- cypherpunks-legacy - lists.cpunks.org

Re: Win95 Registration Wizard info
by JR＠ns.cnb.uam.es 17 Dec '03

17 Dec '03

From: SMTP%"alano(a)teleport.com" 18-JAN-1996 23:29:11.16 >At 10:03 AM 1/18/96 -0500, Perry E. Metzger wrote: >> >>Alan Olsen writes: >>> I picked this link up from the Fringewear list. >>[...] >>> The author takes the registration Wizard in Win95 apart and shows exactly >>> what it does and what it looks for. Some interesting information about the >>> encrypted database of product information it uses. >> >>What, exactly, does this have to do with cypherpunks? > >I posted it for two reasons. > ... reason one deleted ... >2) The program's use of encryption to conceal what products it looks for. > ... rest of message deleted ... I also found interesting the use of a debugger to break Microsoft's crypto. When we speak about crypto, we do not only refer to algorithms, we must also consider insiders, eavesdroppers, etc... Well, this is a good example of a technique to break encrypted messages that has proven useful and, what's more, has the support of the operating system. A big mistake from Microsoft. And also in many other vendors. While not interesting in many protocols, it is worthy in those where one of the parts doesn't trust the other. The point is that any non-trusted party can try a similar approach -using a debugger- to gather information from within their computer (passwords, keys, data...) unless there is some way to prevent it (like using a better approach or protocol). It's silly to send text in the clear through an insecure channel. So it is to store passwords in the clear in world-readable files. Or to keep data in memory which can be paged to disk... The article comes to point out that it is also as silly to store cleartext in any program memory that can be accessed/traced/dissected by an untrusted user. And that Microsoft obviously choose again a too weak (mean?) approach to secure their data. I wonder now wether one could still rely on Microsoft to provide a reasonable Crypto API as they are bragging lately... jr

1 0

Re: Encryption and the 2nd Amendment
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:39 PM 1/20/96, Michael Froomkin wrote: >IMHO the 2nd amendment argument is bunk. [I haven't seen the Wired >article BTW, so this is just a general point.] I haven't seen the "Wired" article either, as I no longer read it. I agree with Michael that an association of crypto with arms is a long reach, unsupported in anything I've seen in the Constitution or related papers. Moreover, any successful link made could be disastrous. After all, it is well-established--whether we like it or not--that the government can regulate and control access to hydrogen bombs, bazookas, nerve gases, grenades, fully-automatic weapons, and even various kinds of rifles and handguns. I would hate to see crypto truly classified as an armament (beyond what the ITARs say) and thus be subject to the same kinds of regulations as above. Be careful what you wish for, you might get it. A much stronger claim can be made, I think, that crypto is a form of language or speech, clearly protected by the First Amendment. Thus, writing one's diary in an encrypted form (a common practice in colonial days, interestingly) is a form of language one uses. Thus, "Congress shall make no law..." about this speech or writing. That two people choose to converse in ROT-13 or in RSA or in their own private code is not something the government is authorized to interfere with. Ikewiselay, itingwray inlay igpay atinlay islay otectedpray. --Imtay Aymay Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: Wipe Swap File
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:38 PM 1/20/96, Dr. Dimitri Vulis wrote: >tallpaul(a)pipeline.com (tallpaul) writes: >> Remember that one simple wipe is *not* secure. Current Department of >> Defense security regs call for wiping the same space something like 8 or 9 >> times. Even then the wipe is not secure enough for higher level DofD >> classified material. There the regs call for the physical destruction of >> the medium after it has been wiped. > >Degaussing the media (running a household magnet over it :-) may be an option. Ordinary household magnets fail for a couple of reasons: 1. Their field strength is not high enough to affect modern media, due to the extremely high coercivity of modern media. (Try it out, you'll be surprised at hard it is to really change a lot of bits with a household magnet.) 2. Most "swap files," as used above, are of course on hard drives. Encased in metal. In any case, the nearest a household magnet can get to the surface is several centimeters. Unless the magnet is very large (such as the 20-pounder I have from my childhood days), the field strength will drop drastically in several centimeters. (Modern disk drives, and even modern videotape machines, use very high-coercivity coatings, including pure metal, and the heads must ride very close to the media to flip the domains. A magnet several centimeters away is effectively at infinity.) 3. A time-varying field is preferred. Bulk erasers work this way, by plugging into an a.c. socket and generating a time-varying field. And even these are getting harder to use to erase video tapes, for example, due to the high coercivity of modern media. Most folks I know no longer even try to bulk erase tapes. >1. Does anyone know a cheap way to recover the traces of the previous >(overwritten) recordings on the media? There are custom drives for various media which have multiple heads, and heads that can be "jogged" a little bit. This allows, I have read, the subtle variations of multiple writes to be extracted. Much more expensive would be various electron microscope-based imaging methods to directly image the domains and extract subtle signs of past write cycles. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

[noise] Internet censorship in the workplace
by Pete Loshin 17 Dec '03

17 Dec '03

A front-page article today in Network World about censoring access to sex-related Internet resources at the office. Apparently, at Texaco, "a woman vehemently opposed to pornography" has been assigned to review logs showing who's been looking at what. Workers who log onto remote sites from Texaco to disguise their interests have not been fooling this individual. -Pete Loshin pete(a)loshin.com

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

"Electronic Security & Counterintelligence" must become pervasive, and this is only possible if we release the private sector from artificial constraints on encryption, and if we return to our democratic foundation, the respect for personal privacy. We cannot regulate this, we can only nurture this fundamental national security arena. TAKEDOWN: Targets, Tools, & Technocracy Robert David Steele http://carlisle-www.army.mil/usassi/ssipubs/stratcon/steele.htm Another excerpt: 2.The greatest obstacle our government faces today in assuring national security and national competitivenessthe cause of causes for conflict and economic lossis the growing gap between those with power and those with knowledge.

1 0

Jan 27 special Bay Area CA mtg
by mrm＠netcom.com 17 Dec '03

17 Dec '03

Out-of-band cypherpunk meeting Saturday Jan 27 12 noon - 3 p.m. Sparcy's cafeteria, B21, Sun Microsystems, Mountain View, California The reason to call a special half-meeting on January 27th is that a producer/videographer for PBS would like to film a discussion among cypherpunks about 1st amendment issues, for a PBS show named "Freedom Speaks." The show airs nationally on PBS. In San Francisco, currently on KMPT Thursdays at 5 p.m., and starting in March, on KQED. The producer is Roger Masterton and he describes his goals like so: (the parts in between [] are my paraphrasing of what he said, for brevity) I am currently working on the story for a program we will tape in 2 weeks about Cryptography, focusing on the Free Speech aspect as well as the governments attempt to limit export of programs. ... The reason that I'm writing to you is that we would like to shoot a cypherpunks meeting as a way of introducing the [program.] [We want to film cypherpunks talking on camera] about the need for cryptograpy and the government's attempt to control access. ... I talked with him on the phone. He is affiliated with a group known as the Freedom Forum in Arlington, VA, which is non-partisan and non-profit. I said, sure, I'd be glad to reserve the room and call for a meeting, but that it would be up to the local Bay Area cypherpunk community as to whether or not folks could make this meeting. I also mentioned that a number of us have had mixed experiences with the media, and that we're pretty cynical about being presented fairly. I told him a several of us have endured the problem of spending all day in some video shoot, only to have 10 seconds of out-of-context inflammatory sound byte show up on the eventual program. If you want to, it would help me to know if you think you can make the meeting on Jan 27th, so we have some idea how long to wait for people to show up before starting the "official" agenda. Marianne mrm(a)eng.sun.com mrm(a)netcom.com p.s. directions to B21 of Sun: Take 101 south to Amphitheater Parkway. Turn left at the light at the bottom of the exit ramp onto Charleston. (This street is also known as Garcia.) After about 1/3 mile, turn right onto the first real side street. In about 2 long city blocks, you'll see big purple and white signs for B21 of Sun. The meeting is held in the cafeteria. This time I'll bring blank foils and pens. :-)

1 0

New China Ruling Threatens Closure Of News Agencies 01/19/96
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

In effect, the edict puts Xinhua, the world's unnewsiest news agency, in charge of agencies normally beyond the grasp of cadre communists -- even in Hong Kong, Macau and, Taiwan. On this basis, the next time Hong Kong billionaire Li Ka-shing did a deal with state authorities that relieved McDonald's Corp. or any other legal entity of its contractual rights (as happened last year), the story would have to be vetted by Xinhua. Xinhua already made information-control history when it established a service that both disseminates outgoing commercial data on the Internet and filters any incoming information. Although the State Council's directive gives Xinhua control over strictly "economic" news, the government body has licensed Xinhua to control everything, effectively ruling out reliable news. Stock markets and business plans are driven by market forces -- even in highly manipulated China. Even when one is tempted to think business is market driven, the whims of China's central controllers can skew everything -- as merchandisers in the casual wear clothing market found when that suddenly dried up because the bosses on top didn't like then Giordano clothing store chairman Jimmy Lai. The State Council's directive will in all likelihood force the New York Times, Reuters and other news organizations to reassess their operations in territories Xinhua is authorized to control. Controls go beyond editorial conventions. According to Xinhua, foreign wire services will not be allowed to increase subscribers in China "directly nor by ways of establishing joint ventures, solely funded companies or agents." The Xinhua report said that foreign news providers "will be punished in accordance with the law if their released information to Chinese users contains anything forbidden by Chinese laws and regulations, or slanders or jeopardizes the national interests of China." Jeopardizing the national interest of China is now taken to mean jeopardizing the interests of the communist party, or the roughly 5% of the population controlling the country from "the barrel of a gun," to borrow from Mao Zedong. Agencies only learned of the new rules Tuesday night when Xinhua, skirting the usual practice of circulating advisories on operational changes internally, simply put the story on the wire. One Hong Kong agency man told Newsbytes: "We always knew writing stories from China was a problem. Now you have to wonder if we'll be able to send stories from Hong Kong, without having to pass them by Xinhua for approval. The directive indicates stories will have to pass through Xinhua first -- pointing to a major evacuation of news services, and technology vendors who handle them. (Nigel Armstrong & I.T. Daily/19960117)

1 0

Idea for "friendly" Windows password hack
by Rich Graves 17 Dec '03

17 Dec '03

[Let me say up front that beyond a lot of perl hacking, I've never had a need to code my way out of a paper bag, so this is not something I'd be able to implement myself, at least not without a month of study.] OK, so we know how to crack .PWL files, and how any program (virus, trojan horse, Windows Help file calling a DLL beginning with ASCII 229 so that virus scanners can't see it) can obtain usernames, passwords, etc. even if persistent "password caching" to disk has been turned off. How might Microsoft (or someone else) address this without forcing users to quit all applications and "log out" of Windows to purge the temporary "password cache" in RAM? I.e., I don't care much about and know I can't count on the security of my PC as such, and it's really convenient to leave a zillion Popular Web Browser windows open when I walk out of my office, but I don't like the idea that anyone might walk up to my PC and log on as me to the otherwise (more or less) secure servers I use. In thinking about how MacOS PowerTalk deals with this by allowing the user to "lock" and "unlock" their keychain at will, it occurred to me that there's no particular reason we should just have to "look, don't touch" the password cache in RAM. After all, it's our insecure single-user operating system, and our passwords. Why not provide a way to grab the passwords cached in RAM, encrypt them securely, put them away somewhere, and scramble the original copy of the passwords in RAM so that Microsoft's code can't get to them? We don't need no steenking user interface. Actually, the first cut at this wouldn't really need to encrypt them securely, but just deny them to the OS, and restore them to the OS, on demand. Just a quick demo of how Microsoft can and should resolve this issue would have people beating down our door, and we'd unambiguously be the good guys. Because we'd be providing the solution, there would be no further moral qualms about posting full details and full source code. -rich owner-win95netbugs(a)lists.stanford.edu ftp://ftp.stanford.edu/pub/mailing-lists/win95netbugs/ gopher://quixote.stanford.edu/1m/win95netbugs http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html

1 0

Re: DES in real life
by James A. Donald 17 Dec '03

17 Dec '03

At 07:01 PM 1/20/96 -0500, Perry E. Metzger wrote: >Thats RC4, and it isn't neccessarily better than RC4, especially if >the RC4 key length is reasonable. No one really knows the strength of RC4. The shortness and simplicity of RC4 leads me to believe that it must be strong. If something that simple had a flaw, the flaw would have been found by now, whereas more complicated algorithms, such as DES, might well avoid discovery of their flaws merely by their irregularity and complexity, which makes analysis tedious. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Guerilla Internet Service Providers
by goldberg＠mars.superlink.net 17 Dec '03

17 Dec '03

At 09:21 PM 1/4/96 -0800, jim bell wrote: >At 10:54 AM 1/4/96 -0800, you wrote: >>>Previous exchanges deleted... >> >>(1) No single communication technology is appropriate for every problem. >> >>(2) A technical fix could include having the receiver send steering orders >>to the transmitter. This solution would, of course, be a long way from the >>low tech scavenged lens and 1/2 meter cardboard mailing tube technology I >>was thinking of. > >I think you guys (further up the reply chain) are missing the point. While >IR does have stealth advantages in, say, wartime, for routine network usage >everyone can be assumed to know where everyone else is, and where all the >optical links are, etc. There's no point trying to use link-location >secrecy. And presumably, encryption will provide all the >message-secrecy/anti-spoofing functions required. Simply ASSUME that the >beams can be intercepted (although probably not intentionally cut). That's >why we're "cypherpunks," right?!? > >Secondly, IR beams can be plenty narrow enough to avoid inter-link >interference, but at the same time wide enough to avoid beam-steering >problems. Note: I'm assuming link distances of under, say 300 meters here. > >Previously, a point was made about the effects of fog cutting links: Due to >scattering, one of the reasons automobile fog lamps are 550 nanometer >yellow/orange is to minimize the scattering that shorter wavelengths (400 nm >blue, 450 nm green) are more prone to. I would imagine that near IR at, >say, 890 nm would be dramatically less sensitive to such scattering. 1400 >nm might be even better. Rain might be a different story. But then again, >if we're limiting the links to around 300 meters, the total amount of water >between "here" and "there" CAN'T be all that great. And in addition, one of >the advantages of computer networking over telephone-type networking is that >we can "tolerate" (although, not LIKE) the occasional necessity of >re-transmitting data. And dynamic re-routing is probably far easier than >for real-time telephone-type data. > >>From the standpoint of computer networking, the main benefit of IR is to >cross rights-of-way without permission or trenching (or stringing cables >from telephone poles) in urban and suburban areas, allowing data transfer >near-fiber speeds. In an urban setting, a single tall building could >become a central hub for most of its nearest neighbors. I don't anticipate >IR being used "to the home" (especially since residential areas have trees, >etc); rather, I would imagine that it would be used to feed the occasional >top-of-the-telephone-pole microcell, with very-low-milliwatt (or high >microwatt) RF going the last 100 meters or so to the home. This would allow >a non-phoneco, non-cableco company to offer bidirectional networking in an >entire residential area with an absolute minimum of costs/rights aquisition. > > I can give you the benefit of some experience I have had with optical data transmission systems. We used IR lasers to span an approximately 800 meter distance between buildings, and the results were dreadful. Never again! Fog took the system down completely, on a regular basis here in New Jersey, as did even moderate snow. Rain was much less of a problem, surprisingly, even heavy rain rarely did more than raise the retransmission rate and lower throughput somewhat. Further, the beams were very narrow, and over that distance minute changes in transmitter orientation would cause the link to go down. I am talking about changes due to expansion and contraction of metal mountings with temperature, for instance. Mounting direct to masonry would probably have helped a lot. Then, there are the things like trees growing into the path over the course of the summer, telephone cables swinging into it intermittently in high winds, etc. Shorter paths allow greater control over environment, certainly, but I would be very careful about deploying large numbers of these types of systems. Spread spectrum microwave radio is a great improvement, but nothing seems to beat properly installed glass fiber for reliability. Frederic M. Goldberg WA2BJZ EMT-D

1 0