- cypherpunks-legacy - lists.cpunks.org

Re: Maybe It's Snake Oil All the Way Down
by Adam Shostack 01 Jun '03

01 Jun '03

The assumption that "having cracked a cipher" leads to "can make lots of money from the break" is one held mostly by those who have never attacked real systems, which have evolved with lots of checks and balances. The very best way to make money from cracking ciphers seems to be to patent the break, and the fixes, and then consult to those who use the cipher, because they need your expertise to fix their systems. P. may have a patent on this method. Adam On Sun, Jun 01, 2003 at 07:05:44PM -0400, Scott Guthery wrote: | Suppose. Just suppose. That you figured out a factoring | algorithm that was polynomial. What would you do? Would | you post it immediately to cypherpunks? Well, OK, maybe | you would but not everyone would. In fact some might | even imagine they could turn a sou or two. And you can | bet the buyer wouldn't be doing any posting. With apologies | to Bon Ami, "Hasn't cracked yet" is not a compelling security | story. | | Cheers, Scott | | -----Original Message----- | From: Rich Salz [mailto:rsalz@datapower.com] | Sent: Sun 6/1/2003 6:16 PM | To: Eric Rescorla | Cc: Scott Guthery; cypherpunks; cryptography(a)metzdowd.com | Subject: Re: Maybe It's Snake Oil All the Way Down | | | | > There are a number of standard building blocks (3DES, AES, RSA, HMAC, | > SSL, S/MIME, etc.). While none of these building blocks are known | > to be secure .. | | So for the well-meaning naif, a literature search should result in "no | news is good news." Put more plainly, if you looked up hash and didn't | find news of a SHA break, then you should know to use SHA. That assumes | you've heard of SHA in the first place. | | Perhaps a few "best practices" papers are in order. They might help | the secure (distributed) computing field a great deal. | /r$ | -- | Rich Salz Chief Security Architect | DataPower Technology http://www.datapower.com | XS40 XML Security Gateway http://www.datapower.com/products/xs40.html -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: web apps with large volumes of bidirectional http traffic
by Nomen Nescio 01 Jun '03

01 Jun '03

Ryan Lackey writes: > I need to find some relatively widely deployed applications which have > frequent user interactions (rapid clicking on links, from as large a > population of links as possible, and also form filling and such). > > (it should be pretty obvious what this is for) It's not, really. Maybe some kind of cover traffic for an underlying hidden data stream? Or maybe you will create a client which mimics a human person, and sends information by choosing what to click on? Sounds like a pretty low-bandwidth channel. > I'd like: > > 0) *rapid*/frequent user interactions; fast clicking on things (like every > second, no more than 5 seconds) > > 1) "sticky"...long interactions with a given site (on the order of hours) > (also all links need to be under the same url/same server) These two don't make much sense together: someone is going to sit there, interacting with a server for hours, clicking every second? That sounds more like a job than something people would do voluntarily. You're either going to need to accept a much lower click rate, or else a much shorter connection time. Okay, maybe one of the online fantasy games services like EverQuest? I hear people get addicted to those and spend hours on them, but I think they do a lot of typing rather than mouse clicks. Or one of the shoot-em-ups? Those probably use the mouse a lot more. They aren't really "web applications" though. Does it really have to be a web app? > So far, the best ideas: > 1) Porn > 2) Mailing lists with lots of internal links (next, reply, etc.) > 3) Sites with search engines with lots of linked data (encyclopedia, > etc.) > 4) html games (or flash, maybe) -- either imagemaps, or just tables, > things like chess, or puzzles, or whatever Most of those won't satisfy your click rate and connect time goals. > I'd definitely appreciate any suggestions on possible web apps which > meet these criteria; reply to lists or ryan(a)venona.com. > > I'll post when it's ready. Maybe you could give some more clues... --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Re: [spam] Re: Nullsoft's WASTE communication system
by Steven M. Bellovin 01 Jun '03

01 Jun '03

In message <DBEJLLBKGOFDEGENOKOKCEHHCLAA.johnbr(a)undefined.com>, "John Brothers" writes: > >> Any license that you may >> believe you acquired with the Software is void, revoked and terminated. > > >Can you void and/or revoke the GPL? It doesn't matter if the GPL statement wasn't inserted by the real owner of the work. Note that the employees almost certainly do not own the "work for hire" -- it would be Nullsoft/AOL Time Warner that does. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

1 0

Nigerian Spammers Using TDD/TTY Telephone Relay Service
by Bill Stewart 01 Jun '03

01 Jun '03

This weekend I received three or more cell phone calls from 800-855-0000, which said they were the AT&T Relay Service, which relays phone calls from deaf people using TDD or TTY or now internet webform services. They claimed to be a "Dr. Charles Ego" (or some name like that) asking to confirm that I'd received his email, and asking for my email address. I was a bit puzzled, because none of the deaf people I have known over the years are doctors, and one of the two signing people I know well was at dinner with me when the call arrived, and they were calling like this was a business call, but it was Sunday night before a US Monday holiday, so they were probably calling from somewhere that it was Monday daytime. The name sounded enough like the usual fraudulent Nigerian Email Scam, so I asked what time zone he was in, and he replied 12:00 GMT, which didn't make sense (either it's Atlantic Time, or he was just wrong.) So I poked around the AT&T Relay Service web site, and it sounds like we've got a new web-based interface to free telephone relay service and the spammers have discovered the potential for abusing it. Sigh. And it's got a privacy policy that sounds like it'll be difficult to track down these callers..... The web site says they deal with privacy issues by not storing call content, though at first reading it doesn't really say whether they do or don't store call record information like IP address, phone number, or call duration, though since it's free that probably means it's either government-subsidized or some other mandated program with accounting requirements like that, or if they have an "except for drugs or terrorism" requirement.

6 8

Apple's "Rendezvous" bites "Itunes"
by Major Variola (ret.) 01 Jun '03

01 Jun '03

[DRM, Utility vs. Infocontrol] Apple is clamping down on piracy by imposing restrictions on the way that music downloaded from its iTunes service can be shared. Changes to the service stop people listening across the internet to playlists of songs created by others. The change was included in an iTunes software update that also fixed some bugs in the service. ITunes users are divided over the changes, but some people have been heavily critical. Stop sharing Apple's iTunes music store has become hugely popular since it was launched in May of this year and recorded about a million downloads in its first week. Part of the reason for its popularity was the fact that it placed few restrictions on what people could do with the music they downloaded. The iTunes service allowed people to listen to almost any music collection that was sharing the same local computer network as they were. But clever iTunes users found a way to extend this local sharing across the internet using Apple's own Rendezvous software. Details of how to tweak iTunes to make it share playlists over the internet, and allow people to record the songs being streamed, were published online. The update for iTunes is intended to close this loophole and limit who can listen to a playlist. "Rendezvous music sharing..., has been used by some in ways that have surprised and disappointed us," said Apple in a statement. "Some people are taking advantage of it to stream music over the internet to people they do not even know," it added. "This was never the intent." The change has been widely debated on discussion boards online as well as on sites such as Mac Central and Slashdot. Many people have said the restrictions mean they will not upgrade to the latest version and that the change stops many legitimate uses of iTunes. One angry user wrote on Slashdot: "The digital lifestyle is all about the fluidity of bits, the fact that all computers on the internet are, in some sense, in the same place, no matter where they're physically located." Others were less outraged and said that, even with the change, the iTunes service imposed far fewer conditions on its users than many other online music services. http://news.bbc.co.uk/1/hi/technology/2946180.stm

3 3

Nullsoft's WASTE communication system
by Bill Stewart 01 Jun '03

01 Jun '03

http://www.nullsoft.com/free/waste/ - Overview http://www.nullsoft.com/free/waste/security.html - Security section http://www.nullsoft.com/free/waste/network.html - Network design http://slashdot.org/article.pl?sid=03/05/29/0140241&mode=thread&tid=126&tid… - Slashdot discusssion Nullsoft, who did Winamp and Gnutella, just released a package called W A S T E which does encrypted communications within small groups of people. It doesn't appear to have had outside analysis of its security yet, but they do invite it, and they say it needs some work. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

8 7

Re: Maybe It's Snake Oil All the Way Down
by Morlock Elloi 31 May '03

31 May '03

> assumption. The only thing that really differentiates the experts from the > naifs is the amount of smoke. That pretty much sums it up. The only thing that one can more or less safely assume is that crypto that is widely believed to be strong is unlikely to be publicly compromised (ie. used against you, the nobody) as it would make it useless. ===== end (of original message) Y-a*h*o-o (yes, they scan for this) spam follows: __________________________________ Do you Yahoo!? Yahoo! Calendar - Free online calendar with sync to Outlook(TM). http://calendar.yahoo.com

1 0

Re: Maybe It's Snake Oil All the Way Down
by Major Variola (ret) 31 May '03

31 May '03

At 08:32 PM 5/31/03 -0400, Scott Guthery wrote: >Hello, Rich ... > >When I drill down on the many pontifications made by computer >security and cryptography experts all I find is given wisdom. Maybe >the reason that folks roll their own is because as far as they can see >that's what everyone does. Roll your own then whip out your dick and >start swinging around just like the experts. Are you trying to confirm that either the WASTE folks are homosexual, or puerile, as one might guess from the names of some of their projects? (Not that either impugns their code.) On the other hand, both AES and 3DES are US gov't approved. Which is sufficient reason to use Blowfish. Some of the other critiques of WASTE methods are substantial, however, in particular the SSL recommendations are useful tidbits to remember.

1 0

IQ, g, flying
by Major Variola (ret) 31 May '03

31 May '03

At 02:30 PM 5/30/03 -0700, Tim May wrote: >The second irony is that just today I took my first flying lesson, in a >Diamond Katana composite/carbon single-prop plane. I took off from the >Watsonville Airport, which is, I assume, the home airport of Adelman. Just FYI, if you read up on G (general intelligence factor), you will learn that the *only* cause of death that increases with G is dying in airplanes. (This is evidence that G is real, and general, and intelligence is adaptive.) You might also enjoy http://www.av8n.com/ which I once stumbled upon because Denker now does crypto.

2 1

Re: Brinworld: Streisand sues amateur coastal photographer at californiacoastline.org
by Major Variola (ret) 31 May '03

31 May '03

At 10:00 PM 5/30/03 -0400, Tyler Durden wrote: >You think that's bad? > >I know someone who was offerred $1,000 a night to play lead trumpet for >Streisand. When he heard that a major requirement was that he was not to >"lock eyes onto Streisand" (ie, look at her), he declined the offer. Who cares? That's a private transaction. Neurosis is not criminal. You can hire Streisand to sing on the condition that she keeps her nose up your ass, so long as its a mutually consensual transaction. But you can't use the threat of violence (ie law) to coerce photogs publishing what anyone can see. *That* is the point.

1 0