- cypherpunks-legacy - lists.cpunks.org

The last I'll say on the unsubscribing thing
by Brad Shantz 17 Dec '03

17 Dec '03

I'm did not say that the people sending the messages to "unsubscrive" were justified in what they did. YES, it is written in the welcome message. I just think that maybe we need to be a little tolerant of a few people out of 1200 who made an honest mistake. I still believe that the people sending the messages haven't read Tim's "nth Fucking Time" message. Or his "Under attack by foreigners" message. Or my response about their lack of ignorance. (Tim, I just mentioned your messages because they came to mind. **GRIN**) Steve, I even think that they didn't read your "unsubscrive list" message, which I thought was wonderful. I just think that instead of complaining to the list they're trying to remove themselves from, we should send them mail individually. I'm sure that Tim already has. (at least he said he did...i think.) Since I posted yesterday, I have received a nubmer of messages from people interested in removing themselves from Cypherpunks. I sent them the paragraph from the welcome message. And that was that. Brad

1 0

Re: No matter where you go, there they are.
by Hal 17 Dec '03

17 Dec '03

Peter - didn't they say that the checking station is also listening to the satellites? That way they can tell that you are playing back signals that you taped earlier because they won't match what the satellites are broadcasting right now. I think your idea would work if you wanted to pretend to be at a point which was _farther_ from each of the satellites than where you actually are. Then you could delay all of the signals. But the only way to be farther would be to be deep underground. You might be able to pretend to be at the center of the earth, but that is not very useful. Actually I suppose this only applies to those satellites which are shared between you and the checkin station. If you are far away then maybe you only share one or two. If you know which ones those are, you can lie to your heart's content about other ones, and for the shared ones you can again delay the signal and claim to be farther than you are. If their authenticated repeaters are used then you have to assume the checking station has all the satellite signals and again the best you can do is pretend to be a Mole Man. Hal

1 0

Re: No matter where you go, there they are.
by jim bell 17 Dec '03

17 Dec '03

At 08:41 AM 4/10/96 -0400, Perry E. Metzger wrote: > >Anonymous writes: >> >> Location-based System Delivers User >> Authentication Breakthrough >> >> By Dorothy E. Denning and Peter F. MacDoran >> Copyright(c), 1996 - Computer Security Institute - All Rights Reserved >> Top - Help >> > >A bunch of us heard about this a while back, and I was in on an >exchange between several people including Phil Karn and Dorothy >Denning. The gist of it is that Denning et al believe they have >something -- and they are smart people -- but all the smart people who >understand both GPS and crypto think its total bunk and not at all >hard to fake being anywhere at all. I would say that I go with the >latter. The latter is far closer to the truth. First off, GPS signals can be faked. In fact, there are commercial boxes sold that generate a full synthetic constellation of GPS signals; these boxes are usually intended to simulate motion of a vehicle when the GPS unit under test is actually stuck in a laboratory or factory floor. If such a box were connected to an amplifier of a few tens or hundreds of milliwatts, it would be possible to park near a potential target and deny him service by making it look like his signal came from anywhere else around the world. (Military boxes would detect this because of A/S, however.) And if you had a receiver at some specific location at which you intend to appear to be connected at, it is likely that full data describing the motions of the satellites could be supplied to any other location on the Internet needing well under 14,400 bps. Jim Bell jimbell(a)pacifier.com

1 0

CoS supoenas records of all anonymous remailers? (Unverified)
by Declan B. McCullagh 17 Dec '03

17 Dec '03

[FWIW, Biased Journalism is a reasonably reputable source. --Declan] ---------- Forwarded message begins here ---------- Date: Tue, 9 Apr 1996 18:27:02 -0700 To: fight-censorship+(a)andrew.cmu.edu, eric(a)remailer.net, farber(a)cis.upenn.edu (Dave Farber) From: jwarren(a)well.com (Jim Warren) Subject: (fwd fyi - NOT verified!!) very urgent news Seems like it's just a tad overbroad, if true. Another example of, "all the 'justice' that one can buy"? --jim >Date: Tue, 9 Apr 1996 15:44:52 -0700 (PDT) >From: shelley thomson <sthomson(a)netcom.com> >Subject: very urgent news >To: jwarren(a)well.com > >Hello, Jim Warren: > > The church of scientology plans to subpoena the records of every >anonymous remailer in the USA. > > I publish a news/black humor magazine on the net called **Biased >Journalism**. As a journalist I have covered the collision between the >church of scientology and the net. My last three issues have focused on >legal action by the church against Grady Ward and Keith Henson. > > Today I had a note from Grady Ward, whose deposition was finished >today. He said that they asked him a lot of questions about me, and >warned me that they may issue a subpoena for me and a demand for my >email. > > The church presumably intends to claim that I am not a real >journalist because I only publish on the net. I need to prepare a legal >defense, and needless to say, can't afford a lawyer. If you can direct >me to any resources, I would appreciate it very much. > > On the basis of events today, Ward believes the church will >issue subpoenas for the records of every anonymous remailer in the USA. > > If these records are delivered to the church, our First Amendment >rights go with them. > > Shelley Thomson > > publisher, **Biased Journalism** > 800-731-0717 voice message >

2 1

Re: No matter where you go, there they are.
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-04-10 10:33:19 EDT, D. Denning allegedly writes: >For two-way authentication, the reverse process would be performed. In the >current implementation, location signatures are 20,000 bytes. For >continuous authentication, an additional 20 bytes per second are >transferred. Re- authorization can be performed every few seconds or >longer. The location signature is virtually impossible to forge at the >required accuracy. This is because the GPS observations at any given time >are essentially unpredictable to high precision due to subtle satellite >orbit perturbations, which are unknowable in real-time, and intentional >signal instabilities (dithering) imposed by the U.S. Department of Defense >selective availability (SA) security policy. Further, because a signature >is invalid after five milliseconds, the attacker cannot spoof the location Umm, excuse me, but doesn't it take longer than 5 ms for a data packet to transit from point A to point B? We ARE talking about transmitting via the Net here, aren't we? >by replaying an intercepted signature, particularly when it is bound to the Replaying an intercepted signature would completely unnecessary. GPS positions are calculated by comparing the phase differential between several different satellite signals. It would be trivial for anyone who understands the inner workings of reprogram their GPS receiver (or build a hacked one) to give a false location. Simply calculate the distances to the satellites relative to your position, (GPS already does this to determine your position) and then calculate them in reference to another location. (This other location would have to be close enough to receive signals from four of the same satellites that you are receiving, if I remember GPS specs correctly.) Phase-shifting the signals according to the distance differences between your true location and the other location yields a signal set that can be fed into any GPS receiver to yield the other location, in real time. >message (e.g., through a checksum or digital signature). Continuous >authentication provides further protection against such attacks. See above. Is this a troll? Jonathan Wienke

1 0

Re: Add-in encryption module to Netscape
by Peter Trei 17 Dec '03

17 Dec '03

runner(a)asiapac.net > Hi, > > Lurking here for quite some time until now a real problem has come up and I > need help here. > > I'm not in the US of A and the Netscape commerce server that my employer > recently purchased has only 48bit key (as told by the salesman). My question is > whether it is possible to add-in my own security module (RSA) and secondly, how > difficult is it? The salesman cannot answer me. > > Thanks a lot. Funny, this looks an awful lot like a query (with an apparently real name attached) which appeared in www-security last week from Malaysia. I'm aware of the following servers, available outside the US, which claim to offer 128 bit SSL encryption: Apache-SSL Unix see http://www.algroup.co.uk/Apache-SSL free, commercial support available. supports client authentication Available from British sites Sioux Unix (solaris) see ftp://ftp.inect.co.za/pub/products/sioux/ANNOUNCE support client authentication Based on Apache 2500 Rand Available from South Africa Alibaba NT/Win95 see http://alibaba.austria.eu.net/ Available from Austria US $599 Zeus Very nice website at http://www.zeus.co.uk/ Unix 999 UK # Available from Britain COSMOS Unix Nice site at http://www.ristech.com/SOMMAIRE/B_PRODUITS/INTERNET/ WebCompare claims this has SSL2, but I can't find a mention of their Website. US $2000 and up. Available from France. For a survey of web servers, I strongly recommend WebCompare: http://www.webcompare.com Peter Trei

1 0

Re: Nazis on the Net
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Apr 21, 1996 17:23:00, '"E. ALLEN SMITH" <EALLENSMITH(a)ocelot.Rutgers.EDU>' wrote: > In view of the Zundelsite business, I thought people might find the >following of interest. Unfortunately, the author is either leaving >some critical information out or is misinformed. Specifically, the actual >history on the Zundelsite business, and the actual circumstances at Ruby Ridge; > >on the latter, Randy Weaver was neither a neo-Nazi nor a racist. He was (and, >so far as I know, still is) a white separatist. (One would think liberals >would >tolerate this - they tolerate the equally offensive black separatists, after >all...). The Zundelsite reference is incomplete in that it fails to describe >the motivations of the mirrorsites. > -Allen Since E.A. Smith wants completeness re the Zundelsite issue, I am curious about his assertion about Weaver. Might we know the source of his complete info on Weaver's political and racial beliefs. I see, in essence, three hypothesis: 1) Cover the ass of a potential neo-Nazi or racist (or both) without any reference to what is really true; 2) Get information from outer space; 3) Base the conclusion on hard evidence. If the answer is 3) I'd like to get a real pointer to the real evidence. By real evidence I mean just that, not wishful thinking or advertising jingles for points 1) or 2). --tallpaul PS: Cypherpunks seems to be getting very wiggy these days.

1 0

OFF Topic: MS-Exchange bug (winmail.dat)
by Sentiono Leowinata 17 Dec '03

17 Dec '03

I need help to disable the long-trailer from MS-Exchange. Everytime my friend sends me an e-mail, the "trailer" (winmail.dat) always there. How to disable it or turn it off? I believe someone mention about this "feature" in this mailing list long time ago, but I can't find it in my archive. Thank you. Sent. ps. can Winmail.Dat be considered as cryto-useless? <grin>

1 0

Re: E-mail harassment by c2
by Rich Burroughs 17 Dec '03

17 Dec '03

At 08:48 PM 4/20/96 -0400, you wrote: >Dear folks at C2, > >If people don't ask you to be placed on a mailing list they jolly well >don't have to follow *your* instructions to get taken off. [snip] I think you're missing what happened. Someone subscribed the address for the _cypherpunks_ list to the clueless list. The "welcome to clueless" message got sent to you via the cypherpunks list. Notice the instructions from C2 say: >If you ever want to remove yourself from this mailing list, >you can send mail to "Majordomo(a)c2.org" with the following command >in the body of your email message: > >unsubscribe clueless cypherpunks(a)toad.com The email address there is the cypherpunks list, not yours. The reason you received the second email is that majordomo(a)c2.org (the address you sent mail to) is not a person -- it's a mail list administering program. Your mail had no command that majordomo recognized, so it sent you the majordomo help file. That's what it's supposed to do. You aren't being harassed by anyone. You aren't on the clueless list. You are on the cyperpunks list -- if you want to unsubscribe, send email to majordomo(a)toad.com with the words "unsubscribe cypherpunks" (without the quotes) in the body of your message. Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

3 2

Re: ApacheSSL
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:50 PM 4/20/96 +0000, umwalber(a)cc.UManitoba.CA wrote: >An ISP that I have ties with is looking to set up a secure server. >Currently, they are running Apache. I told them that for ~$500 they >can put on Apache SSL and be all ready. However, they want to buy >Netscape (for the name, I've already given them the 40bit gospel), >put it on a separate, firewalled machine, allow no access to it, etc, >etc. Is all this paranoia necessary? If they're handling money, then, yes, the paranoia is probably necessary. Aside from the 40-bit vs. 128-bit issue, one of the big security risks of SSL and similar systems is that the server they run on is typically sitting right out there on the Internet waiting for somebody to crack it, and keeping credit card information on the same rather than handing the encrypted information across some secure interface (whether a firewall or dedicated RS232 or whatever.) A bulletproof 128-bit interface doesn't help if it's running on a cracked machine. Putting it on a separate firewalled machine is a Good Thing. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

5 4