- cypherpunks-legacy - lists.cpunks.org

Re: New US regs ban downloadable data-security software
by azur＠netcom.com 17 Dec '03

17 Dec '03

>> shamrock(a)netcom.com (Lucky Green) writes: >> > Commercial data security software of any kind, regardless if it uses crypto >> > or not, is however prohibited from being distributed via the Internet or >> > being exported by any other means. >> But does it ban commercial companies from benefiting from their software if it is illegally exported (e.g., via the Net). Should, for example, PGP find users of its new software (who might be outside the U.S.) paying via ecash, should they accept the payment? -- Steve

1 0

Re: MAJOR MSIE SECURITY BUG
by Bill Stewart 17 Dec '03

17 Dec '03

It's rather self-serving to call this major lack-of-feature a MAJOR SECURITY BUG. Sure, it limits what you can do, but if it does what it claims to do, it's not a bug, it's just lack of vision, and there are _far_ more targets at Microsoft for complaints about that :-) MAJOR SECURITY BUGs are things like ActiveX and JavaScript-you-can't-turn- off. At least they seem to take a fail-secure approach to unknown CAs (even if it is fail-hostilely) rather than a more typical Microsoft fail-insecure-but-friendly fallback. The interesting capability that setting your own CAs isn't just that it lets you choose which service providers can be roots of a hierarchical tree-of-CAs model - it's that it lets you go beyond that model to support a web-of-trust model like PGP's, which is a Good Thing. You can duplicate this in a hierarchical world (if you must :-) by being the your own CA tree root, and certifying the other CAs you like. Netscape's original SSL implementations also only supported one CA root (Verisign), but after they got that working, they added user-selected CAs as well. Maybe MS will add this later? At 11:23 AM 1/10/97 GMT+2, source(a)iaccess.za wrote: >MSIE has a MAJOR security flaw in that it limits MSIE users to a very >restricted set of secure sites ONLY. Netscape Navigator does not have > this MAJOR limitation. >The bugs prevents access to Secure Servers other that those which MS >has decided to grant a monopoly to. This is both limiting to users >and inhibits Servers to their choice of Certificate Authorities. ...... >When MSIE does not recognise a Certificate Authority, it prompts the >user by saying it cannot connect to that site and gives the user no >opportunity to connect or access the Certificate Authority. >One of the ways the Certificate authorities are getting around this >problem is to publish a page listing their certificates. >The problem however is that users have to know this in advance and >MSIE gives no indication that this is >what needs to be done or where to go. .... >CompuSource in South Africa tries to accomnodate MSIE users by [.....] >https://www.compusource.co.za [.....] >Regards, >The Power Team >SMTP: source(a)iaccess.za Tel: +27-21-75-9197 >HTTP: http://www.compusource.co.za FAX: +27-21-72-8005 >FTP: ftp://ftp.compusource.co.za Postal: Building 6, Room 201 > CompuSource (Pty) Ltd # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

A Special Offer!
by dozer＠netwizards.net 17 Dec '03

17 Dec '03

Are you interested in making Millions in your spare time? Any housewife could do it and so can you! Just email me at dozer(a)netwizards.net to receive your FREE information packet. Thanks for your attention, and I'll be talking with you soon. Bill dozer(a)netwizards.net

1 0

Re: Newt's phone calls
by azur＠netcom.com 17 Dec '03

17 Dec '03

>If the person with the cell phone doesn't move, then they don't >get handed off to a different cell. That means that they >stay on the same frquency. No need to scan channels if they don't switch. Wrong Eric, cells are constantly expanding and contracting as subscribers in motion are transferred in and out. Thus you can be stationary, holding a conversation, and assigned to cell A when all of a sudden subscribers enter from adjacent cells B and C threatening to fill cell A beyond capacity. To keep from dropping calls in cell A the MTS will determine which calls can safely, due to signal strength and adjacent cell capacity, be transferred to another cell. If your conversation is selected then off you go to another, geographically overlapping, cell. The MTS can't be sure which subscribers are stationary and which are in motion (it really doesn't care). We saw this unexpected phenomenon frequently during development of Cylink's SecureCell and finally had to recommend our users be stationary during use, because our modems did not tolerate handoffs well without retraining, in order to offer the best chance of uninterupted communication. > >What Bill's saying is that it is difficult to tap the cell phone of >a _particular_ person with just a scanner. However the people >who taped Newt were just scanning for whatever they could get. That's easy. Yes, you need a device which can simultaneously listen to the paging/controll channels and determine, when a handoff to a monitored conversation occurs,to which new channel pair they have been assigned. I seem to recall such a device was for sale a few years back using a ISA/EISA card and some DOS compatible software. It connected to the ubiquitous and well characterized Oki 900 cell phone. >-- >Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm >PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

2 1

Re: Airport security [no such thing]
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:23 PM 1/14/97 -0800, Lucky Green wrote: >As most readers probably know, laptops are often subject to manual >scrutiny. From my non-representative sample, about four out of five tote >bags clearly containing laptops will be manually searched. It's extremely airport, guard, and moon-phase dependent. Some places are real picky, some aren't. I've started following someone's advice about having the laptop go through vertically; it doesn't look like a big opaque block to them, and they can see the rest of the stuff. When I tried it in Orlando, they said "It has to go through lying down", ran it back through lying down, said "Computer", I said "Yup", and they handed it to me :-) >Typically, the attendant requires that the laptop is powered up. >In none of the 20+ manual searches I witnessed did the security personnel >wait past the RAM check before clearing the passenger. I could not help >but contemplate how much of the insides of the laptop could be replaced >while still obtaining an identical display. I've convinced a number of guards to be satisfied by the little LCD-battery-status display that shows it's on and charged (and asleep) without having to actually boot it up (which now that I'm running NT, which doesn't really understand power-management, is a big win...) The two batteries could be replaced with <illegal joke deleted> and the little 5-minute keepalive battery could run that display just fine. It wouldn't take much more to get the main LCD screen to look convincing. On the other hand, there are places that have Real Security Guards; I have a photo of the ceiling of an Israeli bus station where I had to demonstrate that my camera really was camera-like. >Then came the big one: A man wearing a beer truck driver uniform approached >the checkpoint. On his hand truck were two kegs of beer. .... >I was flabbergasted. They let a man with two *large steel containers* enter >unchecked? No asking for ID, no X-ray? I struck up a conversation with the >beer truck driver. I asked him why the kegs did not get X-rayed. He looked >at me with an expression of utter lack of understanding and answered: "They >are too heavy to be put on the [conveyor] belt." Yow! (And also - it's nice that people can occasionally do sensible things even if they're against regulations :-) But you would expect them to have a guard escort the guy to the bar (requiring someone to come back later and take the beer out of the false bottom of the keg. You can already get away with being almost anywhere by being dressed as a pizza deliverer or air-conditioner mechanic or clipboard-carrier; I guess beer-deliverer needs to be added to the list. As long as you act like you belong somewhere.... A more serious example of getting away with things by looking like you're doing something your supposed to be doing was the man who walked out of Nazi Germany carrying a ladder (as told to me by someone else who'd left Germany.) Nobody thought to question him, and it was an era that a laborer not having a truck was normal... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Positions open
by overcome＠concentric.net 17 Dec '03

17 Dec '03

I_Love_SPAM, ATTENTION Fastest growing company expanding. Licensed in 34 counties, publicly held on NASDAQ. Part time up to $500 to $1,500, full time up to $2,000 to $6,000. Need to fill position immediately. Full training provided. Work from Home or Office. Paid vacations plus bonuses. Call this week ONLY for free information. (305)460-8000

1 0

Re: Am I to blame? / "THE INTERNET GOLDRUSH"
by Toto 17 Dec '03

17 Dec '03

snow wrote: > > > The "Internet Goldrush" is ON! > > > It's simple! It's quick! It's here! > The funny thing is, most of the "Gold Rushers" wound up broke, or > working for someone else. > Most people are fools. Deliberately so. An interesting observation. The original Gold Rush involved the thronging masses stepping on each other's toes, shooting each other in the back, etc., and the end result was that a few 'lucky' ones got filthy rich, while the people behind the scenes, encouraging this activity, 'all' got filthy rich. If I had a mansion on the hill, with a high wall surrounding it and a guard on the gate, I would be much more inclined to encourage the masses to seek their fortune at my doorstep, and shop at my general store across the street. Toto

1 0

Re: Airport security [no such thing]
by Krenn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Tue, 14 Jan 1997, Lucky Green wrote: > I recently took a domestic flight from the Oakland, CA airport. While > waiting for the airplane, I spent some time observing the security measures > at the X-ray machine. > > As most readers probably know, laptops are often subject to manual > scrutiny. From my non-representative sample, about four out of five tote > bags clearly containing laptops will be manually searched. Typically, the > attendant requires that the laptop is powered up. In none of the 20+ manual > searches I witnessed did the security personnel wait past the RAM check > before clearing the passenger. I could not help but contemplate how much of > the insides of the laptop could be replaced while still obtaining an > identical display. I have had the same experience. I am sure that removing all components of the laptop not required for its functioning would yield a significant amount of room inside, especially for larger (non-"notebook") machines. I'm not an expert on explosives, but I would imagine a laptop-full of whatever could be pretty nasty. Someone with determination could even make it look like it had a floppy, a CDROM, etc, just by replacing the devices themselves with facades. Not that the airport security would notice, but anyway. But wait - won't the all-important "did you pack your bags yourself" and "did anyone give you bags to take on the plane" stop them? ;-) It just obviates the fact that airport security is really useless against a determined attacker, but manages to be extremely annoying to everyone else. Krenn -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMtyOLknqfwPpt/QVAQF5PAQArUhAYtLjoSwsKspwysZYvwP0kCEs9ncS xN5VaZTi/ow5xOcoVXbRhGQPlu5v1sL+04yLz+1AWnYX2UdtIdSBlZAhtNufOCQg Au0cDp6vKeL/GIGEYX3/HEsDjicpbfXSuq+OZ79hhhButM+5jlsXz972nhLkmEvM aeVSFjB9WHY= =FYTH -----END PGP SIGNATURE-----

2 1

Re: Airport security [no such thing]
by Lucky Green 17 Dec '03

17 Dec '03

At 09:42 AM 1/15/97 -0800, Alan Bostick wrote: >Was he wearing a ID badge with a photo? Was he known to the security >staff? I would assume the staff knew the person. But that's not the point. The beer delivery man could hardly know what was in the kegs. The kegs might have been switched beforehand. In the warehouse, at a previous stop, etc. An attacker might have to replace several kegs, to make sure that at least one altered keg makes it inside the "secure" area. This can be done quite easily. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://www.mersenne.org/prime.htm

1 0

Re: RSA challenge: is it legal to try?
by Greg Broiles 17 Dec '03

17 Dec '03

At 12:35 PM 1/14/97 +0100, Anonymous wrote: >Patents only apply to commercial use. Got a cite for this? I can't seem to find any authority for it. It sounds to me like a simple economic calculation (it's not worthwhile to sue noncommercial users for infringement because they usually don't have enough $ to even pay for the litigation, and "IBM sues 70-year old grandmother" makes for poor public relations) that got turned into "law" by the machinery of urban legend. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0