- cypherpunks-legacy - lists.cpunks.org

Passphrase Online...
by John Shaft 17 Dec '03

17 Dec '03

>>If I am connected to the Internet via a SLIP/PPP connection and I >>type my passphrase while being online (for example, in Private >>Idaho, after getting my mail), could that passphrase be compromised? >>If so, how would that be done? There are a number of things that can happen. Basically, if you don't directly control the device/application that is doing the encryption for you, you run the risk of someone intercepting whatever you xmit. For example, if you have a dial up type shell account with your local ISP, and you depend on some UNIX based encryption program to secure your mail (running on the ISP's machine), anyone with root access can tap the tty and watch you enter your passphrase. You're also susceptable (sp?) to someone taping your phone line and looking at you with a packet analyzer. I suppose if you were doing something locally, and someone wanted to be really sneaky, they could embed something like keycopy on your machine (with a virus or something) and get coppied every time you enter a keystroke. I don't suppose it would be all that difficult to get a machine to run a tsr that got kicked off every time you accessed something like, say , PGP....Comments? Shaft! Damn Straigt. shaft(a)africamail.com

1 0

S/KEY (was: 2 Questions)
by Peter M Allan 17 Dec '03

17 Dec '03

Steven M Orrin <privsoft(a)ix.netcom.com> wrote: > Hey guys, > 2 quick questions: > Are there any known hacks or weaknesses in S/Key? S/Key has a rather limited scope, in aiming to prevent replay attacks. These are where somebody snoops on your network to obtain passwords, an uses them in later login attempts. This is undoubtedly a major weakness in most current networks. S/Key addresses this replay of data obtained in passive eavesdropping, but that is all it does. Several attacks against S/Key have been discussed [1], including: race attacks: eavesdropping most of the hash, and racing the user to provide the rest of it active attacks: impersonating the server to learn future hashes or simply hijacking an established session. Strengthening S/Key really means expanding the scope to get an authenticated and encrypted 2-way connection. [John Gilmore's S/WAN may end up achieving this. I'm not familiar with it (yet?).] Ideas for improving S/Key that involve secret data stored on the server tend to get frowned on, as the original aim was to avoid that. In any case you cannot get the full encrypted 2-way connection without getting a whole lot more complicated. Recent discussions [2] have centred on ways to rekey the list of hashes remotely when the count runs down. These changes, and S/Key itself, are better than nothing but where's the ham sandwich ? [3] Beside the protocol weakness there is potential for finding collisions in the hash function (MD4 originally). A choice of hash functions can be provided. See RFC-1938. 1) See also SecureID, which is more complicated and still subject to similar attacks. 2) Not here. 3) Old joke. A ham sandwich is better than nothing, and nothing is better than a life of complete happiness, so ...... -- Peter Allan peter.allan(a)aeat.co.uk

1 0

Re: Rejection policy of the Cypherpunks mailing list
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Kevin L Prigge wrote: > paul(a)fatmans.demon.co.uk said: > > > I think both of these groups are intellectually dishonest in the > > > extreme when it comes to telling others how this list should be > > > run. I doubt any of them would permit the sort of disruptive > > > behavior that goes on here to go unchallenged in salons they > > > sponsor in their own homes or on Net lists that they themselves > > > maintain. > > > > If you want to talk about intellectual dishonesty try the following: > > > > Imagine if you will a list, the original purpose of which was > > to act as a free and open forum for discussion of cryptography and > > related issues. A list which proudly proclaims in its "welcome to > > the list" message: > > > > We do not seek to prevent other people from > > speaking about their experiences or their opinions. > > > > Now imagine that list falling into a state of content based > > censorship and censorship based on an unspoken but ever present > > class structure, then ask yourself which list you know that most > > closely matches this description, it`s a pretty revealing exercise. > > The exercise reveals to me that only by ignoring the first paragraph > of your example, the part that reads "Imagine if you will a list, > the original purpose of which was to act as a free and open forum > for discussion of cryptography and related issues." can you make > a claim of content based censorship. The purpose of this list was Then why discussion of machine guns should be allowed here? igor

1 0

Re: The Adult Chamber of Commerce is now open
by BUSINESS＠VNET.NET 17 Dec '03

17 Dec '03

IF YOU ARE A BUSINESS OWNER WITH A WEB SITE, you should know that The Adult Chamber of Commerce represents professional businesses on the Web. The Adult Chamber of Commerce is on the Web to help you! We got your E-mail address from your Business newsgroup posting. We did not put your E-mail address on a mailing list! THE BOTTOM LINE: Chamber members see increased traffic to their Web Sites. A massive portion of the Web has Doctors, Lawyers, Accountants, and all sorts of people (buyer) visiting ADULT sites. It's just the nature of the Web. Your business can capture some of this massive traffic and direct it to your Web site through Membership in The Adult Chamber of Commerce. All member companies, Adult & Non-Adult, get listed in the Chamber member links section with an icon that indicates you do business in accordance with the Better Business Practices of The Adult Chamber of Commerce. This listing literally guarantees significant additional traffic to your Web site. Membership inThe Adult Chamber of Commerce is something you should consider if you are interested in getting greater exposure on the Web. Each company is checked out before membership is approved. Since it costs a business as little as $240 annually for membership, it's not expensive for a company to tell others that they support the only professional organization for responsible ADULT businesses. A business applies for membership at the Adult Chamber Web site and visitors regularly check to see if the company [they'e planning to buy from] is a Member in Good Standing. The Adult Chamber of Commerce web site is the place to find the BEST & most responsible companies on the Web. ============================================== Visit and Bookmark http://www.adultchamber.com ============================================== IF YOU OWN A BUSINESS, applying for MEMBERSHIP to The Adult Chamber of Commerce is easy. The Web site has an online application. Memberships are pocessed daily and increasing traffic to your Web site is as easy as becoming a member! The chamber has other services besides increasing traffic to your Web site. We design, re-design and host Web sites professionally. Visit www.adultchamber.com for the whole story and you will see why membership is a good idea for any business. If you want a brochure, leave us your name and address. You can call us to discuss membership at 516/689-2457 or 561/395-0217. THE BOTTOM LINE is that Chamber member businessessee increased traffic to their Web sites and improve sales.

1 0

RE: Rejection policy of the Cypherpunks mailing list
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, On Mon, 27 Jan 1997, Blanc Weber wrote: > From: Sandy Sandfort > > (By the way, if you don't like moderation, you would hate Eric Hughes' > favored solution.) > ............................................... > > > What was that? Eric, would like to require a deposit ($20 was the example he gave) from subscriber/posters. Non-subscribers would not be allowed to post. Subscribers who voluntarily left the list, would get their deposit back. Subscribers who flamed twice (every dog gets one bite) would be kicked off the list and their deposit would be forfeited (or perhaps turned over to the flame victim). S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Passphrase Online...
by Erp 17 Dec '03

17 Dec '03

> I suppose if you were doing something locally, and someone wanted to be > really sneaky, they could embed something like keycopy on your machine (with > a virus or something) and get coppied every time you enter a keystroke. I > don't suppose it would be all that difficult to get a machine to run a tsr > that got kicked off every time you accessed something like, say , > PGP....Comments? Ok, just something that would be a nasty little virii in its own way... If there was a virii produced that copied down a persons keystrokes every time, and then when they logged onto the InterNet aka aachieved a PPP/Slip connection, it automatically sent (without there knowing) a copy of all the keystorkes they have made so far, and then deletes them from an encrypted file, or from within a file it has been adding them too *shrug*... .. aka Automatically sends it to say an anonymous email account or some such. Ok *shrug* jsut an idea... later..... Erp *************************************************** Hey we have fun here at hell! Check us out if your lucky: http://www.fromhell.com/

1 0

Re: OTP security
by Rick Osborne 17 Dec '03

17 Dec '03

Paul replied: >Depends on how that 16th bit is related to the other bits and whether >these predictable bits give any information about the other bits on >the disk. Yes, I had figured that if the bits depended on eachother, then it would blow the whole system. [Yet another case of my fingers lagging behind my brain.] What I was thinking was more along the lines of something like: 1.You've got 16 hardware devices that each generate random noise. 2.One of the devices fails (or is sabotaged) and emits a predictable stream (10101...) 3.The other 15 devices are just fine, and the stream generated by one device does not effect the stream of another. 4.You do not know of the (failure/sabotage) until *after* you've generated your encyrted documents and they are out of your hands. So the revamped question is: How secure are those documents now? _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ Good evening... as a duly appointed representative of the city, county and state of New York, I order you to cease any and all supernatural activity and return forthwith to your place or origin, or to the nearest convenient parallel dimension.

1 0

Re: Rejection policy of the Cypherpunks mailing list
by Toto 17 Dec '03

17 Dec '03

Sandy Sandfort wrote: > Apparently, Toto does not know very much about John or me or our > relationships with the "Establishment." Unfortunately, I know a little 'too much' about you and John and your relationships with the Establishment. But as long as I don't think about it at the dinner table, it doesn't affect my appetite. > I can't speak for John, but You do so all of the time. It seems, rather, that John cannot speak for himself (or is too embarrassed to do so). > I think both of these groups are intellectually dishonest in the > extreme when it comes to telling others how this list should be > run. No, Sandy, it is yourself and John who are 'telling' others how this list 'will' be run. You seem to be projecting your own motivations upon anyone who 'expresses' any unflattering opinion of the the censorship process you have instituted. > Of course squating and claim jumping appeal to the lazy a lot > more than homesteading. It must be nice, Sandy, having the power and control over the list that enables you to fling insults at others and then direct them to others only at your own whim and discretion. I guess that it is every list-dictator's dream to have the power to send a big FUCK YOU to one portion of the list, and send a portrait of themself as Mother Teresa to another portion of the list. Toto

1 0

RE: Rejection policy of the Cypherpunks mailing list
by Sean Roach 17 Dec '03

17 Dec '03

At 02:04 PM 1/27/97 -0800, Sandy Sandfort wrote: ... >Eric, would like to require a deposit ($20 was the example he >gave) from subscriber/posters. Non-subscribers would not be >allowed to post. Subscribers who voluntarily left the list, >would get their deposit back. Subscribers who flamed twice >(every dog gets one bite) would be kicked off the list and their >deposit would be forfeited (or perhaps turned over to the flame >victim). I know that this wasn't your idea, and am not critisizing you. This idea would be great if everyone had an equal access to funds. Persons willing to part with funds could flame people indiscriminately. Persons with more money, meaning no bills or very few in relation to capitol, would be more willing to part with funds. Suddendly, the rich control the press again, at least to the extent that they would be able to say anything. The rich would be more equal. The plan could be hacked. With several accounts, perhaps stolen, forged, etc. a person submits the $20, flames h[is/er] victim, unsubscribes, collects h[is/er] deposit, resubscribes under a new name, and repeats the cycle. Plus, as has been said before, the definition of a flame is subjective. It has been shown that children with more symettrical faces get along better with teachers. It has been shown that even uncorrupted babies know what physical beauty is. If there is any ability to pre-judge a persons character before reading the post, than the post is more likely to be judged accordingly. I hope that you will be fair in your determinations, and I assume that you will do your best. But I still worry, only because that you are human. And humans make mistakes. At least the current moderation doesn't cost any one twenty bucks.

1 0

Re: OTP security
by Rick Osborne 17 Dec '03

17 Dec '03

Paul replied: >Depends on how that 16th bit is related to the other bits and whether >these predictable bits give any information about the other bits on >the disk. Yes, I had figured that if the bits depended on eachother, then it would blow the whole system. [Yet another case of my fingers lagging behind my brain.] What I was thinking was more along the lines of something like: 1.You've got 16 hardware devices that each generate random noise. 2.One of the devices fails (or is sabotaged) and emits a predictable stream (10101...) 3.The other 15 devices are just fine, and the stream generated by one device does not effect the stream of another. 4.You do not know of the (failure/sabotage) until *after* you've generated your encyrted documents and they are out of your hands. So the revamped question is: How secure are those documents now? _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ Good evening... as a duly appointed representative of the city, county and state of New York, I order you to cease any and all supernatural activity and return forthwith to your place or origin, or to the nearest convenient parallel dimension.

1 0