December 2003 - cypherpunks-legacy

Best Computer School?
by SpyKing 17 Dec '03

17 Dec '03

This is a little off topic but maybe someone can help. I've got a teenage son (HS sophomore) who's interested in majoring in computer science in college with a particular interest in cryptography. He's leaning toward MIT. Any suggestions from list members as to colleges to investigate?

4 3

Passphrase Online...
by John Shaft 17 Dec '03

17 Dec '03

>>If I am connected to the Internet via a SLIP/PPP connection and I >>type my passphrase while being online (for example, in Private >>Idaho, after getting my mail), could that passphrase be compromised? >>If so, how would that be done? There are a number of things that can happen. Basically, if you don't directly control the device/application that is doing the encryption for you, you run the risk of someone intercepting whatever you xmit. For example, if you have a dial up type shell account with your local ISP, and you depend on some UNIX based encryption program to secure your mail (running on the ISP's machine), anyone with root access can tap the tty and watch you enter your passphrase. You're also susceptable (sp?) to someone taping your phone line and looking at you with a packet analyzer. I suppose if you were doing something locally, and someone wanted to be really sneaky, they could embed something like keycopy on your machine (with a virus or something) and get coppied every time you enter a keystroke. I don't suppose it would be all that difficult to get a machine to run a tsr that got kicked off every time you accessed something like, say , PGP....Comments? Shaft! Damn Straigt. shaft(a)africamail.com

2 1

S/KEY (was: 2 Questions)
by Peter M Allan 17 Dec '03

17 Dec '03

Steven M Orrin <privsoft(a)ix.netcom.com> wrote: > Hey guys, > 2 quick questions: > Are there any known hacks or weaknesses in S/Key? S/Key has a rather limited scope, in aiming to prevent replay attacks. These are where somebody snoops on your network to obtain passwords, an uses them in later login attempts. This is undoubtedly a major weakness in most current networks. S/Key addresses this replay of data obtained in passive eavesdropping, but that is all it does. Several attacks against S/Key have been discussed [1], including: race attacks: eavesdropping most of the hash, and racing the user to provide the rest of it active attacks: impersonating the server to learn future hashes or simply hijacking an established session. Strengthening S/Key really means expanding the scope to get an authenticated and encrypted 2-way connection. [John Gilmore's S/WAN may end up achieving this. I'm not familiar with it (yet?).] Ideas for improving S/Key that involve secret data stored on the server tend to get frowned on, as the original aim was to avoid that. In any case you cannot get the full encrypted 2-way connection without getting a whole lot more complicated. Recent discussions [2] have centred on ways to rekey the list of hashes remotely when the count runs down. These changes, and S/Key itself, are better than nothing but where's the ham sandwich ? [3] Beside the protocol weakness there is potential for finding collisions in the hash function (MD4 originally). A choice of hash functions can be provided. See RFC-1938. 1) See also SecureID, which is more complicated and still subject to similar attacks. 2) Not here. 3) Old joke. A ham sandwich is better than nothing, and nothing is better than a life of complete happiness, so ...... -- Peter Allan peter.allan(a)aeat.co.uk

1 0

Re: 4th ACM Conference on Computer and Communications Security
by Remo Pini 17 Dec '03

17 Dec '03

Anyone going there? It's right next doors - at least next to mine :) Remo Pini

1 0

Re: PGPmail for Windows, Version 4.5
by Rob 17 Dec '03

17 Dec '03

On 26 Jan 1997 18:59:32 -0500, you wrote: [..] >It doesn't seem to work with the mail program in MS IE, or MS WordMail. >I understand why some people don't like Microsoft, but excluding >support for popular Microsoft programs seems contrary to their >stated goal of promoting the use of crypto. I believe (according to their page) it's in the works to add support for other programs. It might also be that the MS CryptoAPI may impose limitations on crypto plug-ins that require annoying hacks to use conveniently. But maybe not... I'm surprised the didn't mention Pegasus Mail, which is an amazing "hot" mailer, with a sort-of built-in crypto plug-in capability... it's also free. Rob ----- "The word to kill ain't dirty | Robert Rothenburg (WlkngOwl(a)unix.asb.com) I used it in the last line | http://www.asb.com/usr/wlkngowl/ but use a short word for lovin' | Se habla PGP: Reply with the subject and dad you wind up doin' time." | 'send pgp-key' for my public key.

1 0

RE: Rejection policy of the Cypherpunks mailing list
by Blanc Weber 17 Dec '03

17 Dec '03

From: Sandy Sandfort (By the way, if you don't like moderation, you would hate Eric Hughes' favored solution.) ............................................... What was that? .. Blanc

4 3

Re: Shave the Whales
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Dr.Disruptive Vasectomy died of AIDS last night with his homosexual lover. \|/ @ @ -oOO-(_)-OOo- Dr.Disruptive Vasectomy

1 0

Re: 4th ACM Conference on Computer and Communications Security
by Remo Pini 17 Dec '03

17 Dec '03

Anyone going there? It's right next doors - at least next to mine :) Remo Pini

1 0

Re: Rejection policy of the Cypherpunks mailing list
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Kevin L Prigge wrote: > paul(a)fatmans.demon.co.uk said: > > > I think both of these groups are intellectually dishonest in the > > > extreme when it comes to telling others how this list should be > > > run. I doubt any of them would permit the sort of disruptive > > > behavior that goes on here to go unchallenged in salons they > > > sponsor in their own homes or on Net lists that they themselves > > > maintain. > > > > If you want to talk about intellectual dishonesty try the following: > > > > Imagine if you will a list, the original purpose of which was > > to act as a free and open forum for discussion of cryptography and > > related issues. A list which proudly proclaims in its "welcome to > > the list" message: > > > > We do not seek to prevent other people from > > speaking about their experiences or their opinions. > > > > Now imagine that list falling into a state of content based > > censorship and censorship based on an unspoken but ever present > > class structure, then ask yourself which list you know that most > > closely matches this description, it`s a pretty revealing exercise. > > The exercise reveals to me that only by ignoring the first paragraph > of your example, the part that reads "Imagine if you will a list, > the original purpose of which was to act as a free and open forum > for discussion of cryptography and related issues." can you make > a claim of content based censorship. The purpose of this list was Then why discussion of machine guns should be allowed here? igor

1 0

Re: Shave the Whales
by Huge Cajones Remailer 17 Dec '03

17 Dec '03

Dr.Disruptive Vasectomy died of AIDS last night with his homosexual lover. \|/ @ @ -oOO-(_)-OOo- Dr.Disruptive Vasectomy

1 0