- cypherpunks-legacy - lists.cpunks.org

Netscape Security Lies
by source＠iaccess.za 17 Dec '03

17 Dec '03

We have just tested Netscape's security page and it seems they are either lying or have a major bug. All you have to do to confirm this is to go to their page http://home.netscape.com/newsref/ref/netscape-security.html#test and click on the link under the heading Testing the Secure Server link "Here is a secure server you can visit. Do an iptrace and analyse of the interaction between the server and their browser version 3.05bgold and 3.05b, of which both reports that they are not even running a secure version of the server there. We decided to test further and found that the RSA secure server is only SSL 2 and SSL 3 which is what Netscape seems to be touting to the resting of the world saying they have it NOW. Later, if not much later seems far more realistic. I do not like being lied to, mislead or steam rolled by, how about you?

3 2

Re: "privatizing" phones?
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

>> Even if they did change the frequency the call was on, >> it would be a simple matter to decode how the frequency >> change was negotiated, and "follow" the call (also easily >> accomplished with cellular calls). Failing that, there is >> a very limited range of frequencies allocated for cordless >> fones, and simply re-scanning for the conversation is a >> trivial inconvenience. //cerridwyn// >Most of those systems do also change the order of the transmitted data, and >that's not limited to a few possibilities. If it's digital, they usually >encrypt it (only weak, but hey, you normally have to find the key real >time!) Right. After posting that, I realized I forgot to specify I was only referring to analog cordless/cell fones. Digital is a bit of a different story, as it requires more sophisticated equipment to decode. Still not secure though. (right now it's simply obscure). //cerridwyn//

1 0

Some Questions RE: Nortons For Your Eyes Only
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Tue Jul 30 06:40:47 1996 For those of you who have not heard it, Norton's For Your Eyes Only is a piece of software designed to integrate several encryption functions into Win95. Among its features (as I understand it) are automatically encrypting/decrypting on the fly (ala Secure Drive), encryption of the HD boot info, Command auditing, and a hybrid crypto system based on RSA. Several symmetric algorithms are available including RC4, 3DES and Blowfish. Non-US versions do not include the strong crypto algorithms. I only have second-hand information about this program and have a few questions regarding it. 1. Apparently, For Your Eyes Only (FYEO for short) encrypts files using a user-selectable symmetric algorithm and then encrypts the session key with RSA. Does FYEO store this encrypted session key with the rest of the file (like PGP does), or does it keep a central database of encrypted session keys? Keeping the session keys centrally would obviously prevent sharing files across machines, so I imagine that they must be appended (or prepended) to the ciphertext. 2. From what I understand, FYEO prompts you to enter your passphrase when logging in and this passphrase unlocks your RSA key. What algorithm is used to encrypt the RSA key? I am concerned that an exportable (and therefore weak) algorithm is used to protect the RSA key. This would mean that the RSA key could be readily hacked. And if the RSA secret key can be hacked easily, it will do no good at all to have strong encryption on the files themselves. 3. Does FYEO include any kind of authentication system. If so, what signature and message digest algorithms does it use? Thanks. - -- David F. Ogren | ogren(a)concentric.net | "A man without religion is like a fish PGP Key ID: 0x6458EB29 | without a bicycle" - ------------------------------|---------------------------------------- Don't know what PGP is? | Need my public key? It's available Send a message to me with the | by server or by sending me a message subject GETPGPINFO | with the subject GETPGPKEY -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMf3msOSLhCBkWOspAQHN4gf9HeVeJ6a6oKwdmtwcHhFT0cnMjdFIjP4V zcc7Is7qPSMFTZy+1+IwITiXPUugHdxeJbI2JvUyfptbjllfqvacNGy54iIqRZhz DPqaQkeZ8hjj843kZQB1/tmcA+np3jR6C3p3s5PC8np8Ld36J8rQZ6DVNi3XSoSh 6rOXlQKpmxZgq2gtCK+wydG39rvMsKDYo+ATqHZbX+0lryi3+4RI6Yi4185rrMW4 8iMwZs7VHFnl7sicaIro101Gc3xmrMzj+lRfa0kR1G3Ek2x9I7TArKRmcz2qonZM dUJivrjf52rUK+9Mi95HzeI6Sakb6iSIBaP7OO3w/IIIV1W6ufiqIg== =M3JW -----END PGP SIGNATURE-----

1 0

fbi, crypto, and defcon
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

At this year's DefCon (last weekend), there were two speakers from the recently created FBI San Francisco Computer Crime division. During a question/answer session, the question came up regarding their division's view on crypto as compared to the FBI's official view. They, of course, declined to answer on the grounds that they were instructed not to talk about it, and proceeded to explain how they just enforce the law, not create it (deftly ignoring the point made about Freeh's involvement in making laws). The question was rephrased: "How do you personally feel about exporting strong crypto", and again they refused to answer on the grounds that they were there as spokesmen for the FBI, but people could talk to them later and ask any questions they liked, and "the answers may surprise you". Evidence that maybe some goons really do have a clue, but are still too afraid to do anything about it... //cerridwyn//

1 0

The Ironic Arms Trafficker
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In the August 12, 1996 issue of Forbes, on page 38, is a half-page or so by Janet Novack titled, _The Accidental Arms Trafficker._ She quotes CEO Michael Zisman, of IBM's Lotus Development Corp. saying, "Theoretically, when I take my laptop and get on an airplane and go to London, I am violating the law." Goes on to talk briefly about ITAR and the quiet change by the State Dept. in travel rules, mentions Zisman is in DC lobbying for Pro-Code, calls 64 bit Lotus Notes encryption "advanced," and talks about competitors beating Lotus to market. [I suppose Zisman hasn't been listening to Dr. Sternlight or Freeh (whose head, say the Bethesda proctologists, is now stuck *even* *deeper*! ;}] Anyway, no mention of Lotus' Big-Brother Inside proposal, hence my use of the term "ironic." JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "Isn't it odd that Harry Browne is dominating talk radio ...while his campaign continues to be overlooked by mainstream newspapers and television news?" asked campaign director Sharon Ayres. "Is Harry Browne being deliberately ignored, or is the rest of the media just slow to catch on to this genuine grassroots political phenomenon?" she asked. "Both." I answered. [See the Miami Herald for no details.] Defeat the Duopoly! Vote "NOTA," not Slick/Dull in November. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray Coming soon, the "Pennies For Perot" page. Keep billionaires off welfare! ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMf3w+G1lp8bpvW01AQGs9AP/bRhHsroIfyfwOwxoprBmop0lFiRifBaF BA8mpxflDHKUnguuYEBiLKMVS4mW2F8O/tzg13iFlqnbljMTQnSCv3RxhSVL6vMo fcvekwAb0vh/GfumqqXWBupsap+YOoGI/4YIJgZBi/L4LfGlT++qCzdcRoHBSebQ YDAOPG6UaXw= =yB35 -----END PGP SIGNATURE-----

1 0

Taxes in the digicash world
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Hi Suppose that digital cash becomes easy enough to use and becomes the mainstream medium in most [or at least many] economic transactions. The question is, how can the government TECHNICALLY collect taxes? I do not mean to start `libertarianism vs. socialism' discussion, I am more interested in the technical aspects of tax collection when transfers of money are protected by strong crypto.. Let's say, maybe this tax would work: every time someone verifies that a piece of digital cash is valid, s/he has to pay the government a little percentage of the amount. Since digital banks are easier to control than other participants of the market, this kind of tax legislation is easier to enforce. Of course these banks may be offshore, and then such collection becomes problemstic. Another alternative that I see is property taxes and poll taxes,or taxes on some commodities such as oil. But incomes seem to be hard to track. What else? - Igor.

4 3

DESZIP
by Julian Assange 17 Dec '03

17 Dec '03

I am writing an historical piece on crypt(3) optimisation and password guessing heuristics. This naturally enough envolves tracking down and analysing various code/papers that have been seen as significant and/or infulential in those areas. In the late 80's Matt Bishop while at NASA, wrote DESZIP, which for a while was the seminal work. Matt has pointed me to a US summer 1987 article which describes some of the DES optimisations, however as I am an Australian national, Matt can not legally send me the actual implimentation to me due to idiotic ITAR restrictions. If someone not as constrained could address the problem described, I should be delighted. -- "Of all tyrannies a tyranny sincerely exercised for the good of its victims may be the most oppressive. It may be better to live under robber barons than under omnipotent moral busybodies, The robber baron's cruelty may sometimes sleep, his cupidity may at some point be satiated; but those who torment us for own good will torment us without end, for they do so with the approval of their own conscience." - C.S. Lewis, _God in the Dock_ +---------------------+--------------------+----------------------------------+ |Julian Assange RSO | PO Box 2031 BARKER | Secret Analytic Guy Union | |proff(a)suburbia.net | VIC 3122 AUSTRALIA | finger for PGP key hash ID = | |proff(a)gnu.ai.mit.edu | FAX +61-3-98199066 | 0619737CCC143F6DEA73E27378933690 | +---------------------+--------------------+----------------------------------+

1 0

Returned mail.No such addressee
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Tue Jul 30 14:55:00 1996 To: cpunks Date: Tue Jul 30 13:50:00 1996 Actually the archives from ftp.dsi.unimi.it have moved to: ftp://idea.sec.dsi.unimi.it/pub/ It's a very large repository and to hell with ITAR, it's italian. - --------< fate favors the prepared mind >-------- Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/remopini/rpcrypto.html - ------< words are what reality is made of >------ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMf4GJRFhy5sz+bTpAQHB7QgAo+IcNX+FIBW9bJsN3l9O7OIw5mFTQr+x LsvrNsSrTx0jVJaUIaLDh1BzBme9caBYDzdJl+LfAtjufvIBJPEl2+bYVz+aWoP1 BZtfVdmL7ZR4O+z2Q5/r+mnT+Q4OZSk78Zpo9dZd3syJZa2w89DUINA3CNcCoJ8G 33Y5coB5PJZluuywozJYcENneq41lDg5k2DxP79GHyXFLBHYKj7HwO2nUei0H9// FaXRcd9X0Qp0pKPm33lXiKNkAVSl+xtGk8F7BjYClL9F+WjZ1jaXMSKC3aImjRvP 1DeVlSsYF0Y2GYvubOTs45ueAPwVPAboDU3UXgRGblla0utlQ9kRTw== =UYHi -----END PGP SIGNATURE-----

1 0

Re: DESZIP
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 22:01 7/30/96, Julian Assange wrote: >In the late 80's Matt Bishop while at NASA, wrote DESZIP, which for a >while was the seminal work. Matt has pointed me to a US summer 1987 >article which describes some of the DES optimisations, however as I am >an Australian national, Matt can not legally send me the actual >implimentation to me due to idiotic ITAR restrictions. Did you try the Usual Suspects? There are numerous crypto sites in Europe. If none of them has DESZIP, would someone outside the US please upload it... -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: Clinton must like terrorists...
by koontz＠netapp.com 17 Dec '03

17 Dec '03

>Clinton must like terrorists... because his most recent proposals will end >up making more of them. Maybe he is trying to foment revolution?

1 0