December 2003 - cypherpunks-legacy

RE: Encryption to the poors
by Internaut 17 Dec '03

17 Dec '03

When you send spam to a list like this, you're kinda asking for it, aren't you? ---------- From: Fuck@yourself.up[SMTP:Fuck@yourself.up] Sent: Monday, December 16, 1996 07.35 PM To: cypherpunks(a)toad.com Subject: Encryption to the poors >To: cypherpunks(a)toad.com >From: Fuck(a)yourself.up >Subject: Encryption to the poors > >Hey, i can doit to... >RareTrip >-------------------------------------->>CLIP<<--------------- >begin 644 greets.com >MZPJ\3"<!40)2`98#OB8!B_Z+#@@!BQ8"`;AW`5#\K3/"JXO0XOA_R+8/>XT/ >M1XQW]#?&_D'\#TT,O5EX4\U\2(T/1XQ_]#^%K7]5@X4(__&!A@&4%7LJ14C1 >MWN^D>Z/9Y!C\43_,RS"R5JI(@ERBOU?^"/4G"@'KL`)-Z+!_-``N``!V`%P` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M``````````````````````"_:KW4:+S3"[GUK,(a)^GMM)2PCU4;N[^!MY.WDX >M>3A'\7022H4*2[_!('<KN[XZ>1IT,KFI"+N\3WEOOTR;:NFS3PY'N^/S49B[ >MWCIY&GD.>0Y!)RX'*Q\M'VD@=U:[PQMY.W0FN;T$N[!/>6^_!\HG^S**B5R[ >M6""_#L83>1V_"/GQ^<C&47E@>1]Y'WD8>1AY;E^97\PZ!"P?*1<O%VD@=RN[ >MOCIY&B:W7ZT.,;O'('D8#E.XIR._(<@,N[@Z>1IY;7EM#-@Z&`1=D@X`LG<: >M``````````````````````````````````!7:0D<-V]S```````````````` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M````ZE>_5KA6N,<%>O![L,00@V#58Q(1I+[3#@`_\LDK`.A9@;#XZ,8!OOSR >G6$NDN+L`N[D`N;H`NKT`O;X`OK\`OPX?``"RX4-!_[[X_A\JY]<` >` >end >-------------------------------------->>CLIP<<--------------- >

2 1

IMPORTANT: Changes affecting anon.lcs.mit.edu privacy
by lcs Remailer Administrator 17 Dec '03

17 Dec '03

I'm looking into reconfiguring anon.lcs.mit.edu (a.k.a. nym.alias.net) in ways that will improve performance and reliability. This could involve several changes (either temporary during testing, or even permanent) that might affect the privacy of users. I hope these changes won't affect people who use anon.lcs.mit.edu and nym.alias.net according to the instructions, but given the sensitive nature of anonymous services, I want to alert people of these changes to avoid any surprises. * 'Received:' headers may suddenly appear. Currently, anon.lcs.mit.edu does not add 'Received:' headers to any mail it relays or delivers to nym.alias.net aliases. Since the anonymous remailers mix(a)anon.lcs.mit.edu and config/send(a)nym.alias.net already strip header information upon receiving messages, this shouldn't really affect people unless they are telnetting to the SMPT port and forging E-mail. Such forgeries are not condoned by the administrators, anyway, and have actually not been much of a problem. If, however, you were somehow relying on anon.lcs.mit.edu's sendmail for "light" anonymity, you should start using real remailers before it's too late. Though I don't really mind suppressing Received: headers, this looks somewhat difficult to do with MTA's other than sendmail, so if sendmail gets junked, we may end up with something that adds Received headers. * SMTP destination statistics may be kept. Recent versions of sendmail (and other MTA's) can keep statistics on delivery to remote machines, to prevent blocking multiple times when sending mail to unavailable remote hosts. The information kept appears to be the name of each remote machine to which mail has been sent, and the last time at which an attempt to send mail to that host was made. Such information would not be backed up, and could potentially be purged daily. I understand this may cause concern. I welcome any feedback or suggestions on how to deal with this, either in sendmail or also qmail (which I'm thinking of switching to). The worst case scenario seems to be the case where anon is seized or stolen and someone discovers that your machine received a piece of mail from it. No information will be available about whether or not you ever sent mail to anon.lcs.mit.edu. This seems acceptable because if someone really needed to prove you had received a piece of mail from nym.alias.net, that person could already do so by tapping your network and sending you a message through nym.alias.net. Despite these changes, anon.lcs.mit.edu does not currently and will never keep any message-by-message mail logs. Sendmail currently runs at log level 1, which the documentation describes as logging only "Serious system failures and potential security problems."

2 1

RE: Encryption to the poors
by Mullen Patrick 17 Dec '03

17 Dec '03

Kinda cool. Seems like a pretty basic .ASM file, though (I'll have to see how to implement it tonight). Couldn't resist; I had to run it. It converts files into directories. Really outdated. My guess is its algorithm is to start at C:\ and go into each directory from "C:\A*" to "C:D*" and convert each file into a directory. Subdirectories are unaffected. Apparently, this is an attempt to overwrite you DOS directory. Too bad I'm running WinNT! :-) If I'm not mistaken, Win95 would be unaffected, as well. The only things of (little) value I lost were in my Borland C base directory. The file didn't even modify "C:\"! Gee, it's great when you get to run Trojan Horses because you know the company's IT dept. will clone you a new machine if you mess it up! ;-) Anyway. Now you all know what this does. BTW, for future reference, does anyone know of a way to convert the directories back to files? My guess is "no"... One more question. Not to spread (in)fame... Anyone know where I can find Skism? One mod greets did was create the directory "SKISM. ". Name sounds familiar, but not sure. PM ---------- From: Fuck@yourself.up[SMTP:Fuck@yourself.up] Sent: Monday, December 16, 1996 07.35 PM To: cypherpunks(a)toad.com Subject: Encryption to the poors >To: cypherpunks(a)toad.com >From: Fuck(a)yourself.up >Subject: Encryption to the poors > >Hey, i can doit to... >RareTrip >-------------------------------------->>CLIP<<--------------- >begin 644 greets.com >MZPJ\3"<!40)2`98#OB8!B_Z+#@@!BQ8"`;AW`5#\K3/"JXO0XOA_R+8/>XT/ >M1XQW]#?&_D'\#TT,O5EX4\U\2(T/1XQ_]#^%K7]5@X4(__&!A@&4%7LJ14C1 >MWN^D>Z/9Y!C\43_,RS"R5JI(@ERBOU?^"/4G"@'KL`)-Z+!_-``N``!V`%P` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M``````````````````````"_:KW4:+S3"[GUK,(a)^GMM)2PCU4;N[^!MY.WDX >M>3A'\7022H4*2[_!('<KN[XZ>1IT,KFI"+N\3WEOOTR;:NFS3PY'N^/S49B[ >MWCIY&GD.>0Y!)RX'*Q\M'VD@=U:[PQMY.W0FN;T$N[!/>6^_!\HG^S**B5R[ >M6""_#L83>1V_"/GQ^<C&47E@>1]Y'WD8>1AY;E^97\PZ!"P?*1<O%VD@=RN[ >MOCIY&B:W7ZT.,;O'('D8#E.XIR._(<@,N[@Z>1IY;7EM#-@Z&`1=D@X`LG<: >M``````````````````````````````````!7:0D<-V]S```````````````` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M````ZE>_5KA6N,<%>O![L,00@V#58Q(1I+[3#@`_\LDK`.A9@;#XZ,8!OOSR >G6$NDN+L`N[D`N;H`NKT`O;X`OK\`OPX?``"RX4-!_[[X_A\JY]<` >` >end >-------------------------------------->>CLIP<<--------------- >

1 0

Re: Blowfish Performance
by Andrew Loewenstern 17 Dec '03

17 Dec '03

dstoler(a)globalpac.com writes: > Encryption and decryption are faster than the fastest DES > implementation I've found, but the key expansion (subkey > generation) is slow. If you read the Blowfish design goals in Applied Cryptography you will find that it purposely has slow key expansion in order to hamper brute force cryptanalysis. andrew

1 0

Re: [NOT NOISE] Microsoft Crypto Service Provider API
by geeman＠best.com 17 Dec '03

17 Dec '03

Microsoft had to agree to validate crypto binaries against a signature to make sure they weren't tampered with, in exchange for shipping crypto-with-a-hole. They will sign anything (theoretically) if it has the export papers and all. Or without, if you affadavit it is not for export. They do not themselves impose any restrictions on crypto strength. I'm not expressing political position here, just conveying facts .... At 01:13 AM 12/18/96 -0500, Marc Horowitz wrote: >roy(a)sendai.scytale.com (Roy M. Silvernail) writes: > >>> I just got my copy of the Microsoft Cryptographic Service Provider >>> Development Kit, Version 1.0. It appears to support only Windows NT. A >>> first glance reveals no built-in GAK (but I haven't examined it closely >>> yet!). > >You're right, you haven't looked at it closely. Although it doesn't >have Key Escrow, new cryptosystems can only be added if they are >signed by a private key held by Microsoft. Of course, Microsoft has >agreed with the State Dept. to sign only export-"strength" crypto. > > Marc > >

1 0

RE: Securing ActiveX.
by John Fricker 17 Dec '03

17 Dec '03

>Ray Arachelian (sunder(a)brainlink.com) said something about Securing ActiveX. on or about 12/16/96 11:08 AM >On Sat, 14 Dec 1996 ichudov(a)algebra.com wrote: > >> Ray Arachelian wrote: >> > >> > Until Microsoft secures ActiveX in it's own sandbox and doesn't allow it >> > to access things it shouldn't, it's not cool. >> > >> >> I do not understand how one can secure ActiveX. > >Simple. Check out Windows NT, under NT you can write/run programs as >services which log in as an account. When you do this, that service >program is limited to the security restrictions of that account. Not exactly. Win32 API's include the ability for a program to impersonate any known user. Besides ActiveX (OLE really) has nothing to do with services. In order to make ActiveX secure there would need to be a virtual machine with access to a limitted API only. Sound familiar? > >If you're using the NTFS file system and give that account access only to >one directory, it can't access anything but that directory. (If you're >using FAT, this isn't true and the program can read/write/delete anything >it wants.) Works quite well. > >It can be done under 95 but Microsoft will have to write a Sandbox >Virtual Machine (a Virtual x86 session whose API's are filtered to >prevent access to certain things like the file system, and disables >direct I/O.) Not that easy under '95, but it already exists for NT. There is no such thing on WinNT. > >The problem is how to deal with DLL's. You don't know all >features/functions of all DLL's. It may be possible to write a DLL that >runs outside the sandbox and can act as a proxy to the file system, so >it's iffy unless you limit the DLL's and services that ActiveX apps talk >to, and make them all live inside the sandbox. > Why is that a problem? ActiveX components are shipped as discrete objects with a known DLL like interface. DLL's are unloaded when the load counter is zero so they don't hang around in memory after the ActiveX job is done. You also cannot write a "proxy to the file system" in a DLL. That's a special device driver called a filter. Of course there is this Mark Russinovich fellow that is showing how this is not exactly true. It is possible to identify all entry points in a DLL. --j -------------------------------------------------------------------- | John Fricker (jfricker(a)vertexgroup.com) | -random notes- | My PGP public key is available by sending | me email with subject "send pgp key". | www.Program.com is a good programmer web site. --------------------------------------------------------------------

2 1

UPDATE: Financial Cryptography 1997 (FC97), Anguilla, BWI
by Robert Hettinga 17 Dec '03

17 Dec '03

Financial Cryptography 1997 (FC97): The world's first financial cryptography conference, workshop, and exhibition. CONFERENCE UPDATE: December 13, 1997 (The Banker's Edition...) FC97 is sponsored by: The Journal for Internet Banking and Commerce <http://www.arraydev.com/commerce/JIBC/> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.vmeng.com/rah/> FC97 Conference and Exhibition, February 24-28, 1997 FC97 Workshop for Senior Managers and IS Professionals February 17-21, 1997 The Inter-Island Hotel Anguilla, BWI Conference Reservations: <http://www.offshore.com.ai./fc97/> As previously announced, the world's first peer-reviewed conference on financial cryptography, FC97, will be held Monday through Friday, February 24-28, 1997, from 8:30am until 12:30pm, at the Inter-Island Hotel on the Carribbean island of Anguilla. In conjunction with the conference, the Inter-Island Hotel will also be the site of an intensive 40-hour workshop for senior managers and IS professionals during the week preceding the conference (February 17-21), and an exhibition for financial cryptography vendors, from 10am-6pm during the week of the conference itself. The goals of the combined conference, workshop, and exhibition are: -- to provide a peer-reviewed forum for important research in financial cryptography and the effects it will have on society, -- to give senior managers and IS professionals a solid understanding of the fundamentals of strong cryptgraphy as applied to financial operations on public networks, and, -- to showcase the newest products in financial cryptography. In addition, plenty of time has been left open in the afternoon and evening for sponsored corporate functions and activities, for business networking, and, of course, for recreational activities on Anguilla itself. Conference participants are encouraged to bring their families. The Conference Ray Hirschfeld, the conference chair, has picked an outstanding group of professionals and researchers in financial cryptography and in related fields to review the papers for this conference. They are: Chairman: Rafael Hirschfeld, CWI, Amsterdam, The Netherlands Matthew Franklin, AT&T Laboratories--Research, Murray Hill, NJ, USA Michael Froomkin, U. Miami School of Law, Coral Gables, FL, USA Arjen Lenstra, Citibank, New York, NY, USA Mark Manasse, Digital Equipment Corporation, Palo Alto, CA, USA Kevin McCurley, Sandia Laboratories, Albuquerque, NM, USA Charles Merrill, McCarter & English, Newark, NJ, USA Clifford Neuman, Information Sciences Institute, Marina del Rey, CA, USA Sholom Rosen, Citibank, New York, NY, USA Israel Sendrovic, Federal Reserve Bank of New York, New York, NY, USA Some of the names may be recognizable to you. If they're not, included in that list are the inventor of Millicent, the project manager of EU's CAFE digital cash project, the holders of Citicorp's digital cash patent, two famous scholars in cryptography and digital commerce law, the President of International Association for Cryptologic Research, and the Chairman of the Taskforce on the Security of Electronic Money for the G-10 Central Banks. The actual agenda of the conference will be determined by the papers the program committee selects, so we won't have a final schedule for the conference until the middle of January. However, the conference committee is selecting papers in what it considers the union, and not the intersection, of the fields of finance and cryptography. The Final Call for Papers was issued a few weeks ago, and the submission process for papers is now closed. The committee chairman sends his thanks to all of you who submitted papers for consideration. Given the volume of submissions, and the quality of the authors, this inaugural conference should be a very interesting one indeed. To refresh your memory, the program committee solicited papers in the following topic areas: Anonymous Payments Fungibility Authentication Home Banking Communication Security Identification Conditional Access Implementations Copyright Protection Loss Tolerance Credit/Debit Cards Loyalty Mechanisms Currency Exchange Legal Aspects Digital Cash Micropayments Digital Receipts Network Payments Digital Signatures Privacy Issues Economic Implications Regulatory Issues Electronic Funds Transfer Smart Cards Electronic Purses Standards Electronic Voting Tamper Resistance Electronic Wallets Transferability Financial Cryptography '97 is held in cooperation with the International Association for Cryptologic Research. The conference proceedings will be published on the web by the Journal for Internet Banking and Commerce. <http://www.arraydev.com/commerce/JIBC/>. For further information on the submission process, which is, again, now closed, please see the program committee's web-page at <http://www.cwi.nl/conferences/FC97>. As we mentioned before, the conference will be covered by Wired Magazine, and will be the featured conference in it's January 1997 "Deductible Junkets" section. So, if you have already decided to come to FC97, please register and make your plane and hotel reservations as soon as possible. Conference, workshop, and exhibit space is extremely limited. Wired's January issue comes out near the end of December, and we expect there to be something of a rush at that time. The price of a pass to the conference sessions and exhibits is $1,000 U.S. You can pay for your FC97 conference ticket with Visa or MasterCard at the regstriation site: <http://www.offshore.com.ai/fc97/> The price includes breakfast at the conference, some stipends for presenters who need them, and the logistics of having a professional conference with high-bandwidth internet connectivity in a location like Anguilla. In looking around, however, the conference organizers *did* notice that FC97 price is in keeping with other business and professional technology conferences of similar total session length. You can register, and pay for, your conference ticket at: <http://www.offshore.com.ai/fc97/> The Exhibition Concurrent with the conference will be the the FC97 Exhibition, a small trade show for financial cryptography products and services. Each booth will have high bandwidth access to the internet, and will get 2 conference passes. Booth prices start at $5,000 US. Please contact Julie Rackliffe at <mailto: rackliffe(a)tcm.org> for further information . As space is limited, please register as soon as possible if you plan to be there. The Workshop We are especially honored to have Ian Goldberg as the leader of the FC97 Workshop, which will run one week prior to the conference, February 17-21, 1997. Ian, the cryptographer at Berkeley who was made famous last year (in articles in both the Wall Street Journal and the New York Times) for breaking Netscape's transaction security protocols, will be running an intensive, 5-day workshop for senior managers and technology professionals. Someone likened it to a financial cryptography "boot-camp". While the workshop is still being developed, and will depend on the skills of the planned participants, workshop topics will include, but not be limited to: Overview and background of cryptography Survey of existing and proposed Internet payment systems Details on some specific payment systems Issues involved in setting up a secure Internet site A step-by-step walkthrough of setting up an ecash-enabled Web server. Ian has recruited a strong roster of instructors with credentials similar to his own, and, as he plans to maintain a 5-1 student/teacher ratio, the size of the workshop will be restricted and advance registration will be required. Further information about the workshop can be found at: <http://www.cs.berkeley.edu/~iang/fc97/workshop.html> The planned price for the workshop is $5,000. This covers lab space, hardware, network access, software, and, of course, 40 hours of instruction and structured lab activity. The lab itself will be open 24 hours a day, if demand warrants it. Sponsorship Opportunities FC97 offers sponsorship opportunities at all levels. Corporations are encouraged to to be an exclusive sponsor for lunch or dinner, each of which will be followed by a recreational activity of some kind. Sponsors will have the opportunity to permanently attach their name to these networking functions, which the organizers hope will be a large part of the conference experience. There are 10 such events being planned, and 10 corporations will be accepted for sponsorship. Corporate sponsors of these events will also get a substantial initial discount on exhibit space, and complimentary conference tickets. In-kind sponsorship is also available at all levels of support, with opportunities for companies to provide networking, bandwidth, hardware, radio pocket modems and equipment, as well as design and print services, transportation, and other things. If you've got it and you think we'll need it, please contact us. The sponsorship contact is Julie Rackliffe <mailto: rackliffe(a)tcm.org>. Air Transportation and Hotels Air travel to Anguilla is typically done through San Juan, St. Thomas or St. Maarten/Martin. There are several non-stop flights a day from various US and European locations. Connection through to Anguilla can be made through American Eagle, or through LIAT. See your travel agent for details. American Eagle Airlines has agreed to increase their flights as needed to accomodate any extra traffic the conference brings to the island. Anguilla's runway is 3600 feet, with a displaced threshold of 600 feet, and can accomodate business jets. Obviously, you should talk to your aviation staff for details about your own aircraft's capabilities in this regard. Anguilla import duties are not imposed on hardware or software which will leave the island again, so, as long as you take it with you when you leave, you won't pay import duties. Hotels range from spartan to luxurious, and more information about hotels on Anquilla can be obtained from your travel agent, or at <http://www.offshore.com.ai/fc97/>. Registration for FC97 Again, to register and pay for your ticket to FC97 see: <http://www.offshore.com.ai/fc97/> For information the selection of papers for at FC97 see: <http://www.cwi.nl/conferences/FC97> If you're interested in Exhibit space, please contact Julie Rackliffe: <mailto:rackliffe@tcm.org> If you're interested in sponsoring FC97, also contact Julie Rackliffe: <mailto:rackliffe@tcm.org> If you're interested in the FC97 Workshop for Senior Managers and IS Professionals, see: <http://www.cs.berkeley.edu/~iang/fc97/workshop.html> That should be enough for now. Stay tuned for more information on FC97 as it develops. See you in Anguilla! The FC97 Organizing Committee: Vince Cate and Bob Hettinga, General Chairs Ray Hirschfeld, Conference Chair Ian Goldberg, Workshop Chair Julie Rackliffe, Conference, Exhibit, and Sponsorship Manager And our sponsors... The Journal for Internet Banking and Commerce <http://www.arraydev.com/commerce/JIBC/> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.vmeng.com/rah/> ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

RE: permanent invasion of privacy
by blanc 17 Dec '03

17 Dec '03

From: attila In his Society essay, Lykken writes, "I will testify in support of a parental licensure bill to be introduced at the next session of the Minnesota State Legislature. ........................................................... Someone needs to remind this Senator Lykken what happened in Romania, when the beleaguered citizen-units finally took their 'noble', social engineering leader Ceausescu, put him up against a wall and shot him. History could repeat itself. Ah well, but really the most that this proposed bill would accomplish would be a lot of discussion and a lot of attention being brought to the general awareness about where individuals stand relative to their *elected* government (in 4 years - out!). Can you imagine the usenet discussions . . .all over the world. You know, he could be doing everyone a favor by inciting fury in the savvy masses who would, in the process of complaining, educate the ignorant ones about the ethics of social engineering and the precautions against it, as well as about the character of people like this Senator. A problem can be an opportunity in disguise! .. Blanc

3 2

Re: Maybe the CypherPunks *do* have some heart
by Mark Neely 17 Dec '03

17 Dec '03

Just a quick note to say that Houghton-Mifflin has posted a request for people to _STOP_ emailing them! This wasn't a hoax, but they have reached their email target numbers > The Houghton-Mifflin Publishing Co.. is giving books to children's Mark Neely - accessnt(a)ozemail.com.au Lawyer, Internet Consultant, Professional Cynic & Author BizWeb: For Serious Intrepreneurs - www.maximedia.com.au/bizweb

1 0

Re: Hard to Tax Scenario
by reinhold＠world.std.com 17 Dec '03

17 Dec '03

Re: Hal Finney's exegesis on Robin Hanson's scenario of Ann, virtual MD >On the other hand, if tax evasion is nearly universally practiced, >perhaps there are strong cultural pressures against turning someone in. > On the contrary, in a world of anonymous payments and nyms, there is a significant value for connecting nyms and true names and, hence a thriving market in any information that might lead to a connection. Bounty hunters maintain an ongoing lifestyle analysis on every true person. Hot lists of people whose visible consumption and reported work don't jive circulate widely. Ann can't walk down the street in a new pair of shoes without 5 people sending in an mpeg to claim the micro-payment. And she lives in terror as she watches the offer price for info about her rise. By the way, as a covert MD with a receptionist cover, whom does she date? Arnold Reinhold

2 1