May 2003 - cypherpunks-legacy

Re: idea for OTP system, comments desired
by Nomen Nescio 21 May '03

21 May '03

John Bethencourt writes: > Here's the protocol in a more concise form: > > [first authentication] > > Client --> username --> Server > Client <-- 'initial password?' <-- Server > Client --> initialpass --> Server > Client <-- r_0 <-- Server > Client --> h(h(s.r_0)) --> Server > > [subsequent authentications] > > Client --> username --> Server > Client <-- r_x <-- Server > Client --> h(s.r_x) --> Server > Client <-- r_y <-- Server > Client --> h(h(s.r_y)) --> Server One thing that is unclear in your protocol is whether s, which I think is the same as initialpass, is stored permanently on the server. If so, then when the server receives h(s.r_x), it can do two checks. The check you described is that the hash of this matches the value the client sent previously, h(h(s.r_x)). The other is that the server can construct s.r_x since it knows both of these values, and then compare h(s.r_x) with what the client sent. This has two problems. First, it makes the sending of h(h(s.r_x)) unnecessary since the server can verify the client's response just using s. And second, s is a sensitive value which if stolen could be used at some later time to impersonate the user. So I will assume that the server doesn't store s, in which case I don't see why it needs to see initialpass in the first place. In that case the protocol basically says, each time you log on you provide a hash value for which you will provide the hash input next time you log on. The purpose of the r_x values is to keep the user from having to save state; he can compute h(h(s.r_y)) and then forget it, because next time he logs on the server will remind him of what r_y is. The main security problem I see is that an eavesdropper sees r_x and h(s.r_x), allowing him to do a dictionary attack on s. You could use a really slow hash function to slow this attack down, but it is a serious vulnerability. Given that you are using client software to authenticate, I suggest pursuing SPEKE-style password-authenticated key exchange. There are a number of these systems (some patented) which feature immunity to dictionary attacks on the password.

2 1

As if we didn't already know Barney was torture
by Tyler Durden 21 May '03

21 May '03

Sesame Street breaks Iraqi POWs > > >'Culturally offensive' music is being used to break prisoners >Heavy metal music and popular American children's songs are being used by >US interrogators to break the will of their captives in Iraq. > >Uncooperative prisoners are being exposed for prolonged periods to tracks >by rock group Metallica and music from children's TV programmes Sesame >Street and Barney in the hope of making them talk. > >The US's Psychological Operations Company (Psy Ops) said the aim was to >break a prisoner's resistance through sleep deprivation and playing music >that was culturally offensive to them. > >However, human rights organisation, Amnesty International, said such >tactics may constitute torture - and coalition forces could be in breach of >the Geneva Convention. > >Sergeant Mark Hadsell, of Psy Ops, told Newsweek magazine: "These people >haven't heard heavy metal. > > This is an issue that seriously concerns us. If there is a prolonged >period of sleep deprivation, it could well be considered torture > >Amnesty International spokesperson > >"They can't take it. If you play it for 24 hours, your brain and body >functions start to slide, your train of thought slows down and your will is >broken. That's when we come in and talk to them." > >Sgt Hadsell's favourites are said to be 'Bodies' from the XXX film >soundtrack and Metallica's 'Enter Sandman'. > >The theme tune from the US children's programme Sesame Street and songs >from the purple singing dinosaur Barney are also on their hit list. > >"In training, they forced me to listen to the Barney "I Love You" song for >45 minutes. I never want to go through that again," one US operative told >the magazine. > >'No lasting effect' > >Rick Hoffman, vice president of the Psy Ops Veterans Association, told BBC >Radio 4's Today programme that such a tactic would have no long-lasting >effect on prisoners. > >"The use of this kind of audio-technique is rather new in interrogation," >he said. > >"There have been other kinds of non-lethal, non-harmful techniques, such as >sleep deprivation... which leave no long-lasting effects but do have the >end result of breaking down the individual's will to resist questioning." > > >The TV theme tunes are repeated over long periods > >Amnesty International told BBC News Online that at least one Iraqi captive >- a civilian, later released - had reported being kept awake for up to four >days by loud music. > >"This is an issue that seriously concerns us. If there is a prolonged >period of sleep deprivation, it could well be considered torture," said a >spokeswoman. > >"It is a very difficult line to draw between what constitutes discomfort >and what constitutes torture - that line will vary for individuals and it >would depend on each particular case," she added. > >She said they were looking into whether the US and UK were abiding by their >responsibilities under the Geneva Convention on the treatment of prisoners >of war. > >The UK's Ministry of Defence has said all its prisoners are being held >under the terms of the Geneva Convention and are visited by members of the >International Red Cross. > > > > _________________________________________________________________ Tired of spam? Get advanced junk mail protection with MSN 8. http://join.msn.com/?page=features/junkmail

2 1

RE: Oregon's proposed new class of terrorists
by Trei, Peter 21 May '03

21 May '03

> Tim May[SMTP:timcmay@got.net] wrote: > > > On Wednesday, May 21, 2003, at 02:37 PM, Trei, Peter wrote: > > >> May[SMTP:timcmay@got.net] wrote: > >> > >> The Oregon law makes a very broad class of forms of civil > >> disobedience--including unscheduled gatherings which disrupt traffic, > >> sit-ins in colleges, marches, etc.--the same as blowing up buildings > >> or > >> crashing airliners, and carries a mandatory, no parole, minimum of 25 > >> years incarceration. After 25 years, the possibility of being a slave > >> laborer (in effect) picking up trash and cutting brush for the state > >> of > >> Oregon. > >> > > What the hell is it with Oregon, anyway? More idiotic legislation > > seems to come out of that state, in proportion to its population, than > > any other place except the District of Columbia. > > > > Peter Trei > > > > Disclaimer: My opinions, no one elses! > > > > I lived there for two years, 1980-82. Intel requested that I move my > lab up to where the memory division, so I went. Went I moved to a new > project, they moved me back to California...and I was able to dry out. > > My theory is that Oregon is a mixture of: > > -- backwoods rednecks ("We don't need no stinking jobs up here...we got > the mills.") > > -- former Californians anxious to replicate Marin County in the > Willamette Valley (the famous map showing Interstate 5 veering _around_ > Oregon, and the famous saying "Don't Californicate Oregon," a slogan > written by ex-Californians) > > -- the most extreme of the back-to-Nature crowd (Eugene, Medford, etc.) > > -- inner city ghettoes (in Portland, notably) which are the equal of > any back east > > The feeling I get is that Oregon combines the worst of California and the 'classic Western' states. California has a highly intrusive, interventionist government, but this is leavened by the liberalism of many of the positions it holds. Thus, while California is really bad for some individual rights (such as the RKBA), it's fairly libertine on others (such as lifestyles). In the 'classic Western' states (I'm thinking of Wyoming, Montana, Nevada, Idaho, etc, and I don't claim to be really well informed on this), while the general population holds pretty rightwing views, this is leavened by a strain of semi-libertarianism in the government, in the 'don't intevene' sense. Oregon seems to combine the worst of both, along with none of the good points - a highly intrusive California style government, with very rightwing views. Peter

1 0

Re: Oregon's proposed new class of terrorists
by Tim May 21 May '03

21 May '03

On Wednesday, May 21, 2003, at 02:37 PM, Trei, Peter wrote: >> May[SMTP:timcmay@got.net] wrote: >> >> The Oregon law makes a very broad class of forms of civil >> disobedience--including unscheduled gatherings which disrupt traffic, >> sit-ins in colleges, marches, etc.--the same as blowing up buildings >> or >> crashing airliners, and carries a mandatory, no parole, minimum of 25 >> years incarceration. After 25 years, the possibility of being a slave >> laborer (in effect) picking up trash and cutting brush for the state >> of >> Oregon. >> > What the hell is it with Oregon, anyway? More idiotic legislation > seems to come out of that state, in proportion to its population, than > any other place except the District of Columbia. > > Peter Trei > > Disclaimer: My opinions, no one elses! > I lived there for two years, 1980-82. Intel requested that I move my lab up to where the memory division, so I went. Went I moved to a new project, they moved me back to California...and I was able to dry out. My theory is that Oregon is a mixture of: -- backwoods rednecks ("We don't need no stinking jobs up here...we got the mills.") -- former Californians anxious to replicate Marin County in the Willamette Valley (the famous map showing Interstate 5 veering _around_ Oregon, and the famous saying "Don't Californicate Oregon," a slogan written by ex-Californians) -- the most extreme of the back-to-Nature crowd (Eugene, Medford, etc.) -- inner city ghettoes (in Portland, notably) which are the equal of any back east The politicians are bought and paid for by the various special interests, as in most places. When I was there, it was mainly the timber and fishing industries, with high tech just starting to make a big difference (the major high tech employers were Tektronix (Beaverton), H-P (Corvallis, the calculator division back then), and Intel (memories in Aloha, a couple of wafer fabs, systems in Hillsboro). Since then, the high tech industry has boomed dramatically. Oregon legislators are always looking to appear important and busy. Hence the proliferation of laws. And Portland has always had a kind of inferiority complex when it compares itself to Seattle (and San Francisco to the south). It tries to get the big conventions, but fails to. I surmise that one of the reasons for the "Be in a protest which disrupts things, go to prison for the rest of your life" proposed legislation is to make Portland a G7/GATT/NAFTA/WTO-friendly venue, which Seattle clearly was not a couple of years ago. Portland has also had a bunch of incidents where cops were on the take, where cops were rooting through people's garbage, etc. In a hilarious incident, a newspaper took the same tack the cops were taking, that "items left at the curb have been abandoned," and published the contents of the trash cans of the Chief of Police and several other burrowcrats. They were not amused and had the editor arrested. Portland is also where the cops partly finance their department by seizing the cars of _suspected_ customers of prostitutes and selling them. No convictions needed, the American way! And Oregon is where the ex-Intel software guy was busted for committing the crime of allegedly thinking about going to Afghanistan to possibly help repel the American invaders and of allegedly knowing some other Muslims who were allegedly shooting guns in the woods. (This was a Fed action, but Oregon cops helped. And certainly the Oregonians are atitter that thought criminals are living amongst them.) And let's not forget the Bhagwan, who had his Rajneeshi followers spreading biological agents (salmonella) at restaurants near his ranch. Perhaps if all 60,000 residents of Rajneeshpuram (or whatever the spelling) had been sentenced to life imprisonment under Senate Bill 742, it would have sent a message! (Actually, that happened about 19-20 years ago, so in a few years they could be on the verge of being released into the Oregon Forestry Rehabilitation Brigade. "Arbeit Macht Frei--And Our Forests Benefit, Too!") My hunch is that some burrowcrats in Salem are convinced the state is under attack by terrorists and weirdoes and that they'd better issue themselves new aluminum foil hats and pass a bunch of draconian laws to make Oregon safe for its Stepford residents. Oregon has pretensions of being an important state, thinks of itself as being a leader in all things environmental and social, but is actually the ultimate NIMBY state.

1 0

RE: Oregon's proposed new class of terrorists
by Trei, Peter 21 May '03

21 May '03

> May[SMTP:timcmay@got.net] wrote: > > The Oregon law makes a very broad class of forms of civil > disobedience--including unscheduled gatherings which disrupt traffic, > sit-ins in colleges, marches, etc.--the same as blowing up buildings or > crashing airliners, and carries a mandatory, no parole, minimum of 25 > years incarceration. After 25 years, the possibility of being a slave > laborer (in effect) picking up trash and cutting brush for the state of > Oregon. > What the hell is it with Oregon, anyway? More idiotic legislation seems to come out of that state, in proportion to its population, than any other place except the District of Columbia. Peter Trei Disclaimer: My opinions, no one elses!

1 0

NRO to poke others' eyes out
by Major Variola (ret) 21 May '03

21 May '03

http://www.eetimes.com/story/OEG20030519S0030 Beginning next year, NRO will be in charge of the new Offensive Counter-Space program, which will come up with plans to specifically deny the use of near-Earth space to other nations, said Teets. If allies don't like the new paradigm of space dominance, said Air Force secretary James Roche, they'll just have to learn to accept it. The allies, he told the symposium, will have "no veto power." "Negation implies treating allies poorly," Robert Lawson, senior policy adviser for nonproliferation in the Canadian Department of Foreign Affairs, said at a Toronto conference in late March. "It implies treaty busting."

2 1

Re: Washington State Restricts Anti-Cop Videogames
by Major Variola (ret) 21 May '03

21 May '03

At 07:08 AM 5/21/03 -0500, Jim Choate wrote: >Re: Slashdot | Washington State Restricts Anti-Cop Videogames >http://games.slashdot.org/games/03/05/21/0516230.shtml?tid=127&tid=186 Funny, I don't remember anything about "minors" in the Bill of Rights... Congress shall make no law ... abridging the freedom of speech, or of the press.. Vendors are of course free to follow any policy they want, for any reason. Movie theatres follow the G/PG/R/X system for PR, not obligation. Similarly with Walmart and their decision not to sell certain recordings. However Washington is a government, and the 14th has something to say: No State shall make or enforce any law which shall abridge the privileges or immunities of citizens of the United States; nor shall any State deprive any person of life, liberty, or property, without due process of law; nor deny to any person within its jurisdiction the equal protection of the laws.

1 0

Re: new California crypto legislation?
by Major Variola (ret) 21 May '03

21 May '03

At 03:51 PM 5/20/03 -0700, Eric Murray wrote: >I've heard a rumor that there is some new legislation >being proposed in California that would require consumer >communication using SSL to go "directly to the server". Smells like compelled speech to me. Any networked computer can be a server. We are all reporters, we are all book sellers. We are all first class objects. --Tim May

1 0

Slashdot | Washington State Restricts Anti-Cop Videogames (fwd)
by Jim Choate 21 May '03

21 May '03

http://games.slashdot.org/games/03/05/21/0516230.shtml?tid=127&tid=186 -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Commercial Spam-blocker with Sender-Pays using PayPal
by Bill Stewart 21 May '03

21 May '03

I'm forwarding this just because it's the first time I've seen a commercial spam-blocker program that implements sender-pays, so it seemed topical. I don't know if any of their customers have actually implemented that feature (it's got other alternatives like a Bayesian filter and Turing auto-responder) or if anybody has actually bothered to send them mail if they use it. (Their email for it looks like semi-spammy drivel, but they've got permission, because I was once interested in getting updates about one of their other packages and haven't bothered unsubscribing.) Bill -----Original Message----- From: Blue Squirrel [mailto:news@bluesquirrel.com] Sent: Monday, May 19, 2003 11:19 AM To: Stewart, William C (Bill), RTSLS Subject: Letter from Sheri This is probably the 10th e-mail message you've received telling you how you can get rid of junk e-mail messages. But, I found a sweet software package that you might find a little more useful than all of the other anti-spam programs you've heard about. The program is called Spam Sleuth, and it just so happens that Blue Squirrel released an updated version, 2.0.10, last week. How does Spam Sleuth defeat spam? The program uses a Point System. Spam Sleuth has analyzers, and each analyzer: Friends, Spammers,To, Goodwords, Badwords, Profanity, Subject, Attachments, Charsets, HTML Volume, etc. looks at an e- mail a different way and assigns points. The more points an e-mail message receives the more likely it is to be deemed as spam. The less points an e-mail message receives the more likely it is a real gem. Think of it as though it was a contest, and each Analyzer is a different judge, and the messages are the contestants, and Spam Sleuth is the scorekeeper. Every judge looks at the e-mail message and assigns points based on specific criteria. Then all of the points are added together to create an overall total. More points is bad, and less points is good. The point system is clever, and works wonderfully, but the heart of Spam Sleuth has some killer features: Turing Test: If Spam Sleuth accidentally catches a message as spam, it lets the sender type some special letters to show that the message wasn't sent by a mindless machine, and the message is allowed through to your InBox. (Great way to know if you're dealing with a real human on the other end.) This is my favorite because I can be much more aggressive with my settings without worrying I'll miss an important e-mail. E-Mail Stamps: Allows you to charge senders a fee to let an e-mail message through to your inbox. Spam Sleuth sends an email back to the sender and requires them to make a payment via PayPal before the program will allow the message through to your inbox. You configure and decide how much your time is worth, whether it's 5 cents, or a buck. (That's right, you make the spammers pay you to send junk e-mail messages.) Bayesian Analysis: Looks at your previous e-mail and learns the characteristics of spam and good e-mail. Just like a baby, it needs to be taught right from wrong. By marking your messages as Good or Spam, and then Training the Bayesian Analyzer, you can teach it right from wrong. Then it can contribute to the decision of whether a new e-mail is spam or not. (Now that's what I call cloning.) Be sure to check this program out, download a 60 day demo from: http://www.bluesquirrel.com/download/SpamSleuthSetup.exe Sincerely, Sheri P.S. I hooked you up with a discount. So if you call 800-403-0925 or visit http://www.bluesquirrel.com/cart/cart.asp?P=SSS_NL you can get a copy for $19.95 vs. $29.95 normally.

2 1