- cypherpunks-legacy - lists.cpunks.org

Re: Internet wiretap?
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 20:09 12/29/95, Joel McNamara wrote: >This tidbit was posted a few hours ago on c|net (12/29 4:00 PST). > > Thanks to a wiretap on the Internet, three people have been arrested >for illegally > selling and manufacturing cellular phone equipment and electronic >devices over the Internet, > according to Secret Service agent Brian Gimlett. This is the first >time the Secret Service and the > Drug Enforcement Administration were allowed to wiretap via the >Internet, says Gimlett. > >The rest of the story talks about an exchange of e-mail discussing the sale >of various nasty >cellular accessories. There is no information on exactly what "wiretap" >means or any other >technical details. Interesting to note the DEA was in on it. It is not that hard to "tap" a user's account if you are the SMTP server (you just put a Bcc on all outgoing mail and add an extra account to all incoming mail's Envelope). A few lines in the Sendmail parms would do this very simply.

1 0

Re: (fwd) Benchmarks - revs 1.3.50 & 51
by Julian Assange 17 Dec '03

17 Dec '03

> > And the cypherpunk relevance is....<drum roll>...? > >[...] linux kernel stats Absolutely zero. Your's truely pressed the wrong key. --Proff +----------------------------------+-----------------------------------------+ |Julian Assange | "if you think the United States has | |FAX: +61-3-9819-9066 | has stood still, who built the largest | |EMAIL: proff(a)suburbia.net | shopping centre in the world?" - Nixon | +----------------------------------+-----------------------------------------+

1 0

Compuserve and copyrights
by Ed Carp [khijol SysAdmin] 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have sent Compuserve a notice that all posts originating from this site are copyrighted and barred from being stored on a site that does not allow reciprocal access. I would urge that other sites consider sending a similar notice to Compuserve. - -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/digital pager 800/558-3408 SkyPager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi "Past the wounds of childhood, past the fallen dreams and the broken families, through the hurt and the loss and the agony only the night ever hears, is a waiting soul. Patient, permanent, abundant, it opens its infinite heart and asks only one thing of you ... 'Remember who it is you really are.'" -- "Losing Your Mind", Karen Alexander and Rick Boyes -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMOYi1SS9AwzY9LDxAQFdagP/VMdunjZ1LLY7nUVgxUgFEoHDdcyPwWLl oPTQ/jDdcsIfolBQlNp+IzKJyubutW7oUv0qmsInAlXBUDPGvTmgyhPVczud7U79 JQh/ssxCiWZbTHwwwpJyg8Iw+jjAvrNTe4sWh/NOCM/Y3+knIckEm8k5DXA3BTCV 0+fkcV6sf+o= =dQU8 -----END PGP SIGNATURE-----

1 0

Re: Australian "calculatorcard"
by Johnathan Corgan 17 Dec '03

17 Dec '03

>sounds like the card i use for remote dialup to certain non-public >systems i use at work. it has a six digit number on the front that >changes every 60 seconds. the card is registered to me. when i enter >my username/password i'm prompted for the number. it's Pretty Good >(tm) security, but like anything not biometric, it is vulnerable to >black-bag attacks. physical possession being all that is required. if >you know the algorithm and the serial number of the card and the >time, even that isn't necessary. > > >CG> Can anybody provide me with pointers to more in-depth information >CG> about this device and the algorithm(s) behind it ? > >i don't know if there are any net sources for them, but i'd be >suprised if not. my card references "security dynamics" of cambridge >massachusetts. You are referring to the ACE/SecurID token card from Security Dynamics. In addition to the displayed number, you should be prepending it with a memorized PIN; this prevents operation in case of theft. The server end will disable the card after x failed attemps, etc. Otherwise it is basically a one-time password system. I've had a business relationship with these folks for a year or so now-- sharp guys.

1 0

Re: PLA_gue Germ Terrorism
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: John Young <jya(a)pipeline.com> > 12-30-95. To update the list of terrorist threats, the Wash Post reports on the purchase in May of bubonic plague germs by "white supremacist" Larry Wayne Harris, his bust by the FBI and germ teams, prosecutors amazement that possession of such deadly micro-organisms is not illegal, and the consequent plea bargain of wire fraud with probation. The article explains that possession of "terrorist" mites is not prohibited due to a legal loophole which allows scientific trade in wee supremacists. There are calls for outlawing the meat-eaters by closing the gap in the anti-terrorism bill before Congress. But scientists say how dare you spit in our nanodeath soup. It notes that offshore spread is Commerce regulated. ------------- There are very good reasons for keeping this legal loophole. How could one ship, say, Ebola virus for evaluation if it wasn't there? Besides which, E. Coli (the workhorse of prokaryotic genetics) can be a pathogen if the right plasmid is inserted. Banning shipment, buying, etcetera of strains of it would rapidly reduce most genetics work in the U.S. to the state of gene therapy work in Switzerland (i.e., none, due to the Swiss laws outlawing any form of it). Incidentally, thanks to the person who quashed the "black-seeking virus" idiot. Human races are so far from being proper genetically distinct subspecies that nobody competent would call them that, if they only weren't us. -Allen

1 0

SHATEST (was: Re: DOS - MD5 - Thanks)
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Fri, 29 Dec 1995 15:22:46 -0700 (MST), you wrote: I've got a little goodie called SHATEST which I'm going to include with the next release of the NOISE.SYS driver.. it's the Secure Hash equivalent of MD5SUM... (Originally written to test the optimized SHA code-- much thanks to Colin Plumb, BTW--- for the /dev/random driver...) --Rob >A freestanding implementation of MD5SUM (compiled from that in the PGP >distribution) for DOS is at >ftp://ftp.csn.net/mpj/public/md5sum.zip and on the Colorado Catacombs BBS >at 303-772-1062. >I suggested to Phil Zimmermann that he should put this in the next PGP >release along with the compiled DOS version of PGP, but there hasn't been >a new release of PGP since then. >Happy New Year! Ditto... >Mike Johnson >mpj(a)exabyte.com >#include <std_disclaimer.h>

1 0

Re: Australian "calculatorcard"
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- From: David Lesher \ Internet: (wb8foz(a)nrk.com) To: amp \ Internet: (alan.pugh(a)internetmci.com) cc: Cees de Groot \ Internet: (c.degroot(a)inter.nl.net) cc: cypherpunks \ Internet: (cypherpunks(a)toad.com) Subject: Re: Australian "calculatorcard" > sounds like the card i use for remote dialup to certain non-public > systems i use at work. it has a six digit number on the front that > changes every 60 seconds. DS> Do these card systems use a window to handle clock-slip? i'm not sure. i would image so. DS> I'd think you could have the server safely accept # N, N-60 sec, and DS> N+60 seconds; and adjust the server's idea of your card's clock speed DS> from that. DS> What new risk would that create? i would figure the server would give a minute or so for slippage. basically the risk is that it would give someone 3 minutes to do a brute force attack rather than one. if you have decent security on the server side, i.e., disallow the card for 5 minutes or more after 3 or so failed attempts, brute attacks would be minimized. however, if the actual window for a single code is 3 minutes, that increases your chance of hitting it as 3 separate numbers would be valid for a given card at any given time. amp <0003701548(a)mcimail.com> (since 10/31/88) <alan.pugh(a)internetmci.com> PGP Key = 57957C9D PGP FP = FA 02 84 7D 82 57 78 E4 E2 1C 7B 88 62 A6 F9 F7 December 31, 1995 21:59

2 1

Re: Australian "calculatorcard"
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: vin(a)shore.net (Vin McLellan) > Could be one of seven or 8 vendors of so-called "challenge/response" tokens or calculators. Most of those sold in the US and Australia use straight DES (and a token-specific key) to encrypt the "random" challenge number in the token -- but it could be any secret-key algorithm. ----------- This is actually something cryptographic which I know a bit about, so I'll tell you what I know. I had a suitemate a bit back who was working for a local high-tech company as a computer programmer. He used a system somewhat like this, but with some interesting permutations. The main difference was that it didn't use one algorithm. It used quite a few, determined by a hashing of the challenge code. There were a considerable number of challenge codes with distinct hash results that were never used. If the card got too many of those (or too many wrong PINs), it switched to an entirely different set of hashings and encryptions, all of which would warn the server (thanks to their turning out something different in a hash function on the server) that the card had been compromised. I suspect it would also wipe a EEPROM that was storing the valid hash function and algorithms, but he wasn't sure about that. It was all sealed in a plastic block to make sure it was physically hard to reverse-engineer, anyway. -Allen

1 0

Ah, the future...
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, 12 31 95 Associated Press reports: Ah, the future ... At least part of what will happen in the coming year seems clear. Cyberspace will be regulated -- kicking and screaming -- and the court battles over free speech will begin. "It's going to throw the Internet into a state of uncertainty for several years," said [Bob] Smith [of Interactive Services Association]. You may recall the question I asked in an earlier message: And when the State DECIDES...? But that's all right... Despite that, business growth on the net will begin to catch up with the phenomenal increase in accounts. Cordially, Jim NOTE. The newsstory's headline? YEAR OF THE INTERNET: What a tangled web we weave. Its dateline? (Dec 31, 1995 - 00:23 EST). Accessed at? Nando News (www.nando.net) Online filename? info306_3.html That message? Date: Wed, 22 Nov 1995 04:16:50 -0500 (EST) From: "James M. Cobb" <jcobb(a)ahcbsd1.ovnet.com> To: cypherpunks(a)toad.com Subject: Secrets of the Internet This critical essay, "Ah, the future..." was composed 12 31 95.

1 0

SEY_use
by John Young 17 Dec '03

17 Dec '03

12-31-95. WashP: Emulating US founding outlaws, the Seychelles government has enacted an investment law described by transatlantic neo-imperialists as a "Welcome, Criminals" act. The law offers anyone who invests $10 million or more in Seychelles -- no questions asked as to the source -- protection from extradition, from seizure of assets and to other "concessions and incentives commensurate with the investment." Neo-imps say this is "an open invitation to money launderers and other international criminals to set up shop with impunity." Under the statute the Seychelles government could grant diplomatic passports and other protections as a shield from thermonuclear pornography. SEY_use

3 2