- cypherpunks-legacy - lists.cpunks.org

url
by m5＠dev.tivoli.com 17 Dec '03

17 Dec '03

At <URL:http://www.osf.org/~loverso/javascript/track-me.html> find some interesting "surveillance" applications of Javascript. ______c_____________________________________________________________________ Mike M Nally * Tiv^H^H^H IBM * Austin TX * I want more, I want more, m5(a)tivoli.com * m101(a)io.com * I want more, I want more ... <URL:http://www.io.com/~m101> *_______________________________

4 3

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

"Assassination Politics" Part 8 The following article appeared in the Sunday, February 4, 1996 issue of Asahi Evening News, in an article written by columnist Paul Maxwell, page 6. He writes a regular column about the Internet for this newspaper. "Networks: Paul Maxwell" "Dial Internet for murder" 'The first thing we do, let's kill all the lawyers." (Shakespeare, Henry VI). A startling and controversial idea has surfaced on the Internet recently--fear with me for a moment while I explain it. It is based on two technological developments: digital cash and encryption software. Briefly, digital cash is a system for transferring funds from one person to another on the Net. For this system to be as good as cash, the transactions must be capable of being conducted anonymously, just like in real life. (You go into the Seven-Eleven, buy a Cafe Latte, and nobody knows your name or your credit history. The purchase is not recorded in a database of your consumer preferences.) Several competing schemes for digital cash have been launched, but the one that eventually gains universal acceptance will surely have this anonymity feature. The second innovation is a kind of software called public-key encryption. It allows you to send a file or an email message that is "locked" in such a way that it can only be opened by the intended recipient. The recipient, however, cannot open it until given a "key." This "key" may then be used to encrypt a return message that can only be opened by the original sender. Freelance visionary and tinkerer Jim Bell has been following both of these developments for the past few years. Recently, he asked himself a couple of tough questions: "How can we translate the freedom afforded by the Internet to ordinary life?" How can we keep government from banning encryption, digital cash, and other systems that will improve our freedom?" Suddenly, Bell had a revolutionary idea. ("Revolutionary" is the word he uses, and it fits.) You and me--the little guys, the ordinary working people of the world--could get together, all pitch in, and pay to have every rotten scoundrel in politics assassinated. And we could do it legally. Sort of. Bell imagined an organization that would award "a cash prize to somebody who correctly 'predicted' the death of one of a list of violators of rights, usually either government employees, officeholders, or appointees. It could ask for anonymous contributions from the public, and individuals would be able to send those contributions using digital cash." He explains that "using modern methods of public-key encryption and anonymous digital cash, it would be possible to make such awards in such a way so that nobody knows who is getting awarded the money, only that the award is being given. Even the organization itself would have no information that could help the authorities find the person responsible for the prediction, let alone the one who caused the death." Are you following this? Let's say that we, the public, decide we've finally had enough of [insert name of villain]. Ten dollars from me, ten from you--suddenly there's a million dollars in a fund. The money will go to the first person who can "predict" the date, time, and circumstances of the villain's death. Obviously, this information is only known in advance by the assassin. He sends an anonymous, "locked" message. He kills the villain. He sends the "key" to the message. He has, without ever revealing his identity, "correctly predicted" the murder. The "key" that he has provided is then used to "lock the award money in a file that is then publicly posted on the Internet. Only the person who originated the key may open the file and claim the digital cash. In other words, public anger could finance cash awards for assassinations. The organization that collected the money and announced a list of possible targets would never know about a crime in advance, and would never know the identity or whereabouts of a criminal. It would not technically be guilty of conspiracy or complicity. Jim Bell has thought about this a lot, and feels that the idea is technically feasible, practical, even foolproof. Suppose for a moment he's right? What are the implications? World leaders live with the threat of assassination every day of their lives. But at the local level, this could really have an impact. And the "target" list wouldn't necessarily to politicians--any offensive public personality would be fair game. Picture yourself a year from now, sitting around with friends. Somebody says, "Remember when Juice Newton got whacked?" And you say, "Yeah--best ten bucks I ever spent." Satisfying as it might be to declare war on asinine pop singers, Bell has a more civic-minded suggestion: Let's kill all the car thieves. He reasons that a very small number of career criminals are responsible for nearly all car thefts. If one million car owners in a given metropolitan area contributed just four dollars a year, it would create $10,000 a day in "prize money" for the "predictor" of any car thief's death. "Assuming that amount is far more than enough to get a typical car thief's 'friends' to 'off' him," he writes, "there is simply no way that a substantial car-theft subculture could possibly be maintained." Jim as high hopes for his plan--he thinks it could eventually lead to the end of political tyranny. But if you don't like this idea, he has others. In a recent email exchange, I asked what he was doing now. "I recommend that you rent the movie, "The Day the Earth Stood Still.," he answered. "I'm working on a similar project." [end of article]

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

On Sun, 18 Feb 1996, jim bell wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > At 10:25 PM 2/18/96 EDT, E. ALLEN SMITH wrote: > > I've been kind of busy recently (the reason I haven't responded to > >the more recent Assasination Politics stuff), but I'm curious what > >your method is for achieving simultaneous explosions. > > > "Multiple very thin flexible hollow tubes (1 mm ID? teflon?) filled with a > homogenous liquid > explosive (for example, pure nitromethane), length accurately cut to produce > the exactly desired delay. Kept separated from each other by foam spacers > to avoid inter-fiber detonations. Detonated from a single cap, with an > intermediary chamber of liquid explosive to stabilize the shock front, the > detonation wave travels along each tube simultaneously at (presumably) > identical velocity." This method is so dependent on the uniformity of the initiator (the cap in this instance) as to be nearly useless. Normal blasting caps do not detonate with the uniformity required to initiate each of the tube paths at the same time. In the off chance that you contemplated surrounding the cap with liquid explosive of a sufficent type, (which still wouldn't assure proper uniformity with any certainty as the liquid explosive is as likely to detonate slightly off left to right as up to down) you still have extremely difficult problems to overcome. 1> Interference from the milling shape and accuracy of the openings to the tubes containing the liquid explosive. 2> Mild to obscure impurities in the liquid explosives causing differences in velocity with respect to other tubes. Even small changes in pressures within the tubes might cause enough timing problems to make uniform initiation of the primary high explosive assembly impossible. 3> Interference from the milling shape and accuracy of the terminus of the tubes containing the liquid explosive. 4> Overpressure in the device causing premature detonation of the near portion of the high explosive assembly. All of these might cause enough timing error to prevent uniform pressure and thus prevent uniform compression and make supercriticality impossible. Remember, kryonic switiches are necessary even when dealing with the speeds of electric conductivity. The velocities of even hydrazine based explosives are signigicantly lower. The margin for error is similarly lower. Plutonium gun is still the easiest method for the home grown nuclear device, even if it requires more fissile material. > It's a race, designed so that the detonation waves reach their targets (the > foci) at > the same time. If the detonation velocity was, say, 5,000 meters per > second, an accuracy of 0.5 millimeter in length would produce a delay > accuracy of 100 nanoseconds. > > Whatcha think? > > Now where did I put that pit... <G> > > Jim Bell > jimbell(a)pacifier.com > > Klaatu Burada Nikto > > -----BEGIN PGP SIGNATURE----- [...] > -----END PGP SIGNATURE----- --- My prefered and soon to be permanent e-mail address: unicorn(a)schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information

1 0

Re: A Challenge (perhaps!)
by Bruce Baugh 17 Dec '03

17 Dec '03

>I know it doesn't exercise key technology and relies on the secrecy of the >algorithm (which from my very limited knowledge on cryptography I think makes >it almost doomed from the start (?))... Yes, it does. Without the slightest insult of any kind to your friend, the problem is that the vast majority of "new" algorithms have actually been invented time and time again long ago. And the vast majority of those have been shown to have vulnerabilities. Phil Zimmerman writes about this in the PGP docs. It is overwhelmingly likely that your friend has, no doubt with the best of intentions, stumbled across something that has a simple flaw he doesn't know about. Further, secrets are hard to keep. PGP works _because of_ its publicity, not in spite of it. When the algorithm must be kept secret, every little thing must be watched. Just a few months ago, someone cracked the encryption on Microsoft's Win95 registry database by taking a snapshot of the contents of memory at a key moment. Other hacks break other efforts at secrecy. In fact, no sensible user should trust anything to a secret algorithm. I may not be able to tell the difference between Diffie-Hellman and Lillian Helman...but I can go talk to those who can. If the coders and evaluators I trust tell me there's a problem, I can go hunt up another solution. Doing anything else buying a pig in a poke. Now, there are a lot of not-sensible users out there. Slick marketing can result in a bundle being made. But it's not the best way to go. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

2 1

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"lull(a)acm.org" 22-FEB-1996 13:20:54.73 >In any case, throwing away some selected portion of its output is NOT >an appropriate cure for a broken random number generator. >The proper cure is fixing the generator. If I understand the matter correctly, looking at and sorting out a given set of outputs is bad. Looking at a sample (that is _not_ used) and using it to decide how much putting-together (XORing) of the rest to do is OK. They appear to be doing the former. -Allen

1 0

Big Java security hole
by Robichaux, Paul E 17 Dec '03

17 Dec '03

Forwarded to me by a fellow webmaster; I don't know the original source. -Paul Date: Sun, 18 Feb 1996 23:57:02 -0500 From: Drew Dean <ddean(a)CS.Princeton.EDU> Subject: Java security problems We have discovered a serious security problem with Netscape Navigator's 2.0 Java implementation. (The problem is also present in the 1.0 release of the Java Development Kit from Sun.) An applet is normally allowed to connect only to the host from which it was loaded. However, this restriction is not properly enforced. A malicious applet can open a connection to an arbitrary host on the Internet. At this point, bugs in any TCP/IP-based network service can be exploited. We have implemented (as a proof of concept) an exploitation of an old sendmail bug. If the user viewing the applet is behind a firewall, this attack can be used against any other machine behind the same firewall. The firewall will fail to defend against attacks on internal networks, because the attack originates behind the firewall. The immediate fix for this problem is to disable Java from Netscape's "Security Preferences" dialog. An HTTP proxy server could also disable Java applets by refusing to fetch Java ".class" files. We've sent a more detailed description of this bug to CERT, Sun, and Netscape. A second, also serious, bug exists in javap, the bytecode disassembler. An overly long method name can overflow a stack allocated buffer, potentially causing arbitrary native code to be executed. The problem is an unchecked sprintf() call, just like the syslog(3) problem last year. Many such bugs were in the alpha 3 release's runtime, but were carefully fixed in the beta release. The disassembler bug apparently slipped through. This attack only works on users who disassemble applets. The fix is to not run javap until Sun releases a patch. Note that we've only had success in exploiting the first flaw on an SGI. Windows 95 and DEC Alpha versions of Netscape have other bugs in their socket implementations that make it harder (although not necessarily impossible) to exploit the problem. This is the second time that unrelated implementation bugs have prevented us from demonstrating security problems in Java. http://www.cs.princeton.edu/~ddean/java will contain more information soon, including a revised version of our paper, to appear in the 1996 IEEE Symposium on Security and Privacy. Drew Dean <ddean(a)cs.princeton.edu> Ed Felten <felten(a)cs.princeton.edu> Dan Wallach <dwallach(a)cs.princeton.edu> Department of Computer Science, Princeton University For more information, please contact Ed Felten, 609-258-5906, FAX 609-258-1771. _______________________________________________________ Travis Weller WebMaster, Metrowerks, Inc. tcweller(a)metrowerks.com http://www.metrowerks.com/

3 2

No Subject
by Andy Silber 17 Dec '03

17 Dec '03

> NED_PUEV <NED_PUEV(a)HP-Loveland-om2.om.hp.com>, > Radar <radar(a)itouch.net>, > Denise HP TechSupport <sdm(a)hpuerca.atl.hp.com>, > sgajar <sgajar(a)crosslink.net> >Subject: FW: FWD>Bill O Rights >Date: Wed, 21 Feb 96 14:27:43 PST >Encoding: 120 TEXT >X-Mailer: Microsoft Mail V3.0 >Status: > > > > ---------- >From: Dave Behrns >To: MIS Mail Group >Subject: FW: FWD>Bill O Rights >Date: Wednesday, February 21, 1996 2:10PM > > > >>>To whoever may read this, >>> >>>This is not a typical letter, in that by passing it on to as >>>many people as you can, you are taking part in what may yet become the >>>world's biggest practical joke. The U.S. Government has rece ntly >>>passed an act which enforces censorship on the internet. A group of >>>internet users has now come together to kick back at this oppression, >>>and have a bit of fun at the same time. >The aim of this exercise is >>>to re-establish the United States as "The land of the Free", not a >>>fascist state where freedom of speech and thought are curtailed. >>>Communist Russia fell as a result of s uch limits being placed upon >>>the minds of the general populus. On receiving this letter, please >>>pass it on to as many friends or E-mail lists as you can. We predict >>>that if everybody copies the lette r to 5 other addresses, by February >>>29th 1996, this letter should have reached in excess of 2 million >>>people. That's when the fun begins........ >On February 29th, please >>>send the message: >>> >>>Dear Mr. President, >>>Do you remember this: >>> >>>And afterwards enclose the pre-typed copy of the Bill of rights. By >>>sending the letter on the date above, you will contribute to either >>>one huge petition for freedom, or else lead to a crash of the >>>whitehouse server.Send all letters to: >President(a)Whitehouse.gov >>> >>>Remember that solidarity is the key to success !!!!! >>> >>> >>>--------------------------------------------------- >>> >>>THE BILL OF RIGHTS >>> >>>Amendment I >>> >>>Congress shall make no law respecting an establishment of religion, or >>>prohibiting the free exercise thereof; or abridging the freedom of >>>speech, or of the press; or the right of the people peaceably to >>>assemble, and to petition the government for a redress of grievances. >>> >>>Amendment II >>> >>>A well regulated militia, being necessary to the security of a free >>>state, the right of the people to keep and bear arms, shall not be >>>infringed. >>> >>>Amendment III >>> >>>No soldier shall, in time of peace be quartered in any house, without >>>the consent of the owner, nor in time of war, but in a manner to be >>>prescribed by law. >>> >>>Amendment IV >>> >>>The right of the people to be secure in their persons, houses, >>>papers, and >>>effects, against unreasonable searches and seizures, shall not be >>>violated, and no warrants shall issue, but upon probable cause, >>>supported by oath or affirmation, and particularly describing the >>>place to be searched, and the persons or things to be seized. >>> >>>Amendment V >>> >>>No person shall be held to answer for a capital, or otherwise >>>infamous >>>crime, unless on a presentment or indictment of a grand jury, except >>>in cases arising in the land or naval forces, or in the militia, when >>>in actual service in time of war or public danger; nor shall any >>>person be subject for the same offense to be twice put in jeopardy of >>>life or limb; nor shall be compelled in any criminal case to be a >>>witness against himself, nor be deprived of life, liberty, or >>>property, without due process of law; nor shall private property be >>>taken for public use, without just compensation. >>> >>>Amendment VI >>> >>>In all criminal prosecutions, the accused shall enjoy the right to a >>>speedy and public trial, by an impartial jury of the state and >>>district wherein the crime shall have been committed, which district >>>shall have been previously ascertained by law, and to be informed of >>>the nature and cause of the accusation; to be confronted with the >>>witnesses against him; to have compulsory process for obtaining >>>witnesses in his favor, and to have the assistance of counsel for his >>>defense. >>> >>>Amendment VII >>> >>>In suits at common law, where the value in controversy shall exceed >>>twenty dollars, the right of trial by jury shall be preserved, and no >>>fact tried by a jury, shall be otherwise reexamined in any court of >>>the United States, than according to the rules of the common law. >>> >>>Amendment VIII >>> >>>Excessive bail shall not be required, nor excessive fines imposed, nor >>>cruel and unusual punishments inflicted. >>> >>>Amendment IX >>> >>>The enumeration in the Constitution, of certain rights, shall not be >>>construed to deny or disparage others retained by the people. >>> >>>Amendment X >>> >>>The powers not delegated to the United States by the Constitution, nor >>>prohibited by it to the states, are reserved to the states >>>respectively, or to the people. >> >> >> >

1 0

Re: "and two forms of ID"
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>You got my position completely backward on this. I feel much better now. :-). I really didn't want to cross swords with someone who's S/N ratio is as high as yours is around here. >You may be thinking of what I said about the >cost of defeating traffic analysis. That must have been it. >The natural state of the Net seems to be a kind of semi-anonymity. Ah. I believe this is what I'm talking about... >Trying to push it in either direction (complete traceability or >anonymity) is costly. I'm going to build a rant about this pretty soon, but I think that in a geodesic network, audit trails of any kind cost more money, particularly in the "fringes" of the network, where all the processor growth is going to happen, assymetries or not. As processors handle smaller and smaller stuff faster and faster, it becomes harder and harder to "control" and monitor all of them. To operate efficiently, they have to be more and more autonomous. One way to provide decision rules for autonomous processors is to introduce micro-e$ auction markets into the net's infrastructure. A good example might be packet routing. Suppose you attach some very skinny money to a packet (something issued with Micromint, maybe?), and strip it off as the packet goes through the network, sender pays. Routers price their throughput based on their load at any given moment. When you create this "economy of switches", it becomes harder to establish the hierarchical book-entry control/coodination models we all know and love, certificate hierarchies among them. I think that something like this might work as a way of randomizing traffic in a network of remailers, by the way. Let the market determine the remailer path. Specify the number of hops left, and attach enough money for that number of hops. This is one way for people to pay for the use of remailers, and eventually, it could map to packet-level-anonymity someday. For the moment, I'm going to claim that anonymous auction markets are always more efficient than identified, command economies, just like flight is faster than surface travel. At least that's what I think this morning. :-). More as I get some time. However, I do agree that it's foolish to simply declare that everything must be unauditable, just as it is to declare universal auditability. It's better to let the market figure this out. ;-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: PANIX.COM down: denial of service attack
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:09 AM 9/12/96 -0700, #6 wrote: >WSJ 9/12/96 > >Paraphrasing: > >Panix has been under attack for the last week by someone flooding >their server with bogus "requests for information" [see below] ... Even though service has suffered, Panix is still useable. Until I read the MOTDs on Tuesday, I thought it was just normal flakiness. DCF

1 0

ASS_alt
by John Young 17 Dec '03

17 Dec '03

EcoMist of Feb 17 has more on The Seychelles lure for wealthy outlaws; a look at Richleson's new book on spying; and the assault on Swiss vaults for outlaws and spies by outlaw, spying prosecutors. ASS_alt (for the 3) [Thanks to AS]

1 0