December 2003 - cypherpunks-legacy

Re: CancelMoose = William Nagengast?
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

Mark writes: > #define paranoia on > > Just ask your local TLA that has traffic monitors on the up and down links of > all the remailers so they can track a piece of email from sender to recipient. > They will take the (relatively small) logs of the hour and pump out a name > for you. > > #define paranoia off > > :) That's one of the principal advantages of Mixmaster over the earlier generation anonymous remailers. Approaching a Chaumian digital mix more closely than previous implementations, it uses only encrypted standard-sized packets in transit. This protocol should make it hard or impossible to narrow the list down to anything like a single name, depending on ambient traffic conditions. -Futplex <futplex(a)pseudonym.com> "Our encryption doesn't use an encryption algorithm" -Elementrix

1 0

international clampdown on money laundering
by an215712＠anon.penet.fi 17 Dec '03

17 Dec '03

----- Forwarded Message Date: Tue, 10 Oct 1995 23:35:58 -0400 (EDT) From: Brad Dolan <bdolan(a)use.usit.net> To: snet-l(a)world.std.com Subject: Int'l Money Laundering, Part the Second (fwd) - ---------- Forwarded message ---------- Date: Tue, 10 Oct 1995 19:31:40 -0800 Subject: Int'l Money Laundering, Part the Second INTERNATIONAL ASPECTS The increasingly long arm of US law Those of you who have read my earlier exploration on the subject of jurisdiction (http://www.communities.com/paper/swamp.html) should be aware of a wide variety of ways that the US can "reach out and touch someone" they're not pleased with. Well, last week, I learned a few more. There are several ways in which the US is attempting to exert hegemony throughout the world wrt banking regulation: o Identification of "fiscally tolerant" nations and banking havens, and close regulatory examination of all transactions with these countries. o Pressure on major US trading partners and allies to pass and implement anti-money-laundering legislation and regulatory regimes. o Regulations on foreign banks with offices in the US, making compliance demands on world-wide operations. o Criminal prosecution of banks suspected of institutional involvement in money laundering, even if said bank has no offices or branches in the US. o Worldwide pre-trial substitute asset forfeiture of banks suspected of institutional involvement in money laundering, even if said bank has no offices or branches in the US. Pariah Nations in Banking ========================= As I touched on briefly in the previous section, transactions with well-known banking havens can automatically qualify as "suspicious." And in addition to some of the better known havens, a number of countries were pointed out at the conference as being "fiscally tolerant", including Malta, Uruguay, Japan, Ireland and Belgium; in another presentation the countries of Eastern Europe and the former Soviet Union were identified as "rapidly growing" sources of suspicious baning activity. Transactions with counterparties in such countries will be flagged by regulators for closer examination -- banks with large percentages of transactions with these countries will be expected to meet a higher standard in their attempt to identify "suspicious" behavior and will be under increasing pressure to investigate their customers' business practicies and motivation for all bank transactions. Some countries are clearly going to continue to tell the US to "get stuffed." However, if the US is successful in pressuring more and more countries to "tow the line", it will leave a shrinking pool of transactions subject to closer and closer examination. New Money Laundering Legislation ================================ Two presentations, one from Taiwan, the other from Thailand, focused on new or proposed legislation wrt money laundering in those countries. Based on my direct experience of living in the former, and my reseach into the latter, it's going to be a very, very long time before such legislation has a significant impact on either country. Chinese people (who are in the majority in Taiwan, and form an economically active minority in Thailand) are very cash- oriented; I vividly remember payday in Taiwan, with the boss sitting at a table piled with money, bundling up salaries for everyone. I'd come home at the end of each month with a giant wad of cash from my several different jobs. One could hardly imagine a better environment for money laundering than a society in which large quantities of cash change hands on a regular basis. After his talk, the Taiwanese speaker acknowledged the problems, but seemed hopeful that progress could be made. The speaker from Thailand, Nualnoi Treerat, a professor of Economics, discussed the proposed legislation primarily as an attempt to reduce the impact of organized crime on political life and society in Thailand; however, by her own estimations, the underground economy in Thailand represents 17-19% of the country's GDP (mostly drugs and prostitution.) Given the extensive corruption which she also detailed, it seems that such legislation will be a very small step indeed. Other speakers addressed the issue of cultural differences with respect to the use of cash and attitudes towards privacy, and it came up at lunch both days -- in many cultures, financial privacy is held in much higher regard than in the US, and people have a much stronger suspicion towards the government. Furthermore, there are many people who feel this way in the US. There is going to be an inevitable clash between atttempts to closely regulate and monitor money movements and people's fundamental desire for privacy. It's not clear that people of any culture can be sufficiently frightend by the bad guys to give up as much of their privacy as would be required for ultimate success in the War on Money Laundering. Despite the dim chances of success, it's clear that the US has been at least partially successful in coercing and coaxing other countries to adopt measures against money laundering, and to some extent there is local support for these measures. But these direct efforts pale by comparison to some other techniques... Foreign Bank Regulation ======================= In various pro-privacy publications I've read, there have been oblique warnings about doing business with foreign banks that maintain offices in the US. At this conference, I learned some very concrete reasons for this. It turns out that if a foreign bank wants to open a US office, they must demonstrate compliance with US money laundering laws throughout their _worldwide operations_. Furthermore, they're expected to have solid leadership for these policies from their home offices. This puts such banks in a serious bind. For instance, while Annunzio-Wylie absolves (or attempts to absolve) banks from civil liability for filing Suspicious Activity Reports and Criminal Referral Forms on their cusomters, this absolution does not extend to the home countries of these banks, where substantially different laws may obtain -- possibly explicitly forbidding this kind of reporting. There is almost a certain kind of logic to this kind of activity, but not content to extend our laws over the worldwide operations of banks with US offices, there are two ways in which US authorities are now attempting to extend US laws to banks _with no US offices_. Extraterritorial Reach ====================== The best paper presented at the conference, hands down, was "Surviving the Solution: The Extraterritorial Reach of the United States," by Kirk Munroe, a criminal defense attorney practicing in Miami. [I intend to find out if an online version of this paper can be made available.] To quote Mr. Munroe: The US money laundering law specifically provides for extraterritorial jurisdiction when (a) the conduct is by a US citizen anywhere in the world, or, if by a non-US citizen, the conduct occurs, at least in part, in the United States, and (b) the transactions, or a series of related transactions, exceeds $10,000. [18 USC $ 1956(f)] Some add'l background: banks involved in international business typically have a number of _correspondent accounts_ scattered around the world that are used for clearing wire transfers and other transactions. Since the BCCI scandal, the US government has increasingly gone after these accounts when a bank is suspected of facilitating money laundering. Furthermore, banks can have these correspondent accounts seized, even if they no longer contain "dirty" money, because they _facilitated_ a money laundering activity. When you combine these elements, you get a strategy that permits the US government to confiscate worldwide correspondent accounts of banks, even if they don't have a US presence. The first case Mr. Munroe cites is that of Banco de Occidente (Panama), one of his clients, that was alleged to have facilitated the laundering of the proceeds of drug transactions. The indictment included criminal charges against the banks and a criminal forfeiture charge. The government also filed a civil action for the forfeiture of $412 million allegedly laundered (although it had already passed completely through the bank.) The government then proceded to freeze not only the bank's US correspondent accounts, but also accounts in Germany, Switzerland and Canada, leading to the insolvency of the bank and its subsequent takeover by the Panamanian Banking Commission. [The Germans quickly unfroze the account after a civil action brought by the bank.] Quoting Munroe: After months of difficult and complicated negotiations which involved the banks' various interests in eight nations, a resolution was reached with the governments of the US, Canada, and Switzerland... [the bank] entered a guilty plea and agreed to forfeit, over a period of four years, $5 million to the US. The US, in turn, paid the Swiss and the Canadians $1 million each from the initial $2 million forfeiture payment. [Those of you who are still under any delusions about the "safety" of Swiss bank accounts, take careful note of this.] Mr. Munroe concludes that the only reason that the bank got off this "lightly" was because of substantial evidence that it was, by and large, a highly respectable institution and that this instance of laundering was an aberration. The next case cited by Mr. Munroe is that of Bank Leu. I quote from his paper: In sum, a Luxembourg bank with no office in the US was charged and convicted of money laundering in the US on the basis of clearing US dollar negotiable instruments drawn on a US bank but deposited by non-US citizens in Luxembourg. In other words, acceptance of US-dollar negotiable instruments by a bank anywhere in the world outside of the US renders the bank susceptible to US criminal jurisdiction in the money laundering field. The case boils down to this: Bank Leu wanted to expand its private banking business, and hired an officer to market accounts in South America. Two related accounts were opened, and over a one- year period $2.3 million in cashier's checks, all below $10K, were deposited in the two accounts. Although no guilty knowledge could be shown, this case was pursued and won on a theory of "willful blindness", that is, the bank "should have known" that the transactions had no valid business purpose and were inherently suspicious (came via Columbia, were sometimes more than 6 months old, all in small amounts, etc.). According to a LEA representative at the conference, there was a lot of joking in the backoffice at Bank Leu about the money being dirty, and clerks were repeatedly told "don't worry, it's ok" by bank officers. Certainly if this is true, it amounts to _extremely_ willful blindness, but this case still represents an amazingly long reach for US laws. [more to come... "Things bad people do with money"] --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

Re: Basic Flaws in Internet Security and Commerce
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > So: If you can't trust your path to your own file system, what can you > trust? (And this is without even talking about things like firmware > upgrades and BIOS patches and all sorts of other potential approaches.) Can > we do no better than simply assume the local workstation file system can be > trusted? > Nah, it's not as bad as all that. There's fixes to all of this, they're well known, and actually in place at some places. Because it's such a pain having good security on all of the machines most sites choose to have really good security on a firewall to keep the bad guys out, and through policy, isolation, and less stringent security measures protect the machines inside the firewall. That's not to say that everyone with a firewall has good security, far from it. It's also not to say that everyone without a firewall is vulnerable, they're not...I know folks with all of their machines buttoned up tight. It's possible to close most categories of holes, and to detect intrusions in progress. You say you're worried about the system being corrupted so that you can't trust calls to the OS. Some attacks do work this way, but you can prevent the attack via a combination of good security and good practices. And yes, secure authentication and transmission of data makes everything much simpler;) Without it you have to essentially pull up the drawbridge and trust no one outside the moat, since there's no way of knowing if anyone, or any host is who or what they say they are. If anyone wants more specific information about how to protect from various attacks I can help or give you references to the literature, but I won't go into it here since I expect that most anyone you'd find on cypher- punks knows all this at least in outline already. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: SAIC bought InterNic, but who is SAIC? A spook contractor!
by Chris Claborne 17 Dec '03

17 Dec '03

At 05:18 PM 9/28/95 -0700, John Gilmore wrote: >Forwarded-by: gordoni(a)base.com (Gordon Irlam) >SAIC's board members include Admiral Bobby Inman, former NSA head and deputy >director of the CIA; Melvin Laird, Nixon's defense secretary; and retired >General Max Thurman, commander of the Panama Invasion. Recently departed >board members include Robert Gates, former CIA director; William Perry, >current Secretary of Defense; and John Deutch, the current CIA director. >Current SAIC government contracts include re-engineering information systems >at the Pentagon, automation of the FBI's computerized fingerprint >identification system, and building a national criminal history information >system. I am not supporting the idea that SAIC is not annother govt mouthpiece or cover op but it is standard practice to hire retired workers from government that worked in the area that you want to sell services into. I know of a ex army colonel that used to work for a government contractor. I'm sure that he used his contacts to sell services to the government. You gotta love it! Don't trust S/MIME, it's supported by RSA (a govt mouth piece) and uses DES. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. PGP-encrypted e-mail welcome!

2 1

Re: NYT on Internet Flaws
by John Young 17 Dec '03

17 Dec '03

There's a strange anxiety in Markoff's story, as though it was planted on page one to exaggerate a threat to cyber law and order. Reminds that his articles on Kevin were also melodramatic, himself a player, privileged to join the hunt. Maybe this is ambient hot material for his burbling potboiler on Shimomura and Mitnick, honing an author's creative edge, and artistic license, over that, ahem, of the tranquil and capaciously befriended journalist's, pissed that privileged news files were hacked, are hackable.

1 0

Re: Elementrix POTP
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I forwarded: >> Unfortunately, and we really mean unfortunately, we can only reveal what >>"it is" to people who agree to a non-disclosure arrangement while we're >>patent pending. Otherwise we would have no problem revealing the whole >>method. So far, every international expert who has reviewed the method >>agrees (after many, many hours and days of trying to find holes) that POTP >>really does what we say it does. and Kari asked: >Maybe you could name those experts who have inspected it - thanks. Um, in an earlier post she mentioned the venerable Mr. Kahn and someone else whose name I forget. I think I suggested (for cypherpunk credibility) Carl, Wei, and maybe (for the "paranoid") Perry, but I think she just wants to take her chances with us. I suggested also PRZ, as this would maybe help his legal fund. :) Surprisingly, she seemed unaware of any particular NSA interest in the prod. I assured her that they were interested, and we agreed that since the main office of the company was in Israel there was nothing to do on this end. She did not respond to my nosy questions about Israel govt. ownership, or ownership period. I suppose my own combination of nosiness, crypto relative-cluelessness, and insistence on my own use of PGP until something's provably better <g> was beginning to annoy her, so she said, "Go tell them this!" to get me out of her hair. I'm still curious about how her technology claims to do its thing, but that's why I hang with the C-punks (at least, one reason!). ;) "We" (not me) will (eventually) get a copy and either rake it over the coals (likely, IMO) or "endorse" it by failing to find a weakness (not so likely, IMO). Sorry I can't say more, but I don't know more. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMHvVXG1lp8bpvW01AQGwnAQAjk1+LFBuWaq5xovZySk43wNRKSviS57V JTZCQVyFugsNTUQYaYP/h2UZ4hcCtJe0aePgENm5B2tBibp9MuP0skNG9m4v+O8A cG5vei2TDMy7vh5tNWSnDdJ5dEjttGOU/nCEGC6JpDLvfdLICRrp7KdeCIY1bhc3 Up616khae4A= =NTqn -----END PGP SIGNATURE----- Regards, Jim Ray Ray's Corolary to Murphy's Law: "You will be spared _NOTHING_." -- Peter C. Ray [my dad]. ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James Milton Ray <liberty(a)gate.net> IANAL ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

2 1

Check by phone (revisited)
by cman＠communities.com 17 Dec '03

17 Dec '03

There are a variety of these new "check by phone" operations advertising on the Internet; I decided to check some of them out this afternoon. Most of them seem to use the same breathless prose immortalized in "Make Money Fast", along with generous use of the Netscape "blink" attribute, which immediately sent alarm bells ringing, especially when coupled with referral programs that border on a pyramid scheme. Furthermore, it's clear that these operations are highly vulnerable to fraud and abuse, as was mentioned in a thread on the list a few weeks back. Quoting from http://www.pixi.com/morgan_group/checks/by_phone.html: --------- TELEPHONE CHECKS (PAPER DRAFTS) ARE COMPLETELY LEGAL! Paper drafts are established as a legal method of payment as provided in the Uniform Commercial Code, Title 1, Section 1-201 [39] and Title 3, Sections 3-104, 3-401, and 3-403; Code of Federal Regulations, Title 12 Chapter II, Part 210; and Regulation J, Federal Reserve Bank, Part 2, Sections 4A-201 to 4A-212. Only verbal agreement is required for authorization. Also see Romani v Harris, 255 Md 389. --------- Any lawyers feel like checking this stuff out? (I've got the UCC at home, but not the rest of the materials.) When I called the phone number given at: http://www.Village.com/business/enterprise, I got a guy who was obviously at home, "watching the ball game"; he was quite pushy and focused on the system of "referrals" for people who sign up. Among other things, he had never heard of an ACH debit and was therefore unable to compare the conflict resolution processes for the two methods. (ACH debits are what your health club uses to deduct fees from your checking account each month -- the transactions are reversible solely on the customer's say-so.) The folks at http://www.redichek.com/redichek/redifaq.htm seem a bit more professional. They admit in e-mail that there is a security problem here (no kidding), especially wrt sending routing and account information over the Internet. I enclose our correspondence at the end of this posting, for your reading enjoyment. It seems plain from the nature of the folks who are offering these check printing services that they are not regulated or licensed. Also, it seems that these services are really just preparing the drafts, any liability for submitting bogus drafts rests on the merchant into whose account the drafts are deposited. Question: has anyone seen more legitimate folks offering this type of service? Also, it seems that for the fees that these folks are charging, it would be worth it for a merchant to do this in-house. When this topic came up before, I recall people mentioning sources of magnetic ink and check paper; is this stuff really widely available? Another puzzling factor is that all the services seem to base the fees on the amount of the transaction, when, as near as I can tell, the check printer has no exposure, and costs are in no way proportional to transaction size (basically they're collecting data and running a laser printer.) Proably due to their positioning themselves wrt credit card companies. Joe-Bob sez: Check it out. ========================================================================= Date: Wed, 11 Oct 95 18:13:57 -0600 X-Sender: msumsion(a)mail.redi-check.com Mime-Version: 1.0 To: cman(a)communities.com (Douglas Barnes) From: msumsion(a)optical.fiber.net (Michael Sumsion) Subject: Re: Legal basis Douglas, Thanks for the inquiry. Before I answer your questions, I would like to make you aware that we are in the process of building a completely new, completely secure system using this same check-draft service. It will be arriving within the next couple of weeks. This new system will allow online customers to make purchases, using their checking account, without the need to transmit their account information over the Internet. On to your questions: > >Hi, our company may be a potential customer of your service, >but I have questions about the legalities involved in printing >drafts on people's accounts. In particular, this system seems >especially vulnerable to fraud. I just spoke with our banker, >who had not heard of these services, and was quite concerned. Many bankers have not heard of the system, although it has been in use now for over 3 years. We get calls from bankers on a regular basis who are curious about the service. After explaining it to them, they are generally very supportive. As far as the legalities, it is perfectly legal to print a draft, drawn on a customer's account, with the authorization of the customer. In fact, the legal basis for this is printed on the bottom of each of our drafts. >For instance, wouldn't it be possible for any recipient of a >check from someone to copy down the routing information and >account number, and then use that to defraud the account holder >and the merchant? Yes, this is possible. We have never run into this situation, however. We are not stating that this system is any more secure (with the current system) than credit cards. What we WILL say is that this system is as safe as walking into any store and handing the clerk one of your checks. (The new system will eliminate the need to transmit this information.) >Also, I'm curious where the liability rests in the event that >a charge is disputed -- that is, the customer claims that they >didn't authorize the transaction. How readily are the charges >reversed? I'm familiar with ACH debits, which are extremely >easy for customers to reverse; how does this system compare with >ACH debits? Since there is no standard or regulation regarding this in the banking industry, this differs from bank to bank. Some banks will allow you to go back as far as two years to dispute a check. Others will only go back 30-60 days from the date of receipt. I hope that I've been able to answer completely. If you would like to speak with someone about specific processes, please give Allen a call at 801.298.1212. Thanks, Michael Sumsion _/_/_/ _/_/_/ _/_/ _/ _/_/_/ _/ _/ _/_/_/ _/_/_/ _/ _/ TM _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/_/ _/_/ _/ _/ _/ _/_/ _/ _/_/_/ _/_/ _/ _/_/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/_/_/ _/_/ _/ _/_/_/ _/ _/ _/_/_/ _/_/_/ _/ _/ Internet Commerce Solutions - (800) 607-2001 Fax (801) 298-9789 email: msumsion(a)redi-check.com http://www.redi-check.com/redi-check Referral Program: http://www.redi-check.com/redi-check/referral.htm ======================================================================

1 0

Final Roster/Reminder -- Bionomics Conference (fwd)
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Here's a sign of the times> S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ---------- Forwarded message ---------- Date: 11 Oct 95 14:38:02 . . . Subject: Final Roster/Reminder -- Bionomics Conference Dear Friends, With a record number of 35 speakers and panelists (whew!), the program for the 3rd Annual Bionomics Conference has been finalized. Since our brochures were printed, we've added a number of interesting and thought-provoking individuals, including o Lew Perelman, author of "Hyperlearning" o Andrew Basile, author of "The SPA's Guide to Online Law" o Morley Winograd, author of "Taking Control: Politics in the Information Age" o Frank Gregorsky, former chief of staff to Cong. Newt Gingrich o Jim Griffin, Director of Technology at Geffen Records o Don Lavoie, Director, Program on Social & Organizational Learning, George Mason University o Irwin Glenn, Senior Systems Engineer, Netscape Communications o Pat McKim, Managing Partner, Practical Strategies o Cindy Cooke, Director, Democratic Leadership Council of CA o Dennis Miller, Associate Professor, Baldwin-Wallace College . . . What's more, for the truly tech-savvy, you can now pay for your conference attendance with Cybercash. Just check our web site (www.bionomics.org) . . . ^^^^^^^^^

1 0

netscape rewards bug finders
by an407769＠anon.penet.fi 17 Dec '03

17 Dec '03

Netscape Offers Rewards To "Bug Catchers" MOUNTAIN VIEW, CALIFORNIA, U.S.A., 1995 OCT 11 (NB) -- Netscape Communications Corporation (NASDAQ: NSCP) has announced the "Netscape Bugs Bounty" program that rewards users who help the company find and report "bugs" in the beta versions of its recently released Netscape Navigator 2.0 World Wide Web browser software. Users who are the first to report a particular bug will be rewarded with various prizes depending on its importance. The contest begins with the beta versions of Netscape Navigator 2.0 that are already on the Internet. Full rules for the contest will be available on Netscape's home page at http://home.netscape.com . Speaking to Newsbytes, Roseanne Siino a spokesperson for Netscape, said, "As far as we can determine, this is the first contest of its kind. Netscape's whole approach to broad-based beta testing on the Internet was new, and we hope the contest will enliven the beta testing process." Users who are the first to report a particular bug will be rewarded with prizes depending on the "bug class." Users reporting "significant security bugs," as determined by Netscape, will collect cash prizes, while users finding any security bugs will win Netscape "merchandise." Users finding other "serious" bugs will be eligible to win "a choice of items" from the Netscape General Store. Siino pointed out that there are no caps on winners. Top prize will be $1,000 for any and all bugs in the top category: Severe Security Bugs. To win, the finder has to be the first, and, according to the company, it is important to be constantly using the current versions. The beta versions are available now for downloading on the Internet for free evaluation. Netscape's beta testing of 2.0 is already underway. Users who downloaded previous beta versions of the 2.0 software should download today's versions, which fix major and minor bugs identified since its initial release, including security bugs in the pre-release version of the Java language support integrated in 2.0. Netscape has released special beta versions of 2.0 that include Java for users wanting to test it. Because bugs will be reported and fixed on an ongoing basis, Netscape asks users to stay current on the beta version they are using, so that the latest software is constantly being refined. "We are continuing to encourage users to provide feedback on new versions of our software, and the Netscape Bugs Bounty is a natural extension of that process," said Mike Homer, vice president of marketing at Netscape. "By rewarding users for quickly identifying and reporting bugs back to us, this program will encourage an extensive, open review of Netscape Navigator 2.0 and will help us to continue to create products of the highest quality." Netscape has created two versions of its Netscape Navigator 2.0 beta, available for downloading from Netscape's home page at http://home.netscape.com . Version b1J for Windows 95, Solaris, and Irix platforms includes Java and is for users who want to participate in the bounty program. For general users or those on other Unix environments, Windows 3.1, and Macintosh, Netscape has posted beta versions without Java. After initial testing is complete, future beta versions for all supported platforms will contain Java. (Richard Bowers/19951000/Press Contact: Roseanne Siino, Netscape, 415-254- 1900) --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

variations on an attack
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Jiri Baum wrote: > To start a new sub-thread: what if the man in the middle is actually > a behaviour-modifying parasite? At that stage even a physical meeting > won't do you much good (the parasite may be otherwise asymptomatic). That wouldn't quite work since the host would notice the parasite in the middle and could then work out countermeasures. An important part of a MITM attack is escaping notice. What if one night the man in the middle drugged you, kidnapped you, placed you inside a virtual reality machine, replaced your body with a clone, and established a link between the VR machine and the clone so that you experience everything the clone experiences and the clone does everything you intend to do? Can you prove this has not already happened? - the Mad Scientist in the Middle - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHyIA9IjPOsOWLIJAQE3AgP/bNcA0BmDMvto9SocpIcYImoXJ72k9k+Z gYH6dnCo5UCY0KbKwgCbBfQI0bxpaP7EWmZPS/i1HdzWvKOw9JExY2i0gvKMr/BS KGtlG0+RAVSU9DiVRuAr6d7x6IQKYOeRgcNz0Dm2JpaA1eo/DbJ3tsRBYCeaQQ26 gS5XzNzL00M= =lc/J - -----END PGP SIGNATURE----- - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzB8hz8AAAEEAKuHA58RXNk5o0nlDTOsoAs3YTKubscQYoW3kLSjmn7gmskD NtPKxYvXveGN3D/eBgsMzdGVtrl46j1r6VjYsTMcDGUL9wGQnflgHGrbReFYGzkI yW7GhyeUoRqCdmACDpmzUxEqp2J5hK2obL8bcvoiVSBMFogabdIjPOsOWLIJAAUT tEJJIHdvdWxkIGxpa2UgdG8gYmUgcmVmZXJlZCB0byBhcyAidGhlIE1hZCBTY2ll bnRpc3QgaW4gdGhlIE1pZGRsZSI= =Lzd5 - -----END PGP PUBLIC KEY BLOCK----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHyK9SoZzwIn1bdtAQHNsgF/WqMLd/EuNEG3QEXZobZKDQDl0hjMmhBn 56pUQxkNYi0ckMx+YIij9X7XoExm3MsK =D+xl -----END PGP SIGNATURE-----

1 0