- cypherpunks-legacy - lists.cpunks.org

IMPORTANT: Valhalla is leaving alias.net domain!!
by John Perry 17 Dec '03

17 Dec '03

NOTICE: valhalla.phoenix.net is leaving the alias.net domain! Please change your entries from remailer(a)spook.alias.net and wmono(a)spook.alias.net to remailer(a)valhalla.phoenix.net and wmono(a)valhalla.phoenix.net accordingly. Apparently double-domaining valhalla in SunOS 4.1.3 causes severe DNS problems that I can't explain at this time. I apologize for the inconvenience. Raph, can you change the entry to your remailer list accordingly ASAP?? John Perry - KG5RG perry(a)valhalla.phoenix.net

1 0

On export restrictions and the NYT/Internet Commerece
by sameer 17 Dec '03

17 Dec '03

The recent NYT article about the NFS work (nominally about the NFS work, I wouldn't call "spoofing NFS" to be tantamount to being able to spoof any file xfer over the internet) stresses that the internet wasn't built for security, yadd yadda yadda and therefore isn't very useful for internet commerce at this point. I urge everyone who talks to the media about this to stress export restrictions.. The infrastructure *would* be in place by now if we didn't have export restrictions. Deployed encryption at the IP level would be much easier if we didn't have export restrictions, etc. etc. Now that the potential for big bucks are obviously on the line maybe, (They always were on the line, it is just more obvious now) just maybe, enogh large corporations will invest in lobbying for the removal of export restrictions that it will get done. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

FWD>sig du crypt
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Date: 11 Oct 1995 11:04:04 -0800 >From: "Vinnie Moscaritolo" <Vinnie_Moscaritolo(a)quickmail.apple.com> >Subject: FWD>sig du crypt >To: "Bob Hettinga" <RAH(a)shipwright.com> > >Mail*Link(r) SMTP FWD>sig du crypt >>(forwards factored out) >> >>Sig found in sci.crypt: >> >>-- >>Eric Norman >> >> "Congress shall make no law restricting the size of integers >> that may be multiplied together, or the number of times that >> an integer may be multiplied by itself, or the modulus by >> which an integer may be reduced". >> ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Pointer to 10/9/95 EE Times Article
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com, llange(a)eet.cmp.com Front Page: `Cypherpunks' asked to breach Netscape, Microsoft security Desperately seeking hackers Quotes from Sidebar (How the `Cypherpunks' mailing list works): "When The New York Times announced a security flaw in Netscape Communications Corp's World Wide Web browser software a few weeks ago, the `Cypherpunks' hit the big time." This may be true. Companies are now asking for their products to be brutalized by the Cypherpunks' to help ensure security! This could not be said even a few mere weeks ago. "According to the group's moderator, who prefers to remain anonymous, `The most important means to the defense of privacy is encryption. Cypherpunks are therefore devoted to cryptography. They wish to learn about it, to teach it and to implement it.'" Ok, since when is the Cypherpunk's mailing list moderated? It is apparent that the author, Larry Lange, has never studied the list closely or he would know how amusing this sounds... (Geez, if he had ever read one of Tim May's posts on the subject... :-) Oh well, at least, I was amused. Regards, Loren -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHwRFv8de8m5izJJAQEzWgP+LCPtBBH+hz0yqOG2MfduNyGK0kM6gHfN H/ZRZ11z2CExCZiJxRma6MhR/nRmgSePxGWMq/DfbUziUsuNwuJwN/PEEJtAXWTa dJ3FEhUaZbVlhBJK5Um1M0SeZPqiLCQH9K0DJNE0FevrJed/3MAft+owYTk2NQ+H oXDwXtFrTbw= =UGHU -----END PGP SIGNATURE-----

1 0

regulation of money transmitters
by cman＠communities.com 17 Dec '03

17 Dec '03

I just had a very pleasant conversation with the California State Banking Department; they are sending me copies of the relevant laws, and applications for the necessary licenses to sell negotiable instruments and transmit money overseas. I spoke with an examiner and she didn't seem to think there was anything special about them being _digital_ negotiable instruments. Apparently it involves a $5,000 non-refundable application fee, background investigations, examination of the soundness of the corporation, and the posting of a bond proportional to the anticipated volume (updated if volume is larger.) All very reasonable. Those who might be intereted in actually doing something with this information should contact Alicia Adoc at (415) 263 8549, or the banking department in the applicable state.

1 0

Re: NYT on Internet Flaws
by David Berger 17 Dec '03

17 Dec '03

[stuff deleted] >People seem to miss that the NFS hack was only an _example_ of a powerful >way to silently destroy the integrity of an executable. Spoofing the >insecure FTP session they used to retrieve it works. Sending them a random >trojan horse works. The point was not that NFS is insecure. It was that >unless you can authenticate your executables as being trustworthy NOTHING >ELSE MATTERS. No I don't think the community missed the point. While both NFS and FTP are equally weak in the way you point out, I think you should have used FTP as your main example because if we presume that the file server where the binary lives is reasonably trustworthy (like the guys at Netscape haven't inserted a trojan horse into their own binary and placed it up for FTP) then the way the file will propogate throughout the net is FTP and not NFS. Nonwithstanding, the NY Times writer took an otherwise reasonable point and blew it up into a "War of the Worlds" style article. I'd make sure he writes a decent article before quoting me in it. David (wondering whose stock fell because of this page one-er) =========================================================================== David A. Berger Software Engineer/Internet Product Development Enterprise Integration Technologies|800 El Camino Real|Menlo Park, CA 94025 dvberger(a)eit.com http://www.eit.com/~dvberger/ (415) 617-8792 ===========================================================================

4 3

Re: Basic Flaws in Internet Security and Commerce
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > So: If you can't trust your path to your own file system, what can you > trust? (And this is without even talking about things like firmware > upgrades and BIOS patches and all sorts of other potential approaches.) Can > we do no better than simply assume the local workstation file system can be > trusted? > Nah, it's not as bad as all that. There's fixes to all of this, they're well known, and actually in place at some places. Because it's such a pain having good security on all of the machines most sites choose to have really good security on a firewall to keep the bad guys out, and through policy, isolation, and less stringent security measures protect the machines inside the firewall. That's not to say that everyone with a firewall has good security, far from it. It's also not to say that everyone without a firewall is vulnerable, they're not...I know folks with all of their machines buttoned up tight. It's possible to close most categories of holes, and to detect intrusions in progress. You say you're worried about the system being corrupted so that you can't trust calls to the OS. Some attacks do work this way, but you can prevent the attack via a combination of good security and good practices. And yes, secure authentication and transmission of data makes everything much simpler;) Without it you have to essentially pull up the drawbridge and trust no one outside the moat, since there's no way of knowing if anyone, or any host is who or what they say they are. If anyone wants more specific information about how to protect from various attacks I can help or give you references to the literature, but I won't go into it here since I expect that most anyone you'd find on cypher- punks knows all this at least in outline already. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: SAIC bought InterNic, but who is SAIC? A spook contractor!
by Chris Claborne 17 Dec '03

17 Dec '03

At 05:18 PM 9/28/95 -0700, John Gilmore wrote: >Forwarded-by: gordoni(a)base.com (Gordon Irlam) >SAIC's board members include Admiral Bobby Inman, former NSA head and deputy >director of the CIA; Melvin Laird, Nixon's defense secretary; and retired >General Max Thurman, commander of the Panama Invasion. Recently departed >board members include Robert Gates, former CIA director; William Perry, >current Secretary of Defense; and John Deutch, the current CIA director. >Current SAIC government contracts include re-engineering information systems >at the Pentagon, automation of the FBI's computerized fingerprint >identification system, and building a national criminal history information >system. I am not supporting the idea that SAIC is not annother govt mouthpiece or cover op but it is standard practice to hire retired workers from government that worked in the area that you want to sell services into. I know of a ex army colonel that used to work for a government contractor. I'm sure that he used his contacts to sell services to the government. You gotta love it! Don't trust S/MIME, it's supported by RSA (a govt mouth piece) and uses DES. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. PGP-encrypted e-mail welcome!

2 1

Final Roster/Reminder -- Bionomics Conference (fwd)
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Here's a sign of the times> S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ---------- Forwarded message ---------- Date: 11 Oct 95 14:38:02 . . . Subject: Final Roster/Reminder -- Bionomics Conference Dear Friends, With a record number of 35 speakers and panelists (whew!), the program for the 3rd Annual Bionomics Conference has been finalized. Since our brochures were printed, we've added a number of interesting and thought-provoking individuals, including o Lew Perelman, author of "Hyperlearning" o Andrew Basile, author of "The SPA's Guide to Online Law" o Morley Winograd, author of "Taking Control: Politics in the Information Age" o Frank Gregorsky, former chief of staff to Cong. Newt Gingrich o Jim Griffin, Director of Technology at Geffen Records o Don Lavoie, Director, Program on Social & Organizational Learning, George Mason University o Irwin Glenn, Senior Systems Engineer, Netscape Communications o Pat McKim, Managing Partner, Practical Strategies o Cindy Cooke, Director, Democratic Leadership Council of CA o Dennis Miller, Associate Professor, Baldwin-Wallace College . . . What's more, for the truly tech-savvy, you can now pay for your conference attendance with Cybercash. Just check our web site (www.bionomics.org) . . . ^^^^^^^^^

1 0

anonymous web pages?
by Nelson Minar 17 Dec '03

17 Dec '03

Does any facility current exist to allow people to create anonymous web pages? After anonymous email and anonymous news postings, this is an obvious next step. It seems that it would be a fairly simple matter to write a program that would accept email containing a web page and the destination URL, do some checking, and then create (or update) the requested page. Require signatures and allow receiving mail via a remailer chain, and you've got secure anonymous web pages. The hard part would be finding a site that would be willing to serve anonymous pages. I don't understand the politics at various sites that allow anonymous remailers: maybe this isn't much harder? -- __ nelson(a)santafe.edu \/ http://www.santafe.edu/~nelson/ PGP key 9D719FAD Fingerprint 3B 9B 8E 58 1C 90 57 3E B7 99 ED 13 65 2E 0B 24

2 1