- cypherpunks-legacy - lists.cpunks.org

Re: Impact of Netscape kernel hole
by John Young 17 Dec '03

17 Dec '03

Huge Cajones wrote: >Tim's post (although refuted by Marc) raises some serious issues since I >suspect that Joe Public has his secret key sitting in c:\pgp\secring.pgp Isn't it widely known that the secret key is not to be stored in the box, as the PGP manual and security pubs emphasize? Still, it would be good to know if a Netscape snooper could snarf a key while it is being used by PGP to decrypt, that is, whether the hole allows snooping on dynamic ops or just on stored info. Does anyone know if the the hole finders are discussing this on the Net, and if so, where? What are the folks at Netscape saying? Tom, Jeff?

5 5

Netscape Bug :)))
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just over the wire: Seems that there is a bug in Netscape including the new Communicator that will allow a web site to read *ANY* file on your computer. I repeate *ANY*, yes Virginia, *ANY* file on your computer. WebEx user and loving it. :))))) - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBM6DAn49Co1n+aLhhAQFdVwP+LQHkDPYPdqKDQyTxuYW23NgEHGotNyqB KJxk7uf93aGrbY6Zi+6+Y8JZeb7ce9usORYP6YWzRx1K/LhkEHn5un0aIRUlbHed rIxvt1S28bwuiXGrPOWNKTNXfEGb1x/YyBNshooclY1bz1YS1ZRk8t/vBl/aeTZy oWTpxeG/xjU= =Asb/ -----END PGP SIGNATURE-----

5 7

trusted time stamping
by weidai＠eskimo.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com -----BEGIN PGP SIGNED MESSAGE----- I thought my idea about having trusted entities digitally sign a document in order to establish its existence at a particular time was a new idea, but I just read about it in _Applied Cryptography_. Anyway, I wrote some C code to do automatic time stamping with PGP (source code is in the next e-mail). If you just want to try it, simply send an e-mail to weidai(a)eskimo.com with the subject "Time Stamp This Mail". The body of the mail will be signed with a PGP private key (public key is at the end of this message) and returned to the sender. E-mail with any other subject will be piped to my regular mailbox. What's the use of this? Well, here is an interesting application of time stamping that wasn't covered in _Applied Cryptography_. Let's say Alice would like to publish an article anonymously but retain the ability to claim authorship some time later. She can follow this protocol: 1. Alice signs her article with RSA 2. She encrypts her signed article with IDEA 3. She sends the encrypted article to several trusted time stamping servers 4. She places the signatures she gets back along with the encrypted article in a safe place 5. She waits a random length of time 6. She posts the plain article (without encryption or signature) anonymously 7. When Alice wants to claim authorship, she publishes the encrypted article, the IDEA key, and the signatures she got back from the time servers Now, people can be reasonably sure that Alice actually wrote the original article because the time server signatures prove that she signed the article before it was made public. One problem here is that at least one of the time servers she used must have remained secure until step 7. Comments? Wei Dai PGP Public Key avaliable -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLlRtiTl0sXKgdnV5AQFr+gQAsymOrN/Zd3C94NebWZOVFcl2tCkd/cSW EehvHxJMD1qO5fmmsDelhA+YKqqjLz8Dyp94pIqZXtWSu+kx/p5OUjB173PdAyN0 TSNaVMyZX266B/JIRqHI6+/5F2EWysFTXXH23v0mEH/us82Dvdb8rcqyKwQvjGZf mOvhObHf8Fo= =w0Q+ -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQBNAi5UWcgAAAECALp+QU9dtN2N4BjVr8OSxRPXtZ6UX4bLGq8PxpXru6WpsBD/ SJUl6jK4YcnatNJmjkl9oEHC6fjTpwMbZVOWJE0ABRG0MFdlaSdzIFBHUCBUaW1l IFN0YW1wIFNlcnZpY2UgPHdlaWRhaUBlc2tpbW8uY29tPokAVQIFEC5UWpenAxtl U5YkTQEBzDQB/3+eNgnW22sRaZFpBY3Wfzj4uEVXXcYU4vrdS1fsSRixJSEKta/N uyvmkeiB4GyyahhtHTtybywrRzD1y9IlwMmJAJUCBRAuVFmZOXSxcqB2dXkBAYNZ A/4/KHOQ1gjPEkdLhdPJ/yaXyQilqWV+MWiHblrqcDOrsFu1dKizJrBdWa5+vuIX nCu5DSq9cd3/cGrMOYK3OJGQC8JkPc6LNw7siuRGuVn413JBlM3wnCEXnFsAUhpG hDLTPUC2JqmiCwQP6OpxwqlTxPmZk8wKE0Sh/iaGRwZnBg== =vpgO -----END PGP PUBLIC KEY BLOCK----- PGP Public Key available

3 2

Re: FCPUNX:Flag Burning...
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

On 13 Jun 97 at 1:20, RS wrote: > To allow someone to publicly burn a flag is essentially displaying our > freedom being burned. Who is that most gravely desecrates the American flag? Those who burn it, spit on it, shit on it? Or those who violate the principles for which it stands? --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Outlawing the overhearing of conversations
by smb＠research.att.com 17 Dec '03

17 Dec '03

- I find a number which looks to be compressed or encrypted. I fiddle around with it and manage to decrypt it, and it turns out to be a useful to me (and possibly harmful to others). What law have I broken, plausibly? With the possible exception of this point, I suspect that we agree more than we disagree. My note included the following excerpt from the original: The bill makes it a crime to possess or use an altered telecommunications instrument (such as a cellular telephone or scanning receiver) to obtain unauthorized access to telecommunications services (Sec. 9). This provision is intended to prevent the illegal use of cellular and other wireless communications services. Violations under this section face imprisonment for up to 15 years and a fine of up to $50,000. My reply was keyed to the phrase ``unauthorized access to telecommunications services''. As I read it -- and you may differ -- the action that's being prohibited here is picking up things like ESNs, credit card numbers, etc., and using those to obtain fraudulent access to the phone network. I'm hard put to justify such behavior as ethical, and I have no problem with declaring it illegal. (Again, though, prudent folks and/or their insurance companies and/or the government may choose to use/mandate crypto. Banks started using DES authentication for EFT transfers because the Fed insisted -- they didn't see the problem.) As for decrypting numbers picked up over the air -- although I'm going to be vague, I suspect that there is a real issue here. Suppose that you run a pay TV service that you genuinely attempt to protect -- that is, you use DES or stronger. Am I *entitled* to watch for free because I happen to be smart enough and/or rich enough to crack DES? Can I legally or ethically give away or sell recovered keys? The point I'm making here is that you're making a reasonable effort to protect something, and thus implicitly declare it private and worthy of protection. This is in distiction to unencrypted transmissions (i.e., today's cellular stuff), security through obscurity (today's digital cellular), or marginally encrypted (frequency inversion). To be sure, I don't know where to draw the line here, and I don't think I want a judge (state-appointed or freely agreed upon) drawing it for me. Maybe we should take a leaf from NSA's book and say that 40 bits or less of key amounts to a welcome mat... --Steve Bellovin

2 1

Re: IBM sues critics?
by John Young 17 Dec '03

17 Dec '03

Secret Squirrel wrote: >According to a usually reliable contact in a position to know, IBM Friday >filed a liable suit against the 11 authors of the study >titled "The risks of key recovery, key escrow and trusted third-party >encryption" plus their employers and the Centere for Democracy and >Technology, which sponsored the report. According to my contact, IBM >feels that the report directly targets their own key recovery system, >and falsely implies that it isn't reliable. They are asking for >unspecified damages. If this report is true it's worth taking a look at IBM's policy paper "The need for a global cryptographic policy framework" to understand why the key study report is such a threat to Blue's global market strategy: http://www.ibm.com/security/html/pp_global.html IBM's economic incentive to attack the report is substantial, not least because it hopes to garner the lion's share of global GAK -- not that that's news.

1 0

Re: Anonymous proxies & ITAR question
by Rich Graves 17 Dec '03

17 Dec '03

Also sprach nobody: >Under ITAR regs, if a "foreign national" was to use the server to get >access to "munitions" (sure, software kills, didn't cha know?), could I be >held in violation? > >Even if all they had was circumstantial evidence, I'd really like to avoid >being indicted - puts a real kink in one's social schedule. > >Your thoughts on this would be appreciated. This is why we need more remailers, and why it's good that you posted anonymously. The proper thing to do is to be "shocked, shocked!" that anything illegal is happening on your server, immediately shut it down (counting on the network to be self-healing with the help of an enhanced remailer list), and offer to cooperate fully. Unfortunately, you don't keep logs, so you wouldn't really be able to help (damn!). -rich http://www.stanford.edu/~llurch/

4 6

Re: Impact of Netscape kernel hole
by geeman＠best.com 17 Dec '03

17 Dec '03

At 10:28 AM 6/14/97 -0400, Adam Shostack wrote: > > >| >Tim's post (although refuted by Marc) raises some serious issues since I >| >suspect that Joe Public has his secret key sitting in c:\pgp\secring.pgp > > Are FAT file lists stored as files? not exactly. you cannot just open and read. you must jump hoops; but does the nscp hole allow execution of arbitrary code? that would be much worse .... > > On a Unix box, /. refers to the file containing directory >entries, the list of files in the directory. If there is an analogous >file on a dos box, you can explore. so, no: not unless you can write your own foreign code and run it on the victim pc. (Does the bug work on Unix? I've >heard it only works if java or livescript are turned on, so it hasn't >worried me enough to investigate.) > >Adam > > > >-- >"It is seldom that liberty of any kind is lost all at once." > -Hume > > > >

1 0

Netscape Update
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Robert Hettinga wrote: > All this reminds me of something Tim May, Eric Hughes, and others have said > before. Once you've gotten to the point where loss of security equals, in a > very literal sense, loss of money, the incentive to publicize any given > security hole starts to go away. The Netscape PR department is no doubt preparing to spin the "bug fix" into a "major update." The fact of the matter is, the software does exactly what it was designed to do. The fact that those who are "out of the loop" found out how to use that designed feature does not make it a "bug." When the list got spammed with email from 10,000 Laker fans named "Bubba," I blasted plaidworks.com for their rudeness in trying to place all the blame on "hackers" when the fact was that they left their system wide open to abuse for the sake of convenience and profit. Similarly, the government and corporations want systems designed to allow them access to all available information passing through the internet system and then cry "abuse" or "security bug" when individuals discover how to use the design to their advantage. Calling the Netscape feature a "bug" merely serves to draw attention away from the fact that the software was intentionally designed in order to facilitate snooping (ala Clipper chip?) and that indicates that there have been people who have known how to take advantage of the feature since its implementation. Do the people who instituted the design and development of this snooping feature all have "Good Guy" stamped on their forhead? Sure they do... TruthMonger

2 1

Re: Democratic Assassination
by Paul Bradley 17 Dec '03

17 Dec '03

> > Speaking entirely hypothetically: If assasination bots were implemented, > > and I ran one, I would choose to keep a list of poloticians, DEA cops, > > censors etc. and only allow contracts on them, of course, there is > > nothing to stop anyone else running a server that accepted bets on > > anyone. I would just choose not to allow my equipment to be used for > > hiring assasins to kill innocent people. > > But by using this system, aren't we removing the concept of what an > 'innocent' person is anyway? A person 'deserves' to die when enough people > or money dictates that they should. I believe in this sense a DAP system would be a bad thing, but anonymous digital contracts in the more direct sense (ie. just a normal assasination contract as agreed today in meatspace, but using digital cash and other systems to make payments untraceable) are a better option as they remove this democratic side to the killings (although the democratic method prevents frivolous killings). I am not at all saying that a person "deserves" to die when enough people say they should, but merely describing the situation. It is currently the case that when someone becomes A. unpopular enough in public opinion, or B. unpopular with someone with a lot of money, they stand a chance of being killed for this. > Effectively you're censoring votes > for the assasination of a person who you don't feel deserves it - no matter > how many people donate money to that cause. > This destroys the whole 'democratic' idea of what this ideas about. Whoa there! An assasination bot and the hardware it ran on would be private property, I can choose to censor whatever the hell I want on private property. I personally would not run an AP type bot that democratised the process of assasination, as I have said I favour the probable outcome of a more direct contract system, but whether I did or not it is my decision who I accept bets on. If I choose to only accept bets on innocent children and old ladies, that is my own decision on my own property. Business suceeds through reputation, remember the basic principles of the free market... > Also, how do you tell the difference between an 'evil' and 'innocent' > DEA cop? ROFL, the very notion of an innocent DEA cop is a joke... Datacomms Technologies data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: FC76DA85 "Don`t forget to mount a scratch monkey"

1 0