March 2005 - cypherpunks-legacy

Handheld Licence Plate Scanner/OCR/Lookup
by Bill Stewart 05 Mar '05

05 Mar '05

More news dispatches from Brinworld.... http://www.chieftain.com/business/1109862027/1 http://www.thenewspaper.com/news/01/196.asp Bootfinder, made by G2 Systems in Alexandria VA, is a combination of a handheld digital camera, OCR software for locating and reading license plates, and a database lookup system that shows the user whatever information it has about that license plate. The software runs on a laptop; the article doesn't say if it has an online live data feed or just runs on stored data. The two governments currently using it, New Haven Conn and Arlington County VA, are using it to find car tax and parking ticket delinquents, so it's something that doesn't need a live data feed, but that would be easy to patch on - the hard technology's in reading the number, not in using it. It was originally developed for tracing stolen cars, but the developer found that to be a hard sell with cash-strapped police departments, while parking enforcement is a revenue-generating activity so anything that lets those departments rake in money faster is an easy sell. One city saw their car tax payment compliance go from 80% to 95% because it was easy to catch many non-payers and to scare other people into paying before they get caught. The camera can scan 1000 license plates per minute - the article doesn't say how fast the cars can be going, but the cities that use it have parking officials driving down the street scanning parked cars' plates, which are easier to aim at than moving cars. Even so, that suggests that more widespread privacy-invading applications should be easy to develop - David Brin's "Transparent Society" prediction of cameras and computing being cheap enough to become ubiquitous becomes more realistic every year.

2 1

Jeff Jacoby: An inglorious suicide
by R.A. Hettinga 04 Mar '05

04 Mar '05

<http://www.townhall.com/columnists/jeffjacoby/printjj20050304.shtml> Townhall.com An inglorious suicide Jeff Jacoby (back to web version) | Send March 4, 2005 Hunter Thompson's suicide was an act of selfishness and cruelty. But more depraved by far has been the celebration of that suicide by those who supposedly loved or admired him. The 67-year-old author of the ''Fear and Loathing'' books shot himself in the head on Feb. 20 as he sat in the kitchen of his home near Aspen, Colo., taking a phone call from his wife. Anita Thompson had called him from her health club, she told the Aspen Daily News, and he'd asked her to come home and help him with the column he had to write. Then, without warning or a goodbye, he put down the phone and fired a .45-caliber handgun into his mouth. ''I was on the phone with him, he set the receiver down and he did it,'' she said. ''I heard the clicking of the gun.'' There was a loud, muffled noise. Then nothing. ''I was waiting for him to get back on the phone.'' Could anything be more ghoulish and egotistical than making your unsuspecting wife listen while you put a bullet through your skull? Absolutely: making your unsuspecting wife listen while you put a bullet through your skull - and your son, daughter-in-law, and grandson are just a few yards away. Juan Thompson was in a nearby office when his father blew his brains out in the kitchen. Winkel Thompson and 6-year-old Will were playing in the living room next door. It takes a real sadist to arrange his suicide so that his loved ones are forced to hear him die. But what kind of degenerate inflicts something so traumatic on a child of 6? In Thompson's defense, it must be said that he was a hardened alcohol and drug abuser who over the decades had ingested, inhaled, and imbibed a staggering quantity and assortment of recreational poisons. The cumulative damage to his brain must have been considerable. By the time he fired his .45, who knows how clearly he was thinking about anything? But there is no defense for the treatment of Thompson's suicide as some sort of final gonzo coup by a rebel who never played by society's rules. ''Hunter S. Thompson died Sunday as he planned,'' begins Jeff Kass's admiring Feb. 24 account in the Rocky Mountain News, ''surrounded by his family, at a high point in his life, and with a single, courageous, and fatal gunshot wound to the head, his son says.'' High point? Courageous? In what warped moral universe is a man's pointless and ignoble death the ''high point in his life?'' And what is ''courageous'' about turning one's wife into a widow or depriving a 6-year-old of his grandfather? Thompson's son and daughter-in-law, Kass continues, ''could not be prouder'' of his suicide. It was the result of ''a thought process with its own beautifully dark logic. ... The guy was a warrior, and he went out like a warrior.'' Did Thompson, asks Kass, ''have his favorite liquid sidekick, a glass of Chivas Regal, on the counter? 'Of course he did,' Juan Thompson said.'' Another story details the impromptu cocktail party that gathered around Thompson's corpse - still in the kitchen chair - to drink Chivas and toast him. ''It was very loving,'' Anita Thompson is quoted as saying. ''It was not a panic, or ugly, or freaky.'' Her husband's death should be cheered, she says. ''This is a triumph of his, not a desperate, tragic failure.'' That is either unhinged grief speaking or overripe counterculture leftism. Either way, it is grotesque. But it has been echoed everywhere. ''It wouldn't be accurate to say Thompson had a death wish,'' Mark Layman wrote for Knight Ridder. ''Just the opposite: He was the self-described 'champion of fun.' '' Douglas Brinkley, the well-known historian and Thompson family friend, declared that Thompson ''made a conscious decision that he had an incredible run of 67 years, lived the way he wanted to, and wasn't going to suffer the indignities of old age.'' One journalist after another seized the moment to reminisce about some wild evening once spent with Thompson, whose suicide they seem to regard as one last piece of roguish bad craziness from an irrepressible original. How striking is the contrast between Thompson's tawdry death and the excruciating struggle of Pope John Paul II, whose passionate belief in the sanctity of life remains unwavering, even as Parkinson's disease slowly ravages him. The pope's example of courage and dignity sends a powerful message, but the chattering class would rather talk instead about why this stubborn man won't resign. Meanwhile they extol Hunter Thompson and are itching to know - are his ashes really going to be fired from a cannon? -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

3 2

SEC probing ChoicePoint stock sales
by R.A. Hettinga 04 Mar '05

04 Mar '05

<http://www.msnbc.msn.com/id/7087572/print/1/displaymode/1098/> MSNBC.com SEC probing ChoicePoint stock sales Execs sold shares before ID thefts made public The Associated Press Updated: 10:30 a.m. ET March 4, 2005 ATLANTA - ChoicePoint Inc., a leading data warehouser, says the Securities and Exchange Commission is investigating stock sales by its top two executives and the embattled company has decided to stop giving personal information about consumers to small businesses. Its shares tumbled on the news. The dual announcements were made Friday by the Alpharetta, Ga.-based company in a news statement and a regulatory filing. The SEC probe involves sales of stock by chief executive Derek Smith and president Douglas Curling for a $16.6 million profit in the months after the company learned its massive database had been breached and before that was made public. ChoicePoint's stock had dropped about 10 percent since the personal information breach at the data collector was announced Feb. 15. On Friday, ChoicePoint shares fell $2.43, or 6 percent, to $37.85 in early trading on the New York Stock Exchange. Corporate governance experts say the pattern and timing of the trading by Smith and Curling raise questions, while ChoicePoint has said the stock trading was prearranged under a plan approved by the company's board. The decision to stop selling data to small businesses was made because that was the segment of the company that thieves tapped into to gain access to ChoicePoint's database. Smith said in a statement that the decision follows "the response of consumers who have made it clear to us that they do not approve of sensitive personal data being used without a direct benefit to them." ChoicePoint said it will stop selling information products that contain sensitive consumer data, including Social Security numbers, to small businesses, except in limited cases where the products support federal, state or local government purposes. Last month, ChoicePoint said it was notifying about 145,000 Americans that their Social Security numbers and other personal information may have been viewed by criminals posing as legitimate ChoicePoint customers. The company said Friday that the number of potentially affected customers may increase, but it doesn't believe the increase will be substantial. ChoicePoint has said repeatedly it learned of the breach in October, but delayed disclosing it because it said California authorities had asked it to keep quiet to protect the fraud investigation. It said in a detailed explanation Friday that it first learned of the possibility of fraud on Sept. 27. A similar breach involving 7,000 to 10,000 ChoicePoint records occurred in 2002. ChoicePoint said Friday the SEC has notified the company that it is conducting an informal inquiry of the stock sales as well as the circumstances surrounding the possible theft of people's identities in connection with the breach of its database. The stock sales occurred between November and February. ChoicePoint said it will cooperate with the probe and "provide requested information and documents to the SEC." The company also said in a lengthy regulatory filing that the Federal Trade Commission is conducting an inquiry into its compliance with federal laws governing consumer information security and related issues. The FTC has asked for information and documents regarding ChoicePoint's customer credentialing process and the recent incident in Los Angeles involving a Nigerian man who was accused of committing fraud using consumer information from the company's database. The company said it is a defendant in several lawsuits and complaints arising from the breach. It said it could not estimate the financial impact on the company of the customer fraud and related events. It wasn't immediately clear how many customers the decision on small businesses affects. ChoicePoint said Feb. 21 when it decided to rescreen 17,000 small business customers that that action affected 5 percent of its annual revenue of $900 million. In Friday's regulatory filing, it said that because it will no longer sell information to small businesses, it expects a decline in core revenue this year of $15 million to $20 million. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

RE: Jeff Jacoby: An inglorious suicide
by Trei, Peter 04 Mar '05

04 Mar '05

> -----Original Message----- > From: owner-cypherpunks(a)minder.net > [mailto:owner-cypherpunks@minder.net]On Behalf Of Anonymous > Sent: Friday, March 04, 2005 3:01 PM > To: cypherpunks(a)al-qaeda.net > Subject: Re: Jeff Jacoby: An inglorious suicide > > > R.A. Hettinga spoke thusly... > > > <http://www.townhall.com/columnists/jeffjacoby/printjj20050304.shtml> > > > > Townhall.com > > > > An inglorious suicide > > Jeff Jacoby (back to web version) | Send > > > > March 4, 2005 > > > > Hunter Thompson's suicide was an act of selfishness and > cruelty. But more > > depraved by far has been the celebration of that suicide by > those who > > supposedly loved or admired him. > > What does this have to do with cypherpunks? This is not your personal > blog. Most of the list traffic is forwarded or cross-posted news > articles, but how is HST's suicide remotely on-topic? > I absolutely agree. The value of Hettinga's posts to Cypherpunks and the Cryptography list has absolutely gone down the tubes, to the point where I have had to write special filter rules to isolate his posts from the actual content. The dozen or so full-length article on HST have simply no relevance to either list. If he had any respect for others at all, he'd give the URL and a couple lines of summary. Or even better is your suggestion that he use his own blog, or set up his own mailing list instead of spamming the lists with off-topic crap. His behaviour has sunk his reputation well into the Choate/Matt Taylor range. Peter Trei

1 0

Warm Party for a Code Group
by R.A. Hettinga 04 Mar '05

04 Mar '05

> At 9:01 PM +0100 3/4/05, Anonymous wrote: >>What does this have to do with cypherpunks? >"Narcs and feds will not be allowed at the meeting. Fuck them dead." Cheers, RAH ------ <http://www.wired.com/news/print/0,1294,55114,00.html> Wired News Warm Party for a Code Group By Danit Lidor? Story location: http://www.wired.com/news/culture/0,1284,55114,00.html 02:00 AM Sep. 13, 2002 PT The cypherpunks are throwing a PGP (pretty good party) this weekend. The venerable online community is celebrating its 10th anniversary which, in the ephemeral world of the Internet, is remarkable. No wonder. In 1992, the cypherpunks emerged from a small group of people who, because of their interest in cryptography and encryption, recognized that the free-flowing format of the burgeoning Web culture must provide for anonymous interactions. Not surprisingly, they soon came under the uncomfortable scrutiny of the formidable National Security Agency. The situation escalated in early 1993, after a computer programmer named Phil Zimmermann (a patron saint of the community) -- alarmed that the patents for public key encryption were sold to a company called RSA -- wrote an open-source, free program called PGP (Pretty Good Privacy). The resulting debacle, in which Zimmermann was threatened with criminal prosecution for exporting weapons (encryption technology is termed a weapon by the U.S. government), brought the public's right to privacy to the forefront of the now-commonplace tug-of-war between those who favor "crypto anarchy" and those who don't. Through the active work of many civil libertarians, including the cypherpunks, pressure was brought to bear upon the government to re-think its position. The charges against Zimmermann were dropped. It was a triumph. The geeks fought the law, and the geeks won. "The cypherpunks' paranoia about information exploitation is becoming mainstream," Peter Wayner, author of Translucent Databases, wrote in an e-mail interview. "Everyone is learning that the cypherpunks' insistence on limiting the proliferation of information is a good thing." The cypherpunks' e-mail list forms the nucleus of the community, which has grown to include people of many agendas and interests. No longer the exclusive domain of crypto geeks, cypherpunks are "doctors, lawyers, mathematicians, felons, druggies, anti-druggies, anarchists, libertarians, right-wing fanatics, left-wing fanatics, teachers, housewives, househusbands, students, cops and criminals," cypherpunk J.A. Terranson wrote in a posting. Cypherpunk Optimizzin Al-gorithym wrote in typically obscure cypherpunk fashion, "We're all just voices in Tim May's head." May, one of the original cypherpunks, continues to be an active figurehead of the cypherpunks and has often bridged the chasm between its historically secretive culture and its forays into the public sphere. In 10 years, the list has become an amalgamation of a political watchdog site, a social club and a repository of technical cryptographic discussion. "(It's) where people from all different backgrounds and views can hear from one another," mathematician Nina Fefferman said. "We math people are frequently shocked and confused by what the politicians do with regard to legislating crypto-related issues. Conversely, the policy and society people are frequently interested in issues that have to do with the use and regulation of cryptographic standards and research." "The atmosphere isn't as electric because the scene has grown so big," Wayner said. "It's not just a few guys talking about the importance of some mathematical equations. It's like debating the importance of indoor plumbing now. No one disputes it, they just want to argue about copper versus PVC." Wayner, Zimmermann, as well as May, John Gilmore and Eric Hughes (the original founders of the list), however, have emerged from their cypherpunk association as key public privacy figures: vocal and passionate defenders of civil liberties on the Web. It's hard to imagine the secretive and fractious cryptocrusaders assembling for a physical meeting. Even May, the party's host, isn't sure who or how many cypherpunks to expect to his soiree at a hideaway in the Santa Cruz (California) mountains. But he's adamant about who won't be coming. Never one to mince words, he wrote, "Narcs and feds will not be allowed at the meeting. Fuck them dead." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

The coming crackdown on blogging
by R.A. Hettinga 03 Mar '05

03 Mar '05

<http://news.com.com/2102-1028_3-5597079.html?tag=st.util.print> CNET News http://www.news.com/ The coming crackdown on blogging By Declan McCullagh Story last modified Thu Mar 03 04:00:00 PST 2005 Bradley Smith says that the freewheeling days of political blogging and online punditry are over. In just a few months, he warns, bloggers and news organizations could risk the wrath of the federal government if they improperly link to a campaign's Web site. Even forwarding a political candidate's press release to a mailing list, depending on the details, could be punished by fines. Smith should know. He's one of the six commissioners at the Federal Election Commission, which is beginning the perilous process of extending a controversial 2002 campaign finance law to the Internet. In 2002, the FEC exempted the Internet by a 4-2 vote, but U.S. District Judge Colleen Kollar-Kotelly last fall overturned that decision. "The commission's exclusion of Internet communications from the coordinated communications regulation severely undermines" the campaign finance law's purposes, Kollar-Kotelly wrote. Smith and the other two Republican commissioners wanted to appeal the Internet-related sections. But because they couldn't get the three Democrats to go along with them, what Smith describes as a "bizarre" regulatory process now is under way. CNET News.com spoke with Smith about the Bipartisan Campaign Reform Act of 2002, better known as the McCain-Feingold law, and its forthcoming extrusion onto the Internet. Q: What rules will apply to the Internet that did not before? A: The commission has generally been hands-off on the Internet. We've said, "If you advertise on the Internet, that's an expenditure of money--much like if you were advertising on television or the newspaper." Do we give bloggers the press exemption? The real question is: Would a link to a candidate's page be a problem? If someone sets up a home page and links to their favorite politician, is that a contribution? This is a big deal, if someone has already contributed the legal maximum, or if they're at the disclosure threshold and additional expenditures have to be disclosed under federal law. Certainly a lot of bloggers are very much out front. Do we give bloggers the press exemption? If we don't give bloggers the press exemption, we have the question of, do we extend this to online-only journals like CNET? How can the government place a value on a blog that praises some politician? How do we measure that? Design fees, that sort of thing? The FEC did an advisory opinion in the late 1990s (in the Leo Smith case) that I don't think we'd hold to today, saying that if you owned a computer, you'd have to calculate what percentage of the computer cost and electricity went to political advocacy. It seems absurd, but that's what the commission did. And that's the direction Judge Kollar-Kotelly would have us move in. Line drawing is going to be an inherently very difficult task. And then we'll be pushed to go further. Why can this person do it, but not that person? How about a hyperlink? Is it worth a penny, or a dollar, to a campaign? I don't know. But I'll tell you this. One thing the commission has argued over, debated, wrestled with, is how to value assistance to a campaign. Corporations aren't allowed to donate to campaigns. Suppose a corporation devotes 20 minutes of a secretary's time and $30 in postage to sending out letters for an executive. As a result, the campaign raises $35,000. Do we value the violation on the amount of corporate resources actually spent, maybe $40, or the $35,000 actually raised? The commission has usually taken the view that we value it by the amount raised. It's still going to be difficult to value the link, but the value of the link will go up very quickly. Then what's the real impact of the judge's decision? The judge's decision is in no way limited to ads. She says that any coordinated activity over the Internet would need to be regulated, as a minimum. The problem with coordinated activity over the Internet is that it will strike, as a minimum, Internet reporting services. They're exempt from regulation only because of the press exemption. But people have been arguing that the Internet doesn't fit under the press exemption. It becomes a really complex issue that would strike deep into the heart of the Internet and the bloggers who are writing out there today. (Editor's note: federal law limits the press exemption to a "broadcasting station, newspaper, magazine or other periodical publication." ) How do you see this playing out? There's sensitivity in the commission on this. But remember the commission's decision to exempt the Internet only passed by a 4-2 vote. This time, we couldn't muster enough votes to appeal the judge's decision. We appealed parts of her decision, but there were only three votes to appeal the Internet part (and we needed four). There seem to be at least three commissioners who like this. Then this is a partisan issue? Yes, it is at this time. But I always point out that partisan splits tend to reflect ideology rather than party. I don't think the Democratic commissioners are sitting around saying that the Internet is working to the advantage of the Republicans. One of the reasons it's a good time to (fix this) now is you don't know who's benefiting. Both the Democrats and Republicans used the Internet very effectively in the last campaign. What would you like to see happen? I'd like someone to say that unpaid activity over the Internet is not an expenditure or contribution, or at least activity done by regular Internet journals, to cover sites like CNET, Slate and Salon. Otherwise, it's very likely that the Internet is going to be regulated, and the FEC and Congress will be inundated with e-mails saying, "How dare you do this!" What happens next? It's going to be a battle, and if nobody in Congress is willing to stand up and say, "Keep your hands off of this, and we'll change the statute to make it clear," then I think grassroots Internet activity is in danger. The impact would affect e-mail lists, especially if there's any sense that they're done in coordination with the campaign. If I forward something from the campaign to my personal list of several hundred people, which is a great grassroots activity, that's what we're talking about having to look at. Senators McCain and Feingold have argued that we have to regulate the Internet, that we have to regulate e-mail. They sued us in court over this and they won. If Congress doesn't change the law, what kind of activities will the FEC have to target? We're talking about any decision by an individual to put a link (to a political candidate) on their home page, set up a blog, send out mass e-mails, any kind of activity that can be done on the Internet. Again, blogging could also get us into issues about online journals and non-online journals. Why should CNET get an exemption but not an informal blog? Why should Salon or Slate get an exemption? Should Nytimes.com and Opinionjournal.com get an exemption but not online sites, just because the newspapers have a print edition as well? Why wouldn't the news exemption cover bloggers and online media? Because the statute refers to periodicals or broadcast, and it's not clear the Internet is either of those. Second, because there's no standard for being a blogger, anyone can claim to be one, and we're back to the deregulated Internet that the judge objected to. Also I think some of my colleagues on the commission would be uncomfortable with that kind of blanket exemption. So if you're using text that the campaign sends you, and you're reproducing it on your blog or forwarding it to a mailing list, you could be in trouble? Yes. In fact, the regulations are very specific that reproducing a campaign's material is a reproduction for purpose of triggering the law. That'll count as an expenditure that counts against campaign finance law. This is an incredible thicket. If someone else doesn't take action, for instance in Congress, we're running a real possibility of serious Internet regulation. It's going to be bizarre. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: I'll show you mine if you show me, er, mine
by Whyte, William 03 Mar '05

03 Mar '05

I haven't read the original paper, and I have a great deal of respect for Markus Jakobsson. However, techniques that establish that the parties share a weak secret without leaking that secret have been around for years -- Bellovin and Merritt's DH-EKE, David Jablon's SPEKE. And they don't require either party to send the password itself at the end. William > -----Original Message----- > From: pgut001(a)cs.auckland.ac.nz [mailto:pgut001@cs.auckland.ac.nz] > Sent: Wednesday, February 23, 2005 7:30 AM > To: cryptography(a)metzdowd.com; cypherpunks(a)al-qaeda.net; > rah(a)shipwright.com > Subject: Re: I'll show you mine if you show me, er, mine > > > "R.A. Hettinga" <rah(a)shipwright.com> forwarded: > > >Briefly, it works like this: point A transmits an encrypted > message to point > >B. Point B can decrypt this, if it knows the password. The > decrypted text is > >then sent back to point A, which can verify the decryption, > and confirm that > >point B really does know point A's password. Point A then > sends the password > >to point B to confirm that it really is point A, and knows > its own password. > > Isn't this a Crypto 101 mutual authentication mechanism (or at least a > somewhat broken reinvention of such)? If the exchange to > prove knowledge of > the PW has already been performed, why does A need to send > the PW to B in the > last step? You either use timestamps to prove freshness or > add an extra > message to exchange a nonce and then there's no need to send > the PW. Also in > the above B is acting as an oracle for password-guessing > attacks, so you don't > send back the decrypted text but a recognisable-by-A > encrypted response, or > garbage if you can't decrypt it, taking care to take the same > time whether you > get a valid or invalid message to avoid timing attacks. Blah > blah Kerberos > blah blah done twenty years ago blah blah a'om bomb blah blah. > > (Either this is a really bad idea or the details have been > mangled by the > Register). > > Peter. > > > --------------------------------------------------------------------- > The Cryptography Mailing List > Unsubscribe by sending "unsubscribe cryptography" to > majordomo(a)metzdowd.com

1 0

I'll show you mine if you show me, er, mine
by R.A. Hettinga 03 Mar '05

03 Mar '05

<http://www.theregister.co.uk/2005/02/21/crypto_wireless/print.html> The Register Biting the hand that feeds IT The Register ; Security ; Identity ; Original URL: http://www.theregister.co.uk/2005/02/21/crypto_wireless/ I'll show you mine if you show me, er, mine By Lucy Sherriff (lucy.sherriff at theregister.co.uk) Published Monday 21st February 2005 17:11 GMT Security researchers have developed a new cryptographic technique they say will prevent so-called stealth attacks against networks. A stealth attack is one where the attacker acts remotely, is very hard to trace, and where the victim may not even know he was attacked. The researchers say this kind of attack is particularly easy to mount against a wireless network. The so-called "delayed password disclosure" protocol was developed by Jakobsson and Steve Myers of Indiana University. The protocol allows two devices or network nodes to identify themselves to each other without ever divulging passwords. The protocol could help secure wireless networks against fraud and identity theft, and protect sensitive user data. The technique will be particularly useful in ad-hoc networks, where two or more devices or network nodes need to verify each others' identity simultaneously. Briefly, it works like this: point A transmits an encrypted message to point B. Point B can decrypt this, if it knows the password. The decrypted text is then sent back to point A, which can verify the decryption, and confirm that point B really does know point A's password. Point A then sends the password to point B to confirm that it really is point A, and knows its own password. The researchers say that this will prevent consumers connecting to fake wireless hubs at airports, or in coffee shops. It could also be used to notify a user about phishing attacks, scam emails that try to trick a user into handing over their account details and passwords to faked sites, provide authentication between two wireless devices, and make it more difficult for criminals to launder money through large numbers of online bank accounts. Jakobsson is hoping to have beta code available for Windows and Mac by the spring, and code for common mobile phone platforms later in 2005. More info available here (http://www.stealth-attacks.info) . Related stories Hotspot paranoia: try to stay calm (http://www.theregister.co.uk/2005/01/24/wi_fi_hotspot_security/) Crypto researchers break SHA-1 (http://www.theregister.co.uk/2005/02/17/sha1_hashing_broken/) Cyberpunk authors get the girls (http://www.theregister.co.uk/2005/02/17/cyberpunk/) ) Copyright 2005 -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

6 5

With Terror in Mind, a Formulaic Way to Parse Sentences
by R.A. Hettinga 03 Mar '05

03 Mar '05

<http://www.nytimes.com/2005/03/03/technology/circuits/03next.html?8cir=&pag…> The New York Times March 3, 2005 WHAT'S NEXT With Terror in Mind, a Formulaic Way to Parse Sentences By NOAH SHACHTMAN MAYBE sixth-grade English was more helpful than you thought. One of the dullest grammar exercises is being used to help find potential terrorists, and save companies a bundle. Diagramming sentences - picking out subject, verb, object, adjective and other parts of speech - has been a staple of middle and high school grammar lessons for decades. Now, with financing from the Central Intelligence Agency, a California firm is using the technique to comb through e-mail messages and chat room talks, which can be a rich lode of corporate and government information, and a tough one to mine. Figuring out the connections among people, places and things is something computer algorithms do pretty well, as long as that information is structured, or categorized and put into a database. Looking through a company's customer file for a person named Bonds, for example, is fairly simple. But if the data is unstructured - if the word "bonds" hasn't been classified as the name of a ballplayer or as an investment option - searching becomes much more difficult. For people in business or in public service, only 20 percent or so of their information is kept in formal databases, noted Nick Patience, an analyst with the 451 Group, a technology research firm. The rest is unstructured, tucked away in e-mail messages, call logs, memos and instant messages. Attensity, based in Palo Alto, Calif., and financed in part by In-Q-Tel, the C.I.A.'s investment arm, has developed a method to parse electronic documents almost instantly, and diagram all of the sentences inside. ("Moby-Dick," for instance, took all of nine and a half seconds.) By labeling subjects and verbs and other parts of speech, Attensity's software gives the documents a definable structure, a way to fit into a database. And that helps turn day-to-day chatter into information that is relevant and usable. "They take the language that people use every day and compile it in a way that a machine can use," Mr. Patience said. "And that allows people to start using this tremendous amount of intelligence which has gone untapped." Whirlpool, the home appliance manufacturer, is now using Attensity software to help cull information from the 400,000 customer service calls the company receives each month. Tom Welke, a Whirlpool general manager, said the company realized it needed help in March 2002, during a microwave oven recall. The machines were arcing, producing electrical sparks, which caused the food inside to smoke. Mr. Welke decided to pore through records of recent customer calls by searching for the words "arcing" and "smoke." His team found 18,500 records that matched. Six people then spent a weekend reading the results, eventually coming up with 700 calls from customers potentially related to the problem. As a comparison, Mr. Welke then ran the same records through a program from Attensity, which had recently paid him a sales call. "It could tell if the microwave was smoking or if the chicken was smoking hot or if the customer was eating smoked chicken," he said. "It came up with 542 instances in about 10 seconds." Whirlpool is now spending a quarter-million dollars a year on Attensity's expertise, joining companies like John Deere, General Motors and Honeywell as Attensity customers. But wringing profits out of unstructured data for corporate America is only about 40 percent of the software maker's business. The rest is in government work, for groups like the Federal Bureau of Investigation, the National Security Agency and the Defense Intelligence Agency. The software helps federal researchers look for clues to terrorist and criminal activities in "the text from the dispatches from around the world, the field reports, the newspaper articles and the chat rooms," said David L. Bean, Attensity's co-founder. "The intelligence community has plenty of systems for doing six degrees of separation, for putting two and two together," Dr. Bean said. "But they need structured data in order to do it. We give them that structure." The intelligence agencies declined to discuss whether they use the software. But Kris Alexander, a former intelligence analyst for the United States military's Central Command, noted that "putting unstructured information into anything that would organize it would be very helpful." "We have guys who can crack hard drives," Mr. Alexander said. "Getting the information out is easy. The hard part is sharing it, and organizing it, so that everybody in an agency, even nonexperts, can use it." Attensity's algorithms can do more than get a document ready to categorize, however. The software ferrets out meaning in sentences as they are being diagramed. If the word "purchase" is used as a verb, the person doing the buying is tagged as a possible customer. If the phrase "plastic explosive" is used as an object, the subject is labeled as a potential enemy. For now, though, Attensity works only with English. That is a weakness the company's competitors in the world of structuring data are quick to point out. Inxight Software, of Sunnyvale, Calif., for example, produces software that turns grammatical relationships into mathematical formulas, allowing it to parse documents in 31 languages. Intelliseek, of Cincinnati, plucks entities - proper names and places - from blog entries as a way to categorize them. The company's software will also characterize a document as positive or negative based on the words it contains. Oracle and the other major database makers also build in some limited functions for extracting information from unstructured texts. But those systems usually rely on the person using it teaching the algorithms what they need to know - that in a legal document, for example, "sued" and "filed charges" are rough equivalents. With Attensity's software, that kind of instruction is often unnecessary. "Attensity shows how the words all relate to one another - all the actors, objects and actions in a document, and how they connect," said Gayle von Eckartsberg, a spokeswoman for In-Q-Tel, which also provides financing for Inxight and Intelliseek. Perfect sentences are not required for the software to work, said Dr. Bean, the son of a high school English teacher. Instead of using strict grammar laws, Attensity relies on constantly reapplying heuristics - rules of thumb - to sort out subject from object. Dangling participles, misspelled words and grammar-mangling slang can all be handled, allowing Attensity to crunch Internet relay chats, instant messenger conversations and other King's English refugees as easily as it would parse a textbook. But that does not mean, Dr. Bean added, that students should stop doing their grammar homework or paying attention in school. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

bounty for errors in _Translucent Databases_
by R.A. Hettinga 03 Mar '05

03 Mar '05

--- begin forwarded text

1 0