December 2003 - cypherpunks-legacy

Re: new web security product
by Steve Gibbons 17 Dec '03

17 Dec '03

# Perry Metzger wrote: # > I don't think its going to fly. No one wants to pay for an unneeded # > $100 piece of hardware to encrypt the same credit card over and over # > again, when a nearly zero marginal cost piece of software can do the # > same thing. Merchants might. Current credit-card processing terminals are increadibly overpriced for what you get. $100.00 plus the price of an inexpensive PC, plus proprietary software isn't too far of the mark, in comparison. # I agree with Perry. Hardware encryption does add a layer of security # not normally found in software, but it is hardware. I've been a fan of unrelated encryption at each layer of the 7 (5, 4, whatever) layers, lateley. In military/financial terms, the question of "who has access to what" and "needs to know what" at different levels of the protocol stack make a big difference. Network guys should be able to perform traffic analysis, application guys should be able to debug application-specific traffic, but not visce versca. # Shoot, I don't even have a 28.8 modem yet, why would I want a black # box that supposedly does something with my Credit Cards? If you think "Not _my_ credit cards, but my _customers'_...", then it starts to make sense. -- Steve(a)AZTech.Net

1 0

Re:
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 03:41 PM 1/16/96, you wrote: >I thought you might find this interesting... Thanks, that is very cool beyond just ecommerce, because what does it mean for personal encryption? If I buy one of these doo-hickeys for $100, and so do you, does that mean we don't have to buy an AT&T 3600 (secure phone) to talk securely, and also not have to worry about Clipper crap? Or (as it probably is) does that mean we _have_ to talk through this company and it only sends tiny bits of info from the card reader... (it'd be cool if you could modify it...) Interesting. > >found at:http://www.cnn.com/TECH/9601/encryption/index.html >New security device may broaden business on the web > >January 16, 1996 >Web posted at: 9:30 p.m EST (1430 GMT) > >>From Correspondent Marsha Walton > >ATLANTA (CNN) -- For cyberspace marketers, The World Wide Web is a potential >world wide mall, an electronic marketplace for consumer goods and services. > > But for now, most visitors are window-shopping, not buying. A new survey by >the University of Michigan shows consumers are wary of purchasing goods >online for fear their credit card numbers will be misappropriated. > > People who think nothing of giving their credit card number to an anonymous >voice over the phone or handing their card to a waitress at a restaurant, >flinch at the thought of putting that number into a computer. > > But a New Jersey, ISED Corp., has created a device that >secures transactions, both on the Internet and over the telephone. It's >called SED, or secure encryption >device. It costs about a hundred dollars, attaches to a >phone or a PC and operates with the swipe of either a credit or ATM card. > > "What the device will really allow is consumers a new form >of payment from home using their ATM card. They'll be able to purchase goods >and services or whatever on the internet, " said Roger Payne, an engineer >for BT Labs which is testing the product. > > Potentially vulnerable personal account information is >scrambled or encrypted on the magnetic stripe on the card. It is >electronically transferred through the hardware. That eliminates the need >to say or "key in" the account number or expiration date. > > "So that if somebody who is not supposed to be looking at it, they can't >understand what's in there," said Grant Helmendach whose company BUYPASS >processes three quarters of a billion financial transactions a year. > > BUYPASS is marketing SED to "mom and pop" retailers which charge goods by >making an imprint of credit cards, relying on paper transactions that are >costlier, and less secure. > > "Lots of folks want to focus on the Walmarts of the world. not a lot of >people have focused on the smaller specialty shops, specialty retailers, and >what folks at SED have done, is built a terminal that's very inexpensive, >so they can play in this game. They have financial incentive to do that," >said Helmendach. > > As buying by computer catches on, the device could eventually be used to pay >for everything from a pizza delivery to bailing a friend out of jail, and >would be as much a part of the home computer as a floppy disk or a hard drive. > > And just as consumers have grown accustomed to computers and ATM cards, the >combination of the two could be another step toward a "cashless" society. _______________________ Regards, If God intended one space between sentences, why do we have two thumbs? - ? Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu 0C 69 D4 E8 F2 70 24 33 B4 5E 5E EC 35 E6 FB 88

1 0

Re: pgp broken?: my mistake
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

I apologise for including the following line: >>On 16 Jan 96 at 19:16, Derek Atkins wrote: Making it appear that Mr Atkins had something to do with the quote, which he did not. After rereading, the entire post has a sort of nasty tone that I did not intend. Oh, well, maybe I should return to lurk mode for a while... Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0

01 16 96 CuD Cypherpunks-related Items
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, Cypherpunks-related items in 01 16 96 Computer under- ground Digest: Cryptography and Privacy Justice Dept. press release: no PGP prosecution (fwd) FLASH: Phil Zimmermann case dropped! Letter to Wiesenthal Center in re "hate speech" ban AP/NYT: Jewish Groups Call for Internet Censorship CuD is available as a Usenet newsgroup: comp.society.cu-digest The most recent issues of CuD can be obtained from the Cu Digest WWW site at: http://www.soci.niu.edu/~cudigest Cordially, Jim

1 0

Lotus to export 64 bit, partially-escrowed Notes
by Peter Trei 17 Dec '03

17 Dec '03

Alerted by a colleague at the RSA Data Security conference today, I just checked the Lotus site. Folks may wish to look at http://www.lotus.com/home/whatsnew.htm A new 'international' version of Lotus notes is being released, with 64 bit session keys, as opposed to the old 40 bit version. 24 bits of the session key are stored encrypted under a special, government-access RSA public key. This is in addittion to the full 64 bit key being available under the recipient's public RSA key. The idea is that the USG would have to search only a 40-bit keyspace, while others will need to search a 64-bit keyspace. Reportedly, this 'workfactor reduction key' will NOT be available to foreign governments. My colleague reports that opinion at the conference was divided over whether Lotus was doing something which made good business sense, or whether this was 'caving-in'. Speaking only for myself Peter Trei trei(a)process.com

3 2

Re: THE RECIPROCAL ?......
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:33 AM 1/17/96 -0600, you wrote: > >Terence Joseph Mallon writes: > > "When people talk of encryption they use the word break, they are > > approaching from one way but not the only way. I am at present trying the > > reciprocal, that is, to mend." > >Why do I sometimes feel that personalities that once were drawn to >design of perpetual motion machines or techniques for squaring circles >may very soon flock to cryptographic "research"? Actually, I think she was just fucking with his mind... It sounds like an answer that I would give to a paranoid newbie, given half the chance. (If I had thought of it...) "A mindfuck is a terrible thing to waste." I am sometimes surprised at the number of "They have broken PGP" stories I keep hearing. People who know NOTHING about cryptography somehow "know" that PGP has somehow been "broken". I wonder how these memes are getting into the culture at large? Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

RE: Random Number Generators
by Kurt Buff (Volt Comp) 17 Dec '03

17 Dec '03

If you're going to work with hardware to get really random numbers, why not go to the back of any of several PC-type magazines, and order the radiation detector board that someone is hawking? Can't really do any better than that, can you? Counting cosmic ray hits and noting their time differentials should be just what the doctor ordered, right? Kurt ---------- From: Perry E. Metzger[SMTP:perry@piermont.com] Sent: Wednesday, January 17, 1996 11:00 To: Timothy L. Nali Cc: cypherpunks(a)toad.com Subject: Re: Random Number Generators "Timothy L. Nali" writes: > For a class project, I will be designing a VLSI cmos chip to generate > truly random numbers (The chip will be fabricated). I'm limited to a > 2-micron standard cmos technology > The most promising design I've seen so far (that I can actually > do) is based on clocking a D flip-flop in the following way: I'd say that the design you have picked has a couple of problems with it. The first is that you are, from what I can tell, building a synchronizer, which means that you may have metastability problems. (Your diagram wasn't completely clear so I can't tell). Also, you are depending on a sloppy clock and a not sloppy clock actually having the stated properties, which means you aren't really generating randomness so much as hoping you can detect and exploit it. As it is very hard to determine if a stream is really random, this makes your life difficult. Far better to try to use some analog tricks in the circuit itself to generate the random numbers for you. Of course, some of these end up producing metastability problems of their own... Can anyone point this guy at good texts on all of this? I've never found one... Perry

1 0

02 96 Wired: Cyperpunks-related
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, Cypherpunks-related items in 02 96 Wired: TITLES PAGES Surveillance-on-Demand 72 Spam King! 84 Cyphermilitia 95 Steve Jobs 102 [interview; see 162.2: "If the Web becomes too complicated, too fraught with security concerns...."] Catching Kevin 119 Privacy Is History 124 How Good People Helped Make A Bad Law 132 [FBI reverse-engineers EFF] I may have overlooked some items. Wired subscription requests: 1 800 SO WIRED. Cordially, Jim

1 0

CryptoAPI and export question
by m5＠dev.tivoli.com 17 Dec '03

17 Dec '03

Tom Johnston writes: > We would ship a CSP development kit to a foreign vendor, and sign a CSP > developed by the foreign vendor, but only with the appropriate export licenses. So you'll only perform the signing operations in the United States? In other words, what if I'm in Egypt, and I develop a CAPI-compliant DLL (or whatever). Could I go down to the Cairo Microsoft office and get my stuff signed there? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Nobody's going to listen to you if you just | Mike McNally (m5(a)tivoli.com) | | stand there and flap your arms like a fish. | Tivoli Systems, Austin TX | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

[Local] Update Information for Portland Cpunks Meeting
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Portland Cypherpunks meeting is still on. We will be having a key signing. Reminder about time and location: Location: The Habit Internet Cafe 21st and Clinton in Portland OR http://www.teleport.com/~habit/ for more info. Date: January 20th, 1996 (THIS SATURDAY) Time: 5:23pm So far I have received only four keys for the key signing. I am kind of disappointed about the results of the proposed key signing for the meeting... If you are planning on attending, even if you are not planning on participating in the key signing, I need to know so the Habit can plan for the added influx of people. So far I have a large pile of "maybes" and few confirmations. If you have topics you would like to do a presentation on, please give me information on it so that I can distribute it to the other participants. (Or bring it up before the meeting.) *** NOTE *** Teleport (my ISP) has been having mail problems. If you have sent me mail and not received an confirmation, please resend. I may not have received it. Currently, there is only one other speaker confirmed (besides myself). I would like to see more input from the rest, so this does not just become a one way spouting of information. The one confirmed speaker will be presenting some of his findings on remailers involving reliability and getting nyms to function for those not versed in the field. It should be useful information for anyone using remailers. (He had a few findings that surprised me...) I have had a few interesting "maybes", but I will wait until (or if) they show up... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMP1nl+QCP3v30CeZAQFtGAf8DEofknvToxZWO5upwZoFiSUCaENrPtM/ 6t6Mdl3eTZHan28qJV9vXkKAG6Q9gANQ342NQeH1CbmOalNLxnVrETbKTKv8llNG ASH1iZML//JEQJT3XeHYHAPBBCg18zIfskjU0h0of60MzmcsykHN/ZJTIpps8UIq sgB8fk2Uh9LVg/VFyIvnVnpIMQPZ1W+Z5YQco3rEnqKycKjOi0E0XoKsaJFoWelj 1aHtmWrXxC1Lr2H7fVa0DsF5Vh3w5h2RaelpZBR8QB7Uz8JwYb4jaBtdkrSMlqeg IGZaKirdZDX7i0geB905aVVdiRrahbAz4nV82DxkVEbn/h56XHAtvg== =3PKR -----END PGP SIGNATURE----- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0