- cypherpunks-legacy - lists.cpunks.org

Re: War of the 2.x versions!
by Jeff Gostin 17 Dec '03

17 Dec '03

Joseph Block <jpb(a)gate.net> writes: > So what stops someone from patching 2.3? Since 2.3 is already allegedly in > violation, why not just make it compatible with 2.6? Because if you did that, you wouldn't need 2.6ui. Of course, 2.6ui uses no MIT code and doesn't use 2.3a code either. It's from scratch. Yeah, that's the ticket. --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

Re: PC Expo Disk Available
by markh＠wimsey.bc.ca 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Subject: Re: PC Expo Disk Available > Hey guys, I've just sent up the PC Expo disk package to ftp.wimsey.bc.ca > incase anyone is interested in it. Give it some time as Mark has to clear it > but it's in the incoming folder right now... It is available to U.S. and Canadian persons at ftp.wimsey.bc.ca /pub/crypto/software/dist/US_or_Canada_only_XXXXXXXX/pcxpo/pcxpo.zip Mark -----BEGIN PGP SIGNATURE----- Version: 2.4 iQBVAgUBLhnkIWrJdmD9QWqxAQFk2QH/VZnf1PqE0ftwQdfQLIu8Q4kaOeBh0C2R wN8mdxSEpSgWsCOzqgpN9jv195/GrQMETqAznUs2L6jA4rWyfnlbPg== =nPCR -----END PGP SIGNATURE----- -- Mark Henderson markh(a)wimsey.bc.ca - RIPEM MD5: F1F5F0C3984CBEAF3889ADAFA2437433 ViaCrypt PGP key fingerprint: 21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 low security key fingerprint: EC E7 C3 A9 2C 30 25 C6 F9 E1 25 F3 F5 AF 92 E3 cryptography archive maintainer -- anon ftp to ftp.wimsey.bc.ca:/pub/crypto

1 0

(None)
by Jeff Gostin 17 Dec '03

17 Dec '03

Joseph Block <jpb(a)gate.net> writes: > 1701THQ1EBA7FLJ0SOM1THL1EDA7 > Without knowing the phrases, method, or number, what makes this insecure? > I'm not deliberately trying to be dense, I'd like to know why I shouldn't use > this sort of mnemonic method to remember the pass phrase. _Essentially_, you have a random string of text. Mind you, it's not statistically, nor cryptographically, random, but it's something that no PERSON would guess. If you are trying to get something to keep PEOPLE out, you've picked a nice one. If, OTOH, you're trying to get something to keep HACKERS/MACHINES out, you've got a somewhat time consuming one. Does that answer your question? :-) --jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

GOPHER: AOL, CPSR, cypherpunks
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Cypherpunks, Earlier, somebody (I beleive Carl Ellison, but I screwed up and deleted the file) asked about AOL and the gopher site. The problem may not be AOL or CPSR actually. What happened is this: Chael reorganized the gopher site, placing the Cypherpunks Gopher Archive into a subdirectory. So the archive is still at chaos.bsu.edu, but no longer immediately at the top level. Perhaps CPSR's pointer to the site is no longer valid! Or maybe the problem is that he also upgraded to a new gopher server, which is supposed to be backwards compatible ;) and one of these days I'll create some sort of index files (?) to take advantage of the new features, etc. So maybe this is the problem, a new version that AOL doesn't handle. So try gopher'ing directly to chaos.bsu.edu and then into the "Cypherpunks Gopher Archive" if going through somebody else isn't working. Hm... I'll inform CPSR about the change. Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLhnpG8SF/V8IjI8hAQGn0gP/YjRzP3OODE9e7pXdHhOpHtY6UddH75Fj 7z1T/RA9JuL3es926zNZP2K9C1p9AlgwKyPcea2GWkgT8q79Ink4VXKGJbwEzzwV Kyh5a3Efm7ZsewxlUnrkRtppH2qc//bhNkpaTSIlM1Ccl7+yBttONyq6qHFfpzLd m88J8APnLWM= =AbvY -----END PGP SIGNATURE-----

1 0

PC Expo Disk Available
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

Hey guys, I've just sent up the PC Expo disk package to ftp.wimsey.bc.ca incase anyone is interested in it. Give it some time as Mark has to clear it but it's in the incoming folder right now... I'll try to send it up to some other sites, but I guess I won't send it to csua.berkeley.edu as it isn't being taken care of... (if you know otherwise let me know and I'll send it there too...)

1 0

Re: Pass Phrases
by fasttech!zeke＠uu4.psi.com 17 Dec '03

17 Dec '03

We Americans have had many years of being forced to remember relatively high-entropy things. Roughly 23 or 33 bits. I refer, of course, to phone numbers. I, for one, have no problem remembering a few dozen of these, in various area codes, even though I don't dial some of them for years. Our neural cortexes have been "conditioned" to remember 7 digit (or 10 digit) numbers. Much more easily than, say, 8 or 9 digit numbers. So I claim that a simple way to get an easy 33 bits of entropy into your pass phrase would be to generate a "random" 10 digit number, but then remember it as an area code + phone number. You would, of course, combine this number with some other sources of entropy, such as words or phrases. If you really wanted to, you could forget the words or phrases and just remember four numbers of this sort. You would have your magical 128+ bits of entropy a lot more easily than remembering 40 random decimal digits.

1 0

RE: (None)
by Mike Markley 17 Dec '03

17 Dec '03

---------- | From: Jeff Gostin <jgostin(a)eternal.pha.pa.us> | To: <cypherpunks(a)toad.com> | Subject: (None) | Date: Sunday, July 03, 1994 4:08PM | | bmorris(a)netcom.com (Bob MorrisG) writes: | | > I've heard rumors through the years that CIA/NSA/whoever can aim a | > parabolic antenna at your window, read the electronic pulses surrounding | > your computer, and thusly determine what you are typing. Is there any | > truth to this? | If this is a reference to the TEMPEST attack, yes, they can. From | what I hear, it's trivially easy for them to do, because they have The | Right Equipment. Rumor also suggests that that The Right Equipment isn't | so difficult to come by. I don't pretend to understand the intricacies of | TEMPEST, but I do know that the government requires all of their computers | (used at any level of security above none) to be TEMPEST shielded. This | tells us its a real concern. | | There are other ways to beat TEMPEST, like making it damn near | impossible to get close enough to the computer in question to get a | reading. | | --Jeff | -- | ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ | == == | The new, improved, environmentally safe, bigger, better,| | == == -= | faster, hypo-allergenic, AND politically correct .sig. | | ==== ====== | Now with a new fresh lemon scent! | | PGP Key Available +---------------------------------------------------------+ | How well does a Tempest attack work with multiple machines in the same room? It seems to me that it would take additional equipment to filter out the different machines that are being run. It also seems that it should be trivial to create a noise generator that would make Tempest useless. Kind of like using a spark plug to foil older radar guns. Mike. ===================================================== Mike Markley <mmarkley(a)microsoft.com> I'm not a Microsoft spokesperson. All opinions expressed here are mine. =====================================================

1 0

fink.net@doj.gov
by Brad Dolan 17 Dec '03

17 Dec '03

Maybe they should set up an anonymous forwarder...... ---------------------------- begin included text ------------------ From: SMTP%"srctran(a)world.std.com" 5-JUL-1994 09:23:35.81 Subj: PAT NEWS: Wanna be a patent spy for the Justice Department? Date: Tue, 5 Jul 1994 09:02:00 -0400 From: srctran(a)world.std.com (Gregory Aharonian) Message-Id: <199407051302.AA01920(a)world.std.com> To: patents(a)world.std.com Subject: PAT NEWS: Wanna be a patent spy for the Justice Department? Want to be a spy? Here's your chance. The US Department of Justice is seeking evidence of restraint of trade and monopolization in the computer and telecommunications industry. Currently their big investigation is that of Microsoft, but they are looking for other cases of abuse of economic power by dominant companies. With regards to patents, the Justice Department is looking for cases where the owner of a patent denied a potential licensee a license for the patent, while giving licenses to some of your competitors. Maybe this is a case of anti-trust, depending on market conditions. Of course, given that some companies might be unwilling to inform on their suppliers or competitors, the Justice Department is open to anonymous tips from knowledgable sources. While you can have your attorney contact and meet with Justice Department attorneys, you can also send in tips, via, you guess it, the Internet: antitrust(a)justice.usdoj.gov Be that Deep Electronic Throat!!! Greg Aharonian Internet Patent News Service (for subscription info, send 'help' to patents(a)world.std.com) (for prior art search services info, send 'prior' to patents(a)world.std.com) --------------------------- end included text --------------------------- Brad bdolan(a)well.sf.ca.us

2 1

BoardWatch on digital cash
by Stanton McCandlish 17 Dec '03

17 Dec '03

See current (July 1994) _BoardWatch_, pp. 60-63. There's an article on an e-money scheme called NetCash. Unfortunately it is utterly stupid, but BW is giving it a semi-endorsement. Some of you d-c afficionados might like to disabuse them of some notions. Some of the flaws: 1) not cryptographically secure 2) someone can randomly guess the ser. # of your digicash and go spend it 3) non-anonymous 4) the person transferring the netbucks to you can actually spend it before you validate it with the central server (e.g. it would only be of use in cases where product/service has yet to be rendered, and customer gives you the netmoney, which you verify and only then serve them. Completely useless otherwise.) There are more, but those are the main ones. -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

3 2

Re: Windows for Workgroups 3.11
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

If it really is public key, and if the keys really are quite short, then its probably really *not* secure. Remember than a 129-digit (~425 bit) RSA key was broken in 8 months! A 384-bit RSA key is therefore not secure! And if the NSA have a million-processor supercomputer, make that a couple of hours. Thank goodness it doesn't scale with bigger keylengths! G

1 0