January 2006 - cypherpunks-legacy

Doctors Use This Too 1UnEyU
by Myrna Plummer 31 Jan '06

31 Jan '06

The Only Clinically Tested Penis N-largement Pills that works.. - add 1-4 inches to your peniis - 20% thicker - 5x more enjoyable orgasm - or your monneyy back without question ask! Join miilliions of delighted users which has been benefited with "Thunder". http://thunder14.myherb.biz Mu

1 0

[fc-discuss] CFP: The Economics of Securing the Information Infrastructure
by R. A. Hettinga 31 Jan '06

31 Jan '06

--- begin forwarded text User-Agent: Microsoft-Entourage/11.1.0.040913 From: "Stuart E. Schechter" <ses(a)ll.mit.edu> To: <fc-discuss(a)ifca.ai> Subject: [fc-discuss] CFP: The Economics of Securing the Information Infrastructure Sender: fc-discuss-admin(a)ifca.ai Date: Mon, 30 Jan 2006 19:47:47 -0500 The Workshop on the Economics of Securing the Information Infrastructure http://wesii.econinfosec.org/ October 23-24, 2006 Arlington, VA CALL FOR PAPERS Our information infrastructure suffers from decades-old vulnerabilities, from the low-level algorithms that select communications routes to the application-level services on which we are becoming increasingly dependent. Are we investing enough to protect our infrastructure? How can we best overcome the inevitable bootstrapping problems that impede efforts to add security to this infrastructure? Who stands to benefit and who stands to lose as security features are integrated into these basic services? How can technology investment decisions best be presented to policymakers? We invite infrastructure providers, developers, social scientists, computer scientists, legal scholars, security engineers, and especially policymakers to help address these and other related questions. Authors of accepted papers will have the opportunity to present their work to government and corporate policymakers. We encourage collaborative research from authors in multiple fields and multiple institutions. Submissions Due: August 6, 2006 (11:59PM PST)* ======================================================================== Suggested topics (not intended to be comprehensive) ======================================================================== The economics of deploying security into: The Domain Name System (DNS) BGP & routing infrastructure Email & spam prevention Programming languages Legacy code bases User interfaces Operating systems Code origin authentication Measuring the cost of adding security Liability and legal issues Models of deployment penetration Measuring/estimating damages Empirical studies of deployment Establishing roots of trust Identity management infrastructure Internet politics Securing open source code libraries Antitrust Issues Adding security to/over existing APIs Privacy Issues Data archival & warehousing infrastructure ======================================================================== Program Committee ======================================================================== Alessandro Acquisti Carnegie Mellon University Heinz School of Public Policy & Management Ross Anderson University of Cambridge Jean Camp Indiana University Huseyin Cavusoglu Tulane University Richard Clayton University of Cambridge Steve Crocker Shinkuro / DNSSEC Deployment Working Group Ben Edelman Harvard University Department of Economics Allan Friedman Harvard University Kennedy School of Government Adam M. Golodner Cisco Systems Larry Gordon University of Maryland Smith School of Business Yacov Haimes University of Virginia Cathy Handley U.S. Department of Commerce, National Telecommunications & Information Administration Barry Horowitz University of Virginia Richard Hovey U.S. Federal Communications Commission (FCC) Jeff Hunker Carnegie Mellon University Heinz School of Public Policy & Management M. Eric Johnson The Tuck School of Business at Dartmouth College Jeffrey M. Kopchik U.S. Federal Deposit Insurance Corporation (FDIC) Technology Supervision Branch Steve Lipner Microsoft Marty Loeb University of Maryland Smith School of Business Doug Maughan U.S. Department of Homeland Security (DHS) Science and Technology Directorate Doug Montgomery U.S. National Institute of Standards & Technology Internetworking Technologies Group Milton Mueller Syracuse University School of Information Studies Andrew Odlyzko University of Minnesota Andy Ozment MIT Lincoln Laboratory / University of Cambridge Shari Lawrence Pfleeger RAND Corporation Stuart Schechter MIT Lincoln Laboratory Bruce Schneier Counterpane Internet Security Rahul Telang Carnegie Mellon University Heinz School of Public Policy & Management Andrew Wyckoff Organisation for Economic Cooperation and Development (OECD) ======================================================================== Workshop Sponsors ======================================================================== The Institute for Information Infrastructure Protection (I3P) The Workshop on the Economics of Information Security (WEIS) ======================================================================== Paper Formats and Submission Instructions ======================================================================== See the workshop web site at: http://wesii.econinfosec.og/ _______________________________________________ fc-discuss mailing list fc-discuss(a)ifca.ai http://mail.ifca.ai/mailman/listinfo/fc-discuss --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[dave@farber.net: [IP] More detailed queries of what Google stores]
by Eugen Leitl 31 Jan '06

31 Jan '06

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

[dave@farber.net: [IP] Face and fingerprints swiped in Dutch biometric passport crack]
by Eugen Leitl 31 Jan '06

31 Jan '06

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

[declan@well.com: [Politech] Google fixes the ban-beer-and-joke-site problem in China [fs]]
by Eugen Leitl 31 Jan '06

31 Jan '06

----- Forwarded message from Declan McCullagh <declan(a)well.com> -----

1 0

[declan@well.com: [Politech] Why the cybercrime treaty is privacy-invasive and worrisome, by James Plummer [priv]]
by Eugen Leitl 31 Jan '06

31 Jan '06

----- Forwarded message from Declan McCullagh <declan(a)well.com> -----

1 0

[dave@farber.net: [IP] Downloading equals manufacturing.]
by Eugen Leitl 30 Jan '06

30 Jan '06

That's some really creative interpretation. ----- Forwarded message from David Farber <dave(a)farber.net> -----

3 3

[fc-announce] Financial Cryptography and Data Security '06 - Call for Participation
by R. A. Hettinga 30 Jan '06

30 Jan '06

--- begin forwarded text From: Patrick McDaniel <mcdaniel(a)cse.psu.edu> To: fc-announce(a)ifca.ai Subject: [fc-announce] Financial Cryptography and Data Security '06 - Call for Participation Sender: fc-announce-admin(a)ifca.ai Date: Mon, 30 Jan 2006 08:51:58 -0500 Financial Cryptography and Data Security '06 February 2nd -- March 2nd, 2006 Anguilla, British West Indies http://fc06.ifca.ai EARLY REGISTRATION DATE: FEB 3, 2006 *** Call for Participation and Program *** At its 10th year edition, Financial Cryptography and Data Security (FC'06) is a well established and major international forum for research, advanced development, education, exploration, and debate regarding security in the context of finance and commerce. Kicking off this the 10th year festivities is our Keynote Address by the renowned cryptographer Ron Rivest. One of the most influential figures in cryptography, Ron will review some of his past predictions and lessons learned over the last 10 years, and prognosticate directions for the next decade. The conference will also feature an invited talk by Michael Froomkin, "Are We All Cypherpunks Yet?", about the current legal landscape of Financial Cryptography. Registration for Financial Cryptography 2006 is now open; details and online registration can be found at http://fc06.ifca.ai along with information about discounted hotel accommodation and travel. Financial Cryptography is organized by the International Financial Cryptography Association (IFCA). More information can be obtained from the IFCA web site at http://www.ifca.ai or by contacting the conference general chair, Patrick McDaniel, at mcdaniel(a)cse.psu.edu. ** Invited Speakers ** Ron Rivest (Keynote) Michael Froomkin ** Panels ** Ten Years of Financial Cryptography, Moderator: Moti Young Identity Management, Moderator: Frank Trotter ** Main Conference Program ** Authentication and Fraud Detection Authentication and Fraud Detection Phoolproof phishing prevention, Bryan Parno and Cynthia Kuo and Adrian Perrig (Carnegie Mellon University) A Protocol For Secure Public Instant Messaging, Mohammad Mannan and Paul C. van Oorschot (School of Computer Science, Carleton University, Canada) Using Automated Banking Certificates to Detect Unauthorized Financial Transactions, C. Corzo, F. Corzo S., N. Zhang, and A. Carpenter (University of Manchester) Privacy Privacy in encrypted content distribution using private broadcast encryption, Adam Barth and Dan Boneh (Stanford University) and Brent Waters (SRI International) A Private Stable Matching Algorithm, Philippe Golle (Palo Alto Research Center) Private Policy Negotiation, Klaus Kursawe and Gregory Neven (Katholieke Universiteit Leuven) and Pim Tuyls (Philips Research Eindhoven) Reputation and Mix-Nets Uncheatable Reputation for Distributed Computation Markets, Bogdan Carbunar (Purdue University) and Radu Sion (Stony Brook University) An Efficient Publicly Verifiable Mix-net for Long Inputs, Jun Furukawa and Kazue Sako (NEC Corporation, Japan) Auditable Privacy: On Tamper-evident Mix Networks, Jong Youl Choi (Indiana University at Bloomington) and Philippe Golle (Palo Alto Research Center) and Markus Jakobsson (Indiana University at Bloomington) Conditional Financial Cryptography A Generic Construction for Token-Controlled Public Key Encryption, David Galindo (Radboud University Nijmegen) and Javier Herranz (INRIA Futurs-Laboratoire d'Informatique (LIX)) Authenticated Key-Insulated Public-Key Encryption and Time-Release Cryptography, Jung Hee Cheon (Dept. of Mathematics, Seoul National Univ., Korea) and Nick Hopper and Yongdae Kim and Osipkov (Dept. of Computer Science and Eng., University of Minnesota-Twin Cities) Conditional Encrypted Mapping and Comparing Encrypted Numbers, Ian F. Blake (Dept. ECE University of Toronto) and Vladimir Kolesnikov (Dept. Comp. Sci. University of Toronto) Revisiting Oblivious Signature-Based Envelopes: New Constructs and Properties, Samad Nasserian (RWTH Aachen University) and Gene Tsudik (University of California, Irvine) Payment Systems Provably Secure Electronic Cash based on Blind Multisignature Schemes, Yoshikazu Hanatani (The University of Electro-Comunications) and Yuichi Komano (Toshiba Corporation) and Kazuo Ohta (The University of Electro-Comunications) and Noboru Kunihiro (The University of Electro-Comunications) Efficient Provably Secure Restrictive Partially Blind Signatures from Bilinear Pairings, Xiaofeng Chen and Fangguo Zhang (Sun Yat-sen University, China) and Yi Mu and Willy Susilo (University of Wollongong, Australia) Privacy-Protecting Coupon System Revisited, Lan Nguyen (CSIRO ICT Centre, Australia) Efficient Protocols Efficient Broadcast Encryption Scheme with Log-Key Storage, Yong Ho Hwang and Pil Joong Lee (Dept. of EEE, POSTECH, Pohang, Korea) Efficient Correlated Action Selection, Mikhail Atallah and Marina Blanton and Keith Frikken and Jiangtao Li (Department of Computer Science, Purdue University) Efficient Cryptographic Protocols Realizing E-Markets with Price Discrimination, Aggelos Kiayias (University of Connecticut) and Moti Yung (RSA Labs & Columbia Univ.) ** Short Papers ** A Practical Implementation of Secure Auctions based on Multiparty Integer Computation, Peter Bogetoft (Food and Resources Economic Institute, The Royal Veterinary and Agricultural University, Denmark) and Ivan Damgaard (Dept. of Computer Science, University of Aarhus) and Thomas Jakobsen (Dept. of Computer Science, University of Aarhus) and Kurt Nielsen (Food and Resources Economic Institute, The Royal Veterinary and Agricultural University, Denmark) and Jakob Pagter (Dept. of Computer Science, University of Aarhus) and Tomas Toft (Dept. of Computer Science, University of Aarhus) Defeating Malicious Servers in a Blind Signatures Based Voting System, Sebastien Canard and Matthieu Gaud and Jacques Traore (France Telecom R&D, France) Pairing Based Threshold Cryptography Improving on Libert-Quisquater and Baek-Zheng, Yvo Desmedt (Information Security, Department of Computer Science, University College London) and Tanja Lange (Technical University of Denmark) Credit transfer within market-based resource allocation infrastructure, Tyler Close (HP Palo Alto) A Note on Chosen-Basis Decisional Diffe-Hellman Assumptions, Michael Szydlo (RSA Laboratories) Cryptanalysis of a partially blind signature scheme or "How to make 100$ bills with 1$ and 2$ ones", Gwenalle Martinet and Guillaume Poupard and Philippe Sola (DCSSI Crypto Lab - France) An Efficient Group Signature with Concurrently-Secure Joining (invited), by I. Teranishi and J. Furukawa (NEC corporation) ** Additional Events ** In addition to the formal conference sessions, there will be an evening Rump Session of informal results and works-in-progress, an afternoon session of presentations by some of our sponsors (including Stefan Roever of Navio and Nicko van Someren of nCipher), and a program of social events (see the conference website for details). ---- We wish to thank the conference sponsors for their invaluable assistance in making this conference possible: Bibit, Everbank, Google, Navio, nCipher, Offshore Information Services. We would also like to thank Telcordia for their technical assistance with the online submission and review process. - _______________________________________________ fc-announce mailing list fc-announce(a)ifca.ai http://mail.ifca.ai/mailman/listinfo/fc-announce --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [Clips] All Those NSA Wiretaps Are Just a Friendster in Disguise
by coderman 30 Jan '06

30 Jan '06

On 1/30/06, R. A. Hettinga <rah(a)shipwright.com> wrote: > ... > "Here's one more tidbit on wire-taps: They get you free phone service! The > feds tapped the phone of the Sisters of Mercy in Washington D.C. because of > some anti-war stance or something they took in the 1980s. The good sisters > noticed some kind of clicking on the phone at times, and finally decided > that someone must have tapped into their phone. Their solution: Don't pay > the bill so the phone company will have to shut off the phone. The phone > never went dead, and they quit sending them bills! The Feds wouldn't let Ma > Bell shut them down, and probably began paying the bills. The sisters > talked long and free with their friends across the country!" oh man, that's classic! i wonder if i could get them to pay for FiOS...

1 0

[Clips] All Those NSA Wiretaps Are Just a Friendster in Disguise
by R. A. Hettinga 30 Jan '06

30 Jan '06

--- begin forwarded text Delivered-To: clips(a)philodox.com Date: Mon, 30 Jan 2006 11:09:17 -0500 To: Philodox Clips List <clips(a)philodox.com> From: "R. A. Hettinga" <rah(a)shipwright.com> Subject: [Clips] All Those NSA Wiretaps Are Just a Friendster in Disguise Reply-To: rah(a)philodox.com Sender: clips-bounces(a)philodox.com <http://www.pbs.org/cringely/pulpit/pulpit20060126.html> PBS: I, Cringely -- The Pulpit January 26, 2006 The Falafel Connection All Those NSA Wiretaps Are Just a Friendster in Disguise By Robert X. Cringely We'll get back to wiretapping in a moment, but first there's the obvious story this week of Disney buying Pixar, which nobody but me seems to think is about estate planning for Steve Jobs. The guy had 80 percent of his wealth tied-up in Pixar. That kind of holding is very difficult to sell on the open market. A $4 billion sell order? I don't think so. Remember this is someone who less than two years ago had a form of pancreatic cancer that has only a 50 percent five-year survival rate. I'm not saying Jobs is going to die, but I AM saying that he is in a position where he has to think about these things and his financial position at Pixar was untenable for his family, and left him too exposed if Cars turns out to be a lemon. So the sale to Disney gives Jobs a smaller piece of a bigger pie and therefore much easier liquidity. But it also gives him the chance to nag Disney into the 21st century, as I am sure he will. Strong minority shareholders tend to clash with management (look at Ross Perot with General Motors and Ted Turner with Time-Warner), and Jobs will do the same with Disney. He'll push to end Disney's partnership with Microsoft, to bring Disney into the Apple-Intel alliance, and potentially try for some partnership with Sony, too. It's the start of a grand amalgamation based around a combination of content, technology, and networking, and I wouldn't at all be surprised to see it end as a single huge company five years from now with Jobs at the helm. Just as Gil Amelio should have at Apple, Robert Iger from Disney had better be looking over his shoulder. Now back to wiretapping. After last week's column, a number of readers wrote to explain that the National Security Agency's problem with complying with the Foreign Intelligence Surveillance Act (FISA) had to do with the sheer volume of wiretaps involved, which they guessed numbers in the millions or billions. Evidently, these worried readers think, the NSA has been long listening-in to ALL of our calls, and thought that might not go down well with the secret court that issues FISA warrants. I don't think so. The NSA has a very advanced program called Echelon for monitoring radio communication around the world, and probably intercepts a lot of phone calls that way, but for FISA-type wiretaps they tend to use the same outsourcing firms the phone companies use, and these generally tiny outfits can only handle a few thousand taps per year each. By the way, if you are wondering whether YOUR phone could be easily tapped, just check to see if your phone company offers three-way dialing, because that's the feature we're talking about. If you can get it, they can get you. And if you are wondering whether VoIP service can't be tapped, the answer is both yes and no. For the moment, SIP services like Skype can't be tapped but that will change soon. And if you are a Vonage or Packet8 user, well they already have your number. Here's what is most likely going on with the NSA and FISA from a guy who used to work for the NSA: "What I think is going on here is that they're using social network analysis. They get some numbers or endpoints of interest, and start out with classical traffic analysis, which can all be done (as I think you pointed out) with pen registers or their moral equivalent. They look for other numbers, and follow the graph of connections by transitivity. "It's well known that any graph of associations in the real world tends to generate cliques, and that the clique size for a social group of any sort tends to actually be fairly small. This is the 'six degrees of Kevin Bacon' effect. But in a social network, there will also be people with many edges coming to them, and many paths in the transitive closure of the graph of their relationships, and those people are often 'centers.' "In fact, just that sort of analysis was done -- after the fact -- of the 9/11 hijackers (in this week's links). "I would guess that the SNA is used to identify people of interest -- although there would be some false positives, like if they all rented apartments from the same rental management firm, or all ordered from the same we-deliver falafel place. But someone who shows up in the transitive network of a lot of calls from overseas, and is also a high edge-count in the SNA graph, is definitely someone to be interested in. I wouldn't be at all surprised if that's when they apply for a FISA warrant and start actually intercepting." So what we have the NSA doing is probably data mining, calling records in order to identify the people they want to order intercepts on. They are doing it without warrants because they like being sneaky, don't think they could get past the FISA court a warrant for 100 million calling records, and because the FISA law from 1978 probably doesn't distinguish between a pen-trap and an intercept. If that's really the case, this doesn't sound quite as bad as we've feared. I feel better thinking that they are culling calling records rather than listening-in to my conversations. And it makes a lot more sense, from a pure technical capability standpoint. So why couldn't they just tell us? Why couldn't they have simply amended the FISA law to take such activities into account? Because they like to be sneaky, tend to distrust even the people who pay them (that's us), and because they for some reason think that the bad guys won't figure this out for themselves. Duh. This is far from the first instance of such unartful phone tapping, as my friend Mike Class reports from Chicago. Though I didn't know it until we'd been e-mailing back and forth for years, Mike is the Socius to the Provincial -- effectively the number two Jesuit in the Windy City: "Here's one more tidbit on wire-taps: They get you free phone service! The feds tapped the phone of the Sisters of Mercy in Washington D.C. because of some anti-war stance or something they took in the 1980s. The good sisters noticed some kind of clicking on the phone at times, and finally decided that someone must have tapped into their phone. Their solution: Don't pay the bill so the phone company will have to shut off the phone. The phone never went dead, and they quit sending them bills! The Feds wouldn't let Ma Bell shut them down, and probably began paying the bills. The sisters talked long and free with their friends across the country!" -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _______________________________________________ Clips mailing list Clips(a)philodox.com http://www.philodox.com/mailman/listinfo/clips --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0