- cypherpunks-legacy - lists.cpunks.org

Re: Giving Kill Files a Workout...
by Dave Hayes 17 Dec '03

17 Dec '03

Dimitri Vulis writes about unwanted noise: > They feel compelled to silence it altogether. They claim altruistically > that they don't want the noise to bother anyone else, such as the clueless > newbies who keep subscribing to this mailing list and don't know how to > use mail filters. (Sandy Sanford's concern for them was soooo touching...) Misplaced altruism is one of the primary causes of social injustice, authoritarian regimes, and security measures. It is not possible to be "altruistic" until one realizes that one doesn't know what true "altruism" is. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet Don't follow in the footsteps of the ancients, seek what they sought.

1 0

Cpunks Frog Forwards discontinuation
by Damaged Justice 17 Dec '03

17 Dec '03

I will be discontinuing my "Cpunks Frog Forwards" filtering service within one week of the announcement of Perry Metzger's new crypto list, and possibly sooner if my patience runs out, because 1) I have too many other things to take care of in my life, 2) there really isn't as great a need for it anymore due to the number and variety of other filtering services, and 3) my sanity is being stretched to its limits having to wade through the mountains of bullshit that now infest my inbox, even with procmail's kindly assistance. Perry was right: Cypherpunks has become a sewer. As Robert Anton Wilson said, "Only a sewer accepts everything." Here is a list of the other filtering services I am currently aware of: o Alan Clegg runs an UNMODERATED cypherpunks digest, which only reduces the the volume of separate messages. Subscribe by mailing to majordomo(a)gateway.com (Standard majordomo list -- send "help" in the body for information.) o Eric Blossom runs a commercial "Cypherpunks Lite" for a modest fee, approximately 20.00US/year. Mail eb(a)comsec.com for more info. For a sample, read the archive at ftp://ftp.crl.com/users/co/comsec/cp-lite o Ray Arachelian runs a free filtering service, sticking mostly to news and technical stuff with a few other tidbits thrown in. Mail sunder(a)dorsai.dorsai.org for more info, or to be added. See you all on the other side. "Cypherpunks write code." -- I let go of the law, and people become honest / I let go of economics, and people become prosperous / I let go of religion, and people become serene / I let go of all desire for the common good, and the good becomes common as grass. .oOo. [Tao Te Ching, Chapter 57, Stephen Mitchell translation]

3 3

Emergency powers
by Charles Platt 17 Dec '03

17 Dec '03

Of course, Michael Froomkin is right in everything he says about presidential emergency powers. But an unconstitutional abuse of power is surely not acceptable merely because it has become a routine method for accomplishing everyday legislative tasks. First, it allows significant possibility for future abuse; and second, if the Constitution is routinely circumvented, this diminishes its general power (as any law loses its power when it is routinely flouted). The situation is all the more troubling because it receives so little publicity, outside of militant "extremist" groups (i.e. those that are crazy enough to believe that presidential power should be limited in accordance with the law of the land). When a president can take almost action under the excuse that it's a "national emergency" (when in fact there is no emergency), and he doesn't have to answer questions till later, and most citizens are unaware of this, we have a potentially dangerous situation. They key word here is "potentially." Michael Froomkin seems relatively sanguine because the potential for great harm has not been realized. I am not so easily reassured. --Charles Platt

2 1

ALERT! 123,000 announced job cuts
by John Jackson 17 Dec '03

17 Dec '03

DOWNSIZED? - RIGHTSIZED? - RESTRUCTURED? HOW CAN YOU PROTECT YOURSELF FROM THIS EVERYDAY OCCURRENCE? ---> AT&T = 123,000 announced job cuts ---> GENERAL MOTORS = 122,000 announced job cuts ---> IBM = 400,000 announced job cuts ---> JOE's PRINT SHOP = 2 announced job cuts Are you dodging the arrows of Corporate America? Do you know someone (a family member, a friend, maybe even yourself) who has lost a job during the past six months? Has this person secured another job that is paying the same salary and benefits as the job they lost? There was once a time when people held a job for 20 to 30 years and retired with a secure pension. Those days are gone! So what can the average person do to protect him or herself financially in the unfortunate, but all too common, event of losing a job? Financial advisors have been telling us for years that we should diversify our investments. If this concept makes sense, should we not also diversify our sources of INCOME? Does it make sense to leave yourself vulnerable by expecting all of your income to come from one source? Rexall, an international company that was founded in 1903, is flourishing today as a very successful publicly traded company. You have no doubt heard of Rexall and are familiar with the more than 7,000 Rexall drug stores around the country. In fact, more than 87% of adult Americans today recognize the name Rexall and associate it with trust and integrity. Rexall's six divisions are all very profitable and growing at staggering rates. So what does this have to do with you? Rexall has developed an entrepreneurial arm of its company that helps individuals build a substantial secondary income stream without the hassles of ordinary business. No huge investments, no inventory, no employees, NO RISK. This is not some fly-by- night operation. This is REXALL! One of the most well known and respected corporate names in America. My partner, Todd Smith, has helped hundreds of people diversify their income and create substantial passive income streams through the entrepreneurial arm of the Rexall Companies. Todd himself has earned over one million dollars in EACH of the last three years in this simple, no-stress, home-based business. He knows what he is doing and how to help point people, like you, in the right direction. If you would like to learn how we can help you create a financial hedge against a possible downturn in your present employment, or simply to develop an additional source of passive income, call me today. Todd has created an informational audio tape that explains our entire business and how you can participate in it. If you are making all the money you want, have your retirement completely paid for, enjoy your job and can see working it until you retire, then CONGRATULATIONS. You are one-in-a-thousand. On the other hand, if you are like most Americans that are not happy with their current financial situation, it would be worth the phone call and some time listening to Todd's tape. What have you got to lose? If you DON'T call, you have a lot to lose. Call (303)-480-5841 right now and ask for this free tape to be rushed to you without any obligation whatsoever. PS: The message on this Tape is timely, addresses the societal and economic forces that WILL change our lives in the coming new century, and explains precisely why entirely new methods of doing business are necessary and are evolving. Your thinking about money, business, success and your own future will be challenged by this message! (303) 480-5841 - 24 hours ASK FOR TODD's TAPE J. Jackson Associates Income Diversification Strategies Parker, Colorado U.S.A.

1 0

Experience Microsoft Site Builder Workshop Live!
by ! Drive 17 Dec '03

17 Dec '03

Microsoft Site Builder Workshop Live! ( apprx 2.5 hours ) via Real Audio at http://ww3.audionet.com/events/microsoft/ what you need: The RealAudio Player At least a 28.8Kbps connection to the Internet A screen resolution size of 800 x 600 pixels :: Archived On November 13th From The INFOMART In Dallas, TX

1 0

Re: RFC: A UNIX crypt(3) replacement
by Joshua E. Hill 17 Dec '03

17 Dec '03

I have gotten a lot of e-mail that has said basicly the same things: 1) Don't try to redo UNIX crypt(3), S-KEY (Secure Shell, etc.) is better. Well... This is most certainly the case. And if I could force the people in my user base to use one of these alternatives, I would. Unfortunately, I cannot. A fair number of the people who use the systems that I administer log on through dumb terminals. If I can't successfully teach them not to hit the "Ctrl-S" key, how am I going to teach them to do IDEA encryption in their heads? Or MD4 hashes for that matter? The fact is that if I tried to use S/KEY everyone would print out their key list for the month, and then promptly loose it, and regenerate a new one. Gee... Wouldn't that be secure. I have to stay with the one password system. 2) If your administer was worth his weight in spit, you would have a shadow password system, and the preexisting crypt(3) function would be good enough for you. Actually, I _am_ the administrator, and I am worth my weight in spit. Rather, I do use a shadow password suite. However, as security professionals, you must know that it is not whether an attacker can break into your system, but how long it takes. Once there, it is not whether the attacker can gain root, it is how long it takes (how many of the holes have been patched, and how many are even known about). And then to the password file. It is not whether the attacker can crack _all_ the passwords, it is how long it takes. With this algorithm, I hope to increase the last of these values. 3) The algorithm is too complex (or too simple) The algorithm that I proposed makes use of a NMAC as a basic cryptographic primitive. The security analysis of the algorithm should follow the same lines as a hash; that is: if the basic operator is secure, then the chaining of the operator is secure. The NMAC is provably as secure as the key used and the underlying hash function. I did everything that I could to maintain simplicity throughout the algorithm's design. I realize that a simple algorithm is easier to analyze and check for security. A fair bit of the complexity is to make it so that the algorithm is actually a NMAC. 4) Why don't you use FreeBSD's MD5 based crypt(8) replacement? I didn't like FreeBSD's MD5 drop in, because it lacked any security analysis, and complexity of the algorithm prevented any serious attempt at said analysis. It also uses MD5, which has not held up well to the ravages of time. The recent papers on easier ways to find collisions in MD5 did _not_ give me an attack of the warm-and-fuzzies. I would like to make use of an algorithm that is still thought to be secure. Joshua -----------------------------Joshua E. Hill----------------------------- | Thoreau's Law: | | If you see a man approaching you with the obvious intention | | of doing you good, you should run for your life. | -------jehill@<gauss.elee|galaxy.csc|w6bhz|tuba.aix>.calpoly.edu--------

1 0

re: San Jose Mercury News declares encryption battle over
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Dale how long have you been awake? Take a gander at Wei Dei's Crypto++, Peter Gutman's cryptlib, and the half dozen other public domain multi algo source libs available at your finger tips. Anyone with a compiler on just about any platform has access to implementations of blowfish, idea, des, gost, the gamut. So Dale, get coding. diGriz

1 0

Re: RFC: A UNIX crypt(3) replacement
by Joshua E. Hill 17 Dec '03

17 Dec '03

> This is backwards logic; when security begins to hender in the > functionality of the system, the security needs to be gotten rid of. hmmm... Now that _completely_ depends on the system. Now for the system I administer, the level of security really isn't _that_ high (on the grand scale of things). It is, however, high enough that I inconvenience the users with a pro-active password guesser, and passwords that expire occasionally. I suppose that this is a _minor_ inconvenience, but it raises the level of security a very large amount. On a less mundane system (one run by the government, say), security is only _slightly_ less important than being able to use the system in the first place. :) On this type of system almost any inconvenience is worth the cost. > > You have previously said that the passwd file should not be available > > for public consumption. Though this is certainly true, it does not > > hurt that even if the passwd file is available, nothing particularly > > useful can be done with it. > Hince you use pseudorandom password generators and crack. If you count on > somebody not being able to preform an opperation quickly, they'll usually > prove you wrong. whoa... didn't you just say: > when security begins to hender in the > functionality of the system, the security needs to be gotten rid of. I think that psedu-random password generators would almost certainly "hinder in the functionality of the system"... :-) I want to make it so that users can use passwords > 8 characters, and I want to use something a bit better than FreeBSD's solution. Whether or not this is necessarily the One True Way (TM) to security, it will increase security. I'm not saying "Hey everyone. Here is a spiffy new password system that will make your entire system completely secure!" I'm saying "Could everyone please look at this algorithm that I'm thinking of using. Could you please comment on it, so that I can make it better." That's it. All questions on whether or not passwords should shadowed, crackable, not crackable, or consisting only of the letter "e", aside. Is this algorithm secure, and if not, why not. Joshua > --Deviant > The Macintosh is Xerox technology at its best. I very much like your signature... very nice... -----------------------------Joshua E. Hill----------------------------- | Allen's Law: | | Almost anything is easier to get into than out of. | -------jehill@<gauss.elee|galaxy.csc|w6bhz|tuba.aix>.calpoly.edu--------

2 1

Re: HP announcing some International Cryptography stuff on Monday
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:49 PM 11/15/96 -0800, Timothy C. May wrote: >It sounds ominous to me. Another backroom deal, probably for some form of >key recovery strategy, aka GAK. I'd bet GAK too. RSADSI has been working on GAK protocols, so these ones might actually work. I feel as pessimistic about this one as Lucky usually is. At 12:05 PM 11/15/96 -0800, John Gilmore wrote: >Are they the next Big Company to knuckle under to the Feds? Their >pcmcia-with-local-country-surveillance-chip-socket initiative never >seemed to go anywhere. Since I am inherently optimistic, one ray of light may be that the San Jose Mercury News was mentioning the ability to export the system, and then when the necessary licenses (US and foreign) were obtained, turn on the encryption. I guess from this that the encryption is in hardware. Now, software/hardware interfaces are usually fairly simple, so what we have here is a software system with a crypto hook. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

6 5

Re: ideal secure personal computer system
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:24 AM 11/16/96 -0600, Igor Chudov @ home wrote: >Bill Frantz wrote: >> Protection against strangers walking up to your machine and using it is >> nice, and easy to do. Protection against viruses which install Trojan >> horses in your system would also be nice, but is very hard to do in systems >> where programs run with all the privileges of their users. Examples >> include (in alpha order): DOS, MacOS, Unix, and Windows (including NT). > >I wonder what are the operating systems where programs may be run with >_less_ privileges than the user who starts them? Is VMS one of such >systems? Ah, you touch on 20+ years of my professional life. KeyKOS is such a system as is EROS, a similar system being developed at University of Pennsylvania. See: http://www.cis.upenn.edu:80/~eros/ http://www.cis.upenn.edu/~KeyKOS/ http://www.agorics.com/agorics/allkey.html - For KeyKOS documentation. In general these systems provide an execution environment where programs only have access to the resources they need. Think of it as a Unix chroot jail which is specifically designed for each program. Then add controlled communication links back to the user's terminal and you get the idea. Unless a program has a need to write the system file, it won't have the privilege, even if it's user does have the privilege. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

1 0