December 2003 - cypherpunks-legacy

S.F. judge to rule on encoding software
by Jeff Weinstein 17 Dec '03

17 Dec '03

http://www.sfgate.com/net/abate/1021.html FYI. The above URL points to a SF Examiner article about the Bernstein case, including friday's proceedings. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

Re: NYT on Internet Flaws
by MDresser＠aol.com 17 Dec '03

17 Dec '03

In article <199510120347.UAA27336(a)infinity.c2.org>, sameer wrote: > > I completely agree that the reporters on this list make things > very difficult and people do need to be very careful about posting > things which will get misinterpreated by reporters.. etc.< FYI, the day after the Markoff piece ran in the NYT, The Baltimore Sun ran an article debunking it, based on independent reporting. Generalizing about reporters is about as intellectually valid as generalizing about hackers. Michael Dresser, who wrote it (speaking for myself, not my employer)

1 0

Verisign and MITM
by sameer 17 Dec '03

17 Dec '03

I recently submitted a certificate request to Verisign for my SSL web server. Looking over the process, I don't see how it avoids MITM in any way. The process: A) I send to netscape-cert(a)versign.com the email address and phone number of my webmaster (me) along with the cert request, generated using SSLeay's 'req' utility. B) I fax to Verisign a request letter saying "I have a right to use the name Commmunity ConneXion, etc." and proof of right to use name. (Berkeley biz liscense and Alameda Cty. fictitious bizname statement, in my case.) C) I snail mail them the same thing. I don't see any mechanism in place to avoid an MITM subverting step (A), and putting in his cert request in there. There isn't a strong cryptographic unforgeable relationship between my usmail/fax/proof request and the emailed kx509 cert request. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 1

Re: digital cash and identity disclosure
by Holger.Reif＠PrakInf.TU-Ilmenau.DE 17 Dec '03

17 Dec '03

Scott Brickner writes: >Andreas Bogk writes: >>But as far as I got Chaums idea, Alice would not reveal Bobs identity, >>but rather her own. Am I missing a point here? > >You're right. Tim's wrong. Bob can't spend the money Alice gave him >without depositing it in the bank and getting new money issued. Each >coin has "This money was issued to Alice" as an invisible imprint which >only shows up when two coins with the same serial number are together. I don't understand how this could happen? The two coins are identical (as I understood it from the tech backgound of ecash). what has a double- spended coin what a copied single-spended coin not has? Forgive if I missed relevant postings to this subject since I only read parts from the list offline. read you later - Holger Reif http://remus.prakinf.tu-ilmenau.de/Reif/

4 4

faxes are not secure
by an407769＠anon.penet.fi 17 Dec '03

17 Dec '03

BBC Discovers Faxes Are Not Secure (no shit, Sherlock) BLACKPOOL, LANCASHIRE, ENGLAND, 1995 OCT 19 (NB) -- The British Broadcasting Corporation (BBC) found out late last week that faxes are not a secure transmission system. After faxing a copy of a top secret internal management document to a BBC senior staying at the Pembroke Hotel in Blackpool, where the Conservative Party Conference took place all last week, BBC executives were aghast to discover that the fax was sent to the room of Nigel Nelson, a journalist with The People newspaper, who was also staying at the hotel. The mis-route for the fax was caused by the fact that Nelson had advised hotel staff that he was expecting an urgent fax, while the BBC did not notify the recipient that a fax was on its way. Reception staff at the hotel assumed that the incoming fax was meant for Nelson and passed it along to him. Like all good journalists, Nelson realized he had a potential scoop and passed along the story to the paper, which duly published details of the fax, along with a brief mention of how the fax came into its hands. The BBC, meanwhile, has complained loudly that the fax should have been dispatched to Colin Browne head of the BBC's corporate affairs office, who was hosting a reception for conference delegates at the hotel. The fax was send from Leigh Jackson, head of the BBC's Communication Planning office, and outlined management's worries over job losses and the potential effects of a likely strike if the British Government goes ahead, as many think it will, with privatizing the BBC's TV and radio transmitter network in the UK. The fax also allegedly said that the BBC would press the government to pass along at least some of the expected UKP100 million that the sale of the 1,400-strong transmitter network would generate, to the BBC as income for the state TV service. Neither the hotel nor the BBC is making any comment about the incident, but the paper claims that it ran the story with the interest of the public in mind and that how the fax fell into its reporter's hands was not its concern. In an editorial in The People newspaper, which was published on Sunday, Nelson said that "firing off secret faxes to busy hotels without someone ready to receive them is asking for trouble." Nelson went on to say that the story was printed, as it was in the public interest to know what the country's TV company was planning to do with its assets. In the UK, any TV owner or user has to pay the BBC a license fee of around $150 a year to receive any form of terrestrial TV transmissions. Nelson claims that privatizing the transmitter network, while not impinging on the BBC's operations itself, may not be in the public interest in the long run. "Privatization could lead to foreign companies muscling in on the most famous broadcasting network in the world," he said in his editorial. In a prepared statement, the BBC said that the document was not policy and was written by a junior member of staff, and therefore was not as sensitive as the newspaper had made out. "We were victims of technology," the BBC said. (Steve Gold/19951018) --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

2 1

Challenge: Hack Elementrix!
by Dana W. Albrecht 17 Dec '03

17 Dec '03

Everyone, I think that with all the recent attention to Netscape and Microsoft that another target has been altogether overlooked: Elementrix POTP <spit>. > New encryption method announced > > Sept. 29 -- Elementrix Technologies has announced a breakthrough in data > encryption that does away with the need for passwords and public/private > keys, instead working transparently at either an application or hardware > level. Using the One Time Pad method of encryption -- acknowledged for a > long time as being a superior encryption method -- Elementrix has released > both an FTP and E-Mail package that makes sending secure messages as easy > as just clicking a button. Its Power One Time Pad (POTP) technology > promises to ensure that in the very near future, the entire Internet can > become a fundamentally secure place. Elementrix is on the Web. http://www.elementrix.co.il/ Reposted from sci.crypt: In article <30803C0E.2781E494(a)unix.ka9q.ampr.org>, Phil Karn <karn(a)unix.ka9q.ampr.org> writes: > This announcement pegs my bogometer (a device for measuring bogons, > the elementary particle of bogosity). > > Readers of the Skeptical Inquirer and other similar publications will > recognize all the classic signs of a scam, either deliberate or > self-delusionary: > > 1. Breathless, overhyped language ("revolutionary", "breakthrough", etc) > > 2. Clear misstatements of well-established theoretical principles > (the discussion of the one-time pad) > > 3. Reluctance to get specific, usually by citing proprietary concerns. > When this is combined with a claim that a patent application has been > filed, this is a clear sign of bogosity -- one's patent > rights can be compromised only by publishing *before* filing, not after. > > Unless, of course, the claim is rejected by the patent office, > which is almost unheard of these days even for clearly bogus and/or > trivial "inventions". > > Phil While Elementrix has failed to provide any detailed technical information (specifications, source code, etc.) this is not entirely out of reach. You can obtain an evaluation copy of their "secure" FTP client from ftp://ftp.elementrix.co.il/pub/secftp/ This appears to be a binary for Microsoft Windoze. The server at ftp.elementrix.co.il is a "secure" server. Note: ftp> open ftp.elementrix.co.il Connected to ftp.elementrix.co.il. 220 sunex FTP server [Elementrix POTP(1.51) Secure FTP(1.5-3)] ready. Name (ftp.elementrix.co.il:dwa): anonymous 331 Guest login ok, send your complete e-mail address as password. Password: 230 Guest login ok, access restrictions apply. ftp> close 221 Goodbye. ftp> So there you go. Sure, commented source code with accompanying specifications for an implementation are nice, but did Ian and David have such luxuries for their Netscape hack? I will confess that I have not actually tried running their software, let alone reverse-engineering it, as I am Windoze-challenged (running on SunOS 4.1.x as we speak). However, I'm sure there are probably many people on this list with suitable Windoze platforms complete with the necessary reverse engineering tools. In many ways, Elementrix is a more enjoyable target. Their claims of security reek of more marketing hype than even Microsoft would stoop to, and their use of the term "One Time Pad" is disgusting. At least Netscape is trying to use respectable crypto algorithms and is being open about their code. These people deserve to flamed far more than Netscape (and even Microsoft) ever did. Perhaps someone could even convince Sameer to do T-shirts. I'll even agree to cover the cost of one for the first exploit. How about it, Sameer? :) Dana W. Albrecht dwa(a)corsair.com

3 2

Re: Polymorphic e-cash schemes was: digital cash and identity disclosure
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:03 PM 10/20/95, Hal wrote: [Bryce's proposal elided] >Unfortunately, in order for a coin to be POTENTIALLY spent in an off-line >way, the protocols require that the identity of the withdrawer be >embedded, in blinded form, within the coin data. It is this step that >Tim and others object to, because among other things it requires >participants to securely identify themselves to the bank, hence does not >work well in a fully anonymous society. The reason for this requirement >is that if the coin is double-spent, this is not found out until >afterwards, and so the identity of the cheater has to be available so the >bank can go after him. > >So letting the payee choose whether to deposit the coin right away or >wait until later will not address this basic privacy problem with offline >cash. Indeed. And let me clearly state that I am not proposing an either-or situation. In a real ecology of competing digital cash schemes, unconstrained by the software patent issue we now are facing, there would likely be "online clearing only" systems, "offline clearing only" systems, and various hybrids and variants. The market would then decide, based on transaction costs, convenience, security, anonymity features, etc. As with the "real" economy, where a variety of financial instruments coexist. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Verisign and MITM
by tcmay＠got.net 17 Dec '03

17 Dec '03

[ssl-users(a)mincom.oz.au deleted from the distribution, as I am not on that list] At 3:40 PM 10/20/95, sameer wrote: > I recently submitted a certificate request to Verisign for my >SSL web server. Looking over the process, I don't see how it avoids >MITM in any way. .... > I don't see any mechanism in place to avoid an MITM subverting >step (A), and putting in his cert request in there. There isn't a >strong cryptographic unforgeable relationship between my >usmail/fax/proof request and the emailed kx509 cert request. An interesting "direct demonstration" of this would be to get a certificate generated for a well-known company, institution, or political candidate. This would demonstrate the flaws in the e-mai/fax/snailmail process like nothing else. (Tangential note: Of course, my fear is always that exposing such flaws shows that "we need a national identity system." After all, what Sameer is describing is implicit in the fact that neither e-mail, nor a fax, nor snail mail, is proof that an entity exists, or that the paperwork represents the entity. That's a tough nut to crack, absent an "is-a-person" or "is-an-institution" credentialling system.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

big bust
by an407769＠anon.penet.fi 17 Dec '03

17 Dec '03

Feds Bust Huge Cell Phone "Cloning" Ring NEW YORK, NEW YORK, U.S.A., 1995 OCT 20 (NB) -- New York officials have cracked what they call "the biggest illegal cellular telephone cloning operation in the country" with the arrest of three individuals this week. If convicted the suspects could receive up to 15 years in state prison. "Cloning" is the process of retrieving the electronic serial numbers (ESNs) of legitimate phones off the airwaves and programming the purloined numbers into stolen phones. Thieves capture the numbers using special scanners placed near busy highways and airports. ESNs can also be obtained from stolen phones. Denver-based Secret Service agent Bill Bresnahan told Newsbytes the Secret Service is tasked with investigating cellular phone fraud, Bresnahan says investigative techniques include monitoring cell activity for an unusually high number of long distance calls, and the use of direction finding equipment to track down the illicit phones while they are in operation. US West spokesperson Wendy Carver-Herbert and Bresnahan say there are some steps that cell phone users can employ to help foil phone theft or catch thieves. They encourage cell phone users to step up the physical security they provide their phones. "If you are going to leave your car with a parking attendant or parked on the street for several days, remove the handset and the antenna to avoid drawing attention," says Carver-Herbert. She also recommends activating the electronic lock when you are away from the phone. They also recommend monitoring your cell phone bill closely. If you see calls you are sure you didn't place, contact your service provider immediately, and if your phone is stolen the company can block calls from that number. US West Cellular has programmed its computers to watch for anomalies in each customer's calling pattern as another way to foil this high tech crime, and the company employs security personnel to contact customers when calls fall outside the normal pattern. The New York raid seized cloning software, 46 cell phones and various equipment including computers officials said contained legitimate cell phone access numbers which when programmed into cloned phones allows the purchaser to illegally use cellular service without paying. They often make expensive long distance calls to other parts of the world. Officials said as many as 27,000 phones have been cloned over the last seven months and at least 3,000 usable legitimate access numbers were stored in the computers seized in the raid. Authorities estimate losses from the latest scam may have cost phone companies as much as $27 million. Cell phone service providers lose an estimated $1.5 million a day nationwide because of phone cloning. Authorities said it costs a thief about $50 to get a stolen cell phone activated with a cloned number. The phone can then be sold on the street for about $100. The Manhattan District Attorney, Robert Morgenthau, was particularly interested in this case. He said his own phone has been cloned twice by thieves recently. The first time the bill exceeded $3,000 and the second time more than $5,000 in calls were charged to his number. The legitimate holder of the cell phone number that is cloned isn't aware the phone has been cloned until the bill arrives. In an attempt to stop losses cell service provider Bell Atlantic NYNEX Mobile (NYSE: NYN) recently introduced the use of personal identification numbers, which the company said has cut phone fraud by an estimated 80 percent. The user punches in the unique PIN and presses the send button on the phone after dialing the desired number. Authorities say the cellular phone industry spends $5 million annually to stop sophisticated cellular phone fraud. (Jim Mallory/19951020/Press contact: Kim Ancin, 914-365-7573, or Jim Gerace, 914-365-7712, both of NYNEX) --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

Re: digital cash and identity disclosure
by Stephan Somogyi 17 Dec '03

17 Dec '03

At 12:20 21.10.95, Adam Shostack wrote: >Michael Froomkin wrote: > >| i would like to propose the following radical idea: Chaumian digicash is >| a nice curiosity. The future in the mdeium term (10+ years) for better >| or worse belongs to Mondex. > > Deploying hardware is VERY expensive. Expense of deployment for this type of scheme does not seem to be a consideration for banks; they stand to make a ton of money as a result. There are areas where banks will resist spending money on new hardware, but smart-card stuff isn't one of them. > 30m internet users at $100 (half hardware, half tech support) is 3 > billion dollars to deploy today. Secure commerce on the internet would > drive that 30m figure (which will probably double this year anyway) way > up. Adding hardware to a personal computer to read from and write to smart cards will cost money, but the majority of bank customers will not be interested in Internet-based transactions for quite some time. So while the potential market of Internet consumer financial transactors seems large, it is dwarfed by the sum total of bank customers who are likely to wind up with some form of non-pilot smart card-based payment system within the next 2 years. I've been told that a PCMCIA card that reads smart cards would around $30ish; I've not had the time to follow this claim up, so it could be off by a bit. Assuming it's accurate, the price doesn't present a significant hurdle to the typical PC-based consumer. And if there is enough demand, I'm sure that smart card readers will find their way into desktop and laptop machines over time. For example, Catapult's XBAND modem for Genesis and SNES has an ISO smart-card reader/writer in it; such a consumer device's manufacturing cost is sensitive to even a few pennies, so it can't've cost much to put it in there. I consider it much likelier that non-Internet specific payment systems will adapt to the Net, instead of Net-specific payment schemes seeing broad deployment. To clarify: I consider CyberCash and FV to be Net-adaptations of conventional schemes, rather than brand new payment systems. > Digicash doesn't need observer cards, which gives them a huge advantage. > If they ever sign with a real bank. There is a US law called the Bank Secrecy Act that defines the responsibilities of banks with regard to audit trails, record keeping, and disclosure of financial transaction information. After talking to quite a few people both in the regulatory and business realms recently, I am convinced that truly anonymous e-cash simply isn't going happen in the US. And the US is going to have considerable influence on how things go in the rest of the world; whether this is a good thing or not is, unfortunately, an unrelated and purely philosophical debating point. Based on my knowledge of the backing behind Mondex at this relatively early stage in the game, I am inclined to agree with Michael. _______________________________________________________________________ Stephan Somogyi Senior Editor Digital Media

1 0