January 2005 - cypherpunks-legacy

sitting ducks
by Major Variola (ret) 06 Jan '05

06 Jan '05

At 12:16 PM 1/4/05 -0500, John Kelsey wrote: >Interesting questions: How hard is it for someone to actually hit an airplane with a rifle bullet? How often do airplane maintenance people notice bulletholes? > >My understanding is that a single bullethole in a plane is not likely to do anything serious to its operation--the hole isn't big enough to depressurize the cabin of a big plane, and unless it hits some critical bits of the plane, it's not going to cause mechanical problems. FWIW Recall that a few 'copters have been taken down with AK fire, though the birds/round is likely low. And copters are more delicate than a multi-engined fixed wing. Hitting the cabin would be pretty effective though. And certain parts of big planes are vital, perhaps moreso on fly by wire Airbus planes. A homemade mortar through the roof of your van (IRA style) onto a stationary, taxiing plane would be pretty spectacular, sitting ducks... lots of cameras... easy getaway or repeat fire.. Of course the BMG crap is all about eroding rights, not reality.

1 0

Technology vs social solutions
by Major Variola (ret) 06 Jan '05

06 Jan '05

At 12:06 PM 1/4/05 -0500, John Kelsey wrote: >>From: "Major Variola (ret)" <mv(a)cdc.gov> >>3. Homebrew warning systems will face the same problems as eg pro >>volcano warning systems: too many false alarms and no one cares. > >The best defense would seem to be a population with a lot of TVs and radios. At least after the first tsunami hit, the news would quickly spread, and there were several hours between when the waves arrived at different shores. (And a 9.0 earthquake on the seafloor, or even a 7.0 earthquake on the seafloor, is a rare enough event that it's not crazy to at least issue a "stay off the beach" kind of warning.) Actually, people should know this as *background* in the same way that you know not to stand in open fields during lightening, play with downed powerlines, or walk into tail rotors. I think some places have signs pointing to higher elevations, with wave-glyphs. I know that FLA has signs like that for hurricane storm-surges, and there are tornado signs in the midwest. The rational explanation, I suppose, is that tsunami are so rare that the knowledge is not maintained. (How many 'Merkins would know how to construct a nukebomb shelter these days? How many SoCal'ians know how to drive on icy roads?) Of course, broadcast media are used to tell people the obvious, eg don't play in channellized rivers during storms, and the evolution of the species suffers slightly but not entirely from the caveats.

1 0

AOL Help : About AOL� PassCode
by R.A. Hettinga 06 Jan '05

06 Jan '05

<http://help.channels.aol.com/article.adp?catId=6&sCId=415&sSCId=4090&articl…> Have questions? Search AOL Help articles and tutorials: How To: Billing Channels Communicating Online E-Mail More Subjects Products and Services AOL.COM AOL® Computer Check-Up AOL Deskbar AOL® Calendar AOL® File Backup AOL® PassCode AOL® Privacy Wall inStore Money Alerts Technical Support More Help: Help Tutorials Auto Fixes Pop-Up Controls Spam & Mail Controls Anti-Virus Center AOL Help Community Safety, Security & Privacy AOL Voice Services Products and Services >> AOL® PassCode About AOL® PassCode After purchasing and receiving your AOL® PassCode, go to AOL Keyword: PassCode and this screen appears, allowing you to secure your screen name to your AOL PassCode. On this screen you can also release your screen name from AOL PassCode, change service plans and order additional AOL PassCodes. Account Status This area lists your current AOL PassCode service plan, including the secured and unsecured screen names within the plan. If the maximum number of screen names in your service plan are secured to your AOL PassCode, the Manage Service Plan button will appear. View PassCode Account Activity Displays a screen listing a summary of your AOL PassCode account activity, such as the date you purchased your subscription, ordered AOL PassCode devices and details such as the price plan ordered and the quantity of AOL PassCodes ordered. Secure Screen Name To help protect your screen name with AOL PassCode, you need to secure your screen name to your specific AOL PassCode device. Each AOL PassCode has a unique serial number engraved on its back. By associating your screen name with a specific AOL PassCode serial number, the AOL service will know which six-digit number needs to be entered at each sign-on, helping to protect your screen name from unauthorized access. To secure a screen name to your AOL PassCode 1. Sign on to the AOL® service with the screen name you want to secure to your AOL PassCode. 2. Go to AOL Keyword: PassCode. 3. Click Secure Screen Name. 4. Type the eight-digit serial number engraved on the back of your AOL PassCode. 5. Type the six-digit number displayed on the front of your AOL PassCode. 6. Click Save. A confirmation screen appears. This change takes effect immediately and will be enforced the next time you sign on to the AOL service. Whenever you sign on to the AOL service using the screen name that you secured to AOL PassCode, you will be required to enter the six-digit number on the front of your AOL PassCode. Release Screen Name When the screen name you signed on to the AOL service with has already been secured to your AOL PassCode, the Secure Screen Name button changes to Release Screen Name. If you no longer want to use AOL PassCode, you must release your screen name from your AOL PassCode so that you will no longer need to enter a six-digit code when you sign on to any AOL service. To release your screen name from your AOL PassCode 1. Sign on to the AOL service with the screen name you want to release from your AOL PassCode. 2. Go to AOL Keyword: PassCode. 3. Click Release Screen Name. The Secure Screen Name button changes to Release Screen Name when that particular screen name is secured to AOL PassCode. 4. Enter the answer to your account security question. For more information, see What is an Account Security Question. 5. Type the eight-digit serial number engraved on the back of your AOL PassCode. 6. Type the six-digit number displayed on the front of your AOL PassCode. 7. Click Save. This change takes effect immediately, and removes the AOL PassCode protection for subsequent sign-ons. Manage Service Plan Displays a screen with AOL PassCode service plan options, allowing you to change your current service plan. Order more PassCodes Displays a screen allowing you to order additional AOL PassCodes. Live Customer Support Contact AOL 24 hours a day, seven days a week! Chat With Us: Technical SupportBilling Support Call Us: Talk to an expert. AOL Help Main | Manage Your Account | Safety & Security | Anti-Virus | Upgrade Center | Feedback | Privacy Policy Copyright © 2004 America Online, Inc. All rights reserved. Back to Top AOL 9.0 SE/LE Change Version -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

6 6

Re: Banks Test ID Device for Online Security
by Eugen Leitl 06 Jan '05

06 Jan '05

On Wed, Jan 05, 2005 at 02:43:00PM -0300, Mads Rasmussen wrote: > Here in Brazil it's common to ask for a new pin for every transaction Ditto in Germany, when PIN/TAN method is used. There's also HBCI-based banking, which either uses keys living in filesystems, or smartcards -- this one doesn't need TANs. Gnucash and aqmoney/aqmoney2 can do HBCI, even with some smartcards. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

RE: Banks Test ID Device for Online Security
by Bill Stewart 06 Jan '05

06 Jan '05

>R.A. Hettinga wrote: > > Okay. So AOL and Banks are *selling* RSA keys??? > > Could someone explain this to me? At 12:24 PM 1/4/2005, Trei, Peter wrote: >The slashdot article title is really, really misleading. >In both cases, this is SecurID. Yup. It's the little keychain frob that gives you a string of numbers, updated every 30 seconds or so, which stays roughly in sync with a server, so you can use them as one-time passwords instead of storing a password that's good for a long term. So if the phisher cons you into handing over your information, they've got to rip you off in nearly-real-time with a MITM game instead of getting a password they can reuse, sell, etc. That's still a serious risk for a bank, since the scammer can use it to log in to the web site and then do a bunch of transactions quickly; it's less vulnerable if the bank insists on a new SecurID hit for every dangerous transaction, but that's too annoying for most customers. ---- Bill Stewart bill.stewart(a)pobox.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

2 1

Re: FreeBSD's urandom versus random
by R.A. Hettinga 05 Jan '05

05 Jan '05

--- begin forwarded text

1 0

Globalization and 'Contract Culture'
by R.A. Hettinga 05 Jan '05

05 Jan '05

<http://www.techcentralstation.com/010505A.html> Tech Central Station Globalization and 'Contract Culture' By Christopher Lingle Published 01/05/2005 It is obvious that the process of globalization inspires great disagreement concerning its nature and impact. Despite acts of terrorism and labor disputes that have marked this public discussion, one point of agreement is that this process is seemingly irresistible. A sober assessment of the merits of the arguments in this debate requires identifying some essential elements behind this momentum. One place to start is to discard an important misinterpretation. Globalization should not be confused with Westernization or Americanization of economies and cultures. Perhaps this muddled thinking arises from an observed sense of convergence towards certain norms or rules that are associated with Western cultures, especially concerning commercial considerations. Promoting this misconception adds to an unwelcome divisiveness. It also implicitly assigns a sense of domination or superiority of American or Western culture over others, itself a patently foolish assertion. The view offered here is that this convergence is a natural and evolutionary procedure. In this sense, global convergence arises from voluntary choices by citizens and their governments to engage in worldwide markets to achieve some individual and collective goals, including shared prosperity. Indeed, the overpowering nature that some observers find so troubling is actually the outcome of choices made by most other members of their own communities. In the end, the movement is towards the establishment of and guidance by the legal bounds that govern contracts. As will be argued, exposure to contracts has important impacts on cultures since it imposes greater accountability on businesses as well as governments. As such, globalization should not be viewed as the outcome of anonymous, outside and mysterious forces. Instead, an important source of globalizing influences in a local economy arises from choices made by most of ones' compatriots who prefer better or cheaper products that are imports rather than shoddy or higher priced ones produced locally. In this narrow interpretation, globalization can be seen as a universal application of democracy. Opposition to these results is tantamount to an elitist loathing of thy neighbor, or at least their choices. In all events, the spreading of the benefits of globalization depends upon how well markets function, because competitive markets are a force that empowers consumers and humbles producers. And well-functioning markets require and inspire a certain attitude towards agreements that can be identified as a "contract culture". A contract culture exists when all parties in an agreement are predictably treated as equals whenever there is a legal dispute or a need for interpretation of the conditions behind the pact. Markets both depend upon and set the stage for the emergence of a contract culture as well as providing an impetus for the emergence of a commercial morality and a wider application of trust. In turn, institutional frameworks evolve to reinforce and reward or punish actions in reference to the agreements and the legal institutions that support them. This convergence is inspired by globalization. While most may think that the discussion only involves private contracts concerning commercial transactions, it also covers social contracts like constitutions that specify duties and obligations of citizens and rulers. Markets inspire the development of a contract culture where the spirit of compromise becomes part of human interaction. In such a setting, equals are treated as equals just as unequals must also be treated as equals before the law. Governments or large corporations should not receive special treatment in the courts over individual citizens while domestic interests should not override those of foreign claimants. At the same time, interactions within a community where contracts are widely negotiated can bring about a greater appreciation for compromise and humility that might undermine future claims for authoritarian leadership. Viewed from this vantage point, capitalism and free markets are seen to provide a necessary underpinning for democracy's success rather than merely a sufficient one. It is through individualist-based institutions associated with and arising from markets that people exercise true self-ownership to pursue their own chosen goals. The importance of establishing a contract culture cuts deep. It is an intangible element in the measurement of growth factors, but it is certainly an essential element of the institutional framework for an active player in the global economy. Apart from promoting political stability due to greater fairness, the contract culture is also associated with "middle-class values" like the importance of education, thrift and moral values that promote hard work and honesty in contract fulfilment. Globalization can reduce some of the economic vagaries by eliminating some of the sources of recurrent crises. During periods of rapid economic growth, massive cash flows can compensate for some of the inconveniences arising from a weak adherence to contractual obligations. Once an economy reaches a certain level of maturity or begins to lose its comparative advantages, the importance of legal protections becomes clearer. It is the absence of such safety measures that induce investors to undertake reassessments that can lead to the sort of mass exoduses of capital like the one associated with the Asian crises that began in 1997. In many Asian countries, the dominance of autocratic rule led to an entrenchment of hierarchical power relations that retard the development of a local contract culture. Outside of some former British colonies, few Asian countries have an independent and competent judiciary that issue ruling based upon strict interpretations of a body of law concerning fulfilment of contracts that includes predictable bankruptcy proceedings. Yet the exposure to and pressures from the international marketplace will eventually pressure governments to adhere to the rule of law. Some opponents to globalization express legitimate concerns. Perhaps the most compelling objection is the fear of the dilution of local culture. Nonetheless, opening a community to global influences is most likely to reveal the strengths of those elements that are worth keeping and undercover weak points that might be given up. (It is worth noting that the Dutch have been deeply engaged in the globalization process for many centuries without losing their unique cultural identity.) An assessment of globalization should begin with the fact that it introduces a contract culture in association with the rule of law as the basis of a modern market-based economy. Although there will always be transition costs of such monumental changes, there are solid reasons to believe these will be exceeded by the benefits. Above all other benefits is the increased commercial and political accountability that offers greater protections to citizens and consumers. Christopher Lingle is Global Strategist for eConoLytics. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: Banks Test ID Device for Online Security
by Trei, Peter 05 Jan '05

05 Jan '05

R.A. Hettinga wrote: > Okay. So AOL and Banks are *selling* RSA keys??? > Could someone explain this to me? > No. Really. I'm serious... > > Cheers, > RAH > -------- The slashdot article title is really, really misleading. In both cases, this is SecurID. Peter

2 1

Why HDTV Hasn't Arrived In Many Homes
by R.A. Hettinga 04 Jan '05

04 Jan '05

<http://online.wsj.com/public/article_print/0,,SB110488131948416964,00.html> The Wall Street Journal January 5, 2005 TELECOMMUNICATIONS Why HDTV Hasn't Arrived In Many Homes By SARAH MCBRIDE, PHRED DVORAK and DON CLARK Staff Reporters of THE WALL STREET JOURNAL January 5, 2005 Eric Olander has a new love, his Sony high-definition TV. But something is coming between them: High-definition television programming. Mr. Olander adores the picture quality on the high-definition channels he gets from EchoStar Satellite LLC, but there are at best only nine available to him. Whenever he switches back to a regular channel, "everything seems substandard," he says. Adding insult to injury, his TiVo doesn't record high-definition programs in high definition: When he plays them back, they look like ordinary TV. And some of the programs are simply conventional movies converted into a digital form, so they don't have the crisp quality he's grown addicted to. "It's just not enough," says Mr. Olander, a 34-year-old manager at a Los Angeles television station and a gadget freak. Gripes from demanding customers like Mr. Olander help explain why so many cool technologies -- from high-definition TV to home networking to interactive TV -- just aren't catching on yet. Besides shortcomings in existing products, battles over technical standards and fear of video piracy are slowing manufacturers' ability to deploy new stuff. Many potential customers, disappointed and confused, are walking out of stores empty-handed. The good news: Manufacturers are well aware of the problem. Progress in speeding the delivery of digital content and technology will be a major theme among industry giants converging at the Consumer Electronics Show in Las Vegas, which formally opens tonight. For example, Hewlett-Packard Co. and Matsushita Electric Industrial Co., better known as Panasonic, today are announcing a peace agreement in a long-running format war over recordable DVDs. Each company plans to adopt the other's formats, known by confusing acronyms that include +R and RAM. As a result, users will be able to more easily edit video on a Hewlett-Packard PC that was recorded on a Panasonic DVD recorder. "Seamless is a key word," says Naoto Noguchi, vice president of Panasonic's audio-visual business unit. (See related story1.) Now for the bad news. Despite some advances, companies are still moving pretty slowly, not least because they tend to delay progress that can help rivals. Take, for example, the issue of content compatibility. Imagine that a movie purchased from a Best Buy store could only be played on a DVD player that also was bought at Best Buy -- and not on a player from Circuit City or Radio Shack. That is, in essence, what is happening in online music, the first big digital-content battleground. The only major paid download service that works with Apple Computer Inc.'s iPod device is Apple's own iTunes, because of the copyright protection used by the computer maker. In July, a rival online music service, RealNetworks Inc., cracked the Apple system with a technology called Harmony so that customers who bought songs from RealNetworks could play them on an iPod. Apple has taken steps to modify its offerings to prevent iPods from working with Harmony. Such infighting is very common with emerging technology, where design incompatibilities "are a huge impediment to adoption," says Paul Kocher, president of Cryptography Research Inc., a digital security consultancy. Historically, consumer-electronics makers had little need to cooperate with rivals, because their TVs, stereos and other audio-visual gear were standalone products. Attempts at cooperation on common standards often erupted into format wars, such as the famous battle in the 1970s between Betamax videocassettes, backed by Sony Corp., and VHS, backed by Japan Victor Corp., or JVC. Today, getting high-definition TV is already something of a struggle. Viewers who don't receive a special set-top box from a cable or satellite provider must purchase a separate tuner to be able to see high-definition pictures. And people who use the words "digital" and "high def" interchangeably could be in for a nasty surprise when they get their TV home: Not all digital TVs show high-definition programming. Other battles are slowing high-definition content's arrival in homes. A high-capacity successor to the DVD, for example, is needed before consumers can buy or rent high-definition movies. Already two competing technologies, dubbed Blu-ray and HD DVD, have divided the nascent market into warring camps. Determined to make sure the new disks aren't copied as easily as today's CDs and DVDs, movie studios, electronics companies and others are pondering an array of content-protection technologies. Because movies are more difficult to transfer than songs, video piracy hasn't hurt the major studios as badly as music piracy has hurt major record groups. But it has contributed to delays. "The threat is still vaguely theoretical," says Talal Shamoon, chief executive officer of InterTrust Technologies Corp., Sunnyvale, Calif., a pioneer in copyright-protection technology. "The good news is there is still time; the bad news is there is still time." In home networking, electronics makers' tendency to go their own way has led to a muddle of competing standards that could mean a "networked" Sony TV, for instance, wouldn't talk to a PC from Toshiba Corp. Some Sony TVs came with software that let you access video or audio files on your PC -- as long as it was a Sony Vaio PC. Industry giants are slowly working out some of these challenges. One standard-setting group, the Digital Living Network Alliance, is working on standard specifications for connecting consumer-electronic devices and moving files between them. In content protection, industry giants such as IntelCorp. and Microsoft Corp. are backing a technology consortium known as AACS LA, for Advanced Access Content System Licensing Administrator. Another group, the Coral Consortium, favored by H-P, Philips NV and others, is trying to develop ways for different copyright-protection technologies to work together. "I think we are to the point where the forces are converging," says Steve Canepa, a vice president at International Business Machines Corp., which endorses the AACS LA effort. The sheer size of digital media files is another problem for consumers. Wireless networks haven't been fast and reliable enough to dependably move high-definition video around the house. A Silicon Valley start-up, Video54 Technologies Inc., is set to unveil a new antenna technology at the consumer-electronics show that can help steer wireless signals around obstacles in the home and deliver smooth video images. "We are ready to roll into production" with the technology, says Patrick Lo, chief executive officer of Netgear Inc., which makes wireless access devices. Interactive TV has faced similar obstacles. Television studios are working on prototypes of shows allowing fans to play games integrated into programming. But each satellite and cable operator has proprietary technology, based on remote controls or other devices users would use to interact with programs. So the studios must select one system to work with, or go through a laborious process of adapting their content for more than one. Cable companies are working on a single standard for interactive TV known as Open Cable Applications Platform. It would bring the five major cable companies onto the same page, but satellite systems still may develop their own programming, for competitive reasons. "This will be used as a very big corporate advantage among the operators, " says Scott Higgins, EchoStar's director of interactive programming. If proprietary interactive content is strong enough, "you will be stealing viewers from the competition." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: Banks Test ID Device for Online Security
by Bill Stewart 04 Jan '05

04 Jan '05

>R.A. Hettinga wrote: > > Okay. So AOL and Banks are *selling* RSA keys??? > > Could someone explain this to me? At 12:24 PM 1/4/2005, Trei, Peter wrote: >The slashdot article title is really, really misleading. >In both cases, this is SecurID. Yup. It's the little keychain frob that gives you a string of numbers, updated every 30 seconds or so, which stays roughly in sync with a server, so you can use them as one-time passwords instead of storing a password that's good for a long term. So if the phisher cons you into handing over your information, they've got to rip you off in nearly-real-time with a MITM game instead of getting a password they can reuse, sell, etc. That's still a serious risk for a bank, since the scammer can use it to log in to the web site and then do a bunch of transactions quickly; it's less vulnerable if the bank insists on a new SecurID hit for every dangerous transaction, but that's too annoying for most customers. ---- Bill Stewart bill.stewart(a)pobox.com

1 0