- cypherpunks-legacy - lists.cpunks.org

Passphrase Online...
by John Shaft 17 Dec '03

17 Dec '03

>>If I am connected to the Internet via a SLIP/PPP connection and I >>type my passphrase while being online (for example, in Private >>Idaho, after getting my mail), could that passphrase be compromised? >>If so, how would that be done? There are a number of things that can happen. Basically, if you don't directly control the device/application that is doing the encryption for you, you run the risk of someone intercepting whatever you xmit. For example, if you have a dial up type shell account with your local ISP, and you depend on some UNIX based encryption program to secure your mail (running on the ISP's machine), anyone with root access can tap the tty and watch you enter your passphrase. You're also susceptable (sp?) to someone taping your phone line and looking at you with a packet analyzer. I suppose if you were doing something locally, and someone wanted to be really sneaky, they could embed something like keycopy on your machine (with a virus or something) and get coppied every time you enter a keystroke. I don't suppose it would be all that difficult to get a machine to run a tsr that got kicked off every time you accessed something like, say , PGP....Comments? Shaft! Damn Straigt. shaft(a)africamail.com

2 1

S/KEY (was: 2 Questions)
by Peter M Allan 17 Dec '03

17 Dec '03

Steven M Orrin <privsoft(a)ix.netcom.com> wrote: > Hey guys, > 2 quick questions: > Are there any known hacks or weaknesses in S/Key? S/Key has a rather limited scope, in aiming to prevent replay attacks. These are where somebody snoops on your network to obtain passwords, an uses them in later login attempts. This is undoubtedly a major weakness in most current networks. S/Key addresses this replay of data obtained in passive eavesdropping, but that is all it does. Several attacks against S/Key have been discussed [1], including: race attacks: eavesdropping most of the hash, and racing the user to provide the rest of it active attacks: impersonating the server to learn future hashes or simply hijacking an established session. Strengthening S/Key really means expanding the scope to get an authenticated and encrypted 2-way connection. [John Gilmore's S/WAN may end up achieving this. I'm not familiar with it (yet?).] Ideas for improving S/Key that involve secret data stored on the server tend to get frowned on, as the original aim was to avoid that. In any case you cannot get the full encrypted 2-way connection without getting a whole lot more complicated. Recent discussions [2] have centred on ways to rekey the list of hashes remotely when the count runs down. These changes, and S/Key itself, are better than nothing but where's the ham sandwich ? [3] Beside the protocol weakness there is potential for finding collisions in the hash function (MD4 originally). A choice of hash functions can be provided. See RFC-1938. 1) See also SecureID, which is more complicated and still subject to similar attacks. 2) Not here. 3) Old joke. A ham sandwich is better than nothing, and nothing is better than a life of complete happiness, so ...... -- Peter Allan peter.allan(a)aeat.co.uk

1 0

Re: 4th ACM Conference on Computer and Communications Security
by Remo Pini 17 Dec '03

17 Dec '03

Anyone going there? It's right next doors - at least next to mine :) Remo Pini

1 0

Re: PGPmail for Windows, Version 4.5
by Rob 17 Dec '03

17 Dec '03

On 26 Jan 1997 18:59:32 -0500, you wrote: [..] >It doesn't seem to work with the mail program in MS IE, or MS WordMail. >I understand why some people don't like Microsoft, but excluding >support for popular Microsoft programs seems contrary to their >stated goal of promoting the use of crypto. I believe (according to their page) it's in the works to add support for other programs. It might also be that the MS CryptoAPI may impose limitations on crypto plug-ins that require annoying hacks to use conveniently. But maybe not... I'm surprised the didn't mention Pegasus Mail, which is an amazing "hot" mailer, with a sort-of built-in crypto plug-in capability... it's also free. Rob ----- "The word to kill ain't dirty | Robert Rothenburg (WlkngOwl(a)unix.asb.com) I used it in the last line | http://www.asb.com/usr/wlkngowl/ but use a short word for lovin' | Se habla PGP: Reply with the subject and dad you wind up doin' time." | 'send pgp-key' for my public key.

1 0

RE: Rejection policy of the Cypherpunks mailing list
by Blanc Weber 17 Dec '03

17 Dec '03

From: Sandy Sandfort (By the way, if you don't like moderation, you would hate Eric Hughes' favored solution.) ............................................... What was that? .. Blanc

4 3

Re: Shave the Whales
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Dr.Disruptive Vasectomy died of AIDS last night with his homosexual lover. \|/ @ @ -oOO-(_)-OOo- Dr.Disruptive Vasectomy

1 0

Re: 4th ACM Conference on Computer and Communications Security
by Remo Pini 17 Dec '03

17 Dec '03

Anyone going there? It's right next doors - at least next to mine :) Remo Pini

1 0

Double Your Downline & Triple Your Income With 200 FREE MLM LEADS A Month !!
by Scott Marr 17 Dec '03

17 Dec '03

Please Enlarge Your Window for Proper Viewing ---------------------------------------------------------------------------- --------------------------------- Our research indicates that the following information may be of interest to you. If it is not and you would like to be removed from future mailings, please press your reply button now and in the subject line enter: remove-leads ______________________________________________________________________________ Dear Network Marketing Professional: Stop wasting valuable time attempting to convert CONTACTS into PROSPECTS. It's a losing battle and there is a better way to find the people you need to build your business. Every week over 50,000 new people join a network marking business opportunity. Continue reading to learn how your organization can gain the competitive advantage needed for lasting success. Network marketing is a tremendous vehicle for achieving financial independence but just like the vehicle in your garage, it needs high octane fuel to perform at its best. By replying to: Infinity1(a)airmail.net with HIGH OCTANE in the subject you will receive information that will prove to be rocket fuel for your MLM vehicle. You will learn of a company that can provide you and your down line with: * 200 pre-qualified, MLM-specific, fresh leads per month. * Instructions on how to obtain these valuable contacts absolutely FREE each and every month while earning a generous second or third income. * FREE VoiceMail with 10-minute outgoing and 50 incoming message capacity. * FREE 10-page Fax-On-Demand system. * Complete Network Marketing Training system containing good, solid advice with duplicatable techniques and procedures for success. Don't miss this chance to turbo charge your organization while you put some serious cash in your pocket. You'll be glad you did and so will your down line! To Your MLM Success, Scott Marr P.S. If I receive your request before the month ends, I will include an additional report containing valuable tips on how to improve the response rates of your direct mail and display advertising.

1 0

THE NEW YORKER on the V-Chip
by abostick＠netcom.com 17 Dec '03

17 Dec '03

In the Jan. 20, 1997, issue of THE NEW YORKER, the "Comment", written by Malcolm Gladwell, makes a powerful arguement about the unintended consequences of the V-Chip, the programmable device to be included in next-generation television sets sold in the US that supposedly will allow parents to control their children's access to sex and violence on TV. Gladwell makes an analogy between V-Chipped TV content and air-conditioned cars in the New York City subway system in summertime: " . . . we need air-conditioners on subway cars because air-conditioners on subway cars have made stations so hot that subway cars need to be air-conditioned." Similarly, he argues, "the V-chip is likely to increase the amount of sex and violence on television, not decrease it" because when viewers can block offensive programming, there is far less pressure on broadcasters and cable operators to avoid offending. This is just the sort of thing that John Young is given to scanning and putting up on his Web site or sending out to people who send him email with FUN_nie subject lines. If I were him, I'd put it up. And, for the benefit of those people who don't think the V-Chip isn't in itself on-topic for cypherpunks, I might point out that Gladwell's argument applies equally well to mail filtering with procmail recipes -- or Sandy's and John's list moderation experiment. If the noise level on the unmoderated list jumps to even higher than we were seeing before the moderation began, that would provide observational support to Gladwell's argument. -- Alan Bostick | To achieve harmony in bad taste is the height mailto:abostick@netcom.com | of elegance. news:alt.grelb | Jean Genet http://www.alumni.caltech.edu/~abostick

2 1

Re: Fighting the cybercensor. (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 23 Jan 1997 18:59:34 +0100 (MET) > From: Asgaard <asgaard(a)Cor.sos.sll.se> > Subject: Re: Fighting the cybercensor. (fwd) > > >The Web does not equal the Internet, straw man argument. > > A semantic comment: > > We here all know that this is right but it's obvious that > the language is sliding towards Internet = Web. Most people Typical modern American attitude, getting it right is too much work so let's lower the benchmark so anyone can be 'right'. You'll be supporting Ebonics next. Blah. Jim Choate CyberTects ravage(a)ssz.com

2 1