June 2006 - cypherpunks-legacy

Re: [Clips] How Britain Beat Hooliganism
by coderman 17 Jun '06

17 Jun '06

On 6/17/06, R.A. Hettinga <rah(a)shipwright.com> wrote: > ... > A NUMBER OF countries have grappled with soccer-related violence, but one > has significantly reduced hooliganism with some unusual steps that would > startle most American sports fans. well, no one said the Panopticon wasn't effective; just too invasive and prone to unacceptable abuses (either potential or currently realized for varying frequency and atrocity) > The country is England, and measures range from deciding who can buy > tickets to telling fans where they can sit. For matches with entrenched > animosity between the teams, some clubs will sell only to people with a > ticket-buying history, meaning a tourist or casual fan can't simply buy an > available seat. To minimize taunting, fans of visiting teams must enter > stadiums through separate doors marked "visitors," and then must sit > together. > ... > While no one in the British police or government considers the hooliganism > problem solved, hooligans have been pushed away from the stadiums. Some 59% > of the arrests in the 2004-05 season took place away from stadium grounds, > and a police spokesman said the measures have forced some hooligans to use > the Internet or cellphones to arrange fights. if you get past the initial "fuck big brother" reaction there are actually some interesting insights to be gleaned here concerning reputation between peers in public and private spaces, the nature of gauging your personal risk in large groups, and so forth. techniques certainly applicable to cypherpunk and privacy advocate goals. the rest is left as an exercise for the reader... *grin*

1 0

[Clips] How Britain Beat Hooliganism
by R.A. Hettinga 17 Jun '06

17 Jun '06

--- begin forwarded text Delivered-To: rah(a)shipwright.com Delivered-To: clips(a)philodox.com Date: Sat, 17 Jun 2006 09:24:11 -0400 To: Philodox Clips List <clips(a)philodox.com> From: "R.A. Hettinga" <rah(a)shipwright.com> Subject: [Clips] How Britain Beat Hooliganism Reply-To: rah(a)philodox.com Sender: clips-bounces(a)philodox.com <http://online.wsj.com/article_print/SB115049661838582842.html> The Wall Street Journal How Britain Beat Hooliganism By CHUCK CULPEPPER June 17, 2006; Page P3 A NUMBER OF countries have grappled with soccer-related violence, but one has significantly reduced hooliganism with some unusual steps that would startle most American sports fans. The country is England, and measures range from deciding who can buy tickets to telling fans where they can sit. For matches with entrenched animosity between the teams, some clubs will sell only to people with a ticket-buying history, meaning a tourist or casual fan can't simply buy an available seat. To minimize taunting, fans of visiting teams must enter stadiums through separate doors marked "visitors," and then must sit together. Beyond that, tickets often bear the name of the purchaser, so in case of a problem, police may track down the responsible parties and soccer clubs may suspend privileges. Closed-circuit cameras blanket stadiums and help prosecutors in soccer-violence cases. With soccer venues purged of the rowdy standing room-only terraces of the 1980s, and fans have become "much less anonymous in the stadium," says John Williams of the University of Leicester's Sir Norman Chester Centre for Football Research. "Now we have a very controlled spectator space." Beer drinking, too, is tightly regulated, and is limited to concession areas. Domestic soccer-related arrests plummeted to about 2,725 in the 2004-05 season from some 8,000 a year in the 1980s. More recently, English authorities have tackled problems with their fans at overseas soccer matches. In the run-up to the World Cup, British authorities required some 3,300 known hooligans to turn in their passports to local police, preventing them from traveling to Germany. More than 90% complied, and airport agents have ensnared a smattering of others who tried to leave the country. Additionally, Britain sent 40 police officers to Germany to help prevent outbreaks, and four prosecutors to gather evidence for any potential court cases. It's a big change from the '80s, when most big-city matches in England had some hooligan incident or element. The crisis peaked in May 1985, when 39 Italian and Belgian fans died in Belgium when a wall collapsed after Liverpool fans charged toward the fans of an Italian team, Juventus. That led the European soccer federation to ban Britain's soccer teams from competition for five years. While no one in the British police or government considers the hooliganism problem solved, hooligans have been pushed away from the stadiums. Some 59% of the arrests in the 2004-05 season took place away from stadium grounds, and a police spokesman said the measures have forced some hooligans to use the Internet or cellphones to arrange fights. On the World Cup's first weekend, about 20 hooligans started a fight that left 16 people injured, but it took place at a big-screen viewing of the England-Paraguay match in East London. Bigger incidents occurred in other European countries this past season, particularly Poland, where a riot after a league championship in Warsaw last month led to the arrest of 231 people and the hospitalization of 50 police officers. In March, a 21-year-old fan was stabbed to death in Krakow. At the World Cup earlier this week, ahead of the Germany-Poland match, police arrested 40 Polish fans and found knives on four of them. In Britain, annual fan surveys by Leicester University show that hooliganism now "figures very little into their perception of football," Mr. Williams says. While fan bases remain predominately young and male, research shows steady increases in both elderly and women attendees. Perhaps the most telling statistic: About 30% of all professional soccer matches in England don't have any police on scene at all, according to government's United Kingdom Football Policing Unit. An estimated 60,000 English fans traveled to Nuremberg for the country's second World Cup game, against Trinidad and Tobago. Some 28 people were arrested, but largely for scalping, public drunkenness and trying to hop the stadium fence. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _______________________________________________ Clips mailing list Clips(a)philodox.com http://www.philodox.com/mailman/listinfo/clips --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

user centric network endpoint based session authentication/privacy
by coderman 17 Jun '06

17 Jun '06

trying to get some feedback for working documentation / design before our next published iteration expected on july 4th. please feel free to provide public comments or suggest related projects/research/code to me directly or on list. throwing down the gauntlet: --- using various authentication and key management methods at the TCP session level associated with a specific IP/port endpoint pair for access to network services[1][2][3][4][5]* is a relic from decades past and is not only inefficient and inflexible but actively detrimental to good usable security due to the baggage and complexity inherent in these methods.[6][7][8] access to network services should be provided on top of a network endpoint local to the two domains requesting and providing services respectively, with user centric authentication for initialization of the secure IPv4/IPv6 tunnel session to which services are bound and revocation performed by terminating this session and the ability to reestablish it. revocable delegation is implemented by proxy of traffic between peers to the delegated domain and irrevocable delegation implemented by sharing authentication credentials for the desired endpoint service(s) with the trusted peer for direct communication without proxy. --- * i listed three distributed capability based protocols not as a slight, but to point out that a capability / POLA / least privilege approach to building and providing services at the OS and application layers is the only way truly good security can be realized. i would like to see the implementation / protocol specific parts of communication privacy pulled out of such projects so they can focus on and implement what they are designed for and most effective at. this is a long term vision as the effort to transition to wide scale capability based security is significant.[9] in a sense this is simply a way to exchange "the capability to communicate with me privately" and then utilize the services made available to your peers when this capability is exercised. FAQ ------- Q: why delegate authentication and privacy to a network IPv4/IPv6 endpoint layer? - this allows a flexible and intuitive method for implementing privacy and authentication of digital communication between peers. the existing tools and concepts associated with Virtual Private Networks can be employed in a decentralized and user centric manner while existing applications and services can use the strong authentication and session management available by binding to the desired endpoint address. "sharing the authentication and privacy bootstrap" makes sense for everyone. more reasons? - it allows you to limit any unauthenticated attacks against application / private services to the VPN layer itself (OpenVPN port, IPsec stack, etc), thus keeping applications more vulnerable to attack (rich web services, new apps, etc) inside an authenticated boundary. NOTE: this should not be interpreted as the usual "perimeter security" model which is flawed. when each peer communicates directly you have effectively deperimeterized the hosts on the network. - it meshes well with a virtual machine approach to isolating domains where each VM instance can have it's own network endpoint tied to distinct authenticated sessions. - it allows pet names to be given to distinct addresses bound to peer identity (using the SHA2-256 digest of peer public key to generate a feed::/8 address for example, which can be given a petname[10] in /etc/hosts like feed:7ba3:c779:e5f5:cc1a:8bc7:5fe1:ed08 public.peertech.org or 172.16.27.53 devwiki) - traffic shaping, bandwidth monitoring, IDS and other techniques can be applied to distinct authenticated sessions using the desired IP address in a straightforward manner. this can be particularly difficult to do when an application uses ephemeral / dynamic ports but is simple with distinct endpoints. Q: what about passwords? - it is assumed that this style of security would utilize full disk encryption or a key manager (like the browser site login remember feature) to manage strong authentication material associated with a user's identity. passwords are too weak for good network authentication. Q: what would the key distribution for this kind of identity management look like? - some examples: A. Strongly authenticated propinquitous capability exchange: First two peers exchange public keys (self signed OpenVPN certificates) and endpoint locators in person. Second they both connect over wireless / LAN directly using OpenVPN to establish an authenticated and private network between them. B. Strongly authenticated transitive introduction: Using a secure session pair created via strong auth, send the public key of each peer to be introduced to each other. Each peer attempts directly connecting using the endpoint identifiers for each other obtained from the mutually trusted peer. C. Opportunistically authenticated capability exchange: Petition public / untrusted introducer with nickname or other identifier for endpoint discovery (coderman.dyndns.org for example). Connect to peer and exchange and save keys (openssh style). Keys may be verified in the future or reset if problems are encountered. Q: This sounds way too complicated; what can support this kind of connectivity: - while difficult this is feasible and straightforward. existing tools like OpenVPN, OpenSSH 3.4+, IPsec, PPTP, and others can all be integrated in a suitable fashion using everything from UDP, TCP to ICMP and even covert DNS tunnels or 802.11 injection for transport. the key will be making key management and user interaction simple enough for the appropriate threat models. references: 1. "HTTPS protocol" - http://en.wikipedia.org/wiki/Https 2. "STARTTLS protocols" - http://www.ietf.org/rfc/rfc2595.txt 3. "Lessons from E-speak" - http://www.hpl.hp.com/personal/Alan_Karp/espeak/espeak_articles/lessons.pdf 4. "httpsy protocol" - http://www.waterken.com/dev/YURL/httpsy/ 5. "CapTP protocol" - http://www.erights.org/elib/distrib/captp/index.html 6. "Security: Problem Solved?" - http://acmqueue.com/modules.php?name=Content&pa=showpage&pid=311&page=4 7. "Why johnny can't encrypt" - http://www.google.com/search?q=%22why+johnny+can%27t+encrypt%22 8. "Why Phishing Works" - http://www.google.com/search?q=%22Why+Phishing+Works%22 9. "Capability Myths Demolished" - http://citeseer.ist.psu.edu/miller03capability.html 10. "Introduction to Petname Systems" - http://www.skyhunter.com/marcs/petnames/IntroPetNames.html

1 0

Tiffany&Co and Rolex Here
by Kitty Plummer 17 Jun '06

17 Jun '06

Perfect Gift for your spouse and family - Handbags and Purses - Rolex and Luxury Watches - Tiffany and Jewellery You Name It, We have It all at 8o-% Price Reduction Be a real man today http://043.digitalloove.com

1 0

Notice: Loww mortagee ratee approved
by Gerard Brennan 16 Jun '06

16 Jun '06

1 0

View Our Wholesale Rolex Replica ////atches Today!
by Renee Booth 16 Jun '06

16 Jun '06

Content-Transfer-Encoding: quoted-printable VIP REPLICA //ATCHES! We offer a free gift box with every VIP watch ordered. You can use it as a lovely gift for your friends or relatives or keep your gorgeous watch there. No matter what you do=20 with your watch, you will enjoy it. -All Time Classics -Exquisite R0lex Replica -Superb Quality //atch and others!# Check out our gift boxes that will make the present even more glamorous.

1 0

RuBee RFID alternative penetrates tinfoil hats
by Bill Stewart 16 Jun '06

16 Jun '06

http://www.engadget.com/2006/06/13/rubee-protocol-overcomes-rfid-shortcomin… http://www.eweek.com/article2/0,1895,1974931,00.asp http://www.theinquirer.net/?article=32369 RuBee is a new tagging standard that mostly uses magnetic rather than radio signals, making it better at penetrating metal and liquids which are common in warehouse environments where RFID would be useful. Range is about 10-50 feet. Frequencies are below 450 MHz. The main drawback compared to RFID is that it's slower, about 10 reads per second instead of 100-200.

1 0