- cypherpunks-legacy - lists.cpunks.org

Something occured to me
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- About two weeks ago, there was some talk in here with regards to holding DC lawmakers crominally liable for passign bad laws. This was followed up with postins pointing out that you can't do that. However, this morning I remembered something. Whent he republicans took over the congress, they instidtued that Contract on America. One of the first laws that was passed (by both parties, I might add) was a law that made lawmakers abide by the same laws that "normal" people abide by. Does this change, in any fashion, the original idea? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMA+76DokqlyVGmCFAQEmdgQAsM6fAjnwWMDqCIHQG2HGp6ECY3ITexxr N8HFSTZUN7C34fPhAkTmUgalSKbv15Pcca8QXTutXTxhBAXsbTn8rCuQNhdjzigN pXl77a/KRkQqkMCED9DoRkemD3Pt4zPAtQDJbcHmSfokovUSr0q0cFZF8aveCmAB hEyRQEIFgAo= =Ha4N -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> Cthulhu Matata \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> hayden(a)krypton.mankato.msus.edu \/ Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden

5 4

Re: Ssh "security hole": proposed fix
by David Mazieres 17 Dec '03

17 Dec '03

Well, a while ago I suggested the following as simplified (and therefore easier to find bugs in) ssh protocol: > PREAMBLE: > > (1) A -> B: A > (2) B -> A: Cb, PKsb, PKb > (3) A -> B: {Kab}_PKsb, {A, B, Cb}_Kab > (4) B -> A: {{A, B, Cb, Kab, PKsb}_SKb}_Kab > > SSH_AUTH_RHOSTS: > > (5) A -> B: 0 > > SSH_AUTH_RHOSTS_RSA: > SSH_AUTH_RSA: > > (5) A -> B: {{A, B, Cb, Kab}_SKa, PKa}_Kab > > SSH_AUTH_PASSWORD: > > (5) A -> B: {Ka}_Kab I was assuming that you would basically have to tolerate man-in-the-middle style attacks if A did not know PKb before the exchange. However, I have since realized that it is easy to have one's public key in an NFS mounted home directory when talking to a host one has never talked to before. Thus, B can know PKa even if A does not know PKb. This is enough to prevent man in the middle attacks if we modify the protocol slightly: PREAMBLE: (1) A -> B: A (2) B -> A: Cb, PKsb, PKb (3) A -> B: {Kab}_PKsb, {A, B, Cb}_Kab (4) B -> A: {{A, B, Cb, Kab, PKsb}_SKb}_Kab SSH_AUTH_RHOSTS: SSH_AUTH_PASSWORD: (5) A -> B: 0 SSH_AUTH_RHOSTS_RSA: SSH_AUTH_RSA: (5) A -> B: {{A, B, Cb, Kab, PKsb}_SKa, PKa}_Kab ^^^^ IF AUTHENTICATION NOT SUFFICIENT: (6) B -> A: {"Passwd:"}_Kab (7) A -> B: {Ka}_Kab ; Ka is A's password David

5 4

A.Jensen doesn't like Sympatico.ca
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

What do Timmy May and A.Jensen have in common? They hate Toto's ISP: From: pavanas(a)meridio.ccia.com (pavanas abludo incusus) Newsgroups: news.admin.net-abuse.email Subject: Re: Addresses for sympatico.ca and netcom.ca Date: 16 Jul 1997 00:02:54 GMT Organization: Aragorn Asteria Lines: 45 Message-ID: <slrn5so3sq.jr.pavanas(a)meridio.ccia.com> References: <5qfv4p$ce3(a)camel3.mindspring.com> <33CBE926.495E(a)swva.net> <33d6f xt.36276030(a)news.erols.com> Reply-To: pavanas(a)bbs.mpcs.com X-Newsreader: slrn (0.9.4.2 UNIX) Path: altavista!news1.digital.com!data.ramona.vix.com!sonysjc!sonybc!newsjunki xtns.net!newsfeeds.ans.net!portc02.blue.aol.com!bignews.mediaways.net!news-han xtfn.de!newsserver.rrzn.uni-hannover.de!baghira.han.de!news.rz.uni-hildesheim. xtfu-berlin.de!nntprelay.mathworks.com!infeed2.internetmci.com!newsfeed.intern xtci.com!news.alt.net!pavanas On Tue, 15 Jul 1997 22:07:46 GMT, Roswell Coverup <Majestic7(a)ALIENcryogen.SPAMcom> mused and hath written: > >On Tue, 15 Jul 1997 17:18:30 -0400, while digesting the latest ration >of Spam & UCE "Patricia A. Shaffer" <ramsa(a)swva.net> wrote: > >> >>I've(a)Enough.Of.It wrote: >>> >>> Anyone have complaint addresses for these? I can't seem to find any that w xt. >>> >>> btw, Anyone noticed increasing spam from Canada? >>> >>> ...... >>> :)avid >> >>Yes, sir ... about a half-dozen in the last week. One complaint sent to >>sympatico's Administrative Contact bounced back "user unknown". I had >>sent to postmaster as well, and that didn't bounce ... I'm learning ... >>but no response, yet. >> >>Patricia > >I have never received a response from sympatico - they are a spam >factory. > > And then some... Despite repeated attempts I have never managed a response of any kind from anyone at sympatico. Consider them a write off. >-------- >JOWazzoo..aka Roswell Coverup >BlueLister Tracker Downer - Robert. whatcha gonna do when they come for you?? >Very Disturbed Nerd,InterNUT BlueList,NetScum & NJ Swearer List >Fight spam, support Rep. Chris Smith's TCPA extension by joining >CAUCE: http://www.cauce.org cheers -- IHS pavanas We are but dust and shadow. Quintus Horatius Flaccus --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

3 2

Re: big word listing
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

AS> > <process-ID.clock@hostname>password AS> > AS> >and sends it to the server as "APOP username 58349485whatever89583449". AS> Of course, this requires the user password to be stored unencrypted on the AS> server; which you may not want to do. Here's a variation, then: Instead of using process-id.clock to generate the random stuff for the challenge, have your own (P)RNG make up a bunch of them ahead of time, calculate the hashes, and store the challenges and hashes on the server. The password file is kept encrypted, and only decrypted to run the above. You could even do the whole thing by remote access, making up a batch of id: pairs of challenge/repsonse on one machine, encrypt the thing and send it to the server via remailer chain. The reason for the "stealth" bit is because the locus of control is moved to the remote machine, which may itself fall prey to attack. So, the supervisor needs to login as a Mere User (could have several accounts like this, and/or change them frequently) so as to not leave a trail of bread crumbs back to the cottage. * Long, long ago, in a tagline far far away... --- * Monster(a)FAmend.Com *

1 0

About your online business.
by 05551984＠turboma.dyn.ml.org 17 Dec '03

17 Dec '03

---> Do you run an online BUSINESS? ---> Are you interested in electronic MARKETING? ---> Do you want to dramatically INCREASE your SALES? Keep reading... we will explain you how your business can take advantage of bulk e-mail's incredible power! Dear fellow online entrepreneur, If you're like me, you're certainly very enthusiast about the Internet's possibilities. However, we all know that the biggest challenge is to give our sales material a decent visibility. With all those competitors around, you must take action to reach out for customers, to directly reach your potential buyer. You probably already tried dozens of different ways to promote your online business... Search Engines are now overloaded and unlikely to bring much business... Online Malls are expensive and they often won't bring you sales... Newsgroups promotion is now out of question. You need a media that directly reaches out for the customer. You need to use bulk e-mail. Imagine... your sales pitch sent to thousands of potential buyers. It's almost like a virtual flyer distribution. And the best part is that you won't have to spend much to take advantage of this incredible marketing tool. Here's a glimpse at our prices: - 100,000 mailings: only $69.95 - 1,000,000 mailings: only $249.95 To get full details and contact information, just write any message to our automatic autoresponder: siminfo(a)answerme.com Again, all you have to do is to send us any e-mail at siminfo(a)answerme.com You will then receive all information via e-mail within minutes. Bulk E-Mail will turbocharge your business. Don't delay. Act now! Yours trully, Pierre Roussil - SIM Inc. PS: Request the information NOW to take advantage of our HOT limited time offer! ***************************************************************** If you wish to be removed from our mailing list, please write us at simrem(a)answerme.com . You will receive a removal confirmation via e-mail. Thank you. *****************************************************************

1 0

CALLER ID AVOIDANCE
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, While reading the July issue of Soldier of Fortune, I ran across an ad for yet another telephone anonymity service. It reads: CALL 1-900-CUT TRAX Secure your most sensitive calls from all forms of caller I.D. and return-call technologies? Now make calls from your own telephone safely and anonymously. No need to find a public phone to be discreet. Trackers never see your number...only ours! And their number will not appear on your phone bill. Call any number in the continental US... Just $3.95 a minute for safe secure conversations! Call 1-900-CUT-TRAX (1-900-288-8729) Beacon Telesystems 914-423-3329 Not necessarily as secure as they would have you believe, but it does demonstrate there is a market for anonymity, I guess. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 4

Now You Can Own a 'Munitions Tshirt'
by dhenson＠itsnet.com 17 Dec '03

17 Dec '03

Now you can wear a TSHIRT that has been classified as a MUNITION by the US Goverment. That's right! The US International Traffic in Arms Regulations (ITAR) makes exporting cyrptographic materials illegal. ITAR further defines export as providing cryptographic information to a non-US/Canadian citizen even if you are inside the US at the time. Providing information is further defined as telling or showing information to a non-US/Canadian citizen. The Munitions Tshirt has a Perl implementation of the RSA algorithm (the one used by PGP) printed on the front along with a bar-code of the same algorithm. What all the above means is that if you wear the Munitions Tshirt where a non-US/Canadian citizen can see it, even if it is inside the US, you have just exported cryptographic material (which is already freely available outside the US) and have become a criminal in the eyes of the US Government. Now you too can become an international arms dealer for the price of a tshirt (US$15.95 - US$19.95, depending on size) and the guts to wear it. If you are a non-US/Canadian citizen, you can still own a Munitons Tshirt by ordering the tshirt from a source that is outside the US. The email response to a request for info (see next paragraph) includes full instructions for ordering the tshirt no matter where you live. For more information on how to own this classic example of civil disobedience, just send email to dhenson(a)itsnet.com with the subject of 'SHIRT'. (You don't have to be a US/Canadian citizen to request the info.) Or, if you have WWW access, just point your Web browser to: http://colossus.net/wepinsto/wshome.html By the way, 25% of the profits from the sale of the tshirt (in the US/Canada) goes to the PHIL ZIMMERMANN LEGAL DEFENSE FUND to help defend the author of PGP from harassment and possible prosecution by the Fedgoons. And if you get arrested for wearing the Munitions Tshirt, we'll refund your purchase price. :-) Get your Munitions Tshirt now. Who knows how long they'll stay in production! Don Henson, Managing Director (PGP Key ID = 0X03002DC9) West El Paso Information Network (WEPIN) Check out The WEPIN Store at URL: http://colossus.net/wepinsto/wshome.html

1 0

Re: An idea about Java and remailer clients and servers...
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Phil Fraering writes: > Does it have to be the case, then, that we even have separate client > and server versions? If a new program is going to be written in > Java, can't it have the functionality of both client and server? > > Why not "charge" for the ability to send an anonymous message with > the duty to have for a short time (maybe an hour or two) running > on your machine a node in a remailer network? Futplex writes: > It would be interesting to see how the market would react to this. > There might be quite a bit of reluctance to take on the liability > of a remailer operator just to send an anonymous message (maybe > that's a good thing ;) Running a remailer is forbidden by many ISP usage agreements. Many of the potential users of a remailer may not be able to 'pony-up' a few hours of remailer operation lest they loose their account. I thought the idea was to get more people using the remailers, not fewer (perhaps just fewer abusers)... Also, users must be aware of a remailer (and have its public key) to use it. I suppose you could temporarily add the user to a web page which clients checked for a list of current remailers. However, there are issues of reputations of long-running remailers, etc... andrew

1 0

NOD_off
by John Young 17 Dec '03

17 Dec '03

7-24-95. NYPaper: "For I.B.M. Faithful, Questions About Windows 95." These are difficult days for OS/2 users."Every time I say I am an OS/2 user, I get immediately marginalized," an elderly woman confided to a young man sitting next to her at last week's OS/2 World convention in Boston. "It's amazing what saying you are an OS/2 user brings out in people." "You just have to explain that you are at the cutting edge of a powerful new technology," the young man advised her with a heavy dose of sarcasm. WRP_spd "Computer Pornography Hearing Will Not Include Expert Witness." The principal researcher in a computer pornography study will not testify at today's Senate hearing on children and computer pornography. Senator Charles E. Grassley, Republican of Iowa, removed the researcher, Marty Rimm, from the witness list late last week, after Carnegie Mellon University announced a formal investigation into whether Mr. Rimm and his faculty advisers had violated academic and ethical guidelines in preparing and publishing their study. WIT_les 1 +1: NOD_off

1 0

re: big dictionaries
by Chris Gorsuch 17 Dec '03

17 Dec '03

Bill, Good point about using a "slow" hash algorithm. A "dictionary" attack on the hash should fail because, in order to currently use the password the old password had to not be in the dictionary in the first place. However "keyspace" attacks (brute force) would still be quite feasible. Would probably want to put something similiar to a salt in there to help increase the keyspace. Keep in mind that the only reason I suggested a hash at all is to prevent an admin who, in general, would not go through the effort to replace login/password or install a sniffer to get your password, but might be "unnecessarily" tempted by having easy to access passwords stored in plaintext on the server (still in a file only the admin could read). Basically just as a method to keep honest people honest. To verify that a user wasn't using a variation on the original, you would want to only store the hash of the original, but do hashes of the variants on the "new" password and compare with the stored hash of the old password. And of course, only store a password AFTER it has been changed. Really paranoid admins should use challenge/response/one-time passwords with/or kerberos. chris gorsuch chrisg(a)ti.com

1 0