- cypherpunks-legacy - lists.cpunks.org

Re: Yet Another Alarmist TV Show About Child Molesters on the Ne
by James Caldwell 17 Dec '03

17 Dec '03

On 25 Sep 95 at 0:06, Hroller Anonymous Remailer wrote: It's called the Hegelian Diclectic(sp?) first postulated by William Hegel (an ass) in Germany approx the 1600's as a method for social change when none could otherwise be achieved. > And the trashing will continue. It is the classic scenario. > Feed the media negative press clips about the entity you wish > to discredit (here, the Net), e.g.: > 1. All those pedophiles out to lure your children; > 2. Big coverage on catching some of those pedophiles; > 3. First page coverage on breaking Netscape's code with the > headlines that your sensitive information such as your > credit card numbers, etc. can be retrieved (ignoring that > the reason was to show Netscape's poorly structered code > would allow this and, therefore, preventing it before it > could happen); > 4. Expect cryptology to crop up in the Oklahoma bombing trial. > There already has been articles of those involved having > allegedly used that *damned* Net to correspond.

2 1

Fax encryption software
by Jonathan Blake 17 Dec '03

17 Dec '03

I saw this article in alt.privacy. Anybody think the described encryption actually is worth looking at. Xref: netcom.com alt.privacy:29325 Path: netcom.com!ix.netcom.com!howland.reston.ans.net!EU.net!uunet!in2.uu.net!news.deltanet.com!lkf0166 From: clav(a)deltanet.com Newsgroups: alt.privacy Subject: Re: FAX Encryption Software Date: Mon, 18 Sep 95 12:39:53 GMT Organization: Delta Internet Services, Anaheim, CA Lines: 59 Message-ID: <43k3nv$m9(a)news1.deltanet.com> References: <43hvft$n2b(a)news1.deltanet.com> <43ii1t$210(a)nntp.crl.com> NNTP-Posting-Host: lkf0166.deltanet.com X-Newsreader: News Xpress Version 1.0 Beta #3 Dear Mr. Chaos, We are talking about a 72 bit engine that is more than sufficiently strong for time sensitive general business purposes. In addition it does not rely merely on simple factoring but a process called graphical encryption that adds additional difficulty to an attack. I would like to see if your cracking abilities are anywhere near your abilities to return an uninformed answer. I invite you to try your skill. David _________________________________________________________________ _____________ In article <43ii1t$210(a)nntp.crl.com>, acollier(a)crl.com wrote: >clav(a)deltanet.com wrote: > >>ANYONE FOR A CRYPTO-STRONG, YET EASY TO USE FAX/EMAIL SECURITY >>SOFTWARE PACKAGE FOR BUSINESS OR OTHER USE??? > >>Aliroo Ltd. has developed a Windows, eye-to-eye fax/email >>encryption package called PrivaSoft. > >>Unlike any previously devised system, this method protects, with >>only 4 mouse clicks, fax and email transmissions in electronic >>and even paper form - FROM THE TIME YOU CREATE A MESSAGE UNTIL IT >>IS READ - NOT JUST WHEN YOUR FAX IS BEING TRANSMITTED. > >>You can encrypt a message, and then fax or email it (via plain >>old standard fax machine or fax modem), print it to paper or save >>to a disk file. > >>It is fully licensed, without restriction for export, by the U.S. >>Department of Commerce. NO PGP WORRIES. > >Also no worries about security - if DOC says you can have it, you can bet >that NSA has seen to it that it is cryptographically weak, or else uses a >key escrow system (where sombody else can get to the keys), and as insecure >as any other non-published method. For all we know, they may be using a >cereal box decoder ring set up. > >>Email me for a free copy which will be sent to you via email or >>snail mail post. It is fully functional (not crippleware) and >>enables you to try our system out before purchase with 8 free >>page scrambles. It retails for $130 per installed computer. >>Looking for end users and distributors. > >>Thanks, >>David > > -- To subscribe to Graphology-L send e-mail to: listserv(a)netcom.com / subject: leave blank message: subscribe graphology-l(a)netcom.com <your internet address> To get the Graphology-L FAQ send e-mail to grafolog(a)netcom.com / subject: hwafaq / no message ^

1 0

Re: "bad" government
by Blanc Weber 17 Dec '03

17 Dec '03

From: "Perry E. Metzger" Since this isn't a list for discussion of politics, I'll simply suggest that this isn't the right place to discuss this. ..................................................... . . . . . because otherwise it will interfere with reading all those other posts on Unix. (You're right, of course.) .. Blanc

1 0

Re: The Assault on Unicorn has Begun
by dmandl＠panix.com 17 Dec '03

17 Dec '03

Some random and unorganized thoughts on this whole issue from the list's token anti-capitalist: Bob Black (the anarchist) has declared that he has a standing "no first use" policy regarding the state. He won't sic the cops on anyone unless they do it first. Noam Chomsky has publicly stated that, on principle, he won't sue anyone for defamation or libel no matter what they do--and he's had plenty of opportunities. I feel the same way (though I don't see completely eye-to-eye with either of those guys). I would have to be harmed in a VERY serious way before I'd consider calling the cops. As for lawsuits, pretty much the same thing goes, and I almost can't imagine suing anyone for something they _say_ about me. This is something I never think about; it seems absolutely basic to my anarchist views. Unicorn: If you choose to be involved with the straight business world, you've got to deal with the heat. MY views could potentially get me in much more hot water than yours could, but I (grudgingly) accept the risk. I'm not dying to have the capitalists I work for see my rants, but if they do, I've got to live with it. They know me and know that I've never screwed them, and they can believe what they want to believe. I'm not thrilled about this, but c'est la vie. You wimped out at the very first sign of heat, and invoked the LAW (i.e, the state) as your first line of defense. I don't think you specified exactly what the settlement with tmp was, but what could it have possibly been? Payment to you? How would that have helped assuage the concerns of your business associates? An apology from tmp to the associates? Big deal. The guy's obviously a nut-ball, and you could have explained that; presumably the associates have some amount of trust in you. If it _was_ a payment, that's just sleazy and greedy, the standard ambulance-chaser cliche ("You've done irreparable damage to me, but maybe if you agreed to pay me $3,000..."). And how could the tiny amount tmp could afford compensate for the "millions" of dollars you've lost? If the settlement was for an apology, again, big deal--do the associates take this anonymous net.lunatic seriously enough that an apology would make everything all better? And you now look silly, because he's reneged on that part of the deal anyway. So in this case, using the lawyer weapon has had much the same effect as the standard statist weapon ("I know: we'll pass a LAW! _That_ will stop them!")--that is, no effect at all. Tim May (who I have certain obvious philosophical differences with) has been completely consistent on this issue, and his word carries that much more weight because he's been subjected to Detweiler's most relentless battering. THIS is the real world. Your anarchist principles have just been put to the test, and you buckled, immediately falling back on a statist solution. "Right-wing" anarchists are always bashing liberals and "P.C." types for being thin-skinned and unable to stand up to harmless name-calling. Well, you've shown yourself to be just as thin-skinned. The only difference I see is that there's MONEY involved. So? Liberals are wimps for trying to sue you for calling them names, but you're justified in suing because the name-calling has cost you money? And all because you're dealing with straights who can't handle reality? And meanwhile, YOU'RE the one who messed up and blew your own cover? Hmmm... It's very late, and I'm groggy, so I apologize in advance if any of the above seems unnecessarily blunt. It's not intended that way. --Dave. -- Dave Mandl Planetary Work Machine, Brooklyn Branch dmandl(a)panix.com

1 0

Zimmermann statement on PGP 2.6
by Philip Zimmermann 17 Dec '03

17 Dec '03

The following message may be reposted to all interested newsgroups. -----BEGIN PGP SIGNED MESSAGE----- From: Philip Zimmermann, author of PGP To: People interested in PGP Date: 28 May 94 On 24 May 1994, the Massachusetts Institute of Technology released PGP (Pretty Good Privacy) version 2.6. PGP is a software package that encrypts electronic mail, using public key cryptography. Over the past three years, PGP has become the worldwide de facto standard for email encryption. PGP 2.6 is being published under the terms of the RSAREF license from RSA Data Security, Inc (RSADSI). This is a significant milestone in PGP's legal development. Export of this software from the US or Canada may be restricted by the US Government. PGP version 2.6 is being released through a posting on a controlled FTP site maintained by MIT. This site has restrictions and limitations which have been used on other FTP sites to comply with export control requirements with respect to other encryption software such as Kerberos and software from RSA Data Security, Inc. These special mechanisms are intended to preclude export of cryptographic software from the US. The MIT FTP site that carries PGP is net-dist.mit.edu, in the pub/PGP directory. This new freeware version of PGP is for noncommercial use. For commercial use, you may get ViaCrypt PGP, available on a variety of platforms. ViaCrypt may be contacted at 602-944-0773, or via email at viacrypt(a)acm.org. PGP 2.6 is as strong as earlier versions. It contains no back doors. It can read messages, signatures, and keys from PGP versions 2.5, 2.4, 2.3a, and 2.3. Beginning in September, a built-in software timer will trigger PGP 2.6 to begin producing messages, signatures, and keys that cannot be read by earlier versions of PGP. It will still retain its ability to read things from earlier versions after that date, so that users who upgrade to 2.6 will not be inconvenienced, particularly if everyone else upgrades by that time. The reason for the change in format is to grant RSADSI's request to MIT to encourage all users to stop using older versions. ViaCrypt's new products will support the new formats used by PGP 2.6. Details of the compatibility issues and their reasons are outlined in the PGP User's Guide, included in the release package. See also the official statements released by MIT for further details. Version 2.6 also has some bug fixes and improvements of the version 2.5 released by MIT on 9 May 1994. Both the 2.5 and 2.6 versions were produced in a joint project between myself and MIT. Both versions were released by MIT after extensive review by MIT's administration and their legal counsel. I am told by MIT that MIT's legal counsel believes that both versions 2.5 and 2.6 do not infringe the RSA patents in any way, and they both comply with the terms of the RSAREF licenses that each were released under. But regardless of the noninfringing nature of version 2.5, I urge all PGP users in the US to upgrade to version 2.6, to help move toward eradication of earlier, pre-RSAREF versions of PGP. This will improve the overall political and legal landscape surrounding PGP. MIT will publish details on the simple format change so that earlier European versions of PGP may be independently upgraded by the Europeans. This note does not attempt to answer all the questions you may have about the implications of this new release of PGP. For further details, see the information released by MIT, or see the PGP User's Guide in the new release package. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLegMXmV5hLjHqWbdAQE0NAQAiTafSwM8eNfYYvkslNR6bun/GIelvziA M/9h5fn3zUQt2Bc6rkuz1TBlnMZUoduufinI9eSr+cdXbfhxNIQmRArhw3EJd1f+ siZaPmTR3YXvUwuXMcruMbUvEYpSBmtBVrxTzxNSIwx3/hJJB2z9sT1/B+UZdFwi EZX1O/mpiZw= =ULD1 -----END PGP SIGNATURE-----

1 0

Proof that tmp@netcom.com is Detweiler ?
by usura＠vox.hacktic.nl 17 Dec '03

17 Dec '03

Who/what is Detweiler ? > > From: Stanton McCandlish <mech(a)eff.org> > Message-ID: <net-community/orgs-list_769514754(a)rtfm.mit.edu> > Date: 21 May 1994 10:06:51 GMT > Expires: 25 Jun 1994 10:05:54 GMT > Reply-To: Stanton McCandlish <mech(a)eff.org> > Approved: news-answers-request(a)mit.edu > Supersedes: <net-community/orgs-list_767656298(a)rtfm.mit.edu> > NNTP-Posting-Host: bloom-picayune.mit.edu > X-Last-Updated: 1994/05/03 > Originator: faqserv(a)bloom-picayune.MIT.EDU > > Archive-name: net-community/orgs-list > Version: 3.13 > Last-modified: 94/04/08 > > > (This document has been brought to you in part by CRAM. See the > bottom for more information, including instructions on how to > obtain updates.) > > === [massive deletia] > === > CRAM: the Cyberspatial Reality Advancement Movement > > In an effort to bring valuable information to the masses, and > as a service to motivated information compilers, I > (L. Detweiler) will help others unfamiliar with Usenet > `publish' their documents for widespread dissemination via the > FAQ structure, and act as a `sponsor' knowledgable in the > submissions process. This document is being distributed under > this arrangement. > > I have found these compilations tend to appear on various > mailing lists and are valuable enough to deserve wider > distribution. If you know of an existing compilation of > Internet information that is not currently a FAQ, please > contact me and I may `sponsor' it. The benefits to the author > include: > > - use of the existing FAQ infrastructure for distribution: > - automated mail server service > - FTP archival > - automated posting > > - a far wider audience that can improve the quality, accuracy, > and coverage of the document enormously through email > feedback > > - potential professional inquiries for the use of your > document in other settings, such as newsletters, books, > etc. > > - with me as your sponsor, I will also take care of the > technicalities in the proper format of the posted version > and updating procedures, leaving you free of the `overhead' > to focus on the basic updates alone > > Send comments relating to the *distribution* of this document > (particularly relevant newsgroups not currently covered in > its current distribution) or inquiries on other documents to > <tmp(a)netcom.com>. > > The choice of who I `sponsor' is entirely arbitrary. You always > have the option of handling the submission process yourself. > See the FAQ submission guidlines FAQ in news.answers. > -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0

RE: Is Mail being delayed?
by Bill Garland 17 Dec '03

17 Dec '03

>From Tim May : >C'punks, >Once again I'm seeing day-long delays in getting mail, and I don't >know if the problem is at the toad site or at Netcom's end (or at a >relay link in between). Hence this message. ... >If you are gettting mail out of order (replies from others before the >original appears) or delayed by more than several hours, drop me a >note if you would and I will summarize what I learn. This happens to me all the time. I quite often see duplicate postings, too, although the multiple-posting copies of the same message eg the Chaum ecash announcement was a different problem, possibly caused by the same delay problem - re-posters haven't yet seen the first copy. >I'm especially interested to hear from Netcom sites. Can't help you there, except provide evidence that it is not a local netcom problem. Not to say netcom doesn't have local problems... I am at the end of the world here, at least the corner of North America. Think of me as your East Coast Sentinel - I can see Signal Hill from here if I go outside, and I can see Cape Spear from there. On Signal Hill there actually is one of those posts with arrows pointing to New York, London, Moscow, etc, with all the mileage. (Maybe I should invent East Coast Sentinal as a pseudonym.) There are two lines into here for Internet traffic, and perhaps soon to be others, but except for that, we are the end of the line. Might make traffic analysis a problem someday. >--Tim May /----------------------------------------------------------------------\ | I am an Extropian. | Macronic Systems, Inc. offers Ideas for Sale ! | | BEST: DO_IT_SO ! | Go for it : Pledge a Digital US Dollar now. | | CryptoAnarchist. | Send PGP key for more information. | | Cypherpunk. | Get in on the ground floor. Invest Now. Trust me! | | Owner : MSInc., |---------------------------------------------------| | HEx, INFO_Banque | Day Job : Bill Garland = bill(a)kean.ucs.mun.ca | \__________________________________o o_________________________________/

1 0

Is this just MY problem?
by bart＠netcom.com 17 Dec '03

17 Dec '03

Anon1 says: >... Whoever2 says: ... >... ... >... ... HUH? At this point I am no longer conversant with who is who, are you? So, what is the solution? Rather more explicit attribution I think.

1 0

Time Keys, Some Secure Ideas (by Alias: Jay Hyden)
by Anonymous Remailing Service 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >> Time Keys, Some Secure Ideas << The weakest attack on a time key based system is to spoof the computer that keeps track of time into releasing encryption keys i.e. change the clock. Perhaps this could be avoided by hardware inaccessability, say a computer system taken to, and setup on the Moon by those corporation that are already planning to place VR rovers on the lunar surface. Any Earth bound system would be vulnerable to physical attack. Here are some ideas for such a system: o 7 clocks with absolutely no way of reseting them. Perhaps a system that will only let you tell it which clock is the most accurate, and only if you prove you are the proper authority and only if 4 other clocks are on the same minute. o Redundant hardware and power collection and data transmit /receive systems, flash ROM hard drives for storing secret keys and neccesary programs and files. Built to last several centuries if possible. o Key pairs could be generated on Earth, a time of release instruction and perhaps an optional other public key a (return at future date encrypted with this key option.) The package is then encrypted with one of the lunar systems keys, then transmited to the Moon. A verification could be encypted and sent back to insure data integrity. o Other security checks in place would insure that the data was transmited to the Moon by the proper authority, i.e. the Corp. charging for this service. Additional backup logic that would insure that proper power and protocol exist for transmitions from the lunar system. o The key pairs are witness generated, then sent to the lunar system, then the secret key is destroyed on Earth. The public keys become a one way hash to the future until the time designated by the key's owner has elapsed. Then the lunar system would transmit the owners secret key to Earth. o Upon time released instructions the lunar system would transmit the secret key, (encrypted if optioned) upon demand by a known packet radio method. So if the Corp. authority did not exist in say, 100 years, the data could still be retrieved by standard packet radio. People who want to write to ONLY their great great grand- children or the future world in general would have a forum. Jay /"""""\ ~~ ,--------------------------------------------, ~~ /"""""\ /__ - _-\ ~~ ( End HEMP Prohibition! This is an open chal- ) ~~ /-_ - __\ :@ (*)~(*) ~ ( lenge to Historians. Name examples of where ) ~ (*)~(*) @: :%/--~ ))~: ~ (& when the cultivation of legal hemp was harm-) ~ :~(( ~--/%: \__"-==-===* ( ful or destructive to a society in any way! ) *===-==-"__/ (:"\_)_/ (<jay.hyden(a)alpha.c2.com> PublicKey on Servers) \_(_/":) .//:%:%:\. '---------------------------------------------' ./:%:%:\\. =000o====o000===================================================000o====o000= | | | | | | | | | | | - ----------------------------------------------------------------------------- | | | | | | | | | | | | - ----------------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGiLha7iRhcfEZiZAQEn0QP6A8cUmI0MHs866Mu/Ao4mFqr89F8tT3oP KeafNdSWJt8/pOlVZzQxV8P8S8dCkXwBgJJQaQ6tigqtD2+9fK1HEaWi3ZBAVgB+ CwLhqouwds2A5+l9riQfqAT+4yrSbeNR+bH3xyYa8zZSTzp5DB1tJEbWls6Kjr/w hxmFYrf6oSk= =oHrR -----END PGP SIGNATURE-----

1 0

Status of Netscape Bug Exploit (suggestions needed)
by Ray Cromwell 17 Dec '03

17 Dec '03

Ok Folks, here's what I got so far... 1) a URL that can place a specific value in the program counter (gdb) select-frame 2 (gdb) info frame Stack level 2, frame at 0xefbfbc30: eip = 0xefbfbc30; saved eip 0x90909090 ^^^^^^^^^^^^^^^^ called by frame at 0x90909090, caller of frame at 0xefbfbc14 Arglist at 0xefbfbc30, args: Locals at 0xefbfbc30, Previous frame's sp is 0xefbfbc1c Saved registers: eax at 0xefbfbc2c, ecx at 0xefbfbc28, edx at 0xefbfbc24, ebx at 0xefbfbc20, ebp at 0xefbfbc18, esi at 0xefbfbc14, edi at 0xefbfbc10, eip at 0xefbfbc0c, ps at 0xefbfbc08 2) A piece of exploit code on the stack near the PC (gdb) disassemble 0xefbfbc10 0xefbfbc40 0xefbfbc27: nop 0xefbfbc28: nop 0xefbfbc29: nop 0xefbfbc2a: nop 0xefbfbc2b: nop 0xefbfbc2c: nop 0xefbfbc2d: nop 0xefbfbc2e: nop 0xefbfbc2f: nop 0xefbfbc30: nop 0xefbfbc31: nop 0xefbfbc32: nop 0xefbfbc33: nop 0xefbfbc34: nop 0xefbfbc35: nop 0xefbfbc36: nop 0xefbfbc37: nop 0xefbfbc38: nop 0xefbfbc39: nop 0xefbfbc3a: nop 0xefbfbc3b: nop 0xefbfbc3c: nop 0xefbfbc3d: nop 0xefbfbc3e: nop 0xefbfbc3f: nop 0xefbfbc40: nop 3) exploit code that calls the kernel syscall() with SYS_exit (benign exploit, causes your browser to exit) The problem? To make a syscall under BSDI2.0, I have to execute an lcall 0x7,0x0 with 1,0 on the stack. However, to exploit the netscape bug, you can not embed 0x0 in the URL. No problem I thought, I searched Netscape's executable for any kernel calls, and found an lcall 0x7,0x0 at 0x257fee. But I can't do a 32-bit direct jump without a zero, in the instruction (the 32-bit address is 0x00257fee), and I can't do a relative jump from 0xefbfbc30+ If you can come up with some 386 assembly under BSDI2.0 which can invoke syscall() in the kernel without any embeded 0x0 bytes in the code, you can share a Hack Netscape T-Shirt with me. If it turns out to be too hard under BSDI, I'll gladly assist in producing exploits for Windows or another operating system. One trick I thought up for embeding zeros in the code is to self-modify the code using XOR ADDRESS,ADDRESS where ADDRESS is a byte on the stack within the code. Anyone have any better ones? -Ray

1 0