December 2003 - cypherpunks-legacy

Check by phone (revisited)
by cman＠communities.com 17 Dec '03

17 Dec '03

There are a variety of these new "check by phone" operations advertising on the Internet; I decided to check some of them out this afternoon. Most of them seem to use the same breathless prose immortalized in "Make Money Fast", along with generous use of the Netscape "blink" attribute, which immediately sent alarm bells ringing, especially when coupled with referral programs that border on a pyramid scheme. Furthermore, it's clear that these operations are highly vulnerable to fraud and abuse, as was mentioned in a thread on the list a few weeks back. Quoting from http://www.pixi.com/morgan_group/checks/by_phone.html: --------- TELEPHONE CHECKS (PAPER DRAFTS) ARE COMPLETELY LEGAL! Paper drafts are established as a legal method of payment as provided in the Uniform Commercial Code, Title 1, Section 1-201 [39] and Title 3, Sections 3-104, 3-401, and 3-403; Code of Federal Regulations, Title 12 Chapter II, Part 210; and Regulation J, Federal Reserve Bank, Part 2, Sections 4A-201 to 4A-212. Only verbal agreement is required for authorization. Also see Romani v Harris, 255 Md 389. --------- Any lawyers feel like checking this stuff out? (I've got the UCC at home, but not the rest of the materials.) When I called the phone number given at: http://www.Village.com/business/enterprise, I got a guy who was obviously at home, "watching the ball game"; he was quite pushy and focused on the system of "referrals" for people who sign up. Among other things, he had never heard of an ACH debit and was therefore unable to compare the conflict resolution processes for the two methods. (ACH debits are what your health club uses to deduct fees from your checking account each month -- the transactions are reversible solely on the customer's say-so.) The folks at http://www.redichek.com/redichek/redifaq.htm seem a bit more professional. They admit in e-mail that there is a security problem here (no kidding), especially wrt sending routing and account information over the Internet. I enclose our correspondence at the end of this posting, for your reading enjoyment. It seems plain from the nature of the folks who are offering these check printing services that they are not regulated or licensed. Also, it seems that these services are really just preparing the drafts, any liability for submitting bogus drafts rests on the merchant into whose account the drafts are deposited. Question: has anyone seen more legitimate folks offering this type of service? Also, it seems that for the fees that these folks are charging, it would be worth it for a merchant to do this in-house. When this topic came up before, I recall people mentioning sources of magnetic ink and check paper; is this stuff really widely available? Another puzzling factor is that all the services seem to base the fees on the amount of the transaction, when, as near as I can tell, the check printer has no exposure, and costs are in no way proportional to transaction size (basically they're collecting data and running a laser printer.) Proably due to their positioning themselves wrt credit card companies. Joe-Bob sez: Check it out. ========================================================================= Date: Wed, 11 Oct 95 18:13:57 -0600 X-Sender: msumsion(a)mail.redi-check.com Mime-Version: 1.0 To: cman(a)communities.com (Douglas Barnes) From: msumsion(a)optical.fiber.net (Michael Sumsion) Subject: Re: Legal basis Douglas, Thanks for the inquiry. Before I answer your questions, I would like to make you aware that we are in the process of building a completely new, completely secure system using this same check-draft service. It will be arriving within the next couple of weeks. This new system will allow online customers to make purchases, using their checking account, without the need to transmit their account information over the Internet. On to your questions: > >Hi, our company may be a potential customer of your service, >but I have questions about the legalities involved in printing >drafts on people's accounts. In particular, this system seems >especially vulnerable to fraud. I just spoke with our banker, >who had not heard of these services, and was quite concerned. Many bankers have not heard of the system, although it has been in use now for over 3 years. We get calls from bankers on a regular basis who are curious about the service. After explaining it to them, they are generally very supportive. As far as the legalities, it is perfectly legal to print a draft, drawn on a customer's account, with the authorization of the customer. In fact, the legal basis for this is printed on the bottom of each of our drafts. >For instance, wouldn't it be possible for any recipient of a >check from someone to copy down the routing information and >account number, and then use that to defraud the account holder >and the merchant? Yes, this is possible. We have never run into this situation, however. We are not stating that this system is any more secure (with the current system) than credit cards. What we WILL say is that this system is as safe as walking into any store and handing the clerk one of your checks. (The new system will eliminate the need to transmit this information.) >Also, I'm curious where the liability rests in the event that >a charge is disputed -- that is, the customer claims that they >didn't authorize the transaction. How readily are the charges >reversed? I'm familiar with ACH debits, which are extremely >easy for customers to reverse; how does this system compare with >ACH debits? Since there is no standard or regulation regarding this in the banking industry, this differs from bank to bank. Some banks will allow you to go back as far as two years to dispute a check. Others will only go back 30-60 days from the date of receipt. I hope that I've been able to answer completely. If you would like to speak with someone about specific processes, please give Allen a call at 801.298.1212. Thanks, Michael Sumsion _/_/_/ _/_/_/ _/_/ _/ _/_/_/ _/ _/ _/_/_/ _/_/_/ _/ _/ TM _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/_/ _/_/ _/ _/ _/ _/_/ _/ _/_/_/ _/_/ _/ _/_/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/_/_/ _/_/ _/ _/_/_/ _/ _/ _/_/_/ _/_/_/ _/ _/ Internet Commerce Solutions - (800) 607-2001 Fax (801) 298-9789 email: msumsion(a)redi-check.com http://www.redi-check.com/redi-check Referral Program: http://www.redi-check.com/redi-check/referral.htm ======================================================================

1 0

Final Roster/Reminder -- Bionomics Conference (fwd)
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Here's a sign of the times> S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ---------- Forwarded message ---------- Date: 11 Oct 95 14:38:02 . . . Subject: Final Roster/Reminder -- Bionomics Conference Dear Friends, With a record number of 35 speakers and panelists (whew!), the program for the 3rd Annual Bionomics Conference has been finalized. Since our brochures were printed, we've added a number of interesting and thought-provoking individuals, including o Lew Perelman, author of "Hyperlearning" o Andrew Basile, author of "The SPA's Guide to Online Law" o Morley Winograd, author of "Taking Control: Politics in the Information Age" o Frank Gregorsky, former chief of staff to Cong. Newt Gingrich o Jim Griffin, Director of Technology at Geffen Records o Don Lavoie, Director, Program on Social & Organizational Learning, George Mason University o Irwin Glenn, Senior Systems Engineer, Netscape Communications o Pat McKim, Managing Partner, Practical Strategies o Cindy Cooke, Director, Democratic Leadership Council of CA o Dennis Miller, Associate Professor, Baldwin-Wallace College . . . What's more, for the truly tech-savvy, you can now pay for your conference attendance with Cybercash. Just check our web site (www.bionomics.org) . . . ^^^^^^^^^

1 0

netscape rewards bug finders
by an407769＠anon.penet.fi 17 Dec '03

17 Dec '03

Netscape Offers Rewards To "Bug Catchers" MOUNTAIN VIEW, CALIFORNIA, U.S.A., 1995 OCT 11 (NB) -- Netscape Communications Corporation (NASDAQ: NSCP) has announced the "Netscape Bugs Bounty" program that rewards users who help the company find and report "bugs" in the beta versions of its recently released Netscape Navigator 2.0 World Wide Web browser software. Users who are the first to report a particular bug will be rewarded with various prizes depending on its importance. The contest begins with the beta versions of Netscape Navigator 2.0 that are already on the Internet. Full rules for the contest will be available on Netscape's home page at http://home.netscape.com . Speaking to Newsbytes, Roseanne Siino a spokesperson for Netscape, said, "As far as we can determine, this is the first contest of its kind. Netscape's whole approach to broad-based beta testing on the Internet was new, and we hope the contest will enliven the beta testing process." Users who are the first to report a particular bug will be rewarded with prizes depending on the "bug class." Users reporting "significant security bugs," as determined by Netscape, will collect cash prizes, while users finding any security bugs will win Netscape "merchandise." Users finding other "serious" bugs will be eligible to win "a choice of items" from the Netscape General Store. Siino pointed out that there are no caps on winners. Top prize will be $1,000 for any and all bugs in the top category: Severe Security Bugs. To win, the finder has to be the first, and, according to the company, it is important to be constantly using the current versions. The beta versions are available now for downloading on the Internet for free evaluation. Netscape's beta testing of 2.0 is already underway. Users who downloaded previous beta versions of the 2.0 software should download today's versions, which fix major and minor bugs identified since its initial release, including security bugs in the pre-release version of the Java language support integrated in 2.0. Netscape has released special beta versions of 2.0 that include Java for users wanting to test it. Because bugs will be reported and fixed on an ongoing basis, Netscape asks users to stay current on the beta version they are using, so that the latest software is constantly being refined. "We are continuing to encourage users to provide feedback on new versions of our software, and the Netscape Bugs Bounty is a natural extension of that process," said Mike Homer, vice president of marketing at Netscape. "By rewarding users for quickly identifying and reporting bugs back to us, this program will encourage an extensive, open review of Netscape Navigator 2.0 and will help us to continue to create products of the highest quality." Netscape has created two versions of its Netscape Navigator 2.0 beta, available for downloading from Netscape's home page at http://home.netscape.com . Version b1J for Windows 95, Solaris, and Irix platforms includes Java and is for users who want to participate in the bounty program. For general users or those on other Unix environments, Windows 3.1, and Macintosh, Netscape has posted beta versions without Java. After initial testing is complete, future beta versions for all supported platforms will contain Java. (Richard Bowers/19951000/Press Contact: Roseanne Siino, Netscape, 415-254- 1900) --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

variations on an attack
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Jiri Baum wrote: > To start a new sub-thread: what if the man in the middle is actually > a behaviour-modifying parasite? At that stage even a physical meeting > won't do you much good (the parasite may be otherwise asymptomatic). That wouldn't quite work since the host would notice the parasite in the middle and could then work out countermeasures. An important part of a MITM attack is escaping notice. What if one night the man in the middle drugged you, kidnapped you, placed you inside a virtual reality machine, replaced your body with a clone, and established a link between the VR machine and the clone so that you experience everything the clone experiences and the clone does everything you intend to do? Can you prove this has not already happened? - the Mad Scientist in the Middle - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHyIA9IjPOsOWLIJAQE3AgP/bNcA0BmDMvto9SocpIcYImoXJ72k9k+Z gYH6dnCo5UCY0KbKwgCbBfQI0bxpaP7EWmZPS/i1HdzWvKOw9JExY2i0gvKMr/BS KGtlG0+RAVSU9DiVRuAr6d7x6IQKYOeRgcNz0Dm2JpaA1eo/DbJ3tsRBYCeaQQ26 gS5XzNzL00M= =lc/J - -----END PGP SIGNATURE----- - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzB8hz8AAAEEAKuHA58RXNk5o0nlDTOsoAs3YTKubscQYoW3kLSjmn7gmskD NtPKxYvXveGN3D/eBgsMzdGVtrl46j1r6VjYsTMcDGUL9wGQnflgHGrbReFYGzkI yW7GhyeUoRqCdmACDpmzUxEqp2J5hK2obL8bcvoiVSBMFogabdIjPOsOWLIJAAUT tEJJIHdvdWxkIGxpa2UgdG8gYmUgcmVmZXJlZCB0byBhcyAidGhlIE1hZCBTY2ll bnRpc3QgaW4gdGhlIE1pZGRsZSI= =Lzd5 - -----END PGP PUBLIC KEY BLOCK----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHyK9SoZzwIn1bdtAQHNsgF/WqMLd/EuNEG3QEXZobZKDQDl0hjMmhBn 56pUQxkNYi0ckMx+YIij9X7XoExm3MsK =D+xl -----END PGP SIGNATURE-----

1 0

Re: NYT on Internet Flaws
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Adam Shostack sez: > > Dr. Frederick B. Cohen wrote: > > | There are alse several papers there on "Internet Holes" under Network > | Security in the same on-line journal. Every month, another 5-10 holes > | are added to those published in this forum. > > And how many of those holes are published by bugtraq/CERT/8lgm > first? Just curious to see if this is another list I should be on... > Well since I see far less than 5-10 announcements from bugtraq, CERT and 8lgm put together most months, they must have others. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

anonymous web pages?
by Nelson Minar 17 Dec '03

17 Dec '03

Does any facility current exist to allow people to create anonymous web pages? After anonymous email and anonymous news postings, this is an obvious next step. It seems that it would be a fairly simple matter to write a program that would accept email containing a web page and the destination URL, do some checking, and then create (or update) the requested page. Require signatures and allow receiving mail via a remailer chain, and you've got secure anonymous web pages. The hard part would be finding a site that would be willing to serve anonymous pages. I don't understand the politics at various sites that allow anonymous remailers: maybe this isn't much harder? -- __ nelson(a)santafe.edu \/ http://www.santafe.edu/~nelson/ PGP key 9D719FAD Fingerprint 3B 9B 8E 58 1C 90 57 3E B7 99 ED 13 65 2E 0B 24

2 1

Re: anonymous web pages?
by rkw＠dataplex.net 17 Dec '03

17 Dec '03

At 7:18 PM 10/11/95, Nelson Minar wrote: >The hard part would be finding a site that would be willing to serve >anonymous pages. I don't understand the politics at various sites that >allow anonymous remailers: maybe this isn't much harder? Yes, it is "much harder". Unless the site had a cache of all the pages that it was willing to source (the usual case), traffic analysis could easily be applied to determine the sources for pages because, unlike mail which is "store and forward", web pages are provided on a realtime connection. ---- Richard Wackerbarth rkw(a)dataplex.net

2 1

Re: SAIC bought ... [NOISE]
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 7:27 PM 10/11/95, Alan Horowitz wrote: >I used to work for SAIC. It's a legitimate beltway-bandito contractor. To >call it a cover op is sort of missing a point. The government hardly ever >does _anything_ itself (as, say, percentage of budget). Contractors are >the ones who do the dirty work in the trenches. It's not missing the point at all; what I find particularly alarming is this half-measure situation we increasingly find ourselves in, wherein the state farms out the drudgery of being a state but reserves to itself the prerogative to govern by obscure fiat. Institutions like SAIC aren't accountable in a way that gov't agencies at least theoretically are, yet the continuing existence of those agencies amidst this move toward privatization perpetuates this increasingly mythical idea of "accountability." If everything's going to go private, fine, whatever, let's make a go of it, and no one can tell me what software I can/can't use and how much I can/can't deposit, etc.; OTOH, if the USG wants to reserve the right to tell me what I can and can't do in these regards, then it had bloody well better submit to the "responsibility" that goes with that "right": accountability to the electorate. Why do you think the spooks make such prodigious use of cutouts? In part because it's an effective way of evading detection; and, unfortunately, oversight is a subset of detection. I'm sure SAIC does tons of perfectly legitimate contract work--but I'm equally sure that it does tons of covert work. And far too much covert work is covert for no other reason than it's stupid (read my lips: "exploding giant clams") or--in the case at hand--something that a rapidly growing sector of the electorate rightly regards with suspicion. Ted

1 0

RSA Data Security, Inc. To Exclusively License Rights to RSA
by baldwin 17 Dec '03

17 Dec '03

Here's the latest press release from my employer. As was pointed out earlier, for those who did not already know, Business Wire articles are written by companies and distributed to news agencies by BW for a fee. --Bob Baldwin ______________________________ RSA Data Security, Inc. To Exclusively License Rights to RSA Public Key Encryption and Digital Signature Standard (DSS) Technologies; Company Becomes One-Stop Worldwide Source for Encryption Technology REDWOOD CITY, Calif.--(BUSINESS WIRE)--Oct. 12, 1995--RSA Data Security, Inc. today announced that it is now licensing patents for the Digital Signature Standard (DSS), the U.S. government standard for digital signatures. RSA also announced that it has renewed its exclusive licensing agreement for the industry-standard Rivest-Shamir-Adleman (RSA) public key cryptosystem developed at the Massachusetts Institute of Technology (MIT). With the addition of DSS technology to its portfolio of encryption offerings, RSA Data Security has become the exclusive source for the industry's most widely accepted security technologies. RSA also announced that under its uniform, non-discriminatory licensing plan, manufacturers will pay a one-time royalty when they sell products containing RSA and/or DSS technology. No additional per-certificate or use charges are required. `For the first time, the patents covering the most popular encryption and digital signature methods in the world, RSA and DSS, are easily available on a non-discriminatory basis from a single vendor,` said Jim Bidzos, president of RSA. `By offering one-stop shopping for both systems, our customers can seamlessly integrate both RSA encryption and DSS digital signature methods into their products.` Widespread Implementation Many of RSA's software licensees -- such as Adobe, Aquila, Atalla, National Semiconductor, Spyrus, Premenos, Spyglass, Terisa Systems, Frontier Technologies, BroadVision, Checkpoint Software, Raptor Systems, SafeCo Insurance, Wollongong, Square D, Interval Systems, and Comm-Press -- have already requested patent licenses to both the RSA and DSS techniques for use in software and hardware systems. IBM and Siemens currently offer DSS-based products, licensed under RSA's DSS patent, to the U.S. government. `Now that vendors can obtain DSS and RSA patents from one source, we expect to see companies throughout the U.S., Europe and Japan incorporate RSA and DSS technology into dozens of products, including access control systems, network management systems, smart cards, link encryptors, and wireless encryption devices,` said Bidzos. `The demand for these technologies is very strong and will continue to grow as vendors increasingly incorporate security features into their products. In the next several months we expect to be inundated with requests from licensees. This is great news for the security industry, which has waited patiently for easy availability of the RSA and DSS patents.` Digital Signatures A digital signature on an electronic document is an encrypted form of data equivalent to a signature on a printed document, such as a contract or other commercial agreement. It verifies that the document is valid and unaltered, and that the person signing the document has agreed to its terms. Furthermore, secure digital signatures cannot be repudiated. The signer of a document cannot disown it by claiming it was forged. Both DSS and RSA support digital signatures and certificates. Several states, including California and Utah have recently enacted legislation recognizing digital signatures as legally binding. License Availability Uniform licenses to both the RSA and DSS/Schnorr patents are available immediately. The license text, as well as other information regarding these patents, is available on RSA Data Security's home page at http://www.rsa.com. For existing customers of RSA's BSAFE and TIPEM software toolkits, no separate patent licenses are required. All rights under the patents to use, integrate and copy RSA's software are embedded. RSA Data Security, Inc. RSA Data Security, Inc. is the world's brand name for cryptography, with more than 15 million copies of RSA encryption and authentication technologies installed and in use worldwide. RSA technologies are part of existing and proposed standards for the Internet and World Wide Web, CCITT, ISO, ANSI, IEEE, and business, financial and electronic commerce networks around the globe. The company develops and markets platform-independent developers kits and end-user products and provides comprehensive cryptographic consulting services. Founded in 1982 by the inventors of the RSA Public Key Cryptosystem, the company is headquartered in Redwood City, Calif. -0- Note to Editors: RSA Public Key Cryptosystem, BSAFE and TIPEM are trademarks of RSA Data Security, Inc. All other product or company names are trademarks of their respective corporations. For information regarding licensing RSA or DSS patents, contact Paul Livesay at RSA Data Security, Inc. (415) 595-8782, or polrsa.com. For information regarding licensing RSA or DSS toolkits, contact Paul Gordon at RSA Data Security, Inc. (415) 595-8782, or paulrsa.com. --30--kr/sf.. CONTACT: Corman/Croel Marketing & Communications Patrick Corman, 415/326-9648 cormancerf.net Lisa Croel, 415/326-0487 lcroelmediacity.com KEYWORD: CALIFORNIA INDUSTRY KEYWORD: COMPUTERS/ELECTRONICS COMED TELECOMMUNICATIONS PRODUCT REPEATS: New York 212-575-8822 or 800-221-2462; Boston 617-236-4266 or 800-225-2030; SF 415-986-4422 or 800-227-0845; LA 310-820-9473 BW URL: http://www.hnt.com/bizwire AP-NY-10-12-95 0701EDT This material is copyrighted and may not be republished without permission of the originating newspaper or wire service. NewsHound is a service of the San Jose Mercury News. For more information call 1-800-818-NEWS.

3 2

Cypherpunks Moderated: Avoid This Thread
by Donald M. Kitchen 17 Dec '03

17 Dec '03

Anon wrote: >"According to the group's moderator, who prefers to remain anonymous, > `The most important means to the defense of privacy is encryption. > Cypherpunks are therefore devoted to cryptography. They wish to learn > about it, to teach it and to implement it.'" > >Ok, since when is the Cypherpunk's mailing list moderated? Ummm, anyone seen L.D. lately? Just wondering. Don

1 0