- cypherpunks-legacy - lists.cpunks.org

Another security problem reported in Microsoft's Internet Explor
by Peter Trei 17 Dec '03

17 Dec '03

(This is posted to both www-security and cypherpunks. Please be careful where you send responses). See: http://www.news.com/News/Item/0,4,3707,00.html at C|net's news site for the whole story. Short version: InfoSpace has released a program as an IE plugin, which, once the user has agreed to install it, registers InfoSpace as a 'trusted publisher' in Explorer. This apparently means that later requests to download Infospace programs would not trigger the dialog boxes requesting permission to download. InfoSpace describes this as a bug, and is releasing a corrected version. Commentary: I hope that all IE plugin (ActiveX, script, whatever) publishers are as responsive. Ideally, I suppose, a downloaded executable component should not be able to silently manipulate the security policies of the system it arrives on, but it's hard to see how to prevent this in Microsoft's active content model. The Java model is more robustly protected against this problem, but as a result is not as capable. The scary thing is that a clever author of Trojan horses could write an ActiveX control which does nothing but open the gates, and let other programs in without the Authenticode check. It could even let in another version of itself, which is also properly signed, but has no malicous code. Thus, it could cover it's tracks. Peter Trei trei(a)process.com Disclaimer: I do not represent my employer.

1 0

Re: A daily warning regarding Tim ... [edited]
by laverty＠matrixNet.com 17 Dec '03

17 Dec '03

Eudora Pro 2.2 will also filter out all of the crap... At 08:24 AM 9/23/96 -0500, you wrote: >>On Fri, 20 Sep 1996, John Anonymous MacDonald wrote: >> >>> Tim C[*] * studied yoga back-streching exercises for >>> five years so he could * * (*). >> >>Likely the NSA has nothing better to do these days. They got bored with >>just listening, so now they're spamming. Can we lock this fucker out of >>the list? Sure, he'll probably pick another nym to post from... >> > > >Can't lock him out of the list, but you can either set up a kill file, or find >something like the 3.0b version of Eudora, which has filters; you can set it up >where, if an incoming message has a certain From: string, it is transferred >directly into the Trash mail folder, which is, as a rule, cleaned up before >quitting. > >Daniel. > >-- >If in fact we are the only intelligent life on this planet, why the fuck are >we in this goddamn mess? >-- >Find my public key on the World Wide Web -- point your browser at: >http://bs.mit.edu:8001/pks-toplev.html > > > >

1 0

Taking crypto out of the U.S.
by haggis＠brutus.bright.net 17 Dec '03

17 Dec '03

Soon I am going to be going overseas to Japan, and I want to take my notebook with me so I can keep up with everything, however, I have encrypted my hard drive and usually encrypt my mail. Is this in violation of the ITAR to keep everything the same when I go over?

5 4

No Subject
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

>From cypherpunks-errors(a)toad.com Tue Sep 24 00:20:12 1996 Return-Path: cypherpunks-errors(a)toad.com Received: from toad.com (toad.com [140.174.2.1]) by oak.westol.com (8.7.5/8.6.9) with ESMTP id AAA16114 for <shadseek(a)westol.com>; Tue, 24 Sep 1996 00:20:11 -0400 Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id MAA24022 for cypherpunks-outgoing; Mon, 23 Sep 1996 12:43:09 -0700 (PDT) Received: from smtp1.abraxis.com (SMTP1.ABRAXIS.COM [206.155.199.210]) by toad.com (8.7.5/8.7.3) with SMTP id MAA23992 for <cypherpunks(a)toad.com>; Mon, 23 Sep 1996 12:41:23 -0700 (PDT) From: camcc(a)abraxis.com Received: from [206.155.199.39] by smtp1.abraxis.com (NTMail 3.01.03) id ua044324; Mon, 23 Sep 1996 15:44:56 -0400 Message-Id: <2.2.32.19960923194301.0069bebc(a)smtp1.abraxis.com> X-Sender: camcc(a)smtp1.abraxis.com X-Mailer: Windows Eudora Pro Version 2.2 (32) Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Mon, 23 Sep 1996 15:43:01 -0400 To: cypherpunks(a)toad.com Reply-To: camcc(a)abraxis.com Subject: GA HB1630 Lawsuit: Press Advisory Sender: owner-cypherpunks(a)toad.com Precedence: bulk X-UIDL: 843538926.000 Status: U >X-Sender: rcostner(a)intergate.net >Reply-To: efg-action(a)ninja.techwood.org > >Joint Media Advisory: > >AMERICAN CIVIL LIBERTIES UNION >ELECTRONIC FRONTIERS GEORGIA >REP. MITCHELL KAYE > >Groups to Mount Legal Challenge to Georgia Cyberspace Law > >FOR IMMEDIATE RELEASE Contact: See list below >Friday, September 20, 1996 > > ATLANTA, GA-- -The American Civil Liberties Union, Electronic Frontiers >Georgia, Georgia State Representative Mitchell Kaye (R-Marietta) and others >will be holding a news conference on Tuesday, September 24 at 10:30 a.m., >immediately after filing a lawsuit seeking a preliminary injunction against a >Georgia law barring communications in cyberspace. > > The suit names Governor Zell Miller and Attorney General Michael Bowers as >defendants, and will be filed on behalf of 13 plaintiffs. >------------------------------------------------------------------------------ >-------------------------------------- > > WHO: > >Attorneys Ann Beeson (ACLU) and Scott McClain (Bondurant, Mixson & Elmore) > >Plaintiffs Robert Costner (executive director, Electronic Frontiers Georgia); >Jeff Graham (AIDS Survival Project); Rep. Mitchell Kaye (GA House of >Representatives); Bonnie Nadri (The Page Factory); Teresa Nelson (ACLU of >Georgia); Eric Van Pelt (Atlanta Veterans Alliance); Josh Riley (individual >plaintiff); and Kimberly LyleWilson (Atlanta Freethought Society). > > WHAT: > >News conference to announce filing of legal challenge to Georgia >cyberspace law. > > WHEN: > >Tuesday, September 24, 10:30 a.m. > > WHERE: > >ACLU of Georgia >142 Mitchell Street SW (at Peachtree), Suite 301, Atlanta >(404) 523-6201 > >Note: Copies of the brief and plaintiff affidavits will be available at the >news conference and online at the EFGA website, <http://www.efga.org/> and >through the ACLU's website <http://www.aclu.org> and America Online site >(keyword: ACLU). > >Contacts: Teresa Nelson, ACLU GA Ann Beeson, national ACLU: 404-523-6201 > Robert Costner, EFGA: 770-512-8746 > Rep. Mitchell Kaye: 770-998-2399 > Scott McClain: 404-881-4138 > Emily Whitfield, ACLU Nat'l Press Office: 212-944-9800 x426 > > >

1 0

GA HB1630 Lawsuit: Press Advisory
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

>X-Sender: rcostner(a)intergate.net >Reply-To: efg-action(a)ninja.techwood.org > >Joint Media Advisory: > >AMERICAN CIVIL LIBERTIES UNION >ELECTRONIC FRONTIERS GEORGIA >REP. MITCHELL KAYE > >Groups to Mount Legal Challenge to Georgia Cyberspace Law > >FOR IMMEDIATE RELEASE Contact: See list below >Friday, September 20, 1996 > > ATLANTA, GA-- -The American Civil Liberties Union, Electronic Frontiers >Georgia, Georgia State Representative Mitchell Kaye (R-Marietta) and others >will be holding a news conference on Tuesday, September 24 at 10:30 a.m., >immediately after filing a lawsuit seeking a preliminary injunction against a >Georgia law barring communications in cyberspace. > > The suit names Governor Zell Miller and Attorney General Michael Bowers as >defendants, and will be filed on behalf of 13 plaintiffs. >------------------------------------------------------------------------------ >-------------------------------------- > > WHO: > >Attorneys Ann Beeson (ACLU) and Scott McClain (Bondurant, Mixson & Elmore) > >Plaintiffs Robert Costner (executive director, Electronic Frontiers Georgia); >Jeff Graham (AIDS Survival Project); Rep. Mitchell Kaye (GA House of >Representatives); Bonnie Nadri (The Page Factory); Teresa Nelson (ACLU of >Georgia); Eric Van Pelt (Atlanta Veterans Alliance); Josh Riley (individual >plaintiff); and Kimberly LyleWilson (Atlanta Freethought Society). > > WHAT: > >News conference to announce filing of legal challenge to Georgia >cyberspace law. > > WHEN: > >Tuesday, September 24, 10:30 a.m. > > WHERE: > >ACLU of Georgia >142 Mitchell Street SW (at Peachtree), Suite 301, Atlanta >(404) 523-6201 > >Note: Copies of the brief and plaintiff affidavits will be available at the >news conference and online at the EFGA website, <http://www.efga.org/> and >through the ACLU's website <http://www.aclu.org> and America Online site >(keyword: ACLU). > >Contacts: Teresa Nelson, ACLU GA Ann Beeson, national ACLU: 404-523-6201 > Robert Costner, EFGA: 770-512-8746 > Rep. Mitchell Kaye: 770-998-2399 > Scott McClain: 404-881-4138 > Emily Whitfield, ACLU Nat'l Press Office: 212-944-9800 x426 > > >

1 0

Crypto Files in the BA Archives (fwd)
by Dave Emery 17 Dec '03

17 Dec '03

Forwarded message: >From boatanchors(a)theporch.com Mon Sep 23 14:15:39 1996 Date: Mon, 23 Sep 1996 12:54:28 -0500 (CDT) Message-Id: <Chameleon.4.01.2.960923135510.jproc@> Errors-To: listown(a)jackatak.theporch.com Reply-To: jproc(a)worldlinx.com Originator: boatanchors(a)theporch.com Sender: boatanchors(a)theporch.com Precedence: bulk From: jproc(a)worldlinx.com To: Multiple recipients of list <boatanchors(a)theporch.com> Subject: Crypto Files in the BA Archives X-Listprocessor-Version: 6.0c -- ListProcessor by Anastasios Kotsikonas X-Comment: Amateur Radio Equipment Using Vacuum Tubes Content-Type: TEXT/PLAIN; charset=US-ASCII Mime-Version: 1.0 X-Mailer: Chameleon - TCP/IP for Windows by NetManage, Inc. Dear BA'ers, For those of you in the group who are interested in crypto gear, I have posted two files to the BA archives which discuss the KL7 off line crypto unit and the KWR-37 online crypto receiver. To obtain the files, send a message to: listprocessor(a)theporch.com In the body of the message type: get boatanchors kl7.crypto.unit get boatanchors kwr37.crypto.receiver The second article is the one which will be submitted to AWA Old Timers Bulletin. BA'ers get to read it first. Regards, ------------------------------------- Jerry Proc VE3FAB E-mail: jproc(a)worldlinx.com HMCS Haida Naval Museum Toronto, Ontario 'Looking for a 'AN/SRC-501' -------------------------------------

1 0

Re: Snake-Oil FAQ
by Krenn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: > The reason I recommend anonymous remailer distribution, and pseudonyms, is > because of the litigation issue. Even if reviewers are not sued often, the > threat of a suit influences reviews, which is why most reviews in most mags > are puff pieces (glowing reviews, often strongly correlated with who is > advertising in the mag). One can imagine Matt Blaze, for example, choosing > to say _nothing_ about SnakeTronics' ScrambleMatic, for fear (justified) > that he might get letters from their lawyers, thus taking up his time and > even eventually landing him in court. I agree, hence my original post. I for one would not contribute to such a list without anonymity, tho my critiques might be right. The hassle of dealing with a person or organization bent on causing you legal headache is more than I am willing to deal with. It is obvious, given the current state of the legal system in this country, that a lawsuit against a even a well-respected cryptographer might drag on for some time, costing ennumerable dollars and hours, and _might_ even succeed. Krenn -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMkcaT0nqfwPpt/QVAQHzJwP/VG1E60TeZ8xtomW2VmKO/b/jV+a6orWT ebxhtlCX6CicVYtS0L4NBqcY8rQk8bcbeMXed3o5tY7B4FHwANml9Ubcbg7Wo7yL 2JvWI2E6M/4yfKIPuO0aqId57Qx5v36RiDAjZsozKhOJERTGasFJCOFOu/pMOa6M 36lWaXY0tyg= =PTUE -----END PGP SIGNATURE-----

1 0

Security flaw in Microsft Explorer
by Gary Howland 17 Dec '03

17 Dec '03

Program compromises IE security By Nick Wingfield September 23, 1996, 10:45 a.m. PT A start-up Internet company has posted a program on the Net that could allow Web sites to bypass the security controls in Internet Explorer, CNET has learned. The company, InfoSpace, created a program aimed at Net search engines such as Lycos and Excite that want to become the default search engine in Microsoft's Internet Explorer 3.0. But the program, which is actually featured on the Lycos Web site, manages to circumvent Explorer's security warning window--an action that could let InfoSpace sneak programs onto a user's personal computer without warning. Although the InfoSpace program apparently was not created with malicious intent, it underscores the fragility of Internet Explorer's security defenses, as well as broader security issues related to downloading software over the Internet. The InfoSpace program sidesteps a security feature in Internet Explorer, called Authenticode, which is designed to allow users to verify the origins of a piece of software code, such as an ActiveX control, a script, or a plug-in. The Authenticode system requires a user to entrust the developer of a program, whether it's InfoSpace, Lotus Development, or IBM, not to install viruses or other destructive programs on the user's system. Although Authenticode does not prevent software developers from creating such programs, they can be held legally accountable for bad code. That's because the programs contain "digital signatures," a sort of ID card that allows perpetrators to be tracked down by law enforcement agencies. Microsoft works with VeriSign to provide digital signatures for programs. Last month, VeriSign took matters into its own hands by asking a developer, Fred McLain, to remove an ActiveX control called Exploder from his Web site. The Exploder control was designed to crash a user's computer after downloading. "Code signing is not a guarantee of code quality," Charles Fitzgerald, a product manager at Microsoft said. "It's an accountability trail." As with all digitally signed programs, users are offered the option to accept or to reject the InfoSpace program before installing it on their systems. Users are also offered the option to bypass the Authenticode warning window for all InfoSpace programs in the future. But the company's program registers InfoSpace as a "trusted publisher" in Explorer, effectively opening the browser to intrusions. The operation is akin to inviting a guest over to your house for dinner and having them copy the key to your front door without permission. InfoSpace executives denied that there was any malice intended in its program, adding that it has provided Lycos with an updated version of the code. Lycos plans to post the new program later this evening, according to InfoSpace. "It was a bug that got incorporated into the production code," InfoSpace CEO Naveen Jain said. Lycos CEO Bob Davis said he was not aware of the bug in the InfoSpace program and could not comment on it. The program is identified as Lycos Quick Search on the search engine's site. However, Microsoft officials expressed concern, saying it is hard to defend against once a user has consented to download code from the Net. "Clearly their software is doing something a tad aggressive," said Rob Price, a group program manager for Internet security at Microsoft."[With Authenticode], users are making a one-time trust decision, this is a persistent trust decision." Microsoft argued that Explorer provides better security than Netscape Communications' Navigator, which does not currently allow digital signatures on plug-ins. In Explorer, users are warned before downloading code even if the program does not contain a digital signature, though the source of the program is not identified. In contrast to plug-in software and ActiveX controls, Java applets are prevented from damaging a user's computer through built-in restrictions in the Java Virtual Machine. "Java is the model for dynamic executable content on the Net," said Eric Greenberg, group security manager at Netscape.

1 0

Re: Go away CIA
by Wayne H. Allen 17 Dec '03

17 Dec '03

At 08:45 AM 9/23/96 -0400, Wearen Life wrote: >The CIA has many powers both great and small. If the can cover up findings >of UFO's Has this list sunk that low? Wayne H.Allen whallen(a)capitalnet.com Pgp key at www.capitalnet.com/~whallen

2 1

Re: AP [NOISE]
by jim bell 17 Dec '03

17 Dec '03

At 10:10 PM 9/23/96 -0400, hallam(a)vesuvius.ai.mit.edu wrote: > >Jim, > > I do support the presence of troops in Northern Ireland and >do not consider that to contradict my belief that there should be a >united, autonamous Ireland. I do not believe that the "loyalists" are >in fact loyal to the British way of life, any more than the KKK are >representative of the US south. > > Troops are in Northern Ireland for a very simple and depressing >reason. People like Jim want to impose their will on others by force. Quite the contrary. I want to reduce, as much as possible, the ability of people to impose their will on others by force. Read my essay. Eventually you might figure it out. The difference is, I recognize that if you set up a government to try to minimize non-government violence and coercion, you'll get just that: A minimization of NON-GOVERNMENT violence and coercion, at the expense of vastly increasing the GOVERNMENT kind. And I don't consider that progress at all. >Despite prolonged attempts by each faction to assasinate the leaders of >the other they have been unsuccessful. I suppose it didn't occur to you that this is EXACTLY why this dispute has gone on so long? What if instead of being "unsuccessful," these attempts suddenly became 100% successful. Easy, even. Just push a button and the top guy on the other side dies. And you could do this as often as, say, once an hour, with all of his replacements. And the other side can do the same to your leadership. How long do you think it would be before people decide that maybe, they DON'T want to "step up to the plate" and get killed for the sake of their cause? >If terrorists trained by Lybia >and Syria are unable to assasinate at will then we can be sure thaqt Jim's >band of kooks is not going to get any further. Which means that you clearly don't understand the motivating factor of a large, totally anonymous e-cash payment. And why should a handful of "terrorists" be successful? The "AP gang" will consist of 5 BILLION people who want to collect the reward, including anyone close to the target. It'll put an entirely new, ominous meaning into the phrase, "Friends and Family"! B^) >If the integration of both Irealand and the UK into the European >Union has not ended the situation the complete lack of government >will not either. Hell, the whole reason for this dispute is heirarchical social systems, in this case governments and religions! And adding the European Union merely increases the problem by adding to the heirarchy. My solution eliminates the heirarchy, totally. Why, then, should EU's failure imply a failure by AP? It's the diametrically opposite tactic. > It is suprising that someone from the press has not seized upon Jims >ideas as cause for another cyber-scare. I suspect this is because people >like Markof are somewhat more responsible. No, it's probably because they think, nervously, that I might just be right. Even that won't necessarily want to make them want to associate their names with my ideas. If they truly understand them, they'll recognize that it'll happen regardless of the amount of approval it gets from polite society. >This is not going to stop me >from producing an op-ed piece linkiing the net libertarians to assasination >politics unless I hear a few more repudiations of Bell's ideas. A doubt whether most people feel themselves obligated to repudiate a proposal, particularly if they don't know that it won't constitute an improvement over the status quo. On the other hand, if the world engineers a good, permanent solution to the Northern Ireland problem in the next six months, as well as the Middle East problem, the India/Pakistan problem, the Chechnya problem, the North/South Korea problem and a few other heretofore intractable problems, you can start feeling confident that my "extreme" solution will be avoidable. Until then, don't get your hopes up. >If you >don't very clearly reject his murderous ideas you are going to regret it >just as the left regreted having the USSR or the RAF associated with them. > Phill Time will be the best judge of this, I think. Jim Bell jimbell(a)pacifier.com

1 0