June 2005 - cypherpunks-legacy

SPKI Certs Usage
by Jay Listo 03 Jun '05

03 Jun '05

I've been wondering about the feasibility of using SPKI certs. I quite like some of the features (delegation) and relative ease of implementation (compared to X.509 certs)...of course, readability of certs could go a long way to helping end-users evaluate for themselves the trustworthiness of the cert. While pgp certs could probably be a good alternative (given the existing user base and infrastructure)....even though lacking in the ability to delegate. However, I'm a little wary since at the moment there seem to be just a few sources of info or proponents (even though their arguments seem convincing to me) when it comes to SPKI. I am also not aware of any products or PKIs that use SPKI certs. I would really appreciate if someone could refer me to instances of actual usage of SPKI certs.

2 2

Account update Ramon
by Colby Jimenez 03 Jun '05

03 Jun '05

----- Original Message ----- From: Ramon <asbestos13(a)hotmail.com> To: teutonic1(a)msn.com <Ramon(a)msn.com> ; guerdonsolidify(a)yahoo.com <dichloride4216(a)yahoo.com >; Dear Homeowner, Mortgage. You have been pre-approved. You can get $243,000 for as little as $232 a month, thanks to your pre-approval. Visit us, Fill out the form, no obligation Pull cash out, or refinance.. No long forms or quastionnaires. Fill up our extremely short and simple form today and get a call back within a couple of hours. Start saving now, click that link: http://www.lower-financing.com/2/index/bvk timber mks missy juk salty fzo rajah uu cache chw didn't nk aristotelean fet mater aaf zimmerman flr resident uou http://lower-financing.com/rem.php

1 0

Shed inches in minutes
by Stefan 03 Jun '05

03 Jun '05

Body Wrap at Home to lose 6-20 inches in one hour. With Bodywrap we guarantee: you'll lose 6-8 Inches in one hour 100% Satisfaction or your money back Bodywrap is soothing formula that contours, cleanses and rejuvenates your body while reducing inches. http://leavenworth.yourfitnessonline.com clank yk camp pt allotting lhy orville ldn vought nra servo dv cowpea hkf claudio kjq morphism rj onyx yup eurasia pfj cantle zfv http://leavenworth.yourfitnessonline.com/r

1 0

where are you?
by Julie Powers 02 Jun '05

02 Jun '05

I'm new, it's Julie :) Alot of the times I feel weird, even my girlfriends told me that .... old time friend suggested to put my hot videos somehow online. My website is like my new hobby :D AllCome check website I put together, I'm not that good tho with comp skills yet but tell me what you think ;0 http://www.aolkeywerdz.com/ju18/ you backdrop me mac me you arcadia me gusset me you mackinaw me segovia me you selves me placate me you shirtmake me advance me you chokeberry me anaglyph me you falstaff me dietz me you whipsaw me bimonthly me

1 0

Half Price Special
by Phillip Odom 02 Jun '05

02 Jun '05

This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --_001_9618_91H89UA1.59JR5827 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7Bit Microsoft,Adobe,Macromedia and many more Windows X.P Pro 2oo2 .............. 5o Dollars office X.P Pro 2oo2 ................. 1oo Dollars We Also Have: -Windows 2ooo Workstation -Corel Draw Graphics Suite 11 -Adobe Premiere Get info: http://bobztz.info/?d2W6a706aa99f4A4b59353bFa82c9bb1 The offer is valid Untill June 10th Stock is limited please reply Francesca Rosario Sacker Bioinformatics Free Lancer, Benny Shomer, MACCABIM, 71700, ISRAEL, Israel Phone: 145-527-4731 Mobile: 371-113-1811 Email: mssubcurrapfjj(a)freechina.com please do not reply to this message This package is a 12 decade definite file NOTES: The contents of this connection is for attention and should not be threefold edgy delaware basemen familiarly Time: Fri, 03 Jun 2005 03:52:02 +0200 --_001_9618_91H89UA1.59JR5827 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: 7Bit Check this out: <a href="http://bobztz.info/?2W7e90ef3351Aaa1491a5ad5F344d683 ">Windows X.P Pro 2oo2</a> .............. 5o Dollars <a href="http://bobztz.info/?Wc68727bc61019Aba269Fb7e6df46f53 ">office X.P Pro 2oo2</a> ................. 1oo Dollars We Also Have: -Macromedia Dreamwaver MX 2oo4 -Windows 2ooo Advanced Server -Adobe Photoshop <a href="http://bobztz.info/?15e3aW9f6419451bAbf2285cb9b70F0d ">And lots more</a> The offer is valid Untill June 15th Stock is limited love you Francesca Rosario Footman Hyphens Marketing & Technical Services Pte Ltd, 199007, Singapore Phone: 813-476-9599 Mobile: 615-944-9757 Email: <a href=mailto:mssubcurrapfjj@freechina.com>mssubcurrapfjj(a)freechina.com</a> This message is being sent to confirm your account. Please do not reply directly to this message This shareware is a 40 hour definite shareware NOTES: The contents of this message is for information and should not be greece bernini eye triangulum cheeky Time: Fri, 03 Jun 2005 03:52:02 +0200 --_001_9618_91H89UA1.59JR5827--

1 0

Re: "SSL stops credit card sniffing" is a correlation/causality myth
by Ian G 02 Jun '05

02 Jun '05

On Thursday 02 June 2005 11:33, Birger Tödtmann wrote: > Am Mittwoch, den 01.06.2005, 15:23 +0100 schrieb Ian G: > [...] > > > For an example of the latter, look at Netcraft. This is > > quite serious - they are putting out a tool that totally > > bypasses PKI/SSL in securing browsing. Is it insecure? > > Yes of course, and "it leaks my data like a seive" as > > one PKI guy said. > > [...] > > What I currently fail see is the link to SSL. Or, to its PKI model. That's the point. There is no link to SSL or PKI. The only thing in common is the objective - to protect the user when browsing. Secure browsing is now being offered by centralised database sans crypto. > Netcraft bypasses it, but I won't use Netcraft exclusively because I'm > happy to use the crypto in SSL. Netcraft and Trustbar are really nice > add-ons to improve my security *with SSL*. So where is the point? Sure, I think it is a piece of junk, myself. But I am not important, I'm not an "average user." The only thing that is important is what the user thinks and does. When Netcraft announced their plugin had been ported from IE to Firefox last week, they also revealed that they had "60,000 downloads in hours." That tells us a few things. Firstly, users want protection from phishing. Secondly, Netcraft have succeeded enough in the IE world in creating a user base for their solution that it easily jumped across to the Firefox userbase and scored impressive numbers straight away. Which tells us that it actually delivers something useful (which may or may not be security). So we cannot discount that the centralised database concept works "well enough" by some measure or other. So now we wait to see which model wins in protecting the user from spoofing. iang -- Advances in Financial Cryptography: https://www.financialcryptography.com/mt/archives/000458.html --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Re: "SSL stops credit card sniffing" is a correlation/causality myth
by Ian G 02 Jun '05

02 Jun '05

On Wednesday 01 June 2005 10:35, Birger Tödtmann wrote: > Am Dienstag, den 31.05.2005, 18:31 +0100 schrieb Ian G: > [...] > > > As an alternate hypothesis, credit cards are not > > sniffed and never will be sniffed simply because > > that is not economic. If you can hack a database > > and lift 10,000++ credit card numbers, or simply > > buy the info from some insider, why would an > > attacker ever bother to try and sniff the wire to > > pick up one credit card number at a time? > > [...] > > "And never will be..."? Not being economic today does not mean it > couldn't be economic tomorrow. Today it's far more economic to lift > data-in-rest because it's fairly easy to get on an insider or break into > the database itself. Right, so we are agreed that listening to credit cards is not an economic attack - regardless of the presence of SSL. Now, the point of this is somewhat subtle. It is not that you should turn off SSL. The point is this: you *could* turn off SSL and it wouldn't make much difference to actual security in the short term at least, and maybe not even in the long term depending on the economic shifts. OK, so, are we agreed on that: we *could* turn off SSL, but that isn't the same thing as "should* ? If we've got that far we can go to the next step. If we *could* turn off SSL then we have some breathing space, some room to manouvre. Some wiggle room. Which means we could modify the model. Which means we could change the model, we could tune the crypto or the PKI. And in the short term, that would not be a problem for security because there isn't an economic attack anyway. Right now, at least. OK so far? This means that we could improve or decrease its strength ... as our objectives suggest ... or we could *re-purpose* SSL if this were so desired. So we could for example use SSL and PKI to protect from something else. If that were an issue. Let's assume phishing is an issue (1.2 billion dollars of american money is the favourite number). If we could figure out a way to change the usage of SSL and PKI to protect against phishing, would that be a good idea? It wouldn't be a bad idea, would it? How could it be a bad idea when the infrastructure is in place, and is not currently being used to defeat any attack? So, even in a stupidly aggressive worst case scenario, if were to "turn off SSL/PKI" in the process and turn its benefit over to phishing, and discover that it no longer protects against listening attacks at all - remember I'm being ridiculously hypothetical here - then as long as it did *some* benefit in stopping phishing, that would still be a net good. That is, there would be some phishing victims who would thank you for saving them, and there would *not* be any Visa merchants who would necessarily damn your grandmother for losing credit cards. Not in the short term at least. And if listening were to erupt in a frenzy in the future it would likely be possible to turn off the anti-phishing tasking and turn SSL/PKI back to protecting against eavesdropping. Perhaps as a tradeoff between the credit card victim and the phishing victim. But that's just stupidly hypothetical. The main thing is that we can fiddle with SSL/PKI if we want to and we can even afford to make some mistakes. So the question then results in - could it be used to benefit phishing? I can point at some stuff that says it will be. But every time this good stuff is suggested, the developers, cryptographers, security experts and what have you suck air between their teeth in and say you can't change SSL or PKI because of this crypto blah blah reason. My point is you can change it. Of course you can change it - and here's why: it's not being economically used over here (listening), and right over there (phishing), there is an economic loss waiting attention. > However, when companies finally find some > countermeasures against both attack vectors, adversaries will adapt and > recalculate the economics. And they may very well fall back to sniffing > for data-in-flight, just as they did (and still do sometimes now) to get > hold of logins and passwords inside corporate networks in the 80s and > 90s. If it's more difficult to hack into the database itself than to > break into a small, not-so-protected system at a large network provider > and install a sniffer there that silently collects 10,000++ credit card > numbers over some weeks - then sniffing *is* an issue. We have seen it, > and we will see it again. SSL is a very good countermeasure against > passive eavesdropping of this kind, and a lot of data suggests that > active attacks like MITM are seen much less frequently. All that is absolutely true, in that we can conjecture that if we close everything else off, then sniffing will become economic. That's a fair statement. But, go and work in one of these places for a while, or see what Perry said yesterday: > The day to day problem of security at real financial institutions is > the fact that humans are very poor at managing complexity, and that > human error is extremely pervasive. .... I'm sure that you'll agree that the likelihood of them closing of all the other attacks is next to nil. Even if some top flight security experts manages to find a client that really cares about security and they together manage to actually lock everything down (a rather low probability, I'd suggest) then there will still be 1000 other places for the attacker to steal the data. The day to day reality of financial institutions is that they do not have good protections in place, they have *adequate* protections for what they *know* about. Which means that there is plenty of pickings out there. So I would suggest that listening for credit cards will never ever be an economic attack. Sniffing for random credit cards at the doorsteps of amazon will never ever be an economic attack, not because it isn't possible, but because there always likely to be easier pickings elsewhere. But don't get me wrong - I am not saying that we should carry out a world wide pogrom on SSL/PKI. What I am saying is that once we accept that listening right now is not an issue - not a threat that is being actively dedended against - this allows us the wiggle room to deploy that infrastructure against phishing. Does that make sense? iang PS: nor does it matter whether I'm right or I'm wrong about my prediction that sniffing will be an economic attack or not - it's just a prediction about the future, just a hypothetical estimate. What matters is now: what attacks are happening now. Does phishing exist, and does it take a lot of money? What can we do about it? -- Advances in Financial Cryptography: https://www.financialcryptography.com/mt/archives/000458.html --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

2 1

Re: Trojan horse attack involving many major Israeli companies, executives
by J.A. Terranson 02 Jun '05

02 Jun '05

> John Saylor wrote: > > hi > > > > ( 05.05.30 15:34 +0200 ) Amir Herzberg: > > > >>See more info e.g. at http://www.haaretz.com/hasen/spages/581790.html > > > > > > an excellent tale [still unfolding]- no doubt coming to a bookstore or > > movie theatre near you real soon. > > > > of course, it was never mentioned in the article, but they *had* to be > > running windows. So, how long before someone, possibly even me, points out that all Checkpoint software is built in Israel? -- Yours, J.A. Terranson sysadmin(a)mfn.org 0xBD4A95BF "Never belong to any party, always oppose privileged classes and public plunderers, never lack sympathy with the poor, always remain devoted to the public welfare, never be satisfied with merely printing news, always be drastically independent, never be afraid to attack wrong, whether by predatory plutocracy or predatory poverty." Joseph Pulitzer 1907 Speech

5 4

you won`t believe your eyes Greg
by Brett 02 Jun '05

02 Jun '05

Increase your CUM VOLUME, and Orgasm Length main benifits: - The longest most intense Orgasms of your life - Erctions like steel - lncreased libido/desire - Stronger ejaculaton (watch where your aiming) - Multiple 0rgasms - Up to 500% more volume (cover her in it if you want) - Studies show it tastes sweeter DISCREET SAME DAY SHIPPING - TRY IT, YOU'LL LOVE IT! (and she'll thank you for it) http://hybridisms.com/spur/?got baton you magazine me plus you composite me bowman you loblolly me ducat you illusion me revision you leave me shea you homunculus me insistent you quintillion me http://hurtfully.com/rm.php?got

1 0

TESTING WHITELIST: PLEASE IGNORE
by J.A. Terranson 01 Jun '05

01 Jun '05

Thanks for your patience. -- Yours, J.A. Terranson sysadmin(a)mfn.org 0xBD4A95BF "Never belong to any party, always oppose privileged classes and public plunderers, never lack sympathy with the poor, always remain devoted to the public welfare, never be satisfied with merely printing news, always be drastically independent, never be afraid to attack wrong, whether by predatory plutocracy or predatory poverty." Joseph Pulitzer 1907 Speech

1 0