November 2004 - cypherpunks-legacy

Cents and sensibility
by R.A. Hettinga 26 Nov '04

26 Nov '04

<http://www.asiaone.com.sg/cgi-bin/utils/it/printf.pl?specialsprt> IT AsiaOne - Specials Cents and sensibility Would you buy goods online that cost a few cents? Most people don't and won't, for they would either want it for free or fork out a reasonable amount for it By Raju Chellam , Business Times 27 Nov 2004 ON Jan 21, 1998, Boston-based computer giant, Digital Equipment Corp (DEC) began testing a new system for buying and selling low-cost information or goods over the Internet. The system, called MilliCent, was the brainchild of DEC CEO Kenneth Olsen and offered users the chance to buy information or goods or services over the Internet at prices ranging from one-tenth-of-a-cent to US$5 per transaction. That initiative was as revolutionary then as it is now. That's because the idea did not take off then - and has not quite taken off yet. The idea seems simple enough: instead of risking tens or hundreds of dollars buying stuff on the Net, would you mind parting with a single cent, or a few cents, or even a dollar, to buy something you like online? Most people don't - or won't - it seems. They would either want it free, or would be willing to pay a reasonable amount for it, but not just a few cents. Except perhaps for music. There are three success stories here: One, from Soundbuzz.com, a homegrown startup which offers 250,000 songs at $1.99 each for downloading on Creative Technology's MP3 players and other devices. Two, from Apple's iTunes, which charges 99 US cents to download a song from a repertoire of a million songs, to the iPod MP3 player. And three, from the booming ringtone industry, which charges from $1 to $3 per tune downloaded to your cellphone. All this however is a tiny drop in the ocean that is the Internet. Micropayments currently form less than one per cent of the commerce done electronically worldwide. While most consumers buy more goods or services that cost more than a few dollars online, very few buy goods or services that cost less than a dollar online. Gartner Inc says microcommerce will be a US$60 billion business, but only in 2015. Forrester Research says online retail sales - called B2C (business to consumer) - in the US are set to cross US$100 billion for the first time this year. Of that, less than US$50 million will comprise micropayments. That's a poor showing, even in the US. As for Singapore, IDC Corp says 2.8 million Singaporeans - 59.6 per cent of the population - have an Internet connection. Of that, only 1.4 million - 29 per cent of the populace - have shopped online for goods or services. Most of them would have bought stuff that costs over $10. Are more people reluctant to buy stuff that costs a fraction of a dollar online? Are there fewer goods available at those low prices? Or is it too cumbersome for either the buyer or the seller to process e-payments through credit cards for amounts less than a dollar? It is all of those factors and more. As for e-payments, there's a debit card service, called eNets, from Nets (Network for Electronic Transfers Singapore). In April, Nets launched eNets China Payment, that enables millions of mainland Chinese shoppers to use their Chinese bank debit cards to buy goods and services from Singapore's online merchants for the first time. At the launch, 110 online merchants in Singapore signed up to offer goods, including a dozen who offered to sell their wares online to China-based buyers. One lurking fear in buying goods online is fraud. Though consumer fraud is not yet as major an issue in Asia as it is in the US, it is still a major concern. 'Illegal access to checking accounts is the fastest-growing type of US financial consumer fraud, and thieves appear to be proliferating through online channels,' says Avivah Litan, Gartner's vice-president and research director. A Gartner poll in April concluded that 1.98 million online adults have experienced this sort of crime in the past 12 months. The cost is about US$2.4 billion in direct fraud losses, or an average of US$1,200 per victim. 'It will take time for the financial services industry to develop sophisticated backend tools, but banks must implement stronger access controls to online and phone banking systems,' Ms Litan says. If issues like fraud are holding back the growth of online payments in general, is there no hope for micropayments? Not quite. There's some evidence that online payments, whether big or small, are getting traction in the US now. The most well-known company in the category is PayPal. Some others, such as Beenz, Flooz and DigiCash, which boomed in the dotcom era, have since vanished. New ones are coming, with names like Bitpass, Peppercoin, Salon, Valista, Payloadz, Firstgate, Paystone and Yaga. They are all startups with dreams of becoming the next Google in mind. That will take time. Until that happens - or until the next rush of interest shifts to the 'microfirms' that offer micropayments - buyers will have to struggle to find goods and services that cost under a dollar online, even as sellers of goods that cost little struggle to find buyers online. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Hacking tool 'draws FBI subpoenas'
by R.A. Hettinga 26 Nov '04

26 Nov '04

<http://www.theregister.co.uk/2004/11/25/nmap_draws_fbi_subpoenas/print.html> The Register Biting the hand that feeds IT The Register ; Security ; Network Security ; Original URL: http://www.theregister.co.uk/2004/11/25/nmap_draws_fbi_subpoenas/ Hacking tool 'draws FBI subpoenas' By Kevin Poulsen, SecurityFocus (klp at securityfocus.com) Published Thursday 25th November 2004 10:42 GMT The author of the popular freeware hacking tool Nmap warned users this week that FBI agents are increasingly seeking access to information from the server logs of his download site, insecure.org. "I may be forced by law to comply with legal, properly served subpoenas," wrote "Fyodor," the 27-year-old Silicon Valley coder responsible for the post scanning tool, in a mailing list message. "At the same time, I'll try to fight anything too broad... Protecting your privacy is important to me, but Nmap users should be savvy enough to know that all of your network activity leave traces." Probably the most widely-used freeware hacking tool, Nmap is a sophisticated port scanner that sends packets to a machine, or a network of machines, in an attempt to discern what services are running and to make an educated guess about the operating system. An Nmap port scan is a common prelude to an intrusion attempt, and the tool is popular both with security professionals performing penetration tests, and genuine intruders with mischief in their hearts. Last year Nmap crept into popular culture when the movie the Matrix Reloaded depicted Carrie-Anne Moss's leather-clad superhacker Trinity performing an Nmap portscan (http://www.theregister.co.uk/2003/05/16/matrix_sequel_has_hacker_cred/) on a power grid computer prior to hacking in. But success comes with a price, and on Tuesday Fyodor felt the need to broach the "sobering topic" of FBI subpoenas with his users. He advised his most privacy conscious users to use proxy servers or other techniques when downloading the latest version of Nmap if they want to ensure their anonymity. In a telephone interview, Fyodor said the disclaimer wasn't prompted by any particular incident, and that he'd received "less than half-a-dozen" subpoenas this year. "It's not a huge number, but I hadn't received any before 2004, and so it's a striking new issue," he said. None of the subpoenas produced anything, Fyodor says, either because they sought old information that had already been deleted from his logs, or because the subpoenas were improperly served. In every case the request has been narrowly crafted, usually directed at finding out who visited the site (http://www.insecure.org/) in a very short window of time, such as a five minute period. "They have not made any broad requests like, 'Give me anyone who's visited insecure.org for a certain day,'" he says. Fyodor theorizes the FBI is investigating cases in which an intruder downloaded Nmap directly onto a compromised machine. "They assume that she might have obtained that URL by visiting the Nmap download page from her home computer," he wrote. He confesses mixed feelings over the issue. "The side of me that questions authority is skeptical of these subpoenas," he told SecurityFocus. "The other side says, this may be a very serious crime committed ... and if I were the victim of such a crime I would probably want people to cooperate" -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

HNS - Z1 SecureMail Gateway 2.1 Checks Certificates In Real-Time
by R.A. Hettinga 26 Nov '04

26 Nov '04

<http://www.net-security.org/press.php?id=2702> Net-Security.org Z1 SecureMail Gateway 2.1 Checks Certificates In Real-Time Posted on 26 November 2004 | Other Zertificon Solutions releases at HNS E-mail security solution enhanced with online protocol and monitoring in new release Zertificon Solutions just released version 2.1 of the Z1 SecureMail Gateway. The so called "virtual admin office" protects corporate e-mail traffic with centralized cryptography and electronic signature from being manipulated and spied out. The server-based solution contains a certificate management that now also supports the OCSP protocol. This enhancement enables verification of external certificates in real-time and is an increase of the security level. The Online Certificate Service Protocol (OCSP) is the emerging standard for the validation of certificates at trust centers. With the disposal of OCSP the common use of steadily growing Certificate Revocation Lists (CRLs) and databases with expired certificates obsolete. This new way of certificate validation is faster, every time up-to-date and receives a security level which could not be achieved by manual verification by the PC user. Version 2.1 of the Z1 SecureMail Gateway now also contains a statistic module that e.g. shows how many e-mail messages went in and out, how many of them were encrypted and / or signed, which standard was used (PGP or S/MIME). Thus the statistic module monitors the increasing use of central encryption and electronic signature. Free and unlimited test version 2.1 is available on the companies website. About Zertificon Solutions: The Berlin/Germany based specialist develops software and solutions for secure electronic business processes and communication. Zertificon Solutions markets security software which aim on a superior convenience in administration through qualified reseller or consultants and within projects. The core product, Z1 SecureMail Gateway, protects the complete e-mail traffic of an organization via server-based encryption and electronic signature. The company offers security services for IT systems like system integration, software development and consulting within its competence areas "Secure eMail", PKI & SmartCards and Open-Source Security. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Blunkett's Bad Idea
by R.A. Hettinga 26 Nov '04

26 Nov '04

<http://online.wsj.com/article_print/0,,SB110142750390883913,00.html> The Wall Street Journal November 26, 2004 REVIEW & OUTLOOK Blunkett's Bad Idea November 26, 2004 Amidst Tuesday's pomp and pageantry that was the State Opening of the British parliament, the biggest smile during the Queen's speech probably belonged to Home Secretary David Blunkett. For, in spite of cabinet opposition, he managed to get his pet project -- a national identification card -- put atop the government's legislative agenda. Aside from extolling the worth of ID cards in the war on terror, Mr. Blunkett has been lauding their usefulness in fighting organized crime, combating welfare abuse, and curbing illegal immigration. In fact, save improving the performance of the nation's sports teams, it almost seems for Mr. Blunkett that there's no problem these magical cards can't solve. If an argument could be made that ID cards would be a valuable aid against terrorism, fine. But they're not. An ID card system, to cite but one case, didn't prevent the Madrid massacre. So Mr. Blunkett touts other benefits, like reducing benefit fraud. But at a projected cost of #3.1 ($5.8) billion, that'll have to be a lot of fraud. The government's real response to civil libertarians is: "If you've got nothing to hide, why oppose?" That's not the point. A state exists for the people and is accountable to the people. Not vice-versa. At least not in free and democratic countries. Britain is, or was, freer than its Continental neighbors precisely because the government wasn't as intrusive in peoples' lives. To so fundamentally alter the relationship between citizen and state, as Mr. Blunkett proposes, a compelling case needs to be made. He hasn't. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Fallujah: Marine Eye-Witness Report
by John Kelsey 26 Nov '04

26 Nov '04

>From: Tyler Durden <camera_lumina(a)hotmail.com> >Sent: Nov 24, 2004 12:08 PM >To: jamesd(a)echeque.com, cypherpunks(a)al-qaeda.net >Subject: Re: Fallujah: Marine Eye-Witness Report >James A Donald wrote... >>And the problem with a civil war in Iraq is? >And the answer is: 9/11 sucked. >Oh wait, I guess I have to explain that. After the Soviets were pushed out >of Afghanistan the place became a veritable breeding ground for all sorts of >virulent strains of Islam, warlords, and so on. Iraq would likely denigrate >into the same, eventually launching similarly nice little activities. Well, I'm sure glad we avoided having Iraq become a breeding ground for all sorts of virulent strains of Islam, warlords, etc. Also that we avoided it becoming a place that trains people in how to carry out effective guerrilla warfare against US troops. We sure dodged a bullet there.... >-TD --John

6 8

[i2p] 0.4.2 is available (fwd from jrandom@i2p.net)
by Eugen Leitl 26 Nov '04

26 Nov '04

----- Forwarded message from jrandom <jrandom(a)i2p.net> -----

1 0

"And I hope that you die; And your death'll come soon"
by Major Variola (ret) 25 Nov '04

25 Nov '04

>Seen the Norwegian site that calls for Bush's head shot? >Two URLs, the last vivid: > > http://www.killhim.nu/ > > http://killhimwith.bazooka.at/once/ Quite refreshing (although a simple macromedia browser game would have been a nice touch) when a US teenager armed with a Dylan song warrants a visit from the men in black: http://www.rockymountainnews.com/drmn/local/article/0,1299,DRMN_15_3323602,… ------- "People that are really very weird can get into sensitive positions and have a tremendous impact on history." -some idiot republican

1 0

[osint] Mexican police hunt lynch mob
by R.A. Hettinga 25 Nov '04

25 Nov '04

--- begin forwarded text

1 0

[osint] 'Stunning' arms haul in Falluja
by R.A. Hettinga 25 Nov '04

25 Nov '04

--- begin forwarded text

1 0

ID scheme, IT the key to Blunkett's new terror laws
by R.A. Hettinga 25 Nov '04

25 Nov '04

<http://www.theregister.co.uk/2004/11/24/security_bill_roundup/print.html> The Register Biting the hand that feeds IT The Register ; Internet and Law ; Digital Rights/Digital Wrongs ; Original URL: http://www.theregister.co.uk/2004/11/24/security_bill_roundup/ ID scheme, IT the key to Blunkett's new terror laws By John Lettice (john.lettice at theregister.co.uk) Published Wednesday 24th November 2004 12:00 GMT The pile of security legislation the Government unveiled yesterday is disturbingly large but, as Peter Hain has to all intents and purposes confessed, most of it is window-dressing this side of the election. A couple of Bills will get through before May, with ID cards and SOCA, the 'British FBI', among the most likely to do so. Another with heavy IT implications, the Management of Offenders Bill (tagging) also stands some chance, but ID Cards (the Government seems to have switched back to "Cards" rather than "Scheme") looks like being the showpiece the Government will try to sell itself on in the next election campaign. The 'British FBI', the Serious Organised Crime Agency (SOCA) will not cover terrorism, which makes it not much of an FBI, but will have a lot to do with surveillance, and is headed by former MI5 chief Sir Stephen Lander, who revealed himself as worryingly gung-ho in Sunday's Dimbleby programme. It was the excited smirk he gave as he said: "I'm an enthusiast for using wiretaps" that got us. So lots more lovely wiretaps in the Serious Organised Crime and Police Bill, some media training for Sir Stephen, but quite possibly no sign of wiretaps being used in court before the Counter Terrorism Bill makes them more secrecy-friendly on the other side of the election. Lander, along with Blunkett and most of the security services, isn't so keen on having surveillance operations being exposed in court proceedings. On the two flagship bills Blunkett says: "Identity cards would help us tackle the organised criminals and terrorists who use fake identities to carry out their crimes. They would also aid the fight against illegal working and immigration abuse, enable easier and more convenient access to services and ensure free public services are only used by those entitled to them. The Identity Cards Bill will set out the stringent safeguards we want for the use of the cards, what information they contain and who can access it. "The Serious Organised Crime and Police Bill would establish a new agency to lead the fight against crime gangs whose trade in drugs and guns has an impact in every community in Britain. A new law-enforcement agency will be created that will pursue crime bosses using the very latest technology. The Bill would also overhaul the powers of police officers and extend the powers of Community Support Officers so they can deal effectively with anti-social behaviour on the streets." We'll leave the mission-creep obvious in that last sentence until we can do a broader reading of the legislation for 'shopping list' type additions. Both the surveillance aspect and the intent to use the "very latest technology" (which underlies most of the security plans) is of major importance for the IT industry. Two draft bills, the Draft Youth Justice Bill and the Draft Counter-Terrorism Bill, are there to put down marks for the next administration and to 'crowd out' the opposition on the security issue. The Youth Justice Bill will be ramping up the use of tagging and tracking to support a move away from prison and towards community sentences, while the Counter-Terrorism Bill will likely include Blunkett's 'ASBOS for terror suspects' (or as we're trying to call them, Anti-Internet Behaviour Orders, AIBOs, (http://www.theregister.co.uk/2004/11/21/blunkett_internet_ban/) and juryless anti-terror courts. This does not seem sufficient to populate a whole David Blunkett 'sensible preemptive security measure', and we feel sure there will be much more. A couple more measures do not have any obvious security implications, but are likely to be of interest to Register readers. The Inland Revenue and Customs Merger Bill is intended to do what it says on the tin, and will clearly have an impact on your personal financial situation. The Road Safety Bill will allow police to force drink-drive offenders to take another test, and raises the fine for driving while using a mobile phone to #60. This latter is a response to the lack of impact of the previous effort at a ban, which itself was brought in because enforcement of existing legislation on driving without due care and attention was patchy. You'll note that the problem here is enforcement rather than level of fine, but that they're pretending not to notice. The Clean Neighbourhoods And Environment Bill might have an impact on the more rowdy elements of the IT business, not that this should apply to Register readers. It gives local authorities the power to issue fines for a range of messy behaviour, including litter, noise and light pollution (light pollution? No doubt somebody will explain), so getting spot-fined for dropping cigarettes and being unruly outside pubs will become more common. Blunkett's 'zero tolerance' consultant from the US has also been suggesting points on your driving licence for anti-social behaviour, so there will be that to consider in the future as well. Oh, and Blunkett proposes to broaden police powers of arrest, while the Drugs Bill allows police to test for drugs on arrest rather than when charged. Those arrested will already have their DNA added to the national database, and ultimately the wider arrest powers will allow biometrics to be added in the same way (if they haven't got them already by then). It all joins up, conceptually. Joining it up IT-wise will be a lot harder, and that issue will keep us all busy for quite a few years yet. . -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0