- cypherpunks-legacy - lists.cpunks.org

Re: CONTEST: Name That Program!
by Dave Del Torto 17 Dec '03

17 Dec '03

At 12:10 AM 1/31/96, Bill Stewart wrote: >At 11:45 AM 1/30/96 -0500, Nathaniel Borenstein <nsb(a)nsb.fv.com> wrote: >> In fact, I'd settle for getting onto 10% of the machines, although I >> suspect I could get onto more like 80% without raising a sweat. If I were you, Nathaniel, I'd drop that petard of yours on the ground, grab a very absorbent hankie and run like hell. ;) >You've alleged that Macs and Unixen should be about as easy as Windows >machines to crack with your CardShark. I disagree - most Mac users I >know have been using virus protectors more consistently and reliably >than DOS/Windows users. However, if their virus software only stops >known viruses, rather than anything modifying critical resources, >you might get away with it for long enough to surf some numbers. [elided] Actually, for those who don't know, one of the most ubiquitous anti-viral utilities for Macs (Symantec Antivirus for Macintosh, aka "SAM") also offers a mode that constantly watches for any generic attempt to modify crucial file/app/system resources -- and offers the opportunity to deny such attempts. Thus, it doesn't _only_ offer protection against "known" attacks. It even specifies which application/virus is trying to modify which file, allows the user to teach it that certain mods are verboten and halts activity until the user decides how to proceed. This makes it all but impossible (if a Mac is so-protected) to even introduce a trojan-keystroke-sniffing-credit-card-transmitter, much less use it to take over the TCP stack (MacTCP) without the user's knowledge. As for FV's recent "discovery:" [a] I'm glad if FV _really_ wants to educate the public, but I hope they find a better way next time than a "hey, we found this really simple way to hack the universe, but we're not telling all you 13-year-old juvenile delinquent hacker-wannabes" broadcast (talk about yer invitations!), [b] confused why NB didn't anticipate the fuss and prepend a short disclaimer onto his posting of it to cpunx (how about _thrice_ burnt, Nathaniel?), [c] unimpressed by all the vitriol it stirred up and the glee exhibited by everyone in slamming Nathaniel and Co. (lighten up, even if it was deserved) and [d] bummed that no-one remembered my keycapture utility survey of nearly a year and a half ago...as in "gee, I wish _I'd_ thoughta that." ;) Frankly, I wonder if, in the long run, FV's stunt hasn't wrought more harm than good: I got a late-night call from a worried but clueless friend asking me to clarify this "credit card sniffer thing" he'd heard about from someone else: he was all worried that there was an invisible virus on his machine. >sigh< It's seems the brush has been set afire: now which way will the winds blow? Cheers, dave ____________________________________________________________________________ "With annual interest, compounded every nanosecond, that'll be $0.02000018."

1 0

Disperse/Collect version 1.0
by Wei Dai 17 Dec '03

17 Dec '03

To follow up on a post last year where I suggested that Rabin's information dispersal scheme might be useful for sending large files across unreliable remailer networks, I built a shareware package called Disperse/Collect out of my own Crypto++ library. Disperse splits up files into redundant pieces and encodes them in base 64. Collect decodes them and reconstructs the original files. You can download this software from my home page at http://www.eskimo.com/~weidai. Wei Dai

1 0

Financial Services Technology Consortium
by rah＠shipwright.com 17 Dec '03

17 Dec '03

A friend found this... Cheers, Bob Hettinga --- begin forwarded text Bob: I was looking for a web site for Shawmut/Fleet Bank and could not find one. But I did come across this which I thought might be of particular interest to you... http://www.llnl.gov/fstc/index.html It is the Financial Services Technology Consortium (FSTC), which is a consortium of financial services providers, national laboratories, universities, and government agencies who sponsor and participate in non-competitive collaborative research and development on interbank technical projects. Cheers, Will --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: ASCII unabomber paper attribution and FTP address (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: lmccarth(a)cs.umass.edu (L. McCarthy) > Subject: Re: ASCII unabomber paper attribution and FTP address > Date: Tue, 19 Sep 1995 15:10:48 -0400 (EDT) > > Actually it's: > > ftp://ftp.ai.mit.edu/pub/users/misc/unabomber > > It isn't as of 4:28 Central...:( Anyone got a clue as to where it has flow to? Jim

1 0

Re: Gore's "new and improved" key escrow proposal
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: From: Eli Brandt <ebrandt(a)muddcs.cs.hmc.edu> : Tim May said: : > Others here will have a clearer idea than I have, but I don't think a : > "software standard" is what is now being planned. Software-only : > solution cannot possibly have the security that's needed [...] : My reading of the BSA blurb was that software key escrow really is : being planned: "software implementable [and] based on a non-classified : encryption formula". Yes, this sounds pretty silly. I don't see how : you could possibly prevent a rogue phone from interoperating with a : fascistic one. ... except by legislation. Make no bones about it, this is the start of the final attack to outlaw non-escrowed encryption. G

1 0

Re: "Key Escrow" --- the very idea
by solman＠MIT.EDU 17 Dec '03

17 Dec '03

> > ...The cost of conducting these negotiations in the > > physical world is enourmous. > > > > The cost of conducting these negotiations in the real world is negligible... > > Is "the real world" a typo? I suspect you mean something like "in > cyberspace". :) It is most certainly a typo. > I'm not familiar with the line of reasoning you're referring to here. I > suspect it's a large topic. Does it rest on the assumption that cyberspace > and the physical world are largely disjoint? > I think they're not. Activities in cyberspace often > "are about" or "have influence on" the real world. Sometimes vice versa. > Doesn't this mean laws can't be divided into those about the physical world > vs. those about cyberspace, but must in fact be about both? You are entirely missing my point. The superior efficiency of cyberspace, its low transaction costs, have created possibilities there that can not exist in the physical realm. In both realms people have different wants and desires. Because they interact with each other, the actions of one individual can have an impact upon the actions of other individuals. Without any form of social agreement, there would be no security, no certainty about anything. This can be highly inefficient. There is no point in starting a big project today, if there is a high probability that somebody will kill you tomorrow. There is no point in doing something that other people would find useful if there is no mechanism for you to exchange it with them for services that you find useful. To circumvent this inefficiency, individuals enter into contracts with one another. A and B might agree not to kill each other. In exchange for giving up this element of their freedom, they get security. Security has value. It enables them to undertake long term projects that might otherwise not have been possible. But a contract like this is not useful without some mechanism of enforcement, so A and B have to agree to pay for some sort of policeman. This policeman would receive compensation for enforcing the contract between A and B. HERE IS THE DIFFERENCE BETWEEN THE PHYSICAL WORLD AND CYBERSPACE. In the physical realm, in order for a contract like this to work, large numbers of people have to be bound to it. This is true for the following reasons: A) The number of people bound under the contract must be large enough to make it unlikely that the policeman can control them or break his contract. B) Negotiating a contract like this takes alot of time. The compensation for the policeman has to be determined. The mechanisms for disciplining murderers (and determining guilt) have to be determined. The mechanisms for enforcing the contract between the police and the people have to be determined. The mechanisms for determining how much each person will be required to pay have to be determined. This is an extraordinarily inefficient procedure in the physical world. To deal with this inefficiency we have developed laws. Laws specify that all sentient individuals within a given area have to agree to a specific contract. There is no contract negotiation, there is just a contract that automatically applies and because a substantial majority of the individuals within a given locality respect the laws, this system works. In fact legal systems are highly inefficient artifacts in the physical world. In cyberspace, the two motivations for extending contracts to all participants (i.e. having uniform laws) are no longer present. Point A is no longer true. You don't need to have an enforcing policeman whose power is balanced by the large number of people he protects, cryptography can take the policeman's place as the contract enforcer. Point B is no longer valid because the entire negotiation process can be automated by computer with negligible transaction costs. Without any motivation for laws, individuals can get their security through personal contracts with other individuals. If you don't want to worry about fraud, subscribe to a fraud protection agency that you like. Any individual agent that wants to make you an offer will have to first be approved by the fraud protection agency. In exchange for this approval, the agent will pay the protection agency money and then pass along that cost to consumers that required the approval. Alternatively, the agent can agree not to violate the rules of the FPA, and give the FPA a deposit. If the agent screws up, victims of fraud could collect recompense via the method of adjudication specified by the FPA. If the agent isn't willing to agree to the fules of the FPA, then the user and that agent just won't do business. There can be thousands upon thousands of FPAs in a scheme like this and individual FPAs can offer all sorts of protection plans. In the real world a system like this could never be implemented, the cost of administering it would be too great. How could stores know what standard of honesty was required for each individual customer if different customers lived under different laws? The store has to be notified of the specific rules governing a specific customer. The store has to pay a tiny amount to the FPA. It has to be verified that this amount is collected. The store must then alter its sales strategy for the customer. This would clearly no work in the real world. If I wanted to buy a watermelon slush outside of the Kendal T (something I am about to do) it would cost me about $200 in transaction costs beyond the $1 for the slush. This is where the difference lies. It simply becomes feasible to have individually tailored social contracts once you enter cyberspace. Individuals with incompatible social contracts simply can't communicate with one another. You get absolute freedom AND absolute security. JWS

1 0

Una FTPaper 2
by John Young 17 Dec '03

17 Dec '03

ftp.hacktic.nl/pub/incoming/unabomb.txt

1 0

Netscape responds.
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

Netscape now has an article on their home page about the latest break in their security. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

NT and C2
by Weld Pond 17 Dec '03

17 Dec '03

Here is the URL to an article in Network World by Winn Schwartau entitled, "One expert shares his views on Microsoft securitey features. http://www.iquest.net/cgi-bin/gate2?|mmMgT008://bbb.PHDx10.ix0/ibLD1P7i/ExU… If you need a username/password try cypherpunks/cypherpunks Here is an excerpt: Since Microsoft Corp. products are usually robust, I was looking forward to seeing what type of security features the company implemented in Windows NT Workstation Version 3.5. But after walking through the system with Microsoft product managers and developers, I was dismayed to find how woefully short on security features Windows NT is. Despite the fact that the U.S. government is expected to certify Windows NT as a secure operating system, Microsoft's first serious venture into security is not very impressive. Windows NT may pass muster with the federal government, but it does not meet the real-world security needs of corporations running complex, heterogeneous networked environments. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/~weld L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

2 1

NetManage - Cylink Press Announcement
by Bob Williams 17 Dec '03

17 Dec '03

There are quite a few open issues regarding the reliability, interoperability, and licensing of public key technology. All parties interested in access to code for testing and comment please respond to this email address. Thanks Bob ------------ NETMANAGE, Inc. Press Release FOR IMMEDIATE RELEASE Contact: Donna Loughlin, NetManage, (408) 973-7171 Donna(a)netmanage.com NetManage Licenses Public Key Cryptography from CYLINK The Two Firms to Promote an Open Interface for Internet Security which Corrects Flaws and Eliminates Financial and Interoperability Barriers for Cryptography. Cupertino, California - September 19, 1995- NetManage, the leader in TCP/IP Applications for Windows and Internet productivity software, announced today that is has signed a licensing agreement with CYLINK Corporation for technology which incorporates the fundamental patents covering public key cryptography. NetManage will be providing support for public key authentication and data encryption as a fundamental component of its Chameleon Enterprise strategy. The two firms further announced that they plan to provide support for an open interface for Internet security which will address recent flaws found in cryptographic implementations used by Netscape Communications and other unpublicized security holes in existing Internet security protocols. The standard is further intended to eliminate the financial and interoperability barriers that have been holding back widespread use of public key cryptography on the Internet. In a separate announcement released yesterday, CYLINK announced that it had prevailed in a patent lawsuit with RSA Data Security which found that RSA had infringed U.S. patents held by CYLINK which cover all known implementations of public key technology. About Internet Security ----------------------- Establishing a secure Internet connection requires any computer software program to perform two functions: Authentication of the user, and bulk encryption of data. The Authentication phase allows two computers to verify that each party is who they claim to be, and that they are authorized to enter into a secure communications session. This is done via 'public key' technology, which was developed and patented originally by Stanford University and licensed exclusively by CYLINK Corporation. During the authentication phase the two computers also agree upon the encryption method to be used for bulk data transfer during the time the two computers are communicating data between one another. These ciphers can be implemented in either software or hardware, including PCMCIA cards. Popular encryption ciphers include DES, Triple-DES, SAFER, IDEA, Skipjack, RC-2 and RC-4 and are available from a variety of software and hardware vendors. Limitations of Current Internet Security Standards -------------------------------------------------- Current implementations of security protocols proposed as standards by Netscape Communications and RSA Data Security, Inc. include security flaws and fail to fully accommodate open and interoperable secure communications between computers which use different bulk encryption ciphers. These problems have limited the adoption of Internet security as a widespread interoperable feature of all Internet software and hardware products including end-user applications, servers, firewalls, and secure routers. NetManage and CYLINK, along with other major software and hardware developers, will be announcing next week the release of a publicly available security implementation which allows for plug & play interoperability for users of Internet security, and the endorsement of protocol extensions which improve the reliability of current proposed Internet security standards. This open implementation will not lock software or hardware developers into the use of encryption technology from any one vendor. Related APIs, key exchange technology, and encryption will be made publicly available to other software and hardware developers. Licensing will include source code and no per-copy royalty fees. About NetManage --------------- NetManage Inc., the fastest growing software company in the United States, develops markets and supports an integrated set of Internet-based applications, servers and development tools for Microsoft Windows, Windows 95 and Windows NT. NetManage software allows corporations to facilitate communication, sharing of information and collaboration between workgroups using Internet technology. The company's award winning products include Chameleon, Internet Chameleon and ECCO. NetManage is a public company, whose shares are traded on the NASDAQ under the ticker symbol NETM. Its products are sold world-wide by NetManage's direct sales force and authorized channel partners. About CYLINK ------------ CYLINK Corporation is the worlds largest provider of enterprise-wide network information security products and wireless communications. CYLINK is the exclusive holder of the fundamental patents which broadly claim the invention of public-key cryptography (Diffie-Hellman, Hellman-Merkle, and Helman-Pohling) and which were originally developed at Stanford University. Headquartered in Sunnyvale, California, CYLINK serves Fortune 500 companies, financial institutions and government agencies. Licensees of CYLINK technology include CISCO Systems, and other prominent hardware and software developers. # # #

1 0