- cypherpunks-legacy - lists.cpunks.org

The Dr. Fred scandal
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

I feel moved to make a couple of comments. o Dr. Fred did get over the edge. His communication style had little to recommend it. o He did make some good and useful comments along with some others. o Some people posting anonymously and otherwise took out of context quotes in an apparently mean-spirited way and slammed the guy. o Dr. Fred reacted o Others reacted o Some people took private email from Dr. Fred and quite unethically replied publicly on this list without his permission. o I see both sides as owing this list apologies. o There are two sides to this whole thing. Fred brought up some concerns about possible holes in software just as many of us have. Most the time things like this result in good discussions on this list and concensus is reached about the holes existing or not and the extent of the holes. Because of Dr. Fred's presentation, he quickly alienated people, and what little discussion there was about his theories was lost in the noise. We'd do better to let it drop. In the future if someone really annoys you in the way they present something, perhaps it would help more if you sent them private email noting that their communication skills are working against them and giving them some helpful pointers about how they could have done things differently. That way you'll be part of the solution instead of part of the problem. It's easier to get your dander up and express your annoyance publicly, but that affects all the rest of us. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Automatic File Wipe Utils for Win95?
by Richard Charles Graves 17 Dec '03

17 Dec '03

Prescript: No, I am not affiliated with any government agency in any way. -----BEGIN PGP SIGNED MESSAGE----- A government agency is looking for something to ensure that files copied from a Windows 95 machine do not contain any data from unused space on the hard drive. I'm curious too. Perhaps a command.com hack that zeroes out any bits outside the actual file? The problem is that existing utilities do not work because Win95 disables direct disk access to preserve VFAT. A delete utility is not sufficient, because they are also worried about temporary files created by Win95 programs. - -rich llurch(a)networking.stanford.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIgf7Y3DXUbM57SdAQEThgQAnEWB7HI2yoxiFCdosQTNG/WxiBLkqTvJ FSf3ni7ThmHSx7acp2KueevIRcrFw89JaGj1gPH68irZj8Vh8PEP1uopQJw+QWDo A5NsTPiZnDooXN+svGNo1KH0k36+73xXh5wybXzKFgwHWz9X4RtE+lZdJ9JDf1z7 O8IT0zG6nqc= =NSyb -----END PGP SIGNATURE-----

1 0

ADMIN: Cypherpunks list meltdown, temporary delay in postings
by John Gilmore 17 Dec '03

17 Dec '03

Somebody started forwarding every new cypherpunks message BACK to the mailing list. Each such message would, of course, trigger yet another message back to the list, resulting in a runaway situation. My guess is that it's caused by a bug in a procmail script being run by one of three people at io.com. We're investigating. Meanwhile to break the loop I am manually screening cypherpunks messages, which will result in multi-hour delays before your posting is seen by the list (since I only look at new stuff every few hours). I've yanked the three suspect users, and can probably turn it all back on sometime on Saturday. If you have urgent messages to go out, cc them to me personally and I'll probably notice them sooner. By the way, Hugh and I will probably be upgrading our version of Sendmail within the next few weeks, so you can possibly expect some further funny behaviour while we test it. I hope it isn't nearly as funny as this last meltdown. Don't worry, I didn't really write this message. The NSA had a few glitches in their MITM impersonation of toad.com, and posting this to reassure you that everything is OK. :-) John

1 0

Sun speaks out - but not to the cypherpunks
by fc＠all.net 17 Dec '03

17 Dec '03

This response came from Sun to Risks: > Date: Mon, 16 Oct 1995 21:22:40 -0700 > From: Caveh.Jalali(a)eng.sun.com (Caveh Jalali) > Subject: Re: Risks in Java > > If we are going to "analyze" java security, let's keep in mind that there is > an important distinction between the language (java) and the machinery which > runs the java program. > > Java is a general-purpose programming language along the lines of C/C++. > So, there is no doubt that its expressive power overwhelms our > theoretician's abilities to predict java-programs behavior -- this is where > we start getting into the halting problem, computability and other black > magic. Basically, i don't think we can "trust" programs written in any > *useful* programming language. Read: We can't trust Java programs. > The area where we can (must) build trust is the computing base. > Traditionally, this has been the OS, but in the case of java, it is the java > interpreter (such as netscape 2.0 and hotjava). The browser is now the TCB > (trusted computer base) for all practical purposes... Read: The Java interpreter is supposed to be a TCB > And, to address the specific concern about applets spamming the net -- from > what I've seen, applets are only allowed to connect to the server that > supplied the applet in the first place (by default). The worst thing one > could probably pull off is to spam oneself. Read: By default only - also note, none of this invalidates attacks 30-49 from the previously posted list. Who here truly believes that the implementations of Java meet the requirements of a TCB? -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

Verisign and MITM
by sameer 17 Dec '03

17 Dec '03

I recently submitted a certificate request to Verisign for my SSL web server. Looking over the process, I don't see how it avoids MITM in any way. The process: A) I send to netscape-cert(a)versign.com the email address and phone number of my webmaster (me) along with the cert request, generated using SSLeay's 'req' utility. B) I fax to Verisign a request letter saying "I have a right to use the name Commmunity ConneXion, etc." and proof of right to use name. (Berkeley biz liscense and Alameda Cty. fictitious bizname statement, in my case.) C) I snail mail them the same thing. I don't see any mechanism in place to avoid an MITM subverting step (A), and putting in his cert request in there. There isn't a strong cryptographic unforgeable relationship between my usmail/fax/proof request and the emailed kx509 cert request. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 1

Re: Verisign and MITM
by tcmay＠got.net 17 Dec '03

17 Dec '03

[ssl-users(a)mincom.oz.au deleted from the distribution, as I am not on that list] At 3:40 PM 10/20/95, sameer wrote: > I recently submitted a certificate request to Verisign for my >SSL web server. Looking over the process, I don't see how it avoids >MITM in any way. .... > I don't see any mechanism in place to avoid an MITM subverting >step (A), and putting in his cert request in there. There isn't a >strong cryptographic unforgeable relationship between my >usmail/fax/proof request and the emailed kx509 cert request. An interesting "direct demonstration" of this would be to get a certificate generated for a well-known company, institution, or political candidate. This would demonstrate the flaws in the e-mai/fax/snailmail process like nothing else. (Tangential note: Of course, my fear is always that exposing such flaws shows that "we need a national identity system." After all, what Sameer is describing is implicit in the fact that neither e-mail, nor a fax, nor snail mail, is proof that an entity exists, or that the paperwork represents the entity. That's a tough nut to crack, absent an "is-a-person" or "is-an-institution" credentialling system.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: How can e-cash, even on-line cleared, protect payee identity?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:20 PM 10/22/95, Bryce wrote: >I can imagine a future in which this requirement is not difficult to >meet. Perhaps it will be the case that you can accept a coin, open >up a new ("anonymous") account with the bank, deposit the coin, >withdraw a new coin of the same amount, close the account, and now >have an untraceable coin all in a fraction of a second. Bryce, we'll make you a believer in online clearing yet! This is essentially the point several of us have been making, that if "anonymous bank accounts" are allowed (_technically_, no problem), then Bob can take his "possibly watched" piece of cash, deposit it with his bank in his anonymous account, withdraw the same amount (or more, or less, it doesn't matter if the account is truly anonymous) and neither Alice nor the Bank know who got it. As you note, Bob can even open a new account, deposit, withdraw, close the account. This makes the bank a "digital coin laundry," such as Lucky Greene and others have talked about. If forbidden by law in the U.S., no problem using offshore banks. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

8 11

bernstein results?
by sameer 17 Dec '03

17 Dec '03

So when do we find out what the judge had to say about the hearing on Friday? -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 1

Lack of secrecy in U.S. Banks
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ph(a)netcom.com (Peter Hendrickson) writes: > > I ran across an interesting fragment of the U.S. Code. > > Apparently, the Federal Government may access any banking records As a former bank employee, I can assure all readers that privacy of banking records is non-existant. All you need is a friend who works in the computer, auditing, bookkeeping, or loan department (in that order of preference). If your friend has worked there long enough, he/she can probably also get informmation from any other bank in the community. (Don't suggest the security department. As far as bank transactions are involved, the Auditor normally handles that.) To reassure the excessively paranoid, bank employees are normally flooded with so much information per day that they normally take no interest in any more of it than their job forces them to. Moreover, when you consider that it is commonplace for a teller to handle total transactions daily than run well into six figures, few if any individual transaction attract any attention. Banking trivia #1: Banks are the only businesses that close their books daily rather than monthly or quarterly. Banking trivia #2: When choosing a bank, check out the Cash Over/Cash Under account on their balance sheets. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: LIBERTY!! Use it or lose it!! iQCVAwUBMIpbMd74r4kaz3mVAQEi5QP+KYftQ3jKjWFbqqgH65tUB7sONx1poZV0 w8g5OdHlwpG+lU0HeqZlVPlJv+iqmGGo4hCN1sZ5z0LB3FDyeLlO8AQwBHPGadGB dYUtMhq4gpJEpjJba9jdH7neu57j94/S+3Y0lYA0y/ZqJxbwRRntLMJzAZ0RozDH SsJsLn/tOlo= =N8mQ -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)webcasters.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

1 0

Reducing the Flames, Attacks, and Nit-Pickings
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:18 AM 10/22/95, Todd Glassey wrote: >As an aside - What blows my mind is the number of cycles people spend >bitching and moaning about Java itself rather than working to create a >better solution. The recent flames and attacks are pretty typical of mailing lists, especially mailing lists having 1200 highly-opinionated subscribers (gulp!). Not that I like the flames, but they're not the problem I want to really talk about. A trend that bothers me--and others too, from comments here--is the intense "feeding frenzy" that is going on with each and every new product, from Netscape, to Microsoft Network, to Java, to Digicash. Don't get me wrong--finding flaws is a useful thing to do. But this list is becoming _consumed_ by the _process_ of attacking products. Worse, many of the attacks are by innuendo, by rumors and speculations about what features a product has. My comments will likely vanish without a trace, but I urge folks to hold back a bit on jumping in with attacks and reports of problems. Be sure something is _really_ a flaw before sounding the alarms. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0