July 2018 - cypherpunks-legacy

[Zero-Knowledge Press Release] Royal Bank To Test Zero-Knowledge
by Dov Smith 06 Jul '18

06 Jul '18

Systems' Internet Privacy & Sec urity Tools For Home Use Date: Wed, 15 Aug 2001 15:05:49 -0400 Sender: owner-zks-press(a)zeroknowledge.com Reply-To: press(a)zeroknowledge.com ================================================================== Zero-Knowledge Systems Press Release, http://www.zeroknowledge.com ================================================================== FOR IMMEDIATE RELEASE ROYAL BANK TO TEST ZERO-KNOWLEDGE SYSTEMS' INTERNET PRIVACY AND SECURITY TOOLS FOR HOME USE -Select Royal Bank customers to receive Zero-Knowledge Systems' Freedom Privacy & Security Tools- Montreal, Quebec- August 15, 2001-Zero-Knowledge Systems today announced that Royal Bank will begin a six-month pilot program in the fall offering selected customers the opportunity to try privacy and security tools for personal use with their computers at home. The award-winning Freedom software will allow users to secure different aspects of their Internet experience, such as alerting them of unauthorized attempts to connect to their personal computer, simplifying registrations when shopping online, preventing activity-tracking "cookies" from being stored on their computer, and sending personal information only when it's the consumer's choice. "We've designed tools that average consumers can use in their own homes, to give them greater control over how they share their personal information when they do business, surf, or shop on the Internet," said Hamnett Hill, Executive Vice President at Zero-Knowledge Systems. "Companies like Royal Bank have robust privacy and security measures in place for their web-based financial services. Our privacy tools give consumers added confidence when they enter the open marketplace of the Internet." Zero-Knowledge, which has been providing security and privacy enabling technologies and services for the past two years, is partnering with OEMs (Original Equipment Manufacturers), ISPs (Internet Service Providers) and now financial institutions like Royal Bank to make their privacy and security tools available for distribution to customers. "We're pleased to make our privacy and security tools available through organizations that want to help increase their customers' positive experiences online," Hill added. "Our clients have come to trust the privacy and security of their information with Royal Bank when doing their banking online. We want to bring tools that offer privacy and security to other parts of their online experiences," said Peter Cullen, Corporate Privacy Officer at Royal Bank. As part of a direct mailing in the fall, Royal Bank will offer Zero-Knowledge's Freedom Privacy & Security Tools for free to selected current and potential online banking customers. Based on customer feedback, Royal Bank will consider offering the tools to all its customers next spring 2002. Cullen added: "People want more choice and control over what they reveal about themselves online. Royal Bank continues to work on many fronts to help customers feel more comfortable using new technology for their everyday needs, such as shopping and banking online. The easy-to-use tools developed by Zero-Knowledge put additional control over privacy and security in the hands of the consumer." About Zero-Knowledge Systems, Inc. Zero-Knowledge Systems (www.zeroknowledge.com) is a provider of security and privacy software and services. Zero-Knowledge equips Global 2000 organizations with the software and expertise to manage the security and privacy of corporate and customer information assets, build brand around consumer trust, and lower the cost of complying with global privacy regulations and industry standards. Headquartered in Montreal with offices in Redwood City, California, the company's suite of products includes the Privacy Rights Management Center for secure and private management of customer and corporate data within organizations; the Zero-Knowledge Gateway for secure and private corporate Internet activities and communications; and the Freedom Privacy & Security Tools for personal privacy and security online. Journalists can visit the online pressroom at www.zeroknowledge.com/media. About Royal Bank Royal Bank of Canada (RY) is a diversified financial services company. It provides personal and commercial banking, wealth management services, insurance, corporate and investment banking, and transaction processing on a global basis. The company employs more than 57,000 people who serve more than 10 million personal, business and public sector customers in North America and in some 30 countries around the world. For more information, please visit www.royalbank.com. (Freedom(r) and Zero-Knowledge(r) are trademarks of Zero-Knowledge Systems, Inc. These trademarks may be registered in certain jurisdictions. All other trademarks are sole property of their respective owners.) For further information, please contact: Dov Smith Zero-Knowledge Systems 514.350.7553 dov(a)zeroknowledge.com Sara Best Royal Bank Media Relations 416.974.2124 ________________________________ Dov Smith Director of Public Relations Zero-Knowledge Systems, Inc. T 514.350.7553 F 514.286.2755 mailto:dov@zeroknowledge.com www.zeroknowledge.com/media ________________________________ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

I would like to get further information as to why you don't think revocation does not work? I'll admit that in the case of the revocation of Sun's certificates, it was very apparent that the notification process was weak. The other piece, the browser checking of expired/revoked certificates is non-existent but if you properly set up your application, it "should" check the revocation status of both the CA certificate and the subscriber's certificate. Your thoughts? Bram Cohen wrote: > On Wed, 22 Nov 2000 Lynn.Wheeler(a)firstdata.com wrote: > > > the other scenerio that some certification agencies have expressed (i.e. > > licensing bureaus, bbb, consumer report, etc operations) is that in the online > > world ... that they would provide an online service .... rather than > > certificates designed for an offline world. > > Yes, it seems fairly well established that revocations just plain don't > work. > > Once again, the solution to the problems of offline operation appears to > be online operation. > > -Bram Cohen > > For help on using this list (especially unsubscribing), send a message to > "dcsb-request(a)reservoir.com" with one line of text: "help".

1 0

AOL Releases Search Logs from 500,000 Users
by Seth Finkelstein 06 Jul '18

06 Jul '18

AOL Releases Search Logs from 500,000 Users [1]Adam D'Angelo - 8/5/2006 AOL just released the logs of all searches done by 500,000 of their users over the course of three months earlier this year. That means that if you happened to be randomly chosen as one of these users, everything you searched for from March to May (2006) is now public information on the internet. This was not a leak - it was intentional. In their desperation to gain recognition from the research community, AOL decided they would compromise their integrity to provide a data set that might become often-cited in research papers: "Please reference the following publication when using this collection..." is the message before the download. This is a blatant violation of users' privacy. The data is "anonymized", which to AOL means that each screenname was replaced with a unique number. "It is still a research question how much information needs to be anonymized to protect users," [9]says Abdur from AOL. Here are some examples of what you can find in the data: User 491577 searches for "florida cna pca lakeland tampa", "emt school training florida", "low calorie meals", "infant seat", and "fisher price roller blades". Among user 39509's hundreds of searches are: "ford 352", "oklahoma disciplined pastors", "oklahoma disciplined doctors", "home loans", and some other personally identifying and illegal stuff I'm going to leave out of here. Among user 545605's searches are "shore hills park mays landing nj", "frank william sindoni md", "ceramic ashtrays", "transfer money to china", and "capital gains on sale of house". Compared to some of the data, these examples are on the safe side. I'm leaving out the worst of it - searches for names of specific people, addresses, telephone numbers, illegal drugs, and more. There is no question that law enforcement, employers, or friends could figure out who some of these people are. I hope others can find more examples in the data, which is up for [10]download over here. The data set is very large when uncompressed which makes it pretty hard to work with, but someone should set up a web interface so people can browse it (or even 10% of it) without having to download the 400mb file. If you make a mirror or better interface to the data, or find other examples, let me know and I'll put a link up here. This is the same data that the DOJ wanted from Google back in March. [11]This ruling allowed Google to keep all query logs secret. Now any government can just go download the data from AOL. It's unclear if this is the type of data AOL released to the government [12]back when Google refused to comply. If nothing else, this should be a good example of why search history needs strong privacy protection. Thanks to Greg Linden for pointing this out [13]here. Update 2: The md5 of the file AOL posted (and now removed) is 31cd27ce12c3a3f2df62a38050ce4c0a. I'm posting it so you can make sure you have a valid copy, but so far none of the copies I've seen are fake. Update: Seems like AOL took it down. There are some mirrors of the data in the comments of the digg story, linked below. I estimate about 1000 people have the file, so it's definitely going to be circulated around. The [2]main AOL research page is still up, with some other data collections. The [3]google cache of the download page is still up, but you can't get the data. Here's discussion at other sites: * [4]siliconbeat * [5]techcrunch * [6]digg * [7]reddit * [8]zoli's blog References 1. http://www.ugcs.caltech.edu/~dangelo/ 2. http://research.aol.com/pmwiki/pmwiki.php?n=Main.Home 3. http://72.14.207.104/search?q=cache:2Qvd2z9VbuIJ:research.aol.com/ pmwiki/pmwiki.php%3Fn%3DResearch.500kUserQueriesSampledOver3Months +&hl=en&gl=us&ct=clnk&cd=1 4. http://www.siliconbeat.com/entries/2006/08/06/ aol_research_exposes_data_weve_got_a_little_sick_feeling.html 5. http://www.techcrunch.com/2006/08/06/aol-proudly-releases-massive- amounts-of-user-search-data/ 6. http://digg.com/tech_news/AOL_Releases_Search_Logs_from_500_000_Users 7. http://reddit.com/info/cfvt/comments 8. http://www.zoliblog.com/blog/_archives/2006/8/6/2204969.html 9. http://research.aol.com/pmwiki/pmwiki.php?n=Research. 500kUserQueriesSampledOver3Months 10. http://research.aol.com/pmwiki/pmwiki.php?n=Research. 500kUserQueriesSampledOver3Months 11. http://googleblog.blogspot.com/2006/03/judge-tells-doj-no-on- search-queries.html 12. http://www.boingboing.net/2006/01/20/aol_we_did_not_compl.html 13. http://glinden.blogspot.com/2006/08/chance-to-play-with-big- data.html -- Seth Finkelstein Consulting Programmer http://sethf.com Infothought blog - http://sethf.com/infothought/blog/ Interview: http://sethf.com/essays/major/greplaw-interview.php ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] AOL Releases Search Logs from 500,000 Users
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[cryptography] bitcoin scalability to high transaction rates
by Sampo Syreeni 06 Jul '18

06 Jul '18

Since I've been forced to take yet another look into BitCoin and algorithmic (high frequency) trading within a short timespan, I began to wonder how they would work together. What precisely would happen to BitCoin if we had tens to tens of thousands of high frequency traders (thousands of transactions per second per trader) within the network? I haven't been able to come up with any substantive claim about what that would lead to, but it at least seems possible that we could hit some limits within the distributed log algorithm which could lead to significant economies of scale in producing new blocks. Even if we actively sparsify the history -- simply knowing about what to start the process with could be bandwidth heavy, and keeping up with all of the eventually false block chains given that bandwidth could necessitate very high end hardware with an unusual, mainframe-kind I/O-cycles balance. If that were to happen, it could centralize the verification activity to a degree that is amenable to takeover, for simple economic reasons. Alternatively, the distributed algorithm could simply become choked to a degree via bandwidth constraints (not processing cycles) that would lead to enough time inconsistency within the cloud to make it almost impossible for it "to prune the bush into a stalk". Do you think something like this could happen? Is it a viable failure scenario? I fear this especially because the incentive payment for block creation isn't in any way divisible between those who tried, which means that winner takes all, and so that with very high rates of transactions, only highly centralized and massive scale processing plants can expect to reap a benefit from block processing which is statistically within usual financial timescales. (That is, the reward from contributing processing power to the system isn't divisible, unlike BTC's themselves. I can't for example run a low power mining operation and expect to get .000001 BTC in a reasonable time, whereas somebody with more power statistically will have it in a shorter time. That's a clear benefit to scale, because people do not have infinite liquidity, and aren't risk neutral.) (And yeah, this is mostly about economics still. But since BitCoin is a cryptographic protocol, this stuff speaks to the threat model and the incentive design which is integral to why the protocol is designed the way it is. Thus, also to now the protocol should be developed to reincentivize better.) -- Sampo Syreeni, aka decoy - decoy(a)iki.fi, http://decoy.iki.fi/front +358-50-5756111, 025E D175 ABE5 027C 9494 EEB0 E090 8BA9 0509 85C2 _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [IP] Cold Boot Attacks on Disk Encryption
by Declan McCullagh 06 Jul '18

06 Jul '18

Dave, The paper published today makes some pretty strong claims about the vulnerabilities of Microsoft's BitLocker, Apple's FileVault, TrueCrypt, Linux's dm-crypt subsystem, and similar products. So I put the folks behind it to a test. I gave them my MacBook laptop with FileVault turned on, powered up, encrypted swap enabled, and the screen saver locked. They were in fact able to extract the 128-bit AES key; I've put screen snapshots of their FileVault bypass process here: http://www.news.com/2300-1029_3-6230933-1.html And my article with responses from Microsoft, Apple, and PGP is here: http://www.news.com/8301-13578_3-9876060-38.html Bottom line? This is a very nicely done attack. It's going to make us rethink how we handle laptops in sleep mode and servers that use encrypted filesystems (a mail server, for instance). - -Declan Jacob Appelbaum wrote: > With all of the discussions that take place daily about laptop > seizures, > data breech laws and how crypto can often come to the rescue, I > thought > the readers of IP might be interested in a research project that was > released today. We've been working on this for quite some time and are > quite proud of the results. > Ed Felten wrote about it on Freedom To Tinker this morning: > http://www.freedom-to-tinker.com/?p=1257 - ------------------------------------------- Archives: http://www.listbox.com/member/archive/247/=now RSS Feed: http://www.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ---------- --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

wrt Cold Boot Attacks on Disk Encryption
by ' =JeffH ' 06 Jul '18

06 Jul '18

1 0

[IP] Cold Boot Attacks on Disk Encryption -- report on
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [IP] Cold Boot Attacks on Disk Encryption
by Declan McCullagh 06 Jul '18

06 Jul '18

Dave, The paper published today makes some pretty strong claims about the vulnerabilities of Microsoft's BitLocker, Apple's FileVault, TrueCrypt, Linux's dm-crypt subsystem, and similar products. So I put the folks behind it to a test. I gave them my MacBook laptop with FileVault turned on, powered up, encrypted swap enabled, and the screen saver locked. They were in fact able to extract the 128-bit AES key; I've put screen snapshots of their FileVault bypass process here: http://www.news.com/2300-1029_3-6230933-1.html And my article with responses from Microsoft, Apple, and PGP is here: http://www.news.com/8301-13578_3-9876060-38.html Bottom line? This is a very nicely done attack. It's going to make us rethink how we handle laptops in sleep mode and servers that use encrypted filesystems (a mail server, for instance). - -Declan Jacob Appelbaum wrote: > With all of the discussions that take place daily about laptop > seizures, > data breech laws and how crypto can often come to the rescue, I > thought > the readers of IP might be interested in a research project that was > released today. We've been working on this for quite some time and are > quite proud of the results. > Ed Felten wrote about it on Freedom To Tinker this morning: > http://www.freedom-to-tinker.com/?p=1257 - ------------------------------------------- Archives: http://www.listbox.com/member/archive/247/=now RSS Feed: http://www.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ---------- --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

wrt Cold Boot Attacks on Disk Encryption
by ' =JeffH ' 06 Jul '18

06 Jul '18

1 0