- cypherpunks-legacy - lists.cpunks.org

Re: "Microsoft.com" added to my KILL file
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

Tim and Lucky were talking.... >>embedded spreadsheets and embedded graphics. And as for attachments, such >>as attaching programs for running on a machine, mailing list messages are a >>very poor way to distribute such programs, for many reasons. To say nothing of the risk of some nasty Word virus or other malicious executable. _______________________ Regards, Truth can never be told so as to be understood, and not be believed. -William Blake Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu 0C 69 D4 E8 F2 70 24 33 B4 5E 5E EC 35 E6 FB 88

1 0

Re: LD was Re: [NOISE] was Re: a hole in PGP
by Nathan Zook 17 Dec '03

17 Dec '03

On Wed, 2 Aug 1995, Kragen J Sittler wrote: > On Mon, 31 Jul 1995, SysAdmin wrote: > > > ObCypherpunk: Anybody heard from Detweiller? > > Yes, I saw a posting from him (ldetweil@somewhere) on Usenet; I replied > and said it was good to see him back. He answered politely; perhaps he > doesn't recognize me, as his last (previous) words to me were 'just shut > up, you writhing tentacle'. Perhaps he's not so upset about things > anymore; I don't know. > > Peace, > Kragen > Kragen! I haven't heard much from you since someone thought Kragen <-> Kracken ==> monster ---> tentacle! (And you were being pretty rational at the time--for this list.) Doing well, I hope. Nathan P.S.: It's good to see this thread moving to the S side of the SNR

2 1

Re: There's a hole in your crypto...
by Peter Trei 17 Dec '03

17 Dec '03

> Nathan Zook writes: > > > And is there any way to build trusted system out of small, verifiable > > > pieces? Since the way they're connected could also be questioned, I > > > suspect that when you put enough of them together it's just as bad as > > > the case of a single, monolithic program. But this isn't my area, so > > > I don't know. > > No. This was essentially proved during the first third of this century. > Well, I haven't gotten a reply from Nathan Zook on this assertion, so > can anyone else back it up with some references? Perhaps we're > discussing different contexts, but proving correct systems composed of > correct components is still a subject of active research. > nathan I suspect that he's referring to Godels' Theorem, which shows that in any complete logic system it's possible to make undecidable statements. I'm not at all sure if this can be extended to computer programs. Even if it can, I suspect it only applies to contrived cases. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

1 0

Re: US vs Overseas Banks
by Michael Froomkin 17 Dec '03

17 Dec '03

In message <Pine.3.89.9508012150.E12592-0100000@khijol> "Ed Carp [khijol SysAdmin]" writes: > Why should they give a damn who you are? IMO, it's none of their > business. Hell, they're making $$$ on *your* deposits, it's time they > stopped being such shits about it. It's probably bad for business if your bank gets a reputation as "check-bouncers-R-Us". Knowing your customers may make it less likely they bounce checks; it certainly makes collecting (if you honor the check) much easier. -- Michael Froomkin until Aug 6: michael(a)umlaw.demon.co.uk U.Miami School of Law London, England mfroomki(a)umiami.ir.miami.edu <-- this will still find me PO Box 248087 Coral Gables, FL 33124-8087 "Rain in parts, then dry" --BBC See http://www-swiss.ai.mit.edu/6095/articles/froomkin-metaphor/text.html

1 0

fnords
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

:: Request-Remailing-To: wilcoxb(a)nag.cs.colorado.edu Subject: Why I don't sign all my mail Latent-Time: +0:00 Cutmarks: #-- -----BEGIN PGP SIGNED MESSAGE----- Bryce - you write: > Thanks for the info, Bill. I have a question: why are you > sending e-mail in the clear and without authentication? > I don't expect that anyone would want to forge mail from you > to me, but I would be pleased if I could be a little more > certain of those things, and besides "Think of it as a form of > solidarity." Convenience, mostly. Encryption and signature are semi-different issues. If I clear-sign something, and you don't want to check it, it doesn't cause you any trouble, but for most people, getting mail that's encrypted takes extra work, especially if they're following proper security procedures for their PGP implementations (not running it on insecure systems, not leaving passphrases in cleartext for autosigners, etc.) Think of proper security as "solidarity with people who need real security" :-). (Yeah, I also run PGP on insecure systems, mainly for signature-checking, but I do use separate keys that have words like "insecure" in the userid strings.) The big issues are convenient interfaces with my email system. Private Idaho's gotten good enough that if I want to send encrypted/signed/etc. email, I can grab the mail I want to send into the clipboard (or compose it inside PI), add headers for who to send it to, pull down a couple menu items, and it pops into PGP; when it's done, another menu choice dumps the completed message back into Eudora, and the next version can send it out directly if I prefer. On the other hand, moving mail _from_ Eudora _to_ PI is still a couple actions (separate cut/pastes for the body, address, and Subject:), so I don't usually bother. The other convenience problem is key-handling for people whose keys I don't already have. PGP is too slow on a PC to haul the entire keyserver database into my pubkey files. So either I have to send email to a key-server (non-real time, especially since I do most of my email off-line), or use finger. Unfortunately, your key wasn't on the keyservers, and I don't have a decent PC finger client now that I'm using Trumpet Winsock instead of Netcruiser (the finger client I use doesn't allow cut&paste to the clipboard, screen-grabs didn't get me text, and I did eventually get most of your key information by doing several "telnet you@machine 79"s until one of them got the data before the session closed :-) Ugly... And then there's the key validation problem - your key isn't signed by anyone except yourself (yeah, ok, mine's only got signatures from previous keys of mine, which have signatures from expired keys from the people who signed mine :-) So my signature isn't as meaningful as it could be, since you probably can't validate it, and I can't guarantee having a valid public key for you to send you anything important. So I guess I need to go get my keys signed by a couple people, and so do you, and the next code project on my wait-until-3.0 list should probably be a recursive key-signature digger... Meanwhile, Private Idaho is at ftp.eskimo.com/u/j/joelm/, and it's now working with ViaCrypt-for-Windows as well as PGP 2.6.* for DOS. Thanks; Bill Stewart stewarts(a)ix.netcom.com -----BEGIN PGP SIGNATURE----- Version: 2.7.1 iQBVAwUBMCMPB/thU5e7emAFAQFYPAH7BXuxp0BCWKg8v/Uv6QzUQKSix3Zff3Kw FzBeSgDNN9KrOHEaUmemDXcBmcRabyeZyxrFTcgypvwADai1SYA45w== =Ht4c -----END PGP SIGNATURE----- #-- #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- # Crypto in 3-4 lines of perl --> http://dcs.ex.ac.uk/~aba/

1 0

SuperMac Sentinel: Customer Support tale
by Russell Whitaker 17 Dec '03

17 Dec '03

jfg(a)fuente.engr.sgi.com (John Gibbon) wrote: >I got this from a friend, who got it from a friend, > who got it from a friend ... > > -------------------------------------- >SuperMac records a certain number of technical support calls at >random, to keep tabs on customer satisfaction. By wild "luck", they >managed to catch the following conversation on tape. > >Some poor SuperMac TechSport got a call from some middle level >official from the legitimate government of Trinidad. The fellow spoke >very good English, and fairly calmly described the problem. > >It seemed that was a coup attempt in progress at that moment. However, >the national armoury for that city was kept in the same building as >the Legislature, and it seems that there was a combination lock on the >door to the armoury. Of the people in the capitol city that day, only >the Chief of the Capitol Guard and the Chief Armourer knew the >combination to the lock, and they had already been killed. > >So, this officer of the government of Trinidad continued, the problem >is this. The combination to the lock is stored in a file on the >Macintosh, but the file has been encrypted with the SuperMac product >called Sentinel. Was there any chance, he asked, that there was a >"back door" to the application, so they could get the combination, >open the armoury door, and defend the Capitol Building and the >legitimately elected government of Trinidad against the insurgents? > >All the while he is asking this in a very calm voice, there is the >sound of gunfire in the background. The Technical Support guy put the >person on hold. > >A phone call to the phone company verified that the origin of the call >was in fact Trinidad. Meanwhile, there was this mad scramble to see >if anybody knew of any "back doors" in the Sentinel program. As it >turned out, Sentinel uses DES to encrypt the files, and there was no >known back door. The Tech Support fellow told the customer that aside >from trying to guess the password, there was no way through Sentinel, >and that they'd be better off trying to physically destroy the lock. > >The official was very polite, thanked him for the effort, and hung up. >That night, the legitimate government of Trinidad fell. One of the >BBC reporters mentioned that the casualties seemed heaviest in the >capitol, where for some reason, there seemed to be little return fire >from the government forces. > > > -- Russell Earl Whitaker whitaker(a)sgi.com Webmaster, Silicon Junction Silicon Graphics, Inc. Mountain View, CA =============================================================== http://reality.sgi.com/employees/whitaker

1 0

RE:NRC Panel, Law Enforcement questions
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Hello Jim, I apologize that I didn't answer immediately. I have subscribed to several mailing lists and sometimes get some hundred mails a day. I don't have the time to read everything and therefore I have to select. I didn't read this thread, but I found it in my archives. > I wonder, and perhaps my kind friend Hadmut can help me here, if there is > an English translation of any and all Nazi-era German laws/regs regarding > cryptography. As I [dimly] recall, Enigma was born as a private enterprise > and the patent was only later taken over by government and classified after > it was offered for sale to businesses (without much luck). These laws, if > they exist, might make for interesting reading in side-by-side comparison > with either Sen. Grassley's latest proposals, or with anything regarding > cryptography coming from our paranoid FBI director. I fear I have to disappoint you. :-( First of all I don't know of any english translation of such laws. The only english translation of law I know about is the translation of our current basic law. It might be easier to find english translations in english or american libraries than in german libraries. Second, I don't know whether they had a certain law about cryptography. AFAIK Enigma was a commercial product first and was taken over by the government. But I don't know they way they did. Third, there was no need to have laws. I don't want to restart the discussion, but the Nazis didn't understand laws as so important. I have read a book about their justice some time ago. The 'idea' and the 'public feeling' was seen as more important than laws. But perhaps another telecommunication law may be interesting. It was forbidden to receive foreign radio senders. If they came into the house and the radio was tuned to foreing frequencies, you got into serious trouble. I just don't know where to find the text of the law. regards Hadmut

1 0

Re: Java and Safe-TCL security
by Rich Salz 17 Dec '03

17 Dec '03

>One problem is that safe-tcl >was oriented around email, so it lacks facilities for accessing web >pages. No, it's just that the people who took it over^H^H^H^Hand ran with it were most interested in email. My initial motivation was that I wanted to write a new news server that clients could download programs to. /r$

1 0

JAC_kio
by John Young 17 Dec '03

17 Dec '03

8-6-95. NYPaper Book Review: "Spies Unlike Us: A history of French intelligence reveals a far more brutal approach than this country's." The aftermath of 1945 imposed an additional heavy burden on the French secret services. Political allegiances were exacerbated by the presence of a potential huge Communist fifth column in France. The rough lessons of the war led to a premium on "service action" operations of sabotage and assassination before which Britain's M.I.6 would have quailed. Mr. Porch sees the French secret services of today as still not having recovered from their politicization during World War II. During the gulf war, the humiliating realization was forced on the French Army that for intelligence it was totally dependent on American high technology. SAL_mai "The Code War: How United States intelligence outsmarted Japan in World War II." He rightly sees the role of intelligence in the Pacific war not simply as a story of code-breaking successes. Rather, he writes, "the true achievements of intelligence in the Pacific war lie in the day-to-day accumulation of a fund of knowledge.... Cryptography, traffic analysis, aerial photography, prisoner interrogation, document capture and translation, and technical intelligence ... became pillars of an overall effort greater than the sum of its parts." He explains and describes this winning synergy of intelligence elements as well as, or better than, any previous author. PIL_sal Jak/Ari: JAC_kio

1 0

Two-faced Security Problem? Dammit Janus?
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

Not exactly crypto, but the same idea: I've been trying to hook up an HTTP server sitting on a Mac at the end of my normal PPP connection. This was just supposed to be a test, but I kept getting annoying connection problems whenever someone tried to GET a page from me. The connection wouldn't go through about half of the time. After poking around for a week, I discovered that my home machine, newray.digex.net, is listed in the Digex's nameservers TWICE! Once with the IP address that my home machine is waiting for (199.125.128.5) and once with some other IP address in the digex space (164.109.211.61). If you do an nslookup on the name, you get both addresses. I believe that the technically correct thing for someone to do is to choose one of the addresses at random to distribute the load between two machines pretending to be one. This explains the connection failures that happened half of the time. This has led me to wonder, though, whether this is some sort of security breech. For instance, could there be someone out there mascarading as me? Normally I run Eudora, Netscape, Telnet and other outward bound applications. It was almost a fluke that I noticed that there were two entries. Does some software need to find its IP address in a DNS table? For instance, does Eudora need to look up 164.109.211.61 to find "newray.digex.net"? If someone was using this software on the mascarading node, they would need to set up an entry in the tables to make everything work. They just assumed I would never get inbound traffic. Any theories on this? -Peter "More Paranoid Than Ever" Wayner

1 0