December 2003 - cypherpunks-legacy

Miss Canadian Slut International
by Bianca 17 Dec '03

17 Dec '03

Dear Mr. Beauvais, I noticed on a visit to your website that you are a "Proud sponsor of Miss Canada Int. 97/98." I was wondering if you are reconsidering your sponshership in light of the fact that they award the title to sluts and whores. I was watching Jenny Jones, and thought that the lady, Gabrielle, was a very nice young woman, and a good role model for young women, but a representative of Miss Canada International corrected my error by pointing out that the woman is a trashy whore for taking a job with a legitimante Canadian business which she disapproved of. Accordingly, I am informing all of my male friends that it will be perfectly acceptable to slip their hands up the skirts of future Miss Canada International contestants, since they are all sluts and whores. I was wondering if this also applies to the models you represent and work with, since you seem to be proud of an sponsering an organization that regards the bright and talented young women who represent them as sluts and whores. Do you also regard the women that you work with as sluts and whores? Sincerely, Bianca

1 0

Australian Key Escrow Bill Before Parliament for VPNs
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

------- Forwarded Message Date: Tue, 14 Oct 1997 17:08:36 +1000 From: Paul Montgomery <monty(a)apnpc.com.au> Subject: [Oz-ISP] Interception law IS a threat to ISPs A couple of ISPs in messages under the "Interception" heading have pooh-poohed the new interception law that is going through government processes at the moment. FYI, the following PC Week Australia story shows that it's not something to be sneezed at, if you want to differentiate yourself by offering remote access or VPN services that are secured using encryption. As mentioned in the story, Telstra, OzEmail, Access One, Connect.com.au and Magna Data are only the largest of growing band of ISPs who are already constructing VPNs for business customers. It's going to take more than an a packet sniffer to decrypt secure messages going through your network. If you're preparing a VPN trial with something like Data Fellows' F-Secure VPN software, which doesn't allow for key recovery, then you're up the proverbial creek as regards your obligations under this new law. You'll have to keep an extra key for the Feds, ASIO, NCA etc, and only use cryptography software that includes key recovery. You'll also have to be involved in a lengthy approval process with the Attorney-General's department and the ACA, which is dangerously open-ended. The system will be that you have to submit your plans for new secure network products every year, and the law enforcement agencies have a set amount of time to protest that they can't access it. This process will add three months, at minimum IMHO, to the development of new services. And yes, INTIAA has been keeping an eye on it, but they've been getting the wrong information from the Department of Communication. I wouldn't say they've been lied to, but they've been given the wrong end of the stick. - -- START STORY [from PC Week Australia, October 17, pp 1/38] New Law Hurts Net Security Security forces want access to encrypted ISP traffic By Paul Montgomery [reproduction for commercial purposes not allowed etc etc] The Virtual Private Network (VPN) revolution in Australia is being undermined by new legislation from the Liberal government that would weaken security on communications passing through Internet service providers (ISPs). The Telecommunications Legislation Amendment Bill, which went to a second reading in the Senate last week, is aimed at giving government agencies such as the Federal Police, ASIO and the National Crime Authority access to data and voice trafficand ISPs will have to fund its implementation. The bill threatens ISPs ability to provide secure remote access and VPN services, by compelling them to include an extra cryptographic key for police, in a weakened version of encryption that is called key escrow. Any modifications needed to encryption technology would not only weaken security, but mean extra costs passed on to corporate customers. Senator Richard Alston, the Minister for Communications, the Information Economy and the Arts, said in a speech to the Senate that interception was an essential service and that Attorney-General Daryl Williams would be given the power to determine the specifics of the proposed laws effect. Senator Alston recently took over policy coordination for cryptography (see PC Week, October 3, page 12), but the decision on this bill was made back in March. The introduction of some new telecommunications services have been significantly delayed, with obvious adverse consequences for business and consumers, Alston said, which sources say is a reference to Telstras OnRamp ISDN service. Alston also hinted that the government was lobbying switch vendors, at an international level, to include interception capabilities in their equipment. Chris Cheah, assistant secretary of the networks policy branch at Senator Alstons department and one of the officials involved in drafting the bill, confirmed that the bill applied to ISP-encrypted VPN and remote access services. If [ISPs] are offering VPNs which have built-in encryption, and theyre saying to their customers that they will deliver in a secure form to a person at the other end, then they will have to provide decryption, Cheah said. He stressed, however, that there would be no requirement for an ISP to decrypt an end users own encryption. Telstra, OzEmail, Access One, Connect.com.au and Magna Data are already offering VPNs, expected to be a lucrative market for network outsourcing, but a central part of the technology is the security gained from scrambling messages with strong cryptography, using such products as F-Secure VPN from Data Fellows (see page 16). Danny Ng, business development manager for Internet and intranet at Bay Networks, said that because Internet access is not an inherently high-margin business, many ISPs were looking to differentiate themselves by offering outsourced remote access or VPN services. VPN technology is evolving very quickly, and one of the cornerstones to it is security, which usually means encryption, Ng said. For major carriers such as Telstra, the delivery point could be the local exchange closest to the agency wanting the interception, but it would most likely remain at the premises for smaller ISPs, according to Cheah. If ISPs want to get into serious carriage service provision, they will be subject to the same provisions as telcos. That means being able to provide interception capabilities, Cheah said. The bill also removes the burden of keeping up with Internet technology from police and security agencies by ordering ISPs to prepare annual reports on their plans for new crypto services. Luke Carruthers, secretary of ISP representative body INTIAA (Internet Industry Association of Australia), said that the impression he had from meetings with the government on the bill was that ISPs would not have to decode encrypted transmissions. INTIAA is meeting with the Australian Communications Authority and the government this week to work out the details of the legislation. Carruthers will argue the ISPs case. I would expect this issue to be taken up fairly strenuously by the people who it affects the most, he said. - -- END STORY - -- Paul Montgomery, Net journalist for PC Week, lives like a JavaBean. mailto:monty@apnpc.com.au Tel: +61-2-9936-8793 Fax: +61-2-9955-8871 ------- End of Forwarded Message

1 0

Security flaw in PGPverify of INN
by Lutz Donnerhacke 17 Dec '03

17 Dec '03

Hi, I was urged to send you the following information. I noticed CERT and tale itself. But tale claims that the problem is not a problem of pgpverify, it's a problem of some krauts trying to send checkgroups monthly using a bot. The checkgroups mentioned were send since a year. They do not include Date: and Message-ID: because these values were not predictable by the human signer and the bot does not know the passphrase to work with. In consequence there are checkgroups out there which can be resend at any time causing a lot of trouble, because the signature is still valid even if a new Message-ID: and Date: line are used. The obvious fix is to modify pgpverify to block such control messages. ftp://ftp.iks-jena.de/pub/mitarb/lutz/ contains the necessary fixes. HTH Content-Type: application/pgp-signature

1 0

Telstra Australia admits it lied about net
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

http://www.australian.aust.com/computer/fulltext/c1014b.htm Telstra: We were wrong about Net By GEOFF LONG October 14: A Telstra official has admitted that the carrier overestimated the congestion problems associated with the Internet, one of the prime reasons given when it wanted to introduce timed local calls. Speaking at the launch of Telstra's Big Pond Business services, Big Pond general manager John Rolland said congestion caused by Internet users connecting for long periods was not as big an issue as they first thought. He added that the about-face was in line with similar findings from North American carriers and switch manufacturers Alcatel and Ericsson. Mr Rolland said that the main problem areas are where ISPs are situated, but that these were manageable: "What is clear is that in the medium term we will have hot spots, especially around ISPs." However, these could be addressed by working with the ISPs and managing connectivity better. The remarks came in response to Telstra promoting permanent modem connections as part of its Big Pond Business offering.

2 1

Re: Security flaw in PGPverify of INN (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\. ..\|/..|sunder(a)sundernet.com|you once again. I thought you were |/\|/\ <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/ ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/. .+.v.+.|God of screwdrivers"|my eye and there we were.... |..... ======================= http://www.sundernet.com ========================== ---------- Forwarded message ---------- Date: Tue, 14 Oct 1997 17:34:11 +0200 From: Peter Simons <simons(a)RHEIN.DE> To: BUGTRAQ(a)NETSPACE.ORG Subject: Re: Security flaw in PGPverify of INN -----BEGIN PGP SIGNED MESSAGE----- I am replying to the "security problem" report in pgpverify written by Lutz Donnerhacke, which has been delivered via several mailing lists, including BUGTRAQ and Best-Of-Security. Normally I'd simply ignore this article, but this is so breath-takingly ridiculous that I have to set a few facts straight. Lutz Donnerhacke <lutz(a)IKS-JENA.DE> wrote: > I was urged to send you the following information. I noticed CERT and tale > itself. But tale claims that the problem is not a problem of pgpverify, it's > a problem of some krauts trying to send checkgroups monthly using a bot. > > The checkgroups mentioned were send since a year. They do not include Date: > and Message-ID: because these values were not predictable by the human > signer and the bot does not know the passphrase to work with. > > In consequence there are checkgroups out there which can be resend at any > time causing a lot of trouble, because the signature is still valid even if > a new Message-ID: and Date: line are used. > > The obvious fix is to modify pgpverify to block such control messages. > ftp://ftp.iks-jena.de/pub/mitarb/lutz/ contains the necessary fixes. This is plain bullshit. pgpverify is working just fine and there's no security leak or malfunction in the script. The real story behind this 'report' is as follows: Lutz is the moderator for the german language de.* USENET hierarchy. One of his duties is to send out regular checkgroups and other control messages. What he did is that he didn't include the Message-Id and Date header into the signature of the control messages that he posted. He only signed headers like From and Subject. So he posted control messages with incomplete signatures for maybe a year, until this was first noticed and publicly addressed by Ralph Babel. The problem with these control messages is that anybody is able to re-post them with a new Message-Id and Date. Due to the correct PGP signature, most INNs will simply execute them, thus deleting all changes in the hierarchy since the checkgroups was posted originally. While this is not a major problem, it certainly is a problem, as all groups that have been created past a certain date can easily be removed, etc... When his mistake became public, he didn't stand up for it and created a new key to start posting correct control messages, rendering the old ones useless, he put the blame on Tale and his script instead. So please don't believe this "security flaw". pgpverify is working just fine and if the responsible person will use PGP correctly, there is no problem at all. -peter -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 iQCVAwUBNEORSw9HL1s0103BAQEgugP9FWJMNivNBqmJElzoQ6pXnwvS6QsbLjQG YrwHzvcYY3CAR7R446gr/WeuxW1JI1t9+yql8TNSvHeEXAX+qgz/ZMCjcjgjg0Pe j0BuVLBBfKuBoxGZDQybRybu3d5Xflqk07W9HjPP0tDtdkUcjndHr2J1Ea/J4zTd QgGNNUoZDFM= =brmw -----END PGP SIGNATURE-----

3 2

Magic money
by Eric Wilhem 17 Dec '03

17 Dec '03

Is the guy still around who wrote " Magic Money" and if so where can I communicate with him? Apparently his name is "Product Cypher". Thanks, Eric Wilhem

1 0

info
by Stefan D. Wolf 17 Dec '03

17 Dec '03

1 0

Re: Encyrption Program
by semprini＠theschool.com 17 Dec '03

17 Dec '03

This is in response to the several posts regarding the assumed weakness in the program I wrote: While it is true that PRNG's are not very good, because of the inherent lattice structure, I believe I found a way around that problem. To work around the lattice problem, I used a systm of cubic arrays. The program first creates sixteen cubic arrays, and fills them one space at a time with random characters. When the stream of characters to be XORed with the plaintext is generated, it picks a random cube and a random location with that cube. The resulting "random" character is then XORed with the appropriate character of the plaintext. If someone can prove to me that this method is stupid or easily breakable, I would actually be happy. So, those of you bent on proving that I'm wrong, I heartily encourage you to do so. As I mentioned before, you can download both the compiled version *and* the source at "http://www.brigadoon.com/~semprini/3dmx". If you are having trouble reaching that site, e-mail me and I will send you a copy via e-mail. Thank you for your interest and criticisms. They have been helpful. --Dylan

4 3

CDL is here!! (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from mega(a)cash-site.com ----- >From mega(a)cash-site.com Tue Oct 14 13:49:23 1997 From: mega(a)cash-site.com Message-Id: <199710141849.NAA10744(a)enteract.com> Date: Tue, 14 Oct 1997 14:46:05 -0400 X-Sender: mega(a)cash-site.com To: mega(a)cash-site.com Subject: CDL is here!! CDL - the "first" true software that will "change your life" Commissions paid direct from the field DIRECT to YOU!!! No more worries about receiving checks - YOU get paid first! The FIRST company to tap into the $200 billion dollar software industry as a "home business" Packed with software...loaded with value...$200+ CD packed full of software included! There's only ONE WAY to find out more - go download the software for FREE.....install it and look at it - it will blow your mind!! (backed by major corporations) Download your FREE copy today at: http://www.makecash.net/cdl A great way to "make some extra cash" Explosive Opportunity to get in FIRST!! REMEMBER - this is the FIRST in a multi-billion dollar field..are you going to watch us or join us!! We have full support: conference calls daily toll free sizzle line fax-on-demand FREE webpages WOW!!! FREE Download! http://www.makecash.net/cdl /////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. //////////////////////////////////////////////////////////////////////////////// ----- End of forwarded message from mega(a)cash-site.com -----

1 0

Hi from the Girls...... (fwd)
by Japhy Ryder 17 Dec '03

17 Dec '03

----- Forwarded message from 36568300(a)18565.com ----- >From 36568300(a)18565.com Mon Oct 13 20:04:20 1997 From: 36568300(a)18565.com Date: Mon, 13 Oct 97 15:26:38 EST To: mailmaster(a)fish.net Subject: Hi from the Girls...... Message-Id: <6730057729034.43209(a)fish.net> Reply-To: mailmaster(a)fish.net X-Pmflags: 340788480 X-Uidl: 1834e532395abb83946c924b47abc32f Comments: Authenticated sender is <mailmaster(a)fish.net> BEWARE!!! WARNING!!! NOTICE!!! This is an adult site. You must be 18 to enter. If you are offended by subjects of sexual nature PLEASE DO NOT ENETER!!!! In the event you enjoy sex you must join us for the youngest, hotest live sex on the net. You hear us, see us, and direct our every move. To join us now just click on the higlighted text below: http://youngnlusty.com Love, The girls at Young N Lusty ----- End of forwarded message from 36568300(a)18565.com -----

1 0