- cypherpunks-legacy - lists.cpunks.org

announce: weaken for netscape !!
by Anonymous Sender 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello. since it is possible to fortify netscape navigator, it is also possible to weaken it. i'm releasing this patch to underline the fact that you should really think about the degree of trust you put in your crypto software or any modifications done to it by others. so what's this patch is ? this is WEAKEN for netscape (should i put a (TM) logo ? )! it makes crypto in ssl useless !! for people who dont believe me ... here's some tech details : during handshake, ssl client and server exchange two random 32 bytes sequences (Client.Random and Server.Random) in cleartext. when the client receives the server's public key (if the cipherspec uses rsa), it generates a 48 bytes random structure (this is the premaster secret) and sends it to the server encrypted with that public key. so if you can patch the software, how to make this schema useless ? just make the premaster secret predictible, since the master secret is a function of it, plus the two random structures which are available in clear to you (attacker) you may now ask why this is interesting ? after all, if an attacker gains access to your machine all the security is lost anyway. I released this to say that : 1- it is easy to fortify netscape, but can't verify that it really works (i mean you cant verify that it offers real 128 security, what is saied in the properties window in netscape after fortifying it is not a proof of security) 2- weakening netscape is easy ... but u can verify that it works !! 3- this is a very short byte sequence !! imagine what happenes if : 3-1 that sequence is propagated by a virus ! 3-2 your boss installs that sequence by night in your computer !! 3-3 some vendors already ship their software with the weaken sequence !!! enough with args, here is the stuff : this patch works on communicator pro export for win32, i downloaded the copy i worked on a few hours ago ... so by downloading the latest communicator 4.04 export, english from netscape's ftp site you will be able to weaken your browser ;) ... anyway if you want to be sure about your version before weakening it, download fortify, and run it's md5 program with following parameter : md5 -r 0x400-0x32ca00,0x384a00:0x58400 ...\program\netscape.exe there is a line matching the version i'm talking about in the "index" file you will find with fortify.exe (download the whole fortify from www.fortify.net) here's a copy from that line : 4096512 0x400-0x32ca00,0x384a00:0x58400 aea2aba6f731468e34fd1141f603ea20 pro 4.04 0 2 morphs-1.2 x86win32 (97325) netscape's executable size : 4096512 bytes by running md5 as indicated, you should obtain this hash aea2aba6f731468e34fd1141f603ea20 now this is the patch to apply : look for byte sequence : 52 88 8d e0 fe ff ff 8a 40 01 6a 00 88 85 e1 fe ff ff e8 9e 27 00 00 83 c4 0c 8b f8 and change with 6a 72 52 88 8d e0 fe ff ff 8a 40 01 88 85 e1 fe ff ff e8 cd 98 94 77 83 c4 0c 33 ff that's all !!!! in short, i'm changing a call to GenerateRandom to memset >;-) 72 is the ascii code for 'r' (my favorite char). if you can play with ssleay, you can change the ssl/ssl_txt.c, ssl/s3_srvr.c and ssl/ssl.h in order to keep the premaster secret in memory so you can display it in the output given by s_server -accept <port> -www good luck -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: cp850 iQCVAwUBNS59fpVRLpSyKBl9AQFQPQP/fxAuSA80MmLTZtkFI776HfTylXbhXbvM Eq6rWdEip7OhuaG8Nemjc+lVH95I+YRHqG5iHWdT9and1PhQ9QHGwxmWLVT8wa0x HlOVuoMK4BuyfwbcvYAXUwtdgbA6hcVXX/BD+jCPXhE+ZDYPbHGF+NRYaeBIhWRC x1QsId+jPQQ= =eOS5 -----END PGP SIGNATURE-----

1 0

weaken : contact the author
by Anonymous Sender 17 Dec '03

17 Dec '03

here's my pk, just drop me a message in the list -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQCNAzUuVR4AAAEEALkjQwGKIsBT16nqJbZsWiPOH6gfRkzFav0RmWgjBu/bjDKe PmC2aGoQV2FXFYGGnX0bHyBz8Qjewdb7aDg/MQsAXjxsSZvqxNEkXGa6bH4U/Fe8 32WBddLrScc6vikaPv0o3D8bgzr+qQM0s9FSP4n5Jb+N/y2YjJVRLpSyKBl9AAUR tAVtYXJrb4kAlQMFEDUuVR6VUS6UsigZfQEBI9AD/RM6l/Gmw3+IPNQ1fRSFAME3 ZLoWUC6mAW5kUP0IaOFD/tXGXT+ekehcFojHpk9/QIO1mVpxr3bp97/ETZb1ZJiS EHTEjAP/85gja/YlRubfihUUb5/MoIz94a+MWsoDB0qLDJbQ48vyNsftNDrolUFf KUdCME7v3al/m6c0wufP =Bnx/ -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: A Libertine Question (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 2 Aug 1996 19:09:25 -0700 (PDT) > From: Sandy Sandfort <sandfort(a)crl.com> > Subject: Re: A Libertine Question (fwd) > > > A reasonable person recognizes that such a business has two ways > > of fulfilling its responsiblities. They can either submit to > > regulation and quality control from the local municipality or > > else they can hang signs about their place of business declaring > > "Caveat Emptor: Our food may be tainted, eat at your own risk". > > Which do you think is the more reasonable? > > It would be nice if businesses were offered that choice. I would > choose the second, myself. Only my sign would say, "Our food is > guaranteed not tainted by the Acme insurance company, not some > corrupt government." The problem is, governments do not allow > businesses nor consumers to make that sort of choice. With them > it's, "my way or the highway" (or harassment and jail actually). And any insurance company with a whit of sense would charge you rates so high that your much touted small vendors and many of the medium sized vendors currently in business would not exist. You think governments are bad? Wait till you see a bunch of bean counters racing a profit margin. In such a situation we wouldn't even have the opportunity for input into the system via constitutions, charters, and votes. Just imagine how much support a Japanese insurance company would provide its clients in regards to the current epidemic in Japan, absolutely none because it is better the little vendor go out of business than the insurance company. > Until Jim shows me a business that isn't owned and operated by > people, I'll have to respectfully disagree. Businesses are just > people acting alone or in concert. Actions are what count, not > whether the action is of a pecuniary nature or not. I own 2 businesses (CyberTects & Linux System Development Labs) and work for another (Tivoli - IBM), none are equivalent to my person. Businesses are a system of rules and procedures that one offers another person in exchange for some other commodity. Saying a business has the same rights as a person is equivalent to saying the Empire State Bldg. has civil rights because persons built it and occupy it. My dog has a better argument for civil rights than any business, it breaths and shits. Would you seriously give my dog a vote? I shure won't, and I won't support any business with rights. Jim Choate

5 4

Re: SOUP KITCHENS (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 2 Aug 1996 14:10:55 -0700 > From: tcmay(a)got.net (Timothy C. May) > Subject: Re: SOUP KITCHENS > > (Fortunately, people survive all kinds of dirt and germs. If dogs and cats > can eat stuff off the floor, and our ancestors did before hot water, soap, > and autoclaves, then so can we. Not to mention children. But I digress.) True enough, but not the whole story. If a dog or cat is kept well and fed good quality food they live 10+ years. The average life of an animal on the street is between 2-5 years. As to people, we now live around 75-80 years, prior to all these rules and regulations on food and such the average was 20-25. If we go back to what you propose you would be dead a long time ago. > The use of zoning and health code ordnances to harass certain classes of > people is nothing new. Like I said, the Boy Scout Cookout and similar > "good" events are not bothered by City Inspectors descending on them to > shut them down. In my experience they don't get hassled because they get the requisite permits and act in good faith. Many of these small businesses and street vendors are 'hassled' because they are unwilling or unable to meet basic commen sense standards of conduct and go out of there way to circumvent regulations and in some cases commen sense. I have a friend who worked at a local strip club on N. Lamar (Yellow something...) up until a few weeks ago. Seems one of the workers there turned a freezer off and as a result some meat was tainted. Did they throw it out? Hell no, they went ahead and served it because to do othewise would effect their profit margin. My (and by extension your) life is not worth a few measly bucks. My friend complained bitterly and when they went ahead and did it he quit and filed a complaint with the local health dept. (I am completely unaware of the result but the club is still open). I once got food poisoning from a Vietnamese food vendor on the West Mall at UT Austin and complained and called the Health Dept. Last time I was down on The Drag (the popular name of the street) the same vendor was still in business and this was over 10 years later. And for the record I have bought food there, I have just become more careful about its taste and quality. > Further, in time past the operation of a "street food" service (hot dogs, > ice cream, various knoshing items, etc.) was a way for otherwise poor > persons to start a business. My own city, Santa Cruz, has no pushcart > vendors, and only one officially-approved sidewalk hotdog vendor. A loss > for us, a loss for would-be vendors, and with no gain in "food safety" that > I can plausible see. Why do they prohibit permits for these types of businesses? > I actually think this shows another side of the harassment of food > giveaways and low-cost vendors: it cuts down on competition with the > established food entities. While I tend to dismiss "corporate conspiracy" > theories about how Giant Corporations are repressing and suppressing the > Little Guys, there is little doubt that licensing, zoning, and other > governmental restrictions are often used by established entities to keep > out competition. Licenses get used for what economists call "rent-seeking" > behavior. You should be more careful about who you pick to represent you then when you vote. Here in Austin back in the 80's the big thing was to move the airport out of town. So many of the public officials rushed out and bought land near the little town outside Austin in the hopes that the airport would be moved there. It was so bad we had many elections where the citizenry voted not to move the airport and the city council went ahead with the actions anyway. Finaly a few years ago the feds closed Bergston the local airbase and the entire rationale for moving the airport fell through and now all those people have retired from local political actions because they are all broke. > (Examples abound in other areas, too, such as where large chip companies > like Intel actually relish the vast amounts of paperwork they are required > to fill out, becuase this overhead and legal burden can be handled by their > buildings full of paper pushers, but helps to keep small companies from > entering the market. Intel has actually insisted that small companies file > the same environmental impact reports, labor reports, etc., that they have > to fill out. Understandable at one level, but also an example of using "the > system" to put pressure on upstarts. Or, the rent-seeking of professional > guilds, well-known to all of us.) I personaly find it reassuring that some bunch of knuckle-heads are unable to start a chip making facility like you support. The thought of finding flourine compounds in the local river (where I get my tap water) or simply dumped in the air is a little unsettling. Just because some group of bozo's want to start a business is not sufficient justification for that to be allowed. It seems to me that many of the folks who recognize downsized workers pleas for their 'right to a job' as so much bunk are at the same time supporting a businesses right to start up. A pretty humorous double standard. Persons don't have a right to work and businesses do not have a right to start up unless they can meet reasonable levels of responsibility for their actions. People and by extension businesses do not have the right to harm others without their prior consent. As an extension of this, people have a right to limit the ways and means that a business may use in order to operate. > As to Alan Horowitz's bizarre notion that "public streets" are not to be > used for giving away food, I have never heard of anyone being arrested for giving away food, only selling it without a license. I bet the Salvation Army soup kitchen would be worried if this claim were true (they aren't and it ain't). > does he believe the same to be true of giving > away speech, giving away ideas, passing books to other people, etc.? "There > are bookstores for selling or buying books, and anyone who engages in this > sort of action on a public street will have his attitude adjusted with my > billy club." I am unaware of any municipality which prohibits giving away books, they regulate bookstores because they are a business and engaged in commerce. If you are aware of a municipality (or any list reader for that matter) I would appreciate being informed (ie mail me privately). > "Public" areas cause problems for analysis of rights, I will grant. The > "commons problem" is well known. But I think that the specific cases we've > been discussing, of whacking bums with nightsticks for the crime of not > maintaining "proper decorum," and of Food Not Bombs being shut down while > the Boy Scouts are not, are clear cases where the law is being misapplied. And your argument that a business should have the same rights and considerations as a human being is bogus. If that were true then by extensio governments would have rights, which they don't. Unless you breath and shit you don't have rights, only duties and responsibilities assigned by the persons who built the system. A structure is not equivalent by any stretch of the imagination as the person(s) who built it. Jim Choate

1 0

FAA to require transponders on all aircraft passengers
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

According to KCBS, a local radio station, the FAA has closed a long anticipated deal with a manufacturer of transponder devices. The goal of the system to be deployed nationwide is to match aircraft passengers to their luggage and thereby identify unaccompanied luggage on board an aircraft. Transponders will be affixed to all items of luggage and all passengers. If the system discovers a transponder on the luggage in the cargo hold without the corresponding transponder on the passenger on board, an alarm will sound. I am not making this up. As many of you know, I have long predicted subcutaneous transponders to become widely deployed in the near future. First for child identification and monitoring of criminals, then, as the children grow up, as universal ID, driver license, proof of eligibility for employment, PIN substitute, etc. Today, we moved a step closer to this future. [Note that the transponders will have to be affixed to the passenger. An example would be a hospital style bracelet that stops working when removed. Why embedding the transponder in a hand carried item, such as a card, will not work is left as an exercise to the reader. Even an affixed device does not provide perfect security. You'd really have to embed the transponder in the body at an early age to make removal nearly impossible.] -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

2 1

Re: fbi, crypto, and defcon
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:28 PM 8/2/96 -0700, you wrote: >Its up to you what you call it, but here is an interesting example: > >An international phone call costs about 2 cents/min to produce. The average >rate paid for by the consumer is 62 cents. That's means the carriers mark >up this particular product by an amazing 3000%. > >Can you name another business that has comparable mark-ups? Verisign? InterNic Domain name registration? Licence plates in Washington state? --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

Re: fbi, crypto, and defcon
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:20 AM 8/1/96 -0800, jim bell <jimbell(a)pacifier.com> reminded us: >Also: Clipper was fabbed by VLSI Technology. A few pointed inquiries might >work wonders here. It was made by Mykotronx, using tamperproof programmable gate array chips from VLSI, though I don't remember whether they were entirely programmed at Mykotronx+NSA, or whether they were mostly mask-programmed at VLSI first. On the other hand, if you _want_ to make a DES-cracker, at the time Clipper came out, VLSI was making a 192Mbps DES chip, and they may have faster stuff now. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Rescind Authority!

1 0

Re: Stop the presses -- Anti-terrorism bill not that bad
by jim bell 17 Dec '03

17 Dec '03

At 07:48 PM 8/2/96 -0500, Declan McCullagh wrote: > and black and smokeless powder taggants. Such materials will be easy to defeat. Find an indoor shooting range, vacuum up the powder residue that falls in front of the shooting stalls, and you'll have a concentrated mixture of literally hundreds of types of taggants. Add to bomb. Laughing, at this point, is optional. Jim Bell jimbell(a)pacifier.com

1 0

key escrow article on the Asahi Shinbun
by Hayashi_Tsuyoshi 17 Dec '03

17 Dec '03

I found key escrow article on the Asahi Shinbun. Asahi Shinbun is one of the most famous Japanese newspaper. I can't write more info because I am busy now. BTW, Asahi Shinbun has their own server: URL: http://www.asahi.com/. # English version is also available. - Tsuyoshi Hayashi <take(a)barrier-free.co.jp> - PGP public key: http://www.barrier-free.co.jp/take/pgpkey - (CF 27 34 5B 46 FA 2A 12 D2 4C E3 F7 2A 45 E0 22) - Barrier Free, Inc. (established on 25 Jan 1996)

1 0

Canadian CypherPunks SuckSeed From the Union!
by Canadian Nutly News 17 Dec '03

17 Dec '03

[Canadian Nutly News-Bienfait, Saskatchewan]CANADIAN CYPHERPUNKS LIVING in countries all around the world have seceded from the countries and societies surrounding their MeatSpace bodies and have formed Cult of One Republics based on freedom, privacy and the Dog-given right to piss on any source of heat that burns their ass... Inspired by the Nuclear Suitcase Full Of Dirty Shorts technology that was developed in a basement in Bienfait, Saskatchewan, by the Grand Pooh-Bah of Mongeritaville and activated recently at a hidden location near RCMP headquarters in nearby Estevan, the CypherPunks have been enlisting in increasing numbers in Army of Dog Private Guard units consisting solely of themselves. Bill Stewart, a naturalized Canadian CypherPunk, told reportwhores, while belching and patting his stomache, "I've got a powerful lot of gas backed up, and I'm not afraid to use it." Mercetan Mercantile, a Bienfait business buying bottles of bombmaking ingredients from a wide variety of chemical companies and hog farms around the world and reselling them to a specialized children's market, reports that the children they deal with are getting increasingly older as adults recognize the advantages of using revolutionary munitions that will allow them to be tried as children for their crimes. Members of the CypherPunks Disturbed Male List, famous for thier childish pissing contests, have long been suspected of using those pissing contests to distract attention from their development of secret StinkyEggFart technology and parallel technologies designed to raise a stink that can't be ignored. CypherPunk Jim Bell, living in a part of Canada south of Seattle, was instrumental in helping to promote the use of non-violent BadEgg technology to escalate the trend of Tyrannical Dictatorships (TM) toward violating the rights of its citizens to raise a stink and subjecting them to outrageously cruel and unusual punishment, as well as long periods of imprisonment for childish behavior. TruthMongrel, barking over a Sympatico InterNet connection that was raised from the dead by a Circle of Eunuchs member deep within the filthy bowels of the Canadian ISP, said, "Jim Bell is just a pawn in the game plan of the Forces of Light. Canadian CypherPunks have long been aware that he is a schill being run by a handler named Blanc Weber who has a hidden agenda of promoting a peaceful revolution." Attila T. Hun, hacking into TruthMongrel's Sympatico account, broke into his transmission to add, "Even Toto has been coming under the spell of Weber's goody-two-shoes virginal allure. He used to be a *real* man and a serious threat to the continued physical existence of Micro$not Mongul, Bad BillyC, and now he has turned into just another WinLoser95 user begging at the feet of his Redmond Puppet Masters, compromising his integrity by offering to only cut off three of BadBillyG's fingers in return for help making Micro$not's software work. "Next thing you know, he'll be offering just to slap BadBillyC around like a girl, in return for a free copy of WinLoser98." Blanc Weber, when reached for comment, dismissed Attila's claims, and grinningly told reportwhores, "That's ridiculous. Everyone in the Micro$not Memorial Branch Davidian Compound in Redmond knows that the MicroMaster likes to be *spanked*, not slapped." She added, with a wink, "There are rumors that the DOJ anti-trust action against Micro$not is just a business move by the MicroMaster to make his million dollar spankings by Janet Reno tax deductible." Tim C. May, a CypherPukes FartLoserForKing candidate, expressed disgust with the CypherPunks division into two camps, one advocating violent revolution and the other promoting biological development of a mutant strain of vegetable known to insiders as 'The Slime That Ate The Slime That Ate DC." "Fuck this shit...I'm going to NUKE something!" he shouted, pausing to add, "I just picked up a couple of items at the Dirty Shorts Munitions Show&Tell in Las Vegas which will guarantee that Slick Willy will never inhale again..."

1 0