- cypherpunks-legacy - lists.cpunks.org

Need confirmation of Win95 password encryption back door
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A Major Media Outlet requires confirmation that Windows 95, to facilitate its automatic reconnect feature for sleeping laptops and temporary network outages, caches all network passwords (NetWare, NT, UNIX running Samba, SLIP/PPP dialup) in unprotected memory in clear text, whether you've disabled persistent "password caching" to disk and applied the December 14th 128-bit RC4 .PWL patch, or not. There seems to be no way to turn this off. The idea, of course, is that a simple trojan horse could do whatever it wanted with this information. We know that this vulnerability exists in Windows for Workgroups, and Peter wrote a little demo (on hackmsoft page below, without source), but the APIs appear to have changed in Win95. So, anyone have Win95 and some time to kill, or can anyone recommend a good DOS/Windows RAM grepper? - -rich(a)c2.org http://www.c2.org/hacknmsoft/ $ Mon Jan 15 22:17:10 PST 1996 $ $ From llurch(a)networking.stanford.edu to cypherpunks(a)toad.com $ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPtDLo3DXUbM57SdAQEN7QP+J6Gmk6m8dv3X96SKZciI/L7DM04bDSoi HZa+dIoajAiRrfG9oSNcIYbVDDs67qwCSKGFg9hc5K3x99nhbq3Aw2mio62YQj+2 K62pBT9hQLe4dv8AMhLtIqyG4ZztYy+dDjGzsaUIkBUZKo5//Eh8c81xXLQrqXtk RFV+xkXBgww= =12rk -----END PGP SIGNATURE-----

1 0

Re: Spiderspace
by jfricker＠vertexgroup.com 17 Dec '03

17 Dec '03

At 11:38 AM 1/16/96 -0800, you wrote: > >I've been thinking a lot about the problems and opportunities that are >coming up as more and more "spiders" (Web searchers, crawlers) are indexing >directories and files on systems they can find. <a snip of agreement> I haven't checked my logs for Alta Vista but many of the spiders do follow the robot exclusion standard. A simple text file that should be retrieved first by any spider that explains where one may not go. The standard is fully explained at: http://info.webcrawler.com/mak/projects/robots/norobots.html But this does nothing for those items sitting in more traditional public space. Obscurity is no longer security.

1 0

Re: Reach out! Update 01 (CypherPurists trash this)
by Jeremy Mineweaser 17 Dec '03

17 Dec '03

At 10:10 AM 1/13/96 EST, Dan Bailey wrote: >Regarding the *67 feature to disable Caller ID: >This does not stop your ANI information from travelling >with your call. >A *much* better way to do this is the following: >Dial the Operator. >Ask him/her to dial the 800 number for you. > >This will result in your ANI being (000) 000-5555 >I tested this a couple months >ago using AT&T's 1-800-MY-ANI-IS service. I directly dialed >1-800-MY-ANI-IS and it read back my phone number. Then I had >the operator dial it for me and got (000) 000-5555. This >service doesn't work anymore, YMMV.

1 0

RE: Crypto anarchist getting through customs
by Kurt Buff (Volt Comp) 17 Dec '03

17 Dec '03

To expand a bit: I don't remember if it was a lieutenant, captain, or whatever, but he passed out the questionnaire in futherance of his master's degree in something or other. One question dealt with shooting civilians who disobeyed orders to turn over their arms, even if they were owned under what would now be considered legal circumstances. Shockingly, upwards of 25% of the soldiers (Marines, actually, as I remember it, I'll check my references if anyone wants) would have no problem doing so! This in spite of the fact that officers in the armed forces (not sure about enlisted men, but I believe it's true of them as well) swear an oath to uphold the Constitution against all enemies foreign and domestic - and I think that under the Constitution as it is now, forcibly depriving people of their arms would probably be a reasonable basis for considering them in contravention of the Constitution, and therefore enemies of it. Kurt ---------- From: Alan Horowitz[SMTP:alanh@infi.net] Sent: Tuesday, January 16, 1996 15:20 To: attila Cc: Timothy C. May; cypherpunks(a)toad.com Subject: Re: Crypto anarchist getting through customs The notorious questionaire to the SEALS wasn't an official action. It was one lieutenient doing an assignment for a night class. I never said that the federal government was good, or nice, or useful. Alan Horowitz alanh(a)norfolk.infi.net

1 0

Job offer for Computer Security Researcher
by bart＠netcom.com 17 Dec '03

17 Dec '03

Seen on ba.jobs.offered: Computer Security Research Position The Distributed Information Technologies Center at Sandia National Laboratories, in Livermore, California, is seeking a qualified candidate for the position of Senior Member of the Technical Staff in the area of computer security research. The scope of security research and development at Sandia is very broad, encompassing elements that relate to networking, hosts, and protocols. Examples include high-speed encryption, advanced firewalls, detection systems, and secure agents. The focus of the research is to provide both solutions to security issues relevant to the Laboratory as well as contributions to the security technology base needed by the National Information Infrastructure. The security research staff collaborate closely with the research groups that are involved with distributed computing and advanced networking, with the goal of providing a totally integrated solution to the information infrastructure. In addition to having the technical depth necessary to conduct extensive research projects, this Senior Staff Member will be expected to lead proposal efforts, serve as team leader for projects, and maintain active membership in national organizations that influence the direction of security research. The successful candidate will have an advanced degree in computer security or a related field. In addition, candidates will be evaluated on their demonstrated ability to formulate proposals, perform in-depth research, and report results in the form of papers and presentations. A U.S. citizenship is required for this position. Interested candidates should send their resumes to: Peter Dean, Manager Networking Research Department 8910 Sandia National Laboratories PO Box 969, MS9011 Livermore, CA 94551-0969 (510) 294-2656 pwdean(a)sandia.gov

1 0

Re: Spiderspace
by ecarp＠tssun5.dsccc.com 17 Dec '03

17 Dec '03

> From: tcmay(a)got.net (Timothy C. May) > Sure enough, a search of "Cyberia-l" in Alta Vista showed all sorts of > hits, including what appeared to be several _private archives_ of parts of > the traffic. (By "private" I mean in the sense that they were someone's > personal archives, and not necessarily complete or even semi-officially > sanctioned.) There are any number of reasons this migh have shown up - if the private archives are accessible to the public, for example ... but ... > Declan McCullagh, on the Cyberia-l list, followed up to my post on this > topic by noting that things will really get interesting when the internal > file systems of many sites are made searchable, such as with the Andrew > File System (AFS) at CMU and elsewhere. Apparently most users make their > directories accessible to others. ... I was under the impression that the only documents that most web crawlers will search are documents that are link-accessible. Are you saying that this isn't true? Are you saying that Alta-Vista will search EVERYTHING that's publicly accessible, whether by anonymous FTP or web?

2 1

Re: Spiderspace
by Martin Diehl 17 Dec '03

17 Dec '03

On 1/16/96 12:35 PM, tcmay(a)got.net (Timothy C. May) at Internet-USA wrote: > I've been thinking a lot about the problems and opportunities that are > coming up as more and more "spiders" (Web searchers, crawlers) are > indexing directories and files on systems they can find. [snip] > Sure enough, a search of "Cyberia-l" in Alta Vista showed all sorts of > hits, including what appeared to be several _private archives_ of parts > of the traffic. (By "private" I mean in the sense that they were > someone's personal archives, and not necessarily complete or even > semi-officially sanctioned.) [snip] > I've started to look for things like PGP files laying around buried in > subdirectories. I can imagine attacks based on this. [snip] > Fourth...left to your imagination. > --Tim May > We got computers, we're tapping phone lines, we know that that ain't > allowed. > ---------:---------:---------:---------:---------:---------:---------:---- > Timothy C. May | Crypto Anarchy: encryption, digital money, > tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero > W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, > Higher Power: 2^756839 - 1 | black markets, collapse of governments. > "National borders aren't even speed bumps on the information superhighway." I gather that it would be a Bad Thing (TM) to have someone get both the encrypted and clear text forms of your message (from either you or from the recipient) Maybe regularly changing your encryption keys is a Good Thing (TM) Martin G. Diehl

1 0

Remailers and Me
by Bruce Baugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This may sound like a clueless newbie question, but then it pretty much _is_, redeemed only by the fact that I know it. :-) Following a lead provided by another local newbie, I've been doing a bunch of amateur remailer testing, looping messages from here through a given remailer to a nym server, back through the remailer, to here, and toting up the travel times. The latency and reliability figures I'm getting bear little or no resemblance to the info included with Private Idaho, discussed here, and like that. Question: is this anything to be concerned about? I'm assuming that the folks doing ping testing are throwing far more clueful and automated procedures at the problem, just for starters. But then I get the impression that their methodology differs from what I'm doing here, too. (My aim was to simulate "normal" use, at least for me, and to go on to test times through combos of the most reliable sites later.) Bruce "One ringy-dingy, two ringy-dingy" Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEQAwUBMP2cxH3AXR8sjiylAQF0dgfRAZ1Mm6OxLhIQmcWA/gli96RVsZWnODLw HV5eUF8llVVL+XIzl7wuY9u9uiDdbi13mgWYx2PReYYoRZ6cGqCOMmqYyoCCS0Mr drUckoohuERMMi6Yh8V9rHVLSdK49BXril8E/lQo7TxxwRyVASINrh7B22B6Ka1o Ymd+kkjah2WkL0oE+qnNoMylhUc5WYbKaO5BskP91zmV6S4MTHinKDOs8EPGEM1H ZzNBLXJk0C/kYwxTIaqq7I70BzYkSEPqXaT/2LMjzCvuz20pMN5jGGof6EmAQi3B R2wbVKp9A8SmBtFHah+HkROFqulSzLKxglGkPKVGFIVK0Ao= =JsYr -----END PGP SIGNATURE----- Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

1 0

Re: on being elitist...
by Duncan Frissell 17 Dec '03

17 Dec '03

At 07:48 AM 1/17/96 -0600, Ed Carp, KHIJOL SysAdmin wrote: >I would say that an "elitist" is one who believes that the masses (or the >great unwashed, depending on your point of view) are somehow "not >deserving" of surviving or "not worth it" The contemporary PC definition of elitist is "One who believes that people are capable of excellence." And an anti-elitist is "One who believes that people are utterly incapable of excellence." Hence Public Education. I'm sure that some on this list think that people will prosper at different rates but I don't think too many expect a great die off of the masses because of their inability to compete. The cypherpunks relevance is that some members of this list want to use cypherpunk tools to protect their differential income from *greedy* governments who want to get their bloody hands on it. DCF "And Hillary said, 'Bill Gates is greedy because he has amassed a fortune of US$15,000,000,000 but the US Government is a helpful Village because it takes US$1,400,000,000,000 from us each year and does good things with it.'"

1 0

[NOISE]cypherpunks meeting
by Alan Olsen 17 Dec '03

17 Dec '03

This is one of the strangest pieces of mail I have recieved in a while. I know it is not nice to publish private mail, but this has got to be the most clueless response i have gotten yet on the portland Cypherpunks meeting. Either this guy has lost total connection to his clue-server or he left his terminal logged in... Either way it is pretty funny. (At least he did not make any references to the "tentacles" of Tim May... ]:> ) >Date: Tue, 16 Jan 1996 07:39:55 -0500 (EST) >From: paul <phoffman(a)oven.ccds.charlotte.nc.us> >X-Sender: phoffman@oven >To: alano(a)teleport.com >Subject: cypherpunks meeting > >I THINK THAT ALL CYPHER PUNKS ARE S BUNCH OF FAGGOTS HAVING MEETINGS TO >SEE WHO THEY "WANT" ALL OF YOU CAN SEND YOUR GAY MESSAGES WITH KEYS >SOMEWHER ELSE YOU DAMN FAGGOTS! > >paul > >*************************************************** >*copyright 1995 phoffman(a)oven.ccds.charlotte.nc.us* >* 1996 foffman(a)aol.com * >*************************************************** > > Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0