- cypherpunks-legacy - lists.cpunks.org

You are entitled to a FREE Membership.
by DiamndJ63 17 Dec '03

17 Dec '03

To: DiamndJ63(a)aol.com Subject: You are entitled to a FREE Membership. From: DiamndJ63 <DiamndJ63(a)aol.com> Date: Sun, 19 Apr 1998 02:02:02 EDT Organization: AOL (http://www.aol.com) <a href="http://members.spree.com/divito/index.html">Click here to see naked women</a>

1 0

FW: get me off of this list!!!!!
by Herbert Feran 17 Dec '03

17 Dec '03

--- On Sun, 1 Sep 96 12:41:21 PDT Herbert Feran <porsche(a)themall.net> wrote: I need to be taken off of this list but I can't remeber the code to desubscribe. Can anyone tell me what the code is? ------------------------------------- Name: Herbert Feran E-mail: Herbert Feran <h7869755(a)themall.net> Date: 9/1/96 Time: 12:41:21 PM This message was sent by Chameleon ------------------------------------- -----------------End of Original Message----------------- ------------------------------------- Name: Herbert Feran E-mail: Herbert Feran <h7869755(a)themall.net> Date: 9/1/96 Time: 12:48:19 PM This message was sent by Chameleon -------------------------------------

1 0

RE: Workers Paradise. /Political rant.
by jim bell 17 Dec '03

17 Dec '03

At 02:00 AM 9/16/96 -0700, Timothy C. May wrote: >As to the "social safety net," things are far, far beyond a simple safety >net. When 14-year-old pregnant inner city girls are given money to set up >their own households (cf. Charles Murray's "Losing Ground"), this is not a >"safety net," this is subsidized breeding. A friend of mine (who can be just as coarse as I) calls them "Welfare-powered bastard factories." Jim Bell jimbell(a)pacifier.com

1 0

Re: Los Angeles Times article on Helsingius and anon.penet.fi
by edyson＠edventure.com 17 Dec '03

17 Dec '03

Before going into the merits of this, let me make two points: One I specifically asked the reporter (Amy Harmon) to quote me as an individual, not as a spokesperson for the EFF. (It was Amy Harmon, and the only address I have for her bounces, but as you can imagine I would like to get in touch with her! Anyone know it?) These are my personal views; EFF has no formal policy on this yet -- precisely because it's a complex issue. Now, speaking personally: I believe there are trade-offs -- which is what I told the LA Times. I assume I was quoted accurately (although the word "enforce" is awkward), but out of context. Anonymity can be dangerous -- as can traceability, especially in/by repressive regimes. Therefore I would favor allowing anonymity -- with some form of traceability only under terms considerably stronger than what are generally required for a wiretap. Anyone who seriously needs anonymity because of a repressive government is likely to use a foreign (outside whatever jurisdiction he fears) server, so that this is not a matter of "local" laws. The tracer would have to pass through what I hope would be tighter hoops than we have now. Please note that this is not the same as the right to *private* conversations and the use of encryption; this is the issue of being accountable for what you publish in public. My assumption is that there will be a wide variety of Net communities with different rules/regulations/attitudes towards anonymity that would apply ex some kind of international sanctions; I think that's appropriate. Yes, I'm aware of the complexities, and of the possibilities for miscarriages of justice. The world isn't yet the way I want it to be. But I wanted to respond reasonably promptly. BTW, I would welcome a chance to read the whole article (or at least a *little* more of the context, under fair use). Speaking for myself, only (and publicly), Esther Dyson At 06:40 AM 9/1/96 -0400, Dave Farber wrote: >>Posted-Date: Sun, 1 Sep 1996 14:59:53 +1000 (EST) >>Date: Sun, 1 Sep 1996 14:59:53 +1000 (EST) >>From: Charles Senescall <apache(a)quux.apana.org.au> >>To: cypherpunks(a)toad.com >>Cc: declan(a)well.com >>Subject: Re: Los Angeles Times article on Helsingius and anon.penet.fi >>Sender: owner-cypherpunks(a)toad.com >> >>On Sat, 31 Aug 1996, Declan McCullagh wrote: >> >>> The attached article was reposted to fight-censorship with the permission >>> of the Los Angeles Times, which ran it on the front page today. >>[snip] >>> Note Esther Dyson's comments: >>> >>> "The damage that can be done by anonymity is far bigger" than in >>> any other medium, said Esther Dyson, chairwoman of the Electronic >>> Frontier Foundation. "In the end, you need to be able to get at >>> somebody's identity to enforce accountability, and the question is how >>> do you also enforce freedom of speech and freedom from prosecution for >>> unpopular opinions." >> >>Is this _really_ the EFF policy on anonymopus remailers?? >> >>I will check with our local version of the EFF and see what they have to say. >> >>If the EFF is not for anonymity it needs to be publicised. Perhaps the >>EFF has been in bed with the political pigs too long. *OINK* >> >>-- >> .////. .// Charles Senescall apache(a)quux.apana.org.au >> o:::::::::/// Fuck TEL$TRA >>>::::::::::\\\ Finger me for PGP PUBKEY Brisbane AUSTRALIA >> '\\\\\' \\ <A HREF="http://quux.apana.org.au/~apache/"> >> >> >> >> > > Esther Dyson Always make new mistakes! EDventure Holdings <edyson(a)edventure.com> 1 (212) 924-8800 1 (212) 924-0240 fax 104 Fifth Avenue New York, NY 10011 USA www.edventure.com High-Tech Forum in Lisbon, October 27-29, 1996 PC Forum in Tucson, Arizona, March 23-26, 1997

7 6

Edited Edupage, 15 Sept 1996
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"educom(a)educom.unc.edu" 16-SEP-1996 10:15:59.50 >To: IN%"edupage(a)elanor.oit.unc.edu" "EDUCOM Edupage Mailing List" >************************************************************ >Edupage, 15 September 1996. Edupage, a summary of news about information >technology, is provided three times a week as a service by Educom, >a Washington, D.C.-based consortium of leading colleges and universities >seeking to transform education through the use of information technology. >************************************************************ >SATELLITE BROADCASTERS MUST PROVIDE EDUCATION, TOO >A federal appeals court in Washington has ruled that any company providing >direct broadcast satellite (DBS) services must "reserve a portion of its >channel capacity, equal to not less than 4 percent nor more than 7 percent, >exclusively for noncommercial programming of an educational or information >nature," in compliance with regulations drafted by the FCC to enforce laws >enacted in 1984 and 1992. The unanimous decision rejected arguments by Time >Warner and other broadcasters that the law interfered with their First >Amendment rights. "It is the right of the viewers and listeners, not the >right of the broadcasters, which is paramount," said the court, quoting a >1969 Supreme Court ruling. (Chronicle of Higher Education 13 Sep 96 A29) Bloody socialist Supreme Court... sell the _full_ rights, then use the money to reduce taxes. >SYSTEM CRACKER GOT RECIPE FROM HACKER MAGAZINE >The person who disabled New York's Panix Internet service probably followed >the line-by-line instructions for doing so that appeared in the latest issue >of 2600 magazine, the Hacker's Quarterly. "We need to educate the community >that it's very, very simple to cause massive mayhem," says 2600's editor, >who defended his editorial judgment. "A lot of companies subscribe to us so >they can learn before they're victimized." Panix's co-owner says he >supports 2600's right to publish such information: "As a matter of >principle I don't think they should have been stopped," but adds that unlike >most other recipes for breaching security published in the magazine, this >one has no known technical defense. (Wall Street Journal 13 Sep 96 B5) Helpful to quote Panix on it. >Edupage is written by John Gehl <gehl(a)educom.edu> & Suzanne Douglas ><douglas(a)educom.edu>. Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by Information Technology Services at the >University of North Carolina at Chapel Hill. >*********************************************************** >Edupage ... is what you've just finished reading. To subscribe to Edupage: >send mail to: listproc(a)educom.unc.edu with the message: subscribe edupage >Henry R. Luce (if your name is Henry R. Luce; otherwise, substitute your >own name). ... To cancel, send a message to: listproc(a)educom.unc.edu with >the message: unsubscribe edupage. (If you have subscription problems, send >mail to manager(a)educom.unc.edu.)

1 0

No Subject
by patrickbc＠juno.com 17 Dec '03

17 Dec '03

what do you know about hackers

1 0

Re: Los Angeles Times article on Helsingius and anon.penet.fi
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

Dear Ms. Dyson: As a result of my knowing something of your work and additionally having viewed your highly impressive performance on Bill Buckley's CDA debate program, I used to think a great deal of you. And, as a matter of fact, I suppose that I still do. I am frankly troubled, however, by my _impression_ of your beliefs in the abovereferenced matter. Perhaps I have misunderstood your recent post to Cypherpunks; indeed, I am certain that all will be elucidated after you have had an opportunity to review more fully the article in question. I look forward to reading your further thoughts. Sincerely, -David M. Rose

1 0

No Subject
by patrickbc＠juno.com 17 Dec '03

17 Dec '03

Please send me information on hacking bbs Hackmaster-p Patrickbc(a)juno.com

1 0

Re: Snake Oil FAQ 0.4 [comments appreciated]
by Deranged Mutant 17 Dec '03

17 Dec '03

For those not-yet-in-the-know: I no longer have the time to manage it and asked for somebody (and Matt agreed to) to take the Snake Oil FAQ's care and feeding. Note that this is not cc'd to coderpunks. I don't think it's appropriate for coderpunks. On 16 Sep 96 at 9:56, C Matthew Curtin wrote: [..] > --------------------------- snake-oil-faq ---------------------------- > > Snake-Oil Warning Signs > Encryption Software to Avoid [..] > The Snake Oil FAQ is (to be) posted monthly to cypherpunks, sci.crypt, > alt.security, comp.security, and comp.infosystems. We're targeting those who Does it need to be posted monthly? Better to post pointers to it most of the time, possibly to other places as well (alt.2600 comes to mind...). Perhaps when the first 'non-beta' of this document is released a History could be added. [..] > Different products will serve different needs, and it's rare that a product > will serve every need. (Sometimes a product won't be needed: it may be Nitpick: Hm. Change that to "no product will serve every need". > better to use a utility to encrypt files, transmit them over a network using > standard file transfer tools, and decrypt them at the other end than to use > a separate encrypted utility in some cases.) Or more clearly: is encryption THE feature of the utility, or is it an added feature? It's better to use separate utilities made for that purpose rather than one that tries to do everything. [..] > Key Sizes > > Some ciphers, while currently secure against most attacks, are not > considered viable in the next few years because of relatively small keysizes > and increasing processor speeds (making a brute-force attacks feasible). The Change to "making brute force attacks--that is, trying every possible key--feasible". [..] > Symmetric and Public-Key Lengths With > Similar Resistance to Brute-Force Attacks > > Symmetric Key Length Public-key Key Length > 56 bits 384 bits > 64 bits 512 bits > 80 bits 768 bits > 112 bits 1792 bits > 128 bits 2304 bits That's a controversial comparison. I've read references (from a couple of years ago) saying that a 3k-bit RSA key is as strong as a 128-bit IDEA key. Trying to compare the two (symmetric and assymetric) is like running through a tar pit. > Some Common Snake-Oil Warning Signs > > The following are some of the "red flags" one should watch for when > examining an encryption product > > * Technobabble [..] > A sign of technobabble is a descrption which drops a lot of technical > terms for how the system works without actually explaining how it > works. Often specifically coined terms are used to describe the scheme > which are not found in the literature. Of course, how is an amateur supposed to know if these terms are found in the literature? That was a recurring comment that people sent me when I first posted the FAQ. [..] > Just because software uses to different method of computation Typo! "uses to different method..."? [..] > grounded in mathematical theory. The security is based on problems that > are believed, if not known to be hard to solve. Hm. How about "that are widely believed"? [..] > A OTP system is not an algorithm. It works by having a "pad" of > random bits in the possession of both the sender and recipient. [..] > never again be used. The bits in the pad must be truly random, > generated using a real random source, such as specialized > hardware, radioactive decay timings, etc., and not from an > algorithm or cipher. Anything else is not a one-time-pad. Although it is(?) mentioned below, I'd emphasize here in some way that the users of the OTP generate the key. Somebody else sending you a supposed OTP that he generated is not secure. > The vendor may confuse random session keys or initialization vectors > with OTPs. Explain random session keys and initialization vectors. A glossary at the end of the document would be a good thing. > Sometimes attacks are theoretical or impractical (requiring special > circumstances or massive computing power running for many years), and > it's easy to confuse a layman by mentioning these. Oh yeah. These need to be explained. What I had in mind was timing attacks against RSA or IDEA, or factoring of public keys. > * Keys and Passwords > > The "key" and the "password" are often not the same thing. The "key" "often" not?!? (oops...was that my wording?) They aren't the same, though often they are confused in snake oil. [..] > If there's a third-party utility that can crack the software, > avoid it. > > If the vendor claims it can recover lost passwords (without using a > key-backup or escrow feature), avoid it. > > If there is a key-backup or escrow feature, are you in control > of the backup, or does the vendor or someone else hold a copy > of the key? That is, if you lose the key, you don't want a third party to have as much a chance to recover it as you do. [..] > > If the vendor is unaware of export restrictions, avoid the software: > the vendor is not familiar with the state of the art. Also... if the vendor does not understand export restrictions, avoid the software. I'm thinking of a certain snoil-vendor who said 128-bit IDEA keys were'nt secure since they could be exported. > Because of export restrictions, some legitimate (not-Snake Oil) > products may have a freely exportable version for outside of the USA, > which is different from a separate US/Canada-only distribution. Also Such exportable versions are not as secure, of course. [..] > Other Considerations > > Interface isn't everything: user-friendliness is an important factor, but if > the product isn't secure then you're better off with something that is > secure (if not as easy to use). > > No product is secure if it's not used properly. You can be the weakest link > in the chain if you use a product carelessly. Do not trust any product to be > foolproof, and be wary any product that claims it is. I wanted to add some sort of 'non-guru hacks' to test a product. One example might be to actually examine 'encrypted' files to see if they are really encrypted. (I'm thinking of the AMG archiver, which only encrypted the CRC; CODEC archiver also only encrypted the CRC is a file is not compressed.) Thanks again for taking over the FAQ. A good job! Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: DON'T Nuke Singapore Back into the Stone Age
by Arun Mehta 17 Dec '03

17 Dec '03

At 10:35 31/08/96 -0700, Timothy C. May wrote: > If discussions of Lee Kwan Yew's dynasty are considered illegal, then >Singaporans will have to choose not to carry the various newsgroups into >which *I* post such messages! How long do you propose to carry on doing that? Soon, the others in the newsgroups will be asking you very impolitely to stop, just as you would if someone kept on and on posting such stuff to cypherpunks. >At 6:35 AM 8/31/96, Arun Mehta wrote: >>Then again, inappropriate postings are the bane of the Internet: the consensus >>on which the Net functions relies heavily on people not posting >>inappropriately. >This works imperfectly, as all long-time surfers of the Usenet will attest! True, but Usenet only functions because it works most of the time. To the extent we subvert this consensus, we damage Usenet, make it less useful. It shouldn't happen that in trying to save or spread Usenet, we have to destroy it... >And _never_ has it involved determinations of "inappropriate" by >_governments_! There I'm with you -- I'm merely suggesting that you find a way to protest Singapore's actions in a manner that would be less objectionable to most Internet users, in Singapore and outside. >The point of being sometimes "impolite" (*) is to "force their hand." I never said anything about politeness -- the appropriateness I was talking about was in the context of what the people posting to a discussion group consider proper material for them to receive, not what the government of Singapore thinks. In any case, I think we may be slightly going off track as far as the current Singapore problem is concerned. They are blocking access to certain web sites from mid September -- Usenet isn't part of the current discussion, far as I know. Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://www.cerfnet.com/~amehta/ finger amehta(a)cerfnet.com for public key

1 0