December 2003 - cypherpunks-legacy

Re: Basic Flaws in Internet Security and Commerce
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

A fine piece of work. The ideas expressed in this paper should scare the hell out of everyone who uses NFS for any serious applications, which for a fact includes most banks and all investment banks and brokage houses. In this particular area I KNOW what is at risk. Again, I congratulate the authors on a first-class effort. cheers, paul > From owner-cypherpunks(a)toad.com Tue Oct 10 03:15:15 1995 > From: gauthier(a)espresso.CS.Berkeley.EDU (Paul_A Gauthier) > To: cypherpunks(a)toad.com, bugtraq(a)crimelab.com > Cc: gauthier(a)cs.Berkeley.EDU, brewer(a)cs.Berkeley.EDU, iang(a)cs.Berkeley.EDU, > daw(a)cs.Berkeley.EDU, fur(a)netscape.com > Subject: Basic Flaws in Internet Security and Commerce > Date: Mon, 09 Oct 1995 14:26:06 -0700 > Sender: owner-cypherpunks(a)toad.com > Content-Length: 10235 >

1 0

Java=?
by Daniel Miskell 17 Dec '03

17 Dec '03

Being a newcomer to this list, and having read a lot of java-related messages without understanding them fully, could comeone explain to me exactly what java *is*? Thanks for your time, ahead of time. DMiskell(a)envirolink.org --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________ "Oh $HI+, here comes a flock of pushers - 'Jungle Edition.'" -Mortifer Nex, playing peek-a-boo in the trees "If you've got the coordinance, we've got the ordinance to blow up the loved ones who blow you off!" -Uncle Dan's Thermonuclear Explosives, Unlimited

1 0

Baltimore security conference, opening session
by Mike Rose 17 Dec '03

17 Dec '03

I attended the opening session of the National Computer Security Conference this morning. Actually it's been renamed to "Info systems something-or-other", but I don't recall what. The opening session is NIST's opportunity to take center stage, which they did. The most interesting information to come out of the session was that the govt is still pushing very hard for key escrow. Most of the speakers mentioned key escrow, and talked about the need for business and govt to compromise to meet the needs of law enforcement blah blah blah. The "distinguished awardee" is Dennis Branstad, his speech was read by Steven Walker. In it, Branstad claimed that key escrow is a great gift being provided by the government to the private sector, and that companies want it a lot. Stuart Katzke from NIST said that "our" goal (where "our" is computer security professionals) is to deploy secure systems, but he believes that "we" often lose sight of that goal. Said that govt and industry need to find compromises so that both can meet their goals and get systems deployed. I belive he mentioned export laws and key escrow as areas for potential "compromises", but am not certain; if not stated it was implied. My interpretation is that he claims those who object to key escrow are getting in the way of deploying secure systems. Someone, I don't recall who, pointed to the european "interest" in key escrow, saying other govts might not allow systems to be deployed without key escrow, thus key escrow was a good thing. Mike

1 0

Re: Certificate proposal
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:04 AM 10/9/95 EDT, Carl Ellison <cme(a)TIS.COM> wrote: >>I don't understand this whole discussion. A certificate is a signed >>binding of a key and a unique name, right? >It depends on how you define certificate. If you define it this way, then >I'm proposing the elimination of certificates (because I'm eliminating the >unique name as something different from a key). > >If you define certificate as I do -- as a bound statement of some attribute >of a key, then it should become clearer. It's just that the attribute I'm >binding is not some unique person-name -- rather something like permission >to spend money from a bank account. This doesn't necessarily eliminate certificates - while you have a signed statement from Alice's key that she uses Bank Account X, and a signed statement from Alice's key authorizing transfer of $D from Bank Account X to Bank Account Y, the Bank, or a customer, may refuse to accept the request unless there's a signed statement from the Bank's key that Alice's key uses Account X. None of these need Alice's name, or for that matter the Bank's, as long as there's also a signed attribute statement from the Bank's key that it's a bank, etc. The meaning of the certificates changes a bit, but there's still a certificate from the bank binding Alice's Key to Alice's Bank Account. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

5 5

William S. Powell in front of Congress Oct 11, 10:30 AM
by fc＠all.net 17 Dec '03

17 Dec '03

William S. Powell is the person who firs patented an electronic money system (almost 15 years ago now), and he will be testafying before the congressional subcommittee tomorrow - Oct. 11, 1995 at 10:30 AM (scheduled). If you really want to know about electronic cash and how our society has treated it over the last 15 years, you might want to watch this. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

My Last Message
by Duncan Frissell 17 Dec '03

17 Dec '03

Oops! My last message was a letter to the editor of the Economist. I forgot to mention that. DCF

1 0

Chaum's patents
by s1018954＠aix2.uottawa.ca 17 Dec '03

17 Dec '03

Sorry if this has been stated before, but exactly when do Chaum's first set up e-cash related patents expire? I looked it up in applied crypto the last time I had my hands on it and couldn't find the dates. How many (and what) patents are there in this field anyway? (don't bother with that if it's too long to answer) TIA my visit to Dachau > Concentration Camp, I saw original lab notebooks of experiments designed > to increase the survial rate of pilots downed above the cold waters of the > North Sea. A noble cause. Well I don't think so. The pilots missions were to bomb the cities of England. This was in turn to further the meglomaniac plans of the Fuhrer to create a european police state under his personal rule with all objectors murdered. Analysis of the aims of the research must not simply stop at the immediate result but through to the wider goals towards which the research was intended to contribute. In this context we see that the objective was not to save lives but to destroy them in the furtherance of a plan to enslave the entire population of Europe. spread, > easy employment. I'm not a libertarian, or an anarcho-capitalist. I do, however, support rapid deployment, without restrictions, of strong crypto. Here's why: (1) It is impossible to stop these technologies; someone on the list recently reminded us that a bright fourteen year old could reproduce the basic functionality of PGP in a brief period of time. The mathematics of, say, RSA, are fairly basic. I think it's unreasonable to outlaw multiplication of prime numbers, don't you? (2) While these technologies allow people to violate the law, I have enough faith in humanity to believe that civilization won't collapse as a result. There have always been criminals, and there have always been revolutionaries. Only recently has "The State" been able to supress these forces without maintaining a physical presence. Crypto merely returns us to that default. An example of this is, for example, "What if terrorists are going to blow up a big important building, but we don't know which one?" Before wiretapping, and even today with groups which insist on physical presence in a secure location for planning, you had to infiltrate the group. This will still work. LEAs don't like this sort of activity because of the inherent risk for the infiltrator. That's not a good reason to limit these technologies. (3) These technologies also allow honest, law-abiding citizens to protect themselves from criminals, both within and outside the government. Industrial espionage can be defeated through strong crypto, for example. J. Edgar Hoover would have been powerless to harass Martin Luther King, jr. had MLK had access to strong crypto. Obviously, these aren't the only reasons to use strong crypto, and everybody will almost definitely disagree with them as I've described. But it's one answer, anyway. Jon ------------------------------------------------------------------------------ Jon Lasser <jlasser(a)rwd.goucher.edu> (410)494-3072 Visit my home page at http://www.goucher.edu/~jlasser/ You have a friend at the NSA: Big Brother is watching. Finger for PGP key.

2 1

Re: Certificate proposal
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:46 AM 10/9/95 -0700, Hal wrote: >>This doesn't necessarily eliminate certificates - while you have a signed >>statement from Alice's key that she uses Bank Account X, and a signed statement >>from Alice's key authorizing transfer of $D from Bank Account X to Bank >>Account Y, >>the Bank, or a customer, may refuse to accept the request unless there's >>a signed statement from the Bank's key that Alice's key uses Account X. >>None of these need Alice's name, or for that matter the Bank's, as long as >>there's >>also a signed attribute statement from the Bank's key that it's a bank, etc. >>The meaning of the certificates changes a bit, but there's still a certificate >>from the bank binding Alice's Key to Alice's Bank Account. > >I can see using keys with attributes in this way, for credentials or as >other forms of authorization. But what about for communications privacy? >What is the attribute that tells you that using this key will prevent >eavesdropping? What I was trying to get at with this post was that the assertion that key- centered communications probably won't require certificates is incorrect. As far as privacy goes, this set of keys and certifications lets you create private communications (using signed DH, etc.) with the entity that owns the private key for Bank Account X. No, you don't know if that entity is really Alice or really MITM; in fact you don't know Alice's name, if it's done right. You just know that the Bank says it will honor requests for money from Bank Account X (assuming you know where to find the Bank, which is a separate but similar problem.) So assuming you're selling politically correct widgets and not pharmaceuticals or financial privacy consulting services, you probably don't care too much about who's on the other end - the person who's giving you the money is the person you want to be talking to. I'm not trying to define away the MITM problem - I think there _are_ times you want to know for sure who you're talking to - but I think there are also a lot of times that you really don't care, as long as you have continuity and access to reputations of long-persisting identities, where the key is often enough identification. In the case of the Bank, the reason you trust the Bank isn't that you know them physically (though it was interesting when I started dealing with a local bank where the tellers knew me by name after only two or three visits); knowing your local Savings and Loan by name doesn't guarantee you can get any money out of them if there's a bank run, nor does it really guarantee that they won't embezzle the funds and head for Argentina. The reason you trust them is that they (in this case the "they" identified by their key) are doing business dealings with a lot of people and it's more profitable not to abscond. And the reason you know it's really the Bank and not MITM is that they've always identified themselves by their key from the beginning. Just like the credit card who's owner we've been calling Alice has. And because you've successfully withdrawn money from the Bank before, and because you're clearing Alice's credit card transaction reasonably promptly. Checks and credit cards are especially good examples for this - the current systems need your name on them, because your name and signature are the closest they have to an authentication system. However, with digital signatures, the fact that you can sign a document verifiable by the public key is all the authentication that's needed; your name isn't. If the card has an account number for convenience, and Alice substitutes Carol's account number for hers on a statement, her signature won't match the public key the bank wants on the request, and it'll bounce. (In this case, the certificate from the bank would probably include the account number as well as the key, but it's not critical for on-line systems, just more efficient.) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

2 1

GOB_ble
by John Young 17 Dec '03

17 Dec '03

10-9-95. NYPaper: "Is the top priority in computing shifting from speed to how easily you can interact? How fast will the Microsoft-Intel duopoly fade?" Denise Caruso's column When the Internet's original creators decided to publish their networking standards so that any computer could connect to the network, they certainly had no idea that almost 30 years later, their decision would provide the first real lever to pry the Microsoft-Intel duopoly from its leadership role. But this very prospect is why one well-known technology investor made a speech last week called, "Why Microsoft and Intel Don't Matter Anymore." "Haves and Have-Nots Revisited. Rich Nations Talk High-Tech, but the Poor Live No-Tech." Digital technology is revolutionizing telecommunications and erasing the boundaries that separate the telephone, computer and media industries. But the revolution's inequality takes the shine off a business that has celebrated itself as both a one-stop shop for the Information Age and a force for positive political change in the world. "The present reality is that the technology gap between developed and developing nations is actually widening," said Nelson Mandela, who spoke at Telecomm 95's opening. "A software gift service, by lawsuit and negotiation, tries to demonstrate that it takes its claim seriously." Sandra Chartrand's Patents column. One controversy is a patent issued in 1985 for selling software to individuals through the Internet and some CD-ROM's. Its owner, Interactive Gift Express Inc. says the patent covers the selling and downloading of digital information. There are those who disagree. "I've read the patent and can actually say that there is no invention there at all," said Richard Stallman at MIT. Trio: GOB_ble (16 kb)

2 1

Re: netscape mail starts java attachments upon get new mail...
by Rich Salz 17 Dec '03

17 Dec '03

> Java applets can't read /etc/passwd, and can't issue NIS requests unless > they were downloaded from an HTTP server running on the NIS server Oh, you mean like a mirror or local cache? (Sure, Rocky, never happen...) > (actually, they can't do UDP at the moment, so that's out as well) Even with TIRPC NIS is still UDP-only? Has NIS+ fixed this? /r$

2 1