December 2003 - cypherpunks-legacy

Re: Newt's phone calls
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Adam Back <aba(a)dcs.ex.ac.uk> wrote in article <5bp18k$1cc(a)life.ai.mit.edu>... > GSM encrypts only the links to the station - the traffic goes in the > clear through the station. Plus A5 (crypto algorithm used in GSM) is > weak, 40 bits of effective key space. > > It could be worse to have poor crypto, than no crypto, I disagree for two reasons, first there is a big difference between having poor locks and no locks. Most locks can be picked by an expert, they are effective against many theifs however. Second if everyone in the world was using 40 bit email encryption it would prevent most of the "promiscuous" interception of communications. The danger in weak crypto is thinking that it is strong crypto. GSM is weak crypto but stops the type of snooping the Martins engaged in. If you know not to talk about something secret on one then low crypto is better than having a signal anyone can pick up on a device from radio shack. Phill

2 1

Re: IMDMP: SOURCE CODE RELEASE ANNOUNCEMENT
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> >> ...but I must say the list has gone downhill sharply since > >> the start of the censorship. > > > >I guess this a classic case of seeing what you want to see. > >(Uh, Paul, the moderation experiment HASN'T STARTED YET.) I knew that when I wrote this, but the fact that Vulis has been banned from the list is most definitely censorship and has lowered the philiosophy of the list (as in original purpose and ideaology) to a lower plane and provoked a number of flame wars which would otherwise have not taken place. > No, he's got it right. The announcement of the moderation experiment > was followed by a decline in interesting threads. I noticed this too but it was not what I was referring to. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

DATANET SECURITY 97 PROGRAM
by korinne＠datasec.net 17 Dec '03

17 Dec '03

Conference program Datanet Security 1997 Annual International Conference and Exhibition on Wide Area Network Security FEBRUARY 17 - 18 - 19 - 20, 1997 HYATT REGENCY MIAMI HOTEL & CONVENTION CENTER All lectures and presentations have been confirmed Keynote speakers: Monday February 17, 1997 The 1997 Datanet Security conference will be opened with a keynote address by Dr. Ruth A. David, Deputy Director Science & Technology of the Central Intelligence Agency. Following the opening address, Mr. Stuart A. Baker will deliver a keynote speech "Legal Aspects of Network Security". Stuart Baker is partner with Steptoe & Johnson in Washington DC, and former lead counsel for the National Security Agency. Keynote speakers: Tuesday February 18, 1997 The second day of the Annual Datanet Security Conference is highlighted with a presentation by Dr. Rob Kolstad "Non-Security Issues Affecting the Future of the Internet". Rob Kolstad is President of BSDI Inc. "What's Slowing down Deployment of Security ?" is the title of the next keynote address by Novell's Chief Security Architect, Dr. Radia Perlman. She was featured in the 20th anniversary edition of Data Communications magazine as one of 20 most influential people in the field of computer networking. Keynote speaker: Wednesday February 19, 1997 This conference day we feature Mr. Scott Charney as a prominent keynote speaker. Scott Charney is the principal government authority on computer crime. He heads the federal prosecutors and leads the Computer Crime and Intellectual Properties Section within the Department of Justice. ADVANCED TECHNOLOGY PROGRAM Monday February 17, 1997 ELECTRONIC INTELLIGENCE "Intelligence Behind the Journal Intelligence" - Olivier Schmidt Olivier Schmidt is founding editor of several important international professional news journals and expert publications. Among these "Parapolitics", "Intelligence Newsletter" and "Intelligence". He co-authored "Intelligences Secretes" and "OSS et la Resistance Francaise". He lives and works in Paris, France. "The King of Secret Readers: Edgar Allen Poe, William Friedman, and the Logic of the Cold War" - Professor Shawn Rosenheim Shawn J. Rosenheim is Associate Professor of English at Williams College (Williamstown, Mass.), and a founding member of the Communications Technologies Research Group. His most recent publication is "The Cryptographic Imagination: Secret Writing from Edgar Poe to the Internet" (Johns Hopkins University Press, 1996) DISCUSSION PANEL Traditional versus New Technologies: A Challenge for the Intelligence Communities Session and Panel Chairman - David Whipple David Whipple is Executive Director of the Association of Former Intelligence Officers, AFIO. As no other Mr. Whipple is able to illustrate the traditional methods of information gathering. INTERNET SECURITY The Changing Role of the Firewall - Stephen Flaig Mr. Flaig is Vice President for LanOptics Inc., developers of the Guardian firewall. Network Access Flexibility through RADIUS - David Dawson David Dawson is General Manager Network Security Business Unit for Ascend Communications Inc. Previously he was Chief Executive Officer of Morningstar Technologies Inc. He holds a BS in Electrical Engineering from the US Military Academy at West Point. Internet Security and the IBM Firewall - Peter Crotty Peter Crotty is worldwide responsible for IBM's technical firewall support program. Secure Access: If you don't have security everywhere, you don't have it anywhere ! - Doug LaBorde Mr. LaBorde is Manager with the Network Security Business Unit of Ascend Communications. NT SECURITY Windows NT Security: Networked Perspectives - Charles Rutstein Charles Rutstein is Principal Consultant with Price Waterhouse, and has extensive front line computer and network security experience. He authored several books on computer viruses. His latest work, dealing with Windows NT security, has just been released. NT Internet Security - Firewalls, Web-servers, and Vulnerabilities - Bill Stout Bill Stout is network security analyst and senior systems administrator with Hitachi Data Systems. He specializes in Windows NT security issues. VIRUSES Viruses and the Internet; email, Java, Active-X; the new virus carriers - Thierry Giron Thierry Giron holds a Computer Science Hon. degree from Middlesex University (London, UK), and a Business degree from ESC in Reims, France. He joined Trend Micro in Taiwan in 1992, and is since Trend's Customer Engineering Manager for the North American offices. Minimizing the Virus Threat - Glenn Jordan Glenn Jordan is the leading virus technology expert with Dr. Solomon, and is an established member of the Computer Anti-virus Research Organization, an international network of anti-virus researchers. Mr. Jordan is a graduate of the University of North Carolina. Tuesday February 18, 1997 INTERNET SECURITY Cyber Thieves - Gregg Lebovitz Gregg Lebovitz is Director of Security Products at BBN Planet. Mr. Lebovitz spent 15 years at Carnegy-Mellon University, designing, implementing and deploying network routers and distributed applications. Accounting for Square-Root Attacks in Cryptographic Design - Michael Wiener Michael Wiener is senior cryptologist with Entrust Technologies (formerly Nortel Secure Networks). His expertise is in the area of cryptanalysis, authentication, and key-exchange protocols, public-key infrastructures, design of cryptographic systems, and high-speed implementations of public-key cryptosystems. He is agraduate of the University of Waterloo (Canada). Virtual Private Networking: Integrating Internet and Intranet Security - Tony Rosati Tony Rosati is co-founder and Vice President for TimeStep Corporation. He leads design teams ranging from the development of public-key and DES based integrated circuits to the development of system level communications security solutions utilizing cryptographic techniques. Approaching End-to-End Security - Paul Ferguson Paul Ferguson is a senior expert with Cisco Systems. His principal disciplines are Internet security, large-scale routing and design architecture. NETWORK SECURITY Assurance in Products for the Internet - Alan Borrett Alan Borrett is member of the UK IT Evaluation & Certification Scheme, under authority of Her Majestys Government Communications Headquarters (GCHQ) Computer Security in the Third World: The Mexican Case - Prof. Guillermo Mallen Professor Mallen teaches and researches at the Ibero-Americana University in Mexico. He is a former President of the Mexican Academy of Informatics. Single Point Security: The Unisys Vision for Enterprise Security Administration - William Buffam William Buffam is software architect with Unisys Corp. His background is in operating systems, networking, and solution engineering. He holds a Computer Science degree from the University of Manchester. Security Solutions for the Internet - Eli Herscovitz Mr. Herscovitz is founder of RadGuard Ltd., provider of secure datanetwork systems. He chairs the Networking Security Standardization Committee of the Standards Institute of Israel. TUTORIAL Hacker Tools & Techniques and Intrusion Testing - A dual presentation by Edward Skoudis and Cynthia Cullen Cynthia Cullen is a senior consultant with Bell Communications Research Security and Fraud Management. Edward Skoudis is a senior expert in network security issues with Bellcore's Navesink Research Center. Wednesday February 19, 1997 COMPUTER CRIME Network Security's Future - Glenn Gianino Glenn Gianino is Vice President of Advanced Technology with Computer Associates International. His responsibilities included all systems software and hardware including micro, midrange, and mainframe systems, as well as all networking, SNA, wide area networks and Internet services. His most recent assignment involves networking security on all platforms and operating systems. Mining the Information Klondike: CINet, a tool to fight organized crime - Robert Heibel Robert Heibel is Director of the research/intelligence analyst program at Mercyhurst College (PA). A 25-year veteran of the Federal Bureau of Investigation, he served as its Deputy Chief of Counterterrorism. Mr. Heibel is also Executive Director of the Center for Information Research, Analysis, and Training at Mercyhurst. Mr. Heibel is a graduate of Georgetown University. Digital Cash is hard to regulate - Prof. Michael Froomkin Professor Michael Froomkin is associate professor at the University of Miami, School of Law at Coral Gables. He specializes in Internet law and related aspects. Professor Froomkin is a graduate of the Yale Law School, and has a M.Phil. in history of international relations from Cambridge University (UK). He is a Fellow of the Cyberspace Law Institute. Smart Cards: the Coming Wave - James Chen James Chen is founder and President of V-One Corp., a provider of network and internetwork security solutions. Previously Mr Chen was head of the ground network engineering division for Intelsat, responsible for satellite launches. Electronic Commerce on the Internet - Tom Carty Tom Carty is Director of CyberTrust, a division of GTE. Mr. Carty was responsible for the information security privacy organization and architecting key management systems with GTE. He is a graduate of the University of Connecticut and Boston University. ATM: An Emerging Network Technology - Michael Guzelian Michael Guzelian has over 15 years experience in and knowledge of authentication, bandwidth-on-demand, and security issues that face large public networks. DISCUSSION PANEL High Integrity/Mission Critical Systems Session and Panel Chairman - Donald L. Evans Presentations by: Donald Evans, Timothy Stacey and Robert Smock Donald Evans is senior security engineer and senior member of the Johnson Space Center Mission Operations Directorate AIS Security Engineering Team, providing assistance to NASA in developing and maintaining the IS security program for the Space Station and Shuttle ground based programs. He is an advisory board member for the NSA Systems Security Engineering Capability Maturity Model, and a member of the Presidential Sub-committee of the US Security Policy Board. Timothy Stacey was involved with security development for NASA's Space Shuttle and Space Station programs and software engineering in support of NASA and the US Air Force Space Command Systems. He is currently a information security expert with SAIC Space Operations. Robert Smock is head of Flight Operations Information Security Program at United Space Alliance, responsible for providing the primary government contractor support for the protection of NASA's ground-based information resources, which support Space Shuttle and Space Station flight operations at the Johnson Space Center in Houston, Texas.Mr Smock holds a degree in Computer Science. TUTORIAL Network Security: PRIVATE Communication in a PUBLIC World Dr. Radia Perlman and Charlie Kaufman Radia Perlman is Chief Security Architect for Novell, Inc. She is known for the invention of the spamming tree algorithm used by bridges, and many of the algorithms used for routing, including the design of a network that can withstand a denial of service attack. She is the author of two textbooks. She has a PhD from MIT. Charlie Kaufman is security architect for Lotus Notes/Domino. He is the chair of the web transaction security working group of the IETF. He is on the National Academy of Sciences expert panel on computer system trustworthiness. He is coauthor with Radia Perlman, of the book "Network Security: Private Communications in a Public World". Thursday February 20, 1997 INTERNET SECURITY Fighting Piracy on the Net - Peter Beruk Peter Beruk is Director of Domestic Anti-Piracy with the Software Publishers Association. Internet and Server Security - Joshua Peleg Joshua Peleg is the Director of Technical services with Memco Software. Mr. Pelegs expertise is in security, disaster recovery and system level programming. Joshua gained much of his experience while in the Israeli military defense forces. Is your Company a Hackers Help Desk ? - Steve Ritger Steve Ritger is security engineer with SRA International. His expertise is information and network security as well as fraud detection and prevention. JAVA SECURITY Security and "Live" content: A Java Perspective - Peter Coffee Peter Coffee is advanced technologies analyst for PC Week Labs. He has taught information systems management, management science and expert systems development for Pepperdine University, Chapman College, and UCLA. He is the author of "How to program Java". Mr. Coffee is a graduate of MIT and Pepperdine University. TUTORIAL World Wide Web Security Arthur Donkers Arthur Donkers is founder of Le Reseau, an independent security consulting firm in The Netherlands (Europe). He is a graduate of Delft University of Technology, and holds a degree in Electrical Engineering. He authors a monthly column on system administration and security aspects in SysAdmin Magazine. ------------0---------------- Datanet Security 97 is sponsored by the National Association of Webmasters, SysAdmin Magazine, Sprint, and CMP Network Computing Magazine. ---------------------------0-------------------------- Participation in Datanet Security 97 is $ 845. This includes admission to all conference sessions, tutorials and discussion panels, as well as lunches during the four days, a banquet, and a cruise to the Bahama islands (including breakfast, lunch, dinner and show). You can pay on-line via a secure web transaction with all major credit cards. A special hotel arrangement has been made with Hyatt Regency Miami, making discounted room rates available to all participants. The web page with full information is available at http://www.datasec.net Alternatively you can fax 941 775 1533, or email ds97(a)datasec.net. =========================================================================

1 0

HOW AM I MEANT TO GET OFF THIS LIST!
by Marc 17 Dec '03

17 Dec '03

This thing keeps saying im not on it but am! someone help me.

3 3

Fighting the cybercensor.
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Mission: Singapore and China are blocking certain net groups. I think this is a bad thing, question is how can we stop it? The Web was conceived as offering despots and dictators a choice between remaining in the dark ages and allowing freedom of speech. Blocking and filtering schemes threaten this ideal. Requirements: A scheme which makes blocking of individual IP addresses impractical. Architecture: The Web allows for proxies such as provided by the CERN server (and versions of Apache etc). A proxy server configured to accept connections from domains enforcing blocking (china, Singapore etc) can serve as a means of circumventing the restrictions. The problem then arises, how can the victims of censorship find out about the holes in the curtain? I believe that it would not be difficult to persuade large numbers of people to mirror a list of sites maintained at a central location. The blue ribbon campaign attracted a lot of interest on the same topic. Activity that brought to light the political aspect of Web censorship would help the domestic anti-CDA effort. Considerations: [i.e. areas needing brainstorming] 1) Copyright. Clearly copyright holders such as CNN etc would need to be involved. Although proxies have long been a part of the Web and the scheme does not threaten their interests it would be as well to get them on board at an early stage. 2) How can one prevent the proxies themselves being blocked? Some ideas that come to mind: 2a) Only issue new sites gradually so that blocking requires continuous updates. 2b) Use DHCP to change network addresses regularly. 2c) Some crypto hack I can't quite work out (hence the post to cypher punks). I can phrase the challenge more compactly though. We have two sets of opposed groups A and M. The A group wish to establish a continued conversation with groups B and C. M is willing to permit communication with group B but not C. Whenever M discovers that a member of group B is willing to act on behalf of group C, M transfers that member to the C group. The problem is to keep A's channels of communication open despite the efforts of M for very large group sizes. I'm not sure if this is a pure crypto challenge or a game theory problem. Comments? If people are willing to work on this I can provide some facilities and act as a media contact. Phill

2 1

RE: Newt's phone calls
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

get everything needed on a signed cheque. > >A check is no good, most checks are now printed on paper with special lines >that are supposed to become obvious after copying. A signed letter or even >a mailing envelope would probably be better. Actually for the purposes of fax you can trace the signature off the check and then photocopy the traced outline. If you use Mellonex film you can get a very good impression. > Also, scotch tape makes those >pexky shadows disapear like magic. My dad uses it to make multiple versions >of make-up math tests that trivially look like the origional in order to >goad persons who were sick on test day so that they could get the answers >from someone else into printing down those answers and getting less than >random probability. (multiple choice) When I used to do layout of artwork for a magazine we used to use white out to get rid of the shadow lines. There is a particularly good version available in the UK which comes in a red bottle with a flow cap on it. Much better than the crappy pot 'n brush system which is always going hard as the solvent evaporates. Phill PS: I hasten to add that my experience of fraud techniques comes from trying to stop them. PPS: In the days of electronic mail why do people need PS's?

1 0

fingerd
by Toto 17 Dec '03

17 Dec '03

> > Lynx 2.6 is the "latest" for UNIX and they "got" mine. However, > >someone suggesed that it may have been done through finger as well, and > >since my ocmputer is a UNIX box...the people using UNIX shells are gonna > >get nailed too... > > Couple of things you can do: > > 1. Comment out "fingerd" in /etc/inetd.conf and refresh > 2. Install a more secure "fingerd" such that it only > allows "finger `userid(a)node.domain`" instead of > "finger `(a)node.domain`". > > While I've seen #2 in action, I don't know where to go to snarf it. I just > use #1. Anyone know where to 'snarf it'?

1 0

RE: Newt's phone calls
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

>No, the real danger in weak crypto is that the poorly-informed will not >think about it *at all*. If we had "poor crypto", Newt probably wouldn't >have been embarrassed by this sort of casual interception, and the issue >wouldn't have been raised in the public mind. But our communications >still wouldn't be safe from more determined attackers. Brouhahas like >these are good for the pro-(strong-)crypto agenda. Not the way we've being going on, Zero coverage of the crypto issue, zip, nada. That points to EFF and CDT not being on the ball on the crypto issue. Phill

2 1

Re: Dr. Vulis' social engineering experiment
by Toto 17 Dec '03

17 Dec '03

Mike McNally wrote: > Why anyone would expect any particular degree of > "freedom" to use a service run for free by a private individual > is beyond me. I agree, totally. Just because an individual claims, rightly or wrongly, to be a big defender of freedom, involving himself or herself in causes like those of the Electronic Freedom Foundation, does not take away their right to stomp on anyone who disagrees with them on their own private list. To claim otherwise would be as ludicrous as denying the person running the Anonymizer the right to expose the identities of the people he feels might perhaps be abusing his private system, or using it for nefarious purposes, such as hiding their identity from others. Toto > I appreciate the service, but I don't take it for granted and I > certainly don't take it as an inalienable right. > > ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ > Mike McNally -- Egregiously Pointy -- Tivoli Systems, "IBM" -- Austin > mailto:m5@tivoli.com mailto:m101@io.com http://www.io.com/~m101 > ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^

1 0

Re: Dr. Vulis' social engineering experiment
by Nurdane Oksas 17 Dec '03

17 Dec '03

On Tue, 21 Jan 1997, Igor Chudov @ home wrote: > Jane Jefferson wrote: > > > > The heart and soul of the problem is that "sin", "freedom", "good", > > and "evil" are abstract concepts which fluctuate from individual to > > individual. > > An excellent point, Jane. Worth remembering. Why not archive it ...as it may be worth something someday.... oksas

1 0