- cypherpunks-legacy - lists.cpunks.org

Re: The Elevator Problem
by Bryan L Andrews 17 Dec '03

17 Dec '03

Text item: Rob wrote: >This may be old hat, but an earlier post (around the time the Kocher >RSA-timing attack came out) to the list asked about the "Elevator >Problem", where two parties who think they share the same secret want >to confirm it on an open channel. I came up with an idea for a >protocol but never got around to posting it, and dropped off the list >briefly... so pardon me if this is already touched upon. ............ >Comments? This reminds me of the discussions I've seen over the last few months regarding oblivious transfers/zero-based transactions. Good article in Scientific American on it a few months ago. Bryan. Text item:

1 0

Proposal: PGPmail Plugin for Netscape/Mosaic
by modemac＠netcom.com 17 Dec '03

17 Dec '03

I don't know C, unfortunately, otherwise I'd program this myself. So instead I'm putting it up for debate, and to encourage any cypherpunk to give it a shot if he/she thinks it's a good idea. The idea behind this utility is to encourage the use of PGP for sending email. Currently, using PGP with email requires you to compose the message, get the recipient's public key, encrypt the message, upload it to your system (or transfer it over using the clipboard), and email it. It would be much easier if sending a PGP email message was as simple as clicking a mouse. This, this idea for a PGP plugin. It goes like this: You create a small text file containing an email address and a PGP public key. Your own email address and key would be the best choice, of course, but it doesn't have to be yours. Place that file on your Web page with a unique extension, such as public_key.key. Include a link to this text file on your page, with a standard anchor like this: <li>Click here to send me a PGP email message When your Web browser reads a .key file, it invokes the PGPmail plugin utility. This utility calls up a window that allows you to compose your email message (just like a standard email form). When you have finished composing the message, you click the "Send" button as usual. The utility then does the following: - Reads the public key from the .key file. - PGP-encrypts the message with that public key, using the PGP -eat option. - Emails that PGP-encrypted message to the address given in the .key file. The major advantage of this utility is that it would allow you to send an email message to anyone who puts their public key onto their Web page in this fashion, without having to go through the rigamarole of getting the public key, saving it to a file, encrypting the message, emailing the message, and then deleting the public key again (to keep from bloating your keyring, especially if it's not someone you plan to have a regular conversation with). It would also ensure security on your part, because the PGP encryption would take place entirely on your own system. You wouldn't have to depend on a CGI script and someone else's copy of PGP, because the email process doesn't take place until *after* you have encrypted the email message. The ability to send a PGP-encrypted email message with one click of the mouse would result in an explosion of PGP use over the Web. It would allow safe transactions of private information, such as people already do with PGP - but it would be so EASY that anyone with a Web browser could do it.

1 0

Re: Comments on MicroPayments and the Web
by Bruce Baugh 17 Dec '03

17 Dec '03

At 10:54 AM 6/15/96 -0400, Perry E. Metzger wrote: >> Just like commercial crypto, servers, news clients, and the like are all >> superior to the free versions? > >Software and hardware follow different rules. This is true enough. On the other hand, it's true that money by itself is not (in my experience) the deciding factor on the quality of a service provider. I moved some months ago from the biggest ISP in town to one with a much smaller resource base but greatly superior service in the areas that mattered to me (fast news, reliable mail, etc). The guy in charge is making better use of what he's got. On the gripping hand, if my current provider had the other provider's bucks, things could _really_ fly. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

1 0

Re: doubleclick monitoring web browsing habits
by Deranged Mutant 17 Dec '03

17 Dec '03

On 14 Jun 96 at 18:06, Mark M. wrote: [..] > but it is not enough to satisfy my paranoia. I would be truely satisfied if > Netscape would prompt for an e-mail address whenever it sends mail or post to > usenet. When I used to read the list over hks.net (still down, eh?) I would change my name (and sometimes address, for quasi-anonymity) with no problems... you just have to do that *before* you try to reply. (Free)Agent newsreader will let you do that as part of the reply as well. It'll still show the path and machine that sent news, but it allows you to change From:, Reply-To: and Sender: fields. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Fuseable Links - no guarantees??
by jim bell 17 Dec '03

17 Dec '03

At 11:44 PM 6/14/96 -0400, Warren wrote: >I have never paid much attention to the protection of firmware or the >technical issues revolving around such schemes...was wondering: > >I recently saw an add for a UK based group that says they can take a PIC >OTP micro and read the prom (for a fee, of course) - How the heck is this >done?? I have my suspicion that they (somehow) magically peel off the >ceramic coating (without destroying the chewy center), get a circuit mask >and 'micro probe' the I/O of the IC...they then download the secret recipe >to the afore mentioned 'chewy center'. > >Is this close to accurate?? How is it 'done' ??? While I have never come even close to needing to attempt this kind of thing, long ago it occurred to me that if the "no read" bit was stored in a programmable bit, and if the location of that bit was known or could be identified, you could expose that particular bit through a tiny mask hole and cause the part to be readable again. Locating that bit (assuming there's just one) would be relatively simple: Take a test part, program it, read-lock it, and then expose it to a VERY slowly sliding mask with UV behind. Do this for both axes, to find the bit's location on the chip. Jim Bell jimbell(a)pacifier.com

1 0

CYPHERPUNKS
by Blake Wehlage 17 Dec '03

17 Dec '03

Ok, here is the thing I feel and I know that I really am a main factor for the unraveling of the true meaning of the mailing lists. I have had many posts that were unappropiate, and very stupid. That is why I am unsubsribing, and will no longer make posts to the list. You can still reach me at jwilk(a)iglou.com I do though feel I have picked up some very needed knowledge of PGP and crypto. Thank you. I still will keep the title of youngest cypherpunk with pride. Blake Wehlage <jwilk(a)iglou.com> URL: http://www.iglou.com/members/jwilk.html "World's Youngest Cypherpunk" Age 13

1 0

Re: Fuseable Links - no guarantees??
by wxfield＠shore.net 17 Dec '03

17 Dec '03

Jim; I was under the impression that a fuseable link was literally a piece of conductive material that you deliberatley 'blow-away' - In most cases, couldn't you simply 'tap into' the data side of the fuse, and download the info?? >At 11:44 PM 6/14/96 -0400, Warren wrote: >>I have never paid much attention to the protection of firmware or the >>technical issues revolving around such schemes...was wondering: >> >>I recently saw an add for a UK based group that says they can take a PIC >>OTP micro and read the prom (for a fee, of course) - How the heck is this >>done?? I have my suspicion that they (somehow) magically peel off the >>ceramic coating (without destroying the chewy center), get a circuit mask >>and 'micro probe' the I/O of the IC...they then download the secret recipe >>to the afore mentioned 'chewy center'. >> >>Is this close to accurate?? How is it 'done' ??? > > >While I have never come even close to needing to attempt this kind of thing, >long ago it occurred to me that if the "no read" bit was stored in a >programmable bit, and if the location of that bit was known or could be >identified, you could expose that particular bit through a tiny mask hole >and cause the part to be readable again. Locating that bit (assuming >there's just one) would be relatively simple: Take a test part, program it, >read-lock it, and then expose it to a VERY slowly sliding mask with UV >behind. Do this for both axes, to find the bit's location on the chip. > >Jim Bell >jimbell(a)pacifier.com

2 1

[Noise] Re: Clinton Backs Internet 'Decency Act'
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 10:35 AM 6/14/96 -0700, you wrote: >This is also at odds with what Clinton said. The full text of the statement >is available on whitehouse.gov, among other places. I don't see how necessarily. (1) He supports the bill, and (2) he thinks the bill is within the realm of constitutionality, his statement is rather weak, but I think if you take the two points above, their summation is obvious and _is_ contrary to the bravado of Gore's MIT commencement speech. This is not to say he could very well back off to save face, which is what he is starting to do, and I hope he continues to do... Statement by President Clinton in reaction to Court Decision THE WHITE HOUSE Office of the Press Secretary ___________________________________________________________________________ For Immediate Release June 12, 1996 STATEMENT BY THE PRESIDENT The Justice Department is reviewing today's three judge panel court decision on the Communications Decency Act. The opinion just came down today, and the statute says we have twenty days to make an appeal. I remain convinced, as I was when I signed the bill, that our Constitution allows us to help parents by enforcing this Act to prevent children from being exposed to objectionable material transmitted though computer networks. I will continue to do everything I can in my Administration to give families every available tool to protect their children from these materials. For example, we vigorously support the development and widespread availability of products that allow both parents and schools to block objectionable materials from reaching computers that children use. And we also support the industry's accelerating efforts to rate Internet sites so that they are compatible with these blocking techniques. -30-30-30- _______________________ Regards, Democracy is where you can say what you think even if you don't think. -? Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

2 1

Non-Lethal Terrorism
by jya＠pipeline.com 17 Dec '03

17 Dec '03

For background on the recent cyber-terrorists reports from London, we offer the Council on Foreign Relations' 1995 report: NON-LETHAL TECHNOLOGIES Military Options and Implications Report of an Independent Task Force The long history of military operations has been marked by steady increases in the lethality of weapons. U.S. commanders and policymakers face excruciating dilemmas in decisions to use lethal force. They strive to maximize protection of their own troops and to minimize collateral casualties among noncombatants. Authoritarian regimes -- as in Iraq -- and factions in civil wars -- as in Bosnia -- may see fear of American casualties as one factor in deterring intervention against them. Terrorists, guerillas, and other irregular forces often exploit noncombatant populations by mounting attacks from their midst. Can technology, ease these dilemmas by providing acceptable, effective non-lethal capabilities to supplement conventional weapons across a broad spectrum of conflict? In major wars or similiar cases of high-level violence, can such capabilities reduce the risk to U.S. forces by, in effect, substituting technology for manpower in performing certain missions, for example, by shutting off power transmission and communications of adversaries? In situations short of traditional warfare -- for example, the humanitarian intervention in Somalia -- can non-lethal systems help provide calibrated coercion proportional to the objectives? How do they relate to the lethal systems on which U.S. forces depend? What policy issues do such technologies pose? In this report a bipartisan task force, including former Air Force and Army chiefs of staff, leading scientists, and other experts, examines these questions. The task force concludes that a number of non-lethal technologies deserve serious consideration in U.S. planning and development for future military contingencies. http://pwp.usa.pipeline.com/~jya/nltech.htm (47 kb) Beware snooping, consider using the anonymizer at: http://www.anonymizer.com ----- Or, if http fails, NLT_ech to <jya(a)pipeline.com>

1 0

Re: Remailer Operator Liability?
by hendersn＠zeta.org.au 17 Dec '03

17 Dec '03

> Now that the CDA decision has been made, I was wondering how this >would affect the liability status of the various remailer operators? In >the past several remailers have opted to discontinue service due to >legal/political pressure. Will this CDA decision help to decrease remailer >operator liability? Unlikely. The use of anonymous remailers was given as a reason for why it was impossible to effectively determine if indecent material was being distributed to a minor who was using a nym. I think pressure on anonymous remailers is going to increase as various groups complain that the paw innocent widdle kiddies are "vulnerable to corruption"(or some bullshit like that) because their age can be hidden. Read the decision. The CDA _may_ be declared constitutional if there was an effective and reliable way of preventing minors from accessing "indecent" material - which anonymous remailers make harder to do. On another front, anonymous remailers were brought up in the latest hearing of the Church of Scientology's court case against Dennis Erlich. Judge Whyte expressed concern that trade secret status could be destroyed simply by posting information through an anonymous remailer. Of course, the Church dearly wants those concerns to be considered valid in law. I expect Whyte to set a precedent concerning anonymous remailers sometime soon, and it is unlikely to be a good one. Zed(hendersn(a)zeta.org.au) "Don't hate the media, become the media" - Jello Biafra PGP key on request

4 4