December 2003 - cypherpunks-legacy

Exploring hooks in MSIE
by Dietrich J. Kappe 17 Dec '03

17 Dec '03

A little bird told me that MSIE has Javascript hooks that allow a site to check whether all Microsoft products on a client machine are properly licensed. Has anyone investigated the Javascript (err, Jscript) implementation in MSIE to see if this is true? The same little bird told me that MS is building some use of this "feature" into their Websites. Can any MS consultants corroborate on this issue? This is just a rumor. The names of the birds have been changed to protect the innocent. DJK

2 1

Re: National Emergency
by attila＠primenet.com 17 Dec '03

17 Dec '03

In <v03007800aeb2dc721dbf(a)[207.167.93.63]>, on 11/15/96 at 06:59 PM, "Timothy C. May" <tcmay(a)got.net> said: :[snip...] :One of the things that most people don't appreciate is that these emergency :orders are essentially never repealed. (Not too surprising--if I was in :government, I wouldn't voluntarily give back any additional powers, either. :And the only consituency for rolling them back is the membership of the :evil militias, so nothing happens.) : yes, you are absolutely right. absolute power corrupts absolutely and a government given (or taking) extra powers is not likely to surrender same --they hope everyone forgets? maybe there is an analogy: militias: the only way they'll take my weapon is from my cooling, smoking hand.... prez: the only way they'll take my executive privileges is to vote me out of office --IF I consent to leave. -- without arms they do not resist; without communication they know not what to resist. -attila [snip...] :Basically, this was one of the alphabet soup of Emergency Orders, National :Security Decision Directives, and Executive Decisions passed or enacted :(sometimes in secrecy) during the last 30 years of the Continuing Emergency. :(Nixon's wage-price freezes, the oil embargo actions, the strategic :reserves, the anti-inflation measures, various Carter emergencies, and :various Reagan emergency orders, including NSDD-145, which directly affects :control of communicaitons, cryptography, etc.) :FEMA, the Federal Emergency Preparedness Agency, took over several of these :emergency orders (the running of them) in the late 70s. :Standard stuff for we conspiracy buffs. One doesn't need to invoke :historical groups like the Illuminati to see that the levers of power are :pulled by strange folks.

1 0

Re: PGP3.0 & ElGamal
by Steve Reid 17 Dec '03

17 Dec '03

>> Yes, but I believe 3DES has an effective key length of only 112 bits. >> Of course, even this is more than sufficient for a long time to come. > 3DES can have an effective key length of 168 bits if 3 keys are used > instead of two. There are no security problems that I know of from > using 3 keys. The Meet In The Middle attack (MITM, not to be confused with Man In The Middle) is a time-memory tradeoff that works against any multiple encryption. Triple encryption: ciphertext = encrypt(k3, decrypt(k2, encrypt(k1, plaintext))) plaintext = decrypt(k3, encrypt(k2, decrypt(k1, ciphertext))) An MITM attack, as I understand it, works by decrypting from one end and encrypting from the other... Step 1- decrypt(x3, ciphertext) for every possible x3, and store all the results. This requires 2^56 operations and 2^56*8 bytes (550 petabytes?) of memory when done against 3DES. Quite a lot, but it might be doable. Step 2- decrypt(x2, encrypt(x1, plaintext)) for every possible x1,x2. This require 2^112 steps with 3DES. If the result you get can be found in the table built by step 1 then you've figured all three keys.

1 0

Re: Does John Gilmore...
by George A. Stathis 17 Dec '03

17 Dec '03

At 11:11 ìì 16/11/1996 -0800, Sandy Sandfort wrote: >C'punks, > >On Sun, 17 Nov 1996, George A. Stathis wrote: > >> What worries me is that people still subscribe to the >> cypherpunks list after this assault on free speech takes place. > >So I guess we won't be seeing George around here any more (or >did he just me OTHER people should unsubscribe?). Rest assured that... I am not subscribed to your list anyway. Maybe I allowed 5 or 6 messages to reach you, since the 'recipients' contained your list in the first place. It's part of *your* attempt (AFTER Dimitri's expulsion) to "have the last word". :-) - NOT mine! :-) Perhapds I'd subscribe to your list if serious discussions on... crypography take place, which would enable me to better... protect my own software by some kind of encryption. But I decided to lower my prices and publish (my dictionaries) unprotected anyway! :-) As regards 'PGP'... I don't give a damn anymore who reads my mail, since I got used to infringements of privacy anyway (since my childhood days in a dictatorship). In any case, It is not my style to 'hinder other people's discussions'. And if a list contains more than 1000 people INDIFFERENT to Freedom of Speech, it's not AT ALL 'my' kind of list anyway... :-) >> ...I would gladly write articles on Dimitri's expulsion and the >> facade of Free Speech in mailing lists etc.,...But since I have >> no time, it's likely someone else will report this. > >What was that from Thomas Paine about summer soldiers and >sunshine patriots? Three cheers for George and his commitment >to "Free Speech." I know I'm impressed. Aha! aha! aha! :-) You are on the verge on "taking the piss out of" (even) Thomas Paine! How has it happened that you are so determined in your anti-Vulistic zeal, so as to sacrifice even what the rest of the World admires in your country? I always liked Americans for their support of Individual Rights, their Constitution, Jefferson and Thomas Paine, things like that... Well, if you want all these reasons to vanish in thin air, good luck in your next... forcible unsubscriptions! :-) <shrug> George P.S. I have heard cynical Americans before, being 'sarcastic' against selfless supporters of Free Speech. A lot of you people can't even imagine a selfless cause without financial gain. Such is the... Mafia world of... pimping and prostitution, I suppose... :-) (-joke!) ROTFL

2 1

Re: Members of Parliament Problem
by Hal Finney 17 Dec '03

17 Dec '03

From: "Michael Froomkin - U.Miami School of Law" <froomkin(a)law.miami.edu> > [Discussion of blind signatures] > > Brands has a better scheme that I don't understand exactly. He recently > attempted to explain it to me thusly: > > [Brands quote elided] > > Can anyone tell me more? We had quite a bit of discussion of Brands' technology on the list a couple of years ago. Take a look at <URL: http://chaos.taylored.com:1000/0Z/Digital-Cash/Protocols/Brands/Brands-Cash… > which has several pages discussing discrete logs and some of the ideas behind Brands' protocols. Unfortunately I am getting cut-off versions of these pages tonight, along with occasional failures to find a route to this server, so hopefully it is just the net acting up again. Hal

1 0

Re: Remailer Abuse Solutions
by Hal Finney 17 Dec '03

17 Dec '03

From: ph(a)netcom.com (Peter Hendrickson) > Another way to have anonymous posting but not be subjected to spam > and the like is to dispense tokens every week to the subscribers. > They can be signed blindly so that anonymity is preserved, just > like e-cash. I had proposed a similar idea to this a few years ago. You would dispense tokens, each of which needed to be included in an anonymous message. So this prevents spam. But it can also deal with abuse. After sending the message, if it was not abusive, a new blinded token would be broadcast which could only be decrypted by the sender of the original message. But if it was abusive, no new token would be sent. Remailer users would watch these token broadcasts and get their new tokens each time they sent a message. The remailer might have to delay issuing the replacement tokens for a day or two to give the recipient time to complain. If you gave everyone in the world an initial supply of a few tokens, then every time they abused, they'd lose one. But as long as they use the remailer reasonably they can continue to use it forever because they get a new token for each one they use. Messages still remain completely unlinkable and the remailer has no way of learning anything from the tokens it sees since they were all issued in blinded form. Hal

1 0

Re: The Utility of Privacy
by Hal Finney 17 Dec '03

17 Dec '03

David Brin has an article in the December issue of Wired arguing that privacy is obsolete and was never that great an idea in the first place. I corresponded with him a few years ago when he was working on a draft of a book which would develop this idea. Needless to say, I disagreed with many of his views. Here is an excerpt from a letter I sent to him where I defended the notion that privacy is valuable: === You suggest that the main motivation which someone might have for protecting privacy is that they are engaged in some illicit activities: page 45: "Why should I really care if someone sees this? I have nothing to hide." But aren't exceptions to this quite common in real life? What about the gay man who doesn't want to come out of the closet? What about the environmentalist who works in the clerical department of an oil company with little tolerance for such beliefs? What about the closet atheist in the fundamentalist Midwestern town? Maybe you'd say that all of these people should expose their secrets, or have them exposed for them, and that the world would be a better place. (Actually, you do seem to say this, and I'll discuss it later.) But I think this assumes a certain level of tolerance on the part of society. What if this is wrong? What if society, or just your neighbors, or your boss, is not so tolerant? What if you lose your job, or get hounded from your neighborhood, once these secrets are exposed? I really don't think we have any right to second-guess the decisions people have made about what they will reveal and what they will keep private. They are the ones who have to live with the consequences. They are the ones who should make the decisions. For you to say that people should have "nothing to hide" is awfully facile. If you had admitted in your book to be a pedophile or a white supremacist, coming out of the closet as a demonstration of your faith in the values of openness, that would at least indicate that you had experienced that of which you had written. But of course even that would not give you the right to presume to tell others to follow the same course. In my opinion. Furthermore, there is a long tradition of anonymity and pseudonymity in literature. Probably the most prominent examples are the Federalist Papers, published anonymously due to fear of political retribution. The whole area of politically-inspired anonymity is another counter-example to this notion that people only want privacy for evil purposes. How can you look back at the history of even this country, which probably has one of the best records in the world, and feel confident that no one will ever be wiser to express an unpopular view anonymously? Even if you feel safe about it in the U.S., your suggestions would have world-wide impact. There are many countries in the world where criticizing the government will have to be done anonymously if it is done at all. This raises the point that anonymity may promote criticism. You go to some lengths to praise the value of critical commentary as a route to the truth. Yet in real life political considerations are one of the most potent blocks to criticism, and these often apply most strongly to those who are in the best position to criticize. It is only through anonymity that much of the most useful criticism can arise. This is why we have our "whistle-blower" laws, anonymous informants, etc. Yes, anonymity can be easily misused in this regard. Information supplied anonymously needs to be carefully verified before it can be relied on. But I don't see the value in stripping the shield of anonymity from people who would like to expose some injustice but are afraid of the personal consequences. === Hal

1 0

Re: Censor John Gilmore -- EFF is a disgrace!
by George A. Stathis 17 Dec '03

17 Dec '03

At 12:07 ðì 17/11/1996 -0600, snow wrote: >> Stephen Boursy wrote, along with a horde of others with no lives: >> [lots of worthless crap snipped out] >> > None of that analogy is applicable to the cyberpunks list. >> > When a list gets as big as that, it it no longer to be considered >> > a "mailing-list" but it is a _public_ forum. The whole problem >> > here is the abuse of power by both the EFF and John Gilmore. > > Boursy is a twit who has lost more accounts that Vulis. In this case, I'd quote a poet who said "I am not sorry for the poets who were left without an audience, I am sorry for the audiences who were left without any poets". I would suggest that it is not at all a "safe" indication of personal or intellectual _worth_, (of Mr. Boursy or of anyone) "how many accounts he has lost". For two reasons: (1) As I read Mr. Boursy's postings, I see no indication that he is either deranged, or evil, or lacking sanity or maturity. If he had these qualities, they'd sooner or later show up inside the F-K list, to which I subscribe for several months (nearly a year?). (2) The situation inside the "less official" side of thje Internet, at the moment (aka mailing lists) is so notoriously repressive that perhaps a _minority_ of mailing lists do not indulge in so-called "forcible unsubscriptions". E.g. what about the "Orgonomy mailing list" kicked out an eloquent critic of its owner (Dr. Demeo) (can find all names and details if you like) just because he opposed Dr. Demeo's "experiments" in an Israeli desert which (allegedly, according to the critic) resulted in people's deaths. I mention this case, because I was present there, and because (just like the "Cypherpunks" list) it was directly or indirectly related to issues of Freedom ("Orgonomy" being the "Alternative Psychology" of a rather unconventional thinker called Wilhelm Reich who died in an American jail after the McCarthian State framed him). > Ignore him. It is not ethical to send such strong negative _injunctions_ to masses of people and also to strangers (the 1900-strong members of the cyberphunks list for instance). Because, you may or may not have strong reasons for believing you are justified in such invalidation, but more than a 1000 people are now _told_ by (self-appointed) "experts" such as yourself what and whom to ignore or to believe. (Like sheep led to the slaughter)... This was my objection also inside the F-K list, for _some_ of the postings in the past, but none of these postings was connected with acts of censorship, or with "sweeping generalisations" without evidence. On several occasions that I searched and found who or what they were talking about, I discovered they were talking about people whose activities were indeed horrifying (forged cancellations etc) and who also fought back. But what you are doing now, extending the "1-person-blacklist" to your number-two-entry (Mr. Boursy) is exactly the thing that I hoped you might avoid. First they kicked out Dimitri Vulis. Then they slandered and kept out Steve Boursy. Then... When they came after me, there was nobody left to support me. (You can perhaps realize what this paraphrase is about)... :-( Sincerily, and with... Sanity of Mind :-) George Stathis

3 2

Crypto Bounties: Another Thought that crossed my mind.
by snow 17 Dec '03

17 Dec '03

Here we go again: There are is a lot of software that we would all like to see developed and deployed right? There are a lot of people out there who write code, sometimes even freely redistributable code, but they have to eat, and get their net access right? Well, I was thinking, what if a "Crypto Software Bounty Server" were set up, so that someone could propose a tool that they would like to see, along with an initial bounty. Others could contribute toward that bounty (anonymously if they wish) until either the tool was delivered. The original issuer sets standards for the software (i.e. "easy to use interface to mixmaster remailers for Macintosh", then must define easy to use; Software considered delivered when in [alpha beta late-beta &etc.]). The first to present software meeting these qualifications gets the bounty, with the caviate that the software must be either gnu-copylefted, or some similar "free use" copyright, after all, "The Net" paid for it... Some of the problems (and potential solutions) I can think of in this: 1) Refusing to honor the contract--Maybe when a project is proposed, some other people (for a small percentage of the total) sign on as judges. When they feel that it reached the stated goal, then it is done. -Or- Money put up is non-refundable, and the bounty stays in the "bank" until claimed. 2) If the money stays in the bank until claimed, people might not put up that much (or enough) to make a specific project worthwile-- This could be solved by allowing the "bounty" to lapse in one of 3 ways: A) <x> length of time after the initial proposal (bad because i) someone could already be working on it; ii) bad because other people might add to the bounty, so a potential programmer might not start until the "pot" has grown to a certain level. B) <x> length of time after the last addition to the bounty, bad for both i & ii above. These can both be gotten around (and other problems) by allowing programmers to "register" with the service that they are working on a project (either anonymous registery, so that people will still contribute to the project, or list those registered so that people know [if who] someone is working on it) 3) Funding: The server (in both the machine and the organizational sense) could be funded by: A) Interest on the money accumulated. B) A percentage of the bounty (say 10%) C) Both A & B. Has anything like this been proposed before? I know that the FSF (IIRC) accepts contributions, but I am thinking of something more targeted, more "market driven" if you will. This could be expanded to non-crypto software as well, just think, if half the X Window users ponied up $5 a peice for a "good, easy to use non-motif word processor", how long do you think it would take for someone to start coding a MS Word killer? Comments? Petro, Christopher C. petro(a)suba.com <prefered for any non-list stuff> snow(a)smoke.suba.com

1 0

~~~ F.Y.I. ~~~
by ReplyOnly＠ByMail.com 17 Dec '03

17 Dec '03

Dear Friend, The Only Internet Book you will ever Need.... So you're on the Internet, but don't know what to do, where to go, or how to do it. This EXCITING 175 page, 14 chapter, E-Book will cover everything from the World Wide Web, Veronica, IRC Clients, Gopher, Telnet, Advanced Email, and how to set up your own electronic store front. Whether you're a veteran on the net or have just begun, there is something to LEARN from "Your Personal Guide to the Internet". The Internet is growing daily and it is quickly becoming the wave of the future. Have you ever wondered what people are talking about when they mention FTP or client-server protocol? Has it made you feel left out when you didn't understand their lingo? Everyone knows that KNOWLEDGE is POWER, so why not learn more and take advantage of it? Picture this. You buy a beautiful boat, and you go to take it out on the lake. You get there, you can start the boat, but can't get it to go anywhere. That is how many people are on the Internet. They have the software and the ability to go online, but don't know what to do with it. This is where "Your Personal Guide to the Internet" comes in. Just as a boat manual would have been useful to allow you to go on your trip, this guide will allow you to do just about ANYTHING that you can imagine on the Internet. So, how much will this knowledge cost you? Simply, $4.00! That's right, FOUR DOLLARS. Why are we selling it for a such a LOW PRICE? We feel that everyone who is online should be able to use the Internet to their full capabilities. Why go to the bookstore and spend $50 to $100 on Internet books, when you can get everything you need for $4.00? This is a MUST HAVE! Do not pass up this OPPORTUNITY! This is a LIMITED OFFER. **** If you order within 10 days, As a SPECIAL BONUS, you will also receive "1000 Places to Advertise for Free"! **** ORDER FORM (print this out and mail it along with your cash, check or money order): Name ______________________________ Address ____________________________ City _______________________________ State_______________________________ Zip Code ____________________________ Phone Number (if sending check) ______________________ Email Address ________________________@_______________________ Would you like this on diskette ($7.00 includes S & H) or emailed to you for only $4.00? (circle one) Make All Checks Payable To: Creative Financial Alternatives Send check or money order to: Creative Financial Alternatives 14837 Detroit Ave. Suite 135 Cleveland, OH 44107 ***Orders will be shipped within 48 hours upon receipt.*** ***Please Note: All checks are held for 5 business days.. ***Due to the Overwhelming demand Please Don't Reply Back By E-Mail.

1 0