December 2003 - cypherpunks-legacy

Randal Schwartz Petition
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I hate to do this, but for any of you that have been following the Randall Schwartz (or Perl fame) fiasco, there is now a URL with information about collecting petition signatures and letters of support for the sentencing judge. The URL is found at http://www.ugcs.caltech.edu/~kluster/petition.html/ Personally, I think it's rediculous all the crap that went into this conviction, but that's just my personal opinion. This probably isn't the correct place to discuss it, but misc.legal.computing has taken it up. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMDKdnDokqlyVGmCFAQGUNgP+NgqXU3p7Pb0vXYMb9gBiqDzGcIYeXdLG KfhmbTG0mOaVvcWzrrD7oEkdTXiPUhtzOknWH4C6OalSV54JwYGVEueOPfpeztBG 2u0izzyTX1UB2cCb352PxstpwSkrFoQHUqVCDRpHZcSNcTwfrS3vmYK5fLE5VY6n 203SEqfYupA= =Q4x2 -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GED/J d-- s:++>: a-- C++(++++) ULU++ P+ L++ E---- W+(-) N++++ o+ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G+++++ e++ h r-- y++** ------END GEEK CODE BLOCK------

1 0

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by cmcmanis＠scndprsn.Eng.Sun.COM 17 Dec '03

17 Dec '03

jweis wrote: > I have to agree, Netscape may spend some energy to upgrade their > encryption, but it really won't buy them all that much. SSL, to me, is > like using a "security envelope" to mail cash or putting the club on your > car. It presents just enough of an obstacle to keep honest people honest. This is the problem of using "physical" world analogies with the network. A similar argument that is posited is that "Sure its not 100% secure but its better than the carbons from a receipt (now gone) or people who don't shred their garbage." I respond that the network isn't the "real" world so the laws of physics don't apply. Someone in Boston MA is unlikely to fly into Sunnyvale to paw through my garbage, but it would be "trivial" for them to see my receipt go flashing by can throw some spare compute cycles at breaking it. A snooper/cracker program on a "spare" machine might yield a half dozen credit cards a week. I prefer the attitude of better vigilance through layered encryption. That is the transaction might be 40bit RC4 but the "jewels" (otherwise known as the credit authorization information) should be DES3. --Chuck Just my opinion of course.

1 0

ELINT easier than HUMINT
by tcmay＠got.net 17 Dec '03

17 Dec '03

(I've deleted the other list that was cc:ed here....) At 4:03 AM 8/17/95, Chuck McManis wrote: >This is the problem of using "physical" world analogies with the network. >A similar argument that is posited is that "Sure its not 100% secure but >its better than the carbons from a receipt (now gone) or people who >don't shred their garbage." I respond that the network isn't the "real" >world so the laws of physics don't apply. Someone in Boston MA is unlikely >to fly into Sunnyvale to paw through my garbage, but it would be "trivial" >for them to see my receipt go flashing by can throw some spare compute >cycles at breaking it. A snooper/cracker program on a "spare" machine >might yield a half dozen credit cards a week. I agree. This has direct parallels to "physical eavesdropping" vs. "electronic eavesdropping." After all, one might argue, why bother with encrypting phone conversations when a physical bug could pick up the audio? As Whit Diffie has noted, the difference is one of ease of use. It is hard to plant physical bugs...and expensive, prone to error, etc. It would also be pretty obvious, eventually, if every office in a building were physically bugged, but it would be almost undetectable if the Northern Telecom PBX box in the basement was being tapped on the way out. Crypto with back doors is even easier for the wiretapper. Electronic surveillance and related technologies (packet sniffers are a form of surveillance) are cheap by comparison to physical surveillance. And the concentration of communication lines and systems makes ELINT and COMINT much cheaper _per target_ than HUMINT. Now I don't personally worry too much at this time about giving my VISA number over the phone, or even over the Net...I can always deny making an authorization and the CC companies will not charge me (assuming the goods ordered were not also shipped to my address). But the future lies with protecting electronic transactions against surveillance. The breaking of SSL in Netscape is not terribly important in and of itself, given the government-imposed limits on key size, and given the sorts of things now being encrypted (like VISA numbers). It gets more important as the types of things encrypted become more serious. At least now we know how people were "vanished" in that recent movie. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

SmartCash (NewsClip)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Alliance formed to develop first nationwide smart card company New York, Aug. 16 (Reuters) - The United States is a step closer to cashless commerce. Fourteen banks and financial instutions said Wednesday that they will form a company to develop and issue the first debit card that can be used nationwide instead of cash for purchases under $20. The new company, to be called SmartCash, will help speed the implementation of so-called "smart card" technology that uses a micro-processor chip embedded in the card to store vast amounts of information, including improved security features. "The chip gives the card an amazing abitity to contain stored information," said Nancy Elder, a spokeswoman for MasterCard International Inc., one of the companies participating in the creation of SmartCash. In addition to Mastercard International, other founding companies include Banc One Corp., Bank of America, Chemical Bank Corp., CoreStates Financial Corp., NationsBank Corp. and Wachovia Corp. However, participation in SmartCash will be open to all U.S. financial institutions and card providers, the companies said. "SmartCash represents a shared vision and a shared commitment to deliver the increased convenience, flexibility and efficiency of electronic cash to U.S. consumers, merchants and banks," said Hatim Tyabji, chairman of VeriFone Inc., a pioneer in stored value technology and another founder of SmartCash. The SmartCash card also will be standardised with similar efforts already underway for smart cards developed by credit card companies Europay, MasterCard and Visa. "Standardized specifications are all woven into the process. If you use your card in New York, it will be the same as if you use it on the West Coast," Elder said. The stored value application, one of the many uses of the card's embedded chip, enables funds from the cardholder's bank or credit-card account to be loaded into the card from an automated teller machine or from one of the terminals now under developement specifically for the SmartCash card. Elder said the companies have not identified what the cost to the consumer would be, but noted, "the consumer is going to have to see the value in it for them to want to use it." She also said there was a potential for the card to be expanded for use by those without bank accounts, who could credit the card in person at various locations. Elder added that the demand for such a versatile card was the driving force behind the broad alliance of companies already signed on to the SmartCash plan. "Sixty percent of consumers surveyed in the U.S. said they would be willing to switch banks to get the use of stored value (cards)," Elder said. Amy Brinkley, executive vice president at NationsBank, said the venture showed "unprecedented industry cooperation to develop an innovative financial product." SmartCash will combine assets and staff of the founding companies and pursue technology being developed by MasterCard, VeriFone, Electronic Payment Services Inc., and privately held Gemplus. A pilot programme is already under development in Delaware that will be overseen by Wilmington Trust and Electronic Payment and other regional pilot programmes were likely to spring up around the country next year, Elder said. -----

1 0

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by Dave Crocker 17 Dec '03

17 Dec '03

At 11:32 AM 8/16/95, Jason Weisberger wrote: >like using a "security envelope" to mail cash or putting the club on your >car. It presents just enough of an obstacle to keep honest people honest. As the Mitnick experience shows, the vulnerability of the providers' host systems is a concern not addressed by link-oriented schemes such as SSL. Longer keys for SSL would not have improved the protection on the 30,000 credit card numbers he stole. d/ -------------------- Dave Crocker +1 408 246 8253 Brandenburg Consulting fax: +1 408 249 6205 675 Spruce Dr. page: +1 408 581 1174 Sunnyvale, CA 94086 USA dcrocker(a)brandenburg.com

1 0

SSL Challenge - Some thoughts
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

1. What kind of pseudo random number generator does Netscape use? 2. If it is a cryptographically secure sequence, doesn't that run up against ITAR restrictions? 3. Can we improve upon the brute force algorithm in a non-probabilistic way? 4. If we are happy with a 5% yield, we can restrict ourselves to the same 5% of the key space for each message. DJK

1 0

Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>-----BEGIN PGP SIGNED MESSAGE----- > >SSL challenge -- broken Indeed, it seems so, and the feeding frenzy in the press has begun. I zinged this over from cypherpunks to www-buyinfo this morning, and this afternoon I got a rather interesting call from a reporter. I told him about ITARs, its effect on internet commerce and the silliness of a 40 bit key, etc. He wanted to know if I knew Damien's phone number(!), and I told him to have ATT put one of their translators-for-hire on the line and call INRIA, Ecole Polytechnique, or Ecole Normale Superieure, and track him down there. Meanwhile, if Mr. Doligez sees this, call Alan Beck at 619-625-0700, or email him at alan(a)tgc.com. I can see the headlines now: "Netscape Security Broken, Stock Falls". Make-a the Ganglia Twitch. Haven't had this much fun since the hogs ate my little brother... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

SmartCash
by nobody＠valhalla.phoenix.net 17 Dec '03

17 Dec '03

Alliance formed to develop first nationwide smart card company New York, Aug. 16 (Reuters) - The United States is a step closer to cashless commerce. Fourteen banks and financial instutions said Wednesday that they will form a company to develop and issue the first debit card that can be used nationwide instead of cash for purchases under $20. The new company, to be called SmartCash, will help speed the implementation of so-called "smart card" technology that uses a micro-processor chip embedded in the card to store vast amounts of information, including improved security features. "The chip gives the card an amazing abitity to contain stored information," said Nancy Elder, a spokeswoman for MasterCard International Inc., one of the companies participating in the creation of SmartCash. In addition to Mastercard International, other founding companies include Banc One Corp., Bank of America, Chemical Bank Corp., CoreStates Financial Corp., NationsBank Corp. and Wachovia Corp. However, participation in SmartCash will be open to all U.S. financial institutions and card providers, the companies said. "SmartCash represents a shared vision and a shared commitment to deliver the increased convenience, flexibility and efficiency of electronic cash to U.S. consumers, merchants and banks," said Hatim Tyabji, chairman of VeriFone Inc., a pioneer in stored value technology and another founder of SmartCash. The SmartCash card also will be standardised with similar efforts already underway for smart cards developed by credit card companies Europay, MasterCard and Visa. "Standardized specifications are all woven into the process. If you use your card in New York, it will be the same as if you use it on the West Coast," Elder said. The stored value application, one of the many uses of the card's embedded chip, enables funds from the cardholder's bank or credit-card account to be loaded into the card from an automated teller machine or from one of the terminals now under developement specifically for the SmartCash card. Elder said the companies have not identified what the cost to the consumer would be, but noted, "the consumer is going to have to see the value in it for them to want to use it." She also said there was a potential for the card to be expanded for use by those without bank accounts, who could credit the card in person at various locations. Elder added that the demand for such a versatile card was the driving force behind the broad alliance of companies already signed on to the SmartCash plan. "Sixty percent of consumers surveyed in the U.S. said they would be willing to switch banks to get the use of stored value (cards)," Elder said. Amy Brinkley, executive vice president at NationsBank, said the venture showed "unprecedented industry cooperation to develop an innovative financial product." SmartCash will combine assets and staff of the founding companies and pursue technology being developed by MasterCard, VeriFone, Electronic Payment Services Inc., and privately held Gemplus. A pilot programme is already under development in Delaware that will be overseen by Wilmington Trust and Electronic Payment and other regional pilot programmes were likely to spring up around the country next year, Elder said. -----

1 0

Re: SSL challenge -- broken !
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:39 PM 8/16/95 -0500, you wrote: >> I haven't seen any news stories about this on the wire >> services. Someone would have to write a story about it first before >> people would know... > >I've suggested this to a few reporters I know.. It's worth suggesting this _carefully_ so the spin's right. For instance "Oh, no, Netscape lets Hackers suck all the money out of your credit cards" would be bad :-) On the other hand, "The US Government's Evil Plans to block encryption are limiting Netscape's export products to an encryption system already broken by a French university. This means you can send credit card numbers safely to American web sites, but not to foreign ones - like the airline or hotel reservations you were making for your vacation, or those Irish handcrafts or bottle of Scotch you were ordering, or that Hong Kong magazine you were subscribing to, or the CD from that band in Budapest that had the great sound samples out there. And when you were donating to that Amazon rainforest conservation group, the NSA's arbitrary export rules may have just helped the Colombian drug cartels rip off your credit card." #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- "The fat man rocks out Hinges fall off Heaven's door "Come on in," says Bill" Wavy Gravy's haiku for Jerry

1 0

Re: SmartCash (NewsClip)
by Duncan Frissell 17 Dec '03

17 Dec '03

>She also said there was a potential for the card to be >expanded for use by those without bank accounts, who >could credit the card in person at various locations. Or even those who don't exist. Sounds like real cash to me. Note that 20% of the population have no bank accounts. DCF "Coercion-based systems only work if the person coerced is immobile, stupid, or weak."

1 0