July 2018 - cypherpunks-legacy

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

Lynn.Wheeler(a)firstdata.com wrote: > > actually ... not really ... this was discussed early this summer as to what they > actually check ... and how trivial it is to fabricate necessary details to pass > such checking > > random ref: > > http://www.garlic.com/~lynn/aadsmore.htm#client3 > > in general it is sufficient to have registered any DBA name & have a d&b entry > plus some misc. other stuff ... all relatively easy to establish. Since the DBA > name & d&b entry aren't cross-checked as part of the SSL certificate validation > ... just the domain name in the certificate against the domain name used ... you > could be really surprised at what comes up for DBA names. > > I've had credit card statements that listed the DBA names which had absolutely > no relationship to the name of the store I had been to ... which i eventually > had to call both the credit card company/bank and the store to figure out what > was going on. This is not a comment on the crapness of PKI, it is a comment on the crapness of Verisign. The two are far from synonymous. Don't get me wrong - I don't think PKI is a perfect solution by any means - however, it gets us nowhere to attribute the faults of others to PKI. Cheers, Ben. -- http://www.apache-ssl.org/ben.html "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

Lynn.Wheeler(a)firstdata.com wrote: > > actually ... not really ... this was discussed early this summer as to what they > actually check ... and how trivial it is to fabricate necessary details to pass > such checking > > random ref: > > http://www.garlic.com/~lynn/aadsmore.htm#client3 > > in general it is sufficient to have registered any DBA name & have a d&b entry > plus some misc. other stuff ... all relatively easy to establish. Since the DBA > name & d&b entry aren't cross-checked as part of the SSL certificate validation > ... just the domain name in the certificate against the domain name used ... you > could be really surprised at what comes up for DBA names. > > I've had credit card statements that listed the DBA names which had absolutely > no relationship to the name of the store I had been to ... which i eventually > had to call both the credit card company/bank and the store to figure out what > was going on. This is not a comment on the crapness of PKI, it is a comment on the crapness of Verisign. The two are far from synonymous. Don't get me wrong - I don't think PKI is a perfect solution by any means - however, it gets us nowhere to attribute the faults of others to PKI. Cheers, Ben. -- http://www.apache-ssl.org/ben.html "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

Lynn.Wheeler(a)firstdata.com wrote: > > actually ... not really ... this was discussed early this summer as to what they > actually check ... and how trivial it is to fabricate necessary details to pass > such checking > > random ref: > > http://www.garlic.com/~lynn/aadsmore.htm#client3 > > in general it is sufficient to have registered any DBA name & have a d&b entry > plus some misc. other stuff ... all relatively easy to establish. Since the DBA > name & d&b entry aren't cross-checked as part of the SSL certificate validation > ... just the domain name in the certificate against the domain name used ... you > could be really surprised at what comes up for DBA names. > > I've had credit card statements that listed the DBA names which had absolutely > no relationship to the name of the store I had been to ... which i eventually > had to call both the credit card company/bank and the store to figure out what > was going on. This is not a comment on the crapness of PKI, it is a comment on the crapness of Verisign. The two are far from synonymous. Don't get me wrong - I don't think PKI is a perfect solution by any means - however, it gets us nowhere to attribute the faults of others to PKI. Cheers, Ben. -- http://www.apache-ssl.org/ben.html "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff

1 0

Obama's secure PDA
by Ivan KrstiD 06 Jul '18

06 Jul '18

As I'm sure many of you've heard by now, after some initial hesitation due to legal requirements regarding the preservation of presidential records, Mr. Obama has been allowed to continue using a wireless e- mail device after assuming the presidency. There are still conflicting reports about whether the hardware is an altered RIM BlackBerry or a different device, though the most likely contender for the latter option appears to be the General Dynamics SectC)ra Edge, which features a "trusted [secondary] display" and two buttons used to switch between classified and unclassified operation. Some details from Declan McCullagh: <http://news.cnet.com/obamas-new-blackberry-the-nsas-secure-pda/> Manufacturer site and (not very detailed) specs: <http://www.gdc4s.com/content/detail.cfm?item=32640fd9-0213-4330-a742-551 06fbaff32 > I know next to nothing about the state of the art of secure cell devices; do list members have any (public) knowledge or informed speculation about the mechanism behind the unclassified/classified switches? Are we talking two entire separate CPUs with a mutex-shared screen/keyboard? Or just offload of classified processing to a separate on-chip security domain (ala ARM TrustZone)? Similarly, the manufacturer lists separate class/unclass memory chips and separate class/unclass USB ports. Are these sitting on two physically separate buses? Finally, any idea why the SectC)ra is certified up to Top Secret for voice but only up to Secret for e-mail? (That is, what are the differing requirements?) Cheers, -- Ivan KrstiD <krstic(a)solarsail.hcs.harvard.edu> | http://radian.org --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Re: [silk] Everyone's surveilling
by shiv sastry 06 Jul '18

06 Jul '18

The link I quoted from was carefully selected of course. The ONLY crime whose likelihood is reduced by security cameras is said to be shoplifting. Regarding spying and surveillance, the more you spy, the greater the amount of resources you need to analyse the recorded data. In the absence of that you are recording trash that is good only for framing people who may have done nothing. The Indian nuclear tests in 1998 were done under 24 hour surveillance by US satellites. But they didn't nail anyone. But such inconvenient facts don't prevent anyone from surveilling more and more and more. As a result I believe that it is important to behave like one is being watched, reserving really private stuff to periods which you can document as being really private, or private enough for you to be comfortable. But that is all the freedom one has really. All "freedom" must be found within these constraints. A senior of mine, a Professor of Internal Medicine wrote a book called "Trick or Treat" which has nothing to do with surveillance, but he describes some of the less desirable side effects of overinvestigation in medicine - using all the high tech tools available. Often, such an overinvestigated person is discovered to have a previously undiscovered and completely unrelated symptomless condition that may not even require treatment. But its accidental discovery leads to anxiety, further investigation and, sometimes, even needless treatment. Surveillance for disease has become commonplace in many countries in the world. Surveillance for diabetes, heart disease, bone disease, dental disease, breast cancer, cancer of the cervix, colon cancer, and cancer of the stomach are "routine" in some part of the world or the other. While these tests are often a matter of choice, and one can refuse, I know of instances in which a person who fails to submit to surveillance but later develops a disease that could have been detected earlier is "punished" because his insurance will not cover him for not having cooperated earlier. Medical records of course serve as a permanent record that can pin you down and make you a crime suspect depending on how national laws choose to use the information. A national genetic database that is open for police to look at can always be compared with genetic samples from cells found on cigarette butts, or other sources at the scene of a crime. If you happened to be there - you join the list of suspects. shiv On Friday 21 Sep 2007 1:57 pm, Binand Sethumadhavan wrote: > On 12/09/2007, shiv sastry <cybersurg(a)gmail.com> wrote: > > On Tuesday 11 Sep 2007 11:03 pm, ashok _ wrote: > > > do you have any statistics to this effect... that cameras have reduced > > > or prevented crime ? > > > > Yes > > > > http://www.thefoucauldian.co.uk/bb.htm > > "The statistics show that video surveillance can improve security. With > > 90 % of banks now fitted with cameras, 50 % of robbers are identified and > > arrested within two years. Thanks to video surveillance in the Paris > > metro, 83 % of incidents are now detected, and arrests have risen by 36 > > %. The use of this technology in department stores has reduced > > shoplifting by two thirds. " > > On the other hand, see this article (from slashdot): > > http://www.thisislondon.co.uk/news/article-23412867-details/Tens+of+thousan >ds+of+CCTV+cameras%2C+yet+80%25+of+crime+unsolved/article.do > > (or http://tinyurl.com/2n6zrz) > > "A comparison of the number of cameras in each London borough with the > proportion of crimes solved there found that police are no more likely > to catch offenders in areas with hundreds of cameras than in those > with hardly any". > > Binand ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Obama's secure PDA
by Ivan KrstiD 06 Jul '18

06 Jul '18

As I'm sure many of you've heard by now, after some initial hesitation due to legal requirements regarding the preservation of presidential records, Mr. Obama has been allowed to continue using a wireless e- mail device after assuming the presidency. There are still conflicting reports about whether the hardware is an altered RIM BlackBerry or a different device, though the most likely contender for the latter option appears to be the General Dynamics SectC)ra Edge, which features a "trusted [secondary] display" and two buttons used to switch between classified and unclassified operation. Some details from Declan McCullagh: <http://news.cnet.com/obamas-new-blackberry-the-nsas-secure-pda/> Manufacturer site and (not very detailed) specs: <http://www.gdc4s.com/content/detail.cfm?item=32640fd9-0213-4330-a742-551 06fbaff32 > I know next to nothing about the state of the art of secure cell devices; do list members have any (public) knowledge or informed speculation about the mechanism behind the unclassified/classified switches? Are we talking two entire separate CPUs with a mutex-shared screen/keyboard? Or just offload of classified processing to a separate on-chip security domain (ala ARM TrustZone)? Similarly, the manufacturer lists separate class/unclass memory chips and separate class/unclass USB ports. Are these sitting on two physically separate buses? Finally, any idea why the SectC)ra is certified up to Top Secret for voice but only up to Secret for e-mail? (That is, what are the differing requirements?) Cheers, -- Ivan KrstiD <krstic(a)solarsail.hcs.harvard.edu> | http://radian.org --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

[tor-talk] German police keylogger analysis (and the effects on Tor are....?)
by William Wrightman 06 Jul '18

06 Jul '18

Here is an article which details the German federal police's use of keyloggers. http://www.wired.com/threatlevel/2011/10/german-gov-spyware/ There are also links to Wired's coverage of the FBIs keylogger which are well worth a read. Keyloggers would, I assume, defeat the whole purpose of Tor since the URL would be recorded and sent to the fedz. How to overcome? My impression is that no-one is sending .exe attachments these days but rather exploiting unpatched browsers by tricking people to visiting a site (although of course they can always install it manually). I suppose that up-to-date anti-virus and anti-malware might help if you are on Windows. And, of course, using NoScript and blocking Flash and suchlike. What would be the situation if you are using Linux (such as Ubuntu for example). I realise that keyloggers must exist for Linux but would they be more difficult to install? Is moving to Linux one solution? _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

Lynn.Wheeler(a)firstdata.com wrote: > > actually ... not really ... this was discussed early this summer as to what they > actually check ... and how trivial it is to fabricate necessary details to pass > such checking > > random ref: > > http://www.garlic.com/~lynn/aadsmore.htm#client3 > > in general it is sufficient to have registered any DBA name & have a d&b entry > plus some misc. other stuff ... all relatively easy to establish. Since the DBA > name & d&b entry aren't cross-checked as part of the SSL certificate validation > ... just the domain name in the certificate against the domain name used ... you > could be really surprised at what comes up for DBA names. > > I've had credit card statements that listed the DBA names which had absolutely > no relationship to the name of the store I had been to ... which i eventually > had to call both the credit card company/bank and the store to figure out what > was going on. This is not a comment on the crapness of PKI, it is a comment on the crapness of Verisign. The two are far from synonymous. Don't get me wrong - I don't think PKI is a perfect solution by any means - however, it gets us nowhere to attribute the faults of others to PKI. Cheers, Ben. -- http://www.apache-ssl.org/ben.html "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff

1 0

Re: [silk] Everyone's surveilling
by shiv sastry 06 Jul '18

06 Jul '18

The link I quoted from was carefully selected of course. The ONLY crime whose likelihood is reduced by security cameras is said to be shoplifting. Regarding spying and surveillance, the more you spy, the greater the amount of resources you need to analyse the recorded data. In the absence of that you are recording trash that is good only for framing people who may have done nothing. The Indian nuclear tests in 1998 were done under 24 hour surveillance by US satellites. But they didn't nail anyone. But such inconvenient facts don't prevent anyone from surveilling more and more and more. As a result I believe that it is important to behave like one is being watched, reserving really private stuff to periods which you can document as being really private, or private enough for you to be comfortable. But that is all the freedom one has really. All "freedom" must be found within these constraints. A senior of mine, a Professor of Internal Medicine wrote a book called "Trick or Treat" which has nothing to do with surveillance, but he describes some of the less desirable side effects of overinvestigation in medicine - using all the high tech tools available. Often, such an overinvestigated person is discovered to have a previously undiscovered and completely unrelated symptomless condition that may not even require treatment. But its accidental discovery leads to anxiety, further investigation and, sometimes, even needless treatment. Surveillance for disease has become commonplace in many countries in the world. Surveillance for diabetes, heart disease, bone disease, dental disease, breast cancer, cancer of the cervix, colon cancer, and cancer of the stomach are "routine" in some part of the world or the other. While these tests are often a matter of choice, and one can refuse, I know of instances in which a person who fails to submit to surveillance but later develops a disease that could have been detected earlier is "punished" because his insurance will not cover him for not having cooperated earlier. Medical records of course serve as a permanent record that can pin you down and make you a crime suspect depending on how national laws choose to use the information. A national genetic database that is open for police to look at can always be compared with genetic samples from cells found on cigarette butts, or other sources at the scene of a crime. If you happened to be there - you join the list of suspects. shiv On Friday 21 Sep 2007 1:57 pm, Binand Sethumadhavan wrote: > On 12/09/2007, shiv sastry <cybersurg(a)gmail.com> wrote: > > On Tuesday 11 Sep 2007 11:03 pm, ashok _ wrote: > > > do you have any statistics to this effect... that cameras have reduced > > > or prevented crime ? > > > > Yes > > > > http://www.thefoucauldian.co.uk/bb.htm > > "The statistics show that video surveillance can improve security. With > > 90 % of banks now fitted with cameras, 50 % of robbers are identified and > > arrested within two years. Thanks to video surveillance in the Paris > > metro, 83 % of incidents are now detected, and arrests have risen by 36 > > %. The use of this technology in department stores has reduced > > shoplifting by two thirds. " > > On the other hand, see this article (from slashdot): > > http://www.thisislondon.co.uk/news/article-23412867-details/Tens+of+thousan >ds+of+CCTV+cameras%2C+yet+80%25+of+crime+unsolved/article.do > > (or http://tinyurl.com/2n6zrz) > > "A comparison of the number of cameras in each London borough with the > proportion of crimes solved there found that police are no more likely > to catch offenders in areas with hundreds of cameras than in those > with hardly any". > > Binand ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-talk] German police keylogger analysis (and the effects on Tor are....?)
by William Wrightman 06 Jul '18

06 Jul '18

Here is an article which details the German federal police's use of keyloggers. http://www.wired.com/threatlevel/2011/10/german-gov-spyware/ There are also links to Wired's coverage of the FBIs keylogger which are well worth a read. Keyloggers would, I assume, defeat the whole purpose of Tor since the URL would be recorded and sent to the fedz. How to overcome? My impression is that no-one is sending .exe attachments these days but rather exploiting unpatched browsers by tricking people to visiting a site (although of course they can always install it manually). I suppose that up-to-date anti-virus and anti-malware might help if you are on Windows. And, of course, using NoScript and blocking Flash and suchlike. What would be the situation if you are using Linux (such as Ubuntu for example). I realise that keyloggers must exist for Linux but would they be more difficult to install? Is moving to Linux one solution? _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0