- cypherpunks-legacy - lists.cpunks.org

Re: Two-faced Security Problem? Dammit Janus?
by Chris Brenton 17 Dec '03

17 Dec '03

In reply to: > > >After poking around for a week, I discovered that my home machine, >newray.digex.net, is listed in the Digex's nameservers TWICE! Once with the >IP address that my home machine is waiting for (199.125.128.5) and once >with some other IP address in the digex space (164.109.211.61). If you do >an nslookup on the name, you get both addresses. I believe that the >technically correct thing for someone to do is to choose one of the >addresses at random to distribute the load between two machines pretending >to be one. This explains the connection failures that happened half of the >time. > >This has led me to wonder, though, whether this is some sort of security >breech. For instance, could there be someone out there mascarading as me? >Normally I run Eudora, Netscape, Telnet and other outward bound >applications. It was almost a fluke that I noticed that there were two >entries. > More likely this is a matter of someone assigning a host name to a system without realizing it has already been taken. Yes it can be a security breech but as you experienced the connection is broken easily. If someone wanted to grab your identity they would more likely busy your system (by flooding you with ping requests or something similar) and then grab you IP address. >Does some software need to find its IP address in a DNS table? For >instance, does Eudora need to look up 164.109.211.61 to find >"newray.digex.net"? The lookup typically goes the other way around, from host--->IP address. Dependant on the cache hits either address could be returned.

1 0

Re: There's a hole in your crypto...
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:53 PM 8/7/95, Dr. Frederick B. Cohen wrote: >Issue 2: > >The notion that mathematics somehow excludes linguistic proofs >(forwarded I believe by a user with "may" in their email address) is >nonsense. Mathematics at its core is based on linguistic notions that Not this "May," so far as I can recall. --Tim May Special note: My ISP has changed its domain name from "sensemedia.net" to "got.net" (as in "got milk?"), so I have to again ask you all to bear with me and use my new e-mail address, "tcmay(a)got.net". ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Over 350 'Munitions T-shirts' Shipped
by dhenson＠itsnet.com 17 Dec '03

17 Dec '03

As of 27 July 1995, we have shipped over 350 of the RSA/Perl Munition T-shirts. Orders are still pouring in. Don't be left out. Order your's today. Now you can wear a TSHIRT that has been classified as a MUNITION by the US Goverment. That's right! The US International Traffic in Arms Regulations (ITAR) makes exporting cyrptographic materials illegal. ITAR further defines export as providing cryptographic information to a non-US/Canadian citizen even if you are inside the US at the time. Providing information is further defined as telling or showing information to a non-US/Canadian citizen. The Munitions Tshirt has a Perl implementation of the RSA algorithm (the one used by PGP) printed on the front along with a bar-code of the same algorithm. What all the above means is that if you wear the Munitions Tshirt where a non-US/Canadian citizen can see it, even if it is inside the US, you have just exported cryptographic material (which is already freely available outside the US) and have become a criminal in the eyes of the US Government. Now you too can become an international arms dealer for the price of a tshirt (US$15.95 - US$19.95, depending on size) and the guts to wear it. If you are a non-US/Canadian citizen, you can still own a Munitons Tshirt by ordering the tshirt from a source that is outside the US. The email response to a request for info (see next paragraph) includes full instructions for ordering the tshirt no matter where you live. For more information on how to own this classic example of civil disobedience, just send email to dhenson(a)itsnet.com with the subject of 'SHIRT'. (You don't have to be a US/Canadian citizen to request the info.) Or, if you have WWW access, just point your Web browser to: http://colossus.net/wepinsto/wshome.html By the way, 25% of the profits from the sale of the tshirt (in the US/Canada) goes to the PHIL ZIMMERMANN LEGAL DEFENSE FUND to help defend the author of PGP from harassment and possible prosecution by the Fedgoons. And if you get arrested for wearing the Munitions Tshirt, we'll refund your purchase price. :-) Get your Munitions Tshirt now. Who knows how long they'll stay in production! Don Henson, Managing Director (PGP Key ID = 0X03002DC9) West El Paso Information Network (WEPIN) Check out The WEPIN Store at URL: http://colossus.net/wepinsto/wshome.html

3 2

Re: www remailer interface
by dochobbs＠wwa.com 17 Dec '03

17 Dec '03

It has been stated, :I'm a bit uncomfortable about the hardwiring of a particular remailer into :the chain, according to the Web page : : "Select your remailers [...] Your mail will be automatically sent : to the remailer hfinney(a)shell.portal.com and at least one other : remailer that you choose." : :(Nothing personal, Hal :) : :Why was this done ? : :-Futplex The code was written to be used with a local remailer that then sends it along the others that the sender chooses. I modified it so that I don't need to establish my own remailer by sending it to hfinney(a)shell.portal.com. I think this might provide better security for the sender due to the fact that you are forced to chain your letter thus providing more security. The argument can be made that if the initial hardwired remailer is compromised that this removes all security. I chose hfinney because 1. the turnaround time is good. I wanted the first to be fast because it is basically 'insurance' for the sender. 2. it was a remailer that I am familiar with and has been around (in remailer server time) awhile. 3. it was the one that I personally felt most comfortable with using as the hardwired mailer. Granted these might not be the best reasons, but this is the kind of response I was looking for. I can solve the problem by either 1. removing the hardwired 2. removing the hardwired and forcing you to chain 3. keep the hardwired in and use some 'established' remailer or one the group can come to a consensus on. Responses appreciated. I will gladly distibute the code if desired. Like the page states, it was originally written by Nate Sammons, but I can change it as needed. _____________________________________________________________ dochobbs(a)wwa.com M.D. Hobbs mhobbs(a)rad.rpslmc.edu http://miso.wwa.com/~dochobbs finger for my pgp key I am human and nothing human do I count alien.

1 0

patent info URL
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

Since various intellectual property debates and questions come up ("plague") periodically, it seemed like it'd be a good idea to post the following URL: http://www.patents.com/ Its run by a small patent law firm and has a series of well-linked, snappy FAQs on issues pertaining to intellectual property, patents (including some on "I had a really clever idea--what should[n't] I do?"), relevant links, etc. etc Ted

1 0

See y'all in a while....
by Phil Fraering 17 Dec '03

17 Dec '03

I'm leaving the list for a while while I try to work out a different way of accessing the net. In short, I've grown dissatisfied with my ISP and need some time to think things through before making other arrangements. It's too frustrating sorting through all of this mail without proper filtering scripts like I had set up back at srl03. And news is kind-of beside the point: the news server is always full, and rejects any attempt to post because of lack of space. In the meantime, while y'all discuss all that stuff about logical proofs and the like, please, _please_, stay away from crosswalks? I'll probably make another attempt at downloading pgp262s.zip before I shut this down... the first two times the modem (I think theirs) went flaky and dropped the connection on me. Okay. time to see if the signature service works. Later, dudes. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMBwQDCoTheIowlstareqnot8whaththeyEseemMI5rculIym8xjzYV8C mErjcooperUcoopermcooperqBviplMp =aBGi -----END PGP SIGNATURE----- +----------------+Quote from _Infinite In All Directions_, F.J. Dyson-----+ | Phil Fraering / \"The English Hierarchy, if there be anything unsound in| | pgf(a)tyrell.net\ /its constitution, has reason to tremble even at an air | +----------------+-pump or an electrical machine."---Joseph Priestly------+

1 0

Re: www remailer interface
by Will French 17 Dec '03

17 Dec '03

> 1. removing the hardwired > 2. removing the hardwired and forcing you to chain > 3. keep the hardwired in and use some 'established' remailer > or one the group can come to a consensus on. Given the second possibility, I see no reason to hardwire a remailer. It really will make people suspicious! I can easily imagine someone deciding not to use that remailer again, just on general principles. And anyway, chaining is not always necessary, especially if the sender is at a public Web terminal or using an anonymous Web proxy. The remailers don't enforce chaining, why should you? Will French <wfrench(a)interport.net>

1 0

Parental Advisory
by merriman＠arn.net 17 Dec '03

17 Dec '03

Just wanted to let folks know that I'm able to confirm that He is still monitoring the list. Got a response to my posting about my Web page :-/ I hope others will stop by and check it out - links to it welcome. Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

Re: Triple-DES controlled?
by Bill Stewart 17 Dec '03

17 Dec '03

>> Didn't the ANSI financial committee just adopt 3DES (over NSA >> objections)? >> Presumably they consider the export situation solved/solvable. >There is the trivial solution of buying outside the US. The hardware >is actually better these days as the Germans and others have a >worldwide market and the economies that brings. Also. the ITAR rules give banks and financial institutions Extra Slack for exporting crypto gear for their own use. In some ways that makes sense (electronic bank robbery could be a very profitable business, and bankers are politically influential), and yet some of the government's biggest objections to free crypto seems to be that it allows people to have financial privacy... #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- # Crypto in 3-4 lines of perl --> http://dcs.ex.ac.uk/~aba/

1 0

Prime Number Gen's.
by Rev. Ben 17 Dec '03

17 Dec '03

Does anyone know of where I could get source, royalty free, in the US for a good Prime Number Generator? One that used a set of quick probabalistic algorithms would be cool. Thanks Ben. ____ Ben Samman..............................................samman(a)cs.yale.edu I have learned silence from the talkative, toleration from the intolerant, and kindness from the unkind; yet, strange, I am ungrateful to those teachers.-- K. Gibran. SUPPORT THE PHIL ZIMMERMANN LEGAL DEFENSE FUND! For information Email: zldf(a)clark.net http://www.netresponse.com/zldf

2 1