December 2003 - cypherpunks-legacy

cash machine PINheads (fwd)
by Petro 17 Dec '03

17 Dec '03

------- start of forwarded message ------- Path: news.suba.com!feeder.chicago.cic.net!wolverine.hq.cic.net!news.neca.com!news.shkoo.com!news1.mpcs.com!hammer.uoregon.edu!arclight.uoregon.edu!news.bbnplanet.com!su-news-hub1.bbnplanet.com!csn!nntp-xfer-1.csn.net!news.hemi.com!news From: Tkil <tkil(a)scrye.com> Newsgroups: alt.sysadmin.recovery Subject: cash machine PINheads Date: 16 Jan 1997 11:27:04 -0700 Organization: Scrye.com Lines: 59 Sender: tkil(a)creepy.scrye.com Approved: yup. Message-ID: <m3680xfpc7.fsf_-_(a)creepy.scrye.com> References: <E3KH0p.55F(a)xcski.com> <5bh6ke$5rr(a)illuin.demon.co.uk> <5bhhd5$dfv$1(a)comet3.magicnet.net> <spberry.853431573(a)endeavor.ansci.iastate.edu> NNTP-Posting-Host: ppp2.hemi.com X-Attribution: Tkil X-Newsreader: Red Gnus v0.80/Emacs 19.34 found in <URL: http://axion.physics.ubc.ca/atm.html>: A number of security systems were developed, of which two captured most of the market. These were the IBM system, launched in 1979; and the VISA system, which extended it and was introduced shortly afterwards. These systems relate the PIN to the account number in a secret way. The idea is to avoid having a file of PINs, which might be stolen or copied. and to make it possible to check PINs in the ATM itself so as to allow transactions when it is not online to the bank's central computer site. The definitive reference is Meyer and Matyas' huge book Cryptography: a new dimension in computer data security; there is a shorter account in Davies and Price Security for Computer Networks. PINs are calculated as follows. Take the last five significant digits of the account number, and prefix them by eleven digits of validation data. These are often the first eleven digits of the account number; they could also be a function of the card issue date. In any case, the resulting sixteen digit value is input to an encryption algorithm (which for IBM and VISA systems is DES, the US Data Encryption Standard algorithm), and encrypted using a sixteen digit key called the PIN key. The first four digits of the result are decimalised, and the result is called the `Natural PIN'. Many banks just issued the natural PIN to their customers. However, some of them decided that they wished to let their customers choose their own PINs, or to change a PIN if it became known to somebody else. There is therefore a four digit number, called the offset, which is added to the natural PIN to give the PIN which the cusomer must enter at the ATM keyboard. and from <URL: http://catless.ncl.ac.uk/Risks/14.76.html>: *The Risks Digest Volume 14: Issue 76* [...] How is it possible to use an EXPIRED card to make $8000 in cash advances? It's possible because the ATM's verification center ONLY checks if the card number is on a list of STOLEN/LOST cards. If the card is not stolen/lost, the verification center then performs a verification check of the information FROM THE CARD ITSELF, not from some other database. So the perpetrators just wrote a new expiration date on the magnetic stripe of their fake card; the ATM verification center verified that the date hadn't yet passed and that was that. my apologies for the useful info, but the "yes it is" "no it isn't" bit was getting even more irritating. both of these items have quite a bit more text to them that makes for interesting reading -- i just excerpted the bits that dealt with where the PIN was verified. t. -- Tkil <tkil(a)scrye.com> emacs evangelist, hopelessly hopeless romantic "Like brittle things that break before they bend" -- The Sisters Of Mercy, _Floodland_, "Driven Like The Snow" [1987] ------- end of forwarded message ------- -- ***************** PLEASE TAKE NOTE: In an effort to reduce the amount of junk mail that I receive, I am no longer reading email sent to petro(a)suba.com. send email to login(a)encodex.com where login = petro. You send unsoliciated commercial email, and I will kill you.

1 0

RE: Newt's phone calls
by Internaut 17 Dec '03

17 Dec '03

>What does concern me is personal privacy. I don't want people tracking >my movements or purchasing patterns, so I prefer to use cash or >pseudonymous debit cards. How pseudonymous are debit cards? Don't they go through visa before they debit your account? --Internaut

8 18

Jewish English: Hebonics
by BJORN2LUZE＠prodigy.com 17 Dec '03

17 Dec '03

------- http://pages.prodigy.com/VT/ look for the most updated link there... ------- If you have already read this, I suggest you PRINT IT this time and delete it. If you HAVEN'T READ IT YET. Make a copy and post it on some other mailing list. Read on... Wyane. - >>Jewish English or "Hebonics" >> >>The Encino School Board has declared Jewish English a second language. >>Backers of the move say the district is the first in the nation to >>recognize Hebonics as the language of many of American Jews. Here are >>some descriptions of the characteristics of the language, and samples >>of phrases in standard English and Jewish English. >> >>Samples of Pronunciation Characteristics >> >>Jewish English or "Hebonics" hardens consonants at the ends of words. >> >>Thus, "hand" becomes "handt." >> >>The letter "W" is always pronounced as if it were a "V". Thus >>"walking" becomes "valking" >> >>"R" sounds are transformed to a guttural utterance that is virtually >>impossible to spell in English. It is "ghraining", "algheady" >> >> >>Samples of Idiomatic Characteristics: >> >>Questions are always answered with questions: >> Question: "How do you feel?" >> Hebonics response: "How should I feel?" >> >>The subject is often placed at the end of a sentence after a pronoun >>has been used at the beginning: "She dances beautifully, that girl. " >> >>The sarcastic repetition of words by adding "sh" to the front is used >>for emphasis. >> >> mountains becomes "shmountains" >> turtle becomes "shmurtle" >> >> >>Sample Usage Comparisons: >> >> Standard English Phrase Hebonics Phrase >> >> "He walks slow" - "Like a fly in the ointment he walks" >> >> "You're sexy" - (unknown concept) >> >>"Sorry, I do not know - "What do I look like, a clock?" >> the time" >> >> "I hope things turn - "You should BE so lucky" >> out for the best" >> >>"Anything can happen" - "It is never so bad, it can't get worse" Interesting? Sorry, I wasn't the one who wrote this.. It's just interesting to me. Nathan

2 1

Re: Enough is Never Enough -- pro-CDA alliances, from TNNN
by Sir Robin of Locksley 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > > >---------- Forwarded message ---------- >Date: Fri, 17 Jan 1997 18:04:35 -0800 (PST) >From: Declan McCullagh <declan(a)well.com> >To: fight-censorship(a)vorlon.mit.edu >Subject: Enough is Never Enough -- pro-CDA alliances, from TNNN > >[Attached are two excerpts from the article. For the rest, check out: >http://cgi.pathfinder.com/netly/textonly/1,1035,549,00.html --Declan] > >******** > >The Netly News Network >http://netlynews.com/ > >Enough Is Never Enough >By Declan McCullagh (declan(a)well.com) >January 17, 1997 > > A broad coalition of conservative and anti-pornography groups and > individuals will file legal briefs next Tuesday in the Supreme Court > supporting the government's defense of the Communications Decency Act, > The Netly News has learned. > > The alliance includes longtime supporters of the act, such as > Enough is Enough, Focus on the Family, and the National Association of > Evangelicals. Members of Congress will join a separate brief that the > National Law Center for Children and Families is preparing. > > But a letter from the attorney representing the coalition asked > the ACLU for permission to file a brief "on behalf of" 59 plaintiffs, > including such unlikely participants as the National Association for > the Advancement of Colored People, PBS, SafeSurf... and Netscape. > > Netscape? The company that lobbied against the CDA? A firm with a > reputation of putting their balls on the chopping block when fighting > for Net-issues on Capitol Hill? Netscape was as shocked as I was to > learn about their participation. "It wasn't authorized by me or my > office. This is flabbergasting," Peter Harter, public policy counsel > for Netscape, said. "I'd be crucified if this happened." > >[...] > > In their brief, which argues sociological rather than legal > points, the groups hope to highlight the "dangers" of pornography > online. They plan to supply the court with "legislative facts" to > support the position Congress took when crafting the bill. The > document also will include statistics discussing the effects of the > Internet on children and the availability of material covered by the > law. (Marty Rimm, where are you now?) > > Donna Rice-Hughes from Enough is Enough says: "It discusses three > primary areas of our concern: letting the court know the problems on > the Internet. Adult pornography, indecency, and child porn as well. A > section on the harms of pornography. And a section dealing with the > compliance issues: Is it feasible technically to comply with the CDA?" > Stuff like this makes me sick. What the hell is up with these people!? You offended me so you must leave. Well, excuse me, there is a reason internet addresses have a WWW URL. It stands for World Wide Web and as such encompasses the world. If there is stuff in the world that offends someone, don't look! But to tell everyone else that they can't either since some were offended, that is a starting point for cencorship. Now it's porn, tomorrow it's you saying what you beleive (that might also be the truth...) If one is offended by something, don't look! How come Catholicism doesn't get banned and outlawed? Hell, it offends me... Guess not people! >[...] > > Chris Stamper and Noah Robischon contributed to this report. > -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMuBpXKr5aWnB1HshAQEm0QgAwnTz+xjtVKCVNgA0/L5hkqBALubqySM3 zzZlifGue1tq9puyPFEvaPSgRuRWcZSJN9BOYXAVd/kMnMiGwlvV2mAFjGiOCl2W sPu5tUEC01V77l/egifYp8CvVGjsaZRBiQ5Ia0e5kqM/kd6/gxcbcRk69/3kpCQX E2CCHCMZS+aW/HOl2HhX2k8t8oVVAGLoJFkaNV5WEc33N5XMv7URTBpx07NH8nmc EjNpbroXl2LwqakAWleEFbr+eBQLJOPa43CKbRha6Dxop+LaaQrMBgihnHdD410P 6g0SgX0dJup9LTYryF3Ig30tUl/uJPdhg2TpjRw+/bom2v1m4iRZHg== =vZqM -----END PGP SIGNATURE----- Gabor K. Tozser (Gabe)

3 2

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Timothy May's obsessive masturbation has lead to advanced degree of blindness and hairy palms. ___ \/ \/ |_O O_| Timothy May | ^ | / UUU \

3 2

RE: Airport security [no such thing]
by Internaut 17 Dec '03

17 Dec '03

snow wrote: > I say we make people fly naked and ship their stuff via UPS ;). >>shudder<< No!. A clear case of the cure being worse than the disease... I was just kidding. We do have to take on risks, like people wearing clothes, carring packages, ect. As Igor Chudov @ home wrote recently in the Newt's phone calls thread: > I would not be worried about this issue at all. The world at large is > insecure in very many respects: it is easy to find out credit card > numbers, overhear conversations, install hidden microphones, hack > into computers, etc etc. It does not mean that we should stop all > activity simply because there is "some" risk of losses. We have two seemingly conflicting desires: the desire for security and the desire for privacy. I do not call being searched "privacy" yet I do not call not being searched "security". We need to find creative resolutions to these conflicts. Of course, it is debatable if there is even an expectation of privacy on an airplane. I don't mind terrably being searched in an airport by security because I don't expect the privacy. I expect security. I don't want to die. If I have things I don't want them to see, there are other ways to get it there. I would worry if they cataloged what I had in a database and sold it to others. The service is just that -a service. It is not a right. We can travel other ways, too. My late night ramblings cease, Internaut

1 0

1997 Mac Crypto Conf registration
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: mac-crypto(a)thumper.vmeng.com Reply-To: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> Mime-Version: 1.0 Precedence: Bulk Date: Tue, 14 Jan 1997 11:33:11 -0800 From: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> To: Multiple recipients of <mac-crypto(a)thumper.vmeng.com> Subject: 1997 Mac Crypto Conf registration -----BEGIN PGP SIGNED MESSAGE----- hey all; I have posted a registration webpage for the 1997 Mac Crypto Conf at http://www.vmeng.com/mc/conf.html If you plan to give a talk there, I am looking for abtracts by end of Jan thanks Vinnie Moscaritolo http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A - ------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: Pretty Safe Mail 1.0 iQCVAwUBMtvcsfMF2+rAU+UdAQFOogP/R1/WmmAi3oEgLsC1il1OKf+7jR9j4L5U tAvhZIB6nyYpuHdP1fZ+/KfyCi4fYDmHIO4wVJo1BfbUtYL0YkIqzw/00JM8zfHR Zm9pcjSo70EDZPuypYyH+t0RlXJZj1eU0KjhAtRGeeWxAhP686wWCvz8hW4f2VfX uiLObXiqXiw= =faEk -----END PGP SIGNATURE----- --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://offshore.com.ai/fc97/ "If *you* don't go to FC97, *I* don't go to FC97"

1 0

Re: Get me off this fucking list, or else.... (fwd)
by Bill Stewart 17 Dec '03

17 Dec '03

Either a) You don't follow directions very well (since you're still on the list, and since the software works just fine for people who can follow directions or consider spelling to be unimportant), or b) The mailing list daemon is broken (happens sometimes, but usually that gives you no traffic), or c) The mail you're sending doesn't have your correct headers on it (e.g. looks like it's from res(a)pc43.unidyne.uni.pt instead of res(a)unidyne.uni.pt) in which case you may need human help, or d) Somebody doesn't like you and subscribed you to the list because it's well-known to be a high-volume mailing list, and they keep subscribing you after you unsubscribe, in which case harassing the 1300+ people who _do_ want to be on the list is not a good thing to do. So send mail to majordomo(a)toad.com, saying "help" and RFTM. At 04:31 PM 1/17/97 +0000, Rodrigo Espirito Santo wrote: > > >---------- Forwarded message ---------- >Date: Fri, 17 Jan 1997 16:30:25 +0000 (GMT) >From: Rodrigo Espirito Santo <res(a)unidyne.uni.pt> >To: cypherpunks(a)toad.com >Cc: cypherpunks(a)toad.com >Subject: Get me off this fucking list, or else.... > >Hey you dumb asses, i tried to unsubscribe this list in the correct way >but you guys don't know SHIT about this!!!!1 >If you don't get me out now i'll subscribe each and every one of you to >some goddamn gay and lesbiann and freak mailing list!!!!!! >get me out!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > > > > # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1

Re: National Security State has different standards for 'them' and 'us'
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:48 PM 1/16/97 -0500, Brad Dolan wrote: >I was distracted a bit but I believe I heard on NPR news this morning that >Colorado Guv. Roy Roemer showed up at an airport sans id and had a moment >of difficulty getting on his flight. Roemer solved the problem by showing >the Federal Permission-To-Fly checker a picture of himself in a recent >newspaper. >I thought the ill-defined (or ill-described) rules required presentation >of a _government_ picture I.D. Since when is a newspaper photo a >government picture I.D.? No, they don't, though the airlines like you to think that since it simplifies their life and it's something they can tell $5/hour bag checkers as well as higher-paid gate agents. There is no national rule that applies to everybody requiring it; each airline apparently has to negotiate with the FAA to make sure they're doing a "reasonable" job of identifying their passengers. The airline is free to make whatever rules they want. On United, I normally use my employee ID and the credit card I use to buy the electronic-ticket, which verifies reasonably well that I'm the person the ticket was bought for (by the people who told the airline they're my employer's travel agents.) If the _government_ required _you_ to have government ID, there'd be serious Constitutional problems with it; regulating interstate commerce and air traffic safety by forcing the airlines to do something they'd kind of like to do anyway doesn't have the same problems, even though it's almost _more_ offensive to a free society. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: IMDMP: SOURCE CODE RELEASE ANNOUNCEMENT
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> > I suppose you want a special censored list where everyone who uses > > the word "fuck" in relation to your good self or any other member of > > this list you agree with has their posting cut? > > No, I don't want censored anything. "Cypher punks" have degenerated into > a moderated forum where those who dare criticize His Royal Majesty John > the Cocksucker and his court are forcibly unsubscribed, while all sorts > of vile insults directed at John's many "enemies" are encouraged. I quite agree, there is something most definitely wrong with this whole situation, still, at least there are some crypto-relevant people on the "cryptography" mailing list. cypherpunks still has worthwhile nuggets on it but I must say the list has gone downhill sharply since the start of the censorship. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

8 18