- cypherpunks-legacy - lists.cpunks.org

U.S. House only has a T-1
by Declan McCullagh 17 Dec '03

17 Dec '03

http://cgi.pathfinder.com/netly/0,2326,201980911-14598,00.html

9 10

RE: Possible Java hack
by Steve Gibbons 17 Dec '03

17 Dec '03

Some of you may remember an assertion that I made (and posted here) about a month ago under the the thread "Possible Java hack". The latest publicized Princeton hack is exactly the same thing that I eventually came up with, and I've consolidated my findings at <URL: http://www.aztech.net/~steve/java/> (Crypto and Firewalls relevance will become aparent, once you take a look.) FYI, -- Steve(a)AZTech.Net

1 0

Re: PGPsdk is now free for non-commercial use
by phelix＠vallnet.com 17 Dec '03

17 Dec '03

On 16 Nov 1997 22:18:39 -0600, Alan Olsen <alan(a)clueserver.org> wrote: >>From what I have read of the license it is against the license agreement to >ship the libraries on a CD of shareware products for which a price is charged. > >If I were to create a program using the libraries and upload them to Simtel >or one of the other big archives, it could not be distributed on a Simtel >CD-ROM that someone was charging money for. (Ignoring the usual export >issues.) > >I see this as a big problem. This, unfortunately, is a non-issue. I just reread the license agreement and noticed the following: Non-Commercial Distribution License. Subject to all the terms and conditions of this Agreement, PGP hereby grants to you or your organization a limited, nonexclusive, nontransferable license (a) to incorporate [... stuff deleted ...] and (b) to reproduce and distribute the Bundled Freeware Application to end users solely by electronic means (for example, posting on networks or Internet sites for others to download), So, the only way to really (legally) distribute this would be on your own web site, or a web site that will never be picked up on a cdrom distribution. The as of yet unreleased shareware licensing agreements will probably cover cdrom distribution. -- Phelix (ps. always read anything written by lawyers twice)

1 0

Rental of PC software...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, For those of you who believe it is completely illegal to rent PC software should contact: Star Techs 9222 Burnet Rd. Austin, Tx. 512-719-4263 (sorry for the earlier mis-spelling of the name) I'll also forward a reference regarding loaning copyrighted material and who owns the rights to decide whether it is allowed or not. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

HYP_not
by John Young 17 Dec '03

17 Dec '03

3-1-96. NYT: "Speed Record: One Trillion Bits a Second." Fujitsu, NTT and AT&T have succeeded, each separately, for the first time in transmitting information at the rate of one trillion bits a second through optical fiber. "Microsoft Backs Ratings System For the Internet." The system, called RSAC-1, will enable parents and teachers to censor Web sites due to violence, sexual themes, nudity or offensive language. Other companies support the PICS form of censorship in terror of market- share loss to the tele-vigilantes. [Gates told a Mexican sports stadium audience that no real money can be made on the Internet until it has the speed to interactively out-hypnotize television.] HYP_not

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

John Pettitt writes:: # The SET transaction spec is now available on www.visa.com (and presumably on # www.mastercard.com although I didn't check). Norman Hardy writes: > I am unable to find the specs. Anyone have an URL? http://www.mastercard.com still works for me. I haven't looked at the Visa site in a few days. -Lewis

1 0

Problems with certificates.
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

I suspect the real danger would come from issuance of duplicate certificates. MasterCard conrols MarterCard numbers by issuing all of them (and I suspect that there is coding to separate MC from Visa from AmEx). Today, each person generates their own PGP key. While it is unlikely that any two will match, it is likely that at some point some two will match (see matching birthdays in a bar - number is less than you would think). Next rage might well be "vanity" PGP keys. While at the moment it is not known how to create a specific match key to a sequence, if you generate enough keys, there will be some interesting sequences found. Possibly some PGP signatures will even be in violation of the CDA (now that should start a rush 8*). For some time I have been concerned about the scalability of PGP. It works well in small groups but after trying once to create a 6,000 member keyring (took over three days on a 386 & was several meg when done) I decided that areas were going to need work to be a real anyone/anywhere/anytime mechanism. Not saying I have a good answer, just that at some point there will be a problem. Warmly, Padgett

2 1

Another ActiveX hole (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

-------+..........................................................+------- + ^ + : Ray Arachelian : #include <std_disclaimer.h> :../|\.. \|/ : ray(a)earthweb.com :.....................................:./\|/\. <--+-->: ................ : My oppinions are my own and do not :.\/|\/. /|\ :voice: 212-725-6550 : neccesairly represent those of my :..\|/.. + v + :....................: employer. :....... .... http://www.sundernet.com ...personal.email sunder(a)sundernet.com ..... ---------- Forwarded message ---------- Date: Mon, 03 Feb 1997 13:26:44 -0500 From: Andy Breen <abreen(a)earthweb.com> To: yak(a)earthweb.com Subject: Another ActiveX hole hmmmmmmmmmmmmm.... ------------------ DMK: An application of covert channels. From RISKS Digest Vol 18, Issue 80. Date: 1 Feb 1997 05:12:02 GMT From: weberwu(a)tfh-berlin.de (Debora Weber-Wulff) Subject: Electronic Funds Transfer without stealing PIN/TAN The Berlin newspaper "Tagespiegel" reports on 29 Jan 97 about a television show broadcast the previous evening on which hackers from the Chaos Computer Club demonstrated how to electronically transfer funds without needing a PIN (Personal Identification Number) or TAN (Transaction Number). Apparently it suffices for the victim to visit a site which downloads an ActiveX application, which automatically starts and checks to see if Quicken, a popular financial software package that also offers electronic funds transfer, is on the machine. If so, Quicken is given a transfer order which is saved by Quicken in its pile of pending transfer orders. The next time the victim sends off the pending transfer orders to the bank (and enters in a valid PIN and TAN for that!) all the orders (= 1 transaction) are executed - money is transferred without the victim noticing! The newspaper quotes various officials at Microsoft et al expressing disbelief/outrage/"we're working on it". We discussed this briefly in class looking for a way to avoid the problem. Demanding a TAN for each transfer is not a solution, for one, the banks only send you 50 at a time, and many small companies pay their bills in bunches. Having to enter a TAN for each transaction would be quite time-consuming. Our only solution would be to forbid browsers from executing any ActiveX component without express authorization, but that rather circumvents part of what ActiveX is intended for. A small consolation: the transfer is trackable, that is, it can be determined at the bank to which account the money went. Some banks even include this information on the statement, but who checks every entry on their statements... Debora Weber-Wulff, Technische Fachhochschule Berlin, Luxemburger Str. 10, 13353 Berlin GERMANY weberwu(a)tfh-berlin.de <http://www.tfh-berlin.de/~weberwu/

1 0

Re: The Electronic Privacy Papers
by John Young 17 Dec '03

17 Dec '03

Thanks to David Spector's praise and pointer for: "The Electronic Privacy Papers: Documents on the Battle for Privacy in the Age of Surveillance" by Bruce Schneier and David Banisar we offer its 10-page detailed TOC, foreword, preface and epilog: http://jya.com/tepp.htm (49K) The 747-page volume is an excellent read and rich resource of once secret documents, legislation, regulations, letters, memos, names, events, policies, opinions and disputes of the surveillance age and crypto battles. Subscribers to this list are amply represented. In addition to the Amazon URL provided by David: http://www.amazon.com/exec/obidos/ats-query/9615-8912043-502933 Bruce offers a 15% discount off the $60 price at: http://www.counterpane.com/privacy.html B&N sells it in Manhattan for $39.95, hardcover.

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

I have to thank everyone who helped me with using cypherpunk remailers! Thank you very much.. I've got very much response on this so I have to thank you all in this message! Johan Sandberg

1 0