December 2003 - cypherpunks-legacy

Re: SSL weakness affecting links from pa
by ARTURO GRAPA YSUNZA 17 Dec '03

17 Dec '03

> GET forms aren't the only thing wrong with referer, btw. An >associate of mine discovered some prioprietary Netscape information >from the Referer: headers on hits to his website from Netscape >employees, even. Could you elaborate? ---------- From: sameer To: ARTURO GRAPA YSUNZA; Tom Weinstein Cc: toto(a)sk.sympatico.ca; cypherpunks(a)toad.com; stewarts(a)ix.netcom.com; markm(a)voicenet.com; AGRAPA(a)k2.banamex.com; cryptography(a)c2.net Subject: Re: SSL weakness affecting links from pa Date: Monday, April 14, 1997 2:23PM Microsoft Mail v3.0 IPM.Microsoft Mail.Note De: sameer Para: ARTURO GRAPA YSUNZA Tom Weinstein Cc: toto(a)sk.sympatico.ca cypherpunks(a)toad.com stewarts(a)ix.netcom.com markm(a)voicenet.com AGRAPA(a)k2.banamex.com cryptography(a)c2.net Asunto: Re: SSL weakness affecting links from pa Fecha: 1997-04-14 14:23 Prioridad: 3 Ident. del mensaje: A7705E17CEB1D011AF91006097838CEB ----------------------------------------------------------------------- ----- -- > information. This is a security hole in the web site, not in the > browser. The browser follows the HTTP specification. If you have a [. . .] > > In the eyes of some, the referer header is a privacy violation. It > allows a site to see what site you visited before coming there. In the > case of Navigator, we ONLY send the referer header when you click on a > link. Not when you select a bookmark. Not when you type a URL into the > location field. This allows web sites to see who links to them. I > think that's something that a web author is entitled to know. GET forms aren't the only thing wrong with referer, btw. An associate of mine discovered some prioprietary Netscape information from the Referer: headers on hits to his website from Netscape employees, even. I commend Netscape for providing users with the ability to turn off referers. -- Sameer Parekh Voice: 510-986-8770 President FAX: 510-986-8777 C2Net http://www.c2.net/ sameer(a)c2.net

2 1

Cryptographers made fun of on late-night network television
by Bruce Schneier 17 Dec '03

17 Dec '03

The show is Politically Incorrect, on ABC at 1:00am. This show aired on March 21st (which is the night of the 20th): Here's what Bill Mahar said (it doesn't parse well): "Are there any users of cellular phones here? Because people are concerned (2-3 people finally clap) I knew it was a sophisticated group. Um, no. People are concerned about the privacy you know. Newt Gingrich, what happened to him. So a couple of months ago they set out to make these things a lot better so that you couldn't break in. Well. Put in a new code. Yesterday, a team of computer experts announced that they had already cracked the electronic code. And sadly, none of them knew how, still, to unhook a bra." All right, so it's not a GOOD joke. But still.... Bruce ************************************************************************** * Bruce Schneier For information on APPLIED CRYPTOGRAPHY * Counterpane Systems 2nd EDITION (15% discount and errata), * schneier(a)counterpane.com Counterpane Systems's consulting services, * http://www.counterpane.com/ or the Blowfish algorithm, see my website. **************************************************************************

1 0

HOW TO TURN THE WORLD WIDE WEB INTO A MONEY MACHINE
by house＠savetrees.com 17 Dec '03

17 Dec '03

HOW TO TURN THE WORLD WIDE WEB INTO A MONEY MACHINE As a computer owner you have Web Wealth at your fingertips... In a few short years virtually every business will be on the Web ... Don't be left behind... Experts predict that 95 percent of Americans will be on the Internet within 15 years (about where television is today) Dr. Jeffrey Lant, the author of 14 best selling business books, tells you everything you need to know to make Really Big Money on Your Web Site... His NEW book, "Web Wealth" is a fact - filled goldmine of marketing information... If your serious about making money on the Web, this 248 - page power packed book is an absolute necessity... Dr. Lant tells you: *Why almost every business will be on the Web *Why you can't afford to NOT be on the Web *Why you must be associated with and Internet Mall *Why setting up a solo home page makes no sense at all *Why treating a Web Site like a standard print ad is a big mistake *Why the secrets of netvertising generates maximum traffic & results *How to promote your Web Site within the internet *How to promote your Web Site off the Internet *How to build your business with Facts-On-Demand technology *How you can profit from the Internet, even if your running a local service business *How you can profit if your in network marketing *How publications can forget big price increases in paper, production and postage, and make huge profits on the web This MUST-HAVE 8x10 248 page book is a steal at only $27.95 (this price includes shipping & handling). 10 day money back guarantee. If you are not completely satisfied return the book within 10 days any your money will be returned in full. Send your order TODAY... simply write "Web Wealth" with your name and address on a sheet of paper... Send your check for only $27.95 NOW and take the high road to Web Wealth on the information superhighway... Send your order to: Mail House Publishing 403 Nasa Road 1 East Suite 210 / Dept WW21 Houston, Texas 77598 would like your product or service advertised via the internet to over 100,000 people a day call 281-333-0428

1 0

WebWorld 31-32
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

[URGENT] Cyclic codes
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Warning: if you fuck Timmy C[ocksucker] May in the ass, a rabid tapeworm might bite your penis. /\_./o__ Timmy C[ocksucker] May (/^/(_^^' ._.(_.)_

2 1

Re: SSL weakness affecting links from pa
by Toto 17 Dec '03

17 Dec '03

Wesley Felter wrote: > If I want to run an SSL > Web server, why the hell won't Navigator or MSIE let me do it > (peacefully) without a certificate? > If I > already paid RSA's ransom for SSL servers and clients, why should I have > to pay Verisign an outrageous amount of money to make clients "trust" my > server > I know that Netscape is making the Internet safe for rampant consumerism > (if you see the blue bar, it's safe to spend money), but what about > secure, non-financial communications? Sorry, the needs of the AOL sheep > to not have to think about security outweigh everything else. While I > think referrers and cookies are useful, they represent other ways in > which the big commercial browser companies want to pave over the Internet > and turn it into the Mall of America. My own theory is that the Great Beast talked about in the Book of Revelations is the Home Shopping Network. The graven image which the Jews worshipped in the the Egyptian desert was actually a Fat Elvis porcelain figurine, embedded with genuine cubic zirconiums. When Jesus returns, it will be on his own WebSite. The only question is whether the server will be in Jerusalem, Rome, or Salt Lake City. The reason Armageddon will be such a great battle is that Jesus will be handicapped by the fact that so many of his representatives have pissed away the major portion of his reputation capital during his absence. The Home Shopping Network, having never had much reputation capital, will be forced to drop prices dramatically, resulting in us all entering a Heavenly Kingdom where we can each afford a Plastic Jesus for our dashboard AND a Fat Elvis porcelain figure for our boudoir. Of course, the above scenario all depends on Jesus being able to get certification as a 'trusted authority' for his WebSite. I hope he brings his wallet with him. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: [URGENT] Cyclic codes
by Timothy C. May 17 Dec '03

17 Dec '03

Anonymous wrote: > > Warning: if you fuck Timmy C[ocksucker] May in the ass, a rabid tapeworm > might bite your penis. This was already discussed extensively on the list in the early days. It was one of the many threads I started on the subject. Those such as Anonymous, Nobody, and others, are merely recent interlopers who attempt to take credit for discoveries by the original list members, such as myself. After all, how do you think Rabid Wombat got his name? Just say "No" to "TruthMangler Inside" We got tapeworms, we're biting penis's, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:----

1 0

Re: SSL weakness affecting links from pa
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I've written an article on the subject of CA liabilities absent a state digital signature law. Read it and weep. <A HREF="http://www.law.miami.edu/~froomkin/articles/trusted.htm">Click here</A> A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | "Cyberspace" is not a place. U. Miami School of Law | [still avoiding spam] P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

DoDeclassifying Crypto
by John Young 17 Dec '03

17 Dec '03

From: DOD5200.1-R: "Information Security Program" January, 1997 Appendix D Special Procedures for Use in Systematic and Mandatory Review of Cryptologic Information 1. General guideline: Cryptologic information uncovered in systematic or mandatory review for declassification of 25- year old government records is not to be declassified by other than the National Security Agency. The information may concern or reveal the processes, techniques, operations, and scope of signals intelligence (SIGINT), which consists of communications intelligence (COMINT), electronic intelligence (ELINT), and foreign instrumentation signals intelligence (FISINT), or it may concern the components of Information Security (INFOSEC) which consists of communications security (COMSEC) and computer security (COMPUSEC), including the communications portion of cover and deception plans. Much cryptologic information is also considered "Foreign Government Information" as defined in Para. 1.1(d) of the Executive Order 12958. 2. Recognition of cryptologic information may not always be an easy task. There are several broad classes of cryptologic information, as follows: a. Those that relate to INFOSEC: In documentary form, they provide COMSEC/COMPUSEC guidance or information. Many COMSEC/COMPUSEC documents and materials are accountable under the Communications Security Material Control System. Examples are items bearing telecommunications security (TSEC) nomenclature and crypto keying material for use in enciphering communications and other COMSEC/COMPUSEC documentation such as the National Telecommunications and Information Systems Security Committee or is predecessor organization, COMSEC/COMPUSEC Resources Program documents, COMSEC Equipment Engineering Bulletins, COMSEC Equipment System Descriptions, and COMSEC Technical Bulletins. b. Those that relate to SIGINT: These appear as reports in various formats that bear security classifications, frequently followed by five-letter codewords, for example, World War II's ULTRA, and often carry warning caveats such as "This document contains codeword material" and "Utmost secrecy is necessary..." or "Handle Via COMINT Channels Only" or "HVCCO" or "CCO." Formats may appear as messages having addresses, "from" and "to" sections, and as summaries with SIGINT content with or without other kinds of intelligence and comment. c. Research, development, test, life cycle support, planning, and evaluation reports and information that relates to either COMSEC, COMPUSEC, or SIGINT. 3. Some commonly used words that help to identify cryptologic documents and materials are "cipher," "code," "codeword," communications intelligence," or "COMINT," "special intelligence," "communications security," or "COMSEC," "computer security or COMPUSEC," cryptanalysis," "crypto," cryptography," "cryptosystem," "cipher," "decipher," "decode," "decrypt," "direction finding," "electronic intelligence" or "ELINT," "electronic security," "encipher," "encode," "encrypt," "foreign instrumentation signals intelligence" or "FISINT" pr "FIS"," "telemetry," "information systems security" or "INFOSEC," "intercept," "key book," "one-time-pad," "bookbreaking," "signals intelligence" or "SIGINT," "signals security," "TEMPEST," and "traffic analysis" or "TA." 4. Special procedures apply to the review and declassification of classified cryptologic information. The following shall be observed in the review of such information. a. INFOSEC (COMSEC and COMPUSEC) Documents and Materials. (1) If records or materials in this category are found in agency or department component files that are not under INFOSEC control, refer them to the senior COMSEC/COMPUSEC authority of the agency or department concerned or return them, by appropriate channels, to the address in item 4.c, below. (2) If the COMSEC/COMPUSEC information has been incorporated into other documents by the receiving agency, that information must be referred to the National Security Agency/Chief Central Security Service (NSA/CSS) for review before declassification occurs. b. SIGINT (COMINT, ELINT, and FISINT) Information. (1) If the SIGINT information is contained in a document or record originated by a U.S. Government cryptologic organization and is in the files of a non- cryptologic agency or department, such material will not be declassified. The material may be destroyed unless the holding agency's approved records disposition schedule requires its retention. If the material must be retained, it must be referred to the NSA/CSS for systematic review for declassification when it becomes 25-years old or older. (2) If the SIGINT information has been incorporated by the receiving agency into documents it produces, referral of the SIGINT information to the NSA/CSS for review is necessary prior to any declassification action. c. COMSEC/COMPUSEC or SIGINT information which requires declassification by the NSA/CSS should be sent to: Director, National Security Agency/ Chief, Central Security Service ATTN: Information Policy Staff (N5P6) Fort George G. Meade, MD 20755-6000 ---------- For full document: http://jya.com/dod52001r.htm (315K)

1 0

Online Banking: "MoneyClip"
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: oldbear(a)pop.tiac.net Date: Tue, 15 Apr 1997 15:59:34 -0400 To: Digital Commerce Society of Boston <dcsb(a)ai.mit.edu> From: The Old Bear <oldbear(a)arctos.com> Subject: Online Banking: "MoneyClip" Mime-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: The Old Bear <oldbear(a)arctos.com> MONEYCLIP DOES ONLINE BANKING A group of companies has developed a device that turns almost any PC into an automatic teller machine. The MoneyClip, which is a diskette that incorporates a smart card and access software, enables users "to perform virtually any ATM transaction from the comfort of their homes," says the CEO of the Home Financial Network, one of the four developers. In order to use the MoneyClip, a PC has to already be loaded with online banking software and the owner has to have an account at a bank that offers online banking. source: Tampa Tribune April 14, 1997 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from the dcsb list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

2 1