November 2004 - cypherpunks-legacy

1st amendment
by Major Variola (ret) 17 Nov '04

17 Nov '04

At 10:56 PM 11/16/04 -0500, R.A. Hettinga wrote: ><http://cbs11tv.com/localnews/local_story_317193815.html/resources_storyPrin…> >DALLAS SERVER COMPANY CARRIES ZARQAWI DEATH VIDEOS, TERRORIST WEBSITES Any State employee who attempts to oppress free speech, including video, deserves killing. Read the Bill of Rights. Any limitation on financial speech is dubious at best; however, one imagines that bandwidth is readily donated, for free, as in liberty, and beer, and code, and other forms of expression. Any private ISP is free to do as they please; however, when the State is involved, its minions must respect the BoR or expect a well-deserved visit from Mr. Soze, et al. Render unto Caesar, etc.

2 1

condosleeza rice
by Major Variola (ret) 16 Nov '04

16 Nov '04

Dangle da carrot and dem negroes go fer da bait. Dang they'll lie for you like nothin' and dey're disposable as well! Gawd I love da south! Its a shame, Powell won't run. Instead, Fascism needs you, or your children. And hey, if Arnie gets his amendment (snort), the Carcano needs dusting off, say what you will about Oswald's politics, or the quality of spanish bolt-actions, or Maria's grim-reaper physiognomy, where is Oswald's ghost when you need it?

1 0

CBS 11: Dallas Server Company Carries Zarqawi Death Videos, Terrorist Websites
by R.A. Hettinga 16 Nov '04

16 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 <http://cbs11tv.com/localnews/local_story_317193815.html/resources_storyPrin…> CBS 11 | cbs11tv.com DALLAS SERVER COMPANY CARRIES ZARQAWI DEATH VIDEOS, TERRORIST WEBSITES * THE PLANET.COM SAYS IT IS UNWITTING VICTIM, CAN'T POLICE ITSELF Nov 14, 2004 11:00 pm US/Central By Todd Bensman and Robert Riggs The Investigators CBS-11 News CARBONDALE, ILL. -- The grainy Internet movie file flashes a title: "Al Qaeda Movement in the Land of the Two Rivers. An Operation Against the British Troops Near Baghdad." The streaming online video clip shows a car as it motors slowly up a single-lane road, away from the cameraman who shakily zooms in as it gathers speed toward a British checkpoint. A caption appears, reading "Here goes the brave lion to tear up his prey and to win paradise." The cameraman is speaking in Arabic, his voice rising with "God is Great, God is Great" as the car at center screen arrives at the British checkpoint and a soldier standing in the road. Suddenly, a massive fireball of orange and black lashes upward and outward, instantly slaughtering him and wounding two other British soldiers of the Black Watch Regiment, along with the suicide bomber, according to later press reports. The Jihadists responsible are then filmed at the scene kicking a dismembered arm left behind by a recovery tank squad. This is a movie clip put up just last week by notorious terrorist Abu Musab al-Zarqawi's organization within a few days of the actual Nov. 7 attack. Sometime over the weekend, as CBS-11 aired promotions for this story, it disappeared with others of its ilk on an Internet server owned by an up-and-coming Dallas web site hosting company called The Planet. In downtown Dallas ((www.theplanet.com) Glorifying the slaughter of American soldiers and their allies in Iraq. Helping to enhance the global street credentials of Zarqawi among any like-minded person with access to a computer. Aaron Weisburd, a self-appointed cyber warrior who since 2002 has run a crusade called Internet Haganah (www.Internet-Haganah.us) to shut down these so-called "e-jihadists," is the one who tracked the movies to Dallas. And in recent weeks, Weisburd has discovered that Zarqawi's home movies on The Planet servers have plenty of other bad company in Big D. The Planet's Dallas servers have in recent months hosted web sites run by Islamic extremist organizations the U.S. government has long since banned as Designated Terrorist Organizations - three different Palestinian Islamic Jihad promotional sites and Hamas' monthly news magazine. Two Hamas websites and two Al Quaeda websites remain on The Planet's servers, according to Internet Haganah. For the past two and a half years, Weisburd and his Internet Haganah (www.haganah.us) volunteer translators and analysts across the globe have been using a tracking program he devised to expose the presence of extremist outlawed Jihadists and hound them off the Web by asking the server companies to drop their business. A former computer programmer, Weisburd started chasing after e-jihadists on a lark and soon realized that literally thousands of extremist Islamic web sites were out there in cyberspace, beckoning to millions of Muslims around the world to join their bloody causes. "Every moment that these sites are up they encourage jihadists to commit acts of terrorism," Weisburd told CBS-11 News in his first interview with an American media organization. "They provide instructions to people in how to do things like build bombs. They build identity and a sense of community. They incite violence. They encourage people to go out and kill people. "I'm of the opinion that one ought not to just sit there and tolerate terrorists advertising their organization," he said. "They're not just some other organization. They're not a humanitarian organization. They're not a corporation. They're terrorists. They're in the business of killing people. They shouldn't be allowed to enjoy that kind of legitimacy." - From his home office in the southern Illinois college town of Carbondale, Weisburd has found sites in Dallas literally singing the praises of suicide bombing, sporting photo memorials of martyrs and promoting their bloody, violent causes. Working internationally, he claims his efforts have knocked down more than 550 extremist web sites. Sometimes, he said, service provider companies resist but most do not want to be associated with terrorists. "My guess is that in the grand scheme of things one bad customer isn't worth nearly as much as all the good customers you want to keep who don't want to be associated with this stuff either," Weisburd said. "I mean, do you really want to be known as associated with terrorists?" Most of the time, the giant service providers do not know what kinds of web sites they are hosting until someone complains. Such companies typically sell wholesalers their web space and those wholesalers in turn contract much of the business with the public, with just about anyone who offers a name and a credit card. Under federal law, it is illegal for any American company to knowingly do business with a designated terrorist organization without reporting it, although federal prosecutions are considered difficult to bring to fruition across multiple international jurisdictions. Federal prosecutions also are difficult because straw purchasers several steps removed from a terrorist group who might secretly buy the web sites can be difficult to directly link to terrorist organizations. The First Amendment otherwise protects even most hate speech from prosecution, limiting what the government can do but certainly not what civilians like Weisburd can do. Which is to track down the e-jihadists wherever they may turn up, report their new presence and have them thrown off the Web until they pop up again somewhere else. Weisburd said his computer programs constantly prowl the World Wide Web for more than 200 web sites in his growing database, keeping them ever on the run. Weisburd and the estimated 30,000 Internet Haganah followers who see his regular reports on the whereabouts of Islamic extremist websites said he couldn't yet claim credit for shaming the five web sites he knows of off the Dallas servers. In September, three Palestinian Islamic Jihad web sites he had shut down in Switzerland showed up on The Planet's servers in Dallas. Weisburd said he reported their resurfacing to his Internet Haganah readers and moved on to other business. The three websites have since disappeared but Weisburd isn't sure of what happened. The Planet executives declined requests for on-camera interviews but said in telephone conversations that the company simply does not have the ability to police for Islamic extremist material among the 1.5 million web sites and 20,000 customers. The web sites appear to violate content that is banned by The Planet's own acceptable use policy. More than a week after CBS-11 informed Chief Operating Officer Lance Crosby of a Hamas magazine web site, www.fm-m.com that were operating off of his servers, it remained online. Hamas, which was designated a terrorist organization in 1995, has taken credit for years of suicide bombings that have claimed the lives of hundreds of Israeli civilians and at least ten Americans. An email request for interviews at the website went unanswered last week. But former federal prosecutor Matt Yarbrough, now a private attorney specializing in cyber law, said server companies like The Planet can easily and cheaply patrol their servers. "There would have to be a social sort of outcry or decision here on the part of the service provider to want to do this, but it is technically possible," Yarbrough said. "All they would have to do is basically run a string search across its own server farm to look at the content of each one of these web sites, whether it's a key word, or terrorism, or bomb, or Holy Jihad." Yarbrough said service providers who choose not to police for extremist Islamic material risks civil liability should anyone ever be injured or killed as a result of Internet encouragement. "Victims of terrorist attacks are not going to be suing terrorists; they're going to be suing deep pockets right here in the United States that played some role, even if it's very tenuous to what happened in the act of terrorism," Yarbrough said. Mark Briskman, head of the Dallas area chapter of the Anti-Defamation League, said his organization was "saddened to know that a company in Dallas is hosting hate materials and hope they take actions against any sites that violate their rules." "This is not an issue of freedom of speech," Briskman said. "Rather, a company can choose with whom they wish to do business and hold the right to terminate that business relationship. " Meanwhile, macabre new video clips continued showing up on The Planet servers last week, posted there by Zarqawi's organization, Weisburd said. They included a video clip entitled "Smoke 'em Out" showing American soldiers putting out fires from a car bomb attack somewhere in Iraq. The video then shows footage of a dead U.S. soldier, accompanied by the caption "The picture of a U.S. soldier who was killed in the explosion." A smiling Iraqi man is shown proudly holding a torn American combat boot. Weisburd said he discovered the video clips on the Dallas server while patrolling a highly restricted Al Qaeda discussion forum where Zarqawi's personal spokesman often posts messages about the group's latest terror attacks. After the suicide bombing that killed the British soldier, Weisburd said, the terrorist spokesman posted a message in the forum claiming credit and promising to post proof soon. The next day, Zarqawi's spokesman announced the proof and provided a link to the video of the exploding car bomb, on The Planet.com. Asked how he would like The Plant to respond, Weisburd said, "I would hope that they would contact their customer whose site is being used to host that film and that their customer would respond by suspending that account. "The Planet is not profiting from this hardly at all. Being a step or two removed from the paying customer, there's really very little interest for them," he said. "But they have a lot to lose in terms of simply business reputation. " As in any war, even in cyberspace, those who shoot are liable to be shot at. And figuratively, Weisburd, who is Jewish, has taken plenty of shots from the e-Jihadists who have come to hate him and the trouble he causes. "Web sites are central to their identity. It's a window on their soul," Weisburd explained. "They associate with these sites in a very personal way. And so, when you cause one of these sites to be shut down you cause them personal pain. They'll find their sites down and go to my site and find out it was me." Haganah is a hebrew word meaning "defense" and became potent when it was chosen as the name of Jewish defense militias that fended off relentless Arab attacks on settlements before Israel's 1948 establishment. The Haganah was precurser to today's Israeli Defense Force. Internet Haganah's persistence has drawn repeated counterattacks from Islamist website forums and chat rooms. Posters urge Muslim hackers to attack Weisburd, and they have succeeded on a number of occasions of shutting him down, albeit temporarily. "They just generally call me 'That Jew,' Al Yahood," he said. "In Arabic, calling somebody a Jew is as bad as it gets." Physical threats of violence are not uncommon, either. Most recently, Weisburd received a letter from someone in Cherry Hill, N.J. threatening that they would cut his head off if he did not stop the cyber warfare. But Weisburd, who keeps loaded firearms at hand at all times, says he is ready for them and will keep the pressure on. "I'm in-your-face," he said. "It's important to confront them as it would be any thug. The way you deal with people like them is you stand up and fight them. You don't run away and hide. "You don't let them control the battlefield, and you don't let them take advantage of your own networks in order to destroy your own society." For more information about what you can do about Internet terrorism, contact www.Internet-Haganah.us. - -- - ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' -----BEGIN PGP SIGNATURE----- Version: 1308 iQA/AwUBQZrPDsPxH8jf3ohaEQJ2LQCgySzPPx8aFoQeLvgVTxaVBrFeKWsAoIYb fUIpuf/XiBBXwGs+mvXxAKXM =zk6G -----END PGP SIGNATURE-----

1 0

[osint] Al-Qaeda propaganda website shut down
by R.A. Hettinga 16 Nov '04

16 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --- begin forwarded text To: "Bruce Tefft" <btefft(a)community-research.com> Thread-Index: AcTMRPaUQi8W4viLTUaHaDASsEmcWgAAM3oQ From: "Bruce Tefft" <btefft(a)community-research.com> Mailing-List: list osint(a)yahoogroups.com; contact osint-owner(a)yahoogroups.com Delivered-To: mailing list osint(a)yahoogroups.com Date: Tue, 16 Nov 2004 20:38:21 -0500 Subject: [osint] Al-Qaeda propaganda website shut down Reply-To: osint(a)yahoogroups.com Al Qaeda propaganda website shut down Wednesday November 17, 05:54 AM Al-Qaeda propaganda website shut down A web site that reportedly contained speeches by Suleiman Abu Ghaith, an alleged spokesman for al-Qaeda leader Osama bin Laden, was shut down by a Swedish internet provider after the site was traced to its server. Spray Network, a subsidiary of Lycos Europe, shut the site down after being informed of the site, said Fredrik Skaerheden, a Spray Network spokesman. "We have a very clear policy that any material that in any way may urge or encourage criminal acts or violence is immediately removed," Skaerheden told The Associated Press. The web site, www.members.lycos.co.uk/abugaith1, reportedly contained several audio files of Abu Ghaith giving speeches and sermons in Arabic, and contained several violent and bloody images. According to the Middle East Media Research Institute, or MEMRI, which first traced the site to the Swedish server, at least one of the sermons called for Muslims to give their lives to fight the United States. A report on MEMRI's Web site quoted the sermon as hailing bin Laden and describing the Jihad fighters as people who "seek death as others seek life and seek Allah's promise in the Koran and sacrifice their property, their blood, and their lives as a sign of the sincerity of their faith." Anyone can create a web site for free on Lycos' servers, Skaerheden said, adding that many of the Lycos Europe member sites are hosted by Spray's servers in the Swedish capital, Stockholm. http://au.news.yahoo.com/041116/2/rr8i.html - ------------------------ Yahoo! Groups Sponsor --------------------~--> $9.95 domain names from Yahoo!. Register anything. http://us.click.yahoo.com/J8kdrA/y20IAA/yQLSAA/TySplB/TM - --------------------------------------------------------------------~-> - -------------------------- Want to discuss this topic? Head on over to our discussion list, discuss-osint(a)yahoogroups.com. - -------------------------- Brooks Isoldi, editor bisoldi(a)intellnet.org http://www.intellnet.org Post message: osint(a)yahoogroups.com Subscribe: osint-subscribe(a)yahoogroups.com Unsubscribe: osint-unsubscribe(a)yahoogroups.com *** FAIR USE NOTICE. This message contains copyrighted material whose use has not been specifically authorized by the copyright owner. OSINT, as a part of The Intelligence Network, is making it available without profit to OSINT YahooGroups members who have expressed a prior interest in receiving the included information in their efforts to advance the understanding of intelligence and law enforcement organizations, their activities, methods, techniques, human rights, civil liberties, social justice and other intelligence related issues, for non-profit research and educational purposes only. We believe that this constitutes a 'fair use' of the copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use this copyrighted material for purposes of your own that go beyond 'fair use,' you must obtain permission from the copyright owner. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/osint/ <*> To unsubscribe from this group, send an email to: osint-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ - --- end forwarded text - -- - ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' -----BEGIN PGP SIGNATURE----- Version: 1308 iQA/AwUBQZqzocPxH8jf3ohaEQLqBQCfXmSSbDyKMsn5ECNGIukcdIo+ntwAn2Pa uA+n1tf2Qb0KT0IbFvSZpr6c =Eg7m -----END PGP SIGNATURE-----

1 0

Crypto-Tax: Re: India to tax / levy license fees on ISPs that offer VPNs
by R.A. Hettinga 16 Nov '04

16 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --- begin forwarded text

1 0

[i2p] weekly status notes [nov 16] (fwd from jrandom@i2p.net)
by Eugen Leitl 16 Nov '04

16 Nov '04

----- Forwarded message from jrandom <jrandom(a)i2p.net> -----

1 0

Gettin' Our Scots-Irish Up
by R.A. Hettinga 16 Nov '04

16 Nov '04

Fight. Sing. Drink. Pray. Cheers, RAH ------- <http://www.nationalreview.com/script/printpage.asp?ref=/owens/owens20041115…> The National Review November 15, 2004, 8:24 a.m. Gettin' Our Scots-Irish Up Country music reflects America's spirit. I am fortunate to have been given the opportunity to review Jim Webb's magnificent new book, Born Fighting: How the Scots-Irish Shaped America, for NRODT [National Review on dead trees --RAH]. It is a wonderful social history of an individualistic, stubborn, rebellious people responsible for creating America's strongest cultural force. A particularly powerful component of this culture is country music. Webb calls country music "a uniquely American phenomenon," a "hypnotic and emotionally powerful musical style" that evolved from its Celtic origins in the mists of Scotland and Ireland. Country music is at the heart of the Scots-Irish culture....In the hollows through those earlier years the dulcimer found its plaintive notes, the traditionally exquisite violin turned into such a hot fiddle that some warned it came from the devil (think Charlie Daniels: "The Devil came Down to Georgia"), and the banjar, a native African instrument made with a gourd, evolved into the hillbilly banjo. Indeed, anyone who wants to understand the Scots-Irish in America would do well to begin by listening to this genre. It is no accident that Webb describes the importance of country music for the Scots-Irish in his chapter entitled "Fight. Sing. Drink. Pray." Country music is about real life, about "hard living, cheating hearts, and good-looking women." It's also about sin and redemption. Country music teaches that actions have consequences, and no one has ever conveyed this reality more clearly than the hard-living, hard-drinking George Jones. The titles of his songs tell it all: "From Hillbilly Heaven to Honky-Tonk Hell," "Hell Stays Open All Night Long," "The Man that You Once Knew," "He Stopped Loving Her Today," and "I've Had Choices." I've had choices, since the day that I was born. There were voices, that told me right from wrong. If I had listened, no I wouldn't be here today, Living and dying, with the choices I've made. Country music teaches these lessons in a way that puts to shame most of what passes for poetry these days. Consider what I believe to be the greatest country song of all time: "Amarillo By Morning," by the incomparable George Strait. Amarillo by morning, Up from San Antone Everything that I've got, Is just what I've got on... They took my saddle in Houston, Broke my leg in Santa Fe Lost my wife and a girlfriend, Somewhere along the way.... Amarillo by morning, Up from San Antone Everything that I've got, Is just what I've got on I ain't got a dime, But what I've got is mine I ain't rich, But Lord I'm free Amarillo by morning, Amarillo's where I'll be. Or "Whiskey Lullaby," by Brad Paisley and Alison Krause: She put him out like the burnin' end of a midnight cigarette She broke his heart, he spent his whole life tryin' to forget We watched him drink his pain away a little at a time But he never could get drunk enough to get her off his mind Until the night. He put that bottle to his head and pulled the trigger And finally drank away her memory Life is short but this time it was bigger Than the strength he had to get up off his knees. Country music can be overtly religious, which, of course, scares the dickens out of secular elites in this country. Consider Jimmy Wayne's "I Love You This Much": He can't remember the times that he thought Does my daddy love me? Probably not But that didn't stop him from wishing that he did Didn't keep from wanting or worshipping him He guesses he saw him about once a year He could still feel the way he felt Standing in tears Stretching his arms out as far as they'd go Whispering daddy, I want you to know. Chorus I love you this much and I'm waiting on you To make up your mind, do you love me too? However long it takes I'm never giving up No matter what, I love you this much. He grew to hate him for what he had done 'Cause what kind of a father, could do that to his son He said 'damn you daddy', the day that he died The man didn't blink, but the little boy cried. Chorus Half way through the service While the choir sang a hymn He looked up above the preacher And he sat and stared at him He said "Forgive me father" When he realized That he hadn't been unloved or alone all his life His arms were stretched out as far as they'd go Nailed to the cross, for the whole world to know. Chorus But even a man of faith can lose it - at least for a while - if the burden is great enough. The next time you get a chance, listen to Alan Jackson sing "you left my heart as empty as a Monday-morning church" about a man who has just buried his wife. As Webb observes, when the Scots-Irish aren't praying, they are often fighting, singing, or sinning in other ways. Despite the admonition of countless fire-and-brimstone preachers from time immemorial, the Scots-Irish have lived the, ahem, secular life to the fullest. As an old Marine, the drinkin'-and-fightin' strain of country music has always appealed to me (not that I have ever engaged in such rowdy behavior, of course). To my way of thinking, there's nothing like the in-your-face music of Johnny Cash, Waylon Jennings, Hank Williams Jr., Aaron Tippin, and Toby Keith. And we shouldn't forget the rowdy girls. I love the ladies - Patsy Cline, Loretta Lynn, June Carter Cash, Reba, Faith Hill, and the rest - but I have always had a soft spot for the wild ones: Tanya Tucker and my latest favorite, Gretchen Philips, the redneck woman who's here for the party. I may not be a ten but the boys say I clean up good And if I gave 'em half a chance for some rowdy romance you know they would. The Scots-Irish have a 2000-year-old military tradition, so it's not surprising that country music is also overtly patriotic. Who can forget Alan Jackson's 9/11 musical memorial, "Where Were You?" or Toby Keith's moderate response to the terrorists, "Courtesy of the Red, White, and Blue" ("we'll put a boot in your ass, it's the American way")? Country music looks to tradition for continuity. There's nothing like a "ghost of Hank Williams" song. So Alan Jackson sings about "Midnight in Montgomery": Midnight in Montgomery, silver eagle, lonely road I was on my way to Mobile for a big New Years Eve show I stopped for just a minute to see a friend outside of town Put my collar up, found his name, and felt the wind die down Then a drunk man in a cowboy hat took me by surprise Wearing shiny boots, a Nudi suit and haunting haunted eyes. He said, "Friend it's good to see you, it's nice to know you care" Then the wind picked up and he was gone Was he ever really there? 'Cause it's midnight in Montgomery Just hear that whippoorwill See the stars light up the purple sky Feel that lonesome chill When the wind it's right, you'll hear his songs Smell whiskey in the air Midnight in Montgomery He's always singing there. Of course, the elites in this nation hate country music just as they hate what Webb describes as the Scots-Irish culture. So after the elections, novelist Jane Smiley wrote in Slate that The election results reflect the decision of the right wing to cultivate and exploit ignorance in the citizenry. . . . Ignorance and bloodlust have a long tradition in the United States, especially in the red states. . . . Listen to what the red state citizens say about themselves, the songs they write, and the sermons they flock to. They know who they are - they are full of original sin and they have a taste for violence. . . . Well, to Ms. Smiley and her fellow "elites," from us country-music fans: As Aaron Tippin sings in a different context, "Jane - kiss this!" - Mackubin Thomas Owens is an associate dean of academics and professor of national-security affairs at the Naval War College in Newport, R.I. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

3 2

The Beginning of the Crypto Era
by R.A. Hettinga 16 Nov '04

16 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 <http://www.eweek.com/print_article2/0,2533,a=139274,00.asp> EWeek The Beginning of the Crypto Era November 15, 2004 By Larry Seltzer In a move that was totally expected, if a little early, Yahoo has announced that it will put its money where its mouth is and start checking Yahoo Mail with its DomainKeys system. The company had told me that it would do so by the end of the year, but I suppose it had had this last week, during the FTC e-mail authentication summit, as an internal deadline. Earthlink also announced that it will test DomainKeys on its system. DomainKeys is important. It is the main implementation of the second of the two most credible approaches to SMTP authentication, specifically the use of cryptographic signatures to authenticate messages against the domains from which they were sent. The other approach-to check against the IP addresses of the servers in those domains-also moved forward recently with the second version of the Sender ID spec. Don't assume that the DomainKeys implementation is the final form. There is an IETF group called ietf-mailsig working in preliminary stages to standardize the crypto approach to SMTP authentication and they might want to make some changes to the approach used by Yahoo. And I expect Yahoo to be open to such suggestions. In fact, Yahoo's openness to reasonable suggestions and unobjectionable licenses is a big reason to be optimistic about widespread adoption of it. Indeed, while Yahoo has intellectual property claims on its developments in DomainKeys, the company isn't being a jerk about it, like some other coMpanieS in this business that shall remain naMeleSs. There are some interesting questions about DomainKeys and Yahoo's handling of it. The first has to do with performance. My own first impression of cryptography as a solution was that the added performance burden on MTAs (message transfer agents, better known as mail servers) would be great and that many companies would have to upgrade their hardware to run a DomainKeys-enabled server with decent performance. In a recent eSeminar in which I participated, Richi Jennings of Ferris Research echoed this view. But while it's still too early to tell, there's reason to believe the performance issue is not as serious as first impressions would indicate. I've spoken to Sendmail, the leading MTA company in the world, about it. Nobody, except Yahoo, has more hands-on experience actually testing and coding DomainKeys than Sendmail. Sendmail thinks the added performance burden, entirely CPU-based, is on the order of 15 percent to 20 percent. This isn't nothing, but MTAs aren't typically CPU-constrained-they are network- and perhaps disk-constrained-so there could easily be spare CPU capacity in the typical MTA (unless it's running Exchange Server or Notes, in which case it's CPU-starved). Next Page: Why no SPF implementation? The other question I have about Yahoo is why it has refused to implement SPF. Sender Policy Framework is the uncontroversial part of Sender ID, the part that checks the message envelope. Many people still argue that SPF is all we really need. But no serious people believe this, least of all SPF's author Meng Weng Wong, who is a principal author and sponsor of the Sender ID spec and also a fan of DomainKeys. All SPF really stops is bounce messages, also known as "Joe Jobs." It's an important part of the solution, but it's far from an adequate one. But it is an easy one, and there's no good technical reason why Yahoo should resist it. All the other major mail providers, to my knowledge, are implementing SPF as part of their experimentation. The answer for Yahoo is probably something as stupid as not wanting people to get the misimpression that they are hedging on DomainKeys. I asked the company about this several weeks ago, and it weaseled out of a direct answer. Most dissatisfying. The Yahoo announcement focuses on phishing, probably because it's topical. Spam has become a major annoyance, but phishing is scary. And SPF does nothing to address phishing. This is why Microsoft developed Caller ID, the header portion of Sender ID. I should also take a moment to wag my finger at those who continue to express concern at how spammers are adopting SPF and other authentication standards in order to get around them. I don't know if they're walking into a trap or if they're just experimenting, but it won't do them any good. The more spammers authenticate, the easier they will make themselves to block. For insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzer's Weblog. Remember, authentication systems are not complete anti-spam systems. They just identify who is sending the mail, not why they are sending it. This whole approach requires the coordinated use of reputation systems that will use the authenticated address to tell you whether a sender is trustworthy. In such a scenario, an authenticated spammer becomes easy to block. The collapse of MARID brought forth a call for experimentation with the various proposals in the hope that the experience would inform the standards process and help to produce a consensus. We're lucky. The experimentation so far has formed along the lines one would expect, meaning the proposals backed by the major players. The advancement of DomainKeys puts in an approach that the open-source community won't object to and that is forward-looking. It doesn't have to be the only success in this area, but it's good that we have it. Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. - -- - ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' -----BEGIN PGP SIGNATURE----- Version: 1308 iQA/AwUBQZpjVMPxH8jf3ohaEQJJKwCgi1SpEnUCBsoXyXRVKX0O1pyltdkAoKat BGbyLClwxL8k4hHIlcdZ7xB4 =jRYJ -----END PGP SIGNATURE-----

1 0

'Virtual Debit Card' Aims To Combat Online Fraud
by R.A. Hettinga 16 Nov '04

16 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 <http://online.wsj.com/article_print/0,,SB110056759053675009,00.html> The Wall Street Journal November 16, 2004 MONEY 'Virtual Debit Card' Aims To Combat Online Fraud By JENNIFER SARANOW Staff Reporter of THE WALL STREET JOURNAL November 16, 2004; Page D2 Consumers typically have been wary of using bank cards online. One bank's solution is to get rid of the cards. In an effort to ease customers' concerns about fraud and identity theft when shopping online, PNC Bank has launched a new checking account with a "virtual debit card." In addition to a regular debit card that can be used at automated teller machines and in stores, the "Digital Checking" account comes with an "eSpend" card. The card is basically a piece of paper with an account number, expiration date and verification code for making purchases online, over the phone and by mail order. Customers can set a daily limit for their eSpend card (say $1,000) and once that amount is spent, additional purchases won't be approved. PNC Bank, a unit of PNC Financial Services Group Inc., Pittsburgh, hopes the eSpend card will attract people who want to make purchases online with their debit card but are uncomfortable doing so for fear of making their bank account vulnerable to fraud. If an unauthorized person obtains a customer's eSpend number, only the specified daily limit could be taken out of a customer's bank account. If this occurs, PNC says customers aren't liable for the charges. Purchases made with the eSpend card show up separately on bank statements. The account, which is aimed at online-banking customers, also comes with identity-theft reimbursement insurance, a debit card rewards program and no fee for using non-PNC ATMs. The account has a monthly $11 service fee unless customers opt for direct deposit of paychecks or government checks such as Social Security, and pay at least three bills online. The eSpend card comes as debit cards are quickly overtaking cash and checks as preferred methods of payment. According to a report from the American Bankers Association and Boston-based Dove Consulting, 31% of in-store purchases were made with a debit card last year, up from 21% in 1999. Consumers typically have been wary of using debit cards online because, unlike credit cards, they are directly tied to bank accounts. But online use of debit cards is starting to grow. In the first quarter of this year, Visa debit cards were used for 46% of online purchases, up from 43% a year earlier, according to Visa International. Analysts are skeptical about how excited consumers will be about PNC's new card. "I think it's an interesting idea but if you look at consumer usage, consumers are using their debit cards online today in increasing numbers, so it's unclear how much of a demand there would be for a card with that unique application," says Tony Hayes, a Dove analyst. Other banks have long offered similar credit-card products as a way to encourage purchases on the Internet and reduce the amount of fraud they are liable for. In June of 2002, for example, Citigroup Inc.'s Citibank launched free, downloadable software that allows credit-card customers to obtain a new disposable account number each time they make a purchase online. A downside: Such "virtual account numbers" can't be used when a credit card must be shown at pickup. - -- - ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' -----BEGIN PGP SIGNATURE----- Version: 1308 iQA/AwUBQZpi4MPxH8jf3ohaEQKJ3QCfZ+wnHeKvUtcB5OPrDJpowuwZVlcAniqe Y95BEeRcqR2WVUz/2nG4zZvh =wU3/ -----END PGP SIGNATURE-----

1 0

[ISN] BlackBerry prickles Department of Defence spooks
by R.A. Hettinga 16 Nov '04

16 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --- begin forwarded text

1 0