- cypherpunks-legacy - lists.cpunks.org

Re: Java & Netscape security [NOISE]
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 21 Nov 1995, Dr. Dimitri Vulis wrote: > Hmm... If it looks remotely like marketing, it'd better carry the usual > disclaimers that past returns are no indication of future returns etc. :) > > >In the first case, the poster is not commenting about anything to do with > >their work, -- it really is just one man's opinion -- while in the second > >they are actually commenting upon something their employer is selling. What I'm trying to say is that if someome posts from watson.ibm.com, and IF they are talking about OS/2, we will not accept that they are not speaking independantly of the knowledge they have garnered from watson. It just doesn't work that way. In the same way, someone who writes from Netscape.com or AT&T, or Sun and tries to disclaim that they are speaking for the company, when they step out as an employee of a company is deluding themselves. When in the press have you seen a reporter claim as a source, an "unnamed Senator"? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E. P.P.S. I just sent email to Steve Bellovin from AT&T. I thought I'd settle the question once and for all, as to whether he IS reading this mailing list or not.

6 6

Using anon.remailers
by Eric Anderson 17 Dec '03

17 Dec '03

Would someone point me to where I can read about how to use the cypherpunk and mixmaster type of anon.remailers? Thanks, Eric

1 0

Israeli authorities censor book, confiscate copies (fwd)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 18 Sep 1997 17:20:52 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Israeli authorities censor book, confiscate copies [Shame on the Israeli government. I suspect this would be an interesting case for web-based mirroring. --Declan] --- TEL AVIV, Israel (AP) - A Tel Aviv court on Thursday temporarily banned the sale of a book about a missing Israeli submarine after state prosecutors claimed it endangered national security. Hundreds of copies of the book were ordered off bookstore shelves. Author Michael Eldar said police searched his house and confiscated several copies of the book as well as other documents. [...] The case is unusual because the manuscript had been approved, as required of all security-related material, by Israel's military censor. [...] ---------- Forwarded message ---------- Date: Thu, 18 Sep 1997 11:49:20 0200 From: "Eviather H. Ben-Zedeff" <evi(a)research.haifa.ac.il> To: declan(a)well.com Subject: Israeli authorities endangering freedom of the press hi, I am a journalism teacher and an editor in Israel. A friend of mine, Captain Mike Eldar, Israeli Navy (Ret) asked me 18 months ago to edit an autobiography and a book he wrote. During 1997, both books were published and suppressed by the Israeli military. Please, help us to fight brutal censorship in Israel. Support freedom even in this remote part of the Middle East. Eviathar H. Ben-Zedeff Department of Communication Haifa University Mt Carmel, Haifa, Israel <evi(a)research.haifa.ac.il>

1 0

Subscription sites for CDR...
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 18 Sep 1997 11:44:24 -0700 > From: Tim May <tcmay(a)got.net> > Subject: Re: New Computer Security Act > (Toad.com address changed to algebra.com. Hugh Daniel confirmed to me that > about 130 subscribers are still using the toad.com address. And he > confirmed that none of them are getting the traffic sent to the "real" > Cypherpunks lists, those at algebra.com, cyberpass.net, and ssz.com. I > again urge folks to get with the program. Toad.com is going to vanish > someday, at least as any kind of distribution site for CP traffic.) There is also cypherpunks-e(a)htp.org now... ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: NSA, ITAR, NCSA and plug-in hooks.
by ahupp＠primenet.com 17 Dec '03

17 Dec '03

>Date: Tue, 21 Nov 1995 02:10:02 +0100 >From: Tatu Ylonen <ylo(a)cs.hut.fi> >To: ahupp(a)primenet.com >Cc: cypherpunks(a)toad.com >Subject: Re: NSA, ITAR, NCSA and plug-in hooks. > >> PKZIP allows encryption (other's ?). How about a hook to that? > >PKZIP "encryption" is self-deception. A program for cracking it, >PKCRACK, is widely available on the internet. See e.g. >ftp.funet.fi:/pub/crypt/analysis. > >[For information about internationally available cryptographic >software, see http://www.cs.hut.fi/crypto.] > > Tatu Ylonen <ylo(a)cs.hut.fi> PKCRACK uses a dictionary attack. Anyway, my point was that you could use PKZIP's encryption as an excuse for passing a password.

1 0

Re: Virus attacks on PGP
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:34 11/21/95 -0500, SINCLAIR DOUGLAS N wrote: >> Certainly having PGP run from a CDROM or other read-only device would be a >> big help. Even better would be to have all the privileged code also run >> from a read-only device. > >Seeing as PGP is quite small the simplest and cheapest read-only device >would be a write-protected floppy disk. But do remember that your copy of PGP could be infected as it is loaded from the disk. You really need to protect your privileged code too. Bill

1 0

PROPOSAL: cypherpunks-news@toad.com?
by Martin Diehl 17 Dec '03

17 Dec '03

On 11/22/95, Adam Writes: > Perry Metzger <perry(a)piermont.com> writes: > > "James M. Cobb" writes: > > > Friend, > > > > > > > > > The following information from > > > > 1) You are not my friend. > > > > 2) My private mail to you hasn't convinced you to stop this > > barrage of reposts. Would you please do so? > I am inclined to agree with Perry in as much as the volume of posts > to the cypherpunks list is greatly increased by reposts of news from > other mailing lists, USENET newsgroups, WWW sources, newspapers, TV > programs, films, books, talks, etc. While some of the information > posted is interesting, and relevant, some others are less relevant, > bordering on noise. [SNIP] > The proposal: a separate list for current-event > reports/news/reposts. [SNIP] > What do others think? > Adam This is what I think about setting up an additional list: 1. If I subscribe to both lists, it won't change my eMail traffic 2. If the "news, NOISE, off-topic" posts are sent to both lists, my eMail volume will increase 3. The cypherpunks subscribers are not the problem 4. What Adam and Perry (and others) want is that the "news, NOISE, off-topic" posters change their behavior and not post long news items verbatim. 5. How are you going to get those posters to agree to change? My vote, for what it's worth, is don't split the list. It won't work because the extra posts ARE going to go to this list because that's where they believe their readers are. Martin G. Diehl

2 1

Re: Design proposal: crypto-capable generic interface
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Wed, 22 Nov 1995 10:11:00 -0800 (PST) >From: Raph Levien <raph(a)c2.org> >Subject: Re: Design proposal: crypto-capable generic interface >Message-Id: <Pine.SUN.3.91.951122094209.29001A-100000(a)infinity.c2.org> > In restrospect, "daemon" was a poor choice of words to describe my >proposal. "Slave process" gets the idea across much better, I'm a great fan of programming by cooperating processes -- but I still worry when it comes to crypto. What we need to do, if we want real security, is hold all the crypto secrets (therefore the crypto itself) in a device (PCMCIA card?) in the physical posession of the user. The cooperating-process model could make that easier -- but, if designed wrong, it could call for the device to give up a secret to be sent by IPC over to the slave process. >> > This requires that >> >keys have some nonforgeable names, which is unfortunately not a >> >feature of PGP 2.6.2. S/MIME will do it just fine, if you buy into the >> >Certifcation Authority (<wink> at Nick Szabo). >> >> Public keys, if that's what you're talking about, have perfectly good >> nonforgeable names -- themselves. They are unique. They are the proper >> name which can collect all the attributes of that key which are of interest >> (e.g., permission to spend $, name of a human who knows the private key, >> attributes about that human, etc.). > > Ok. But public keys have one serious disadvantage: their size. [...] > I propose using the MD5 hash of the whitespace-free MOSS >representation of the public key, in hex. It's simple enough to be >described in one sentence, but does everything I want. That sounds fine -- but why deal with a text MOSS representation? It's the modulus which is unique -- so just hash the binary bytes of the modulus, MSB first. There's no need to force anyone checking a key to have all the MOSS printing software in the loop. You might also consider using SHA instead of MD5 -- but that adds to the character count on your business card. [I printed up my own business cards with PGP fingerprints for my 2 primary keys -- and it took up about 1/4 of the card, in a readable font.] > Note that PGP 2.6.2 does _not_ allow the use of a public key as the >name of a public key, unless you do a horrible hack such as replace the >pubring.pgp file with the one public key of interest. PGP keyring structures do use the key as its own name, I believe. The UserID is a separate entity, associated with the stand-alone key. A signature applies to a pair (UserID,Key). If I could change the PGP keyring structure, I'd add a new entity -- an Attribute block -- a string and my key ID, with a signature on the Attribute+ObjectKey. This can be done today with the UserID and signature -- and I've even tried it. It works, but PGP is used to accessing keys by the text in a UserID field and that's not appropriate. The Attribute would give a statement I'm prepared to stand by, giving testimony about the key being signed or the person who has demonstrated the ability to sign something I've verified with that key. We might need to add something like MOSS's aliases, for my use only, to let me access keys. If I know someone as Bobby -- that's an association in my own head -- not applicable to anyone else. When I access him by that alias, that's for my use. Therefore, only I should define it and only I should sign the association. This is what I'd use instead of PGP's UserID blocks -- alias blocks. I commend TIS/MOSS's aliases to people's study. The MOSS guys have used the alias structure not only to define nicknames of importance only to me but also to define crypto-lists (like mailing lists). Needless to say, the assignment of aliases needs to be protected. An attacker mustn't be allowed to slip a new alias and/or new key into your ring -- especially if it's a crypto-list definition. > Thanks for the suggestion. However, my concerns are with >implementation and deployment, not research. I am perfectly willing to >consider cryptographic algorithms to be black boxes that do what they say >they will. I think the charter exists to start a new list. John Gilmore >has already offered to start a "coderpunks" list on toad.com. Shall we >take him up on it? My suggestion is that if you want this limited in content, it'll have to be moderated. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)tis.com http://www.clark.net/pub/cme | |Trusted Information Systems, Inc. http://www.tis.com/ | |3060 Washington Road PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2| |Glenwood MD 21738 Tel:(301)854-6889 FAX:(301)854-5363 | +--------------------------------------------------------------------------+

2 1

Re: Spam the Sign!
by Jeff Simmons 17 Dec '03

17 Dec '03

> > > > I do what RSADSI does with ftp.rsa.com. It requires a cronjob > > and sed. I didn't get the NSA to approve it, but I figure if it's good > > enough for RSADSI it's good enough for me. > > Do you have a legal opinion to support this statement? Our lawyers > tell us that executives of netscape could go to jail if we make the > 128bit version of netscape available from an "export controlled" > ftp or http server. We are working to clarify the situation with > the government or figure out an alternative distribution scheme that > will remove us from the grey area. > > Getting the US version of netscape widely available is one of my > highest priorities, but I can't tell Barksdale that he should go to > jail over it. I'm constantly pushing from within the company to keep > things moving forward. Actually ;-) Barksdale going to jail would probably advance the cause of strong cryptography more than anything I can think of. Can you imagine the media circus when he's led out the door in handcuffs? A man worth somewhere around a billion dollars being arrested for trying to give away his product? Court reporters trying to explain ITAR to the public? The mind boggles. ... and he looked over at me and said, "What are ya in for?" and I said, "Giving away free software," and they all moved away from me on the bench ... You guys didn't get to where you are now waiting around for HTML v3.0 to be approved. There must be some way to challenge an attempt to use ITAR to stop the DOMESTIC spread of strong crypto that doesn't involve the incarceration of your top executives ... -- Jeff Simmons jsimmons(a)goblin.punk.net

1 0

Re: Junk E-Mail
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, People are complaining about junk mail. No problem... 11 21 95 The Electronic Telegraph reports: THE European Parliament will decide today whether to ban junk mail. Euro MPs are also considering whether to outlaw credit card transactions by phone and whether direct selling via E-mail should be curbed. Today's vote has been triggered by proposals from the European Commission to protect consumers buying goods without seeing them. Your complaints are highly valued at Minute Mortuary at 2d & Main, which advertises "Privacy Knows No Limits." Cordially, Jim NOTE. The Electronic Telegraph website's URL: http://www.telegraph.co.uk The newsstory's headline: Junk mail faces last post Its online filename: wjunk21.html

1 0