December 2003 - cypherpunks-legacy

Interesting Newsletter - GSSN Oct 1995
by mjsus＠atlanta.com 17 Dec '03

17 Dec '03

GLOBAL STRATEGIC SYSTEM NEWSLETTER October, 1995 Information Security System Responsibilities, Structure and Development Is your vital business information safe or are you just assuming that this information is safe? Have you established an adequate Information Security System (ISS) to protect your key information against unwanted external or internal visits and use? The changes in the usage and utilization of the information technology have created new requirements for both the information management and its security. However, still too often businesses and companies do not take the information protection seriously enough to establish proactive information security systems and other controls. If some controls have been established, these controls often focus primarily on the physical security instead of the company-wide information security. The business information such as business plans, market strategies, trade secrets and others is a very valuable organizational asset, and it would be foolish not to initiate adequate security controls to protect this key asset within the whole organization including physical facilities, employees, external contractors, computers systems, contract negotiation processes and any other business process. Who is responsible for the information security? Everybody. However, the extent of this responsibility varies from one function to another or from one person to another. Fundamentally, the top management including the organization's CEO is responsible for establishing the information security system. The top management is responsible for defining, documenting and comunicating the company-wide information security policy to all levels of the organization. In addition, the executive management may establish either specific or general information security objectives to transform the organization from one situation to a more protected situation. The executive management is also responsible for appointing the Information Security Officer (ISO), who performs and acts as the Management Representative and has the authority and responsibility to establish, implement and maintain the information security system. All other members of the organization are responsible for implementing the information security policy in their daily activities. Some individuals may have additional responsiblities such as ISS auditing and monitoring in accordance with the documented and planned information protection arrangements. The top management is responsible for reviewing the performance and suitability of the system periodically to ensure its suitability and any need for revising the policy, objectives or the system itself. The structure of ISS is unique to each organization. The responsibilities and authorities are different in all systems, because organizations are unique. However, there are some general requirements that can be used to design and develop the unique ISS for any organization, but still meet basic and fundamental information protection requirements. These requirements can include all or some of the following main categories: Management Responsibility, Client / Customer Contract Security, Information Systems Design and Development, Document and Data Control - & Configuration Management, Purchasing Information Security, Facility Management and Physical Security, Information Systems Management, Information Security System Audit, Personnel and Employee Security, Legal Information Security Matters, Counter Information Security System Activities and Information Security Insurance Administration. Each of these general categories have more detail and specific requirements including both documentation, activity recording and data control requirements. Using these requirements and any guidelines, the business can establish its unique information security system that protects the integrity of the information effectively and accurately. The information security system has to be designed and then developed to eliminate any potential security risks. This requires planning and proactive thinking. The development can start from the Information Security Policy and Objectives that is developed by the executive management. After this the completed system manual can be developed by the Information Security Officer. This ISS manual should make reference to all applicable additional procedures and instructions that are used within the system. Typically, these procedures (such as Information Security Disaster Plan and Procedures) described WHOs, WHATs, WHENs, WHEREs and in some cases also HOWs such as back-up instructions and methods. If it is necessary, additional security plans can be developed for any specific project or process. These plans should be consistent with an overall ISS. The masterlists or other equivalent methods should be developed and maintained to control all ISS plans and documentation. The planning of the information security system provides an excellent opportunity for the management to evaluate and analyze all information risks and design practical and useful approaches to eliminate these risks. Nobody should underestimate the need for the ISS, but this need should not be artificially created either. The information security system as any system has to be practical and really bring tangible benefits. This is one reason why the information security assessment should be performed prior to the development project. This assessment can identify both weaknesses and strengths in the information security. Careful evaluations can help the business to focus on real issues, and not to develop the system that meets some imaginary requirements, but fails to address those key areas and functions of the organization, where additional controls would really be needed. The information security system should be developed for the management, but the ISS users do also include all employees within the organization - and as in many other organizational development, the complete implementation of the ISS shall be dependent on the employee security and their awareness.

1 0

Re: BlackNet in "Hardware" (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

> >No book report here, but it was as gripping as the rest of her efforts. > >It's "about" people rather than computer hackery, but the computery bits > >were done quite well. Does an Amiga 2000 <really> have PC and Mac > >compatibility options? I don't know, and it doesn't matter anyway. > > I recollect that the Amiga had some gizmo--I think it was called > "MagicSack" or something like that--that let it run Macintosh programs, > sort of. It never really caught on, at least as an alternative to real > Macs. And I think something similar was available for DOS. This was all > several years back, before the Amiga faded out. > > Amiga users and former Amiga users can probably tell us more. > The Amiga has both hardware and software emulation of both Dos and Mac. The hardware Mac emulator runs faster than an actual Mac. The software emulator runs ok, but is about 2-3 times slower than an equivalent Mac. The Amiga 2000, 3000, and 4000 have PC compliant slots that harbor a co-computer in the guise of a bridgeboard. The software emulators pretty much suck because they are slow. There are currently 6 Million Amiga users, hardly 'faded out. The Amiga did not fail because it lacked in either hardware or software. It failed because of market momentum and a lack of marketing savy at Commodore. Only somebody who has never used an Amiga for an extended time would ever make a comment implying they were inferior in any technical way. Their hardware architecture in still way ahead of both Windows and Mac as is their operating system. Just remember, nobody ever lost their job by buying IBM. Jim Choate CyberTects ravage(a)einstein.ssz.com

1 0

request for binary: ec211u16.exe
by sameer 17 Dec '03

17 Dec '03

I'm wondering if anyone has the following binary from digicash: ec211u16.exe . If so please contat me. Thanks. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

Re: NYT on Internet Flaws
by James A. Donald 17 Dec '03

17 Dec '03

At 10:46 AM 10/22/95 -0400, MDresser(a)aol.com wrote: > Generalizing about > reporters is about as intellectually valid as generalizing about hackers. On the contrary: Hackers are self selected, and so are very diverse. Reporters are selected from above by an incestuous elite who have their hands in each others pockets, and so are very homogenous. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

How can e-cash, even on-line cleared, protect payee identity?
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Well I've decided that the best way to learn is to stick my neck out and say something probably stupid in public. So here I go again: In an on-line clearing e-cash scheme, Chaum's "double-spender identifier" fields are unnecessary, but a "serial number" type field to uniquely identify the e-coin is still necessary. Using blinding, this serial number may be unknown to the bank, but it will be known to the payer. If the payer and the bank are collaborating to identify the payee, then they can simply use this serial number to identify the recipient of the coin. Is there a scheme which will prevent this collusive payee identification, and if so where can I read about it? (On-line is preferable of course, but I don't expect to be that fortunate.) Now even if it were the case that the payee is always identifiable by a collusion of the bank and the payer (such as is the case in DigiCash Ecash), all this means is that you shouldn't accept a coin using one nym, and deposit it in the bank using another. You need one bank account per nym, as well as one bank account per anonymous transaction, and then you have complete control over revelation of your identit(y/ies). I can imagine a future in which this requirement is not difficult to meet. Perhaps it will be the case that you can accept a coin, open up a new ("anonymous") account with the bank, deposit the coin, withdraw a new coin of the same amount, close the account, and now have an untraceable coin all in a fraction of a second. Bryce signatures follow "To strive, to seek, to find and not to yield." <a href="http://ugrad-www.cs.colorado.edu/~wilcoxb/Niche.html"> bryce(a)colorado.edu </a> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMIrRpvWZSllhfG25AQFWTQQAgxDWvYrBpoM5D0Idn7ZeCHbZSxMGFr50 Ut40sE83Yfctb6nJdrA+trpynEcu1wJkBbZ7zKDw/TFEUHZy1v4lhZPe+yxmYZcD w9fPC5HaJQqcTp/hhiw9L4iMswdbrmJu/SkUz85ZVosy8blasdOgFwcoZTIFpZHk tyATeEGYygo= =xqJ6 -----END PGP SIGNATURE-----

2 2

Re: airport security
by farber＠central.cis.upenn.edu 17 Dec '03

17 Dec '03

Ever think that the one real payoff for the ID at airports is to kill the market for re-sold frequent flyer certificates and partially used tichets that then get sold to others (like at most schools)

1 0

Re: airport security
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Alan Horowitz <alanh(a)infi.net> writes: > measures, etc, etc. The other side *has already won* the terror war, > merely by virtue of having set the agenda, and making us spin in tighter > and tighter circles - reacting, not initiating. What, then? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: LIBERTY!! Use it or lose it!! iQCVAwUBMIrYyN74r4kaz3mVAQFI4AP/ZDZnldBk7lG3lgIScGIlWJIK8LjiYB7R OXo0gm4zHfQ610puxnBcfq/BQdDJ7DvDW6RegZXonZedNJbvMVWwpttvZW608Rve v9+pUgrjsbQ7QC8RbyKSKAqyjTo7fjjoNVt5NvcL27OVs9ORC5yKEeeWaPtRoQ6V 3MjZqThCmHI= =JS0t -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)webcasters.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

2 1

Real ECash from Mark Twain Bank
by Hal 17 Dec '03

17 Dec '03

<URL:http://www.marktwain.com/ecash.html> will apparently have info on its "real ecash" starting late Sunday, October 22. It is not there yet at 6 PM pacific time. <URL:http://digicash.support.nl/publish/ec_pres3.html> will have a press release soon, as well. Here is what it says now: > First Real Electronic Cash Launched > > Copyright ) 1995 by DigiCash bv. > > FOR IMMEDIATE RELEASE (Release Date: October 23, 1995) > > This page will be available very soon.

1 0

hot news at DigiCash
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hot news at DigiCash. One, a real live bank is going to be issuing Ecash denominated in U.S. dollars. See "http://www.digicash.com/" and "http://www.marktwain.com/". Two, the one million trial cyberbucks have been issued and no more will be issued, although the First Digital Bank will continue to run the trial for now. In honor of the occasion I hereby offer E=100 US=$8.00 SELL-OFFER "Sun Oct 22 19:34:28 MDT 1995" 2 bryce(a)colorado.edu Pretty soon we'll be able to exchange First Digital Bank trial cyberbucks for Mark Twain Bank cyberbucks denominated in U.S. Dollars. I wonder if our trial cyberbucks will be considered collector's items? I know that I will always be proud of *mine*... Bryce signatures follow "To strive, to seek, to find and not to yield." <a href="http://ugrad-www.cs.colorado.edu/~wilcoxb/Niche.html"> bryce(a)colorado.edu </a> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMIrzb/WZSllhfG25AQEGNAQApa3hQlc7jWZBIzsSUqh4o6LQfhoCPzaJ dEOHWDTS+1L8IyNo1PS3Z0hZNeDDiGda7PsilwLouH6M8kUtD7BFXyU/31QDZnXq oLdiq/OJ3A5U04ElEtRXRn7m0eQtoPv4V41UkR0GGkLx93DyGPC6ecXX4vE14oKq jLc4Dt296gc= =gnEm -----END PGP SIGNATURE-----

1 0

Re: Mondex vs. Digicash (was: Godzilla vs. Mothra)
by Stephan Somogyi 17 Dec '03

17 Dec '03

At 10:35 22.10.95, Douglas Barnes wrote: > If the Digicash system allows people to set up their > accounts without getting out of their chairs (which I suspect will > be the case, if they do it right), it will initially get more > adopters. Agreed, especially since it's going to be a while until Mondex, NetBill et al are accessible by consumers outside of the trial areas. I wonder whether this DigiCash announcement will be a limited trial or a full-blown deployment. > I know at least one group of people who believe they have a good line > on a serious security problem in Mondex. Mondex is definitely practicing security by obscurity. Tim Jones, Mondex's CEO, was very cagey last week at the e-commerce conference about how transaction mechanics and where various public and private keys reside. I have serious questions about some aspects of Mondex's security. > o Even if the Mondex hardware were given away for free, think how > much fun it is for the average user to add a new piece of hardware > to their machines... ever install a sound card and CD-ROM drive on > a PC? I remember reading something like 20% of all "multimedia" > kits were returned, largely due to user install problems. If there > is a competing method that costs the same and _doesn't_ require > the hardware, people will tend go with this. Depends on the hardware. I recently saw a pamphlet for a mag-stripe + smart card reader with a numeric keyboard for PIN entry that plugs into a PC as a bump in the wire between the keyboard and the CPU. The company is in Arizona; I can't recall the name offhand. Adding smart card capability to a PC is not in the same league of user hassle as a multimedia upgrade. It's also much cheaper. > but if you explain that the money uses existing (auditable) > channels going in, and existing (auditable) channels going out, and > that only spenders are anonymous, they relax considerably. They may > change their minds later, but we're about to get an existence proof. The problem is with peer-to-peer transactions that don't go through a bank. Mondex claims that such transactions are anonymous and unaudited. What would stop someone from moving a 500 pound per-card maximum from one card to the next and then back up into the system elsewhere? I'm under the impression that Mondex's value isn't serialized the way DigiCash's is, so you can't track the value itself. And if the cards themselves keep no records of transactions made with peer devices, tracking seems rather tricky. > how can you be so sure that Mondex will win over > Digicash, and that they won't co-exist like, say, money orders, > currency and cashier's checks (three instruments with both similar > and dissimilar attirbutes)? The different schemes have enough overlap that it's not clear to me that a single bank will want to support multiple as yet untried systems. Admittedly, we haven't yet seen which bank is working with DigiCash, but Mondex has some pretty heavy hitters behind it already. Since DigiCash is Internet-focused and Mondex is a non-net-specific system that can be adapted for use over the Net, it seems to me that a bank adopting Mondex would get more out of its investment than if it bought into DigiCash. Banks are going to get into some kind of e-cash system sooner than later, and Mondex seems to be the farthest along. _______________________________________________________________________ Stephan Somogyi Senior Editor Digital Media

1 0