- cypherpunks-legacy@lists.ogf.org

Munged account feeding ol
by M..Stirner＠f28.n125.z1.FIDONET.ORG 23 Aug '93

23 Aug '93

-=> Quoting Uucp to All <=- Uu> From kumr!toad.com!owner-cypherpunks Uu> From: fergp(a)sytex.com (Paul Ferguson) Uu> To: cypherpunks(a)toad.com Uu> Date: Sun, 22 Aug 93 08:01:40 EDT Uu> Am I the only one getting carbon copies of many of my own messages Uu> from someone else's munged account? Uu> Uu> Error: User "dhaise" isn't on lebanon Uu> Uu> ----------returned message---------- I've received one of these too. ... Try to look unimportant because the bad guys may be low on ammo. ___ Blue Wave/QWK v2.12 -- M. Stirner - via FidoNet node 1:125/1 UUCP: ...!uunet!kumr!shelter!28!M..Stirner INTERNET: M..Stirner(a)f28.n125.z1.FIDONET.ORG

1 0

Remailers, pgp and SMTP.
by b44729＠achilles.ctd.anl.gov 23 Aug '93

23 Aug '93

Perhaps this has been discussed before (I am often guilty of Not Paying Attention(tm)), but would security not be improved for the remailers if people used some simple software to connect to the remailer via socket 25 and send the message that way, rather than leaving log files on their host? For remailers run from student account security could be increased by doing the same; preventing log files by using direct SMTP connections? Ex: (1) User composes message. (2) User encrypts to recipient. (3) User encrypts to remailer. (4) User then mails to remailer using a small program to handle the SMTP connection directly. (5) Remailer (perhaps running on a student account) decrypts message with its secret key. (6) Remailer manually (whenever it gets around to it (to guard against traffic analysis)) SMTP's the message to the recipients host. (7) Recipient decrypts message. Of course these security gains could be circumvented by root (on the remailer) in several different ways, but it would take much more work I would think. Hell, it could be that the remailers already do this (I don't have the code) but I doubt if many people send mail to the remailers by connecting to port 25 of the host. -Sam

1 0

indirect remailer
by cdodhner＠indirect.com 23 Aug '93

23 Aug '93

The indirect remailer <cdodhner(a)indirect.com> still has some bugs to work out with the pgp portion of the scripts etc. Therefore the logs and archive files and debug stuff will remain active until I have time to fix it, probably in a day or two. I'll be sure to let you all know when it's as secure as it can be (as secure as anything can be when I don't have root and somebody else does...) Happy Hunting, -Chris.

1 0

Re: Digicash
by plmoses＠unix.cc.emory.edu 23 Aug '93

23 Aug '93

I dont see that a "reverse" ATM card (ie, one that was "charged" with money to spend) poses any greater risk to the bearer, IF some kind of authorization code/check is built into the card. What I am hazy on is how such an authorization could exist while avoiding the problem of creating a dossier. If the individual user could encode his own PIN on the card without telling the bank, that would do it. Or, the bank could know the PIN but if the Retailer's transaction software never *records* the PIN, then there will be no privacy problem...since there will be nothing to cross check against the bank's records. The retailer is happy cos he has HIS data (item sold, amount, date, etc); the consumer is protected, and the bank is not involved at all. Eh?

1 0

Better late than never, eh Stanton?
by plmoses＠unix.cc.emory.edu 23 Aug '93

23 Aug '93

>From hughes(a)toad.com Sun Aug 22 20:07:28 1993 >To: plmoses(a)unix.cc.emory.edu (Paul L. Moses) >Subject: [plmoses(a)unix.cc.emory.edu (Paul L. Moses): forwarding] >Date: Sun, 22 Aug 93 17:07:20 -0700 >From: hughes(a)toad.com > > >------- Forwarded Message > >Return-Path: plmoses(a)unix.cc.emory.edu >Received: from emoryu1.cc.emory.edu ([128.140.1.1]) by toad.com id AA25788; Tue, 17 Aug 93 09:19:15 PDT >Received: by > emoryu1.cc.emory.edu (5.65/Emory_cc.3.4.6) via MAILPROG > id AA17454 ; Tue, 17 Aug 93 12:19:07 -0400 >Return-Path: plmoses(a)unix.cc.emory.edu >Date: Tue, 17 Aug 93 12:19:07 -0400 >From: plmoses(a)unix.cc.emory.edu (Paul L. Moses) >Message-Id: <9308171619.AA17454(a)emoryu1.cc.emory.edu> >To: owner-cypherpunks(a)toad.com >Subject: forwarding > >>From anton(a)hydra.unm.edu Sun Aug 15 03:21:35 1993 >From: Stanton McCandlish <anton(a)hydra.unm.edu> >Subject: Re: On The Inherent Evil of Electronic Democracy >To: plmoses(a)unix.cc.emory.edu (Paul L. Moses) >Date: Sun, 15 Aug 1993 01:21:25 -0600 (MDT) >In-Reply-To: <9308121908.AA06721(a)emoryu1.cc.emory.edu> from "Paul L. Moses" at Aug 12, 93 03:08:00 pm >X-Mailer: ELM [version 2.4 PL21] >Mime-Version: 1.0 >Content-Type: text/plain; charset=US-ASCII >Content-Transfer-Encoding: 7bit >Content-Length: 3327 > >Quoth Paul L. Moses, verily I say unto thee: >- -=> >- -=>Regarding the Electronic Democracy idea, I vote with Tim May. Look at the > >Just the opposite here. > >One factor has been missing from this discussion. > >Representative "democracy" is a statist imposition. > >One other factor: > >The number of issues to be voted on is quite large. Even with easy access >via cable-tv data networks, public voting kiosks, etc, no one will be able >to keep up. This will immediately result in demand for LESS legislation, >which is a good thing no matter how you look at it. > >Simple requirements for quorums before a proposition comes up for voting >would head off most goofy bills right from the start. If you have to have >at least, say, 10% of the population to vote to ALLOW AN ISSUE TO EVEN BE >VOTED ON, most idiot bills will be nipped in the bud. One other thing >you'll see disappear is "private laws". Our congress wastes an incredible >amount of time and money working on laws that affect only one corporation, >or one small area. For one thing, most of this stuff is irrelevant as far >as the Law of the Land goes. It's not something our legislature should be >involved in. Let companies work out their own damn problems. For >another, local-area laws should be handled by local areas. Period. >In my opinion. > >The main objection I keep seeing is that all them loonies will vote for >stupid laws. I'd like to ask you how many of these people vote NOW? Not >very many. The idiotic, the lazy, and the careless do not vote, by and >large. The people that vote are the people that think about issues, and >decide that they want to do something about them. > >Anyway, when some of this comes about, and it is quite inevitable, I would >hope that a very least e-voting gives the people veto power, to directly >overturn anything passed by congress and the prez, and even the power to >kill bills before they even get past the discussion stage. Add to that >the right to directly propose legislation, provided there is a quorum, and >I think that would be a good starting point. > >If all Tim and others with the same views are upset about is that a sudden >change could result in utter chaos, I have no argument with that. The >changes must be gradual, so as to not cause a governmental backlash. I >can see just installing the system and cutting congress out of the picture >entirely. The resulting mess would be allowed to go on for about a month, >before the pres declared martial law due to national emergency, and then >it'd be all over. One thing that irritates the hell out of me about many >anarch[o-capital]ists and libertarians, is an all or nothing stance. Some >of you folks don't seem to clue to the ideas of compromise, gradual >change, long-term planning, and strategic retreat to throw an enemy off >balance. You aren't going to take the world by storm, and Tim's dire >predictions of a hell hole that would result if such occured are right on >the mark. Play our cards right, and we'll take the world by whispering breeze. > >- -- >Stanton McCandlish * Space Migration * Networking * ChaOrder * NO GOV'T. * >anton(a)hydra.unm.edu * Intelligence Increase * Nano * Crypto * NO RELIGION * >FidoNet: 1:301/2 * Life Extension * Ethics * VR * Now! * NO MORE LIES! * >Noise in the Void BBS * +1-505-246-8515 (24hr, 1200-14400, v32bis, N-8-1) * > > > >------- End of Forwarded Message > >

1 0

Re: Cracking & auditing crypto protocols
by Peter Wayner 23 Aug '93

23 Aug '93

I'm not sure whether it is fair to call Walter Tuchman a Real Cryptanalyst, but there are many reasons to suspect that he is a talented one. When he headed the IBM team developing DES, it is said (by Coppersmith) that they developed many attacks like what we now know as Differential Cryptanalysis. These contributed to their design of DES and I think it would be fair to say that the same principles could be used to assess the strength of the Clipper chip. A Mykotronix employee told me that it "Contains s-boxes and all that stuff." I don't know whether he was the one responsible for these insights back then, but he certainly was in the right place to learn alot by osmosis. -Peter

1 0

Munged account feeding old mail?
by fergp＠sytex.com 22 Aug '93

22 Aug '93

Am I the only one getting carbon copies of many of my own messages from someone else's munged account? 8<------------------------

2 1

No Subject
by XXCLARK＠indst.indstate.edu 22 Aug '93

22 Aug '93

fergp(a)sytex.com asks: >Am I the only one getting carbon copies of many of my own messages >from someone else's munged account? Nope. But I received one only, and that a bounce back from cypherpunks... Seemed to take several days to come back. >X-Delivery-Notice: SMTP MAIL FROM does not correspond to sender. >Received: from INDST (SMTP) by indst.INDSTATE.EDU (Mailer R2.08) with BSMTP id > 4801; Sun, 22 Aug 93 04:04:07 EST >Received: from nic.cerf.net by indst.indstate.edu (IBM VM SMTP R1.2.2MX) with > TCP; Sun, 22 Aug 93 04:04:06 EST >Received: by nic.cerf.net (4.1/CERFnet-1.0) id AA11147; Sun, 22 Aug 93 02:06:2 > PDT >X-Path: cerf!sdcoe!philly!lanleb!lebanon!daemon Sat, 21 Aug 93 23:45 >Received: by sdcoe DHL85510: Sat, 21 Aug 93 23:45 Version 2.2.1 18Aug93 >Date: Fri, 20 Aug 93 11:02 edt >From: daemon(a)lebanon.cerf.fred.org (FMF Mailer Version 2.03 19apr93) >To: xxclark(a)indst.indstate.edu >Subject: returned mail >Message-Id: <DHL85510(a)sdcoe.cerf.fred.org >Error: User "dhaise" isn't on lebanon >----------returned message---------- >From lanleb!philly!sdcoe!toad.com!owner-cypherpunks Wed, 18 Aug 93 02:36 >Received: by lanleb.cerf.fred.org Version 2.02 6apr93 > id DHI00002; Wed, 18 Aug 93 02:36 edt >Date: Tue, 17 Aug 93 01:24:07 EST >Ppath: lebanon!dhaise >From: XXCLARK(a)indst.indstate.edu >To: cypherpunks(a)toad.com > ... >----------end of returned message---------- > daemon lebanon 8/22/93

1 0

Re: "Secure Voice"
by geoffw＠nexsys.net 22 Aug '93

22 Aug '93

Anybody know about the voice capabilities of the ZyXel class modems? I own a ZyXel 1496E which can digitize voice and also transmit voice data that has been digitized. It would be easy to first encript this stream before sending it out. The 1496E+ also support CELP (or is it (CLEP?) but that one cost about $400. (The 1496E is around $300) It also is a 14.4 K baud modem and does FAX.

2 1

"Secure Voice"
by bart＠netcom.com 22 Aug '93

22 Aug '93

Just received a low budget brochure from SVC offering their "Secure Voice" TM software for $250. Used with a '386 minimum, a Sound Blaster board, and a 14.4K V.42 modem they claim to do compression and DES encryption (triple DES with a '486). "You talk into your computer, the computer digitizes your voice, encrypts it, transmits it through the high speed modem over the open phone lines to the other end, where it is decrypted, and can be heard." They indicate you need one "Secure Voice" for each end so I'd guess they have it copy protected. "No BS Updates: ... As a purchaser, you are entitled to free software updates for the life of this product. We keep no records of who purchases our products, so to receive your update, send us your original disk and a SASE." Their address: PO Box 9512 College Station, TX 77842 Texas residents add 8.25%, VISA/MC add 5%

1 0