- cypherpunks-legacy - lists.cpunks.org

Re: Public Key Infrastructure: An Artifact...
by Lynn.Wheeler＠firstdata.com 20 Nov '00

20 Nov '00

as pure asside ... any SSL server certificate signed by any CA in my browswer's CA list is acceptable. for list of current valid signing CA's in a typical browswer see: http://www.garlic.com/~lynn/aepay4.htm#comcert14 http://www.garlic.com/~lynn/aepay4.htm#comcert16 my broswer makes no distinction on which CA signed what ... and/or even what they signed. If I get a certificate signed by any CA in my browswers list that says foo.bar ... and I think i'm connecting to foo.bar ... then the SSL connection will go thru. given that the supposed justification for SSL certificates is weaknesses in the domain name infrastructure integrity ... and they beef up the domain name infrastructure integrity (in part so that SSL certificate issuing operations ... like any from the above list ... can rely on domain names not having been hijacked) ... then it eliminates that as a business case & justification for SSL certificates. There are a lot of short-comings of the existing SSL certificate infrastructure. To a large extent, most PKI definitions are purely hypothetical (there is the line someplace, in theory there is no difference between theory and practice, but in practice there is) ... trivial example is that most PKI definitions include things like CRLs for dealing with revoked or compromised certificates/private keys ... and yet the SSL infrastructure doesn't have any of that in it (even tho client checking of server SSL domain certificates accounts for 99.999999% of all such PKI operations that occur in the world today). Ben Laurie <ben(a)algroup.co.uk> on 11/19/2000 05:03:20 AM This is not a comment on the crapness of PKI, it is a comment on the crapness of Verisign. The two are far from synonymous. Don't get me wrong - I don't think PKI is a perfect solution by any means - however, it gets us nowhere to attribute the faults of others to PKI. Cheers, Ben. -- http://www.apache-ssl.org/ben.html "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff

5 5

Re: Public Key Infrastructure: An Artifact...
by obfuscation＠beta.freedom.net 20 Nov '00

20 Nov '00

> On Sat, 18 Nov 2000 obfuscation(a)beta.freedom.net wrote: > > > Bram Cohen <bram(a)gawth.com> writes: > > > Unless that problem is fixed, man in the middle is hardly made more > > > difficult - for example, Mallory could break into some random machine on > > > the net and steal it's public key, then hijack local DNS and when someone > > > goes to amazon.com redirect them to amazon.hackeddomain.com, and then > > > proxy to amazon.com - now even SSL says the connection is safe. > > > > Are you sure that works? I would think the SSL client would do a > > connection to the URL the user typed, www.amazon.com, and check the > > name in the cert to see if it (approximately) matches. > > When the user goes to www.amazon.com, they get a plaintext http redirect > to amazon.hackeddomain.com, which does check. Still confused... The original connection to www.amazon.com is an SSL connection, right? We are following an https: URL? (Otherwise, SSL would not even come into the picture.) If you do a DNS hack to redirect www.amazon.com to amazon.hackeddomain.com, the latter site will not be able to complete SSL handshaking without triggering a browser warning, will it? Are you suggesting that the server would reply to the SSL handshake with a NULL transform? I just checked my browser (Netscape) and it did not offer NULL as an option. The only ciphersuites offered in the client_hello message were: V2CipherSpec SSL_RC4_128_WITH_MD5 = { 0x01,0x00,0x80 }; V2CipherSpec SSL_RC4_128_EXPORT40_WITH_MD5 = { 0x02,0x00,0x80 }; V2CipherSpec SSL_RC2_CBC_128_CBC_WITH_MD5 = { 0x03,0x00,0x80 }; V2CipherSpec SSL_RC2_CBC_128_CBC_EXPORT40_WITH_MD5 = { 0x04,0x00,0x80 }; V2CipherSpec SSL_IDEA_128_CBC_WITH_MD5 = { 0x05,0x00,0x80 }; V2CipherSpec SSL_DES_192_EDE3_CBC_WITH_MD5 = { 0x07,0x00,0xC0 }; The server must choose from this list, and all of these require the server to respond with an RSA certificate. So it looks to me like the SSL protocol will not allow the redirection attack to work without triggering a user alert, unless there is some subtlety here... Ob

3 2

CDR: test
by TAKA 20 Nov '00

20 Nov '00

:: Request-Remailing-To: 09071330009(a)docomo.ne.jp 成功？

1 0

CDR: Vá ao Cinema...Em Casa
by apoio＠giganetstore.com 20 Nov '00

20 Nov '00

<http://www.giganetstore.com> <http://www.giganetstore.com/index_promocao.asp> Para retirar o seu email desta mailing list deverá entrar no nosso site http://www.giganetstore.com , ir à edição do seu registo e retirar a opção de receber informação acerca das nossas promoções e novos serviços.

1 0

CDR: The Signature Issue
by Jim Choate 20 Nov '00

20 Nov '00

Here's a 'Texas' state view... http://faxxon.cifnet.com/taskforce/sigdisc.htm Think of a signature as proof of action/intent. It's a 'verb verification mechanism'. -- ____________________________________________________________________ He is able who thinks he is able. Buddha The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

CDR: NNA Online: Notary Certificates - All States
by Jim Choate 20 Nov '00

20 Nov '00

To at least the answer of requiring witnesses to 'signature by mark', appears to require two actually. http://www.nationalnotary.org/1-800-USNOTARY/certif_ALL.html The specific law is dependent upon your state. At least in Texas for things like voting, buying cars or houses, legal documents such as adoption papers, etc. this is pretty standard stuff. This has something to do with 'The Hague Convention' and is apparently international in scope. Remember, IANAL. -- ____________________________________________________________________ He is able who thinks he is able. Buddha The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

CDR: your request to download the ifilter client software
by support＠iseek.com.au 20 Nov '00

20 Nov '00

Dear cypherpunks, Thank you for your request for the ifilter product. You can download the release version of our software by clicking on the link below. http://download.ifilter.com.au/dl/974707405-hxVRX7sH/ifilter_installer.exe To assist you with the ifilter software a you can find the manual at http://download.ifilter.com.au/manual/manual.pdf You will require Adobe Acrobat to read this manual. You can pick up a free copy of the Acrobat reader from Adobe's web site which is at http://www.adobe.com This software is currently released for Windows95, Windows98. and Windows NT workstation. It requires direct internet access. Please note. This link will only be active for 72 hrs. Regards, The staff at ifilter

1 0

CDR: Re: what is The OpenNIC project (fwd)
by Jim Choate 20 Nov '00

20 Nov '00

____________________________________________________________________ He is able who thinks he is able. Buddha The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- -------------------------------------------------------------------- ---------- Forwarded message ---------- Date: Mon, 20 Nov 2000 12:31:17 -0800 From: Simon Higgs <simon(a)higgs.com> Reply-To: orange(a)dns.list To: orange(a)dns.list Subject: Re: what is The OpenNIC project At 02:56 PM 11/20/00 -0500, Richard J. Sexton wrote: I just told Declan McCullagh said we'd love to play with OpenNIC. I told him there was a problem with conflicting TLDs. >It's thaty Robin thing that wanted to cooperate but nly if we'd get along >with >kashpureff and boling. We declined and they said sayonara. > >At 01:50 PM 11/20/00 -0500, you wrote: > > > >The OpenNIC project is mentioned in the article - what is it? Anyone > >know? > > > >Joe > > > >---------- Forwarded message ---------- > >Date: Mon, 20 Nov 2000 12:24:04 -0500 (EST) > >From: Joe Baptista <baptista(a)pccf.net> > >Reply-To: list(a)ifwp.org > >To: DOMAIN-POLICY(a)LISTS.NETSOL.COM > >Cc: list(a)ifwp.org, NCDNHC <NCDNHC-Discuss(a)lyris.isoc.org>, ga(a)dnso.org > >Subject: [IFWP] Re: CDR: RE: What got censored today... (fwd) > > > > > >---------- Forwarded message ---------- > >Date: Mon, 20 Nov 2000 13:43:14 -0500 > >From: Declan McCullagh <declan(a)well.com> > >To: Joe Baptista <baptista(a)pccf.net> > >Cc: "Carskadden, Rush" <carskar(a)netsolve.net>, > > "'cypherpunks(a)einstein.ssz.com'" <cypherpunks(a)einstein.ssz.com> > >Subject: Re: CDR: RE: What got censored today... (fwd) > > > >I have an op-ed in today's Wall Street Journal that mentions alternative > >DNS schemes: > > > >http://www.cluebot.com/article.pl?sid=00/11/20/1714249 (html) > >http://www.politechbot.com/p-01507.html (text) > > > >No response yet from ICANN, Esther Dyson, Vint Cerf, etc. > > > >-Declan > > > > > >On Fri, Nov 17, 2000 at 12:30:50PM -0500, Joe Baptista wrote: > >> On Fri, 17 Nov 2000, Carskadden, Rush wrote: > >> > >> > I can't read it very well. What does it say? > >> > >> It's a little sign that says "USE ORSC DNS" or something like that - see > >> www.yourcann.org for more data. > >> > >> Joe > >> > >> > > >> > ok, > >> > Rush > >> > > >> > > >> > -----Original Message----- > >> > From: Jim Choate [mailto:ravage@einstein.ssz.com] > >> > Sent: Thursday, November 16, 2000 9:43 PM > >> > To: cypherpunks(a)einstein.ssz.com > >> > Cc: sci-tech(a)einstein.ssz.com > >> > Subject: What got censored today... (fwd) > >> > > >> > > >> > > >> > > >> > > >> > ____________________________________________________________________ > >> > > >> > He is able who thinks he is able. > >> > > >> > Buddha > >> > > >> > The Armadillo Group ,::////;::-. James Choate > >> > Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com > >> > www.ssz.com .', |||| `/( e\ 512-451-7087 > >> > -====~~mm-'`-```-mm --'- > >> > -------------------------------------------------------------------- > >> > > >> > ---------- Forwarded message ---------- > >> > Date: Thu, 16 Nov 2000 19:27:13 -0800 > >> > From: Simon Higgs <simon(a)higgs.com> > >> > Reply-To: orange(a)dns.list > >> > To: orange(a)dns.list > >> > Subject: What got censored today... > >> > > >> > > >> > > >> > >http://cyber.law.harvard.edu/scripts/rammaker.asp?s=cyber&dir=icann&file=ica > >> > nn-111600&start=0-09-04 > >> > > >> > Starts at 2:18:20 > >> > > >> > Lasts about five seconds before Mr Anal-Retentive-Bald-Video-Guy >censors it. > >> > > >> > > >> > >> -- > >> Joe Baptista > >> > >> http://www.dot.god/ > >> dot.GOD Hostmaster > >> +1 (805) 753-8697 > >> > > > > > > > > > > > >-- >Richard J. Sexton richard(a)vrx.web +1 (613) 473-1719 >http://dns.vrx.list/tech/rootzone richard%vrx.web(a)vrx.net Best Regards, Simon Higgs -- It's a feature not a bug...

1 0

CDR: Important Membership Information
by announce＠inbox.nytimes.com 20 Nov '00

20 Nov '00

Dear cypherpunks567, Welcome to NYTimes.com! We are delighted that you have decided to become a member of our community. As a member you now have complete access to the Web's premier source for news and information -- free of charge. NYTimes.com not only provides you with in-depth coverage of events happening around the world but also with a wealth of additional features and services. The site is updated regularly throughout the day by New York Times reporters and editors to give you greater insight into events unfolding throughout the day. No matter what the hour, you can look to NYTimes.com for the most trustworthy coverage available and unique perspective you won't find anywhere else. Please feel free to explore the other areas of NYTimes.com. Here are some starting points you may find useful: ** Get NYTimes.com headlines e-mailed directly to you. Choose from the day's top stories, breaking news alerts and your favorite sections: http://email.nytimes.com/email/email.jsp?welcome ** Search and retrieve articles from The New York Times Archives back to 1996. Searches and summaries of articles are free, but there is a small fee for full text. http://archives.nytimes.com/archives?welcome ** Explore the Help Wanted and other classified listings on the Web: http://classifieds.nytimes.com/hw?welcome ** Get a free photo screensaver from The New York Times Photo Archives Choose from Vintage New York, Americana, Coney Island and more: http://www.nytimes.com/partners/screensaver/index.html?welcome ** Search our archive of 50,000 book reviews, listen to author interviews or sign-up for an exclusive weekly newsletter from our Books Editor: http://www.nytimes.com/books/home?welcome Thank you again for becoming a member. We hope that you will make a point of visiting the site often. Sincerely, Rich Meislin, Editor in Chief New York Times Digital P.S. Your opinions are important to us. Share your thoughts about the site with us by sending an e-mail to feedback(a)nytimes.com ************************************************************* Your account information is listed below for future reference: Your Member ID is cypherpunks567 You selected your password at registration. Your e-mail address is cypherpunks(a)toad.com If you did not authorize this registration, someone has mistakenly registered using your e-mail address. We regret the inconvenience; please see http://www.nytimes.com/subscribe/help/cancel.html for instructions.

1 0

CDR: ziplip address
by C. James 20 Nov '00

20 Nov '00

Hello, I am interested in having an e-mail address with ziplip.com Can you offer me assistance. Cheers, CJ

1 0