December 2003 - cypherpunks-legacy

Re: Opinion piece in NYT; responses needed
by Deranged Mutant 17 Dec '03

17 Dec '03

> Mutatis> It's a decentered network (or set of networks) designed > Mutatis> to get information to its addressee. Data flows through [..] > This is unfortunately a wide-spread myth. While it's true for mail and > news, it's not for IP packets. Witness: Duh. You're right. My glitch. --- "Mutant" Rob <wlkngowl(a)unix.asb.com> Send a blank message with the subject "send pgp-key" (not in quotes) for a copy of my PGP key.

1 0

Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Mon, 29 Jan 1996 15:07:46 -0500 (EST), Nathaniel Borenstein wrote: >[My apologies in advance if you see several copies of this message. I >am posting this fairly widely due to the severity and importance of the >problem described.] >As you may already have heard via the popular press, First Virtual >Holdings has developed and demonstrated a program which completely >undermines the security of every known credit-card encryption mechanism >for Internet commerce. This is a very serious matter, and we want to >make sure that the Internet community is properly informed about the [..] All that over keyboard grabbers??? *yawn* This is nothing new at all.

1 0

FV Security Holes (?)
by Inverardi＠abacus.ch 17 Dec '03

17 Dec '03

Received: from relay3.UU.NET by abainet.abacus.ch (PostalUnion/SMTP(tm) v2.1.8d for Windows NT(tm)) id AA-1996Jan30.114852.1590.835; Tue, 30 Jan 1996 11:48:55 GMT Received: from toad.com by relay3.UU.NET with SMTP id QQaasw09854; Tue, 30 Jan 1996 05:40:13 -0500 (EST) Received: by toad.com id AA18530; Tue, 30 Jan 96 02:27:35 PST Received: from fuqua.fiftysix.org by toad.com id AA18520; Tue, 30 Jan 96 02:27:18 PST Received: (from mixmaster@localhost) by fuqua.fiftysix.org (8.6.12/8.6.9) id EAA17459; Tue, 30 Jan 1996 04:25:02 -0600 Date: Tue, 30 Jan 1996 04:25:02 -0600 > I believe that FV works by assigning the user some sort of id number. > > They send the id accross the net, FV has a database with "FV-ID" <-> > credit-card-number correspondences, the merchant sends FV the id, FV > bills your card and pays the merchant. Ok now, so you can get one's FV-Number by simple eavesdropping? That sounds just too easy to me. Does anybody have more detailed information about FV and how it works? bye. iNVi.TF! ---------------------------------------------------------------------- Remo Inverardi - Voice +41 61 811 14 82 - Fax and BBS +41 61 811 14 42 ABACUS Software Research AG - Rorschacherstr. 170 - CH-9006 St. Gallen ----------------------------------------------------------------------

1 0

PPP link encryption?
by Alexandra Griffin 17 Dec '03

17 Dec '03

Is there any software out there on the net for doing real-time, transparent encryption of a PPP link? Also, if this link is running at 600kbit/s to 1Mbit/s, how much processing power would be required to keep up (assuming we're using, say, the IDEA cipher)? Would a dedicated 386DX/33-based router on each end be sufficient? Finally, could someone make a ballpark estimate as to the amount of additional latency that would be added? thanks, - alex

2 1

RE: FV Demonstrates Fatal Flaw (Noise + Humour)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

(Second year PR student press release crap deleted) On 1/29/96 Nathaniel Borenstein preached the evils of Internet Commerce....... NB> If your idea of "today's computer users" comes from cypherpunks, you're NB> living in a dream world. FV's experience with average Internet users NB> includes some of us who ask us not to use complicated "technical terms" like NB> "cut and paste". Ther certainly can't be counted on to know which NB> software to download and which to avoid. I'd bet that one half learned to download and use Vueprint 4.3 and the other half are finishing up learning Mavis Beacon's Typing Tutor. Later on in the day, Nate yacked that...... NB> This is fine for you and me. But Internet commerce has to work for the NB> hundreds of millions of non-technical consumers who are swarming onto NB> the Internet. If someone emails them a program that purports to show NB> them pretty pictures (dirty movies?)..... Glad you are trying to market some of your other overpriced services, Point your (Not THAT!!!) browser to: http://www.infohaus.com/access/by-keyword and pan down to the bottom of the page, Seems that every third service for sale by First Virtual is about sex. For instance...... adult advertising, amateur art, bisexual, cyberpunk (full of dating services?!?) gay, images, jpegjpg, lesbian literature, male marketing, nude, nudity, pornography, sex, singles, and on and on! Send out a press release after Chaum has bought you guys out! The Christmas Troll --

1 0

Re: "German service cuts Net access" (to Santa Cruz)
by Duncan Frissell 17 Dec '03

17 Dec '03

At 12:07 AM 1/28/96 -0800, Timothy C. May wrote: >* the Germans recently arrested an American who landed in Germany >somewhere, as part of a trip. It seems he had been involved with the >production of Neo-Nazi material, somewhere out west. This was the last I >heard about the story. Sorry, I'm going from carbon-based memory. > He was grabbed in Denmark and extradited to Germany so you'd have to avoid most of the EU. DCF

9 14

CONTEST: Name That Program!
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

As you may have read in my previous message, First Virtual has developed and demonstrated a program that completely undermines all known schemes for using software-encrypted credit cards on the Internet. More details are avialable at http://www.fv.com/ccdanger. That was the easy part. The hard part, it turns out, is deciding what to call this program. We've kicked around a variety of names: -- Card Shark (because we call the general kind of program a "shark") -- Four Solutions (because we believe that FV is one of four known approaches to Internet commerce which avoid this attack) -- Predator (because a program like this is scary to think about!) -- Pickpocket (because that's vaguely analogous to what it does) -- Snoopy (because we thought it was cute) -- CyberCrash (no special reason, it just had a nice ring to it) In the end, we just couldn't decide. But we knew it needed a name, so we've decided to leave it up to the citizens of the Internet. For that reason, we're sponsoring a contest. We invite you to send your vote "nameit(a)fv.com". First Virtual will have sole discretion in selecting a winning name. If we select a name that is submitted by someone on the net, the FIRST person to submit it will be the winner. If we select one of the names given above, we will select at random from all the people who "vote" for that name. The winner will receive $1000 (US). Yes, we're really paying $1000 for the winning name! (If you have or want a First Virtual seller's account, we'll pay you through First Virtual, otherwise we'll mail you a check.) Twenty-five runners-up will be selected to receive First Virtual sweatshirts and other memorabilia. CONTEST RULES: All entries must be received by email to nameit(a)fv.com, on or before February 14, 1996. Please include all of the following: -- Your suggested name for our program. -- Your own name and postal mailing address -- Your shirt size (in case you're a runner-up) CONTEST DEADLINE: February 14, 1996 -------- Nathaniel Borenstein <nsb(a)fv.com> Chief Scientist, First Virtual Holdings FAQ & PGP key: nsb+faq(a)nsb.fv.com

4 4

Delusional
by Rich Salz 17 Dec '03

17 Dec '03

You're disagreeing that I invented safe-tcl? You disagree that I sent you and Ousterhout the very first message that said I want to strip out the dangerous commands? That I created the mailing list and then gave it up becuase you and Rose "took over" the concept while only releasing a safe-Tk, leaving off the embeddeable server part? Must we go to the archives? You're disagreeing that without enabled mail FV would probably not have happened? IF so, then one of us is delusional and it's not me, kiddo. Replies to this message will be ignored. /r$ PS: Sorry C-P folks. In penance for this off-topic probably-uneeded defense against Nathaniel's attack, I will compare the Usenet RC2 against the licensed code and tell you what I find. -r$

2 1

NRO Slush Fund
by John Young 17 Dec '03

17 Dec '03

URL: http://www.nytimes.com/yr/mo/day/front/spy-agency-money.html January 30, 1996 Spy Agency Said to Have Spare Billions The National Reconnaissance Office, the secret agency that builds spy satellites, lost track of more than $2 billion in classified money last year, largely because of its own internal secrecy, intelligence officials say. In the past, congressional oversight of the reconnaissance office has been sketchy, because few members of Congress understood the highly technical language of spy satellites and some did not know what they were approving when they authorized billions of dollars a year in secret spending.

2 1

Signed posts (was Re: FV ... Fatal Flaw ...)
by olbon＠dynetics.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Amidst all of the <exon> about the "fatal flaw", Mr. Scarenstein brings up (amazingly) an interesting point regarding signed posts that I have wondered about for a while. At 5:30 PM 1/29/96, Nathaniel Borenstein wrote (highly edited!): >Do you have my key in your key ring? I rather doubt it. So what good >would it have done? > >Have you downloaded my key from the net? Assume that you have. How do >you know it's mine? The issue of knowing that a signed post belongs to a particular individual has come up often. Clearly the best approach is verifying the key in person Failing that, however, I have adopted a strategy of maximizing the probablility that the key actually belongs to me. I do this by: 1. Including the fingerprint and where to get the key in my signed post (within the pgp sig) 2. Putting the key in a fairly secure place (i.e. on a machine controlled by my employer, but where I can check the key periodically 3. Putting the same key on the keyservers I could (and should) also place it on my web page as well. This is not to say that someone could not impersonate me by creating a key and placing it in all of these places, but I think it would be difficult, and probably not worth the effort. I am not real worried about this threat (but heck, if someone really wants to impersonate me, I'd be flattered). I think these measures are probably sufficient for a mailing list level of discussion. Any comments? (flames >/dev/null) Clay - -------------------------------------------------------------------------- Clay Olbon II | olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: finger olbon(a)mgr.dynetics.com Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 "To escape the evil curse, you must quote a bible verse; thou shalt not ... Doooh" - Homer (Simpson, not the other one) - -------------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQ4mjwS4mEMx6xUNAQFkjgP/QYovJZzguQy4yQqWYZQPCpZn1oU8VaCr 14JW7XIk29F4xDHEPT8YlCvt7lJ6aYvWNbFVpmTWzj8IiAgWwDeQZVbQyA+YRuMs w5kOF2brGAElln+j5hxtoIzvfy2lp+Jr8c6Q3yklCX6Yizt6G+Ma08HC1HkUZ2Jd d0GSBZwk4nw= =PF/1 -----END PGP SIGNATURE-----

1 0