December 2003 - cypherpunks-legacy

Can you trust your ISP ??
by I~nigo Gonzalez 17 Dec '03

17 Dec '03

Hello, I'm thinking about how can I get rid off this kind of attack *before* it happens. Can you please send me your comments about this? I don't know so much about the how SSL works, but I think this is something that can happen... SCENARIO -------- 1) Suppose We have a host with https protocol enabled, and someone outside wish to access the information we have on the server via https; but (for some reason wich we don't know), the connection has to be made through the Gateway named X (see plain diagram below): Outside <-------------> Gateway X <---------------> Our Server 2) I think that when a Secure Socket Layer connection begin this is what it happens: a) Outside generates a private/public key pair and he send us his public key, wich has to go through Gateway X, who send it to Our Server. b) Our Server generates his own private/public key pair and send his public key (whether it's sent ciphered or not doesn't matter... yet). c) Now both parts have their response public keys, ciphered transaction begins. All seems to be fine, but... 3) Suppose that We don't trust on what's going on through the line, and that IN FACT, someone in Gateway X is disturbing our communications like this: a) When Outside's public key comes to the gateway, Gateway X generates a public/private key pair (wich we will call spoofed keys), and it send a spoofed IP header marked as from "Outside" in order to act as "Outside" for "Our Server". b) Once "Our server" send his public key, "Gateway X" intercept the packet, decrypts it if necessary (because it has the private key needed to decrypt it), and it send "Outside" the public spoofed key (remember what it did on stpe a?). c) Now transaction takes place through "Gateway X", wich can read modify, and fake any data because it has now the ability to act as the other side to both "Outside" and "Our Server"... Avoid the problem: - The *only* think I can figure out to avoid the menace is to have a certified (Verisign and others) public key with a short expiration date. Of course this approach has a little problem: *how* can I verify that once expired "Our Server's" public key is really "Our Server's" key... a Certification Authority is something worth of spoofing... ;-) Maybe the best thing could be becoming my own certification authority... but how!? If for *some* reason the above cannot be done, the a simple way to avoid too much trouble is to limit transactions to just *atomic* transactions (checking account and getting some money are two different transactions). This can still be spoofed if "Gateway X" makes its own transaction with faked Outside's keys. Of course, We must limit the tansactions we accept in "Our Server". Notice that a password and challenges are useless in this kind of situations. ¿Any other way? maybe we can get somethig a bit safer if we found something fixed, inmutable and rely on it (acting like some kind of virtual communication channel between Outside and Our Server: Untrusted Outside <-------------> Gateway X <---------------> Our Server ^ ^ | | \-------- Virtual secure communication channel -------/ If every message "Outside" send to "Our Server" must have a response, then we could make "Our Server" send responses with some good (well tought) cryptographic technique wich will refer somehow to "Outside's" message fingerprint. I mean, every message from the Outside must have a message signature (i.e message must pass through MD5); and its response must have a valid "Response to: <query's MD5 signature>" and (of course) that response must be signed somehow. I still don't know how to do it well; but I will tell you how as soon as I will know. Thank you for wasting your time reading this. -- Iñigo González - ADV Internet Technical Advisor <nexus(a)adv.es> "Never say anything online that you wouldn't want to see on the front page of The New York Times." - alt.2600.moderated Posting

2 1

Re: Conservation Laws, Money, Engines, and Ontology
by Rick Smith 17 Dec '03

17 Dec '03

Wouldn't the model fit reality better if it were based on biological analogies instead of the raw physics of energy? I recognize there's a desire here to put some controls on one's own equipment ("I don't want to receive spam if I don't want to") and that physics provides the conceptual lever to argue in favor of the desired controls. Biological systems are a poor choice for grained control by people who like to change their minds. But the Internet really is more like an ecology with its own complex notion of "emergent order" than a simple physical process that must obey conservation laws in some narrow fashion. Trees obey physical conservation laws, but they don't exchange micropayments with soil, air, and Sun to ensure the balance is preserved. As things get out of balance, trees die. Other entities flourish. I can't imagine the mechanism by which very precise access charging and cost recovery mechanisms would replace the current "free" model. As we all know, it's not really "free." Information is published and made available because the vendor needs to distribute it and finds the Internet to be a cheap way to make it available. Many vendors exchange information and entertainment for your attention to a commercial message. As long as there are unmetered 'Net resources (and they're unmetered for a plethora of reasons) you'll never get rid of free riders. I think you have to choose between the relatively lawless open world or an enclave where you bar the door with your favorite security measures. You allow spam as long as you allow uninvited guests. And what is cypherpunks but a continuous party of uninvited guests? Regarding these micropayment machines, I think it would be interesting to identify some existing, widely used, real world analogues to them: how big/small are individual transactions, how much money can you securely collect, how much does the mechanism cost to deploy and maintain, how hard is it to attack, etc. Gumball machines? Pop machines? Pay phones? I'm not sure there *is* a real world analogue. Rick. smith(a)sctc.com secure computing corporation

1 0

Re: Conservation Laws, Money, Engines, and Ontology
by Greg Kucharo 17 Dec '03

17 Dec '03

>The most basic principle is this: those with resources they control (and >"own") set the rates and policies. I assume you mean this applies to both parties. The ISP has resources that I want to purchase. I have monetary resources it wants in return. Here's an idea; a contract socket. This socket negotiates a info exchange deal based on a base of variables that you have programmed it with. The exchange is made and money changes hands. Build in the usual things like reputation checking and what not to verify that the other guy meets the variables outlined(or at least can be trusted to). ??????????????????????????????????????? Greg Kucharo sophi(a)best.com "Eppur si moeve" -Galileo ???????????????????????????????????????

1 0

Re: Yahoo!'s Picks of the Week (September 9, 1996)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:08 AM 9/10/96, William Knowles wrote: >Did anyone else catch this one? > >> Welcome to this week's selection of Picks, declassified and hot off >> the press thanks to the Freedom of Information Act. Well, okay, not >> really. But we like to pretend. On the other hand, if you would like >> to peruse what once was private but now is public (in a federal >> government sense of the word), head on over to The National Security >> Archive. An independent, non-governmental research institute and >> library, the NSArchive is where you'll find declassified >> U.S. documents that shed light on anything from the Nixon-Presley >> Meeting (Elvis wanted to be a Federal Agent at Large!) to the Cuban >> Missile Crisis and a handful of White House e-mail in-between. >> >> http://www.seas.gwu.edu/nsarchive/ The National Security Archive has been around for many years, and has no connection (insofar as I know or suspect) with the NSA. They have regularly supplied talking heads to various talk shows, especially six years ago during the Gulf War. (In fact, they have a leftist bias.) --Tim We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: ... subversive leftists
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:57 PM 9/9/96, William H. Geiger III wrote: >In <Pine.LNX.3.94.960909125148.16761A-100000(a)blau.pin.de>, on 09/09/96 at >12:53 PM, > Stephan Schmidt <schmidt(a)pin.de> said: > > >>I hope this one was ironic. > >>> The Democratic People's German Reich is fully justified in cutting off >>> contacts with subversive radical publications in Jew-dominated nations like >>> Holland. >>> >>> As Reichskommander Schmidt points out: "The citizen-units who access >> ^^^^^^^^^^^^^^^^^^^^^^^ >>But this one is tasteless and insulting even if it was >>meant ironic. > >If the boot fits....... > I don't know why Stephan waited so many days to make his comment. It was my noticing that I had "collided" with his name, Schmidt, when I made my facetious post that caused me to almost immediately issue a clarification that I was not thinking of him when I made my first post. To be clear, again, I was not basing my "Reichskommander Schmidt" line on Stephan Schmidt. That was just a coincidence. As to the "Reichskommander," in our country, and on the Net, such jokes are not illegal. I rather suspect they are in Germany, either the DDR or the Western side. As to "tasteless and insulting," a matter of personal perspective. I find it helpful to call a spade a spade, and others apparently do as well. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

RRE: Lexis-Nexis personal information database
by E. Allen Smith 17 Dec '03

17 Dec '03

One wonders exactly how much of this information is compiled from government-generated sources? The SSN is automatically originally government-derived, of course... -Allen From: IN%"rre(a)weber.ucsd.edu" 7-SEP-1996 02:02:07.36 [Excerpt from Privacy Forum 5.17.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Tue, 3 Sep 96 12:01 PDT From: privacy(a)vortex.com (PRIVACY Forum) Subject: PRIVACY Forum Digest V05 #17 PRIVACY Forum Digest Tuesday, 3 September 1996 Volume 05 : Issue 17 ----------------------------------------------------------------------------- Date: Tue, 3 Sep 1996 11:22:15 -0400 (EDT) From: Larry Hunter <hunter(a)intr.net> Subject: Lexis-Nexis personal information database Lexis-Nexis sells a commercial database called "Ptrax" which holds detailed personal information on nearly all Americans (L-N claims it contains 300 million names). This database includes name, current address, up to two previous addresses, phone number, birth-date, social security number, mother's maiden name and possible other personal information. This database is kept quite current. Through the Nexis Express service, this information could be available to any individual with a credit card. As most readers will are aware, such information could easily be used for theft of identity and other frauds. It is possible to have one's name removed from this database by making a telephone request. Call (800)543-6862, select option 4 ("all other questions") and tell the representative answering that you wish to remove your name from the Ptrax database. You may also send a fax to (513)865-7360, or physical mail to LEXIS-NEXIS / P.O. Box 933 / Dayton, Ohio 45401-0933. Sending physical mail to confirm your name has been removed is always a good idea. As word of the existence of this database has spread on the net, Lexis-Nexis has been inundated with calls, and has set up a special set of operators to handle the volume. In addition, Andrew Bleh (rhymes with "Play") is a manager responsible for this product, and is the person to whom complaints about the service could be directed. He can be reached at the above 800 number, selection option 4 and then ask for extension 3385. The information in this note has been been confirmed by me, and was originally provided in forwarded messages from Russell Whitaker, Jason Werner, Vern Winters, Katherine Florman and Reuben Snipper. Larry Hunter hunter(a)intr.net ------------------------------ End of PRIVACY Forum Digest 05.17 ************************

1 0

RRE: Computers, Freedom, and Privacy
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 7-SEP-1996 07:46:46.51 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Tue, 3 Sep 1996 12:37:14 -0700 (PDT) From: Bruce R Koball <bkoball> THE SEVENTH CONFERENCE ON COMPUTERS, FREEDOM, AND PRIVACY Call for Participation San Francisco Airport Hyatt Regency Hotel Burlingame, California March 11-14, 1997 CFP97: Commerce & Community will be sponsored by the Association for Computing Machinery SIGCOM and SIGSAC. The host institutions will be Stanford University and the University of California at Berkeley. Co-sponsors and cooperating organizations include the ACM SIGCAS, the Electronic Frontier Foundation, the Center for Democracy and Technology, the Electronic Privacy Information Center, and the WELL. CFP97: Commerce & Community is the latest in a series of annual conferences assembling a diverse group of experts and advocates from the domains of technology, business, government, and academia to explore the evolution of information and communication technologies and public policy, and its effects on freedom and privacy in the United States and throughout the world. Past CFP sessions have discussed, debated -- and often anticipated -- issues of great social import. In this tradition, CFP97: Commerce & Community will examine the social and policy questions posed by: * the growth of electronic communities; * electronic commerce and the commercialization of cyberspace; * the problems of legal and regulatory control of the Net; * the interests of privacy and property in the electronic domain; * high-tech law enforcement and security concerns. The CFP97 Program Committee invites your suggestions for presentations on these or other important issues at the nexus of technology, business, public policy, freedom, and privacy. Proposals may be for individual talks, panel discussions, debates, moot courts, moderated, interactive sessions or other formats. Each proposal should be accompanied by a one-page statement describing the topic and format. Descriptions of multi-person presentations should include a list of proposed participants and session chair. Proposals should be sent by email to cfp97(a)cfp.org. If necessary, typewritten proposals may be sent to: CFP'97, 2210 Sixth Street, Berkeley, CA 94710. Please submit your proposal as soon as possible. The deadline for submissions is October 1, 1996. (Please note that we have extended our deadline for submissions) For more information on the Computers, Freedom and Privacy Conferences, as well as up-to-date announcements on CFP'97, please visit our Web page at: http://www.cfp.org cfp97_call v1.2

1 0

Edited Edupage, 8 Sept 1996
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"educom(a)educom.unc.edu" 9-SEP-1996 11:29:04.71 >************************************************************ >Edupage, 8 September 1996. Edupage, a summary of news about information >technology, is provided three times a week as a service by Educom, >a Washington, D.C.-based consortium of leading colleges and universities >seeking to transform education through the use of information technology. >************************************************************ [...] >SCIENTOLOGISTS FIGHT FOR COPYRIGHT PROTECTION ON NET >Police investigators in Helsinki say the Internet "anonymous remailer" site >anon.penet.fi was shut down partially because of a copyright dispute with >the Church of Scientology (and not because the site was a primary conduit >for child pornography, as was previously reported). The Church of >Scientology, which has been successful in convincing the courts that its >teachings are validly copyrighted material, was pursuing an individual who >used the anonymous remailer site to post Scientology texts without the >Church's permission. The operator of the site decided to close it down >rather than reveal the individual's name to Helsinki police. The Church >says it was not opposing the existence of the server: "We have no >opposition to there being anonymity for private, consensual communications. >What we oppose is using anonymous servers for the purpose of permitting >criminal or other unlawful acts." (New York Times 6 Sep 96 C2) Why don't I believe the first portion of that statement? [...] >COPYRIGHT LAW ARCHIVED ON THE NET >The Stanford University library is working with the Council on Library >Resources to compile an electronic archive of information on copyright law >in an effort to keep educators and others aware of the ongoing debate over >the "fair use" doctrine. The Stanford site < http://fairuse.stanford.edu > >contains the full text of court decisions, legislation and international >copyright agreements, as well as related articles on the topic. (Chronicle >of Higher Education 6 Sep 96 A42) >NEW ANGLE ON WEB SURFING >BroadVision's new Web site, called The Angle, features the company's >One-To-One intelligent agent and WebPoint content management technologies. >"What intranets are looking for are ways to help users of their site get >information they need, and are entitled to, quickly and efficiently without >too much surfing," says the company's CEO, who touts his service as an >efficiency-booster for corporate technology managers. Unlike its rival, >Firefly, which is used to direct music seekers to selections they might like >based on similar buyers' tastes, the One-To-One agent software is built on >rule-based reasoning. BroadVision is considering licensing Firefly's >technology, which uses a personalization algorithm to identify trends among >users and personal tastes, to expand its offerings. (Interactive Age >Digital 4 Sep 96) [...] >CONGRESS, NOT THE COURTS, TO RESOLVE COPYRIGHT ISSUES >The U.S. Patent and Trademark Office is shifting gears in its drive to >resolve electronic copyright issues, and is now working with members of >Congress to develop a legislative solution to the issue of online service >provider liability, which has been a sticking point in efforts to pass new >copyright legislation. "We are looking for a way to define the nature of >the provision of mere telecommunications services, for which >telecommunications providers should bear no liability for copyright >infringement. We are trying to define where the dividing line is between >someone who actively engages in the provision of information versus someone >who is a mere conduit," says a senior legal counselor for the PTO. The PTO >originally believed these issues could be resolved through the court system, >but now says it will work with Congress and industry to develop legislative >solutions. (BNA Daily Report for Executives 4 Sep 96 A4) Eeep... I trust the courts more than people selected by a popularity contest. Remember that various of the worse CDA-replacement bills had in them provisions for CDA-like filtering being protected from liability? To me, that's a pretty clear government sponsorship of such filtering, which makes it censorship. [...] >WHERE WIZARDS STAY UP LATE >The NY Times Sunday Book Review says the Hafner/Lyon book on the origins of >the Internet ("Where Wizards Stay Up Late") compiles a great deal of >much-needed information and "shows just how striking an innovation and >collaboration the Arpanet really was. One central focus of the book >(excerpted in the Sep/Oct Educom Review) is the contribution of the >brilliant psychologist and computer scientist J.C.R. Licklider, who >predicted an era when "human brains and computing machines will be coupled >.... tightly, and ... the resulting partnership will think as no human brain >has ever thought and process data in a way not approached by the >information-handling machines we know today." (New York Times Book Review 8 >Sep 96 p19) >Edupage is written by John Gehl <gehl(a)educom.edu> & Suzanne Douglas ><douglas(a)educom.edu>. Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by Information Technology Services at the >University of North Carolina at Chapel Hill. >************************************************************ >Edupage ... is what you've just finished reading. To subscribe to Edupage: >send mail to: listproc(a)educom.unc.edu with the message: subscribe edupage >Niccolo Machiavelli (if your name is Niccolo Machiavelli ; otherwise, >substitute your own name). ... To cancel, send a message to: >listproc(a)educom.unc.edu with the message: unsubscribe edupage. (If you >have subscription problems, send mail to manager(a)educom.unc.edu.)

1 0

Re: [WAS xs4all.nl] Terrorists
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:35 AM 9/9/96 -0500, Adam Shostack wrote: >Stephan Schmidt wrote: > >| One thought : How many of you would support terrorist >| web server (say Oklahoma, TWA, Iran, Lybia, RAF, IRA, ...) ? > >I've given support to at least two terrorist organization, probably >closer to five in the last year. I can't see supporting one more >would do any more harm. > >Adam And I support a terrorist organization (the US Government) every year whether I want to or not. The US was convicted of a major violation of international law (akin to terrorism) in the International Court of Justice back in the '80s for air sowing mines in Nicaragua's main harbor. DCF

2 1

Re: Satellite Bowel Movement?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:12 AM 9/9/96, Blak Dayz wrote: > I was out buying groceries and after they scanned the shit through they >told me that all the ATMs in the City were out due to connection problems. So i >go home and start trying to scan for the shits and i cant find them. If anyone >knows what the hell happened i would appreciate the details. I believe it may >have been a solar flare that caused the companies to redirect their satellites. >It would do me alot of help considering i had to pay CASH (i hate paper) >for the >stuff and i would like to complain to the fucking JPL and satt. operators about >them warning the public. I agree. In times like this, they should be warning the public! The overload was caused by Zeta Reticulans draining more power from the grid than had been planned by the Ruling Council. Clinton dispatched _three_ of his Black Helicopters to Area 51, and they kicked some alien butt. I think the Morks will be more malleable. We on the Doom13/D&D/Cypherpunks list are wise to their wayz, and their warez, and will issue aluminum foil helmets to all those in danger. Latr, d00d! --Zarkon

1 0