December 2003 - cypherpunks-legacy

Re: Lotus Notes signature / encryption
by Charlie_Kaufman＠iris.com 17 Dec '03

17 Dec '03

>Could someone kindly tell me about the drawbacks of the Lotus Notes >signature / encryption system (export version)? I guess my first question would be "compared to what?". Compared to the Lotus Notes domestic version, the crypto is weaker in two ways. First, there is a backdoor by which all but 40 bits of each symmetric key is encrypted under a public key whose private half is known to the U.S. government. This encrypted value is included in all messages where the key is passed aroung. Depending on how you feel about breaking 40 bit keys, this means it is somewhere between easy and trivial for the U.S. government to eavesdrop on your communications It also uses 512 bit RSA keys for distribution of encryption keys, which makes it attackable by attackers other than the U.S. government. While no one has ever publicly demonstrated breaking a 512 bit RSA key (last I heard), the workfactor is well understood and it's clearly feasible (and in fact overdue). Compared to exportable versions of S/MIME or SSL, the crypto is considerably stronger. Against attackers other than the U.S. government (and even a paranoid would admit there are other attackers to be concerned about (e.g. the French government)), the workfactor to attack the symmetric keys is 64 bits - a little shakey but not the weakest link in most systems. Further, RSA signature keys are 630 bits, which is better than most exportable systems. Compared to non-exportable (but internationally available) systems, like PGP and strong S/MIME and SSL, the crypto is substantially weaker. Another aspect to consider is the strength of the PKI. Lotus Notes uses an organizationally based PKI, meaning that to a large degree your security depends on the trustworthiness and competence of your system administrator. With PGP, your security is under your own control to a much larger degree. For people who are more security aware than their administrators (as most PGP users are), the PGP PKI offers better security. For people who are less security aware than their administrators (as most Lotus Notes users are), the Lotus Notes PKI offers better security. Finally, a "drawback" that might be relevant to this group is the fact that because the Lotus Notes export version has a key-escrow-like backdoor, using it offers tacit political endorsement for the U.S. government's contention that key escrow is a technically practical compromise between the needs of users for privacy and the "needs" of government to know all the secrets of everyone on the planet. In my mind, this argues strongly in favor of using real strong crypto if that is an option, but using weak crypto as an alternative is offering tacit political endorsement for the even more dangerous contention that weak crypto is good enough. Your mileage may vary. --Charlie Kaufman (charlie_kaufman(a)iris.com)

1 0

Re: IP: "CyberCash can't oust credit cards"
by Dave Birch 17 Dec '03

17 Dec '03

Ryan Lackey said >I think resistance to new payment schemes on the part of a merchant is in >cost and effort to set up. Having a free apache commerce plugin which >handles >a variety of payment systems... What's wrong with this model is that it imports historical physical models that are irrelevant on the Net. Why does the merchant take payments at all? Imagine this scenario: you go into the Good Guys and buy a Walkman. The clerk gives you a ticket. You go round to your branch of Wells Fargo and get a cashiers cheque made out to the merchant, walk round to the merchant's branch of BankAmerica -- or BankBank, or whatever it's called now :) -- and deposit the cheque in the merchants account. BankBank gives you a receipt which you take back to the Good Guys and pick up your Walkman. Now, apart from all of the walking around, this is not a bad system. The Good Guys don't need cash registers, links to First Data etc etc. The Good Guys don't need to put up stickers saying "we take Visa", because the bank takes everything. The Good Guys don't care how you paid. The bank is much better placed than the merchant to handle the risks associated with payments and therefore the information asymmetries associated with the payment are significantly reduced (there's a good article about this in the Federal Reserve Bank of Atlanta's Economic Review, 1Q98). On the Net, there's no walking around. In the physical world, it clearly makes no sense for every bank to build a network out to every merchant: hence it makes sense to have physical payment instruments (e.g. notes, cheques) and credit/charge cards. On the Net, though, every participant is connected. When you buy a book from Amazon, what is the point of sending your credit card details to Amazon just so that they can send the details on to an acquiring network, third-party processor etc. Surely it makes more sense for merchants to have deals with payment agents (this is the model in OTP, Smart Access etc). When you press the button marked "Pay" on your browser, wouldn't it be more natural for a message to go to your bank than to the merchant? Thus, I get a "ticket" from Amazon saying "you owe $20 for this book". I pass the ticket to a payment agent (which may be a bank) and pay them (the negotiation being between my wallet and the agent"). The agent sends me a receipt to keep: I send the receipt to Amazon and they send me a book. Alternatively, perhaps the receipt let's me play Doom for a month or get ten upgrade to an item of software or whatever. All Amazon care is that the money has been paid: what do they care whether I used DigiCash or Mondex, Visa or MasterCard? You might argue that the merchant would discount for cleared funds (pay by Mondex and get 2% off) but I think that its frankly too much bother for them to work out N different prices by M different payment methods. I would imagine that just a merchants run loyalty schemes ("double points if you buy cornflakes") then so would payment agents ("double points for DigiCash") but each could operate their business independently. I would argue that the idea that merchants take payments is outdated. Since merchants don't care about cypherpunk favourites such as bearer instruments and anonymity, they'll be perfectly happy to have an acquiring account with BigBank and get a statement at the end of the month that details the payments taken and says "Money collected $1000, our fee $50, deposited to your account $950". Now, the merchant hasn't had to buy a commerce server, negiotiate 10 different acquiring agreements, implement SET or do anything else. Hey, so it's 5%: so what? Regards, Dave Birch. === mailto:daveb@hyperion.co.uk ===== http://www.hyperion.co.uk/ ===

1 0

Re: Rats in the Walls
by Reeza! 17 Dec '03

17 Dec '03

At 07:21 PM 02 07 98 +0200, Anonymous wrote: >"Reeza!" <howree(a)cable.navy.mil> wrote: > >> At 04:41 PM 02 07 98 +0200, Anonymous wrote: >> >and there are indeed safe havens elsewhere, >> > >> >"Educate, don't Agitate" >> > >> >> Tell me more,,, > >You and who's army? > What army? I'm in the navy, and I'm getting sick of it.

1 0

Re: Covert Access to Data and ID
by John Young 17 Dec '03

17 Dec '03

Froward From: Anonymous To: die(a)pig.die.com Cc: jy(a)jya.com Subject: Intel plans for world domination Date: Wed, 8 Jul 1998 10:51:04 -0500 Good afternoon gentlemen, I've been reading the correspondence on the possibility of govt keystroke access with some interest. I'm in a slightly odd position as I'm responsible for security in one of the larger wintel companies. As such I've been getting quite a feeling of deja vu reading your mails. Intel and others are moving in exactly this direction with a number of initiatives, most notably the PC98, PCXX, and "Wired For Management". WfM in particular is very scary - one of the components is a facility for PC's to download and run digitally signed software before the OS is booted - between "the end of BIOS initialisation and when control is transferred to a high-level OS" in the words of one Intel document. The code is verified by routines embedded in the BIOS and will allegedly use some subset of X.509v3 and PKCS#1. As so often happens in circumstances like this I can't risk passing documents directly as I can't be sure of their provenance - I really have no idea which ones are now considered trade secrets and which have been made public. Instead I recommend you have a look at the Intel WfM site http://www.intel.com/ial/wfm/ with particular reference to the "Pre-Boot Execution Environment" (PXE) and "System Management BIOS" (SMBIOS). The Microsoft pc98 site is at http://www.microsoft.com/hwdev/pc98.htm and the Intel one at http://developer.intel.com/design/pc98/. ---------- And, DM reminds of the DIRT program Ray Arachelian first posted here: There's an article on page 37 of the July 6, 1998 issue of NetworkWorld about a new software product for Windows machines that is basically a trojan horse that allows access to all keystrokes and files on a system from a remote "America's Most Wanted"-type HQ. I can't find the article online at www.networkworld.com, but you can go the the company's site at http://www.thecodex.com/dirt.html to see it. Sale of DIRT is "restricted to military, government, and law enforcement agencies", the article says.

1 0

Join StarDates.com, The Internet's Best FREE Dating Service!
by hizaici72＠prodigy.com 17 Dec '03

17 Dec '03

That's right! Stardates.com is the internet's best FREE dating service. No gimmicks, no free trials that expire, just FREE Click the link below: http://209.2.134.99/ and select JOIN FREE from the menu options to fill out our on-line application. All personal information is kept strictly confidential. We even have an anonymous email system to keep your email address private. So if your your looking to meet people, join Stardates.com Hey, what do you have to lose? Sincerely, Michael Sole Vice-President StarDates **************************************************** Bulk Email Advertising Works Best!! This Could Have Been Your AD !!! For Advertising Information Please Calll 1-510-653-4709 Evenings PST **********************************************

1 0

Jim Bell Message
by John Young 17 Dec '03

17 Dec '03

Forwarded from a long-time cpunk who received a call from Jim Bell yesterday. Jim asked that this message be publicized: 7/7/98 By this post he is publically accusing the Federal Government of having spied on him from two physical addresses. These are two houses to the North & to the East of his parent's house. The government moved in within 6 months (approx) of the time before his arrest. One of the addresses is 7217 Mississippi, which is listed as "Billy King", who died a couple of years ago. The house is ostensibly being occupied by his widow (or that is the impression). It is listed as being as owned by Alverna King, but he has his doubts. The other is address is 7302 Corregidor, purchased about 2.5 - 3 years ago by someone. Listed as being the address of Sundown Development, a small business company. A second floor was added soon after it was acquired by the company. They aren't listed as the owners on record, but they are listed as being at that address. Thinks this is a sham. The govmt was basically next door spying on him for at least a year, before it started provoking him. In response to his using the internet for freewheeling debate, they engaged in some bugging that is illegal under Washington State law. It is illegal to use bugging without the knowledge of the participants. He has developed a technique for identifying when someone is tailing him. Found this on Father's day when some people got a little too close to him. He drove to his Sister's party on Hayden Island in Oregon, and noticed the tails. Identified them as Rixen Marine, which he thinks is a sham, another front organization. One of the reasons he was arrested (though they're not willing to admit it) is because was way too successful in tailing _them_. A few more days and he would have blown their entire operation. He couldn't go into the details of how he found out these things. Did research & sophisticated observation. Will be getting friends to do searches in databases, etc. to gather more info to substantiate his suspicions. He said his recent arrest was on a probation violation charge - failure to pay a fine or something, wasn't clear on the specifics. There will be a hearing on his case this Friday the 10th. Prosecutors last year didn't know what the govmt was up to - not told of the spying (a "black operation"). Their method of spying on him are techniques which are possible, though rarely used. If people knew they would be very surprised. It will be a big story - big as Watergate - when it comes out. Their usage of these high-tech methods for access is difficult, so not used often. The government is trying to cover up their reaction to what he wrote in his essays. ------------------- <end of message>

1 0

Covert Access to Data and ID
by John Young 17 Dec '03

17 Dec '03

Dave Emery's remarks on government access to keystrokes (proposed by the NYT as an alternative to GAK) points to the probable increase of intrusive devices to counter increasing use of encryption and other privacy and anonymity measures. This topic comes up here now and then, with mentions of a slew of methods to protect privacy of data during transmission or storage. But the possibility of logging the initial creation or manipulation of data is not as often discussed, nor how to tie a person to the data, as now being asked in legal and law enforcement fora to identify, catch, convict and jail computer culprits. That the NYT floated the idea surely means someone is testing public response to an idea that seems to be more intrusive than GAK: the logging of initial data and any manipulation of it, prior to encrypting, and maybe including a means to link the actions to the user. If this is logging (and related retrieval) is done covertly, encryption could thereby become a falsely reassuring cloak of privacy. Dave thinks devices like these are surely in the works, and he can say more about their sponsors, technologies and implementations. One driving force, as he previously noted, is the desire for devices to assure copyright protection, backed by the WIPO treaty, which now being considered for approval. See the House report on it at: http://jya.com/hr105-551.txt (141K) And the EFF and ACLU opposition to it: hr2281-opp.htm Other forces, though, are employers who want to snoop, law enforcement, government, marketers, actually the same groups who dislike privacy protection measures, but often prefer to snoop covertly while loudly proclaiming support for privacy. Thus, the more general question Dave has raised is how widespread is the development and implementation of technolgies for covert surveillance on the Web and in desktop boxes -- happily spreading quietly while attention is focussed on the very encryption which it will circumvent? And what are these devices, or what might they be, what might be countermeasures and who might be working for and against them. SDA must have insights to share. Over to Dave Emery and those more knowledgeable. For those who missed his earlier message we've put it, with a follow-up at: http://jya.com/gaks-de.htm

4 3

U.S. relaxes licensing grip on encryption
by Xena - Warrior Princess 17 Dec '03

17 Dec '03

(From the Mercury News, see subject line) http://www.sjmercury.com/business/center/encrypt070898.htm It's a start, at least.

1 0

A Mirror - 'Don't be blue if you should be green'
by StanSqncrs＠aol.com 17 Dec '03

17 Dec '03

Sorry, that server that address I gave you on earlier seems to be all locked up, so I created a mirror, check it out, Stan, The Desecration of 'The Dark Side of the Moon' http://members.aol.com/RealityWal/DarkSide/darkside.html

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I made another page, which details what Capital records did to Dark Side of the Moon when they reissued on cd. Guess what they covered-up. :-) Check it out, Stan, The Desecration of 'The Dark Side of the Moon' http://members.tripod.com/StanSqncrs/DarkSide/darkside.html

1 0