December 2003 - cypherpunks-legacy

RE: FV Demonstrates Fatal Flaw in Software Encryption of Credi tCards
by David Van Wie 17 Dec '03

17 Dec '03

On January 30, 1996 nsb[SMTP:nsb@nsb.fv.com] wrote: >> Of course, since Federal law requires the credit card companies, not the >> user, to pay the costs of fraud, First Virtual's entire premise is a red >> herring. > >Actually, you're wrong here too. It is the banks, not the credit card >companies, that carry the risk. Changing the subject doesn't change the point. Your announcement implies that users are liable, and that is incorrect. This is misleading, and in my view, reprehensible. This was the point of my post. The fact that the fraud is traceable when detected should have been self evident. If your post has said "Financial Industry Should Watch out for Keyboard Sniffers" as a *potential* threat for which the risks should be weighed, that would have been different. Arguably farfetched, but different. Your post relies on people's ignorance of their rights with respect to credit card liability, and therefore is shameful. dvw

2 1

Re: Time codes for PCs (fromn German Banking)
by jim bell 17 Dec '03

17 Dec '03

At 11:42 PM 1/29/96 +0100, JR(a)ROCK.CNB.UAM.ES wrote: >From: SMTP%"jimbell(a)pacifier.com" 27-JAN-1996 03:43:05.83 > >>A peripheral I've long wanted to see, commonly available: ACCURATE time, >>broadcast to the millisecond/microsecond/nanosecond, available from sources >>as varied as TV VIR's, FM subcarriers, and other sources, available as an >>easy input (via a peripheral card) to a computer. >> > Yup! Do you think it is really possible? If I remember well >speed of light is 300.000 Km/s. That means that light takes around >1 ms. to cover 300 Km. If you use a satellite, antenna, whatever >to broadcast a timing signal, the accuracy will depend on when >do you receive it, and that in turn on your distance from the >source. <sigh!> I am well aware of the facts you indicate, and many more of which you aren't even aware. But one of the functions (in fact, the basic, intended one) of GPS is to locate, as precisely as possible, the exact location of the receiver. Thus, time delays can be compensated to the accuracy of the location fix, at the very least. If we assume 100 meters error, max, that's about 300 nsec error. (GPS receivers AUTOMATICALLY compensate for such delays!) >>I have a 12-year-old Heathkit "Most Accurate Clock" that I assembled myself, >>and had the foresight to install it with its computer interface option. >>(receives 5, 10, or 15 MHz signals broadcast from Boulder, Colorado, >>containing "exact" time.) >> > Just remember that the best you can get would be microseconds if >you're in a 300 meter radius, or milliseconds on a 300 Km. And possibly >nanoseconds at 0.3 m. Well, this clock doesn't pretend to be better than about 5-10 milliseconds even in signal-locked condition. However, there is a dipswitch on the bottom of the unit, settable in 500 mile increments, from Boulder, Colorado. 500 miles corresponds to 3 milliseconds. Clearly this was a good device when made, but has obviously been supplanted by at least a factor of 1000 by GPS. > Then remains the cypherpunk part on all this: how can you >trust the *signal* your receptor receives? How do you know no one is >interferring it or sending an inaccurate or false one? Simple answer: You don't. More complicated answer: Most such devices don't merely input the time signal, but they use an accurate internal clock to maintain good time when signals go away. In fact, the best units "discipline" the local oscillator, either actually changing its frequency or at least following its errors over time. The result is that sudden errors would be noticed. A good TCXO is stable to well better than 1 ppm. > And that on a broadcast system. A system owned by someone who >you may not trust (say a private TV channel, radio or satellite). So >you may want to have several sources, and to be able to verify that >the signals you receive all come from their respective sources. Well, since "everybody" in one locale can receive a particular (local) TV channel, one solution might be to compare time with respect to the beginning of a particular scan line.. You may not trust the signal, but you know its a signal that "everybody" receives. There may be no other provision for adding time to it, but a relatively low accuracy crystal oscillator could identify particular frames, etc. > Yum! a nice problem to think about. One factor is that you >wouldn't expect changes in public sources used by sensible systems >since those could not pass unnoticed and might raise big protests. >But you still have the MITM attack to consider...

1 0

Tim's paranoid rant about Declan appearing on "Europe's Most Wanted"
by Just Rich 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- OK, I didn't want to sow dissension in the ranks, but this is just too much, and Declan has not given a satisfactory response to direct email. On Thu, 1 Feb 1996, Timothy C. May wrote: > At 7:27 AM 2/1/96, sameer wrote: > >> I guess Declan M. won't be visting France or any of the other EU > >> countries any time soon! > > > > That reminds me of a question-- > > > > If, for example, Germany decides that my company is in > >violation of their laws for mirroring the Zundelsite, will they send > >us a letter saying that, so we know not to go to Germany? > > The Nebraska-based neo-Nazi publisher who was picked up in Denmark and > extradited to Germany pretty much knew his actions were illegal in Germany, > but I doubt (sheer speculation on my part) he had ever been formally > notified that an arrest warrant had been issued by Germany and could be > exercised in Denmark. > > The situation with Declan, Sameer, Duncan, and others, is even less clear. I disagree. It is clear to me that there is absolutely no cloud hanging over us. If any German court tried to press charges against me for posting Zendel's materials, they'd be laughed across the Argonne. Most mainstream Jewish groups *love* me right now. I find it curious, and I am beginning to get a little annoyed, that my name is rarely mentioned, though I set up the first mirror, and Declan got the files from me. I am very annoyed that Declan has not responded to repeated requests to remove the cleartext "Stanford University" from the parts of his Web site that mention me. Of course the stanford.edu, or at least net 36.190, will remain in the URL, but there is no reason that the link text could not say "Rich Graves' mirror." First Declan sent me mail saying he would respect my wishes, but he didn't. Then a friend of mine reminded Declan of my request, and Declan responded with abuse. I do not object to the cleartext "Stanford University" because anyone is pressuring me to remove the page. Far from it; almost every personal response has been positive, and the student newspaper, at www-daily.stanford.edu, is going to run a positive story tomorrow or the next day. Rather, I object simply because I do not represent Stanford University, and it is an intellectually dishonest abuse of power to suggest in any way that I do. Declan wants me to believe that this disclaimer is enough: "Please note that the existence of a web site at any particular institution does not in any way imply endorsement. Universities and businesses do not take responsibility for what their community members or customers place online." This is clearly untrue when the person in question is a staff member, as I am. Were I still a student, then I could more legitimately say that I'm a student at Stanford, and that I have the academic freedom to post whatever I want; but as someone who now merely works for a living at Stanford, I do whatever I want by the (very) good graces of my (very good) employer. Should we have forced Marianne to state her affiliation for the TV cameras last Saturday? > Things are moving much faster now that the Net is the means of > distribution. Yes, far too fast. Otherwise good people aren't thinking about what they're doing in their glee to "fight censorship." > I was of course half-joking about Declan visiting Europe, but > surely France could decide to throw the book at him, and any EU country he > entered (such as Ireland, judging from his name) could hold him at their > entry point and ship him off to France to "set an example." Bullshit. > I suspect the U.S. never officially notified that Monterrey, Mexico alleged > drug dealer that he was wanted in the U.S., and as other kidnappings of > foreigners have shown, the U.S. feels it unnecessary to formally announce > to foreigners that they may be arrested in the U.S. (or kidnapped into the > U.S.). Thus, I strongly suspect that France will not bother to notify > Declan or Sameer or any of us that they face arrest in France (or > affiliated EU countries). > > In Declan's case, I suspect France wants him for the Mitterand book and France doesn't want anyone for the Mitterand book, which was not, in fact, criminally banned. It was censured, not censored, in a civil trial. Declan is distorting the facts to suit his ego as Mr. Anti-Censorship. I find this breast-beating hype embarrassing and dishonest, and I am seriously beginning to regret giving the Zundel files to Declan. Had I known what he was going to do with them, and how he was going to behave, I would have retained closer control. One mirror site was enough. The German providers would not have blocked stanford.edu had it remained the only mirror site. The President of Stanford, Gerhard Casper, is a recognized constitutional scholar from Germany. The Stanford Provost, Condoleezza Rice, was one of the two or three people most responsible for the Bush Administration's policy towards German Unification. Dozens of Stanford students have studied in Berlin. Had they blocked stanford.edu, or had they gotten through to Stanford and somehow gotten Stanford to force me to take down the pages, then we would have set up more mirrors. I would have started, and maybe stopped, by setting up mirrors on c2.org and netcom.com. Graduated response. Germany has in fact blocked no sites beyond webcom.com. I have the patience to wait a week for the German political authorities to wake up and smell the bratwurst. Declan is himself becoming a sort of revisionist, loose with the facts. > Germany wants him for the Zundelsite mirrors. The lesser European countries > will of course follow their leads. This is ludicrous. I expect better from you. > Seriously, Declan, I admire what you've done, but I hope you don't plan to > leave the U.S. for Europe anytime soon. This is paranoid bullshit. Most of the Jewish organizations I have talked to grudgingly applaud the Zundelsite mirrors. Some actively applaud them. The Wiesenthal Center, of course, is "different." They haven't answered email, and I haven't had time to call them. Censorship is dying, destroyed by truth. Please don't spoil the party with this paranoid bullshit. Ernst Zundel is a lying Nazi asshole who wants you to believe that there is a Global Jewish Conspiracy to censor him. Fuck him. Declan, if you don't fix up your page the way I want it by morning (please not that you have three more hours of morning than I do), I will post a modified (spell-checked) version of this note on my Web page, to alt.censorship, and to your "fight-censorship" mailing list. - -rich -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRCMdY3DXUbM57SdAQGBVgP8DOOtrKoV5bBDEICmRSlokkn91KnKdXXS 231Qv5mEWrrin9Jf8Zj80Zl/gTX/8J08s40v0vQUHi9G8It1hpzAFKz5k8lFZdTW dbcSyRMDwXz8pHvNxiGyQShZOIs1m/rnO7Z0iiuA0Y9r1+nBqeu1rQSeIyriBFUw UfWqjk8iWdk= =cODd -----END PGP SIGNATURE-----

7 11

Re: Visa & MC Std
by olbon＠dynetics.com 17 Dec '03

17 Dec '03

At 8:25 AM 2/1/96, pj ponder wrote (much elided): >AN FRANCISCO -- Hoping to remove a major impediment to credit card >transactions over the Internet, a business group led by Mastercard >International >and Visa International plans to announce an industry-standard technology >Thursday for protecting the security of electronic payments. ... > >The software standard, called Secure Electronic Transactions, or SET, >will permit a user to send a credit card account numbers to a merchant >in a scrambled >form. > >The scrambled number is supposed to be unintelligible to electronic >eavesdroppers and thieves -- and even to the merchants receiving the >payment. > >But a special code is supposed to enable the merchant to check >electronically and automatically with the bank that issued the credit >card to make sure that it is a >valid card number and that the customer is the authorized user of the >card. The number-scrambling part of the system is based on a well-known >and widely used >national software standard known as the Data Encryption Standard. ---------------- A few psueudorandom points regarding this post: First, it seems silly to implement a separate standard that only works for the credit card number. What about the privacy of the rest of the info (what I am ordering, how much, etc.). Can (or will) this be layered with Netscape's SSL? How is this to be implemented? It sounds like the merchants will just pass the encrypted number to the credit card company. If this is the case, key management could become an issue. I suppose this could easily be implemented using public key crypto, but only DES was mentioned. If only DES is used and everyone uses the same DES key, that would be a valuable key to break! How about a MITM attack. Get the encrypted credit card #, and change the purchase amount, delivery info, etc if that is not encrypted. If there is anyone on the list with more info on this, I would love to hear it (heopfully we will hear something from Netscape, since they are quoted in the article). From what I know so far, it seems like a poor compromise. --------------------------------------------------------------------------- Clay Olbon II | olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: finger olbon(a)mgr.dynetics.com Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 "To escape the evil curse, you must quote a bible verse; thou shalt not ... Doooh" - Homer (Simpson, not the other one) ---------------------------------------------------------------------------

2 1

Let a Thousand Zundsites Bloom
by Duncan Frissell 17 Dec '03

17 Dec '03

I'm sure that Rich vs Declan is exciting but I have to agree with Declan that the more Zundsites the merrier. It rarely pays to be subtle with nation states. They don't have good information processing capabilities. It helps to really hit them over the head with things. It also means more to the public if you can say "Sure the Germans banned this site but we put up a dozen copies within a few hours." It is this casual ability to defeat nation states that is the significance of the net and should be emphasized. DCF "Few Generals have ever lost a battle because they brought too many troops."

1 0

Re: Tim's paranoid rant about Declan appearing on "Europe's Most
by Declan B. McCullagh 17 Dec '03

17 Dec '03

Forwarded from another mailing list. (Charles is a journalist/author...) ---------- Forwarded message begins here ---------- Date: Thu, 1 Feb 1996 09:11:19 -0500 (EST) From: Charles Platt <cp(a)panix.com> Subject: Out of Control Rich Graves' suggestion that Declan is "out of control" is interesting. Perhaps Rich merely meant that Declan made a mistake but the subtext suggests that Declan should be in some sense marching in step, following a consensus, obeying a policy. I don't like the smell of this. In my experience, having read MUCH literature from revisionists and from organizations such as Wiesenthal and ADL, it is IMPOSSIBLE for anyone to adopt an independent or middle path without raising the wrath of those on both sides of Jewish issues. I also suggest that public statements, especially from ADL/Wiesenthal, cannot be taken at face value. For instance: > * The ADL is tracking racist sites, but the goal is to expose them and > educate the public. Anyone who believes that this is the totality of ADL activities and intentions is simply unaware of the history of the ADL. I have personally witnessed an ADL representative trying to recruit hackers to paralyze a BBS where white-supremacist materials were stored. And this I think is just the tip of the iceberg.

1 0

Re:
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQ+jNCoZzwIn1bdtAQEgAwF+LRiwIlumqj6P2/pft8804Cbbttz3R7yL Pwd44+uUTk1SxJZePCt7O1jReYfDohTB =Ii6p -----END PGP SIGNATURE-----

1 0

Re: Apology and clarification
by Simon McAuliffe 17 Dec '03

17 Dec '03

For those that are sick of this thread (as I am), I apologize in advance for throwing another log on the fire. I just can't help trying to get through... Nathaniel Borenstein <nsb(a)nsb.fv.com> writes: > First of all, I believe that I owe the cypherpunk community an > apology for an error in judgement on my part. The message that I [...] > Our approach combines the following four known problems into a > fatal attack: > > 1) Consumer machines are insecure and easily compromised. > 2) Keyboard sniffers are easy to write. > 3) Credit card numbers are self-identifying (they have check digits) > and can easily be extracted from a huge stream of input data. > 4) Once intercepted, small amounts of information (e.g. a cc #) > may be distributed completely tracelessly over the Internet. > > When you put all four of these together, you have an attack that > IS new, in the sense that nobody we know of has ever mentioned it > before, and which could in fact be used by a single criminal, with > only a few weeks of programming, to tracelessly steal MILLIONS of > credit cards, if software-encrypted credit-card schemes ever caught > on. You're right, the four problems you mention are known and have been for a long time, and have also been used in attacks. What you don't seem to understand is that the overall attack from the combination of these isn't new either. In many ways a credit card number, name and expiry date form a password. It's a password that the bank accepts to allow money transfers in much the same way as a computer accepts a password to allow information transfers. On this very list (amongst other places), there has been discussion of trojans and viruses for grabbing passwords, and of methods of determining what is a password and what isn't a password. In the same way you can decide if a number is a credit card number, there are heuristics you can use to determine if a user is entering a password, though often it may require more than just monitoring keystrokes. To collect expiry dates and names for credit cards, monitoring additional side information may also be useful. So I see no fundamental difference between the two, credit card numbers _are_ passwords. I myself have used precisely this technique many years ago, as I'm sure many others here have, to demonstrate security problems. The only difference is the heuristic for determining what constitutes a password in the domain you're snooping. What's more, the methods in existence before your post can be and have been built in viruses which are considerably more prolific than a trojan. Not only is your attack not new, it is less powerful that some similar attacks that predated yours. Implying credit card numbers are more valuable than passwords is dubious. There are organisations that could lose millions of dollars if their password security was compromised, but it's hard to say the same for credit cards. In this country, although I don't know about yours, I'm not even liable if somebody steals my credit card and uses it. I would consider a "credit card password" as a lesser commodity than a password for giving access to an entire computer system. [...] > So here's the factual claim, to be proven or disproven: One good > programmer, in less than a month, can write a program that will > spread itself around the net, collect an unlimited number of credit > card numbers, and get them back to the program's author by > non-traceable mechanisms. Does anyone on this list doubt that > this is true? If so, I'd like to know the flaw in my thinking, -- > I am *not* too proud to withdraw any claims that aren't true. If > not, I think it's worth noting that this fact was previously > completely unknown to the bankers and businessmen who are putting > large sums of money at risk on the net. The only way to get the > message to those communities is with a very visible public > announcement of the kind you saw yesterday. Of course this is a threat, I don't think _anybody_ will deny that, but this is not a new threat. True, the attack may not have been known to businesspeople and bankers, but there are many others areas of security they also know nothing about. Trying to claim an old invention as your own just looks like hype, PR and lies, not to mention showing a lack of knowledge which could do the reverse from what you set out to achieve. It is certainly a Good Thing for the public to know about the potential for various types of snooping, but surely it could be done in some way which doesn't make it look like you invented it. I don't think anybody here objects to the attack itself, but rather the claims you made about it and the way you communicated it. --- E-mail: sai@comp.vuw.ac.nz/sai@kauri.vuw.ac.nz +64 4 233 9427 PGP Fingerprint: 65 5B B4 6C CB 6A 65 F1 01 91 B9 FE 34 23 99 D3 PGP Key by mail, finger or from http://www.vuw.ac.nz/~sai/pgp-key.html

1 0

None Unix swapfile security issues...
by Anonymous 17 Dec '03

17 Dec '03

I'm working on a unix application where I want to store a key in memory and don't want it to get written out to a swap file. If the key is in any of the application's memory pages, it could be swapped out at any time, and potentially left in the swap file when the computer is turned off. But, what if the program creates a pipe() and writes the key into it, then reads the key out when necessary? A pipe has a 4K buffer, but that buffer is in the kernel's memory, not in the application's pages. Could a kernel buffer get written out to a swapfile?

2 1

Declan appearing on "Europe's Most Wanted"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:27 AM 2/1/96, sameer wrote: >> I guess Declan M. won't be visting France or any of the other EU countries >> any time soon! > > That reminds me of a question-- > > If, for example, Germany decides that my company is in >violation of their laws for mirroring the Zundelsite, will they send >us a letter saying that, so we know not to go to Germany? The Nebraska-based neo-Nazi publisher who was picked up in Denmark and extradited to Germany pretty much knew his actions were illegal in Germany, but I doubt (sheer speculation on my part) he had ever been formally notified that an arrest warrant had been issued by Germany and could be exercised in Denmark. The situation with Declan, Sameer, Duncan, and others, is even less clear. Things are moving much faster now that the Net is the means of distribution. I was of course half-joking about Declan visiting Europe, but surely France could decide to throw the book at him, and any EU country he entered (such as Ireland, judging from his name) could hold him at their entry point and ship him off to France to "set an example." I suspect the U.S. never officially notified that Monterrey, Mexico alleged drug dealer that he was wanted in the U.S., and as other kidnappings of foreigners have shown, the U.S. feels it unnecessary to formally announce to foreigners that they may be arrested in the U.S. (or kidnapped into the U.S.). Thus, I strongly suspect that France will not bother to notify Declan or Sameer or any of us that they face arrest in France (or affiliated EU countries). In Declan's case, I suspect France wants him for the Mitterand book and Germany wants him for the Zundelsite mirrors. The lesser European countries will of course follow their leads. Seriously, Declan, I admire what you've done, but I hope you don't plan to leave the U.S. for Europe anytime soon. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2