December 2003 - cypherpunks-legacy

Small German bank claims first with online service
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

> FRANKFURT, Aug 28 (Reuter) - German private bank Gries & >Heissel Bankiers on Wednesday launched an Internet banking >service -- the first comprehensive service of its kind in a >country where online bank options are gradually taking off. > The small Berlin-based bank linked up with U.S. computer >firm Hewlett Packard Co to develop the system, which Internet >users can access using a high-security personal code. > Clients will be able to view detailed balances on their >deposit, current and securities accounts and transact all normal >banking business on the World Wide Web. > Although online banking is a developing trend on the German >financial services market, larger banks with far broader >customer bases are working on more selective Internet packages. > Thomas Gries, one of Gries & Heissel's personally-liable >directors, said he regarded Internet banking as a logical >supplement to the bank's existing services. > ``We have had an Internet home page since October 1995. This >move from a pure information medium to an interactive one was a >logical one,'' Gries said. > Banking officials attending the CEBIT electronics conference >in Hanover this week said German online banking business was >poised to grow dramatically. > ``In the next six months, five to ten German banks will be on >the Internet,'' said Stefan Schoeller, board member at Bayerische >Vereinsbank AG unit Vereins- und West Bank. > Vereinsbank plans to launch Internet services within about >six months via its Advance Bank direct unit, pending a review of >security options. > Rival discount broker Direkt Anlage Bank, a unit of >Bayerische Hypotheken- und Wechsel Bank AG, on Tuesday launched >an Internet service for its securities account holders at half >the cost of its telephone banking service. > Meanwhile market leader Deutsche Bank AG is to test >electronic cash on the Internet this autumn in a joint >initiative with Dutch electronic payments group Digicash NV. > Vereinsbank officials at CEBIT said they planned a steady >expansion of the bank's online options over the coming years, >predicting 10 to 15 percent of its current account clients would >be online by the year 2000. Around 12 million Germans would rely >on home banking by that date, the bank predicted. > At the moment, around 3.7 percent of the bank's clients, or >45,000 individuals, handle their banking via PC alone, Stefan >Schoeller said. > Hewlett-Packard's German sales manager Michael Lindner said >his company, which last year helped set up the world's first >Internet bank, Security First Network Bank, had spoken to >several other German banks about some kind of Internet venture. > ``We certainly do not plan to limit our involvement to a >small exclusive bank,'' he said. > Lindner said there were about two million Internet users in >Germany and 35 million worldwide. He admitted that the amount of >bank business transacted on the Net -- about $200 million -- was >``very limited'' but predicted a dramatic rise in volume. > Vereinsbank's Schoeller said the cost advantage alone made >it worthwhile for customers to go online. A normal current >account incurred charges of 8.40 marks a month, while the same >account online would cost just 5.40 marks, he said. > All banks are stressing the security of the Internet. > > > _______________________ Regards, Boredom is the feeling that everything is a waste of time; serenity, that nothing is. -Thomas Szasz Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Cypherpunks Lite
by youssefy＠ucla.edu 17 Dec '03

17 Dec '03

There was a posting by someone about three weeks ago that gave the address for a person who ran a filtered version of the cypherpunks list, can someone please repost that information?

2 1

Re: MSIE cryptography
by Peter Trei 17 Dec '03

17 Dec '03

John Hemming - CEO MarketNet" <johnhemming(a)mkn.co.uk> writes: > Just downloaded the most recent English Version 2.1 for Windows 3.1. > This does appear to do the same in terms of no encryption at all after > the server hello. > > To be fair to Microsoft the number of cycles performed for the private key > echange is quite high. Therefore, not having any key and not doing the > RSA calculations makes the access quite a bit faster. > > The older versions (and some Win95 versions) that we have found around > seem to just crash our server. I am not really feeling like debugging that. I understand that some versions of MSIE support SSL level 3. SSL3 includes a capability to switch 'cipher suites' in mid-session, or pick one at the start of the session. One of the standard cipher suites performs authentication, but not encryption. This is consistant with your description. Please ensure that the server you are connecting to is not configured for authenticate-only. It would be a pity to raise a big ruckus over what may be just a mis-configured server. Peter Trei trei(a)process.com

2 1

Re: In reference to comments made to me and to the Group
by Institute for Security and Intelligence 17 Dec '03

17 Dec '03

Mr. Geiger: I do not have interest in nor time for a flame war. But I do appreciate your perspective, whether or not I agree. Rather than flaming, I propose that all interested readers post their *CONSTRUCTIVE* ideas on the CyberTerrorism issue. If you feel it is not an issue, then don't respond. I'm not looking for opinions on politicians, the government, etc., nor do I care what you think of me or my views. However, if you can put some _solid_ thoughts into bullet items, or any other format you deem useful, perhaps we can move forward. Ideas. Actions. No commentary, raves, rants, flames, or other bandwidth wasters. Let's see what we come up with. Barry C. Collin Institute for Security and Intelligence

3 2

Moscowchannel.com hack
by Joel McNamara 17 Dec '03

17 Dec '03

Not really crypto, but related to the DOJ hack in a way. Moscow Channel is a pretty slick, Russian news/commentary page. Their Web site was hacked and altered by someone who didn't seem to like Russians all that well. See: http://www.moscowchannel.com/ While not as elaborate as the DOJ hack, it's interesting that Web page vandalism is starting to turn into a unique form of protest and social commentary. As Web sites with security holes increase, my guess is vandalism will increase incrementally. Both in terms of random graffiti, and targeted attacks. Just a matter of time before some builds a dedicated Satan type tool that scans for HTTP server holes or messed up file permissions to make locating potential victims easy.

5 7

Re: DON'T Nuke Singapore Back into the Stone Age
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:35 AM 8/31/96, Arun Mehta wrote: >There are two sides to this: after all, it is the Singaporeans who finally >have to sort out this problem with their government, and denying them >the Usenet platform for discussion would only hinder that process. The point is to make clear to them that the Usenet and similar Web sites are global in nature, not subject to censorship without a very high local cost. If discussions of Lee Kwan Yew's dynasty are considered illegal, then Singaporans will have to choose not to carry the various newsgroups into which *I* post such messages! (This was done by many of us during the Karla Homulka and Teale trial in Canada a couple of years ago: Canada imposed press restrictions on discussion of the trial and the grisly evidence...and then was chagrinned to find that the global Net did not adhere to their notions of what should and could be discussed. They even seized copies of "Wired" at the border, very much akin to Singapore's stone age policies.) >Then again, inappropriate postings are the bane of the Internet: the consensus >on which the Net functions relies heavily on people not posting >inappropriately. This works imperfectly, as all long-time surfers of the Usenet will attest! And _never_ has it involved determinations of "inappropriate" by _governments_! Our point in protesting Singapore's actions (and Germany's, France's, America's, India's, etc., in other cases) is to technologically subvert their notions that their politicians can determine what the Net, Web, and Usenet carry. To be blunt, if Singapore wants to stop me from discussing the dictator Yew and his feeble son, they can't. Except by pulling the plugs on forums in which my posts are carried. I consider this a Good Thing (that politicians in Country A generally have no power to tell citizen-units in Country B what they can say and what they can't). The point of being sometimes "impolite" (*) is to "force their hand." (* I find it Orwellian that being "polite" is taken to mean not saying anything controversial. It was impolite for Salman Rushdie to write "The Satanic Verses," is was impolite for people to mention Karla Homulka in talk.politics.canada, it was impolite to point out that the prime minister of India drinks a glass of his own urine every day, it was impolite to refer to Bill Clinton's dalliances with Paula Jones, and so on. In a free society, all things are discussable. That various countries want to make the Net less free is not something we should support, even if it is more "polite" to accede to the wishes of their dictators, secret policemen, demagogues, preachers, and henchmen.) --Tim May -- [This Bible excerpt awaiting review under the U.S. Communications Decency Act of 1996] And then Lot said, "I have some mighty fine young virgin daughters. Why don't you boys just come on in and fuck them right here in my house - I'll just watch!"....Later, up in the mountains, the younger daughter said: "Dad's getting old. I say we should fuck him before he's too old to fuck." So the two daughters got him drunk and screwed him all that night. Sure enough, Dad got them pregnant, and had an incestuous bastard son....Onan really hated the idea of doing his brother's wife and getting her pregnant while his brother got all the credit, so he pulled out before he came....Remember, it's not a good idea to have sex with your sister, your brother, your parents, your pet dog, or the farm animals, unless of course God tells you to. [excerpts from the Old Testament, Modern Vernacular Translation, TCM, 1996]

10 12

encryption
by patrickbc＠juno.com 17 Dec '03

17 Dec '03

Will pay $5.00 for a good encryption program. Write to patrickbc(a)juno.com

1 0

RE: Encryption
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:52 PM 8/30/96, Benjamin Suto wrote: >I'm probably the last person who could mention something intelligible >here, but assuming this encryption algorithm works, and Joe wants to give >Jane a file, how would he tell her how to decrypt it? There are two parts to this: the algorithm and the key. For a strong cipher, the algorithm can be told to Jane...there is no real security in "security through obscurity." The remaining part is the _key_. It can be communicated in person, prior to sending the message (or after, though this is of course a less interesting situation). Or by a trusted courier, again prior to the encrypted communication. (A common thought error newcomers make is to ask "If the key can be communicated securely, why is encryption needed?" Think of military communications--the keys are established before a mission, then units can communicate securely, even over insecure radio channels.) Public key cryptography allows Joe and Jane to communicate without any exchange of private key material. Joe encrypts a message to Jane's public key, then sends it by some channel. Jane can decrypt it, using her private key. >If he found a "secure medium" to give her the passcode under, wouldn't >encrypting it be useless since he could just use that secure medium to >send the original file? As I said, think of _time value_. It is often necessary to exchange key material (or get public keys in advance of a communication) before a message sending is needed. Also, key materials may be exchanged via reasonably-secure channels, such as FedEx delivery, and then the Internet may be used for actual messages. While FedEx may be vulnerable to interception in certain cases, clearly this is an improvement over using no encryption. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Real-time key server
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 04:30 PM 8/27/96 DST, "Osborne, Rick" <OSBORRI(a)msmail.northgrum.com> wrote: >In my research into keyservers, I find that none of them are realtime. > Sure, there are CGI interfaces to them, but that's not what I mean. I was >hoping for something along the line of a Finger or SMTP protocol, such that >a client connects to a host (say, keyserv.northgrum.com) on a certain port >(say, 5397) and goes through a realtime version of what is accomplished via >email. [...] >Why? Because: >1. I do not want to reinvent the wheel. >2. I would like to conform to existing standards. There are at least three shapes of wheel readily available. Some of the keyservers have had finger interfaces; there was one on wasabi.io.com for a while, though it may be inactive. John Perry may know where to find source code for it? Assuming you want PGP keys delivered in ASCII format, finger protocol should work just fine - you could easily enough hack your own fingerd server to live on the fingerd port, which gets PGP key files from a directory or database instead of from users' home directories, and run it on pgp.northgrum.com or whatever. You could even hack the existing finger code from {Free,Net}BSD, making sure to clean up any remaining sprintf()s and {*}get()s. Alternatively, a CGI query _is_ an easy way to do it, and there's existing code on the MIT keyserver that's blazingly fast. John Gilmore's SWAN project is using a DNS-based PGP key server; check out http://www.cygnus.com/~gnu/swan.html for more details. >Okay, I was told to not post to the list until I'd: >1. Lurked for a month, >2. Figured out who Detweiler was, >3. Found out about BlackNet and DC Nets, >4. Learned of at least three of David Chaum's innovations. >And at that point "[I] may be ready to post [my] first comments." > >Well, dammit, I can't wait that long. I need help now. I've only been on >for 2 weeks, I have no clue who Detweiler is (other than the >welcome message I haven't heard two words about him/her/it), and I know >enough to sound stupid about the other stuff. But if you still think I'm >worthy of listeneing to, then read on. Three out of four ain't bad, and Detweiler's been using his alias on the list for a couple of years and acting quite civilized :-) Some good reading sources are Bruce Schneier's book "Applied Cryptography" and Tim May's "Cyphernomicon" piece which is on the web somewhere. Also, asking for pointers to existing work does categorize you with the clueful minority..... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

1 0

PGP Comments Considered Occasionally Harmful Re: Pronto making a comment
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To cypherpunks, Re: mbabcock and Jim Ray's discussion. >> How did you get Pronto to do a comment? > >I added a "comment=" in my config.txt ;) ... the old fashionned way. ... >-----BEGIN PGP SIGNATURE----- >Version: 2.6.3i >Charset: ascii >Comment: http://www.cyberbeach.net/~mbabcock/PGP/ Note that the comment makes traffic analysis much easier. Sure, you can send your mail through five different remailers, but if each layer of PGP has your home page URL or some other distinctive Comment:, it's traceable. -----BEGIN PGP SIGNATURE----- Version: 2.7.1 Comment: PGP available outside U.S.A. at ftp.ox.ac.uk iQBVAwUBMif6ZvthU5e7emAFAQHh2AH/R4KY4MPQBjF2XCeeFCY5XPVQTePvPwT6 5MAAzyTL/8RwU0Ul7G7rQgeb/08CxqetC0Ry22AhMV8uEV6DgTbcLg== =4Ttw -----END PGP SIGNATURE----- # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

1 0