April 2004 - cypherpunks-legacy

Credentica (Re: Is there a Brands certificate reference implementation?)
by Christian Paquin 30 Apr '04

30 Apr '04

Hello Steve, > From: Steve Furlong <sfurlong(a)acmenet.net> > To: dgcchat(a)lists.goldmoney.com, cypherpunks(a)al-qaeda.net > Fwd: cryptography(a)metzdowd.com, e$(a)vmeng.com > Date: 25 Apr 2004 12:14:30 -0400 > > Does anyone know of a reference implementation for Stefan Brands's > digital certificate scheme? Alternatively, does anyone have an email > address for Brands so I can ask him myself? (I haven't gotten anything > back from ZKS's "contact us" address. But I don't know if Brands is > still at ZKS.) I am one of the lead developers of Credentica, which is Stefan Brands' latest venture after his amicable departure from ZKS quite some time ago. We are exclusively focused on the development of identity and access management technology based on Stefan's Digital Credential work. Following our closing of investment from Nokia earlier this year, we started with the design and implementation of a Software Development Toolkit for Digital Credentials. We are exploring the idea of releasing parts of it under an open-source license, and intend to post updates here from time to time on our progress. More information will be available on our upcoming Web site, which should be up soon. Meanwhile, if you are interested in getting a glimpse of what we are doing, check out Stefan's keynote materials at a recent NIST PKI workshop, which you can find here: http://middleware.internet2.edu/pki04/proceedings/ Kind regards, Christian Paquin Cryptographic Developer Credentica

1 0

Re: no anon conversations?
by joss 30 Apr '04

30 Apr '04

On Fri, 2004-04-30 at 14:12, An Metet wrote: > What technologies currently exist for receiving a/psuedononymous message? > With Mixmaster, sending mail, posting news, and even blog posting are > possible, However, receiving replies securely or, better, holding a private > conversation is difficult or impossible. Best bet seems is to encrypt and > spam somewhere very public? Ugly, ugly. No technological method, just a few > "trust me" remailers. Other options? Also, the mixminion Type-III anonymous remailer which is currently in development (www.mixminion.net) supports secure replies to anonymous messages. This technology is, however, still very much in alpha phases. Usable, but not secure. Worth looking at and following, but not useful for anonymity right now. Joss

1 0

[Politech] John Gilmore's horrific, dystopian view of an RFID world [priv]
by R. A. Hettinga 30 Apr '04

30 Apr '04

--- begin forwarded text

1 0

[ISN] Mobile flaws expose executives to bugging
by InfoSec News 30 Apr '04

30 Apr '04

http://business.timesonline.co.uk/article/0,,8209-1092789,00.html By Steve Boggan April 30, 2004 EXECUTIVES at some of Britain's biggest companies are using mobile phones that can be secretly tracked and bugged, despite a series of Times investigations demonstrating gaping holes in handset security. During tests at the offices of Shell, BP, HSBC and Goldman Sachs, The Times identified 95 phones potentially vulnerable to a new form of hacking known as "bluesnarfing". Under the process, which threatens mobile phones that use Bluetooth wireless technology, hackers can download text messages, phone lists and even remotely tamper with handsets to enable them to be used as listening devices. Last week The Times identified 46 phones that could have been vulnerable to attack during a 12-minute test in the central lobby of the Palace of Westminster. During our latest experiment, we had the ability to access the phone of a Shell employee supplying aviation fuel to aircraft companies and bug the handsets of chauffeurs driving executives. At the offices of Shell, a passive scan showed that 19 phones would have accepted an unauthorised Bluetooth connection. None was made, to avoid infringement of the Computer Misuse Act. Of these, 13 were Nokias and five were Ericssons. The Nokia 6310 and 6310i, the most popular business phones in the UK, and the Ericsson T610, one of the best-selling picture phones, have proved to be the most insecure. Outside, a group of chauffeurs were waiting in seven identical and consecutively-numbered Volvos. An attack on any of their phones would have allowed us to set up a divert to a handset of our choice. We could then have instructed their phones to call us secretly, leaving a channel open through which we could have heard executives conversations in the cars. At BPs office in St Jamess Square, Westminster, we identified 24 potentially vulnerable phones while at Goldman Sachs in Fleet Street, the figure was 35 phones. We scanned in a smoking area outside the offices of HSBC in Canary Wharf during a ten-minute period. Seventeen potentially vulnerable phones were identified. The latest cause for concern involving the Nokia 6310s and Sony Ericsson T610s involves secret tracking. Commercial companies offer phone tracking services to businesses and individuals who want to locate sales forces quickly. An SMS message is sent to the relevant mobile phone with an activation code. Once activated, the phones location is shown on an internet website map. Bluesnarfing allows the activation code to be diverted to an attacker, so that an account is set up without the handset owners knowledge. He or she could then be tracked, without their knowledge, 24 hours a day. Nokia admits there are problems with its 6310s and 8910s but says it is working on a solution that will be available to users from this summer. Sony Ericsson says it has cured the text message and divert problems in new phones but phone lists, calendars and pictures can still be accessed. It promises a cure for that problem in the second half of the year. Shell and BP said they never commented on security; Goldman Sachs was aware of the problem and had issued advice to staff; and HSBC said its technical staff were looking into the problem. _________________________________________ ISN mailing list Sponsored by: OSVDB.org --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Mobile flaws expose executives to bugging
by InfoSec News 30 Apr '04

30 Apr '04

http://business.timesonline.co.uk/article/0,,8209-1092789,00.html By Steve Boggan April 30, 2004 EXECUTIVES at some of Britain's biggest companies are using mobile phones that can be secretly tracked and bugged, despite a series of Times investigations demonstrating gaping holes in handset security. During tests at the offices of Shell, BP, HSBC and Goldman Sachs, The Times identified 95 phones potentially vulnerable to a new form of hacking known as "bluesnarfing". Under the process, which threatens mobile phones that use Bluetooth wireless technology, hackers can download text messages, phone lists and even remotely tamper with handsets to enable them to be used as listening devices. Last week The Times identified 46 phones that could have been vulnerable to attack during a 12-minute test in the central lobby of the Palace of Westminster. During our latest experiment, we had the ability to access the phone of a Shell employee supplying aviation fuel to aircraft companies and bug the handsets of chauffeurs driving executives. At the offices of Shell, a passive scan showed that 19 phones would have accepted an unauthorised Bluetooth connection. None was made, to avoid infringement of the Computer Misuse Act. Of these, 13 were Nokias and five were Ericssons. The Nokia 6310 and 6310i, the most popular business phones in the UK, and the Ericsson T610, one of the best-selling picture phones, have proved to be the most insecure. Outside, a group of chauffeurs were waiting in seven identical and consecutively-numbered Volvos. An attack on any of their phones would have allowed us to set up a divert to a handset of our choice. We could then have instructed their phones to call us secretly, leaving a channel open through which we could have heard executives conversations in the cars. At BPs office in St Jamess Square, Westminster, we identified 24 potentially vulnerable phones while at Goldman Sachs in Fleet Street, the figure was 35 phones. We scanned in a smoking area outside the offices of HSBC in Canary Wharf during a ten-minute period. Seventeen potentially vulnerable phones were identified. The latest cause for concern involving the Nokia 6310s and Sony Ericsson T610s involves secret tracking. Commercial companies offer phone tracking services to businesses and individuals who want to locate sales forces quickly. An SMS message is sent to the relevant mobile phone with an activation code. Once activated, the phones location is shown on an internet website map. Bluesnarfing allows the activation code to be diverted to an attacker, so that an account is set up without the handset owners knowledge. He or she could then be tracked, without their knowledge, 24 hours a day. Nokia admits there are problems with its 6310s and 8910s but says it is working on a solution that will be available to users from this summer. Sony Ericsson says it has cured the text message and divert problems in new phones but phone lists, calendars and pictures can still be accessed. It promises a cure for that problem in the second half of the year. Shell and BP said they never commented on security; Goldman Sachs was aware of the problem and had issued advice to staff; and HSBC said its technical staff were looking into the problem. _________________________________________ ISN mailing list Sponsored by: OSVDB.org --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Lowering the Bar for Threats
by An Metet 30 Apr '04

30 Apr '04

Eric Cordian quotes: > FBI Shill: Are we gonna exterminate the rat? > > Hale: I'm going to fight within the law and, but, ... if you wish to, > ah, do anything, yourself, you can. You're such a liar. I don't know why I even bother to respond to you. You left off the next few lines: "So that makes it clear," Hale added. "Consider it done," Evola said. "Good", Hale replied. And now you know... the rest of the story. I encourage anyone interested in the case to read the details online. By most accounts, jurors did a good job of seeing through Hale's obfuscations and careful attempts at plausible deniability. > I wonder how long it will be until Americans get their houses pushed over > with bulldozers for criticizing the government. Probably at least until > after the election. Free speech is one thing. Soliciting murder is something else. But let's say you're right and the government cracks down on criticism. Which is easier, to get government to change, or to ignore the restrictions and continue to publish critical essays, protected by cryptographic anonymity?

2 1

A national identity card is unlikely to deliver all the things expected of it
by R. A. Hettinga 29 Apr '04

29 Apr '04

<http://www.economist.com/world/europe/PrinterFriendly.cfm?Story_ID=2629019> The Economist Identity cards Will they work? Apr 29th 2004 >From The Economist print edition A national identity card is unlikely to deliver all the things expected of it BRITONS like to think of themselves as plucky individualists, resistant to authoritarianism both foreign and domestic. It's a self-image that is becoming increasingly difficult to sustain. This week, David Blunkett, the home secretary, unveiled a draft bill that, if enacted, would create the most ambitious and intrusive national identity card scheme in Europe. For many, the only complaint was that it was long overdue. Over the past decade, opinion polls have consistently shown 75-85% in favour of ID cards. Oddly, people want them even though they don't trust the government with personal information. MORI, a pollster, reports that just 10% are "very confident" their details would be kept secure. A YouGov poll carried out last September found that two-thirds didn't trust civil servants to keep information from one another, while half suspected they would share it with outsiders. Clear majorities also predicted disruption, inconvenience, and a rash of forgeries. This puts unusual pressure on the scheme. Britons want cards to help stop illegal immigrants from working or using public services, and to fight terrorism and reduce fraud. They will compromise on personal privacy because they reckon the system will deliver on these things. Will it? The government's plans are certainly ambitious. Starting from scratch, it wants to build a central register that will hold the name, date of birth, current and former addresses, nationality, passport number and national insurance details of everybody residing in the country longer than three months. The register will also record every occasion on which this information is accessed or changed, and by whom. Keen citizens will be able to add more to the register if they find this insufficient. More ambitious still are plans to link the register to other government databases, and to incorporate biometrics such as fingerprints and iris scans. This is handy for deterring forgers, but it raises the price and complexity of the system well above anything that exists, or is being contemplated, elsewhere in Europe. Building a secure ID-card system is not difficult, says Richard Barrington, head of government affairs at Sun Microsystems. The real problems (and the costs) arise elsewhere: in collecting people's images or iris patterns, "binding" these to paper documents such as driving licences, and managing the system so that false and multiple identities are expunged. "If this is not done in a disciplined way, the register will become like every other government database-that is, full of junk," he says. This becomes exponentially more difficult as the job progresses. On the current, rather relaxed timetable for building the register (a pace forced by cabinet sceptics), it will capture about 80% of the economically active population by 2013. Then comes the challenge. The final 20% includes people on the fringes of society-those who do not work legitimately, drive, vote, or hold British passports; in other words, precisely the sort you would want in a database. Capturing them will be desperately difficult, despite a proposed #2,500 ($4,500) fine for non co-operation. A larger problem is one of function creep. There is likely to be pressure, not just from politicians but also from convenience-minded citizens, to make the card do more. Data will inevitably be added to the register, and (as MPs have themselves hinted) companies will make increasing use of it to check identities. The problem, say security engineers, is that the more uses for a card, the more rapidly it degrades. Even in Belgium, which has had compulsory identity cards since 1919, social-security information is kept on a separate bit of plastic. Those lonely souls who worry about the erosion of civil liberties might take comfort from the fate of the various "smart card" schemes already in existence in Britain. The most ambitious one was launched three years ago, in Southampton. By now, every resident was supposed to have a card, which would allow access to, and payment for, a wide range of council services. Electronic voting was mooted. But it proved difficult to get banks, transport operators, or even council departments on board. Today, the card is used mostly to check out library books and get into leisure centres. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Jury Finds for Most Insurers In World Trade Center Case
by R. A. Hettinga 29 Apr '04

29 Apr '04

...which means, that now Uncle Fed et. al. is on the hook, financially, to build the proposed bedrock-to-blue-sky mausoleum at WTC. Which stands to reason, given the fact that the property was expropriated by the state anyway, some 40+ years ago. World "Trade", indeed... Cheers, RAH ------- <http://online.wsj.com/article_print/0,,SB108326757696697579,00.html> The Wall Street Journal April 29, 2004 5:14 p.m. EDT DOW JONES REPRINTS This copy is for your personal, non-commercial use only. To order presentation-ready copies for distribution to your colleagues, clients or customers, use the Order Reprints tool at the bottom of any article or visit: www.djreprints.com. * See a sample reprint in PDF format. * Order a reprint of this article now. Jury Finds for Most Insurers In World Trade Center Case Associated Press April 29, 2004 5:14 p.m. NEW YORK -- World Trade Center leaseholder Larry Silverstein suffered a court defeat Thursday that means he won't get his $3.5 billion insurance policy paid twice over. In a partial verdict, a federal jury found that the majority of the insurers, who hold more than a billion dollars of the policy, are bound by a form that defined the Sept. 11 terrorism attack as one event. The trial was the first of at least two that will ultimately decide how much insurance money will be available to rebuild ground zero. The verdict came just after the jury said in a note that it had reached a decision days ago on all except the largest insurance company, Swiss Re International Business Insurance Co. Judge Michael Mukasey decided to accept the findings and to send the jury back to resume deliberating the Swiss Re issue. The jury did find in Silverstein's favor regarding three insurance companies, but they provided less than $200 million of the insurance for the trade center. If Mr. Silverstein prevails against Swiss Re and companies not subject to this trial, he could eventually receive a double payment for roughly $2 billion in insurance. The partial verdict came after a 21/2-month trial that focused on which insurance policies applied at the trade center when the towers collapsed on Sept. 11, 2001. Mr. Silverstein has waged a court battle since shortly after Sept. 11 to have the destruction of the trade center declared two separate events for insurance purposes, which would entitle him to two payouts of the $3.5 billion policy he was still negotiating when the towers fell. Although the 13 insurers' policy hadn't been finalized on Sept. 11, the insurers said they had signed temporary binders based on the terms of a form issued by Mr. Silverstein's broker, Willis Group Holdings Ltd. An appeals court ruled last September that that form, known as Wilprop, would define the Sept. 11 destruction of the trade center as one occurrence for insurance purposes, meaning Mr. Silverstein would only be entitled to one payout. The 13 insurers held about $2.1 billion in coverage on the trade center. A second trial will attempt to define the trade center's collapse as one attack or two. A third trial would determine how much the insurers must pay. In closing arguments last week, Mr. Silverstein's attorney Herbert Wachtell argued that the Willis brokers had switched the 13 insurers over to another policy form issued by Travelers Property Casualty Corp. in July 2001. Mr. Wachtell said that Willis broker Timothy Boyd, who obtained insurance for Mr. Silverstein, either told representatives for the insurers they were switching to Travelers, or weren't obligated to because some insurers waived the ultimate wording of the policy's form. But insurers' attorneys, led by Barry Ostrager of Swiss Reinsurance Ltd., which carried a leading 22% share of the policy, said that the Willis brokers could produce no emails or written notice to the insurers that a switch was being made. The insurers also referred to a Sept. 12, 2001, fax by Silverstein insurance manager Robert Strachan of the Wilprop form to site owner Port Authority of New York and New Jersey and a leading Silverstein lender as evidence that that was the insurance that applied at the time. Silverstein attorneys argued that Mr. Strachan was distraught the day after the attacks and mistakenly didn't receive an email attachment of the Travelers form, so just faxed what he had in his office. One Willis broker, Paul Blackmore, did testify he had emailed the Travelers form to Swiss Re underwriter Daniel Bollier, who testified that he received it, but didn't read it carefully because such a form had never been discussed with him. In his instructions to the jury, Judge Mukasey said that jurors could decide that one party in the case is bound by a form it didn't read, but only if the party had been given fair notice of the existence of that form. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: cypherpunks-digest V1 #13266
by Tim Benham 29 Apr '04

29 Apr '04

> Date: Thu, 29 Apr 2004 16:20:44 +0000 > From: Justin <justin-cypherpunks(a)soze.net> > Subject: Re: Fact checking > ... > > Australia has mandatory voting. I think that's what you're arguing > > against > > I'm arguing against any sort of coercion - whether it's a loss of > rights, being stuffed in a prison, or being beaten with a stick. You > consider voting in Australia to be mandatory? The punishment is a fine, > different from loss of suffrage but not necessarily more serious. I'm not in favor of compulsory voting, but you wont have to pay the small fine unless you're too lazy to think of an excuse. Last time I got off by claiming my foot was too sore to walk to the polling station. In practice it's only compulsory to either apply for an absentee vote or attend a polling station on election day and get your name crossed off a list. You can bin the pieces of paper the official gives you. The effect is that about 70% of voters just turn up and vote the way "their" party tells them to vote. This number is in secular decline. I think what's needed is a "None of the above" option on the ballot. If "None of the above" won a majority then the office would be left vacant. (We actually had this system for student elections at my alma mater) Non-voters obviously aren't sufficiently attracted to any of the candidates to bother voting, so they should be counted as votes for "None of the above" (but not this part -- they were doing well to get a 10% turn-out for a student election). Pretty soon we'd have no government. cheers, Tim

1 0

looping test
by Riad S. Wahby 29 Apr '04

29 Apr '04

Test message to check for looping. Please ignore. -- Riad Wahby rsw(a)jfet.org MIT VI-2 M.Eng

1 0