December 2003 - cypherpunks-legacy

Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:30 PM 1/29/96 -0500, Nathaniel wrote: >Have you downloaded my key from the net? Assume that you have. How do >you know it's mine? > >I use PGP about 20 times per day. I use it in a manner that is >*meaningful*. Unless we have in some way or another verified each >others' keys, it is meaningless for me to sign a message to you. >Putting a PGP signature on a message to someone who has no way of >verifying your keys is a nice political statement, but is utterly >meaningless in terms of adding any proof of the sender's identity. -- We have this discussion around here occasionally; one thing it does is allows somebody to know that different messages were from the _same_ person, whether that person is using a purported True Name or an outright alias. Another thing it does is allows you to demonstrate, if need be, that you have the keys that were used to sign a message, by signing another message with the same key, and optionally by doing the Web Of Trust thing to validate your identity to someone. I'm not aware that anyone's actually _done_ this in court, but Utah and maybe other states have laws recognizing the validity of digital signatures, and other courts could at least accept it along with the usual Expert Witnesses. Obviously it doesn't let you prove that an unsigned message isn't from you, but that's pretty tough without requiring all messages to be signed with your True Nationalist-ID-Card Is-A-Citizen Key. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # http://www.idiom.com/~wcs

1 0

Re: FV's Borenstein discovers keystroke capture programs! (gifs at 11!)
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:24 AM 1/30/96 -0500, Nathaniel Borenstein <nsb(a)nsb.fv.com> wrote: >> But I just can't believe that he thinks that >the telephone is more secure on average than a keyboard. > >We have a few pages of C code that scan everything you type on a >keyboard, and selects only the credit card numbers. How easy is that to >do with credit card numbers spoken over a telephone? >The key is large-scale automated attacks, not one-time interceptions. Speaker-independent recognition of digits is a done deal. For large-scale automated attacks, you obviously don't wiretap the customer; you hire The Dread Pirate Mitnick* to wiretap the 800 number for the Home Shopping Channel, and hoover down the CC numbers of a large number of known frequent-shopping cardholders. (Actually, hitting on them might be a bit tough, since they've presumably got direct T1s or T3s from one or more carriers, which are harder to tap than the average residence line.) (*Not the original Kevin "Dread Pirate" Mitnick, who's retired, but Fred Bargle, who's got the current Dread Pirate Mitnick franchise.... :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # http://www.idiom.com/~wcs

1 0

Re: Netscape, CAs, and Verisign
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:50 PM 1/30/96 -0500, Phill wrote: >Question is how can Netscape (or anyone else) _securely_ allow an arbitrary CA's >certificate to be used? Certainly the process cannot be automatic. Binding the >Verisign public key into the browser may be an undesirable solution, but the >problem is to think of a better one. It's easy, and I gather Netscape has done it in 2.x - let the _user_ decide what CAs to trust. For convenient verification, you can have the user sign the keys for each of the CAs, and then the chain-following software only needs to compare each certificate's signer with the user's own pubkey, rather than comparing with Verisign's. If you want to be automatic about it, you _could_ have the user sign Verisign's key when first generating keys, or you could ask the user the first time. You've got to pull the wool over your _own_ eyes, here :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # http://www.idiom.com/~wcs

3 2

Crypto suggestion - re: Fatal Flaws in Credit Cards
by Bill Stewart 17 Dec '03

17 Dec '03

Nathaniel's written about the "fatal flaw" in any system that involves typing credit card numbers into your computer being that they're easy for a keyboard-sniffer or similar cracker to recognize. An obvious work-around for this (and for many of the problems with Social Security / Taxpayer ID numbers) is to use some sort of smartcard that generates one-shot numbers that the credit card company (or tax thugs) can map back to the "real" owner's ID. The downside of this approach is that you need a lot of bits to support it, since you have to accomodate the expected number of users * the average uses/user + overhead, and that may (for credit cards) be annoyingly long to type in (though fine for electrical-interface cards, or cards that display their numbers as barcodes for a wand reader, or whatever.) Some potential algorithms: 1) public-key - 512 bits isn't really enough (cracking it doesn't necessarily let you charge to everybody's Visa number, but it does let you figure out what everybody's is), and that's already too long. 2) data-base of randomly generated numbers - the would do ok for SSNs; give everybody a dozen or two, and let them get more if they want. That wouldn't even require a smartcard, but it would tend to require a SSN card that you don't lose, since you probably won't remember the dozen long numbers on the back. This would of course require redesigning all those databases that know an SSN is 9 digits long - I view this as a Good Thing, especially since it may get people to stop using them as database keys. Is it practical for credit cards? Ten billion customers times a million uses each is 16 digits; I suppose that's not much longer than current card numbers, though each card company would need to keep track of more numbers. You'd probably cache a hundred or a thousand in the card, and update the card every couple of years? 3) Some kind of hash or secret-key encryption of a constant (your "real" card number) and a random number? This would still be susceptible to brute-force search (10**20 not being an exceptionally large number), and you'd need an algorithm with either zero or a very low probability of collisions. A secret-key version would require a tamper-proof card to reduce probability of theft, and I'm not sure I believe in tamper-proof cards, even if you have a lot of keys and a salt that tells the credit-card company which key to use. Any other suggestions? #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # http://www.idiom.com/~wcs

3 2

Re: Declan appearing on "Europe's Most Wanted"
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 1:26 2/1/96, Timothy C. May wrote: >The Nebraska-based neo-Nazi publisher who was picked up in Denmark and >extradited to Germany pretty much knew his actions were illegal in Germany, >but I doubt (sheer speculation on my part) he had ever been formally >notified that an arrest warrant had been issued by Germany and could be >exercised in Denmark. It is even worse since they invited him into the country (and issued him a Visa with the intent of arresting him and shipping him to Germany) to attend a Nazi Convention. It was, in essence, a Government Authorized Sting Operation.

1 0

Toronto ZS radio coverage
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

The first item on the 8:00 AM radio news this morning was about the Zundelsites, cypherpunks, and German censorship. The station was CFNY 102.1, an alternative music station that is quite net.aware. We probably got the coverage here because Toronto is Zundel's home town.

1 0

Re: Germany investigates AOL for providing Zundelaccess
by Duncan Frissell 17 Dec '03

17 Dec '03

At 07:34 PM 2/2/96 -0500, Declan B. McCullagh wrote: > America Online spokesman Ingo Reese in Hamburg said his company >also was happy to work with the prosecutors. The company is ``totally >opposed'' to illegal propaganda, he said, but argued that commercial >on-line companies have as much control over materials posted on the >Internet as telephone companies have over their customers' >conversations. That's what happens when you hire Germans for your German operations. DCF

1 0

Re: [NOISE] Futplex makes the news!
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:24 PM 2/2/96 -0500, lmccarth(a)cs.umass.edu wrote: >Just to be clear, I haven't been expelled or suspended from the school, and >I have not been notified of any kind of pending disciplinary action against >me. The pages are indeed gone, however. > >Lewis "Futplex" McCarthy, checking in from Rumor Control Central > So that's why my How to Read Banned Newsgroups on Compuserve is unavailable. I'll get it back up on IOS later today. Would someone else like to mirror it for redundancy? It's only one page. Sameer -- if you're listening, maybe you and I could start an updated site "Censorship Central" that maintains updated links to banned materials so people can do "one stop shopping." DCF

1 0

What is this threat?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Anonymous questioned the meaning of the FBI-DECA national security threat: >Perception management and active measures activities. ---------- Updated "The Puzzle Palace" will have more on this. "Perception management" means any method used to conceal intelligence or counterintelligence -- HUMINT, ELINT, SIGINT, etc. -- including encryption or other operations or communication technologies not accessible to, or comprehensible by, the USG. "Active measures activities" means any operations, human, technological or administrative, that threaten the US. The threat is a catch-all for interference with, or operation against intelligence and counterintelligence, surveillance and counter-surveillance or any other means used by the USG to protect against threats. Its obscurity is used to cover in general what is not covered explicitly by the other six well-known threats -- and to avoid revealing details of what is known or may yet be discovered. It points to USG, and likely international, operations more blackly cloaked than those garishly paraded.

1 0

No Subject
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

India's Department of Telecommunications (DoT) charges a licence fee of $50,000 per _annum_ for BBS operators, and nearly twice as much for e-mail providers. It is preparing to finalise a policy for Internet service providers; as it doesn't understand the distintion between Internet _networks_ (MCI, Sprintnet etc) and "retail" providers (the geek in the garage), it is planning to charge well over $100,000 in annual licence fees. This is totally against the opinions of Telecom Secretary R K Takkar, as expressed to my newsletter, The Indian Techonomist, some months ago. I spoke to Mr Takkar for some time, providing him the "education" that he asked for in my newsletter and that large datacom companies here have been curiously averse to give him. He appreciated my point of view, and invited me to send a proposal for an alternative datacom policy, which I have done (and which is summarised below). I hope to meet him next week to follow this up. As a major part of my call for removing restraints is based on the Internet's treatment by other world governments, I would like letters of support to show this. My proposal may appear tame, but it isn't really. It will allow small ISPs to pay as little as $150 a year in licence fees; reduce the (high) likelihood of cartels between large companies; and entrench electronic free-speech at (some) parity with other media. (Note that the DoT has said that it is "not considering" blocking access to parts of the Net for reasons of morals or security. This despite the local media's loudly proclaimed discovery that the Net is 97.34% paedophile, or whatever.) Highlights 1. Definitions - The category for E-mail providers becomes redundant, leaving international gateway, national network, and "retail" service providers - Content providers have constitutional protection as electronic publishers - BBSes do not require licensing, being content providers 2. Goals - Licence fees not for revenue generation, but to ensure responsibility (unavoidable. Mr Takkar's words) - Licence fees based on telecom infrastructure costs, not revenues (at the moment, a licence is almost like income tax) - Regulation required for free and fair competition (see below) - TRAI should also handle datacom regulation, and datacom consumer complaints (the Telecom Regulatory Authority of India is likely to be very independent of the government, headed by a former Supreme Court judge) 3. Regulation - Equal access to gateway, network and service providers (to prevent denial of service and cartels, very likely here without explicit rules preventing them) - Rationalisation of DoT leased line tariff structure (now, a network costs more than the sum of its parts! too complicated to explain briefly) 4. Licensing - Uniform fee structure for gateway, network and service providers (say 2.5% of leased line costs, which are known as they are provided by the DoT) - Barriers to entry greatly reduced (minimal ISP pays $150 p.a) - However, total licence fee revenue for DoT not significantly reduced (important for success of this proposal; large nationwide network may still pay $100,000+ thanks to its huge leased line requirements) The full text of the proposal will be made publicly available on the Net sometime next week. Those who would like to see it, and a template for a letter of support, should send me mail at dcom-appeal(a)dxm.org. I would like letters from non-commercial organisations, lobby groups, policy bodies, and so on, but NOT datacom companies (I wouldn't mind _personal_ letters of support from them, but they wouldn't do for the DoT). I would particularly like to see something from Hong Kong, which I have used as a good example of how to do things in Asia. Thanks, Rishab ---------------------------------------------------------------------- The Indian Techonomist - newsletter on India's information industry http://dxm.org/techonomist/ rishab(a)dxm.org Editor and publisher: Rishab Aiyer Ghosh rishab(a)arbornet.org Vox +91 11 6853410; 3760335; H 34 C Saket, New Delhi 110017, INDIA

1 0