December 2003 - cypherpunks-legacy

Re: Tim's paranoid rant about Declan appearing on "Europe's Most
by Declan B. McCullagh 17 Dec '03

17 Dec '03

Forwarded from another mailing list. (Charles is a journalist/author...) ---------- Forwarded message begins here ---------- Date: Thu, 1 Feb 1996 09:11:19 -0500 (EST) From: Charles Platt <cp(a)panix.com> Subject: Out of Control Rich Graves' suggestion that Declan is "out of control" is interesting. Perhaps Rich merely meant that Declan made a mistake but the subtext suggests that Declan should be in some sense marching in step, following a consensus, obeying a policy. I don't like the smell of this. In my experience, having read MUCH literature from revisionists and from organizations such as Wiesenthal and ADL, it is IMPOSSIBLE for anyone to adopt an independent or middle path without raising the wrath of those on both sides of Jewish issues. I also suggest that public statements, especially from ADL/Wiesenthal, cannot be taken at face value. For instance: > * The ADL is tracking racist sites, but the goal is to expose them and > educate the public. Anyone who believes that this is the totality of ADL activities and intentions is simply unaware of the history of the ADL. I have personally witnessed an ADL representative trying to recruit hackers to paralyze a BBS where white-supremacist materials were stored. And this I think is just the tip of the iceberg.

1 0

Re:
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQ+jNCoZzwIn1bdtAQEgAwF+LRiwIlumqj6P2/pft8804Cbbttz3R7yL Pwd44+uUTk1SxJZePCt7O1jReYfDohTB =Ii6p -----END PGP SIGNATURE-----

1 0

Re: Apology and clarification
by Simon McAuliffe 17 Dec '03

17 Dec '03

For those that are sick of this thread (as I am), I apologize in advance for throwing another log on the fire. I just can't help trying to get through... Nathaniel Borenstein <nsb(a)nsb.fv.com> writes: > First of all, I believe that I owe the cypherpunk community an > apology for an error in judgement on my part. The message that I [...] > Our approach combines the following four known problems into a > fatal attack: > > 1) Consumer machines are insecure and easily compromised. > 2) Keyboard sniffers are easy to write. > 3) Credit card numbers are self-identifying (they have check digits) > and can easily be extracted from a huge stream of input data. > 4) Once intercepted, small amounts of information (e.g. a cc #) > may be distributed completely tracelessly over the Internet. > > When you put all four of these together, you have an attack that > IS new, in the sense that nobody we know of has ever mentioned it > before, and which could in fact be used by a single criminal, with > only a few weeks of programming, to tracelessly steal MILLIONS of > credit cards, if software-encrypted credit-card schemes ever caught > on. You're right, the four problems you mention are known and have been for a long time, and have also been used in attacks. What you don't seem to understand is that the overall attack from the combination of these isn't new either. In many ways a credit card number, name and expiry date form a password. It's a password that the bank accepts to allow money transfers in much the same way as a computer accepts a password to allow information transfers. On this very list (amongst other places), there has been discussion of trojans and viruses for grabbing passwords, and of methods of determining what is a password and what isn't a password. In the same way you can decide if a number is a credit card number, there are heuristics you can use to determine if a user is entering a password, though often it may require more than just monitoring keystrokes. To collect expiry dates and names for credit cards, monitoring additional side information may also be useful. So I see no fundamental difference between the two, credit card numbers _are_ passwords. I myself have used precisely this technique many years ago, as I'm sure many others here have, to demonstrate security problems. The only difference is the heuristic for determining what constitutes a password in the domain you're snooping. What's more, the methods in existence before your post can be and have been built in viruses which are considerably more prolific than a trojan. Not only is your attack not new, it is less powerful that some similar attacks that predated yours. Implying credit card numbers are more valuable than passwords is dubious. There are organisations that could lose millions of dollars if their password security was compromised, but it's hard to say the same for credit cards. In this country, although I don't know about yours, I'm not even liable if somebody steals my credit card and uses it. I would consider a "credit card password" as a lesser commodity than a password for giving access to an entire computer system. [...] > So here's the factual claim, to be proven or disproven: One good > programmer, in less than a month, can write a program that will > spread itself around the net, collect an unlimited number of credit > card numbers, and get them back to the program's author by > non-traceable mechanisms. Does anyone on this list doubt that > this is true? If so, I'd like to know the flaw in my thinking, -- > I am *not* too proud to withdraw any claims that aren't true. If > not, I think it's worth noting that this fact was previously > completely unknown to the bankers and businessmen who are putting > large sums of money at risk on the net. The only way to get the > message to those communities is with a very visible public > announcement of the kind you saw yesterday. Of course this is a threat, I don't think _anybody_ will deny that, but this is not a new threat. True, the attack may not have been known to businesspeople and bankers, but there are many others areas of security they also know nothing about. Trying to claim an old invention as your own just looks like hype, PR and lies, not to mention showing a lack of knowledge which could do the reverse from what you set out to achieve. It is certainly a Good Thing for the public to know about the potential for various types of snooping, but surely it could be done in some way which doesn't make it look like you invented it. I don't think anybody here objects to the attack itself, but rather the claims you made about it and the way you communicated it. --- E-mail: sai@comp.vuw.ac.nz/sai@kauri.vuw.ac.nz +64 4 233 9427 PGP Fingerprint: 65 5B B4 6C CB 6A 65 F1 01 91 B9 FE 34 23 99 D3 PGP Key by mail, finger or from http://www.vuw.ac.nz/~sai/pgp-key.html

1 0

None Unix swapfile security issues...
by Anonymous 17 Dec '03

17 Dec '03

I'm working on a unix application where I want to store a key in memory and don't want it to get written out to a swap file. If the key is in any of the application's memory pages, it could be swapped out at any time, and potentially left in the swap file when the computer is turned off. But, what if the program creates a pipe() and writes the key into it, then reads the key out when necessary? A pipe has a 4K buffer, but that buffer is in the kernel's memory, not in the application's pages. Could a kernel buffer get written out to a swapfile?

2 1

Declan appearing on "Europe's Most Wanted"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:27 AM 2/1/96, sameer wrote: >> I guess Declan M. won't be visting France or any of the other EU countries >> any time soon! > > That reminds me of a question-- > > If, for example, Germany decides that my company is in >violation of their laws for mirroring the Zundelsite, will they send >us a letter saying that, so we know not to go to Germany? The Nebraska-based neo-Nazi publisher who was picked up in Denmark and extradited to Germany pretty much knew his actions were illegal in Germany, but I doubt (sheer speculation on my part) he had ever been formally notified that an arrest warrant had been issued by Germany and could be exercised in Denmark. The situation with Declan, Sameer, Duncan, and others, is even less clear. Things are moving much faster now that the Net is the means of distribution. I was of course half-joking about Declan visiting Europe, but surely France could decide to throw the book at him, and any EU country he entered (such as Ireland, judging from his name) could hold him at their entry point and ship him off to France to "set an example." I suspect the U.S. never officially notified that Monterrey, Mexico alleged drug dealer that he was wanted in the U.S., and as other kidnappings of foreigners have shown, the U.S. feels it unnecessary to formally announce to foreigners that they may be arrested in the U.S. (or kidnapped into the U.S.). Thus, I strongly suspect that France will not bother to notify Declan or Sameer or any of us that they face arrest in France (or affiliated EU countries). In Declan's case, I suspect France wants him for the Mitterand book and Germany wants him for the Zundelsite mirrors. The lesser European countries will of course follow their leads. Seriously, Declan, I admire what you've done, but I hope you don't plan to leave the U.S. for Europe anytime soon. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Visa and MC announce Thursday
by PJ Ponder 17 Dec '03

17 Dec '03

sorry about screwing up the day of the week, today is really *Thursday*, not Friday. . . . first post of the day, & so forth. My earlier message: From: ponder(a)mail.irm.state.fl.us (pj ponder) To: cypherpunks(a)toad.com Subject: Visa & MC Std Sender: owner-cypherpunks(a)toad.com just heard this on NPR Friday ^^^^^^ am on the east coast of NA. http://www.nytimes.com/library/cyber/week/0201internet-safety.html February 1, 1996 Group to Unveil Industry Standard for Electronic Payments <the rest clipped> p.s. went right out and bought the NY Times and the WSJ, but they didn't have any more info than what is on the nytimes.com server. [return to signal mode]

1 0

No Subject
by hauke＠supra.kodak.com 17 Dec '03

17 Dec '03

unscribe cypherpunks(a)toad.com

1 0

Re: The FV Problem = A Press Problem
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

At 6:42 PM 1/30/96, Jonathan Rochkind wrote: >I'd say _all_ news, not just software news, is P.R. controlled, these days. >You can largely hold Edward L. Bernays, the "father of public relations" >(who just died last year) responsible for that--or the societal conditions >that allowed Bernays to do his thing. Bernays developed expertise in >"engineering of consent" turned the news into a commercialized and On January 13, 1996 I had the lead article in _Computer underground Digest_ (Volume 8, Issue 04) on the CyberAngels and how they were patrolling cyberspace against the Four Horsemen types. Rockland is certainly welcome to tell the cypherpunks list the press release(s) from which I wrote this "public relations." cc Tim May, CAF founder, chief technical officer, and media relations specialist

1 0

short FV question
by Simon Spero 17 Dec '03

17 Dec '03

When my CTS plays up like it has this past week, I use a Dragon dictate Voice Recognition system. Since I' Not actually touching a keyboard, does this make me secure? Simon ---- RSA - The Canadian For Butt

2 1

I hate over-hyped claims
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

Perception in some quarters to the contrary, I am very averse to over-hyped claims, and I would therefore like to publicly acknowledge a factual error in my previous announcement. I wrote: > The only known Internet-based solution that does not require such > hardware is the First Virtual Internet Payment system, details of which > are available at http://www.fv.com. This is not quite true, and I should have known better, but I forgot about the one other example I'd heard of. I should have said: > The only known Internet-based solutions that do not require such > hardware are the First Virtual Internet Payment system, details of which > are available at http://www.fv.com, and the GC Tech system, described at > http://www.gctec.com/. I apologize to the good folks at GC Tech for this unfortunate mistake. They are our competitors, but that does not mean we intended to make any false or misleading claims about them. I stand by all my other claims. -- Nathaniel -------- Nathaniel Borenstein <nsb(a)fv.com> Chief Scientist, First Virtual Holdings FAQ & PGP key: nsb+faq(a)nsb.fv.com

1 0