December 2003 - cypherpunks-legacy

Re: Security flaw in PGPverify of INN (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\. ..\|/..|sunder(a)sundernet.com|you once again. I thought you were |/\|/\ <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/ ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/. .+.v.+.|God of screwdrivers"|my eye and there we were.... |..... ======================= http://www.sundernet.com ========================== ---------- Forwarded message ---------- Date: Tue, 14 Oct 1997 17:34:11 +0200 From: Peter Simons <simons(a)RHEIN.DE> To: BUGTRAQ(a)NETSPACE.ORG Subject: Re: Security flaw in PGPverify of INN -----BEGIN PGP SIGNED MESSAGE----- I am replying to the "security problem" report in pgpverify written by Lutz Donnerhacke, which has been delivered via several mailing lists, including BUGTRAQ and Best-Of-Security. Normally I'd simply ignore this article, but this is so breath-takingly ridiculous that I have to set a few facts straight. Lutz Donnerhacke <lutz(a)IKS-JENA.DE> wrote: > I was urged to send you the following information. I noticed CERT and tale > itself. But tale claims that the problem is not a problem of pgpverify, it's > a problem of some krauts trying to send checkgroups monthly using a bot. > > The checkgroups mentioned were send since a year. They do not include Date: > and Message-ID: because these values were not predictable by the human > signer and the bot does not know the passphrase to work with. > > In consequence there are checkgroups out there which can be resend at any > time causing a lot of trouble, because the signature is still valid even if > a new Message-ID: and Date: line are used. > > The obvious fix is to modify pgpverify to block such control messages. > ftp://ftp.iks-jena.de/pub/mitarb/lutz/ contains the necessary fixes. This is plain bullshit. pgpverify is working just fine and there's no security leak or malfunction in the script. The real story behind this 'report' is as follows: Lutz is the moderator for the german language de.* USENET hierarchy. One of his duties is to send out regular checkgroups and other control messages. What he did is that he didn't include the Message-Id and Date header into the signature of the control messages that he posted. He only signed headers like From and Subject. So he posted control messages with incomplete signatures for maybe a year, until this was first noticed and publicly addressed by Ralph Babel. The problem with these control messages is that anybody is able to re-post them with a new Message-Id and Date. Due to the correct PGP signature, most INNs will simply execute them, thus deleting all changes in the hierarchy since the checkgroups was posted originally. While this is not a major problem, it certainly is a problem, as all groups that have been created past a certain date can easily be removed, etc... When his mistake became public, he didn't stand up for it and created a new key to start posting correct control messages, rendering the old ones useless, he put the blame on Tale and his script instead. So please don't believe this "security flaw". pgpverify is working just fine and if the responsible person will use PGP correctly, there is no problem at all. -peter -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 iQCVAwUBNEORSw9HL1s0103BAQEgugP9FWJMNivNBqmJElzoQ6pXnwvS6QsbLjQG YrwHzvcYY3CAR7R446gr/WeuxW1JI1t9+yql8TNSvHeEXAX+qgz/ZMCjcjgjg0Pe j0BuVLBBfKuBoxGZDQybRybu3d5Xflqk07W9HjPP0tDtdkUcjndHr2J1Ea/J4zTd QgGNNUoZDFM= =brmw -----END PGP SIGNATURE-----

3 2

Magic money
by Eric Wilhem 17 Dec '03

17 Dec '03

Is the guy still around who wrote " Magic Money" and if so where can I communicate with him? Apparently his name is "Product Cypher". Thanks, Eric Wilhem

1 0

info
by Stefan D. Wolf 17 Dec '03

17 Dec '03

1 0

Re: Encyrption Program
by semprini＠theschool.com 17 Dec '03

17 Dec '03

This is in response to the several posts regarding the assumed weakness in the program I wrote: While it is true that PRNG's are not very good, because of the inherent lattice structure, I believe I found a way around that problem. To work around the lattice problem, I used a systm of cubic arrays. The program first creates sixteen cubic arrays, and fills them one space at a time with random characters. When the stream of characters to be XORed with the plaintext is generated, it picks a random cube and a random location with that cube. The resulting "random" character is then XORed with the appropriate character of the plaintext. If someone can prove to me that this method is stupid or easily breakable, I would actually be happy. So, those of you bent on proving that I'm wrong, I heartily encourage you to do so. As I mentioned before, you can download both the compiled version *and* the source at "http://www.brigadoon.com/~semprini/3dmx". If you are having trouble reaching that site, e-mail me and I will send you a copy via e-mail. Thank you for your interest and criticisms. They have been helpful. --Dylan

4 3

CDL is here!! (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from mega(a)cash-site.com ----- >From mega(a)cash-site.com Tue Oct 14 13:49:23 1997 From: mega(a)cash-site.com Message-Id: <199710141849.NAA10744(a)enteract.com> Date: Tue, 14 Oct 1997 14:46:05 -0400 X-Sender: mega(a)cash-site.com To: mega(a)cash-site.com Subject: CDL is here!! CDL - the "first" true software that will "change your life" Commissions paid direct from the field DIRECT to YOU!!! No more worries about receiving checks - YOU get paid first! The FIRST company to tap into the $200 billion dollar software industry as a "home business" Packed with software...loaded with value...$200+ CD packed full of software included! There's only ONE WAY to find out more - go download the software for FREE.....install it and look at it - it will blow your mind!! (backed by major corporations) Download your FREE copy today at: http://www.makecash.net/cdl A great way to "make some extra cash" Explosive Opportunity to get in FIRST!! REMEMBER - this is the FIRST in a multi-billion dollar field..are you going to watch us or join us!! We have full support: conference calls daily toll free sizzle line fax-on-demand FREE webpages WOW!!! FREE Download! http://www.makecash.net/cdl /////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. //////////////////////////////////////////////////////////////////////////////// ----- End of forwarded message from mega(a)cash-site.com -----

1 0

Hi from the Girls...... (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from 36568300(a)18565.com ----- >From 36568300(a)18565.com Mon Oct 13 20:04:20 1997 From: 36568300(a)18565.com Date: Mon, 13 Oct 97 15:26:38 EST To: mailmaster(a)fish.net Subject: Hi from the Girls...... Message-Id: <6730057729034.43209(a)fish.net> Reply-To: mailmaster(a)fish.net X-Pmflags: 340788480 X-Uidl: 1834e532395abb83946c924b47abc32f Comments: Authenticated sender is <mailmaster(a)fish.net> BEWARE!!! WARNING!!! NOTICE!!! This is an adult site. You must be 18 to enter. If you are offended by subjects of sexual nature PLEASE DO NOT ENETER!!!! In the event you enjoy sex you must join us for the youngest, hotest live sex on the net. You hear us, see us, and direct our every move. To join us now just click on the higlighted text below: http://youngnlusty.com Love, The girls at Young N Lusty ----- End of forwarded message from 36568300(a)18565.com -----

1 0

Cyber Promotions Selling Off Its Own Mailing List (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from cyberout(a)pleaseread.com ----- >From undeliver(a)pleaseread.com Mon Oct 13 20:24:07 1997 Message-Id: <199710140123.UAA09407(a)enteract.com> Date: Mon, 13 Oct 1997 21:07:02 -0400 (EDT) X-1: NEW! Click on http://www.cyberpromo.com for FREE AUTORESPONDERS! X-2: This server blocks unauthorized email relaying. X-3: Link To Anti-Relay Code X-4: THIS MAIL WAS SENT THROUGH IEMMC'S NEW REMOVE FILTRATION SYSTEM! X-Advertisement: Visit http://www.iemmc.org for name removal information. From: cyberout(a)pleaseread.com To: fulldatabase(a)pleaseread.com Organization: Cyber Sender 7.0 Subject: Cyber Promotions Selling Off Its Own Mailing List ANNOUNCEMENT: Cyber Promotions is SELLING OFF ITS OWN MAILING LIST! For the first time, you can own Cyber Promotions proprietary list of 2.9 million email addresses. This is the same list to which Cyber has sent its e-Mags and exclusives. This list has never been sold before! You can take advantage of Cyber Promotions hard work since 1994. Cyber has painstakingly collected these email addresses from the following sources... * Online classified advertisements * Subscribe requests * Autoresponder requests * FreeResponder owners * FreeRelay recipients * Online business-related profiles * Web visitors * Internic records * Web mall advertisers * ... and much more! Since many of the people in this database have been on this exclusive list for over 6 months, they have had many opportunities to unsubscribe. This list only includes people who have not requested removal. Very few of these email addresses are available from other sources. You can use this list over and over again. You stand to make big money if you market your product, service or opportunity to this database. Regular price will be $2995 -- ONE WEEK SPECIAL only $995 -- (SAVE $2000) YOU CAN BE ONE OF THE VERY FIRST PEOPLE TO BENEFIT FROM THE BEST MONEY-MAKING EMAIL LIST EVER! So, don't wait. Order this list today before your competitors get to it first! This list is available on CD-ROM. You can receive it via 2nd day Airborne Express. Call Cyber Promotions at (215) 628-9780 between 10am and 7pm Eastern, and ask for Brian or Alan. Dont delay! This is the list you've been looking for. 48 hour special: Order within 48 hours and receive free limited versions of Stealth Bomber (send 50,000 emails an hour from your local dialup account and cloak your account id) and List-X (collect your own email addresses). Call NOW! (For list removal, hit reply and type "remove") ----- End of forwarded message from cyberout(a)pleaseread.com -----

1 0

FREE HOME BUSINESS KIT WITH OVER $600 IN FREE SOFTWARE!! (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from netbiz(a)mail2.c-flash.net ----- >From netbiz(a)mail2.c-flash.net Mon Oct 13 23:00:35 1997 From: netbiz(a)mail2.c-flash.net Message-Id: <199710140400.XAA11339(a)enteract.com> Date: Mon, 13 Oct 1997 22:57:49 PDT Date: Mon, 13 Oct 1997 22:57:49 PDT Subject: FREE HOME BUSINESS KIT WITH OVER $600 IN FREE SOFTWARE!! X-Mailer: Emailer Platinum (tm) by Internet Marketing Inc. //////////////////////////////////////////////////////// Realizing that many of you do not wish to receive UCE, if you would please type REMOVE in the Subject Header, your name will be REMOVED permanently from our mailing lists. All addresses being sent to now have be cleaned through our REMOVE System. By typing REMOVE in the header, you will no longer receive mail from this address!! Thank You! ///////////////////////////////////////////////////////// This is a 100% FREE OFFER to get your own FREE HOME BUSINESS KIT. This is NOT a Scam, Nor a Pyramid Scheme, but is however a Legal Legitimate Network Marketing Business!!! This Business is a FULLY licensed Telecommunications Company operating with licenses in all 50 states. There are absolutely NO PURCHASE REQUIREMENTS to join our company. SORRY...THIS OFFER IS FOR US RESIDENTS ONLY!!!! THE FREE HOME BUSINESS KIT INCLUDES: 1) FREEDOM Bulk Emailer worth $400.00 2) CHECKR SOFTWARE, worth $200.00 allows you to accept checks over fax,phone, or email. 3) Over 30 Million Email Addresses 4) FREE PERSONALIZED WEB SITE 5) Premade Marketing Letters and Templetes 6) Over 1600 FREE Sites To Advertise Your Business 7) Personalized Guidance and Direction 8) Over 50% Savings on Long Distance Bills at only 9.9 cpm 9) Over 90% Savings on Calling Cards, with NO SURCHARGE! 10) 800/888 Personal or Business Phone Lines at 9.9cpm for only $1.50/month!! 11) Huge Income Potential!! 12) Monthly Residual Income!! 13) Plus Much, Much More!! BEFORE YOU READ ANY FURTHER, YOU NEED TO KNOW THAT THE FOLLOWING BUSINESS OPPORTUNITY WILL COST YOU ABSOLUTELY NOTHING! IT'S 100% FREE!!!!! Do You Know 3 People That Use Long Distance? Dumb Question Huh? If you GAVE those 3 people a FREE Business Kit including all the Necessary Software, Do You Think They Might Know 3 People Who Use Long Distance? What if You Told Them They Could: Save on every Long Distance Call! (24 Hours a Day!) Long Distance Rates as low as 9.9 cents per minute> AT&T, MCI, and Sprint can't touch this! 800/888 for your home! Avoid calling home collect! Perfect for kids away at college or even use it to check your messages. Your cost for this is the same 9.9 cents per minute! AT&T charges a $10.00 monthly service fee for this feature. It's ONLY $1.50 per month with us! No-Surcharge Calling Card! Save almost 90% with rates as low as 19 cents a minute! (MCI, Sprint, and AT&T charge 80 cents minimum surcharge per call.) Pick your own card number and PIN for convenience. One More Thing . . . Don't confuse THIS with phone "clubs" who charge a monthly fee ($10-$50) for the "rights" to get a discount. Remember, you don't have to join anything to receive any of these great communication services, like long distance, paging and calling cards! Introducing The Easiest, Most Profitable, and Fun Way to Not Only Save Money, but to Work Part Time at Home and Get Paid!!! Lets' Take a Look at the Realistic Income You Can Generate By Just Telling 3 People!! You Tell 3 People about this offer = 3 people Those 3 Tell 3 People about this = 9 people Those 9 Tell 3 People about this = 27 people Those 25 Tell 3 People about this=81 people Those 81 Tell 3 People about this=243 people Those 243 Tell 3 People about this=729 people Those 729 Tell 3 People about this=2187 people Those 2187 Tell 3 People about this=6561 people Now add up all 8 levels of people to get = 9,840 people YOU KNOW HAVE 9,840 PEOPLE ON YOUR SUCCESS TEAM Now The Fun Part!! We know just by human nature that people could spend an average of $25.00 per month on Long Distance. Some people spend 10 times that, and others may not spend any. For all practical purposes, lets say all 9,840 people spent only $25.00 per month on Long Distance. 9,840 people x $25.00/month = $246,000/month on Long Distance!! HERE'S WHERE YOUR REWARD COMES IN!! Because You Told 3 People and got the ball rolling you are now paid 2% commission on the total monthly phone bill in your team. That's $246,000 Dollars X 2% Commissions = $4,920.00/per month in your pocket!!! WOULD THAT HELP INCREASE YOUR LIFESTYLE A BIT? YOU KNOW IT WOULD!! BUT TELLING 3 PEOPLE IS VERY CONSERVATIVE!! What would your income be if you told 5 people? I can't tell you, because you wouldn't beleive me!! So is this for real, or am I just blowing smoke? You Bet It's For Real!! People using Long Distance Is as natural as the air we breath, and the food we eat. This can, and will happen if you do your part!! What is your part? 1.You need to Tell 3, Tell 4, Tell 5, etc. and spread around your ID#, mine is #AH603800 2.You need to work with your downline to make sure that they Tell 3, Tell 4, Tell 5, etc. 3.You need to stay in touch and teach them how to do what you just did!! My favorite saying is "Give a Man a Fish, and Feed Him For a Day! Teach a Man to Fish, and Feed Him For Life!" So What Do You Need to Get Started? You Need to Contact Me For More Detailed Information including the Toll Free Sign Up Number and Web Site...You can contact me at netbiz(a)mail2.c-flash.net and type "MORE INFO" in the subject header, or leave a message for me at 414-669-3722, and make sure you leave your email address and phone number. After you sign up FREE, send me an email at netbiz(a)mail2.c-flash.net, be sure to include your name, address, telephone number, email address, and your new ID# they will assign you, and I will rush out your FREE BUSINESS AND MARKETNG KIT, including FREEDOM BULK MAIL SOFTWARE, and CHECKR, check by fax or phone software. Plus Your FREE MARKETING START UP KIT!!! ----- End of forwarded message from netbiz(a)mail2.c-flash.net -----

1 0

Re: PGP CAKware & IETF controlled Open-PGP standard
by Omegaman 17 Dec '03

17 Dec '03

Adam Back writes: > Jonathan Seybold <jseybold(a)pgp.com> writes: > > Adam, one aspect of your suggestion puzzles me: > > One thing which concerns me most is KNOWING when a message I send > > (or receive) could be read by someone else. The PGP CMR scheme makes this > > very clear: if there is an extra CMR key, the message may be read by > > whomever controls that key, if not, only the recipient may decrypt the > > message. > > If, however, the message is secretly re-encrypted to a corporate > > storage key AFTER it is received, I will never know that. > > You will if you mark the key with this information. This is a straw man anyway. You don't know this now. Someone you are communicating with could already be forwarding plaintext to a third party unbeknownst to the sender. This is a "do you trust the recipient" issue. > What I _am_ arguing is that in designing systems to provide companies > with data recovery mechanisms that you should a) not weaken security > more than necessary, and b) that it would be nice if you used a method > which doesn't introduce GAK compliancy for communications keys. > > I presented I think in plenty of detail an alternate mechanism which > is both non-GAK compliant, and more secure. So what is the problem? > Is there a technical flaw in my solution? No. But there is in their's(PGP Inc.) as I think you and others have amply demonstrated. The technical issues alone are enough to reject usage of PGP5.5's CMR features. It intrigues me that there has been virtual silence from PGP employees on the technical issues. Only Hal Finney via the IETF-Open-PGP has come anywhere near commenting upon this. I haven't seen anyone from PGP Inc. comment on your data-recovery implementation ideas. In my optimistic moments, I take this as a sign that internally, PGP inc. is giving consideration to producting more sensible and effective solutions. (Maybe even as outlined here) > > This means, I believe, that they should NEVER INVOLVE HIDDEN BACK > > DOORS THAT USERS ARE NOT AWARE OF. > > Agreed. You can flag backdoors with either solution. See above. The prescence of flags does not prevent this. By definition I might add ;). Trust issues, etc. are involved. > It works well enough, but it could be made much more secure, by > separating storage key functionality from transient message key > functionality. This would also give you the chance to resolve the > articificially created need for GAK compliancy, which arises because > you are being forced by this lack of distinction between key > functionalities to use one key for both long term storage and what > should be transient communications key usage. Hal Finney's description of key sttributes indicate that implementing separate storage keys would not be hard for PGP Inc to implement in the next release. > Decentralised control is good, of course, but the pgp5.5 and SMTP > policy enforcer is a ready to roll GAK system. Of course, other companies could have (and will) implement similar systems. That PGP, with it's reputation and stated policies, would is surprising. Hopefully, PGP will live up to their reputation by realizing this misstep and correcting it with a more secure, less GAK-compliant implementation. > The PGP bashing PGP observes is an attempt by the pro-privacy crypto > community to influence PGP to re-think the GAK compliancy, and to > point out the more secure way to implement corporate recovery of > stored email messages without GAK compliancy. > > I reserve the right to bash any company which attempts to field GAK > compliant software. The "bashing" in this notoriously harsh forum has been rather tender in my view. Perhaps the perception of "bashing" is based on recognition (and guilt) that the CMR mechanism is flawed and goes against "the spirit of PGP." Methinks, y'all doth protest too much. -- --------------------------------------------------------------------- Omegaman <mailto:omegam@cmq.com>|"When they kick out your front door, PGP Key fingerprint = | How are you gonna come? 6D 31 C3 00 77 8C D1 C2 | With your hands upon your head, 59 0A 01 E3 AF 81 94 63 | Or on the trigger of your gun?" Send email with "get key" as the| -- The Clash, "Guns of Brixton" "Subject:"to get my public key | _London_Calling_ , 1980 ---------------------------------------------------------------------

1 0

New Mailing List: Terrorism
by John Gilmore 17 Dec '03

17 Dec '03

Sounds like some "civil rights oriented" EMS, fire, law enforcement, intelligence community, etc people should join, and let the rest of us know what they are doing... John From: churton.budd(a)mediccom.org (Churton Budd) Date: Sat, 11 Oct 1997 10:55:40 GMT TERRORISM --------- TERRORISM is intended for discussion about terrorism response and prevention, including intelligence gathering and emergency responses. Topics include weapons of mass destruction, suspicious activities, educational and funding opportunities, politics, and response ideas. TERRORISM is an open forum to EMS, fire, law enforcement, intelligence community, disaster preparedness & response, and military personnel with an interest in preventing and responding to terrorist incidents. Announcements about new educational opportunities and grants are welcome, as are new products, services, or technologies directly related to terrorism response. Listname: terrorism Post to: terrorism(a)mediccom.org subscription command: subscribe terrorism sent to: listserv(a)mediccom.org

1 0