December 2003 - cypherpunks-legacy

Cypherpunks defeat?
by Anonymous 17 Dec '03

17 Dec '03

At 10:02 AM -0500 9/24/98, Albert P. Franco, II wrote: >I think perhaps a tougher question is, "Is there a way, without resorting >to bloodshed, to regain control of our private property and private lives?" >That's not a troll! I know that there are a lot people on this list with >their assault rifles at the ready, that are convinced that only armed >resistance will work. But. I think that's the "easy" way out. (How) can it >be done another way? It's ironic that you would have to ask that question here. The cypherpunks group was founded on this very premise: that through the use of cryptography, people would become able to engage in a wide range of voluntary transactions, outside of the reach of meddling interlopers. Most cypherpunks have become disillusioned about their dreams, and you will seldom hear them defend the notion that cryptography offers any kind of alternative to a society based on coercion. The past few years have been hard ones. The failure of digital cash, the gradual trend towards a debate over when and how (rather than whether) to regulate domestic cryptography, widespread abuse of anonymity, all these make the original cypherpunk goals seem even more distant today than in the past. Is the cypherpunks dream dead? Is the movement over? Maybe it is time to give up. Throw in the towel, admit that we lost. Sure, there are still battles to be fought, rear-ground actions where we can perhaps delay the inevitable outcome. But the vision has been lost, and all that is left is the post-mortem analysis of the failed dream.

8 11

TODAY'S NEWS AND PICS PACKED STUFFED! - READ IT NOW!
by STUFFED NEWS DAILY 17 Dec '03

17 Dec '03

+ 30 FREE HOT JPEG PHOTOS + 5 SUPER SEXY STORIES + NOTES ON MARRIAGE + SUCKING AND FLOPPING + MADONNA GOES ALL GIRL + THE BEST OF EUREKA + KEEP IT COMING MONICA + TOP 9 SIGNS GRAMPS IS ON VIAGRA + NO PLACE TO HIDE AT THE NAKED LUNCH + I LOVE PAPAYA ----> http://stuffed.net/98/9/28/ <---- Welcome to today's issue of Stuffed. To read it you should click on the URL above. If it is not made clickable by your email program you will need to use your mouse to highlight the URL, copy it and then paste it into your browser (then press Return). This email is never sent unsolicited. Stuffed is the supplement for the Eureka newsletter you subscribed to. Full instructions on unsubscribing are in every issue of Eureka! ----> http://stuffed.net/98/9/28/ <----

1 0

Information about the Anonymous
by Anonymous 17 Dec '03

17 Dec '03

This message is being sent to you automatically in reply to the message you sent to remailer(a)replay.com with the subject "remailer-help". There is an automated mail handling program installed on this account which will take any message with the proper headers and automatically re-send it anonymously. It is capable of providing a very high level of security if you use the Mixmaster software to produce the messages. You can get the Mixmaster client software from <http://www.thur.de/ulf/mix/> (Germany). Please read its manual page and README file for usage instructions. More information about anonymous remailers is available at <http://www.stack.nl/~galactus/remailers/>. For an up-to-date listing of anonymous remailers with statistics, see <http://anon.efga.org/anon/rlist.html>. You can also get the list by fingering rlist(a)anon.efga.org or rlist(a)anon.lcs.mit.edu. You can use the remailer by sending mail to remailer(a)replay.com, with the header "Anon-To: address", the address that you want to send anonymously to. If you can't add headers to your mail, you can place two colons on the first line of your message, followed by the "Anon-To:" line. Follow that with a blank line, and then begin your message. For example: ================================================================ From: joe(a)site.com To: remailer(a)replay.com Subject: Anonymous Mail :: Anon-To: beth(a)univ.edu This is some anonymous mail. ================================================================ The above would be delivered to beth(a)univ.edu anonymously. All headers in the original message are removed. She would not know that it came from Joe, nor would she be able to reply to the message. However, there are a few ways that the true identity of the sender could be found. First, if many anonymous messages were sent, someone could compare the times that the messages were sent with the times that 'joe' was logged in. However, this can be prevented by instructing the remailer to delay the message, by using the "Latent-Time:" header: ================================================================ From: joe(a)site.com To: remailer(a)replay.com Subject: Anonymous Mail :: Anon-To: beth(a)univ.edu Latent-Time: +1:00 This is some anonymous mail. ================================================================ The message would be delayed one hour from when it is sent. It is also possible to create a random delay by adding an 'r' to the time (+1:00r), which would have the message be delivered at a random time, but not more than an hour. You can also delay the message until a specific time. For example, "Latent-Time: 0:00" without the '+' would delay the message until midnight (at the remailer site). Times must be in 24-hour format. NOTE: This remailer automatically reorders messages in a large pool, which produces a similar effect. Another problem is that some mailers automatically insert a signature file. Of course, this usually contains the sender's e-mail address, and so would reveal their identity. The remailer software can be instructed to remove a signature file with the header "Cutmarks:". Any line containing only the cutmark characters, and any lines following it will be removed. ================================================================ From: sender(a)origin.com To: remailer(a)replay.com :: Anon-To: recipient(a)destination.com Cutmarks: -- This line of text will be in the anonymous message. -- This line of text will not be in the anonymous message. ================================================================ NOTE: The cutmark characters in the example are "-- ", the usual e-mail signature separator. If you forget the trailing blank after the "--" in the "Cutmarks:" directive, your signature won't be cut off. Sometimes you want a subject line or other headers in your anonymous message. Additional headers can be written to the output message by preceding them with a "##" line. Multi-line headers with indented continuation lines are allowed. ================================================================ From: chris(a)nifty.org To: remailer(a)replay.com :: Anon-To: andrew(a)where-ever.org ## Reply-To: chris(a)nifty.org Subject: A message with user-supplied headers: the subject extends over two lines Hi there! ================================================================ The remailer can also be used to make anonymous posts to Usenet. To do this, send a message with the header "Anon-Post-To: newsgroups", the newsgroups that you want to post anonymously to. Please note that the group names must be separated by commas (but NO spaces). ================================================================ From: poster(a)origin.com To: remailer(a)replay.com :: Anon-Post-To: alt.test,misc.test ## Subject: Anonymous Post This is an anonymous message. ================================================================ When posting test messages, please use the appropriate groups (alt.test, misc.test). The remailer support newsgroup alt.privacy.anon-server is not a test group. A subject is needed for Usenet postings. The remailer writes a "Subject: none" header to the output message if you don't add your own subject. In order to post an anonymous follow-up article and have it appear in a thread, you must set the "Subject:" and "References:" headers of your message correctly. The explanation below has been adapted from the nym.alias.net help file (mailto:help@nym.alias.net). The subject of your message should be the same as the article to which you are replying, unless you are replying to the first message in a thread, in which case you should prepend "Re: " to the original subject. To build a references header, copy the references header of the article to which you are replying, and append that article's Message-ID. If you are replying to the first article of a thread, it won't have a references header. In that case just use the article's Message-ID as your references header. Be sure to leave a space between Message-IDs in your references heder. For example, if replying to a message which includes these headers: ================================================================ Newsgroups: alt.privacy.anon-server Subject: Re: anonymous remailers References: <5dfqlm$m50(a)basement.replay.com> Message-ID: <5dko56$1lv$1(a)news02.deltanet.com> ================================================================ your anonymous follow-up message should begin with these lines: ================================================================ :: Anon-Post-To: alt.privacy.anon-server ## Subject: Re: anonymous remailers References: <5dfqlm$m50(a)basement.replay.com> <5dko56$1lv$1(a)news02.deltanet.com> ================================================================ [Note that an indented line in a message header indicates a continuation of the previous line.] If replying to the first message in a thread, with these headers: ================================================================ Newsgroups: alt.privacy.anon-server Subject: Help with PGP Message-ID: <5e96gi$opv(a)job.acay.com.au> ================================================================ your reply should begin with these lines: ================================================================ :: Anon-Post-To: alt.privacy.anon-server ## Subject: Re: Help with PGP References: <5e96gi$opv(a)job.acay.com.au> ================================================================ The "References:" header can be trimmed to include only IDs from messages that you have quoted from or are replying to. By separating messages with cutmarks, you can send more than one message at once: ================================================================ From: me(a)mysite.org To: remailer(a)replay.com Subject: whatever :: Anon-To: recipient1(a)site1.org Cutmarks: -- ## Subject: message 1 Message one. -- :: Anon-To: recipient2(a)site2.org Cutmarks: -- ## Subject: message 2 Message two. -- me(a)mysite.org ================================================================ The two messages will be delivered separately, and the signature will be removed. Only one cutmark is used in the example, but you may use different cutmarks in each part of your message if necessary. For added security, you can encrypt your messages to the remailer with PGP. The remailer software will decrypt the message and send it on. Here is the remailer's public key: Type Bits/KeyID Date User ID pub 1000/E7AEC1E5 1995/05/23 Replay Remailer Service <remailer(a)replay.com> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQCKAy/Bo9QAAAED6NMBE5oNGLqUmZvUZTWBfL41B67EVtDHu5VmqrPLX6w0gk8U lPUNlW/1wACNQAFs/hxKKd0B15d8R7Qk1X7H1KPsdF9AAp8DIBe3MN59Z8iO1dYB GW8YhPg2EXnNAZyVQb/CGhDZhm8naq3wsQynZZu4J7DmVD0VsrLnrsHlAAURtC1S ZXBsYXkgUmVtYWlsZXIgU2VydmljZSA8cmVtYWlsZXJAcmVwbGF5LmNvbT6JAJID BRAvzinRPRWysueuweUBAVpyA+dmx166/op40+nr9OQjahqWHdvLYkKipanaLNM4 u0/U8RrkySEj5n/R0zaJSG4mutZ28DqUEhz7rBHrFRYleENRtiI9TxZZrJVWInE9 No7VwSW9jWlpta2rCfu97EWLdPVPLXmXpd90TONHMk8a7sf/Lz5JFWIIK5PSqI/Z xQ== =5+RC -----END PGP PUBLIC KEY BLOCK----- To utilize this feature, create a message with two colons on the first line, then the "Anon-To:" or "Anon-Post-To:" header, then any other commands such as "Cutmarks:" or "Latent-Time:", then a blank line, then the optional "##" line and your additional headers, then a blank line, and then the body of your message. Encrypt this with the remailer's public key. Then send it to the remailer, adding the header "Encrypted: PGP". If you forget this, the remailer won't know that it needs to be decrypted. Also be sure to use the "-t" option with PGP, or the linefeeds might not be handled properly. ================================================================ From: me(a)mysite.org To: remailer(a)replay.com :: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.6.3in hIwCJD7BWgsRsnUBA/9kVuVlhFczhjI5cYFLGEAQiv4fUUlZ+hgPp6SQysToVLTM d0OvWqEb4TJgMREf6pHv4022yRLV6Pb9xaE/Gb82SUZYNE6TvfpxyKbWtRSthPXx OlsLD+IudqvBQus6DoY/9ClbbXyibP6mOCy7gwFZWOy6OMv2O2ZI3ufc/iCpgKYA AAAoLD7rvsI+c/Bod/GKAffpHqN2fimsoXrdcEMhIfN+rSC7PnMmaX1c4w== =afKM -----END PGP MESSAGE----- ================================================================ To confuse possible attackers even more, you can generate some cover traffic by sending encrypted messages with the special "Null:" header rather than the usual "Anon-To:" or "Anon-Post-To:" headers. The remailer will drop these messages in the bit bucket. Any text after your encrypted remailer message is also remailed. This allows sending messages to someone who is anonymous. If you create a PGP-encrypted message to yourself via this remailer, and then give it to someone, they can send you a message by sending the encrypted message to the remailer. The remailer will then decrypt it and send it to you. The message gets anonymized in the process, so the sender will need to include a return address if he wants a reply. Messages sent this way can be encrypted using the "Encrypt-Key:" feature. Any text following a line beginning with "**" will be encrypted with this key. For example, if you put in the plaintext of your PGP message: ================================================================ :: Anon-To: you(a)yourhost.org Encrypt-Key: your_password ** ================================================================ The appended message after the "**" will be encrypted with the key "your_password", using PGP's conventional encryption option. It is much simpler to manage these "reply blocks" -- both from the sender's and recipient's perspective -- by using a nymserver. Please read <http://www.publius.net/n.a.n.html> for more information (the homepage for nym.alias.net, the home of the nymserver software). For greatest untraceability, your reply block can be directed to post to alt.anonymous.messages on Usenet. Since you must use a subject line when posting to Usenet, messages sent using the same reply block will have the same subject. To avoid this, you can encrypt a message digest of the subject using the "Encrypt-Subject:" feature. For example, if you put inside your reply block: ================================================================ :: Anon-Post-To: alt.anonymous.messages Encrypt-Key: your_password Encrypt-Subject: your_other_password ## Subject: This subject is MD5 hashed and IDEA encrypted ** ================================================================ The subject will be converted to a 128-bit number and encrypted with IDEA using CFB mode with the key "your_other_password", and printed in hexadecimal format (48 characters); and the message will be posted to alt.anonymous.messages. The original subject cannot be recovered, only the MD5 hash of it, and then only if you have the password. The resulting subject will be different each time due to the use of CFB mode, so this helps prevent traffic analysis based on the subject header. Decoding the subject (to verify that the message is directed to you) requires special software. A small C program which can do this is part of the remailer distribution, but a more robust application would be appreciated. You can get the remailer source code as ASCII-armored Unix TGZ archive by sending mail to remailer-source(a)squirrel.owl.de. Abuse Policy: I consider the following to be inappropriate use of this anonymous remailer, and will take steps to prevent anyone from doing any of the following: - Sending messages intended primarily to be harassing or annoying. - Use of the remailer for any illegal purpose. Due to the global nature of the Internet, it is the sole responsibility of the orginal sender to determine what is legal. - Unsolicited commercial messages (SPAM). - Complaints to spammers. - Posting lists of addresses to Usenet groups for purposes of soliciting commercial e-mail (spam-baiting). Spammers will be exposed, publicly humiliated, and billed whenever possible. If you don't want to receive anonymous mail, send a message to the operator, and your address will be added to the block list. For more information on filtering out unwanted e-mail, see <http://www.abuse.net/>. You can get a list of statistics on remailer usage by sending mail to the remailer with Subject: remailer-stats To get the remailer's public keys, send mail with Subject: remailer-key or finger rlist-keys(a)anon.efga.org or remailer-keys(a)anon.lcs.mit.edu to get the public PGP keys of all active Cypherpunk remailers. For a copy of these instructions, send mail with Subject: remailer-help To reach the operator, direct your mail to abuse(a)replay.com.

1 0

YOUR CLASSIFIED - AD / 333 NEWSPAPERS !!!!
by anto＠commnet.it 17 Dec '03

17 Dec '03

YOUR AD IN 333 NEWSPAPERS !!!!!!!!!! *********************************************** Seven years ago, I learned how to place my Classified Ad in several hundred newspapers, with just one telephone call. And, my cost was $0.51 per newspaper. The total circulation was well over 1.5 Million. I could reach just about any market, anywhere in this country. Since then, my small mail-order company has exploded. And, I use this same time tested and true method week after week. I would like to share this powerful information and show you how to save hundreds, even thousands of dollars on advertising that works. The average cost of a classified ad in a newspaper is about $15.00 to $20.00 dollars. Multiply that by 333 and your total cost is well over $6,000.00 Dollars. By using our amazing method, your total cost is only $170.00. Not to mention the time and money you save by placing one call, instead of 333 long distance calls. You can limit your promotion to a Single State or place your ad in Several States around the country, all with just one phone call. You can reach One Million Readers on the East-Cost today and a Million on the West-Coast tomorrow. It's that simple !!!! Your cost for this priceless information, is only $19.00 !!! You will make that back on your first promotion. WE are so confident that this type of advertising will boost your profits, we will guarantee your satisfaction with our Money Back Guarantee !! So, you have nothing to lose. Now, order our amazing classified ad method today !!!!!! PRINT ORDER FORM Ship To: ************************** ********* NAME____________________________________________ ADDRESS________________________________________ CITY______________________________________________ STATE__________________ ZIP_____________________ E-MAIL__________________________________ Don't Delay, ORDER YOUR COMPLETE MEDIA KIT TODAY !!!!!!! ********************************************************************** Mail Payment $19.00 CASH, money order, or check TO: ******************** INFORMATION, Ltd. P. O. Box 515019 St. Louis, MO 63151-5019 U.S.A. WE will ship your complete KIT directly to you !!!! ************************************************************** OPTIONAL / OVERNIGHT SHIPPING - ADD $15.00 ************************************************************** Thank you for your kind attention, and have a nice day !!! +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Find Out Anything About Anyone On The Net !!! ========================================= YOU can easily learn how to investigate and learn EVERYTHING about your employees, neighbors, friends, enemies, and or anyone else !!! It is absolutely amazing !!! YOU Must Get This Extraordinary Package today......... + YOU can track down an old friend or a lost love, and, just for fun, investigate your family history. + YOU can screen prospective employees criminal records, look at their driving, or credit history. + YOU can verify test results from drug testing and even look into your children's friends history for any type of record. + YOU can TRACK down and locate an old debtor who is hiding from you and see if he/she is hiding any assets. + YOU can look up "unlisted telephone numbers." Locate social security, birth, adoption or death records. Check Army, Navy, Marine Corps, or Air Force service file records. YOU will simply be amazed to learn what sensitive and important information other people and enemies can discover about YOU !!!!! YOU Can Find Out Anything About Anyone On The Net !!! Do background checks on people and charge for it, as you start your own investigative services. Stop guessing about the LAW !!! Look up laws and do much more, direct from famous law libraries. Get this easy to use KIT right away, and then, YOU can become a private investigator. ORDER TODAY !!!!! Send $18.00 cash (wrapped in two pieces of paper), money order, or check to: INFORMATION, Ltd. P. O. Box 515019 St. Louis, MO 63151-5019 USA The Complete Package Will Be Immediately Shipped Prepaid Directly to You With Everything You Will Need In Your Kit to Get Started Right Away !! THANK YOU for your kind attention, and have a nice day !!!! YOU MAY ORDER BOTH PACKAGE KITS FOR ONLY $33.00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Admin Internet Services This message is not intended for residents in the State of Washington, screening of addresses has been done to the best of our technical ability. If you are a Washington resident or otherwise wish to be removed from this list, go to global remove site if you want your address removed from future mailing. http://209.84.246.162/remove.htm This Global Communication has been sent to you by: PAVILION INTERNATIONAL SERVICES Offices: London, Paris, Berlin, Hong Kong

1 0

Archives! Polite reminder!
by Sparkes, Ian, ZFRD AC 17 Dec '03

17 Dec '03

In my previous mail of a couple of weeks ago I offered to produce a CD of the CP archives. So far there have been no offers of data for this exploit. This is a polite reminder that if someone can offer a copy of the archives in an easily transportable format, I will take care of the creation and distribution of the CD. Come on Cypherpunks - don't let your apathy get the better of you. Rgds Ian

1 0

Wanted: Twofish source code
by Bruce Schneier 17 Dec '03

17 Dec '03

I am looking for Twofish ports in other assembly languages and other high-level languages. If anyone has, or is willing to write, source code that they will put in the public domain, I would like to talk with them. Thanks, Bruce ********************************************************************** Bruce Schneier, President, Counterpane Systems Phone: 612-823-1098 101 E Minnehaha Parkway, Minneapolis, MN 55419 Fax: 612-823-1590 Free crypto newsletter. See: http://www.counterpane.com

1 0

Mild anti-phone-company rant
by Brown, R Ken 17 Dec '03

17 Dec '03

Why worry about mere governments when the phone company can ru(i)n your life? BT AKA British Telecom were reported on the BBC radio over the weekend to be using their customer's account records to poach business from Internet service providers. Sales staff searched for customers who frequently dialled known ISP numbers. They then tried to sell them BT's Internet service (imaginitively branded as "BT Internet") A bit of a marketing advantage that, knowing exactly who your mark phoned, when and for how long. What's next? Maybe BT Pizza will try contacting heavy users of Domino. Or BT Hot and Horny will send brochures in plain covers to subscribers who phone certain numbers apparently in Grenada or Chile (Not that I would ever call such numbers but a friend of mine was surprised to find so many Manchester accents in Latin America...) UK government's response to all that is at http://www.coi.gov.uk/coi/depts/GOT/GOT.html - which will also tell you about the way BT overcharges independent payphone operators and rakes off money whenever you call a mobile phone. http://news.bbc.co.uk/hi/english/uk/newsid%5F181000/181800.stm says how Kent police are doing a deal with BT so that the phone company will withdraw service from people who make too many frivolous 999 calls (emergency number - like the US 911 - but a lot easier to key in when your room is full of smoke). So if the police don't like you they can ask BT to cut off your phone and they just will? And if you think I've got it in for BT at least they seem to be more competent than their main rivals in the UK market, inCapable and Witless (did I spell that right?) for whom I spent a day and a half waiting at home last week, instead of at work. On Thursday I was there for hours for one man to come in, stick something into a wall port, see that it lit up (I could have told him that the connection to the switch worked) and give me a piece of paper to sign, telling me that they had connected my phone to the WRONG NUMBER which, after I had called them to ask for my own phone number back got disconnected entirely. On Friday they didn't turn up at all. Totally wasted day. And I currently have neither phone nor cable TV services, and haven't had for THREE WEEKS. And they had the temerity to send me a bill - even if it was only for 4.45. I think I should charge them for my wasted time. Maybe I should ask for consultancy rates. But I suppose if I demanded more than a year's phone bill off them they'd soon decide they dindn't have to supply me with service at all. Nuts. There must be a cheap way to get online without dealing with phone companies. They seem to combine the entrepreneurial spirit of the civil service with the humility of the banks and the dedication to customer choice of Microsoft and IBM. This mail is entirely my own private opinion and nothing at all to do with my employers who probably wouldn't approve of it in the unlikely event that they ever noticed it. Despite the fact that I am using their Internet connection to send it. Of course I could always have sent it from home via my ISP. Or I could have IF I HAD A BLOODY PHONE LINE THAT BLOODY WELL WORKED. Ken Brown

1 0

Re: Cypherpunks defeat?
by Robert Hettinga 17 Dec '03

17 Dec '03

Forwarded with Andrew's permission... Cheers, Bob Hettinga --- begin forwarded text Date: Mon, 28 Sep 1998 09:15:48 -0400 (EDT) From: Andrew Odlyzko <amo(a)research.att.com> To: rah(a)shipwright.com Subject: Re: Cypherpunks defeat? Bob, Concerning the recent posting by Jim Donald about micropayments, let me say that as a co-inventor of a micropayment scheme (presented at the FC'97 conference) I do see a role for them. However, I do think it will be a limited role. The reason is economic. It is not just that people don't want to be "nickeled and dimed." A more substantive reason is that in most situations the content producers can get more money from aggregating content. I have analyzed this in papers such as The bumpy road of electronic commerce, in "WebNet 96 - World Conf. Web Soc. Proc.," H. Maurer, ed., AACE, 1996, pp. 378-389. and Fixed fee versus unit pricing for information goods: competition, equilibria, and price wars, P. C. Fishburn, A. M. Odlyzko, and R. C. Siders, First Monday 2(7) (July 1997), http://www.firstmonday.dk/. Also to appear in "Internet Publishing and Beyond: The Economics of Digital Information and Intellectual Property," D. Hurley, B. Kahin, and H. Varian, eds., MIT Press, 1998. Both are available at http://www.research.att.com/~amo/doc/eworld.html Best regards, Andrew ************************************************************************ Andrew Odlyzko amo(a)research.att.com AT&T Labs - Research voice: 973-360-8410 http://www.research.att.com/~amo fax: 973-360-8178 ************************************************************************ --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Remailers, PGP, and a Project Suggestion
by mark＠unicorn.com 17 Dec '03

17 Dec '03

Anonymous apparently informed the cypherpunks: >What UNIX really needs is some kind of mailer which integrates an updated >premail, PGP 2.x support, and PGP 5.x support. Unfortunately, much to the >delight of the government, the people who would code such a thing are >probably in the U.S. like I am. Privtool (http://www.unicorn.com/privtool/privtool.html) already provides PGP 2.x support, mixmaster support and limited premail support; I'll add PGP 5.x or OpenPGP when I have a Linux machine again. Mark

1 0

IP: Potentially Big Security Flaw Found in Netscape Software
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Delivered-To: ignition-point(a)majordomo.pobox.com X-Sender: believer(a)telepath.com Date: Mon, 28 Sep 1998 11:24:13 -0500 To: believer(a)telepath.com From: believer(a)telepath.com Subject: IP: Potentially Big Security Flaw Found in Netscape Software Mime-Version: 1.0 Sender: owner-ignition-point(a)majordomo.pobox.com Precedence: list Reply-To: believer(a)telepath.com Source: New York Times http://www.nytimes.com/library/tech/yr/mo/biztech/articles/28java.html September 28, 1998 Potentially Big Security Flaw Found in Netscape Software By JOHN MARKOFF SAN FRANCISCO -- A potentially serious security flaw has been discovered in the programming language used in the Navigator and Communicator software of the Netscape Communications Corp., with the defect possibly allowing an outsider to read information on a personal computer user's hard disk. The weakness, which was disclosed in Usenet online discussion groups on Friday by Dan Brumleve, a 20-year-old independent computer consultant in Sunnyvale, Calif., can be exploited by the Javascript programming language, which is widely used by World Wide Web page developers for a variety of common tasks. Brumleve said that he had tested the attack on a range of Navigator and Communicator programs, up through the most recent test version of Communicator, 4.5, and found the flaw in all of them. The vulnerability does not affect the Microsoft Explorer browser and e-mail program, Brumleve said. He was able to take advantage of the vulnerability by writing a 30-line piece of Javascript code that is able to capture and copy information automatically from the so-called cache, or temporary storage area, on a PC's hard disk. The captured information can reveal which Web sites a computer user has recently visited. The captured information could also include data that a computer user might have created when communicating with a Web site -- including personal data typed in when registering at a site or conducting a retail transaction. Credit card information, however, would not be revealed, because it is protected by separate security software. "It concerns me, because it means that a high-traffic Web site might use this to find out what other Web sites their visitors are going to," Brumleve said in a telephone interview Sunday. He said that the flaw could also be used by an employer to see if employees were searching for pornography, for example. Although there is no evidence that the security flaw has actually been exploited by someone with harmful intent, the gravity of the threat was noted by other computer security specialists. They noted that a user's vulnerability extends beyond visiting a hostile Web site that might exploit the flaw. The flaw could also be exploited through e-mail received using Netscape's software, they said, by sending an intended victim an e-mail message that would secretly force the user to run an illicit Javascript program. "This is pretty scary," said Richard M. Smith, president of Phar Lap Software Inc., a software development company in Cambridge, Mass. "In some sense the cache on your computer tells a lot about your life." Privacy of personal information on the Internet has become an increasingly sensitive issue in recent years as many Web sites have begun systematically collecting demographic information on Internet users. But this newly discovered flaw could enable an unscrupulous person or organization to basically read a person's full Web history. "This is a huge privacy issue and it goes directly to the current lack of adequate technical standards to protect privacy on line," said Marc Rotenberg, director of the Electronic Privacy Information Center, a public policy group in Washington. "There's even a question of a company like Netscape might be liable for the improper disclosure of private information." Netscape said Sunday that it was still assessing the problem. "We're taking a look at the bug, which appears to have privacy implications," said Eric Byunn, a Netscape product manager. He said that the company would make an announcement soon about its plans for responding to the flaw. Copyright 1998 The New York Times Company ----------------------- NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml ----------------------- ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer ********************************************** --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0