- cypherpunks-legacy - lists.cpunks.org

Re: Revoking Old Lost Keys
by Alan Olsen 17 Dec '03

17 Dec '03

At 12:02 PM 1/7/96 GMT, you wrote: >shamrock(a)netcom.com (Lucky Green) writes: > >>I would very much like to see expiration dates on public keys. Is PGP 3.0 >>offering this feature? > >I would very uch like to see PGP 3.0, but that's another story... So would I. I posted a message to alt.security.pgp and sci.crypt stating that "I had found the release schedule for PGP 3.0 on page 16 of Applied Cryptography (1st edition) and was wondering if had been updated for the second." I got lots of answers, but no one seemed to look at what was on page 16. (It happens to be the examples of incredibly huge numbers.) No wonder I have so little faith in that newsgroup... | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: Microsoft continues to mislead public about Windows security bugs (a bitlong, with references)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 12:01 1/8/96, James A. Donald wrote: >At 07:15 PM 1/8/96 -0800, Rich Graves wrote: >>As Microsoft well knows, this is completely untrue. [...] >> >> [...] >> >>Microsoft has not even admitted that this bug in both Windows 95 and >>Windows for Workgroups affects Windows for Workgroups, apparently because >>they have decided not to fix it. >> >> [...] >> >> We believe that it would be highly irresponsible to release the full >> version of this hack, but we will soon release a crippled >> demonstration-only version >> >> Is anybody listening? > >They will listen if you start to release full uncrippled exploits, after >a reasonable delay. Very true. But why does it always seem to take an exploitable crack before companies pay attention to security flaws? Is it because they are unable to admit that they have made a mistake? Everybody makes mistakes. What's the big deal? I really don't understand it. Any psychologists on this list? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Eavesdrop Law
by John Young 17 Dec '03

17 Dec '03

As variation on the recent discussion of employee e-rights, WSJ today: New eavesdropping law creates labor-management tussle in Illinois. The Illinois AFL-CIO is going to court to fight a provision in a bill Gov. Jim Edgar signed last month that the labor group says allows employers to listen in on employees' conversations "for virtually any reason." A spokesman for the Illinois Retail Merchants Association, the provision's prime backer, says such fears are "wild speculation." Critics say the provision's language, allowing monitoring for "service quality control or for educational, training, or research purposes," is far too broad. The retail merchants association notes that employers are responsible for the conduct of employees who deal with customers over the phone.

1 0

Re: SSH for Windows
by Alex de Joode 17 Dec '03

17 Dec '03

: ...can be found at URL http://public.srce.hr/~cigaly/ssh/. FYI. also on ftp.hacktic.nl/pub/replay/pub/incoming/ssh-1-2.zip (the .hr link is _very_ slow) -AJ-

4 3

Re: please stop the Mitnick stuff
by Perry E. Metzger 17 Dec '03

17 Dec '03

Gordon Campbell writes: > >When there are one or two small items posted on a topic thats no big > >deal. When its a lot of stuff, it becomes an enormous pain. Multiply > >the few seconds to read and digest enough of a message to know you > >should delete it by dozens of messages per mailing list per day and by > >a dozen mailing lists and you suddenly have an untenable waste of your > >time. > > I con't recall you speaking up against the various flame wars that have been > going on in here lately, Perry. Thats because I largely send people private mail. I try not to nag in public. Just because you don't see me say "this is irrelevant" doesn't mean I didn't notice. Perry

1 0

Can you break my encryption protocol ?
by Mark Grant, M.A. (Oxon) 17 Dec '03

17 Dec '03

I'm trying to put together a simple protocol for encrypting confidential but typically low-value data (i.e. I don't want people to be able to read it, but in most cases it wouldn't be catastrophic if they could). I want it to be completely license-free, so I can't use RSA or other patented algorithms. It also would only be used inside one organisation, so key management isn't so much of a problem, and the main attack it has to defend against is packet-sniffing on the Net. It also has to support variable-length keys for ITAR.. The idea is as follows.. Client and server both have copies of a passphrase, of any length. When starting the connection, client sends 128 random bits to the server. Both ends take this data, append the passphrase, and use MD5 to generate a session key. If a key of less than 128 bits is required for legal reasons, then the appropriate number of bits are retained, and the rest replaced with bits from the random data that was sent in the clear. That is, if you're only allowed 40 bit security, you take the first 88 bits that you were sent, and append the last 40 bits of the generated key to give you the session key to use. You then go off and encrypt the session (probably using 3DES or Blowfish). Can anyone spot any flaws in this system ? The only potential problem I can see would be that by cracking a number of sessions you could work out the passphrase. However, I think the number required would still be infeasible. Also, are there any known problems with using Blowfish for encrypting a data stream ? I'm assuming it's OK as it's used in PGPfone. Mark

2 1

RE: S.652 (H.R. 1555) (\"obscene, lewd, lascivious, filthy, or indecent...et al\")
by John Young 17 Dec '03

17 Dec '03

Responding to msg by blancw(a)accessone.com (blanc) on Tue, 9 Jan 8:41 PM >What needs to do is to learn to speak like politicians. > Learn to go around the subject, make indirect >reference, make vague allusions, be indirect & >wavering, ambiguous & obfuscating, evasive & >hypocritical; never openly offending, never possible >to be held liable for having said anything of >consequence. > >Of course it will still be annoying, but how can they >criticize their own style & manner. Ah, you've godiva'd le roy, and guttered moi.

1 0

Re: PRIVACY: Private traces in public places
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Responding to msg by tcmay(a)got.net (Timothy C. May) on Wed, 10 Jan 0:9 AM >I'm not trivializing the issue of search engines and >archiving systems turning up articles written, old >posts, etc. Every couple of weeks, sometimes more >often, someone sends me a copy of one of my postings >and claims that someone else must be forging my name >(recent posts on racial issues, for example--while I'm >not a racist, I despise quotas, setasides, and >preferential treatment for lazy people, of any >race...this obviously makes some people "ashamed for >me" :-}). http://nytsyn.com/live/News3/006_010696_101827_2723.html Last summer the first case in Britain of a libel on the Internet was settled out of court when Laurence Godfrey accepted undisclosed damages from another nuclear physicist, Philip Hallam-Baker, over remarks made in 1993 on Usenet, an electronic conference with 16 million users. And Peter Lilley, the Social Security Secretary, sent a stiff letter to the vice-chancellor of Leeds University after one of its students used a faculty computer to make defamatory allegations about him.

1 0

Re: Encryption sales ban costs U.S. $60 billion
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:40 PM 1/7/96 -0800, dang(a)netcom.com (DRG) wrote: >S.F. Examiner: > >ENCRYPTION SALES BAN COSTS U.S. $60 BILLION > >NEW YORK U.S. companies will lose as much as 30 percent of the $200 >billion in U.S. computer system sales expected in 200 because of federal >export laws that limit the encryption of information, a recent study found. OK, so crypto export laws will cost about as much as direct expenditures on the War On Politically Incorrect Drugs, or medical costs of tobacco. No problem.... :-( #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "The price of liberty is eternal vigilance" used to mean us watching # the government, not the other way around....

1 0

Certificates: limiting your liability with reuse limitations
by Michael Froomkin 17 Dec '03

17 Dec '03

Suppose I am a CA. I am worried that by issuing a certificate with a lifespan of more than 2 milliseconds I am opening myself up to unlimited liability if for some reason, despite my best efforts, I issue an erroneous certificate. I know I can write disclaimers, but that's not reliable since courts often ignore them, and anyway it scares off customers. I know I can put an expiration date on the certificate, but that's not enough. I can accumulate a lot of exposure in a few seconds, much less weeks. I know I can put a reliance limit in the X.509 ver 3 certificate, but that's not enough. Even a $1 limit could be used many millions of times. Is it feasabile to say: Can only be relied on once per day/week/month? Is this something the relying parties can reasonably be expected to monitor? It seems to me that this sort of a limit is essential if a CA is to feel comfortable outside Utah.... A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

4 3