- cypherpunks-legacy - lists.cpunks.org

Re: The Free Speech Implications of Remailers
by Lynne L. Harrison 17 Dec '03

17 Dec '03

At 10:32 PM 10/1/95 -0700, Tim May wrote: <snip> >Well, guess what? The very technologies we have been so central in >deploying are the technologies that make _conventional_ means of >controlling distasteful material so hard. >system of the various mail delivery systems.) <snip> >Crypto anarchy means the racists, sexists, speciesists, and other "ists" >cannot be muzzled. I call this a good thing. It's why I'm here. Excellent analysis. One can't argue with logic, nor should one forget the purpose and spirit of this list. The fact that spamming is in poor taste is irrefutable. However, some of the "where did this come from"? responses are starting to sound like some people are suddenly against the use of anonymous remailers. I, for one, would hope that people are simply rising to the challenge of tracing the routers. Kill the message if you are so moved -- not the technological messenger. ******************************************************************** Lynne L. Harrison, Esq. Poughkeepsie, New York lharrison(a)mhv.net "Say not, 'I have found the truth', but rather, 'I have found a truth.'" - Kahlil Gibran from "The Prophet" ********************************************************************

1 0

Re: DNS Security ( was Re: NetScape's dependence upon RSA down...)
by kerowe＠ncsa.uiuc.edu 17 Dec '03

17 Dec '03

At 1:58 PM 10/1/95, Donald E. Eastlake 3rd wrote: >DNS security is an important point. People not aware of efforts in this >area may want to check out draft-ietf-dnssec-secext-05.txt which has >more or less passed working group last call and is being considered by >th Security Area Directory / IESG. Reference code is also available >(see message pasted at end below). > >Donald But the proposed DNS extension itself does not deal with CRL and Key Compromise Lists. Ken. ------------------------------------------------------------- Kenneth E. Rowe (kerowe(a)ncsa.uiuc.edu) Senior Security Engineer (217) 244-5270 (Office) / Security Coordinator (217) 244-0710 (NCSA IRST) National Center for Supercomputing Applications *** email ncsa-irst(a)ncsa.uiuc.edu for computer incident response ***

2 1

Re: NetScape's dependence upon RSA down for the count!
by David_A Wagner 17 Dec '03

17 Dec '03

In article <9509301910.AA10970(a)dmsd.com> you write: > > The "messenger attack" as described in my earlier posts regarding > public key encryption and key management seems to apply to NetScape's SSL. > I have a Fifty dollar bill for the first person to submit to the mail box > nethack(a)dmsd.com a working Unix server (with cleartext session logs) which > accepts all connections on a unix based host to the www port and redirects > them to netscape.com leaving a clear text log of each session's SSL packets > in /tmp by session. All entries become the property of DMS Design. The winner > and I will submit a claim for one of Community COnneXion's "I HACKED NETSCAPE" > tee shirts as a server hack. (Have Fun!!) > This is a trivial program! I can't believe anyone considers this technically difficult. But hey, who am I to question, if you'll pay $50! Ok, let me back that up with real code. Here's a proxy I've been using for experimenting, in lieu of root access & tcpdump. Usage: proxy localport remotehost remoteport > capturefile Try: $ ./proxy 2999 www.netscape.com 80 > capturefile & $ netscape http://localhost:2999/home/welcome.html & or $ ./proxy 3999 alpha.mkn.co.uk 443 > capturefile & $ netscape https://localhost:3999/ & Here's the source. It's a bit unstable, and could be a improved a little, but was fine for a quick kludge. So feel free send the $50 to the following address at your convenience!! :-) David Wagner UC Berkeley 330 Soda Hall Berkeley, CA 94720 #include <stdio.h> #include <sys/types.h> #include <sys/param.h> #include <sys/socket.h> #include <sys/time.h> #include <netinet/in.h> #include <netdb.h> #include <ctype.h> /* dump bytes, sorta similar to tcpdump's style */ dump(char *p, int len) { int i, j; while (len > 0) { for (i=0; i<16 && i < len; i++) { printf("%2.2x", (unsigned char) p[i]); if (i & 1) printf(" "); } j = i; for (; i<16; i++) { printf(" "); if (i & 1) printf(" "); } printf(" # "); for (i=0; i<j; i++) printf("%c", (isprint(p[i])) ? p[i] : '.'); printf("\n"); len -= j; p += j; } printf("\n"); } /* copy one message; guaranteed not to block */ int fromto(int from, int to) { static char buf[2048]; int len; len = read(from, buf, sizeof(buf)); switch(len) { case 0: return(0); /* EOF */ case -1: perror("read"); exit(1); } dump(buf, len); return(write(to, buf, len)); } /* kludge to deal with select fd_set * parameters weirdness */ /* #define FSC(x) ((fd_set *) x) */ #define FSC(x) ((int *) x) /* repeatedly copy both ways */ proxy(int xfd, int yfd) { fd_set fs; char buffer[2048]; int done = 0; while (!done) { FD_ZERO(&fs); FD_SET(xfd, &fs); FD_SET(yfd, &fs); if (select(64, FSC(&fs), FSC(0), FSC(0), (struct timeval *) 0) == -1) { perror("select"); exit(1); } if (FD_ISSET(xfd, &fs)) if (fromto(xfd, yfd) <= 0) done = 1; if (FD_ISSET(yfd, &fs)) if (fromto(yfd, xfd) <= 0) done = 1; } } int remoteinit(char *addr, int port) { struct sockaddr_in si; int fd; struct hostent *hp; char hostname[MAXHOSTNAMELEN]; memset(&si, 0, sizeof(struct sockaddr_in)); si.sin_family = AF_INET; si.sin_addr.s_addr = inet_addr(addr); si.sin_port = port; if (si.sin_addr.s_addr == -1) hp = gethostbyname(addr); else hp = gethostbyaddr((char *)&si.sin_addr.s_addr, sizeof(struct sockaddr_in), AF_INET); if (hp == NULL) { fprintf(stderr, "unknown host %s\n", addr); exit(1); } si.sin_family = hp->h_addrtype; memcpy(&(si.sin_addr), hp->h_addr, hp->h_length); strncpy(hostname, hp->h_name, MAXHOSTNAMELEN-1); if (si.sin_family == AF_INET) printf("Connecting to %s (%s)\n", hostname, inet_ntoa(*(struct in_addr *)&si.sin_addr.s_addr)); else printf("Connecting to %s\n", hostname); if ((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { perror("socket"); exit(1); } if (connect(fd, &si, sizeof(si)) < 0) { perror("connect"); exit(1); } return(fd); } int localinit(int port) { struct sockaddr_in thissock; int s, i; if ((s = socket(AF_INET, SOCK_STREAM, 0)) < 0) { perror("socket"); exit(1); } memset((char *)&thissock, 0, sizeof(struct sockaddr_in)); thissock.sin_family = AF_INET; thissock.sin_port = port; thissock.sin_addr.s_addr = htonl(INADDR_ANY); i = 1; setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (char *)&i, sizeof(int)); if (bind(s, (struct sockaddr *)&thissock, sizeof(struct sockaddr_in)) < 0) { perror("bind"); exit(1); } if (listen(s, 5) < 0) { perror("listen"); exit(1); } return(s); } usage() { fprintf(stderr, "Usage: proxy localport remotehost remoteport\n"); exit(1); } int main(int argc, char **argv) { int partialxfd, xfd, yfd, i, localport, remoteport; struct sockaddr_in thatsock; char *remotehost; if (argc != 4) usage(); localport = atoi(argv[1]); remotehost = argv[2]; remoteport = atoi(argv[3]); if (localport < 1024 || remoteport <= 0) usage(); partialxfd = localinit(localport); for (;;) { i = sizeof(struct sockaddr_in); if ((xfd = accept(partialxfd, (struct sockaddr *)&thatsock, &i)) < 0) { perror("accept"); exit(1); } yfd = remoteinit(remotehost, remoteport); proxy(xfd, yfd); } }

1 0

List latency.
by Peter Trei 17 Dec '03

17 Dec '03

> > At 12:20 PM 10/2/95, Peter Trei wrote: > > >For those curious about the latency, I'm posting this at 12:08, on the US > >east coast. > >How long did it take to reach you? > > I got it at 09:14, Pacific Daylight Time, so there appears to be no lag. Here's the relevant headers for the bounceback to me, which took an hour: > Received: from relay3.UU.NET [192.48.96.8] by alcor.process.com > with SMTP-OpenVMS via TCP/IP; Mon, 2 Oct 1995 13:10 -0400 > Received: from toad.com by relay3.UU.NET with SMTP > id QQzjst04916; Mon, 2 Oct 1995 12:51:05 -0400 > Received: by toad.com id AA00166; Mon, 2 Oct 95 09:10:05 PDT > Received: from alcor.process.com by toad.com id AA00160; Mon, 2 Oct 95 > 09:10:02 PDT Message-Id: <9510021610.AA00160(a)toad.com> Received: from thunk > [192.42.95.240] by alcor.process.com > with SMTP-OpenVMS via TCP/IP; Mon, 2 Oct 1995 12:10 -0400 > Date: Mon, 2 Oct 1995 12:14:30 -6 Translating: Sent by thunk.process.com 12:14 EDT Received by alcor.process.com 12:10 EDT -4 minutes (thunk's clock is off) Received by toad 9:10 PDT 0 minutes Received by uunet 12:51 EDT 41 minutes Received by alcor 13:10 EDT 19 minutes It looks like there's a considerable delay entering and leaving uunet. I'm not sure which machine gets the blame, but it's either toad&uunet, or uunet&alcor. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

2 1

re: `NOISE' what crypto is that ? [was Re: NT and C2]
by Weld Pond 17 Dec '03

17 Dec '03

>Weld Pond writes: >[...] > > http://www.iquest.net/cgi-bin/gate2?|mmMgT008://bbb.PHDx10.ix0/ibLD1P7= >i/ExUP0e/A1vxiw.T05smgmRibLD1P7iggyR/D1UgM/ppp/6DYsPv/ibLD1P7i/ExUP0e/Ex= >UP0egMmN1xAUvTgrmNvgmwONgOmyMyYnlXkKCfX,ve8TxU8Di31,nlXk6CllpW,ve8TxU8Di31= >MRmypd > > >What kind of (en)coding is that ? some kind of rot13++ ? > I know it looks funny but that is the actual URL. I think it is some kind of verity search engine they use at IQuest. To get it to work I had to paste in the 4 lines individually into Netscape because the URL edit windows doesn't seem to do linefeeds. It's getting pretty bad when you feel like you should uuencode the URL so that people get it straight. Here is the URL again: http://www.iquest.net/cgi-bin/gate2?|mmMgT008://bbb.PHDx10.ix0/ibLD1P7i /ExUP0e/A1vxiw.T05smgmRibLD1P7iggyR/D1UgM/ppp/6DYsPv/ibLD1P7i/ExUP0e/Ex UP0egMmN1xAUvTgrmNvgmwONgOmyMyYnlXkKCfX,ve8TxU8Di31,nlXk6CllpW,ve8TxU8D i31MRmypd Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/~weld L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

1 0

Re: `Hack Microsoft' challenge is NYT Computer News Daily's top story
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:37 PM 10/2/95, MIGUELDIAZ(a)megaweb.com () wrote: >I don't know about everyone else, but a T-shirt seems a very >small reward for uncovering a "hole" in the encryption >algorithm of Microsoft products. Does that apply to any and >all bugs?? i.e. not necessarily security problems?? You are of course welcome to offer a richer prize. Meanwhile, Sameer is the one making the offer, so it's not for us to say he's being cheap. Also, the history of science is filled with cases where bets with trivial payoffs intensely motivated people. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: NetScape's dependence upon RSA down for the count!
by jbass＠dmsd.com 17 Dec '03

17 Dec '03

Sorry David, The offer was for a server/filter/MITM/proxy that logged clear text not cyphered text for the SSL stream. Combine your program with SLL code from other sources and 95% of the program is complete. Add to that a way to produce a valid certificate for the client and you will earn the $50 and a lot of praise for a job well done from everybody. > > I have a Fifty dollar bill for the first person to submit to the mail box > > nethack(a)dmsd.com a working Unix server (with cleartext session logs) which > > accepts all connections on a unix based host to the www port and redirects > > them to netscape.com leaving a clear text log of each session's SSL packets > > in /tmp by session. All entries become the property of DMS Design. The winner > > and I will submit a claim for one of Community COnneXion's "I HACKED NETSCAPE" > > tee shirts as a server hack. (Have Fun!!) > > > > This is a trivial program! I can't believe anyone considers this > technically difficult. But hey, who am I to question, if you'll > pay $50! > > Ok, let me back that up with real code. Here's a proxy I've been > using for experimenting, in lieu of root access & tcpdump. For the rest of you, David gave you a small jump start. Checkout the web pages at C2.org and netscape.com for access to the ssl prototype code. Have fun, John Bass Owner, DMS Design

1 0

One-Time-Pad generation from audio device
by Rev. Mark Grant 17 Dec '03

17 Dec '03

Over the weekend I hacked up a one-time-pad generator from the random number code I've been writing for Privtool, which uses noise from the audio device to generate random numbers. The code basically reads in a 512-byte block from /dev/audio, then takes the MD5 of that block to generate 16 bytes of the OTP. The raw audio data I'm getting is not particularly random and will compress by 3:1 using gzip or compress, so I'm assuming that using a 32:1 ratio here via MD5 will give a truly random output (it's certainly uncompressible). Before I release the source code to the Net, can anyone give me any good reasons to believe that this won't produce physically random output, or make suggestions on how to test, or improve, the generated output ? There's a #define which can be used to easily increase the amount of data fed into the MD5, but at the moment it will only generate about 1 MB per hour on a Sparcstation (limited by the audio input rate), so I don't want to increase that if I don't have to. Mark

3 3

Re: WHERE did this come from?
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 18:38 9/30/95, rivaud(a)rain.org wrote: >Attatched to this is, (I hope), the header text from a unsolicited e-mail >message I received. The return address does not work. WHY? How can I >inform the sender that I hope to never receive there material again? > >I tried "reply-all" through Eudora, but my reply got bounced back to me >as undeliverable. > >I have removed the content of the original message. I don't know why it >was sent to me, but it contained material that I found offensive. > >Any help, or words of wisdom and enlightenment would be appreciated. >Information would be nice too. > >Thanks. This is a KNOWN SPAM (it is currently being talked about in the Net-SPAM Usenet Newsgroup). It has been coming from 3 sites (one in Italy, one in France, and one in Germany). The national Police in all 3 countries (as well as the FBI) are apparently investigating it. To track the situation monitor this Web Page (Which should be Globally Accessible): http://www.panix.com/~lan/crusader

3 2

Re: Netscape finally issuing md5sums/pgp signed binaries ? (was Re: NetScape'sdependence upon RSA down for the count!)
by cman＠communities.com 17 Dec '03

17 Dec '03

The idea here is to use multiple alternative channels for distributing the checksums (newsgroups, mailing lists, telephone support lines, fax-back service, e-mail, etc.), in addition to the ftp sites. Also, since you guys use (relatively untrusted) mirror sites, you can distribute the checksums on your official sites, so that people can verify them from you directly, even if it's more practical for their main download to be from a "local" mirror. > > I've been thinking about this recently for obvious reasons. My concern >is that if someone can attack your download of netscape, they could also >attack your download of the program that validates netscape. Is there >really any way out of this one? > > --Jeff

1 0