February 2005 - cypherpunks-legacy

Re: Dell to Add Security Chip to PCs
by Ed Reed 04 Feb '05

04 Feb '05

>>> Ian G <iang(a)systemics.com> 2/2/2005 6:38:46 PM >>> > I'm just curious on this point. I haven't seen much > to indicate that Microsoft and others are ready > for a nymous, tradeable software assets world. No, and neither are corporate customers, to a large extent. Accountability is, in fact, a treasured property of business computing. Lack of accountability creates things like Enron, Anderson Consulting, Oil-for-Food scams, and the missing 9 billion dollars or so of reconstruction aid. It's the fuel that propells SPAM, graft, and identity theft. What I've not seen is much work providing accountability for anonymous transactions. It's a shame people persist in thinking a single solution will satify everyone, as though computing was somehow different from everything else in life. Ed --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

2 1

mmm, petits filous (was Re: NTK now, 2005-02-04)
by R.A. Hettinga 04 Feb '05

04 Feb '05

At 5:45 PM +0000 2/4/05, Dave Green wrote: > mmm, petits filous > > Everyone else likes to worry about Google's gathering > conflict of interests, but Verisign's S.P.E.C.T.R.E.-level > skills still take some beating. This week, orbiting crypto > analysts Ian Grigg and Adam Shostock belatedly pointed out > to ICANN that perhaps Verisign couldn't trusted with > .net. Why? Well, Verisign these days offers both top level > domains and SSL certificate authentication. They also, with > their NetDiscovery service - sell ISPs a complete service for > complying with law enforcement surveillance orders. So, if an > American court demands an ISP wiretap its customers, and the > ISP turns that order over to Verisign to do the dirty: well, > Verisign can now fake any domain you want, and issue any > temporary fake certificate, allowing even SSLed > communications to be monitored. What's even more fun is that > they are - at least in the US - now moving into providing > infrastructure for mobile telephony. Yes, NOT EVEN YOUR > RINGTONES ARE SAFE. > http://forum.icann.org/lists/net-rfp-verisign/msg00008.html > - you know, this is probably a little late > http://iang.org/ssl/ > - but then, this is the year of the snail > http://www.thefeature.com/article?articleid=101334&ref=5459267 > - stupid network vs stupider company -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: Dell to Add Security Chip to PCs
by Trei, Peter 04 Feb '05

04 Feb '05

Seeing as it comes out of the TCG, this is almost certainly the enabling hardware for Palladium/NGSCB. Its a part of your computer which you may not have full control over. Peter Trei Tyler Durden > ANyone familiar with computer architectures and chips able to > answer this > question: > > That "chip"...is it likely to be an ASIC or is there already > such a thing as > a security network processor? (ie, a cheaper network > processor that only > handles security apps, etc...) > > -TD > > >From: "R.A. Hettinga" <rah(a)shipwright.com> > >HOUSTON -- Dell Inc. today is expected to add its support to > an industry > >effort to beef up desktop and notebook PC security by installing a > >dedicated chip that adds security and privacy-specific > features, according > >to people familiar with its plans. > > > >Dell will disclose plans to add the security features known > as the Trusted > >Computing Module on all its personal computers. Its support > comes in the > >wake of similar endorsements by PC industry giants Advanced > Micro Devices > >Inc., Hewlett-Packard Co., Intel Corp. and International > Business Machines > >Corp. The technology has been promoted by an industry > organization called > >the Trusted Computing Group.

12 16

Dell to Add Security Chip to PCs
by R.A. Hettinga 04 Feb '05

04 Feb '05

<http://online.wsj.com/article_print/0,,SB110727370814142368,00.html> The Wall Street Journal February 1, 2005 11:04 a.m. EST Dell to Add Security Chip to PCs By GARY MCWILLIAMS Staff Reporter of THE WALL STREET JOURNAL February 1, 2005 11:04 a.m. HOUSTON -- Dell Inc. today is expected to add its support to an industry effort to beef up desktop and notebook PC security by installing a dedicated chip that adds security and privacy-specific features, according to people familiar with its plans. Dell will disclose plans to add the security features known as the Trusted Computing Module on all its personal computers. Its support comes in the wake of similar endorsements by PC industry giants Advanced Micro Devices Inc., Hewlett-Packard Co., Intel Corp. and International Business Machines Corp. The technology has been promoted by an industry organization called the Trusted Computing Group. The company is also expected to unveil new network PCs. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

4 4

Tor 0.0.9.4 is out (fwd from arma@mit.edu)
by Eugen Leitl 04 Feb '05

04 Feb '05

----- Forwarded message from Roger Dingledine <arma(a)mit.edu> -----

1 0

New Accord Reader available to city traders
by R.A. Hettinga 03 Feb '05

03 Feb '05

<http://www.aberdeencity.gov.uk/textonly/vbparser.asp?path=http://www.aberde…> News Item New Accord Reader available to city traders 03 February 2005 14:29 Traders in Aberdeen are being offered help stamping out underage sales of tobacco, solvents, spray paints and other restricted items. The Accord Reader is a small till-top device that verifies an age band for customers, using the information stored on their Accord Card - Aberdeen City Council's pioneering smartcard. The gadget is already a common sight in city stores - with the Safer Aberdeen partnership having bought and distributed 320 readers among shops providing off sales, prior to Christmas. Now the Accord team is writing to newsagents, video stores and cinemas offering them the chance to pick up the invaluable devices, which cost just #15 each. Accord Readers are small devices, little bigger than the Accord Card itself. They work by accessing the birth date information stored on each card and displaying a minimum age for the customer, such as 12, 16, 18 - verifying whether they are entitled to buy tobacco, lottery products, alcohol and other age-restricted items. The cardholder's date of birth itself is not revealed and no other personal information - such as entitlement to concessionary travel, free school meals or library lending - can be accessed. The Accord Card is already issued to secondary school pupils in the city - a key group when addressing the issue of underage sales. It can be used to determine whether a customer can legally be sold items including tobacco products, knives, videos and DVDs, fireworks, glue, lighter fuel and spray paint. The Accord Reader Benefit to the retailer: Rather than relying on retail staff to calculate, or even guess, a customer's date of birth, the Proof of Age Reader gives them access to secure, reliable data at their fingertips. Any Accord Card can be inserted in the Reader, instantly displaying a message that the bearer is ''OVER XX'', one of a range of specified ages. Retailers also have a secondary check, using the photograph on the back of each Accord Card, to confirm the customer is who they say they are. All pupils of Council-run secondary schools in Aberdeen hold Accord Cards. Benefit to customers: Customers will be safe in the knowledge they can prove they are entitled to purchase certain products, and they - and you - are not unwittingly breaking the law. The Accord Card In simplistic terms, the Accord Card is: * A system identifier Grampian Police backs the Accord Card as a proof of age and identity. It also identifies those users who are Young Scots. * A product carrier Currently, 19,000 concessionary cardholders use the card - as a proof of identity - when they travel on public transport. This initiative is being further developed to provide transport ticketing. Accord replaces library cards. However, its use is not limited to Council service - it can be used in the private sector. It will be a long lasting card, which provides users with greater and easier access to many benefits and services. * An electronic purse Twelve secondary schools currently use Accord as an electronic purse - allowing for cashless catering and vending. This encourages children to access concessionary entitlements anonymously - removing any stigma attached to receiving free school meals or clothing grants. These are just a few of the potential benefits of the Accord Card. It aims to become one card that replaces many others - for example, replacing library cards, leisure cards, travel cards and dinner tickets. The Accord Card will be available to all citizens of Aberdeen during 2005. To find out more about the scheme, please contact the Accord Office on 01224 645596 between the hours on 9:00 am and 4:00pm, Monday to Friday. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Police cuff US student keystroke logger
by R.A. Hettinga 03 Feb '05

03 Feb '05

<http://www.theregister.co.uk/2005/02/02/student_keystroke_logger/print.html> The Register Biting the hand that feeds IT The Register ; Security ; Network Security ; Original URL: http://www.theregister.co.uk/2005/02/02/student_keystroke_logger/ Police cuff US student keystroke logger By Lester Haines (lester.haines at theregister.co.uk) Published Wednesday 2nd February 2005 14:39 GMT A Houston High School student faces a fine possible $2,000 fine or 180 days' jail after admitting rigging a keystoke logger to a teacher's PC and using it to download exams, Houston's Local 2 reports (http://www.click2houston.com/education/4152951/detail.html) Fort Bend School District School spokeswoman Mary Ann Simpson said: "Sometime in mid-December, we got a tip that this student was selling test exams that had apparently come from a teacher's computer, so that's when the investigation began." Said probe ended with the unnamed 16-year-old having his collar felt by the police. He immediately confessed to the crime when confronted, was charged with a Class B misdemeanour and transferred to another school. Police this week sent out alerts to other schools warning them of the threat of keystoke-logging ne'er-do-wells. . -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Dell to Add Security Chip to PCs
by Ed Reed 03 Feb '05

03 Feb '05

>>> Ian G <iang(a)systemics.com> 2/2/2005 6:38:46 PM >>> > I'm just curious on this point. I haven't seen much > to indicate that Microsoft and others are ready > for a nymous, tradeable software assets world. No, and neither are corporate customers, to a large extent. Accountability is, in fact, a treasured property of business computing. Lack of accountability creates things like Enron, Anderson Consulting, Oil-for-Food scams, and the missing 9 billion dollars or so of reconstruction aid. It's the fuel that propells SPAM, graft, and identity theft. What I've not seen is much work providing accountability for anonymous transactions. It's a shame people persist in thinking a single solution will satify everyone, as though computing was somehow different from everything else in life. Ed

1 0

Tor: Please block these file-sharing ports from your exit policy (fwd from arma@mit.edu)
by Eugen Leitl 03 Feb '05

03 Feb '05

----- Forwarded message from Roger Dingledine <arma(a)mit.edu> -----

1 0

Researchers Combat Terrorists by Rooting Out Hidden Messages
by R.A. Hettinga 02 Feb '05

02 Feb '05

<http://www.newswise.com/p/articles/view/509563/> Newswise Source: University of Delaware Released: Tue 01-Feb-2005, 13:10 ET Researchers Combat Terrorists by Rooting Out Hidden Messages Libraries Science News Keywords STEGANOGRAPHY, STEGANALYSIS, HIDDEN MESSAGES, DIGITAL IMAGES, CRYPTOGRAPHY, TERRORISM Contact Information Available for logged-in reporters only Description Researchers at the University of Delaware are working to combat terrorism by developing techniques to detect the use of steganography, which encompasses various methods of hiding messages in apparently ordinary digital images and videos. Newswise - A University of Delaware research team has received National Science Foundation funding to combat terrorism by developing techniques to detect the use of steganography, which encompasses various methods of hiding messages in apparently ordinary digital images and videos. It is feared electronic steganography can be used by terrorist organizations to pass along orders or other vital information surreptitiously through images posted on the Internet or sent via e-mail. The grant for more than $167,000 was awarded to Charles Boncelet, UD professor of electrical and computer engineering, to conduct research in the relatively new field of steganalysis. Boncelet will work on the project with Lisa Marvel, a UD graduate now employed by the U.S. Army Research Laboratory, and with several graduate students. Boncelet said steganography is Greek for covered writing, and is a means by which a person can hide the very fact that they are communicating. In that, it differs from the better-known practice of cryptography, Greek for secret writing, in which a message is purposely garbled and can be understood only by those who have the key to decipher it. The two forms of communication are not mutually exclusive, Boncelet said, and can be combined. A person can encrypt a message and then hide the fact that they are sending it. Boncelet previously worked in steganography for the U.S. Army and through this project will begin working in steganalysis, or the development of methods by which to seek out steganography. "The work we are doing is in multimedia, with a focus on digital images," Boncelet said. "You can take an image on your web site and use steganographic techniques to hide a message in the image. The image looks completely ordinary but if you know the key, you can extract the secret message." "The object of the research," Boncelet said, "is to try to figure out how to find steganography in the images." The problem is that steganalysis is very difficult because the messages are hidden by design. However, Boncelet said, "when you hide a message in a digital image, you change the image a little bit. If you change the image too much, it gives it away." The way to determine any changes to an image, given that the steganalyst does not have the benefit of the original for purposes of comparison, is to use algorithms and very fast computers to look for unusual features in the image. Boncelet said he believes the research will lead to a novel class of electronic steganography searchers based on image representations that depend on a quality factor, with the long-term goal being automated scanners that can rapidly find likely candidates amongst large numbers of images and videos. "Assuming the technique we develop is successful, we hope to branch out to video and audio," Boncelet said, "but right now the focus is on digital images." In addition to the research, the project will provide training in steganalysis and intelligence techniques to the students involved. Boncelet said steganography "is a very big fear for governments," adding that the security agencies that deal with the technique "worry about terrorists passing messages, or traitors leaking out information from secure sites." After the terrorist attacks of Sept. 11, 2001, there was widespread speculation in the public press that terrorists had used steganography on the Internet to communicate plans. Although those reports were never confirmed, the possibility remains a grave concern. One of the earliest examples of steganography comes from ancient history, Boncelet said, explaining that a Greek city was surrounded by enemy soldiers and the leader wanted to get a message to his allies to send troops. He selected a slave and shaved his head, tattooing the plea for help on his scalp, then allowed the slave's hair to grow back over the message. The slave was sent out of the city walls, was captured and released by the enemy troops, and arrived safely with the message. In World War II, Boncelet said, American soldiers used steganography to provide information on their whereabouts to relatives back home by putting a pinprick on a map. Army censors were forced to pepper letters with hundreds of pinpricks to offset the practice. German spies used steganography in microdots, tiny images of typed pages that could be pasted over periods in seemingly harmless letters. The NSF grant is for one year and was awarded through the Approaches to Combat Terrorism Program in the Directorate for Mathematical and Physical Sciences, which supports new concepts in basic research and work force development with the potential to contribute to national security. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

8 7