December 2003 - cypherpunks-legacy

Re: Tim's paranoid rant about Declan appearing on "Europe's Most
by Declan B. McCullagh 17 Dec '03

17 Dec '03

Forwarded from another mailing list. (Charles is a journalist/author...) ---------- Forwarded message begins here ---------- Date: Thu, 1 Feb 1996 09:11:19 -0500 (EST) From: Charles Platt <cp(a)panix.com> Subject: Out of Control Rich Graves' suggestion that Declan is "out of control" is interesting. Perhaps Rich merely meant that Declan made a mistake but the subtext suggests that Declan should be in some sense marching in step, following a consensus, obeying a policy. I don't like the smell of this. In my experience, having read MUCH literature from revisionists and from organizations such as Wiesenthal and ADL, it is IMPOSSIBLE for anyone to adopt an independent or middle path without raising the wrath of those on both sides of Jewish issues. I also suggest that public statements, especially from ADL/Wiesenthal, cannot be taken at face value. For instance: > * The ADL is tracking racist sites, but the goal is to expose them and > educate the public. Anyone who believes that this is the totality of ADL activities and intentions is simply unaware of the history of the ADL. I have personally witnessed an ADL representative trying to recruit hackers to paralyze a BBS where white-supremacist materials were stored. And this I think is just the tip of the iceberg.

1 0

Re:
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQ+jNCoZzwIn1bdtAQEgAwF+LRiwIlumqj6P2/pft8804Cbbttz3R7yL Pwd44+uUTk1SxJZePCt7O1jReYfDohTB =Ii6p -----END PGP SIGNATURE-----

1 0

Re: Apology and clarification
by Simon McAuliffe 17 Dec '03

17 Dec '03

For those that are sick of this thread (as I am), I apologize in advance for throwing another log on the fire. I just can't help trying to get through... Nathaniel Borenstein <nsb(a)nsb.fv.com> writes: > First of all, I believe that I owe the cypherpunk community an > apology for an error in judgement on my part. The message that I [...] > Our approach combines the following four known problems into a > fatal attack: > > 1) Consumer machines are insecure and easily compromised. > 2) Keyboard sniffers are easy to write. > 3) Credit card numbers are self-identifying (they have check digits) > and can easily be extracted from a huge stream of input data. > 4) Once intercepted, small amounts of information (e.g. a cc #) > may be distributed completely tracelessly over the Internet. > > When you put all four of these together, you have an attack that > IS new, in the sense that nobody we know of has ever mentioned it > before, and which could in fact be used by a single criminal, with > only a few weeks of programming, to tracelessly steal MILLIONS of > credit cards, if software-encrypted credit-card schemes ever caught > on. You're right, the four problems you mention are known and have been for a long time, and have also been used in attacks. What you don't seem to understand is that the overall attack from the combination of these isn't new either. In many ways a credit card number, name and expiry date form a password. It's a password that the bank accepts to allow money transfers in much the same way as a computer accepts a password to allow information transfers. On this very list (amongst other places), there has been discussion of trojans and viruses for grabbing passwords, and of methods of determining what is a password and what isn't a password. In the same way you can decide if a number is a credit card number, there are heuristics you can use to determine if a user is entering a password, though often it may require more than just monitoring keystrokes. To collect expiry dates and names for credit cards, monitoring additional side information may also be useful. So I see no fundamental difference between the two, credit card numbers _are_ passwords. I myself have used precisely this technique many years ago, as I'm sure many others here have, to demonstrate security problems. The only difference is the heuristic for determining what constitutes a password in the domain you're snooping. What's more, the methods in existence before your post can be and have been built in viruses which are considerably more prolific than a trojan. Not only is your attack not new, it is less powerful that some similar attacks that predated yours. Implying credit card numbers are more valuable than passwords is dubious. There are organisations that could lose millions of dollars if their password security was compromised, but it's hard to say the same for credit cards. In this country, although I don't know about yours, I'm not even liable if somebody steals my credit card and uses it. I would consider a "credit card password" as a lesser commodity than a password for giving access to an entire computer system. [...] > So here's the factual claim, to be proven or disproven: One good > programmer, in less than a month, can write a program that will > spread itself around the net, collect an unlimited number of credit > card numbers, and get them back to the program's author by > non-traceable mechanisms. Does anyone on this list doubt that > this is true? If so, I'd like to know the flaw in my thinking, -- > I am *not* too proud to withdraw any claims that aren't true. If > not, I think it's worth noting that this fact was previously > completely unknown to the bankers and businessmen who are putting > large sums of money at risk on the net. The only way to get the > message to those communities is with a very visible public > announcement of the kind you saw yesterday. Of course this is a threat, I don't think _anybody_ will deny that, but this is not a new threat. True, the attack may not have been known to businesspeople and bankers, but there are many others areas of security they also know nothing about. Trying to claim an old invention as your own just looks like hype, PR and lies, not to mention showing a lack of knowledge which could do the reverse from what you set out to achieve. It is certainly a Good Thing for the public to know about the potential for various types of snooping, but surely it could be done in some way which doesn't make it look like you invented it. I don't think anybody here objects to the attack itself, but rather the claims you made about it and the way you communicated it. --- E-mail: sai@comp.vuw.ac.nz/sai@kauri.vuw.ac.nz +64 4 233 9427 PGP Fingerprint: 65 5B B4 6C CB 6A 65 F1 01 91 B9 FE 34 23 99 D3 PGP Key by mail, finger or from http://www.vuw.ac.nz/~sai/pgp-key.html

1 0

Visa and MC announce Thursday
by PJ Ponder 17 Dec '03

17 Dec '03

sorry about screwing up the day of the week, today is really *Thursday*, not Friday. . . . first post of the day, & so forth. My earlier message: From: ponder(a)mail.irm.state.fl.us (pj ponder) To: cypherpunks(a)toad.com Subject: Visa & MC Std Sender: owner-cypherpunks(a)toad.com just heard this on NPR Friday ^^^^^^ am on the east coast of NA. http://www.nytimes.com/library/cyber/week/0201internet-safety.html February 1, 1996 Group to Unveil Industry Standard for Electronic Payments <the rest clipped> p.s. went right out and bought the NY Times and the WSJ, but they didn't have any more info than what is on the nytimes.com server. [return to signal mode]

1 0

No Subject
by hauke＠supra.kodak.com 17 Dec '03

17 Dec '03

unscribe cypherpunks(a)toad.com

1 0

Re: The FV Problem = A Press Problem
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

At 6:42 PM 1/30/96, Jonathan Rochkind wrote: >I'd say _all_ news, not just software news, is P.R. controlled, these days. >You can largely hold Edward L. Bernays, the "father of public relations" >(who just died last year) responsible for that--or the societal conditions >that allowed Bernays to do his thing. Bernays developed expertise in >"engineering of consent" turned the news into a commercialized and On January 13, 1996 I had the lead article in _Computer underground Digest_ (Volume 8, Issue 04) on the CyberAngels and how they were patrolling cyberspace against the Four Horsemen types. Rockland is certainly welcome to tell the cypherpunks list the press release(s) from which I wrote this "public relations." cc Tim May, CAF founder, chief technical officer, and media relations specialist

1 0

I hate over-hyped claims
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

Perception in some quarters to the contrary, I am very averse to over-hyped claims, and I would therefore like to publicly acknowledge a factual error in my previous announcement. I wrote: > The only known Internet-based solution that does not require such > hardware is the First Virtual Internet Payment system, details of which > are available at http://www.fv.com. This is not quite true, and I should have known better, but I forgot about the one other example I'd heard of. I should have said: > The only known Internet-based solutions that do not require such > hardware are the First Virtual Internet Payment system, details of which > are available at http://www.fv.com, and the GC Tech system, described at > http://www.gctec.com/. I apologize to the good folks at GC Tech for this unfortunate mistake. They are our competitors, but that does not mean we intended to make any false or misleading claims about them. I stand by all my other claims. -- Nathaniel -------- Nathaniel Borenstein <nsb(a)fv.com> Chief Scientist, First Virtual Holdings FAQ & PGP key: nsb+faq(a)nsb.fv.com

1 0

VISA /MC Press release
by John Pettitt 17 Dec '03

17 Dec '03

10:20 PR Visa And Mastercard Combine Security Specifications For Card Transactions On The Internet Into One Standard Companies: X.MST X.VSA Move Expected to Accelerate Development of Electronic Commerce and Bolster Consumer Confidence in the Security of Cyberspace Transactions PURCHASE, N.Y. & SAN FRANCISCO, Feb. 1 /PRNewswire/ -- Addressing consumer concerns about making purchases on the Internet, MasterCard International and Visa International joined together today to announce a technical standard for safeguarding payment card purchases made over open networks such as the Internet. Prior to this effort, Visa and MasterCard were pursuing separate specifications. The new specification, called Secure Electronic Transactions (SET), represents the successful convergence of those individual efforts. A single standard means that consumers and merchants will be able to conduct bankcard transactions in cyberspace as securely and easily as they do in retail stores today. The associations expect to publish SET on their World Wide Web sites in mid-February. Following a comment period, the joint specification is scheduled to be ready for testing in the second quarter of 1996. Visa and MasterCard expect that banks will be able to offer secure bankcard services via the Internet to their cardholders in the fourth quarter 1996. Participants in this effort with MasterCard and Visa are: GTE, IBM, Microsoft, Netscape Communications Corp., SAIC, Terisa Systems and Verisign. Also, SET will be based on specially developed encryption technology from RSA Data Security. "This is the first step in making cyberspace an attractive venture for banks and merchants. A single standard limits unnecessary costs and builds the business case for doing business on the Internet," said Edmund Jensen, president and CEO of Visa International. "Further, our work with MasterCard demonstrates our unwavering commitment to address the needs of our member financial institutions and their merchants and cardholders." H. Eugene Lockhart, CEO of MasterCard, said: "MasterCard has viewed one standard for secure card purchases on the Internet as a critical catalyst for electronic commerce because it bolsters consumer confidence in the security of the electronic marketplace. A single standard has always been our objective because it is in the best interests of not only consumers, but also merchants and financial institutions worldwide. We are glad to work with Visa and all of the technology partners to craft SET. This action means that consumers will be able to use their bankcards to conduct transactions in cyberspace as securely and easily as they use cards in retail stores today." The card associations will separately test SET with consumers, merchants and financial institutions. A joint interoperability test will be conducted after the individual tests to ensure SET, where necessary, operates as smoothly as the point-of-sale system used today. Upon conclusion of the tests, an updated version of the specification will be published for software providers. MasterCard's Web address is http://www.mastercard.com. Visa's Web address is http://www.visa.com. MasterCard International Incorporated is a global payments company that provides consumer credit, debit and other payment products in partnership with 22,000 member financial institutions worldwide. MasterCard's family of brands, MasterCard, Maestro and Cirrus, represent approximately 300 million cards in circulation, and over 13 million acceptance locations, including 243,000 MasterCard/Cirrus ATMs worldwide. MasterCard's pioneering work in the areas of transaction processing and delivery systems continues to revolutionize the way consumers pay for goods and services. Headquartered in the San Francisco Bay Area, Visa is the world's largest payment system. It plays a pivotal role in developing and implementing new technologies that benefit its 19,000 member financial institutions and their cardholders, businesses, governments and the global economy. Visa's 442 million cards are accepted by more than 12.2 million merchants worldwide. Visa/PLUS is the largest global ATM network. /CONTACT: David Melancon of Visa International, 415-432-2427; or Dorea Smith of MasterCard International, 914-249-1421/ 10:00 EST John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch

1 0

Anonymous Interview
by Duncan Frissell 17 Dec '03

17 Dec '03

"Anonymous" the author(s) of "Primary Colors" (the Clinton Campaign novel) conducted an interview with a Time Magazine writer using his/her/their agent's online account. A demonstration that borrowed accounts can overcome account ID control attempts. DCF

1 0

Re: Unscribe
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:34 AM 2/2/96, Ewout Meij wrote: >unscribe cypherpunks(a)toad.com ^^^^^^^^ > >unscribe emeij(a)pi.net ^^^^^^^^ > >There is a theory which states that if ever anyone discovers exactly >what the Universe is for and why it is here, it will instantly >disappear and be replaced by something even more bizarre and >inexplicable. There is a theory which states that the correct way to unsubscribe from mailing lists is defined by the mailing list charter and principles, and that sending misspelled "unscribe" messages to the wrong place, and including "unscribe" messages intended for other lists, is bizarre and inexplicable. --TCM P.S. to Ewout: Send a message to "majordomo(a)toad.com" with a body message consisting only of "unsubscribe cypherpunks". Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0