- cypherpunks-legacy - lists.cpunks.org

Re: IWD_ism
by Thaddeus J. Beier 17 Dec '03

17 Dec '03

John Young wrote: > > 1-6-96. > > "Information-Warfare Defense Is Urged" > > The Defense Science Board said the Pentagon should > launch counterattacks against computer hackers by > injecting the attackers' computers with "a polymorphic > virus that wipes out the system, takes it down for weeks." > This is completely unbelievable, who are these people? I believe that the polymorphic virus is originally from the classic "Shockwave Rider" and was seen as an impossible fiction even in that book of improbable fiction. -- Thaddeus Beier thad(a)hammerhead.com Visual Effects Supervisor 408) 287-6770 Hammerhead Productions http://www.got.net/people/thad

3 2

FTC Online Privacy Report
by John Young 17 Dec '03

17 Dec '03

The Federal Trade Commission released yesterday: "Consumer Privacy on the Global Information Infrastructure" http://www.ftc.gov/bcp/conline/pubs/privacy/privacy1.htm Reuters 1-6-97: The Federal Trade Commission, which last year held a conference on privacy issues, said participants at the gathering agreed that businesses have four ways to protect consumer privacy: -- Notify consumers about how personal information collected online is used. -- Give consumers a choice about whether and how their personal information is used. -- Ensure the security of personal information is protected. -- Give consumers access to their own personal information to ensure its accuracy.

3 2

Re: The Upcoming DES Challenge
by Liz Taylor 17 Dec '03

17 Dec '03

There is nothing unglamorous about a known plaintext attack, if the plaintext is choosen carefully. I don't know anything about bank ATMs and the protocols they use, but I presume the PIN is stored on the card single DES encrypted. If this is so, anyone can take an ATM card, attack it to recover the key and then use that key to recover the PIN for any stolen ATM card of that bank (or that branch). Hopefully, the ciphertext/plaintext pair that RSA announces will be a real target like this, with the actual key disabled. Once the key is recovered, the press can then claim that ATM cards are not safe any longer. On a related note, do you think the key will first be recovered by a hardware device or by the Great Internet DES Key Search? Hardware is much faster, but no such device exists in the private/amateur sector now. Estimates are that it will take 10 months to actually build such a device. Opinions?

1 0

Re: The Upcoming DES Challenge
by sameer 17 Dec '03

17 Dec '03

> There is nothing unglamorous about a known plaintext attack, if the > plaintext is choosen carefully. I don't know anything about bank ATMs > and the protocols they use, but I presume the PIN is stored on the card > single DES encrypted. If this is so, anyone can take an ATM card, attack it > to recover the key and then use that key to recover the PIN for any stolen > ATM card of that bank (or that branch). Hopefully, the ciphertext/plaintext > pair that RSA announces will be a real target like this, with the actual key > disabled. Once the key is recovered, the press can then claim that ATM > cards are not safe any longer. Stolen ATM cards are actually not that valuable. They have fixed limits and require physical presence to exploit. Try swift/forex/etc. secret des keys.. those are valuable. -- Sameer Parekh Voice: 510-986-8770 President FAX: 510-986-8777 C2Net C2Net is having a party: http://www.c2.net/party/ http://www.c2.net/ sameer(a)c2.net

1 0

Re: Relative Strength of 40-bit Crypto Implementations
by Lucky Green 17 Dec '03

17 Dec '03

At 01:29 AM 1/7/97 -0500, Vin McLellan wrote: > A client asked me today about where he could find evidence of the >relative strength of different encryption algorithms, when all are >restricted to 40-bit keys. He assumed dot-Gov was going to restrict his >export product to the 40-bit limit, but he wanted to provide the strongest >security he could within that limitation. The best answer you can possibly give him is to move production overseas. Any 40 bit cipher is garbage. Period. It is easy to produce crypto overseas. Many medium sized companies are doing so today. Insiders claim that larger companies, such as Netscape, are in the process of setting up shop abroad as well. Clearly, one can't produce software containing crypto in the US and stay competitive at the same time. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://www.mersenne.org/prime.htm

2 1

RE: Thoughts on moderation
by Blanc Weber 17 Dec '03

17 Dec '03

From: Douglas Barnes I don't see this move as censorship of any sort -- cleaning the Augean stables is more like it. I am profoundly tired of wading through completely worthless and vapid trash accusing Tim and John of various sexual perversions. .................................................. So what about determining the lowest parameter of tolerance for style & content - how low you can go before your messages are transferred to the "flames" division? Then, for instance, Uni could say to Dale: "you will find my detailed retort to your deluded accusations on the other list" (which Dale would, of course, go over there and read <g>). In any case, everyone would know what that sensitive, low point of intolerance is such that if they descend to it they will be sifted out and recategorized. .. Blanc

1 0

Copyright loophole?
by azur＠netcom.com 17 Dec '03

17 Dec '03

While doing research at a law library, I came across what appears to be a legal loop-hole in the copyright law. It seems a famous author's publisher had a substantial number of unbound and unsold copies of his works sitting around. Another publisher purchased them from his publisher, without the author's knowledge, and printed an anthology which included an index which was not part of the purchased (copyrighted) items. In Kipling vs. G.P. Putnam & Sons (1903, CA2 NY) 120 F 631, the 2nd circuit found that (from 17 USCS § 501) "Publication of an index to accompany copyrighted volume of author's work although containing words and phrases found in text, does not constitute infringement." From the original opinion: "They were also at liberty to make and publish an index contained in their volumes even though the index, as necessary must, contain words and phrases found in the text." Q1: Could this decision (which has stood since 1903) support the creation, storage and distribution of "standalone" on-line indicies to copyrighted works without infringement? (I could not find a direct reference to "fair-use" in the portion of the opinion referencing the index nor a related ruling, using the 1976 Copyright Act, which overturned the "index' provision.) Q2: How much content can an index contain and still not infringe? Q3: What would be the legal standing of these indicies, or several unrelated "indexes", if they can jointly (but not separately) be used to reconstitute the original copyright work by a private citizen? (Anonymous index posting, especially via a Ross Anderson style Eternity Service, might "practically" circumvent government enforcement.) -- Steve

1 0

sig. files with PGP
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi there, I have a question reg. PGP: If certain parts of an encrypted message are known, does that compromise the security of the rest of the message? Example: If I always use a signature file, in plaintext messages as well as in encrypted messages, could an attacker knowing that signature file to be part of my encrypted message crack the rest too? Please copy replies to my private e-mail, for I am currently not subscribed to the CP list... Thanks in advance for your help, Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE * */ /* and PRIVATE ONLINE COMMUNICATIONS! * * */ /* * * */ /* E-mail: harka(a)nycmetro.com * * */ /* * */ /* Finger or E-Mail for PGP public key. * * */ /* Key Size: 2047 / KeyID: 04174301 * * */ /* Fingerprint: FD E4 F8 6D C1 6A 44 F5 http://www.eff.org */ /* 28 9C 40 6E B8 94 78 E8 */ /* Note: My old key (KeyID: B2728495) has been revoked. */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ ___ Blue Wave/386 v2.30 [NR] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMtN8SjltEBIEF0MBAQEEoQf/TVZO2Z9gr8Jik0SnbfE7VbrORETlD7q3 nqIsU5FY6iCJKmXy9Us/VW6LOyuRr0qAMbM8IAdMaX96P1FFFGoZ+6QAH1txV+xs i6+w6TKtHmLZDyMaa40hH5F3/sUUECT5MyW59McO2+seX3gYDwi+jLp6XVZq8BFs uLymgoDmh+NsDXBcOUs9ULCQy8rsu/nYmbwQxlWqhUnPw1o1nnuUGuBZaEfU6xJj gthebIpjCPh9YAthdI/XxE4bmYmS1AVhL4Fz6cwR9yMQ4JC3eEoZnhIUvFd16w6i eOo1Og9sD241ksJTjH7lT0qaRAQFh0ccEQoFoCP/7dAesVjwXKjRhg== =3u9n -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

SSL Insecurity
by Rick Osborne 17 Dec '03

17 Dec '03

A while back, someone posted an article on the insecurity of Netscape's implementation of SSL. Can someone send me back that article, or a few pointers as to where I can find related information? Thanks, Rick Rick Osborne / osborne(a)gateway.grumman.com / Northrop Grumman Corporation ------------------------------------------------------------------------- "Get that finger out of your ear! You don't know where that finger's been!"

3 2

Trade secret liabilty [Was Re: Sandy and I will]
by Michael Froomkin - U.Miami School of Law 17 Dec '03

17 Dec '03

a reliable friend wrote to me to say ... <quote> The Uniform Trade Secrets Act (which has been adopted by a majority of jurisdiction) provides for liability of a third party who knows or has reason to know that information he recieves or discloses was acquired by improper means or under circumstances giving rise to a fiduciary duty OR that he knows to be proprietary but which he recieved by accident or mistake. Depending on the facts, the language could encompass a moderator who knew about or turned a blind eye to distribution of trade secrets on his list. </quote> A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0