December 2003 - cypherpunks-legacy

Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit
by Rich Salz 17 Dec '03

17 Dec '03

>There are many ways to spread it besides a virus. Zillions of 'em. And There are zillions (what, more than one thousand?) ways to get someone to run a random piece of software that will capture their keystrokes? I don't believe you. Name six. /r$

13 19

Re: FL Demonstrates Fatal Flaw in Logins
by joseph＠genome.wi.mit.edu 17 Dec '03

17 Dec '03

Sorry to all, but I'm not seeing what would appear to be obvious. There seems to be a lot of talk about FV "new program" that undermines security of computer login/credit cards over the net and such like that. I don't know about you guys, but I wrote stuff like that in sixth grade on the old apple IIe. It's pretty simple to write a programs that attaches itself to the keyboard driver and logs the text types, or only logs certain parts, what is the large deal? As it applies to internet security, I don't see how it can make a difference. It must be run from the local computer, at system level. If I'm on my home computer, I know what's running, and feel safe that a loging program isn't amung them. What would enable a remote site to pick up my typings. However, I don't know much about Java, would it be possible to make such an applet with Java? --Joseph -------------------------------------------------------------------------------- Joseph Sokol-Margolis joseph(a)genome.wi.mit.edu Assistant Systems Administrator seph(a)mit.edu Whitehead Institute/MIT Center for Genome Research phone: (617) 252-1922 One Kendall Sq. Bldg. 300 fax: (617) 252-1902 Cambridge, MA 02139-1561 ----------------------http://www-genome.wi.mit.edu/~joseph/----------------- ----

2 1

Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards
by Weld Pond 17 Dec '03

17 Dec '03

Nathaniel Borenstein <nsb(a)nsb.fv.com> writes: >The attack we've outlined -- and partially demonstrated -- is based on >the combination of several known flaws: > > -- It's easy to put malicious software on consumer machines > -- It's easy to monitor keystrokes > -- It's trivial to detect credit card numbers in larger data streams > -- It's easy to disseminate small amounts of information tracelessly But take away the inputting of the credit card number via keystroke and the flaw disappears. How would your program deal with a scheme like this? Programs needing secure entry create a "secure entry field" which is really just an imagemap with the digits (and alphas if required) placed randomly about. The user then uses the mouse to click on these numerals. Ideally the graphics that represent the numerals would be drawn from a random pool and are misformed to thwart any OCR attempts. The graphics could be made even more difficult to OCR by mixing in words and pictures to represent the numbers. An even better solution may be to have the imagemap generated by the server and just the mouse clicks sent back to be decoded on the server. That is how server side imagemaps work now over the web. It shouldn't be hard to take credit card numbers this way. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/ L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio L0pht Open House 2/3/96 at 8:00pm - Live on irc #l0pht - write root(a)l0pht.com for details.

3 2

More FUD from the Luddites at FV
by cman＠communities.com 17 Dec '03

17 Dec '03

Once again, FV has decided that it is easier to spread Fear, Uncertainty and Doubt than innovate. This is part of a continuing pattern that has been extensively documented in previous threads on this mailing list. There are a great many problems with the claims that FV are making with respect to their souped-up keyboard sniffer; here is the one I consider to be the clincher: If I can place any program of my design on a user's machine to sniff credit cards, I can easily exert total control over all of the e-mail sent or received from that machine. Since I can do this, it is now trivially easy to circumvent the "security" of FV e-mail confirmations. Furthermore, to do this, all I really need is control over the network traffic to that user's machine, which in many instances is going to be easier than placing a program on someone's machine. I can then set up dummy companies that my "virus" or whatever will buy "information" from -- some of these might get detected when user's get their bills, but this hypothetical program might chose amounts that would disappear into the noise of actual, legitimate purchases. Therefore, the real moral of the story is: DON'T PUT UNTRUSTWORTHY PROGRAMS ON YOUR HARD DISK --doug P.S. a good video camera in the right spot, or a telephone tap of a major mail-order distributor could probably get you more credit cards, faster, than the FV approach. Credit cards are fundamentally insecure; typing your CC# into your computer is no more dangerous than giving it to the minimum-wage clerk at Denny's. This insecurity is factored into the business model of the credit card companies -- end users do not pay one dime for erroneous or fradulent charges that lack a signature along with a card swipe or imprint. ------ ------ Douglas Barnes "The tighter you close your fist, Governor Tarkin, cman(a)communities.com the more systems will slip through your fingers." cman(a)best.com --Princess Leia

1 0

Re: Opinion piece in NYT; responses needed
by Deranged Mutant 17 Dec '03

17 Dec '03

> Mutatis> It's a decentered network (or set of networks) designed > Mutatis> to get information to its addressee. Data flows through [..] > This is unfortunately a wide-spread myth. While it's true for mail and > news, it's not for IP packets. Witness: Duh. You're right. My glitch. --- "Mutant" Rob <wlkngowl(a)unix.asb.com> Send a blank message with the subject "send pgp-key" (not in quotes) for a copy of my PGP key.

1 0

Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Mon, 29 Jan 1996 15:07:46 -0500 (EST), Nathaniel Borenstein wrote: >[My apologies in advance if you see several copies of this message. I >am posting this fairly widely due to the severity and importance of the >problem described.] >As you may already have heard via the popular press, First Virtual >Holdings has developed and demonstrated a program which completely >undermines the security of every known credit-card encryption mechanism >for Internet commerce. This is a very serious matter, and we want to >make sure that the Internet community is properly informed about the [..] All that over keyboard grabbers??? *yawn* This is nothing new at all.

1 0

FV Security Holes (?)
by Inverardi＠abacus.ch 17 Dec '03

17 Dec '03

Received: from relay3.UU.NET by abainet.abacus.ch (PostalUnion/SMTP(tm) v2.1.8d for Windows NT(tm)) id AA-1996Jan30.114852.1590.835; Tue, 30 Jan 1996 11:48:55 GMT Received: from toad.com by relay3.UU.NET with SMTP id QQaasw09854; Tue, 30 Jan 1996 05:40:13 -0500 (EST) Received: by toad.com id AA18530; Tue, 30 Jan 96 02:27:35 PST Received: from fuqua.fiftysix.org by toad.com id AA18520; Tue, 30 Jan 96 02:27:18 PST Received: (from mixmaster@localhost) by fuqua.fiftysix.org (8.6.12/8.6.9) id EAA17459; Tue, 30 Jan 1996 04:25:02 -0600 Date: Tue, 30 Jan 1996 04:25:02 -0600 > I believe that FV works by assigning the user some sort of id number. > > They send the id accross the net, FV has a database with "FV-ID" <-> > credit-card-number correspondences, the merchant sends FV the id, FV > bills your card and pays the merchant. Ok now, so you can get one's FV-Number by simple eavesdropping? That sounds just too easy to me. Does anybody have more detailed information about FV and how it works? bye. iNVi.TF! ---------------------------------------------------------------------- Remo Inverardi - Voice +41 61 811 14 82 - Fax and BBS +41 61 811 14 42 ABACUS Software Research AG - Rorschacherstr. 170 - CH-9006 St. Gallen ----------------------------------------------------------------------

1 0

PPP link encryption?
by Alexandra Griffin 17 Dec '03

17 Dec '03

Is there any software out there on the net for doing real-time, transparent encryption of a PPP link? Also, if this link is running at 600kbit/s to 1Mbit/s, how much processing power would be required to keep up (assuming we're using, say, the IDEA cipher)? Would a dedicated 386DX/33-based router on each end be sufficient? Finally, could someone make a ballpark estimate as to the amount of additional latency that would be added? thanks, - alex

2 1

RE: FV Demonstrates Fatal Flaw (Noise + Humour)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

(Second year PR student press release crap deleted) On 1/29/96 Nathaniel Borenstein preached the evils of Internet Commerce....... NB> If your idea of "today's computer users" comes from cypherpunks, you're NB> living in a dream world. FV's experience with average Internet users NB> includes some of us who ask us not to use complicated "technical terms" like NB> "cut and paste". Ther certainly can't be counted on to know which NB> software to download and which to avoid. I'd bet that one half learned to download and use Vueprint 4.3 and the other half are finishing up learning Mavis Beacon's Typing Tutor. Later on in the day, Nate yacked that...... NB> This is fine for you and me. But Internet commerce has to work for the NB> hundreds of millions of non-technical consumers who are swarming onto NB> the Internet. If someone emails them a program that purports to show NB> them pretty pictures (dirty movies?)..... Glad you are trying to market some of your other overpriced services, Point your (Not THAT!!!) browser to: http://www.infohaus.com/access/by-keyword and pan down to the bottom of the page, Seems that every third service for sale by First Virtual is about sex. For instance...... adult advertising, amateur art, bisexual, cyberpunk (full of dating services?!?) gay, images, jpegjpg, lesbian literature, male marketing, nude, nudity, pornography, sex, singles, and on and on! Send out a press release after Chaum has bought you guys out! The Christmas Troll --

1 0

Re: "German service cuts Net access" (to Santa Cruz)
by Duncan Frissell 17 Dec '03

17 Dec '03

At 12:07 AM 1/28/96 -0800, Timothy C. May wrote: >* the Germans recently arrested an American who landed in Germany >somewhere, as part of a trip. It seems he had been involved with the >production of Neo-Nazi material, somewhere out west. This was the last I >heard about the story. Sorry, I'm going from carbon-based memory. > He was grabbed in Denmark and extradited to Germany so you'd have to avoid most of the EU. DCF

9 14