- cypherpunks-legacy - lists.cpunks.org

Re: RFC: A UNIX crypt(3) replacement
by Joshua E. Hill 17 Dec '03

17 Dec '03

> This is backwards logic; when security begins to hender in the > functionality of the system, the security needs to be gotten rid of. hmmm... Now that _completely_ depends on the system. Now for the system I administer, the level of security really isn't _that_ high (on the grand scale of things). It is, however, high enough that I inconvenience the users with a pro-active password guesser, and passwords that expire occasionally. I suppose that this is a _minor_ inconvenience, but it raises the level of security a very large amount. On a less mundane system (one run by the government, say), security is only _slightly_ less important than being able to use the system in the first place. :) On this type of system almost any inconvenience is worth the cost. > > You have previously said that the passwd file should not be available > > for public consumption. Though this is certainly true, it does not > > hurt that even if the passwd file is available, nothing particularly > > useful can be done with it. > Hince you use pseudorandom password generators and crack. If you count on > somebody not being able to preform an opperation quickly, they'll usually > prove you wrong. whoa... didn't you just say: > when security begins to hender in the > functionality of the system, the security needs to be gotten rid of. I think that psedu-random password generators would almost certainly "hinder in the functionality of the system"... :-) I want to make it so that users can use passwords > 8 characters, and I want to use something a bit better than FreeBSD's solution. Whether or not this is necessarily the One True Way (TM) to security, it will increase security. I'm not saying "Hey everyone. Here is a spiffy new password system that will make your entire system completely secure!" I'm saying "Could everyone please look at this algorithm that I'm thinking of using. Could you please comment on it, so that I can make it better." That's it. All questions on whether or not passwords should shadowed, crackable, not crackable, or consisting only of the letter "e", aside. Is this algorithm secure, and if not, why not. Joshua > --Deviant > The Macintosh is Xerox technology at its best. I very much like your signature... very nice... -----------------------------Joshua E. Hill----------------------------- | Allen's Law: | | Almost anything is easier to get into than out of. | -------jehill@<gauss.elee|galaxy.csc|w6bhz|tuba.aix>.calpoly.edu--------

2 1

Re: Censor John Gilmore -- EFF is a disgrace!
by Dave Hayes 17 Dec '03

17 Dec '03

[Multiple CC's trimmed, I don't think anyone at msn.com cares...] > #From Phrack 49, file p49-09 published this month: ... > File 09 of 16 > by Dr.Dimitri Vulis (KOTM) > A Content-Blind Cancelbot for Usenet (CBCB) ... > And what follows, is Dr. Dimitri, defender of freedom of expression, > champion of the anti-censors on the net, posting code to the world to > engage in exactly those activities that everyone has been ranting about > as being so utterly "horrifying (forged cancellations etc)" as it > were. You call yourself on cypherpunks, and you blithely assume that a Phrack author actually signs his real name? Either I thought you guys were *real* hackers and you aren't, or this is a very funny troll. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet "Better to be safe than to be sorry" is a remark of value only when these are the actual alternatives.

3 2

HP's crypto technology
by Hal Finney 17 Dec '03

17 Dec '03

I was poking about on the hp web server, trying to get some more hints about the technology they are pushing: <URL: http://www-dmo.external.hp.com/gsy/press/sevcik.html> > Date: 7/11/96 > > Rich Sevcik, vice president and general manager of the Systems > Technology Group, testified to a U.S. Senate subcommittee June 12 on > the importance of cryptography to Hewlett-Packard's ability to compete > in the international marketplace and to the nation's high-technology > competitiveness. > > [...] > > In conclusion, he introduced HP's technology called the International > Cryptography Framework (ICF). Products based on ICF would contain a > suite of cryptography capabilities of various strengths and types, > all non-functional. A customer then could enable the desired types and > strengths of cryptography in conformance with export and host government > regulations by obtaining a stamp-size smart card (known as a "policy > card"), programmed to turn on the particular cryptography capability > allowed. This would protect the right of each nation to establish an > independent policy governing cryptography in digital communication and > storage. Sevcik showed the subcommittee members a prototype cryptography > unit and several policy cards. He said HP plans to have an initial > ICF product available later this year as part of a total smart card > system solution offered due to an alliance with Informix and GEMPLUS, > with other ICF-based products planned for next year. > > U.S. export license authorities are finishing their review of this > first-phase implementation of ICF. "We have been extremely pleased with > the responsiveness and cooperation of these agencies in the review of > our technology," Sevcik said. "We have every reason to believe that > the cryptographic unit and host systems will be granted liberal export > authorization consistent with our expectations for ICF." <URL: http://www.hp.com/csopress/95sep26.html> > Press Release > > HP Announces Alliance with Gemplus and Informix to Deliver Personal > Information Cards for Consumers > > U.S. Government Reviewing Industry-backed HP International Cryptography > Framework > > September 26, 1995 > > PALO ALTO, Calif., Sept. 26, 1995 -- Hewlett-Packard Company, Gemplus > and Informix today announced the formation of an alliance to develop a > secure infrastructure that will enable corporations to speed new services > to consumers via a credit-card-sized personal information card. > > These cards will carry several thousand times the amount of data carried > by currently available smart cards. Additionally, the data on these cards > will be fully encrypted for secure international communication, so the > card will be able to be used anywhere in the world. HP believes that > the U.S. government will authorize the export to commercial enterprises > of products in Phase I(1) of HP's international cryptography framework > standard -- one of the underlying technologies in the infrastructure > that will enable the international use of personal information cards. The > framework is based on HP's open cryptographic structure. > > [...]

1 0

Emergency powers
by Charles Platt 17 Dec '03

17 Dec '03

Of course, Michael Froomkin is right in everything he says about presidential emergency powers. But an unconstitutional abuse of power is surely not acceptable merely because it has become a routine method for accomplishing everyday legislative tasks. First, it allows significant possibility for future abuse; and second, if the Constitution is routinely circumvented, this diminishes its general power (as any law loses its power when it is routinely flouted). The situation is all the more troubling because it receives so little publicity, outside of militant "extremist" groups (i.e. those that are crazy enough to believe that presidential power should be limited in accordance with the law of the land). When a president can take almost action under the excuse that it's a "national emergency" (when in fact there is no emergency), and he doesn't have to answer questions till later, and most citizens are unaware of this, we have a potentially dangerous situation. They key word here is "potentially." Michael Froomkin seems relatively sanguine because the potential for great harm has not been realized. I am not so easily reassured. --Charles Platt

2 1

TRW sells your credit data to British firm
by Brad Dolan 17 Dec '03

17 Dec '03

Assoc. Press 11/14/96: A British retailer and credit checker said Thursday it was buying Experian Corp., a former subsidiary of TRW and one of the biggest credit-rating business in the United States, for $1.7 billion. The deal is part of an effort by Great Universal Stores PLC, which owns the Burberry retail chain and is Britain's largest catalog retailer, to position itself as a global supplier of credit and marketing information. [I wonder what recourse I have if GUS gets my credit data wrong? Or decides to share it with MI6? -bd] Great Universal, known more commonly as GUS, said it would pay $900 million in cash and borrow the rest of the price for Orange, Calif.-based Experian, which TRW sold in September. GUS plans to merge Experian into its credit information business, CCN. Experian chairman D. Van Skilling said the two companies have many customers in common and will be able to provide them easier access to credit information around the world. [...] Experian is one of the largest providers of credit reports on consumers with information on 93 percent of U.S. households and 12 million businesses. Experian says its database may be the broadest and most current in the country. The company also helps businesses identify potential customers. Great Universal entered the credit information business in 1980 and now has customers throughout Europe and has operations in Asia, South Africa, and the United States. TRW completed the sale of Experian for $1.01 billion less than two months ago. An investor group led by Bain Capital Inc. and Thomas H. Lee Co., both of Boston, bought the company. TRW kept a 16 percent stake in Experian. [I wonder who the "investor group" is comprised of? I wonder why TRW would sell something for $1B that is apparently valued at $1.7B? Reminds me of the local paper which was sold for $X to an investor group that included Sen. Howard Baker and (Pres. candidate) Lamar Alexander. The investor group then resold the paper for $2X or $3X. What business accumen! -bd]

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk mix pgp hash latent cut ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle ?"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"death"} = "<x(a)deathsdoor.com> cpunk pgp hash latent post"; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. nym.alias.net is back up. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 18 Nov 96 6:48:35 PST remailer email address history latency uptime ----------------------------------------------------------------------- jam remailer(a)cypherpunks.ca * ********** 14:29 99.94% balls remailer(a)huge.cajones.com - ********** 5:32 99.81% replay remailer(a)replay.com - **++****** 9:22 99.69% haystack haystack(a)holy.cow.net - ***#***--# 24:20 99.57% cyber alias(a)alias.cyberpass.net - +**+ ++** 37:22 99.46% weasel config(a)weasel.owl.de ++-++- 2:11:49 99.16% middle middleman(a)jpunix.com - -.- * +-- 1:53:39 98.71% lead mix(a)zifi.genetics.utah.edu +++++++++* 35:42 98.50% squirrel mix(a)squirrel.owl.de - ++--+-++ 2:19:11 98.29% reno middleman(a)cyberpass.net +*-- 1:16:19 98.24% lucifer lucifer(a)dhp.com - + ++++++++ 42:33 98.05% mix mixmaster(a)remail.obscura.com - -+..+++++- 2:00:45 96.31% nym config(a)nym.alias.net #* *#*# :42 95.87% extropia remail(a)miron.vip.best.com .--------- 9:21:36 92.07% dustbin dustman(a)athensnet.com - -++-- 3:39:00 69.30% exon remailer(a)remailer.nl.com ## 7:06:33 41.67% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

No Subject
by nobody＠replay.com 17 Dec '03

17 Dec '03

>While I don't believe many people in government are "evil" or have "bad >intentions," I'm a strong believer that _systemic_ or _institutional_ evil >is possible. Thus, the wide opposition to mandatory key escrow, just as >civil libertarians of all stripes would oppose mandatory tatooing of >national I.D. barcodes on arms, or the mandatory retro-fitting of all homes >with special curtains containing a police-accessible "transparency mode." And the vision of 1984 looms ever closer. Pity you guys guessed....your activites have put us 12 years behind schedule to date, and we're not happy about that. --NSA

1 0

Re: [Fwd: National Emergency]
by Bob Faw 17 Dec '03

17 Dec '03

At 10:15 PM 11/17/96 -0700, you wrote: >This information may be of interest to you. Forwarded with permission. > >--RJ Dawnne Gee Why Dawnne, this is only logical--considering that the new "WEB-access TV" set announced this week has been declared a "weapon" for export purposes by our government. When our leaders consider public information to be a threat to national security, we're in a whole lot more trouble than most folks realize. bob faw p.s. Go to bed, dude, it's getting late. ;-) bob ----------------------------------|------------------------------------- B. D. "Bob" Faw |NewMedia Editor, Columnist, Webmaster Poet, Scholar, WordSmith, Engineer|"American Wine on the Web" http://www.eee.org/bobfaw/ | (a complete Internet wine magazine) bob_faw(a)eee.org | http://www.2way.com/food/wine/ bfaw(a)cello.gina.calstate.edu| newbie(a)pobox.com author(a)pobox.com |Senior Writer, "Faultline" TV Series ----------------------------------|------------------------------------- Webmaster, "The Journal of International Information Management" (JIIM) http://bpa1.aic.csusb.edu/pages/students/info479/bfaw/jiim/ ----------------------------------|-------------------------------------

1 0

DOO_dad
by John Young 17 Dec '03

17 Dec '03

Several pieces on the export of encryption regs, the crypto czar, Motorola's crypto modem, PGP's buy of PrivNet, and Keytronic's finger-ID keyboard. Professor Denning opines that the HP doodad will include GAK. ----- http://jya.com/doodad.txt DOO_dad ---------- The NYT has a long report today on a pedophile computer racket run from a prison. With details on how investigators were able to break through hard drive security and use DejaNews to track a suspect. A prison computer business was used to cloak the kiddy pixels. Red flags the Internet's lurid prospects compared to the virtues of do-me-dads like the Times. see: www.nytimes.com

2 1

Re: Cypherpunks, Inc?
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: azur(a)netcom.com, cypherpunks(a)toad.com Date: Mon Nov 18 14:00:17 1996 > Now why don't the cypherpunks put together something like the item > below? In fact, why don't we form some sort of Guild, trademark the term > cypherpunks (I'll volunteer) and offer cracking and security products > (like the one below) or services? A product security endorsement from > Cypherpunks Inc. could carry a lot of weight :-) "We", do, check out the cryptocd at www.rpini.com. - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: http://www.rpini.com/crypto/crypto.html iQEVAwUBMpBd4hFhy5sz+bTpAQFqewf/aJ/xx/hxZn1o/nMKJcLjauCpfcZmxX12 aGD2fJw8PncAzmZAnyxP0/ymK21+mdry1wZPsJXLtqrwJqT8nxPqEXXtfh19MHm9 HB1pDo0nYSOWfP7ENq3lNe995FGEvQ6EMiyy/7PxulcY+0T53Q78CTk6GD0KgPxd rqmfmxvqNuKERzCONhtirkiwkm2NjFT2ytd7H3VTFSUv7wIHGp2dFiiscC2csP2I XUlVlQ7w6TUGkO498qSY3wB+ZLHMYYkU21rvKgCTz4AZqmTLRWgZar5g3qlug1uS RA1r/GB3vfa6KuTcOGowt26FvROEsHu3ZSrZzOry8U0LMo2tgIcNtA== =vtPA -----END PGP SIGNATURE-----

1 0