Cryptography-Digest Digest #606, Volume #9       Thu, 27 May 99 21:13:04 EDT

Contents:
  DECIPHER THE PRESS (SCOTT19U.ZIP_GUY)
  Re: evaluation cryptographic algorithms (fungus)
  Re: Threatening SW ^besides^ Strong-Crypto (Ray Girvan)
  The BRUCE SCHNEIER  Tirade (Anthony Stephen Szopa)
  Re: non-computerized cryptography (Anthony Stephen Szopa)
  Re: What good is hushmail? (fungus)
  Re: Please recommend freeware encryption SDK (SCOTT19U.ZIP_GUY)
  Re: DSA (Digital Signature Standard) and the Schnorr Patents ("rosi")
  Re: What good is hushmail? (fungus)
  Re: Any way to decrypt .PWL windows password files? (fungus)
  Re: The BRUCE SCHNEIER  Tirade (Omar N. Ikley)

----------------------------------------------------------------------------

From: [EMAIL PROTECTED] (SCOTT19U.ZIP_GUY)
Subject: DECIPHER THE PRESS
Date: Fri, 28 May 1999 00:30:23 GMT

This was taken off the news wires I wonder what it really means since when
one gets a clearance you lose your rights. Some other news broadcast  said
this was only wire tap that the FBI asked for that was turned down. I am 
postive that you sign a waiver when you get a clearance. My question was why
was a wire tap even asked for? There is something fishy going on and I really
can't decipher what it really means. I am shocked that Reno even gives a
dam about the constitution.

                 Reno explained that when the FBI first sought to
                 wiretap Wen Ho Lee, a Taiwanese-born scientist at the
                 Los Alamos National Laboratory in New Mexico, the
                 application for a warrant was rejected by Justice�s Office
                 of Intelligence Policy and Review.
                      �The facts presented in 1997 were insufficient to
                 support a finding of probable cause� to believe that Lee
                 was knowingly engaged in clandestine
                 intelligence-gathering on behalf of a foreign power, Reno
                 said. That is the standard required by the Foreign
                 Intelligence Surveillance Act of 1978 and by the
                 Constitution.
                      Reno explained that then-Assistant FBI Director John
                 Lewis complained about that decision to her and she
                 asked Justice�s Executive Office for National Security to
                 review the decision. Daniel Seikaly of that office agreed
                 with the earlier decision and his ruling was transmitted to
                 the FBI, Reno said.
                      Seikaly never took the matter up with Reno or with the
                 deputy attorney general, she said.
                      �I assumed since I did not hear again from the FBI that
                 it was resolved to their satisfaction,� Reno said. 

                 FBI Had Doubts
                 Indeed, a senior FBI official has said the bureau itself
                 doubted it had sufficient evidence for a warrant. This
                 official said agents basically had three facts: the Energy
                 Department listed Lee as among those officials who knew
                 about the W-88 nuclear warhead that China had obtained
                 data about, that Lee had traveled to China to give lectures
                 and that he had once telephoned another laboratory
                 scientist under suspicion of spying, this official has said.
                      Reno repeated she has not thought of resigning and
                 said she was told by White House Counsel Charles Ruff
                 that she has President Clinton�s confidence.

Maybe I am losing my mind but you can bet your sweet ass if any one
of these facts existed for a white man they would have a taperecorder
stuck up his ass. My question is this whole story a Red Herring or what?
It is obvious they could wire tap him. Is the administration getteing ready
to steal more rights away form us or what. I really wish some one can
decrypt what the hell this really means since there is something missing
in what we are being spoon fed on this story.

Thank You
P.S. Please some one decode this for me!!!


David A. Scott
--
                    SCOTT19U.ZIP NOW AVAILABLE WORLD WIDE
                    http://www.jim.com/jamesd/Kong/scott19u.zip
                    http://members.xoom.com/ecil/index.htm
                    NOTE EMAIL address is for SPAMERS

------------------------------

From: fungus <[EMAIL PROTECTED]>
Subject: Re: evaluation cryptographic algorithms
Date: Fri, 28 May 1999 01:30:54 +0200



Andreas / Detlef Stieger wrote:
> 
> Hi everyone.
> 
> I always wondered how cryptoscientists evaluate their algorithms.
> 
> I think it is dangerous just to look at the number of possible keys and to
> calculate how long it would take to check all the keys if all computers in
> the world would join calculation power 24 hours a day, seven days a week.
> ("Exhaustionsmethode")
> 
> How must an encryption algorithm be so that it can be evaluated as "strong"
> (besides that is has to have a large number of possible keys) I heard of
> assymetric keys and so on...
> 

An algorithm is regard as strong if there is no known attack better
then searching all the keys. When you have this situation then you
can define the strength of the algorithm by the number of bits in
the key.

Asymetric/symmetric keys are generally not comparable to each other.
Asymmetric keys need to be much bigger to provide the same security.

> I would also like to know what, providing that an algorithm is "strong", can
> make him "weak"?
> (publicating the source code, attack algorithms, new and faster
> computers...)
> 

Publishing the source openly is often regarded as essential for an
algorithm. No good cryptographer will use an algorithm which must
be kept secret for security reasons.

New attacks are an unknown quantity.

Faster computers will help, but if the key is 128 bits then you
still won't break it even with all the computers in the world
(do the maths and you'll see....)


-- 
<\___/>
/ O O \
\_____/  FTB.

------------------------------

Date: Fri, 28 May 1999 00:42:42 +0100
From: Ray Girvan <[EMAIL PROTECTED]>
Subject: Re: Threatening SW ^besides^ Strong-Crypto

[EMAIL PROTECTED] (Charles M) writes:

> Slow week and too much thinking again.
> The crypto bit is so much in the news, and so long-running that I for 
> one am apathetic on the topic. But I was thinking last night about 
> whether there mightn't be other kinds of software that would pose as 
> great a thread to "national security" as Strong-Crypto ...

It would help a lot if you got out of the Cold War paranoia that 
everyone is obsessed with finding American secrets.  I think that 
outside the US, most users are interested in crypto for simple 
practical reasons: their own communications security.  The same 
applies to the data mining or knowledge management software you suggest.

Ray

-- 
[EMAIL PROTECTED] +++ Technical Author +++ Topsham, Devon, UK
http://www.users.zetnet.co.uk/rgirvan/ +++ The Apothecary's Drawer



------------------------------

From: Anthony Stephen Szopa <[EMAIL PROTECTED]>
Crossposted-To: talk.politics.crypto,alt.privacy
Subject: The BRUCE SCHNEIER  Tirade
Date: Wed, 26 May 1999 10:07:29 -0700
Reply-To: [EMAIL PROTECTED]

The BRUCE SCHNEIER  Tirade



BRUCE SCHNEIER is president of Counterpane Systems and says:

"One-time pads don't make sense for mass-market encryption products.
They may work in pencil-and-paper spy scenarios, they may work on the
U.S.-Russia teletype hotline, but they don't work for you.  Most
companies that claim they have a one-time pad actually do not.  They
have something they think is a one-time pad.  A true one-time pad is
provably secure (against certain attacks), but is also unusable.

Elementrix, now defunct, announced a one-time pad product a few years
ago, and refused to recant when it was shown that it was no such thing.
Ciphile Software <http://www.ciphile.com> just tries to pretend:
"Original Absolute Privacy - Level3 is an automated pseudo one-time pad
generator with very sophisticated and powerful augmenting features."
Whatever that means."

A true one-time pad is...  unusable?  Why:  because no one has shown how
it can be done yet?

Let me begin by asking Mr. Schneier why the OTP is unusable?

Next, let me ask Mr. SCHNEIER if he possesses a copy of OAP-L3
encryption software?  I certainly did not provide him with one.

In one breath Mr. SCHNEIER says that Ciphile Software is "pretending"
then in the next he claims:  "whatever that means."  Mr. SCHNEIER, do
you know what you are talking about when you trash Original Absolute
Privacy - Level3 Encryption Software?

Is it the mark of a professional to make assertions about something he
does not know anything about?

And do the readers of this news group think it wise to accept someone's
unsubstantiated claims at face value just because they have earned a
certain level of respect in a particular field or community?

Apparently, what Mr. SCHNEIER is critiquing is my web site home page
sales hype that has remained unchanged since its inception over two
years ago.  Granted, the phrase "with very sophisticated and powerful
augmenting features" is vague and ambiguous so I have removed it.  But
is this a legitimate basis upon which a professional judges an
encryption software product?

Is this what you expect an encryption software and security consultant
to pass off as a legitimate basis from which to discredit a particular
encryption method?

So, does Mr. SCHNEIER know what he is talking about when he talks about
OAP-L3?

I will grant you that Mr. SCHNEIER is certainly entitled to our
forgiveness if he were to publicly acknowledge that he erred in his
trashing of OAP-L3.

If no retraction is forthcoming:  so be it.  It will be his credibility
that may be effected.

I know of no facts or have not heard Mr. SCHNEIER offer any material
fact(s) that support his claim that Ciphile Software with Original
Absolute Privacy - Level3 is actually pretending to be anything.  OAP-L3
is an extremely secure encryption software product, and this claim is
supported by the facts.  This has always been apparent from the
documentation available at the web site past and present.  The software
is readily available as SHAREWARE as well.

Mr. SCHNEIER has chosen to ignore the facts in favor of a cheap shot
rather than doing his homework as I would expect a professional to do.

About Ciphile Software and Original Absolute Privacy - Level3 Encryption
Software -

"... your software is, so far as I can tell, bulletproof."

"It's an amazing package."

I think it is best to let an UNBIASED WELL INFORMED public decide the
merits of Ciphile Software's OAP-L3.



Anthony Szopa
Ciphile Software

------------------------------

From: Anthony Stephen Szopa <[EMAIL PROTECTED]>
Subject: Re: non-computerized cryptography
Date: Thu, 27 May 1999 07:39:08 -0700
Reply-To: [EMAIL PROTECTED]

Jaap-Henk Hoepman wrote:

> On Wed, 26 May 1999 13:19:38 -0700 ���� <[EMAIL PROTECTED]> writes:
> > Greetings:
> >
> > I'm interested in locating texts or other information pertaining to
> > "non-computer based" cryptography.
> >
> > The trends in cryptography undeniably have shifted to 100%
> > computer-based systems. But is there anything still being written about
> > systems which do NOT rely on a computer to generate 1024 bit prime
> > numbers??
>
> Well, there's visual cryptography off course; and I believe there are several
> authentication systems based on pattern or image recognition but apart from
> that I'm not aware of other approaches. Would be interested in hearing about
> them though...  If you receive other replies by mail, please summarize here.
>
> Very roughly speaking, visual crypto uses transparancies as a physical one time
> pad. By putting the image on the transaprency over the image containing the
> message, the message appears. Without the image on the transparancy, the image
> containing the message appears to be random.
>
> See:
>
> @Unpublished{Sti97,
>   author =       "D. R. Stinson",
>   title =        "An Introduction to Visual Cryptography",
>   note =         "Available at
>                  http://cacr.math.uwaterloo.ca/~dstinson/index.html
>                   (with transparancies) ",
>   year =         1997
> }
>
> @InProceedings{Mat96,
>   author =       "Tsutomu Matsumoto",
>   title =        "Human-Computer Cryptography: An Attempt",
>   crossref =     "Int.\ Conf.\ on Computer and Communications Security 1996",
>   pages =        "68--75",
>   keywords =     "visual cryptography",
>   project =      "RvB"
> }
>
> @InProceedings{NaoP97a,
>   author =       "Moni Naor and Benny Pinkas",
>   title =        "Visual Authentication and Identification",
>   crossref =     "CRYPTO97",
>   pages =        "322--336",
>   keywords =     "visual cryptography",
>   project =      "RvB"
> }
>
> @Unpublished{NaoP97b,
>   author =       "Moni Naor and Benny Pinkas",
>   title =        "Visual Authentication and Identification",
>   note =         "Prel. version appeard at Crypto '97. Available at
>                  http://theory.lcs.mit.edu/~tcryptol",
>   year =         1997,
>   keywords =     "visual cryptography",
>   project =      "RvB"
> }
>
> @InProceedings{Dro96,
>   author =       "Stefan Droste",
>   title =        "New Results on Visual Cryptography",
>   crossref =     "CRYPTO96",
>   pages =        "401--415",
>   project =      "RvB"
> }
>
> Jaap-Henk
>
> --
> Jaap-Henk Hoepman             |  Sure! We've eaten off the silver
> Dept. of Computer Science     |  (when even food was against us)
> University of Twente          |         - Nick Cave
> Email: [EMAIL PROTECTED]      === WWW: www.cs.utwente.nl/~hoepman
> PGP ID: 0xFEA287FF Fingerprint: 7D4C 8486 A744 E8DF DA15 93D2 33DD 0F09

I know exactly what you are talking about.

Ciphile Software's Original Absolute Privacy - Level3 encryption
Software Package
is exactly what you are describing.

It uses NO, I repeat:  NO mathematical equations as an integral part of
the
encryption / decryption process.  The only math used in the entire
process is a
comparison of digit triplets less than or equal to 767, and a division
by 3 where
the remainder is truncated.  No other math is used.

It is available as shareware at http://www.ciphile.com

------------------------------

From: fungus <[EMAIL PROTECTED]>
Subject: Re: What good is hushmail?
Date: Fri, 28 May 1999 01:41:50 +0200



[EMAIL PROTECTED] wrote:
> 
> The point is that right now, absent applet validation and end to end
> key validation by some neutral entity, hushmail's security is to some
> extent dependent on the absence of concerted gov interest in
> particular users.Of course you could say that of every communications
> medium. But hushmail is making claims for its relative security that
> need to be analyzed carefully.

Future versions of Java could solve this problem, maybe even the next
release. 

Meanwhile, you could always write a script which checks the applet
at random times, look at the SSL certificate, bounce the mail off
anonymiser.com and ziplip.com, etc.

The really truly paranoid won't be using Hushmail. Attacking hushmail
just to catch the small fish is risky for the NSA. They could easily
be spotted and blow the whole operation, all it would take is for
a couple of users to compare key fingerprints or romebody to see a
bad applet. The NSA doesn't work that way - the resulting bad publicity
from being exposed could do the NSA more damage then the possible value
of any messages they might intercept.



-- 
<\___/>
/ O O \
\_____/  FTB.

------------------------------

From: [EMAIL PROTECTED] (SCOTT19U.ZIP_GUY)
Subject: Re: Please recommend freeware encryption SDK
Date: Fri, 28 May 1999 00:17:39 GMT

In article <7iken3$rpt$[EMAIL PROTECTED]>, MatthewJohnson <[EMAIL PROTECTED]> wrote:
>In <[EMAIL PROTECTED]> Squitter Shivwits <[EMAIL PROTECTED]> writes:
>
>>Dan Koppel wrote:
>>> 
>>> Hello all,
>>>   I was wondering if anybody out there could recommend a freeware
>>> encryption SDK that could be used for commercial purposes.  I would like to
>>> integrate it with some software that I wrote.  I understand that PGP is
>>> freeware if used non-commercially, so I guess I'm looking for something
>>> else.  Please let me know if I've got my facts right.
>>>    Thanks and I appreciate any input on this,
>>>     Dan Koppel
>>>     [EMAIL PROTECTED]
>
>>Use scott19u.zip for the finest in free security:
>
>I would not call this "the finest in free security".  And I would
>certainly check out the thread in this same newsgroup titled "Review
>of scott19u" before deciding on using scott19u.
>
>>   http://members.xoom.com/ecil/index.htm
>
>>I have used it and nobody reads my files.
>
>Well, if it is true that nobody reads your files, it could be because
>they haven't tried hard enough yet.
>

 I'd like to comment but just what is SDK I haven't decrypted that yet?

 


David A. Scott
--
                    SCOTT19U.ZIP NOW AVAILABLE WORLD WIDE
                    http://www.jim.com/jamesd/Kong/scott19u.zip
                    http://members.xoom.com/ecil/index.htm
                    NOTE EMAIL address is for SPAMERS

------------------------------

From: "rosi" <[EMAIL PROTECTED]>
Crossposted-To: talk.politics.crypto
Subject: Re: DSA (Digital Signature Standard) and the Schnorr Patents
Date: Thu, 27 May 1999 18:23:36 -0400

<[EMAIL PROTECTED]>...
>Rosi <[EMAIL PROTECTED]> wrote:
>
>> Dear Vin,
>>
>>    The text is a bit overwhelming. Excuse me for not reading it entirely
>> and carefully before this reply.
>
> Sorry to be overwhelming, but I can appreciate your plight.  I had
>not intended to write as much as I did, but I didn't have the time to
>write short.
>
><...>
>

Dear Vin,

   I can understand. I have had the same problem before (on
top of my poor English). I have had the experience of people
'switching modes' in an argument and dragging in totally unrelated
issues, etc.

   However, patent law is law. I think you agree with this one. It is
not that you provided free community service or similar sort that
you may deserve a patent. There are relevant thing and not so
relevant things. I think it may be better to actually argue on the claims.
But not a patent professional and do not know if that is good advice.

   Let me be concrete. You may not have meant it, but I can only
judge from what you say. Your 'association' of Roger with NSA
does not help your case. Not in my opinion. To me, that is quite
irrelevant.

>>    However, I think we somehow agree that as a patent issue, it is
>> 'maybe or maybe not'. It can hardly made anything other than that.
>
> Actually, I disagree.  I think many potential claims are absurd and
>can be easily and completely dismissed.
>

   I am not sure what you disagree with. If you disagree with other
people, I see and I agree (allowance for disagreement). But you
quoted 'maybe or maybe not'. If you see otherwise, you would have, I
expect, said that those saying 'maybe or maybe not' are totally wrong.
You might have tried to refute, why instead of 'maybe or maybe not', it
really is ...? Or as a tactic, you should not have quoted at all.

   I should not get entangled in the patent side of the issue, though I
still think it is such a one. I only apply simple logic and say what I
see as relevant. I apologize for anything I said that is inappropriate.
I feel for you that in your profession things may not be universally
accepted as right or wrong, even though it may appear so obviously
right or wrong to one. But that is definitely not not shared by other
disciplines where such things should be easier to achieve.

   Thank you for your post.
   --- (My Signature)

> I only jumped into this discussion because some bright guys were
>referring to the Schnorr patents with that sort of language. It was
>clear to me -- just from the way I saw the Schnorr patents used as a
>fulcrum to challenge US policy on DSS and EES -- that they were
>underestimating the credibility of the Schnorr patents in the DSS
>debates in (at least) the early and mid 1990s.
>
> While making no claim to be a patent scholar, my point was only that
>Claus Schnorr's claims -- and/or either his US, European, or Japanese
>patents -- was credible enough that it profoundly influenced vendor
>adoption of the DSS, and that, in turn, had an serious impact on both
>US policy (as well as the relative security of US federal agencies.)
>
> I don't mean to suggest that the Schnorr patents were the only factor
>-- or even one of the most important factors -- in blocking ESS,
>Fortezza, required key-escrow or key recovery, etc. I only claim that
>the Schnorr patents became, briefly, very important in that struggle
>when they helped derailed the DSS bandwagon.
>
> In the larger context, I think it slowly became apparent to almost
>everyone that the NSA's confidence that it could use the gross
>aggregate purchasing power of the federal agencies in infosec to shape
>and dominate the cryptographic security market was extraordinarily
>naive.
>
> The more blatently they tried to manipulate the market, the more they
>revealed how little they understood about the industries they sought
>to control.
>
> Today, only Congressmen, the European Parlament, and foreign
>reporters view the NSA with the sort of awe that was common among
>American computer and communications professionals in the mid 1980s.
>
>>    For exmaple, if I say that Prof. Schnorr could even more
>> convincingly contribute to the advances in cryptography and
>> privacy of individuals if he had given out his patent for free. you at
>> once might challenge me for a proof. I can NOT give one. Equally, I
>> think it is a hard case to prove what you seem trying to show that his
>> patent 'deterred' the other side.
>
> As far as _proving_ that the Schnorr patents were a factor in slowing
>the adoption of the DSS, that could be done fairly easily by anyone
>who talked to a lot of people in this industry. The US standards orgs
>are also full of people who would freely discuss of how the NSA
>operated within their organizations.
>
> The impact of the vendors' rejection of the DSS on the NSA's (overt
>and apparent) crypto strategy can also be fairly easily documented by
>anyone who talks to the appropriate government officials, many now
>retired, who had a part in managing this issue -- at the NSA and NIST,
>as well as at other government agencies.
>
> While I didn't write the sort of journalistic report that could
>document all this, it would not be difficult to do so.
>
> Unlike most of the traditional business of the NSA or other
>intelligence agencies, this initiative demanded that the NSA send out
>people in an attempt to influence the vendors, the customers, the
>standards orgs, and the civil agencies of the US government.
>
> Nothing like that stays secret, especially in the aftermath of a
>failed campaign.
>
>>    Maybe, legal profession is different. But this seems simple to me.
>> If Prof. Schnorr's patent had that effect as you seemed to show, then
>> it needs to be, IMO, a strong case. But you quoted and tried to show
>> it is (in the strongest sense) a 'maybe or maybe not'. How could you
>> be so sure that it had that kind of impact.
>
> Actually -- without attempting to offer an amateur's opinion on
>patent law -- it's apparent to me that all that was needed was only a
>credible challenge.
>
> A potential and credible threat was enough to move DSS's
>international royalty-free status into question, and that -- coupled
>with RSAPKC's relative efficiency in signature verification -- was
>enough to influence the DSS's acceptance in commercial products.
>
> (There was also another oblique but important potential patent
>challenge to DSS; a patent relevant to the protocol commonly used with
>DSA, rather than to the algorithm, per se. Prof. Silvio Micali of MIT
>has a patent that seems to cover the precomputation technique commonly
>used to make DSA more efficient in signature verification. Only with
>precomputation could DSS come within shouting distance of RSAPKC in
>signature validation. Since a document is typically signed once, but
>validated many times, this was a critical factor.)
>
>> We do not know, I believe,
>> what has really been on the mind of NSA, etc.
>
> After chatting about this with former government officials for a
>decade, I don't think it is that difficult to understand the NSA's
>strategy. It is my experience that former NSA guys make superior
>drinking buddies, and appreciate people who try to understand what
>happened and why.
>
> I was uncertain for years whether the whole campaign might be a
>charade: part of an elaborate long-term strategy to simply delay the
>widespread adoption of strong PKC-based cryptosystems, with no real
>expectation of success.
>
> It is still hard to believe the hubris of the NSA officials who
>decided that they could turn the tide and displace PKC with GAKed
>technology, simply by managing the standards process and federal
>purchasing.
> It will always be an open question, but I think most senior NSA
>officials actually believed they could pull it off. This is probably
>only credible to people who understand how pervasive and dominant the
>NSA's influence, money, and expertise was in shaping the first 15
>years of the American computer industry. For myself -- and I wrote an
>industry history of those years for IBM -- I think they got lost
>somewhere on memory lane.
>
>> While I am definitely not
>> here to deminish the positive role of Prof. Schnorr's scheme, I think
>> I am definitely not to ignore the individuals who contributed so much
>> to the status of Clipper as it stands today.
>
> If I understand you correctly, I agree.
>
> There are many people -- including many within the US government,
>where a guerrilla war raged for a decade around the NSA's control of
>this issue (and the stranglehold on federal agency procurement the
>NSA's strategy demanded) -- who will deserve credit if citizen and
>commercial access to strong crypto and unGAKed key management wins the
>day.
>
>>    You need not agree with me.
>>    Thank you very much.
>
> In turn, I thank you for your interest, time, and patience.
>
> _Vin
>--------
>  "Cryptography is like literacy in the Dark Ages. Infinitely potent,
>for good and ill... yet basically an intellectual construct, an idea,
>which by its nature will resist efforts to restrict it to bureaucrats
>and others who deem only themselves worthy of such Privilege."
>  _A Thinking Man's Creed for Crypto  _vbm
>
> *     Vin McLellan + The Privacy Guild + <[EMAIL PROTECTED]>    *
>      53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548



------------------------------

From: fungus <[EMAIL PROTECTED]>
Subject: Re: What good is hushmail?
Date: Fri, 28 May 1999 02:03:01 +0200



Bruce Stephens wrote:
> 
> Also, although the Java source for the applets are available (so I can
> check that), how do I know that the bytecode that my browser
> automatically downloads actually corresponds to that source?
> 

Easy - compile it and compare the result. (Hint: They used the Sun JDK 1.1
compiler....)

> Do browsers typically let me compile my own Java sourcecode and use
> that in preference to the class files a web page references?  I don't
> remember such an option, but perhaps I've just missed it?

This is a good question...

The browsers can't do it directly but I've already got a program which
filters incoming HTML to remove banner ads. If such a program elready
exisits then I see no reason why you couldn't make another program
which modifies the Hushmail HTML to load the applet from your local
disk.


-- 
<\___/>
/ O O \
\_____/  FTB.

------------------------------

From: fungus <[EMAIL PROTECTED]>
Subject: Re: Any way to decrypt .PWL windows password files?
Date: Fri, 28 May 1999 02:06:31 +0200



Claude Martel wrote:
> 
> Greetings,
> 
> My friend, who is kind of lost sometimes, changed his password lately
> and is unable to remember it. I fixed it easily by bypassing the loosy
> win95 security and replacing his pwl file, but I was wondering if there
> is a way/program to decrypt the PWL file?
> 

Do a web search for "pwl cracker". There are dozens of programs out there
which can crack pwl files in seconds...


-- 
<\___/>
/ O O \
\_____/  FTB.

------------------------------

From: [EMAIL PROTECTED] (Omar N. Ikley)
Crossposted-To: talk.politics.crypto,alt.privacy
Subject: Re: The BRUCE SCHNEIER  Tirade
Date: Fri, 28 May 1999 00:23:33 GMT

Anthony Stephen Szopa <[EMAIL PROTECTED]> wrote:

>The BRUCE SCHNEIER  Tirade

You should be proud to be worthy of the attention of the likes of Bruce
Schneier.
-- 
"Omar N. Ikley"     better known as [EMAIL PROTECTED]
 0123 4  56789      <- Use this key to decode my email address.
                    Fun & Free - http://www.5X5poker.com/

------------------------------


** FOR YOUR REFERENCE **

The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:

    Internet: [EMAIL PROTECTED]

You can send mail to the entire list (and sci.crypt) via:

    Internet: [EMAIL PROTECTED]

End of Cryptography-Digest Digest
******************************

Reply via email to