December 2003 - cypherpunks-legacy

Re: Why not PGP?
by Geoff Klein 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: froomkin(a)law.miami.edu, rollo(a)artvark.com, cypherpunks(a)toad.com Date: Fri Oct 11 15:08:50 1996 On 10 Oct Michael Froomkin wrote: >> 2. Suppose someone writes a program Z that has no expicit crypto code >> in it, but has hooks for installing one or another version of PGP. Given >> a copy of Z, someone in this country could install PGP he got from MIT, >> whereas someone in Europe could install the international version. >> Would export of Z violate ITAR restrictions? > > Yes, but these are currently being challenged in 3 separate court > actions. Can you post a reference to more info about these actions please. - ------------------------------------------------------------------------ Geoff Klein, Pronto Secure Product Manager http://www.commtouch.com, Tel: 972-9-963445 (ext 130), Fax: 972-9-961053 For my PGP public key send mail with subject: Get Key - ------------------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBMl441ELv5OMYFK1FAQF8tQQAipKnURVdvOMRiOdKNPXjDO13ZL7qyXqy s3Bk6THTWxMLGhmuHc566NdZAMjQJIRFPKjf/0OJdiu9XZYPAGZjo42ry435hG0S 4WqfN19MIhVN0oLpCSTz/cUFQFBGh916icPjnp43/2fx+rqCfcF87MCicBUjukFd X34M9N91cLs= =PNAM -----END PGP SIGNATURE-----

1 0

Re: Creative Wiretap Arguments [Was :Re: Put up or shut up]
by craigw＠dg.ce.com.au 17 Dec '03

17 Dec '03

The introduction of the digital mobile network was deleayed several months here in australia (this was several years back). The delay was based on the need to be able to intercept digital communications. Untill a backdoor was built into the system, the Federal Police would and did not let the cel net go online. > >Which raises the issue, "Is the ISP required to install 'wiretap-friendly' > >capability?" Apparently not, if the cellular phone industry is any > >precedent: For awhile, cops couldn't easily tap cell phones because no such > >capability had been designed into the cell-site software. Such an omission > >was not considered a violation of law. ,'~``. \|/ ,'``~. (-o=o-) (@ @) ,(-o=o-), +--.oooO--(_)--Ooo-----oOO-(_)-OOo-------oooO--(_)--Oooo.------+ | | | Soon, we may all be staring at our computers, wondering | | whether they're staring back. | | | | [Network Admin For WPA Business Products. aka doshai >;-) ] | | .oooO http://pip.com.au/~doshai/ Oooo. | | ( ) Oooo. .oooO ( ) | +-----\ (----( )-------oooO-Oooo--------( )--- ) /---------+ \_) ) / \ ( (_/ (_/ \_) Key fingerprint = 2D F4 54 BB B4 EA F1 E7 B6 DE 48 92 FC 8D FF 49 Send a message with the subject "send pgp-key" for a copy of my key. (if I want to give it to you)

1 0

[NEWS] Crypto- and AP-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Washington Post: Wednesday, October 9, 1996 AT&T Adds On-Line Card Protection By David S. Hilzenrath When it comes to using credit cards on-line, many Internet businesses say their biggest fear is fear itself. Citing consumer concerns about the security of credit-card numbers as an impediment to on-line commerce, two industry powerhouses have introduced guarantees in an effort to overcome what they call unwarranted anxieties. AT&T Corp. Tuesday said it would indemnify holders of its own credit card against fraud when they use AT&T security software to shop at World Wide Web sites that AT&T maintains for its business clients. That means AT&T would assume responsibility for the customer's usual $50 deductible. America Online Inc. said last month that it would assume responsibility for the deductible when subscribers shop at on-line retailers that have been certified as meeting its own customer-service standards. That would include about 50 of the more than 250 merchants on-line with AOL, which only recently began the evaluation process, said Michael Minigan, vice president of marketing for AOL's interactive-marketing unit. ``We think that this is a way to jump-start the industry for both businesses and consumers,'' said Kathleen Earley, vice president of AT&T's EasyCommerce Services for businesses. Through the power of the AT&T name and the security guarantee, ``we can help customers overcome any concerns that they may have,'' Earley said. AT&T introduced a different guarantee in March, promising that holders of its Universal Card who also use AT&T as their on-ramp to the Internet would not be held liable if their credit cards were compromised anywhere in cyberspace. AT&T said it didn't think the guarantee would cost it much money because the risk of a security breach is so small. Many analysts and retailers agree that the burgeoning business of electronic commerce is battling a perception problem. Concerns about hackers stealing credit-card numbers on-line have spawned a new industry of companies dedicated to making on-line transactions secure through the use of encryption. ``There's still a reluctance to use credit cards on-line,'' said David Simons, managing director of Digital Video Investments, which studies the Internet for institutional investors. ``It's irrational because there's probably a greater chance of theft or fraud by giving your credit card out to an individual on an 800 number or ... the old-fashioned way, over the counter.'' ``This is strictly a perception issue,'' said Jeff Bezos, founder and chief executive of Amazon.Com, an Internet-based bookstore that handles thousands of sales a day. ``It's so much easier to go through a trash can or dumpster and get credit-card numbers than it is to break the encryption schemes that are used on the Internet.'' Still, Bezos said there is evidence that perceptions are changing. When Amazon.Com opened for business 15 months ago, about half of its customers opted to provide their credit-card numbers over the phone instead of over the Internet. Now, 85 percent complete the transactions on-line, Bezos said. AP Online: Tuesday, October 8, 1996 Bankers Shrug Off Cybertalk BY E. SCOTT RECKARD HONOLULU-- Go high-tech or wither, speakers as auspicious as Federal Reserve Chairman Alan Greenspan told the 1,100-strong American Bankers Association convention. ''If you don't, you're basically toast, and punishment is swift,'' agreed convention speaker Don Tapscott, author of ''The Digital Economy.'' You might think conventioneers from the largest organization of U.S. banks would all be rushing to be first in online banking, computerized marketing to customers, and other services and automated processes. You would be wrong, especially at smaller banks, where many seem content to take a more relaxed approach. Louis Prichard, president of Farmers National Bank of Danville, Ky., is computer literate. He rose at 5 a.m. Hawaii time Monday to e-mail colleagues and check the bank's latest financial picture via his laptop. Farmers has a World Wide Web site with information about services and rates. But home and online banking are still being studied by the four-branch, $190 million assets bank, and Prichard says that while Tapscott glossed over computer security concerns, his customers worry about them. He wants other banks to solve the start-up problems before he wades in. ''We're like water skiers: We'll let someone else cut through the waves,'' he says. ''We'll ride along, not far behind.'' Far fewer than half the bank officials in a huge ballroom at the Hilton Hawaiian Village here held their hands up when Tapscott asked if they had tried the Internet. Some, like Harold R. Pehlke, never use computers and are downright hostile to the idea. Pehlke, 57, chief executive of Republic Bank of Chicago, sat through one of many small-group sessions on new technology, then announced to the consultant making the presentation: ''You have convinced me to retire in three years.'' ''I wasn't sure I was going to do it, but after listening to you I am.'' Even featured speakers older ones, anyway shared similar views. William Seidman, head of the Federal Deposit Insurance Corp. under presidents Reagan and Ford, said he had listened to Tapscott's presentation, ''and my immediate reaction was, 'Thank God I'm old.''' On reflection, though, Seidman said he realized that most bank depositors were probably in no particular rush for high-tech banking. ''Don't panic,'' he told the bankers. ''It'll take plenty of time before your average customer gets there.'' That sounded good to Gib S. Nichols, a director of the Flathead Bank of Bigfork, Mont. ''Our customers will let us know when it's time,'' he said. Seidman, who ran the Resolution Trust Corp. when it began selling off the wreckage of the 1980s savings and loan debacle, said the now flourishing bank industry had better watch for risks as well as find new high-tech ways to market services. Many banks ''are reaching for loans today,'' he said. ''When the going gets tough, the tough get out of the way and let someone else do the dying,'' he said. ''We used to say as regulators, 'When the tide goes out you'll see who's swimming without a bathing suit.' Those of you who feel the tide better look down.'' News Release (NationsBank):Tuesday, October 8, 1996 NationsBank Official Partner of NCL's Internet Fraud Watch NationsBank (NYSE: NB) is joining the National Consumers League's battle to ensure the safety and security of online commerce. Through a $100,000 grant, NationsBank is becoming the exclusive bank sponsor of NCL's Internet Fraud Watch. Internet Fraud Watch, launched in February by the League and operated from its National Fraud Information Center, is a first-of-its-kind program for monitoring, reporting and preventing fraud on the Internet. NCL shares Internet Fraud Watch data with local, state, and federal agencies, including the Federal Trade Commission and state attorneys general, as well as international law enforcement groups. "Internet Fraud Watch is a resource that consumers can use to get educated on the Internet," said NCL President Linda F. Golodner. "Since our launch in February, our Web site alone has received more than 300,000 visits from consumers and averaged 25,000 hits a week. We have helped consumers as well as law enforcement officials keep cyberfraud in check." The NationsBank grant will significantly expand the Internet Fraud Watch consumer education and protection programs, according to Golodner. With plans to offer Web-banking in mid-1997 and more than 120,000 customers already using its PC banking product, NationsBank ranks online security as a top priority, according to NationsBank President Ken Lewis. "NationsBank is happy to help NCL broaden its fraud education and prevention efforts," said Lewis. "The Internet's growing popularity and potential for commerce make it a vitally important avenue for American business. It's equally important that consumers know the Internet is a safe and secure place to do business." The Federal Trade Commission rigorously monitors the Internet. The FTC recently cracked down on a pyramid scheme it believed had bilked consumers of more than $6 million. It also took action against several firms that marketed business opportunities by using deceptive claims and false earnings reports. "Consumers who suspect a scam on the Internet have critical information that can be used by law enforcement agencies to track down and stop potential frauds before more consumers are victimized," said Jodie Bernstein, director of the FTC's Bureau of Consumer Protection. "The Internet Fraud Watch program gives consumers an easy and cost-free way of providing this information, and it has been a major help to the FTC in identifying particular scams in their infancy." National Consumers League advisors field calls about alleged incidents of online fraud, direct callers to local resources and report the information to state and federal enforcement authorities. Enforcement agencies use the data to help shut down cybercrimes and boiler rooms. Work-at-home schemes are among the top-five scams currently operating online. (NCL Top Five Internet Scams will be available on Wednesday, Oct. 9.) Consumers can reach NCL's Internet Fraud Watch by phone through the National Fraud Information Center at (800) 867-7060, or visit the home page at http://www.fraud.org . They may also send e-mail messages to nfic(a)internetmci.com. Financial Times: Wednesday, October 9, 1996 Smartcard Trials Extended The race to replace notes and coins with electronic cash hots up this month as the Mondex consortium extends trials of its smartcards. The group, which includes British Telecom, Midland Bank and NatWest Bank, is issuing students at York and Exeter universities with the cards, which contain a microchip that can be loaded with electronic money from automatic teller machines and home telephones. The cards are "swiped" through retailers' tills to deduct payment for purchases. Users do not have to sign an authorisation slip as they do with direct debit and credit cards. Electronic money saves banks and retailers the considerable costs of handling physical cash. But so far consumers testing Mondex smartcards in the UK have not received a share of this saving. Mondex is well ahead of its main rival in the UK, VisaCash, whose backers include Barclays and Lloyds Bank. It could be a year before VisaCash starts its own trials; Mondex could be offering its cards to the public by then. Jonathan Guthrie AP Worldstream: Tuesday, October 8, 1996 Banker Sentenced to Death for Fraud HANOI, Vietnam-- A Vietnamese private bank executive has been sentenced to death after a court in southern Vietnam found him guilty of financial fraud and stealing funds from accounts, state-run media reported Tuesday. Nguyen Van Son, deputy general director of Gia Dinh Joint Stock Commercial Bank, will face a firing squad for his crimes, said the Communist Party newspaper Nhan Dan, or The People. Ho Chi Minh City's People's Court convicted Son of fraud linked to the private bank he and his wife, Thai Kim Lieng, established in 1992. The court said Son stole about $4.5 million from the bank's accounts. Unable to collect the necessary capital to qualify for a bank license, Son and his wife forged several documents claiming they had about $800,000 worth of funds from 17 shareholders, court records said. When the State Bank of Vietnam granted the couple a banking license in 1992, they began siphoning off money from newly opened savings and other accounts. At the time, the bank had more than $6.5 million worth of accounts, the newspaper said. The bank also had collected substantial gold reserves. Son continued to forge credit documents over several years to increase the bank's financial standing, the report said. A police investigation in 1994 led to the arrests of Son, his wife and five other bank associates. Lieng and bank director Nguyen Le Tue also stood trial with Son. Both were sentenced to life in prison. Four other bank executives were sent to prison for terms ranging from 3 to 20 years. Although a number of banking scandals have been reported in Vietnam since Hanoi began shifting toward a market economy. This latest case is the largest of its kind and marks the first time a bank executive has been sentenced to death for his crimes. Nhan Dan described Son's crimes as ''organized acts that cause extremely serious consequences and pose dangers to society.'' In addition to the death and prison sentences, the court ruled that the culprits must repay money taken from the bank. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: pgp, edi, s/mime
by Geoff Klein 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: andrew_loewenstern(a)il.us.swissbank.com, raph(a)cs.berkeley.edu, cypherpunks(a)toad.com Date: Fri Oct 11 15:08:58 1996 > Raph Levien writes: > > In sum, S/MIME leaves PGP in the dust, both techically and as > > a market force. Disagree: 1. Technical superiority of S/MIME over PGP is arguable. 2. It will be some time (if ever) before you will be able to communicate securely using S/MIME across US borders. - ------------------------------------------------------------------------ Geoff Klein, Pronto Secure Product Manager http://www.commtouch.com, Tel: 972-9-963445 (ext 130), Fax: 972-9-961053 For my PGP public key send mail with subject: Get Key - ------------------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBMl443ULv5OMYFK1FAQEWmQQAljOoIDcxoaOdOHWW9EurIsMsGt85Wmkn 65slX58eONq3LdkLY+NEEIG/bpIZIzcy0wQO7aWX2qQdJRYBSBSmHzDxb4A07cJM AN3c5q3pRZzB27iKJHlsPtoauvRE+O0LAwTRz+0zhNfAwsDcvttfYXTE8AycwtoY DCuPGrR1s6g= =/otj -----END PGP SIGNATURE-----

1 0

Re: Why not PGP?
by jim bell 17 Dec '03

17 Dec '03

At 08:49 AM 10/11/96 +0100, Adam Back wrote: >- what they care to enforce > > NCSA Mosaic had a PGP signature checking hook, they were told to > take it out. Microsoft's CAPI arrangement is that they will not > sign non-US CAPI compliant crypto modules (Examples of enforcement of > no-hooks interpretation). Does that fix the "export only the signature" problem (for the government)/opportunity (for the rest of us)? You know, present Microsoft with the software, don't tell them it's already out of the US, and they sign it. Export the signature only (who cares if this is legal!) and edit the international software to contain the signature. Jim Bell jimbell(a)pacifier.com

2 1

Re: LET'S MEET DIMITRI
by jim bell 17 Dec '03

17 Dec '03

At 03:26 PM 10/10/96 -0700, Sandy Sandfort wrote: >C'punks, > >On Thu, 10 Oct 1996, Ray Arachelian wrote: > >> I hereby pledge $50. :) Now who is funding the baseball bat >> committee on this same topic? :) > >Thanks you Ray. Now who's next? > > > S a n d y > >P.S. Regretably, if Dimitri has big enough 'nads to > take us up on this offer, as my guest, he will > be under the mantle of my protection. Therefore, > no kinetic, edged or energy weapons allowed. Excellent! Chemical weapons WEREN'T MENTIONED! (Now where did I put that beaker...) Jim Bell jimbell(a)pacifier.com

1 0

Burmese fonts and Netscape Browser
by vitamin＠best.com 17 Dec '03

17 Dec '03

Has anyone played in Java with Burmese fonts? Any pointers would be greatly appreciated!

1 0

SPA Press Release on ISP suits (fwd)
by David Lesher 17 Dec '03

17 Dec '03

Michael Dodson sez: In CYBERIA-L(a)LISTSERV.AOL.COM The formatting may be a bit rough. I am not a pro at this. FOR IMMEDIATE RELEASE ((edited)) Contact: David Phelps, (202) 452-1600, ext. 320, dphelps(a)spa.org SPA Files Copyright Suits Against ISPs and End Users Internet Anti-Piracy Campaign Launched (Oct.10, 1996 --Washington, D.C.) -- The Software Publishers Association (SPA) announced today that it has filed five civil lawsuits for copyright infringement occurring on the Internet. Three of the lawsuits were filed against Internet service providers (ISPs), and the remaining two were filed against individual end users. Additionally, SPA launched its Internet Anti-Piracy Campaign, which includes education and enforcement components, in an effort to educate and work cooperatively with ISPs regarding copyright infringement. ISP lawsuits were filed on Oct. 7 and 8 against Community ConneXion of ................................................^^^^^^^^^^^^^^^^^^^ Oakland, Calif.; GeoCities of Beverly Hills, Calif.; and Tripod Inc. of Williamstown, Mass. The SPA members named as plaintiffs in all three suits were Adobe Systems Inc., Claris Corp. and Traveling Software Inc. In each case, SPA first contacted the ISP and requested that the infringing material be removed, but the ISP failed to respond and cooperate. {.....} ((end of edited release)) See http://www.computerworld.com/news/news_articles/961010spa.html for early reactions. Michael Dodson dodsonm(a)wane-leon-mail.scri.fsu.edu -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

It seems that this batch didn't make it to the list, so I'm trying again... News Release (Netscape): Monday, October 7, 1996 Netscape to Use CyberCash Technology Netscape Communications Corporation (NASDAQ: NSCP) and CyberCash, Inc. (NASDAQ: CYCH) today announced a technology and marketing relationship to broaden payment options for Internet consumers. As part of the agreement, CyberCash has licensed its CyberCoin Internet payment technology to Netscape. Netscape will bundle its technology into future versions of Netscape products, including Netscape LivePayment server software for online payment processing. The two companies will also collaborate on including future CyberCash payment services, such as CyberCash's electronic check services, into future Netscape commerce offerings. Netscape and CyberCash plan to jointly market these Internet payment solutions to consumers and businesses, and will work together on efforts to accelerate the deployment of Secure Electronic Transactions (SET) credit card payment protocol in the marketplace. "We have had customer demand for small value payment technology particularly from the professional information publishing industry -- the integration of CyberCash's CyberCoin with Netscape's commerce solutions provides our customers with a way to complete small transactions over the Internet," said Srivats Sampath, vice president of marketing for server, tools and applications at Netscape. "By offering a range of payment options for businesses and consumers, Netscape and CyberCash will help expand the range of goods and services available in the electronic marketplace." "Combined with Netscape's customer base, CyberCoin is filling a need in the marketplace for small payment processing," said Denis Yaro, executive vice president, products and operations at CyberCash. "This is a huge step in our efforts to bring Internet transaction technology to consumers and businesses and to increase online inventory, making the virtual mall a reality." "We are pleased to see this agreement between Netscape and CyberCash," said Chuck White, senior vice president of First Data Card Services Group's Electronic Funds Services unit. "The relationship between Netscape and CyberCash will make it easier to deliver integrated payment solutions to our client financial institutions, and their merchant customers that are using Netscape LivePayment." CyberCoin is a payment service which permits online purchases for items costing between 25 cents and $10.00. This new payment solution opens up significant opportunities for merchants to market low cost, high value items such as news and information, graphics, games and music. It also allows merchants to unbundle larger product offerings, and sell them in smaller increments. Financial institutions to offer the CyberCoin service include First Union Bank, First USA Paymentech, Michigan National Bank and First Data Corp. Bundling CyberCash's CyberCoin technology into future releases of Netscape's LivePayment point-of-sale software will enable online businesses to accept multiple payment methods and implement new pricing and business models. Netscape LivePayment will integrate this new payment functionality seamlessly and cost-effectively, providing business people with administration and configuration controls with flexible logging reports, and a variety of sample merchant applications to minimize the start-up development costs of merchants. Both Netscape and CyberCash will market Netscape LivePayment software to businesses looking to develop or expand online distribution channels. Netscape plans to integrate CyberCoin into future versions of Netscape Navigator client software, which includes technology that streamlines consumers' shopping experience by providing a uniform interface for Internet purchases and transactions. Similar to a real wallet, this technology will organize into one place a user's credit card numbers, shipping addresses, digital IDs, electronic receipts and other payment instruments needed to purchase goods and services on the Internet. Netscape and CyberCash will coordinate their efforts on SET to assure interoperability between their credit card-related electronic commerce implementations. Netscape was one of the principal architects of the SET specifications proposed by Visa International and MasterCard International. Committed to being among the first to deliver SET-compliant products to the marketplace, both Netscape and CyberCash will also collaborate with other important industry leaders in an effort to facilitate SET's arrival in the shortest possible timeframe. About Netscape Netscape Communications Corporation (NASDAQ: NSCP) is a leading provider of open software for linking people and information over enterprise networks and the Internet. The company offers a full line of clients, servers, development tools and commercial applications to create a complete platform for next-generation, live online applications. Netscape Communications Corporation is based in Mountain View, California. About CyberCash CyberCash, Inc., (NASDAQ: CYCH), of Reston, Virginia, founded in August 1994, is a leading developer of software and service solutions for secure financial transactions over the Internet. The CyberCash system is designed to allow banks to offer secure Internet payments to their customers. CyberCash works with virtually all financial processing institutions, and is currently working with VISA and MasterCard to develop and implement the Secure Electronic Transaction (SET) protocol for online credit card transactions. The company's initial service, which handles payments using major credit cards, was introduced in April 1995. CyberCoin, the company's innovative micropayment service that enables cash transactions, was launched on Sept. 30, 1996. CyberCash's electronic check service is expected to be released in Q4, 1996. Edge: Tuesday, October 8, 1996 VeriFone Introduces Personal ATM and VeriSmart VeriFone, Inc., Monday announced plans to bring the convenience of a bank automatic teller machine into the homes of millions of consumers around the world, enabling them to replace cash and access dozens of personal services anytime, anywhere, using telephones, televisions, personal computers and other low-cost devices and information appliances.Announced Monday at the ABA Bank Card Conference, VeriFone unveiled plans to introduce a low-cost, palm-sized, smart card reader/writer called the Personal ATM (P-ATM). The P-ATM will connect to any standard telephone line, allowing consumers to interact with their bank account to download cash,' securely and conveniently in the privacy of the home or office. In addition, leveraging VeriFone's leadership in Internet commerce, the P-ATM will also interface with the VeriFone vWallet, and any stored-value card scheme, enabling consumers to make purchases over the Internet, download funds from their bank onto their smart card, transfer funds between accounts, and perform on-line transactions between consumers and merchants. VeriFone also revealed the development of the VeriSmart System architecture, which is expected to accelerate consumer adoption of smart card applications. The VeriSmart System will integrate a low-cost personal ATM device, a powerful set of software applications that lets consumers securely interact with any provider offering smart card services, and a comprehensive package of support services. Applications might include the ability to download electronic cash from their bank, instantly receive rewards from loyalty programs, or provide selected healthcare information to their doctor or pharmacist. Six leading technology companies -- CIDCO, Gemplus, Key Tronic, Mondex International, Scientific Atlanta and WebTV Networks, Inc. -- have announced their support for VeriSmart and plan to work with VeriFone to develop further technologies around the system. "We are taking an aggressive role in developing the infrastructure for smart card applications with our plans to introduce the Personal ATM and the VeriSmart System," said Hatim Tyabji, chairman, president and CEO of VeriFone. "VeriSmart will be the first technology that is card-scheme and hardware-device independent, uniting all the elements in a truly end-to-end solution. We plan to actively layer VeriSmart technology into our merchant point-of-sale terminals and Omnihost client-server systems, to create solutions that bridge all VeriFone markets worldwide. This action unveils the third element in our three pronged strategy -- traditional debit/credit business, Internet commerce and now consumer smart card technologies -- expanding VeriFone's leadership in secure payments technologies worldwide." In addition, American Express, GTE, Hewlett-Packard Company, MasterCard, NIPSCO Industries, Inc., Sparbanken Bank (BABS), Sears Payment Systems (SPS), and Wells Fargo have all announced support of the VeriSmart System. The VeriSmart System is being designed to electronically link consumers to their banks, telephone and utility companies, retail merchants and other personal services. Using any one of a variety of smart card-ready devices, such as the Personal ATM, telephone, PC, or set-top-box, a consumer will access numerous personal services and interact with multiple stored-value card schemes, loyalty programs, identification, and health care information. The VeriSmart System will provide end-to-end security for all communications between the access device and the smart card applications on the VeriSmart server, ensuring data integrity of financial transactions and other confidential information. "This is the beginning of a new era for smart card applications," said Tom Kilcoyne, general manager of VeriFone's Consumer Systems Division. "The industry has been waiting for a compelling, cost-effective solution that enables financial institutions, and a broad range of consumer service providers, to move aggressively to build smart card applications. Endorsement in the consumer market from these respected companies, combined with VeriFone's global leadership position and expertise in the secure payment transaction market, supports our belief in VeriSmart as a powerful system that can accelerate development of the market for smart cards worldwide." Wide Industry Support VeriFone's Consumer Systems Division's effort to enhance the market for smart cards is drawing the support of consumer market leaders that will contribute in pivotal areas of the system. CIDCO Inc., the world's leading producer of subscriber terminal equipment that supports intelligent network services being offered by telephone operating companies, has formed an alliance with VeriFone to incorporate VeriSmart technology into its products and to work with VeriFone on future projects. "CIDCO is excited to be collaborating with VeriFone in the explosive consumer smart card market," said Paul Locklin, CIDCO president and CEO. "The VeriSmart system brings a strong added value to the products we market to our regional Bell operating company customers." "VeriFone and Gemplus have had a close and long-standing relationship over the years and we are proud to be part of this latest breakthrough solution," said Marc Lassus, Gemplus CEO. "As a market leader, our strategy has been to partner with companies that enable us to offer the best-of-breed solutions, and our participation in VeriSmart extends this strategy to the consumer market for smart cards." "As consumers become more accepting of smart cards, initiatives like VeriSmart will make it easier for banks and other institutions to introduce new products and services that provide greater choice and convenience," said Ruann F. Ernst, general manager of HP's Financial Services Business Unit. Associated Press: Tuesday, October 8, 1996 Bankers Hope to Control 'Electronic Cash' By E. SCOTT RECKARD The largest organization of U.S. banks wants "smart cards" and "electronic cash" limited to the banking industry. The American Bankers Association, in its first official position on how electronic cash should evolve, says such "stored-value" cards should be issued only by regulated institutions with direct access to Federal Reserve payment services -- namely banks, thrifts and credit unions. The bankers' recommendation comes as several software companies are also jockeying to provide payment systems over the Internet. At a convention here, the bankers trade group warned that users of prepaid phone cards have been ripped off by fly-by-night issuers. The same could happen in storing funds for general use on plastic cards like credit cards or in computers, the bankers said in issuing their report Sunday. "If a nonbank issuer of stored value fails, consumers could be left holding the bag - an empty bag," said James M. Culbertson, president for the past year of the ABA and chairman of First National Bank in Asheboro, N.C. The bankers' group acknowledged that some day computer companies may get into the business of electronic cash. But if that happens, banks want the computer companies to be subject to the same regulatory scrutiny that applies to banks and thrifts. While seeking exclusive rights to smart cards and their ilk, banks have resisted the idea that conventional bank regulations should apply to electronic cash. They oppose a proposal to apply the Federal Reserve's "Regulation E" to stored-value cards. That regulation requires banks to offer written confirmations of ATM transactions. Bankers say such a requirement would make stored-value cards too expensive to issue. And in pilot projects, banks have not treated the smart cards as deposits that are insured by the Federal Deposit Insurance Corp. That means the consumer does not earn interest on the unused cash backing up the card and the banks do not have to set aside reserves as they would for a conventional deposit. A smart card has a computer chip that stores information, including how much the consumer has deposited. As a purchase is made, the amount is automatically deducted from the balance in the card's memory. In the future, consumers will be able to transfer cash to smart cards from their home computers or at an automatic teller machine at a bank. Electronic money is also being tested to pay for purchases over the Internet. The move away from paper-based transactions has been a boon in many ways for banks. The replacement of manual check-processing by electronically stored images of the checks has probably paid off more for banks than any other high-tech innovation, bank technology consultant Charles O. Hinely said in an interview. But banks could be pushed out of the payment system altogether if they don't quickly get into computerized services and transactions, said Don Tapscott, author of "The Digital Economy." "If you don't, you're basically toast, and punishment is swift," he told the bankers. The trade group's new president, Walter A. Dods Jr., said he would work to improve the image of bankers, whom he described as unfairly maligned despite the financial support and considerable charity work they provide their communities. "But what do we get in return? We get legislation to limit ATM fees. We get a reader telling Business Week recently that 'banks are just sucking us dry,"' said Dods, the chairman of First Hawaiian Bank. Washington Post: Wednesday, October 9, 1996 AT&T Adds On-Line Card Protection By David S. Hilzenrath When it comes to using credit cards on-line, many Internet businesses say their biggest fear is fear itself. Citing consumer concerns about the security of credit-card numbers as an impediment to on-line commerce, two industry powerhouses have introduced guarantees in an effort to overcome what they call unwarranted anxieties. AT&T Corp. Tuesday said it would indemnify holders of its own credit card against fraud when they use AT&T security software to shop at World Wide Web sites that AT&T maintains for its business clients. That means AT&T would assume responsibility for the customer's usual $50 deductible. America Online Inc. said last month that it would assume responsibility for the deductible when subscribers shop at on-line retailers that have been certified as meeting its own customer-service standards. That would include about 50 of the more than 250 merchants on-line with AOL, which only recently began the evaluation process, said Michael Minigan, vice president of marketing for AOL's interactive-marketing unit. ``We think that this is a way to jump-start the industry for both businesses and consumers,'' said Kathleen Earley, vice president of AT&T's EasyCommerce Services for businesses. Through the power of the AT&T name and the security guarantee, ``we can help customers overcome any concerns that they may have,'' Earley said. AT&T introduced a different guarantee in March, promising that holders of its Universal Card who also use AT&T as their on-ramp to the Internet would not be held liable if their credit cards were compromised anywhere in cyberspace. AT&T said it didn't think the guarantee would cost it much money because the risk of a security breach is so small. Many analysts and retailers agree that the burgeoning business of electronic commerce is battling a perception problem. Concerns about hackers stealing credit-card numbers on-line have spawned a new industry of companies dedicated to making on-line transactions secure through the use of encryption. ``There's still a reluctance to use credit cards on-line,'' said David Simons, managing director of Digital Video Investments, which studies the Internet for institutional investors. ``It's irrational because there's probably a greater chance of theft or fraud by giving your credit card out to an individual on an 800 number or ... the old-fashioned way, over the counter.'' ``This is strictly a perception issue,'' said Jeff Bezos, founder and chief executive of Amazon.Com, an Internet-based bookstore that handles thousands of sales a day. ``It's so much easier to go through a trash can or dumpster and get credit-card numbers than it is to break the encryption schemes that are used on the Internet.'' Still, Bezos said there is evidence that perceptions are changing. When Amazon.Com opened for business 15 months ago, about half of its customers opted to provide their credit-card numbers over the phone instead of over the Internet. Now, 85 percent complete the transactions on-line, Bezos said. AP Online: Tuesday, October 8, 1996 Bankers Shrug Off Cybertalk BY E. SCOTT RECKARD HONOLULU-- Go high-tech or wither, speakers as auspicious as Federal Reserve Chairman Alan Greenspan told the 1,100-strong American Bankers Association convention. ''If you don't, you're basically toast, and punishment is swift,'' agreed convention speaker Don Tapscott, author of ''The Digital Economy.'' You might think conventioneers from the largest organization of U.S. banks would all be rushing to be first in online banking, computerized marketing to customers, and other services and automated processes. You would be wrong, especially at smaller banks, where many seem content to take a more relaxed approach. Louis Prichard, president of Farmers National Bank of Danville, Ky., is computer literate. He rose at 5 a.m. Hawaii time Monday to e-mail colleagues and check the bank's latest financial picture via his laptop. Farmers has a World Wide Web site with information about services and rates. But home and online banking are still being studied by the four-branch, $190 million assets bank, and Prichard says that while Tapscott glossed over computer security concerns, his customers worry about them. He wants other banks to solve the start-up problems before he wades in. ''We're like water skiers: We'll let someone else cut through the waves,'' he says. ''We'll ride along, not far behind.'' Far fewer than half the bank officials in a huge ballroom at the Hilton Hawaiian Village here held their hands up when Tapscott asked if they had tried the Internet. Some, like Harold R. Pehlke, never use computers and are downright hostile to the idea. Pehlke, 57, chief executive of Republic Bank of Chicago, sat through one of many small-group sessions on new technology, then announced to the consultant making the presentation: ''You have convinced me to retire in three years.'' ''I wasn't sure I was going to do it, but after listening to you I am.'' Even featured speakers older ones, anyway shared similar views. William Seidman, head of the Federal Deposit Insurance Corp. under presidents Reagan and Ford, said he had listened to Tapscott's presentation, ''and my immediate reaction was, 'Thank God I'm old.''' On reflection, though, Seidman said he realized that most bank depositors were probably in no particular rush for high-tech banking. ''Don't panic,'' he told the bankers. ''It'll take plenty of time before your average customer gets there.'' That sounded good to Gib S. Nichols, a director of the Flathead Bank of Bigfork, Mont. ''Our customers will let us know when it's time,'' he said. Seidman, who ran the Resolution Trust Corp. when it began selling off the wreckage of the 1980s savings and loan debacle, said the now flourishing bank industry had better watch for risks as well as find new high-tech ways to market services. Many banks ''are reaching for loans today,'' he said. ''When the going gets tough, the tough get out of the way and let someone else do the dying,'' he said. ''We used to say as regulators, 'When the tide goes out you'll see who's swimming without a bathing suit.' Those of you who feel the tide better look down.'' News Release (NationsBank):Tuesday, October 8, 1996 NationsBank Official Partner of NCL's Internet Fraud Watch NationsBank (NYSE: NB) is joining the National Consumers League's battle to ensure the safety and security of online commerce. Through a $100,000 grant, NationsBank is becoming the exclusive bank sponsor of NCL's Internet Fraud Watch. Internet Fraud Watch, launched in February by the League and operated from its National Fraud Information Center, is a first-of-its-kind program for monitoring, reporting and preventing fraud on the Internet. NCL shares Internet Fraud Watch data with local, state, and federal agencies, including the Federal Trade Commission and state attorneys general, as well as international law enforcement groups. "Internet Fraud Watch is a resource that consumers can use to get educated on the Internet," said NCL President Linda F. Golodner. "Since our launch in February, our Web site alone has received more than 300,000 visits from consumers and averaged 25,000 hits a week. We have helped consumers as well as law enforcement officials keep cyberfraud in check." The NationsBank grant will significantly expand the Internet Fraud Watch consumer education and protection programs, according to Golodner. With plans to offer Web-banking in mid-1997 and more than 120,000 customers already using its PC banking product, NationsBank ranks online security as a top priority, according to NationsBank President Ken Lewis. "NationsBank is happy to help NCL broaden its fraud education and prevention efforts," said Lewis. "The Internet's growing popularity and potential for commerce make it a vitally important avenue for American business. It's equally important that consumers know the Internet is a safe and secure place to do business." The Federal Trade Commission rigorously monitors the Internet. The FTC recently cracked down on a pyramid scheme it believed had bilked consumers of more than $6 million. It also took action against several firms that marketed business opportunities by using deceptive claims and false earnings reports. "Consumers who suspect a scam on the Internet have critical information that can be used by law enforcement agencies to track down and stop potential frauds before more consumers are victimized," said Jodie Bernstein, director of the FTC's Bureau of Consumer Protection. "The Internet Fraud Watch program gives consumers an easy and cost-free way of providing this information, and it has been a major help to the FTC in identifying particular scams in their infancy." National Consumers League advisors field calls about alleged incidents of online fraud, direct callers to local resources and report the information to state and federal enforcement authorities. Enforcement agencies use the data to help shut down cybercrimes and boiler rooms. Work-at-home schemes are among the top-five scams currently operating online. (NCL Top Five Internet Scams will be available on Wednesday, Oct. 9.) Consumers can reach NCL's Internet Fraud Watch by phone through the National Fraud Information Center at (800) 867-7060, or visit the home page at http://www.fraud.org . They may also send e-mail messages to nfic(a)internetmci.com. Financial Times: Wednesday, October 9, 1996 Smartcard Trials Extended The race to replace notes and coins with electronic cash hots up this month as the Mondex consortium extends trials of its smartcards. The group, which includes British Telecom, Midland Bank and NatWest Bank, is issuing students at York and Exeter universities with the cards, which contain a microchip that can be loaded with electronic money from automatic teller machines and home telephones. The cards are "swiped" through retailers' tills to deduct payment for purchases. Users do not have to sign an authorisation slip as they do with direct debit and credit cards. Electronic money saves banks and retailers the considerable costs of handling physical cash. But so far consumers testing Mondex smartcards in the UK have not received a share of this saving. Mondex is well ahead of its main rival in the UK, VisaCash, whose backers include Barclays and Lloyds Bank. It could be a year before VisaCash starts its own trials; Mondex could be offering its cards to the public by then. Jonathan Guthrie AP Worldstream: Tuesday, October 8, 1996 Banker Sentenced to Death for Fraud HANOI, Vietnam-- A Vietnamese private bank executive has been sentenced to death after a court in southern Vietnam found him guilty of financial fraud and stealing funds from accounts, state-run media reported Tuesday. Nguyen Van Son, deputy general director of Gia Dinh Joint Stock Commercial Bank, will face a firing squad for his crimes, said the Communist Party newspaper Nhan Dan, or The People. Ho Chi Minh City's People's Court convicted Son of fraud linked to the private bank he and his wife, Thai Kim Lieng, established in 1992. The court said Son stole about $4.5 million from the bank's accounts. Unable to collect the necessary capital to qualify for a bank license, Son and his wife forged several documents claiming they had about $800,000 worth of funds from 17 shareholders, court records said. When the State Bank of Vietnam granted the couple a banking license in 1992, they began siphoning off money from newly opened savings and other accounts. At the time, the bank had more than $6.5 million worth of accounts, the newspaper said. The bank also had collected substantial gold reserves. Son continued to forge credit documents over several years to increase the bank's financial standing, the report said. A police investigation in 1994 led to the arrests of Son, his wife and five other bank associates. Lieng and bank director Nguyen Le Tue also stood trial with Son. Both were sentenced to life in prison. Four other bank executives were sent to prison for terms ranging from 3 to 20 years. Although a number of banking scandals have been reported in Vietnam since Hanoi began shifting toward a market economy. This latest case is the largest of its kind and marks the first time a bank executive has been sentenced to death for his crimes. Nhan Dan described Son's crimes as ''organized acts that cause extremely serious consequences and pose dangers to society.'' In addition to the death and prison sentences, the court ruled that the culprits must repay money taken from the bank. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Microsoft CAPI
by James A. Donald 17 Dec '03

17 Dec '03

Mike McNally writes: >> And so what happens when the Microsoft key is compromised? >> It might be hard to break by purely cryptographic means, but >> surely there are some people at Microsoft who aren't >> millionaires. At 03:13 PM 10/9/96 -0500, Andrew Loewenstern wrote: > I ask: "Who Cares?" It is easy enough to distribute with the secure-non-GAK > plug-in a patch for disabling the module authentication. Heck, you could > even make an ActiveX applet that did it. Better than disabling, would be to give the user the choice of whose signature to trust. Perhaps many users would prefer a crypto engine signed by Zimmerman, rather than Microsoft. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1