December 2003 - cypherpunks-legacy

DCSB: Risk Management is Where the Money Is; Trust in Digital Commerce
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 X-Sender: rah(a)pop.sneaker.net Date: Thu, 15 Oct 1998 11:01:58 -0400 To: dcsb(a)ai.mit.edu, dcsb-announce(a)ai.mit.edu From: Robert Hettinga <rah(a)shipwright.com> Subject: DCSB: Risk Management is Where the Money Is; Trust in Digital Commerce Cc: Dan Geer <geer(a)world.std.com>, Terry Symula <symula(a)ma.ultranet.com>, "Heffan, Ira" <HEFFAN(a)tht.com>, Roland Mueller <roland(a)secunet.com> Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Robert Hettinga <rah(a)shipwright.com> -----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston Presents Dan Geer Senior Strategist and VP, CertCo, Inc. Risk Management is Where the Money Is Tuesday, November 3rd, 1998 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA The focus of "security" research today is the study of "trust management," i.e., the study of how trust is created, propagated, circumscribed, stored, exchanged, accounted for, recalled and adjudicated in an electronic world. This is both natural and mature -- natural because security is a means and not an end, mature because security technology must differentiate along cost-benefit lines. All the security technology that you can buy today enables some aspect of trust management and the academic and entrepreneurial segments alike are busy supplying many novel ways to propagate trust. They have it all wrong. Trust management is definitely exciting, but like most exciting ideas it is not important. What is important is risk management, the sister, the dual of trust management. And it is risk management that is the part of financial services that will drive the security world from here on out whether you realize it or not. Dan Geer is VP and Senior Strategist for CertCo, Inc., market leader in digital certification for electronic commerce. Dan has been at a number of security oriented startups in the Boston area since leaving academia where he was Manager of Systems Development for MIT's Project Athena. He holds a S.B. in EE/CS from MIT, and a Sc.D. in Biostatistics from Harvard. He was deeply involved in medical computing for fifteen years. A frequent speaker, popular teacher and member of several professional societies, he has been active in USENIX for some years at the Board level. His recent publications include "The Web Security Sourcebook" (Wiley, 1997) and the security chapter in Leebaert's "The Future of the Electronic Marketplace" (MIT, 1998). This meeting of the Digital Commerce Society of Boston will be held on Tuesday, November 3, 1998, from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, on One Federal Street. The price for lunch is $32.50. This price includes lunch, room rental, various A/V hardware, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men (and no sneakers or jeans), and "appropriate business attire" (whatever that means), for women. Fair warning: since we purchase these luncheons in advance, we will be unable to refund the price of your lunch if the Club finds you in violation of the dress code. We need to receive a company check, or money order, (or, if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, October 31st, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston", in the amount of $32.50. Please include your e-mail address, so that we can send you a confirmation If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Upcoming speakers for DCSB are: December Joseph DeFeo TBA January Ira Heffan Internet Software and Business Process Patents February Roland Mueller European Privacy Directive We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, <mailto: rah(a)shipwright.com>. For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . We look forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.5.5 iQEVAwUBNiYOVsUCGwxmWcHhAQFxUggAjVPIS2STdjusV7TZJd/VrrA9NOzw12al 9k9wFsEcWwvknad85QCiTY1Vkwa7hCakuH9YkU9BZlWLgNhpm0tBTZ/nkMjGRaaX 3V8d89CfjaXoMfxYEmL95Cm0HEND5hUFoSmlWPQUjvThcQwrbWzXubzsmPn0Jd7M kqUrp/oFmqv4XYjgFWQxIz6va4dB772fTKCCmGJankNYh/ho+/HWm0pasymTzl/b akPKYSnTgCNQrUqHy6zSJJiinrAWQkPYcEinWktnT/TJGU1DFuxciJzQhu1c1eVr 8xtkgPn86Rmz4HXKnLRRm+lTWOKAo6+IDR4N1vR38pCiHx4ySIQ+PQ== =/Xht -----END PGP SIGNATURE----- ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Commerce Undersecretary William Reinsch defends the governments encryption policy
by Ernest Hua 17 Dec '03

17 Dec '03

> We want to work through the market. What that means is, if the market > turns in unexpected directions, we have to be ready to re-evaluate our > policy. So I don't think you're going to see a "final" version > ever. As long as the market moves and changes, our policy will be > tweaked to accommodate what's happening. In other words ... If we don't approve, it's time to go back to ITAR and 40-bits. > I don't think they're doing it just because the government asked them > to; they're doing it because they see a market. In addition, in the > spring the FBI and the Justice Department asked companies to come in > to see if a technical solution could be found to deal with these > issues. Companies have done that, too. It must be nice to be able to pressure and threaten companies behind the scenes and then come out to the public to say that they are "cooperating" or "volunteering". > At the same time, of all the economic sectors in the country, this > one's moving the fastest. There's a real danger that, if we can't get > our policy together and out there in the marketplace soon, we could be > overtaken by events overseas. In other words, "all this time we've been denying that there was overseas competition, well, we were lying through our teeth." "And that thing with the EU complaining about Echelon and the Germans trying to head up the Europeans to bust ITAR/EAR ..." Oops! Can't say the "E" word in public because "nobody" knows about that! > I think you have to contrast that situation, which was reasonably > artificial, with the reality of law enforcement. In this case, it took > a decent amount of resources to crack a specific message that, I > believe, the people doing the crack knew was in English, and knew was > one message. Must be nice not having real technologists pointing out blatant flaws/lies in your public statments. > Now, if you're the FBI, think about that. From their standpoint, we're > talking about traffic that isn't so easily identifiable. It might be a > long stream of encrypted material that they're trying to intercept in > real time; they don't necessarily know what language it's in; they > don't necessarily know what Sure ... if the FBI were really stupid ... and the FBI didn't really want to do any homework, but instead, would rather have NSA's dictionaries do the walking ... encryption would be a real bitch, wouldn't it? Even 40-bit. Ern

1 0

FBI Affidavit on Ex-NSA Cryptanalyst
by John Young 17 Dec '03

17 Dec '03

We offer the FBI's 23-page affidavit of charges against David Sheldon Boone, ex-NSA cryptanalyst who allegedly passed top secret SIGINT, EW and nuclear targeting plans to the Soviets: http://jya.com/dsb100998.htm Tantalizing hints on means and methods, quoting the affidavit of the FBI agent in charge: On one occasion, "Igor" [Soviet agent] told BOONE that the KGB/SVRR had access to United States Signals Directive (USSID) Zero, which was an index of all other USSIDs, and from this index IGOR asked BOONE to obtain specific USSIDs. I have ascertained that USSIDs are classified NSA publications for use in providing Signals Intelligence (SIGINT) support to the United States military. BOONE told the OA [FBI Operational Asset posing as Soviet agent to set up Boone] that he had given "Igor" a photocopy of an NSA document entitled "United States Signals Intelligence Directive (USSID) 514," dated May 6, 1988. BOONE told the OA that this USSID was unusual because it was one of few USSIDs to be classified TOP SECRET rather than SECRET. BOONE told the OA that USSID 514 was not widely disseminated but that one copy had been at USAFS Augsburg. And more on Boone's training and duties in cryptanalysis at Fort Meade and in Germany. Bad Ausburg is the location of one of the NSA intercept stations for the Echelon program is it not?

2 1

mail2fax remailer capability?
by Adam Back 17 Dec '03

17 Dec '03

I am noticing the odd free email2fax "your fax was sent successfully" report in the dud messages sent to (the non-replyable) nobody(a)remailer.ch. Warming to the heart that -- anonymous fax. Now I am wondering what the coverage is like on fax gateways -- it clearly only is going to work in places where there are free local calls, for numbers counting as local to the gateway. Just thinking it would be kind of nice if one could send a message To: +1.234.567.891-mail2fax(a)anon.lcs.mit.edu via mixmaster and have it sort out the delivery if possible to mail2fax gateways operating with local calls in that area code. (Analogously perhaps to the auto USENET posting from those remailers with this option turned on -- that is either direct (remailer posts) or indirect (forwarded to a mail2news gateway)). Has anyone come across any mail2fax site which tries to keep track of other free fax services and forward faxes to one in the right area? ('Course if we could get some damn working ecash, we could fax it anywhere -- sender pays:-) Next stage -- anonymous voice mail delivered via voice modem / soundcard, all via mixmaster, that would be nice! Adam

2 1

Re: Commerce Undersecretary William Reinsch defends the governments encryption policy
by Ernest Hua 17 Dec '03

17 Dec '03

Michael, Absolutely! But I still really am hoping in desperation that some people in the main stream press would get a clue that this is all double speak, and that they are simply playing a game to buy time for their old system, and buy political wins for the next system. Heck, if I was in FBI/NSA's shoes, and this was the slimy game I see everyday in D.C., it would be the same game I play to get what I need. And I would be very irresponsible if I did not play the game, however slimy it is. The problem is that it seems like most of the public take speeches like the speakers are pretty much honest, when in fact, most of the time, they are playing spin control. I have no doubt the FBI/NSA are in trouble. Echelon (or whatever they call it) is in trouble. They are irresponsible if they did not fight to the end to preserve some of their multi-billion $$$ investment, but they are in dire straits if they are hoping for a second generation centralized scanning intelligence machinery like Echelon. My belief is that they have to gather automated intelligence from far more disparate and heterogenous (and possibly conflicting) sources in the near future, and find ways to make sense out of all of the data. But I think the intelligent observer would see that they have no choice because this technology .. I hate that word because people call some of the most simple and dumb stuff "technology" in order to make money from it .. this technology is impossible to control, which means that precisely the most important target worth going after will have plenty of resources to foil Echelon, but the people made most vulnerable (because of the regulations) are the common folks. THAT is what is pissing me off. If they have some effective way to regulate underground trade of encryption, then they would have a story to tell. However, the fact that most encryption get out of this country so darn fast (we're counting minutes now ...) means they are not even trying. Prosecuting that guy in San Jose is just nuts. Since when does prosecuting a legitimate business man will actually stop people, who firmly believing that they have some natural right to distribute encryption? And I must emphasize that my opinion has NOTHING to do with whether encryption SHOULD, from a social/political/legal view, be exportable or not. Ern

1 0

ATTENTION HOMEOWNER***FREE SERVICE***FREE SOFTWARE
by lewisantonio＠usa.net 17 Dec '03

17 Dec '03

ATTENTION HOMEOWNER***FREE SERVICE***FREE SOFTWARE Save Thousands of $$$$$ off your Mortgage without Refinancing! Cut years off your Mortgage without Increasing your Payments! Build Equity in your Home 300% Faster! Email: mailto:lewisantonio@usa.net For Instant Info. Visit: http://www.freeyellow.com/members/scrap64/page5.html

1 0

wtf...
by Secret Squirrel 17 Dec '03

17 Dec '03

Has this list server died or is it just me? it seems like the list has died or is it just slowly fading into oblivion? It seems as though the only people still posting come from some great spam factory in left field. Have all of the questions been answered? Is everyone happy with the encryption they have? Doesn't anyone have any new thoughts on export restrictions, hash implementations, or the like? I know that I'm still out here, is anyone else? Does this ring a bell? People must come and together deploy these systems for the common good. Privacy only extends so far as the cooperation of one's fellows in society. We the Cypherpunks seek your questions and your concerns and hope we may engage you so that we do not deceive ourselves. We will not, however, be moved out of our course because some may disagree with our goals. Who else is out there?

1 0

mail2fax remailer capability? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 15 Oct 1998 20:14:40 +0100 > From: Adam Back <aba(a)dcs.ex.ac.uk> > Subject: mail2fax remailer capability? > Has anyone come across any mail2fax site which tries to keep track of > other free fax services and forward faxes to one in the right area? It wouldn't surprise me any to find that Kinko's and other such chain print shops couldn't do that sort of thing. Now if they'd do it over the web.... > ('Course if we could get some damn working ecash, we could fax it > anywhere -- sender pays:-) Open a laundromat, at least one person here in Austin has begun providing smart-card/no cash services. > Next stage -- anonymous voice mail delivered via voice modem / > soundcard, all via mixmaster, that would be nice! An anonymous remailer which drove a multi-format/media database would be pretty nifty. Might find more than a few niche markets to dabble in as well. In a sense you'd have your own little one machine data-haven. ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: wtf...
by Mohammed Lazhar 17 Dec '03

17 Dec '03

hey Guys : I just subscribed to the list. I will be posting stuff soon Mohammed

2 1

RE: FYI: More on WebTV security
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: Pablo Calamera <pablo(a)microsoft.com> To: "'dstoler(a)globalpac.com'" <dstoler(a)globalpac.com>, rah(a)shipwright.com, mac-crypto(a)vmeng.com Cc: jimg(a)mentat.com Subject: RE: FYI: More on WebTV security Date: Thu, 15 Oct 1998 17:19:11 -0700 comments inserted, extraneous text deleted. > -----Original Message----- > From: dstoler(a)globalpac.com [mailto:dstoler@globalpac.com] > Sent: Tuesday, October 13, 1998 5:39 AM > To: Pablo Calamera; rah(a)shipwright.com; mac-crypto(a)vmeng.com > Cc: jimg(a)mentat.com > Subject: Re: FYI: More on WebTV security > > [stuff deleted] > The press release implies that there is secure end-to-end > email between two WebTV customers. The wording is somewhat ambiguous though it does have more of a bent on the security of the transport layer. Perhaps it could have been clearer and specifically said that messages where encrypted during transport using 128 bit encryption. > Perhaps I am overly cynical, but I am guessing that they are > using SSL (TLS) from a web based email application on the > client to WebTV's servers. I presume email data is decrypted > at the servers, then re-encrypted to the recipient when she > uses the WebTV client to read email. Close. We could not even export SSL (TLS) with 128 encryption in this scenario. We have a proprietary transport protocol that we use that employs 128 bit RC4. > This approach would allow access to private email at the > servers by WebTV employees or law enforcement agencies. > > Note the careful use of the phrases "unauthorized party" and > "without posing undo risks to national security and law > enforcement" in the press release. > > I believe that WebTV's email security is directly coupled to > their ability to establish and enforce good security policy > within their operation and the trustworthiness of the > employees who have access to sensitive data. Partially true. We believe a major component of our security is indeed in the encrypted transport of your email from the service through the internet, through a leased POP to your box. Our Privacy Policy and Terms of Service are available for your viewing. http://webtv.net/home/privacy_text.html http://webtv.net/home/tos_text2.html This level of protection goes beyond email to registration, preferences/setup, "favorites" etc... Virtually all communications with the WebTV service. > I am concerned that carefully constructed wording of > Microsoft's press release implies stronger email security > than really exists. I hope I am wrong. We believe that with the level of encryption and the quality of our network operations that we have the best level of privacy protection for our users of any online service. I agree that the carefully worded press release may imply more than what we got. But we are very happy with this initial step. It has taken a very long time just to get export approval for this architecture and we look forward to further relaxation of export controls so we can compete on even footing with our foreign competitors. Pablo > David Stoler > > > Key paragraphs from Microsoft's press release: > > WebTV Networks has been granted the first export license to > use strong 128-bit encryption for any user and any > application in Japan and the United Kingdom. So, for example, > an e-mail message with personal information sent from a WebTV > subscriber in Japan to a second WebTV subscriber in Japan > will be sent securely because there is no known technology by > which an unauthorized party could intercept and decipher it. > > Therefore, as part of the WebTV Network, the WebTV-based > Internet terminal (starting at under $100) is now the most > secure communications device available from a U.S. company. > > "WebTV Networks' export approval is a significant step for > industry and reflects the U.S. government's commitment to > promoting e-commerce abroad," said William Reinsch, U.S. > undersecretary for export administration. "The WebTV Network > provides secure communications for its customers and partners > without posing undue risks to national security and law enforcement." > > > --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1