- cypherpunks-legacy - lists.cpunks.org

RE: Bomb Law Reporter - special edition
by Sandy Sandfort 22 Aug '01

22 Aug '01

Faustine wrote: > Have you happened to have seen any good > papers on constructing do-it-yourself cheap, > effective, portable shielding? Here's a company that sells tempest shielded "tents": http://www.bemashield.com/seseries.html This a site that has all sorts of tempest links: http://www.eskimo.com/~joelm/tempestsource.html With a bit more searching, you can find a company that manufactures the material used in the tents (I'd try 3M). Then, if you're handy with a sewing machine and can find the appropriate Simplicity pattern, you're in business. S a n d y

1 0

Need Contact? 230 Mio Prospects just $90 !!!
by contact＠gogoo.com 22 Aug '01

22 Aug '01

230 MILLION EMAIL ADDRESSES FOR ONLY $ 90 You want to make some money? I can put you in touch with over 230 million people at virtually no cost. That's right, I have over 200 Million Fresh email addresses that I will sell for only $ 90. These are all fresh addresses that include almost every person on the Internet today, with no duplications. They are all sorted and ready to be mailed. That is the best deal anywhere today! Imagine selling a product for only $5 and getting only a 1% response. That's OVER $10,000,000 IN YOUR POCKET !!! These 230 Million email addresses are yours to keep, so you can use them over and over. They come on a collection of several CDs. This offer is not for everyone. If you can not see the just how excellent the risk / reward ratio in this offer is then there is nothing I can do for you. To make money you must stop dreaming and TAKE ACTION. TWO PACKAGES: Simple: (addresses and Reports ONLY) Extended: (mailing software included) PACKAGE DESCRIPTIONS BELOW; **************************************** THE SIMPLE MARKETING SETUP (addresses and ReportsONLY) 230,000,000 email addresses on CD Reports, Helpfiles etc. These name are all in text files ready to mail!!! CHF 150.00, (~$90.00) ORDER METHOD - SEE BELOW **************************************** THE EXTENDED MARKETING SETUP 230,000,000 email addresses on CD Reports, Help-Files etc. These name are all in text files ready to mail!!! AND Several different email programs and tools to help with your mailings and list management. CHF 200.00 (~$ 120.00) ORDER METHOD - SEE BELOW IF YOU ORDER BY MAIL OR FAX WE WILL SHIP YOUR CD CONTAINING THE 230 MILLION NAMES WITHIN 24 HOURS OF YOUR ORDER!!! WE ACCEPT: AMERCAN-EXPRESS, VISA & MASTERCARD TYPE OF CARD AE/VISA / MC??_______________ EXPIRATION DATE ___________________________ NAME ON CREDIT CARD________________________ CREDIT CARD #_______________________________ BILLING ADDRESS ____________________________ CITY_________________________________________ STATE___________________ZIP__________________ COUNTRY____________________________________ PHONE INCLUDE AREA CODE___________________ EMAIL ADDRESS______________________________ WE WILL BILL selected amount to your account (shipping costs included!!!) FAX your order and the above requested credit card information to: FAX # ++41 61 923 94 41 ---> AUTOMATED ORDER FAX ONLY!!!! ALL INFORMATION NECESSARY FOR YOU TO SUCCESSFULLY MAIL QUICKLY, PROPERLY, & LEGALLY IS PROVIDED WITH YOUR ORDER. Please NOTE: This advertisement is NOT sponsored by ANY Internet Service Provider!!!

1 0

Re: BESS's Secret LOOPHOLE (censorware vs. privacy & anonymity)
by Duncan Frissell 22 Aug '01

22 Aug '01

At 10:24 PM 8/15/01 -0500, Jim Choate wrote: >Liar, check the archives. I never said anybody was dangerous. What I did >say was that I felt the C-A-C-L philosophy was dangerous. I stand by that. >I believe that were the C-A-C-L philosophy to take hold the results would >make the death counts from Nazism and Communism in this century pail in >comparison. You have to be wired a little funny to think that a free society would suffer the murder rate of those slave societies with their organized mechanisms of extinction. Killing the 170 Megs of people that socialists of all stripes murdered in the 20th century is hard work. Takes a big killing organization. For fun I tried to guestimate the number of murders private individuals committed in the 20th century and even making assumptions that inflated the final figure, I was only able to come up with a max of 30 megs of people. (Derived by applying the peak US murder rate of 10 per 100,000 to a somewhat arbitrary average world population of 3 billion during this century) DCF ---- In normal operation, a 1000 MGW coal-fired power plant releases more radioactivity than a 1000 MGW nuclear power plant.

2 1

Timing Analysis of Keystrokes and Timing Attacks on SSH (fwd)
by Jim Choate 22 Aug '01

22 Aug '01

---------- Forwarded message ---------- Date: 22 Aug 2001 11:37:39 -0400 From: "Perry E. Metzger" <perry(a)piermont.com> To: cryptography(a)wasabisystems.com Subject: Timing Analysis of Keystrokes and Timing Attacks on SSH What I find really neat here is that up until now, serious traffic analysis has been fairly neglected in the open crypto community. Is this the start of things to come? ------- Start of forwarded message ------- Date: Wed, 22 Aug 2001 08:53:30 -0600 From: aleph1(a)securityfocus.com To: secpapers(a)securityfocus.com Cc: secureshell(a)securityfocus.com Subject: Timing Analysis of Keystrokes and Timing Attacks on SSH Message-ID: <20010822085330.J3366(a)securityfocus.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Timing Analysis of Keystrokes and Timing Attacks on SSH Dawn Xiaodong Song, David Wagner, Xuqing Tian University of California, Berkeley SSH is designed to provide a security channel between two hosts. Despite the encryption and authentication mechanisms it uses, SSH has two weakness: First, the transmitted packets are padded only to an eight-byte boundary (if a block cipher is in use), which reveals the approximate size of the original data. Second, in interactive mode, every individual keystroke that a user types is sent to the remote machine in a separate IP packet immediately after the key is pressed, which leaks the interkeystroke timing information of users' typing. In this paper, we show how these seemingly minor weaknesses result in serious security risks. First we show that even very simply statistical techniques suffice to reveal sensitive information such as the length of users' passwords or even root passwords. More importantly, we further show that using more advanced statistical techniques on timing information collected from the network, the eavesdropped can learn significant information about what users type in SSH sessions. In particular, we perform a statistical study of users' typing patterns and show that these patterns reveal information about the keys typed. By developing a Hidden Markov Model and our key sequence prediction algorithm, we can predict key sequences from the interkeystroke timings. We further develop and attacker system, Herbivore, which tried to learn users' passwords by monitoring SSH sessions. By collecting timing information on the network, Herbivore can speed up exhaustive search for passwords by a factor of 50. We also propose some countermeasures. In general our results apply not only to SSH, but also to general class of protocols for encrypting interactive traffic. We show that timing leaks open a new set of security risks, and hence caution must be taken when designing this type of protocol. http://paris.cs.berkeley.edu/~dawnsong/papers/ssh-timing.pdf - Elias Levy SecurityFocus http://www.securityfocus.com/ Si vis pacem, para bellum --------------------------------------------------------------------- To unsubscribe, e-mail: secureshell-unsubscribe(a)securityfocus.com For additional commands, e-mail: secureshell-help(a)securityfocus.com ------- End of forwarded message ------- --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Para t� siempre lo mejor ...
by MisProductos.com 22 Aug '01

22 Aug '01

1 0

Re: Lawyers, Guns, and Money
by Faustine 22 Aug '01

22 Aug '01

dmolnar wrote: >Perhaps in evaluating potential programs, it would be helpful to list >people in the policy + technology area who are worth looking into. Along >perhaps with which institutions they studied at? I'll start. I regret that >I'm not familiar with this area, and so I'm sure I'll overlook many >interesting people. Great start! If anyone is interested, maybe this weekend I could put together a list of the top policy analysis schools with their technology & policy faculty and backgrounds: I'm sure there are plenty of researchers with a lower profile than those on your list who might be a great match for potential students out there. All you really need is to find a few key people to mentor you whom you can really learn from and relate to, to make it worthwhile. >I'm also not sure what to do about people with some >policy interests who are primarily cryptographers -- do we include Ron >Rivest because of his work on electronic voting? Sure, anyone you think might be interesting to work with and learn from. >By the way, what exactly do you *do* after you graduate from a technology >and policy program? You can find all sorts of thing to do at universities, think tanks, NGOs, lobbying groups, etc. doing applied work, abstract work, or a combination of both. I'm sure where you end up depends a lot on your focus area and skill set. >Every now and then I wonder if I will eventually end up in law school or a >policy + technology program. The thought is alternately exciting and >saddening. Then again, so is the prospect of being a "pure" researcher. Since it's multidisciplinary from the start, if you take the analysis road, you have a much better chance of "building in" some flexibility and doing as much "pure research" as you want to in the long run. Take law, you're just stuck with doing law. But of course I'm 100% biased, so any any encouragement in this direction should be judged accordingly! :) Good luck... ~Faustine.

1 0

Information You Requested from Microsoft.com
by 1support＠microsoft.com 22 Aug '01

22 Aug '01

NOTE: PLEASE DO NOT RESPOND DIRECTLY TO THIS E-MAIL. THIS E-MAIL IS NOT MONITORED. Welcome to Microsoft Online ID secure Internet environment! Below is your membership information. Please keep this confirmation mail as a record of your password. Consider this information confidential and treat accordingly. Your Microsoft Online ID Password is: cypherpunks A Microsoft Online ID provides access to various Microsoft secured programs. Please check the Frequently Asked Questions and/or Help page of the program you are accessing for questions. Sincerely, Microsoft Online ID Administrator

1 0

Information You Requested from Microsoft.com
by 1support＠microsoft.com 22 Aug '01

22 Aug '01

NOTE: PLEASE DO NOT RESPOND DIRECTLY TO THIS E-MAIL. THIS E-MAIL IS NOT MONITORED. Welcome to Microsoft Online ID secure Internet environment! Below is your membership information. Please keep this confirmation mail as a record of your password. Consider this information confidential and treat accordingly. Your Microsoft Online ID Password is: cypherpunks A Microsoft Online ID provides access to various Microsoft secured programs. Please check the Frequently Asked Questions and/or Help page of the program you are accessing for questions. Sincerely, Microsoft Online ID Administrator

1 0

Re: Anonymous Posting
by Faustine 22 Aug '01

22 Aug '01

anonymous wrote: Faustine wrote: > So why is it that the vast majority of the technical and insightful > contributions here seem to come from people who aren't averse to > using a reasonable simulacrum of a real name and address? >I find the content from remailers is far higher than average for the >list. Fine, but "average" in this context isn't as useful as measuring the top n percent in terms of total value of information to any given participant. > I made the deliberate choice not to use a remailer because I think > it's more interesting to contribute while having a prior body of > posts "attached" to me. People come to know more what to expect--and > if I irritate/bore/piss them off too much, they stop reading > me. Which is exactly as it should be. >>So sign your messages. With your true name, if that's important. I wonder why you seem to have missed my point about services like Hushmail and Cotse. > Though if you're after complete privacy re: your opinions and the > details of your life, you're better off not writing them down in the > first place, here or anywhere else. >>The technology isn't there yet, true, but it won't get there without >>deploying it and using it. Why isn't this obvious? Even if the technology were 100% reliable, it's a matter of common sense. No amount of technology will ever keep you from trusting the wrong person, writing down something you should have kept in your head, or blabbing when you should have kept your mouth shut. In an absolute sense, "complete privacy" is only possible with an absence of communication signifiers. Developing privacy-enhancing technology, on the other hand, is absolutely crucial. But as I agree with what Bruce Schneier said about there being no such thing as "absolute security", I think it's always going to be a matter of what's "private enough" for any given situation. How "high stakes" you find posting to a mailing list depends on your particulars. And for me, Hushmail and Cotse are fine. If somebody is hell bent on fucking me over--here or elsewhere--the best remailer in the world won't help if they have the requisite knowledge, time, and resources. And I never said there was anything wrong with using a remailer. It's just that in the context of participating in a list, I think people tend to act worse since they have no real (or even symbolic) attachment to anything they say. I used to use a remailer to post to another list every single day for months. But I enjoy it more being a little more connected to it the way I participate here, that's all. > I assume everyone here weighed those considerations for themselves > before they got here: as far as I'm concerned, nobody has the > slightest business deciding it for anyone else. >Don't worry, the cypherpunks list isn't going anywhere. It's just not >realistic to put that genie back in the bottle. It would have to be a >separate list entirely or one which rode on the current cypherpunks >list. If your goal is to get rid of the technically incompetent and improve the quality of the list's content, you have to weigh the possibility of the bullshitting troll quotient going way, way up as well. And anyway, I think you're overestimating the skill level needed to use one: sure, the absolute cretins will have to go, but it remains to be seen how much moronic juvenalia will still be left over. Unfortunately, being intelligent and being immature are not mutually exclusive. >We may not be able to decide for others, but we can certainly look >down on so-called cypherpunks who, in many cases, cannot even encrypt >a message, never mind "writing code". So are you basing your assessment of who to look down on solely on whether or not they use PGP and remailers here, or are you going by the total informative content(or lack thereof)in their posts? Personally, I wouldn't be too quick to assume I know what anyone around here can or can't do. > Many, in fact, exhibit >hostility towards remailers and anonymity, as you do. That is a gross misreading of what I said. In the context of addressing "what makes participating in a list worthwhile", I just don't believe dictating from on high "everyone must use a remailer" is going to fix all the problems you think it will. And it'll probably create a lot more new ones. But I could be wrong, it'll be interesting to see how it turns out if you actually get one going. >What I fail to understand is why such people are on this list in the >first place, but, as you say, people make their own decisions. >(None of these comments apply to Tim May, of course.) Interesting how you know full well when you really need to make an exception to your too-broad generalization about people who use their real names on the list. ~Faustine.

1 0

Product Give Away - Take 5 !
by Stephanie Key 22 Aug '01

22 Aug '01

If you cannot view this message, please visit http://www.globalzon2k.com/news_vercheck1.htm G7 Productivity Systems, Inc. is sending this email to its subscribed users. You are subscribed as: cypherpunks(a)algebra.com FREE Products shipped in Full Retail Packaging Pick up to 5 of each! <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=314&size=1> <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=315&size=1> <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=313&size=1> <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=317&size=1> <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=316&size=1> Fortune. (149.99 value) DataScan (149.99 value) eXpressForms 2000 (129.99 value) TransForm Personal (59.99 value) VersaClips (19.99 value) ? Fortune: Relationship manager and addressbook ? DataScan: Business card and telephone directory scanning software ? ExpressForms 2000: Forms, Invitation and Greeting Card generator to publish on the Internet ? TransForm Personal: Scan and convert your paper forms into editable electronic forms in seconds. ? VersaClips: Accentuate your checks, website and documents with handcrafted background images. Click on any of the graphics above to add your FREE products! About VersaCheck 2001 VersaCheck enables businesses and individuals to create their own custom checks. All it takes is a desktop printer, blank paper and VersaCheck software! The checks look professional and are fully bankable. VersaCheck is available at most computer retail stores and online. It works with most accounting and personal finance software such as Quicken, Money, QuickBooks, Peachtree and many more. Four popular versions to choose from: VersaCheck 2001 Personal Home & Business Professional Premium <http://www.g7ps.com> VersaCheck Comes with High Quality Blank Security Check Stock Available Colors: Tan, Burgundy, Green and Blue Sample Check Please call 800-303-2620 for questions or assistance regarding this offer. Thank you very much. Best regards, Stephanie Key Customer Relationship Executive 800-303-2620 To change your communication preferences Click Here <http://www.globalzon2k.com/scripts/de.asp?e=cypherpunks%40algebra%2Ecom > or simply reply to this Email with UNSUBSCRIBE in the subject line. Copyright © Globalzon, Inc. All rights reserved. Designated trademarks and brands are the property of their respective owners.

1 0