- cypherpunks-legacy - lists.cpunks.org

RE: Political Cleanup program
by Kurt Buff (Volt Comp) 17 Dec '03

17 Dec '03

Ya won't have complete equity amongst lobbyists, until ya remove the power of bureaucrats to control people's lives. When laws can be used to deprive people of their livelihood, via either taxation or regulation, you will create situations where people can make money from it, and therefore unscrupulous people will take advantage. The only defensible argument for government at all is to protect people from depredation, either from fellow citizens or from external threats. When you prevent people from engaging in peaceful commerce, you open the floodgates to tyranny. Thus, the solution is less government, not to try to legislate human nature. Kurt [speaking for myself, of course] ---------- From: Richard Huddleston[SMTP:reh@wam.umd.edu] Sent: Monday, December 18, 1995 6:12 To: jimbell(a)pacifier.com; vznuri(a)netcom.com Cc: cypherpunks(a)toad.com Subject: Re: Political Cleanup program Detweiler wrote: * >JB: * >>Politics is traditionally corrupt, it appears, because donors to politicians * >>and political campaigns expect a quid pro quo for their donations. Various * >>unsatisfactory solutions include campaign spending limits, etc. * > * >I have an unusual view that I've never seen elsewhere: the problem with * >our government is not that money or PACs are involved, but that the system * >does not handle or resolve the conflicts between them very well. in other * >words, in contrary to the current view that all PACs are evil, I think the * >problem is not that we have PACs, but that our current system does not * >balance their demands in some sensible manner. the system is * >susceptible to corruption. it is conceivable however that there would be * >a system that involves money and politics but still avoids corruption. Not to sound like a dupe or anything, but every time I get discouraged at the rampant mealyism of our political system I go read the first couple of paragraphs of a text from GOVT 101. There, I get reminded that the way most political debate is handled elsewhere is with bullets. Personally, I welcome a complete equity between all lobbyists seeking to obtain a politico's ear. Take the money out of the equation, and let the merits of their causes, if any, stand on their own. Happy holidays, Richard

1 0

Applescripts for monitoring Netscape Activity
by Bill.Humphries＠msn.fullfeed.com 17 Dec '03

17 Dec '03

The recent Netscape beta bug mentioned here raised a technical question? Anyone here have a pointer to an applescript, frontier or macperl script for monitoring what programs do to your system folder and desktop? Otherwise, I'd better write one. It'd be a good way to learn more about the behavior of apps. Thanks and happy holidays, Bill Humphries Call your Representative and Senators and demand an end to attempts to censor the Internet. More info at http://www.vtw.org/ *** The answer to porn speech is free speech -- via Molly Ivins ***

1 0

wish list for Crypto++?
by Wei Dai 17 Dec '03

17 Dec '03

I am looking for suggestions for features to include in the next version of Crypto++ (current version is 1.1, you can find it at http://www.eskimo.com/~weidai/cryptlib.html) Major additions already planned/implemented include speed improvements, Safer (all the variations), and elliptic curve cryptosystems (over prime fields as well as fields of characteristic 2). There is also a good chance that RSA will be added back, but I'm still waiting for the final word from the RSADSI lawyer. What else do people want to see? Wei Dai

1 0

Java and timing info - second attempt
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I asked about using Java scripts to capture remote timing info before and got no response. I assume everyone thought it was a stupid question. Therefore, I'll ask it again. The thing that makes Java a big deal is that you execute other people's code on your machine. You browse a Java-enhanced Web page, click on something interesting, suck across an applet, and execute it on your machine. This setup enables a bunch of nifty interactive Web stuff. Turn the picture around: You setup a Java-enhanced Web page, include some interesting buttons to click, write some clever applet, and people around the world suck your applet onto their machine and execute it. Combine this with some a standard crypto API for doing Web-based digital signatures or authentication or encryption and you may begin to see some possibilities. Would it be possible to create a Java applet that causes the client machine to sign or encrypt something with their private key, and then send back timing info? For the answer to be YES a few things need to be true. There needs to be some sort of standard crypto API in use that can be accessed by a Java script, and Java scripts need to be able to capture and send back timing info. Does anyone on this list know enough about Java to know if it can do any of these things? Jim_Miller(a)suite.com

3 2

Re: Java and timing info - second attempt
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 22:31 12/18/95 -0800, Jeff Weinstein wrote: > In Netscape Navigator 2.0 Java and JavaScript do not have access >to crypto routines. At some point in the future this will probably >change, but only after we understand the implications much better >than we do today. More importantly for covert channel analysis, do they have access to good clocks? Access to a good clock could make a Java applet a good candidate for the receiver in a generalized covert channel attack. Access to both process time and real-world time can give a good indication of load on the processor, and might be needed for animation. A transmitter could send by using or not using the CPU. (Installing the transmitter is left as an excersize for the student. ;-) ) Who said that life was safe? ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

(fwd) Junk email address collection (from a junk emailer)
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Personally, I think anyone who uses dejanews as a way to grep Usenet is an idiot, but since this idiot actually did spend several hours doing so, and then sent unsolicited commercial email to several thousand people, it's worth listening to him. Of course he's wrong about DejaNews having anything to do with Stanford. Anyone know anyone there? This guy is obviously afraid of me. It's a pretty funny story, actually. Too bad I can't tell it to anyone. - -rich - ---------- Forwarded message ---------- From: Name Witheld by Request To: Rich Graves <llurch(a)networking.stanford.edu> Subject: Important info for you Rich, There is one more point I would like to make to you. Since you have recently responded in a sincere way regarding everything I have asked you about, I would like to return the favor and suggest some things that might be of help to you and your cause. If you want to put a damper on some of the random unsolicited emailings to newsgroups members, I would like to tell you how. I have done extensive marketing research online, and I am very involved with Internet commerce and everthing that affects it. Just like you have your "circles" of associates, so do online business people. I have met a lot of business users online, and have learned the ins and outs of things related to Internet commerce and marketing. Anyway, in these "circles" of discussions, and seeing information and posts from some of these business people, I have learned many things that your group is most likely not exposed to. For example, there is a major resource where the majority of email names are stripped from, and I would like to reveal it to you, and give you the solution to putting an end to it. But only because I truly want to help, and show you that I am not your enemy. You may already know some of this. The "Deja News" Web service (at Stanford) is one of the major resources that some of these mailers use to get names. They attempt to do target marketing by doing searches for keywords related to their customers, or their own, advertising material that they wish to send. They simply do a search for several words like "resumes" if they have something to do with a resume service, etc. I'm sure you get the idea. After they do their search, they merely dump screen after screen of the search engine's findings and then strip the addresses using a FIND-CONTAINS "@" command in any database program. This is how they strip the names to create a mass email list. There is ONE way that could really screw over these mailers from using this resource. This is inside information that has been revealed to me (I have also seen references to it somewhere else). Don't ask who it was that was telling everyone about it, because I honestly couldn't tell you - I just know it is going around. Since you are there at Stanford, I am sure that you may be able to bring this information to someone working on this project so they can make some necessary changes. Here it is: When one of these mailers goes to do a search (and from what I hear, many of them do it on regular intervals to get new names) they cannot do a TERSE search. Why? Because it cuts off the email addresses if you notice the output. They cannot obtain addresses from this data. So what do they do? They do a VERBOSE search and this way the email addresses are completely listed. Make a change to this VERBOSE search option so that it will only list the partial email address, and you will eliminate THOUSANDS, if not millions of unwanted email messages on the Net. I guarantee if they made this change to the site it would make a HUGE difference. From what I hear, most newsreaders only list news post lists by "author" and not by email address, so these companies cannot easily strip names through regular newsgroup programs, and must use a service (like Deja News) to compile large email lists. Also, you and your buddies may want to look into a guy selling a software program called "Floodgate." Apparently this person is selling a program for about $300 that is designed to strip names from text files that are created from copying the output of other sources. Just thought I would donate some helpful information to make up for my offense. I don't mind if you should share this info with your contacts and if you tell them that it came from me, however, I would prefer if you would not post this information or statement publicly. I do not wish to get involved with a MAJOR uprising of business people that would murder me for revealing stuff like this. If I come across some other stuff which may be of interest to you, I will let you know. I think it is much better for us to work together instead of against one another. Let me know what you think, -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMNeZ3Y3DXUbM57SdAQE/5QP/cwqEiY7eX8fR/9JEPmSdhE63Ax+H+NCw Uac9VXlKKSH3e+JfI7c/+sWhYafLvWVFlz7Ikj1/uMilAmNJjJTUZfTHqdlYKN/+ kkmc+cCWfGAkl6PFcFqcvSdPKJvyVMsnUFufFBsl629Ot7Pb8yZJTXEq0vr8+BcG QOdMuhEZiXk= =Hq1v -----END PGP SIGNATURE-----

3 2

(Fwd) SECURITY ALERT: Password protection bug in Netscape 2.0b
by Peter Trei 17 Dec '03

17 Dec '03

Haven't had time to test this myself. Peter Trei ------- Forwarded Message Follows ------- Date: Mon, 18 Dec 95 17:18:28 From: <lstein(a)genome.wi.mit.edu> Subject: SECURITY ALERT: Password protection bug in Netscape 2.0b3 To: www-security(a)ns2.rutgers.edu, jcarroll(a)redman.canada.dg.com Cc: tara(a)linkage.cpmc.columbia.edu A potentially serious bug has just come to my attention concerning the handling of password-protected pages accessed via Netscape 2.0b3. Apparently when you type in the password to access a protected document Netscape stores the password in a local hidden file (in one of the .db files created in the .netscape directory on UNIX systems, and in the Netscape Preferences file on Macintoshes). This password is then used for accessing the document during subsequent accesses. The problem is that Netscape does not delete the stored password when the program quits. The problem has been reproduced on Unix and Macintosh platforms. I haven't tried the Windows implementation yet, but I suspect the same problem exists. This leads to the following behavior: 1) Open up Netscape and access a password-protected document. 2) Quit Netscape 3) Start Netscape again and try to retrieve the document. When the password-entry dialog comes up, click "Cancel". 4) Try to access the document a second time. Now Netscape lets you in without asking for the password! On Unix systems, this means that if you go over to a associate's machine to show him a protected document, Netscape will record your typed in password for posterity. Your associate now has full access to this page. The situation is particularly dangerous on PCs in a shared "computer lab" environment. Everybody who uses Netscape unwittingly makes his passwords available to all other users. Please let me know if anyone finds out more about this problem. I'm going to add it to the WWW security FAQ. Lincoln ======================================================================== Lincoln Stein, M.D.,Ph.D. lstein(a)genome.wi.mit.edu Director: Informatics Core MIT Genome Center (617) 252-1916 Whitehead Institute for Biomedical Research (617) 252-1902 FAX One Kendall Square Cambridge, MA 02139 =================http://www-genome.wi.mit.edu/~lstein====================

3 2

New additions (12/18) for Karn vs State Dept
by Phil Karn 17 Dec '03

17 Dec '03

I've just received, HTMLized and added two new documents to the web page concerning my case against the State Dept. They are: http://www.qualcomm.com/people/pkarn/export/karnsf.html (Joint Statement of Facts Not In Dispute, 12/18/95) and http://www.qualcomm.com/people/pkarn/export/repmem.html (Reply Memorandum In Further Support of Defendants' Motion to Dismiss, Or In the Alternative, For Summary Judgment 12/18/95) As before, the base URL for the case is http://www.qualcomm.com/people/pkarn/export I'd like to thank the government's attorneys at the Department of Justice for this time providing an electronic copy of their filing to my attorneys. This made it easier for me to bring it to you on the web. Last time I scanned in the government's documents on an OCR system, the same one I used to scan in the 3DES code in Applied Cryptography to demonstrate the process as part of my declaration. However, I still had to convert the text files from WordPerfect to ASCII and then HTMLize them by hand. If you find any formatting errors, please let me know so I can fix them. --Phil

1 0

Re: cyphernomicon FTP site?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:18 PM 12/19/95, Vinod Valloppillil wrote: >Anyone know where I can FTP a full copy of the cyphernomicon? It would help if you said what you'd tried. For example, have you tried ftp.netcom.com in the directory pub/tc/tcmay? There you will find several versions, including compressed versions. This can be hard to access, due to crowding, but can eventually be gotten to. It has also been placed at other locations, according to reports here. Check the archives. Personally, I hear that even the author prefers the HTML version at http://www.oberlin.edu/~brchkind/cyphernomicon/. Anybody who plans to download the entire linear file and then print it out must be missing a bits in his shift register. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Bit Commitment Query
by Robbie Gates 17 Dec '03

17 Dec '03

I am confused about bit commitment via one way hashing as described in Schneier (1st ed, p 73) h is a one way hash function. This description from Schneier, except that variables are changed so i don't need subscripts: 1. Alice has a bit b she wants to commit to. She picks random bit strings R and S, and sends Bob h(R,S,b),R 2. To verify commitment, she tells Bob S and b so he can verify the hash. What i don't get is Schneier's claim: ``If Alice didn't send Bob R, then she could change the value of S and then the value of the bit. The fact that Bob already knows R prevents her from doing this.'' Can someone explain exactly how Alice cheats if Bob doesn't know R. I can't see how she can alter R and S and b at all without being able to produce hash collisions. In essence, why doesn't the following work: 1. Alice has a bit b. She picks a random bit string R and sends Bob h(R,b) 2. To verify, she tells Bob R and b. Assuming Bob knows b is a single bit, how does Alice cheat without needing to produce hash collisions for h. thanks in advance for any help, - robbie -- ---------------------------------------------------------------------- robbie gates | it's not a religion, it's just a technique. apprentice algebraist | it's just a way of making you speak. pgp key available | - "destination", the church.

2 1