- cypherpunks-legacy - lists.cpunks.org

RE: Microsoft's CryptoAPI - thoughts?
by Alan Pugh 17 Dec '03

17 Dec '03

>>What does everyone think about this? Perhaps I already missed the boat, but >>I just found out about it. How would international apps work? Would a data >>file encrypted with an app compiled with a US-only CSP (cryptographic >>service provider) be able to be loaded by a European equivalent app? >> >>[Info can be found at: http://www.microsoft.com/intdev/inttech/cryptapi.htm] I too would be interested in any insights some of the folks here might have on this API. It would seem to me that in light of some of the discussions on this list recently concerning the perversity of ITAR, that this API could easily run afoul of it. I've seen a brief article on it in pcweek and was suprised I'd not seen it here yet. Perhaps I just missed it. I hate to say good things about M$, but they certainly have the pull to perhaps get an API through. amp

1 0

Re: PGP in Eudora and other mail programs
by geoff klein 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- X-Pgprequest: signed MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=dgjlnouteqkhfsmbcz97531sfhkmpi > THIS IS A MESSAGE IN 'MIME' FORMAT. Your mail reader does not support MIME. > Some parts of this will be readable as plain text. > To see the rest, you will need to upgrade your mail reader. --dgjlnouteqkhfsmbcz97531sfhkmpi Content-Type: application/octet-stream Content-Description: PGP encrypted file Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: tcmay(a)got.net, cypherpunks(a)toad.com Date: Fri Jan 26 14:30:46 1996 At Thu, 25 Jan 1996 11:54:46 -0800 Timothy C. May wrote: >..... > And yet how many of these programs actually can transparently > (automatically, push-button, etc.) support PGP? >...... Commtouch is about to release Beta-1 of Pronto Secure. This will REALLY support PGP transparently, and as far as E-mail clients go, Pronto makes Eudora look like "sour grapes". We expect to announce a special Beta testing offer for c'punks in early February. - ---------------------------------------------------------------------- Geoff Klein email: geoff(a)commtouch.com Product Manager - Pronto Secure http: //www.commtouch.com - ---------------------------------------------------------------------- CommTouch SW Inc, U.S CommTouch, Israel Home, Israel 1206 W. Hillsdale Blvd 10 Technology Ave 27 Amishav St San Mateo, CA 94403 Ein Vered, 40696 Tel-Aviv, 67191 Tel: (415) 578-6580 Tel: 972(9)963445 972 (3) 7321378 Fax: (415) 578-8580 Fax: 972(9)961053 972 (3) 5716203 - ---------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBMQlWGkLv5OMYFK1FAQFYeQQAqPXMk0fS7ZmFkV0rCD3goLgkCnfxbN6F sPXZ08pHD2mH5MU50+gyprgJx87H/9OGwzR+pbGHtZP3QwucWBrwLCU2gj1dAzZ6 CGhrgZJTOa1XEKy9xzXJSuLXEAHuJYDQnmANVneRt04Ld0Z67QEW6cZHYCeVwHeH KavQ4tAJ9WM= =ouF2 -----END PGP SIGNATURE----- --dgjlnouteqkhfsmbcz97531sfhkmpi--

1 0

NSA advanced knowledge
by John Young 17 Dec '03

17 Dec '03

Responding to msg by rsalz(a)osf.org (Rich Salz) on Wed, 24 Jan 7:34 PM >Is there any indication that the NSA knew about >public-key before it entered the open literature? Fred B. Wrixon writes in "Codes and Ciphers," under the "Public Key" entry: ... This Hellman-Diffie proposal was apparently anticipated by a similar version developed by the National Security Agency (NSA) a decade earlier. (p. 164) No citation or elaboration is given for this claim. Wrixon's book is a simply written compendium: Codes and Ciphers: An A to Z of Covert Communication, from the Clay Tablet to the Microdot. Fred B. Wrixon Prentice Hall, 1992. Paper $18.00 ISBN 0-13-277047-4

1 0

Re: German home banking (fromn RISKS)
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> Don't high speed modems transmit and receive on the same frequencies, > using echo cancelation to decode the receive signals? Does that > make it impossible to eavesdrop on high-speed (i.e. V32bis) modems? No, and a lot of crackers and phone phreaks found out the hard way. You can buy protocol analysers off-the-shelf that will give a dump of the entire communication by just passively listening in (or possibly playing back a recording). I have seen units that could decode all of the popular Blue Book protocols for consumer equipment such as faxes and high-speed modems as well as ISDN, T1, DS3, ATM, etc... Most are programmable and some are full-blown computers running stripped down versions of Unix and can also be controlled over the network from RealComputers. With multiple analysers and a little custom software you could easily perform MITM attacks. The hardest part is getting in the middle. Modulation, comm-protocols, and compression techniques are not a replacement for honest to goodness crypto. andrew

1 0

Attack Simulator
by Anonymous 17 Dec '03

17 Dec '03

Internet Scanner Software Checks Network Security Atlanta, Jan. 17 -- Internet Security Systems has released version 3.2 of its Internet Scanner software. The company said the program is an "attack simulator" that tests your organization's network for security holes. ISS said Internet Scanner 3.2 has enhanced reporting capabilities and added tests for more than 130 security vulnerabilities, including the recently revealed Microsoft File Sharing bug. "Our added focus on Microsoft security holes stems from our customers' rapid adoption of TCP/IP (Transmission Control Protocol/Internet Protocol)-enabled Microsoft Windows NT and Windows 95," said Chris Klaus, founder and chief executive officer of ISS. According to Don Ulsch, a security consultant affiliated with the National Security Institute in Westborough, Massachusetts, The movement to Windows 95 created a whole new set of security concerns for network administrators. "Similar to virus scanning software, a security scanning tools' value to a corporation declines quickly unless it can detect the latest security holes. In the security arena, every upgrade is crucial," said Ulsch. New features of Internet Scanner 3.2 include added reporting capabilities including hyperlinks that connect to CERT advisories and vendor World Wide Web sites to pull down patches and information regarding network holes, and addition of Linux as a supported platform. The company said that will allow easy scanning from laptop PCs. The additional tests added to the new version include the Microsoft File Sharing bug, the TelnetD bug, the Stealth Scan, Finger Bomb, and misconfigured Linux NIS services. The company said its customers who have current maintenance contracts can now electronically download the updated version from the USS Web home page at http://iss.net. Internet Security Systems, tel 770-441-2531, fax 770-441-2431

1 0

[NOISE] Bad key management
by stevenw＠best.com 17 Dec '03

17 Dec '03

>From RISKS: ------------------------------ Date: Tue, 23 Jan 1996 20:32:37 -0500 (EST) From: Ed Ravin <eravin(a)panix.com> Subject: I won't tell if you won't... I just found this browsing through a router manufacturer's "Frequently Asked Questions" file: Q3 I have a bridge/router, and I have forgotten my password. I am no longer able to log in and configure the device(s). What do I do now? Do not panic! Enter the following password at the password prompt:XYZZYHIMOM. This should get you into the unit. Notice!! This is a back door to the units, and should not be made available to people who do not need to know about it! And I don't even own one of these routers -- I found this in a reseller's online catalog. Back doors in devices that are often hooked directly to external networks are a Bad Idea, if you ask me. At least the manufacturer documented it... (password above changed to protect the guilty) Ed Ravin +1 212 678 5545 eravin(a)panix.com ------------------------------ ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

Re: Cypherpunk Enquirer
by Ted Garrett 17 Dec '03

17 Dec '03

Man, I wish I knew who was writing this! No matter what mood I start out in, once I've waded through the noise and get to the Enquirer, I always feel better.

1 0

Re: "This post is G-Rated"
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 7:24 1/26/96, Johnathan Corgan wrote: >On Fri, 26 Jan 1996, Duncan Frissell wrote: > >> One wonders why people spend so much time arguing about the V-chip, telecoms >> dereg, sex on the net, Trade Policy, or Immigration when it's intuitively >> obvious that these things are (or soon will be) no longer subject to central >> control of any kind. > >It is absolutely fascinating to observe the widely differing views held >by you and Lucky Green on the same subjects. > >The two of you seem to represent opposite ends of the spectrum of >cypherpunks thought, to the extent that there is such a thing. Its been like that for a long time :-) Just for the record, I hope that Duncan's view will prove to be correct. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: "Gentlemen do not read each other's mail"
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 20:18 1/25/96, jim bell wrote: >Now, I was born in 1958 and thus can't claim personal knowledge of the time, >but it's truly amazing how UNPERCEPTIVE the public must have been in the >late 40's and early '50s about "intelligence" realities. Let me give you a >specific example: The classic movie, "The Man who Never Was," relates the >(true) story of a counter-intelligence mission done by the British to (I >think) mislead the Germans into believing that the attack on Sicily would be >substantially LATER than it actually was. The code name for the project was "Operation Mincemeat" and the intent was to get the defences at Normandy ("Operation Torch" - ie: D-Day) away from there and transferred to Sicily (which was NOT a D-Day objective) not as you say to fool them on when the attack was coming. It did its job and much of the mobile coastal defences were moved out of the area.

1 0

Re: "Concryption" Prior Art
by Peter Wayner 17 Dec '03

17 Dec '03

I believe the patent applies to simultaneous compression and encryption. The simultaneity supposedly saves time. That's the big advance. -Peter

1 0