December 2003 - cypherpunks-legacy

GTE and Cylink ATM Crypto
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

GTE & Cylink Team On Encryption For ATM Washington, D.C., 31 January 1996 -- During a press conference last night at Comnet, GTE and Cylink unveiled InfoGuard 100, a jointly developed offering billed as the first encryption system able to work with ATM (asynchronous transfer mode). InfoGuard 100 is meant to provide the security needed to induce business and government to use ATM public networks, said Michael M. Guzelian, GTE's marketing director for broadband systems, speaking at the press conference. GTE is the number one provider of encryption to the federal government, while Cylink holds a 70 percent share of the commercial encryption market, according to Kamy Kavianian, senior product marketing manager at Cylink for SecureWAN. GTE and Cylink will also jointly market the new ATM encryption system. "The deal (for InfoGuard 100) is mutually exclusive, but we don't know anyone else who can do it," noted Jeff Callo, Cylink's director of business development. InfoGuard consists of two main components, according to the officials. An ATM adapter from GTE provides ATM interfaces and cell processing and control functions. Cylink's CIDEC-VHS contributes "high-speed data encryption and decryption," in addition to physical security and "full automated key functions." Kavianian told the journalists that InfoGuard 100 is based on DES encryption. Users of InfoGuard will foil "key exhaustion," a method used for breaking encryption codes, if they "change their codes frequently," Guzelian added. Essentially, CIDEC-VHS has turned out to be "the first encryption method fast enough to keep up with ATM," Guzelian maintained. The agreement between Cylink and GTE represents "an excellent example of coopetition," Callo said. --

2 1

Re: [rant] A thought on filters and the V-Chip
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"frissell(a)panix.com" "Duncan Frissell" 29-JAN-1996 11:02:03.09 >What parents are attempting to do when they restrain their children's access to "sex and drugs and rock and roll" (or Republicanism for that matter) is to mediate their "spiritual" environment to keep them from becoming hardened. They know the kids will grow up, they just want them to grow up in a nice way. ------------------- From what I've seen, kids are better off when they don't see the world through blinders/rose-colored-glasses. For instance, benign neglect is a lot better for children than overprotectiveness... I wish my parents (as much as I love them) had applied it to me, I'd have turned out a lot better. (I am also getting information from multiple psychiatrists and psychologists, including ones who (unlike me) have raised children). ------------------- >Children who listen to Vera Lynn's singing and Cole Porter's songs will end up quite different from those who favor louder, less vocal music. Note that in spite of what liberals might think, fundamentalist christians are less likely to divorce, less likely to report spousal beatings, less likely to kill themselves, and more likely to measure high personal satisfaction ^^^^^^^^^^^^^^^^^^^^^^^^^^ levels on standard psychological tests than are, say, readers of The Nation. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ------------------- Well, yes, someone with a blind conviction that they're going to someplace nice when they die, confidence that their intolerance is right, and other such ideas tends to have higher personal satisfaction levels. Also, this "personal satisfaction" is overrated... as Jack L. Chalker pointed out, a blade of grass is perfectly happy... even after it's picked. ------------------- >The cypherpunks relevance of all this is that it should soon be possible to create completely mediated environments for ourselves and our children. Through the use of implants and real-time VR processing, it will be possible to edit our "interface" with the Real World such that unpleasant aspects are edited out. We will be able to change the attire, hair, facial expressions, voice, and even smell of those around us to conform to our own esthetic desires. Likewise with our physical surroundings. Safety may discourage making a complete transformation in one's surroundings, but one can certainly soften the edges. --------------------- Sasha's enhanced reality or whatever it was called, yes. The cypherpunk relevance would appear to be more that there should be methods to get true information to kids (and those under repressive governments, which is about the same thing in most families) despite attempts to stop it. Anyone for posting (anonymously) some image viewers and pornographic site locations to one of the k12 groups? -Allen

1 0

Re: Escrowing Viewing and Reading Habits with the Governmen
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"trei(a)process.com" 29-JAN-1996 14:32:19.64 >The general reaction of the library community was, I am glad to say, entirely pro-privacy. -------------------- To their credit, yes. One application of this that others may be interested in is that ILL requests (I have been told) come from a library, not from a library's user. Thus, when I made one and got it back from the CIA's lending library (yes, they have one), they didn't know who I was... fortunately, given the book in question. Sort of a lesson for things like sites, et al. If all that someone can tell is that a IP or whatever request came from a particular site, then traffic analysis and other such things are disrupted. One way to do this would be to set up fictional accounts automatically to serve as proxies (relayed to the real account), which would make it impossible for a normal proxy-detector (lack of information or a particular set of information) to filter them out. -Allen

2 1

Nautilus?
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi. I was wondering if some of you ever used Nautilus, if it was good, if it has a backdoor, etc. I am not knowledgeable enough to inspect source by myself. Any comments? Since the topic was probably discussed extensively, feel free to reply to me directly. Regards to all cyphering punks! JFA Why, you might wonder, is it that civil servants never look out through the window in the morning? What would they otherwise occupy themselves with in the afternoon?

1 0

CRAX Mix Rax
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

European Commission Moves To Stamp Out Racism On Internet Burssels, 31 Jan 1996 -- The European Commission (EC) has formed a pan-European group to "encourage the mixing of people of different cultures" from both inside and outside Europe. According to EC officials, the first task of the Consultative Commission on Racism and Xenophobia (CRAX), as it is called, will be to investigate and, using legal means, stamp out the current wave of racism on the Internet. In a prepared statement, CRAX said that it hopes that the EC "will take all needed measures to prevent the Internet from becoming a vehicle for the incitement of racist hatred." EC officials are soft-peddling on what legislation they plan to enact to back up the investigations of CRAX. Currently, apart from France and Germany, there is no specific anti-racist legislation. The laws of France and Germany were created in the aftermath of the Second World War in order to prevent the rising of the so-called "Fourth Reich," an extremist group which posts messages on the Internet, as well as running Thule bulletin board systems (BBSs) in Germany. According to EC officials, the Thule BBSs, which first appeared in 1991, started spreading the Neo-Nazi word on the Internet in late 1994, having established themselves as a means of information exchange in Germany and, to a limited extent, in France. As reported previously, the "Thule Network" first came to the public's attention when the January, 1994, issue of Chip magazine (a popular computer monthly in Germany) claimed to have unearthed eight Thule BBSs. According to Chip magazine at the time, "The (Thule) network distributes information on demonstrations and invitations to meetings, addresses for contacting parties and groups, and it reviews and offers books and magazines. One of the mail-boxes contained instructions for producing military explosives and letter bombs. A great deal of space is taken up by 'political discussions' among the users." Thule is Norse or Viking terminology for "top of the world." The Thule Network's name actually derives from the small, elitist 1920s movement which was considered to be the Nazi vanguard. Thule movement leaders included Rudolf Hess. Some BBSs on the Thule network have names such as "Wolf Box" and "Resistance," while many Internet messages are signed by people calling themselves "The Wolf," among other names. --

2 1

Re: Crypto-smart-card startup Inside Technologies
by jim bell 17 Dec '03

17 Dec '03

At 12:30 AM 1/31/96 -0800, Peter Monta wrote: >There's an article in the January 29 _EE Times_ about a French >cryptographic-smart-card startup called Inside Technologies. >Tidbits: > > ..."In public-key cryptography, 512-bit keys are typical and > already vulnerable. So we are looking at 640-bit-long keys > supported by a scalable design." This kind of thing disgusts me. We already know 512-bit keys are weak. As I recall, I was told that 512 bit keys could be cracked in 20,000 MIPS-years. If the ballpark formula holds that adding 10 bits doubles the security, that merely means that 640 bits is 2**(128/10) or 8000 times strong. While obviously better than 512, it is not ENOUGH better to make me confident that this is a long-term secure length. 768 or 1024 bits should be considered the minimum. A deliberate design of 640 bits makes it look like it's intended to be crackable in 5-10 years, much as DES was suspected of a similar design decision in limiting its keylength to 56 bits.

2 1

Online Libel Rules
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

UK - New Rules For Online Libel Called For Wokingham, Bershire, England, 31 January 1996 -- CompuServe, Europe Online, and Microsoft Network (MSN), have banded together to lobby the British Government for a clear definition of the legal rules for online libel. In British law, libel is defined as a defamatory statement. Because of the "new" nature of online services, however, online libel is treated as something of a gray area as regard legal issues. In a joint submission to the Lord Chancellor's department, the three online companies claim that online service providers typically cannot control the content of messages that users of their services or the Internet, send. The companies are recommending that the online service provider not be held responsible for libels statements made online, unless the service provider has "reasonable notice" that a libels statement has been transmitted on to its system, and "has the ability and the authority to prevent" its publication, but "fails to do so" within a reasonable time. According to Andrew Gray, European business manager with CompuServe, the Chancellor's Department is currently conducting an extensive review of UK libel law to deal with a number of current problems. Based upon this review, the Government is expected to introduce new libel legislation this spring. "We applaud the Lord Chancellor's Department's efforts to bring the defamation law up to date. We hope that the upcoming legislation will deal effectively with the problem of libel that takes place over an online service or the Internet," Gray explained. Andreas Breijs, manager of Europe Online, meanwhile, said that online services are not like traditional newspapers or magazines. "These services are more like a railway train, where the operator may own the passenger cars, but has no idea what the passengers may be saying to each other, and no way of controlling their conversations," he said. Judy Gibbons, manager of Microsoft's MSN operating in the UK, said that the major online providers work hard to run responsible services. "They should not be penalized for the actions of unrelated individuals who might happen to make libelous statements using their services without the knowledge or consent of the service provider," she said. Alistair Kelman, a lawyer specializing in information technology (IT) affairs, said that he was not surprised by the online services' request to the Lord Chancellor's Department, especially given the current situation. "There is no case law on this subject and it is likely that a test case will come sooner, rather than later. The Government is keen on a clarification on the issue, as it is itself publishing a lot of its information on the Internet, in the move towards a more open and IT-relevant Government," he explained. Peter Sommer, an IT security specialist and Fellow of the London School of Economics, said that, far from being just another publishing medium, it was important that people understand that the Internet is very similar to a telephone line. "If I libel someone over the phone, you're not going to involve the telephone company, are you? It's the same with the Internet and some online services. Of course, if the online service has the ability to remove someone's comments and does not do it, then it's a different matter and that is what the definition by the Lord Chancellor's office is all about," he said. --

1 0

Active processes monitoring?
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi! I'm running on a first generation 486 ISA 4meg ram Win 3.11 I use realdeal /commercial and wipeswap.exe in an *.bat that launch Win3.11 How can I detect if another process is running on my system? I use MEM /c in a dos window. But is that sufficient? Can a hidden process detect MEM loading and hide itself somehow? Are there others applications like MEM that are not as universal? (here, I guess that such stealth behaviour have to rely on identifying the program being loaded, thus, a less common program has less chance of being fooled) Thanks JFA

2 1

parallel encryption
by Simon Spero 17 Dec '03

17 Dec '03

Ok, so I've got my BeBox and so finally have an SMP of my own again; anyone want to suggest any cool crypto stuff that parallelises well? Rogaways hashs look interesting, and nDES offers an obvious process network for pipelining, but what about things like running multiple interleaved CBC streams in parallel, with each stream starting off from a different IV? I can't think of any practical ways of speeding up a single RSA operation, although twice as many processors obviously gives twice the thruput. Simon ------ "GM spent $3.6 billion giving birth to the Saturn, and it doesn't even go supersonic." - Ben Rich, Skunk Works head (75-91)

2 1

Re: The FV Problem = A Press Problem
by vin＠shore.net 17 Dec '03

17 Dec '03

Mr. Bornenstein's press release ("FV's position on Merc article") was egregiously self-serving and embarrassingly over-inflated. Yet, First Virtual's CC-focused keyboard sniffer ("...a program which completely undermines the security of every known credit card encryption mechanism for Internet commerce") and his postulated widespread stealth attack on unprotected consumer PCs highlighted an obvious -- but oft forgotten, at least in non-CompSec circles -- vulnerability. An encrypted link is only as secure as the CPUs at either end. Not an unimportant consideration as we plunge into Internet commerce; and surely a valid point for one vendor to make, if it suggests unrecognized risks in a competitor's scheme for consumer purchases and payments. Borenstein is handling his inevitable mugging in C'punks with zest and considerable aplomb; even including an apology for submitting his sensationalistic attack on crypto-based competitors to this List. Before folks leap from FV's text to damning the San Jose Mercury New's articles by Simson Garfinkel, however, they should pause and read or maybe re-read Garfinkel's three articles. <http://www.sjmercury.com/clips/> Mr. Garfinkel is probably the single most technically-literate journalist writing about computer security for mainstream (or trade press) media. His Mercury News article is precisely focused on FV's initiative in developing this demo program (a trojan screen saver) and the campaign by the Southern California company to use the demo to illustrate a relatively unguarded aspect of Netscape's SSL-protected credit card transactions, which have been widely touted as the be-all of Network Commerce. It was, as Garfinkel bluntly put it: "a direct attack against the security promised by Netscape Communication Corp.'s popular Netscape Navigator..." Mr. Borenstein later expressed his regret that Garfinkel had cast the story as a competitive attack, but IMNSHO Garfinkle was right on target: the FV campaign was a targeted bombardment of their most prominent competitor. And a campaign it was -- well deserving media attention. FV apparently carted their demo code and attack model back and forth across the country. FV gave presentations to NIST, NSA, the US Treasury, and the White House, according to Garfinkel. The only silly comment in Garfinkel's article was a direct quote from FV's Bornenstein: "One of the things we've heard from people inside government were comments along the line, 'We thought only NSA knew how to do this....'" (And if a world-class CompSec/UNIX expert like Garkinkel wasn't chuckling when he wrote that -- and expecting knowledgeable readers to giggle and grin when they read it -- I'll stew and eat my beaver hat!) The Merc's quotes from independent security experts -- commenting on FV's attack model -- were notably dry and balanced. Yes, the attack and threat vectors were real -- but, noted the American Banker's Association's Kawika Daguio: "It is a classic attack." "I've seen it, and I've seen things like it before," said Mr. Daguio. Nothing new. Matt Bishop, the UC prof, also sounded less than awed by FV's creativity: "There is no reason why one could not write a program to monitor keystrokes, look for numbers which look like credit card numbers, and sent them out over the Internet," in an unobtrusive way, to a thief elsewhere. (Prof. Bishop might have had more to say, had he been told it took a FV programmer a _month_ to write a keyboard sniffer optimized for credit card data;-) As a newcomer to this List, I have the impression that C'punks are a little jaded when it comes to mass-market CompSec and ComSec threats -- and perhaps a little rabid when it comes to anyone rash enough to suggest that the first mass-market crypto product (in the hands of naive consumers, with unprotected PCs and poor CompSec habits) may have dangerous procedural vulnerabilities. A little perspective, guys! Crypto from an insecure base has risks that deserve to be highlighted; and credit cards numbers are uniquely negotiable passwords. FV is scare-mongering, sure -- but that's combat marketing. Mr. Borenstein's press release posted in C'punks was chumming with raw bloody beef -- and that was just dumb -- but it was striking how blithely many folks here acknowledged (and immediately dismissed) the threat he described. Nothing wrong with FV trying to slow the bandwagon of a major competitor by drawing attention to vulnerabilities or potential vulnerabilities of their technology in a mass market. This happens a lot -- although most corporate perpetrators try to hide their hand a lot more than FV did, and they generally sound a lot less self-righteous -- but a little brawling is not a bad thing, particularly in IS security. (Some markets, like firewalls, desperately need a little more competitive clarity.) On the other hand, Mr. Borenstein's hyper-inflated presentation of First Virtual's case all but begged for the C'punk lynch mob that has followed him down through several threads on this List. If he didn't expect the reception he got, he should fire his PR advisor and get someone who knows how to write without the purple prose and napham. Simson Garfinkel and the Mercury News are getting a bad rap from folks caught up in the mob chasing Mr. Borenstein. Read the three articles. The on-line version has a headline that is a bit overwrought ("Program shows ease of stealing credit information") but overall, it's a credible, savvy, and amusing piece of journalism about FV. Quite professional, I'd say. Suerte, _Vin Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

FV has 91 day lag between sales and payment
by Vincent Cate 17 Dec '03

17 Dec '03

FV seems to be the only Internet payment mechanism that lets buyers quickly open an account and use their credit card to cover purchases. Anyone know of any others? The FV 90 day lag is their main downside in my opinion (though defaulting to not paying if the customer does not answer email is another problem). So FV does not take any risk at all - and a merchant has to have enough extra capital to let 3 months worth of sales sit at FV. Some ideas for ways that they or someone else could improve on this: 1) reduce the 91 days after a merchant had been a merchant for awhile 2) reduce the 91 days when sales were to long time customers 3) verify customers with letters/phone calls when opening the account and then with digital signature on sales - and give very short clearing time -- Vince ---------- Forwarded message ---------- Date: Wed, 31 Jan 1996 15:11:02 -0800 From: morehelp(a)fv.com To: vince(a)offshore.com.ai Subject: <960130/vinc0328078> (Lag between sales and payment?) Your question has been answered by a help operator for FIRST VIRTUAL (TM). The operator assigned to your question is op106 (Christopher Arndt), That operator, or someone consulted by that operator, has provided the following answer to your question: ---------------- Hello, We put an escrow hold on a seller's money for 91 days to protect ourselves from buyer credit card charge backs. We realize this can be inconvenient for some of our sellers, but at this time, that is how the system works. Federal Regulation Z of the Credit Card Regulations entitles credit card holders to a 90 period during which they can charge back any purchase. Though buyers are obligated to return the goods, this does not always happen. The credit card company is obligated by federal law to pay the buyer back, and it is the merchant who is left without payment. In our system, because it is First Virtual that has the merchant credit card account, not you, First Virtual is at risk of losing money when your buyers issue charge backs on your sale items. Because we do not conduct any credit checks on a seller, and because any buyer can charge back any charge, if we didn't protect ourselves with this 91 day hold, we could easily fall victim to charge back fraud. But once 90 days have passed, it becomes significantly harder for a buyer to make a charge back. And it is at this point that we feel that the risk of a charge back is sufficiently low that we can deliver your funds to you. We hold your money for 91 days for our protection, but the flip side is that we allow our sellers the freedom of being allowed to sell without having to go through a credit check. Virtually anyone can sell using First Virtual, and this opens up many possibilities for people who otherwise would not be able to sell products through major credit cards over the Internet. Thank you for your interest in First Virtual -- ************************************************************* ...one flew east, one flew west, one flew over the cuckoo's nest... Christopher Arndt First Virtual Holdings carndt(a)fv.com http://www.fv.com ************************************************************* ---------------- You may communicate further with our operator by replying to this message. If you are unhappy with the service you get from operator op106, you may send mail to "helpescalator(a)fv.com". Your original question is included at the end of this message. Thank you for using FIRST VIRTUAL!

2 1

France to push for international net legislation
by bofur＠alpha.c2.org 17 Dec '03

17 Dec '03

According to radio reports here, the French government has just announced it's intention to pressure the European community to create international laws to control the Internet. This is in the wake of the net publication of a certain book that had been heavily censored in France. Does anyone have any more details - has an actual policy been put forward stating how they intend to control the net? And what do/will the laws cover? Bofur. -------------------------------------------------------------------------- Bofur bofur(a)alpha.c2.org PGP available from PGP key servers Key fingerprint = 81 0C 8F 88 0A 4F 67 3F ED 52 DE 3C 55 34 26 25

1 0

Questions about Anonymity, and the FAQ
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:00 AM 2/1/96, Anonymous wrote: >Are anon remailers the only way to send anon email without giving up the >source eventhough an organization has a wealth of dough/technology and >several class B addresses? Couldn't they just trick their mail servers or >would a nslookup/whois defeat that? "Trick the mail servers" is not a cryptographically strong approach...it is just a variant of "security through obscurity." In terms of "work factor" (a measure of the number of bits of protection, and thus the amount of work an opponent has to undertake), the various "Port 25" sorts of hacks are ridiculously easy to break. Maybe not for everyone (for example, moi would have no idea how to break it!), but for determined and knowledgeable adversaries, easily breakable. The Chaumian mix, semi-realized in Cypherpunks-style remailers, are the best hope for cryptographic security. >And are nym accounts the only way to receive email without giving up who >the intended recipient of tha mail/news post actually is? No, public message pools are an easy way to do this--it's what I used for my BlackNet experiment. Tell your sender to encrypt to the public key you provide--which isn't your key you usually associate with your true name!--and to post the resulting cyphertext in, say, alt.anonymous.messages. Since only you can read it, but no one knows who is reading the messages in alt.anonymous.messages, the implications are clear. I address many of these issues in my Cyphernomicon FAQ, available in various ways, including the Web URL of "http://www.oberlin.edu/~brchkind/cyphernomicon/". --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: The FV Problem = A Press Problem
by vin＠shore.net 17 Dec '03

17 Dec '03

Greg Broiles <gbroiles(a)darkwing.uoregon.edu> opined: >NSB's messages have suggested, amongst the fear-mongering, that the real >target of the card-shark publicity campaign is not Joe Consumer but bankers, >investors, and other "big money" folks; people who care about the >large-scale fraud rate of credit card use. <snip> True enough. Of course, those are the folks who take the weight when credit card sales go sour... or the system is victimized by widespread automated fraud. >While, as Vin McLellan points out, Simson Garfinkel's articles were >technically accurate (modulo the quote from Daguio, where he's quoted as >suggesting an "out of hand" transaction, which is likely either a typo or a >misunderstanding - dollars to donuts he said "out of band"), they also >appeared as part of a marketing process. Actually, the most striking thing about the Garfinkel articles was the degree to which he made the First Virtual marketing/propaganda Campaign against consumer-PC-based credit card encryptors _the focus_ of the Mercury News articles. FV's attack-code demo was overtly presented as a propaganda ploy -- "a direct attack" on Netscape's security model -- by Garfinkel. There was nothing in the Merc text that carried the hysterial pitch of the press release FV posted to C'punks; nothing of the pious Crusade to Save Electronic Commerce that set everyone teeth on edge. FV's Stein and Borenstein were presented as competitive businessmen, out to rough up a competitor who had been getting too much uncritical attention. (The long sidebars on FV's technology are what you'd expect for the Mercury News' coverage of a local SoCal contender.) The Murky News' "Chief Scientist, FV" quote -- Borenstein recalling audiences in the White House, Treasury, etc., who declared, "We thought that only the NSA knew how to do this." -- was absolutely priceless. Everyone who didn't need a ten-page memo to supply the technical and historical context got the giggle. It's the Quote of the Week in Silicon Valley and NoHo. Deftly, with a straight face, Garfinkel left Nathaniel standing there with his pants down, wondering where the draft was coming from. (Mr. Borenstein, no slouch on-line, has faired far better in his give and take among the Cypherpunks -- who in their rabid majority only wanted to lynch him.) >....the implication of the Murky News articles, that one [FV] can be >trusted but not the >other.... <snip> >It's a shame that Garfinkel didn't spend more time/column space on >suggestions or observations from the independent people he interviewed and >less time on the "hot news - Netscape security broken by a competitor" >angle.... <snip> Your observations had me wondering if we read the same articles. My thought: would that all snow jobs were handled by journalists with the same dry perspicacity! >We should, however, learn from what FV did right - they wrote software which >(apparently) had or can have a real political effect. (It seems to have >worked on Garfinkel, anyway). Cypherpunks write code? FV wrote code and got >some attention for their otherwise unexciting message. <snip> Now _that's_ a useful and on-target observation. Suerte, _Vin Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

Re: France to push for international net legislation
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:27 AM 2/1/96, bofur(a)alpha.c2.org wrote: >According to radio reports here, the French government has just announced >it's intention to pressure the European community to create >international laws to control the Internet. > >This is in the wake of the net publication of a certain book that had >been heavily censored in France. I guess Declan M. won't be visting France or any of the other EU countries any time soon! --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

re: More FUD
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

>The degree to which the attack you describe is a threat to online >commerce depends critically on the degree to which viruses and Trojan >horse programs can propagate through their potential base of platforms. Have to interject a comment: even real professionals (which virus writers are not) have trouble getting software to work on on machine, let alone all of the different platforms out there. Windows is worse (ever try to write a .VXD - not easy). Take Michelangelo (please) is a member of a class of viruses the is very difficult to detect: you have to read one word at 0:414 from DOS to know something is wrong. True, in early '92 when [Mich] came out things were more difficult - not everyone had 640k in their machine so the user acurally had to have a clue how much memory was supposed to be there. Today is there anyone with 512k ? Detection has *always* been easy, it is removal that is difficult and *automated* removal that is even more so - know what it takes to determine that there is a macro that might be a virus in a WORD document ? One bit. (Of course things are made a bit more difficult by the fact that MicroSoft considers that bit's location or even its *existance* to be "proprietary" and requires an NDA before they will discuss it - I refuse to sign it). In recent months I have had all sorts of software blow up in Windows. On this machine alone (a 486DX-100 w 8 Mb of RAM & Win 3.1, 1 Mb SVGA and nothing special), Reachout 5.0, FTP Onnet 2.0, QEMM 8.0 (Windows Manager), and several name brand programs have required massage to get to play together - and these are the programs from people I consider expert at what they do, in fact each is IMNSHO the best in their class. And you tell me that someone is going to spread a virus on the net that will capture keystrokes on any machine it hits without anyone noticing ? It is to laugh (and if they can, they are wasting their time with credit card numbers). (Did I mention that the documentation those signing the M$ NDA have been receiving has been *wrong* ?) Not going to say you could not make one machine act that way - that is easy, not even going to say you won't make a number of machines act that way, but spread with a virus enough will self-destruct on enough machines that intelligent people will get suspicious and some will react creatively. Fact is that the greatest protection the net has is that no two machines are alike, may even start that way but after six months, no way. Warmly, Padgett

2 1

RE: Netscape encrypted email!!
by Miguel Saraiva 17 Dec '03

17 Dec '03

I believe the new microsoft exchange (from msdn level 3 ) also has some sort of security built in. Haven't tried yet. (It needs (?) Exchange Server for it ) >> * Integrated email - Netscape Navigator 2.0 offers full-featured and rich >> email capabilities, allowing you to both read and send secure email >> messages without launching an external email application. >I downloaded it and checked it out. But it was not clear how to use this >secure email - so it may lack something yet in user friendlyness, or I may >have just missed it. Anyway, it should be much easier to use than PGP. >Are we all going to switch to Netscape for email? Is anyone using this? >Want to tell us how? > -- -- -> Leon : Miguel Angelo Saraiva : msaraiva(a)marktest.pt <- -- -- -- Vince

1 0

FV's blatant double standards
by rishab＠dxm.org 17 Dec '03

17 Dec '03

I only just managed to go through my mail backlog and read Simson Garfinkel's original Mercury News article. I was appalled by FV's double standards in evaluating security risks. Both First Virtual and real-time transaction models (without encryption, or with it e.g. Netscape) require that the recipient not be compromised. FV relies on e-mail (domain names); Netscape relies on IP addresses. IP addresses are much harder to intercept than domain names (which can be hijacked - see my earlier posts). This essentially means that while e-mail can be mis-routed, IP packets can't. Additionally, plaintext e-mail as well as IP traffic can often be sniffed along the way. FV demonstrated, through it's "card sharp" or whatever, that real-time transactions are vulnerable to sniffers on the recipient's own machine. Of course. We all knew that. But the mistake is to assume that FV isn't _equally_ vulnerable to that threat. If you can write a trojan that will somehow get privileged access to my machine, trap my keystrokes, and identify my credit card number, you can certainly write one that will, sitting on my machine: "intercept the user's electronic mail, read the confirmation message from First Virtual's computers, and send out a fraudulent reply" (to quote from Simson's article). Simson further quotes FV's Lee Stein: "A single user can be targeted, Stein said, but ''it is very difficult. . . . There are too many packets moving . . . to too many different machines.''" - which is of course equally true for real-time Netscape transactions. Simply put, if there's a program sitting on your computer with privileged access, it can read your mail, hide it from you, and reply, as easily as it can read your keystrokes. Even simpler: if there's a privileged program on your machine, NOTHING IS SECURE - not SSL, not FV, not plaintext credit cards, not PGP, NOTHING. This is old hat, and FV has shown nothing new with its one-sided stunt; the only reason there has been little hype recently about card-sniffing trojans is that trojans and viruses and the rest of their ilk have being dying of exposure in the media, ever since the Internet Worm grabbed headlines years ago. Rishab

1 0

Re: PGP commercial usage
by take＠imasy.or.jp 17 Dec '03

17 Dec '03

At 0:43 PM 96.1.31 +0000, Dave Roberts wrote: >I have read and reread the documentation that is included with the PGP >distribution (although my copy is over a year old now), and am still >trying to work out if commercial use of 2.6ui is allowed outside the USA. > >Could someone elaborate for me, or perhaps point me to some up to date >reference documentation. Few days ago I found good page for it. http://www.ifi.uio.no/pgp/FAQ.shtml#License This page said that: + Can I use PGP 2.6.3i for commercial purposes? + + Yes, you can, but you need to buy a separate license for the IDEA algorithm used in + PGP. (RSA is not patented outside the US, so you don't need a license for this + algorithm.) IDEA licenses can be purchased from Ascom Systec AG in Switzerland. + (The licensing of the IDEA algorithm was formerly administrated by Ascom Tech, but + this responsibility has been transferred to Ascom Systec. Please, do not contact + Ascom Tech about this matter!) The fee is charged on a per-user basis as follows: # Sorry, this is about 2.6.3i, not 2.6ui. P.S. Now I'm studying MacPGP... - Tsuyoshi Hayashi <take(a)imasy.or.jp> --- hayashi(a)scs.sony.co.jp is no longer valid. --- Please update to take(a)imasy.or.jp

1 0

Re: France to push for international net legislation
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:27 PM 1/31/96 -0800, sameer wrote: >> I guess Declan M. won't be visting France or any of the other EU countries >> any time soon! > > That reminds me of a question-- > > If, for example, Germany decides that my company is in >violation of their laws for mirroring the Zundelsite, will they send >us a letter saying that, so we know not to go to Germany? Don't worry. If you actually *read* the Zundsite materials, you find out that the guy who was busted in Denmark and sent to Germany just jumped bail and is in Florida. No prob. The German penal system is a joke. DCF

1 0

Re: your bogus post
by Paul Graham 17 Dec '03

17 Dec '03

marketing works, and companies have to use it to stay profitable. I would not mind if fv made bogus claims in their press releases. People expect that in press releases. But I think that they should keep their press releases on their web site, where we can ignore them, instead of disguising them as "discoveries" in netnews. So, what do you think of their product? No client or potential client of our online mall has ever asked us to implement fv payment. Everyone seems happy with credit cards. I think that the people at fv could see what was happening, and this ill-considered post was a desparate attempt to make everyone take fv seriously. In my case it had the opposite effect. -- pg

1 0

Re: Apology and clarification
by Eli Brandt 17 Dec '03

17 Dec '03

In a nutshell: FUD Virtual's press release glosses over the hard part of the attack -- distribution and collection. Yes, the credit-card system is broken as designed, but that's already reflected in its cost structure. The proposed attack will never make up a significant fraction of credit-card fraud. You know, FV should put out a press release warning that all encryption-based payment systems are insecure, due to the threat of the proposed "Chinese-lottery virus". Bet you could get the Times to print it... In article <+cmu.andrew.internet.cyclists+0l3TCU200UfA00z5cl(a)andrew.cmu.edu>, Nathaniel Borenstein <nsb(a)nsb.fv.com> wrote: >When you put all four of these together, you have an attack that IS new, >in the sense that nobody we know of has ever mentioned it before, Who would bother? Ask yourself if you'd have been quite so excited about this "new attack" if you were just Nat Borenstein, private citizen, with no financial interest in a competing technology. >and which could in fact be used by a single criminal, with only a few >weeks of programming, to tracelessly steal MILLIONS of credit cards, >if software-encrypted credit-card schemes ever caught on. You wave your hands and say that "consumer machines are insecure", but I don't think you have any conception of what it would take to get your trojan onto "MILLIONS" of machines. There is no historical precedent for such an attack (no, Ping-Pong and Stoned don't make the cut). Your suggestions of such things as rogue GIF viewers aren't even in the ballpark. What fraction of the victims will expose their credit card numbers? what fraction will notice your trojan and warn against it? The ratio has to be very, very large. >and get them back to the program's author by non-traceable >mechanisms. I didn't see the part where you explain how this works, either. >If not, I think it's worth noting that this fact was previously >completely unknown to the bankers and businessmen who are putting >large sums of money at risk on the net. The only way to get the >message to those communities is with a very visible public >announcement of the kind you saw yesterday. You wouldn't have shot your reputation so badly if you weren't so damned disingenuous about the whole thing. Paragraphs like the above really irritate me. -- Eli Brandt eli+(a)cs.cmu.edu

1 0

Visa & MC Std
by ponder＠mail.irm.state.fl.us 17 Dec '03

17 Dec '03

just heard this on NPR Friday am on the east coast of NA. http://www.nytimes.com/library/cyber/week/0201internet-safety.html February 1, 1996 Group to Unveil Industry Standard for Electronic Payments ---------------------------------------------------------------------- Forum Join a discussion on Computers and Society: On-Line Economics. ---------------------------------------------------------------------- By JOHN MARKOFF AN FRANCISCO -- Hoping to remove a major impediment to credit card transactions over the Internet, a business group led by Mastercard International and Visa International plans to announce an industry-standard technology Thursday for protecting the security of electronic payments. The new technical standard brings together previously warring camps -- one led by the giant Microsoft Corp., the other by an Internet software upstart, Netscape Communications Corp. The standard, which industry executives expect to go into commercial use before the end of the year, is intended to give merchants of goods and services in cyberspace the convenience of a single, universally employed means for protecting the privacy of on-line credit card transactions. And for customers, the new technology promises a much higher level of security for electronic purchases than has previously been available on the Internet. The new approach "is more secure than the system in use in the physical world in which you give your card to a waiter in the restaurant," said Mark Greene, vice president for electronic payments for the Internet division of IBM, which is one of the companies endorsing the new standard. To the extent that the end of this technology face-off gives a lift to electronic commerce, Netscape can only benefit, since it is the provider of the leading software used for "browsing" the Internet's World Wide Web and for conducting on-line transactions on the Web. Netscape is already on a financial roll, announcing fourth-quarter revenue Wednesday that was nearly double the level of the previous quarter and profits that exceeded analysts' expectations. "This will make it a lot easier for consumers to buy and sell things electronically," said Taher Elgamal, chief scientist of Netscape. "We won't have to face the issue of competing standards." Netscape will be working to incorporate the new technology into its Navigator Web-browsing software. Microsoft, in turn, will be adding the technology to its Explorer software, which competes with Netscape's Web browser. The software standard, called Secure Electronic Transactions, or SET, will permit a user to send a credit card account numbers to a merchant in a scrambled form. The scrambled number is supposed to be unintelligible to electronic eavesdroppers and thieves -- and even to the merchants receiving the payment. But a special code is supposed to enable the merchant to check electronically and automatically with the bank that issued the credit card to make sure that it is a valid card number and that the customer is the authorized user of the card. The number-scrambling part of the system is based on a well-known and widely used national software standard known as the Data Encryption Standard. Besides being added to Netscape's and Microsoft's Web browser, the SET technology would need to be incorporated into Internet server computers -- the machines that function as storage terminals and gateways that individual users' computers interact with on the global computing network. Testing of SET will begin this spring, according to Dick Lonergan, executive vice president of Visa, who said that commercial service was expected to begin late this year. Currently, many powerful types of encryption technology are barred from export because the government fears that foreign enemies or terrorists may be able to conspire electronically. But the new credit card security standard will not be subject to such strictures, its developers said, because it is designed to protect only financial information -- not electronic messages or other types of computer documents. In addition to Mastercard, Visa, IBM, Microsoft and Netscape, the other big organizations endorsing the new SET standard include GTE Corp. and Science Applications International Corp., a technology and military consulting business. Two other backers include Terisa Systems Inc. and Verisign Inc., both Silicon Valley companies that have developed some of the underlying technology for the SET standard. Last September, Microsoft and Visa together proposed a security standard known as Secure Transaction Technology, which would have competed directly with a system being developed by a group led by Mastercard, IBM and Netscape. Shortly afterwards, however, Visa and Mastercard -- the two largest credit card associations -- said publicly that they would pursue a single standard to avoid forcing merchants and consumers to choose between competing technologies. "We took the best of both technologies," said Edward Hogan, senior vice president for electronic commerce at Mastercard International. "There was a blip in the road, but both associations realized that their memberships wanted a single standard." Home | Sections | Contents | Search | Forums | Help Copyright 1996 The New York Times Company ----------------------------------------------------------------------

1 0

RE: FV Demonstrates Fatal Flaw in Software Encryption of Credi tCards
by David Van Wie 17 Dec '03

17 Dec '03

On January 30, 1996 nsb[SMTP:nsb@nsb.fv.com] wrote: >> Of course, since Federal law requires the credit card companies, not the >> user, to pay the costs of fraud, First Virtual's entire premise is a red >> herring. > >Actually, you're wrong here too. It is the banks, not the credit card >companies, that carry the risk. Changing the subject doesn't change the point. Your announcement implies that users are liable, and that is incorrect. This is misleading, and in my view, reprehensible. This was the point of my post. The fact that the fraud is traceable when detected should have been self evident. If your post has said "Financial Industry Should Watch out for Keyboard Sniffers" as a *potential* threat for which the risks should be weighed, that would have been different. Arguably farfetched, but different. Your post relies on people's ignorance of their rights with respect to credit card liability, and therefore is shameful. dvw

2 1

Re: Time codes for PCs (fromn German Banking)
by jim bell 17 Dec '03

17 Dec '03

At 11:42 PM 1/29/96 +0100, JR(a)ROCK.CNB.UAM.ES wrote: >From: SMTP%"jimbell(a)pacifier.com" 27-JAN-1996 03:43:05.83 > >>A peripheral I've long wanted to see, commonly available: ACCURATE time, >>broadcast to the millisecond/microsecond/nanosecond, available from sources >>as varied as TV VIR's, FM subcarriers, and other sources, available as an >>easy input (via a peripheral card) to a computer. >> > Yup! Do you think it is really possible? If I remember well >speed of light is 300.000 Km/s. That means that light takes around >1 ms. to cover 300 Km. If you use a satellite, antenna, whatever >to broadcast a timing signal, the accuracy will depend on when >do you receive it, and that in turn on your distance from the >source. <sigh!> I am well aware of the facts you indicate, and many more of which you aren't even aware. But one of the functions (in fact, the basic, intended one) of GPS is to locate, as precisely as possible, the exact location of the receiver. Thus, time delays can be compensated to the accuracy of the location fix, at the very least. If we assume 100 meters error, max, that's about 300 nsec error. (GPS receivers AUTOMATICALLY compensate for such delays!) >>I have a 12-year-old Heathkit "Most Accurate Clock" that I assembled myself, >>and had the foresight to install it with its computer interface option. >>(receives 5, 10, or 15 MHz signals broadcast from Boulder, Colorado, >>containing "exact" time.) >> > Just remember that the best you can get would be microseconds if >you're in a 300 meter radius, or milliseconds on a 300 Km. And possibly >nanoseconds at 0.3 m. Well, this clock doesn't pretend to be better than about 5-10 milliseconds even in signal-locked condition. However, there is a dipswitch on the bottom of the unit, settable in 500 mile increments, from Boulder, Colorado. 500 miles corresponds to 3 milliseconds. Clearly this was a good device when made, but has obviously been supplanted by at least a factor of 1000 by GPS. > Then remains the cypherpunk part on all this: how can you >trust the *signal* your receptor receives? How do you know no one is >interferring it or sending an inaccurate or false one? Simple answer: You don't. More complicated answer: Most such devices don't merely input the time signal, but they use an accurate internal clock to maintain good time when signals go away. In fact, the best units "discipline" the local oscillator, either actually changing its frequency or at least following its errors over time. The result is that sudden errors would be noticed. A good TCXO is stable to well better than 1 ppm. > And that on a broadcast system. A system owned by someone who >you may not trust (say a private TV channel, radio or satellite). So >you may want to have several sources, and to be able to verify that >the signals you receive all come from their respective sources. Well, since "everybody" in one locale can receive a particular (local) TV channel, one solution might be to compare time with respect to the beginning of a particular scan line.. You may not trust the signal, but you know its a signal that "everybody" receives. There may be no other provision for adding time to it, but a relatively low accuracy crystal oscillator could identify particular frames, etc. > Yum! a nice problem to think about. One factor is that you >wouldn't expect changes in public sources used by sensible systems >since those could not pass unnoticed and might raise big protests. >But you still have the MITM attack to consider...

1 0