December 2003 - cypherpunks-legacy

Security problems in recent list spam
by Lou Poppler 17 Dec '03

17 Dec '03

I was irritated enough by a recent Commercial spam to the list, (a message from Sue) that I researched the web pages it points us to. I note 2 very interesting features in the order form page (www.steppingstones.com/ordercab.htm) This form collects various info, and returns a POST request invoking ACTION="/cgi-bin/mailto.exe" It appears that these folks leave themselves open to some abuse, from anyone creative enough to modify the form slightly! Also, in the ObSnakeOil department, the form contains this claim: > You are ordering via a secure server which scrambles your credit card > information to prevent it from being intercepted. If, however, you are > still not comfortable sending your credit card number on line, please > fill out the above order form without any payment information and either > call us toll free at 1-800-585-1118 (outside the US, call (203) 730-2220) ... Now, it appears that this form returns a non-encrypted POST request to their server, and furthermore the action taken by the server is to email all the data to the ultimate business recipient. Thus the credit card info would be sent through the net TWICE as plaintext.

1 0

The Advent of Netwar
by John Young 17 Dec '03

17 Dec '03

A RAND publication relates to the administration's focus on borderless crime and/or dissent as national security threats: The Advent of Netwar. J. Arquilla, D.F. Ronfeldt 118 pp, 1996. $15.00 ISBN: 0833024140 Key concepts: Cybernetics -- Military aspects; Electronic intelligence; Military art and science -- Technological innovations; Communications, Military -- Technological aspects; Electronic countermeasures Abstract: The information revolution is leading to the rise of network forms of organization, with unusual implications for how societies are organized and conflicts are conducted. "Netwar" is an emerging consequence. The term refers to societal conflict and crime, short of war, in which the protagonists are organized more as sprawling "leaderless" networks than as tight-knit hierarchies. Many terrorists, criminals, fundamentalists, and ethno-nationalists are developing netwar capabilities. A new generation of revolutionaries and militant radicals is also emerging, with new doctrines, strategies, and technologies that support their reliance on network forms of organization. Netwar may be the dominant mode of societal conflict in the 21st century. These conclusions are implied by the evolution of societies, according to a framework presented in this RAND study. The emergence of netwar raises the need to rethink strategy and doctrine to conduct counternetwar. Traditional notions of war and low-intensity conflict as a sequential process based on massing, maneuvering, and fighting will likely prove inadequate to cope with nonlinear, swarm-like, information-age conflicts in which societal and military elements are closely intermingled. ----- There is a summary of this document and ordering info at: http://www.rand.org/publications/MR/MR789.html

2 1

Secure Erase for PCs?
by foodie＠netcom.com 17 Dec '03

17 Dec '03

Hi all - I know this has been discussed multiple times, but archive searching has turned up nothing. What freely available tools are there for securely erasing a disk under DOS and Windows? Ideally I'd like a tool for each, but pointers to either are much appreciated. Thanks, -j

2 1

[ANNOUNCEMENT] Secure envelopes
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Here, Timmy Mayflower descends into total inanity. He should have a cold shower and/or a Turkish coffee. |\ \ \ \ \ \ \ \ __ | \ \ \ \ \ \ \ \ | O~-_ Timmy Mayflower | >----|-|-|-|-|-|-|--| __/ | / / / / / / / / |__\ |/ / / / / / / /

2 1

Re: The Science Generations
by Dale Thorn 17 Dec '03

17 Dec '03

Ryan Russell/SYBASE wrote: > If I may offer another opinion... > I ran a BBS for about three years straight off > of floppies on an Apple ][+, without any > hardware failures or disk problems. [snip] I can't argue against someone else's personal experience, but, if you are asking me to believe that the rather cheaply made Apple II would perform nearly as long and reliably as an HP-86/87 (for example), when making hundreds of thousands (millions?) of accesses to floppies over a period of weeks or months, without a disk drive tuneup or alignment, then I must be living in the wrong reality, i.e., everything performs the same, regardless of its construction design. SHOCK TIME: I'm going to shock you now, by telling you that of all the HP computer gear I have bought, the failure rate of new computers and major peripherals was approximately 40%, within the initial one-year warranty period. Actually, the failure rate within 90 days was well over 30%. When I wrote out the detailed list and sent it to corp. HQ, they must have peed their pants, judging by the reaction I got. Surprised? So how do I justify this? All I really know for sure, besides what I've told you, is when the initial fixes are made, I can run heavy- duty operations for many times longer without interruption than I possibly could with most other brands. Wanna know who the worst offenders are in consumer electronics, not only when it comes to warranty-period failures, but failures soon after, due to shoddy failure-proofing? Sony and Toshiba. I haven't had a lot of Toshiba equipment, but the experiences I've had, and the attitude of the company for not fixing them, are convincing for me (just my opinion). I have had a *lot* of Sony stuff, mostly small (but fairly expensive) items, and their product quality is abysmal, excepting large items such as TVs, or a couple of small "professional" items such as the Walkman D6C cassette recorder (Stereophile's favorite) and their pilot's radios S??-70 and -80.

1 0

RE: FIPS key recovery meeting
by Internaut 17 Dec '03

17 Dec '03

>Members mentioned a few cases where an employee was unable to decrypt >his files, but no one knew of a case where an organization was unable to >obtain shared data (e.g., a database), because it was encrypted. Other >members seemed reluctant to accept his distinction. They seem to view key >recovery as a way to audit proper use of organization assets by employees, >or to protect the organization from malicious acts of employees, or to >recover data if a custodian is run over by a bus. pretty funny! think of all the loss of unrecoverable encrypted data from a custodian run over by a bus!

1 0

RE: Secure Erase for PCs?
by John Fricker 17 Dec '03

17 Dec '03

>Mark Rosen (mrosen(a)peganet.com) said something about Re: Secure Erase for PCs? on or about 12/9/96 6:19 PM >> I know this has been discussed multiple times, but >> archive searching has turned up nothing. >> >> What freely available tools are there for securely >> erasing a disk under DOS and Windows? >> >> Ideally I'd like a tool for each, but pointers >> to either are much appreciated. >> >> Thanks, >> > Though, technically, no disk can be securely erased, my program, Sure it can. Ten overwrites will rendered remnant data obscure. So says the electron microscope waving data recovery experts anyway. > Very Good Privacy, can securely delete files after they have been encrypted. Thought you said "no disk...". So how does VGP do it? --j ----------------------------------- | John Fricker (jfricker(a)vertexgroup.com) | -random notes- | My PGP public key is available by sending me mail with subject "send pgp key". | www.Program.com is a good programmer web site. -----------------------------------

2 1

[URGENT] Forgery detection
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

The only `culture' Timmy May possesses is that cultivated from his foreskin scrapings. ,,, -ooO(o o)Ooo- Timmy May v

1 0

Diffie-Hellman Mayonnaise
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Tim Mayonnaise is just a poor excuse for an unschooled, retarded thug. ___ <*,*> Tim Mayonnaise [`-'] ' - '

1 0

Review of the EPP plug-in 0.2 for Eudora
by Alan Olsen 17 Dec '03

17 Dec '03

[Note: this is CCed to the developer for two reasons. First, I wanted him to know of the review. Second, I have another two bugs at the bottom that I have not reported.] I have been putting the Eudora PGP plug-in through its paces. My findings have been interesting... The instalation was quick and painless. All of the defaults were pulled from the mail information upon first running the Eudora after installing. It provides some basic functions for using PGP. The functions provided are: -- Clearsign Message -- Decrypt Message -- Encrypt Message -- Verify Signature -- Add Key -- Paste (Insert) Key These appear under the Edit menu in the plug-ins submenu. (It would be nice for these to be in their own seperate menu, but that may be beyond the scope of the plug-in developers kit.) I have not seen any glaring errors (GPFs and the like.) There are some functional problems I have discovered. These should be cleaned up in a future version. (What do you expect for a 0.2 release?) These are the problems/bugs I have found so far: -- If you do not define a default ID in the PGP config.txt, it will take the last ID generated on the secret key ring. (This is a common problem. This is not the only app that has it.) -- The program does not word wrap before sending the message to get signed. This breaks the signature when Eudora word wraps it opon sending the message. (Another common problem. I remember a bunch of apps fixing this one at one time a few months ago...) -- If you decrypt a message, the mail headers are destroyed. (I just discovered this one last night. It makes replying a bit of a challenge...) -- The plug-in does not deal with "personalities". (This is not a bug, but something that would be *REAL* helpful. Now if you could get personalities that connected to nym servers.) All in all, this is a useful plug-in. It has a few rough spots, but that is to be expected. (This is a 0.2 release.) Having this functionality in Eudora makes PGP encrypted lists *MUCH* more usable. (Cut and paste for each message and/or firing up a seperate e-mail app to scan for messages becomes more trouble than it is worth in a real hurry...) BTW, this is the original information as to where to get the plug-in. How much of this is current, i am not certain... (The mailing list was broken according to Lucky Green.) > Eudora/PGP Plug-In > >Download version 0.20 from the Web: > * http://www.prism.gatech.edu/~gt6525c/eppi/epp16_02.zip > (for 16-bit version of Eudora 3.0 for Windows 3.1) > * http://www.prism.gatech.edu/~gt6525c/eppi/epp32_02.zip > (for 32-bit version of Eudora 3.0 for Windows NT/95) > >If you don't have Web access, but have FTP access, try the following sites. >Note that if the version you are trying to get was released today or just a few days ago, it may not have shown up at the sites below yet, so give it a few days: > >papa.indstate.edu: /pub/winsock-l/mail/epp16_02.zip > /pub/winsock-l/Windows95/mail/epp32_02.zip > /pub/winsock-l/WindowsNT/mail/epp32_02.zip > >ftp.winsite.com: /pub/pc/win3/winsock/epp16_02.zip > /pub/pc/win95/winsock/epp32_02.zip > >If you want to be automatically notified of new versions, send e-mail to gt6525c(a)prism.gatech.edu with the subject of "eppi news", and the following message body: > >join >stop > > --- | "Spam is the Devil's toothpaste!" - stuart(a)teleport.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0