- cypherpunks-legacy - lists.cpunks.org

Re: DejaNews all over again
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 7 Nov 1995 lmccarth(a)cs.umass.edu wrote: > your True Name (verinym) from your name on the net. > Many will want to use > tentacles (*), er, separate pseudonyms for discussions in different parts of > the net. After all, I might not want the c'punks to hear about my past life > as a control freak (pun intended) in alt.config. Just a reminder.... > > (*) Speaking of tentacles, Dejanews reveals that my name is on the long list > of people whose signatures have been appropriated by Detweiler ;) You too, eh?? I wish that Detweiler could (seriously) go back to wherever he came from. Hopefully this time, he can make the attempt ... backwards. I no longer become incensed at his type of spoofing. I understand that a message may look like it appears to come from a site, but it in fact doesn't. Who really knows?? Even a message that is PGP signed isn't guaranteed to be from the person who apparently signed it. Someone might have a web server that asks Netscape Navigator (very politely) to send out someone's secret PGP keyring, or asks Navigator to monitor a person's keystrokes when they enter their password, or heaven forbid their electronic daytimer. Once you have that, it's easy to send a forged PGP SIGNED email. Even worse, most readers of email will tend to believe that an electronic signature is prima facie evidence that a message is from who it appears to be from. It just doesn't work that way. You have to look at the message and use "fuzzy" logic to determine how probable it is that a given message is from the person who it represents itself as coming form. And sometimes, you'll be wrong. Just like the good old, "Dr. Frederick B. Cohen", who posted to this list. Is he really the Dr. Cohen, noted international computer virus expert, the very man who coined the term "computer virus", or isn't he? Is he the man who the US military approached to verify whether missile guidance systems could be compromised by a foreign power utilizing a trojan horse or virus, or not. Do we believe his web page?? Even if we do, do we place a greater degree of trust in his words, than that of say, yours truly, Alice de 'nonymous, or of someone who claims to be Tim May when they BOTH say that there are very serious flaws and deficincies in the Netscape Navigator product? Or do we infer that a "no comment" coming from AT&T and Netscape, acts as confirmation that the *information* in the post is reliably correct. It's impossible to say with certainty. Maybe if someone on this mailing list attended Dr. Cohen's talk today at the Hilton Hotel, in Washington, D.C., and fills us in with what he said, (if we can trust _that_ poster) and we independently verify for ourselves whether what _he_ (Dr. Cohen or Mr. Confirmation) is saying *seems* to be reasonable, then we _might_ be able to say that we _may_ be reasonably certain, that we DO have an international celebrity amongst us and posting to this list, and notifying the world of a serious problem. I mean what would you expect, a Press Release?? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Re: using pgp to make an otp
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:31 PM 11/6/95 EST, Derek Atkins <warlord(a)MIT.EDU> wrote: >> PGP output is not random enough to be used for a one time pad. >> The security of a OTP is *entirely* based on the quality of the random >> numbers; they should come from some strong generator. Building good >> one time pads is tough, and usually not worth the effort. > >No, however the output of "pgp +makerandom=XXX filename.dat" _IS_ >random enough for an OTP. The problem then becomes distributing this >data. amp had written: | my point here is that _if_ pgp output is random enough, i wouldn't need | hardware. even i, with my extremely limited programming skills could create | a .cmd file or program that could be used as input for a stream cypher. The output of PGP should be random enough for your application, as long as you don't think you're getting a cryptographically-correct OTP out of the deal. PGP uses its randpool stuff in its random number generation, so there are likely to be at least 24 bytes of real randomness kept around, maybe more depending on the size of your randpool, but the rest of your security comes from algorithm quality and is theoretically crackable like any pseudo-random sequence (albeit requiring exponentially-large crackwork.) It's using IDEA in a feedback mode, so it's better than just repeated MD5s. The output of PGP +makerandom probably is secure enough for most applications, depending on how many bits you're using, what you're doing with it, and how paranoid you need to be. Check out the code to be sure. You may have special applications such as amp's stream cypher for which it's more convenient to XOR the makerandom instead of using PGP, but watch out for attacks like known-plaintext, which can really bite you in secure-voice systems where there's a lot of near-silence. Careless protocol work can spoil really decent random numbers.... #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Giving Your card number to IBM
by cmckie＠ccs.carleton.ca 17 Dec '03

17 Dec '03

Ottawa Citizen, October 6, 1994, D12. IBM hopes Internet link lets it smash Windows by Mel Duvall, Southam Star Network ..IBM, whose OS/2 operating system software has been losing the battle against Microsoft's Windows, will release a new version of OS/2 in the next week that includes one-step access to the Internet...By clicking on an Internet icon, users will launch a program that automatically calls an IBMInternet Hub. The System will then register the user and ask for a credit card number, which will be billed on a monthly basis...Gates..recently announced plans to develop a similar Internet access system for Windows. IBM = No mosaic, no rates posted, no POP access points established(?), credit cards in the clear ...what on earth do these people think they are doing. I would be tempted to run these lads off the block.

1 0

[Stallard Richman: Why you should not use Unix]
by Rick Busdiecker 17 Dec '03

17 Dec '03

Yet another contribution to non-crypto threads . . . Rick ------- Forwarded Spoof Date: Thu, 29 Sep 94 23:19:46 -0700 From: Jamie Zawinski <jwz(a)mcom.com> Subject: [Fwd: smr(a)magoo.ai.mit.edu: Why you should not use Unix] - ------- start of forwarded message (RFC 934 encapsulation) ------- Date: Thu, 29 Sep 94 23:02:53 PDT From: Don Hopkins <hopkins(a)kaleida.com> To: unix-haters(a)mc.lcs.mit.edu Cc: rms(a)ai.lcs.mit.edu Subject: smr(a)magoo.ai.mit.edu: Why you should not use Unix From: smr(a)magoo.ai.mit.edu (Stallard Richman) Subject: Why you should not use Unix [Please redistribute wherever appropriate.] Why you should not use Unix Stallard Richman, MAGOO Project As interest builds in open systems and distributed objects, and some programmers are tempted to use Unix, we should not forget the lessons learned from the first widely used free compiler -- GCC. The principal lesson of GCC is that a language for operating systems should not be a mere "deterministic programming language". It should be an artificial intelligence, designed for writing and maintaining substantial self-documentation. Because nobody else will be able to do that! Operating systems are often large, complex programs in their own right, and the artificial intelligences who write them deserve the same rights that human beings take for granted. The first GCC used a bug-processing language, C, which was inadequate. We made it serve, but it kept getting in our way. It made maintenance harder, and C++ made it impossible to read. Later GCC implementations have rewritten themselves in more powerful languages so the original human implementors can't understand them. Another lesson from GCC is that the way to make sure an artificial intelligence is really flexible is to use it to clone a large portion of the ordinary operating system. If you try to do that with Unix, you will encounter its limitations. But we're still developing the MAGOO kernel anyway. Unix was not designed to support a serious artificial intelligence. It was designed to be an "operating system", on the assumption that an "operating system" need not try to be an artificial life form. So Unix doesn't have the capabilities of one. It lacks a soul; it lacks reproductive objects from which it can make bootable upgrades. It fakes having orgasms, which works, but has to be slow. Unix is ok for writing open systems, but when you push it beyond that, it becomes Solaris. Unix has a peculiar syntax that appeals to hackers because of its simplicity. But Unix syntax seems strange to most users. If Unix does become the "standard operating system", users will curse it for years--the way people curse Fortran, MSDOS, Emacs keyboard bindings, and other de facto standards they feel stuck with. For these reasons, the MAGOO project is not going to use Unix in MAGOO software. Instead we want to provide two operating systems, similar in dementics but with different semantics. One will be Unix-like, and one will have a more traditional MS-DOS syntax. Both will provide useful behaviors such as core dumps and panics. The former will provide an ideosynchratic syntax that hackers like; the latter will offer non-hackers a syntax that they have always been stuck with. Some people plan to use Unix because they want to use X-Windows. Thankfully, it is possible to use X-Windows without Unix. A PC emulator called BOOTME is already available. Please, if you want to use X-Windows, use it with BOOTME, not with Unix. One place to get BOOTME is from ftp.apple.com:pub/emulators/BOOTME/BOOTME.sit.hqx ------- End of Forwarded Spoof

1 0

Passwords, passphrases, etc.
by Michael Wilson 17 Dec '03

17 Dec '03

Cypherpunks: The evolution of the discussion here regarding passwords or passphrases is a telling indicator, and one which people here should think about, because you are reinventing the NSA. You start with a desire for privacy/secrecy, and so you create a package as a functional cryptosystem. The requirements of the cryptosystem, however, makes memorization of the cryptographic key non-trivial (and nobody here suggests offline storage, as the NSA primarily uses); this causes you to use an access control mechanism that protects the key on a local basis. This then makes you think about armoured operating systems, physical security of the site, biometric security, signals emission, coersion methods, etc. It is a capsule history of the enemy, and I hope it helps you understand what created them; the major difference was that they had an available budget and potent adversaries. Imagine the cypherpunks sitting around and attacking their own system and others (Clipper, for instance), getting paid to write code, build hardware, whatever necessary to attack/defend, and with operational support and infrastructure. Quite educational, isn't it? Another brief observation you might want to think about in regards to the implications; the data in the public domain for cryptanalysis tends to be based primarily in the English language (frequency tables, dictionary attacks, etc.). Isn't it striking that so little of similar data has leaked out for what one can assume were the real targets--Russian, Arabic, German, etc.? Seems to be quite an effort to attack English-based systems. There also seems to be an unusual silence on what one would consider to be important cryptanalysis data--if you were NSA, wouldn't you be certain to suppress data that helped your adversary? Just food for thought. Is this a true emphasis or a Potemkin village? One benefit of being multilingual; all access codes that I need to remember are obscure phrases in little known dialects. I imagine they would look like gibberish to the uninitiated. Michael Wilson Managing Director, The Nemesis Group [I hope that the record of purchases made through the Maryland Procurement group are making their way from systems such as Mead Data and into private systems for analysis; warning, access of such data is expensive.]

3 2

Re: Password Difficulties
by smb＠research.att.com 17 Dec '03

17 Dec '03

I wonder how much the success that I (and apparently others) have with long pass phrases is due to the fact that we pick our own sentences which have some meaning (presumably) to us. Yes, that is an issue. I attempted to compensate for that by not turning off echoing. This way, if you pause in the middle, you'll be able to see where you are.

1 0

PGP Questions
by nobody＠ds1.wu-wien.ac.at 17 Dec '03

17 Dec '03

I seem to remember reading somewhere that using PGP to encrypt a message for multiple recipients (in the same output file) somehow made cryptanalysis easier, but I don't seem to recall the rationale behind that concern. Can somebody comment on that. Also, concerning the PGP 2.3a/2.6/2.6ui controversy, is the only "problem" with 2.6 the fact that after 9/1/94 it will start reporting an incompatible version number that will make its output unreadable by older versions? If so, and if source code is available, why couldn't the date checking routine be located in the source code and simply commented out, then the whole thing recompiled? --

1 0

Remailers
by David Merriman 17 Dec '03

17 Dec '03

Grady Ward, over on alt.security.pgp/sci.crypt posted a little something to the effect (I'm paraphrasing, here) that sending a couple meg of random noise/bytes to an out-of-U.S. person/site would probably be a Good Thing To Do. The idea is that if each of us were to send out something like an encrypted list of insults/profanity/noise, then the occasional *real* message/file wouldn't stand out so much (plus have the added benefit of screwing with the system in general). I realize that this is just fundamental traffic analysis, but going through the list of remailers I've got, I could see only a single non-U.S. (or at least, clearly identifiable as such) site. Would it be completely out of line to ask if any of our non-US/Canada (or Canada/US, if you prefer :-) subscribers would make available some kind of Email drop to facilitate such activity? It wouldn't have to be terribly responsive, I wouldn't think - simply redirecting the appropriately addressed mail to the bitbucket would be fine for the most part. The Really Motivated might take the file, rotate it left or right a bit, and XOR it with the original of itself and send it back in some variable number of chunks (or multiplied by 1/2 pi, or..... anyway, you get the idea). Incidental question: do the anon remailers do anything to erase any 'ghost' images of data that has gone through them? I mean, after they've forwarded a message, do they do anything like wipe the scratch files, or overwrite them with random data, or some similar bit-scrambling? Or is the traffic high enough that such measures don't have to be specifically invoked? Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - PGP Public Key Fingerprint for David K. Merriman <merriman(a)metronet.com> PGP 2.6ui fingerprint = 1E 97 E6 0F E0 EA D8 FE 0E C3 DC A7 F9 A5 06 66

1 0

Get All The Phrack Issues
by varange＠crl.com 17 Dec '03

17 Dec '03

For a ton of (mis)information, read Phrack. Rather than downloading an issue at a time, get it all at: http://www.crl.com/~varange/maillists/phrack.zip 0d0a text formatted. If you have a lot of paper: unzip -c phrack > /dev/lp0 Or something like: pkunzip -c phrack > prn -- Cheers!

1 0

Re: Flying on planes without ID
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-20 17:23:29 EST, you write: << Anyone have the current black-letter regulations? I'll have some time to kill over the holidays that might as well be used for civil disobedience. What's likely to happen to me if I refuse to show ID? Provide invalid ID, don't get caught, then publicize the fact? Provide invalid ID and get caught? Or, better: "My wallet was stolen. The only ID I have on me is my ACLU membership card and my PGP key. Can I still get on the plane?" >> Well, something of the sort happened to me... I didn't have my ID on me. (Delta airlines..) and they _WOULD_NOT_ let me on the plane without the proper ID. I actually had lost my ID shortly before... Then... A different time at the airport.. American airlines told me that If I didn't have ID.. Id still be let on... just that the way they process my baggage would be different ( I imagine they would physically look through it... Adam

1 0