December 2003 - cypherpunks-legacy

Anyone know of a white paper on security?
by John Fricker 17 Dec '03

17 Dec '03

The question I'm seeking to answer is : What criteria should be used to determine whether a scripting language such as Java, LiveScript, etc. is secure? There are obvious issues such as access to the file system but has anyone thought this all the way through and codified a white paper? john.

2 1

Re: Still more on the Digicash protocol
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:26 12/8/95 -0600, Mark Twain Ecash Support wrote: >DigiCash agrees that it is desirable to encrypt the payment request. The >problem is how? You can't use the payor's public key, since the payor is >anonymous to the payee. There are other, high overhead, protocols that might >be used, but after taking MIM into account, securing the payment request >from within Ecash while retaining acceptable latency is much harder to >acomplish than one might think. Wouldn't a Diffie-Hellman key exchange work here? Or is that too much overhead? ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

"Information Technology for Control of Money Laundering"
by Michael Pierson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've just finished perusing the Office of Technology Assessment's "Information Technology for Control of Money Laundering" <ftp://otabbs.ota.gov/pub/pdf/money.laundering/*.pdf>. It's an informative and fascinating document for anyone interested in the issues of money laundering and its implications for the future of digital currency, as well as its increasing role as an important rationale in promoting government surveillance agendas. Broken into seven chapters, this document provides a valuable overview of the subject from the government's perspective. 1. "Electronic Money Laundering" covers the ABCs of money laundering and its connection to drug trafficking, terrorism and the global underground economy. It traces the relevant statutory history from the Bank Secrecy Act of 1970 onward. 2. "Mechanisms of Wire Transfer" examines the basics of wire transfers and the details of the FEDWIRE, CHIPS and SWIFT systems. 3. "Money Laundering and Law Enforcement" examines the laws and regulations involved and the various Federal and State Agency roles and responsibilities. 4. "Technologies for Detecting Money Laundering" is particularly interesting. It discusses the FinCEN Artificial Intelligence System (FAIS), and AI approaches including Expert Systems, Link Analysis, Neural Network techniques, Machine Learning and various statistical modeling methods. 5. "Privacy and Confidentiality" covers different investigative prerogatives, the legal history and case law of privacy jurisprudence, aspects of individual and corporate confidentiality, etc... 6. "International Issues" explores off-shore banking, international law enforcement efforts like the Financial Action Task Force (FATF) and the subject of bilateral and multilateral cooperative agreements and conventions. 7. "Conclusions and Policy Options" discusses money laundering and the world economy, and various policy directions for the future as well as the type of monitoring regimes that might be established. It pays particular attention to the subject of the future impact of digital money, observing: "As alternative modes of electronic payment, e.g., "digital cash", develop, whatever precedents are set for access to wire transfers might also be applied to these alternatives. If not, digital cash, or "the electronic purse" may provide another channel for dirty money, so that monitoring of wire transfers will no longer be effective." I noticed that major network news reports on the "growing threat" of money laundering were particularly evident in close temporal conjunction to the wide public coverage of the latest FBI CALEA revelations. Just coincidence, I guess... Bonus: While your there you might want to (if you haven't yet) pick up another OTA document entitled "Electronic Surveillance in a Digital Age" which provides some useful additional government position tracking data on the legal and technical aspects of CALEA. It's available in both text <ftp://otabbs.ota.gov/pub/elec.surveil/*.txt> and PDF <ftp://otabbs.ota.gov/pub/pdf/elec.surveil/*.pdf> formats. - -Michael -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMidCtGJlWF+GPx9AQGROQP+KtumqozBLlFgupOCcoKRIk6udFz0jRt4 Vt1y1noiV0tJCE2XQdEGiU7KhRHDC8QX+Zi1wxVqnlhxNI8hF5g4nDGf+DHyw54r KsXce7fJvPVZ3dn69dYIQ70gpa6BfAvsFXGAP9gnL3RxnxxYGfBknp2xdz0SiBQv t0bnWwIab68= =bWRK -----END PGP SIGNATURE-----

1 0

Re: More FUD from First Virtual
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:52 PM 12/8/95 -0500, Jon Cooper wrote: > The US government can stop it. It is irrelevant what *should* stop >it, but it's extremely useful to note that the US government's political >climate of paranoia and FUD in general will certainly not allow truly >anonymous cash systems inside of our country in the forseeable future. But who's going to ask? If an anonymous payment system springs up outside the US, we can use it as a store of value if nothing else or for shopping overseas. Domestically, we can convert non-anonymous payment systems into semi-anonymous ones. What counts is difficulty of transaction and market demand not legal structure. Thus, about five minutes after the "temporary VISA card" travelers check substitutes are issued, I can start selling them for (discounted) cash to all comers. Likewise Ecash laundry servers letting anonymous people use non-anonymous Ecash. It remains to be seen how much customers value anonymity. There should be a niche market in any case. DCF "Every man his own ISP."

1 0

BoS: Netscape 2.0b2 allows for invasion of privacy (fwd)
by bkuhn＠scientech.com 17 Dec '03

17 Dec '03

Talking of Netscape - this posting prompted me to forward it given the security and privacy implications inherent in the problem. Cheers Graeme ------- Start of forwarded message ------- >From: Scott Weston <scott(a)tripleg.com.au> >Subject: Netscape 2.0b2 allows for invasion of privacy >Newsgroups: aus.net.announce,comp.privacy >Date: Fri, 01 Dec 1995 11:09:06 +1100 Hi 'Net Dwellers, First off - I've posted this before (however not to this group) and only got a response from the Netscape Corp. They were glad I found the problem and said that they would fix it, however I feel that people should know about it. Also I would like people to help me spread this document around, i.e. if you know of a newsgroup (or people) that would find this interesting then please re-postit. On with the problem... I've recently got hold of the latest netscape, and was (at first) very excited about the new "LiveScripts" that it supports. If people don't yet know - these "LiveScripts" allow you to put small programs into your web page that is then executed by the Netscape client. There is no DIRECT way for these programs to send information back to the owner of the web page, however I was able to do it in a not-so-direct way. The "LiveScript" that I wrote extracts ALL the history of the current netscape window. By history I mean ALL the pages that you have visited to get to my page, it then generates a string of these and forces the Netscape client to load a URL that is a CGI script with the QUERY_STRING set to the users History. The CGI script then adds this information to a log file. Now if this hasn't quite CLICKED yet lets do a little example. Johnny Mnemonic starts up his newly acquired version of Netscape2.0b2 to start his daily "surf" session. First he decides to check his CD-NOW purchase and uses the handy Auto-Login URL. Then he decides to go to Lycos and do a search. In his search he find my page, which he decides to visit. Suddenly he is transported, not to my main page but to one of my CGI scripts, which in turn happens to have ALL the URL's he just been to in it. This means that in my log will be: - the URL to use to get into CD-NOW as Johnny Mnemonic, including username and password. - The exact search params he used on Lycos (i.e. exactly what he searched for) - plus any other places he happened to visit. I do this in a way that the user will KNOW that it has happened and will _hopefully_ email Netscape and tell them they are NOT impressed. But it would be EASY for me to change the CGI script so that the user is unaware that it has actually happened, unless they closely examine their URL history (in fact they'll probably just think its a netscape bug). If you're skeptical about this then do the test yourself. Get netscape 2.0b2 and do some normal surfing, and then go to Lycos. Do a search for: scotts car boot sale which should return the URL - http://www.tripleg.com.au/staff/scott Click on the URL and sit back an watch. First my main page will show up but a little while later you should be transported to a CGI bin script that will show you your URL history. I have tested this with both the Linux 2.0b2, and Solaris 2.0b2 versions and both have done the same thing. I would be interested in knowing if it happens for ALL versions of Netscape2.0b2. The log file does log the User Agent (i.e. the name of the platform you are using) so by simply going to the page I will know that your version of Netscape is also open to this form of attack. Currently I can find no way to configure Netscape2.0b2 to NOT run LiveScripts - and at the very least this option should be quickly added to the next version of netscape to be released. But a far better solution (IMHO) would be for netscape to pop up a window before running the LiveScript and let you know what the LiveScript wants access to, e.g. if it only wants to print out the current time then that's OK, but if it wants to read my history list and then transport me to a CGI script and add me to a logfile then maybe I would say NO. I think I've said enough.... If you've got any further questions, or want some more information just email me : scott(a)tripleg.com.au -- Scott. Quote from a car accident insurance claim: "I told the police that I was not injured, but on removing my hat, I found that I had a skull fracture." ------- End of forwarded message -------

1 0

Re: BoS: Netscape 2.0b2 allows for invasion of privacy (fwd)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:33 PM 12/8/95, Bill Kuhn wrote: >Talking of Netscape - this posting prompted me to forward it given the >security and privacy implications inherent in the problem. > >Cheers >Graeme > >------- Start of forwarded message ------- >>From: Scott Weston <scott(a)tripleg.com.au> >>Subject: Netscape 2.0b2 allows for invasion of privacy >>Newsgroups: aus.net.announce,comp.privacy >>Date: Fri, 01 Dec 1995 11:09:06 +1100 > >Hi 'Net Dwellers, "'Net Dwellers" or "Det Weilers"? Hmmhhh.... In any case, this has already come up a couple of times on the Cypherpunks list, and was even commented upon by Jeff Weinstein of Netscape a couple of days ago. The bug was fixed in b3. I really encourage people who are not following the list more carefully to check the back traffic before posting bug reports. Forwarding messages is often the culprit in this, as the forwarder simply assumes we may be interested, but he has himself not been following the thread. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re:Internet Stocks
by Ashfaq Rasheed 17 Dec '03

17 Dec '03

Can this be made a regular feature on the list? It will be helpful to discuss on the Internet companies are doing in the stock market. Also it would be interesting to see if any startups have a strong product to survive in the market Thanks! Ashfaq

2 1

InfoWarCon
by winn＠Infowar.Com 17 Dec '03

17 Dec '03

P L E A S E D I S T R I B U T E W I D E L Y InfoWarCon (Europe) '96 Defining the European Perspective Brussels, Belgium May 23-24 1996 Sponsored by: National Computer Security Association Winn Schwartau, President and CEO, Interpact, Inc. Robert David Steele, Chairman & CEO, OPEN SOURCE SOLUTIONS Information Warfare represents a global challenge that faces all late-industrial and information age nation states. It also represents the easiest and cheapest way for less developed nation-states and religious or political movements to anonymously and grieviously attack major nations and international corporations. Not only are the definitions of InfoWar unclear, but they span many areas and disciplines. This conference will examine the European perspectives on all three classes of Information Warfare while contributing some American lessons learned, mistakes made and successes enjoyed. Class I: Personal Privacy Class II: Industrial and Economic Spying and Warfare Class III: Global Conflict, Terrorism and the Military As at all other InfoWarCon, this special European Conference encourages active audience participation, contribution and debate. May 22, 1996 17:00 - 20:00 Pre-Registration 18:00 - 21:00 Hosted Cocktail Party with Music Most conference speakers will be in attendance. Meet Mr. Schwartau and Mr. Steele. May 23, 1995 07:00 - 08:30 Registration 07:00 - 08:30 Sponsored Continental Breakfast PLENARY SESSIONS 08:30 - 09:00 Keynote Speech Major General William Robbins Assistant Chief Of Staff, Command, Control, Communications, Computing, and Information Ministry of Defence, United Kingdom (Invited) 09:00 - 10:00 "Information Warfare: Chaos on the Electronic Superhighway" Winn Schwartau President and CEO, Interpact, Inc., USA An overview of Information Warfare from the civilian perspective by one of the world's leading experts on the subject. This will be an eye-opening presentation with time reserved for questions from the audience. Mr. Schwartau will be available throughout the conference for personal and private discussions as well as book signings. 10:00 - 11:15 Military View of Information Warfare Moderator: Captain Patrick Tyrell Assistant Director, Information Warfare Policy, Ministry of Defence, United Kingdom Panel: The German View The Russian View The Croatian View 11:15 - 11:45 Sponsored Break 11:45 - 13:00 Law Enforcement in Cyberspace: Cooperation is the Key: Panel Moderator: Winn Schwartau, Interpact, Inc. Panel: Interpol Surite FBI Netherlands How will global partners respect each other's laws and cooperate in their enforcement? Will extradition for cyber-crimes become necessary? Leading experts will walk us down the paths to success and offer lessons learned on failures and risks. 13:00 - 14:30 Lunch 13:30 - 14:00 Special Luncheon Presentation BREAKOUT SESSIONS 14:30 - 16:00 Breakout I: Threats to European Civil Prosperity Moderator: Admiral Lacoste/General Heinrich, France (Invited) Panel: Belgium Germany United Kingdom Europe is becoming as dependent upon its econo-technical infrastructure more than ever with the design and construction of the European Space Initiative. Communications systems create the basis for global commerce, transportation systems permit the distribution of goods, the financial infrastructure is a requisite component of any information based economy and the power grid glues it all together. But, the threats to their stability and integrity are many and must be dealt with on a continent that has a history of war and more recently terrorism. What are the risks? The rewards? And the solutions? Breakout II: Information Warfare: Support for Conventional War Fighting Moderator: TBD Panel: US - Gen. Jim McCarthy USAF (Ret) Russia Netherlands Conventional Wars and regional conflicts are replacing the fear of East-West conflict. Advanced Industrial and Information Age societies will supplement their armed forces with enhanced information processing capabilities. What are they and will they change the face of war? 16:00-16:30 Sponsored Break PLENARY SESSION 16:30 - 18:00 "Hackers: National Resources or Merely Cyber-Criminals?" Moderator: Mich Kabay, Ph.D. Director of Education, NCSA and Robert Steele, President, OSS, Inc. Panel: Hactic and The Digital City Experiment: Amsterdam, Netherlands (Invited) Hacker, United Kingdom CHAOS Computer Club, Germany Are hackers merely criminals operating under the guise of Internet freedom? Or are they national resources to be cultivated and who have served as an early warning system for Cyberspace? One group of American hackers have threatened to "Declare War on France" on behalf of American interests. How do we as nations deal with this? Mich Kabay and Robert Steele will debate the issue and then you will meet the hackers in person. The first Information Warriors invite your questions, comments and interaction. Learn first hand who they are, what they believe and how they function. 18:00 - 21:00 Hosted Reception 21:00 - 23:00 "Dutch Dinners" for Birds of a Feather Rallying points will be provided. May 24, 1996 07:00 - 8:30 Sponsored Continental Breakfast 08:30 - 9:00 Keynote Speech "Efforts to Maximize Information As New Age Weapon" (TBD) PLENARY SESSIONS 9:00 - 10:00 "Creating Smart Nations Through National Information Strategies: Intelligence And Security Issues" Robert David Steele, President, OSS, Inc. US Planning for the future requires new thinking and a new "triad" of defense: Open Source Intelligence, Electronic Home Defense and Information Warfare. 21st Century realities invite dozens more players whom must be monitored and controlled. Governments and the military should avail themselves of the publicly available open source information as part of their ongoing intelligence operations. Mr. Steele has suggested that nations should "draft" the civil sector by requiring 'due diligence' and very high standards of private sector communications and computing security. 10:00 - 11:15 "The Convergence of Military and Commercial Vulnerabilities" Moderator: Winn Schwartau, President and CEO, Interpact, Inc. Panel: Bob Ayers, DISA, Department of Defense, US Holland / Belgium UK France Much of military success depends upon the reliable operation of civilian and commercial systems. No longer do the government and military and private sector function in isolation. What levels of cooperation are required to assure proper defense and war fighting capability? How much of the private sector must be viewed as a national security asset - to be protected as much as is a forward deployed military unit? 11:15 - 11:45 Sponsored Break 11:45 - 13:00 Societal Impact of Information Warfare Moderator: Winn Schwartau, President and CEO, Interpact, Inc. Society is absolutely dependent upon technology; without networks and computers and communications, portions of society can collapse within days. If major systems fail, what will the reaction of a techno-reliant society be? And, what are the ethics of a military who instigates the collapse of an adversary's civilian infrastructure rather then resort to bombs and bullets? Is a techno-phobic society psychologically prepared for the consequences? 13:00 - 14:30 Lunch 13:30-14:00 Special Luncheon Presentation BREAKOUT SESSIONS 14:30 - 16:00 Breakout I: Legislation & Personal Privacy: A Global Electronic Bill of Rights? Moderator: General Pickering, Canada (Invited) Panel: Electronic Privacy International (Invited) Sweden The Vatican This panel will examine the different approaches governments take to protect the personal privacy of their citizens and what steps need to be taken to create a global consensus. How do differing privacy laws affect countries ability to do business? How will authoritarian regimes counter the perceived threat of free and open information flow? Breakout II: "Industrial Espionage: An Update" Moderator: DST, France (Invited) - (RS) Panel: Surite tells all Kroll Associates US Germany 122 Countries are actively engaged in industrial and economic espionage to the benefit of their respective states. It's a lot easier for a third world or agrarian society to steal intellectual and proprietary property than to invest time and resources develop their own. Who's involved and what are they doing? What steps need to be taken to defend such actions? 16:00 - 16:30 Sponsored Break PLENARY 16:30 - 18:00 Defining War in the Information Age "The New National Security" Brief comments by Winn Schwartau and Robert Steele - and then a lively interactive audience debate. An enemy bomb landing in any country can be easily construed as an act of war. However, in Cyberspace, anonymous acts of aggression that lead to war or replace conventional attacks are not so simple to classify. This highly charged subject will consider what war is and what it isn't: - Is an attack against a financial institution an act of war? - What about the intentional collapse of a communications infrastructure? - Is human lethality a necessary pre-requisite for war? - Do we need to redefine national security for the post Cold-War world? 18:00 - 18:10 Closing Comments 18:00 - 20:00 No-Host Reception Hotel Information: Hotel Palace rue Gineste 3 1210 Brussels Belgium +32 2 203 62 00 +32 2 203 55 55 (Fax) InfoWarCon (Europe) - 96 Registration Form: Name: ___________________________________________________________ Title: ___________________________________________________________ Org: ___________________________________________________________ Address: ___________________________________________________________ Address: ___________________________________________________________ City: ___________________________________________________________ State: _______________________________ Zip: _____________________ Country: __________________________ Email: ________________________ Phone: __________________________ Fax: _________________________ FEES: Payment made BEFORE March 1, 1996: ( ) $845.00 NCSA Members/OSS Attendees ( ) $895.00 All others ( ) $795.00 3 people from same organization ( ) $745.00 5 or more people from same organization Payment made AFTER March 1, 1996: ( ) $895.00 NCSA Members/Paid OSS Attendees ( ) $995.00 All others ( ) $845.00 3 people from same organization ( ) $795.00 5 or more people from same organization Make checks payable to NCSA, or Charge to: ( ) VISA ( ) MasterCard AMEX ( ) Number: ___________________________________________ Exp date: ___________________________ Signature: ___________________________________________ MAIL OR FAX OR EMAIL REGISTRATION TO: National Computer Security Association 10 South Courthouse Avenue Carlisle, PA 17013 Phone 717-258-1816 or FAX 717-243-8642 EMAIL: conference(a)ncsa.com To obtain the latest edition of this program, send EMail to: euroinfowar(a)ncsa.com For more information about NCSA: WWW: http://www.ncsa.com CompuServe: GO NCSA EMail: info(a)ncsa.com Sponsorships for various InfoWarCon (Europe) 96 events are still available. To find out how to sponsor portions: Contact Paul Gates at the NCSA: pgates(a)ncsa.com To reach: Winn Schwartau: Winn(a)Infowar.Com Robert Steele: ceo(a)oss.net V 1.1/12.7.95 Peace & Happy Holidays Winn Winn Schwartau - Interpact, Inc. Information Warfare and InfoSec V: 813.393.6600 / F: 813.393.6361 Winn(a)InfoWar.Com

1 0

Re: GAK and Self-Incrimination?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 8-DEC-1995 13:28:32.69 Given that GAK means one never knows if the government is listening, could a person claim protection against self-incrimination as a reason to not use GAK, and get away with it? (This is different from the phone system, which may also be tapped. The analogy would be the same if the government forced one to pick a telephone it could tap over one it could not, which so far has not been the case, but which soon may be if switching systems which are not compliant with Digital Telephony Act provisions are shut down.) Consider this hypo: I send an encrypted message to a partner in crime containing plans for future crimes and descriptions of past crimes. I don't GAK the message. The government prosecutes me under the Anti-Terrorism and Child Protection Act of 1997. My defense? That GAKKing the message would be tantamount to incriminating myself, which the Fifth Amendment protects me against. ------------------- There is the problem with this argument that personal diaries have recently (Packwood) been found to not fall under the Fifth amendment. However, IA(most definitely)NAL. -Allen

1 0

Re: Free calls to Govt (fwd)
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

I did and it did not work. At 04:22 PM 12/10/95 EDT, you wrote: > I've been told that number is out of date. Since I forgot to save it, >would someone who did check and find out? > Thanks, > -Allen > > -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0