December 2003 - cypherpunks-legacy

Re: Earl Edwin Pitts, $224,000
by jim bell 17 Dec '03

17 Dec '03

At 06:06 PM 12/18/96 -0800, Timothy C. May wrote: >At 8:20 PM -0500 12/18/96, Adam Shostack wrote: >>http://www.cnn.com/US/9612/18/fbi.spy/index.html >>FBI agent spied for Soviet Union, Russia. >>Too bad he didn't have access to the Clipper database. That would >>have helped us find its free market price. > >...and who's to say he didn't? Anyone who bought it--the Russians, for >example--would hardly have been likely to publicize their purchase. > >(Maybe if _we_ purchased it, we'd publicize the purchase, but nearly anyone >else would not.) Or maybe he could just _claim_ to have sold the database. That'd work just as well, I think. Think how much trouble the gov't would have to go to do disprove him! Jim Bell jimbell(a)pacifier.com

2 1

RE: permanent invasion of privacy
by blanc 17 Dec '03

17 Dec '03

From: Dale Thorn, who hasn't a clue [on why the cpunks of late haven't discussed children's point of view]: Not lately? And why is that? Don't know, Dale. Would everyone please send a message to Dale, explaining why you haven't been discussing this? -- [on the possibility that abused children might be helped by the uses of encryption]: How is an abused child going to be helped by encryption? Why are you on this list, Dale? -- [on why, as I said, "empathy with children is not borne of government, but of a normal state of mind"]: That's just rhetoric. What normal state of mind? Takes one to know one, Dale. -- [on going out to alt.philosphy.objectivism to evoke detailed discussions of pertinence to his interest in benefitting from government programs]: In other words, if it doesn't offer something for me, the selfish adult, I don't wanna hear it. I'm not *obliged* to hear, it Dale. .. Blanc

4 6

C2NET ANNOUNCES STRONGHOLD 2.0, BUNDLED THAWTE CERTIFICATES
by sameer 17 Dec '03

17 Dec '03

For Release: December 19, 1996 C2Net: Douglas Barnes, +1 510 986 8770, cman(a)c2.net UK Web: Dave Williams, +44 0113 222 0046, dwilliams(a)ukweb.com Thawte Consulting: Mark Shuttleworth, +27 21 975 4675, marks(a)thawte.com C2NET ANNOUNCES STRONGHOLD 2.0, BUNDLED THAWTE CERTIFICATES Oakland, CA -- C2Net Software, an Oakland-based security software company, announced today the beta release of Stronghold 2.0. Stronghold is currently the second most popular commercial webserver on the Unix platform, according to the Netcraft survey of webservers on the Internet. (see: http://www.netcraft.co.uk/survey/) Bundled With Thawte Certificates ================================= Additionally, C2Net and Thawte Consulting cc, a certificate authority based in South Africa, jointly announced a bundled product: a Stronghold webserver and a Thawte server certificate. The bundle will sell for $545; Stronghold alone lists at $495. Thawte's main competitor, Verisign, sells web server certificates for $290; similar certificates are $100 when purchased separately from Thawte. "We can now offer our customers the convenience of one-stop shopping when setting up a secure web site," said C2Net President Sameer Parekh. "Thawte is now poised to be a significant competitor to VeriSign, and we think that competition in this area is very healthy and will bring greater value to the entire Internet" Certificates are used for secure connections to authenticate the server to the client. People using Netscape and Microsoft browsers can connect to sites using both Thawte and VeriSign certificates because the "root certificates" for these companies come pre-loaded with the Netscape and Microsoft browsers. New Features in Version 2.0 =========================== Stronghold 2.0 is adding a number of new features users have been asking for. "We've redesigned the security interfaces and built on the new Apache 1.2 code base," commented Mark Cox, Stronghold product manager at UK Web. "Stronghold has had many productivity and performance enhancements and it is now fully compliant with the new HTTP/1.1 standard." The HTTP/1.1 standard is a significant update to HTTP/1.0, the protocol that governs how web browsers and web servers communicate. HTTP/1.1 brings many new features to the table, including improved content and language negotiation, improved persistent connections, and better recovery from interrupted transfers. (For more information on HTTP/1.1, see http://www.apacheweek.com/features/http11/) Stronghold 2.0b1 also incorporates a number of popular features from the Thawte webserver, Sioux, including more flexible directives for specifying security properties and improved certificate-based authentication. A subsequent beta version of Stronghold 2.0 will contain a full-fledged grapical configuration manager, based on the one in Sioux, as well as support for the latest version of the SSL protocol, known as SSLv3. Merged With Sioux ================= Along with the bundling agreement, Thawte and C2Net have merged their webserver products, Sioux and Stronghold. "This gives us a chance to focus more of our energy on our certificate business," said Mark Shuttleworth of Thawte Consulting. "By doing this, our two companies will be better able to compete in both the web server and certificate- issuing markets." Existing Sioux customers will be able to upgrade to the new version of Stronghold for $95. Upgrade Policy ============== Starting today, users who purchase Stronghold will be guaranteed a free upgrade to 2.0 when it gets out of beta testing. Other existing Stronghold users will probably need to pay a $95 upgrade fee, depending on when they purchased the product. Stronghold is developed outside of the United States, and is distributed within the US and Canada by C2Net (http://stronghold.c2.net/) and in the rest of the world by UK Web (http://stronghold.ukweb.com/) All versions of the product use uncompromised, full-strength cryptography. Background ========== C2Net (previously known as Community ConneXion, Inc.) is the leading provider of uncompromising security on the Internet. In addition to Stronghold (http://stronghold.c2.net/) C2Net also markets SafePassage Web Proxy (http://stronghold.ukweb.com/safepassage/) a product that allows users of popular web browsers to use full-strength cryptography worldwide. UK Web Limited is a leading Internet services company specialising in server technology, Internet security, business solutions and effective site design. They are the international distributors for both Stronghold and SafePassage products. Portions of Stronghold were developed by the Apache Group, and were taken with permission from the Apache Server http://www.apache.org/. Stronghold also includes software developed by Eric Young (eay(a)mincom.oz.au) Contacts ======== C2Net: Douglas Barnes, +1 510 986 8770, cman(a)c2.net UK Web: Dave Williams, +44 0113 222 0046, dwilliams(a)ukweb.com Thawte Consulting: Mark Shuttleworth, +27 21 975 4675, marks(a)thawte.com New with Stronghold v2.0b1 http://stronghold.c2.net/get/beta/ == Security In Stronghold 2.0b1 we've upgraded to the latest SSL and cryptography library, with a number of performance improvements, particularly in the DES implementation. The security/SSL architecture in Stronghold has been rewritten to take advantage of the Sioux source code base and the various features in Sioux. SSL client authentication has been improved. Regular expression-based matching of client certificate information to determine access control is possible. Stronghold now has an API for certificate to username mapping so that client certificates may be mapped to standard usernames. Session ID caching is now more robust. The sessiond is no longer needed, because the session ID cache is within the same address space as the server processes. == Ease of Use The Stronghold documentation has been revised and improved greatly since the last release. The 2.0b1 documentation is now three hundred pages long and will grow to include more extensive documentation for the final release. The documentation is available in both PostScript and HTML formats. The server has more command line options which provide information about the server. In particular, you can get a list of all the modules in the server or a full listing of all configuration directives that are supported by that binary. Compiling the server to add/remove new modules is also much easier. The Configure script automatically detects which operating system the server is running on and sets the compilation flags appropriately. Stronghold is now easier to install, with more verbose text during the install. Stronghold now comes with binaries for a number of useful management utilities, such as htpasswd, htdigest, and dbmmanage. == Functionality Stronghold is now compliant with HTTP/1.1, the latest in web protocol technology. Stronghold is the first commercial webserver to support HTTP/1.1. Stronghold 2.0b1 includes the lastest beta version of Apache (1.2b2), which includes a number of improvements, in addition to a large number of bugfixes. The server status page has been improved include additional information, including virtual hosts and client side certificates. The status page is also much more readable. Stronghold has a more fully-functional server-side includes mechanism, including the "eXtended Server Side Includes" SSI format. Stronghold provides server admins the ability to easily setup cookie-based user tracking so the admin can see what path through their site the users have been taking. It is now possible to restart the server and reload the configuration files without interrupting connections which are currently in progress. Stronghold is now compatible with the NCSA "Satisfy" directive for access control. CGI scripts are now "unbuffered". By unbuffering the CGI scripts it is possible to do things using normal CGI that were previously only possible using "nph". More information is available to ErrorDocument handlers about the cause of the error via the use of the ERROR_MSG environment variable. == New Bundled Modules Stronghold now bundles PHP, a very powerful language for dynamic content and database connectivity. PHP provides for database connectivity to mSQL, Postgres95, Solid, and mysql servers. Using PHP, Stronghold can now generate web pages on the fly using a very powerful C-like language for processing forms input, database queries, etc. Stronghold now bundles with SWISH/WWWWAIS search engine for indexing and searching through web sites. Stronghold now comes with the proxy module enable by default. The proxy module has also been significantly improved since the previous version. A full-featured URI rewriting language that allows server administrators to define rules for transforming URIs. Support for the DigiCash ecash protocol is now built into the server. Using this module it is possible to set up an ecash-accepting shop on the Internet without an actual account with an ecash-issuing bank. == Configurability It is now possible with Stronghold to configure the server such that user's CGI scripts are run under their own UID, with their own permissions, instead of the UID of the server, with the same permissions as the rest of the server or other CGI programs run by other users. Many directives now support regular expressions, so configuration options can be set based on regular expression matching criteria. The new <Files> container allows server adminstrators to set configuration options on a much finer basis, down to individual files in directories. Server administrators can now set environment variables based on which web browser the client is using. These environment variables can be used to deliver different web pages, or work around bugs in various different browsers. Configurable logging is now the default, and has been enhanced. It is now possible to create a number of different logfiles each with their own configurable logging format. It is also now possible to setup a virtual host which listens to more than one IP number, or more than one port. It is easier in Stronghold 2.0b1 to debug CGI scripts. The server administrator or CGI author can configure logfiles where CGI error messages and diagnostic information get stored. The entire server can protect itself from runaway CGI scripts by configuring in the resource limits for CGI that are now available in Stronghold. Server redirects are more configurable. The client can now be told whether or not a redirect is temporary, permanent, or if the requested object is completely gone. The "Options" directive is much more configurable. It's possible now using the "Options" directive to add and remove options from the current set of "Options" merely by prepending a '-' or '+' to the option name. There is now a configuration directive to set and remove HTTP headers. Using this directive various directories or various files can have custom headers attached if the server administrator wants to easily support some of the many HTTP extensions. The configuration file can include directives which are turned on or off conditionally depending on whether or not certain modules are compiled into the server.

1 0

Thank you all for the help.
by Thanks＠yourself.up 17 Dec '03

17 Dec '03

RareTrip Mexico Baja California Norte Ensenada -I think, therefore i am.- <---Sorry you didn't do it The file you received was the HUSH Trojan, of course it was Encrypted using Cryptcom of Nowhere Man and ICE. So ITS NOT A VIRUS! I am not proud of what i did, but if i can get you to gain knowledge (NEVER RUN FILES ATTACHED TO AN EMAIL) i would do it no matter what. Dont say i didn't warn you (fuck(a)yourself.up) Hey guys! No hard feelings ok. Sorry. i feel bad. need a doctor. ******** You can email the next address: AVSECURE(a)HOTMAIL.COM *****************

1 0

Thank you all for the help.
by Thanks＠yourself.up 17 Dec '03

17 Dec '03

>To: cypherpunks(a)toad.com >From: Thanks(a)yourself.up >Subject: Thank you all for the help. > >RareTrip >Mexico Baja California Norte Ensenada >-I think, therefore i am.- <---Sorry you didn't do it > >The file you received was the HUSH Trojan, of course it was Encrypted using Cryptcom of Nowhere Man and ICE. So ITS NOT A VIRUS! >I am not proud of what i did, but if i can get you to gain knowledge (NEVER RUN FILES ATTACHED TO AN EMAIL) i would do it no matter what. >Dont say i didn't warn you (fuck(a)yourself.up) >Hey guys! No hard feelings ok. Sorry. i feel bad. need a doctor. > >******** You can email the next address: AVSECURE(a)HOTMAIL.COM ***************** >

1 0

Thank you all for the help.
by Thanks＠yourself.up 17 Dec '03

17 Dec '03

>To: cypherpunks(a)toad.com >From: Thanks(a)yourself.up >Subject: Thank you all for the help. > >RareTrip >Mexico Baja California Norte Ensenada >-I think, therefore i am.- <---Sorry you didn't do it > >The file you received was the HUSH Trojan, of course it was Encrypted using Cryptcom of Nowhere Man and ICE. So ITS NOT A VIRUS! >I am not proud of what i did, but if i can get you to gain knowledge (NEVER RUN FILES ATTACHED TO AN EMAIL) i would do it no matter what. >Dont say i didn't warn you (fuck(a)yourself.up) >Hey guys! No hard feelings ok. Sorry. i feel bad. need a doctor. > >******** You can email the next address: AVSECURE(a)HOTMAIL.COM ***************** >

1 0

Thank you all for the help.
by Thanks＠yourself.up 17 Dec '03

17 Dec '03

>To: cypherpunks(a)toad.com >From: Thanks(a)yourself.up >Subject: Thank you all for the help. > >RareTrip >Mexico Baja California Norte Ensenada >-I think, therefore i am.- <---Sorry you didn't do it > >The file you received was the HUSH Trojan, of course it was Encrypted using Cryptcom of Nowhere Man and ICE. So ITS NOT A VIRUS! >I am not proud of what i did, but if i can get you to gain knowledge (NEVER RUN FILES ATTACHED TO AN EMAIL) i would do it no matter what. >Dont say i didn't warn you (fuck(a)yourself.up) >Hey guys! No hard feelings ok. Sorry. i feel bad. need a doctor. > >******** You can email the next address: AVSECURE(a)HOTMAIL.COM ***************** >

1 0

Thank you all for the help.
by Thanks＠yourself.up 17 Dec '03

17 Dec '03

>To: cypherpunks(a)toad.com >From: Thanks(a)yourself.up >Subject: Thank you all for the help. > >RareTrip >Mexico Baja California Norte Ensenada >-I think, therefore i am.- <---Sorry you didn't do it > >The file you received was the HUSH Trojan, of course it was Encrypted using Cryptcom of Nowhere Man and ICE. So ITS NOT A VIRUS! >I am not proud of what i did, but if i can get you to gain knowledge (NEVER RUN FILES ATTACHED TO AN EMAIL) i would do it no matter what. >Dont say i didn't warn you (fuck(a)yourself.up) >Hey guys! No hard feelings ok. Sorry. i feel bad. need a doctor. > >******** You can email the next address: AVSECURE(a)HOTMAIL.COM ***************** >

1 0

Info about FUCK@YOURSELF.UP
by sorry＠lame.guys 17 Dec '03

17 Dec '03

Ok, you better sleep nicely cause i would never again Post nothing to this list. Sorry again. Sincerely *RareTrip*

1 0

Password Keystroke Snarfer Programs
by Bill Stewart 17 Dec '03

17 Dec '03

Several articles on the PGP-users mailing list have discussed keystroke snarfers that unexpectedly grab and save keystrokes, including passwords, severely weakening any benefits from encryption. taoboy <taoboy(a)sprynet.com> mentioned Mac programs FileGuard and HiddenOasis and the SpellCatcher spell-check program's Ghostwriter feature, which he'd noticed had stuck his password into a disk file; he suggests that Windows machines probably have similar surprises. From: patm(a)connix.com (Pat McCotter) > Which is why, every once in a while, I do a search of my entire disk for my > PGP pass phrase and various other passwords I use. [....] I do this with > Norton DiskEditor. I have to upgrade to do this on my Win95 machine which I > understand is much worse than Win3.x in this area. Be careful - PGP goes to a lot of effort to overwrite your passphrase when it's done using it; Norton or grep or other disk-crawlers are unlikely to do so, because that sort of paranoia's not part of their job, and simply typing in a command in a command window will often get it saved in a command history file. So your search for the passphrase on disk makes it _more_ likely that some program will stash it on your disk... You could work around this by using a complex passphrase and adding a distinctive word to the end, e.g. "mumblefrotz foobaroid zarquon FINDTHIS", which doesn't become much less secure if the FINDTHIS gets left on the disk from your "grepemall FINDTHIS c:" command. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

5 4