December 2003 - cypherpunks-legacy

VISA /MC Press release
by John Pettitt 17 Dec '03

17 Dec '03

10:20 PR Visa And Mastercard Combine Security Specifications For Card Transactions On The Internet Into One Standard Companies: X.MST X.VSA Move Expected to Accelerate Development of Electronic Commerce and Bolster Consumer Confidence in the Security of Cyberspace Transactions PURCHASE, N.Y. & SAN FRANCISCO, Feb. 1 /PRNewswire/ -- Addressing consumer concerns about making purchases on the Internet, MasterCard International and Visa International joined together today to announce a technical standard for safeguarding payment card purchases made over open networks such as the Internet. Prior to this effort, Visa and MasterCard were pursuing separate specifications. The new specification, called Secure Electronic Transactions (SET), represents the successful convergence of those individual efforts. A single standard means that consumers and merchants will be able to conduct bankcard transactions in cyberspace as securely and easily as they do in retail stores today. The associations expect to publish SET on their World Wide Web sites in mid-February. Following a comment period, the joint specification is scheduled to be ready for testing in the second quarter of 1996. Visa and MasterCard expect that banks will be able to offer secure bankcard services via the Internet to their cardholders in the fourth quarter 1996. Participants in this effort with MasterCard and Visa are: GTE, IBM, Microsoft, Netscape Communications Corp., SAIC, Terisa Systems and Verisign. Also, SET will be based on specially developed encryption technology from RSA Data Security. "This is the first step in making cyberspace an attractive venture for banks and merchants. A single standard limits unnecessary costs and builds the business case for doing business on the Internet," said Edmund Jensen, president and CEO of Visa International. "Further, our work with MasterCard demonstrates our unwavering commitment to address the needs of our member financial institutions and their merchants and cardholders." H. Eugene Lockhart, CEO of MasterCard, said: "MasterCard has viewed one standard for secure card purchases on the Internet as a critical catalyst for electronic commerce because it bolsters consumer confidence in the security of the electronic marketplace. A single standard has always been our objective because it is in the best interests of not only consumers, but also merchants and financial institutions worldwide. We are glad to work with Visa and all of the technology partners to craft SET. This action means that consumers will be able to use their bankcards to conduct transactions in cyberspace as securely and easily as they use cards in retail stores today." The card associations will separately test SET with consumers, merchants and financial institutions. A joint interoperability test will be conducted after the individual tests to ensure SET, where necessary, operates as smoothly as the point-of-sale system used today. Upon conclusion of the tests, an updated version of the specification will be published for software providers. MasterCard's Web address is http://www.mastercard.com. Visa's Web address is http://www.visa.com. MasterCard International Incorporated is a global payments company that provides consumer credit, debit and other payment products in partnership with 22,000 member financial institutions worldwide. MasterCard's family of brands, MasterCard, Maestro and Cirrus, represent approximately 300 million cards in circulation, and over 13 million acceptance locations, including 243,000 MasterCard/Cirrus ATMs worldwide. MasterCard's pioneering work in the areas of transaction processing and delivery systems continues to revolutionize the way consumers pay for goods and services. Headquartered in the San Francisco Bay Area, Visa is the world's largest payment system. It plays a pivotal role in developing and implementing new technologies that benefit its 19,000 member financial institutions and their cardholders, businesses, governments and the global economy. Visa's 442 million cards are accepted by more than 12.2 million merchants worldwide. Visa/PLUS is the largest global ATM network. /CONTACT: David Melancon of Visa International, 415-432-2427; or Dorea Smith of MasterCard International, 914-249-1421/ 10:00 EST John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch

1 0

Anonymous Interview
by Duncan Frissell 17 Dec '03

17 Dec '03

"Anonymous" the author(s) of "Primary Colors" (the Clinton Campaign novel) conducted an interview with a Time Magazine writer using his/her/their agent's online account. A demonstration that borrowed accounts can overcome account ID control attempts. DCF

1 0

Re: Unscribe
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:34 AM 2/2/96, Ewout Meij wrote: >unscribe cypherpunks(a)toad.com ^^^^^^^^ > >unscribe emeij(a)pi.net ^^^^^^^^ > >There is a theory which states that if ever anyone discovers exactly >what the Universe is for and why it is here, it will instantly >disappear and be replaced by something even more bizarre and >inexplicable. There is a theory which states that the correct way to unsubscribe from mailing lists is defined by the mailing list charter and principles, and that sending misspelled "unscribe" messages to the wrong place, and including "unscribe" messages intended for other lists, is bizarre and inexplicable. --TCM P.S. to Ewout: Send a message to "majordomo(a)toad.com" with a body message consisting only of "unsubscribe cypherpunks". Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: new release of apache-ssl
by Jyri Kaljundi 17 Dec '03

17 Dec '03

On Wed, 31 Jan 1996, sameer wrote: > Apache-SSL 0.4.4 will soon be on the ftp site, and commercial > licensees may request upgrades from apachessl(a)c2.org. If someone put's this up on some European ftp site, please tell us. Right now only version 0.4.2 is available on utopia.hacktic.nl and ftp.funet.fi. Juri Kaljundi, DigiMarket jk(a)digit.ee

1 0

RC2 code on sci.crypt
by Bruce Schneier 17 Dec '03

17 Dec '03

For those not paying attention, there is RC2 code on sci.crypt. RSADSI is acting as if it is real, and will publish some legal posturing about it real soon now. Bruce ************************************************************************** * Bruce Schneier APPLIED CRYPTOGRAPHY, 2nd EDITION is * Counterpane Systems available. For info on a 15% * schneier(a)counterpane.com discount offer, send me e-mail. **************************************************************************

3 2

Japanese Firm Announces E-cash Implementation
by Andrew Barrett/CheckFree Corporation 17 Dec '03

17 Dec '03

Multimedia Business Analyst via Individual Inc. : NTT has developed a secure electronic cash system for smart cards and Internet-based transactions, reports Reuter. Using very secure encryption algorithms, the system allows users to transfer cash from their bank accounts to smart cards after verification by the issuing bank. NTT researcher Mikio Suzuki said the Japanese telecom operator plans to begin trials of the system with a number of major city banks in the near future. These are expected to include Fuji Bank and Sakura Bank.

1 0

digital signatures and "meaning"
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Digital signatures can have many different uses and meanings. The most popular application of digital signatures is proof of authorship. A person signs something when he claims that he wrote it and if the signature is invalid, the message must have been altered. However, digital signatures are used for many other applications. Typical applications include timestamping, digital cash, and validating a document or statement. The problem with these applications is that there must be some way to distinguish and timestamp signature from a proof of authorship. There are several different ways to do this: - Make all digital signatures prove proof of authorship. Someone would include the text of the document he wants to sign and put a message saying at the end such as: "This document existed on such and such date" or, in the case of digital cash, "This coin was blinded and signed by the bank using standard protocols." - Append some kind of electronic tag to the message that represents a certain kind of authorization. This is identical to the previous method except it relies more on protocols. - Specify the type of signing that is to be done with a key. This could be included in the text of the user-ID field of the public key in a PGP-like program. It could also be done by extending a key generation and management protocol to include a tag on the key itself specifying what this key is to be used for. There are advantages and disadvantages to each of these. The first has the advantage that it requires no protocol modification but relies on "legaleese." The second method does require that protocols be slightly modified, but these modifications could be made by just pre-processing and post-processing the message with another program. However, this is more limited than the first method because it essentially uses "canned" messages. The final method relies on either no modification to the crypto program used or a non-trivial modification. Personally, I tend to think that anything that uses a standardized protocol is a Good Thing. This is why I think that the second and third methods listed above would work better than the first. Comments? - --Mark =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= markm(a)voicenet.com | finger -l for PGP key 0xf9b22ba5 http://www.voicenet.com/~markm/ | bd24d08e3cbb53472054fa56002258d5 PGP: Because sometimes, a _Captain Midnight_ decoder ring simply isn't enough. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBMQ1agLZc+sv5siulAQFKtwP/Xs7gOm1vP2FeDJDjahymYbMum3JrFqh0 VKXrkjmlh42ygX9y2sLfivN7DMsAGIF86NRaW67x0LD2uPuBl00KyvC18bqEPfiF kMbvOZv96xL4fBssheRR7F4YH/oaASxCagxuAkIqBxi9uEzAppNloxMYHy87w0kY h+48n+YH3D0= =QTZp -----END PGP SIGNATURE-----

1 0

Re: Lotus Notes
by Rich Salz 17 Dec '03

17 Dec '03

Thanks for the explanation -- in all my discussion with RSA and explanation to our lawyers I was thinking strictly API. Your quote of the RSAREF license says they won't refuse anythign reasonable, and one would be hard-pressed to say that changing keysize for something already not exportable isn't reasonable. I'll have to read our license when I get to work tomorrow. /r$

1 0

The Boys From Brazil - thoughts on cloning Nazi servers
by Simon Spero 17 Dec '03

17 Dec '03

I've tried to stay out of this thread, as it is mostly off topic, but I do have one suggestion to people setting up clones of the zundel site. There's a fine line between defending someones freedom of speech, and actively promoting that speech. The reason these mirrors have been set up is to counter the restriction on access to the original site that has been put in place by Deutche Telecom; however, in addition to defeating this restriction, this approach also makes the material more widely available than it was previously, which could be seen as crossing the line between defence of free speech, and active promotion. One approach that would stop this line being crossed would be to configure the clone servers to only allow access to sites in Germany affected by the original restriction. This compromise defends freedom of speech, but does not give the site any wider promulgation than it would have had had no government restrictions been emplaced. Simon

1 0

Re: Unscribe
by Alex de Joode 17 Dec '03

17 Dec '03

TCM sez: : At 1:34 AM 2/2/96, Ewout Meij wrote: : >unscribe cypherpunks(a)toad.com : ^^^^^^^^ : > : >unscribe emeij(a)pi.net : ^^^^^^^^ : > : >There is a theory which states that if ever anyone discovers exactly : >what the Universe is for and why it is here, it will instantly : >disappear and be replaced by something even more bizarre and : >inexplicable. : There is a theory which states that the correct way to unsubscribe from : mailing lists is defined by the mailing list charter and principles, and : that sending misspelled "unscribe" messages to the wrong place, and : including "unscribe" messages intended for other lists, is bizarre and : inexplicable. : --TCM [pi.net] 'Planet Internet' is the dutch equivalent of AOL. -AJ-

1 0