- cypherpunks-legacy - lists.cpunks.org

Ratess approved
by Francisco Mcgowan 27 Mar '06

27 Mar '06

1 0

Stronger climaxes and orgasms
by Donald Harrison 26 Mar '06

26 Mar '06

A recent survey showed that 68% of women are unsatisfied with their sexual partners. Of course most of these women would never tell their partner that they are unhappy. Not being able to fully satisfy a woman can result in depression and feelings of inadequacy. Thankfully, men of all ages can now safely and naturally enhance their body and penis anatomy and renew sexual vitality without resorting to dangerous surgery. The all natural proprietary blend of unique herbs found in Maxaman is designed to restore blood flow to your penis, unleash stored testosterone, and heighten sensation by activating the body's natural hormone production and supplying vital nutrients necessary for peak sexual performance. http://bgcdelmfj.allegcons.info/?ahikfjxwqowybgzmmcdelm

1 0

Fwd: This thing is awesome!
by Dewitt Sierra 26 Mar '06

26 Mar '06

in, wanting to resist, wanting to understand what it s all about Near the entrance to the cavern you can also find the City Jail. Don't enter element of many games, from Chess through to Scruples. Of all the possibilities that are unimaginative to human thinking.

1 0

Re: [Full-disclosure] guidelines for good password policy and maintenance / user centric identity with single passwords (or a small number at most over time)
by coderman 26 Mar '06

26 Mar '06

On 3/26/06, J. Theriault <administrator(a)maginetworks.com> wrote: > ... > Why not just encourage your users to use a "passphrase" instead of a > "password", such as using a (with proper grammar) book/movie quote or > phrase? excessive typing == unnecessary leaked information and longer auth process (acoustic, profiling, easier pattern discovery, etc.) i don't have a problem supporting a passphrase mode (>16 chars? >32?) but i'd rather not make it the default. (and the default is and must be the most secure and usable path for this to be trustworthy and widely usable)

1 0

[Clips] Terrorist 007, Exposed
by R. A. Hettinga 26 Mar '06

26 Mar '06

--- begin forwarded text Delivered-To: clips(a)philodox.com Date: Sun, 26 Mar 2006 13:04:44 -0500 To: Philodox Clips List <clips(a)philodox.com> From: "R. A. Hettinga" <rah(a)shipwright.com> Subject: [Clips] Terrorist 007, Exposed Reply-To: rah(a)philodox.com Sender: clips-bounces(a)philodox.com <http://www.washingtonpost.com/wp-dyn/content/article/2006/03/25/AR200603250…> The Washington Post Terrorist 007, Exposed By Rita Katz and Michael Kern Sunday, March 26, 2006; B01 For almost two years, intelligence services around the world tried to uncover the identity of an Internet hacker who had become a key conduit for al-Qaeda. The savvy, English-speaking, presumably young webmaster taunted his pursuers, calling himself Irhabi -- Terrorist -- 007. He hacked into American university computers, propagandized for the Iraq insurgents led by Abu Musab al-Zarqawi and taught other online jihadists how to wield their computers for the cause. Suddenly last fall, Irhabi 007 disappeared from the message boards. The postings ended after Scotland Yard arrested a 22-year-old West Londoner, Younis Tsouli, suspected of participating in an alleged bomb plot. In November, British authorities brought a range of charges against him related to that plot. Only later, according to our sources familiar with the British probe, was Tsouli's other suspected identity revealed. British investigators eventually confirmed to us that they believe he is Irhabi 007. The unwitting end of the hunt comes at a time when al-Qaeda sympathizers like Irhabi 007 are making explosive new use of the Internet. Countless Web sites and password-protected forums -- most of which have sprung up in the last several years -- now cater to would-be jihadists like Irhabi 007. The terrorists who congregate in those cybercommunities are rapidly becoming skilled in hacking, programming, executing online attacks and mastering digital and media design -- and Irhabi was a master of all those arts. But the manner of his arrest demonstrates how challenging it is to combat such online activities and to prevent others from following Irhabi's example: After pursuing an investigation into a European terrorism suspect, British investigators raided Tsouli's house, where they found stolen credit card information, according to an American source familiar with the probe. Looking further, they found that the cards were used to pay American Internet providers on whose servers he had posted jihadi propaganda. Only then did investigators come to believe that they had netted the infamous hacker. And that element of luck is a problem. The Internet has presented investigators with an extraordinary challenge. But our future security is going to depend increasingly on identifying and catching the shadowy figures who exist primarily in the elusive online world. The short career of Irhabi 007 offers a case study in the evolving nature of the threat that we at the SITE Institute track every day by monitoring and then joining the password-protected forums and communicating with the online jihadi community. Celebrated for his computer expertise, Irhabi 007 had propelled the jihadists into a 21st-century offensive through his ability to covertly and securely disseminate manuals of weaponry, videos of insurgent feats such as beheadings and other inflammatory material. It is by analyzing the trail of information left by such postings that we are able to distinguish the patterns of communication used by individual terrorists. Irhabi's success stemmed from a combination of skill and timing. In early 2004, he joined the password-protected message forum known as Muntada al-Ansar al-Islami (Islam Supporters Forum) and, soon after, al-Ekhlas (Sincerity) -- two of the password-protected forums with thousands of members that al-Qaeda had been using for military instructions, propaganda and recruitment. (These two forums have since been taken down.) This was around the time that Zarqawi began using the Internet as his primary means of disseminating propaganda for his insurgency in Iraq. Zarqawi needed computer-savvy associates, and Irhabi proved to be a standout among the volunteers, many of whom were based in Europe. Irhabi's central role became apparent to outsiders in April of that year, when Zarqawi's group, later renamed al-Qaeda in Iraq, began releasing its communiquis through its official spokesman, Abu Maysara al-Iraqi, on the Ansar forum. In his first posting, al-Iraqi wrote in Arabic about "the good news" that "a group of proud and brave men" intended to "strike the economic interests of the countries of blasphemy and atheism, that came to raise the banner of the Cross in the country of the Muslims." At the time, some doubted that posting's authenticity, but Irhabi, who was the first to post a response, offered words of support. Before long, al-Iraqi answered in like fashion, establishing their relationship -- and Irhabi's central role. Over the following year and a half, Irhabi established himself as the top jihadi expert on all things Internet-related. He became a very active member of many jihadi forums in Arabic and English. He worked on both defeating and enhancing online security, linking to multimedia and providing online seminars on the use of the Internet. He seemed to be online night and day, ready to answer questions about how to post a video, for example -- and often willing to take over and do the posting himself. Irhabi focused on hacking into Web sites as well as educating Internet surfers in the secrets to anonymous browsing. In one instance, Irhabi posted a 20-page message titled "Seminar on Hacking Websites," to the Ekhlas forum. It provided detailed information on the art of hacking, listing dozens of vulnerable Web sites to which one could upload shared media. Irhabi used this strategy himself, uploading data to a Web site run by the state of Arkansas, and then to another run by George Washington University. This stunt led many experts to believe -- erroneously -- that Irhabi was based in the United States. Irhabi used countless other Web sites as free hosts for material that the jihadists needed to upload and share. In addition to these sites, Irhabi provided techniques for discovering server vulnerabilities, in the event that his suggested sites became secure. In this way, jihadists could use third-party hosts to disseminate propaganda so that they did not have to risk using their own web space and, more importantly, their own money. As he provided seemingly limitless space captured from vulnerable servers throughout the Internet, Irhabi was celebrated by his online followers. A mark of that appreciation was the following memorandum of praise offered by a member of Ansar in August 2004: "To Our Brother Irhabi 007. Our brother Irhabi 007, you have shown very good efforts in serving this message board, as I can see, and in serving jihad for the sake of God. By God, we do not like to hear what hurts you, so we ask God to keep you in his care. You are one of the top people who care about serving your brothers. May God add all of that on the side of your good work, and may you go careful and successful. We say carry on with God's blessing. Carry on, may God protect you. Carry on serving jihad and its supporters. And I ask the mighty, gracious and merciful God to keep for us everyone who wants to support his faith. Amen." Irhabi's hacking ability was useful not only in the exchange of media, but also in the distribution of large-scale al-Qaeda productions. In one instance, a film produced by Zarqawi's al-Qaeda, titled "All Is for Allah's Religion," was distributed from a page at www.alaflam.net/wdkl . The links, uploaded in June 2005, provided numerous outlets where visitors could find the video. In the event that one of the sites was disabled, many other sources were available as backups. Several were based on domains such as www.irhabi007.ca or www.irhabi007.tv , indicating a strong involvement by Irhabi himself. The film, a major release by al-Qaeda in Iraq, showed many of the insurgents' recent exploits compiled with footage of Osama bin Laden, commentary on the Abu Ghraib prison, and political statements about the rule of then-Iraqi Interim Prime Minister Ayad Allawi. Tsouli has been charged with eight offenses including conspiracy to murder, conspiracy to cause an explosion, conspiracy to cause a public nuisance, conspiracy to obtain money by deception and offences relating to the possession of articles for terrorist purposes and fundraising. So far there are no charges directly related to his alleged activities as Irhabi on the Internet, but given the charges already mounted against him, it will probably be a long time before the 22-year-old is able to go online again. But Irhabi's absence from the Internet may not be as noticeable as many hope. Indeed, the hacker had anticipated his own disappearance. In the months beforehand, Irhabi released his will on the Internet. In it, he provided links to help visitors with their own Internet security and hacking skills in the event of his absence -- a rubric for jihadists seeking the means to continue to serve their nefarious ends. Irhabi may have been caught, but his online legacy may be the creation of many thousands of 007s. Rita Katz is the author of "Terrorist Hunter" (HarperCollins) and the director of the SITE Institute, which is dedicated to the "search for international terrorist entities." Michael Kern is a senior analyst with the institute. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _______________________________________________ Clips mailing list Clips(a)philodox.com http://www.philodox.com/mailman/listinfo/clips --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

guidelines for good password policy and maintenance / user centric identity with single passwords (or a small number at most over time)
by coderman 26 Mar '06

26 Mar '06

comments? Creating a secure password: o Include punctuation marks and numbers. o Mix capital, lowercase and space characters. o Create a unique acronym. o Short passwords should be 8 chars at least. Weaknesses to avoid: o Don't use a password that is listed as an example or public. o Don't use a password you have been using for years. o Don't use a password someone else has seen you type. o Don't use a password that contains personal information. o Don't use words or acronyms that can be found in a dictionary. o Don't use keyboard patterns (qwerty) or sequential numbers. o Don't use repeating characters (aa11). Keep your password secure: o Never tell your password to anyone or use it where they can observe it. o Never send your password by email or speak it where others may hear. o Occasionally verify your current password and change it to a new one. o Avoid writing your password down. (Keep it with you in a purse or wallet if you have to write down the password until you remember it.) --- High assurance passwords / exotic threat model interactive auth: use challenge response for single use Key Encryption Keys containing a minimum of 128 bits of entropy in a full SHA-512 derived key. exotic threat model implies full process for physical, emission, cryptographic and user interface security. (i.e. expert level security infrastructure and flawless identity management). ideally this would be coupled with a personal vascular scan biometric device (user centric with vascular auth challenge to open/sign hardened internal secrets) the odds of such a device being designed, produced and verified in an open and full disclosure manner is not high. :P

1 0

RFA: hardware, wireless, defcon (request for assistance with project release/distribution/runtime at defcon 14)
by coderman 26 Mar '06

26 Mar '06

:: public request for help with janus wireless / open source project at defcon 14 :: if you will be at defcon 14 this august and have one or more of the following and would be willing to help with an open source project launch / test during the con please get in touch with me using Off-The-Record or coordinate a meat space rendezvous via email - coderman@gmail. coderman42 on AIM :: OTR print A59CDCB3 46468A16 27D21678 270AF0B5 0B0477CF my appreciation to anyone and everyone for their help; we will need it (we are a very small group based in portland with limited resources and time). i will try to express my appreciation and reward your generosity in some fashion. please forward this to anyone with crypto clue who might be interested and likely to participate. desired and/or required: - VIA Nehemiah hardware and >128M of memory. C5XL, C5P or C5J / C7 required. - slimline IDE or USB CDROM/DVDROM drives. - any x586/Pentium system with > 128M of ram and 8G or more free on unformatted disk partition. - portable USB storage devices that can be formatted to XFS/iso image. - any system capable of burning single or dual layer DVD-R discs. - any wireless equipment that can support WPA/WPA2 EAP TLS w RADIUS (enterprise mode) - any prism2, hermes, atheros, cisco, intel or other linux supported wireless hardware in pcmcia/cardbus or mini-PCI/PCI formfactor. 200mW+ especially useful. - 802.11 or other HAM/FHSS/DSSS/OFDM amplifiers in the 900Mhz, 2.4Ghz, and 5.8Ghz bands (or other reasonable bands - HAM with auth/no-privacy packet radio signalling?) - antennas / cables / filters / mounting systems / for any of the above bands. - audio/video recording and/or mastering equipment and knowledge. - home/work/edu internet bandwidth that can support and would be available for the conference (or a subset) running a tor proxy and/or bittorrent seeder. traffic shaping and read-only boot/runtime is supported if you use the live ISO cd for hosting a tor[rent] node. please consider the potential security risks of running a tor node reachable from a private defcon wireless network before agreeing to this. middle/relay only nodes would still be helpful. - well CPU and memory endowed systems that you would make available to a private IPsec/OpenVPN network for distributed build and test services. all hardware you want to keep is encouraged to stay in your possession and a few hours or more would be helpful when contributing time/skills at the conference. you will need to meet me in person before or the day of the conference. the earlier the better. thanks again, i look forwarded to meeting any of you in person and discussing this project and code. martin - janus wireless coderman(a)gmail.com|peertech.org|charter.net|mindspring.com <coderman> 'bastardized Leonard Cohen; the only quote you'll ever see me tarnish so,' ---cut--- "It is not to tell you anything But to live forever That I write this. ... This is the only code I can write. I am the only one who has built it. I didn't kill myself When things went wrong I didn't shirk difficult integrity, when the easy seduced me. I learned to write I learned to code What might be named On nights like this By one like me. " ---end-cut--- -- out of date and high level description of what this project is all about: 0. Overview Warning: this software is in early experimental stages and should be used accordingly. The Janus Wireless distribution provides a secure environment for private group networking. Please read the rest of this document for a description of digital identity and group networking features implemented in this release. 1. Identity Management The cornerstone of any secure system is the concept of digital identity used to establish authenticated sessions and manage resources. The Janus Wireless software defines your identity with a combination of passphrase and a USB memory stick. Both of these methods must be used together to authenticate you and should be protected like you would protect keys to other valuable personal items like a residence or vehicle. It is very important that you understand the security of your communications and data is dependant on the security of your passphrase and USB memory stick. Store these safely and never use them on a computer where your passphrase may be captured (key logger or shoulder surfer) or the USB memory copied. Physically hardened tamper resistant and/or evident hardware tokens may be used where needed for stronger authentication security. 2. Boot Options There are four different options to choose from when booting into a secure operating system instance. Each has a distinct purpose and you must reboot your system when changing from one domain to another. This may seem a bit cumbersome at first but this step is required to ensure the security of the operating system by initializing the computer with a known configuration from the BIOS bootstrap upward. keys : The first option presented is the secure key management mode which handles creation, modification, and distribution of digital identities and the cryptographic keys associated with them. All interaction with this domain occurs via the USB memory stick and other storage devices to implement a logical "air gap" boundary between this secure domain and others. No network services or capabilities are provided. live : Live mode provides a client environment that can run directly off of the disc used to boot the computer. Network support is provided for establishing virtual private network connections. install : A permanent installation on encrypted hard disk can be deployed with this mode. Please note that full disk encryption across all partitions is required. hdd : Encrypted operating systems stored on disk can be launched with this option. Note that the USB key used to install the encrypted OS is required to boot. If you lose this key or it becomes corrupted all data will on disk will be lost. 3. Getting Started Reboot into the 'keys' mode with a USB memory stick inserted to begin creating user and resource identities. Any live or hdd configuration options can be defined at this point as well. 4. Additional Information Invoke the 'about' command and select the desired topic for additional information on using this software and other common questions. Press the <Ctrl> <Alt> <Delete> keys or invoke the 'reboot' command to restart the system and enter a different bootstrap target. f9e6efb5-0374f333-978717d5-9194321e-67215b35-1c1b3106-1496b640-690342ed gpg --print-md sha512 janus-wireless-pub.txt /etc/janus/keymgr/public/janus-wireless-pub.txt: E93E70B4 B457EB34 298C7A00 32CB5FE3 832DBC69 F894E747 F1C86D5F 454B9595 C2CC5C80 4CFBB105 8639C0A3 A442424F 0CF932F6 AFA8CCD0 25E6FA02 9CEC860C

1 0

Hey baby, found this site and wanted you to check it out first
by Tamika Foote 25 Mar '06

25 Mar '06

1 0

Only 2 Weeks Required tHjl3R
by Joni Wyatt 25 Mar '06

25 Mar '06

Good News! Interested to obtain Bachelors', Masters', MBA's, Doctorate & Ph.D. degrees available in your field in 2 weeks time? It's available now... Call Us and get yours today 1-484-693-8861 Our Education office has someone available 24 hours a day, 7 Days a week Why waiting? 1-484-693-8861 vi

1 0

Re-finance at the lowestt ratess
by Winston Gleason 25 Mar '06

25 Mar '06

1 0