December 2003 - cypherpunks-legacy

WIP_out
by John Young 17 Dec '03

17 Dec '03

12-21-96. NYP: "Global Agreement Reached To Widen Law On Copyright" On-Line Material: International law would specify that copyright protection includes the right to control the on-line distribution of copyrighted materials, as well as the right to prevent others from making unauthorized copies. "Fair use" -- the tradition of allowing individuals to make a limited number of copies for noncommercial purpose, or to use brief excerpts in news reports or artistic criticism -- would still apply in cyberspace. In a compromise meant to defuse one of the harshest criticisms of the treaty, negotiators agreed to delete language that would have treated even temporary copies of material downloaded from the Internet as possible violations of international copyright law. ----- WIP_out ---------- WIPO on the Web: http://www.wipo.org

1 0

Security hole in premail
by Mixmaster 17 Dec '03

17 Dec '03

There's a pretty nasty bug in premail that allows any non-root to obtain the contents of the premail secrets file. This is a race condition that can be exploited because an indefinite amount of time can pass between the time that premail checks if the secrets file exists and when it tries to write to the file. It can be exploited as follows: attacker: $ umask 111 $ ln -s ~/premail-secrets-file /tmp/.premail-secrets.$< normal user: $ premail -login Remember to logout when done. Your premail passphrase, please: All the attacker has to do is execute "touch premail-secrets-file" between the time that the user is prompted for the passphrase and the time when the login is completed. $ ls -al premail-secrets-file -rw-rw-rw- 1 d00d nogroup 19 Dec 20 19:01 premail-secrets-file $ cat premail-secrets-file [contents of premail secrets file] This bug can be fixed in two ways. One way is to set the premail-secrets setting to some non-world-writable directory. The second way is to apply the following patch: *** premail.orig Fri Dec 20 18:46:01 1996 --- premail Fri Dec 20 18:55:54 1996 *************** *** 3574,3579 **** --- 3574,3582 ---- } for ($triesleft = 2; !$done && $triesleft; $triesleft--) { $pass = &getpass ($x); + if(!-O $ps) { + &error ("Secrets file exists and is owned by another user\n"); + } $status = &decrypt_secrets ($ps_pgp, $ps, $pass); if (!-s $ps) { unlink $ps; } $done = (!$status && -e $ps);

1 0

Re: Credentials without Identity--Race Bits
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

aaron(a)herringn.com wrote: >Flew down to LA recently with a firearm (checked, of course). > >Looking over the ticket later, I was mildly surprised to find "GUN" in >a string of otherwise unintelligible text. This is a case of damned if you do, damned if you don't. The last time that I declared (as the legal notices at the check-in podium admonished me to do) a firearm in my luggage, my bag sported a large, chromium yellow GUN tag that also featured a graphic representation of a pistol (I guess for baggage handlers who can't read, or can't read English, and would still like to take advantage of one of the perks of their position).

2 1

Re: "Cypher punks'" sexual preferences
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

> Bruce Schneier <schneier(a)counterpane.com> writes: > > > John Gilmore just called me. > > Is Bruce gay? Bruce has a very strange look in his eyes. Perhaps he never has sex with anyone. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

3 5

Re: Executing Encrypted Code
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-20 19:54:09 EST, ph(a)netcom.com (Peter Hendrickson) writes: << > I believe this is a pipedream. As it stands now, virtually all of the > software that requires special hardware dongles is ridiculously expensive, > even compared to similar offerings from other companies. >> Well.... it seems to me that if the software is going to be so expensive.. that would THEN motivate to put dongles on.. seeing as these are the hardest to crack.

1 0

RE: Life with Dale
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May [.....]what was left of her [is] rotting in a grave somewhere north of me. ....... [...] interestingly, the Cypherpunks had a big beach party between Pescadero (where Dubroff lived) and Half Moon Bay (where she flew out of) just a couple of days prior to her departure. (This was the beach party put together by Doug Barnes, last spring.) ....................................................... Coincidence? .. Blanc <g> > > > >

1 0

Dale defends free society from the NSApunks (was Re: Encryption ?
by nobody＠replay.com 17 Dec '03

17 Dec '03

I thought this was so funny I've saved it. Perhaps we could vote on the quality of Dale's ideas and arrive at an estimate of the proportion of NSA supporters on the list. THE AKOND OF SWAT :Date: Thu, 19 Dec 1996 07:36:03 -0800 :From: Dale Thorn <dthorn(a)gte.net> :To: SHARK <otaner(a)boun.edu.tr> :Cc: cypherpunks(a)toad.com :Subject: Re: Encryption ? : :SHARK wrote: :> :> I am a Mathematic student at Bosphorus University in Turkey. :> I am interested in both computer applications and mathematical base of :> encryption.Where can I find this kind of staff on internet. :> Is it necessary to have high level of mathematical background in order to :> deal with encryption?? :> :> By the way Is there any member of this list from Turkey? : :There are a lot of NSA people here on cypherpunks, and they try very :hard to control encryption, to make everyone think it is difficult, to :discourage independent inquiry. : :That is the main reason they accuse people of being snakeoil vendors, :to discourage people from inquiring about really new ideas, like some :of my ideas for example. : :Just so you know....

3 2

Re: FWD: PGP-fone Mailing List Archive
by Bill Stewart 17 Dec '03

17 Dec '03

>reachable off the PGP Fone Registry, but the exact URL is : > http://pgp.rivertown.net/pgp-fone/archives Actually seems to be http://pgp.rivertown.net/pgp-fone/archive/ # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Credentials without Identity--Race Bits
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:34 AM 12/20/96 -0800, Tim wrote: >At 1:22 AM -0800 12/20/96, Vangelis wrote: > >Umm.. tried to get on a flight without having ID lately? Doesn't work - > >against policy. Anti-terrorism policy and all.. it's for your own > >safety, of course. >At the risk of undercutting Bill's facetiousness, this was of course >precisely his point. Yeah. I've spent most of this year going around North America on airplanes a couple of times a month. Sometimes they insist on government ID, claiming (falsely) that it's a government regulation. Other times they insist on photo ID (probably correctly) claiming it's a government regulation (usually I fly electronic-ticket, which they ask for photo-ID for, and I don't mind that.) United is almost always satisfied with my employee-ID and the credit card I used to buy the ticket with, except that they don't bother telling curbside baggage-handlers that. And that's not even counting the "You must turn on your laptop" crap. And it's PRO-terrorism policy "Be afraid! Be very afraid!" It's just not something a civilized place would do. (Of course now that Ted "Accused Unabomber" Kaczynski is in jail, the Olympics are over and it's pretty obvious that TWA 800 exploded due to bad design//////////natural causes, they really _ought_ to either give our civil rights back or else find some other excuse for it, like "heavy Christmas traffic is an attractive target". But instead they've got announcements about "suspicious packages should be reported to security checkpoints immediately" and "cars parked in the Red Zone will be towed away and detonated".) At least they weren't doing most of this paranoia when I visited my sister earlier this summer, bringing a couple pounds of Silly Putty in my luggage as presents for her kids, packed near the alarm clock.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1

Instruction Sets which are tough to emulate
by ph＠netcom.com 17 Dec '03

17 Dec '03

I'm guessing there are a bunch of ways to make a processor hard to emulate. For instance, you can make the registers 65 bits wide. Can anybody think of some more? Peter Hendrickson ph(a)netcom.com

2 1