December 2003 - cypherpunks-legacy

Re: FV's Borenstein discovers keystroke capture programs!
by Jeremy Mineweaser 17 Dec '03

17 Dec '03

At 09:53 AM 1/30/96 -0500, Nathaniel Borenstein wrote: >As to how the credit card numbers are entered: they are entered at >account setup time via a telephone call. Then why should an attacker even bother to infect users' machines with your program? There is a much better way. Let me outline it for you: The keyboard sniffer can be modified to attach to the computer which holds your customer database. It simply watches for card numbers (which is even more trivial than doing so on the client's machine, as it's the only thing this machine does) and stores them. Then, when the attacker calls in to set up an account, the keyboard sniffer is alerted (by any of several methods, such as a specific, probably invalid, credit card number) and replaces this value with a card number that was previously captured. In this manner the attacker has obtained a valid FV account drawn on a valid credit card number of a real FV customer. This account can then be used to purchase various goods and services. And while it causes a similar degree of damage as your previous scheme, it also causes you to lose money in the process. Since you are the verifier (in the function of the bank) in this case, then you will lose out in the event of fraud. The credit card companies will still receive their money, and guess who will pay it: FV! This method has several other benefits over your previous scheme. Your scheme required infection of numerous computers; this scheme requires infecting only one computer. And while one may be held liable for the infection of the database computer, the person who opens the fake FV account cannot. All s/he has done is call you up and follow procedure. Even if he were dumb enough (as we know many criminals are) to give you his real card number over the telephone, it would not show up in your database. He would be completely clean... no trace. Furthermore, once the rogue program is in place, EVERY attack succeeds. As a corollary to this attack, the attacker could design his/her trojan to watch for the creation of new accounts and replace the intended FV_ID with another value created by a PRNG seeded by a known value. The attacker can then seed his/her copy of the PRNG with the same value and conduct valid (although fraudulent) transactions using the generated FV_IDs. With this approach he does not even have to contact your new accounts office via telephone; s/he simply implants the trojan and begins making transactions. This is similar to the above attack with regard to payment liability. --- Jeremy Mineweaser | GCS/E d->-- s:- a--- C++(+++)$ ULC++(++++)>$ P+>++$ j.mineweaser(a)ieee.org | L+>++ E-(---) W++ N+ !o-- K+>++ w+(++++) O- M-- | V-(--) PS+(--) PE++ Y++>$ PGP++>+++$ t+() 5 X+ R+() *ai*vr*vx*crypto* | tv(+) b++>+++ DI+(++) D+ G++ e>+++ h-() r-@ !y-

1 0

Re: Ernst Zundel impersonator on Usenet
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 0:24 1/29/96, Declan B. McCullagh wrote: >I'm not familiar with how AOL screen names work, but my guess is that >the Kingston, NY resident impersonating Zundel forgot to switch back >to his other screen name before posting. You have to log-off and then log back in to change use a different UserName.

1 0

DRU_mup
by John Young 17 Dec '03

17 Dec '03

1-30-96. TWP: "Defense Memo Warned of Israeli Spying." A DoD security office issued a confidential warning in October that the Israeli government was "aggressively" trying to steal U. S. military and intelligence secrets, partly by using its "strong ethnic ties" to the United States to recruit spies. It described Israel as a "non-traditional adversary" in the world of espionage, noting similar intelligence "threats" from other close allies such as France, Italy, Japan, Germany, and Britain. "Relaxed CIA Covert Action Rules Urged." A private, blue-ribbon task force is urging policymakers to consider allowing the CIA to resume sending out spies posing as American journalists or members of the clergy and lifting the ban on certain covert actions such as those designed to prevent terrorist attacks or support the overthrow of hostile regimes. DRU_mup

1 0

Re: Sad state of affairs
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:28 AM 1/30/96, bofur(a)alpha.c2.org wrote: >It's a pretty sad statement of how poorly this list is functioning when >the RC2 source can be publically released but people would rather >sling mud over glorified keystroke trappers and rant about Nazi deathcamps. > >Our friends at the NSA must be pleased with the slow death of this group. > >Sadly, >Bofur. Well, Bofur, the alleged RC2 code is, at most, "just another cipher." The issue of the Germans disconnecting from parts of the Net, as a means of pressuring sites to get material removed, and the bypasses (such as proxies and mirror sites at CMU, MIT, and Stanford), is just as important, if not more so. In any case, Bofur, if you want to talk about RC2, talk about it. Nobody's stopping you. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

[NOISY] Your own Zundelsite in five minutes or less
by Declan B. McCullagh 17 Dec '03

17 Dec '03

Here's how to open your own Zundelsite mirror archive in five minutes or less. To open your own partial Zundelsite (without the French text or audio files), first download the 1.3 MB compressed zundelfile from one of the following URLs: ftp://ftp.cs.cmu.edu/afs/cs/user/declan/ftp/zundelsite.tar.gz http://joc.mit.edu/mirror/zundelsite.tar.gz http://web.mit.edu/afs/athena/contrib/bitbucket2/zundel/zundelsite.tar.gz Compare against this checksum, that I've also placed in: [ftp://ftp.cs.cmu.edu/afs/cs/user/declan/ftp/zundelsite.sum.txt] MD5 (zundelsite.tar.gz) = 356cdf078f2a155af73a76663e25fe1a Then decompress the zundelfile, untar it, and register your URL with the Zundelsite Registry at: declan+zundel(a)andrew.cmu.edu. I'll add your site to my list of mirrors at: http://www.cs.cmu.edu/afs/cs/user/declan/www/Not_By_Me_Not_My_Views/censors… .html As of this afternoon, there are Zundelsite mirrors operating at MIT, Stanford University, Carnegie Mellon University, the University of Texas, and the University of Pennsylvania. -Declan

2 1

Re: New Mailing List (encrypted)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Sat, 13 Jan 1996 13:42:49 -0600, <perry(a)vishnu.alias.net> wrote: > I have installed PGPdomo on vishnu.alias.net. I've also >created a new mailing list that you can join if you wish. It's a >closed mailing list, so subscriptions must be approved. What makes If we have attempted to subscribe, but received no response, does that mean that we didn't get approved? If so, how can we "qualify"?

1 0

Domain hijacking, InterNIC loopholes
by rishab＠dxm.org 17 Dec '03

17 Dec '03

While filling in details for modification of my domain (dxm.org) I realised that I haven't seen much written on domain hijacking. We all know about mail spoofing, which let's you pretend you're someone else. Mail spoofing is one-way - you can send, but not receive. This is the same with IP spoofing, where you pretend to be a trusted machine, but again you can send but not receive. Unlike IP spoofing, which can lead to major security breaks (you can become root on someone else's machine), domain hijacking is not so much a security issue as a commercial one. Domain hijacking uses loopholes in InterNIC domain registration procedures to completely take over a domain, allowing you to send and receive e-mail, and other traffic such as ftp/www. As I haven't seen this explained, and have seen no warnings for sysadmins, here goes: To do 'IP hijacking' (receive packets as well as send) you will need to modify routing tables all over the place, where you're not likely to have access. To do domain hijacking, you would need to modify DNS entries in several nameservers, to which again you're not likely to have privileged access. On the other hand, if you could associate an existing domain with a nameserver you _do_ control (root access on any machine connected to the Net is enough for this), your lack of access to the present nameservers would become irrelevant. So, 1. set up a nameserver on your machine, with address, cname or MX records as required for the victim domain address - victim.com. You can do fancy things with nslookup on victim.com's existing nameservers to find out what's required. Make sure the MX, address and cname records in your machine point to machines under your control. 2. send a modify domain mail to hostmaster(a)internic.net, with your machine as nameserver replacing any existing ones. The InterNIC has no authentication procedures for normal hostmaster requests, so your modification will get processed. 3. Ta DA! Wait for InterNIC to update its records and broadcast changes to other nameservers. From then on, a lookup for victim.com will go to ns.internic.net, find that ns.evil.org is the nameserver, and send all mail to @victim.com to victim.evil.org, route traffic to www.victim.com to www.evil.org, whatever you want. This is not a security risk? No. But, to quote a delightfully low-key document from InterNIC, "[such] an unauthorized update could lead a commercial organization to lose its presence on the Internet until that update is reversed." Ah. But that update will be reversed only when victim.com's sysadmins realise what's happened. If evil.org is clever enough, it will not halt the mail flow, but forward everything on to victim.com (after keeping a copy, of course). It could act as a proxy server to www.victim.com, accessing all URLs (using victim.com's real IP address) on demand and relaying them to browsers who are actually looking at www.evil.org. And so on. Unless victim.com's admins are particularly observant, they may not notice a thing. How many sysadmins out there do what victim.com could have done? I.e. run nslookup on victim.com regularly to check that the nameservers listed are as they should be, and if they're not, to immediately send a new update to InterNIC? Not many, I believe. On the other hand I know no case of domain hijacking actually taking place. But I don't know specific instances of WWW credit card fraud either. That delightful InterNIC document I mentioned is the draft paper on the InterNIC Guardian Object, first out in November 1995, latest version out earlier this month. It's an internal InterNIC proposal for a "Guardian Object" which would guard any other object (such as a domain name, or individual, or hostname, or even another guardian). It would allow a range of authentication methods, from none (very clever) and MAIL-FROM (easy to spoof) to CRYPT (1-way hash, like Unix passwd) and PGP (using public keys stored at InterNIC). All domain and other templates will be changed to work with guardians. The procedures in the original draft looked easy enough; the latest ones are formidable. Incidentally, this draft appeared two months after the InterNIC started charging. The wonders of the profit motive. Rishab ps. I'm not quite back on the Cypherpunks list yet, so please Cc responses you feel are important to me at rishab(a)dxm.org. pps. I quite forgot. The URL for the latest Guardian Object draft: ftp://rs.internic.net/policy/internic/internic-gen-1.txt

5 4

Two bits, Four Bits, ETC
by Brian D Williams 17 Dec '03

17 Dec '03

BEGIN IBM LOTUS'S GAK'ED MESSAGE-- -----BEGIN PGP SIGNED MESSAGE----- Two Bits: frantz(a)netcom.com (Bill Frantz) >One other small advantage I can see to using Lotus's crippled >encryption. It disguises the fact that a message is actually >(double) encrypted with PGP. Attackers have to break the 40 bits >before they see the PGP encrypted data. A pecular kind of >steganography. (If you leave off the PGP header and trailer, it >may be hard to determine which 40 bits are the correct >key.) Excellent point Bill! Lets not forget that IBM owns Lotus Notes, be sure to include that in your bashing. They caved in on Lucifer after all. ;) Four Bits: On First Virtuals Sniffer program: Stick a VISA,MASTERCARD,DISCOVER, or AMERICAN EXPRESS sticker on the front of a SECURE_ID card Attack>null ( Security Dynamics is SDTI on NASDAQ ;) ) Six Bits: _TAKEDOWN_ by Tsutomu Shimomura confirms that Kevin Mitnick used PGP extensively, and encrypted his drives, expect the TLA's to use that in their arguments. (Head them off at the Pass!) A Dollar: For those who seem to have missed it. "Vladimir Z. Nuri" <vznuri(a)netcom.com> = Larry Detweiler Back to our regular Flamefest...... Brian -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQ5nd3sfmVh/uI7xAQFr7AQAjvjOZUEEJKdDmcVVWYFs/L20R3BIJYLC RhAOAyCh40GGiYzzvB8kHTGnu/iSE9cIp7AP2ifUHf1C9aL2TAQWuwxTROPMCwpX hSHN+UpJ5Au3YrNGZkMDPDVsGUM5EsWaaWJ2uczG330e3mZR6tBNU/BhfdS58RZy bLULdZno3nI= =kccs -----END PGP SIGNATURE----- END IBM LOTUS'S GAK'ED MESSAGE----

2 1

Re: The FV Problem = A Press Problem
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 9:03 AM 01/30/96, Timothy C. May wrote: [...] >But, it occurred to me, this is just part of the larger syndrom. Simson's >article was practically written from the FV press release. While he >interviewed some "security experts," clearly the timing of his article >(this morning) and the announcement by Nathaniel of his discovery (this >morning) suggests the cozy relationship involved. > >The larger syndrome is that software deals, alliances, mergers, and >problems are all based on hype. Nathaniel Borenstein issues press releases, >Sameer Parekh issues press releases, and maybe even I would issue press >releases if only I knew how to. [...] I'd say _all_ news, not just software news, is P.R. controlled, these days. You can largely hold Edward L. Bernays, the "father of public relations" (who just died last year) responsible for that--or the societal conditions that allowed Bernays to do his thing. Bernays developed expertise in "engineering of consent" turned the news into a commercialized and manufactured commodity. As the NYT magazine "people who died last year" blurb on him said, maybe once you could trust that the news you read was something that a reporter or editor independently decided was newsworthy. Now, the news you read is manufactured in press releases to sell a product, and is there because a well written press release convinced a reporter or editor that a marketting ploy was actually a newsworthy event (or, perhaps, because the advertising dollars that went along with the press release convinced him). Witness FVs demonstration of key capture becoming a newsworthy event. If you want to effect what's in the media, maybe you should learn how to issue press releases. > Journalists seem to love this, because the press releases write the > stories. Companies like it, too, because they can get free newspaper > space. Everyone is scratching each other's back. Yup. Throw the government into the mix too, and I think you've got a pretty good model of the media. -- "The conscious and intelligent manipulation of the organized habits and opinions of the masses is an important element in a democratic society. . . Those who manipulate this unseen mechanism of society constitute an invisible government which is the true ruling power of our country." -- Edward Bernays

1 0

why no FV defenders
by cman＠communities.com 17 Dec '03

17 Dec '03

[in response to Ted Anderson <ota+(a)transarc.com>, who wondered why cypherpunks are so unanimous in denouncing FV, when we are usually at each other's throats.] Most of the pile-on can be attributed to the fact that FV does _not_ really see encryption as part of the solution. Other than bits of lip service here and there in technical groups, they actively denounce it when they don't think anyone who knows better is watching (I've seen it with my own eyes at banking conferences, etc.) Their extremely supercilious attitude doesn't help either. The fact that their commerce model is skewed towards long-settlement, non-anonymous transactions of extremely soft goods makes them unsympathetic -- although, say, the Digicash people are just as condescending and certainly _more_ difficult to deal with on a business level, they have a product that is more applicable to transactions cypherpunks are generally concerned with, so they get pile-ons that are maybe half this size, and usually have some defenders. Also, clearly, Digicash and other vendors are involved in producing cryptographic products, whereas FV is actively involved in spreading FUD about the abilities of crypto products in general... this is sort of like advocating cat torture on rec.pets.cats and expressing amazement at the negative response. This is not to say that there isn't a problem with the current state of operating systems, especially PC operating systems, or to say that crypto is magic dust you can sprinkle & make things secure but I think there's a general belief here that the ultimate solution to these problems has a substantial role for cryptography, and that cryptography can be used even today to reduce risk to acceptable levels in consumer financial transactions. FV does _not_ believe either of these things, although I'm sure NB will pay some lip-services on the "eventually" score. ------ ------ Douglas Barnes "The tighter you close your fist, Governor Tarkin, cman(a)communities.com the more systems will slip through your fingers." cman(a)best.com --Princess Leia

1 0

Re: Crypto Exports, Europe, and Conspiracy Theories
by cme＠cybercash.com 17 Dec '03

17 Dec '03

At 11:06 1/26/96, Adam Shostack wrote: >Timothy C. May wrote: > >| You have to ask yourself this question: "Why are there no cryptographically >| strong products--finished products, not specific ciphers or chunks of >| code--developed in Europe and freely imported into the U.S.?" > > There are. If you buy a Gauntlet Internet firewall from TIS, >you can also buy a German T1 speed DES card for it. I believe the >code was written by TIS's London office. The Israeli Firewall-1 >(version 2) firewall offers VPN (Virtual Private Networks) with some >decent encryption scheme. The German company is CE Infosys -- and they make a PCMCIA DES card also, BTW. The PC card is a decent performer but I haven't tested speed (of the interface) for the PCMCIA card. The code driving the card was written in Glenwood MD. The Gauntlet uses normal SWIPE protocol. It can not be exported at this time. However, there is a plan afoot at TIS to produce a version of Gauntlet with full 56-bit DES SWIPE -- but with TIS CKE added to the communication stream and therefore making the product exportable. For more information, you can check TIS's web page www.tis.com - Carl +--------------------------------------------------------------------------+ | Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | "Officer, officer, arrest that man! He's whistling a dirty song." | +----------------------------------------------------------- Jean Ellison -+

1 0

ANNOUNCE: Experts Predict End Of Secure Communications (makes FV's announcement look pretty silly too)
by cjs＠netcom.com 17 Dec '03

17 Dec '03

EXPERTS PREDICT END OF SECURE COMMUNICATIONS (East Bumbleton, Arkansaw) Experts from Really Neat Idea Labs have predicted the end of secure communications on the internet. The firm today announced that anyone watching another person enter a credit card on a computer could possibly get that person's credit card number. A spokesperson for RNI Labs said, "Wow man! This is like an incredible discovery, man. If you can like see someone entering their card number then you can like look at what keys they push and like get their number and like charge stuff to them. There is like no hardware or software on earth that can like prevent it." The spokesperson went on to say that the reprocussions of their discovery could lead to world-wide economic chaos, a rebirth of the third reich, and the 27th coming of Jesus Christ. In a related story, retired talk-show host Johnny Carson is under federal investigation. An anonymous tipster told authorities that Mr. Carson has been using his "Amazing Karmack" hat to guess the credit card numbers of newly mailed cards. Mr. Carson could not be reached for comment.

1 0

Re: PPP link encryption?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:36 AM 1/30/96 -0500, Alexandra Griffin wrote: >Is there any software out there on the net for doing real-time, >transparent encryption of a PPP link? >... >Finally, could someone make a ballpark estimate as to the amount of >additional latency that would be added? Ballpark estimate: If the encryptor receives a complete packet before encrypting and forwarding it then there would be an additional packetSize/byteRate + encryptionTime seconds added to the packet's transit time. If the encryptor encrypts "on the fly", passing the bits of a packet as their are received, then it would add almost no latency. However, the encryption algorithms would be limited to stream cyphers, which have security and error recovery implications. See "Applied Cryptography" for details. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

Re: New Mailing List (encrypted)
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:21 AM 1/30/96 -0800, anonymous-remailer(a)shell.portal.com wrote: >On Sat, 13 Jan 1996 13:42:49 -0600, <perry(a)vishnu.alias.net> wrote: > >> I have installed PGPdomo on vishnu.alias.net. I've also >>created a new mailing list that you can join if you wish. It's a >>closed mailing list, so subscriptions must be approved. What makes > >If we have attempted to subscribe, but received no response, does that >mean that we didn't get approved? If so, how can we "qualify"? I have noticed that the software they are using is VERY picky about he formatting of the request and how it is encoded in PGP. To get it to work, I had to use the EXACT instructions posted to get it to subscribe. The PGPMajordomo software is a great idea, but in practice it has not been that fun to use. The biggest problem has been that the mail client I use does not do PGP that well. Hopefully the state of E-Mail support for PGP will change. Another project to add to the list... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ Is the operating system half NT or half full?

1 0

RE: FV Demonstrates Fatal Flaw in Software Encryption of Credi tCards
by David Van Wie 17 Dec '03

17 Dec '03

On January 30, 1996 hua[SMTP:hua@chromatic.com] wrote: >> the credit card companies in detecting fraud and locating criminals is >> quite real. > >Retail clerks are not lone bandits. My point is not that all retail clerks are bandits. Most are trustworthy, but surely any long time CC user has given their card to someone who would rip them off if they thought they could get away with it. My point is that CC #'s are not national security secrets, they are disclosed to potential adversaries regularly. >> Of course, since Federal law requires the credit card companies, not the >> user, to pay the costs of fraud, First Virtual's entire premise is a red >> herring. If the credit card companies are willing to take the risk, they >> will (and are). > >Federal law does not require that a company stay in business once it >has entered the banking market. The point is FV's post relies on a frightening and false premise - that the users are exposed to one or more financial risks by FV's keyboard sniffer threat. dvw

1 0

Re: Denning's misleading statements
by cme＠cybercash.com 17 Dec '03

17 Dec '03

At 20:49 1/27/96, Timothy C. May wrote: >I've never met Dorothy Denning, so I hesitate to characterize her as a >villainess. But certainly she's the only noted cryptographer I know of >who's gone so far out on a limb to defend a position the vast majority of >computer scientists, civil libertarians, and cryptographers scoff at. I've met some others -- most noteably Silvio Micali [but he has a financial interest in that position]. However, DERD is the only one I've met who is all the way over on Freeh's side. - Carl +--------------------------------------------------------------------------+ | Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | "Officer, officer, arrest that man! He's whistling a dirty song." | +----------------------------------------------------------- Jean Ellison -+

1 0

Reply Blocks and Nyms: newbie question
by bruce＠aracnet.com 17 Dec '03

17 Dec '03

I'm almost certainly going to be changing my address in the next few weeks. I'd like to keep the same nym account. Can someone take a stab at explaining how to feed the relevant info to C2?

2 1

RE: Cyphercoding Training Wheels??
by Michael E. Carboy 17 Dec '03

17 Dec '03

Greetings All, I have been lurking as a newbie on the cypherpunks mailing list for 'bout one month. Have ordered Koblitz book on Number Theory and Applied Cryptography. As I slowly (and probably painfully) learn some number theory, I would like to start coding, particularly as it would related to encrypting and decrypting stuff. I ask the community's input as to whether I should use visual basic or visual C++ ??? I am using a windoze95 platform. Any comments would be welcome.. thanks Michael E. Carboy carboy(a)hooked.net finger for key

2 1

Re: Lotus Notes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 20:25 1/29/96, Charlie_Kaufman/Iris.IRIS(a)iris.com wrote: >The Notes R4 approach gives the best of two fairly unpleasant worlds. You can >export crypto if you either limit yourself to 40 bits [...] > >Notes R4 didn't give up anything to get this. Of course Lotus gave something up for it. The voluntarily made sure that even the supposedly non-GAK domestic version provides relatively easy access for the authorities. Sixty-four bits are an inconvenience, but nothing more. If Lotus had wanted to make the domestic version GAK free, they would have used 128 bit. In the end Lotus caved in twice: they released a 'super easy' GAK international version and a not 'quite so easy' GAK domestic version. Sixty-four bits is GAK. Period. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: The FV Problem = A Press Problem
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tbyfield(a)panix.com (t byfield) on Tue, 30 Jan 3:49 PM > Chomsky took the phrase from a book by Walter >Lippman, published I think in 1922; the book's name >escapes me now. Would that be "Public Opinion?" If so, that's an interesting progression: Bernays to Lippman to Chomsky: PR begets PO begets ... How would the politico-linguist's advocacy be characterized, PR, PO or whatever is evolving parasitically from hegemonic, ever manipulative media? All the variations of MCI-MS-News-Oracles, global combos and recombos burgeoning and emerging. All the promising, braying, dreaming, lying, manipulating markets and investors reminds of Lippman's and Bernay's and Chomsky's warnings about evil-doers causing the sky to fall.

1 0

My mail to Nathaniel (was Re: Re: FV Demonstrates Fatal Flaw inSoftware Encryption of Credit)
by Paul M. Cardon 17 Dec '03

17 Dec '03

My mailer insists that Nathaniel Borenstein wrote: > Hello. I am Nathaniel Borenstein's automatic mail robot. I should have suspected as much. Hello robot. Nice robot. Busy robot. > > Your message is in the highest priority category of mail that was > not sent through the "urgent backdoor". Nathaniel WILL READ YOUR > MAIL SOON, most likely tomorrow morning. Busy Nathaniel. > THE "URGENT BACKDOOR": If your message absolutely cannot wait until > tomorrow morning, or possibly a bit later, please re-send it to the > address "nsb+urgent(a)nsb.fv.com". Please make note of the special > urgent address for future reference. Be warned, however, that > Nathaniel can tell me to override the "urgent" delivery for anyone > who regularly abuses it. You gotta be kidding. I just gotta see the response from this one. > Additionally, if you're someone he doesn't know, Nathaniel will NOT > ANSWER your mail if the answer is contained in the NSB FAQ. I can most assuredly aver that my comments and questions were not covered in the NSB FAQ. ;-) --- Paul M. Cardon -- I speak for myself. 'nuff said. MD5 (/dev/null) = d41d8cd98f00b204e9800998ecf8427e

1 0

Re: FV's Borenstein discovers keystroke capture programs! (pictures at 11!)
by Jeremy Mineweaser 17 Dec '03

17 Dec '03

At 04:39 PM 1/29/96 -0500, Nathaniel Borenstein wrote: >Well, the mis-conceptions are flying fast and furious. > >You're twisting our words. We believe it is a truly fatal flaw in those >internet commerce schemes that are based on software encryption of >credit card numbers. There are several schemes for Internet commerce >that are unaffected: > > -- First Virtual (of course) Question: Could you please describe the nature of the First Virtual protocol? Now before you tell me to RTFM, let me explain. I assume, although without absolute certainty, that in order to bill me you must know my credit card number. If you do not know my credit card number, and depend on someone else who does, you are nothing more than a middleman who introduces additional possibility for breach of security. If you do know my credit card number, you must deal with the associated problem of storing this number. Now perhaps I am wrong, and you really do keep all of your clients' card numbers in a printed book hidden within a safe, and for each transaction you remove the book, use your table to match FV_ID to CC#, process the transaction, and replace the book. However, I doubt this. More likely, you store the card numbers on a computer. And no doubt, someone or something enters those numbers into a database. You have just violated your own cardinal rule. Jeremy --- Jeremy Mineweaser | GCS/E d->-- s:- a--- C++(+++)$ ULC++(++++)>$ P+>++$ j.mineweaser(a)ieee.org | L+>++ E-(---) W++ N+ !o-- K+>++ w+(++++) O- M-- | V-(--) PS+(--) PE++ Y++>$ PGP++>+++$ t+() 5 X+ R+() *ai*vr*vx*crypto* | tv(+) b++>+++ DI+(++) D+ G++ e>+++ h-() r-@ !y-

2 1

RE: No FV supporters?
by Pete Loshin 17 Dec '03

17 Dec '03

Nathaniel seems to be defending his cause sufficiently well, and graciously answering the abuse. Some of the abusers are showing a fairly comprehensive lack of knowledge of the FV system. I would venture to say that FV has no more profit motivation than, say, Netscape--or how about Open Market? They who gleefully opened a "Here are the secure servers that haven't been hacked" page some time ago. That was pretty self- serving, wasn't it? Nor would I consider the FV brouhaha much more obvious than, say, the front page announcements about "NFS and RPC considered dangerous" that hit the big papers last year. The weaknesses of those protocols for internetworking have long been known to those working with TCP/IP. Now, clearly there are lots of opinions on FV's system, but if people like Sameer and Rich Salz (e.g., who have reputations as knowledgeable and aware) are going to trash FV it would mean a lot more to many readers if they could state more specifically what it is about FV that doesn't work (or that doesn't work as well as, say, SSL or CyberCash or Open Market's approaches). As for the Weld Pond/et al graphical clicking approaches, they may work and they may defend against some attacks, but I won't use it (too much clicking around, too likely to make mistakes) and neither will anyone without a GUI. My $0.02. -Pete Loshin pete(a)loshin.com Ted Anderson wrote: >I am rather shocked that after wading through hundreds of msgs of abuse >of Nathaniel and FV I haven't seen one message of support; but perhaps I >missed it. etc.

6 9

More FUD from the Luddites at FV [pt. 2]
by cman＠communities.com 17 Dec '03

17 Dec '03

People have been dealing with viruses and malicious programs since the dawn of PCs. (Before that even, really.) This is not news. A virus or trojan horse can do something much worse than the (possible) inconvenience of a "bad guy" getting your credit card number. Whether you're a business or an individual, having, say, your hard drive wiped clean by a virus would be several orders of magnitude worse than the relatively minor inconvenience of having to get unauthorized items deleted from your credit card bill. This is just as possible as the credit card scenario FV is painting, and PC owners have been dealing with this kind of threat for over a decade. Rather than focus on something as tame as credit card numbers, let's look at what else a malicious program could do if it had unlimited power over your PC: o Ransack your tax preparation files o Compress and transmit your financial information to your competitors or to Blacknet. o Capture the passwords and logins that you use while telecommuting o Use your dial-up bank-by-computer software to make unauthorized transfers. o Reformat your hard drive. The fact is, malicious programs are a threat that has been in the background for over a decade, and PC users with any experience to speak of are familiar with at least the rudiments of dealing with this class of problem. If anything, they're more familiar with this kind of threat than more network-specific threats. (Look at the huge sales of popular anti-virus products.) Sure, there are clueless people out there, but the solution is to help make them less clueless, not to stampede them in a panic, which is apparently FV's goal here. --doug Ernest Hua writes: >I'm quite amazed at the level of ... well ... how can I characterize it >without insulting too many people? ... arrogance? ... > >Many of you would be amazed at what motivates the average person to buy >or to use a computer. Most people, when asked about security, do not >even have a concept, let alone how it applies in a computer environment. > >There is far more misinformation and miseducation among the average user >than you might think. Not everyone understands why they need a modem in >order to get onto the Internet. Not everyone understands why you need >to sign up for an account with an ISV in order to get onto the Internet. >(You would be amazed at how many people think that just buying a modem >is good enough to get onto the Internet.) > >The response is typically, "I don't understand all that technobabble!" >"Just give me something that works!" "This is too complicated!" > >If you think that the dumb user should be left to fight for his/her own >survival on the information highway, you are easily condemning 75% to >90% of the current users. > >I am not entirely convinced that Borenstein is totally selfless in his >(or FV's) announcement. However, the basis of his argument, while it >may not apply to the cypherpunk community, has much merit in the real >world. > >Try helping 100 random people with computers. Bet you 90 of them have >trouble getting onto the Internet, period, let alone figuring how to >run Netscape. There is a reason why AOL/CompuServe do very well >caterring to those who are technically-challenged. > >Ern ------ ------ Douglas Barnes "The tighter you close your fist, Governor Tarkin, cman(a)communities.com the more systems will slip through your fingers." cman(a)best.com --Princess Leia

3 2

Re: FL Demonstrates Fatal Flaw in Logins
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:49 AM 1/30/96 -0500, Perry E. Metzger wrote: >Benjamin Renaud writes: >> The only events a Java applet is privy to are those that are typed in >> an applet window (and only those it itself spawned). > >Don't say "is privy". Say "is supposed to be privy". Doubtless bugs >will appear in java security in the future -- they've shown up in the >past. My bigest worry about Java security is the size of its "security kernel". Having a small, well defined, security kernel is a big advantage. All the better if the source is available for public review. Java has a large, and to me somewhat undefined "security kernel". (BTW - I havn't been able to find on the web pages the kind of overview of the libraries which would make the detailed method descriptions make sense. Perhaps I havn't looked in the right place.) ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0