- cypherpunks-legacy - lists.cpunks.org

Re: A funny story [noise]
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

>... someone had left thier keys in the door lock. > So being the good cypherpunk that I am I jumped out and grabbed the >keys from the lock, then knocked on the window. The passenger rolled >down the window and accepted the keys back. Much to my surprise the >passenger was none other than Whitfield Diffie. Let me get this straight. You performed a key exchange with Whitfield Diffie? His keys were publicly available, and you securely transferred them back again? What a concept! Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0

Re: NT's C2 rating
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:21 AM 3/21/96 -0800, David Loysen <dwl(a)hnc.com> wrote: >>The fine print says its insecure as soon as its connected to a network. >Ain't nothing fine about that print. An operating system or piece of >hardware may be C2 certifiable. But only a complete system in a specific >configuration can be certified as C2 compliant. The way I read the orange >book, no system with a network connection can ever be C2. A system with a network connection _can_ be C2 or higher rated - *if* it can adequately verify that it knows who its users are. That's hard, but it's doable, if it restricts access to a limited set of users, and has enforcement mechanisms to support it. For instance, connection over an encrypted, crypto-authenticated LAN which can enforce session ownership or trustably label all data packets could work; you'd typically do that with some kind of wrapper over IP or TCP and a bullet-proofed OS interface. It's far cleaner if you can do networking in user space rather than the kernel; I think the UUCP-equipped configurations for AT&T's B1-rated System V/MLS were part of the rated configuration, though it's been a while since I've been near that world. It's also easier if you limit each system (or at least level) to one local user per machine so machine ID tells you user ID. Compartmentd Mode Workstations were just coming out when I last did that stuff, so I don't know quite how much of the Red Book they implement, but they had goals of supporting networked above-B1 computing. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

Re: Dorothy Denning attacks Leahy's crypto bill
by Bill Stewart 17 Dec '03

17 Dec '03

Hey, wait, are Jim Bell and I supposed to be in fairly complete agreement on something? :-) At 12:09 AM 3/20/96 -0800, jim bell <jimbell(a)pacifier.com> wrote: >At 09:45 PM 3/19/96 -0800, Declan McCullagh wrote: ... >>From: denning(a)cs.cosc.georgetown.edu (Dorothy Denning) >"Far easier"? That's an odd statement, because the export of encryption is >easy with or without restrictive laws. How much trouble is a "criminal or >terrorist" going to risk by violating a few measly export laws? It probably would make it much easier for Designated Scary People to use crypto without having to take special precautions. If IPv6 security was part of the standard Microsoft Win2000 networking stack (ok, without major botches, and with a convenient user interface :-), and PGPphone came on the Soundblaster N+1 installation disk, all those tax-evaders and pharmaceutical wholesalers and, and, and father-rapers could talk to their accountants in private and chat with each other about tax-evadin' and father-rapin' and _crime_, and it'd be much harder to Federalize their money and arrest their clients. And a lot of that probably won't happen if Microsoft and Soundblaster have to make domestic and international versions of their software. >>I am concerned that the proposed legislation responds only to a loud >>cry for assistance and is not the reasoned and practiced position of >>our multinational corporations. Well, certainly not the position of MNCs who are big players in the military-industrial complex. But what's this _our_ terminology? In particular, cryptography offers the only technical defense against the ability of computers to centralize and correlate information from many sources, which is one of the primary threats to personal privacy today, and MNCs are generally supportive of centralizing any information they can. >> At the International Cryptography >>Institute, which I chaired in September 1994 and 1995, our discussions >>did not find that this unrestricted distribution of encryption >>technology was required to satisfy business objectives. Well, I'd expect not. It wasn't exactly an unbiased crowd; there were a couple people there on Our Side, but it was largely people who agreed with Dr. Denning on the political objectives, and the business contingent included companies like TIS which _sell_ so-called escrow software. > >Notice that we've already established that this bill in no way produces an >"unrestriction distribution of encryption technology." Wish it did, but it >doesn't. Yeah. >>The Commerce/NSA study did acknowledge that the existence of foreign >>products claiming strong encryption could have a negative effect on >>U.S. competitiveness. However, by allowing encryption services to be >>sold separately from the applications software that uses them, CAPIs >>will make it extremely unlikely that general-purpose software will be >>substantially effected by export controls. Which side is Dr. Denning _on_ here? At present, software using CAPIs is not exportable under the ITAR, since the CAPI is a "component of a munitions system"; is she now advocating legalized export of software using government-approved CAPIs only? >Notice that she seems to be making policy for the government, yet again. She seems to have been the big public advocate of it for years.... >>Export controls are often blamed for the lack of security in our public >>infrastructure. Sure - the fact that Microsoft Office built-in file protection isn't even up to RC4/40 standards isn't primarily the fault of export controls, but the lack of a clearly defined official export standard doesn't _help_ them make a business case for including good encryption. >>Encryption policy is a difficult and often emotional issue. > >It's only emotional because of malicious and counter-productive efforts by >government, and government suck-ups like Denning. She certainly hasn't helped, and she's aided and abetted and provided assistance to the folks like Freeh who want to stop free speech and privacy, but it's also emotional because many of us really don't want our privacy compromised and our freedom of speech restricted. The Bill of Rights isn't perfect, but it's far better than what the government is using today, and it's got provisions like the 9th and 10th amendments to remind readers that it's just a set of examples of civil rights, not an exhaustive inventory. >>I will be pleased to meet with you and the committee for comment and >>questioning, or to assist in any way I can with the development of a >>balanced approach to encryption legislation. I've always enjoyed discussing issues with people who offer an outrageously extreme set of proposals, then back off to a still offensive level and call it "balanced". The status quo already gives too much effective power to the government, and she's proposing to give in where it the alternatives are unenforceable and strenghten her position where there's new power to be seized. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

Re: NT's C2 rating
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:30 PM 3/21/96 -0800, David Loysen <dwl(a)hnc.com> wrote: >I don't see any reason a C2 or B2 system can't be networked to another >system(s) with the same classification. But that isn't really what I meant. >Can you make a firewall system that is C2 compliant? Isn't this what you >would need in order to connect a C2 system or network to another non secure >network, (i.e. the internet)? Leaving out Red Book details (since back when I last read the Red Book, nobody really had any general solutions to the problems), the problem is that the Orange Book demands that for C-level and above, the operating system must know the identity of all the users so it can track file, process, and authentication accesses, and for B1 and up, it also needs to know what users are allowed to use what security levels and what levels they're actually operating at. 1) It's difficult to do that - you have to trust the messages coming over a wire from the other machine to tell you who they're from, unless you can be sure there's only one user per wire. That means you need a mechanism for trusting the other machine, a mechanism for communicating that trust, a shared or mappable mechanism for identifying users, etc. That takes a certain amount of work even when you control all the machines that your machine can talk to, which you often can't (e.g. on an outer firewall.) 2) To _certify_ a system for general use (as opposed to certifying a specific instantiation of a system), you need to be sure that it will be installed and maintained in a way that will provide that identification and assurance. That's even harder, because you either need cryptographic authentication and session control, or else you need a way to guarantee that the system you're certifying only talk to machines that are administered in coordination with it, in spite of being installed by some Army grunt or military contractor who may RTFM but isn't a security wizard. And in the C2-certification biz, "cryptographic" means "something you got from the NSA", because they're the ones who do military crypto, and they tend not to trust software. Fortezza cards may do this stuff ok.... 3) The networking code becomes part of the Trusted Comptuting Base, which means you have to be able to verify that it can't mess with anything that you don't want it messing with, and if it supports more than one simultaneous user, it's got to be able to keep track of sessions and communicate them reliably to the OS and TCB. That works relatively well for serial-port user logins and maybe uucp. TCP/IP, on the other hand, is typically implemented down in the guts of the OS, partly because IP needs to talk to hardware a lot, partly because it's often easier to do the TCP and IP together, partly for "speed", and partly because it's much more efficient to hand stuff to multiple users from kernel space than to hand it up to a user-space application which then IPCs things back through the kernel to their destination user processes. It also tends to have various pieces running as root, either to access hardware or protected parts of the software, or to make it easier to transfer ownership of information to processes owned by different users. (Yes, this is a Unix-centric view, but other systems tend to do similar stuff.) This makes it difficult to verify that it's clean (hey, parts of it are tough enough to get working really well, much less bug-free), and it's even tougher at higher levels like B2 that want Least Privilege rather than having a SuperUser root that can do everything. Root stuff is just basically dangerous anyway. And B1-level OSs often run the TCB (including root) at System Low to make sure no regular user can mess with it, which makes it hard for root-owned processes to write up to users. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

BOAF Sat April 6, Melbourne
by Julian Assange 17 Dec '03

17 Dec '03

____ _ _ _ / ___| _ _| |__ _ _ _ __| |__ (_) __ _ \___ \| | | | '_ \| | | | '__| '_ \| |/ _` | ___) | |_| | |_) | |_| | | | |_) | | (_| | |____/ \__,_|_.__/ \__,_|_| |_.__/|_|\__,_| ------------------------------------------------------------------------------- Birds of a feather ____ _ _ | _ \ __ _ _ __| |_ _ _| | | |_) / _` | '__| __| | | | | | __/ (_| | | | |_| |_| |_| |_| \__,_|_| \__|\__, (_) |___/ Saturday April 6, 1996 (easter weekend) 8:30pm till day light boaf(a)suburbia.net Melbourne Australia (http://www.lonelyplanet.com/dest/aust/melb.htm) Q: who's invited? A: you Q: who will be there? A: a cross-social strata of individuals, occupations and ages. It will be an eclectic evening. Q: no, I mean who will *really* be there? A: now is not the time for potentially dichotomatic simplifications of character, but what the heck... (a) Suburbia users: From magistrates and politicians to convicted computer hackers. We have as users private investigators, writers, programmers, QC's, record producers, musicians, film directors, journalists, policemen, intelligence agents, chess champions, members of obscure religious sects, netball umpires, many, many types of scientists and engineers, security experts, doctors, accountants, bartenders, choral conductors, comedians, nurses, DJ's, military police, drivers license testing officers, farmers, haematologists, herbalists, unionists, lecturers, librarians, linguists, paramedics, basketball umpires, air force pilots, singers, surgeons, system operators, linesmen, TV service men, solicitors, taxi drivers, teachers, unemployed inventors, veterinarians, actresses, aerobics instructors, art directors, athletes, chefs, bank clerks, cleaners, prison officers, dentists, dishwashers, film marketers, housewives, locksmiths, pensioners, radiologists and waiters (to name a few) (b) members of the following Suburbia run mailing lists: Avenue St. Etienne (a musical group) fans. BoS (best-of-security digest) Paranoid system admins, computer hackers, security professionals and a whole bunch of spooks Inside-Source (inside-source) As above, but don't introduce these guys to your sister. LACC (Legal Aspects of Computer Crime) Lawyers, security professionals, police, hackers, certifyably paranoid system admins and political activists (c) Memebers of the: Powerline Action Group Alternative Technology Association Center for Comtempory Photography Ross House Association Australian Public Access Network Association Private Inquiry Agents Association (d) Selected people and organisations that we owe favors to, and who shall remain anonymous. (e) Fans of T. Capody, P.K Dick, Stanislaw Lem, Pushkin, Nabakov, Dostoevesky or Thomas Pynchon. Venue: A computationally secure address in North Melbourne, approximately 10 minutes drive from the city center and 5 minutes walk from the North Melbourne railway station. There will be around 15 Internet ISDN connected PC's and a pro-tem dedicated link to Suburbia. Though, we encourage you to forget all about life as a keyboard interface for the night. Main course meals will be available for around $10 a head. Drinks will be served till 1am. Email boaf(a)suburbia.net for the ADDRESS and DIRECTIONS on how to get to it. You will need to include the number of people you plan bringing and how many of those (including yourself) desire to digest something other than the fascinating conversation. Do not request the address unless you definitely plan on coming, or our calculations and your reputation will go down like a V1. There is NO door fee, but small donations of dollars and/or computer/radio/microwave hardware/cables are encouraged (or you might get a few funny looks) to help cover costs. Music: BYO and we will play it provided it is something people can background if they want to talk. Most techno, hard-rock and pop will end up as a North Melbourne UFO sighting before it gets anywhere near the audio equipment. R&B, Jazz fusion, and Syd Barret (early Pink Floyd) style/derived material will be looked upon a good deal more favorably, but some of us are open minded. Dress: Anything that doesn't get you an indecent exposure charge will get you in the door. 1930's incognito is just fine. ps. the undercover colour of the day is purple.

1 0

LET'S ROCK!!!!
by weinberg＠accessus.net 17 Dec '03

17 Dec '03

Ok, here is the situation. I have a person mad at me in one of my mailing lists. Turns out, this person was the owner of the mailing list! Well now I'm stuck, knocked out of the list. The owner can not see any of my mail, no matter how hard I try. I need some ideas to eather get through to her, or really fuck up the mailing list. Any ideas? WThinker P.S. please E-Mail directly to me. If you can. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ WThinker Social Deviant, W.W., and CHIPs expert! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

protection on IoMega ZIP drives
by Joseph L. Moll 17 Dec '03

17 Dec '03

This is in regard to the now popular ZIP disks, the removable 100MB cartridge for PC's/MAC's. Anyone have any idea how secure the ZIP disk is once it is "protected?" I know that the disk will refuse to be mounted without the passkey, but what is really happening here? Best Regards, --- Joseph (Joe) L. Moll mailto:jmoll@acquion.com Network/Communications Engineering http://www.acquion.com phone:864-281-4108 fax:864-281-4576 Acquion, Inc. Greenville, SC USA -- Specialists in Electronic Commerce

5 4

Re: protection on IoMega ZIP drives
by Deranged Mutant 17 Dec '03

17 Dec '03

On 23 Mar 96 at 3:00, Ed Carp wrote: > Has anyone tried SFS? It should work on the zip drive, though I've not > tried it (yet)... If I recall some recent threads on alt.security.pgp (or sci.crypt?), SFS doesn't work on ZIP drives (since ZIPs use the parallel port...). [Or do ZIPs use Scuzzies and the people who had problems were just too lame to figure out that they had to load the driver before SFS?] Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

2 1

Re: A funny story [noise]
by David E. Smith 17 Dec '03

17 Dec '03

At 08:52 PM 3/21/96 PST, hoz@univel wrote: >>... someone had left thier keys in the door lock. >> So being the good cypherpunk that I am I jumped out and grabbed the >>keys from the lock, then knocked on the window. The passenger rolled >>down the window and accepted the keys back. Much to my surprise the >>passenger was none other than Whitfield Diffie. > >Let me get this straight. You performed a key exchange with >Whitfield Diffie? His keys were publicly available, and you >securely transferred them back again? What a concept! Weren't those his _private_ keys, though? You probably shouldn't be able to transfer those in a secure system. ObCrypto: would the transfer of private keys be necessarily a good thing? Or would a transfer of "reputation" be a better idea? Example: suppose, and this is _very_ hypothetical, that the President of the U.S. has a PGP key. (We can dream, eh?) Would it be wiser to transfer that key from one President to the next, or have the President sign the President-elect's new key? (I'm stretching here - feel free to killfile me.) dave --- David Smith, Intellecutal Terrorist http://www.midwest.net/scribers/dsmith/

1 0

Mac Keystroke Capture
by kkirksey＠appstate.campus.mci.net 17 Dec '03

17 Dec '03

I've always warned my network users and other clients against using software that "protects" you from data loss by capturing your keystrokes, e.g. NowSave, Last Resort, and Thunder 7's Ghostwriter feature. NowSave 6.0 adds a new wrinkle to the problem, as I discovered yesterday when I installed the Now Utilities 6.0 public beta. NowSave 6.0 has a new feature: when you re-start your machine after a system crash, NowSave automatically opens at startup a SimpleText file containing all the keystrokes it captured before the crash. My machine crashed yesterday during an internet session, and when it re-started I was greeted with a SimpleText window containing my internet account password, two CryptDisk passphrases, and my PGP passphrase. This is not a good thing. But it could be a good thing, IMHO. Most people install these programs without realizing exactly what they do. With this new version of Now Utilities, users are likely to be greeted with a screenful of information, as I was, that they would just as soon not have saved anywhere on their hard drive. This kind of incident would, hopefully, encourage them not to use key capture software. One can only hope... Ken = Ken Kirksey | If Pat Buchanan is elected President of the = = Mac Developer & | United States, at least the trains will run = = Resident Cypherpunk | run on time. = = kkirksey(a)appstate.campus.mci.net - Me =

1 0