December 2003 - cypherpunks-legacy

Re: "German service cuts Net access" (to Santa Cruz)
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

olmur(a)dwarf.bb.bawue.de writes: > Free speech ends where other people can reasonable claim that their > feelings are badly hurt. Ask yourself what standard in implied in this sentence... Is it "Man as a life-loving rationnal animal" or "Man as an ever sobbing, unable to cope, emotionnally controlled animal" ??? JFA "I always tried to live in order to be able to *fly* another day." -Gen. Chuck Yeager

3 2

[FACTS] Germany, or "Oh no not again"
by Thomas Roessler 17 Dec '03

17 Dec '03

I had the prosecutor's spokesman on phone today. The result is that someone gave a hint to the prosecutors which explicitly mentioned Zundel, T-Online and Compuserve. Consequently, the prosecutors *had* to start investigations against Zundel, T-Online and Compuserve. In particular, they are right now *checking* whether providing internet access is a criminal offence due to the possibility to gain access to `inciting material' (the German word is `Volksverhetzung') via the Net. This means that it is not even clear whether the investigations against internet providers will be dropped or not; in fact many people believe that these investigatinos *will* be dropped. My personal guess about all this is that some net.citizens are trying to have the prosecutors engaged in absolutely absurd investigations (or, even better, achieve a court room clash on this subject) to get some clarification of the legal situation of the Net in Germany. Quite similar to the RSA T-Shirt story in the States. ,-) tlr

6 7

RE: FV's Borenstein discovers keystroke capture programs! (pictures at 11!)
by Tim Oerting 17 Dec '03

17 Dec '03

no doubt all the responses to the cypherpunk list are unnecessary as we all agree this is a load of PR nonsense. But I just can't believe that he thinks that the telephone is more secure on average than a keyboard. I can tell pretty easily if something is running on my system that I didn't intend..it is much less probably to say that I know that someone isn't listening with a scanner if I'm on a cordless or just plain tapping my line if I'm on a standard phone. Admittedly I think cell phones may take more effort on the part of the eavesdropper but are still doable. I'm certain that none of first virtual customers use a cordless phone, indeed since you feel the telephone is such a secure device you no doubt require that all of your customers use STUIII phones to communicate. ---------- From: Nathaniel Borenstein[SMTP:nsb@nsb.fv.com] Sent: Monday, January 29, 1996 12:07 PM To: cypherpunks(a)toad.com Subject: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards First Virtual's Internet Payment Systems never places the consumer's credit card number on the Internet. Instead, the consumer provides it to us by telephone when the account is opened. ---------- From: Nathaniel Borenstein[SMTP:nsb@nsb.fv.com] Sent: Monday, January 29, 1996 1:39 PM To: cypherpunks(a)toad.com; dmacfarlane(a)zip.sbi.com Subject: Re: FV's Borenstein discovers keystroke capture programs! (pictures at 11!) Well, the mis-conceptions are flying fast and furious. You're twisting our words. We believe it is a truly fatal flaw in those internet commerce schemes that are based on software encryption of credit card numbers. There are several schemes for Internet commerce that are unaffected: -- First Virtual (of course)

4 3

Crypto-smart-card startup Inside Technologies
by Peter Monta 17 Dec '03

17 Dec '03

There's an article in the January 29 _EE Times_ about a French cryptographic-smart-card startup called Inside Technologies. Tidbits: ..."In public-key cryptography, 512-bit keys are typical and already vulnerable. So we are looking at 640-bit-long keys supported by a scalable design." ..."Users want their own, custom algorithms, which can be downloaded at the time of use". ..."The CLU [cryptographic logic unit] will operate at a higher clock frequency than the RISC---60 MHz, in our design---yielding 640-bit RSA decrypt in less than 50 ms". The article goes on to say that they plan to both manufacture smart cards, presumably for ecash and communications, and license the design at the macrocell level, possibly for use in embedded systems like mass storage. By my count, six European companies mentioned, zero American. Cheers, Peter Monta pmonta(a)qualcomm.com Qualcomm, Inc./Globalstar

2 1

Re: Apology and clarification
by Eli Brandt 17 Dec '03

17 Dec '03

In a nutshell: FUD Virtual's press release glosses over the hard part of the attack -- distribution and collection. Yes, the credit-card system is broken as designed, but that's already reflected in its cost structure. The proposed attack will never make up a significant fraction of credit-card fraud. You know, FV should put out a press release warning that all encryption-based payment systems are insecure, due to the threat of the proposed "Chinese-lottery virus". Bet you could get the Times to print it... In article <+cmu.andrew.internet.cyclists+0l3TCU200UfA00z5cl(a)andrew.cmu.edu>, Nathaniel Borenstein <nsb(a)nsb.fv.com> wrote: >When you put all four of these together, you have an attack that IS new, >in the sense that nobody we know of has ever mentioned it before, Who would bother? Ask yourself if you'd have been quite so excited about this "new attack" if you were just Nat Borenstein, private citizen, with no financial interest in a competing technology. >and which could in fact be used by a single criminal, with only a few >weeks of programming, to tracelessly steal MILLIONS of credit cards, >if software-encrypted credit-card schemes ever caught on. You wave your hands and say that "consumer machines are insecure", but I don't think you have any conception of what it would take to get your trojan onto "MILLIONS" of machines. There is no historical precedent for such an attack (no, Ping-Pong and Stoned don't make the cut). Your suggestions of such things as rogue GIF viewers aren't even in the ballpark. What fraction of the victims will expose their credit card numbers? what fraction will notice your trojan and warn against it? The ratio has to be very, very large. >and get them back to the program's author by non-traceable >mechanisms. I didn't see the part where you explain how this works, either. >If not, I think it's worth noting that this fact was previously >completely unknown to the bankers and businessmen who are putting >large sums of money at risk on the net. The only way to get the >message to those communities is with a very visible public >announcement of the kind you saw yesterday. You wouldn't have shot your reputation so badly if you weren't so damned disingenuous about the whole thing. Paragraphs like the above really irritate me. -- Eli Brandt eli+(a)cs.cmu.edu

1 0

short FV question
by Simon Spero 17 Dec '03

17 Dec '03

When my CTS plays up like it has this past week, I use a Dragon dictate Voice Recognition system. Since I' Not actually touching a keyboard, does this make me secure? Simon ---- RSA - The Canadian For Butt

2 1

RC2 code on sci.crypt
by Bruce Schneier 17 Dec '03

17 Dec '03

For those not paying attention, there is RC2 code on sci.crypt. RSADSI is acting as if it is real, and will publish some legal posturing about it real soon now. Bruce ************************************************************************** * Bruce Schneier APPLIED CRYPTOGRAPHY, 2nd EDITION is * Counterpane Systems available. For info on a 15% * schneier(a)counterpane.com discount offer, send me e-mail. **************************************************************************

3 2

Visa & MC Std
by ponder＠mail.irm.state.fl.us 17 Dec '03

17 Dec '03

just heard this on NPR Friday am on the east coast of NA. http://www.nytimes.com/library/cyber/week/0201internet-safety.html February 1, 1996 Group to Unveil Industry Standard for Electronic Payments ---------------------------------------------------------------------- Forum Join a discussion on Computers and Society: On-Line Economics. ---------------------------------------------------------------------- By JOHN MARKOFF AN FRANCISCO -- Hoping to remove a major impediment to credit card transactions over the Internet, a business group led by Mastercard International and Visa International plans to announce an industry-standard technology Thursday for protecting the security of electronic payments. The new technical standard brings together previously warring camps -- one led by the giant Microsoft Corp., the other by an Internet software upstart, Netscape Communications Corp. The standard, which industry executives expect to go into commercial use before the end of the year, is intended to give merchants of goods and services in cyberspace the convenience of a single, universally employed means for protecting the privacy of on-line credit card transactions. And for customers, the new technology promises a much higher level of security for electronic purchases than has previously been available on the Internet. The new approach "is more secure than the system in use in the physical world in which you give your card to a waiter in the restaurant," said Mark Greene, vice president for electronic payments for the Internet division of IBM, which is one of the companies endorsing the new standard. To the extent that the end of this technology face-off gives a lift to electronic commerce, Netscape can only benefit, since it is the provider of the leading software used for "browsing" the Internet's World Wide Web and for conducting on-line transactions on the Web. Netscape is already on a financial roll, announcing fourth-quarter revenue Wednesday that was nearly double the level of the previous quarter and profits that exceeded analysts' expectations. "This will make it a lot easier for consumers to buy and sell things electronically," said Taher Elgamal, chief scientist of Netscape. "We won't have to face the issue of competing standards." Netscape will be working to incorporate the new technology into its Navigator Web-browsing software. Microsoft, in turn, will be adding the technology to its Explorer software, which competes with Netscape's Web browser. The software standard, called Secure Electronic Transactions, or SET, will permit a user to send a credit card account numbers to a merchant in a scrambled form. The scrambled number is supposed to be unintelligible to electronic eavesdroppers and thieves -- and even to the merchants receiving the payment. But a special code is supposed to enable the merchant to check electronically and automatically with the bank that issued the credit card to make sure that it is a valid card number and that the customer is the authorized user of the card. The number-scrambling part of the system is based on a well-known and widely used national software standard known as the Data Encryption Standard. Besides being added to Netscape's and Microsoft's Web browser, the SET technology would need to be incorporated into Internet server computers -- the machines that function as storage terminals and gateways that individual users' computers interact with on the global computing network. Testing of SET will begin this spring, according to Dick Lonergan, executive vice president of Visa, who said that commercial service was expected to begin late this year. Currently, many powerful types of encryption technology are barred from export because the government fears that foreign enemies or terrorists may be able to conspire electronically. But the new credit card security standard will not be subject to such strictures, its developers said, because it is designed to protect only financial information -- not electronic messages or other types of computer documents. In addition to Mastercard, Visa, IBM, Microsoft and Netscape, the other big organizations endorsing the new SET standard include GTE Corp. and Science Applications International Corp., a technology and military consulting business. Two other backers include Terisa Systems Inc. and Verisign Inc., both Silicon Valley companies that have developed some of the underlying technology for the SET standard. Last September, Microsoft and Visa together proposed a security standard known as Secure Transaction Technology, which would have competed directly with a system being developed by a group led by Mastercard, IBM and Netscape. Shortly afterwards, however, Visa and Mastercard -- the two largest credit card associations -- said publicly that they would pursue a single standard to avoid forcing merchants and consumers to choose between competing technologies. "We took the best of both technologies," said Edward Hogan, senior vice president for electronic commerce at Mastercard International. "There was a blip in the road, but both associations realized that their memberships wanted a single standard." Home | Sections | Contents | Search | Forums | Help Copyright 1996 The New York Times Company ----------------------------------------------------------------------

1 0

RE: FV Demonstrates Fatal Flaw in Software Encryption of Credi tCards
by David Van Wie 17 Dec '03

17 Dec '03

On January 30, 1996 nsb[SMTP:nsb@nsb.fv.com] wrote: >> Of course, since Federal law requires the credit card companies, not the >> user, to pay the costs of fraud, First Virtual's entire premise is a red >> herring. > >Actually, you're wrong here too. It is the banks, not the credit card >companies, that carry the risk. Changing the subject doesn't change the point. Your announcement implies that users are liable, and that is incorrect. This is misleading, and in my view, reprehensible. This was the point of my post. The fact that the fraud is traceable when detected should have been self evident. If your post has said "Financial Industry Should Watch out for Keyboard Sniffers" as a *potential* threat for which the risks should be weighed, that would have been different. Arguably farfetched, but different. Your post relies on people's ignorance of their rights with respect to credit card liability, and therefore is shameful. dvw

2 1

cypher-list noise levels
by Jonathon Fletcher 17 Dec '03

17 Dec '03

Hi, Can someone on the PGPdomo cypher-list tell me how good the signal to noise ratio currently is, and how good the content is. I've not signed up, but I'm tempted to try and get away from the noise on here recently. -Jon -- Jonathon Fletcher <jonathon(a)pobox.com>

2 1