December 2003 - cypherpunks-legacy

Bulk e mail software
by info＠softcell 17 Dec '03

17 Dec '03

Please put remove in the subject and press reply if you do not want mail from us Would you like to bulk E-Mail without getting your service terminated? Get the software for FREE? And not send mail to people who do not want it? Just visit our web site located at. http://www.softcell.net

1 0

Re: another idea?
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> > How about, we have > > cypherpunks-raw: unmoderated 110% SPAM > > cypherpunks: moderated by Sandy and other moderator. > > That was the original proposal. > Now that the 'discussion' has come around full circle, can we > stop talking about it and DO it? Am I to presume that we will be putting something in the "welcome to cypherpunks" message people get when they join to tell them how to subscribe to the uncensored list? - or are we going to have yet more censorship on this list which is rapidly degenerating into a playground of illuminati and elite censors??? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

2 1

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Timothy `C' May is so full of shit that some of it bursts out on this mailing list. /\ /\ + \______/ + / . . \ < / > \ \--/ / ------

1 0

Re: Newt's phone calls
by jim bell 17 Dec '03

17 Dec '03

At 05:56 PM 1/14/97 -0500, Brad Dolan wrote: >Mmmm. I'm told that, on most cellphone calls, a scanner will present both >sides of the conversation on the same frequency. Usually one side will be >louder. Perhaps there's some feedback from a party's receiver back into >his transmitter? It's called duplex echo. Whenever you convert 2-wire audio to 4-wire (two pair) you're going to get a reflection. The cell-phone company can't perfectly match the impedances connecting to the local phonecos, and so a little signal gets reflected. Actually, this is desireable locally because it acts as feedback to the speaker, as long as the reflection is kept within reason. The result is that both sides of the communication are hearable in the radio signals. Jim Bell jimbell(a)pacifier.com

1 0

s/n problems on this list
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I've posted on this subject many times in the past, and its something I like to brainstorm on. signal to noise problems on this list. generally, the moderator-specific approaches I find less palatable than techniques that can be automated. here are some more ideas for automated moderation techniques. 1. software called "grouplens" I've talked about here (search yahoo) has been used to rate articles. they found that there was a very high correlation between how long people spent reading articles and the "interesting" rating that they gave that article. hence, a proposal: cpunks have long advocated and hacked mailer programs to stick in crypto. how about sticking in a hack that tracks how long mail messages are being read, and send that info back to an auxilliary mailing list address. the list software keeps track of time spent reading articles and can allow people to screen the list based on the "most interesting articles". "send me only those articles that go over a threshhold of 500 combined human attention minutes". of course this can be messed up by hackers who try to skew the ratings. I would suggest a limit on the max time per article per person. 2. I like the idea of a system that keeps track of complaints against given users. it could keep track of the complaint/per age of every subscriber. e.g. hypothetical: LD gets 10 complaints per week, and TCM gets 30 per week on average, and it could allow people to screen the mail based on these numbers, such as a command "send me mail of all users below a 20 complaint/per week value". you could, for either of these approaches, have an "official screening value" in which the owner of the list adjusts these parameters to his liking. just more ideas. I like cpunks generally favor a technological fix that doesn't involve bottlenecks of individual moderator opinions. (2) would be pretty easy to implement inside existing mailing list software, at the majordomo side.

2 1

People Who Need People...
by Blanc Weber 17 Dec '03

17 Dec '03

I was just going through a web service which, when you enter your city & zip, will bring up all the businesses within that geographical area - Leisure Travel Services etc., then further sub-categorized into Leisure: Restaurants (type: Greek, Italian, Chinese, etc.) Travel: Airlines, Hotels & Motels etc. plus further sub-categories. I was mulling over the all the info which can be quickly pulled up about these people and then remembered that these are not just individual persons whose info I'm looking at, but commercial establishments - companies with services & products which they are offering to anyone. So it's okay. (Why?) Because they *want* to be listed; they want information about themselves to be available to anyone (anyone with money to spend, that is). So it occurred to me: when you need money, you want everyone to know where you are.<g> This could be further generalized into: when you need something, you want everyone to know about it (in case anyone has a solution to your plight). What a different consideration it is, to think of persons separately from their place of business or trade, where they don't want anything to be known or broadcast (except at their individual discretion, consent, release, etc.) When you don't need anything - when you're full, satisfied, and happy - you want 'outsiders' to leave you alone. I think some people can really get confused as to where privacy begins and marketing ends (or is it the other way, I get confused <g>). I know it's happened on this list, where arguments have developed over the fine line of difference between contrasting "rights" to information - i.e, while in the workplace vs while in the front yard on the sidewalk of one's own house or walking around at the mall, etc. Allowance, consent, personal prerogatives, authority over one's decisions & choices - these concepts are all going to require much thought and refinement of demarcation, as the line between being closed or open to others, hidden or exposed, a little bit or a lot, here and/or there, becomes finer and finer while the "net" widens and grows. That is, those who in the past have not felt the need to think much about these things will now be confronted with the necessity of doing so; of considering precisely what the fine line of difference is between conflicting ideas about personal authority, privacy, and public access; what they think is right or wrong, acceptable or intolerable, just from the nature of the circumstances. (like Newt, for instance.) .. Blanc

1 0

Re: RSA challenge: is it legal to try?
by jim bell 17 Dec '03

17 Dec '03

At 11:47 PM 1/13/97 -0800, Greg Broiles wrote: > Presumably the RC5 patent (if one is awarded) won't suffer from >the peculiarities of the international patent schemes which made RSA only >patentable in the US. "Pecularities"? If anything, the peculiarities would have been within _US_ law, and not international law. As I understand it, most people cite the requirement that an invention patent must be applied-for BEFORE disclosure as a requirement for most international patents, which explained by RSA wasn't patented outside of the US. Alone, that would have denied non-US patents to RSA. However, such an explanation grandly ignores the fact that computer software (let alone mathematics in general) was not considered patentable ANYWHERE (?) before public-key systems made their appearance in 1976. It also ignores the strong likelihood that the reason for the Patent-Office policy change (done, apparently, without benefit of a corresponding law change) was because with public-key/RSA there was finally an example of software the government wished to deny to the average citizen, and the only mechanism (short of secrecy, which was broken) to do so was to patent it. I'm still waiting for an "innocent" explanation for the US patent office beginning to issue software patents. I don't think there is one. Jim Bell jimbell(a)pacifier.com

2 1

Information is POWER- Get it!
by iiucom＠iiu.com 17 Dec '03

17 Dec '03

****This letter is sent to you automaticly. If you wish to be removed, reply and type remove*********** ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ This is a new LEGAL service bringing Public Information to the world of Personnel computing!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ This letter is being sent to you because you know that information is Power. You are interested in new ways of doing business economically and safely. You won't let anyone take advantage of you. Please read the next few paragraphs to see if our services can help you. We are Informational Investigations, Unlimited, a public information company. What we do is to provide the public with information on people and companies. Let me explain. Say you've lost touch with an old friend. We can find that person. What if that someone or a company owes you money. We can find that person/company so you can collect. Here's another way IIU can help you. Are you buying a house? Do you think knowing what the seller paid for the same house could help you in the negotiations? Do you trust the real estate to give you the right tax assessment? We can give you the taxes on your dream house directly from yhe assessors office. No better way to be accurate than that! Are you hiring a 'nanny' or babysitter? I know from my experience how emotional a decision that can be. The worry, the questions about his/her background. EASE YOUR MIND! Why not check to see if this person was convicted of a crime. Do they have bad credit or a DWI? OK? Want to see one more? Here's how we have saved landlords money for years. Renting an apartment? Extending credit? Call us! We can do the background checking for you, saving you time and money in the long run. Have you ever tried to get a deadbeat out out of your apartment for non-payment? With today's courts, it is almost impossible. Save money NOW. Call us to do a background on the perspective tenant BEFORE you rent to them. A few dollars now may save you THOUSANDS later in attorney's fees and lost rent. CONVINCED? We won't belabor the point. We can provide you with the information you need to make informed decisions quickly and economically. Our fees? Simple. We charge you the cost of the search plus $20.00. Our search fees, the amount it costs us to get your information, is usually $50.00 or less. Most searches are $10.-15.00. All information is obtained legally through public databases. Call us at (800) 375-5260, Monday-Friday-9AM to 5PM ET. Or visit our web site at: http://www.iiu.com. Make a bookmark for it. Tell a friend. Thank you for taking the time to read our letter. INFORMATIONAL INVESTIGATIONS, UNLIMITED, INC.

1 0

Reminder: Physical DC Cypherpunks Meeting
by Mark O. Aldrich 17 Dec '03

17 Dec '03

Cypherpunks: A January 1997 physical DC Cypherpunks meeting will be held at GRC International, Inc., in Vienna, Virginia, on Saturday, 18 January. Directions to GRCI, including a couple of spiffy-neato maps, are available at: http://www.grci.com/overview/locations/vienna/ If you're in town for the inauguration (yes, it's the following Monday), then stop by and check out the East Coast "punks" contingent. Meeting starts at 1400 hours (2:00 PM). You will be entering a secured facility and will have to endure the usual rigors of being badged, exchanging pleasantries with the guard, and being limited to "requires escort" status. So, allow a few minutes extra before the meeting starts. Agenda includes a presentation by Carl Ellison, Senior Systems Engineer from CyberCash, Inc. Ad-hoc additions are welcome - show up with your presentation materials and you're automatically added to the agenda. We even have a historical crypto-relevant door prize to be given away at the meeting! (Assuming you can haul it home <g>) GRCI is located at the corner of Gallows Road and Boone Blvd, about two miles north of the Dunn-Loring Metro station on the western end of the orange line. As solicitations for rides haven't appeared (yet) on the list, the assumption is that they're being coordinated off-list at the moment. If your ride fails you and you're stuck at the Metro on Saturday, the phone number for where we'll be meeting is 703.506.4951. We can try to beg you a ride from some gracious punk with wheels. The front desk is 703.506.5000 or 4000, is there's no answer downstairs. If you show up late for the meeting and there's nobody there to sign you in, you'll have to have the guard call us. We'll be downstairs in the "lower level conference room." Just say those words and s/he'll know where we are. S/he can then call and someone will come up to get you. Post-meeting world-problem-solving and beer-swilling activities can be undertaken in any of the numerous suitable locations in and about the illustrious Tyson's Corner locale. We'll coordinate at the end of the meeting. Hope to see y'all this Saturday! ------------------------------------------------------------------------- |I want to die peacefully, | Mark Aldrich | |like my Granddad did. | GRCI INFOSEC Engineering | |Not in sheer terror, | maldrich(a)grci.com | |like his passengers did. | MAldrich(a)dockmaster.ncsc.mil| |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

2 1

Hi again, and an invitation to kibitz
by amanda＠intercon.com 17 Dec '03

17 Dec '03

Hello folks, A couple of years ago I signed off of cypherpunks in annoyance at what I thought was a high "fluff" level, and said I'm sign back on when I had crypto software to talk about. Well, I do and so I have :). Last week at MacWorld Expo, we announced a new product designed to provide a secure AppleTalk tunnel over the Internet; we'll be doing a public beta in a few weeks, and expect to be shipping relatively soon after that, assuming that the public beta goes well. The initial version is moderately secure (that is to say, I believe that the most effective attacks to be DES key search and a dictionary attack on the user's pass phrase). I'm interested in comments on weaknesses aside from the use of 56-bit DES; I'm profiling DES-EDE and if it's fast enough we'll be switching to that. Here's a sketch of the protocol: (a) Server sends 8-byte challenge to client (b) Client sends Microsoft NT authentication response to the server (take the password in Unicode form, do an MD4 hash, pad with 0s to 21 bytes, split into 3 7-byte groups, use these as DES keys to encrypt the challenge three times, send the 24-byte result as the response). (c) If authentication fails, close the connection. (d) If authentication succeeds, all subsequent traffic is enccrypted with DES in CFB mode. Until April :), the DES key used is taken from the first 7 bytes of the MD4 hash of the password (after April, we expect to switch to Diffie-Hellman key exchange first, followed by a revised authentication handshake). I have not been able to find any obvious weak points, even if MD4 is weak, since the digest is not put on the wire--recovering the digest would require recovering a DES key given a single known plaintext/ciphertext pair. I would be very interested in any weak points anyone can identify (particularly with step b, since that would have repercussions beyond this little piece of software). I would also be interested in the effects on anyone's analysis given the following modifications: - Using SHA (160 bit hash) instead of MD4 - Using DES-EDE (112 bit key) instead of DES - Using Blowfish in CFB mode instead of DES - Using RC5 in CFB mode instead of DES (not likely unless RC5 is cheap) - Using RC4 (40 bit key) instead of DES (not likely) Comments? Catcalls :) ? Amanda Walker Senior Software Engineer InterCon Systems Corporation

3 2