- cypherpunks-legacy - lists.cpunks.org

FBI is investigating an alleged "Black Bloc" threat sent to Politech
by Declan McCullagh 04 Jul '01

04 Jul '01

----- Forwarded message from Declan McCullagh <declan(a)well.com> -----

1 0

New Hushmail version
by davidthompson＠hushmail.com 04 Jul '01

04 Jul '01

Sounds like some neat stuff going on at Hushmail. OpenPGP keys? Will this mean I can sign my messages and have non-hush users verify them? That would be great. Plus the ability to store the Hush applet locally would answer one of the big objections people have had. I wonder, are the keys stored locally too? That seems important. But what's this about cutting back from 5MB to 2MB? Geez, a MB costs less than a penny these days. Can they really have so many users that saving 2 cents a user will matter? DT ---------- Forwarded message ---------- Date: Wed, 4 Jul 2001 03:50:55 -0700 Subject: Important V2 Notice From: support(a)hushmail.com To: Dear HushMail user, HushMail Version 2.0 will launch in early July! Please read the following instructions carefully to ensure a smooth transition to the enhanced service. * Logging on to Version 2.0 * 1. Enter your username as usual. 2. A pop-up box will advise you that a new Thawte certificate is validating the authenticity of the version 2.0 HushMail applet. - To proceed you must click Yes 3. Enter your passphrase as usual. Your next step is to upgrade your Hush key pairs. This involves generating new OpenPGP keys by moving your mouse randomly within a key-generation application. At no point in this process are your email, attachments, or private keys vulnerable. After you have upgraded to OpenPGP key pairs, you will be automatically transferred to the HushMail Version 2.0 login page. 4. You now have the option to install certain HushMail application files locally. In HushMail Version 2.0, users have the option to install the Hush applet Java class files on their hard drive. The Java applet that HushMail utilizes allows email messages to be encrypted before being sent to the Internet The implications of a local install are: *Faster access This will save time as it means users no longer have to wait for the download every time they log in. *Authentic code Hush delivers its Java classes in a signed archive. Until now the class files were delivered each time the user logged in. With Version 2 the class files may be installed locally, thus requiring the user to check the validity of the files only once. 5. Enter your passphrase as usual. Now check out the great new look and features of HushMail Version 2.0! * Important notice * - HushMail 2.0 allows you to manage your mail more efficiently, as the amount of disk space you have used is now displayed. In version 2.0 the disk storage space allotted to each free HushMail account is reduced from 5MB to 2MB. We have made this decision in order to continue to provide and to improve this free service. This reduction in storage space will take place on July 20. We advise you to delete mail in excess of the new 2MB limit to ensure a smooth migration to the upgraded service. Alternatively, you may take this opportunity to obtain a HushMail Premium account at a celebratory launch price from only US$2.49 per month. Go to http://www.hushmail.com/upgrade/ for more details. - In preparation for the launch, HushMail users must ensure that the mail in their HushMail folders is within their allotted disk storage space. If they are over the 2MB (HushMail free accounts) or 32MB (HushMail Premium accounts) limit during the migration period, archived mail in excess of the storage limit may be lost permanently. - Throughout the migration period, which will last about three weeks from launch, we will be transferring your email to a new, faster, even more robust storage system. During this time, your old email messages may not be available. Dont worry. They are safe and will be transferred back into your email account. Premium account users and extremely frequent users will be given preference during this process. At no point in this process is encrypted email ever unencrypted. - Users may occasionally encounter some downtime over this migration period. The disruption to service will be minimal and we apologize in advance. * Troubleshooting * There will be a help link and a number of FAQs posted to assist you in resolving any issues you should encounter during migration to Version 2.0. * New Product Announcement * HushIdentity secure Web-based email system for your business - Encrypted email @ your domain Experience the security of HushMail with your own business or personal domain email address. - Cost-effective managed PKI solution for your small business Register 10 email accounts from only US$19.99 per month Find out more at, http://www.hushidentity.com/ Thank you for using HushMail as your secure mailing solution. We appreciate your continued support and hope you will be pleased with this enhanced service. Sincerely, Susanne Reiche Director of Customer Support Team Hush Free, encrypted, secure Web-based email at www.hushmail.com

1 0

The Register - Canadian Tire loses fight to call itself 'crap'
by Jim Choate 04 Jul '01

04 Jul '01

http://www.theregister.co.uk/content/6/20197.html -- -- ____________________________________________________________________ Whereof one cannot speak, thereof one must be silent. Ludwig Wittgenstein The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

3Com Volume Discount
by Alex Wong 04 Jul '01

04 Jul '01

Dear Valued Customer, Re: Volume Discount 3C900-Combo refurbished / 1000pcs / usd8.5- 3C16704 4-ports refurbished / 1000pcs / usd25- 3C16592A 12-ports 10/100 brand new / 500pcs / usd150- 3C3594 PCI 56K V.90 Voice brand new / 10000pcs / pls check Best Regards Alex Wong Cleverway

1 0

pgp crack
by ashley.david 04 Jul '01

04 Jul '01

i have lost my private key can you help open my file

1 0

The Register - Money tracking by micro chip
by Jim Choate 04 Jul '01

04 Jul '01

http://www.theregister.co.uk/content/3/20198.html -- -- ____________________________________________________________________ Whereof one cannot speak, thereof one must be silent. Ludwig Wittgenstein The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Thought-A-Day
by Fountain Of Joy 04 Jul '01

04 Jul '01

Never give in,never,never,never,never. --Winston Churchill ********************************************************************************** Your name has been recommended to receive thoughts of wisdom from Fountain of Joy. These thoughts will be delivered, free of cost, to your desktop,everyday, for an initial evaluation period. We believe that the meaningful insights of these carefully selected thoughts will make your life peaceful,successful & happy in a way you had never imagined before. However, if you desire to unsubscribe, reply to this email with 'remove' in the subject line. Director, Fountain of Joy (Non-religious Organisation)

1 0

Legal Journals on the Web
by Jim Choate 04 Jul '01

04 Jul '01

http://www.usc.edu/dept/law-lib/legal/journals.html -- -- ____________________________________________________________________ Whereof one cannot speak, thereof one must be silent. Ludwig Wittgenstein The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Cloning, miscarriange, and the 1st
by Steve Schear 04 Jul '01

04 Jul '01

At 08:22 AM 7/3/2001 -0500, Jim Choate wrote: >The fact is that if clonning research is stopped then the low success rate >will continue. A self-fulfilling prophecy. If it is allowed to go forward >in a very short time (a year perhaps) the problems will be ironed out and >the success rate will exceed 'natural' (Grrrr Judeo-Christian ethics) >rates of success. > >Eugenics - the management of reproductive choice by the state. > >What we need to do is outlaw the imposition of religious and political >viewpoints from the discussion....wait.... > > Amendment I > >Congress shall make no law respecting an establishment of religion, or >prohibiting the free exercise thereof; or abridging the freedom of speech, >or of the press; or the right of the people peaceably to assemble, and to >petition the Government for a redress of grievances. The problem with this argument is that despite the apparent religious agnosticism of the 1st, the moral basis upon which the SC has interpreted our laws is Judeo-Christian. Historically you've been protected from government intrusion unless your religion offends too many powerful people or presents political challenges. Consider the Mormons and shamanic drug rituals of the native Americans. Didn't Mao say something about all politics being, eventually, dispensed from the end of gun? steve

3 4

Re: [OT,long] "Zeroing" a machine / flashing from OS (fwd)
by Eugene Leitl 04 Jul '01

04 Jul '01

-- Eugen* Leitl <a href="http://www.lrz.de/~ui22204/">leitl</a> ______________________________________________________________ ICBMTO : N48 10'07'' E011 33'53'' http://www.lrz.de/~ui22204 57F9CFD3: ED90 0433 EB74 E4A9 537F CFF5 86E7 629B 57F9 CFD3 ---------- Forwarded message ---------- Date: Sat, 30 Jun 2001 11:13:15 -0400 (EDT) From: Bill Arbaugh <waa(a)cs.umd.edu> To: Peter Lister <P.Lister(a)sychron.com> Cc: linuxbios(a)lanl.gov Subject: Re: [OT,long] "Zeroing" a machine / flashing from OS I essentially solved this problem with a prototype built using the 430HX chipset a few years ago. The project, AEGIS, used the boot block portion of the flash to hold intitialization and recovery code. Everything else had a digital signature paired with it. Prior to passing exec control to the next step- the signature is checked. If it's valid, then we pass control. If it's not, then we try to recover a valid version. Essentially, I built a prototype of the TCPA spec (www.trustedpc.org) before the TCPA was even a thought. That's history. Today, we've been funded by DARPA to add this same functionality to LinuxBIOS (or at least use the init routines from LinuxBIOS). We also will add crypto hardware support. We're just getting started, but we hope to have some results late summer early fall. We're also hoping to team up with a major manufacturer so that we can have the capability on their servers and laptops. Our biggest problem is that we don't want users to have to change their flash chip. That means that we can't use Linux as the loader. Instead, we need to use something along the lines of GRUB. We're looking at a number of alternatives now, and we'll let everyone know what we find. Bill ------------------------------------------------------------------- Bill Arbaugh www.cs.umd.edu/~waa University of Maryland waa(a)cs.umd.edu College Park 301.405.2774 ------------------------------------------------------------------- On Sat, 30 Jun 2001, Peter Lister wrote: > James Finnie said... > > > Many boards do infact have a jumper on the board, which removes the > > ability to flash the BIOS without having physical access to reset > > the jumper - these mechanisms are completely secure, as they disable > > one of the flash chip write pins. And lets face it, if people have > > physical access to the machine, and want to do you some damage, > > there is little you can do about it. > > I'm thinking of cases where a hostile party can run any *software*, > including an arbitrary bootloader or OS, but can't get access to the > hardware to set a jumper or hit a switch (unless it's a software > controlled switch, of course - which includes the ATX "power switch"; > more of a polite hint to shut down). You tell me that the jumpers *do* > provide physical security. Fine - though it occurs to me that the > manufacturer's "secret" flash code might just look at the state > indicated by said jumper and refuse to flash, with no physical control. > Few people would know the difference. > > Yes, if someone has physical access, all bets are off - the question is > "How close can I get to physical access just via software?" and the > answer would appear to be "If I can flash system rom with an evil BIOS, > pretty close". > > > If a hacker has gained sufficient access to your mission critical > > datacenter systems through a trojan, in order to be able to run some > > arbitrary flashing code, I would say that was the least of your > > worries.... they already have access to whatever they could want, > > why would they bother implanting a trojan BIOS? > > Because it survives the scrubbing of magnetic media - even the complete > disassembly of the machine. Done well, it would be undetectable by any > current virus checker. You have to assume, for instance, that it could > pervert the disk controllers. I'm probably not interested in user A, > whose lax security gave me a root exploit (as you say, he's screwed > anyway) - I'll bide my time and wait until A has gone bankrupt and all > the computer systems are auctioned off to user B - whose system is > otherwise impregnable. > > I appreciate that commodity hardware is not designed for this sort of > security, since it is considered desirable to update in the field with > just a floppy. Most people consider a system board with BIOS as just a > component. Machines are being treated more as anonymous cluster members > than standalone systems with specific identities, so that it seems > likely that they will be moved between jobs quite dynamically. > > Given the stories of trivial "write protection", manufacturers > assurances of security seem generally worthless. :) Probably the best > defense would be a hardware "factory settings" switch which zaps all > nonvolatile storage back to a burned-in state, rather than relying on > "write protection". The machine could press its own button, since that > would be a guaranteed safe option, as even hostile software could do no > more than reinstate the trusted code. > > Don't be surprised when the first LinuxBIOS derived rom virus toolkit > gets into the hands of the script kiddies and the FBI arrests Ron. Of > course, this may be the best way to get the manufacturers to solve the > problem (a virus, not arresting Ron). > > -- > Peter Lister, Sychron Inc. - 1-866-SYCHRON > Intelligent Infrastructure - www.sychron.com

1 0