December 2003 - cypherpunks-legacy

Re: RE: Java DES breaker?
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Wed Dec 11 08:11:13 1996 > A few small bugs in this idea, at least for the masses -- > 1) This would only appeal to people who have unlimited usage > 2) ...and don't care about not having their phone available (I know > they're asleep at the time) > 3) ...and don't have an ISP that will kick them off when a timeout > period expires. AND don't have a phone system that charges for local calls (like for example almost everyone except americans... :( - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html Fingerprint: 33F9B4E9 - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: http://www.rpini.com/crypto/crypto.html iQEVAwUBMq5ekRFhy5sz+bTpAQHLRgf+NQY8XwrB+Fjdto+1bsr8M2vaH9GdNS9R PjjbNitAnXrqnoyeYHq4IyC4zkfr6wYce14McRyp5ePjNrfYO0n0rTFH3XBvpFwx usgDSeYNWrcXPuOB8WrPjHxy7OVv8kgnAp00PHImk+x9E5ppJHfSFUDzYlKProie 8CelWUb/EcKkwTJfMnH+s1S9HRPDwxiE7m2OlID1c/+ZobQr0B7BqbSnK9CIvPst cwpzzoAUjNOiSoOIHuUO7ud/Ie03ohPDF0bF4KiKJaeRUNZjLaK7V7DgpfgWv+Zk V2K14TLQ5gAFcFCDnLKo1qePLmZtu1F0YJcbYkQLBh7dhqQpoPtHrQ== =Xg6k -----END PGP SIGNATURE-----

1 0

black.hole in the net
by mf＠MediaFilter.org 17 Dec '03

17 Dec '03

Call For Projects: ____________________the black.hole in the net is open. ____________________please go to: ____________________http://black.hole. or ____________________http://blackhole.autono.net. for name.space. networks, go directly to ____________________http://project.black.hole. to add your link (name.space. url's only!). and ____________________http://switchboard.black.hole. This project is based on "soft home" or "multi-homing" on web servers with the use of only one ip number. any number of names can be mapped to a single ip number. the server delivers the web page associated with the name that the server answers to, i.e. http://black.hole returns the black.hole page http://switchboard.black.hole returns the black.hole link page http://project.black.hole returns the black.hole link generator page The black.hole is an example of content-routing possible with the name.space naming system. Best regards, Paul Garrin mf(a)mediafilter.org please forward this message. http://name.space. http://namespace.autono.net. for more info on name.space, visit the site, or hear the confrontation over it on hotwired's hotseat (this is not an ad or endorsement for wired!) http://www.packet.com/hotseat (in realaudio)

1 0

Re: Redlining
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

At 12:26 AM 12/11/1996, Matthew J. Miszewski wrote: >My original point, in fact, was taken out of context and so: > >At 10:50 AM 12/3/1996, Matthew J. Miszewski wrote: >>(snip) >>>(Just for the record, what the hypothetical insurance companies and >>>employers are doing by using data they have obtained should not, in >>>a free society, be illegal in any way. All information contributes >>>to decision-making, about loans, credit, insurance, employment, etc. >>>In a free society, it is up to people to not disclose that which >>>they do not wish remembered.) >> >>While the libertarians on the list have affected my way of looking at >>regulation I, and others, do not subscribe (suscribe ;)) to Tim's >>absolute theory. Unless, of course, by free society Tim is refering >>to one where corporations hold themselves to a level of "personal" >>responsibility, which in many realms is part of any definition of >>"free". >> >>Take, for example, the practice of redlining. How are people who live in >>"bad" neighborhoods supposed to not reveal that information. > >My question was a real one. The basis of it comes from my work with >the homeless in which they have a difficult time getting a job >because they have no "home address" to put on the forms, some do not >have or remember their SSNs, etc. This causes a cyclic problem for >the homeless. My question to Tim was, in the real world, how is the >protection of this data feasible. The way you protect your home address is by using another address for work which is not your home. The way I would do this is to find a mail box service which offers addresses that look like a home. A homeless person might find somebody with a home (like you) who will receive their work related mail for them. A "phone" is easy to get, too. You can get a telephone number which is linked to a voicemail box. You can even get this number listed in the telephone book, if you like. The cost of this service should be less than twenty dollars a month. If you want to go wild, you can get a pager linked voicemail number. This means your pager goes off when you get a message. Handy. But, even this small expense may be out of reach of a homeless person or a homeless advocate. What you can do is get a second line for your home and keep it unlisted. Then, give it to your homeless friends for work related purposes. If the number is only used for work messages, you could probably handle over a hundred people on this one line. As for the social security number, it has been claimed many times on this list that nobody checks them anyway. There are programs which generate real-appearing numbers. (I think one was called "ssn.exe".) And, you can go to the SSA to find out somebody's SS number or to have one issued. It will take awhile. >I do have responses to each of your "points" in your last post, but have >found the process of responding point-by-point tedious and non-productive >(maybe less productive than the time I have to give to the exercise, I was >not intending on placing a value judgement on it). This gives the appearance that you are avoiding the points I raised. My conclusion is that your views are indefensible. Having described my views on the poor as "idiotic", I think it is in poor taste to withdraw from the field without justifying your claim. >As the topic quickly wandered from the original post on privacy >concerns to racial discrimination, I will address that. I apologize >to the list (for those that find it irrelevant), but I can not reply >directly to Red. Cryptoanarchy is not friendly to schemes to prohibit racial discrimination. Indeed, it is unfriendly to any scheme which attempts to control the relationships between people. >I, personally, find racial discrimination to be a problem in the USA. It would be nice if everybody in the U.S. was not a racist. It would be nice if all the bad people just left. >Not only do I find it a moral problem, but it has adverse effects on >markets and the efficiency of these same markets. It is costly not >only in personal measures, but in economical terms as well. But, of course, I don't subscribe to the notion that market efficiency is the best means of determining policy. For one thing, concepts such as efficiency and production are politically defined. If I grow food for myself, it does not affect GDP figures. If I trade the food for money and buy something, then the same production increases GDP. This is not sensible. More importantly, I don't believe that market efficiency, however measured, is sufficient justification for dictating other people's actions. "Market efficiency" is a gambit to conceal dictatorial powers in a scientific cloak. Discussions of market efficiency typically overrule the preference that citizens have. One could imagine that a study that concluded alcohol consumption reduced national efficiency and should therefore be banned. Yet, this completely fails to take into account the strong preference many people have to drink. Some even consider it to be a religious sacrament. I don't believe such preferences should be ignored. They should be respected. Likewise, if somebody just cannot stand Albanians, we should respect their preference even though we may personally disagree with it and even though we may believe it makes the annual GDP number lower. I am not sure exactly what "costly ... in personal measures" means. If you mean that somebody who will not speak with Albanians is deprived of rewarding friendships they might otherwise have, that is probably true. On the other hand, the Albanian-hater will not see it that way. That is his or her tough luck. >I do expect many on the list to disagree with me....They will >disagree that it affects markets in any way. Just for the record, I can imagine that racial prejudice could have a slight effect on mortgage prices (i.e, interest). But, since the CMO revolution, I am inclined to believe that effect will be quite small and is probably unnoticeable. >They will assert that legislative restrictions are far worse than >industry self-policing. Just for the record, I am not advocating "industry self-policing". Policing is what I disagree with. >More will disagree that the government has any business regulating >the area. As I had stated simply before, I disagree. All you have really said is "I believe X." Should we take your belief on faith or are there reasons which underly your beliefs? >Thru painful learning experiences and reality checks - long arguments >over several months and too much coffee - I decided that I would not >want to live in a libertarian's ideal society. This decision was >based on my perception that it just wouldnt work in reality. >>I'm sure many readers of this list have had conversations which >>abruptly end with "Are you a Libertarian?", which is generally >>completely irrelevant to the point under discussion. What is >>happening is that the other person is more interested in knowing your >>tribal identification than what you believe. A pity. > >As strange as it may sound to you, most of my conversations go this >way. It is ironic to me that I have been placed on this side of an >argument. Yet, you are doing something very similar when you raise the issue of "a libertarian's ideal society". Likewise, you criticized Tim May for having (roughly) "too absolute a theory". In either case, you are avoiding substantive discussion, preferring to make prejudicial remarks. Here we are discussing some very specific policies and their ethical implications. There is no need to raise the specter of the "libertarian ideal society". One nice thing about Libertarian-style discussions is that most of the policies are separable; that is, we can discuss redlining without discussing highway privatization. This makes a nice contrast to other styles of discussion in which the proposed scheme only works if everybody participates. The most extreme example was Marxism where it was claimed that it would fail if the entire world was not Marxist. >Do you tend to think of me now as "less of a Libertarian" much as >your forewarned "In the House" black reference? "In the house"? This appears to be an American idiom which I haven't learned yet. I used the word "forewarned" once. I said that it would be hard to believe that even wealthy African-Americans were racist in their lending practices. I still find it hard to believe. It may surprise you to know that I am not all the interested in whether you call yourself a Libertarian. >>Do we then believe that we should outlaw the actions they take based >>on these beliefs? So long as the people in question are doing no >>harm, I propose we leave them alone to live their lives. > >This is the essence of, at least, my disagreement with you Red. I >dont agree that redlining doesnt harm people. You see no harm. I >do. Your reluctance to discuss the nature of the harm you perceive does not give the impression that you have good reasons for your perception. Red Rackham

1 0

Much Ado About Names
by mf＠MediaFilter.org 17 Dec '03

17 Dec '03

Much Ado About Names The internet naming system, known as the "domain name system" has made the transition to the private sphere from the once taxpayer supported public sphere, under guardianship of the National Science Foundation. The current operator of the name registry, the InterNIC (internet network information center), is Network Solutions, Inc.who now enjoys a highly profitable monopoly. Network Solutions, Inc., who is owned by Scientific Applications International Corporation (SAIC) began charging for the once gratis name registrations in September 1995 as the internet was well on its transition to a commercial marketplace. Their registration fee of $100 for the first 2 years of service has richly lined NSI's coffers as the number of registrations reached around 50,000 per month during 1996. During this interval, the limitations of the current naming paradigm became obvious as companies discovered that they had to race, or in some cases litigate, to secure their internet identities, "their-name.com"--only to discover that it was already assigned. Some, like golf protege, Tiger Woods, became victims of name speculators who registered famous names in hopes of selling them back to their rightful owners. The holders of "tigerwoods.com" were said to be willing to give the REAL Tiger Woods his name back only if they could do his website! Part of the problem lies not just in human greed, but in the limited number of the so-called "top level domains" administered by the InterNIC, "com." "edu." "org." "net." and "gov.". Under this system, which has its roots in the US Dept. of Defense bureaucracy, was designed to identify the purpose or geographic location of computers on the internet. The "com." domain was the division given to commercial network addresses, who at the time the system was established, were a minority of networks on the interet--the majority being "mil." "gov." "edu." and "net.". Now that the number of commercial networks has grown beyond any scale ever imagined by the architects of the internet, the "com." domain has proven to have reached its limits. Users have been frustrated by the limitations, speculation, and buraucracy associated with registering an address on the internet with the InterNIC/NSI/SAIC monopoly. Pressure on the committee that assigns unique parameters on the internet, the Internet Assigned Numbers Authority (IANA) has pushed IANA to for an ad-hoc committee to decide how to deal with the domain name "shortages". IANA has put forth a controversial plan to license comapnies who wish to compete in the market for domain name service--in a market- place which was recently deregulated, and in which IANA has no congressional authority to impose regulation, or levy taxes --or as they frame it, collect license fees: a $1000 non-refundable application fee, a $2000 annual license fee, plus 2% of comapany revenues. IANA claims that these funds will be spent on maintaining the rootservers--the computers which hold the central name dabase. The computers holding the domain name database are currently run by an inner circle, most of whom are members of the IANA. The server at University of Southern California, USC, for example, is run by Mr. John Postel, the head of the IANA. The locations and operators of the current rootservers include: Defense Research and Engineering Network (DREN-DOM) Department of Defense High Performance Computing Modernization Working Group, Networking Subcommittee c/o Director U.S. Army Research Laboratory Aberdeen Proving Ground, MD 21005-5067 Domain Name: DREN.NET Administrative Contact: Reschly, Robert J., Jr. (RJR3) reschly(a)ARL.ARMY.MIL (410) 278-6808/8676 (DSN) 298-6808/8676 Technical Contact, Zone Contact: Fielding, James L. (JLF) jamesf(a)ARL.MIL University of Maryland (UMD-DOM) Academic Information Technology Services Network Operations Center Bldg 224, Room 1301 College Park, MD 20742 Domain Name: UMD.EDU Administrative Contact, Technical Contact, Zone Contact: Sneeringer, Gerry (GS307) sneeri(a)NI.UMD.EDU (301) 405-2996 Network Solutions, Inc. (INTERNIC-DOM) 505 Huntmar Park Drive Herndon, VA 22070 Domain Name: INTERNIC.NET Administrative Contact: Network Solutions, Inc. (HOSTMASTER) hostmaster(a)INTERNIC.NET (703) 742-4777 (FAX) (703) 742-4811 Technical Contact, Zone Contact, Billing Contact: Kosters, Mark A. (MAK21) markk(a)NETSOL.COM (703) 742-4795 (FAX) (703) 742-4811 Los Nettos (LN-DOM) USC Information Sciences Institute 4676 Admiralty Way Marina del Rey, CA 90292-6695 US Domain Name: LN.NET Administrative Contact: Postel, Jon (JBP) POSTEL(a)ISI.EDU <-----Mr. Postel is head of IANA****** (310) 822-1511 Technical Contact, Zone Contact: Woolf, Suzanne (SW145) WOOLF(a)ISI.EDU (310) 822-1511 Billing Contact: Anderson, Celeste (CA534) celeste(a)ISI.EDU (310) 822-1511 University of Maryland (UMD-DOM) Academic Information Technology Services Network Operations Center Bldg 224, Room 1301 College Park, MD 20742 Domain Name: UMD.EDU Administrative Contact, Technical Contact, Zone Contact: Sneeringer, Gerry (GS307) sneeri(a)NI.UMD.EDU (301) 405-2996 U.S. Sprint/NSF International Connectivity Project (ICP-DOM) VAHRNA0401 13221 Woodland Park Road Herndon, VA 22071 Domain Name: ICP.NET Administrative Contact: Kurt, Gastrock (GK368) gastrock(a)SPRINT.NET 1-800-230-5108 Technical Contact: Kilmer, Hank (HK468) hank(a)SPRINT.NET 1-800-230-5108 (FAX) 703-904-2292 Zone Contact, Alternate Contact: Sprint Network Info. & Support Center (SPRINT-NOC) noc(a)sprintlink.net (800) 669-8303 Billing Contact: Goel, Vab (VAB-US) vgoel(a)SPRINT.NET 7039042635 NORDUnet (NORDU-DOM) c/o SUNET-KTH S-100 44 Stockholm SWEDEN Domain Name: NORDU.NET Administrative Contact: Eriksen, Bjorn [System Manager] (BE10) BER(a)SUNIC.SUNET.SE +46 8 790 60 00 Technical Contact, Zone Contact: Liman, Lars-Johan (LL846) LIMAN(a)SUNET.SE +46 8 790 65 60 (FAX) +46 8 24 11 79 Vixie Enterprises (VIX-DOM) Star Route Box 159A Woodside, CA 94062 Domain Name: VIX.COM Administrative Contact, Technical Contact, Zone Contact, Billing Contact: Vixie, Paul (PV15) paul(a)VIX.COM (415) 747-0204 DOD Network Information Center (NIPR-DOM) Government Systems, Inc. Attn: NSI (Hostmaster) 14200 Park Meadow Dr., Suite 200 Chantilly, VA 20151 Domain Name: NIPR.MIL Administrative Contact, Technical Contact: Government Systems, Inc. (HOSTMASTER) 703-802-4535 (FAX)703-802-8376 HOSTMASTER(a)NIC.DDN.MIL IANA's plan, which has no congressional mandate, is imposing regulation on a deregulated market, subsidizing corporations, and collecting double taxes on US and International companies, as evidenced by the identities of the networks who would reap the benefits of any fees imposed on other registries. To add insult to injury, is to examine the profile of SAIC, a 2 billion dollar company with strong ties to the Pentagon and the NSA. SAIC is an employee-owned company of 20,000 with about 450 offices around the globe. Its current board of directors include former National Security Agency chief Bobby Inman, Former Defense Secretary Melvin Laird, and the former head of research and development for the Pentagon, Donald Hicks. Ex-CIA director Robert Gates, Secretary of Defense William Perry and CIA Director John Deutsch have been past board members. Eighty-three percent of SAIC's $2 billion annual revenue comes from government contracts, including defense, intelligence and law enforcement contracts. SAIC is designing new information systems for the Pentagon, helping to automate the FBI's computerized fingerprint identification system, and last year won a $200million contract to provide "information support" to the IRS. (source: John Dillon, "Networking with Spooks", CAQ magazine, winter, 1996). Enter the free market. Individual comapnies cropped up in response to the command economy of artificial shortages that had been imposed by a US-centric, militaristic bureaucracy and created new networks of rootservers outside the "sanctioned" servers on which all connections on the internet depend. If your name does not appear in the "sanctioned" database (the rootservers detailed above), your name will not be found everywhere on the internet....only other computers who check the "outsider" database will be able to resolve the new domain names created by the independent companies.--and there are already around 200 new possible names under which one can register on these new services. This poses a problem for the independent upstart name registries because, although they may have a fully functional rootserver system in place, and a fully automated and operational registration service in place, they are essentially frozen out of service becuase the de-facto rootservers, controlled by members of IANA, decide which entries will be in the database of the "sanctioned" rootservers. Hence, the IANA has a vested interest in protecting their control over the "whos-who" list of internet networks, as do their compatriots at Network Solutions, Inc., SAIC, and the government agencies who do business with them. For an example of a fully functional, independent name registry, please go to http://namespace.pgpmedia.com. For some further information on the controversy, please go to http://www.packet.com/hotseat this is a "realaudio" webcast between John McChesney of NPR, Paul Garrin of name.space., and Simpson Garfinkel of WIRED magazine. Also see, "Rebellion Over Who Controls the Net" by Christine Biederman and Jamie Murphy (N.Y. Times, "Cybertimes", November 23, 1996) "Internet Domain Names: Whose Domain is This?" http://www.itu.ch/intreg/dns.html by Robert Shaw,Advisor, Global Information Infrastructure Information Services Department, International Telecommunication Union (ITU) Geneva, Switzerland (Presented at the workshop "Coordination and Administration of the Internet" held at the John F. Kennedy School of Government, Harvard University, Cambridge, Massachusetts, USA, September 9-10, 1996). the John Dillon article "Networking with Spooks" appears in the latest issue of CAQ, available soon at http://mediafilter.org/caq (or http://caq.mag.)

1 0

I thought this was a technical list.
by Anonymous 17 Dec '03

17 Dec '03

1 0

Re: Review of the EPP plug-in 0.2 for Eudora
by Damon Gallaty 17 Dec '03

17 Dec '03

At 05:48 AM 12/10/96 -0800, Alan Olsen <alan(a)ctrl-alt-del.com> wrote: >[Note: this is CCed to the developer for two reasons. First, I wanted him >to know of the review. Second, I have another two bugs at the bottom that >I have not reported.] > Hi...I'm the developer. I'd like to respond to these items that Alan Olsen listed so that everyone knows what the heck I'm doing with the Eudora/PGP Plug-In, a.k.a EPPI. [snippet about what EPPI is deleted] >The functions provided are: > >-- Clearsign Message >-- Decrypt Message >-- Encrypt Message >-- Verify Signature >-- Add Key >-- Paste (Insert) Key > >These appear under the Edit menu in the plug-ins submenu. (It would be >nice for these to be in their own seperate menu, but that may be beyond the >scope of the plug-in developers kit.) > Unfortunately, the plug-in developers kit, called the Eudora Messaging System API (EMS API), is very limited, and only provides the functions necessary to get the incoming or currently-displayed mail message, and to paste the results of the plug-in into said message. It gives _no_ control over the Eudora menus. In fact, you can't even activate any arbitrary menu or function of Eudora, nor can you read any information besides what is passed to you by the various functions which call your plug-in. Many of the problems below have been called to my attention. I'll note those that have, and add to my list those that haven't. I'll also explain what I'm doing to correct the problems. If anyone has a better suggestion of fixing a specific problem, please let me know. > >These are the problems/bugs I have found so far: > >-- If you do not define a default ID in the PGP config.txt, it will take >the last ID generated on the secret key ring. (This is a common problem. >This is not the only app that has it.) > Already known. I'll have a field to specify default ID, with an entry for the hex key ID in case there are more than one of the same user ID. >-- The program does not word wrap before sending the message to get >signed. This breaks the signature when Eudora word wraps it opon sending >the message. (Another common problem. I remember a bunch of apps fixing >this one at one time a few months ago...) > Already known. I'll perform the word-wrap in the plug-in. >-- If you decrypt a message, the mail headers are destroyed. (I just >discovered this one last night. It makes replying a bit of a challenge...) > Already known. I'll change the way the plug-in replaces text by only replacing the text between the PGP BEGIN and END headers. >-- The plug-in does not deal with "personalities". (This is not a bug, but >something that would be *REAL* helpful. Now if you could get personalities >that connected to nym servers.) > There's not much I can do about this. I have no way of knowing in the plug-in that a user has switched personalities, so there is no way to notify the plug-in to use a different configuration. I could, however, add personalities to the plug-in, which would at least let the user select different configurations in it to match the current personality being used. Comments? >All in all, this is a useful plug-in. It has a few rough spots, but that >is to be expected. (This is a 0.2 release.) > Thank you. Yes, I knew it was going to be rough at first, hence the version numbering of 0.x. I'll get to 1.0 when I feel it's truly a polished Eudora plug-in worthy of paying for (though I plan to keep it freeware). > >BTW, this is the original information as to where to get the plug-in. How >much of this is current, i am not certain... (The mailing list was broken >according to Lucky Green.) > Sadly, my account was unexpectedly yanked out from under me, so that information is wrong. However, thanks to some generous folks who responded to my plight, I have some temporary locations set up, until I can find a permanent home. Here is the updated information: Download version 0.20 from the Web: * http://www.geocities.com/Heartland/5065/epp16v02.zip (for 16-bit version of Eudora 3.0 for Windows 3.1) * http://www.geocities.com/Heartland/5065/epp32v02.zip (for 32-bit version of Eudora 3.0 for Windows NT/95) If you don't have Web access, but have FTP access, try the following sites. Note that if the version you are trying to get was released today or just a few days ago, it may not have shown up at the sites below yet, so give it a few days: papa.indstate.edu: /pub/winsock-l/mail/epp16v02.zip /pub/winsock-l/Windows95/mail/epp32v02.zip /pub/winsock-l/WindowsNT/mail/epp32v02.zip ftp.winsite.com: /pub/pc/win3/winsock/epp16v02.zip /pub/pc/win95/winsock/epp32v02.zip If you want to be automatically notified of new versions, send e-mail to EPPINEWS(a)professional.org with the following message body: join stop You will not be able to post to this list. It is merely a convenient way to receive notification of new updates to EPPI. Send comments to: dgal(a)cad.gatech.edu I have noticed that GeoCities has had some problems last week. Hopefully, these are corrected by now. If not, try the FTP sites. - Damon Gallaty <dgal(a)cad.gatech.edu>

1 0

Re: take me off the list, please!!!
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

At 07:01 PM 12/10/96 -0500, you wrote: :please take me off the mailing list, i cant stand the petty bickering. What a :waste, you guys spend all your time taking potshots at each other instead of :really relevant issues. My sincere apologies to those not involved. If you're so damn serious about really relevant issues, how about taking the time to learn something so simple as how to get off the list. Geez! Cordially, Alec PGP Fingerprint: Type bits/keyID Date User ID pub 1024/41207EE5 1996/04/08 Alec McCrackin <camcc(a)abraxis.com> Key fingerprint = 09 13 E1 CB B3 0C 88 D9 D7 D4 10 F0 06 7D DF 31

1 0

Harddisk encryption ??
by Pavel Korensky 17 Dec '03

17 Dec '03

Hello, I am trying to post this message once more. It seems that my first message somehow didn't find the way to the mail-list. I have one problem which I would like to consult with you. I need to protect the data on the computer harddisk against physical theft. Current situation: Computer with several harddisks - approx. 9 GB. On this computer, the following OS are used: Linux, DOS, Windows NT. The data on this computer must be accessible from all operating systems. Encryption of files must be transparent to user and encryption algorithm must be "strong". Because I am not able to find any disk encryption software which is able to run on all these platforms, I decided to use the following temporary solution: Add one more computer with Linux OS. On this computer, there will be only a small root partition with necessary Linux components. All other disk space will be encrypted with IDEA, using the /dev/loop. This machine will be some kind of secure file server. On the second machine, where the user works, there will be partitions with operating systems, necessary utilities and the TCP/IP stack for DOS/Windows, NT and Linux. The data and application disks will be mounted via NFS and user will work with files from file server. The computers will be interconnected with Fast Ethernet. This mini-network is NOT connected to the Internet, so the NFS (in)security should not be a problem. Also, both computers will be placed in the same room (distance approx. 3 m), so there should be no problem with tapping/data capturing on the Fast Ethernet connection. I have the following questions. Can anybody see some major security hole in this system ? How fast will be this system ? Anybody has any idea if there is some more sophisticated solution for this problem ? Anybody heard about some strong disk encryption which is able to rund under Windows NT, Linux and DOS ? It seems that the Win NT are the major problem. I am not able to find any disk encryption for NT. Anybody is able to port Secure File System to Windows NT ? I am trying to port this program under Linux, but I am not the NT system programmer. Thanx for any comments, help, ideas etc. Best regards PavelK -- **************************************************************************** * Pavel Korensky (pavelk(a)dator3.anet.cz) * * DATOR3 Ltd., Modranska 1895/17, 143 00 Prague 4, Czech Republic * * PGP key fingerprint: 00 65 5A B3 70 20 F1 54 D3 B3 E4 3E F8 A3 5E 7C * ****************************************************************************

3 2

Re: Virus?
by Eric Wilson 17 Dec '03

17 Dec '03

At 09:10 PM 12/10/96 EST, you wrote: >Has anybody heard of the Monkey_B virus? If so what does it do exactly? >Also does anybody know where I could find a downloadable Win95 upgrade >upgrading Windows 3.x to Win95? > > The Monkey virus ( I'm not sure what the "B" variant has altered ) is a memory resident, stealth, boot infector that writes ( and encrypts!) the partition table to side 0, cyl 0, sector 3 of your hard disk. It then modifies your MBR to point to this location. When the virus is resident it infects any floppy ( not write protected )that is accessed by the system. If you need help with cleaning the Monkey from your system, try asking the geniuses at alt.comp.virus for some help. Keep in mind they argue with each other more than cypherpunks do! Here's a hint on cleanup, booting clean and running Fdisk/mbr will remove the virus from your hard disk, but it WILL NOT restore your partition table! Eric

1 0

DCSB: Applying PGP To Digital Commerce
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: rah(a)pop.tiac.net Mime-Version: 1.0 Date: Wed, 11 Dec 1996 08:08:44 -0500 To: dcsb(a)ai.mit.edu, dcsb-announce(a)ai.mit.edu From: Robert Hettinga <rah(a)shipwright.com> Subject: DCSB: Applying PGP To Digital Commerce Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Robert Hettinga <rah(a)shipwright.com> -----BEGIN PGP SIGNED MESSAGE-----BY SAFEMAIL----- The Digital Commerce Society of Boston Presents Rodney Thayer Sable Technology Corporation "Applying PGP To Digital Commerce" Tuesday, January 7, 1996 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Rodney Thayer has 20 years experience in the software development business. For the past 10 years he has been designing, implementing, deploying, and troubleshooting networking software. He currently is the Principal of a consulting firm based in Newton, Massachusetts where he is involved in the implementation of communications products for a variety of customers, including software vendors, major end-user organizations, and several governmental organizations both foreign and domestic. He also writes and lectures on the deployment, troubleshooting, and implementation of data communications networks. Mr. Thayer will talk about how PGP can be used in the business world today, for exchange of information, digitally identifying documents, and other commerce applications. In this presentation, we will discuss the application of PGP, including mechanics, the cryptographic and legal issues, and the infrastructure requirements for it's use. The state of the art in digital message encryption is now at the point where it has become practical to use encrypted and digitally signed email for digital commerce. Recently, one scheme, PGP, has emerged from the realm of the cyberpunk as a legitimate tool for business. Commercial products are now available that support PGP encryption in electronic mail and for documents and digital storage. PGP is no longer a cult tool for computer junkies and cyberpunks. It is a legitimate, sound cryptographic technology that can be used, today, for digital commerce. As an increasingly crypto-aware business community searches for solutions, the question of how to use message encryption tools such as PGP becomes germaine to the business community. This meeting of the Digital Commerce Society of Boston will be held on Tuesday, January 7, 1996 from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, One Federal Street. The price for lunch is $27.50. This price includes lunch, room rental, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men, and "appropriate business attire" for women. We will attempt to record this meeting and put it on the web in RealAudio format at some future date We need to receive a company check, or money order, (or, if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, January 4, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston". If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Planned speakers for DCSB are: February David Kaufman 1996 in Review / Predictions for 1997 March TBA April Stewart Baker Encryption Policy and Digital Commerce We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, rah(a)shipwright.com . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to majordomo(a)ai.mit.edu . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to majordomo(a)ai.mit.edu . Looking forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE-----BY SAFEMAIL----- Version: 1.0b5 e29 iQCVAwUBMq6xm/gyLN8bw6ZVAQFMMAP/f1zlK1gngnR8Lj3YXAIuKaZhw5ldsCb5 h0+JqPT6i6Yxxd64sOUosIZ20jgd2Msjg3Di3We4TfZVB/fZRq89sjDp+9CYd32o MSN8ldSGbaTGabwvAMGWMG5OkCwBGYjPyxwSf6/iBZtb3VbWiTHdR+g/YMIkCKHJ WMclXCtZAHU= =1f7Q -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0