- cypherpunks-legacy - lists.cpunks.org

SNI_ffs
by John Young 17 Dec '03

17 Dec '03

3-30-96 TWP reports on an Argentinian hacker who penetrated a slew of sensitive networks and how the FBI tracked him by getting a warrant to run a sniffer-filter at Harvard, the POE. The hacker's dad, a Lt. Col., barks, "The Yankees don't have the slightest idea about security. If a kid can enter, they should be ashamed to admit it." The Feds snort, "The case underscores the vulnerability of computer systems worldwide, a preview of a coming era of cyber-sleuthing, what computer crime-fighting will look like in the coming years." And that it shows they can catch tresspassers without violating other users' privacy. Banisar sniffs, "The case shows that there's a need for more encryption." SNI_ffs

2 1

Re: [NOISE] Cable-TV-Piracy-Punks
by jim bell 17 Dec '03

17 Dec '03

At 11:59 PM 3/30/96 -0800, Mike Duvos wrote: >A few more hopefully short comments... > > Why not? If the card knows its own key, then someone else > > can probably get the key out by some nasty mechanism. > >There is no physical difference between cards. The key >information is stored in EEPROM, and the links which permit the >EEPROM to be written are burned after programming is complete. >The EEPROM data is then only accessible to intimately associated >circuitry in its vicinity. > >Presumedly the state of the EEPROM cannot be deduced by any >external examination of the card, and any attempt to >incrementally abrade the card down to the relevent circuit >elements should completely obliterate the minute charge >differences which represent the data. > >At least, that's the theory. The Europeans trust this technology >well enough to let it represent real money, so presumedly they do >not consider hacking a possibility. > >Perhaps our resident VLSI and Alpha Particle expert, Timothy C. >May, could give us a guess as to whether Perry's "Nasty >Mechanism" is more or less likely than Maxwell's "Daemon." I don't know what Tim May will tell you, but over 10 years ago a technology was developed which is something like a scanning electron microscope, however with very low beam energies and is designed to be able to scan a chip and quantitatively measure the voltage at various/all points on the chip. It can be thwarted by a thick coating on the chip, but most organic coatings can be removed with a "plasma asher," a chamber designed to remove photoresist coatings on chips. Jim Bell jimbell(a)pacifier.com

1 0

Re: Crypto CD UpDate
by JR＠ns.cnb.uam.es 17 Dec '03

17 Dec '03

>If pieces of the source/executable are digitally signed, you have a basis >for some degree of trust. (My pgp came with a detached signature. A bit >self-referental, but at least a start.) > >Regards - Bill Agreed, but it imposes further restrictions: it's OK if you can put PGP digitally signed by prz, but not all packages will be available signed from their authours, especially compiled for various platforms. OTOH, most unknowledgeable people will trust almost anything (they are already doing so when downloading java applets). And it would do a great work to spread knowledge about cryptography. Which is a Good Thing. All in all, I think it is a good idea, but addressing the general public will require quite some work, and the 'connoisseurs' might either do as Tim (only use the net) or just make their own mass-store, removable, thingies. Stil I'd bet many people will be eager to get a mirror of the major sites on CD. jr

1 0

(Excerpted Fwd) Minnesota Online privacy bill in conference comm
by Deranged Mutant 17 Dec '03

17 Dec '03

------- Forwarded Message Follows ------- Date: Sat, 30 Mar 1996 11:33:26 -0600 To: privacy(a)ftc.gov, net-happenings(a)vm1.nodak.edu, pubs(a)educom.edu From: shel(a)mtn.org (Sheldon Mains) Subject: Minnesota Online privacy bill in conference committee Reply-to: privacy(a)ftc.gov Minnesota Online Privacy Bill in Conference Committee is in Conference Committee 3-27-1996 The following online privacy option bill passed the full Minnesota State House and is now in conference committee with a "study" passed today by the State Senate. The various interests, including major commercial on-line services, woke up to the bill and found Senate members to amend their version which was similar to the House's on the floor with a short bill that would instead require study. It is a pretty incredible story that the House bill (following after this intro) has gotten so far without major attention. Sheldon Mains shel(a)mtn.org You can track the legislation via the legislative WWW at: http://www.leg.state.mn.us [..] Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

2 1

Re: Netscape Navigator 3.0 beta
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

Found an interesting article on Ecash in Industrial (Internatioal) Design. / What is Money / Karrie Jacobs ID March/April 96 _______________________ Regards, Those who would have nothing to do with thorns must never attempt to gather flowers. Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu 0C 69 D4 E8 F2 70 24 33 B4 5E 5E EC 35 E6 FB 88

1 0

No Subject
by Black Unicorn 17 Dec '03

17 Dec '03

> On Sat, 30 Mar 1996, Dr. Dimitri Vulis wrote: > > > Black Unicorn <unicorn(a)schloss.li> writes: > > > > > On Fri, 29 Mar 1996, jim bell wrote: > > > > > > > > >Anyone who knows me knows I spend all my days end arounding the > > > > >U.S. government. > > > > > > > > Explains a lot! You _are_ paid for this. In an earlier era, you > > > > would have gladly run the ovens at Auschwitz if you'd gotten paid > > > > for it. would have gladly run the ovens at Auschwitz if you'd > > > > gotten paid for it. > > > > > > You're way out of line here. > > > I expect an apology. > > > > Consider the above in context. Would you be willing to run the ovens/gas > > chambers if you were exterminating U.S. government employees/contractors? > > No, I would not. That's the difference between me and you- er... Mr. Bell. . Finally, Lance blew his nym. I'd love to hear the rationale behind this. . So, do you think that I'm Jim Bell's tentacle or that he's my tentacle? Does it make a difference? > > "The final solution to the IRS/BATF problem." :-) . And what if you were "processing" U.S. Congressmen? I find this entire line of conversation revolting. I also don't find it very surprising given the sources/source. . --- . Dr. Dimitri Vulis . Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information

1 0

No Subject
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Yes, Netscape caches passwords. --- begin forwarded text From: support(a)sfnb.com Date: Fri, 29 Mar 96 17:27:02 -0500 Sender: <support(a)sfnb.com> Apparently-To: bankusers(a)sfnb.com Dear Security First customer: With the release of Netscape Navigator 2.0, Netscape enhanced their caching mechanism to improve the browser's performance. As a result of this enhancement, the Navigator was storing Security First username and password information when entered in cleartext on a customer's local hard drive in a file called fat.db. Therefore, if a knowledgeable and malicious person had access to a Security First customer's computer, they could have potentially stolen that customer's username and password. To our knowledge, this vulnerability was NOT exploited by anyone. We were made aware of this fact in an e-mail to the bank from Lucky Green, a frequent contributor to the cypherpunks mailing list. Immediately upon learning of this situation, Five Paces engineers worked closely with Netscape engineers and fixed the problem. To prevent caching of the username and password, we changed the login script to include "pragma: no-cache" in the http header. This command instructs the browser not to cache any information from this page on the local hard drive. Please note this was not specific to Security First. Any Web site that requests a username and password in an onscreen form is potentially vulnerable to this cleartext caching if the "pragma: no-cache" header is not used. In order to ensure that your username and password have been cleared from your cache, bank customers should go to the Options dropdown menu in the Navigator, and select Network, then Cache, and then click on the "Clear Disk Cache Now" button. We know that software involving Internet commerce is changing at a rapid pace, and we will continue to monitor all changes that might affect our customers. We would like to thank Lucky and also Jeff Weinstein of Netscape for bringing this to our attention. The Internet community benefits when we all work together to make it a better network. If you have any questions, please do not hesitate to e-mail me at karlin(a)sfnb.com, or our customer service staff at support(a)sfnb.com. Sincerely, Michael Karlin President & COO Security First Network Bank ================================================================ Michael S. Karlin Security First Network Bank 2957 Clairmont Road 404.679.3201 Suite 280 404.679.3210 Fax Atlanta, GA 30329 karlin(a)sfnb.com --- end forwarded text -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 2

[ITAR/POLITICS] rsa-in-3-lines-of-perl just shrunk!!
by Adam Back 17 Dec '03

17 Dec '03

Sorry to contribute to the simply awesome noise to signal ratio here lately (hopefully the subject tag should help those not interested in politics), but... [if you don't know what I'm talking about, see http://www.dcs.ex.ac.uk/~aba/rsa/ for a combined perl hack and ITAR violation] Due mainly to a couple of insights donated by someone who was introduced to the code via a friends `munition' T-shirt... he started the ball rolling again... it shrunk from: #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) to: #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/) (Actually it's not quite as impressive as it might look at first glance because the old version included the comment "-export-a- crypto-system-sig -RSA-3-lines-PERL", so the new one should really be compared against: #!/bin/perl -s $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) ) but it's still a whole 31 bytes shorter, and it now really is in 3 lines of perl rather than cheating and not counting the #!/bin/perl line. (Several people took me to task on that one). I won't consume list bandwidth describing exactly how the new one works, and the arcane perl and dc hackery that went into it, as I have described it all in excruciating detail on: http://www.dcs.ex.ac.uk/~aba/rsa/story.html I really wasn't expecting to see it shortened any further. There goes all those T-shirts, outdated, my sincere apologies to Richard White also, whose tattoo was featured in the April issue of Wired (at least the UK edition, the US one too?), Oh yeah, and if you can see any ways to shorten it, please tell me! (Perl5 specifics not allowed, there is already a shorter p5 specific version but it's got to be as portable as possible). Adam ps I now have a reasonable stock of T-shirts again after the prolonged hiatus of my printer, who finally delivered the 2nd batch. -- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

1 0

Re: Witch Hunts
by tcmay＠got.net 17 Dec '03

17 Dec '03

Bruce Zambini wrote: >It is also worth noting that the original Detweiller, in a sense, played >De Sade to Tim May's Rousseau, in that he used an unorthodox, but >effective, critical technique. (This is, in fact, one reading of De I don't buy this. If you consult the archives, circa the fall of 1993, you'll find that while Detweiler/S.Boxx/etc. repeatedly begged me to engage him in debate, I declined. So, what was the "effective" part? I thought his insults, rants, forgeries, screams, shouts, and general gibbering detracted from his real points, such as they were. I'm beginning to think there must be a personality type or behavioral pattern at work here. Others in recent months have also had their ideas buried in a stream of insults, rants, and CAPITAL LETTERS! The pattern seems to be the same, though I doubt any of them are Detweiler. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: SQUID's (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > > Apparently you are grossly unfamiliar with the > > characteristics and capabilities of SQUID's. To help you > > catch up... > > Actually, I am quite familiar with Superconducting Quantum > Interference Devices and the one existing commercial application > of the technology, a magnetometer probe containing a liquid > nitrogen cooled SQUID chip at its tip. There are several commercial probes available, not a single source as you claim. The Air Force has used them in experimental fighter programs for several years allowing hands-off flying (in a simulator) with quite good results. Quite a few neurophysiologists use them along with NMR to map the neuronal activity of the human brain on a neuron by neuron basis. The folks who make the various flavors of super-conducting wire use them to test for imperfections in the product. I sugest that your familiarity with the SQUID technology might be a little dated. Take the time to contact Conductus. > > [Biography of Mr. Squid deleted] > > I will still laugh at suggestions that Mr. Squid can remotely > read the EEPROM in my smart card, however. I didn't make that assertion. I clearly offered it as a source of education and entertainment. I even went so far as to specificaly predicate my recital with this caveat. While Mr. SQUID might be able to do it, the other commercial probes out there would have no problem from reading your smart card on a transistor by transistor state if that is what were required.

1 0