May 2004 - cypherpunks-legacy

Shoulder surfing for passwords by ear
by Sunder 13 May '04

13 May '04

Hmmm, sounds like we now need keystroke sound jammers. Shouldn't be too hard to implement if you have a good random noise generator, but it could get annoying if you play white/pink noise while a password prompt pops up. Of course, there's still the issue of the pinhole camera in the ceiling tiles aimed at your keyboard, but that's old hat. :) I wonder if different users hit the keys in a different enough way to make any difference... http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci9633… 'Whispering keyboards' could be next attack trend By Niall McKay, Contributing Writer 11 May 2004 | SearchSecurity.com OAKLAND -- Listen to this: Eavesdroppers can decipher what is typed by simply listening to the sound of a keystroke, according to a scientist at this week's IEEE Symposium of Security and Privacy in Oakland, Calif. Each key on computer keyboards, telephones and even ATM machines makes a unique sound as each key is depressed and released, according to a paper entitled "Keyboard Acoustic Emanations" presented Monday by IBM research scientist Dmitri Asonov. All that is needed is about $200 worth of microphones and sound processing and PC neural networking software. Today's keyboard, telephone keypads, ATM machines and even door locks have a rubber membrane underneath the keys. "This membrane acts like a drum, and each key hits the drum in a different location and produces a unique frequency or sound that the neural networking software can decipher," said Asonov. <SNIP>

3 2

Google Mail: Virtue Lies in the In-Box
by R. A. Hettinga 13 May '04

13 May '04

<http://www.nytimes.com/2004/05/13/technology/circuits/13stat.html?th=&pagew…> The New York Times May 13, 2004 STATE OF THE ART Google Mail: Virtue Lies in the In-Box By DAVID POGUE S Google's white-hot initial stock offering hogs the headlines, its rivals can only gnash their teeth and wonder: How did a couple of Stanford Ph.D. dropouts build an outrageously profitable billion-dollar-a-year company in only five years? Part of the answer is great Web-search technology. But another part is the company's motto: "Don't Be Evil." That credo explains why Google's home page is practically empty, because ads and graphics would slow dial-up modems. It also explains why Google's ads are clearly labeled and separate from search results. Slipping paid-placement links into your search results, as MSN and Yahoo do, would be evil. So six weeks ago, when Google described Gmail, the free e-mail service it is testing, the prevailing public reaction was shock. The company said that its software would place ads in your incoming messages, relevant to their contents. It appeared to many people that Google had gone way beyond evil into Big Brother land. What could be more sinister than snooping through private correspondence looking for advertising opportunities? Privacy advocates went ballistic. The Electronic Privacy Information Center called for Gmail to be shut down, describing it as "an unprecedented invasion into the sanctity of private communications." And a California state senator, Liz Figueroa, offered a bill that would make it illegal to scan the contents of incoming e-mail. (Never mind that such a bill would make it illegal for children's e-mail services to filter out pornographic material.) Those reactions, as it turns out, are a tad overblown. In fact, no human ever looks at the Gmail e-mail. Computers do the scanning - dumbly, robotically and with no understanding the words - just the way your current e-mail provider scans your messages for spam and viruses. The same kind of software also reads every word you type into Google or any other search page, tracks your shopping on Amazon, and so on. Besides, if you're that kind of private, Gmail is the least of your worries. You'd better make sure that the people at credit-card companies, mail-order outfits and phone companies aren't sitting in back rooms giggling at your monthly statements. Heck, how do you know that your current e-mail providers - or the administrators of the Internet computers that pass mail along - aren't taking an occasional peek? Still, you feel what you feel. If Gmail creeps you out, just don't sign up. That would be a shame, though, because you'd be missing a wonderful thing. Even in its current, early state, available only to a few thousand testers, Gmail appears destined to become one of the most useful Internet services since Google itself. Like Yahoo Mail and Hotmail, Gmail is a free, Web-based e-mail program, which means that you will be able to check or send e-mail from any computer on the Internet, wherever you go. Even if you already have a traditional e-mail account, a Web mail account makes a great backup. But otherwise, you wouldn't even peg Gmail as being from the same planet as Yahoo and Hotmail. The most important difference is the amount of storage: one gigabyte. That's 250 times the amount you get on a free Yahoo account, 500 times the amount on Hotmail. One gigabyte changes everything. You no longer live in terror that somebody will send you a photo, thereby exceeding your two-megabyte limit and making all subsequent messages bounce back to their senders. You're no longer neurotic about checking your mail twice a day just to keep the in-box cleaned out. You can let years' worth of e-mail pile up, complete with file attachments (maximum size: 10 megabytes each). One gigabyte means that Gmail can be a handy personal transfer disk. Send files to yourself and then retrieve them when you get to the office. Keep important pictures or documents in your Gmail account all the time, ready to forward when friends request them. In fact, Google argues that with so much storage, you should get out of the habit of deleting messages. Why risk throwing away something that you might need again someday? An Archive button moves a message out of the in-box, but it remains searchable. Actually deleting a message involves fussing with a pop-up menu. Of course, if you're going to keep all your e-mail around forever, you'd better have some pretty good tools for managing it. Fortunately, if anyone can tame a vast pile of data, it's Google. Its famous search command works brilliantly on your own e-mail, plucking one message out of 5,000 in a fraction of a second. Each message offers a hollow star icon that turns yellow when you click on it, to signify anything you like: "Deal with this," "Those darned in-laws," or whatever. Each row also displays the first line of the message in light-gray type, which is a time-saving bit of X-ray vision. Gmail doesn't have the usual mail folders. Instead, you can flag messages with labels of your own choosing. The advantage here is that you can apply different labels to a single message, in effect filing it under several categories at once. An extremely easy-to-use filter feature lets you flag incoming messages with certain labels automatically according to who sends them, what's in their subject line and so on. Yet another clever organizational feature is "conversations," known to computer geeks as threading. Back-and-forth messages on a single topic, even among several participants, appear as one entry in your in-box. When opened, the exchanges appear like file-folder tabs, which you can expand or collapse individually or all at once. And now, about those ads. They turn out to be a maximum of three text-only four-line affairs, clearly labeled and way off the to the right, just as on Google itself. In my e-mail, a message about Earth Day contained an ad for a computer-recycling company. A question about music players had two ads for stores selling the Apple iPod. In a press release for a computer show, a Linuxworld link appeared. You sometimes get Releated Links beneath the ads, too. Google doesn't get money for these; it offers them just to be friendly, and they can sometimes be useful indeed. For example, in a message about a coming family vacation, sent from my wife downstairs (yes, we're that sort of family), Google offered a link to a Web site of restaurant reviews in the resort town we were considering. Ads appear in fewer than half of my messages; in fact, they seem to appear primarily when a capitalized brand name appears in the message. If your correspondence is mostly personal stuff ("Miss you guys. How did Casey's toe surgery go? Went out to the new vegetarian steakhouse yesterday - great."), you may not see many at all. The ads are so subtle, so easily ignored, that it's hard to imagine anyone preferring the big, blinking, slow-loading graphic ads that appear every time you check for messages at the Hotmail and Yahoo Mail sites. Even more refreshing, Gmail doesn't turn you into an unpaid billboard for Yahoo or Microsoft (Hotmail's owner) by stamping ads on at the bottom of every outgoing message, no matter how sensitive the topic. Other Gmail features include an excellent spelling checker, a built-in address book, auto-complete for addresses, the ability to specify a Reply To address (a different e-mail address for replies to your messages), indicators (>>) that denote messages sent only to you, in-message photo display, online help and one-key shortcuts (C for Compose, R for reply, and so on) that let power users cruise through entire e-mail sessions without ever touching the mouse. The automatic spam-removal feature is adequate for the moment, but once thousands of people begin to use the Report Spam button, Google plans to harness the cumulative intelligence of its customers to refine its spam filters in innovative ways. Finally, Google promises that it won't shut down your account until you go nine months without using it. (Hotmail and Yahoo delete all your mail and recycle your address after only 30 days). Now that's not being evil. Google hasn't said when, exactly, Gmail's testing period will end and the service will go live. That's just as well, because there are a few items that should still be on its To Do list: compatibility with Apple's Safari browser (at the moment, it works on on the Mac, Windows and Linux versions of Mozilla, Firefox and Netscape 7.1, plus Internet Explorer for Windows ), for example, and a signature feature that stamps your name on each outgoing message. It would be nice if you could use regular e-mail readers like Outlook Express to check your Gmail, as you can withHotmail. A certain audience will miss the ability to format outgoing messages with fonts, styles and colors, too. Otherwise, Gmail is infinitely cleaner, faster, more useful, more efficient, less commercial and less limiting than other Web-based e-mail services. Once Gmail goes live, Hotmail and Yahoo won't know what hit them. The only population likely not to be delighted by Gmail are those still uncomfortable with those computer-generated ads. Those people are free to ignore or even bad-mouth Gmail, but they shouldn't try to stop Google from offering Gmail to the rest of us. We know a good thing when we see it. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Chinese youths trash Internet caf�
by R. A. Hettinga 13 May '04

13 May '04

<http://www.theregister.co.uk/2004/05/12/china_cybercafe/print.html> The Register Chinese youths trash Internet cafi By Tim Richardson (tim.richardson(a)theregister.co.uk) Published Wednesday 12th May 2004 11:40 GMT Staff at a Chinese Internet cafe have resigned after they were beaten up last week by a gang of 16 teenagers barred from entering the cybercafe. The gang of youths beat one worker with bins and fire extinguishers before trashing the Internet cafi. Earlier they threatened to beat up anyone who "dared to check identity cards" after being refused entry to the cybercafe. The attack is the latest in as series of assaults at an Internet chain in Xi'an, capital of Shaanxi Province in northwest China, and follows a recent Government crackdown to prevent minors from entering cybercafes. The Chinese Government is concerned the Net can corrupt the minds of youngsters. But the clampdown has only sought to enrage some whippersnappers, who, in one attack, even slashed bicycle tyres, according to Xinhuanet. In a separate incident, two cybercafe workers in Shanghai were killed over an argument about the use of computers. According to AP, around ten men chased the two workers before stabbing them to death. China has shut down more than 8,600 cybercafes over the last couple of months over fears that they can affect the "mental health of teenagers" while spreading "unhealthy online information". As part of China's bid to protect youngsters, authorities also ruled that Internet cafes are not to operate in residential areas or within 200 metres of primary and high schools. . -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

We're jamming, we're jamming, we hope you like jammin too
by Major Variola (ret) 13 May '04

13 May '04

At 03:09 PM 5/11/04 +0200, Eugen Leitl wrote: >The second covers a "hacking the system" concept. I'd considered >something similar myself, though different in approach. Rather than >finding RFID chips and "redistributing" them, why not create >programmable RFID broadcasters which could spoof other chips, and >distribute these. The idea being to pollute any RFID detectors with a >vast spew of superfluous data. RFID jamming should be very easy and a quite amusing DoS attack on commercial targets. Easy because its not frequency hopping, low power, and relatively low frequency. Particularly cute would be transmitting sex-toy codes intermittently. ASK any Elmer you happen to see, what's the best jamming, RFID.. (With apologies to the tuna industry and those too young to know the jingle. Or to know the RF double meanings.)

5 4

Re: We're jamming, we're jamming, we hope you like jammin too
by Major Variola (ret) 12 May '04

12 May '04

>> ASK any Elmer you happen to see, >> what's the best jamming, RFID.. >> (With apologies to the tuna industry and those too young to >> know the jingle. Or to know the RF double meanings.) >Interesting cultural reference that goes entirely above my head with a >cute swooshing sound. >Care to explain, please? :) I hope the subject line was not too obscure, mon. ASK = amplitude shift keying, which I believe is the RFID modulation Elmer = guru/wizard/elder in HAMspeak Jingle: Ask any mermaid you happen to see, what's the best tuna? Chicken of the sea. Ie, fish in cans. Sorry Charlie. Charlie don't surf, but that's because tuna cans don't give enough forward gain. Tying knots in the cultural web, MV

1 0

Illuminating Blacked-Out Words
by R. A. Hettinga 12 May '04

12 May '04

<http://www.nytimes.com/2004/05/10/technology/10crypto.html?pagewanted=print…> The New York Times May 10, 2004 Illuminating Blacked-Out Words By JOHN MARKOFF European researchers at a security conference in Switzerland last week demonstrated computer-based techniques that can identify blacked-out words and phrases in confidential documents. The researchers showed their software at the conference, the Eurocrypt, by analyzing a presidential briefing memorandum released in April to the commission investigating the Sept. 11 attacks. After analyzing the document, they said they had high confidence the word "Egyptian" had been blacked out in a passage describing the source of an intelligence report stating that Osama Bin Ladin was planning an attack in the United States. The researchers, David Naccache, the director of an information security lab for Gemplus S.A., a Luxembourg-based maker of banking and security cards, and Claire Whelan, a computer science graduate student at Dublin City University in Ireland, also applied the technique to a confidential Defense Department memorandum on Iraqi military use of Hughes helicopters. They said that although the name of a country had been blacked out in that memorandum, their software showed that it was highly likely the document named South Korea as having helped the Iraqis. The challenge of identifying blacked-out words came to Mr. Naccache as he watched television news on Easter weekend, he said in a telephone interview last Friday. "The pictures of the blacked-out words appeared on my screen, and it piqued my interest as a cryptographer," he said. He then discussed possible solutions to the problem with Ms. Whelan, whom he is supervising as a graduate adviser, and she quickly designed a series of software programs to use in analyzing the documents. Although Mr. Naccache is the director of Gemplus, a large information security laboratory, he said that the research was done independently from his work there. The technique he and Ms. Whelan developed involves first using a program to realign the document, which had been placed on a copying machine at a slight angle. They determined that the document had been tilted by about half a degree. By realigning the document it was possible to use another program Ms. Whelan had written to determine that it had been formatted in the Arial font. Next, they found the number of pixels that had been blacked out in the sentence: "An Egyptian Islamic Jihad (EIJ) operative told an xxxxxxxx service at the same time that Bin Ladin was planning to exploit the operative's access to the US to mount a terrorist strike." They then used a computer to determine the pixel length of words in the dictionary when written in the Arial font. The program rejected all of the words that were not within three pixels of the length of the word that was probably under the blackened-out area in the document. The software then reduced the number of possible words to just 7 from 1,530 by using semantic guidelines, including the grammatical context. The researchers selected the word "Egyptian" from the seven possible words, rejecting "Ukrainian" and "Ugandan," because those countries would be less likely to have such information. After the presentation at Eurocrypt, the researchers discussed possible measures that government agencies could take to make identifying blacked-out words more difficult, Mr. Naccache said in the phone interview. One possibility, he said, would be for agencies to use optical character recognition technology to rescan documents and alter fonts. In January, the State Department required that its documents use a more modern font, Times New Roman, instead of Courier, Mr. Naccache said. Because Courier is a monospace font, in which all letters are of the same width, it is harder to decipher with the computer technique. There is no indication that the State Department knew that. Experts on the Freedom of Information Act said they feared the computer technique might be used as an excuse by government agencies to release even more restricted versions of documents. "They have exposed a technique that may now become less and less useful as a result," said Steven Aftergood, a senior research analyst at the Federation of American Scientists, of the research project. "We care because there are all kinds of things withheld by government agencies improperly." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: We're jamming, we're jamming, we hope you like jammin too
by Trei, Peter 12 May '04

12 May '04

You might want to look at the work RSA Labs is doing on 'blocker tags'. These are special tags which leverage the mechanism used to disambiguate the presence of multiple tags to make it look as if you are carrying 2^n (n usually 128) different tags at once. They propose a protocol to make them only block tags for items which have undergone sale to their final owner, but the idea could be applied to all tags. http://www.rsasecurity.com/rsalabs/rfid/index.asp Peter Trei Full Disclosure: I work for RSA > -----Original Message----- > From: owner-cypherpunks(a)minder.net > [mailto:owner-cypherpunks@minder.net]On Behalf Of Major Variola (ret) > Sent: Wednesday, May 12, 2004 1:48 PM > To: cypherpunks(a)al-qaeda.net > Subject: We're jamming, we're jamming, we hope you like jammin too > > > At 03:09 PM 5/11/04 +0200, Eugen Leitl wrote: > >The second covers a "hacking the system" concept. I'd considered > >something similar myself, though different in approach. Rather than > >finding RFID chips and "redistributing" them, why not create > >programmable RFID broadcasters which could spoof other chips, and > >distribute these. The idea being to pollute any RFID > detectors with a > >vast spew of superfluous data. > > RFID jamming should be very easy and a quite amusing DoS attack > on commercial targets. Easy because its not frequency hopping, low > power, and relatively low frequency. Particularly cute would be > transmitting sex-toy codes intermittently. > > ASK any Elmer you happen to see, > what's the best jamming, RFID.. > > (With apologies to the tuna industry and those too young to > know the jingle. Or to know the RF double meanings.)

1 0

Re: who goes 1st problem
by Jason Holt 12 May '04

12 May '04

[Adam and I are taking this discussion off-list to spare your inboxes, but this message seemed particularly relevant. Perhaps we'll come back later if we come up with anything we think will be of general interest.] -J On Tue, 11 May 2004, Adam Back wrote: > Anyway the who goes 1st problem definition has my interest piqued: I > am thinking this would be a very practically useful network protocol > for privacy, if one could find a patent-free end-2-end secure (no > server trust), efficient solution. Another desirable feature I think > is to not use too much funky crypto, people are justifiably nervous > about putting experimental crypto into standards, even if it has > security proofs until some peer review has happened. Agreed. Ninghui Li's RSA OSBEs might be the answer; they're not quite as elegant as the IBE version, but they work with blinded RSA signatures, and so should be patent-free by next year, assuming Ninghui doesn't seek any patents. Section 4 of his PODC paper describes the RSA implementation. He also has a new paper which does neat things with commitments that I haven't wrapped my mind around yet. Actually, we might also consider contacting Dan Boneh at some point; he seems to be interested in the proliferation of IBE, and might be sympathetic to the needs of the IETF to have free standards, especially considering the exposure it'd get for his system. However, we need to define just what we need to accomplish. Since my lab works in trust negotiation, we think in terms of policies a lot, whereas SSL just assumes you know what certs you want to send to whom. But let's assume the SSL model for simplicity. The second issue, now that I think of it in this context, would be how you actually get your certs to the other guy. Hidden credentials, as Ninghui pointed out, assume you have some means for creating the other guy's cert, eg., a template "(nym):Senior_Agent:(current year)" producing "Bob:Senior_Agent:2004". The OSBE paper, OTOH, assumes we're going to exchange our certificates, just without the CA signatures. Then I can send you messages you can only read if you really do have a signature on that cert. But I've always thought that was problematic, since why would honest people bother to connect then use fake certs? The attacker doesn't need to see the signature - he believes you. So honest users would need to regularly give out fake certs so they can hide their legit behavior among the fake connects. Will Winsborough also suggests this with the notion of ACK policies - you *always* give people something they ask for, so they can't tell what you have and what you don't. So maybe what we really want is some sort of fair exchange or something, where I can show you my valid certs as you show me the valid certs of your own. If one side is guessable, we've discussed this sort of thing with hidden creds: E("Hi Bob, since you're a senior agent, you can see my agent credential: 'Alice:Denver field office agent (apprentice):2004", "Bob:Senior_Agent:2004") E("Hi Bob, since you're a BYU alumnus, you can see my BYU credential: 'Alice:Senior:computer science:3.96 gpa:2004", "Bob:Senior_Agent:2004") etc. So that's an open problem. But let's assume guessable-certs, since that's the only way I know how to really keep certs and policies safe for now. The OSBE-RSA math still works. So we're good so far, except that the RSA approach is interactive. Section 4 says that in the RSA scheme, Alice sends her cert /and blinded signature/ to Bob (which may or may not be bogus), and then Bob can send back an encrypted message. (In HC and IBE-OSBEs, Bob doesn't need the blinded signature to use as a public key). But maybe Robert's improved secret sharing scheme from the new HC paper can give us some ideas: 1. Alice sends blinded signatures for each of her relevant certs, not revealing which signature goes with each cert, and not revealing the cert contents. 2. Bob generates the contents of each of Alice's certs relevant to his policy, and simply generates each possible combination of hash-of-cert-contents and blinded-signature. One from each row will be a match-up between contents and signature, and Alice will have to figure out which. Unfortunately, this requires n^2 multiplies and exponentiations. -J

2 1

Re: [linux-elitists] Two on RFID from Politech: Hack the tech, & Gilmore's dystopia (fwd from dmarti@zgp.org)
by Eugen Leitl 12 May '04

12 May '04

----- Forwarded message from Don Marti <dmarti(a)zgp.org> -----

1 0

Wikipedia project: Crypto
by R. A. Hettinga 11 May '04

11 May '04

--- begin forwarded text

1 0