December 2003 - cypherpunks-legacy

RE: !! Point 'n Crypt -- Win95 Privacy for Everyone !!
by Peter Trei 17 Dec '03

17 Dec '03

> From: Walt Armour <walt(a)blarg.net> > Subject: RE: !! Point 'n Crypt -- Win95 Privacy for Everyone !! > Security through obscurity is no security at all. > > As for PnC (actually, the scCryptoEngine beneath it), we get the 40 bits > from the 56 bits by nulling out the high nybble of every other byte. > > walt > > ---------- > From: Peter Trei[SMTP:trei@process.com] > Would you mind telling us just how you expand the 40 key to the 56 > bits needed for DES? (Security through obscurity has a bad rep on > this list). For many methods of doing so, 40bit DES is NOT > secure against a motivated individual's attack. > > Peter Trei > trei(a)process.com Thanks for being so forthcoming! There are methods for using 40 bit keys that are a lot better than this. My contention stands: 50 200MHz Pentiums *WILL* crack this overnight. A single 100 MHz Pentium will do it in a month. (This assumes a known plaintext attack in EBC or CBC mode). Not utterly trivial, but well within the means of a motivated individual. Peter Trei trei(a)process.com

1 0

EFF: Bernstein court declares crypto restrictions unconstitutional
by Rich Burroughs 17 Dec '03

17 Dec '03

> COURT DECLARES CRYPTO RESTRICTIONS UNCONSTITUTIONAL > Free Speech Trumps Clinton Wiretap Plan > >December 18, 1996 [snip] This is the best news that I have heard in some time :) Congrats to John, EFF, Cindy Cohn, and the other counsel for Professor Bernstein. I am very much looking forward to seeing that decision... Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb U.S. State Censorship Page at - http://www.teleport.com/~richieb/state dec96 issue "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

passphrase protection (was: Re: [PGP-USERS] Security LeakPrograms)
by Dave Del Torto 17 Dec '03

17 Dec '03

In Reply to the Message wherein it was written: >I have just in the last few minutes realized how I need to bring attention >to the security level of my own computer or PGP means NOTHING in terms of >protection. Indeed, Floyd: the dirty little secret is that passphrase protection is a more serious weakness than almost any other factor. I don't just mean dictionary attacks: those are way too expensive if you can just grab a text stream saved to an invisible file on an unsuspecting user's net-accessible machine. The new generation of PGP software (3.x) includes several new prompts/enhancements to the passphrase entry process: perhaps subsequent releases could take those even further into the realm of system-level monitoring. >PZ writes in the manual about the inability to fully wipe, etc. >when using virtual memory but this problem I just encountered in security >goes beyond that, I believe. >I have been installing a Macintosh program, FileGuard, which adds several >levels of security. I knew about and had used the invisible extension >HiddenOasis that saves EVERY keystroke made on the machine. I started doing an informal survey of all key capture utilities (on all platforms) a couple of years back, but there were so few utilities publicly available back then, very few respondents came back at me with items to list. It occurred to me then that if there _were_ persons trying to grab passphrases from an individual's machine, it would be a significant advantage to have "invisible" keystroke monitors and for all knowledge of the existence of such utilities to remain a closely-guarded secret (from, say, the laptop of an FBI counter-intelligence instructor suspected of selling secrets to foreign agents for a few hundred thousand dollars, or something improbable like that). However, it's not the "good guys" we mainly need to be concerned with: there is a great deal of industrial espionage that needs some sunshine. The viability of personal privacy software in the marketplace is threatened if such utilities spread: as a responsible company protecting both the public's interest and our own company's survival, we need to plan for very sophisticated passphrase attacks and constantly educate users about this danger. That having been said, this invisible "HiddenOasis" item you mention is a new one to me: I'd like a copy to test in our lab and my interest in hearing about everyone's favorite keycapture utility is rekindled. Maybe my boss will let me devote, oh, about 0.73% of my time to this. ;) PGP's engineers have already spec'ed out some good defenses against subtle attacks like ion migration (memory burn-in), and with everyone's help (we can't watch every security leak, that's why we need you guys!), we can continue to work up defenses against such wee beasties. Any whistleblowers are also invited to drop a dime: my public key is widely available (even clickable) through the header URL above and we still have anonymous remailers in this country. Nudge-nudge, say no more, etc. [elided] >To my surprise as I set user priveledges with FileGuard, I saw a previously >unnoticed folder far from my root directory called, "Ghostwriter." This gives new meaning to the term "spook"... >I rummaged through it and many, most of the files therein (900k of files) >showed various passwords I had consdered absolutely uncompromised in >plaintext. It's quite a shocking feeling to realize what defaults are built into some popular commercial apps, isn't it? :/ You don't often see "insignificant" items like this get mentioned in any popular reviews either. It could be that even more users out there are ignorant of this issue than there are sysadmins who haven't read up on the SYN attack. >It turns out that the spell-check program, SpellCatcher [elided] created >these files which (from the manual), "For the Ghostwriter feature, Spell >Catcher saves a continuous stream of keystrokes to a text file inside the >SPEL CATCHER FOLDER." The manual does mention disabling Ghostwriter before >typing a "sensitive password." But offers no way to PERMANENTLY shut this >feature OFF. [elided] If confirmed, this is an absolutely unconscionable design flaw, IMHO. Anyone who has a specific comment (include URLs if possible), please mail me and put "passphrase protection" somewhere in the subject line. <"mailto:ddt@pgp.com?subject=passphrase protection"> I'll collect them, filter to our engineers where appropriate and eventually, when we have enough for a decent matrix, I'll either post a summary on our website or write up an informational RFC. dave ________________________________________________________________________ Dave Del Torto +1.415.524.6231 tel Manager, Strategic Technical Evangelism +1.415.631.0599 fax Pretty Good Privacy, Inc. http://www.pgp.com web

1 0

thread?
by danalogi＠videotron.net 17 Dec '03

17 Dec '03

can we read this thread as a newsgroup somehwre? or it's avaible only as remail? fred.

1 0

RE: permanent invasion of privacy
by Blanc Weber 17 Dec '03

17 Dec '03

From: Dale Thorn Maybe if you got off your ass and did something worthwhile for society, things would really change for the better. But I won't hold my breath. ............................................................. Don't be so presumptious, Dale. I could be a secret cpunk NSA tentacleH^H^H^H^agent on the list trying to discourage people from pursuing certain ideas - like yours, for example. .. Blanc (LOL) > >

1 0

Bernstein case in the White House press conference
by John Gilmore 17 Dec '03

17 Dec '03

"What do you mean? Of course the Emperor is wearing clothes!" John http://library.whitehouse.gov/Briefings.cgi?date=0&briefing=0 December 19, 1996 PRESS BRIEFING BY MIKE MCCURRY 1:37 P.M. EST THE WHITE HOUSE Office of the Press Secretary ______________________________________________________________ For Immediate Release December 19, 1996 PRESS BRIEFING BY MIKE MCCURRY The Briefing Room 1:37 P.M. EST MR. MCCURRY: I sit up here with no information to give, empty. Throw this thing away, this is useless. (Laughter.) I spent the whole morning running around, just like you guys do, running around trying to find somebody who knows something. And I found a whole lot of people who knew nothing. ...several pages deleted... Q Mike, the Post story on the encryption -- federal court decision on encryption software -- can you say what that does to the government's rule-making effort and its plans to -- MR. MCCURRY: I am told that folks at Justice are trying to figure that out. They're analyzing the opinion now and seeing what impact it has. The preliminary read that I've got from them is that it should not have any impact on it because of the way the case is structured and the opinion was drawn. But they're looking at it more carefully now. Q Mike, any comment on The New York Times report that the United States is cracking on war criminals in Bosnia? ....a page deleted... Q Thank you. MR. MCCURRY: Thank you, Helen. See you all tomorrow. Maybe we'll have some real news tomorrow for a change. (Laughter.) THE PRESS: Thank you. END 2:05 P.M. EST #289-12/19

1 0

RE: The virus I got...
by Mullen Patrick 17 Dec '03

17 Dec '03

You already had the Monkey (or whatever) virus. It was not included in the file distributed to the list. The file was a pure Trojan, not infector. PM _______________________________________________________________________________ From: Internaut on Thu, Dec 19, 1996 3:30 Subject: RE: The virus I got... From: Mark Rosen[SMTP:mrosen@peganet.com] Sent: Wednesday, December 18, 1996 04.37 PM >Oh, and as far as I know, no virus was installed, >though you should check for one just for good measure. There was one, though I don't remember what it's name was. Maby it was Monkey. I already deleted it. --Internaut

2 1

Re: We won the Bernstein case.
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Simon Spero <ses(a)tipper.oit.unc.edu> writes: > On Wed, 18 Dec 1996, Bruce Schneier wrote: > > > John Gilmore just called me. There should be info on it on the EFF website > > real soon now. > > shehechianu vekiyemanu hevigianu lazman hazeh... No wonder Jewhater Timmy May (fart) is rapidly approaching apoplexy! Omeyn. There probably will be an orgy at the NYC punks meeting tonight, which I'm not going to attend, not being a queer "cypher punk". > So does this mean that anything can be exported as long as it's in source > code, or is object code covered as well? Try to find Judge Patel's district on the map. Hint: North California is covered, North Carolina (and North Dakota) ain't. > Simon > > --- > Queen's Own Cypherpunk Regiment / 82nd Chairborne - Gilmour's Irregulars Pathetic queens indeed. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: controlling web "cookies"
by Andrew Loewenstern 17 Dec '03

17 Dec '03

[note, I have rerouted this thread from coderpunks to cypherpunks where it is more appropriate...] Adam Shostack writes: > Posting hacks like this, while fun, tells the bad guys > (in Washington) how we're going to bypass their next > bits of nonsense. > A number of cute hacks posted to cypherpunks after > Clipper II were defended against in Clipper III. So > don't post your cute hacks against systems until they're ok'd > by the government or deployed. Part of the reason past Clipper schemes haven't been deployed is because they had been shown not to work! I say if there are weak spots, keep punching holes in them. While Washington is spinning around trying to come up with a new-and-improved version, keep deploying good strong crypto and working the free-speech/civil-liberties angle in the courts. By the GAKers come up with a workable solution (which is probably impossible given the politics involved in global-GAK) it will be too late. andrew

1 0

"Cryptography Policy and the Information Economy" draft available
by Matt Blaze 17 Dec '03

17 Dec '03

I've got a new draft available of my critique of US cryptography policy and its impact on the future of the "information economy". It summarizes comments I made to a recent meeting of the Computer and Communications Industry Association, and is an updated version of testimony I gave to the Senate commerce committee earlier this year. Postscript is at ftp://ftp.research.att.com/dist/mab/policy.ps ASCII text is at ftp://ftp.research.att.com/dist/mab/policy.txt -matt

1 0