December 2003 - cypherpunks-legacy

No Subject
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:42 AM 12/12/96 -0800, Red Rackham wrote: >It seems to me that in the case of an employee giving the wrong number >to his employer, the only person that suffers is the employee through >loss of future payments from the Social Security Administration. The >employer certainly doesn't suffer. Assume that the income tax is >paid. > >What laws would an employee violate? What are the chances of >conviction? What are the likely penalties if convicted? 26 USC 7205(a), "Any individual required to supply information to his employer under section 3402 who willfully supplies false or fraudulent information . . shall, in addition to any other penalty provided by law, upon conviction thereof, be fined not more than $1,000, or imprisoned not more than 1 year, or both." 42 USC 408(a)(7)(A), "Whoever for the purpose of obtaining (for himself or any other person) any payment or any other benefit to which he (or such other person) is not entitled, or for the purpose of obtaining anything of value from any person, or for any other purpose . . with intent to deceive, falsely represents a number to be the social security account number assigned by the Secretary to him or to another person, when in fact such number is not the social security account number assigned by the Secretary to him or to such other person . . shall be guilty of a felony and upon conviction thereof shall be fined under title 18 or imprisoned for not more than five years, or both." and 8 USC 1324a(b) requires that employers force employees to fill out a form to document citizenship status, and the form currently in use (INS I-9) requests a social security number. - -- Catfish Friend -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMrEM89GzuQsii+JdAQHc8wP/cKizciQHtI3ue/CdKJ62DbuPVlobRTl5 qY1oOQs3L3rb0mKa0FdklcfxaXYYMY0zJpGmGTSynDwJKGSCm5O6fPkCPG064LSp npMzmOqOWpUSrYX652Q8EMFPODHKCl0FX78ksQ1ns8Xv//bT4wdPt5GR6AlTrvdc XH1s/oB9tMM= =2xtm -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

3 2

Merry Christmas, HipXmas-SantaSpam!
by Santa Claus 17 Dec '03

17 Dec '03

* * /|\ ///*\\\ * * * //\\ * //\\ * * * * * // \\ // \\ // \\ S A N T A * * * N O R T H P O L E | | \____/ Wherever you go, whatever you do, Remember that Santa is always with you. I live in your heart, I dance in your soul, I show you what love is, and good things to know. The Spirit of Christmas spreads all through the land, With joy and the giving of gifts you should have. But gifts are just one thing to give and to get -- We wish you much more, far more than that. My elves send you pride in whatever you do, My reindeer give strength on days you feel blue, My wife, Mrs. Claus, grants wisdom and grace, Belief in yourself and all you create. And me, what do I give? Is there much more? Plenty and plenty you won't find in stores. I give you the knowledge that you can do more Than you ever knew -- of that be quite sure. My sleigh's packed with toys, my list sweeps the floor, A cup of hot cocoa and I'm out the door. Just gaze high in the sky where Peace always soars, And you live in my heart as I live in yours. * * * * * * M e r r y C h r i s t m a s * * S a n t a C l a u s --------- This santa poem was sent to you from a person who visited the ReplyNet site (www.reply.net) and entered your name and address on our Santa page. Your e-mail address is NOT being collected.

4 3

No Subject
by Fyodor Yarochkin 17 Dec '03

17 Dec '03

Hey.. is there any CoderPunks Meetings somewhere in russia? -X----- Fyodor --- fygrave(a)freenet.bishkek.su --------------------------X-- "With heart and hand I pledge you while I load my gun again, you will never be fogotten or the enemy forgiven, my good comrade..." - Anton Szandor LaVay -X--http://www.freenet.bishkek.su/fygrave.html---tel:(3312)474465-------X-- -X--http://www.geocities.com/SunsetStrip/Alley/8302-mirror-at-geocities-X-- pgp is awaliable from pgp-key-servers : pub 2048/3D22AF59 1980/03/24 Fyodor Yarochkin <fygrave(a)freeenet.bishkek.su> Key fingerprint = 1F 38 55 07 98 F9 42 7D 57 73 74 FA 9C 5B 29 FB "As Above, So Below. The Macrocosm, the Microcosm. The Entire Universe is Contained In The Human Creature" To The Fallen Angels

4 3

Re: Java DES breaker?
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

More than one person writes: > Vulis wrote: > > "Mark M." <markm(a)voicenet.com> writes: > > > compiles Java to a stand-alone executable. Details at > > > http://webhackers.cygnus.com/webhackers/projects/java.html . > > It would be very foolish to touch any shit that comes out of Cygnus. > > Why? (specifically, I am about to try using a GCC port to WinNT, and > I would like to know _why_ you think their work is shit). First, because it's King John "Lackbrain" Gilmore's company. :-) Second, because they hire unqualified people (rather, people whose qualifications have nothing to do with the job) and they've already fucked up every project they've ever touched. Third, because they steal from the people who originally developed the free software by charging money for the non-existent "support". I'm quite happy with MS VC++ for NT. I doubt that Cygnus can do a good job porting gcc to NT. People much better than the assholes at Cygnus have not done a great job porting gcc to OS/2. If I want gcc, I just run it on the Linux box, or a Sun box. Fuck Cygnus. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

4 6

BUY_spy
by John Young 17 Dec '03

17 Dec '03

12-18-96. "Special Chips Off-Load and Speed Encryption Transactions" Buy-spy GAK chips from IRE, Rainbow, Atalla, IBM. "Clinton administration opposed to encryption bills" "Goodlatte to resubmit encryption bill" Commerce Department has said it expects to issue rules implementing the new Clinton export policy by January 1, 1997. [NYT reports final rules are due out December 22.] "Method and apparatus for the secure communication of data" Patent: An auto-dialer suitable for use as a smart card capable of being acoustically coupled to a telephone and being reprogrammed in response to acoustic signals. A device for generating a set of tones encoded with data. "Enciphered file sharing method (Fujitsu)" Patent: An enciphered file sharing method adapted to an area distributed type data processing system. "EMD Encryptor; First 32-Bit desktop utility to provide multiple encryption capabilities for home and corporate computer users Largest encryption key size: 256-bit. ----- BUY_spy

1 0

RE: !! Point 'n Crypt -- Win95 Privacy for Everyone !!
by Peter Trei 17 Dec '03

17 Dec '03

> From: Walt Armour <walt(a)blarg.net> > Subject: RE: !! Point 'n Crypt -- Win95 Privacy for Everyone !! > Security through obscurity is no security at all. > > As for PnC (actually, the scCryptoEngine beneath it), we get the 40 bits > from the 56 bits by nulling out the high nybble of every other byte. > > walt > > ---------- > From: Peter Trei[SMTP:trei@process.com] > Would you mind telling us just how you expand the 40 key to the 56 > bits needed for DES? (Security through obscurity has a bad rep on > this list). For many methods of doing so, 40bit DES is NOT > secure against a motivated individual's attack. > > Peter Trei > trei(a)process.com Thanks for being so forthcoming! There are methods for using 40 bit keys that are a lot better than this. My contention stands: 50 200MHz Pentiums *WILL* crack this overnight. A single 100 MHz Pentium will do it in a month. (This assumes a known plaintext attack in EBC or CBC mode). Not utterly trivial, but well within the means of a motivated individual. Peter Trei trei(a)process.com

1 0

EFF: Bernstein court declares crypto restrictions unconstitutional
by Rich Burroughs 17 Dec '03

17 Dec '03

> COURT DECLARES CRYPTO RESTRICTIONS UNCONSTITUTIONAL > Free Speech Trumps Clinton Wiretap Plan > >December 18, 1996 [snip] This is the best news that I have heard in some time :) Congrats to John, EFF, Cindy Cohn, and the other counsel for Professor Bernstein. I am very much looking forward to seeing that decision... Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb U.S. State Censorship Page at - http://www.teleport.com/~richieb/state dec96 issue "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

passphrase protection (was: Re: [PGP-USERS] Security LeakPrograms)
by Dave Del Torto 17 Dec '03

17 Dec '03

In Reply to the Message wherein it was written: >I have just in the last few minutes realized how I need to bring attention >to the security level of my own computer or PGP means NOTHING in terms of >protection. Indeed, Floyd: the dirty little secret is that passphrase protection is a more serious weakness than almost any other factor. I don't just mean dictionary attacks: those are way too expensive if you can just grab a text stream saved to an invisible file on an unsuspecting user's net-accessible machine. The new generation of PGP software (3.x) includes several new prompts/enhancements to the passphrase entry process: perhaps subsequent releases could take those even further into the realm of system-level monitoring. >PZ writes in the manual about the inability to fully wipe, etc. >when using virtual memory but this problem I just encountered in security >goes beyond that, I believe. >I have been installing a Macintosh program, FileGuard, which adds several >levels of security. I knew about and had used the invisible extension >HiddenOasis that saves EVERY keystroke made on the machine. I started doing an informal survey of all key capture utilities (on all platforms) a couple of years back, but there were so few utilities publicly available back then, very few respondents came back at me with items to list. It occurred to me then that if there _were_ persons trying to grab passphrases from an individual's machine, it would be a significant advantage to have "invisible" keystroke monitors and for all knowledge of the existence of such utilities to remain a closely-guarded secret (from, say, the laptop of an FBI counter-intelligence instructor suspected of selling secrets to foreign agents for a few hundred thousand dollars, or something improbable like that). However, it's not the "good guys" we mainly need to be concerned with: there is a great deal of industrial espionage that needs some sunshine. The viability of personal privacy software in the marketplace is threatened if such utilities spread: as a responsible company protecting both the public's interest and our own company's survival, we need to plan for very sophisticated passphrase attacks and constantly educate users about this danger. That having been said, this invisible "HiddenOasis" item you mention is a new one to me: I'd like a copy to test in our lab and my interest in hearing about everyone's favorite keycapture utility is rekindled. Maybe my boss will let me devote, oh, about 0.73% of my time to this. ;) PGP's engineers have already spec'ed out some good defenses against subtle attacks like ion migration (memory burn-in), and with everyone's help (we can't watch every security leak, that's why we need you guys!), we can continue to work up defenses against such wee beasties. Any whistleblowers are also invited to drop a dime: my public key is widely available (even clickable) through the header URL above and we still have anonymous remailers in this country. Nudge-nudge, say no more, etc. [elided] >To my surprise as I set user priveledges with FileGuard, I saw a previously >unnoticed folder far from my root directory called, "Ghostwriter." This gives new meaning to the term "spook"... >I rummaged through it and many, most of the files therein (900k of files) >showed various passwords I had consdered absolutely uncompromised in >plaintext. It's quite a shocking feeling to realize what defaults are built into some popular commercial apps, isn't it? :/ You don't often see "insignificant" items like this get mentioned in any popular reviews either. It could be that even more users out there are ignorant of this issue than there are sysadmins who haven't read up on the SYN attack. >It turns out that the spell-check program, SpellCatcher [elided] created >these files which (from the manual), "For the Ghostwriter feature, Spell >Catcher saves a continuous stream of keystrokes to a text file inside the >SPEL CATCHER FOLDER." The manual does mention disabling Ghostwriter before >typing a "sensitive password." But offers no way to PERMANENTLY shut this >feature OFF. [elided] If confirmed, this is an absolutely unconscionable design flaw, IMHO. Anyone who has a specific comment (include URLs if possible), please mail me and put "passphrase protection" somewhere in the subject line. <"mailto:ddt@pgp.com?subject=passphrase protection"> I'll collect them, filter to our engineers where appropriate and eventually, when we have enough for a decent matrix, I'll either post a summary on our website or write up an informational RFC. dave ________________________________________________________________________ Dave Del Torto +1.415.524.6231 tel Manager, Strategic Technical Evangelism +1.415.631.0599 fax Pretty Good Privacy, Inc. http://www.pgp.com web

1 0

thread?
by danalogi＠videotron.net 17 Dec '03

17 Dec '03

can we read this thread as a newsgroup somehwre? or it's avaible only as remail? fred.

1 0

RE: permanent invasion of privacy
by Blanc Weber 17 Dec '03

17 Dec '03

From: Dale Thorn Maybe if you got off your ass and did something worthwhile for society, things would really change for the better. But I won't hold my breath. ............................................................. Don't be so presumptious, Dale. I could be a secret cpunk NSA tentacleH^H^H^H^agent on the list trying to discourage people from pursuing certain ideas - like yours, for example. .. Blanc (LOL) > >

1 0