- cypherpunks-legacy - lists.cpunks.org

Re: Trigger-Words...
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

harka(a)nycmetro.com wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > Hi there, > > does anybody know any contact points/Web pages, where I might get > some information on e-mail filtering via trigger-words? I am > interested in how this technology specifically works and a > collection of trigger-words would be nice too :) Look at http://www.algebra.com/~ichudov/usenet/scrm/robomod/robomod.html, and look for the explanation of how bad.words.list works in my robomoderator. - Igor.

1 0

Re: Trigger-Words...
by Martin Janzen 17 Dec '03

17 Dec '03

harka(a)nycmetro.com writes: >does anybody know any contact points/Web pages, where I might get >some information on e-mail filtering via trigger-words? I am >interested in how this technology specifically works and a >acollection of trigger-words would be nice too :) You might start with the Mail Filtering FAQ: http://www.cis.ohio-state.edu/hypertext/faq/usenet/mail/filtering-faq/faq.h… It's pretty Unix-specific, covering procmail, Elm filter, and mailagent. For PC-based mailers, you're probably better off checking the documentation and/or the web page for the one you're using. Finally, take a look at the comp.mail.* newsgroups. Or just use the search engines, throwing in combinations of the above terms... -- Martin Janzen janzen(a)idacom.hp.com Pegasus Systems Group c/o Hewlett-Packard Company, CMD Vancouver

1 0

Re: Best Computer School?
by Matthew Toth 17 Dec '03

17 Dec '03

MIT is one the best schools in the country for C.S. Close behind is Carnegie Mellon University (C.M.U.) in Pittsburgh, PA. (the folks who put out CERT.) Not sure how much Crypto they do, though.

1 0

Recovery of Windows NT administrator password
by Garrard, David 17 Dec '03

17 Dec '03

An inherited Windows NT system that I am involved with has a lost administrator password ( no one no longer knows what it is ). Can anyone point me to software products/companies that can help in the recovery. Given Microsoft's dismal record on security I am sure there must be solutions to this dilemma. Any help would be greatly appreciated. Best Regards David L. Garrard

1 0

AltaVista sprouts a hole ...
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Russell Stuart <R.Stuart(a)rsm.com.au> MIME-Version: 1.0 Precedence: Bulk Date: Wed, 29 Jan 1997 08:07:27 +1000 From: Russell Stuart <R.Stuart(a)rsm.com.au> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: AltaVista sprouts a hole ... From: risko(a)csl.sri.com (RISKS List Owner) Newsgroups: comp.risks Subject: RISKS DIGEST 18.77 Message-ID: <CMM.0.90.1.853810937.risko(a)chiron.csl.sri.com> RISKS-LIST: Risks-Forum Digest Monday 20 January 1997 Volume 18 : Issue 77 FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator ***** See last item for further information, disclaimers, caveats, etc. ***** <snip> ------------------------------ Date: Fri, 3 Jan 97 23:52:00 +0100 From: Anders Andersson <andersa(a)Mizar.DoCS.UU.SE> Subject: Leaking WWW surfer interest profiles I notice that AltaVista's inline advertisements link to a server outside Digital, "ad.doubleclick.net", and that the URL includes the user's list of keywords being searched. I'm concerned that these URL's may occasionally leak information about the user's interests and inclinations to third parties, information which the user may prefer to keep private. This is not a new problem that appeared with the inline ads, since also the Referer: field of the HTTP protocol discloses to a target server exactly what AltaVista index page led the user to it. However, this requires that the user willfully follows that link. If sensitive information being leaked via the Referer: field is a problem, the user may obtain client software that withholds Referer: data, either conditionally or unconditionally. Also, a user who has asked AltaVista for "gay" pages is probably not too concerned about accidentally disclosing this fact to the maintainer of said "gay" pages. However, the doubleclick.net ads appear to bear no relationship to the keywords being searched, and they appear not only in the URL for the hyperlink to follow, but also in the IMG SRC URL. This means that in order to avoid disclosing my keyword lists to doubleclick.net, I have to disable automatic loading of inline images when using AltaVista! Why is it that when I perform a search for, say, "gay OR nazi AND scientology", AltaVista tricks my browser to give this very search string away to an advertising company by means of an inline image (the contents of which has nothing to do with my search)? I think I can trust the AltaVista maintainers not to save my keyword lists for future analysis, but what about an advertising company? It's kind of serendipity reversed. When you open a book to look up information on a specific subject, the book scans your mind to find out what other interests and hobbies you have. Anders Andersson, Dept. of Computer Systems, Uppsala University Box 325, S-751 05 UPPSALA, Sweden +46 18 183170 andersa(a)DoCS.UU.SE ------------------------------ <snip> Regards Russell Stuart Software Development Manager RSM Technology PTY LTD ---------------------- Phone: +61 7 3844 9631 Fax: +61 7 3844 9522 Email: R.Stuart(a)rsm.com.au --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/ "If *you* don't go to FC97, *I* don't go to FC97"

3 2

Crypto verification needed for Pretty Safe Mail
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

There have been questions raised on the newsgroups regarding Pretty Safe Mail, arguably the best implementation of a PGP product for the Macintosh. In response, the product manager at Highware has requested that a trusted third party verify the security of Pretty Safe Mail. However, a NON-U.S. cryptologer is needed. I'm including the post below. Please forward to any people you know who may qualify. Pretty Safe Mail is a GREAT product. If it can be shown to be safe and effective, it will do wonders to spread the use of strong crypto. ===== From: axel(a)highware.com (Axel de Landtsheer) Newsgroups: comp.security.pgp.discuss Subject: Re: Concerned about Pretty Safe Mail for Mac > I'm concerned about the product "Pretty Safe Mail" for the Macintosh, >by a company called Highware. I was wondering whether anyone here had >tried evaluating it at all. > > It is a complete PGP implementation (not a front-end). They claim >to have licensed some of PRZ's code from PGP. However, as far as I >can tell, they are not making any of the source code available. The source code for PSM is indeed not available. We are however eager to have the code checked by any trusted source. These sources cannot be US companies because of the new US regulations which state that US companies must not give such support to overseas companies. Us being a Belgian company, this makes things a little more difficult. Does anybody have a suggestion for such a trusted source outside the US? > As someone on the comp.security.pgp newsgroups pointed out, writing >a wonderful user interface on a PGP trojan horse that either crippled >the session key generator or used the session key to leak random >portions of secret key primes would be a perfect tactic for a >government wishing to penetrate PGP security. With such a great >interface, compared to the original PGP, it can't help but become >widely used. PSM is not a Trojan Horse. Does any trusted source want to check that? > I realize that without the source code, it's a major hassle, but >has anyone looked at Pretty Safe Mail (previously called Safemail) >at all for suspicious behavior? For example: > > 1) non-random session key generation? > 2) non-random key pair generation? > 3) unnecessary disk access to secret keys? > 4) anything else? Many people are worried about the random-key generation because they do not need to bang away on the keyboard for five minutes when they create a key pair. Apparently, this seems to loosen their nerves (I heard some people created about 10 key pairs a day - just a joke). In short, we use all events that happen on the Mac (clicks, typing, opening of windows, display of icons, ...) together with the time they happen, and encrypt these to fill a table which is the starting point for the random-number generator. Why make people type away on the keyboard if you have enough random events to start from? Again, we want to have this checked by a trusted source asap... ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Axel de Landtsheer | Highware, Inc. | 109 av. H. Jaspar, 1060 Brussels, Belgium Product Manager | voice: +32 2 537-6810 fax: +32 2 537-5155 axel(a)highware.com | http://www.highware.com, ftp://ftp.highware.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To obtain my PGP key, send me a message with subject "Send PGP key"

1 0

Re: can Sun Tzu be a cypherpunks?
by Toto 17 Dec '03

17 Dec '03

nobody(a)nowhere.com wrote: > Question: Can cypherpunks use these methods to defeat those > who would take our freedom? WARNING! "The Xenix Chainsaw Massacre" Is A Very Dangerous Document ------------------------------------------------------------------- It is reputed among many of the top minds in the Computer Industry to be a very real, and revealing, documentary of some of the horrors of the Industry which are sometimes rumored, but seldom exposed. But be warned-they say it in private, not in public. Though management at the major Corporations in the Industry brush aside the document as the mad ramblings of an unstable, failed business executive, the fact remains that there are more and more people coming forward who claim to have suffered demotions or loss of employment after deliberately or inadvertently revealing their support of the document's claims and it's authenticity. If you choose to read this manuscript, do not speak of it in casual conversation at your place of employment, or around strangers in any business or social environment. Though it is almost impossible to document cases of reprisal of this nature, the increasing numbers of ex-employees of major Corporations in the Computer Industry making these claims, and the devastating consequences they allege to their professional and private lives, make it wise to be discreet in expressing any opinion, or even knowledge, of this document. If you choose to share this document with others, it would be wise to do so discreetly, even anonymously, should you be unsure of the reliability and discretion of whomever you choose to share this knowledge with. Though I personally lean toward viewing the manuscript as authentic, my exhaustive research into it's origin has always come to a dead-end, even among the principals involved. C.J. Parker, former President of Pearl Harbor Computers, Inc., denied emphatically, in a face-to-face encounter with anything whatsoever to do with the document. When I pressed him with questions regarding the hasty demise of his business and the unraveling of his personal life after the public circulation of "The Xenix Chainsaw Massacre" began, he became very agitated and distraught, bordering on violence, and the interview was abruptly terminated. Dr. William M. Denney, one of the few principals in the manuscript referred to directly, was reluctant to be interviewed, but eventually made a few comments which I found to be very revealing. Dr. Denney, Vice-President of Basis, Inc. in Emmeryville, Ca., consistently rated as one of the top ten Unix Open Systems vendors in the world, said, "I deny any knowledge of or participation, in any way whatsoever, with anything connected to 'The Xenix Chainsaw Massacre', and it would be wise for others to do the same." I find this statement to be very cryptic and, at the same time, very revealing; very much in line with what would expect from one associated with the alleged underground computer society described in the manuscript. As for Mr. Torry Basford, a former employee of Bell Labs who was Mr. Parker's first mentor in the world of Unix and is rumored to be laboring in obscurity in a small community college somewhere in the southwestern U.S., Mr. Parker would only say, "The man has suffered enough, please leave him alone." Regardless of the origins or authenticity of the document, it is considered by many to be extremely unsettling, perhaps even dangerous, and one might be better served to avoid reading the manuscript, if for no other reason than simple peace of mind. ___________________________________ If you would like a copy of the manuscript, send me a private email indicating a desire to receive it. Toto

1 0

Physical meet, Sat. Feb. 15 - not 18. (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From owner-austin-cpunks(a)ssz.com Tue Jan 28 20:10:19 1997 From: Jim Choate <ravage(a)einstein.ssz.com> Message-Id: <199701290209.UAA06585@einstein> Subject: Physical meet, Sat. Feb. 15 - not 18. To: austin-cpunks(a)einstein.ssz.com (Austin Cypherpunks) Date: Tue, 28 Jan 1997 20:09:55 -0600 (CST) X-Mailer: ELM [version 2.4 PL23] Content-Type: text Content-Length: 784 Sender: owner-austin-cpunks(a)einstein.ssz.com Precedence: bulk Reply-To: austin-cpunks(a)einstein.ssz.com Hi all, I apparently didn't pay much attention to what month I was looking at when I made the initial meeting. Turns out the 18th is a Tuesday obviously a day that few of us can make. As a result I looked at the 'real' Feb. calendar and the meeting date is as follows: Saturday, Feb. 15, 1997 6pm. HEB Central Market Restaurant Look for the red 2nd. ed. Applied Cryptography book For more info email 'austin-cpunks(a)ssz.com' Also invited to this meet are members of the mailing lists: Experimental Science Instrumentation Advanced Computer Experimentation Sorry for the confusion. Jim Choate CyberTects ravage(a)ssz.com

2 2

Last nail for US crypto export policy?
by Ian Goldberg 17 Dec '03

17 Dec '03

EXPORTABLE CRYPTOGRAPHY TOTALLY INSECURE: CHALLENGE CIPHER BROKEN IMMEDIATELY January 28, 1997 - Ian Goldberg, a UC Berkeley graduate student, announced today that he had successfully cracked RSA Data Security Inc.'s 40-bit challenge cipher in just under 3.5 hours. RSA challenged scientists to break their encryption technology, offering a $1000 award for breaking the weakest version of the code. Their offering was designed to stimulate research and practical experience with the security of today's codes. The number of bits in a cipher is an indication of the maximum level of security the cipher can provide. Each additional bit doubles the potential security level of the cipher. A recent panel of experts recommended using 90-bit ciphers, and 128-bit ciphers are commonly used throughout the world, but US government regulations restrict exportable US products to a mere 40 bits. Goldberg's announcement, which came just three and a half hours after RSA started their contest, provides very strong evidence that 40-bit ciphers are totally unsuitable for practical security. "This is the final proof of what we've known for years: 40-bit encryption technology is obsolete," Goldberg said. The US export restrictions have limited the deployment of technology that could greatly strengthen security on the Internet, often affecting both foreign and domestic users. "We know how to build strong encryption; the government just won't let us deploy it. We need strong encryption to uphold privacy, maintain security, and support commerce on the Internet -- these export restrictions on cryptography must be lifted," Goldberg explained. Fittingly, when Goldberg finally unscrambled the challenge message, it read: "This is why you should use a longer key." Goldberg used UC Berkeley's Network of Workstations (known as the NOW) to harness the computational resources of about 250 idle machines. This allowed him to test 100 billion possible "keys" per hour -- analogous to safecracking by trying every possible combination at high speed. This amount of computing power is available with little overhead cost to students and employees at many large educational institutions and corporations. Goldberg is a founding member of the ISAAC computer security research group at UC Berkeley. In the Fall of 1995, the ISAAC group made headlines by revealing a major security flaw in Netscape's web browser.

1 0

Crypto verification needed for Pretty Safe Mail
by Anonymous 17 Dec '03

17 Dec '03

There have been questions raised on the newsgroups regarding Pretty Safe Mail, arguably the best implementation of a PGP product for the Macintosh. In response, the product manager at Highware has requested that a trusted third party verify the security of Pretty Safe Mail. However, a NON-U.S. cryptologer is needed. I'm including the post below. Please forward to any people you know who may qualify. Pretty Safe Mail is a GREAT product. If it can be shown to be safe and effective, it will do wonders to spread the use of strong crypto. ===== From: axel(a)highware.com (Axel de Landtsheer) Newsgroups: comp.security.pgp.discuss Subject: Re: Concerned about Pretty Safe Mail for Mac > I'm concerned about the product "Pretty Safe Mail" for the Macintosh, >by a company called Highware. I was wondering whether anyone here had >tried evaluating it at all. > > It is a complete PGP implementation (not a front-end). They claim >to have licensed some of PRZ's code from PGP. However, as far as I >can tell, they are not making any of the source code available. The source code for PSM is indeed not available. We are however eager to have the code checked by any trusted source. These sources cannot be US companies because of the new US regulations which state that US companies must not give such support to overseas companies. Us being a Belgian company, this makes things a little more difficult. Does anybody have a suggestion for such a trusted source outside the US? > As someone on the comp.security.pgp newsgroups pointed out, writing >a wonderful user interface on a PGP trojan horse that either crippled >the session key generator or used the session key to leak random >portions of secret key primes would be a perfect tactic for a >government wishing to penetrate PGP security. With such a great >interface, compared to the original PGP, it can't help but become >widely used. PSM is not a Trojan Horse. Does any trusted source want to check that? > I realize that without the source code, it's a major hassle, but >has anyone looked at Pretty Safe Mail (previously called Safemail) >at all for suspicious behavior? For example: > > 1) non-random session key generation? > 2) non-random key pair generation? > 3) unnecessary disk access to secret keys? > 4) anything else? Many people are worried about the random-key generation because they do not need to bang away on the keyboard for five minutes when they create a key pair. Apparently, this seems to loosen their nerves (I heard some people created about 10 key pairs a day - just a joke). In short, we use all events that happen on the Mac (clicks, typing, opening of windows, display of icons, ...) together with the time they happen, and encrypt these to fill a table which is the starting point for the random-number generator. Why make people type away on the keyboard if you have enough random events to start from? Again, we want to have this checked by a trusted source asap... ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Axel de Landtsheer | Highware, Inc. | 109 av. H. Jaspar, 1060 Brussels, Belgium Product Manager | voice: +32 2 537-6810 fax: +32 2 537-5155 axel(a)highware.com | http://www.highware.com, ftp://ftp.highware.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To obtain my PGP key, send me a message with subject "Send PGP key"

1 0