September 2003 - cypherpunks-legacy

[cdr] The Register - Garage door manufacturers battle over DMCA (fwd)
by Jim Choate 05 Sep '03

05 Sep '03

http://www.theregister.co.uk/content/7/32684.html -- -- ravage(a)ssz.com jchoate(a)open-forge.com www.ssz.com www.open-forge.com

1 0

Getting certificates.
by James A. Donald 05 Sep '03

05 Sep '03

-- SSH server public/private keys are widely deployed. PKI public keys are not. Reason is that each SSH server just whips up its own keys without asking anyone's permission, or getting any certificates. Outlook and outlook express support digital signing and encryption -- but one must first get a certificate. So I go to Thawte to get my free certificate, and find that Thawte is making an alarmingly great effort to link certificates with true name information, and with the beast number that your government has assigned to you, which imposes large costs both on Thawte, and on the person seeking the certificate, and also has the highly undesirable effect that using these certificates causes major loss of privacy, by enabling true name and beast number contact tracing of people using encryption. Now what I want is a certificate that merely asserts that the holder of the certificate can receive email at such and such an address, and that only one such certificate has been issued for that address. Such a certification system has very low costs for issuer and recipient, and because it is a nym certificate, no loss of privacy. Is there any web page set up to automatically issue such certificates? The certs that IE and outlook express accept oddly do not seem to have any provision for defining what the certificate certifies. This seems a curious and drastic omission from a certificate format. Since there is no provision to define what a certificate certifies, one could argue that any certification authority that certifies anything other than a true name connected to a state issued id number, the number of the beast, is guilty of fraud. This would seem to disturbingly limit the usefulness and application of such certificates. It also, as anyone who tries to get a free certificate from Thawte will discover, makes it difficult, expensive, and inconvenient to get certificates. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG 7rl5qfyPL81rhIdYUGyx/+C8WqCcrYTgFcl1rLUX 4F/YurXISWTFVDuUgRsBx/0QJKrnyQcX24+wmb5i3

3 4

Best social engineering of the year?
by Major Variola (ret.) 05 Sep '03

05 Sep '03

http://www.smh.com.au/articles/2003/09/04/1062548967124.html On the night of Wednesday, August 27, two men dressed as computer technicians and carrying tool bags entered the cargo processing and intelligence centre at Sydney International Airport. The men, described as being of Pakistani-Indian-Arabic appearance, took a lift to the third floor of the Charles Ulm building in Link Road, next to the customs handling depot and the Qantas Jet Base. They presented themselves to the security desk as technicians sent by Electronic Data Systems, the outsourced customs computer services provider which regularly sends people to work on computers after normal office hours. After supplying false names and signatures, they were given access to the top-security mainframe room. They knew the room's location and no directions were needed. Inside, they spent two hours disconnecting two computers, which they put on trolleys and wheeled out of the room, past the security desk, into the lift and out of the building. The brazen theft has prompted Australia's top security agencies to conduct emergency damage audits amid fears that terrorists may have gained access to highly sensitive intelligence from the computers. <snip>

1 0

Random musing about words and spam
by Thomas Shaddack 05 Sep '03

05 Sep '03

Spammers recently adopted tactics of using randomly generated words, eg. "wryqf", in both the subject and the body of the message. These "pseudowords" are random, which makes them different from real words that are made of syllables. Could the pseudowords be easily detected by their characteristics, eg. presence of syllables, wovel-consonant sequences/ratio, something like that? This could shift the balance of force in spam detection again, until the adversary will be forced to adopt the tactics of generating the random words from syllables instead of characters. Presence of pseudowords then could be added as one of spam characteristics.

5 6

Public Peer Review requests!
by Lance James 04 Sep '03

04 Sep '03

InvisibleNet has formed the Invisible Internet Project (I2P) to support the efforts of those trying to build a more free society by offering them an uncensorable, anonymous, and secure communication system. I2P is a development effort producing a variable latency, fully distributed, autonomous, scalable, anonymous, resilient, and secure network. The goal is to be able to operate successfully in arbitrarily hostile environments - even when an organization with unlimited financial and political resources attacks it. I2P is not a filesharing app. I2P is essentially an anonymizing and secure replacement IP stack, running on top of the existing network. There has already been progress made in writing applications on top of the network to enable generic TCP/IP applications to tunnel through the network transparently, as well as to enable nym lookup and management - two applications which, when paired together, would allow any web browser to point at http://www.[yournym].iip/ and communicate with your webserver anonymously and securely. There are many more ideas for what I2P could be used for, and its certain we won't think of the most interesting ones. I2P is an absurdly ambitious effort. Depending on what mailing lists you read or people you talk with, they'll either say its impossible or just insanely hard. To be perfectly frank, I2P by itself doesn't contribute anything really significant to the CS/P2P research community, but it does take the great work of other projects and research efforts - such as freenet, iip, kademlia, mnet, tarzan, the remailers, and many, many more - and attempts to apply good software engineering techniques to provide hard anonymity and security in a variable latency network. "Variable latency" is repeated so often because I2P doesn't try to operate with a one size fits all set of anonymity and security constraints, and different people will require different tradeoffs. Bin Laden will probably not be able to pull off live streaming video, but Joe and Jane Sixpack and should be able to. Is I2P ready to download and run with? No. So why bother mentioning it? Because we need more critical eyes to make sure we address the right issues the right ways. We think we've got things pegged so that it'll not only work, but also be secure and anonymous. We're moving forward on the development path towards getting an alpha network release out the door, but we need these specs reviewed for flaws that we've missed. Of course, we also need lots of other things, from coders to documenters to QA to network simulators to CS people, but it is your eyeballs that we're calling out for today. What we have ready for review: - Invisible Internet Network Protocol (I2NP) spec[1], describing how network "routers" operate and what messages they send to other routers - Common Data Structures spec[2], describing the serialization of objects described in other specs, as well as the encryption algorithms used. - Invisible Internet Client Protocol (I2CP) spec[3], describing a simple local client protocol for making use of the network. - Polling HTTP Transport spec[4], an example transport protocol for use with I2NP to allow actual communication between routers, regardless of firewall, NAT, or HTTP proxy. We also have the 0.2 release of a software development kit (I2P SDK)[5], which includes everything necessary to design, develop, and test applications to run over the network, as well as all of the above specs. It includes a Java client API implementing I2CP, a sample application (ATalk, a one to one chat app that supports file transfer), a Java router, and a Python router. There are also C and Python client API implementations of I2CP are on the way. These router are "local only" - meaning they don't talk to other routers. This can be used in the same way we can build normal networked applications - by running the server on the local machine and pointing the applications at it. We've been keeping this quiet because its too easy to hype up a vaporware product and we wanted to wait until there was something worth reading about before saying anything. So please read these specs and send in your comments - either to info(a)invisiblenet.net or to the iip-dev mailing list[6]. Perhaps even jump on that list if you want to discuss things (archives are linked to from the web page), browse the wiki[7], or join us on IIP for development meetings - every tuesday at 9P GMT in #iip- dev (archives[8] since meeting 48 are pretty much I2P specific). Thanks for your time, and we look forward to any responses. - The InvisibleNet team [1] http://www.invisiblenet.net/i2p/I2NP_spec.pdf [2] http://www.invisiblenet.net/i2p/datastructures.pdf [3] http://www.invisiblenet.net/i2p/I2CP_spec.pdf [4] http://www.invisiblenet.net/i2p/polling_http_transport.pdf [5] http://www.invisiblenet.net/i2p/I2P_SDK.zip [6] http://www.invisiblenet.net/iip/devMailinglist.php [7] http://wiki.invisiblenet.net/iip-wiki?I2P [8] http://wiki.invisiblenet.net/iip-wiki?Meetings --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Re: Using Virus/Worm comments to implicate others
by Tyler Durden 04 Sep '03

04 Sep '03

Dave Howe wrote... >Tim May wrote: > > Reading about the Romanian student arrested today for allegedly > > releasing one of the "Blaster" variants, I was struck by how easy it > > would be to "bring a shitstorm down" on someone by inserting comments > > into the virus code. >oh joy - yet another way to joe-job someone. Not unimportant...this means that if you don't like, say, George Dubya, then all "they" have to do is put your name into a comment inside a worm (along with a threat against his life), and then woosh! You'll be eating Cuban food and no one will know what happened to you. -TD _________________________________________________________________ Get 10MB of e-mail storage! Sign up for Hotmail Extra Storage. http://join.msn.com/?PAGE=features/es

1 0

[gshively@pivx.com: Blaster / Power Outage Follow up]
by Eric Murray 04 Sep '03

04 Sep '03

----- Forwarded message from Geoff Shively <gshively(a)pivx.com> -----

1 0

Using Virus/Worm comments to implicate others
by Tim May 04 Sep '03

04 Sep '03

Reading about the Romanian student arrested today for allegedly releasing one of the "Blaster" variants, I was struck by how easy it would be to "bring a shitstorm down" on someone by inserting comments into the virus code. --excerpt-- Second Suspect Arrested for Internet Virus Wed Sep 3, 5:54 PM ET By JIM KRANE, AP Technology Writer Police in Romania on Wednesday arrested a 24-year-old former student in connection with a computer-crippling Internet worm, according to a computer security company that aided police. ... Company analysts traced Ciobanu through some Romanian-language text inside the virus that eventually led them to a Web page containing Ciobanu's home address and telephone number, Vicol said. ... --end excerpt-- Tim again: This is not the first time an arrest has been made based on comments in virus/worm code. Sometimes the comments are about professors, sometimes about girlfriends, sometimes about local food and other trivia. It would be easy to implicate someone, for at least the initial months of house arrest (as with Parsons, the American kid also arrested for an alleged Blaster release), by scattering incriminating comments. Getting incriminating evidence onto their home or office computers is not as easy, but we can all think of ways this could be done. Absent verifiable signatures on such code (who would sign such a thing with a traceably sig?), conviction may be difficult. A charged person could claim he was "set up." Still, acquittal is months or years down the road, after great expense. I'll bet we see something along these lines soon. --Tim May "They played all kinds of games, kept the House in session all night, and it was a very complicated bill. Maybe a handful of staffers actually read it, but the bill definitely was not available to members before the vote." --Rep. Ron Paul, TX, on how few Congresscritters saw the USA-PATRIOT Bill before voting overwhelmingly to impose a police state

2 1

Re: Getting certificates.
by James A. Donald 04 Sep '03

04 Sep '03

-- James A. Donald: > > Outlook and outlook express support digital signing and > > encryption -- but one must first get a certificate. > > > > Now what I want is a certificate that merely asserts that > > the holder of the certificate can receive email at such and > > such an address, and that only one such certificate has > > been issued for that address. Such a certification system > > has very low costs for issuer and recipient, and because it > > is a nym certificate, no loss of privacy. Dave Howe > then generate one. it won't be accepted as legitimate by the > majority of clients though That scarcely matters. Almost no one uses PKI client certificates. All client certificates in actual use are rejected by default, and one always has to explicitly tell the client to accept. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG KkjE3D30eoM+hwpAF+AM2EZj/DxNiCTm2v0ALwuy 4UbHmZOBy/WI0yibAaB4UHUypY1guhHUSbQ/cFNPO

1 0

re: Getting certificates.
by James A. Donald 04 Sep '03

04 Sep '03

-- 3 Sep 2003 at 20:16, Anonymous via the Cypherpunks wrote: > Here is an interesting post regarding the CA issue: > > http://lists.spack.org/pipermail/wordup/2003/000684.html > > You may want to look at http://www.cacert.org. It may do what > you want. Their free client certificates are no different from Thawte's. True name, with the number of the beast branded upon it. The giveaway is that they want to get their CA preloaded into outlook express and IE. To get that, one must first worship the beast. Establishing true names, however, is too much like hard work, which is why very few people have been prepared to do it. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG tvYlPJRcqo6WpcnJV+UoskrpqMAjhfJBgGyIDKtO 4lu+EE81UdLOihMlOIZFKZbPYYYlp9BIfRfdHBM7K

1 0