December 2003 - cypherpunks-legacy

lambda 3.02 - Big Brother goes international
by owner-lambda-en＠freenix.fr 17 Dec '03

17 Dec '03

--- lambda 3.02 April 14, 1997 Sender: owner-lambda-en(a)freenix.fr Precedence: bulk * Private Communications Under International Scrutiny: --> Key escrow encryption: The OECD says no, individual countries endorse it --> A global pact for universal wiretapping gains ground in Europe, with support of the U.S. and other industrialized nations * Short-Circuits: --> Social security data causes privacy concerns in U.S., France * * * * * OECD tries to prevent privacy abuses on encryption policy The Paris-based Organization for Economic Cooperation and Development released on March 27 its "Guidelines For Cryptography Policy," after more than a year of intense talks between officials from the 29 governments (see http://www.oecd.org/dsti/iccp/crypto_e.html) Yet there was one pleasant surprise: the guidelines do not explicitly urge governments to establish "key escrow" encryption schemes, although individual countries will be able to act according to its own wishes, for "national security" purposes. According to the Washington, DC-based Electronic Privacy Information Center, among the eight basic principles adopted by the OECD, one is the rejection of key escrow encryption (see point 6, "lawful Access"). "The U.S. sought endorsement for government access to private keys. Initial drafts of the guidelines included this recommendation. The final draft does not. OECD countries rejected this approach," said EPIC. The good point is an "endorsement of voluntary, market-driven development of crypto products. The OECD emphasized open, competitive markets to promote trade and commerce in new cryptographic methods." However, the United States, France and Britain have taken steps to pursue key escrow schemes -- but northern Europe isn't signing on. * USA: From EPIC Alert 4.05: "The White House has released a new draft proposal on key escrow encryption to the Congress. The draft (dated March 12) is entitled the 'Electronic Data Security Act of 1997.' The legislation is the latest attempt to push forward the result the Administration sought to achieve with the failed Clipper Chip initiative -- ensuring government access to all encrypted communications through government-escrowed keys." Resources: http://www.epic.org/crypto/ http://www.cpsr.org/cpsr/nii/cyber-rights/web/crypto_amer.html * France: A decree that will clearly establish the next trusted third-party scheme for business and individuals has not yet been released by the government. Draft proposals (see lambda 3.01) mentioned certain "national" preferences for future TTP agencies. These proposals have divided government officials (it may be an obstacle to common-market principles covering the free flow of capital and workers in the European Union). And the OECD clearly states (see point 8, "International Cooperation") that: "In order to promote international trade, governments should avoid developing cryptography policies and practices which create unjustified obstacles to global electronic commerce. Governments should avoid creating unjustified obstacles to international availability of cryptographic methods." * Britain: The U.K.'s Department of Trade and Industry released its proposal last month on licensing encryption services. According to Ross Anderson, the famed Cambridge University-based cryptographer: "Their effect will be to ban PGP and much more besides," because licensing will be mandatory. An excerpt of the draft regulations say: "We intend that it will be a criminal offence for a body to offer or provide licensable encryption services to the UK public without a valid licence. [...] Public will be defined to cover any natural or legal person in the UK. [...] Encryption services is meant to encompass any service, whether provided free or not, which involves any or all of the following cryptographic functionality - key management, key recovery, key certification, key storage, message integrity (through the use of digital signatures) key generation, time stamping, or key revocation services (whether for integrity or confidentiality), which are offered in a manner which allows a client to determine a choice of cryptographic key or allows the client a choice of recipient/s." Anderson commented: "The licence conditions imply that only large organisations will be able to get licences: small organisations will have to use large ones to manage their keys (this was the policy outlined last June by a DTI spokesman). The main licence condition is of course that keys must be escrowed, and delivered on demand to a central repository within one hour. The mere delivery of decrypted plaintext is not acceptable except perhaps from TTPs overseas under international agreements." The DTI report: http://www.cl.cam.ac.uk/users/rja14/dti.html Other resources: http://www.cpsr.org/cpsr/nii/cyber-rights/web/crypto_brit.html * Scandinavia: Despite these measures, the Nordic countries meanwhile released user-friendly plans to offer a secure and non-escrowed electronic mail system, called the Nordic Post Security Service (Denmark, Finland, Norway and Sweden). Every Scandinavian citizen will soon be offered the possibility of opening an e-mail account using smart card technology that allows for digital signatures and strong encryption of up to 1024 bit-length keys, a high level security. The private key will be embedded on the card, and no TTP system is planned. * * * * * Europe is launching a universal wiretap network The British watchdog group Statewatch revealed confidential documents from the European Union's intergovernmental meetings that show a global wiretapping system is under way among Europe, the United States and other industrialized countries. Legally speaking, the resolution and memorandum agreed among the EU's 15 countries have not yet been accepted by national parliaments, so it has no value except as a clear and profound indication of political will. See the full report, archived on the lambda's server thanks to Statewatch: http://www.freenix.fr/netizen/swreport.html Tony Bunyan, the director of Statewatch, published a communique at the end of February explaining the basic purposes of the wiretap plan: -- fwd message -- "The Council of the European Union and the FBI in Washington, USA have been cooperating for the past five years on a plan to introduce a global telecommunications tapping system. The system takes advantage of the liberalisation of telecommunications -- where private companies are taking over from national telephone systems -- and the replacement of land/sea based lines and microwave towers by satellite communications. Telephone lines are now partly land-based or under sea or via microwave land-based towers but the new generation of telecommunications will be totally satellite-based." The EU-FBI initiative notes the demise of: 1. state-owned telephone companies 2. nationally-based telephone systems is concerned about: 3. the problems faced with intercepting "mobile" phones and encrypted communications and wants to ensure: 4. there is harmonisation of national laws on interception 5. to ensure that telecommunications provider business cooperate with the police and internal security 6. the equipment produced has standards which can be intercepted 7. as many countries as possible to sign up and thus create a de facto global system (through provisions of equipment etc to third countries). A related disclosure in a book by Nicky Hager shows that instead of "suspects" and "targets" the ECHELON system simply trawls the airwaves for "subversive thoughts" in written form and increasingly in verbal form. ECHELON is run under the 1948 UKUSA agreement by the US, UK, Canada, New Zealand and Australia." -- end of fwd message -- * * * * * Short-Circuits: Social security data causes privacy concerns in U.S., France The Internet site of the U.S. Social Security Administration was closed due to privacy concerns, in that it supplied information about an individual's personal income and retirement benefits, the Washington Post reported April 10. Abstracts from the Edupage press review: "The shut-down followed receipt by the Administration of a harshly critical letter written by a bipartisan group of legislators who said the site's security systems were inadequate. To obtain information, a computer user needed merely to supply a name, address, telephone number, place of birth, Social Security number, and mother's maiden name -- items that are available in many private databases." In France, the government adopted on April 2 a draft law that extends the use of social security numbers, known as NIR, to tax authorities (the French equivalent to the U.S.'s Internal Revenue Service). The NIR is one of the most sensitive pieces of social data in Europe, since it classifies individuals according to their place of birth and is linked to all social benefits files. Earlier attempts in the 1970s to extend the NIR to other parts of the government had failed. The government passed these measures officially to fight fraud in social benefits households (minimum salary, housing aid, family pensions, etc.). The national data privacy commission, the CNIL, along with the League for Human Rights, expressed great concerns about the plan, which, if implemented by parliament, could especially harm low-income people. --- end of lambda 3.02 --- www.freenix.fr/netizen/302-e.html Jerome Thorel, April 1997. English proof-reader: K. N. Cukier --- To unsubscribe the lambda bulletin, send to majordomo(a)freenix.fr the following command: unsubscribe lambda-en to subscribe: subscribe lambda-en <your e-mail> ###

1 0

Re: Bombing Denver? / Or: How Capt. Button Learned to Stop Worrying and Love the Bomb
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

snow wrote: > > > The story thus far: > > An United States A-10 warplane on a live bombing run breaks formation > > and spends the next hour flying toward Colorado. > > And the best explaination that the military can provide is that a > > U.S. warplane capable of doing major damage to a U.S. city just flew > > around for over an hour, with no way for the military to prevent it > > from bombing our citizens. > > The military tells us that a warplane approached some of the most > > sensitive military installations in the country, without being noticed > > or intercepted. > > Well, Considering that A-10's can fly comfortably in "ground clutter", > or "trees" as civilians call them, it isn't suprising to me that they > couldn't track the fucker, and it is my firm belief that if the pilot > had wanted to dump his paylod over denver, coffin makers would be on overtime > right now. So you are basically claiming that Jim Bell's AP system opens the door for U.S. military personnel to participate, given the fact that U.S. defences are incapable of screening the mentally unstable from having possession of the latest in hi-tech armaments, or stopping them if they should choose to pick up a little cash on the side? Does your "firm belief" account for the fact that, upon changing direction near the end of the flight, as if in a bombing run for Denver or Vail, the A-10 suddenly reversed direction, as if taking evasive action, and then circled back to resume it's run, before disappearing? Even giving the least threatening scenario, that the pilot went for an innocent joyride and ran out of gas, it astounds me that the media could just wholeheartedly embrace the military's limp explainations of the fact that an armed warplane could wander at will through some of the most sensitive military areas in the country, and not bring this to the public's attention. Perhaps the bars and lounges that the news media personnel relaxed in during Desert Storm, while feeding the public the military's press releases verbatim were disassembled and moved to the U.S. It would be a shame if the media raised troubling questions in regard to this affair and the Pentagon raised the price of drinks in the media lounge. TruthMonger

1 0

Re: Bombing Denver? / Or: How Capt. Button Learned to Stop Worrying and Love the Bomb
by Toto 17 Dec '03

17 Dec '03

Timothy C. May wrote: > The A-10 is believed by Reliable Sources to have been on its way to bomb > the Federal Building, while the McVeigh trial was starting, in Denver. > > (I'm on some strange lists and can't vouch for this revelation.) Which begs the question, "Would those lists be strange if you 'weren't' on them?" (Sorry, I couldn't help myself...) -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

2 1

Re: anonymous credit
by Toto 17 Dec '03

17 Dec '03

Hal Finney wrote: > > Here is a simpler example of Wei's anonymous credit idea. We can call it > the "borrowing cryptographers". Hal, I have been following this thread with interest (no pun intended), and have had the foresight to not add to ideas that go beyond my own ability to follow. (I have to read your posts several times to even begin to grasp some of them.) I am wondering what other concrete examples you might be able to add to the one in this post which might point to an actual funtional implementation of the ideas you have been promulgating. Many of the CypherPunks discussions involve largely theoretical concepts which need much development to be practical, but it seems to me that in this post you are approaching a level where what you are discussing might actually be feasibly introduced in various microcosmic situations. Being a Canadian, and therefore semi-socialist by nature, I am thinking along the lines of Credit Union applicability of your ideas. Credit Unions often take the form of small groups of individuals or companies with common aims and/or backgrounds/interests. The basic idea behind many Credit Unions is that they are more prone to lend money to individuals or institutions which are promoting ideas which can be profitable, but which the average banker or loan agency would not understand sufficiently to advance money on. For example, having an interest in the issues you are discussing, I might be ameniable to getting involved in an effort to fund the development of the 'Hal-Wei Anonymous Credit' program. The advantage of a Credit Union setup is that I know that it is run with an eye to realistic chances of success being considered, but also will take into account efforts that should be funded which may have only a marginal chance of financial success, but will further the general cause of those things I am interested in. Truly there are a rising number of issues today which might benefit from the ability to participate anonymously in the funding of causes in which one has an interest. While AP is one of the more startling and newsworthy (?) aspects of anonymous lottery/credit systems, there are a multitude of minor causes which might benefit from the ability to engage in an anonymous credit system, as well. A simple example might be those who wish to financially back a legal challenge of their health-care system, without risking being denied benefits as a result of their participation. I think that some of the CypherPunks' contributions to computer technology go largely unrecognized because of the fact that they aide those who do not wish to draw attention to themselves, for the most part. There isn't a week that goes by without my receiving an email from someone who thanks me for the benefit they have gained by my introducing them to encryption or anonymous remailers, yet I doubt that many of them give the same feedback to those who provide those services. Remailer operaters seem to mostly receive shit and abuse for feedback, as a result of their efforts, yet I know from experience that there are many to whom their services have been a blessing. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

5 12

Digi-Cash IPO! $1.60 per share
by chairman 17 Dec '03

17 Dec '03

Greetings: Our market research indicated that this information may very well be very interesting to you! As you may know, initial public stock offerings confer upon QUALIFIED INVESTORS huge profit potential opportunities, IF they understand risk. Millennium Interactive Technologies Corp., developer of the first ever advertiser funded system of digital cash is offering 625,000 common shares directly to the public at $1.60 per share, with a 625 share minimum. MITNET is an E-commerce startup which will offer Digital Cash and a FREE smart card to every user who retrieves advertising E-mail from its Internet web site. MITNET DCUs (Digital Currency Units) can be redeemed to pay for your on-line charges, Or converted instantly into the currency of any nation. MITNET ad-mail is the future of Internet advertising! OFFERING CAN ONLY BE MADE BY WAY OF PROSPECTUS QUALIFIED INVESTORS of full age can obtain a printed copy of this offering prospectus, demo software, and the website URL, by sending a reply with name, street address, and day or evening phone number. (please specify) =================================================== This is neither an offer to sell, nor the solicitation of an offer to buy any securities. =================================================== Dislike commercial e-mail? Let us put you on our master *DO-NOT-MAIL* list which we supply to 400+ bulk e-mail firms. Simply reply with the word remove anywhere in your message. =================================================== mailto:ceo@mitnet.com

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"wazoo"} = "<remailer(a)wazoo.com> cpunk mix pgp hash latent cut ek"; $remailer{"shaman"} = "<remailer(a)lycaeum.org> cpunk pgp hash latent cut ek"; $remailer{"hidden"} = "<remailer(a)hidden.net> cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 14 Apr 97 6:46:43 PDT remailer email address history latency uptime ----------------------------------------------------------------------- nym config(a)nym.alias.net #-+#***##*-# 1:20:48 99.99% hidden remailer(a)hidden.net *+.-###*#*## 33:34 99.97% lucifer lucifer(a)dhp.com +++++++*--++ 37:43 99.96% weasel config(a)weasel.owl.de ++-++---+-+ 2:26:15 99.94% winsock winsock(a)rigel.cyberpass.net -------+--- 3:02:13 99.88% balls remailer(a)huge.cajones.com * #######*## 1:25 99.87% reno middleman(a)cyberpass.net -___.--*+-** 8:53:42 99.72% dustbin dustman(a)athensnet.com ----- .+-+- 1:22:31 99.67% cyber alias(a)alias.cyberpass.net + ++ +*++** 32:39 99.66% replay remailer(a)replay.com -.-*-**** +* 48:24 99.59% mix mixmaster(a)remail.obscura.com -__.--++*-+ 13:31:30 99.54% squirrel mix(a)squirrel.owl.de -+-++- -+-+ 2:21:21 99.45% shaman remailer(a)lycaeum.org ++*+-++--+** 23:01 99.35% extropia remail(a)miron.vip.best.com _..---...- 22:24:15 97.51% exon remailer(a)remailer.nl.com *#* *__ * ## 3:49:43 95.05% jam remailer(a)cypherpunks.ca ** ** 8:26 26.45% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: SSL weakness affecting links from pa
by ARTURO GRAPA YSUNZA 17 Dec '03

17 Dec '03

Tom Weinstein wrote: >This particular feature (the HTTP referer header) has nothing to do with >corporations "having their way" with users. It was created so that web >authors could put "back" buttons on their pages. The security problem >arises when stupid CGI authors use GET forms to transfer sensitive >information. This is a security hole in the web site, not in the >browser. The browser follows the HTTP specification. If you have a >problem with that, contact the author of that specification. Or, better >yet, contact the web site (as far as I know, there are none) that has >this security hole. Stupid programmers abound even in large corporations. Bugs, patches and security holes are now normal everyday things. I agree with Toto. Companies should take more responsability in the programs they produce. Especially nowadays when a lot of people without any computer background or insight into the dangers are accessing the Net. Why does Netscape (and microsoft) warn users about secure and insecure forms? So they can say "I told you so!" when you get screwed by someone. Same thing goes for the GET method. Whatever a "stupid CGI author" does has little bearing on the issue. It's like saying the tire fell off my car because the person who built the road to spec ("GET" is allowed) is to blame not the car maker. I should be warned about certain roads by the car maker. If "GET" is allowed but unsecure YOU should warn me! Admit it! It did not occur to your programmers to warn about access to "GET" forms like it occurred to them to warn about http references inside a https-accessed document. Now we have to live with it. And you say "stupid CGI authors". What if they did it on purpose? Are you going to say "then its stupid web users"? I'd really like to hear you say that in public! >In the eyes of some, the referer header is a privacy violation. It >allows a site to see what site you visited before coming there. In the >case of Navigator, we ONLY send the referer header when you click on a >link. Not when you select a bookmark. Not when you type a URL into the >location field. This allows web sites to see who links to them. I >think that's something that a web author is entitled to know. NO WAY! The web author is NOT entitled to know where I came from. So if you go to Sears the saleperson is entitled to know you came from JCPenney's? If so, then I am just as much entitled to not tell him or at least entitled to know that there's a sign on my back that says where I came from. How many web users are aware of the HTTP REFERRER header? Not many, especially if they have not read the specs or looked at the logs from a web server. As an adminsitrator I AM NOT ENTITLED to that info. >So, you think we're doing something bad. Why don't you tell me what >you think we should do? Accept responsibility? Ok, that's wishful thinking. How about not blaming others? How about warning your users? You didn't do it in this case. If you do then you can say "I told you so!" Art Grapa agrapa(a)banamex.com

2 1

RE: [PGP-USERS] SFS and PGP
by Alec 17 Dec '03

17 Dec '03

>From: "James A. Tunnicliffe" <jim.tunnicliffe(a)inference.com> >To: "'pgp-users(a)rivertown.net'" <pgp-users(a)rivertown.net> >Cc: "'GWNapier(a)aol.com'" <GWNapier(a)aol.com> >Subject: RE: [PGP-USERS] SFS and PGP >Date: Mon, 14 Apr 1997 07:21:52 -0700 >-----BEGIN PGP SIGNED MESSAGE----- > >GWNapier(a)aol.com says: >> Lately I have heard a lot about SFS. The bits and pieces I heard >> about it said it integrated PGP into it. If anyone knows about where >> I can get more info about, I would appreciate it. If SFS has nothing >> to do with PGP and I have heard wrong, I give you my deepest >> apologies for bringing it up on this list. > >Peter Gutmann's SFS (Secure File System) is a highly regarded program >for encrypting entire disk partitions at the sector level. It's a >low-level device driver that encrypts your disk writes and decrypts >your disk reads transparently on the fly, so your disk is always in >an encrypted state. Apart from being a quality encryption product, >it has nothing to do with PGP, secure email, etc. It's for a whole >different (though very valuable) purpose... > >For more information, see: > http://www.cs.auckland.ac.nz/~pgut001/sfs.html > >Tunny >====================================================================== > James A. Tunnicliffe | WWWeb: http://www.inference.com/~tunny > Inference Corporation | PGP Fingerprint: CA 23 E2 F3 AC 2D 0C 77 > tunny(a)Inference.com | 36 07 D9 33 3D 32 53 9C >====================================================================== > >-----BEGIN PGP SIGNATURE----- >Version: 4.0 Business Edition >Comment: Achieving civil liberty through complex mathematics > >iQEVAgUBM1I+iPAmQsmyRPddAQGltAf/Vsn7Mj9dJyl8za4gOcK8s5CbetyqPc2Z >giqxUr63ghdOSPhDYkRbfvroS6GrfVbTF4Gdhx7aZ+8J5FF5YXF1I1iHELkAJxTm >AFoErAkZZHLUH5D2RddV0dXJQBPFa0O2h8kxL8V24ktUnGyi5UOwXPoub9vwAVnM >+x1fu8J6/z8PkOLHOe/BczAUCRtgzHFD9XZ0wVSXQgLKgIkftxF5gfO/x0UM9w17 >rdiAx4QzLotwmUKKhVUVAm2glcvkRa0Zs0JQv5QdtVOvNCPSJpcz90yFqUbKiPJp >R0SQhcAmJveJMNEUoetQ68s3eMdoe1U0nGJOVg0tK5rdZzEDxyXxPA== >=XKVJ >-----END PGP SIGNATURE----- > >

1 0

Re: SSL weakness affecting links from pa
by ARTURO GRAPA YSUNZA 17 Dec '03

17 Dec '03

Re: SSL & GET I suspect that the pass-the-buck syndrome is in full force. If the specs authors should realize that programmers are going to code by them then shouldn't programmers realize that users are going to use their products? The user, the specification author, the browser manufacturer, the server manufacturer, and the content provider all share the responsibility. Just 'cause its in the specs doesn't mean (shouldn't mean) that everyone else can just wash their hands of it. There are stupid users, stupid specification authors, stupid browser manufacturers, etc. If the specs are not secure the user shouldn't use it, the manufacturer shouldn't code to it, etc. OR SHOULD THEY SHARE RESPONSIBILITY? I guess the real solution will come in court when someone tries to sue a content provider who tries to sue a server manufacturer who tries to sue a browser manufacturer who tries to sue a specs author. My concern is that the author of the comments, who works for Netscape by the way, is passing the buck on to the content provider. Its great policy for Netscape, bad policy Netscape's clients. Re: HTTP REFERER Useful? Yes. Entitled? NO. Art Grapa agrapa(a)banamex.com ---------- From: Eric Murray To: ARTURO GRAPA YSUNZA; AGRAPA(a)k2.banamex.com Cc: cypherpunks(a)toad.com; tomw(a)netscape.com; cryptography(a)c2.net Subject: Re: SSL weakness affecting links from pa Date: Monday, April 14, 1997 12:45PM Microsoft Mail v3.0 IPM.Microsoft Mail.Note De: Eric Murray Para: ARTURO GRAPA YSUNZA AGRAPA(a)k2.banamex.com Cc: cypherpunks(a)toad.com tomw(a)netscape.com cryptography(a)c2.net Asunto: Re: SSL weakness affecting links from pa Fecha: 1997-04-14 12:45 Prioridad: 3 Ident. del mensaje: 8C705E17CEB1D011AF91006097838CEB ----------------------------------------------------------------------- ----- -- ARTURO GRAPA YSUNZA writes: > > > Tom Weinstein wrote: > > >This particular feature (the HTTP referer header) has nothing to do with > >corporations "having their way" with users. It was created so that web > >authors could put "back" buttons on their pages. The security problem > >arises when stupid CGI authors use GET forms to transfer sensitive > >information. This is a security hole in the web site, not in the > >browser. The browser follows the HTTP specification. If you have a > >problem with that, contact the author of that specification. Or, better > >yet, contact the web site (as far as I know, there are none) that has > >this security hole. > > Stupid programmers abound even in large corporations. Bugs, patches and > security holes are now normal everyday things. I agree with Toto. > Companies should take more responsability in the programs they produce. No, specification authors should take more responsibility in the specs that they produce. The HTTP spec's use of GET is insecure. Specification writers should realize that people will follow their specs, and should be thinking of security and privacy issues as they are beig written. > >In the eyes of some, the referer header is a privacy violation. It > >allows a site to see what site you visited before coming there. In the > >case of Navigator, we ONLY send the referer header when you click on a > >link. Not when you select a bookmark. Not when you type a URL into the > >location field. This allows web sites to see who links to them. I > >think that's something that a web author is entitled to know. > > NO WAY! The web author is NOT entitled to know where I came from. So if > you go to Sears the saleperson is entitled to know you came from > JCPenney's? If so, then I am just as much entitled to not tell him or at > least entitled to know that there's a sign on my back that says where I > came from. How many web users are aware of the HTTP REFERRER header? Not > many, especially if they have not read the specs or looked at the logs > from a web server. As an adminsitrator I AM NOT ENTITLED to that info. Why not? It's a useful tool to find out who has linked to you. On the other hand, it _is_ a privacy concern, and I don't want to send it to sites I visit. So I included an option blocking the Referrer tag in Cookie Jar, the cookie-blocking program I wrote. I'd like to think that writing it helped push Netscape into supporting better options for cookies (see rfc2109) and into adding this option for not sending Referrer but I'm sure there were many other louder calls for the same thing. > Accept responsibility? Ok, that's wishful thinking. How about not > blaming others? How about warning your users? You didn't do it in this > case. If you do then you can say "I told you so!" Users need to educate themselves. Even a fairly security and privacy concious company like Netscape still has exectutives who feel as though they have to answer to the bottom line and who will sacrifice consumer privacy to get there if they feel that the advantages outweigh the risks. Netscape has consistently led industry in realizing and fixing and admitting security holes and privacy issues, largely due to the effort of Jeff and the rest of their security group in educating upper management on those issues and making them realize their importance. However I am not willing to bet my privacy on Netscape's good will, as it could turn at any time. The way to real privacy is to educate oneself. Demanding companies to "fix it" is lame and ineffectual. You have the technology- fix it yourself! Distribute your code. Make the companies look bad. Educate the sheeple. But asking companies to look out for your privacy is a waste of time. -- Eric Murray ericm(a)lne.com Privacy though technology! Network security and encryption consulting. PGP keyid:E03F65E5

1 0

Re: SSL weakness affecting links from pa
by ARTURO GRAPA YSUNZA 17 Dec '03

17 Dec '03

How about: "You are about to send a 'referrer header' telling the next web site about the web page you are currently looking at. Should <netscape> send this 'referrer header'? [Yes/No/Always Send Referrer Headers/Never Send Referrer Headers] [CHECKBOX] Don't ask again." ---------- From: bryce(a)digicash.com To: ARTURO GRAPA YSUNZA; Black Unicorn Cc: cypherpunks(a)toad.com; cryptography(a)c2.net; toto(a)sk.sympatico.ca; Tom Weinstein; Bill Stewart; Mark M.; ARTURO GRAPA YSUNZA Subject: Re: SSL weakness affecting links from pa Date: Monday, April 14, 1997 1:44PM Microsoft Mail v3.0 IPM.Microsoft Mail.Note De: bryce(a)digicash.com Para: ARTURO GRAPA YSUNZA Black Unicorn Cc: cypherpunks(a)toad.com cryptography(a)c2.net toto(a)sk.sympatico.ca Tom Weinstein Bill Stewart Mark M. ARTURO GRAPA YSUNZA Asunto: Re: SSL weakness affecting links from pa Fecha: 1997-04-14 13:44 Prioridad: 3 Ident. del mensaje: A0705E17CEB1D011AF91006097838CEB ----------------------------------------------------------------------- ----- -- A million monkeys operating under the pseudonym "Black Unicorn <unicorn(a)schloss.li>" typed: > > "You are about to forward a referer header to the page you have selected. > Forwarding the referer header to this site may reveal more about your web > browsing habits than you would prefer. Should <netscape> surpress the > referer header? Yes/No/Always Surpress/Never Surpress." Minor UI nit: it would be much much better if it said "You are about to send a 'referrer header' telling the next web site about the web page you are currently looking at. Should <netscape> send this 'referrer header'? [Yes/No/Always Send Referrer Headers/Never Send Referrer Headers]" Regards, Zooko Journeyman Disclaimers follow: I am not a cypherpunk. NOT speaking for DigiCash or any other person or organization. No PGP sig follows.

1 0