December 2003 - cypherpunks-legacy

Re: [crypto] Avatar Protection?
by AJ Barrett 17 Dec '03

17 Dec '03

At 09:13 PM 12/4/96 -0500, e$pam wrote: <snip> This sounds like a good argument for the crypto "watermark" idea that was discussed a few times earlier on the list. I think it goes something like this: The document/avatar/code/whatever has a crypto identifier embedded in it that can be extracted to verify ownership. Perhaps a good analogy might be a steganographic application. > The problem is this: Is there a way for a user to "view" the client's > avatar (and in this sense, the user usually has to receive a copy > of the code to render the avatar and render it on the local machine) > but not save a copy? Assume that a client with no save feature > is not a viable option...too easy to work around. Yep. Even the "eyes only" setting in PGP is no good if the recipient is savvy enough to cut and paste the plaintext to the clipboard. -- Sincerely, AJ Barrett <abarrett(a)checkfree.com> Product Analyst CheckFree Corporation: The Way Money Moves http://www.checkfree.com

1 0

Bank Of America To Launch Internet Banking System 12/02/96
by reagle＠rpcp.mit.edu 17 Dec '03

17 Dec '03

TOKYO, JAPAN, 1996 DEC 2 (NB) -- By Martyn Williams. Bank of America is due to offer its credit card customers the ability to perform basic account transactions via the Internet next year. The bank will be using a system currently under development by Hitachi Ltd. and Bank of America subsidiary Concorde Solutions, a Hitachi spokeswoman confirmed to Newsbytes today. "The new system will enable credit card transactions via the Internet," said Hitachi's Emi Takase. "Bank of America is aiming to market the system from August, 1997." Customers should be able to check credit card balances and account details, apply for credit limit increases, and many of the other actions that a telephone is currently used for. Concorde Solutions, a company 70 percent owned by Bank of America, will develop the application for users with Hitachi. It will run on top of the Japanese company's TP Broker system, an object request broker that was developed with Visigenic Software Inc. Launch customer for the system will be Concorde parent Bank of America, but plans are for the system to be marketed to other banks. "The product will be sold by both companies afterwards," said Takase. (19961202/Press contact: Emi Takase, Hitachi Ltd., +81-3-3258-2055, fax +81-3-3258-5480, e-mail emi(a)cm.head.hitachi.co.jp; Reported By Newsbytes News Network: http://www.newsbytes.com) -- C O P Y R I G H T * R E M I N D E R This article is Copyright 1996 by Newsbytes News Network. All articles in the clari.* news hierarchy are Copyrighted and licensed to ClariNet Communications Corp. for distribution. Except for articles in the biz.clarinet.sample newsgroup, only paid subscribers may access these articles. Any unauthorized access, reproduction or transmission is strictly prohibited. We offer a reward to the person who first provides us with information that helps stop those who distribute or receive our news feeds without authorization. Please send reports to reward(a)clari.net. [Use info(a)clari.net for sales or other inquiries.] Details on use of ClariNet material and other info can be found in the user documentation section of our web page: <http://www.clari.net>. You can also read ClariNet news from your Web browser.

1 0

Re: [crypto] Avatar Protection?
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

Even with a custom client, I suppose there's always a chance of pulling things out of RAM. How about a slightly different question: Is there a way to sign it such that it wouldn't work if the signature was removed, so there would be no question of who created it? I suppose this is analogous to: Is there a way to sign plaintext such that the plaintext can't be seen without the signature attached? I suppose not.. Is there a way to embed the signature as part of the code so it can't be removed? Ryan ---------- Previous Message ---------- To: Ryan.Russell cc: cypherpunks From: deviant @ pooh-corner.com (The Deviant) @ smtp Date: 12/05/96 04:24:15 AM Subject: Re: [crypto] Avatar Protection? -----BEGIN PGP SIGNED MESSAGE----- On 4 Dec 1996, Ryan Russell/SYBASE wrote: > A graphic-designer friend of mine and I were talking > about VRML avatars, and custom design work, and > could he offer a service designing them etc... > > His worry is that since everyone in the same virtual > environment as his customer would see the designer > avatar, wouldn't they also be able to easily rip off > his work? (or his customer's property, take your pick.) > > I wasn't sure...it seems to me that I read something vaguely > along these lines for a cryptography protocol of some sort.. > The problem is this: Is there a way for a user to "view" the client's > avatar (and in this sense, the user usually has to receive a copy > of the code to render the avatar and render it on the local machine) > but not save a copy? Assume that a client with no save feature > is not a viable option...too easy to work around. Well, its concievable to write your own client, and make the code such that it only works with that client... I know, it kindof sucks, doesn't it? > > I suppose an analogy would be: Is there a way for a person to > see the plaintext, but not record it? I think that question really > answers itself - no. How about alternatives? If the server > of the environment only renders "views" (say, certain angles, or > a bitmap) of the avatar, rather than sending the description file? > > Any other thoughts? > > Ryan > --Deviant PGP KeyID = E820F015 Fingerprint = 3D6AAB628E3DFAA9 F7D35736ABC56D39 "First things first -- but not necessarily in that order" -- The Doctor, "Doctor Who" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMqZOczCdEh3oIPAVAQHEAwf+IZ4KzMjcmb8t/HTMBvp83ChZ0VLS6xa3 +OwtpvkVGnuD4AJ+ayvDS10u4oAx78OillYDPolz6Gpnv0L+KDseo0sz7Yhgvepp HwUw4UqMDBu9BMfkITFs6IS773EIgC8JmIf8/u6xEH/tvUjl44RQlgX+YE1Ybhvq cGo3dF60fdiYzmoYvYESrMo9ldr97bImSjUE46bd4ZrtHjVTqDB75r9Uhb38SPWD SdEi6rdC4sX1dY9zdJHIruhIM5BBpZcHX9Vo8cOSvzZY1s7rHXVQgb34rIcUcx7T 2GJTeJsTS2boi9O0urkKW8FIZtq82AnBk5WsavRtEIw0O5pC0jhR2g== =aWWo -----END PGP SIGNATURE-----

1 0

Codebreakers on the shelves!
by Alan Olsen 17 Dec '03

17 Dec '03

The Codebreakers by Kahn is available at some stores. (Powell's Technical books in Portland, OR has copies. It is right next to Applied Cryptography.) It has not filtered down to some ordering systems, so some bookstores claim it is out of print. Warning: The book is $65.00 hardbound! (It is also *NOT* a small book. It is large. About 2000 pages by my guess. (Maybe more. I was being pulled out of the bookstore at the time. My wife was trying to save me from the evil mind control rays of Powell's Tech books.) I know what is on my shopping list for Christmas. --- | "Spam is the Devil's toothpaste!" - stuart(a)teleport.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

2 1

HP
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

> HP UNVEILS NEW CRYPTO CONTROL FRAMEWORK > > Hewlett-Packard announced a new framework technology designed to let > governments enable and disable strong cryptography products. The > framework is independent of the method used in a given product. The > heart of the system is a small, tamper-resistant module with the > cryptographic algorithms that remain dormant until activated. A policy > activation token (basically some key bits) can be used to choose > between the various crypto algorithms stored on the module. The HP > press release makes this sound like the greatest thing since public > key encryption, but in reality it appears to be just another attempt > to insert government control into private data exchanges. Look for > legislative attempts to make this technology mandatory on all > encryption products. Technology details are at the site. > <URL:http://www.dmo.hp.com/gsy/security/icf/main.html> > > > > NETSURFER DIGEST (c)1996 Netsurfer Communications, Inc. > All rights reserved. > > NETSURFER DIGEST is a trademark of Netsurfer Communications, Inc. > -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Internet & Intranets 91 11 2233328 | - Web Development & PERL 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - (Networked) Multimedia

1 0

Nice use of crypto...
by Adam philipp 17 Dec '03

17 Dec '03

While browsing for some JAVA material I can across the following article that seems like a real nice application of crypto. What is it? Oh, you can just click on the URL and find out... its 4am and I'm too tired to give a precis. http://www.javaworld.com/javaworld/jw-12-1996/jw-12-int.property.html Adam, Esq. -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\ | My PGP key is available on my |Unauthorized interception violates | | home page: http://www.rosa.com |federal law (18 USC Section 2700 et| |=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|seq.). In any case, PGP encrypted | |SUB ROSA...see home page... |communications are preferred for | | -=[ FUCK THE CDA]=- |sensitive materials. | \=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-/ If A is a success in life, then A = x + y + z. Work is x; y is play; and z is keeping your mouth shut. Albert Einstein (1879-1955)

1 0

Re: Laptops, TEMPEST, chewing gum, and baling wire
by Alan Olsen 17 Dec '03

17 Dec '03

At 02:18 PM 12/5/96 -0800, Timothy C. May wrote: >At 11:52 AM -0800 12/5/96, Alan Olsen wrote: > >>Now the truly paranoia will not only cover their heads with tinfoil, they >>will cover their laptops as well. > >Just be careful to remove the tinfoil prior to leaving the country. As you >know, tinfoil is an ITAR-controlled item. "Curses! Foiled again!" --- | "Spam is the Devil's toothpaste!" - stuart(a)teleport.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0

New DCSB list for announcements
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Thu, 5 Dec 1996 15:38:01 -0500 (EST) From: Rich Lethin <lethin(a)ai.mit.edu> To: dcsb(a)ai.mit.edu Subject: New DCSB list for announcements Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Rich Lethin <lethin(a)ai.mit.edu> By request, I've created a new DCSB mailing list, dcsb-announce(a)ai.mit.edu which will be for DCSB-related announcements, only. The ability to post to the list will be restricted by Majordomo. Subscriptions are for folks who can't/don't/won't paw through the talk on the normal DCSB mailing list and digest, but would like to hear about upcoming lunches. Because the lunch announcements will be sent to both the dcsb-announce and dcsb lists, there's no need to be on both. To subscribe, send an email To: dcsb-announce-request(a)ai.mit.edu Subject: irrelevant subscribe Rich ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: Laptops and TEMPEST
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:44 AM 12/5/96 -0800, stewarts(a)ix.netcom.com wrote: >Take a basic television with big rabbit-ear antennas. >Tune to the football game on Channel 6. >Take your AT&T Globalyst 250P (which is a gray NEC Versa with a Death Star), >with the 16-million-color 640x480 screen in 65536-color mode, >and pop up a DOS command window in white-on-black. >Type a few lines of text, then look at the TV. > >The sync wasn't quite right, but there were about three copies of >my DOS window. It may have been scrolling slowly vertically or horizontally, >but it was relatively readable given the lack of resolution of the screen. >A good receiver run by a Bad Guy ought to be able to set its scan rates >correctly to pick up the screen at better resolution. >There are obviously more variables to be explored, but other people >who were present at the time considered the football game to be >more important :-) Wow! I am amazed the FCC has not come down hard on AT&T for something that noisy. (I have run my system with an open case and never gotten interference that bad.) <paranoia> Or maybe it is a plot to keep an eye on Matt Blaze. ("Here... Have this free company laptop!") </paranoia> Now the truly paranoia will not only cover their heads with tinfoil, they will cover their laptops as well. But seriously, it does not sound good. I know there is specialized equiptment used by ham radio operators to locate leakage of radio frequencies. Maybe someone could use it to find who the worst offenders are and how bad the problem is. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMqb8n+QCP3v30CeZAQEe5gf/WWxP6BSq17o9OPUXu2bu4DNPldb42CpB 2QHFs2N3VKymiOa1wQH7E4XyeKZzsZQdt8d6fpl12t+jMS9XqMi+2uaQNQ9IeMDG UVAc04La/MTVCeL+SkxZUfHSp618cB/QNRT9l7MpcplfCmnhODNx06i9De7MDfnc 4zSRLMZ0mXzoOl0tKunRGSGKDVn5Yh/3Lxdk2KwR3ITUrhiENowEvBaLithv5jYG GXdUzQwoMfEZ+rHhHJuXB0TQT4KtyrsnpNLrkH2h16j2kIp9fO05+mh9Ef2UYWgo TeIiHal3BjZ537hmF2JpUd7ShJYhooDrKOHRXAoaMhg5ny87FTtq4g== =Las6 -----END PGP SIGNATURE----- --- | "Spam is the Devil's toothpaste!" - stuart(a)teleport.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

2 1

Laptops and TEMPEST
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>Not to mention the point that an external attacker--say, the NSA van parked >across the street--will under no circumstances be able to measure "the" >spectrum: his antennas cannot possibly measure the signals (at the lower >bits) seen by the FM receiver, noise source local to the computer, whatever. Tim was talking about the Bad Guys setting your radio noise generator, but the other side of the coin is TEMPEST - making sure your computers don't emit enough radiation for Bad Guys to read it. CRTs are well known as emitters of easily decoded signal, but people have occasionally suggested on this list that laptop LCD screens are much quieter. I now have a data point on this one, and basically, it ain't so. Take a basic television with big rabbit-ear antennas. Tune to the football game on Channel 6. Take your AT&T Globalyst 250P (which is a gray NEC Versa with a Death Star), with the 16-million-color 640x480 screen in 65536-color mode, and pop up a DOS command window in white-on-black. Type a few lines of text, then look at the TV. The sync wasn't quite right, but there were about three copies of my DOS window. It may have been scrolling slowly vertically or horizontally, but it was relatively readable given the lack of resolution of the screen. A good receiver run by a Bad Guy ought to be able to set its scan rates correctly to pick up the screen at better resolution. There are obviously more variables to be explored, but other people who were present at the time considered the football game to be more important :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk # (If this is posted to cypherpunks, I'm currently lurking from fcpunx, # so please Cc: me on replies. Thanks.)

3 2