplace for information. Accordingly, it has been argued that information will be valued less as intellectual property and more in terms of the access it provides to other markets and the value it adds to relationships. As a practical matter, copyright may be overshadowed by the growing use of contracts as a means of both securing value and defining expectations in continuing relationships. Positions in simple distribution chains are likely to erode as a result of disintermediation and intense competition. In particular, reduced production costs and the desire to avoid residual transaction costs may force vendors away from complex pricing models. For example, usage-based pricing may give way to subscription pricing. Such dynamics may lead to new institutional arrangements for managing life-cycle costs of information, especially in small markets where users are also producers. Similarly, as production costs decrease, the costs of information may be assimilated by the underlying infrastructure or assumed by users. This trend may be seen in the pricing of online services and in the massive volunteering of content on the World Wide Web. The Web, including software and servers, enables editorial and navigation functions traditionally performed by publishers and libraries to be performed in increased measure by individual authors and end users. Cost analysis in this environment may hinge on identification and evaluation of critical bottlenecks -- with the understanding that many technological limitations may be short-lived. Congestion may lead to new methods of supplementing point-to-point transmissions, such as caching, mirroring, and satellite broadcast. These new mechanisms may raise intellectual property and interconnection questions that may be addressed both as business and policy issues. Congestion may also hasten the implementation of type of service priority at either the network or server levels. Negotiation over quality and scope of service may become extremely complex, and vendors may be tempted to price to as many dimensions of value as possible. However, simple pricing models may have surprisingly strong appeal, as they have had in the analog environment. Sequential distribution windows for motion pictures illustrate the potential for simple price differentiation in a technologically complex environment. Price differentiation is now playing an increasingly important role in the marketing of software and databases. In fact, there may be public policy arguments for price differentiation, not only for reasons of efficiency but to enable some of level of access for those who cannot afford access under standard terms, just as public libraries have offered access for those who could not afford to buy. ***** The Information Infrastructure Project emphasizes communication and sharing of insight among scholars and practitioners with different skills and backgrounds. Papers should be written in a clear, non-technical manner (technical appendices may be permitted) for a mixed, interdisciplinary audience that will include publishers, librarians, economists, lawyers, and policy- makers. Prospective authors should submit short abstracts for review and comment as soon as possible. Extended abstracts or outlines should be submitted by October 15, 1996, to ensure consideration for the program. Acceptances of abstracts and outlines are conditional pending receipt of a satisfactory draft by December 15, 1996. Papers and supplementary material will be published as a volume in the Project's series with the MIT Press. Copyright assignment is not required, and parallel publication of individual papers in journals is encouraged. Please send paper proposals and requests for subsequent announcements to: iip(a)harvard.edu Or send mail to: Tim Leshan Information Infrastructure Project John F. Kennedy School of Government 79 John F. Kennedy St. Cambridge, MA 02138 617-496-1389 Fax: 617-495-5776 leshan(a)ksgrsch.harvard.edu -- Alan Lewine http://www.dcez.com/~alewine/ "[I]n sex as in other areas of life, beware governmental regulation." --Richard Posner, "Sex and Reason" (1992) --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: LACC: Encryption and Japan
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:46 AM 9/25/96 +0100, T Bruce Tober <octobersdad(a)reporters.net> wrote: >A few months ago I read an article concerning one of the encryption >gurus (other than PZ) setting up a company in Japan to create a new >encryption program as good as or better than PGP which since it was >developed in Japan, wouldn't be subject to ITAR. Jim Bidzos of RSA did a contractual deal with NTT, who have produced a chip with RSA and Triple-DES implemented on it. I'm not sure the details of the deal, but essentially it's a license to use the patented RSA technology. It's not that it's better or worse than PGP; it's hardware implementations of some of the building blocks PGP uses. The real win of PGP was taking the pieces (RSA public key key-distribution and signatures, hashing, and symmetric crypto (DES,Bass-O-Matic,IDEA)), putting them together into one relatively usable package, and distributing it. The Web Of Trust that you build out of the RSA signatures is also a win, since it lets you build non-hierarchical key distribution, which is especially valuable for non-government-approved lefties :-) as well as letting you build hierarchical military-style approval if you want. But that's all applications of the core technologies - NTT is providing the core pieces that you can build that sort of thing out of. The NTT deal means that non-US manufacturers can build crypto-phones, crypto-faxes, crypto-wide-area-network-muxes, etc., without annoying US local ordinances interfering. If they use it widely, and a flood of such products hit the US, ITAR becomes effectively dead, which may help it become really dead. And if they don't, you can at least get somebody in Japan to build a crypto-virtual-private-WAN router so your company's internal international email and phone network will be untappable. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0