December 2003 - cypherpunks-legacy

Re: SecurID
by vin＠shore.net 17 Dec '03

17 Dec '03

Paul J. Bell <pjb(a)ny.ubs.com> gave a desperate shout for help: >someone at my firm is about to press the securid system down our collective >throats. please point me to the recent thread on this subject, and/or point >me to some url's or the like, or to someone who has some firsthand >knowledge of the pitfalls and/or vulnerbilities of secirid. I think Enigma Logic, Digital Pathways, and Cryptocard -- all vendors of competitive one-time passsword (OTP) tokens --have diatribes against the ACE/SecurID system on their web sites. Check them out. Over the past two years, there have also been a number of fairly in-depth debates about SecurIDs and the ACE protocols on the Firewalls mailing list (ftp the archives at greatcircle.com) and in comp.security.unix. My SecurID FAQ, available from SDTI at <http://www.securid.com> might give you ideas too. Most people find the SecurID (and most of its competitors) relatively well-designed and and secure devices. Most of the negative comment I've seen is from competitors who say the SecurID and it's ACE support system is too expensive, and from ACE administrators who gripe that the software is not optimized for their favorite platform. It is unfortunately true that SDTI has not yet mastered the knack of producing perfectly bugless code. Earlier this year SDTI also fouled up badly when they failed to bring their Customer Support operation up to speed to support a new generation of authentication servers (ACE 2.X) which involved a relatively more complex Unix installation. They've spent a lot of money and hired a lot of people, but I don't think there is yet a consensus about whether they've licked that. Still, some people think they get their money's worth. SecurID is the OTP token of choice at most (80 percent +) large corporate sites --in a market with a lot of competitors, including well-done freeware OTP alternatives: s/key and OPIE. Of course, those buyers could all be wrong. SDTI's success is really built on the fact that users -- the people who actually carry the tokens -- usually say they like the SecurID better than the alternatives. The SecurID claims the lion's share of the market because it is relatively intuitive and easy to use: the PIN and token-code can be typed in like a (long) traditional password. The alternative tokens -- all challenge/response devices -- force the user to engage in a multi-step process to get a random challenge from the remote host, tap it into the token, encrypted it, then send it back to the host as the OTP. SecurIDs are supported by an ACE authentication server which -- alone among the OTP vendors -- holds its Access Control files in a commercial-grade SQL-savvy relational database, which means that can be interlinked with HR or any other SQL-savvy corporate RDBS. As the industry sets the stage for enterprise-wide IP security (hopefully soon to include crypto) many believe the authentication server's capabilities become more important than the token's design. But, hey, those folks could be wrong. SDTI also just bought RSA Data Security, which some feel enhances its prospects for making some further contribution to enterprise security. Even before that, some 50 of the leading independent vendors of network-based products (from firewalls and comm servers to big databases) had chosen to integrate ACE/SecurID client code into a huge variety of products. This is a fairly unprecidented level of industry support -- but they might be all wrong too. ACE/SecurID is notable among other OTP systems for both its support infrastructure (STDI supported the client/server architecture five years before any other OTP vendor,) and because it is a (patent-protected) time-synched device: the 30/60-second dynamic token-code the SecurID displays is a hash of Current Time and a token-specific secret seed. This has pros and cons (honest, both pros and cons;-) Unfortunately, what ACE/SecurID does not do -- what no OTP can do -- is safeguard or secure your communications links. (It also does not minimize the need for ongoing system administration; capable auditing and oversight; or an explicit local security policy -- all of which can also be burdensome to the user. But the real bear is network security.) On an unprotected network or telephone link -- in the face of a sophisticated attack -- nothing but network-level crypto or link encryption can stave off either eavesdropping or active TCP "session stealing." (Several of SDTI's strategic partners do provide encrypted tunnels through open networks. There are even some well-regarded freeware or shareware options.) SecurIDs, like any OTP, only identifies the guy who knocks on the front door. This is useful; it's even important -- but it's not enough. Most environments need (but don't have) crypto too. But even in the face of this acknowledged threat -- session hijacking -- many sites still find it useful to invest in OTP tokens, often SecurIDs. They do this because: * OTPs can offer a more-certain two-factor authentication (something known; something held); * OTPs foil a whole array of trojan and sniffer-based attacks which seek to collect the passwords of innocent users like yourself; and * OTPs can raise a partial barrier against network-based attacks. Effectively, OTPs force most network-based attacks to become overt... so the user and/or sysadmin has a chance to recognize that something is wrong and react defensively. Some believe the ACE/SecurID system actually does a little better than that. The ACE protocol encrypts all packets containing user authentication data as it passes between the ACE/Clients (often embedded communication servers of various types) and the ACE/Server. This establishes an encrypted virtual net for authentication data with the user site, which blocks another class of attacks. In an ACE/SecurID-protected environment, the threat of network-based attacks is thus somewhat constained. Authentication calls, and the TCP/IP sessions they authorize, remain quite vulnerable if they are transmitted over the Internet, or an extended private network, or telephone links susceptable to physical wiretaps. OTPs safeguard the authentication calls against replay attacks --and most of the race attacks seem managable -- but unencrypted sessions ultimately remain vulnerable to both eavesdropping and session hijacking In many corporations, however, only a fraction of the data traffic travels on these high-risk links. While there are net-based attacks that might reach in to grab unencrypted message traffic on your internal LAN (Is someone is also trying to force a firewall on you guys too, PJ?) within the ACE client/server environment, at least user authentication data -- name, OTP, and PIN -- seems to be securely encrypted. Not that there aren't hackers -- and cynical system administrators -- probing and testing it daily. Rumors and dark suspicious whispers abound, as seems inevitable with any successful product that relies on crypto. (Actually, any widely used computer security product -- have you noticed?) Personally, I find it reassuring to remember that for virtually every flaw there is, inevitably, a fix. But then, Wall Street's recent soaring climbs and plunging drops remind me of just how potent rumors can be. Please come back and tell us if you find any real dirt, Mr. Bell. (And please pardon the blithe spirit that infected my comments. It's just hard to play the straight man on a Saturday summer night.) Also, an obligatory avowal: SDTI regularly pays me huge sums of money for information and advice, but they ignore at least half of what I say. You can too. Suerte, _Vin Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

Re: Police prepare stunning end for high-speed car chases
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:16 8/10/96, Anonymous wrote: >Why don't they just have government access to car engines? They could >just require car manufacturers to include remote shutdown devices for >the engines. But they will. Didn't you know that? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Where is the fraud? (re: Anguilla)
by tcmay＠got.net 17 Dec '03

17 Dec '03

One more thing.... At 12:53 AM 8/11/96, Vincent Cate wrote: >This is a fraud by taxbomber. He is totally involved with selling fake >passports. He calls them "camouflage passports" and they have names like >"British Honduras" of countries that no longer exist, or never did. He >does not think they are "fake", but the rest of the world does. He also >suggested opening up bank accounts with these fake passports (encouraging >fraud). On this last point, how is this "encouraging fraud"? If I deposit money in a bank and choose to identify myself as "Mickey Mouse, Citizen of the Magic Kingdom," perhaps even presenting a Disneyland Passport, who is being defrauded? Is the bank being defrauded? Not if Mickey is depositing money. What if the bank is _lending_ money to Mickey? Then of course they might find that the "Magic Kingdom" is not a real country, and that Mickey's "passport" was not issued by one of the 192 godfearing countries in the United Nations. So what? Then they deny the loan. Where is the fraud? Is Anguilla in the business of determining what a True Name is? (What is it, by the way?) I should remind readers that it is legal to sell such passports in the U.S....somewhere I have one that says "This document not good for travel in the People's Republics of Berkeley, Santa Monica, and Madison," or somesuch. Again, which specific law in Anguilla specifies which pieces of paper may be bought and sold? Does the law say an actual crime or case of fraud has to occur, or is only the potentiality of a crime or fraud involved? Does the crime or fraud have to occur in Anguilla? Inquiring minds want to know. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Police prepare stunning e
by pjn＠nworks.com 17 Dec '03

17 Dec '03

In> IT COULD be the end of the car chase as we know it. With the In> automotive equivalent of a stun gun, science fiction is coming In> to the aid of law enforcement. In> A high-powered electrical device under development at the In> Pentagon's Army Research Laboratory in Adelphi, Maryland, is In> to be tested by police and border patrol agents and could be In> in use by next year. In> The car stopper works by focusing an intense electromagnetic In> charge on the electronic systems that manage most modern In> engines, disabling them and paralysing the car. In the jargon In> of its inventors, the 150 kilovolt charge is a nemp, or non-nuclear In> electromagnetic pulse. Contractors are bidding to produce a In> police version. In> Very precisely directed beams are required, but even then In> there will be problems. A pulse powerful enough to disable an In> engine at any reasonable range would also be likely to disrupt In> communications, damage television and radio sets, disable computers In> and even stop heart pacemakers. There is also the danger of In> loss of control when a car is being driven at high speed. In> Counter-measures would include using old-fashioned engines In> with no electronics, or perhaps surrounding the most delicate In> components with shielding. The best might be to get hold of In> one of the stun guns and use it to disable pursuing police vehicles. Is there any dif between this and a HERF gun? P.J. pjn(a)nworks.com ... RAM DISK is NOT an installation procedure! ___ Blue Wave/QWK v2.20 [NR]

1 0

Re: Police prepare stunning end for high-speed car chases
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On Aug 10, 1996 23:07:44, 'shamrock(a)netcom.com (Lucky Green)' wrote: >At 23:16 8/10/96, Anonymous wrote: >>Why don't they just have government access to car engines? They could >>just require car manufacturers to include remote shutdown devices for >>the engines. > >But they will. Didn't you know that? Why don't we have people's access to government? We could require officials to include remote shutdown devices when they renege on promises, line their pockets, start wars to get re-elected, betray public trust by cruel neglect of their sworn obligations while strutting and bombasting -- damn fools interrupting my X-rated sleazy cheating schemes to fuck my neighbor's dog, or ferret, or mudhole; god, I hate my momma's favorite fuck-up, poor little me, please, world, help me get off Ritalin and wheat germ and my lead-filled ass. Now, off to Sunday school to pray not to burn in hell. On second think, fuck it, com 'ere pooch.

1 0

INFO: Gather and talk to Republican luminaries live online from the convention!
by Voters Telecommunications Watch 17 Dec '03

17 Dec '03

---------------------------------------------------------------------------- REPUBLICAN CONVENTION! LIVE! CHECK IT OUT ONLINE! (DO NOT DISTRIBUTE AFTER AUGUST 20, 1996) WHAT: Live feed from the Republican Convention in San Diego over the net Eat, drink, shmooze with Republican luminaries through the Net. WHERE: @Cafe, #12 St. Mark's Place (212-979-5439) WHEN: 8:30pm, Tuesday August 13, 1996 At 8:30pm EST on Tuesday, August 13, 1996, the Republican National Convention will be broadcast live over the Internet! The Several members of Congress will be present and, technology and Murphy's Law permitting, they'll be able to talk to you online through CUSeeMe. Many of New York's Republicans will be gathering at the @Cafe (address below), one of New York's many fine cybercafes, to eat, drink, shmooze, and queue up for a chance to talk to notable Republican legislators live from the Republican convention. Montana Senator Conrad Burns, who has been a driving force within the bi-partisan push to deregulate encryption, will be cyber-present, as will Montana Governor Marc Racicot, widely regarded as a visionary. The event is being coordinated in San Diego by Mike Rawson of Senator Conrad Burns office. Rawson, who has been instrumental in putting the Senate hearings live online along with Jonah Seiger of the Center for Democracy and Technology, will be bringing Senators, and other luminaries to the event. The Republican National Convention's live broadcast page is at: http://www.convention96.rnc.org/live.htm Simply point your Web browser there on Tuesday night to see the live goings-on. The @Cafe is where most people will probably gather, but there are many fine Internet cafes in New York. To find the one nearest you, go to Clay Irving's NYC Guide at: http://www.panix.com/~clay/nyc/cybercafes.shtml @cafe 12 St. Marks Place. It's an Internet provider! No, it's a restaraunt! Whatever it is, it seems like a cool place! alt.coffee 139 Avenue A - Tel: 212.529.CAFE coffee. computers. comfy chairs. Cyber Cafe 273A Lafayette Street, New York, New York 10012 Tel: (212) 334-5140 Fax: (212) 334-6436 In the heart of SOHO New York, Cyber Cafe is a stylish interface between the latest internet technology and the best in fresh, organic food. Internet Cafe 3rd Street (between 1st and 2nd) Kokobar espresso bar-cafi-bookstore features workstations for all-out Internet access. Located in Fort Greene. The VOID 16 Mercer Street (at Howard, one block north of Canal) For more information on the live hookups from the Republican convention, contact Mike Rawson at Senator Conrad Burns' office at 202-224-8250. For more information on the gathering at the @Cafe in New York City, contact Shabbir J. Safdar at 917-978-8430. ###

1 0

Re: Anguilla / taxbomber - legality
by Duncan Frissell 17 Dec '03

17 Dec '03

At 12:56 AM 8/11/96 -0400, Vincent Cate wrote: >But fraud is illegal in Anguilla, and fake passports are concidered >fraud. > I should have thought that fraud required use rather than manufacture. It is hard to defraud someone just by making something. You have to communicate with them in some way. The US has very broad fraud statutes and yet these passports are sold in the US. I've never heard of any action against them. There is also a First Amendment issue with the World Federalists and their "Citizen of the World" passport. In any case, and ISP is not a publisher or vendor. Sometimes people pay more attention to lawyers than they should. DCF

1 0

Re: National Socio-Economic Security Need for Encryption Technology
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:15 AM 8/10/96 -0400, Scottauge(a)aol.com wrote: >I was watched CBS reports a couple nights ago about how all these blue collar >and now white collar jobs are going across seas. > >So a possible way to protect jobs is to protect the knowledge on how to do >them. >In essence, knowledge is money, cuz that is what we usually want for it >now-a-days. "Oh you want me to do that for you, hmmmm, lets see...." The first axiom of economics is "Wants are unlimited." I'm glad that they're "shipping all those jobs overseas." The more people we have working the more goodies are produced. If the labor of US workers is freed up, then they can go about producing something else valuable that they didn't have time to produce before because those "third worlders" weren't doing their fair share back when they were trapped in feudalism or fabian socialism. You can't get more stuff (wealth) unless everyone is out there working to capacity (consistent with their desired work/leisure tradeoff). DCF

1 0

Re: Rumors of death of Anguilla Data are greatly exagerated.
by tcmay＠got.net 17 Dec '03

17 Dec '03

(I have respect for what Vince did, by actually moving to the Caribbean and setting up a data haven/offshore ISP business. However, just as we discuss the situation about remailers going down, or monitoring the cleartext, or blocking certain addresses, so too should we discuss what Vince is choosing to do. Maybe he is ultimately right, maybe not. I'm including this preface just so no one thinks I'm trying to start a feud. No way.) At 12:53 AM 8/11/96, Vincent Cate wrote: >Taxbomber wrote: >>This is the work of some journalist hacks who did a major job of >>character assassination by claiming that we (and our provider) >>were involved in selling fake passports. > >This is a fraud by taxbomber. He is totally involved with selling fake >passports. He calls them "camouflage passports" and they have names like >"British Honduras" of countries that no longer exist, or never did. He >does not think they are "fake", but the rest of the world does. He also >suggested opening up bank accounts with these fake passports (encouraging >fraud). "What is truth?" Many of the things customers of a data haven are likely to be doing are "fraudulent" or "illegal" in some jurisdictions....I'm sure I don't have to spend effort here citing examples from religious, medical, and business domains. (But I can't resist: vitamin data the U.S. calls fraudulent, political information about Ireland the U.K. calls illegal, sex information the government of Iran punishes with death, and so on.) Selling fake passports seems not to be something Vince ought to even be paying attention to. Granted, pressure from outside states may put pressure on Vince, but this actually confirms my worst (OK, _nearly_ my worst) suspicions about the viability of such data havens. >My lawyer called me up and told me that fake passports are illegal in >Anguilla and that I should pull this guy immediately. I did. It is our >policy to not permit anything on our servers that is illegal in Anguilla. >My lawyer is where I get the definition of "illegal in Anguilla". Instead of "pulling" this guy, did you first send a copy of your lawyer's letter to you to this guy, and advise him that he should remove just this one specific item, the allegedly illegal British Honduras passports? >Tim: >>I'd guess that Vince has had a fun time in the Carribbean, but that he'll >>be closing up shop sometime soon. Once some services are yanked, confidence >>is lost. > >I am not closing up at all. Anything that is legal in Anguilla can be >done from my servers. If not, then not. Note that there are no taxes >here, and there are still many things a guy can do here that are not >permitted in other places. However, fake passports turns out not to be >one of them. Then I suggest you carefully provide a full copy of what you consider to be illegal to all subscribers. Or give subscribers a time period to remove the _specific_ items that are deemed to be illegal. I have some questions, though. Would bomb-making instructions be legal or illegal, acceptable or not acceptable on your system? How about "Kill the Queen" screeds? And so on. Sorry to put you on the spot, Vince, but a "data haven" is by its nature going to have a lot of "unusual" material, to use a euphemism. Everything from Bell's bids for having government officials offed, to plans for sale on creating false identiites, to crypto anarchy manifestos advocating the destruction of democracies. If you "pull" the entire account of a business when the Governor-General, or His Royal Excellency--or whomever it is that runs Anguilla--applies pressure....well, you won't have much of a real data haven, now will you? Could you actually give us an idea of what is considered legal to run in Anguilla, and what is not? How about dial-a-porn sites? (I seem to recall mention from you or a visitor that "Penthouse" is not permitted to be sold in Anguilla, so....) How about gambling? How about assassination markets? (Is it legal in Anguila if no residents or citizens of Anguilla are included in the "game"?) And so on. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Email Bombing
by kickboxer 17 Dec '03

17 Dec '03

Yeah, but if the REAL email bomber were such an accomplished hacker, he did not alter the scripts well enough to make the SysAdmin overlook them... -kickboxer

1 0