December 2003 - cypherpunks-legacy

your bogus post
by Paul Graham 17 Dec '03

17 Dec '03

We run an online mall. We had been planning eventually to offer the store owners the option of taking fv payment as well as credit card numbers. After reading your recent post to cypherpunks, which I would say is the most bogus post ever made on this bogus subject, we are determined *not* to use fv payment systems if we can possibly avoid it. That post was news to no one. The kind of attack you "discovered" has been known about for years, and is just not a serious threat. Your post was nothing but a calculated attempt to frighten end users, and get publicity for fv. A company capable of doing such irresponsible things is not one that we would trust with users' money. -- pg

3 2

RE: FV Demonstrates Fatal Flaw in Software Encryption of Credi tCards
by David Van Wie 17 Dec '03

17 Dec '03

On January 30, 1996 hua[SMTP:hua@chromatic.com] wrote: >> the credit card companies in detecting fraud and locating criminals is >> quite real. > >Retail clerks are not lone bandits. My point is not that all retail clerks are bandits. Most are trustworthy, but surely any long time CC user has given their card to someone who would rip them off if they thought they could get away with it. My point is that CC #'s are not national security secrets, they are disclosed to potential adversaries regularly. >> Of course, since Federal law requires the credit card companies, not the >> user, to pay the costs of fraud, First Virtual's entire premise is a red >> herring. If the credit card companies are willing to take the risk, they >> will (and are). > >Federal law does not require that a company stay in business once it >has entered the banking market. The point is FV's post relies on a frightening and false premise - that the users are exposed to one or more financial risks by FV's keyboard sniffer threat. dvw

1 0

Re: Denning's misleading statements
by cme＠cybercash.com 17 Dec '03

17 Dec '03

At 20:49 1/27/96, Timothy C. May wrote: >I've never met Dorothy Denning, so I hesitate to characterize her as a >villainess. But certainly she's the only noted cryptographer I know of >who's gone so far out on a limb to defend a position the vast majority of >computer scientists, civil libertarians, and cryptographers scoff at. I've met some others -- most noteably Silvio Micali [but he has a financial interest in that position]. However, DERD is the only one I've met who is all the way over on Freeh's side. - Carl +--------------------------------------------------------------------------+ | Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | "Officer, officer, arrest that man! He's whistling a dirty song." | +----------------------------------------------------------- Jean Ellison -+

1 0

Re: Lotus Notes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 20:25 1/29/96, Charlie_Kaufman/Iris.IRIS(a)iris.com wrote: >The Notes R4 approach gives the best of two fairly unpleasant worlds. You can >export crypto if you either limit yourself to 40 bits [...] > >Notes R4 didn't give up anything to get this. Of course Lotus gave something up for it. The voluntarily made sure that even the supposedly non-GAK domestic version provides relatively easy access for the authorities. Sixty-four bits are an inconvenience, but nothing more. If Lotus had wanted to make the domestic version GAK free, they would have used 128 bit. In the end Lotus caved in twice: they released a 'super easy' GAK international version and a not 'quite so easy' GAK domestic version. Sixty-four bits is GAK. Period. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: The FV Problem = A Press Problem
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tbyfield(a)panix.com (t byfield) on Tue, 30 Jan 3:49 PM > Chomsky took the phrase from a book by Walter >Lippman, published I think in 1922; the book's name >escapes me now. Would that be "Public Opinion?" If so, that's an interesting progression: Bernays to Lippman to Chomsky: PR begets PO begets ... How would the politico-linguist's advocacy be characterized, PR, PO or whatever is evolving parasitically from hegemonic, ever manipulative media? All the variations of MCI-MS-News-Oracles, global combos and recombos burgeoning and emerging. All the promising, braying, dreaming, lying, manipulating markets and investors reminds of Lippman's and Bernay's and Chomsky's warnings about evil-doers causing the sky to fall.

1 0

My mail to Nathaniel (was Re: Re: FV Demonstrates Fatal Flaw inSoftware Encryption of Credit)
by Paul M. Cardon 17 Dec '03

17 Dec '03

My mailer insists that Nathaniel Borenstein wrote: > Hello. I am Nathaniel Borenstein's automatic mail robot. I should have suspected as much. Hello robot. Nice robot. Busy robot. > > Your message is in the highest priority category of mail that was > not sent through the "urgent backdoor". Nathaniel WILL READ YOUR > MAIL SOON, most likely tomorrow morning. Busy Nathaniel. > THE "URGENT BACKDOOR": If your message absolutely cannot wait until > tomorrow morning, or possibly a bit later, please re-send it to the > address "nsb+urgent(a)nsb.fv.com". Please make note of the special > urgent address for future reference. Be warned, however, that > Nathaniel can tell me to override the "urgent" delivery for anyone > who regularly abuses it. You gotta be kidding. I just gotta see the response from this one. > Additionally, if you're someone he doesn't know, Nathaniel will NOT > ANSWER your mail if the answer is contained in the NSB FAQ. I can most assuredly aver that my comments and questions were not covered in the NSB FAQ. ;-) --- Paul M. Cardon -- I speak for myself. 'nuff said. MD5 (/dev/null) = d41d8cd98f00b204e9800998ecf8427e

1 0

Re: FL Demonstrates Fatal Flaw in Logins
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:49 AM 1/30/96 -0500, Perry E. Metzger wrote: >Benjamin Renaud writes: >> The only events a Java applet is privy to are those that are typed in >> an applet window (and only those it itself spawned). > >Don't say "is privy". Say "is supposed to be privy". Doubtless bugs >will appear in java security in the future -- they've shown up in the >past. My bigest worry about Java security is the size of its "security kernel". Having a small, well defined, security kernel is a big advantage. All the better if the source is available for public review. Java has a large, and to me somewhat undefined "security kernel". (BTW - I havn't been able to find on the web pages the kind of overview of the libraries which would make the detailed method descriptions make sense. Perhaps I havn't looked in the right place.) ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

Re: FV's Borenstein discovers keystroke capture programs! (
by Peter Trei 17 Dec '03

17 Dec '03

In <kl3Wc7OMc50eRIr810(a)nsb.fv.com> "Nathaniel Borenstein" wrote: > We have a few pages of C code that scan everything you type on a > keyboard, and selects only the credit card numbers. How easy is that to > do with credit card numbers spoken over a telephone? ------------------------------------------------------------------------------------ In: <sl3SprmMc50eAWY4U=(a)nsb.fv.com> "Nathaniel Borenstein" wrote: >I used to trust the telephone not to be tapped in a selective way based on >keyword recognition, but in recent years, with the improvement in voice >recognition technology, I have stopped trusting it that way, and I know >plenty of other people have too -- if you say "NSA" into a cellular call, >you are probably inviting an eavesdropper. -------------------------------------------------------------------------------------------- Can you make up your mind, please? Do you regard automated voice recognition as a threat to your privacy, or not? Is there some reason you think it's lot easier to recognize a spoken "NSA" than "Three One Four One Five Nine Two Six Five Four"? Consistancy is a wonderful thing - you should try it sometime. speaking strictly for myself Peter Trei ptrei(a)acm.org PS: I've kept a log of this whole silly thread. It will not be forgotten.

2 1

Clipper
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

>> One of the interesting things about the whole crypto debate, going back at >> least to the Clipper announcement (and actually some months before) has >> been that the pro-restrictions, pro-GAK side of the argument has almost no >> defenders! Except for David Sternlight, Dorothy Denning, and Donn Parker >> ("attack of the killer Ds"?), there are almost no public spokesmen for the >> pro-restriction, pro-GAK side. >> There's quite a few folks in the Yale CS department that are pro-Clipper >> or fence sitters. They justify it in class by claiming that law >> enforcement needs these abilities if LE is to remain effective. I don't think "pro-Clipper" properly characters the enemy. Clipper is chip used in a voluntary federal standard. If we had sufficient civil liberties guarantees, I bet even a lot of c'punks wouldn't object to govt agencies using clipper chips. But the Freeh/Denning position, as I understand it, is that: * privacy is not a right * the govt should routinely spy on citizens * strong crypto should be illegal * no public debate on the underlying issues Are there other computer scientists with this position? Roger

1 0

No Subject
by prmoyer＠magpage.com 17 Dec '03

17 Dec '03

Well, I'm discouraged. I'm looking for strongly encrypted cellular telephones, but I can't seem to find many. If you know of some, could you pass along some pointers for me? I would really like to avoid using a GAK enabled product, if there's any way to avoid it (even if it means paying lots of extra $$$). Cheers, Phil

1 0