July 2018 - cypherpunks-legacy

None
by Jim Salters 05 Jul '18

05 Jul '18

*** January/February Project Update *** Since our last update, we have launched two new projects (Business Continuity Compliance and Status Reporting, Image Quality and Usability Assurance Phase II), completed one project (Counter-Phishing Phase I), and have added two new projects to our pipeline (Better Mutual Authentication, Resiliency Maturity Model) in addition to Interoperable Verification of Check Security Features. [As a reminder, projects show up in this update only after it has a high probability of launching. We have a number of initiatives in earlier stages of development.] Our Standing Committees (SCOMs) and Special Interest Groups (SIGs) continue to provide a forum for discussion that results in networking, knowledge sharing, and action in the form of projects and workshops. If you are not yet active in one or more committees, please contact me or the committee's Managing Executive. SCOMs and SIGs are still open to non-members, however, projects are members-only. FSTC provides an action-oriented, collaborative forum for our members to address shared business opportunities and challenges through technology projects and knowledge-sharing. We view our projects as our core activity, and one of the key benefits of FSTC membership is eligibility to participate in these projects. In our efforts to keep our members and friends up-to-date on the latest developments in these active and developing initiatives, we provide our colleagues this periodic project update As always, please contact me or Zach Tumin, FSTC Executive Director, for more information. Or visit our website at http://fstc.org. Active Projects: 1. Counter-Phishing Phase I (completed Dec 2004) 2. e-Authentication: Business and Technology Proof-of-Concept (launched Oct 2004) 3. Business Continuity: Compliance and Status Reporting (launched Nov 2004) 4. Image Quality and Usability Assurance Phase II (launched Nov 2004) Projects in Formation (soliciting commitments): [coming soon] Projects in Development: 1. Interoperable Verification of Check Security Features 2. Resilience Maturity Model (RMM): Phase I 3. Better Mutual Authentication: Phase I ______________ ACTIVE PROJECTS: 1. Counter-Phishing Phase I (completed Dec 2004) http://fstc.org/projects/counter-phishing-phase-1/ FSTC has completed a first-phase initiative to address the problem of phishing and related threats in financial services, as it affects the relationship between customer and firm. In collaboration with other industry groups, the project team developed a suite of documents and tools that allowed institutions to understand the comprehensive nature of the problem, and understand the available solution options available to the industry. The project developed a detailed model of the problem, a cost/impact model, the solution space, and a survey of over 60 solution providers. In addition, the project developed a next-phase proposal draft for coordinated industry action to enable Better Mutual Authentication (described below). 12 financial institutions and over 15 technology companies participated in the initiative, and recently published the project's core findings and recommendations to the public. These documents are available from the FSTC web site (link above). A core group is currently developing a next-phase initiative in Better Mutual Authentication, which is described below, and other areas. This project originated from the Security SCOM: co-chaired by Mike McCormick of Wells Fargo, and Mike Versace of NEC. (http://fstc.org/advisory/security.cfm) ______________ 2. FSTC/GSA e-Authentication: Business and Technology Proof-of-Concept (launched Oct 2004, to complete in late March) http://fstc.org/projects/new.cfm#eauth This 5-month project is assessing the viability of the potential business opportunity that exists for financial institutions to leverage their online customer relationships and provide a federated identity-driven authentication service to government agencies, and to integrate these services into financial institutions' online applications. FSTC, jointly with the GSA's E-Authentication Initiative Project Management Office (EAI PMO), have launched a three-track project to ascertain the business model, legal framework, and technical viability of using institutions' identity credentials to permit consumers and businesses to access secure online government applications through federation. There are 7 financial institutions and 10 technology companies and other organizations participating in the project. An in-person meeting is currently scheduled for mid-March in Atlanta, hosted by Bank of America. The project should complete in late March. ______________ 3. Business Continuity: Compliance and Status Reporting (launched Dec 2004) http://fstc.org/projects/new.cfm#compliance The FSTC Business Continuity Standing Committee has launched an initiative to assist the financial industry in coming to a common understanding on the meaning of continuity regulation, prioritization of compliance related activities, and creating efficiencies in documenting regulatory compliance status. To establish a clear understanding of the regulatory environment, a list of continuity related guidance will be pulled together along with the name of the agency responsible. Each regulation will be reviewed and a clearly worded summary of the continuity requirements will be developed. Where possible the regulatory agencies will be contacted for clarification on specific points. Common themes and requirements will be documented and prioritized. The project will focus on providing straight forward interpretations of what is needed for an FI to comply with current regulations. This project is sponsored by the Business Continuity SCOM, co-chaired by Tom Hirsch of US Bank, and Damian Walch of IBM. Please contact FSTC Managing Executive Charles Wallen for more information (charles.wallen(a)fstc.org) (http://fstc.org/advisory/business_continuity/) ______________ 4. Image Quality and Usability Assurance: Phase II (launched Nov 2004) http://fstc.org/projects/new.cfm#iqa2 In Phase I, more than 20 companies, representing 2/3 of US check volume, most major vendors, and key industry associations, undertook a 90-day effort to assess the impact of poor quality check images, and defined 16 technical metrics and 4 usability levels that can be used to measure image quality and usability in a standard and interoperable way. The findings of the Phase I project team justified further development, to test these metrics in a real-world scenario, on millions of images, to determine the quantitative thresholds for the 16 metrics that will define a minimum baseline "standard" for acceptable quality images for the industry. The business objectives are to maximize efficiencies, cost savings, and ensure strong adoption of image exchange. The project will undertake a robust, "real-world" analysis and test to provide actionable specifications and direction to the industry to allow financial institutions, technology vendors, standards organizations, and other key partners to collectively implement baseline image quality and usability through industry collaboration under the FSTC umbrella. This project originates from the Check Truncation SIG (http://fstc.org/advisory/check-truncation.cfm) co-chaired by James Burroughs, Wells Fargo; Glen Ulrich, US Bank; and Ian Goodall, NCR. 7 financial institutions and 18 vendors and industry organizations are participating. ______________ PROJECTS IN DEVELOPMENT: 1. Interoperable Verification of Check Security Features (IV-CSF) As a follow-on to the recently completed Survivability of Check Security Features project (http://fstc.org/projects/csf/) this initiative will seek to develop the business and technology foundation to enable interoperable verification of check security features. As a growing number of banks offer their customers security features targeted at surviving the imaging process, interoperability becomes an important enabler. The objective of this initiative, through interoperability, is to mitigate fraud risk for all stakeholders (banks, customers, merchants, etc.) by shortening the time between a check being presented, and the check verification process, and to enable any receiver of a check to verify it as close to the point of presentment as possible. This project originates from the Check Truncation SIG (http://fstc.org/advisory/check-truncation.cfm) A whiteboard session was held January 26-27 in Tempe, AZ, hosted by Bank of America and co-hosted by JPMorgan Chase. A full draft proposal will be published to the Check Truncation SIG in the coming week to ten days, reflecting the refined objectives and deliverables that were developed in Tempe. Potential project launch is in the March/April timeframe. ______________ 2. Resilience Maturity Model (RMM): Phase I A group of FSTC member institutions and vendors met at the FSTC Technology Recovery Roundtable, hosted by US Bank on October 6th in St. Paul. At the meeting, the group defined a potential project that would develop metrics to evaluate an institution's resilience, much like the Carnegie Mellon CMM model in software development. Resilience in this context is an institution's overall business continuity, disaster recovery, and crisis management program. The business objective of the project would be to allow financial institutions to "rate" themselves and their key business partners against industry-vetted definitions and metrics, and justify investment (or not) where needed to achieve the desired level of resilience. The group met again in New York on January 13th, hosted by JPMorgan Chase, and further refined the concept with 7 of the top 10 institutions in the US represented. A proposal is currently being finalized, and will be published in the next 7-10 days to the general public. More than 8 firms have already committed to participate. If you are interested, please contact Charles Wallen, Business Continuity SCOM Managing Executive, at charles.wallen(a)fstc.org. ______________ 3. Better Mutual Authentication: Phase I As a next-phase concept coming out of the Counter-Phishing: Phase I project, the initiative will focus on establishing a blueprint for the financial industry to establish better mutual authentication between customers and financial institutions. The three components of better mutual authentication include: customer to institution, institution to customer, and email communications from the institution to customer. The objective is to create a framework that supports individual institutions' efforts, while defining a "blueprint" of requirements to ensuring a level of consistency in customer experience (if affected), leveraging customer education efforts, and establishing interoperability wherever possible and prudent. An in-person, large-institution-only meeting is currently being scheduled for mid-late-March to create the charter, objectives, and deliverables for such an initiative. More information will be available in the coming weeks under the auspices of the Security Standing Committee. ## ---------------------------------------------------------------- To subscribe or unsubscribe from this elist use the subscription manager: <http://ls.fstc.org/subscriber> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

PGP Corporation Announces Release of PGP Desktop 8.0.3
by R. A. Hettinga 05 Jul '18

05 Jul '18

<http://home.businesswire.com/portal/site/google/index.jsp?ndmViewId=news_vi…> Headlines October 24, 2003 08:31 AM US Eastern Timezone PGP Corporation Announces Release of PGP Desktop 8.0.3; Support For the Latest Windows and Mac Operating Systems and Popular Email Clients PALO ALTO, Calif.--(BUSINESS WIRE)--Oct. 24, 2003--PGP Corporation, the recognized leader in secure messaging and information storage, today announced the immediate availability of PGP(R) Desktop 8.0.3. This version adds support for Microsoft Office 2003, including Outlook 2003 and Windows Server 2003; Novell GroupWise 6.5; and Mac OS X 10.3 (Panther). "Although technology changes increasingly quickly, PGP products keep pace," said Jon Callas, PGP Corporation's CTO and Chief Security Officer. "This release ensures customers continued access to the rich set of features in PGP Desktop products, including digital signatures to automatically detect email 'spoofing,' key management, and standards-based technology." The release is available free to all customers who have purchased PGP Desktop 8.0 products, including PGP Corporate Desktop, PGP Workgroup Desktop, and PGP Personal Desktop as well as earlier versions of PGP Enterprise, PGP Desktop, and PGP Personal. Licensed customers wishing to upgrade to PGP Desktop 8.0.3 may download the update from www.pgp.com . About PGP Corporation The recognized worldwide leader in secure messaging and information storage, PGP Corporation develops, markets, and supports products used by a broad installed base of enterprises, businesses, governments, individuals, and cryptography experts to secure proprietary and confidential information. During the past ten years, PGP(R) technology has built a global reputation for open and trusted security products. The PGP Corporation family of products includes PGP Universal, an automatic, self-managing network-based solution for enterprises, and individual desktop solutions. Venture funding is provided by DCM-Doll Capital Management and Venrock Associates. Contact PGP Corporation at www.pgp.com or 650-319-9000. PGP is a registered trademark and the PGP logo is a trademark of PGP Corporation. Product and brand names used in the document may be trademarks or registered trademarks of their respective owners. Any such trademarks or registered trademarks are the sole property of their respective owners. Contacts For PGP Corporation: Jump Start Communications, LLC Lori Curtis, 970-887-0044 lori(a)jumpstartcom.com Print this release Terms of Use | © Business Wire 2003 -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Re: OT: Traffic Light Control (was Re: First real-world SCADA attack in US)
by Robert E. Seastrom 05 Jul '18

05 Jul '18

Mark Radabaugh <mark(a)amplex.net> writes: > On 11/23/11 11:23 AM, Valdis.Kletnieks(a)vt.edu wrote: >> On Wed, 23 Nov 2011 11:14:34 EST, Bryan Fields said: >>> So really all a hacker needs is a pair of dykes, some electrical tape, and an >>> all black jumpsuit. >> Actually, you want a really dark blue jumpsuit. All-black creates a sillouette in >> all but the very darkest conditions. > White service truck, orange cone, jeans, heavy cotton shirt and an > orange vest in the middle of the day is far less noticeable. Don't forget the hard hat. Aluminum forms clipboard and Nextel phone complete the outfit but are optional. -r ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tahoe-dev] erasure coding makes files more fragile, not less
by Shawn Willden 05 Jul '18

05 Jul '18

On Mar 28, 2012 1:22 PM, "Eugen Leitl" <eugen(a)leitl.org> wrote: > > On Wed, Mar 28, 2012 at 09:00:56AM -0400, Shawn Willden wrote: > > > The arguments make are the basis for the approach I (successfully) pushed > > when we started the VG2 grid: We demand high uptime from individual > > Can you please tell more about the VG2 grid? I clean missed it. (Sorry I'm slow to respond -- I'm vacationing with my family and often have better things to do than read email :-) ). Volunteer Grid 2 is a Tahoe grid composed of volunteers all over the world. Learning from some problems that the first volunteer grid had, I suggested to early members that VG2 establish some clear and somewhat restrictive policies in order to ensure that the grid was useful for system backups. Two specific backup-driven requirements we had were high reliability/availability and relatively high capacity. To that end, we established a 95% nominal up time requirement and a 500 GB minimum node capacity requirement. We also avoid co-located nodes and disallow usage of more than min(storage_provided, 1 TB). The limit on usage is to avoid having one user deploy, say, 10 TB and then try to consume that much from the grid, swamping the rest of the servers. > > servers because the math of erasure coding works against you when the > > individual nodes are unreliable, and we ban co-located servers and prefer > > to minimize the number of servers owned and administered by a single person > > in order to ensure greater independence. > > > > How has that worked out? Well, it's definitely constrained the growth rate > > of the grid. We're two years in and still haven't reached 20 nodes. And > > It doesn't surprise me at all, since I've never heard a single squeak > about it in the usual channels. (And I'm moderately well-informed > in such matters). I'm surprised. It was definitely announced here when it was created, and discussed occasionally since. > > although our nodes have relatively high reliability, I'm not sure we've > > actually reached the 95% uptime target -- my node, for example, was down > > for over a month while I moved, and we recently had a couple of outages > > caused by security breaches. > > > > However, we do now have 15 solid, high-capacity, relatively available (90%, > > at least) nodes that are widely dispersed geographically (one in Russia, > > six in four countries in Europe, seven in six states in the US; not sure > > about the other). So it's pretty good -- though we do need more nodes. > > How large is the total storage capacity? What about introducer nodes, is > there just one? Total storage capacity, as reported by the stats gatherer, is around 14 TB. That's disk used (~6 TB) plus disk available (~8 TB). As near as I can tell by eyeballing the graph and summing my estimates is that consumption grows by about 40 GB per day. We have a helper but it's lightly used. Only one introducer. The node on the slowest network connection has about 1 Mbps of bandwidth, two or three nodes are on gigabit links, most are 6-50 Mbps, IIRC. Hardware is similarly varied, with the low end being a small NAS box, the high end being some fairly powerful servers in data centers, and everything in between including some virtual servers. Upload performance, as measured from my machine (which has a 50 Mbps up, 100 Mbps down connection), averages about about 300 KBps, before erasure coding, so with my settings I get around 100 KBps net upload rate. I haven't done any download tests recently, but in the past they've been approximately the same as upload speeds, but without the erasure coding penalty. -- Shawn _______________________________________________ tahoe-dev mailing list tahoe-dev(a)tahoe-lafs.org http://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by Jim Salters 05 Jul '18

05 Jul '18

*** January/February Project Update *** Since our last update, we have launched two new projects (Business Continuity Compliance and Status Reporting, Image Quality and Usability Assurance Phase II), completed one project (Counter-Phishing Phase I), and have added two new projects to our pipeline (Better Mutual Authentication, Resiliency Maturity Model) in addition to Interoperable Verification of Check Security Features. [As a reminder, projects show up in this update only after it has a high probability of launching. We have a number of initiatives in earlier stages of development.] Our Standing Committees (SCOMs) and Special Interest Groups (SIGs) continue to provide a forum for discussion that results in networking, knowledge sharing, and action in the form of projects and workshops. If you are not yet active in one or more committees, please contact me or the committee's Managing Executive. SCOMs and SIGs are still open to non-members, however, projects are members-only. FSTC provides an action-oriented, collaborative forum for our members to address shared business opportunities and challenges through technology projects and knowledge-sharing. We view our projects as our core activity, and one of the key benefits of FSTC membership is eligibility to participate in these projects. In our efforts to keep our members and friends up-to-date on the latest developments in these active and developing initiatives, we provide our colleagues this periodic project update As always, please contact me or Zach Tumin, FSTC Executive Director, for more information. Or visit our website at http://fstc.org. Active Projects: 1. Counter-Phishing Phase I (completed Dec 2004) 2. e-Authentication: Business and Technology Proof-of-Concept (launched Oct 2004) 3. Business Continuity: Compliance and Status Reporting (launched Nov 2004) 4. Image Quality and Usability Assurance Phase II (launched Nov 2004) Projects in Formation (soliciting commitments): [coming soon] Projects in Development: 1. Interoperable Verification of Check Security Features 2. Resilience Maturity Model (RMM): Phase I 3. Better Mutual Authentication: Phase I ______________ ACTIVE PROJECTS: 1. Counter-Phishing Phase I (completed Dec 2004) http://fstc.org/projects/counter-phishing-phase-1/ FSTC has completed a first-phase initiative to address the problem of phishing and related threats in financial services, as it affects the relationship between customer and firm. In collaboration with other industry groups, the project team developed a suite of documents and tools that allowed institutions to understand the comprehensive nature of the problem, and understand the available solution options available to the industry. The project developed a detailed model of the problem, a cost/impact model, the solution space, and a survey of over 60 solution providers. In addition, the project developed a next-phase proposal draft for coordinated industry action to enable Better Mutual Authentication (described below). 12 financial institutions and over 15 technology companies participated in the initiative, and recently published the project's core findings and recommendations to the public. These documents are available from the FSTC web site (link above). A core group is currently developing a next-phase initiative in Better Mutual Authentication, which is described below, and other areas. This project originated from the Security SCOM: co-chaired by Mike McCormick of Wells Fargo, and Mike Versace of NEC. (http://fstc.org/advisory/security.cfm) ______________ 2. FSTC/GSA e-Authentication: Business and Technology Proof-of-Concept (launched Oct 2004, to complete in late March) http://fstc.org/projects/new.cfm#eauth This 5-month project is assessing the viability of the potential business opportunity that exists for financial institutions to leverage their online customer relationships and provide a federated identity-driven authentication service to government agencies, and to integrate these services into financial institutions' online applications. FSTC, jointly with the GSA's E-Authentication Initiative Project Management Office (EAI PMO), have launched a three-track project to ascertain the business model, legal framework, and technical viability of using institutions' identity credentials to permit consumers and businesses to access secure online government applications through federation. There are 7 financial institutions and 10 technology companies and other organizations participating in the project. An in-person meeting is currently scheduled for mid-March in Atlanta, hosted by Bank of America. The project should complete in late March. ______________ 3. Business Continuity: Compliance and Status Reporting (launched Dec 2004) http://fstc.org/projects/new.cfm#compliance The FSTC Business Continuity Standing Committee has launched an initiative to assist the financial industry in coming to a common understanding on the meaning of continuity regulation, prioritization of compliance related activities, and creating efficiencies in documenting regulatory compliance status. To establish a clear understanding of the regulatory environment, a list of continuity related guidance will be pulled together along with the name of the agency responsible. Each regulation will be reviewed and a clearly worded summary of the continuity requirements will be developed. Where possible the regulatory agencies will be contacted for clarification on specific points. Common themes and requirements will be documented and prioritized. The project will focus on providing straight forward interpretations of what is needed for an FI to comply with current regulations. This project is sponsored by the Business Continuity SCOM, co-chaired by Tom Hirsch of US Bank, and Damian Walch of IBM. Please contact FSTC Managing Executive Charles Wallen for more information (charles.wallen(a)fstc.org) (http://fstc.org/advisory/business_continuity/) ______________ 4. Image Quality and Usability Assurance: Phase II (launched Nov 2004) http://fstc.org/projects/new.cfm#iqa2 In Phase I, more than 20 companies, representing 2/3 of US check volume, most major vendors, and key industry associations, undertook a 90-day effort to assess the impact of poor quality check images, and defined 16 technical metrics and 4 usability levels that can be used to measure image quality and usability in a standard and interoperable way. The findings of the Phase I project team justified further development, to test these metrics in a real-world scenario, on millions of images, to determine the quantitative thresholds for the 16 metrics that will define a minimum baseline "standard" for acceptable quality images for the industry. The business objectives are to maximize efficiencies, cost savings, and ensure strong adoption of image exchange. The project will undertake a robust, "real-world" analysis and test to provide actionable specifications and direction to the industry to allow financial institutions, technology vendors, standards organizations, and other key partners to collectively implement baseline image quality and usability through industry collaboration under the FSTC umbrella. This project originates from the Check Truncation SIG (http://fstc.org/advisory/check-truncation.cfm) co-chaired by James Burroughs, Wells Fargo; Glen Ulrich, US Bank; and Ian Goodall, NCR. 7 financial institutions and 18 vendors and industry organizations are participating. ______________ PROJECTS IN DEVELOPMENT: 1. Interoperable Verification of Check Security Features (IV-CSF) As a follow-on to the recently completed Survivability of Check Security Features project (http://fstc.org/projects/csf/) this initiative will seek to develop the business and technology foundation to enable interoperable verification of check security features. As a growing number of banks offer their customers security features targeted at surviving the imaging process, interoperability becomes an important enabler. The objective of this initiative, through interoperability, is to mitigate fraud risk for all stakeholders (banks, customers, merchants, etc.) by shortening the time between a check being presented, and the check verification process, and to enable any receiver of a check to verify it as close to the point of presentment as possible. This project originates from the Check Truncation SIG (http://fstc.org/advisory/check-truncation.cfm) A whiteboard session was held January 26-27 in Tempe, AZ, hosted by Bank of America and co-hosted by JPMorgan Chase. A full draft proposal will be published to the Check Truncation SIG in the coming week to ten days, reflecting the refined objectives and deliverables that were developed in Tempe. Potential project launch is in the March/April timeframe. ______________ 2. Resilience Maturity Model (RMM): Phase I A group of FSTC member institutions and vendors met at the FSTC Technology Recovery Roundtable, hosted by US Bank on October 6th in St. Paul. At the meeting, the group defined a potential project that would develop metrics to evaluate an institution's resilience, much like the Carnegie Mellon CMM model in software development. Resilience in this context is an institution's overall business continuity, disaster recovery, and crisis management program. The business objective of the project would be to allow financial institutions to "rate" themselves and their key business partners against industry-vetted definitions and metrics, and justify investment (or not) where needed to achieve the desired level of resilience. The group met again in New York on January 13th, hosted by JPMorgan Chase, and further refined the concept with 7 of the top 10 institutions in the US represented. A proposal is currently being finalized, and will be published in the next 7-10 days to the general public. More than 8 firms have already committed to participate. If you are interested, please contact Charles Wallen, Business Continuity SCOM Managing Executive, at charles.wallen(a)fstc.org. ______________ 3. Better Mutual Authentication: Phase I As a next-phase concept coming out of the Counter-Phishing: Phase I project, the initiative will focus on establishing a blueprint for the financial industry to establish better mutual authentication between customers and financial institutions. The three components of better mutual authentication include: customer to institution, institution to customer, and email communications from the institution to customer. The objective is to create a framework that supports individual institutions' efforts, while defining a "blueprint" of requirements to ensuring a level of consistency in customer experience (if affected), leveraging customer education efforts, and establishing interoperability wherever possible and prudent. An in-person, large-institution-only meeting is currently being scheduled for mid-late-March to create the charter, objectives, and deliverables for such an initiative. More information will be available in the coming weeks under the auspices of the Security Standing Committee. ## ---------------------------------------------------------------- To subscribe or unsubscribe from this elist use the subscription manager: <http://ls.fstc.org/subscriber> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

PGP Corporation Announces Release of PGP Desktop 8.0.3
by R. A. Hettinga 05 Jul '18

05 Jul '18

<http://home.businesswire.com/portal/site/google/index.jsp?ndmViewId=news_vi…> Headlines October 24, 2003 08:31 AM US Eastern Timezone PGP Corporation Announces Release of PGP Desktop 8.0.3; Support For the Latest Windows and Mac Operating Systems and Popular Email Clients PALO ALTO, Calif.--(BUSINESS WIRE)--Oct. 24, 2003--PGP Corporation, the recognized leader in secure messaging and information storage, today announced the immediate availability of PGP(R) Desktop 8.0.3. This version adds support for Microsoft Office 2003, including Outlook 2003 and Windows Server 2003; Novell GroupWise 6.5; and Mac OS X 10.3 (Panther). "Although technology changes increasingly quickly, PGP products keep pace," said Jon Callas, PGP Corporation's CTO and Chief Security Officer. "This release ensures customers continued access to the rich set of features in PGP Desktop products, including digital signatures to automatically detect email 'spoofing,' key management, and standards-based technology." The release is available free to all customers who have purchased PGP Desktop 8.0 products, including PGP Corporate Desktop, PGP Workgroup Desktop, and PGP Personal Desktop as well as earlier versions of PGP Enterprise, PGP Desktop, and PGP Personal. Licensed customers wishing to upgrade to PGP Desktop 8.0.3 may download the update from www.pgp.com . About PGP Corporation The recognized worldwide leader in secure messaging and information storage, PGP Corporation develops, markets, and supports products used by a broad installed base of enterprises, businesses, governments, individuals, and cryptography experts to secure proprietary and confidential information. During the past ten years, PGP(R) technology has built a global reputation for open and trusted security products. The PGP Corporation family of products includes PGP Universal, an automatic, self-managing network-based solution for enterprises, and individual desktop solutions. Venture funding is provided by DCM-Doll Capital Management and Venrock Associates. Contact PGP Corporation at www.pgp.com or 650-319-9000. PGP is a registered trademark and the PGP logo is a trademark of PGP Corporation. Product and brand names used in the document may be trademarks or registered trademarks of their respective owners. Any such trademarks or registered trademarks are the sole property of their respective owners. Contacts For PGP Corporation: Jump Start Communications, LLC Lori Curtis, 970-887-0044 lori(a)jumpstartcom.com Print this release Terms of Use | © Business Wire 2003 -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Re: OT: Traffic Light Control (was Re: First real-world SCADA attack in US)
by Robert E. Seastrom 05 Jul '18

05 Jul '18

Mark Radabaugh <mark(a)amplex.net> writes: > On 11/23/11 11:23 AM, Valdis.Kletnieks(a)vt.edu wrote: >> On Wed, 23 Nov 2011 11:14:34 EST, Bryan Fields said: >>> So really all a hacker needs is a pair of dykes, some electrical tape, and an >>> all black jumpsuit. >> Actually, you want a really dark blue jumpsuit. All-black creates a sillouette in >> all but the very darkest conditions. > White service truck, orange cone, jeans, heavy cotton shirt and an > orange vest in the middle of the day is far less noticeable. Don't forget the hard hat. Aluminum forms clipboard and Nextel phone complete the outfit but are optional. -r ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tahoe-dev] erasure coding makes files more fragile, not less
by Shawn Willden 05 Jul '18

05 Jul '18

On Mar 28, 2012 1:22 PM, "Eugen Leitl" <eugen(a)leitl.org> wrote: > > On Wed, Mar 28, 2012 at 09:00:56AM -0400, Shawn Willden wrote: > > > The arguments make are the basis for the approach I (successfully) pushed > > when we started the VG2 grid: We demand high uptime from individual > > Can you please tell more about the VG2 grid? I clean missed it. (Sorry I'm slow to respond -- I'm vacationing with my family and often have better things to do than read email :-) ). Volunteer Grid 2 is a Tahoe grid composed of volunteers all over the world. Learning from some problems that the first volunteer grid had, I suggested to early members that VG2 establish some clear and somewhat restrictive policies in order to ensure that the grid was useful for system backups. Two specific backup-driven requirements we had were high reliability/availability and relatively high capacity. To that end, we established a 95% nominal up time requirement and a 500 GB minimum node capacity requirement. We also avoid co-located nodes and disallow usage of more than min(storage_provided, 1 TB). The limit on usage is to avoid having one user deploy, say, 10 TB and then try to consume that much from the grid, swamping the rest of the servers. > > servers because the math of erasure coding works against you when the > > individual nodes are unreliable, and we ban co-located servers and prefer > > to minimize the number of servers owned and administered by a single person > > in order to ensure greater independence. > > > > How has that worked out? Well, it's definitely constrained the growth rate > > of the grid. We're two years in and still haven't reached 20 nodes. And > > It doesn't surprise me at all, since I've never heard a single squeak > about it in the usual channels. (And I'm moderately well-informed > in such matters). I'm surprised. It was definitely announced here when it was created, and discussed occasionally since. > > although our nodes have relatively high reliability, I'm not sure we've > > actually reached the 95% uptime target -- my node, for example, was down > > for over a month while I moved, and we recently had a couple of outages > > caused by security breaches. > > > > However, we do now have 15 solid, high-capacity, relatively available (90%, > > at least) nodes that are widely dispersed geographically (one in Russia, > > six in four countries in Europe, seven in six states in the US; not sure > > about the other). So it's pretty good -- though we do need more nodes. > > How large is the total storage capacity? What about introducer nodes, is > there just one? Total storage capacity, as reported by the stats gatherer, is around 14 TB. That's disk used (~6 TB) plus disk available (~8 TB). As near as I can tell by eyeballing the graph and summing my estimates is that consumption grows by about 40 GB per day. We have a helper but it's lightly used. Only one introducer. The node on the slowest network connection has about 1 Mbps of bandwidth, two or three nodes are on gigabit links, most are 6-50 Mbps, IIRC. Hardware is similarly varied, with the low end being a small NAS box, the high end being some fairly powerful servers in data centers, and everything in between including some virtual servers. Upload performance, as measured from my machine (which has a 50 Mbps up, 100 Mbps down connection), averages about about 300 KBps, before erasure coding, so with my settings I get around 100 KBps net upload rate. I haven't done any download tests recently, but in the past they've been approximately the same as upload speeds, but without the erasure coding penalty. -- Shawn _______________________________________________ tahoe-dev mailing list tahoe-dev(a)tahoe-lafs.org http://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[liberationtech] Bitcoin and The Public Function of Money
by Dmytri Kleiner 05 Jul '18

05 Jul '18

I want to write a bit about the public function of money, especially as compared to the market function of money, in light of some of the recent discussion about Bitcoin. Bitcoin is already a very useful technology due to the fact that it allows transactions to take place without any central authority. This alone is significant. The technology behind it is also perhaps applicable in other areas, such as the Namecoin project to replace the centralized Domain Name system. Does Bitcoin have the potential to replace Government fiat money? No. It doesn't. It only has the potential to be one commodity form within the money economy. Countless books and papers have described money, money is a very complex thing which serves many functions. Keith Hart has written about the "Two Sides of the Coin," heads on one side, tails on the other. One way to interpret this might be to contrast between the public function and the market function of money. The origin of money is tribute. The source of money is the public, in whatever form, whether empire or democracy or something else, money is spent on public expenditure and demanded back as tribute. Whatever its commodity value, whether minted on gold, printed on paper or electrified as bits in a database, this sort of money has value because it can be used to fulfill tributary obligations, for example, it can be used to pay taxes. As the entire source of this money is government spending, the amount of this money is determined by the amount we want to provide on behalf of all as a society. This is the "Heads" side. Not all economic activity is done for money. Much of it takes, and has historically taken, gift and kin-communal forms, where work and wealth is shared without specific prices for specific commodities, but rather on a basis of social trust and reciprocation. Markets emerge as economic activity extends beyond communal and neighbourly forms, markets extends the social to beyond the kin-communal, and along with such social distance come more transient relationships that can not rest on trust and reciprocation, and thus must be encompassed by spot transactions, and as a result specific prices for specific commodities and specific price relationships between commodities. With these transient relationships comes money. But this sort of money is different. Commodities can also be traded directly, even if their relative worth is counted in "Heads" money, and trade can also be done on-account, by credit. The amount of which is not limited to the physical amount of "Heads" money in circulation. In the wider economy, money is endogenous, the amount of money circulating in the economy is not a function of any monetary base, but rather is a function of the amount of things we want to make and do for each other. More specifically, the amount we want to make and do for each other for money. This is the "Tails" side. This is vertical money and horizontal money. Vertical money is created and destroyed by the public, horizontal money expands and contracts as a result of the economic activity of private individuals and their incorporated forms. Money that has a commodity base, i.e. Gold, is not completely rooted in a particular public form, since it's value can cross international borders. This is where Bitcoin, a digital specie essentially, emerges as a new and rather unique form of money. It's built-in cryptographic limits on supply make it essentially a virtual commodity form of money, fixed and "hard", like Gold, yet digital and transferable electronically across global telecommunications networks. As such, it has attractive features as both means of exchange and store of value. Yet, while it certainly is useful on the "Tails" side of money, as one of the various kinds of assets circulating in the global market economy, it does not serve public function well. There is a reason that modern public forms of money are not commodities, why modern economies use "fiat" money, money that is not based in or guaranteed by conversion to any sort of commodity. If the public restricts itself to commodity-money for public expenditure, this means that what it spends must be limited to what it taxes plus what it borrows, since commodities have a fixed available supply. And though many ignorant or simply disingenuous commentators, such as promoters of austerity, present this to be the case even now, in a modern monetary economy based upon fiat money issued by the public for public purpose, this is factually not the case. The thing about public money is that we can have as much of it as we want to have. How much we spend relative to how much we tax is a public policy choice, and the right-wing dogma that the appropriate choice is for the budget to be balanced, for taxes to be equal to spending, is universally understood to be false, even among the most celebrated right-wing economists. In his 1948 article "A Monetary and Fiscal Framework for Economic Stability", "Chicago Boys" patriarch Milton Friedman proposed a counter-cyclical policy, where government spending would be increased beyond taxation during economic downturns, similar to Abba Lerner's "Functional Finance" which is often referred to as "Keynesian" economic policy. Whatever their ideological stripes, there is little disagreement among economists that to the degree that public budgets need to be balanced, they must be balanced relative to economic cycles and sectoral balances and not merely between annual public spending and taxation. The balance between spending and taxes is simply the balance of the public "Heads" side of the coin, always in counter-balance with the private "Tails" side of the coin, as expressed by the activity of private interests in the global market. It is no secret that the national State form is unsatisfactory. Not only is it burdened by its aristocratic roots, and not only is it corrupted by the fact that its modern form is largely captured by the international corporate elite, but the State is clearly unsatisfactory for modern publics as a result of the fact that static territorial forms are increasingly ineffective and inappropriate structures to serve global, distributed communities. The public form has to evolve from the state form to the networked form, but for that to happen, new, networked public forms will need to emerge that are able to take over the socially necessary public functions. Including the management of forms of public money. The critical feature required of public money is that we can socially determine how much of it there is, and how much of we want to apply to public purpose. We need ways to create and destroy public money so that we can can have a counter-balance to private activity, to manage cycles, to counter-balance economic sectors, and to socially pursue public objectives, such as health, education, and justice. Thus, Bitcoin's innovation in terms of creating a networked form of commodity money is not useful in creating networked forms of public money, and as a result it does not create a way for networked public forms to replace the current State forms. I'll be at Stammtisch this evening at 9pm, please come if you're in Berlin, if not, R15N continues at Mal au Pixel in Paris, you can join the network by calling +33 181 97 97 11 online version is here: http://www.dmytri.info/bitcoin-and-public-money/ -- Dmytri Kleiner Venture Communist -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

National ID bill vote results and more
by Downsizer-Dispatch＠DownsizeDC.org 05 Jul '18

05 Jul '18

D o w n s i z e r - D i s p a t c h |*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*| We have two important bits of news to share with you today. One has to do with the House ID Card vote. We have the results, what they mean, and what comes next. The other has to do with a new, hip, pro-liberty radio show now broadcasting on several stations. We want you to know about them. Why? Well, the hosts are DC Downsizers and the program broadcasts our radio spots. Please read on... House approves electronic ID cards Declan McCullagh of CNET News.com reported late yesterday, "The U.S. House of Representatives approved on Thursday a sweeping set of rules aimed at forcing states to issue all adults federally approved electronic ID cards, including driver's licenses. Under the rules, federal employees would reject licenses or identity cards that don't comply, which could curb Americans' access to airplanes, trains, national parks, federal courthouses and other areas controlled by the federal government. The bill was approved by a 261-161 vote." See McCullagh's full report: http://tinyurl.com/586xq McCullagh went on to write, "Thursday's vote mostly fell along party lines. About 95 percent of the House Republicans voted for the bill, which had been prepared by the judiciary committee chairman, F. James Sensenbrenner, a Wisconsin Republican. More than three-fourths of the House Democrats opposed it." So have we lost? NO! These are exactly the same provisions we fought when the House passed HR 10 last Fall. If you recall, the Senate opposed these provisions, and they were dropped from the final bill. The fight will now return to the Senate - where we must win because the President has publicly thrown his weight behind it. The odds are decent that we can stop this bill. In the meantime, you can note how your Representative voted. Did they vote your interests? Check it out for yourself. http://clerk.house.gov/evs/2005/roll031.xml Free Talk Live & Downsize DC Free Talk Live is talk radio unlike any other. In an industry where shows are either pro-republican or pro-democrat, Free Talk Live is unabashedly pro- FREEDOM. Typical talk radio is heavy on call-screening. Some hosts are afraid of certain issues. Free Talk Live is not. The show is called Free Talk Live because listeners are Free to call in and Talk about anything from the political to the personal. You can hear it Live 6 days per week. Who is Free Talk Live? Ian & Manwich, and the other co-hosts are all hard-core DC Downsizers. Free Talk Live has only been syndicated for 2 months. So far, they're on in 4 markets. The complete list is here: http://freetalklive.com/affiliates.php Free Talk Live has been running Downsize DC's radio spots for a long time now - since the days when they were just a local show in Tampa Bay. These days, Downsize DC spots run as "fill" on the show. That means if that if they have unsold inventory, the spots run at least once per hour. Currently, most of the inventory is unsold, and Downsize DC is getting at least 17 airings per week. Imagine the exposure Downsize DC would get if Free Talk Live were on in 20, 50, or 100 markets! It will happen eventually, but it will happen sooner if you would do the following: Help get the show on in your market. This whole process only takes a couple of minutes. 1. Go to http://radio-locator.com. Type in your city and state, and find all the "News/Talk" and "Talk" stations in your area. 2. Call each one, and ask to speak with the Program Director. Tell him that you want to hear Free Talk Live 6 nights (or days depending on your time zone) per week! 3. While you're at it, ask him or her to add Harry Browne on Saturday nights as well. Both shows are broadcast on the Genesis Communications Network (gcnlive.com) And Harry Browne also plays the Downsize DC radio spots. For Liberty, Jim Babka President DownsizeDC.org, Inc. |*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*|*| D o w n s i z e r - D i s p a t c h is the official email list of http://www.DownsizeDC.org. CONTRIBUTE to this project at http://www.downsizedc.org/contribute.shtml http://www.DownsizeDC.org is sponsored by DownsizeDC.org, Inc. -- a non-profit educational organization promoting the ideas of individual liberty, personal responsibility, free markets, and small government. VISIT the Foundation's web site at http://www.DownsizeDC.org UNSUBSCRIBE from this list by sending a text only (no HTML) email to distribution-request(a)DownsizeDC.org with the word unsubscribe on the first line of the body of the message. Please leave the rest of the message blank. SUBSCRIBE to this list by sending a text only (no HTML) email to distribution-request(a)DownsizeDC.org with the word subscribe on the first line of the body of the message. Please leave the rest of the message blank. CHANGE your subscription address by subscribing your new address and unsubscribing your old address. You are encouraged to forward this message to friends and business associates, and permission is hereby granted to reproduce any items herein as long as attribution is provided for articles and the subscription instructions above are included. --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0