- cypherpunks-legacy - lists.cpunks.org

hunting for no hole in PGP
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

>How do you propose that a user's keystrokes can be analyzed? I have an idea. (many voices groaning...) The "reduced keyspace" and the "subliminal channels" fear both come from the mysterious process of choosing the 128-bit IDEA key. The other bogeyman that I hear the most about in PGP is the public/private key generation. Random numbers scare people, including me. Could PGP use and IDEA key that is the MD5 hash of the "random number" (the way it is currently calculated) concatenated with the message itself? It would be easy to verify that the correct key had been selected. It would be impossible for some "ghost" in the random number routines to use a predictably reduced keyspace, or to send subliminal data, because its output never (directly) gets sent. Something similar could be done during public/private key generation. Have the PGP folks considered doing something similar? Sometimes this seems like a good idea to me, and other times it looks like useless effort and one more opportunity for something to go wrong. Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0

Re: a hole in PGP
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 8:08 PM 7/31/95, Dr. Fred said: >it is impractical to verify that there >are no subtle back doors Ah. I knew my undergraduate philosophy degree from good ol' Mizzou would come in handy some day. In the sophistry biz, the above is an informal fallacy. It's called a disproving a negative, more popularly called the "Flying Saucer" fallacy, as in, "prove to me that flying saucers (or PGP trap-doors) don't exist". I would put the rest of your rejoinder in the same class of tinker-toy logic, Doc. You're testing my patience. Feeling flush from my New Orleans road trip, I went out and bought the commercial version of Eudora, filter-feature and all, which means I'm just itching to test it. In other words, it means you are flirting with the kill-file, the bozo-filter, more rudely, a <plonk!ing>. Play nice, Doc, or don't play at all. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

5 5

Re: Set phone permit "wire" taps
by Rich Salz 17 Dec '03

17 Dec '03

Sorry to keep cluttering up the list. I'll try to make this my last message in this thread. You did not answer my request. Of course you're under no obligation to do so, but a claim like the following: >I've been arrested too amy times, an done enough local, state, and >federal time to know. Is just too hard to accept without verification. Please tell me, if not the whole list, where and when you've been incarcerated -- preferably at the federal level -- so that I can, say, call the warden and verify. >Now SHOW ME something. Sure, what? If you have more questions after looking at my homepage http://www.osf.org/~rsalz/ let me know. Or for more fun, here's my SSN: 314-15-9265. >You sure question a lotta credentials, >like you've REALLY been somewhere or done something. I don't see how these two parts relate, but I've never done anything cool like you might be thinking of. In my professional life I'm primarily a programmer who's written lots of code, and been able to give away some of it. I just think you're a fake. >Love Always, Kisses to you too, but I'm still waiting for an answer. /r$

1 0

pkzip cracking
by an264373＠anon.penet.fi 17 Dec '03

17 Dec '03

Does anyone have a utility to crack password encrypted/protected zip files? Or an address to download one? All replies / flames / pointers appreciated. Sauroth ---------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. If you reply to this message, your message WILL be *automatically* anonymized and you are allocated an anon id. Read the help file to prevent this. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Info
by Mabidex1 17 Dec '03

17 Dec '03

Hey guys, I know next to nothing on this sort of stuff, but I do have a friend that works at the phone company...I'm REALLY interested in learning the ins and outs of the trade... have any Ideas where I can start? what files I should read, etc... I would appreciate your help... Mabidex 102415.404(a)Compuserve.com

1 0

Re: Sex & Crime TV filter
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> >However, to help derail this V-chip being mandated, what if we (I mean > >activists, writers of columns, etc.) "insisted" that _commercials_ be > >similarly labelled? > > I love it. Great idea, Tim! Someone in Germany developed a device which stops the VTR while they are showing the commercials, but it isn't available yet. Hadmut

1 0

Re: Commercial killers
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 1:00 AM 8/1/95, Robert Hettinga wrote: >God help me, all of this reminds me of a Carl Sagan book, of all things. >One of his science fiction characters was said to have made his first >fortune by building a commercial zapping chip for VCRs. > >Butthead Astronomer, indeed... There have been _billions and billions_ of proposals for commercial zappers. (Actually, not such a saganesque number, but dozens at least.) Harry Bartholomew was telling me a year or so ago about some ideas for detecting volume changes. I think, however, the problem of distinguishing commercial from non-commercial signal is, I think, a tough one. My point earlier was not to actually do this, but to suggest that if the V-chip is to code various kinds of content, then the logic is strong for commercial content to be similarly coded. (For example, schools often show taped broadcasts...they might claim that it would be harmful and improper for children to be exposed to beer commercial during school hours...) This would gore the ox of the advertisers, so they might quietly have the whole V-chip thing killed. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

3 2

Re: a hole in PGP
by Doug Hughes 17 Dec '03

17 Dec '03

>How is it "unscholarly, unprofessional, needlessly personal, and just >plain insulting" to question the idea that hundreds of thousands of >people are trusting their freedom to software that is probably not >secure? I think it is highly unprofessional to try to claim that PGP is >secure and to try to bolster that position by claiming that some >"Request for Comments" supports it when that same said RFC refutes it. ... ... >As far as the potential that they are working with the NSA to subvert >personal privacy, it is a potential, just as it is a potential that I am >working with the NSA to undermine confidence in PGP. The issue is and >should be, why (specifically) do you believe that PGP is secure. Here you go again. "Probably not secure". Earlier you make implications of trap doors. The only way for a trap door to be there, would be if one of the authors put it there. Otherwise, you would be suggesting that one dark night, on a new moon, the NSA snuck in to MIT, changed the source code, inserted a back door, and snuck out without anybody being the wiser. Implying there is a trap door is much different than implying there may be a flaw in the code itself that allows a security breach. I agree with Matt's assessment on your behavior Fred. Your statements lead me (among others) to believe that you think that one or more of the authors are not trustworthy and have tampered with the code to insert trap doors. His remarks on your statements being near-defamatory hit mighty close to home for this on-looker. I'm sure I'm not alone.

1 0

Re: Zimmermann legal fund
by nsb＠nsb.fv.com 17 Dec '03

17 Dec '03

At 12:20 PM 8/1/95 +0800, Enzo Michelangeli wrote: >Now, my main objection to opening a US account is that it's unclear >whether or not, for simply receiving payments there, a non-resident and >non-citizen account holder like myself incurs in any tax liability with >Uncle Sam's Inland Revenue. Can anybody on this list shed light on the >issue? Last time I checked, the guys at FV weren't sure either. The real question isn't based on your bank account, but on whether or not Uncle Sam thinks you are "doing business in" the US. This is the fundamentally thorny question that is raised by cyberspace businesses. Having payments made to a US bank account may make it more likely that the US will decide that you are doing so, but they could decide it anyway just because you have buyers in the US, or because you're using a US-based payment server. The laws are, to say the least, not clear on such points. As a practical matter, however, it is true that using a US account will make it easier for Uncle Sam to tax you if it decides that's appropriate. -- NB

1 0

Re: U.S. Banks are not all that bad
by cman＠communities.com 17 Dec '03

17 Dec '03

As near as I can tell, there are spotty instances of the behavior Lucky describes, but it is becoming more common, especially wrt required ID. I must say that I've had some absolutely amazingly bad experiences with banks in Asia, Mexico and Central America, so I'm a skeptic when it comes to assuming that non-US banks are light years better. Although I have no direct experience of European banking, I do know that the European banking industry, taken as a whole, is substantially behind the US banking industry in automation and efficiency. Most of the irritation that I hear reported about US banks is the result of pushing customers too hard to change expensive banking habits or erecting policies that eliminate money-losing practices without regard to their impact on customer goodwill. At First Interstate recently, I had to make a withdrawal from the teller, as the ATM was broken. Their policy _does_ reqiure a "counter check", and normally they charge, but when I explained that the ATM was kaput they did it for free. It is _much_ cheaper for them if you use the ATM, and this kind of policy is designed to encourage you to do this. It's the kind of thing that the market will sort out nicely -- if it irritates people and loses them money more than it saves them money, they will stop doing it. Remember, the US has an absolutely fantastic amount of competition wrt banking services, especially when compared to other countries.

2 1