December 2003 - cypherpunks-legacy

Secondary Ecash applications on hold
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

A few weeks ago, I promised you all to write some scripts that will lay the groundwork for some of the more unusual applications of Ecash. Unfortunately, I went straight from one contract to the next and didn't find the time to work on the scripts. I am currently in St. Louis, making sure that Ecash makes the impact on Internet commerce that many of us think it should make. Anyone on this list that ever thought of opening a shop using Ecash or is interested in Ecash in general is encouraged to email me at support(a)marktwain.com and share their ideas. TIA, -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: NSA, ITAR, NCSA and plug-in hooks.
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

> > >I think it's 121.1, Category XIII paragraph (b) item (5): > > >"Ancillary equipment specifically designed or modified for paragraphs (b) > > >(1), (2), (3), (4) and (5) of this category;" > > > > Question: What makes computers in general NOT describable by such a > > paragraph?!? > >"specifically designed"? > >nathan That makes it easy: Just make sure that you also write a compressor or filter program with similar compatibility, and nobody can argue that the hooks were SPECIFICALLY DESIGNED for encryption.

1 0

Re: Crypto requlations & laws
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

> Could the person posting the location of the crypto laws please repost. http://www.kub.nl:2080/FRW/CRI/projects/bjk/lawsurvy.htm Bert-Jaap Koops

1 0

credit card conventional wisdom
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I've been seeing a particular meme-nugget of conventional wisdom circulating in reference to credit cards that I'd like to debunk. (recently showed up in the WSJ, "Boardwatch" magazine editorial column, etc). these legends and thinkings are starting to annoy me to the point of becoming a pet peeve. the argument goes like this: secure credit card number uploading schemes (such as in Netscape) are not important on the internet because credit card numbers are already insecure. you give them to low-wage workers all the time who might steal the number from you anyway. there are a lot of fallacies with this. I find this to be a key cypherpunk issue, and I hope others will agree to the point of trying to attack this fallacy through letters to the editor, debates, etc., because it seems to rationalize weak security. - 1st point: yes, you do give credit cards to low wage workers in businesses, but this is not directly parallel to sending a credit card over the internet. the fuzzy thinking goes like this: "credit card numbers are already not secure. therefore, trying to secure them is frivolous". this is patently ridiculous on the face of it. it's circular reasoning. credit card numbers could become more secure if all businesses made them more secure. getting all businesses to make them secure is part of the battle. raising consciousness on the issue is part of the battle. saying, "there is no point" is a copout imho. - the insecurity of sending a card over the net could be far better or worse than that of handing it to an individual. 1st, when you send a number over the net, potentially anyone (including people other than the destination business) could spy on it. when you give it to someone in a company, only that representative (who would be trusted by the company) has access to it. or, alternately, maybe no one could *ever* see your card sent over the internet, including workers at the end site, who never deal with the numbers directly. such a system is possible and may become the norm. but not if shallow-thinking people can't imagine it as possible. - it is not impossible to have cards that don't have numbers but instead have magnetic stripes, and the only way for them to work is to be physically scanned. this would reduce fraud but would also reduce the convenience of sending numbers over the phone (mail order) for example. I'm not saying all cards should be this way, but it might make sense for some people to get a "scan only card" that cannot be used unless physically scanned. the point is that there are variations on the credit card theme that make them more secure, and there's a bit of a hurdle in getting Joe Sixpack to realize this, and realize it's desirable. - the boardwatch magazine editor argued that uploading credit card numbers over the internet in a secure fashion is a "non problem" because credit cards are already insecure. have you ever heard of PROGRESS, mr. bonehead? if the net began to make credit transactions more secure, perhaps that would create a momentum in which other offline businesses might become more strict or careful about credit card security. - credit card fraud is absolutely enormous in this country. and there are not really any very strong safeguards against it except a lot of "security through obscurity" (of credit card numbers). *everyone* pays the cost of this horrible fraud rate through increased transaction charges, higher interest rates, etc. just because you may not see it itemized on your credit card bill, does not mean you are not paying for it. (in much the same way that a sort of "shoplifting tax" is reflected in the cost of all merchandise). - the internet may eventually become completely secure. arguing that "we don't need security on the internet because we don't have it in the business world of daily credit card use, and they get along fine" is ridiculously simplistic and specious. the fact is that businesses do *not* really like many aspects of credit cards: low security, overhead costs, cost of interface devices to the credit card companies, etc. all these negative ingredients could be improved in cyberspace. but it won't happen if every time a new superior system comes along, someone argues, "but there's nothing wrong with what we have now!!!" when this is quite obviously mistaken to anyone with any minimal background& understanding in the area. furthermore, consumers are somewhat notorious for not really knowing what they want, and sometimes arguing against something they would buy or use in the future. == I'm continually amazed at how often security issues are mixed up in people's brains and reasoning. there are a lot of fallacies that work their way into respectable writing by reputable people that tend to mirror circular reasoning such as, "if something is insecure already, it makes no point to try to make a piece of it more secure". security is sometimes won slowly in increments, in which one could argue against each increment as useless or inconsequential, but the end result could lead to far better security. furthermore, there are a lot of different kinds of security weaknesses-- there is not a simple black-and-white measurement of "secure" vs. "insecure" but a lot of intermediate gradations. attempts to get secure credit card number transfer on the internet are not an end in themselves. they are the first steps toward an entirely new transaction system. those who see a single step and criticize it as feeble in the context of past systems are missing the point and apparently can't think past the present nanosecond of their lives.

5 8

Re: Netscape rewards are an insult
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here ... I know that this is *painfully* dated, and I apologize to the list for replying to a one month old post, but I felt I had to put some final items on the record. And I think that this is still timely ... so ... On Sat, 14 Oct 1995, Dr. Frederick B. Cohen wrote: > Phil typed: > > Have things really come to this? Besides the legal implications of > > discovering a hole and then selling the information to someone, (who > > presumably will only want this information for one purpose) where has > > the attitude of doing for the sake of doing gone? > > It's one thing to do good for the sake of doing good. Most of us do that > every day by participating in this list. It's quite another thing to be > insulted in the process. I think that Netscape's reward is an insult, Dr. Frederick B. Cohen has nailed it once again. He's right. But Phil's comments really need to be addressed ... vis-a-vis the implications of "discovering a hole and selling it". Phil's hypothetical is rightfully worrisome, but we should remember it _is_ only a hypothetical. Let's not worry much about hypotheticals. Perhaps we should worry more about what in fact IS an ACTUAL, rather than what might possibly be. The hand-wringing should be over the existing reactions to publicly ignored security holes and the ETHICS of the new Internet players. The ones who are so very cock-sure of themselves. So cock-sure, that they willingly gamble with public security and think that their invasion of individuals personal boundaries and privacy is nothing noteworthy. That it will just somehow pass. My post detailing a structural flaw in Netscape Navigator was announced, very quietly, to this list OVER ONE MONTH AGO. And what has been done about it, by AT&T and/or Netscape?? Nothing. AT&T has its reputation attached to this code, as does Deutsche Telecom, as does Netscape. The only "action" they've taken is to info-freeload and then do absolutely, positively, definitely ... nothing. Diddly-squat. No one has taken any action whatsoever. How would we treat a company ... let's say a construction company that found out that one of its buildings was unsafe, and then proceeded not to barricade the complex. If the company found out that the girders were not up to the engineered spec, and simply allowed risk and harm to continue. If the Company thought it was OK to gamble with people's lives? Would we say that the reckless disregard for the public interest merited criminal sanction?? Hopefully, we would. To attack some hypothetical "information provider" for selling some "hypothetical" information which a corporation denies is actually of any value, at all -- nominal, or otherwise -- is an argument that just doesn't float. It completely misses the mark. > If they think you can find major security bugs in Netscape for as little > as $1000, they should take the product off the market, or at least stop > claiming that it offers security. They should definitely take the product off the market. Period. They should also stop claiming that it offers any security. In fact, they should attach a product warning label, something that says that Netscape Navigator degrades your inherent safety and security as soon as you use it. That would be the "right thing" to do. Because that is truthful. AT&T's "brass" should have used the "Tylenol" or "Perrier" crisis management model on this one. Rather than, "The stick your head in the sand like an ostrich" model. Or the "Gee, maybe if I close my eyes, and pull the covers over my head, the boogie-man will go away" school. Someone has to call them on their collective jump into the World of Management by Denial. The issue here isn't the so-called "reward", the focus should rightly be placed on who knew what and when they knew it, and what they did as a consequence. The issue is whether these Goliath Companies, happily roll the dice when public safety and security is on the line. It's that simple. A real no brainer. > > Has Netscape been pestering > > security experts on the net for free work? Have they been plaguing > > people or lists with email asking the net to do their jobs? > > They do far worse. They claim security when they don't have it, and > when the cypherpunks demonstrate the false claims, Netscape offer > insulting future tribute. I think that if they are sincere, they should > reward the individuals who found the last few holes with $25,000 each, > and show that they really mean business. Actually, they said that they want to "harness" the power of the internet, and in return offered a chance to be enrolled in a contest for a mug or a T-shirt, or maybe ... if they ... in "their sole discretion" thought something was a security bug, then they'd offer a $1,000 award. Not *pestering* security experts, but simply asking them to sorta, kinda take a look at the product. Look, and help build the Companies' fortunes, while the "Creative" talent might get a nice Netscape mug for their troubles. This is what Netscape DID, but this isn't the true issue. The true issue is a question of attitudes, not of monetary compensation. I really don't care if Netscape or AT&T offer gold stars and nice little pats on the head, or offer many "millions" or offer $25,000, or expect the world's foremost security auditors to work for T-shirts or a bitta Crackerjack. That's not the issue. I just don't believe that any company should on the one hand represent that they have a secure product -- that they actually care about security -- while on the other hand they take their black-box code and say that anyone who brings an error to their attention -- a critical security flaw -- agrees implicitly to make the report the Company's property -- property to be used at the Company's sole discretion. A security review audit is first and foremost for the benefit of the end users. The audit is not so that the company can use the information for its own purposes. The information is not there so that the company can use a confidential auditor's report on security flaws to spy on their own customers, and its certainly not there to enable a code cover-up. Hell, these firms try to cover up even when the information is PUBLIC, let alone when it's given to them in private. And the crying and whining is unbecoming, because the attempt at private communication was made. It was made with both Netscape, and with AT&T. > > The ironic part is the people who have been the most successful at > > finding bugs are not the ones who are demanding money for it! > You're right. the people who find the bugs simply ask that the public interest be served ... that the Network's interest be served, and that the National interest be served. Defective product serves no one, and adding an object to an existing computing environment under the rubric of an experimental data type serves no-one. Correction, it serves no-one except those who would rather see harm come to the public. Those who value and place their own self-interest above that of others. And the consequnces be damned. > The ironic part is that a company that claims to have a "secure" method > for using credit cards on the Internet thinks that their security is so > weak that it only takes $1000 to find a major hole. The ironic part is that even once a critical design flaw is identified, no action is taken by anyone -- even when the person who finds it demands no money whatsoever for it -- the real irony is that the press is silent, and so is the company. See no evil, speak no evil, hear no evil. Let the harm and damage continue ... by my calculation, it's been one month already ... shall we maybe try now for two?? I don't think so. > -- > -> See: Info-Sec Heaven at URL http://all.net > Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236 Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

7 8

Re: credit card conventional wisdom (fwd)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: Simon Spero <ses(a)tipper.oit.unc.edu> The printed digits above the embossed account number are the first four digits of the BIN (on Visa cards) or ICA (on MasterCards). They are there to discourage re-embossing of the card with another account number. ---------------------- You may be interested in knowing that this appears to vary depending on the card issuer (or possibly on when the card was issued). My MasterCard (from USAA) has no such printed digits; instead, the entire account number is on the back of the card, plus 3 (I would guess check) digits. -Allen

1 0

MED_vac
by John Young 17 Dec '03

17 Dec '03

11-15-95. NYPaper Page One: "When Patients' Records Are Commodities for Sale." Individual medical records, carrying more sensitive personal information than ever before, are increasingly being gathered and stored by the tens of thousands in commercial databanks maintained by institutions like hospital networks, health maintenance organizations and drug companies. And although there is a Federal law that protects the privacy of video rental lists, private medical information is being bought and sold freely. The issue of medical privacy touches virtually everyone. "It is true to say that if you know a person's history of health problems, then you know more about that person than you would with any other data," said Lawrence O. Gostin, a professor at Georgetown University Law Center. And as medical records start including new genetic information that can predict diseases likely to show up in years to come, they will be able to reveal "not just health histories, but health futures," Mr. Gostin said. Yesterday hearings were held on a bill called the Medical Records Confidentiality Act, intended to establish uniform Federal rules for the use and disclosure of health information. Although the bill details procedures for obtaining consent, it also establishes a formidable list of exceptions to this requirement. The police, health oversight agencies, health information services, public health offices and medical researchers are among those allowed to obtain records of an identified patient without that person's consent and, in many cases without notification. MED_vac (15 kb)

1 0

RSA T-shirt
by David K. Merriman 17 Dec '03

17 Dec '03

FWIW, I finally got a chance to see if my barcoded RSA-in-perl t-shirt would actually scan - and it did! It took a bit of fiddling, but it was scannable using one of those hand-held CCD barcode readers. Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

Re: credit card conventional wisdom
by Rich Salz 17 Dec '03

17 Dec '03

>There is in fact a distinction between "card present" and "card not present" >transactions. AMEX cards for example have an extra group of four digits which >are not part of the embossed card number. They are used as additional >verification to prove that a card is present. So the run-it-through-the-mechanical-device is treated as card not present? /r$

4 5

DCSB: "A Middleware Guy Looks at Issues in Digital Commerce"
by rah＠shipwright.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston (Formerly The Boston Society for Digital Commerce) Presents Rich Salz Open Software Foundation "A Middleware Guy Looks at Issues in Digital Commerce" Tuesday, December 5, 1995 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Rich has been with OSF for nearly four years, where he has been the technical lead of the OSF DCE 1.1 and 1.2 releases. He is also helping write the secure multi-threaded WWW server for the DCE-Web project. He has been active in Usenet, and is the author of INN, one of the most popular Usenet/NNTP implementations. His home page is http://www.osf.org/~rsalz. Rich says: >In the rush to separate lift even more money out of your wallet >-- sorry, to provide consumers with more choice and opportunity >-- the electronic commerce community has largely been ignoring >issues that the distributed systems field has been trying to >address for years. This meeting of the Boston Society for Digital Commerce will be held on Tuesday, December 5, 1995 from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, One Federal Street. The price for lunch is $27.50. This price includes lunch, room rental, and the speaker's lunch. ;-). The Harvard Club *does* have a jacket and tie dress code. We need to receive a company check, or money order, (or if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, December 2 (that's two weeks from this Saturday), or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, c/o The Shipwright Development Corporation, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they must be made payable to "The Harvard Club of Boston". If anyone has questions, or has a problem with these arrangements (We've had to work with a few glacial A/P departments ourselves, for instance), please let us know via e-mail, and we'll see if we can work something out. January's speaker will be Art Hutchinson of Northeast Consulting Resources, Inc. We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the BSDC Program Commmittee, care of Robert Hettinga, rah(a)shipwright.com . For more information about the Boston Society for Digital Commerce, send "info bsdc" in the body of a message to majordomo(a)ai.mit.edu . If you want to subscribe to the BSDC e-mail list, send "subscribe bsdc" in the body of a message to majordomo(a)ai.mit.edu . Looking forward to seeing you there! Cheers, Bob Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMKooW/gyLN8bw6ZVAQFMAQP+MQn6wlKxMVHekN1mruUrwILBR0KTcxSK RQo7ELRJAP0aEiEskio3bphrgCpWgxKHJn9KP3YEHuNbwwXZGVzVTlijvzmbVksf ybtAsspMERb/9yWOe4AT69R/hSTAjEkzCwx86iP4FbjBccPiQPQD1eKJ+4C4obW+ WFuq7mpizeU= =J6UH -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0