- cypherpunks-legacy - lists.cpunks.org

CDR: NRGE - Buy Alert! 28926
by marketing21＠uole.com 20 Nov '00

20 Nov '00

1 0

CDR: The Window, Opportunity
by bcallu＠arabia.com 20 Nov '00

20 Nov '00

1 0

CDR: Re: Carnivore All-Consuming
by Steve Schear 20 Nov '00

20 Nov '00

At 06:21 PM 11/19/00 +0000, Jim Dixon wrote: >On Sat, 18 Nov 2000 George(a)orwellian.org wrote: > > > EPIC FOIA... > > > > http://www.latimes.com/wires/20001117/tCB00V0387.html > > > > WASHINGTON--The FBI's controversial e-mail surveillance tool, > > known as Carnivore, can retrieve all communications that go > > through an Internet service -far more than FBI officials have > > said it does -a recent test of its potential sweep found, > > according to bureau documents > > [snip] > >Carnivore is an NT-based PC. How could it conceivably process all >communications through even a mid-sized ISP? > >There are at least two problems: processing power and network >architecture. > >As regards the first, our customers, many of them smaller ISPs, >find it necessary to employ NT clusters to handle subsets of their >traffic (Usenet news, Web proxies, and so forth). So it is >difficult to believe that a single NT box could monitor their >entire traffic load. A PC, using off-the-shelf HW, is capable of filtering a full 100 Mbps link (144K packets/sec) as demonstrated by the BlackICE products http://www.networkice.com/html/blackice_sentry.html steve >As regards the second, most ISPs of any size have multiple PoPs >and multiple high-speed connections to other networks. It would >require incredible contortions to route all of their traffic to >one point for monitoring. And for the larger network, the bandwidth >into that single point would be unmanageable. > >The UK government proposed building something more sophisticated than >Carnivore. Consultants led them to believe that this was feasible, >and costed a solution. The UK ISP associations (the LINX and ISPA) >replied to their proposals by saying that (a) the proposals showed >no understanding of the technical structure of the Internet and >(b) their cost estimates were ridiculously low, even if the >Internet could be distorted sufficiently to be monitored in the >manner envisioned. > >As far as we can see, the UK government as an institution is not >capable of even understanding the Internet. They simply do not have >enough competent technical staff. They do have a lot of relatively >senior people who claim to be competent - and give bad advice, some >of which finds its way into legislation and programs of action. > >The overall capacity and the complexity of the Internet is increasing >at an explosive rate. For better or for worse, this far exceeds the >growth in any government's capability of monitoring Internet traffic.

2 1

CDR: Need Money? Aggressive lenders Say YES to Home Loans! 9803
by return60＠uole.com 20 Nov '00

20 Nov '00

1 0

CDR: RE: The cause of uncertainty in the election outcome.
by Ernest Hua 20 Nov '00

20 Nov '00

Well, that's not entirely true either. The judicial system is generally pragmatic, in the sense that they do not address issues not brought before the court. For instance, if someone commits a crime, a prosecutor must bring up charges. Yes, this concept seems rather obvious and trivial, but what it means is that it is very easy for the body of laws which affect any particular situation (e.g. Presidential election) to become contradictory and for the accepted practice to deviate significantly from what the law strictly allows. It's not necessarily a bad thing that the system works this way, but it's definitely a side effect, and most people don't want to fix what ain't broke. Clearly, the Florida situation demonstrates that something is likely broken. Ern -----Original Message----- X-Loop: openpgp.net From: James A. Donald [mailto:jamesd@echeque.com] Sent: Sunday, November 19, 2000 11:24 AM To: cypherpunks(a)cyberpass.net Subject: The cause of uncertainty in the election outcome. Because the vote is so close, the outcome depends entirely on a multitude of judgment calls about which votes count, and which are counted, and how they shall be counted. The normal procedure in England and the democracies descended from England, or imposed by English troops, is that the major parties reach agreement before and during the vote count, on how the votes shall be counted. In the US however, you have a multitude of laws, laws which contradicted each other, and contradicted actual practice. For example a lot of perfectly good absentee ballots that were presented by the military in accord with the usual military practice were rejected this time because they did not comply with the letter of the law, even though they complied with custom and practice. The cause of the uncertainty is judicial imperialism. It is often said that Americans are litigious,but the cause of this destructive litigation is judicial willingness to unpredictably overturn existing practice.

1 0

CDR: Re: Is this Reno/wiretap stat true?
by David Marshall 20 Nov '00

20 Nov '00

"James A. Donald" <jamesd(a)echeque.com> writes: > -- > > At 01:29 PM 11/19/2000 -0500, George(a)orwellian.org wrote: > > Found in Usenet: > > > > # I don't know if Reno is a traitor, but consider this: > > # Between 1992 and 1997, there were approximately 2,500 > > # national security wiretaps requested by the FBI. Only one > > # of these 2,500 requests was turned down: Wen Ho Lee's! And > > # this turndown took place while Wen Ho Lee was still > > # downloading nuclear secrets from Lost Alamos. > > > > True/False? > > > Any new, important and surprising fact reported on usenet without source or > explanation is almost certainly a lie. That's always good advice to go by. In this particular case, I recall hearing a claim that only one wiretap was turned down, and that one was to be exercised on Wen Ho Lee, but I don't recall the total number of requests. The source for this was the Rush Limbaugh Show, so make of it what you will. Not to defend the Butcher of Waco by any means, but we also don't know the circumstances surrounding the wiretap. Maybe it's true, though unlikely, that all the other wiretap requests had evidence behind them, while the one for Wen Ho Lee took the form "We think this guy is doing something bad. We don't know what, but he ate Dim Sum this morning, and we're worried that he might like more than just Chinese food." Of course, that's never stopped the government from approving wiretaps before. :)

1 0

Re: Public Key Infrastructure: An Artifact...
by Lynn.Wheeler＠firstdata.com 20 Nov '00

20 Nov '00

note also that current SSL infrastructure is vulnerable to things like domain name hijacking; aka, at least part of SSL protocol is to make sure that you really are talking to the host that you think you are talking to ... i.e. the SSL certificate contains host/domain name (all this, in theory because of weaknesses in the domain name infrastructure) ... and when SSL goes to check something in the certificate ... it is checking the hostname/domainname against the hostname/domain name that the browser is using. However, SSL-certificate issuing CAs have to rely on the domain name authoritative infrastructure with regard to issuing SSL-certificates & domain name ownership issues ... this is the same authoratative infrastructure that supposedly can't be relied on and justifies having a the whole SSL-certificate infrastructure to begin with. In any case, the domain name infrastructure has been looking at ways to beef up the integrity of its operation ... like having public keys registered as part of domain name registration. Now, if domain name infrastructure is going to use public key registration as part of beefing up its integrity ... that would medicate much of the justification for the SSL-certicate infrastructure. Furthermore, if a higher integrity domain name infrastructure included public keys in the domain name record ... clients could request a real-time, trusted copy of the public key as a adjunct to host-name lookup. This would further eliminate the requirement for any certificate involvement in the majority of the existing SSL transaction operation (i.e. client gets the public key at the same time hostname resolution is done ... the client can trust a real-time host/domain name because of the improvement in the domain name infrastructure integrity ... and at the same time it can trust a real-time publickey for the same host/domain). Bram Cohen <bram(a)gawth.com> on 11/18/2000 11:15:38 AM

3 8

CDR: ADMIN: List Moving (fwd)
by Jim Choate 20 Nov '00

20 Nov '00

____________________________________________________________________ He is able who thinks he is able. Buddha The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- -------------------------------------------------------------------- ---------- Forwarded message ---------- Date: 19 Nov 2000 13:13:40 -0500 From: "Perry E. Metzger" <perry(a)piermont.com> To: cryptography(a)c2.net Subject: ADMIN: List Moving The cryptography list will be moving in the next few days from c2.net to a server I control elsewhere. "Stay tuned." Perry

1 0

CDR: Public Key Infrastructure: An Artifact...
by Jeffrey Altman 20 Nov '00

20 Nov '00

> The problem with all of these things is that they are still based on > creating an association between a domain name and a key, when in fact what > you want is an association between some abstract concept of a counterparty > which exists in an end user's mind (like, say, amazon) and the ownership > of a machine that user's browser is talking to. > > Unless that problem is fixed, man in the middle is hardly made more > difficult - for example, Mallory could break into some random machine on > the net and steal it's public key, then hijack local DNS and when someone > goes to amazon.com redirect them to amazon.hackeddomain.com, and then > proxy to amazon.com - now even SSL says the connection is safe. > > -Bram Cohen I don't understand this last paragraph at all. If you put a proxy on amazon.hackeddomain.com and I connect through the proxy to the real amazon.com, where is the threat? If the SSL connection is established with the proxy, then the X.509 certificate on that host does not match www.amazon.com and the connection would not verify. If the connection is proxied to the real www.amazon.com the SSL connection will verify, and because it is protected end to end the proxy will not be able to do anything other than disconnect the connection at an arbitrary time. There is no man in the middle attack here. Jeffrey Altman * Sr.Software Designer The Kermit Project * Columbia University 612 West 115th St * New York, NY * 10025 * USA http://www.kermit-project.org/ * kermit-support(a)kermit-project.org

1 0

CDR: Public Key Infrastructure: An Artifact...
by Jeffrey Altman 20 Nov '00

20 Nov '00

> On Sat, 18 Nov 2000, Ben Laurie wrote: > > > Bram Cohen wrote: > > > > > > Unless that problem is fixed, man in the middle is hardly made more > > > difficult - for example, Mallory could break into some random machine on > > > the net and steal it's public key, then hijack local DNS and when someone > > > goes to amazon.com redirect them to amazon.hackeddomain.com, and then > > > proxy to amazon.com - now even SSL says the connection is safe. > > > > Yes, and Mallory can't read the data - so what was the point? > > Yes he can - he's presenting the key for hackeddomain.com, which he stole, > so he's quite capable of reading requests sent for it. > No he can't. What hackeddomain.com is sending is the certificate for hackeddomain.com which does not contain the host name www.amazon.com. Therefore, it won't be accepted by the client. If hackeddomain.com acts as a proxy, then the certificate that is received by the client is the real one from www.amazon.com and so the session is protected. You can't have it both ways. Jeffrey Altman * Sr.Software Designer The Kermit Project * Columbia University 612 West 115th St * New York, NY * 10025 * USA http://www.kermit-project.org/ * kermit-support(a)kermit-project.org

1 0