- cypherpunks-legacy - lists.cpunks.org

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Timmy Maytag's father, an idiot, stumbled across Timmy Maytag's mother, an imbecile, when she had no clothes on. Nine months later she had a little moron. \\\ (0 0) _ooO_(_)_Ooo____ Timmy Maytag

1 0

swiss buy centralized euro-smartcard system
by Michael Froomkin - U.Miami School of Law 17 Dec '03

17 Dec '03

http://www.hotwired.com/staff/pointcast/Features/1814.html A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

Re: "Secret" Postal Device stolen
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> So much for key escrow. *ding!* we have a winner! andrew

1 0

Re: Fortune, 3 Feb
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Mike McNally wrote: > > Big article in Fortune about e-mail privace. One little paragraph > about encryption ("scrambling"). Fairly clue-free overall, but > entertaining. > I found the article to be extremely silly, although it was probably useful for "management". Anyway, computer security is an oxymoron. - Igor.

1 0

Re: Voice Encrytion/Scrambling
by Lucky Green 17 Dec '03

17 Dec '03

At 05:09 PM 2/2/97 -0800, Huge Cajones Remailer wrote: >Can anyone comment on and give pointers to devices designed to >encrypt voice transmission over POTS lines? I am interested in >the respective sound qualities (if you've tried it) and >relative strengths of encryption algorithms. http://www.comsec.com/ Uses 2048 bit DH and 3DES. The voice quality is excellent. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

My Departure, Moderation, and "Ownership of the List" -Reply
by Eldon Jenkins 17 Dec '03

17 Dec '03

Sandy, I've been a member of this list off and on for the past few years. In reading this list daily for quite some time I feel that the filtering you are doing has made quite a substantial and positive change. Normally I would spend an hour or so at work filtering through the list deleting endless threads of nonsense just so I could glean the valuable information that is hidden in midst of the mindless chatter. Now the time I spend searching for information has been drastically reduced and I would like to thank you for this. While I am against censorship and moderation whole-heartedly I see this as a different case. You are not preventing anyone from posting, you just sort the posts and place them in their appropriate list. I see your efforts as more of an organizing project rather then censorship. I would love to see the list continue to be moderated. Just my two cents though. Eldon Jenkins USRobotics Programmer

1 0

Re: PCS Encryption?
by Andrew Meredith 17 Dec '03

17 Dec '03

Greg Rose wrote: > > The three different digital standards in North America are TDMA, > CDMA, and GSM (in NY and DC only AFAIK). GSM is also a Time Division Multiple Access (TDMA) system. In it's original form it uses specrum around 900 MHz, which I believe not to be available in the US. Shame really, I can roam with my GSM phone over pretty much the rest of the planet ... except the US. Anyway, there are two higher frequency derivatives, PCS1800 & PCS1900, which have been deployed in the US. I'm not involved directly in the US market so I'm not sure where. I assume however that these are the systems to which Greg refers. > Newer analog phones use at least some of this, but I don't know much > about them. I'll ignore GSM. ^^^^^^^^^^^^^^^ Aww shame ;) > The conclusion is that neither way of doing it is truly > cryptographically strong, but both are a lot better than > listening to Princess Di call Newt "Squidgy" on a Radio Shack > scanner. GSM uses the A5 algorithm which *is* cryptographically strong, but is unfortunately considered to be top secret stuff. If, however, you were to pick up a copy of "Applied Cryptography, 2nd Edition" by Bruce Schneier you may find something of interest. I hope that you'll work out from my .sig why I can't say much more. Hope this helps Andy M -- ___________________________________________________________________ Andrew Meredith Senior Systems Engineer Tel: +44(0) 1793 565377 Network Engineering Tools Grp Fax: +44(0) 1793 565161 GSM Products Division Page: +44(0) 839 421153 Motorola SMTP: meredith(a)ecid.cig.mot.com 16, Euroway, Blagrove X400: QSWI016(a)email.mot.com Swindon, SN5 8YQ, UK SMS: 44860608008(a)sms.telco.mot.com ___________________________________________________________________

1 0

Re: Dissolving Choke Points
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

i do have unix (linux) and stuff, but i can't take a lot of subscribers -- maybe 200-300 or so. i actually wrote a proposal for a mailing list without a central control point, with several advantages being impossibility of control, absense of a single point of failure, and cryptographic verification of honesty of moderators. if there is any interest, i will post it here. igor Peter Hendrickson wrote: > > I was amused by the similarities of USG crypto policy and the > moderation of the cypherpunks list. Recently a number of new > regulations were announced to go into effect by a certain date. > Requests for comments were made after the policy was announced. Many > of us thought that was pretty sneaky. I feel the same way about the > moderation plan. > > Moderation has been a failure. I'm pretty good at filtering and I > can sadly report that there is very little signal out there. > > There are lessons to be learned here. One is that censorship does > not promote a stimulating and creative dialogue. The cypherpunks list > right now is about as interesting as hanging out by the 7-11. > > Another lesson is the danger of choke points. We can see how > tempting it is for people to exercise their control. Even John Gilmore > was unable to restrain himself from involuntary social engineering > experiments. Who would we have considered to be more trustworthy? > > Toad.com is a choke point, not just in terms of moderation but in > terms of the rate at which it can distribute messages. Let's > replace it. > > What we want are many machines carrying the cypherpunks list. A > message posted to any machine goes to all of the others. Each > machine sends messages to its subscribers only once. Some of > these machines should be across borders. > > The mail loop and multiple posting problems are solved by observing > the message IDs. > > Fast implementation: use moderated mailing list software. Put a > filter in the .forward file of the "moderator" account which looks > at the message ID and forwards the message if it hasn't been seen > already. The mailing list machines all subscribe each other. > > I've been looking for a stable machine with a good net connection to > do this. I haven't found one. However, if we have many machines > sharing the load, the stability of any one unit is not as important > because the list will survive multiple "hits". Only the subscribers > on one machine will be affected by having their messages delayed. > This greatly reduces the work and responsibility for any one list > operator. (As John will attest, keeping a machine running 24 hours a > day, 7 days a week, rain or shine, is a lot of work.) > > Also, with multiple machines, each unit handles a small amount of the > load. This makes more machines available and has less impact on > people's net connections. > > Last I checked, there were about 1200 addresses on the mailing list at > toad.com. All we need are about 10 machines to take 120 subscribers > each. (This is a completely manageable load.) > > Do you have a Unix machine on the Net? Does it have sendmail and > Perl? Then you have all that it takes to participate. Send me > mail and I'll help you set it up. > > Peter Hendrickson > ph(a)netcom.com > > P.S. I like and respect John and Sandy and I've learned a lot from > both of them. While basically well-intentioned, they just made a > mistake in this instance. > > - Igor.

1 0

Re: GAK cracking?
by C. Kuethe 17 Dec '03

17 Dec '03

On Mon, 3 Feb 1997, tmcghan(a)gill-simpson.com wrote: > Just days after a U.S. graduate student cracked the most powerful > computer encryption system allowed out of the country, the Commerce > Department announced it would allow three companies to export an > even stronger system. [snip] > Companies said products with just 40-bit long keys, the old limit, > were too easy to crack. The approvals came just days after Ian Goldberg, a > graduate student at the University of California, cracked a message > encoded with a software key 40-bits long. > > The government did not name the companies given permission to export > stronger, 56-bit programs, but Glenwood, Md.,-based Trusted > Information Systems acknowledged that it was one of the three. Why does it not surprise me that TIS gets permission to export 56-bit (DES?) ? They do key recovery (is it GAK?) They brag about government consulting. The clients they will admit to having are listed on: http://www.tis.com/docs/products/consulting/govt/govcon.html and, purely unsubstantiated rumors here, but I've heard (seen) TIS, NSA, FBI and other "friends" of ours all together in the same paragraph. Conspiracy? Maybe... This is both good and bad.... yes, longer codes are now exportable, but only to / by certain people? I notice that the new cipher length is 56 bit...same size as DES? hopefully that's just a coincidence (yeah, right) or maybe somebody's starting to see the real world where people download pirate cryptosystems and says "so let's export bigger ones and make a buck off it, too..." (yeah, right) PLUR chris -- Chris Kuethe <ckuethe(a)gpu.srv.ualberta.ca> LPGV Electronics and Controls <c100305(a)wolfcreek.cs.ualberta.ca> http://www.ualberta.ca/~ckuethe/ RSA in 2 lines of PERL lives at http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Another ActiveX hole (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

-------+..........................................................+------- + ^ + : Ray Arachelian : #include <std_disclaimer.h> :../|\.. \|/ : ray(a)earthweb.com :.....................................:./\|/\. <--+-->: ................ : My oppinions are my own and do not :.\/|\/. /|\ :voice: 212-725-6550 : neccesairly represent those of my :..\|/.. + v + :....................: employer. :....... .... http://www.sundernet.com ...personal.email sunder(a)sundernet.com ..... ---------- Forwarded message ---------- Date: Mon, 03 Feb 1997 13:26:44 -0500 From: Andy Breen <abreen(a)earthweb.com> To: yak(a)earthweb.com Subject: Another ActiveX hole hmmmmmmmmmmmmm.... ------------------ DMK: An application of covert channels. From RISKS Digest Vol 18, Issue 80. Date: 1 Feb 1997 05:12:02 GMT From: weberwu(a)tfh-berlin.de (Debora Weber-Wulff) Subject: Electronic Funds Transfer without stealing PIN/TAN The Berlin newspaper "Tagespiegel" reports on 29 Jan 97 about a television show broadcast the previous evening on which hackers from the Chaos Computer Club demonstrated how to electronically transfer funds without needing a PIN (Personal Identification Number) or TAN (Transaction Number). Apparently it suffices for the victim to visit a site which downloads an ActiveX application, which automatically starts and checks to see if Quicken, a popular financial software package that also offers electronic funds transfer, is on the machine. If so, Quicken is given a transfer order which is saved by Quicken in its pile of pending transfer orders. The next time the victim sends off the pending transfer orders to the bank (and enters in a valid PIN and TAN for that!) all the orders (= 1 transaction) are executed - money is transferred without the victim noticing! The newspaper quotes various officials at Microsoft et al expressing disbelief/outrage/"we're working on it". We discussed this briefly in class looking for a way to avoid the problem. Demanding a TAN for each transfer is not a solution, for one, the banks only send you 50 at a time, and many small companies pay their bills in bunches. Having to enter a TAN for each transaction would be quite time-consuming. Our only solution would be to forbid browsers from executing any ActiveX component without express authorization, but that rather circumvents part of what ActiveX is intended for. A small consolation: the transfer is trackable, that is, it can be determined at the bank to which account the money went. Some banks even include this information on the statement, but who checks every entry on their statements... Debora Weber-Wulff, Technische Fachhochschule Berlin, Luxemburger Str. 10, 13353 Berlin GERMANY weberwu(a)tfh-berlin.de <http://www.tfh-berlin.de/~weberwu/

1 0