December 2003 - cypherpunks-legacy

[noise!] (fwd) Re: FYA/I: Who'd have gaussed it?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Just in case you wanted to know how dept... Cheers, Bob --- begin forwarded text Date: Tue, 23 Jan 1996 11:21:54 -0500 (EST) From: Paul Picot <ppicot(a)irus.rri.uwo.ca> To: Philip Stein <pstein(a)measurement.com> Cc: jeff(a)rand.org, technomads(a)UCSD.EDU Subject: Re: FYA/I: Who'd have gaussed it? Mime-Version: 1.0 Zounds! A guantlet thrown! I accept! > >It just occured to me: a good way to do this might be with The Mother Of > >All Degaussing Coils. [...] > >If you can degauss the Queen Mary, surely all the disk drives in a little > >office building should pose no problems, right? > > This won't work (thank goodness). The local field strengths needed to > change the magnetic state of a disk platter (whose coercivity is MUCH > higher than that of the queen mary) is orders of magnitude greater than > what can be generated at any distance. Use a coil *around* the building. This makes the problem just within the realm of the possible, though horribly impractical. I'll spare the collected minds and spool spaces of the technomads list the details, and reduce this to a recipe: Collect the following: - 20 miles of 0000-guage insulated copper wire (about 32 tons worth) - five standard 20 MW gas-turbine power plant generators (about 20 tons ea.) - fuel for about 10 minutes of operation (about 4 tons) - five standard high voltage transmission rectifier modules for the above. - one standard 69,000 volt, 10,000 amp transmission-line contactor set Wrap 1000 turns of the wire around your target. This makes a bundle about 18 inches in diameter. Wire your generators and rectifiers to yield 70,000 volts DC, and connect them via the contactor to the coil. Fire up the turbines, and take them to redline, storing kinetic energy in the rotors. Firewall the turbines and trigger the contactor. It will take about 10 seconds for the coil current to hit 8000 amps, creating a 1-tesla magnetic field within the coil. This is sufficient to erase magnetic media. Then kill your generators before everything melts :-). And this is now certainly outside the scope of technomads... - Paul --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Motorola Cordless Secure Clear Telephone
by cassiel＠alpha.c2.org 17 Dec '03

17 Dec '03

Enjoying reading the latest discussions. I was in Totally Wireless yesterday when I noticed a new product from Motorola called "Cordless Secure Clear"--which supposedly is a cordless phone which offers security/encryption functions. Does anyone know how strong the security is on this phone? Is it just meant to keep my kid sister from listening in or is it stronger? Any info would be appreciated. Please include a response to me directly as I subscribe to the lite version of this list. Thanks! Cassiel

1 0

No Subject
by Douglas F. Elznic 17 Dec '03

17 Dec '03

How does an actual key signing work? What are some pointers and guidelines for one? -- ==================Douglas Elznic=================== delznic(a)storm.net http://www.vcomm.net/~delznic/ (315)682-5489 (315)682-1647 4877 Firethorn Circle Manlius, NY 13104 "Challenge the system, question the rules." =================================================== PGP key available: http://www.vcomm.net/~delznic/pgpkey.asc PGP Fingerprint: 68 6F 89 F6 F0 58 AE 22 14 8A 31 2A E5 5C FD A5 ===================================================

1 0

Re: January 22 Infoworld
by llurch＠networking.stanford.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- stainles(a)bga.com (Dwight Brown) kindly shared with the group: > >Nicholas Petreley's "Down To the Wire" column is a short take on the >insecurity of encryption schemes used by most commercial software. >There shouldn't be much new here to cypherpunks (he discusses the >vulnerabilities of WordPerfect, Word for Windows, Excel, and Compuserve's >CIS.INI, and uses some out of date examples "to protect the integrity of >current software": bad move, Nicholas), but it'd make a good introduction >for people who aren't familiar with the issues. > >Petreley also announces that InfoWorld is planning a "network-cracking >event", in which they plan to set up various network OS'es, make them as >secure as they can, invite "a small number of accomplished hackers" to >attack them, and publish the results. He says they're looking for >participants... > >InfoWorld's web site is http://www.infoworld.com. Petreley can be reached at >nicholas_petreley(a)infoworld.com. Unfortunately, Petreley's latest article isn't on the Web yet. But it's worth checking out last midweek's column, if only t see Sameer's name. This was only posted online. - -rich - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQVSWSoZzwIn1bdtAQHMFAGAhQrzSNtsRsv79f9dTKeLDb1eYB5NHUHT ZJHY+unUNYCOhrJpxa0FRrQU8CxEKNV9 =zWhM -----END PGP SIGNATURE-----

1 0

Re: IPSEC == end of firewalls
by Frank Willoughby 17 Dec '03

17 Dec '03

At 03:01 PM 1/23/96 -0500, you wrote: >Frank Willoughby writes: Egads. Let's take this off-line & stop bothering the cypherpunks folks with this discussion. Those not interested in this thread are kindly requested to hit the <delete> key now. Thanks. 8^) >Yes, certainly. You can bribe someone, get physical access to >machines, etc. > >However, unless you know a way to crack RSA, it is unlikely that >a system using Photuris+IPsec will permit IP spoofing. I re-iterate, any system can be gotten around - and frequently will. As far as IPsec goes, it is probably just a matter of time before we see the first CERT Advistory (maybe in a couple of years) on this. Nothing is invincible. > >> The creativity of hackers is succeeded only by their motivation and >> ability to put many hours into trying to solve a problem. Including >> the word "probably" was deliberate. Kerberos was also thought to be >> secure - 'til it was compromised. > >Kerberos was compromised? When? By whom? Are you talking about >Bellovin's paper on weaknesses in Kerberos (most of which are >avoidable or fixed in K5), or are you talking about a real break? If >the latter, its the first that I've heard of it. Actually, I was refering to Bellovin's paper. Surely you don't think that the bugs that were discovered are the only ones which can be exploited and that Kerberos (or any other software product) is invincible? I don't. >> >> I suspect even when firewalls are embedded in the O/S, >> > >> >That would be somewhat meaningless. The point of a firewall, as others >> >here have noted, is that it is easier to secure one machine than five >> >hundred or ten thousand. >> Of course it is easier to secure one machine that 500 or 10K. However, NOT securing the 500 or 10K systems still leaves them vulnerable to network attacks. Providing the O/S with rudimentary firewalling capabilities helps to increase the security of those systems. Like many of my colleagues in the Information Security field, I have (grossly) modified/hacked/butchered my systems to provide the system with some rudimentary firewalling capabilities and the extra security I needed. In many cases, it meant taking advantage of strange behaviours of the systems to achieve the capabilities & results I wanted. >> I disagree here also. Systems by themselves are fairly useless. >> Their power (and main vulnerability) comes from their ability to >> network with other systems. A system connected to a network is >> vulnerable. The fact that a corporate firewall protects the system >> from the Internet in no way decreases the vulnerability of that >> system (and other systems) from *internal* attacks which can be as >> devastating as an Internet attack. >> >> Including firewall capabilities as part of the Operating System's network >> applications would help the system protect itself from abuses from the >> Internet - as well as from internal. > >These last two paragraphs are gibberish. > Beats me. They make sense to me. What part about Information & Network Security don't you understand? These are fairly basic concepts. I can go explain these concepts either in another forum or off-line via e-mail or phone (your dime, my time), but not here. This is the cypherpunks mailing list, not the firewalls mailing list. >You can't "firewall" every machine -- the act is meaningless. A >Firewall is a filter designed to protect you from bugs in the setup or >implementation of the software on the machines on the inside. What >would it mean for a machine to have "firewall software" in the >operating system? Systems already attempt to prevent unauthorized >access -- the reason you have firewalls is because that software is >sometimes buggy. "Firewall software" in the OS is a meaningless >concept. > Perhaps this is where you are getting mixed up. A firewall isn't just a box which you plug into a network between the company's WAN and the Internet - it's a capability. Many "firewalls" are systems which implement this capability. The main characteristics of the firewall are (paraphrasing rather liberally from Steve Bellovin's book): o The firewall is designed to protect an entity from a particular network connection. Usually, we think of the entity as being another network. In this particular case, we are putting in a firewall (or the ability to filter out what we don't to deal with) on the O/S itself to reduce the risks of potential attacks from a network (internal LAN, Internet, etc). o All traffic from the insecure network has to go through the firewall. Logical. If the "firewall" is a piece of software which is installed on the O/S to "filter out" certain network connections, then we have "firewalled" our system. Commercial firewall products such as: DEC's DECseal, Raptor's Eagle, V-ONE's SmartWall, etc, actually provide two levels of protection: 1) They protect the internal network from hazards of the Internet (or untrusted network) 2) The protect themselves from hazards of the Internet or other untrusted network (such as the internal LAN) Implementing a firewall as part of an O/S provides the protection mentioned in point number 2: It protects itself from the internal LAN to some degree. Granted not as much as it possibly can, due to the fact that you have users & applications on the system which aren't secure, however, an added measure of protection will be provided to the system. >Perry Perry, (and others who may be interested in this thread) This is my last mail on this thread in this list. If you or others would like to discuss this further, please feel free to send me an e-mail directly or join me in discussing this in the firewalls mailing list. Fellow cypherpunks, I'm sorry about the bandwidth used in responding to Perry's question. Unfortunately, it was addressed to the list and required a response from me. Thanks for your patience. Back to the subject at hand (cryptography) Best Regards, Frank Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.

3 2

DC-Nets and Noise
by Travis Corcoran 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Message-Signature-Date: Tue Jan 23 17:18:12 1996 In article <ad21e7f60202100476b7(a)[205.199.118.202]> tcmay(a)got.net (Timothy C. May) writes: > Date: Wed, 17 Jan 1996 01:38:47 -0800 > From: tcmay(a)got.net (Timothy C. May) > Newsgroups: omi.mail.cypherpunks > > (In any case, even for those who disagree, modern filtering techniques make > it trivial for the "gurus" to filter out all messages except by the several > of themselves, so I've never understood the point about how the list must > purge itself of "noise.") To support Tim's thesis, I'll point out that I use the following lisp configuration directives (among others) along with a news-highlighting package that I hacked up (gnus-live.el) in order to make reading this list (bridged to a newsgroup at my site) a much nicer experience. When I enter the newsgroup, the authors and topics that I like are highlighted. I read this 5% of the list in about 15 min, skim another 5%, and then delete the other 90%. - From my perspective cypherpunks seems to be pretty * HIGH * bandwidth! ------------------------------ snip! ------------------------------ (gnus-live "Subject" "GAK Hacks and Position Surveillance") (gnus-live "Subject" "Libertarian Party and Crypto Anarchy") (gnus-live "Subject" "List of reliable remailers") (gnus-live "Subject" "^[A-Z][A-Z][A-Z]_[a-z][a-z][a-z] *$") ; jya's <FOO>-paper articles (gnus-live "From" "Steven Levy <steven(a)echonyc\\.com>") (gnus-live "From" "Bruce Schneier <schneier(a)winternet\\.com>") (gnus-live "From" "payne(a)openmarket\\.com") (gnus-live "From" "tjic@.*openmarket\\.com") (gnus-live "From" "[a-z\.]+@.*openmarket\\.com") (gnus-live "From" "tcmay(a)[mail\.]?got\\.net") (gnus-live "From" "bsg(a)basistech\\.com (Bernard S\\. Greenberg)") (gnus-live "From" "rah(a)shipwright\\.com (Robert Hettinga)") ------------------------------ snip! ------------------------------ - -- TJIC (Travis J.I. Corcoran) http://www.openmarket.com/personal/tjic/index.html Member EFF, GOAL, NRA. opinions (TJIC) != opinions (employer (TJIC)) "Buy a rifle, encrypt your data, and wait for the Revolution!" PGP encrypted mail preferred. Ask me about mail-secure.el for emacs. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed by mail-secure.el 1.006 using mailcrypt Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMQVepoJYfGX+MQb5AQGC+AP/ZgiOzJKNuz3ifGCsS4VHEqbA74D1NuT3 auOTUPi7qIUuGLy4GlNGTdv+tPileNuk66FCzAQ8jU+WjVjcUrqFHLoiGCEAAPeX kOJYIf0McaMNO0osz4pJU3//BzHz9HAP2YF8kCfytA+nfPihOtMaCfSpal66ALfl o9kWE4ue1+Q= =fRtA -----END PGP SIGNATURE-----

1 0

re: [local] Report on Portland Cpunks meeting
by Weld Pond 17 Dec '03

17 Dec '03

>There was a key signing. It was a bit rough as for many of us it was our >first key signing. (I think Neal was the only person who had been to an >organized key signing.) Still, it went fairly well. Only a couple of >people brought their key fingerprints on disk instead of paper. As of >today, I have only recieved signed keys back from a couple of people >though... The next key signing will be done a bit differently. (Live and >learn.) There was also a suggestion for a nym signing at some point. This begs the question, "How would you conduct an efficient key signing given what you have learned?" I am in the process of organizing one and would like to get input as to the best way that this should take place. Should people bring key fingerprints and public keys on floppy? Would it be nice to be online and grab public keys off of a key server? How would you conduct a nym signing? Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/ L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

3 2

Re: Crippled Notes export encryption
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

At 9:06 AM 1/23/96, Herb wrote: >Careful... what would YOU have done, with your customers demanding stronger >crypto today and you unable to legally give it to them? Umm - contract the crypto overseas somewhere it would be legal to export it from? Then import the code to the USA, with a press release to WSJ & NYT stating that American programmers were being put out of work by ITAR. Joseph Block <jpb(a)miamisci.org> "We can't be so fixated on our desire to preserve the rights of ordinary Americans ..." -- Bill Clinton (USA TODAY, 11 March 1993, page 2A) 2048bit-Fingerprint: F8 A2 A5 15 56 42 9B 16 3F BD 57 0F 8A ED E3 21 No man's life, liberty or property are safe while the legislature is in session.

1 0

Re: Crippled Notes export encryption
by matts＠pi.se 17 Dec '03

17 Dec '03

At 11.00 1996-01-23 -0600, Alex Strasheim wrote: >There's probably a big opportunity here for some enterprising cypherpunk >who's willing to move to Amsterdam (or who lives there already). Set up a >company that provides crypto guts and distribution services for American >software companies. You don't have to. PGP already exists in an international version as well as a US version. Just make your software call PGP to do all encryption and ask the user to download PGP from his favorite web site (on his side of the US border). matts

1 0

re: [local] Report on Portland Cpunks meeting
by Bruce Baugh 17 Dec '03

17 Dec '03

>This begs the question, "How would you conduct an efficient key signing >given what you have learned?" I am in the process of organizing one and >would like to get input as to the best way that this should take place. >Should people bring key fingerprints and public keys on floppy? Would it >be nice to be online and grab public keys off of a key server? How would >you conduct a nym signing? I'd go for somewhat clearer instructions than seem available. To wit: 1) Each participant, send your public key in ASCII armored form to the one coordinating the signing. 2) The coordinator will collate these into a single key file and have a list of key IDs and fingerprints. 3) Bring a printout of your key's fingerprint. You will read this off for others to compare with their copies of the coordinator's list. Have ID and such to show that you're you, or some other way of establishing that you are who you say you are. (In our case, everyone could be vouched for by at least one other person known to the others.) 4) The coordinator will [send by email|pass out on disk|whatever] the collated key file. Back home, sign each of the keys that actually got verified at the signing. Mail this back to the coordinator. 5) The coordinator will collate the results of this, and send you the new version. Add these. Now you've got your key and the other keys, all signed by everyone there. Grabbing keys off a server would certainly be doable, too. The key (no pun intended) thing is that people have their fingerprints in a useful form - so when we do it again, I hope Alan specifies printout, handwritten text, or something else that doesn't require a computer. And of course folks shouldn't bring their actual secret keys with them. The nym signing is an idle thought of mine. I have a nym key which is, at the moment, signed only by itself. I know friends of mine have nym accounts. if we could assemble a group of folks whom I can trust enough to link the nym and myself, it'd be nice to add some more signatures to the nym key, and vice versa. On the other hand, the accumulated signatures would probably point right back at any group talking about such a thing, like me right now. :-) Maybe it's infeasible. Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

1 0