February 2005 - cypherpunks-legacy

Cybercash on Vacation
by R.A. Hettinga 17 Feb '05

17 Feb '05

<http://www.technologyreview.com/articles/05/03/issue/forward_cybercash.asp?…> Technology Review TechnologyReview.com Print | Forums Cybercash on Vacation By Peter Wayner March 2005 Back in 1996, a small handful of cryptographers, bankers, and blue-sky thinkers were debating, on Internet mailing lists, the future of money, when one of them came up with a brilliant idea. If they formed an organization, booked a Caribbean hotel in the dead of winter, and put a few papers through the peer review process, they could get their bosses to pay them to hang out in person. They could sit in the sun and dream about what it would take to move cash, settle debts, sell things, sign contracts, and extend credit in the virtual world. Bob Hettinga, an organizer of the resulting Financial Cryptography Conference, sounds a bit maudlin when he looks back at that first meeting, which took place in February 1997 on the island of Anguilla: "It was like all the net-dot-gods descended on Anguilla. Geeks, financial, cryptographic, and otherwise. Cypherpunks. Bankpunks, pseudonymous individuals, guys who would go on to become senior administration officials, and even people who were paying the $1,000 conference fee in cash because their corporate-sponsored lawyers told them to stay out of the papers after various previous escapades." This year's conference, taking place in February and March in the Commonwealth of Dominica, doesn't have the same luster. The program is jammed with papers about "privacy-preserving protocols" and "probabilistic escrow" but contains little from the nonacademic world. The people who work at actual financial institutions just aren't as interested in financial cryptography as they were in 1997. It wasn't supposed to be this way. In 1997, the bankers, lawyers, and accountants were fascinated by what the digital magicians could do with a few equations. Even though it's easy to make perfect copies of digital files, for instance, mathematicians found a way to produce a digital $50 bill that would stymie counterfeiters. They didn't stop there. They imagined transactions that avoided the overhead of a central clearing house, digital currency that paid interest, and even complicated digital rights management tools that locked up music, art, and writing with the same equations used to protect money. Some talked about minting just 500 digital baseball cards for each player and letting the values rise and fall with batting averages. In short, they imagined a world where wealth was not frozen in gold and locked in vaults, but rather held in digital mechanisms that could adapt to whatever people wanted. Some mechanisms could even be as anonymous as paper cash, and transactions wouldn't require much more than the click of a mouse. But while the mathematics is still fascinating, the emergence of any system based on it is receding into the nebulous future. Today, credit card companies dominate the Web with a system that, at its heart, is little different from the one that employed carbon-paper chits. One of the few companies to find some success in financial cryptography, PayPal, gets most of its revenue from eBay auctions, where it serves, in essence, as a well-designed front end for the credit card system. Adam Shostack, another of the original organizers, thinks that the reason for the failure of financial cryptography is simple. "People are conservative in how they pay for things," he says. Indeed, the problem for financial cryptography's would-be pioneers is that the old credit card system seems to be good enough for the new online world. If Amazon, Wal-Mart, and other e-commerce sites can keep customers happy with plastic cards, there's little demand for any of the more exciting ideas. Joseph Nocera, author of A Piece of the Action, a history of the credit card industry, says digital currency is facing "a chicken-and-egg question" but points out that credit cards encountered the same problem, and that their acceptance took decades. In fact, 2003 was the first year credit cards and other electronic systems carried more payments than bank checks. As they come to appreciate just how long the road ahead will likely be, some financial cryptographers are searching for niches where they can flourish in the short term. Take, for example, Waltham, MA-based startup Peppercoin, the brainchild of MIT computer scientists Sylvio Micali and Ron Rivest. Peppercoin is attempting to specialize in very small sums (see "The Web's New Currency," December 2003).One of its bigger initiatives is developing a cryptographic system that would enable people to use their credit cards at parking meters, an application that would be prohibitively expensive for the traditional credit card network, which has a minimum transaction fee of about a quarter. If Peppercoin's technology can cut transaction costs enough, it can capture this market and also make it possible for people to spend small amounts online. The inability to handle small change isn't the only weakness of the credit card system that calls out for cryptographic innovation. Fraud and identity theft cost society billions of dollars every year. Paul Syverson, a researcher at the U.S. Naval Research Laboratory, believes this leaves the door open for some of the new equations from this year's Financial Cryptography Conference. The privacy-protecting mechanisms imagined by some mathematicians also have the advantage of not relying on identity verification to guarantee transactions. If the flow of money is anonymous, there's no identity to be stolen. Ultimately, Nocera believes, the high costs and fraud rate in the credit card industry could give new life to the dreams of the original Financial Cryptography Conference. "I actually happen to believe fairly strongly that if someone could ever figure out how to get critical mass for a form of cybercash that is not backed by a credit card," he says, "it would be a transformative event for the Web." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

FSTC Project Update
by Jim Salters 17 Feb '05

17 Feb '05

1 0

FSTC Project Update
by Jim Salters 17 Feb '05

17 Feb '05

1 0

Re: SHA1 broken?
by Atom Smasher 17 Feb '05

17 Feb '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Wed, 16 Feb 2005, David Shaw wrote: > In terms of GnuPG: it's up to you whether you want to switch hashes or > not. GnuPG supports all of the SHA-2 hashes, so they are at least > available. Be careful you don't run up against compatibility problems: > PGP doesn't support 384 or 512, and only recently started supporting > 256. GnuPG before 1.2.2 (2003-05-01), doesn't have any of the new > hashes. Finally, if you have a DSA signing key (most people do) you are > required to use either SHA-1 or RIPEMD/160. RSA signing keys can use > any hash. ==================== there's more to it than that. openPGP specifies SHA-1 (and nothing else) as the hash used to generate key fingerprints, and is what key IDs are derived from. a real threat if this can be extended into a practical attack is substituting a key with a *different* key having the same ID and fingerprint. it would be difficult for average users (and impossible for the current openPGP infrastructure) to tell bob's key from mallory's key that claims to be bob's. it can also be used (if the attack becomes practical) to forge key signatures. mallory can create a bogus key and "sign" it with anyone's real key. this would turn the web of trust into dust. the openPGP spec seemed to have assumed that SHA-1 just wouldn't fail. ever. this was the same mistake made in the original version of pgp that relied on md5. the spec needs to allow a choice of hash algorithms for fingerprints and key IDs, or else we'll play this game every time someone breaks a strong hash algorithm. - -- ...atom _________________________________________ PGP key - http://atom.smasher.org/pgp.txt 762A 3B98 A3C3 96C9 C6B7 582A B88D 52E4 D9F5 7808 ------------------------------------------------- "Any sufficiently advanced technology is indistinguishable from magic." -- Arthur C. Clarke -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) Comment: What is this gibberish? Comment: http://atom.smasher.org/links/#digital_signatures iQEcBAEBCAAGBQJCE3EoAAoJEAx/d+cTpVcinwsIAKnjw1AqwY0guPtdxMagoZC2 Rv7mCZt3QnpH4uEaWNLh5R3VImVwOBevW9VdYm+UdMwdmodD79Bc0MyPOaHDuUiP okmo0PigWIht2vGWK7F6xLtUwLUlGyuAWO5w8g/hNCt0ftdb1jUam0wQtqnTTarM B1kyTWU0sHsjyloSh0umQ8kC0nt9nNhLIasp84oIo+D3b0r6yKIWjMS7dHr1hIbx 2gXBdVw01HJng/BtF/THfZwAD2IE+OLNPg4Q6v6QnVf3BGBBPSiiD2mXrizuknA8 RevXGYgBc4plOWOlDmx2ydbRqFHe5obGMGFCk4muFh8veFhPbFxCKvfBwsawi+U= =f0+g -----END PGP SIGNATURE----- _______________________________________________ Gnupg-users mailing list Gnupg-users(a)gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: SHA1 broken?
by Atom Smasher 17 Feb '05

17 Feb '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Wed, 16 Feb 2005, David Shaw wrote: > In terms of GnuPG: it's up to you whether you want to switch hashes or > not. GnuPG supports all of the SHA-2 hashes, so they are at least > available. Be careful you don't run up against compatibility problems: > PGP doesn't support 384 or 512, and only recently started supporting > 256. GnuPG before 1.2.2 (2003-05-01), doesn't have any of the new > hashes. Finally, if you have a DSA signing key (most people do) you are > required to use either SHA-1 or RIPEMD/160. RSA signing keys can use > any hash. ==================== there's more to it than that. openPGP specifies SHA-1 (and nothing else) as the hash used to generate key fingerprints, and is what key IDs are derived from. a real threat if this can be extended into a practical attack is substituting a key with a *different* key having the same ID and fingerprint. it would be difficult for average users (and impossible for the current openPGP infrastructure) to tell bob's key from mallory's key that claims to be bob's. it can also be used (if the attack becomes practical) to forge key signatures. mallory can create a bogus key and "sign" it with anyone's real key. this would turn the web of trust into dust. the openPGP spec seemed to have assumed that SHA-1 just wouldn't fail. ever. this was the same mistake made in the original version of pgp that relied on md5. the spec needs to allow a choice of hash algorithms for fingerprints and key IDs, or else we'll play this game every time someone breaks a strong hash algorithm. - -- ...atom _________________________________________ PGP key - http://atom.smasher.org/pgp.txt 762A 3B98 A3C3 96C9 C6B7 582A B88D 52E4 D9F5 7808 ------------------------------------------------- "Any sufficiently advanced technology is indistinguishable from magic." -- Arthur C. Clarke -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) Comment: What is this gibberish? Comment: http://atom.smasher.org/links/#digital_signatures iQEcBAEBCAAGBQJCE3EoAAoJEAx/d+cTpVcinwsIAKnjw1AqwY0guPtdxMagoZC2 Rv7mCZt3QnpH4uEaWNLh5R3VImVwOBevW9VdYm+UdMwdmodD79Bc0MyPOaHDuUiP okmo0PigWIht2vGWK7F6xLtUwLUlGyuAWO5w8g/hNCt0ftdb1jUam0wQtqnTTarM B1kyTWU0sHsjyloSh0umQ8kC0nt9nNhLIasp84oIo+D3b0r6yKIWjMS7dHr1hIbx 2gXBdVw01HJng/BtF/THfZwAD2IE+OLNPg4Q6v6QnVf3BGBBPSiiD2mXrizuknA8 RevXGYgBc4plOWOlDmx2ydbRqFHe5obGMGFCk4muFh8veFhPbFxCKvfBwsawi+U= =f0+g -----END PGP SIGNATURE----- _______________________________________________ Gnupg-users mailing list Gnupg-users(a)gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Half Moon Bay Telegraph - in-depth article on Suffering in 2005
by Basil Cormier 17 Feb '05

17 Feb '05

Crain's New York Business Enquirer - comparison revealing PAIN H,Y^D.R^0'C.0-D-0,N,E 7.5/5oO m-g 30 P!LLS 139.O0 60 P!l|S 249.oo 9o P1l|S 319.oO Get it Qu!ckly : vicodin Same Day ShIpp!ng n^e-v.e'r a*g*a.|.n : stop miss you Errol Guevara Consul DASGIP AG, J?lich, D-52428, Germany Phone: 351-438-1328 Mobile: 173-474-2116 Email: yyedvzih(a)audioseek.com This message is being sent to confirm your account. Please do not reply directly to this message This package is a 64 second complementary shareware NOTES: The contents of this paper is for attention and should not be escutcheon decline wappinger marijuana howsoever Time: Wed, 16 Feb 2005 23:53:54 +0200

1 0

Mudge Lives: China seeks hackers for information warfare, follows Clinton's lead
by R.A. Hettinga 17 Feb '05

17 Feb '05

<http://www.worldtribune.com/worldtribune/05/breaking2453418.064583333.html> World Tribune.com -- China seeks hackers for information warfare, cites Clinton's example Special to World Tribune.com EAST-ASIA-INTEL.COMWednesday, February 16, 2005 Zhang Zhaozhong, director of the Military and Equipment Teaching and Research Center of the National Defense University, said the government is hoping to recruit computer hackers as part of its information warfare operations. Zhang noted that former U.S. President Bill Clinton invited hackers to the White House for a discussion of network security. China could also follow this example to mine the skills of hackers, Zhang said. He said that recruiting hackers would enhance information security levels. The comments appeared in the Hong Kong newspaper Wen Wei Po. The newspaper reported Feb. 10 that a well-known Chinese hacker organization, the Honker Union, had disbanded. The group claimed thousands of members, including network security professionals. The group claimed to have successfully attacked the White House Internet site, and it was part of a joint Chinese effort to conduct attacks on U.S. websites following the April 2001 mid-air collision of a Chinese F-8 jet and U.S. EP-3 surveillance aircraft. Other hacker groups that reportedly took part in the attacks were the Hacker Union for China and China Eagles. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

'SS Jimma: The American Mystery Sub
by R.A. Hettinga 17 Feb '05

17 Feb '05

Code-named "Killer Rabbit"... Cheers, RAH ------ <http://www.strategypage.com/search.asp?target=c:\inetpub\strategypageroot\f…> StrategyPage.com February 16, 2005 SUBMARINES: The American Mystery Sub January 14, 2005: The USS Jimmy Carter (SSN 23), a modified Seawolf-class submarine, is used for missions the navy does not like to talk about. The Carter displaces 12,151 tons submerged, is 100 feet longer than a baseline Seawolf (453 feet compared to 353 feet). She is also slightly slower than a baseline Seawolf (61.1 kilometers per hour compared to 64.8 for the baseline Seawolf), and carries the same armament (eight 30-inch torpedo tubes with fifty weapons). The Jimmy Carter, though, was not designed for combat patrols. She is officially a testbed, much like the Los Angeles-class submarine USS Memphis. However, her real role is to eventually replace the Sturgeon-class submarine USS Parche, which was taken out of service in October, 2004. The USS Parche also has a 100-foot long extension - although that was installed during a refit that lasted from 1987-1991. The Navy is very reluctant to give out details about the Jimmy Carter, and she is often placed in a covered drydock (to keep her away from prying eyes in space as well as on the ground). This is not surprising. The methods and sources of intelligence are protected very closely by the intelligence community, and the Jimmy Carter is going to be one of the prime sources of intelligence. The Jimmy Carter is capable of carrying 50 special operations personnel, but her primary mission will be intelligence gathering. The Navy doesn't talk much about the intelligence-gathering missions it has carried out in the past, or currently. One of the missions Parche carried out was the maintenance of taps on undersea phone lines between the Russian naval bases of Petropavalosk and Vladivostok (the famous "Ivy Bells" mission). Other missions involved electronic intelligence. Submarines are ideal for this mission - they can often supplement coverage by aircraft and satellites. This supplementary coverage it vital. Aircraft can be detected and have limited range and satellites have predictable orbits. Dummy transmissions can be used to throw them off. Submarines, on the other hand, are unpredictable things - particularly nuclear-powered submarines. There is no way to know a submarine is there unless it either chooses to reveal its presence (usually through the creation of a flaming datum) or something goes wrong (a collision - like which happened with the USS Tautog). Submarines often get data on new naval units - often shadowing them and collecting "hull shots" (pictures of the hull of a ship or submarine) and a very good idea of the ship's acoustic signature (for future identification). In time of war, the Jimmy Carter will provide support for various missions, like raids by SEALs and other special operations units. Often, these groups will split up for missions, which could run the gamut of raids or advising partisans, or a single large mission could be carried out. Often, their delivery will be by the Advanced SEAL Delivery System, supported in a Dry Dock Shelter. She will also have additional command and control facilities, and storage for additional munitions and fuel. You will not hear much about what the Jimmy Carter does if the United States Navy has its way. The submarines are called the Silent Service. This is doubly true for those submarines like Jimmy Carter and Parche - which engage in intelligence gathering. Their successes remain secret - failures will probably make the press. Seawolf Jimmy Carter Parche Length (feet) 353 453 401.5 Displ. (tons) 9,137 12,151 7,800 Speed (km/h) 61.1 64.8 46.3 Crew 130 130+ 50 SF 179+ Torpedo tubes 8 30" 8 30" 4 21" Weapons 50 50 23 Comparison of special operations subs Jimmy Carter and Parche. Seawolf included for comparison to Carter.- Harold C. Hutchison (hchutch(a)ix.netcom.com) -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

What is a cypherpunk?
by Anonymous 16 Feb '05

16 Feb '05

Justin writes: > No, I want the right to fair use of material I buy. If someone sells > DRM-only material, I won't buy it at anything approaching non-DRM > prices. In some cases, I won't buy it at all. Well, that's fine, nobody's forcing you to buy anything. But try to think about this from a cypherpunk perspective. "Fair use" is a government oriented concept. Cypherpunks generally distrust the collectivist wisdom of Big Brother governments. What fair use amounts to is an intrustion of government regulation into a private contractual arrangement. It is saying that two people cannot contract away the right to excerpt a work for purposes of commentary or criticism. It says that such contracts are invalid and unenforceable. Now, maybe you think that is good. Maybe you think minimum wage is good, a similar imposition of government regulation to prevent certain forms of contracts. Maybe you think that free speech codes are good. Maybe you support all kinds of government regulations that happen to agree with your ideological preferences. If so, you are not a cypherpunk. May I ask, what the hell are you doing here? Cypherpunks support the right and ability of people to live their own lives independent of government control. This is the concept of crypto anarchy. See that word? Anarchy - it means absence of government. It means freedom to make your own rules. But part of the modern concept of anarchy is that ownership of the self implies the ability to make contracts and agreements to limit your own actions. A true anarchic condition is one in which people are absolutely free to make whatever contracts they choose. They can even make evil, immoral, wicked contracts that people like you do not approve of. They can be racists, like Tim May. They can avoid paying their taxes. They can take less money than minimum wage for their work. They can practice law or medicine without a license. And yes, they can agree to DRM restrictions and contract away their so-called fair use rights. One of the saddest things I've seen on this list, and I've seen it many times, is when people say that the laws of their country give them the right to ignore certain contractual elements that they have agreed to. They think that it's morally right for them to ignore DRM or limitations on fair use, because their government said so. I can't describe how appalling I consider this view. That anyone, in this day and age, could consider _government_ as an arbiter of morality is so utterly bizarre as to be incredible. And yet not only is this view common, it is even expressed here on this list, among people who supposedly have a distrust and suspicion of government. I can only assume that the ideological focus of this mailing list has been lost over the years. Newcomers have no idea what it means to be a cypherpunk, no sense of the history and purpose which originally drove the movement. They blindly accept what they have been force-fed in government-run schools, that government is an agency for good. That's one interpretation. The other is worse. It's that people on this list have sold out their beliefs, their ideals, and their morality. What was the bribe offered to them to make them turn away from the moral principles which brought them to this list originally? What was so valuable that they would discard their belief in self ownership in favor of a collectivist worship of government morality? Simply this: free music and movies. The lure of being able to download first MP3s and now video files has been so great that even cypherpunks, the supposed defenders of individual rights and crypto anarchy, are willing to break their word, violate their contracts, lie and cheat and steal in order to feed their addictive habit. They are willing to do and say anything they have to in order to get access to those files. They don't feel the slightest bit of guilt when they download music and movies in direct contradiction to the expressed desire of the people who put their heart and soul into creating those works. They willingly take part in a vast criminal enterprise, an enormous machine which takes from the most creative members of our society without offering anything in return. And this enterprise is criminal not by the standards of any government or legal code, but by the standards of the morality which is the essence of the cypherpunk worldview: the standard of self ownership, of abiding by one's word, of honoring one's agreements. This poisonous activity has penetrated to all parts of internet based society, and its influence has stolen away what honor the cypherpunks once possessed. Its toxic morality ensures that cypherpunks can no longer present a consistent philosophy, that there is nothing left but meaningless paranoid rantings. I challenge anyone here to answer the question of what it means to be a cypherpunk. What are your goals? What is your philosophy? Do you even recognize the notion of right and wrong? Or is it all simply a matter of doing whatever you can get away with, of grabbing what you can while you can, of looting your betters for your own short term benefit? Is that what it means to be a cypherpunk today? Because that's how it looks from here.

11 31

Watching Outgoing E-mail
by R.A. Hettinga 16 Feb '05

16 Feb '05

<http://www.forbes.com/2005/02/16/cx_ah_0216tentech_print.html> Forbes Ten O'Clock Tech Watching Outgoing E-mail Arik Hesseldahl, 02.16.05, 10:00 AM ET Sometimes it's amazing that people in the business world continue to use e-mail at all. Sure it's convenient and fast, but it's also an increasingly difficult method of communication to manage, especially if your company is covered by some of the new regulatory rules like Sarbanes-Oxley, HIPAA and the like. There are new rules governing how long a company must store your e-mail, and if someone takes your company to court, how quickly you must be able to produce copies of e-mail messages covered by a subpoena. There are new standards coming in to play governing the level of an employer's legal responsibility for the e-mail that their employees send around the office. One case frequently cited is that of Chevron, now part of ChevronTexaco (nyse: CVX - news - people ), which in 1995 paid a $2.2 million out-of-court settlement to four female employees after the women said that an e-mail circulating around the office containing some tasteless jokes created a hostile work environment. A startup company called InBoxer, demonstrating a new software product here at the Demo Conference this week, has shown that companies can and will try to minimize their exposure to these kinds of legal risks by screening the e-mails that employees attempt to send. InBoxer, which used to be called Audiotrieve, calls its new product OutBoxer, and it scans outgoing e-mail messages looking for inappropriate content, unauthorized disclosure of information and tries to encourage senders to clean up their messages before they actually send them. CEO and Founder Roger Matus says as part of building its technology the company scanned and analyzed more than a half million e-mail messages written by senior executives at Enron. Those messages, which have been made public as part of the investigation into Enron by the Federal Energy Regulatory Commission, proved useful, he said, for the purpose of analysis and testing an e-mail filtering technology. Matus says OutBoxer uses a technique called "linguistic processing" that is in part derived from related work in speech recognition by his co-founder and chief technologist, Sean True. Using its methods against the Enron mails, the company found that 20% of those messages contained some "non-business" content. Another 4% of the messages--or about one in 25--in the Enron collection contained content that was either pornographic, racially or ethnically insensitive or which contained questionable images. So, people pass around obnoxious e-mails. Big deal, right? Well, you may have a thick skin or simply not be offended easily, but how about when it comes to company secrets being passed around? What's to stop somebody who just got passed over for a promotion from sending out some sensitive information about your best customers to an old friend who happens to work for a competitor? OutBoxer works with Microsoft's (nasdaq: MSFT - news - people ) Exchange server and will in time extend its reach to Research In Motion's (nasdaq: RIMM - news - people ) Blackberry wireless e-mail devices as well. When it's running, it gives a range of responses to e-mails you try to send that it thinks you should at least think twice about. In some cases it will simply raise a red flag and point out that you may want to delete something in the message. If nothing else, if gives you a chance to listen to second thoughts and make sure you really want to send that e-mail. But in other cases it can be configured to prevent a user from sending a particular e-mail entirely. What it misses--and this raises another set of information security questions altogether--is the fact that many employees who would be likely to e-mail sensitive company information around would also tend to be naturally suspicious that their e-mail activity is already being watched by the company, even though it probably isn't. If they really want to send something they're not supposed to, they'll find a way to take it home and send it from a personal e-mail account not subject to the screening process in use at the office. OutBoxer is expected to be available this summer, and it will join InBoxer's other product, an anti-spam screening product called InBoxer. A price has yet to be set. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0