Re: Duress PIN, Mixfit and PlugMate

>John Gotti <[email protected]>wrote:
>>Jan Panteltje wrote:
>>> Ch1ffr3punk <[email protected]>wrote:
>>>> Ch1ffr3punk wrote:
>>>> Jan Panteltje wrote:
>>>>>> [email protected] (LucLan)wrote:
>>>>>>> In alt.cypherpunks Jan Panteltje <[email protected]> wrote:
>>>>>>>> Ch1ffr3punk <[email protected]>wrote:
>>>>>>>>> Ch1ffr3punk wrote:
>>>>>>>>
>>>>>>>>> Do you think that borders guards are that stupid when they search
>>>>>>>>> people and see VeraCrypt usage?
>>>>>>>>
>>>>>>>> And if you use for passwords, NFT tags, hidden in a book etc.,
>>>>>>>> US law enforcement has devices to destroy them.
>>>>>>>
>>>>>>>
>>>>>>> Anybody been swallowing micro-sdcards?
>>>>>>>
>>>>>>>
>>>>>> No. Why?
>>>>>
>>>>> Put you secret messages and data on it,
>>>>> swallow it and then pass through customs?
>>>>> Make sure you carry a big smartphone with lots of OK stuff
>>>>> to distract security?
>>>>
>>>> Probably a better way would be to carry no devices at all
>>>> and only purchase an empty USB stick at arrival, when you
>>>> download all your goodies from public repositories and
>>>> only need to remember the passphrase you exchanged with
>>>> your loved ones.
>>>>
>>>> That's how MicroCrypt works and additionally you can
>>>> receive/transfer files with NymX over the Nym Mixnet,
>>>> so that third-parties do not know with whom you do
>>>> files transfers.
>>>>
>>>> https://github.com/Ch1ffr3punk/MicroCrypt
>>>> https://github.com/Ch1ffr3punk/NymX
>>>>
>>>> HTH!
>>>>
>>> P.S. Prior depature, one can sign-up with https://atomicmail.io/
>>> without providing any credentials, so that your loved ones have
>>> your email address, when using MicroCrypt.
>> 
>> 
>> //>--
>>> https://oc2mx.net
>> Interesting,
>>   https://oc2mx.net/am.html
>> 
>> I will be 80 in a few month this year, been on internet since it started, used Win 3.1 and Trumpet Winsock,
>> when Billy The Gates said 'internet is not that important'.
>>   Bill Gates stated that he saw "little commercial potential for the internet for the next 10 years"
>>   during a Comdex trade event in 1994.
>>   Additionally, in his 1995 book "The Road Ahead,"
>>   he described the internet as a novelty that would eventually be replaced by something better.
>> 
>> Before that in 1980 we had 'Videotex' (Viditel in the Netherlands where I am now)..
>> Have my own website ever since...
>>   https://panteltje.nl/index1.html
>> Sometimes ran the server at home when I had a fixed IP address (cable) now web hosting outsourced.
>> 
>> Started using Linux when SLS Linux came, end of MS windows for me.
>> 
>> Anyways these days US will also want to know about your online activities for a Visa ..
>> So not expecting to get a Visa from them, I refused to join CIA many years ago too.
>> 
>> As to transferring encrypted stuff, there are so many ways...
>> With memory things getting smaller and smaller and having more and more capacity,
>> hiding something, even in your watch, becomes easier and easier.
>> Drones... Radio... Satellite..
>> Played with it all.
>> 
>> Or you can just post your encrypted stuff on Usenet and thousands will read it...
>> 
>> There is more to it...
>> I tramp keeps going maybe after the nukes try Morse and smoke signs?
>
>Your NewsFleX sucks mate.
>Today as in the 80s.
>
>Path traversal in the downloader.
>
>Command injection: URLs and group names end up in shell commands executed with popen().
>
>Memory corruption in NNTP, SMTP, and FTP responses: with a line exactly READSIZE long, the terminator is written beyond the
>buffer.
>Crash and possible stack corruption caused by a malicious server. 
>
>HTML parser without size checking: temp_pos grows without checking the buffer limit. 
>
>Insecure credentials: NNTP password saved in clear text and sent via AUTHINFO PASS over a TCP socket without TLS. 
>
>The OTP is cryptographically insecure: it generates the key via rand(), without secure initialization. 
>Predictable keys and possible reuse of the pad, so the promised confidentiality is unreliable. 
>The filter password uses crypt() with a fixed salt of "P8". 
>The hash is easily attackable and the same for identical passwords.
>
>Verdict: I would not use it on the Internet, with real credentials, or on the main system. 
>Above all, it should never be run as root, despite the README explicitly recommending it.
>For historical testing, only in a dedicated VM, as a non-privileged user, without a shared home and without personal data.


Well, I have been using it since I moved to Linux with SLS Linux in 1992 or so
I wrote it because there was no 'Free Agent' for Linux.

It has been working perfectly here for me as root since that day (I am always root), and now also runs on my Raspberry Pi4 8 GB.
 raspberrypi: ~ # uname -a
Linux raspberrypi 5.15.32-v7l+ #1538 SMP Thu Mar 31 19:39:41 BST 2022 armv7l GNU/Linux

The nice thing is that I have a Usenet database with postings and articles I liked and kept going back to the late nineties.

Problems?
Problems came when the maintainer of libforms made some changes, dropped middle and right mouse button support for example,
reported it, I think he fixed it.
But I use an old version of libforms.

As to crashes, and other problems you seem to have, no :-)
It's not perfect but few software works that well.

But if you are too dumb or lazy to install it or improve it :-) keep with the stuff you like,

It is nice to have a database going back decennia and a search function in it.
And of course you can search with 'locate' and 'grep' etc etc too.

I noticed a lot of panic by 'news reader clans  when they hear about NewsFleX.
That is it because it is a zillion times better than most crap showered upon you poor guys.

BTW I no longer use the html function, html has no place in Usenet (or email) IMNSHO.

But wise cracker, write a better one!
If you can ;-)