- cypherpunks-legacy - lists.cpunks.org

Re: Washington State Restricts Anti-Cop Videogames
by Major Variola (ret) 21 May '03

21 May '03

At 07:08 AM 5/21/03 -0500, Jim Choate wrote: >Re: Slashdot | Washington State Restricts Anti-Cop Videogames >http://games.slashdot.org/games/03/05/21/0516230.shtml?tid=127&tid=186 Funny, I don't remember anything about "minors" in the Bill of Rights... Congress shall make no law ... abridging the freedom of speech, or of the press.. Vendors are of course free to follow any policy they want, for any reason. Movie theatres follow the G/PG/R/X system for PR, not obligation. Similarly with Walmart and their decision not to sell certain recordings. However Washington is a government, and the 14th has something to say: No State shall make or enforce any law which shall abridge the privileges or immunities of citizens of the United States; nor shall any State deprive any person of life, liberty, or property, without due process of law; nor deny to any person within its jurisdiction the equal protection of the laws.

1 0

Re: new California crypto legislation?
by Major Variola (ret) 21 May '03

21 May '03

At 03:51 PM 5/20/03 -0700, Eric Murray wrote: >I've heard a rumor that there is some new legislation >being proposed in California that would require consumer >communication using SSL to go "directly to the server". Smells like compelled speech to me. Any networked computer can be a server. We are all reporters, we are all book sellers. We are all first class objects. --Tim May

1 0

Slashdot | Washington State Restricts Anti-Cop Videogames (fwd)
by Jim Choate 21 May '03

21 May '03

http://games.slashdot.org/games/03/05/21/0516230.shtml?tid=127&tid=186 -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Commercial Spam-blocker with Sender-Pays using PayPal
by Bill Stewart 21 May '03

21 May '03

I'm forwarding this just because it's the first time I've seen a commercial spam-blocker program that implements sender-pays, so it seemed topical. I don't know if any of their customers have actually implemented that feature (it's got other alternatives like a Bayesian filter and Turing auto-responder) or if anybody has actually bothered to send them mail if they use it. (Their email for it looks like semi-spammy drivel, but they've got permission, because I was once interested in getting updates about one of their other packages and haven't bothered unsubscribing.) Bill -----Original Message----- From: Blue Squirrel [mailto:news@bluesquirrel.com] Sent: Monday, May 19, 2003 11:19 AM To: Stewart, William C (Bill), RTSLS Subject: Letter from Sheri This is probably the 10th e-mail message you've received telling you how you can get rid of junk e-mail messages. But, I found a sweet software package that you might find a little more useful than all of the other anti-spam programs you've heard about. The program is called Spam Sleuth, and it just so happens that Blue Squirrel released an updated version, 2.0.10, last week. How does Spam Sleuth defeat spam? The program uses a Point System. Spam Sleuth has analyzers, and each analyzer: Friends, Spammers,To, Goodwords, Badwords, Profanity, Subject, Attachments, Charsets, HTML Volume, etc. looks at an e- mail a different way and assigns points. The more points an e-mail message receives the more likely it is to be deemed as spam. The less points an e-mail message receives the more likely it is a real gem. Think of it as though it was a contest, and each Analyzer is a different judge, and the messages are the contestants, and Spam Sleuth is the scorekeeper. Every judge looks at the e-mail message and assigns points based on specific criteria. Then all of the points are added together to create an overall total. More points is bad, and less points is good. The point system is clever, and works wonderfully, but the heart of Spam Sleuth has some killer features: Turing Test: If Spam Sleuth accidentally catches a message as spam, it lets the sender type some special letters to show that the message wasn't sent by a mindless machine, and the message is allowed through to your InBox. (Great way to know if you're dealing with a real human on the other end.) This is my favorite because I can be much more aggressive with my settings without worrying I'll miss an important e-mail. E-Mail Stamps: Allows you to charge senders a fee to let an e-mail message through to your inbox. Spam Sleuth sends an email back to the sender and requires them to make a payment via PayPal before the program will allow the message through to your inbox. You configure and decide how much your time is worth, whether it's 5 cents, or a buck. (That's right, you make the spammers pay you to send junk e-mail messages.) Bayesian Analysis: Looks at your previous e-mail and learns the characteristics of spam and good e-mail. Just like a baby, it needs to be taught right from wrong. By marking your messages as Good or Spam, and then Training the Bayesian Analyzer, you can teach it right from wrong. Then it can contribute to the decision of whether a new e-mail is spam or not. (Now that's what I call cloning.) Be sure to check this program out, download a 60 day demo from: http://www.bluesquirrel.com/download/SpamSleuthSetup.exe Sincerely, Sheri P.S. I hooked you up with a discount. So if you call 800-403-0925 or visit http://www.bluesquirrel.com/cart/cart.asp?P=SSS_NL you can get a copy for $19.95 vs. $29.95 normally.

2 1

Fwd: 6:30 pm Tuesday 20 May 2003 Refund Day II: The case of Adam Kosmin vs. Toshiba, in the matter of Adam's refund, will likely not be tried but put off for another day. (fwd)
by Jim Choate 20 May '03

20 May '03

---------- Forwarded message ---------- Date: Tue, 20 May 2003 01:59:46 -0400 Subject: Fwd: 6:30 pm Tuesday 20 May 2003 Refund Day II: The case of Adam Kosmin vs. Toshiba, in the matter of Adam's refund, will likely not be tried but put off for another day. res ipsa loquitor... Begin forwarded message: > Subject: 6:30 pm Tuesday 20 May 2003 Refund Day II: The case of Adam > Kosmin vs. Toshiba, in the matter of Adam's refund, will likely not be > tried but put off for another day. > > Efforts at an out of court settlement having failed, the issue between > Adam Kosmin and Toshiba will at some unknown date be tried in a court > of > law. The case may be tried on Tuesday 20 May 2003, but more likely the > court will set yet another date some time in the future, perhaps a > month > from now. So far Adam Kosmin and Toshiba have been out to the Queens > County courthouse twice. This Tuesday's appearance will be the third > in > this matter. > > At 5:00 pm on Tuesday 20 May 2003 Adam Kosmin and some tribesfolk will > gather at the coffee house across the street from the Queens County > courthouse. All supporters of free software and all students of > contract > law are invited! > > If the case is heard this Tuesday, it might be useful to have on hand > more > than one laptop computer running a free OS. As always, Knoppix, or > Knoppix > variant, disks are welcome. These tools may help us explain to the > judge > some facts that are not often presented in large circulation > newspapers. > > If convenient, wear standard CLOTHES OF RESPECT. Do not interrupt or > shout > out in court. You may not read in court. You must sit and pay > attention > and be ready to help the judge and Adam. > > > Here is information about Refund Day I: > > http://www.svlug.org/events/refund > http://www.netmonger.net/~onr/ny/welcome.html > http://www.nytimes.com/library/tech/99/02/biztech/articles/ > 16windows.html > > > Adam Kosmin is the leader of Refund Day II and all questions should be > addressed to him at > > info(a)windowsrefund.net > > For more about Refund Day II: > > http://www.windowsrefund.net > > > This action is not the whole of Refund Day II. It is just the > beginning. > Already other actions, not yet public, are in process. No matter what > happens in court we will continue the fight. What is at stake is our > right > to private ownership of computers and our right to free private, > tribal, > business, and public use of the Net. > > > <blockquote > what="information that is not twice confirmed yet" > contact-for-more-information="info(a)windowsrefund.net"> > > 1. court > > Queens County Court > > > 2. place of court > > 89-17 Sutphin Blvd. > Jamaica, NY 11435 > 718-262-7123 > > > 3. day and time of case > > Tuesday 20 May 2003 > 6:30 P.M. in the Small Claims/Commercial Claims Part Courtroom > First Floor Room 101 > > Note that the room number may actually be different. It is best to > arrive > early and meet with Adam at the coffee house across the street. > > > 4. name and/or number of action > > Index number: 531QSC2003 > Kosmin, Adam vs. Toshiba American Information Systems Inc > > > 5. ways to get out there > > By subway, take the F train to Sutphin Blvd. The court house is on > the same > street. It is several blocks from the subway stop. > > </blockquote> > > > Note: This action is not a formal official action of LXNY, though many > LXNY > members support the rule of law, and further, the particular > application of > the rule of law to Microsoft and Toshiba. > > > Jay Sulzberger <secretary(a)lxny.org> > Corresponding Secretary LXNY > LXNY is New York's Free Computing Organization. > http://www.lxny.org

1 0

ColorLines: Timeline of Homeland Security (fwd)
by Jim Choate 20 May '03

20 May '03

---------- Forwarded message ---------- Date: Mon, 19 May 2003 09:10:37 -0500 (CDT) Subject: ColorLines: Timeline of Homeland Security from cdavis: A succinct timeline of post-9/11 events and policies effecting immigrants and civil liberties. http://www.arc.org/C_Lines/CLArchive/story6_1_06.html

1 0

LAT: (fwd)
by Jim Choate 20 May '03

20 May '03

---------- Forwarded message ---------- Date: Mon, 19 May 2003 15:07:04 -0500 (CDT) Subject: LAT: from MoveOn.org mailing list post. "A Nuclear Road of No Return" by Robert Scheer http://www.latimes.com/la-oe-scheer13may13,0,5142385.column (free registration required) "On Sunday, the Washington Post wrote the obituary for the United States' effort to find Saddam Hussein's alleged weapons of mass destruction. "Frustrated, U.S. Arms Team to Leave Iraq," read the headline, confirming what has become an embarrassing truth - that the central rationale for the invasion and occupation of oil-rich Iraq was in fact one of history's great frauds."

1 0

new California crypto legislation?
by Eric Murray 20 May '03

20 May '03

I've heard a rumor that there is some new legislation being proposed in California that would require consumer communication using SSL to go "directly to the server". A scan of the current in-process legislation doesn't turn up anything. Eric

1 0

idea for OTP system, comments desired
by John Bethencourt 20 May '03

20 May '03

I've come up with an idea for a one-time-password based authentication protocol, and I would like any comments on it. It doesn't use sequences of passwords that need to be periodically reinitialized, so it is more convenient than systems like S/Key. In the following explanation, `h' is a cryptographic hash function and `x.y' denotes the concatenation of strings x and y. The `server' is taken to be a system which users need to authenticate to, e.g., to use some service. The `client' is software run by the user to assist them in authentication. To begin, the administrator of the server adds a user to the system. The server stores the username and an initial password set by the administrator. A flag is set for that user to indicate that that user has never been authenticated. The administrator tells the initial password to the user. To authenticate for the first time, the client connects to the server and sends the username. The server requests the initial password. The client prompts the user for it, and sends it to the server. The server then generates a random string, r_0, and sends it to the client. The client now prompts the user for the password, s, which they would like to use from now on. The client computes h(h(s.r_0)) and sends it to the server. The server stores the username, r_0, and h(h(s.r_0)). To authenticate for the second time, the client connects to the server and sends the username. The server sends r_0 to the client. The client prompts the user for s, then computes h(s.r_0) and sends it to the server. The server computes h(h(s.r_0)) and checks that it matches what it has stored for that user. The server then makes a new random string r_1 and sends it to the client. The client computes h(h(s.r_1)) and sends it to the server. The server stores the username, r_1, and h(h(s.r_1)). All subsequent authentications proceed like the second. Here's the protocol in a more concise form: [first authentication] Client --> username --> Server Client <-- 'initial password?' <-- Server Client --> initialpass --> Server Client <-- r_0 <-- Server Client --> h(h(s.r_0)) --> Server [subsequent authentications] Client --> username --> Server Client <-- r_x <-- Server Client --> h(s.r_x) --> Server Client <-- r_y <-- Server Client --> h(h(s.r_y)) --> Server This protocol seems pretty simplistic. I wonder if people have considered it and found a flaw in it. If not, I would expect people to be using it in place of S/Key, since it has the advantage of not requiring the password sequences to be reinitialized. I searched around on the web and couldn't find anything that seemed relevant. The only possible flaw that I could think of was the following: The attacker will have a large number of pairs like h(s.r_0), r_0 h(s.r_1), r_1 h(s.r_2), r_2 h(s.r_3), r_3 . . . Is there some way to use this knowledge to make inverting h to find s easier? Of course, that would depend on the particular hash function, and I don't know enough of the math behind secure hash functions to answer the question. Also, the random string r_i will need to be long enough to make collisions sufficiently unlikely (or the server could keep a list of past random strings to ensure it does not reuse them). If anyone can think of any flaws in this system or knows of any relevant literature, I would very much like to hear about it. Thanks, John Bethencourt

1 0

Taking aim at denial-of-service attacks
by Steve Schear 20 May '03

20 May '03

May 13, 2003, 6:01 AM PT BERKELEY, Calif.--Graduate students from Carnegie Mellon University on Monday proposed two methods aimed at greatly reducing the effects of Internet attacks. In two papers presented at the IEEE Symposium on Security and Privacy here, the graduate students suggested simple modifications to network software that could defeat denial-of-service attacks and that could be implemented in the current protocol used by the Internet. The symposium, sponsored by the Institute of Electrical and Electronics Engineers, began Sunday and lasts through Wednesday. ...... The puzzle method The second presentation, also by a graduate student at Carnegie Mellon, proposes that servers use "puzzles"--problems that take a certain amount of processing time to solve--as a means of taxing any computer that tries to communicate with the server. Such a technique, which has also been suggested as a way to defeat spammers who send unsolicited mass e-mail, would help defend against denial-of-service attacks that attempt to tie up a victim server's memory with hundreds or thousands of connections. The plan from XiaoFeng Wang asserts that such small tasks would hardly be noticed by legitimate users, while attackers would have to expend far more effort to do any damage. While others have suggested similar methods, Wang added to his proposal an auction-like transaction to further allow legitimate traffic to win out over attacks. "Our mechanism enables each client to 'bid' for resources by tuning the difficulty of the puzzles it solves and to adapt its bidding strategy in response to apparent attacks," Wang stated in the paper that outlined his findings. Bellovin also liked this idea but again said that certain issues need to be resolved. "It will work up to a point," he said. "The problem is that spammers and denial-of-service attacks are not using their own machines. If they need 16 times as many computers, they can--most likely--easily get that many more." http://news.com.com/2100-1009_3-1001200.html --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

2 1