May 2002 - cypherpunks-legacy

RE: Lead Generation
by Lead Generation 30 May '02

30 May '02

1 0

Re: sources on steganography
by Bill Stewart 30 May '02

30 May '02

Peter Wayner has a few books that deal with this and related topics. Search for them on Amazon or wherever. At 11:19 AM 05/29/2002 -0400, you wrote: >I am writing my dissertation on steganography. Basically I'm writing a >technical monograph that would be of use to undergraduate instructors. >What do you think are the best sources on steganography on >the Web? What about books other than Johnson, Katzenbeiser & Peticolas, >and the volumes covering the four international workshops on information >hiding. > >I am also interested in the history of the subject. One major problem with >the available sources covering the history (like Kahn) is that they >completely disregard China, India, and Arab countries. Any pointers? > >thanks, >hector

1 0

A Unique Dual Income Opportunity
by IQ - VBI 30 May '02

30 May '02

Life Insurance Settlements: A unique dual-income opportunity A Life Settlement is the sale of a life insurance policy that gives the policy owner a significant cash settlement. Earn substantial referral fees Sell more product Renewal Commissions of Original Policy Stay Intact A Value-Add to Your Existing Business DON'T CHANGE YOUR CURRENT WAY OF DOING BUSINESS Turn your existing book into an additional income stream with very little effort. Please fill out the form below for more information Name: E-mail: Phone: City: State: Call or e-mail <mailto:info@vbimail.com> us today! 800-871-9440 or visit us online at: www.Life-Settlements-Online.com <http://www.life-settlements-online.com> We don't want anybody to receive our mailings who does not wish to receive them. This is professional communication sent to insurance professionals. To be removed from this mailing list, DO NOT REPLY to this message. Instead, go here: http://www.Insurancemail.net <http://www.Insurancemail.net> Legal Notice <http://www.insuranceiq.com/legal.htm>

1 0

Hi! 4350AFGh7-25-11
by test5572b57＠hotbot.com 30 May '02

30 May '02

1 0

Success Marketing 8889ibFy5-030NXth-16
by jerry8532w82＠aol.com 30 May '02

30 May '02

1 0

Don't delete this is important 1130Vlqx2-823MScK2904ziys6-5-26
by latest4807e13＠yahoo.com 30 May '02

30 May '02

1 0

It could happen to you. Get your free EURO
by Honora7510v42＠nederlands.com 30 May '02

30 May '02

On January 1st 2002, the European countries began using the new Euro. Never before have so many countries with such powerful economies united to use a single currency. Get your piece of history now! We would like to send you a FREE Euro and a FREE report on world currency. Just visit our site to request your Euro: http://81.9.8.4/TheEuroExchange/ In addition to our currency report, you can receive: * FREE trading software for commodities and currencies * FREE online trading advice via email * FREE trading system for stock and commodity traders Find out how the new Euro will affect you. If you are over age 18 and have some risk capital, it's important that you find out how the Euro will change the economic world. CLICK NOW! http://81.9.8.4/TheEuroExchange/ $5,000 minimum investment Please carefully evaluate your financial position before trading. Only risk capital should be used. Investors can and do lose money. http://81.9.8.4/ListOptOut/ To OptOut 9951HwDa4-625vweV0443jpAs8-465zJPc7568Haei4-421YKlP6663uiAc1-209uEOJ9612NvxBl72

1 0

Re: When encryption is also authentication...
by Ian Grigg 30 May '02

30 May '02

> SSL for commerce is readily in place without batting an eyelid these days. Costs are still way too high. This won't change until browsers are shipped that treat self-signed certs as being valid. Unfortunately, browser manufacturers believe in cert-ware for a variety of non-security reasons. Hopefully, one day the independant browser manufacturers will ship browsers that show a different icon for self- certs, rather than annoy the user with mindless security warnings. Then, we can expect a massive increase in secure browsing as sites start defaulting to self-signed certs, and a consequent massive increase in security, as well as a follow-on massive increase in the sale of certs. Unfortunately, we probably won't see an enhanced market for CA certs until Verisign goes broke. > However, I'd be interested to know just how many users out there would enter > their card details on an unprotected site, despite the unclosed padlocks > and the > alert boxes. Huge numbers of them. You won't see it in security lists, but most of your average people out there do not understand the significance of the padlock, and when merchants request credit card numbers, they quietly forget to tell them. And, in a lot of cases, credit card details are shipped over cleartext email rather than browsers. Many of these merchants have card-holder-present agreements, the restrictions of which, they just ignore. Commerce being what commerce is, it is more important to get the sale than deal with some obscure security nonsense that doesn't make sense. > Have security fears and paranoia been abated by widespread crypto > to the point whereby users will happily transmit private data, whether > encrypted > or nay, just because they *perceive* the threat to now be minimal? Now that the > media has grown tired of yet-another-credit-card-hack story? Much of today's body of (OECD) net users don't read the news about the net and don't understand the debate, nor can they make sense of how to protect themselves from a site that is hacked... Three or four years back, much of the body of the net was still technically advanced and capable of understanding the fallacious security arguments. These days, perversely, the users are better able to evaluate the security risks, because they don't understand the arguments, so they look to the actual experience, which provides no warnings. > Pointers to any evidence/research into this much appreciated... ta. Unfortunately, real data is being kept back by the credit card majors. It is my contention that there has never been a case of sniffed-credit-card-abuse, and nobody I've ever talked to in the credit card world has ever been able to change that. On the whole, all net-related credit card fraud is to do with other factors: mass thefts from hacked databases, fraudulent merchant gatherings, fear-of- wife revocations, etc. Nothing, ever, to do with on-the-wire security. -- iang

2 1

Making Veri$ign rich(er)
by Ian Grigg 30 May '02

30 May '02

> Ian Grigg wrote: > > > Costs are still way too high. This won't change until > > browsers are shipped that treat self-signed certs as being > > valid. Unfortunately, browser manufacturers believe in > > cert-ware for a variety of non-security reasons. > [...] > > Jason Holt <jason(a)lunkwill.org> wrote: > > Self signed certs defeat the purpose of the certificate chain mechanism, which > is not just there to make Veri$ign rich. I understand that we are all working to make Veri$ign rich by pushing their cert-ware. Let me offer you a way in which we could make them richer. Believe me, they need our help. > Mallory can self-sign a cert for > bob.com, and hack Alice's DNS to point bob.com at her own site. But it's > (theoretically, anyway) much more difficult for her to convince Verisign that > she owns bob.com. If we trust Verisign to do that, then we know we're really > talking to Bob when we visit bob.com. What you describe above is an arcane theoretical attack. An MITM is an extraordinarily difficult thing to do. In practice, totally impractical in risk analysis terms. Its impracticality is because there are always easier pickings out there than conducting this attack. Consider the attack. You have to be able to so some spoofing, or some interception, or some hacking of critical infrastructures to do this. After all, you have to be able to insert yourself where Mallory needs to be in some sense, which means perverting the normal flow of packets. This is generally highly risky. It is also expensive and hard to control. Say you are attacking Amazon. If you pervert the DNS, as you suggest, you will have to be able to handle a lot of DNS requests. Also, there is a high chance that you will be noticed. Net techies and hackers and ISP people are looking at this sort of thing all the time. Now consider what you get: you can sit in the middle and manage some SSL traffic. So you'll need some capacity to sift through all the different sessions to snaffle the good data. At the end of the day, you'll be burning up a lot of CPU cycles to manage that traffic. (So you'll need access to some good sized hardware if you are attacking Amazon.) Finally, you manage to start farming those valuable CCs. Depending on how much hardware you've got that is managing the thousands of MITM sessions, you could pick up quite a bunch. But, if you do manage to get to the point of actually harvesting some CCs, you will by now have laid out such a road map that someone should be able to find you. So, you had better have a fast exit. Here's the thing: even if you get some, it wasn't worth it. Think like a crook. Any thing that you can do with SSL, you can do easier just by hacking into some poor NT box and accessing the database to read off the CCs. Then you get to walk away without leaving any tracks. Then you get the last month's takings, because the company already did the harversting for you. And, in practice this is how it goes. No thief ever bothers to do an MITM, even over *un*encrypted traffic. They simply hack into the machines and steal it all. That's why there has never been a case of CCs sniffed over the net and being used to commit a fraud (at least, no recorded ones). Change the analysis to small merchants, and it is even worse (of course Amazon will have a cert, so even its rich bounty is unavailable, you have to do this on small merchants). So, how do we make Veri$ign richer? Easy, switch browsers to accepting self-signed certs. To see this, we have to have tried or heard about small enterprises who have tried to set up their SSL certs. It's very expensive. Most don't do it. If we had the money we could ask Netcraft.com for the figures, but, last I checked, only 1% of servers have proper setups with proper certs. Why? because it is so expensive to set up. Most sites try and fail. They give up when they realise it isn't worth their time. So Veri$ign fails to sell the cert. And the site remains unencrypted, uncerted, unprotected only by the fact that nobody is watching. (Security by obscurity is indeed the greatest friend that we have, by actual saved amounts of money.) Now, if there was a halfway house, the site could at least be set up so that it is encrypted. Right there, is a big improvement in security. If we could do that, if we could encourage the browsers to accept the self-signed but encrypted web sites, that would let all the poor people in the world (the other 99% that can't afford all the hoo-haa of dealing with VeriSign and techies and ISPs and ...) have a go at setting up secure web sites. Secure by encryption that is. My guess is that it would get the number up to 10%. Why would that make Veri$ign richer? Because taking that 10% of encrypted sites would be a much more powerful target market. Veri$ign knows they care. Those sites just haven't got around to doing the work to get the cert set up. But they are encrypted. They are half way there. They want to be there! A decent, marketing approach to this user base would result in a pretty good conversion rate. We are talking 20-30% here, because we know they care. So, that expands the market for cert-ware by 2-3. Such doesn't work when you are dealing with a untargetted site base of 10 times that. All they have to do is understand that their MITM model, as learnt from the textbooks, does their market more harm than good. Sack the cryptographers, and employ some script kiddies to tell them what it is about. Should be worth a doubling of their share price. -- iang

2 1

Re: sources on steganography
by Morlock Elloi 30 May '02

30 May '02

> Why would I be interested in "fool[ing] [you]." All I asked was for some > help with sources. If you cannot be of help, at least don't be a I think that perception and sense of humour are sort of required for crypto work. ===== end (of original message) Y-a*h*o-o (yes, they scan for this) spam follows: Yahoo! - Official partner of 2002 FIFA World Cup http://fifaworldcup.yahoo.com

1 0