|
Cryptome DVDs are offered by Cryptome. Donate $25 for two DVDs of the Cryptome 12-years collection of 46,000 files from June 1996 to June 2008 (~6.7 GB). Click Paypal or mail check/MO made out to John Young, 251 West 89th Street, New York, NY 10024. The collection includes all files of cryptome.org, jya.com, cartome.org, eyeball-series.org and iraq-kill-maim.org, and 23,000 pages of counter-intelligence dossiers declassified by the US Army Information and Security Command, dating from 1945 to 1985.The DVDs will be sent anywhere worldwide without extra cost. |
3 August 2008
Date: Sun, 03 Aug 2008 09:04:38 -0700 Subject: CRYPTOME: Response to hushmail-pry.htm From: "S Brian Smith" <sbs[at]hushmail.com> Hello, This post is in error: http://cryptome.org/hushmail-pry.htm The post refers to the wrong file for the comparison. The check should have been done against this file: applets/HushEncryptionEngine.jar That is the file actually used on the website. It is processed with Proguard to reduce the download size, and has no debug information. If you checksum that file, the checksum will match the file on the website. The file mentioned in the post, HushEncryptionEngine_3-0-0-30.jar, contains debugging information and is not processed by Proguard. Therefore it does not match the file for download on the website. Regards, Brian Smith Hush Communications
__________
Date: Sun, 3 Aug 2008 18:40:48 +0200 From: "Rafal Kwasny" <mag[at]entropy.be> Subject: Cyptome. Hushmail Applet I recently saw info about hushmail http://cryptome.org/hushmail-pry.htm. However author compared wrong files, hushmail applet is available in /applets/ directory within .zip file https://www.hushmail.com/downloads/HushEncryptionEngine_3-0-0-30.zip and it is the same file as serverd via WWW.
2 August 2008
A sends:
Hushmail exposed? Some people started to ask me questions like: "Is Hushmail still safe?", and I wanted to investigate this further... and I found it: Hush provides full source code for review of their HEE (Hush Encryption Engine) in: https://www.hushmail.com/help-downloads (Direct Download) https://www.hushmail.com/downloads/HushEncryptionEngine_3-0-0-30.zip within this file (HushEncryptionEngine_3-0-0-30.zip) there is a file called "HushEncryptionEngine_3-0-0-30.jar". "HushEncryptionEngine" is the Java executable responsible for the process of encryption of messages in Hushmail (Java enabled version). The hash of this file is: 0e6efd6b236cbb2a73049a65d6d9c5e23ac3d25b (SHA-1 Hash) But this isn't the same file avaiable by Hushmail in their servers: https://mailserver1.hushmail.com/shared/HushEncryptionEngine.jar https://www.hushtools.com/shared/HushEncryptionEngine.jar The hash of this version is: 09e56f59a8392522543af1a1a95cb80729aa62c6 (SHA-1 Hash) and the file definitely isn't the same avaiable in the file "HushEncryptionEngine_3-0-0-30.zip" (but it should be). You can confirm this opening the mentioned files with a tool like 7-Zip or WinZip. Again: The hash from the original version included with the source code released by Hush: 0e6efd6b236cbb2a73049a65d6d9c5e23ac3d25b (SHA-1 Hash) And the hash from the version available in Hushmail website: https://mailserver1.hushmail.com/shared/HushEncryptionEngine.jar and https://www.hushtools.com/shared/HushEncryptionEngine.jar is: 09e56f59a8392522543af1a1a95cb80729aa62c6 (SHA-1 Hash) Cryptome readers may draw the conclusions by themselves.