December 2003 - cypherpunks-legacy

RE: permanent invasion of privacy
by blanc 17 Dec '03

17 Dec '03

From: attila In his Society essay, Lykken writes, "I will testify in support of a parental licensure bill to be introduced at the next session of the Minnesota State Legislature. ........................................................... Someone needs to remind this Senator Lykken what happened in Romania, when the beleaguered citizen-units finally took their 'noble', social engineering leader Ceausescu, put him up against a wall and shot him. History could repeat itself. Ah well, but really the most that this proposed bill would accomplish would be a lot of discussion and a lot of attention being brought to the general awareness about where individuals stand relative to their *elected* government (in 4 years - out!). Can you imagine the usenet discussions . . .all over the world. You know, he could be doing everyone a favor by inciting fury in the savvy masses who would, in the process of complaining, educate the ignorant ones about the ethics of social engineering and the precautions against it, as well as about the character of people like this Senator. A problem can be an opportunity in disguise! .. Blanc

3 2

Re: Maybe the CypherPunks *do* have some heart
by Mark Neely 17 Dec '03

17 Dec '03

Just a quick note to say that Houghton-Mifflin has posted a request for people to _STOP_ emailing them! This wasn't a hoax, but they have reached their email target numbers > The Houghton-Mifflin Publishing Co.. is giving books to children's Mark Neely - accessnt(a)ozemail.com.au Lawyer, Internet Consultant, Professional Cynic & Author BizWeb: For Serious Intrepreneurs - www.maximedia.com.au/bizweb

1 0

Re: Hard to Tax Scenario
by reinhold＠world.std.com 17 Dec '03

17 Dec '03

Re: Hal Finney's exegesis on Robin Hanson's scenario of Ann, virtual MD >On the other hand, if tax evasion is nearly universally practiced, >perhaps there are strong cultural pressures against turning someone in. > On the contrary, in a world of anonymous payments and nyms, there is a significant value for connecting nyms and true names and, hence a thriving market in any information that might lead to a connection. Bounty hunters maintain an ongoing lifestyle analysis on every true person. Hot lists of people whose visible consumption and reported work don't jive circulate widely. Ann can't walk down the street in a new pair of shoes without 5 people sending in an mpeg to claim the micro-payment. And she lives in terror as she watches the offer price for info about her rise. By the way, as a covert MD with a receptionist cover, whom does she date? Arnold Reinhold

2 1

The Complete, Unofficial TEMPEST Information Page
by Joel McNamara 17 Dec '03

17 Dec '03

Everything (well almost everything) you ever wanted to know about TEMPEST but were afraid to ask. Research papers, links to TEMPEST hardware manufacturers and consultants, military security manuals, monitoring devices, history, and more. http://www.eskimo.com/~joelm The page is devoted to presenting open-source information about TEMPEST and related topics. There is actually quite a large body of unclassified information available about this subject (much of it on the Net). My goal is to provide a useful reference for those interested in emanations security as it relates to intelligence, computer security, and privacy issues. Joel McNamara joelm(a)eskimo.com Disclaimer: I've never been involved with the TEMPEST community, had a security clearance for TEMPEST, or have access to classified material relating to TEMPEST. Like most good intelligence gathering, the information on the above-mentioned page is completely derived from publicly available, unclassified sources.

1 0

RE: Securing ActiveX.
by Blake Coverett 17 Dec '03

17 Dec '03

In response to my questioning why one would want to run an ActiveX control in a sandbox Ray writes: > To prevent ActiveX controls from formatting your hard drive while still > being able to run native code to do fast DES cracking, why else? > Sandbox!=Virtual CPU emulator. Sandboxes work at the supervisor/user CPU > level deciding which calls are cool and which will result in a core dump. I would be happier running an ActiveX control with Peter Trei's signature on it than I would an unsigned control in a sandbox. (This kind of a trust decision is probably the normal case in the intranet world. ActiveX as it sits is quite sufficient for rolling out internal intranet applications.) On the second point, I never suggested that a sandbox would require virtual CPU emulation. What I do find likely is that the overhead from the extended types of checking the kernel would need to do would probably outweight the performance advantage of native code over a JIT compiler. The DES cracker is probably not a good example of the problem because it would make virtually no API calls. > Viruses can sneak into software. Given enough time you will see them > sneak into compilers which will then happily create virus infected or > trojan loaded controls which will be happily signed. I'll leave the test > of that scenario up to your imagination. There were cases of viruses > making their way to production distributed disks back a few years ago > because people weren't watching carefully enough. This is scaremongering. No, I don't virus scan every new CD I get from Microsoft/Netscape/etc, do you? More importantly to the discussion at hand, what is to prevent said virus from infecting the compiler used to build the sandbox? Part of the decision to trust a software vendor must include trusting that they use appropriate clean build procedures. > Or you may find that shareware control authors won't bother to sign their > controls, etc... Same situation. At some point trust or no trust, once > your hard drive is wiped, so is the record of the signature that says "The > last control you downloaded came from XYZ.com and was written by Vulis." If you choose to run an unsigned control all bets are off. On a related note, I recently saw a Java implementation of a board game that recommended the user download the zipped up .classes and run it locally. How many average users realize this would disable the Java sandbox entirely? > > An equivalent Unix problem would be to allow an open-access guest > > account with the ability to transfer in and execute arbitrary binaries. > > While doing this securely may be possible in theory I don't think the > > state of the art is up to it today. (I sure wouldn't allow it on my system.) > > Right, so if that's the case, why would you allow ActiveX controls to run > on your system? It's the same problem whether signed or not as > signatures only tell you the author's identity and not much else. You mis-read the paragraph above. Trying to build the sandbox for native code as you've described is akin to the problem above. Is it not? regards, -Blake

4 3

Re: Securing ActiveX.
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Bill Frantz <frantz(a)netcom.com> wrote in article <59721c$t8o(a)life.ai.mit.edu>... > At 7:19 AM -0800 12/17/96, Blake Coverett wrote: > >I would be happier running an ActiveX control with Peter Trei's signature > >on it > >than I would an unsigned control in a sandbox. (This kind of a trust decision > >is probably the normal case in the intranet world. ActiveX as it sits is > >quite > >sufficient for rolling out internal intranet applications.) > > While I might agree about Peter, I wouldn't agree if the signature was > Microsoft's (or any other large software vendor). There is just too much > room for bugs and or Trojan horses to enter via that route. I fail to see what the fuss is about. there are clearly advantages to having a good operating system architecture which provides protection for running applications and allows fine grained control over access to sensitive resources. The problem with the Java Sandbox model is that its all or nothing. In order to protect the user it allows the applet access to nothing that is important. As a result the applet can perform no function that is of importance. "Give us your corporate strategy and billing record and we will give you dancing beans on your screen" as one wag put it. I am still waiting to see a Java applet that does anything usefull. Most do no more than an animated gif would. The most elaborate are little more than carbon copies of the standard computer games. The download problem really is not that hard. The big problem is content. So far nobody appears to have the remotest idea how to use Java and I expect it to be about five years before the model emerges. From hypercard to the Web took ten so don't expect it to be overnight. The Microsoft bashing could be given a rest. Bill G. wins only because the rest of the market gave up. Stick a non computer litterate person in front of UNIX, Lotus 1-2-3 for MS Dos or Wordperfect for MS-Dos. If you don't realse then why Bill won you should try another career. MS-DOS and Windows are crappy O/S because they lack the type of memory protection that VMS and UNIX have. This was in part incompetence but mostly Intels disastrous design for the 80286. Meanwhile Apple managed to produce an inexcusably bad O/S without protection on a chip that had excelent provision for it. If you want your applet to do anything of use then the Java security model is inadequate. It is usefull for the software developer to have a rich security model since it makes it much easier to build secure software. Under VMS there are 32 different priviledges allowing fairly fine grained control. It is possible in some cases to access a wider range of resources by nafarious tricks but its hard to do something bad by accident. Phill

1 0

UNIX crypt
by Anne Carasik 17 Dec '03

17 Dec '03

I'm sure this has been discussed before, but this has come to mind recently. Has UNIX crypt been broken? If so, what was used to break the encryption? Are there any documented cases of it? Thanks for your help, AC --------------------------------------------------------------- /_ __ / Anne Carasik / Professional Services Organization / / /_/ / TN 919.460.2368 / Raleigh Sales Office / / Fax 919.460.2249 / stripes(a)m3142axc.ssr.hp.com All opinions expressed are mine, no one else would want them

1 0

Van Eck's TEMPEST Paper
by John Young 17 Dec '03

17 Dec '03

As a supplement to Joel McNamara's exemplary new TEMPEST page, and thanks to Steve Schear, we've put Van Eck's 1985 paper on TEMPEST at: http://jya.com/emr.pdf (702 kb) It's a finely detailed paper on EMR snooping with copious graphics. As Joel and Seline note, it may be purposely misleading on TEMPEST, (as appropriate to TEMPEST legends; Seline's may be bent as well, but who knows what the disinfoes know). Read Joel's page for the bright light facts.

1 0

Microsoft IE may not work without censorship files
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thought you'd find this amusing. Some names may have been changed to protect the innocent. - -rich - ---------- Forwarded message ---------- Date: Tue, 17 Dec 1996 15:24:36 -0800 From: Alice D'Anonymous <> To: win95netbugs-owner(a)lists.stanford.edu Subject: Inernet Eplorer I reqiure assistance in obtaining my internet explorer connection. I made an error while deleting cache, history and temp files which somehow prevents me from hooking up to Microsoft's Explorer. In the control panel I attempt to click on the Internet Icon and the following occurs: A Content Advisor box appears and states the following: Content advisor configuration information is missing. Someone may have tried to tamper with it. Check content Advisor Settings. End of quote. In the internet properties box, I tried to look for what they recommended but was not sure what to look for. I have the Windows 95 disk. Could you please advise accordingly. P.S. Netscape works fine. I previously had Internet Explorer woking before I cleaned house. Thanks... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMrcuKZNcNyVVy0jxAQF7dgH+JZt25esoFtkgsVx/p6iRJkvQVvkYpSDr OKoAL4PB01++okGIKOCGPdWC+Uxs9cQJTX+4ZW/8CTN5aHX/D2glmg== =qsrc -----END PGP SIGNATURE-----

1 0

Re: Ping of Death?
by ! Drive 17 Dec '03

17 Dec '03

read about it here http://www.sophist.demon.co.uk/ping/ At 02:39 PM 12/17/96 -0700, you wrote: >Anyone heard of the Ping of Death, aka the Ping Bomb. It's a large chunk of >hostile code, disguised as a mere ping, that can lead to server rebooting. > >James Glave > >Technology Assignment Editor, Wired News, http://www.wired.com/ >Producer, Packet, http://www.packet.com/ >Phone: 1.415.276.8455 >Fax: 1.415.276.8499 ------------------------------------ pgp KeyID 3D932EA9 pub key available via mailto:pgp-public-keys@keys.pgp.net subject: get drink(a)aa.net

1 0