December 2003 - cypherpunks-legacy

Re: Netscape rewards are an insult
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here ... I know that this is *painfully* dated, and I apologize to the list for replying to a one month old post, but I felt I had to put some final items on the record. And I think that this is still timely ... so ... On Sat, 14 Oct 1995, Dr. Frederick B. Cohen wrote: > Phil typed: > > Have things really come to this? Besides the legal implications of > > discovering a hole and then selling the information to someone, (who > > presumably will only want this information for one purpose) where has > > the attitude of doing for the sake of doing gone? > > It's one thing to do good for the sake of doing good. Most of us do that > every day by participating in this list. It's quite another thing to be > insulted in the process. I think that Netscape's reward is an insult, Dr. Frederick B. Cohen has nailed it once again. He's right. But Phil's comments really need to be addressed ... vis-a-vis the implications of "discovering a hole and selling it". Phil's hypothetical is rightfully worrisome, but we should remember it _is_ only a hypothetical. Let's not worry much about hypotheticals. Perhaps we should worry more about what in fact IS an ACTUAL, rather than what might possibly be. The hand-wringing should be over the existing reactions to publicly ignored security holes and the ETHICS of the new Internet players. The ones who are so very cock-sure of themselves. So cock-sure, that they willingly gamble with public security and think that their invasion of individuals personal boundaries and privacy is nothing noteworthy. That it will just somehow pass. My post detailing a structural flaw in Netscape Navigator was announced, very quietly, to this list OVER ONE MONTH AGO. And what has been done about it, by AT&T and/or Netscape?? Nothing. AT&T has its reputation attached to this code, as does Deutsche Telecom, as does Netscape. The only "action" they've taken is to info-freeload and then do absolutely, positively, definitely ... nothing. Diddly-squat. No one has taken any action whatsoever. How would we treat a company ... let's say a construction company that found out that one of its buildings was unsafe, and then proceeded not to barricade the complex. If the company found out that the girders were not up to the engineered spec, and simply allowed risk and harm to continue. If the Company thought it was OK to gamble with people's lives? Would we say that the reckless disregard for the public interest merited criminal sanction?? Hopefully, we would. To attack some hypothetical "information provider" for selling some "hypothetical" information which a corporation denies is actually of any value, at all -- nominal, or otherwise -- is an argument that just doesn't float. It completely misses the mark. > If they think you can find major security bugs in Netscape for as little > as $1000, they should take the product off the market, or at least stop > claiming that it offers security. They should definitely take the product off the market. Period. They should also stop claiming that it offers any security. In fact, they should attach a product warning label, something that says that Netscape Navigator degrades your inherent safety and security as soon as you use it. That would be the "right thing" to do. Because that is truthful. AT&T's "brass" should have used the "Tylenol" or "Perrier" crisis management model on this one. Rather than, "The stick your head in the sand like an ostrich" model. Or the "Gee, maybe if I close my eyes, and pull the covers over my head, the boogie-man will go away" school. Someone has to call them on their collective jump into the World of Management by Denial. The issue here isn't the so-called "reward", the focus should rightly be placed on who knew what and when they knew it, and what they did as a consequence. The issue is whether these Goliath Companies, happily roll the dice when public safety and security is on the line. It's that simple. A real no brainer. > > Has Netscape been pestering > > security experts on the net for free work? Have they been plaguing > > people or lists with email asking the net to do their jobs? > > They do far worse. They claim security when they don't have it, and > when the cypherpunks demonstrate the false claims, Netscape offer > insulting future tribute. I think that if they are sincere, they should > reward the individuals who found the last few holes with $25,000 each, > and show that they really mean business. Actually, they said that they want to "harness" the power of the internet, and in return offered a chance to be enrolled in a contest for a mug or a T-shirt, or maybe ... if they ... in "their sole discretion" thought something was a security bug, then they'd offer a $1,000 award. Not *pestering* security experts, but simply asking them to sorta, kinda take a look at the product. Look, and help build the Companies' fortunes, while the "Creative" talent might get a nice Netscape mug for their troubles. This is what Netscape DID, but this isn't the true issue. The true issue is a question of attitudes, not of monetary compensation. I really don't care if Netscape or AT&T offer gold stars and nice little pats on the head, or offer many "millions" or offer $25,000, or expect the world's foremost security auditors to work for T-shirts or a bitta Crackerjack. That's not the issue. I just don't believe that any company should on the one hand represent that they have a secure product -- that they actually care about security -- while on the other hand they take their black-box code and say that anyone who brings an error to their attention -- a critical security flaw -- agrees implicitly to make the report the Company's property -- property to be used at the Company's sole discretion. A security review audit is first and foremost for the benefit of the end users. The audit is not so that the company can use the information for its own purposes. The information is not there so that the company can use a confidential auditor's report on security flaws to spy on their own customers, and its certainly not there to enable a code cover-up. Hell, these firms try to cover up even when the information is PUBLIC, let alone when it's given to them in private. And the crying and whining is unbecoming, because the attempt at private communication was made. It was made with both Netscape, and with AT&T. > > The ironic part is the people who have been the most successful at > > finding bugs are not the ones who are demanding money for it! > You're right. the people who find the bugs simply ask that the public interest be served ... that the Network's interest be served, and that the National interest be served. Defective product serves no one, and adding an object to an existing computing environment under the rubric of an experimental data type serves no-one. Correction, it serves no-one except those who would rather see harm come to the public. Those who value and place their own self-interest above that of others. And the consequnces be damned. > The ironic part is that a company that claims to have a "secure" method > for using credit cards on the Internet thinks that their security is so > weak that it only takes $1000 to find a major hole. The ironic part is that even once a critical design flaw is identified, no action is taken by anyone -- even when the person who finds it demands no money whatsoever for it -- the real irony is that the press is silent, and so is the company. See no evil, speak no evil, hear no evil. Let the harm and damage continue ... by my calculation, it's been one month already ... shall we maybe try now for two?? I don't think so. > -- > -> See: Info-Sec Heaven at URL http://all.net > Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236 Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

7 8

Re: credit card conventional wisdom (fwd)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: Simon Spero <ses(a)tipper.oit.unc.edu> The printed digits above the embossed account number are the first four digits of the BIN (on Visa cards) or ICA (on MasterCards). They are there to discourage re-embossing of the card with another account number. ---------------------- You may be interested in knowing that this appears to vary depending on the card issuer (or possibly on when the card was issued). My MasterCard (from USAA) has no such printed digits; instead, the entire account number is on the back of the card, plus 3 (I would guess check) digits. -Allen

1 0

MED_vac
by John Young 17 Dec '03

17 Dec '03

11-15-95. NYPaper Page One: "When Patients' Records Are Commodities for Sale." Individual medical records, carrying more sensitive personal information than ever before, are increasingly being gathered and stored by the tens of thousands in commercial databanks maintained by institutions like hospital networks, health maintenance organizations and drug companies. And although there is a Federal law that protects the privacy of video rental lists, private medical information is being bought and sold freely. The issue of medical privacy touches virtually everyone. "It is true to say that if you know a person's history of health problems, then you know more about that person than you would with any other data," said Lawrence O. Gostin, a professor at Georgetown University Law Center. And as medical records start including new genetic information that can predict diseases likely to show up in years to come, they will be able to reveal "not just health histories, but health futures," Mr. Gostin said. Yesterday hearings were held on a bill called the Medical Records Confidentiality Act, intended to establish uniform Federal rules for the use and disclosure of health information. Although the bill details procedures for obtaining consent, it also establishes a formidable list of exceptions to this requirement. The police, health oversight agencies, health information services, public health offices and medical researchers are among those allowed to obtain records of an identified patient without that person's consent and, in many cases without notification. MED_vac (15 kb)

1 0

RSA T-shirt
by David K. Merriman 17 Dec '03

17 Dec '03

FWIW, I finally got a chance to see if my barcoded RSA-in-perl t-shirt would actually scan - and it did! It took a bit of fiddling, but it was scannable using one of those hand-held CCD barcode readers. Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

Re: credit card conventional wisdom
by Rich Salz 17 Dec '03

17 Dec '03

>There is in fact a distinction between "card present" and "card not present" >transactions. AMEX cards for example have an extra group of four digits which >are not part of the embossed card number. They are used as additional >verification to prove that a card is present. So the run-it-through-the-mechanical-device is treated as card not present? /r$

4 5

DCSB: "A Middleware Guy Looks at Issues in Digital Commerce"
by rah＠shipwright.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston (Formerly The Boston Society for Digital Commerce) Presents Rich Salz Open Software Foundation "A Middleware Guy Looks at Issues in Digital Commerce" Tuesday, December 5, 1995 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Rich has been with OSF for nearly four years, where he has been the technical lead of the OSF DCE 1.1 and 1.2 releases. He is also helping write the secure multi-threaded WWW server for the DCE-Web project. He has been active in Usenet, and is the author of INN, one of the most popular Usenet/NNTP implementations. His home page is http://www.osf.org/~rsalz. Rich says: >In the rush to separate lift even more money out of your wallet >-- sorry, to provide consumers with more choice and opportunity >-- the electronic commerce community has largely been ignoring >issues that the distributed systems field has been trying to >address for years. This meeting of the Boston Society for Digital Commerce will be held on Tuesday, December 5, 1995 from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, One Federal Street. The price for lunch is $27.50. This price includes lunch, room rental, and the speaker's lunch. ;-). The Harvard Club *does* have a jacket and tie dress code. We need to receive a company check, or money order, (or if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, December 2 (that's two weeks from this Saturday), or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, c/o The Shipwright Development Corporation, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they must be made payable to "The Harvard Club of Boston". If anyone has questions, or has a problem with these arrangements (We've had to work with a few glacial A/P departments ourselves, for instance), please let us know via e-mail, and we'll see if we can work something out. January's speaker will be Art Hutchinson of Northeast Consulting Resources, Inc. We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the BSDC Program Commmittee, care of Robert Hettinga, rah(a)shipwright.com . For more information about the Boston Society for Digital Commerce, send "info bsdc" in the body of a message to majordomo(a)ai.mit.edu . If you want to subscribe to the BSDC e-mail list, send "subscribe bsdc" in the body of a message to majordomo(a)ai.mit.edu . Looking forward to seeing you there! Cheers, Bob Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMKooW/gyLN8bw6ZVAQFMAQP+MQn6wlKxMVHekN1mruUrwILBR0KTcxSK RQo7ELRJAP0aEiEskio3bphrgCpWgxKHJn9KP3YEHuNbwwXZGVzVTlijvzmbVksf ybtAsspMERb/9yWOe4AT69R/hSTAjEkzCwx86iP4FbjBccPiQPQD1eKJ+4C4obW+ WFuq7mpizeU= =J6UH -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

So. FL Cypherpunks Keysigning/Party
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Greetings South Florida cypherpunks-- All cypherpunks in or near Dade county who wish to meet will be getting together at 7:30PM on Wednesday, November 29th. In keeping with past South Florida cypherpunks tradition, we are going to meet where the _beer_ is, and (better yet!) this South Florida cypherpunks meeting will coincide with the monthly meeting of the Miami Area Society of Homebrewers ("M.A.S.H.") at the Abbey Brewing Company on Miami Beach. This bar serves a selection of barsnacks, not quite as extensive as the food at The Riverwalk Brewery, but at least they aren't going out of business... Location: The Abbey Brewing Company (305) 538-8110 1115 16th Street, Miami Beach Directions: [From North: Take I-95 South to 195 exit, over to the beach, and go South on Alton Road. Look for a green sign that says "BAR" atop the building.] [From South: Take I-95 North to 395 exit, over to the beach, and go North on Alton Road. Look for a green sign that says "BAR" atop the building.] I will be bringing the videotape of the "Mitchells In The Morning" talkshow featuring PRZ that I mentioned a while ago, but The Abbey has no VCR, and the atmosphere might not be right for a showing. Because the meeting is on Miami Beach, folks from far away are urged to carpool or use Tri-rail to Metrorail and then get a ride from Jim Ray (I will try to stay *somewhat* sober). e-mail <liberty(a)gate.net> for ride or carpool details & I'll try to coordinate the transportation aspect of the meeting for those in need of a ride. Joe Block <jpb(a)miamisci.org> is willing to coordinate the keysigning aspect of the meeting, and he will post in a few days. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMKoxZm1lp8bpvW01AQHLywP/YUWrjYBGyhTXVNyJa05WrUZPtZcNx2sK e6Q0Zc4CYm2q3y5Xq2jdOz8pql95y2L/anSNAJS3zdAR4SFpGR45ZxNtLXy1YU6r 6KDCwPpjoJ4+aUdXrfcW/2DR3BMatHIy25I26SqWmwiVSFRvjIBEH9PO73QA9c7Z Yo5nKaDvRu0= =oRZQ -----END PGP SIGNATURE----- Regards, Jim Ray "...the politicians have been arguing over whether to increase the budget enormously or just hugely. The news media refer to this process as 'cutting' the budget." -- Dave Barry Visit my "Pretty Good Homepage" at http://shopmiami.com/prs/jimray/ ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 (key on page & servers) <liberty(a)gate.net> IANAL ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or http://www.netresponse.com/zldf _______________________________________________________________________

1 0

Re: Hardware-random-bits interface
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>I've been thinking about physically random bits recently, so >I'd like to offer a simple, easily implementable interface to a >source of such bits, along with a design sketch using a common >radio receiver chip as the noise source. The interface consists >of two bits in the standard PC parallel port, one serving as >the data line and the other the sampling clock. [stuff deleted] > Device probing: the device should somehow identify itself > as a random bit generator. One way to do this is to wire > one of the parallel port data bits to a status line; for > example, data bit 0 (pin 2) could be wired to status bit 5 > (pin 12). Software can then twiddle the data bit and > watch for the response. I'm not a crypto expert, or a mathematician, or anything like that, but I think I have a few suggestions that you should consider. 1. DON'T let the random-number generator "know" that it is being accessed, even with something as simple as a clock. The reason is that if it became important enough, an agency with a BIG BUDGET could make a custom chip that implemented the same apparently-random function, (but might really be a 10**18 state machine with, say, only 10**6 starting positions) but could be "alerted" and reset by a specific pattern of external accesses, possibly activated by a special-purpose virus. The resulting "fake" chip would appear to result in random output, if never reset, but would produce a data stream with a predictable series with a limited number of starting points. 2. Since the main goal of the project is to have this end up being an ECONOMICAL board, you'll probably end up with a data stream which has some sort of slight bias in one direction or another. As far as I can see, that's okay, because it merely means that you're getting somewhat less than one bit of randomness with each accessed bit. But as I understand it, the solution to this is to combine the bits in software so that you end up with fewer bits. While it's been months since I've read Schneier's book, I recall that it talked about extracting more-perfectly-randomized bits from a larger collection of not-quite-so-randomized ones. 3. In addition, for most trustworthy results, I think you should XOR the resulting data with a long-period pseudorandom stream of bits derived and modified from some reasonably random inputs, such as keystroke timings and free-running-system-clock bits. The reason is that (as far as this neophyte knows) a stream of GOOD randomized numbers XOR'ed with a stream of reasonably randomized numbers results in a stream at least as randomized as the better source. More importantly, such a procedure should help deter any attempt to corrupt the physically-random source, because even going to that trouble of subverting it they'd only defeat only one stage in the process. 4. I think the user should be given the option of socketing the IC's. True, that would make it easier for an interloper to replace, but it would also allow the user to quickly swap the critical chips, possibly at intervals of a few days to a few weeks, to partially guard against sabotage. 5. The whole assemblage should be able to be stored in a package sealed with evidence tape.

1 0

Re: Hardware-random-bits interface
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:17 PM 11/15/95, David K. Merriman wrote: >At 02:31 PM 11/14/95 -0800, you wrote: >>I've been thinking about physically random bits recently, so >>I'd like to offer a simple, easily implementable interface to a >>source of such bits, along with a design sketch using a common >>radio receiver chip as the noise source. > >It sounds like a fairly decent idea, _as long as you shield the bejeebers >(technical term :-) out of it_. Otherwise, anybody with a signal generator >could skew your numbers however they saw fit: any component lead can act as >an antenna, no matter now small that lead is. But if you "shield the bejeebers out of it," then all the radio receiver generates is whatever signal manages to sneak through--which, ironically, would make it _easier_ for an outside attacker to drive--and some amount of internal receiver/amplifier noise, such as the Johnson noise talked about here. (Every receiver has an "equivalent noise temperature," recall.) And if one is left with only internal noise, why not simply use a nice clean source like a Zener diode? --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

Re: Hardware-random-bits interface
by David K. Merriman 17 Dec '03

17 Dec '03

At 02:31 PM 11/14/95 -0800, you wrote: >I've been thinking about physically random bits recently, so >I'd like to offer a simple, easily implementable interface to a >source of such bits, along with a design sketch using a common >radio receiver chip as the noise source. It sounds like a fairly decent idea, _as long as you shield the bejeebers (technical term :-) out of it_. Otherwise, anybody with a signal generator could skew your numbers however they saw fit: any component lead can act as an antenna, no matter now small that lead is. One way to handle it would be to lay it out as a multi-layer PCB, with the signal & power traces inside, and ground plane on the outer layers. Then enclose the circuit components inside a shielding enclosure (mu-metal would be good) mounted to the PCB, then tuck the entire assembly inside another enclosure (small aluminum box for example, also connected to ground). Of course, there would be easier ways to fabricate it, but they would just make the shielding that much more difficult to implement. Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0