December 2003 - cypherpunks-legacy

Re: The FV Problem = A Press Problem
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 9:03 AM 01/30/96, Timothy C. May wrote: [...] >But, it occurred to me, this is just part of the larger syndrom. Simson's >article was practically written from the FV press release. While he >interviewed some "security experts," clearly the timing of his article >(this morning) and the announcement by Nathaniel of his discovery (this >morning) suggests the cozy relationship involved. > >The larger syndrome is that software deals, alliances, mergers, and >problems are all based on hype. Nathaniel Borenstein issues press releases, >Sameer Parekh issues press releases, and maybe even I would issue press >releases if only I knew how to. [...] I'd say _all_ news, not just software news, is P.R. controlled, these days. You can largely hold Edward L. Bernays, the "father of public relations" (who just died last year) responsible for that--or the societal conditions that allowed Bernays to do his thing. Bernays developed expertise in "engineering of consent" turned the news into a commercialized and manufactured commodity. As the NYT magazine "people who died last year" blurb on him said, maybe once you could trust that the news you read was something that a reporter or editor independently decided was newsworthy. Now, the news you read is manufactured in press releases to sell a product, and is there because a well written press release convinced a reporter or editor that a marketting ploy was actually a newsworthy event (or, perhaps, because the advertising dollars that went along with the press release convinced him). Witness FVs demonstration of key capture becoming a newsworthy event. If you want to effect what's in the media, maybe you should learn how to issue press releases. > Journalists seem to love this, because the press releases write the > stories. Companies like it, too, because they can get free newspaper > space. Everyone is scratching each other's back. Yup. Throw the government into the mix too, and I think you've got a pretty good model of the media. -- "The conscious and intelligent manipulation of the organized habits and opinions of the masses is an important element in a democratic society. . . Those who manipulate this unseen mechanism of society constitute an invisible government which is the true ruling power of our country." -- Edward Bernays

1 0

why no FV defenders
by cman＠communities.com 17 Dec '03

17 Dec '03

[in response to Ted Anderson <ota+(a)transarc.com>, who wondered why cypherpunks are so unanimous in denouncing FV, when we are usually at each other's throats.] Most of the pile-on can be attributed to the fact that FV does _not_ really see encryption as part of the solution. Other than bits of lip service here and there in technical groups, they actively denounce it when they don't think anyone who knows better is watching (I've seen it with my own eyes at banking conferences, etc.) Their extremely supercilious attitude doesn't help either. The fact that their commerce model is skewed towards long-settlement, non-anonymous transactions of extremely soft goods makes them unsympathetic -- although, say, the Digicash people are just as condescending and certainly _more_ difficult to deal with on a business level, they have a product that is more applicable to transactions cypherpunks are generally concerned with, so they get pile-ons that are maybe half this size, and usually have some defenders. Also, clearly, Digicash and other vendors are involved in producing cryptographic products, whereas FV is actively involved in spreading FUD about the abilities of crypto products in general... this is sort of like advocating cat torture on rec.pets.cats and expressing amazement at the negative response. This is not to say that there isn't a problem with the current state of operating systems, especially PC operating systems, or to say that crypto is magic dust you can sprinkle & make things secure but I think there's a general belief here that the ultimate solution to these problems has a substantial role for cryptography, and that cryptography can be used even today to reduce risk to acceptable levels in consumer financial transactions. FV does _not_ believe either of these things, although I'm sure NB will pay some lip-services on the "eventually" score. ------ ------ Douglas Barnes "The tighter you close your fist, Governor Tarkin, cman(a)communities.com the more systems will slip through your fingers." cman(a)best.com --Princess Leia

1 0

Re: Crypto Exports, Europe, and Conspiracy Theories
by cme＠cybercash.com 17 Dec '03

17 Dec '03

At 11:06 1/26/96, Adam Shostack wrote: >Timothy C. May wrote: > >| You have to ask yourself this question: "Why are there no cryptographically >| strong products--finished products, not specific ciphers or chunks of >| code--developed in Europe and freely imported into the U.S.?" > > There are. If you buy a Gauntlet Internet firewall from TIS, >you can also buy a German T1 speed DES card for it. I believe the >code was written by TIS's London office. The Israeli Firewall-1 >(version 2) firewall offers VPN (Virtual Private Networks) with some >decent encryption scheme. The German company is CE Infosys -- and they make a PCMCIA DES card also, BTW. The PC card is a decent performer but I haven't tested speed (of the interface) for the PCMCIA card. The code driving the card was written in Glenwood MD. The Gauntlet uses normal SWIPE protocol. It can not be exported at this time. However, there is a plan afoot at TIS to produce a version of Gauntlet with full 56-bit DES SWIPE -- but with TIS CKE added to the communication stream and therefore making the product exportable. For more information, you can check TIS's web page www.tis.com - Carl +--------------------------------------------------------------------------+ | Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | "Officer, officer, arrest that man! He's whistling a dirty song." | +----------------------------------------------------------- Jean Ellison -+

1 0

ANNOUNCE: Experts Predict End Of Secure Communications (makes FV's announcement look pretty silly too)
by cjs＠netcom.com 17 Dec '03

17 Dec '03

EXPERTS PREDICT END OF SECURE COMMUNICATIONS (East Bumbleton, Arkansaw) Experts from Really Neat Idea Labs have predicted the end of secure communications on the internet. The firm today announced that anyone watching another person enter a credit card on a computer could possibly get that person's credit card number. A spokesperson for RNI Labs said, "Wow man! This is like an incredible discovery, man. If you can like see someone entering their card number then you can like look at what keys they push and like get their number and like charge stuff to them. There is like no hardware or software on earth that can like prevent it." The spokesperson went on to say that the reprocussions of their discovery could lead to world-wide economic chaos, a rebirth of the third reich, and the 27th coming of Jesus Christ. In a related story, retired talk-show host Johnny Carson is under federal investigation. An anonymous tipster told authorities that Mr. Carson has been using his "Amazing Karmack" hat to guess the credit card numbers of newly mailed cards. Mr. Carson could not be reached for comment.

1 0

Re: PPP link encryption?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:36 AM 1/30/96 -0500, Alexandra Griffin wrote: >Is there any software out there on the net for doing real-time, >transparent encryption of a PPP link? >... >Finally, could someone make a ballpark estimate as to the amount of >additional latency that would be added? Ballpark estimate: If the encryptor receives a complete packet before encrypting and forwarding it then there would be an additional packetSize/byteRate + encryptionTime seconds added to the packet's transit time. If the encryptor encrypts "on the fly", passing the bits of a packet as their are received, then it would add almost no latency. However, the encryption algorithms would be limited to stream cyphers, which have security and error recovery implications. See "Applied Cryptography" for details. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

Re: KOH "Helpful" Crypto Virus
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 13:20 1/30/96, Laszlo Vecsey wrote: >I'm looking for more information on the KOH Virus, a 'helpful' virus which >kindly asks to infect your system and encrypt all of your data. It spreads >to floppies (upon request) and to other systems, encrypting all files. [...] >Please point me towards the source/binary, or further information. You can get the binary, full source, and manual on disk for $32 plus $3 for S&H from American Eagle Publications POB 1507 Show Low, AZ 85901 (800) 719-4957 (520) 367-1621 While you are at it, you might also want to pick up their famous collection CD-ROM full of virus code, live viruses, virus creation engines, etc. From their catalog: "For starters, you get a fantastic virus collection consisting of 574 families [...] about 3700 carefully tested and cataloged viruses in all...$99 + $5 S&H. A must have :-) -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: New Mailing List (encrypted)
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:21 AM 1/30/96 -0800, anonymous-remailer(a)shell.portal.com wrote: >On Sat, 13 Jan 1996 13:42:49 -0600, <perry(a)vishnu.alias.net> wrote: > >> I have installed PGPdomo on vishnu.alias.net. I've also >>created a new mailing list that you can join if you wish. It's a >>closed mailing list, so subscriptions must be approved. What makes > >If we have attempted to subscribe, but received no response, does that >mean that we didn't get approved? If so, how can we "qualify"? I have noticed that the software they are using is VERY picky about he formatting of the request and how it is encoded in PGP. To get it to work, I had to use the EXACT instructions posted to get it to subscribe. The PGPMajordomo software is a great idea, but in practice it has not been that fun to use. The biggest problem has been that the mail client I use does not do PGP that well. Hopefully the state of E-Mail support for PGP will change. Another project to add to the list... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ Is the operating system half NT or half full?

1 0

your bogus post
by Paul Graham 17 Dec '03

17 Dec '03

We run an online mall. We had been planning eventually to offer the store owners the option of taking fv payment as well as credit card numbers. After reading your recent post to cypherpunks, which I would say is the most bogus post ever made on this bogus subject, we are determined *not* to use fv payment systems if we can possibly avoid it. That post was news to no one. The kind of attack you "discovered" has been known about for years, and is just not a serious threat. Your post was nothing but a calculated attempt to frighten end users, and get publicity for fv. A company capable of doing such irresponsible things is not one that we would trust with users' money. -- pg

3 2

RE: FV Demonstrates Fatal Flaw in Software Encryption of Credi tCards
by David Van Wie 17 Dec '03

17 Dec '03

On January 30, 1996 hua[SMTP:hua@chromatic.com] wrote: >> the credit card companies in detecting fraud and locating criminals is >> quite real. > >Retail clerks are not lone bandits. My point is not that all retail clerks are bandits. Most are trustworthy, but surely any long time CC user has given their card to someone who would rip them off if they thought they could get away with it. My point is that CC #'s are not national security secrets, they are disclosed to potential adversaries regularly. >> Of course, since Federal law requires the credit card companies, not the >> user, to pay the costs of fraud, First Virtual's entire premise is a red >> herring. If the credit card companies are willing to take the risk, they >> will (and are). > >Federal law does not require that a company stay in business once it >has entered the banking market. The point is FV's post relies on a frightening and false premise - that the users are exposed to one or more financial risks by FV's keyboard sniffer threat. dvw

1 0

Re: Denning's misleading statements
by cme＠cybercash.com 17 Dec '03

17 Dec '03

At 20:49 1/27/96, Timothy C. May wrote: >I've never met Dorothy Denning, so I hesitate to characterize her as a >villainess. But certainly she's the only noted cryptographer I know of >who's gone so far out on a limb to defend a position the vast majority of >computer scientists, civil libertarians, and cryptographers scoff at. I've met some others -- most noteably Silvio Micali [but he has a financial interest in that position]. However, DERD is the only one I've met who is all the way over on Freeh's side. - Carl +--------------------------------------------------------------------------+ | Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | "Officer, officer, arrest that man! He's whistling a dirty song." | +----------------------------------------------------------- Jean Ellison -+

1 0