July 2018 - cypherpunks-legacy

Re: Financial identity is *dangerous*? (was re: Fake companies, real money)
by John Kelsey 06 Jul '18

06 Jul '18

>From: Chris Kuethe <chris.kuethe(a)gmail.com> >Sent: Oct 13, 2004 1:15 PM >To: "James A. Donald" <jamesd(a)echeque.com> >Cc: cryptography(a)metzdowd.com, > "cypherpunks(a)al-qaeda.net" <cypherpunks(a)al-qaeda.net> >Subject: Re: Financial identity is *dangerous*? (was re: Fake companies, >real money) On Wed, 13 Oct 2004 09:27:20 -0700, James A. Donald <jamesd(a)echeque.com> wrote: > Two problems: ... >> It is clear that the world needs a fully cashlike form of >> internet money, that there is real demand for this, but the low >> security of personal computers makes it insecure from thieves, >> and the hostility of national governments make it insecure from >> governments. >Agreed. I would hope that users of "iCash" get fully educated on what >that entails: that that blob of bits is just as much $20 as that green >piece of paper or that big pile of quarters. And if someone gets it >and spends it, you may as well have been mugged. Okay, but there's a problem: If you want to mug me personally, you have to show up where I am, catch me unaware, take some personal risk that I'll fight back or shoot you or something, or that a cop will happen by at an inopportune moment, or that there's some surveilance camera you don't know about catching the whole thing on tape. At the end of that, you've done one mugging, and made maybe $100 or so. This is why mugging, armed robbery, etc., is basically a crime for people who don't think too far ahead. If you want to steal anonymous bearer assets from networked computers, you're going to contrive to do a whole lot of it at once, and you're going to have enormous incentives to develop new attacks to do so. I have to care about attackers everywhere on Earth, and about the most capable getting past my defenses. It's not like trying to keep random bored teenagers from breaking into your house by putting a proper lock on a properly installed door, it's like trying to keep a team of ex-SEALs, safecrackers, locksmiths, and demolition experts from breaking into your house. Today, most of what I'm trying to defend myself from online is done as either a kind of hobby (most viruses), or as fairly low-end scams that probably net the criminals reasonable amounts of money, but probably don't make them rich. Imagine a world where there are a few hundred million dollars in untraceable assets waiting to be stolen, but only on Windows XP boxes with the latest patches, firewalls and scanners installed, and reasonable security settings. IMO, that's a world where every day is day zero. All bugs are shallow, given enough qualified eyeballs, and with that kind of money on the table, there would be plenty of eyeballs looking. And once it's done, several thousand early adopters are out thousands of dollars each. This isn't much of an advertisement for the payment system. It's anonymous and based on bearer instruments, so there's no way to run the fraudulent transactions back. The money's gone, and the attackers are richer, and the next, more demanding round of attacks has been capitalized. >People do eventually learn when it costs them something out of pocket. >Now that they've learned that the white headphones mean "I'm a target >with an iPod, mug me!" I see a lot of iPod users with boring old sony >or koss headphones. Right now, insecurity doesn't cost the end-user >enough. As soon as some virus comes along and wipes out some new york >times columnist's savings, and he screams about it, then and only then >will the slightest nonzero percentage of the sheeple pay attention for >a bit. They also have to be able to do something about it. What would you tell a reasonably bright computer programmer with no particular expertise in security about how to keep a bearer asset as valuable as his car stored securely on a networked computer? If you can't give him an answer that will really work in a world where these bearer assets are common, you're just not going to get a widespread bearer payment system working, for the same reason that there's probably nobody jogging with an iPod through random the streets of Sadr City, no matter how careful they're being. ... --John Kelsey --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Certicom Earns FIPS 140-2 Validation on Palm OS
by R. A. Hettinga 06 Jul '18

06 Jul '18

<http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=SVBIZINK3.story&STORY=/ww…> Nov. 12, 2003 Silicon Valley Biz Ink :: The voice of the valley economy Certicom Earns FIPS 140-2 Validation on Palm OS < back Security Builder GSE enables developers to quickly add a FIPS 140-2 validated cryptographic module to their government solutions MISSISSAUGA, ON, Nov. 12 /PRNewswire-FirstCall/ - Certicom Corp. (TSX: CIC), a leading provider of wireless security solutions, today announced that Security Builder(R) GSE(TM), Certicom's core developer toolkit for government, has earned the Federal Information Processing Standards (FIPS) 140-2 certification for the Palm OS 4.1 platform (certificate No. 351). This makes Security Builder GSE the first developer toolkit to provide a FIPS 140-2 validated module for multiple handheld operating systems. In June, Certicom announced FIPS 140-2 validation on Microsoft Windows and Microsoft Windows CE operating systems. By supporting multiple platforms, Security Builder GSE allows system integrators and original equipment manufacturers to use a common API to quickly and easily embed FIPS validated security into their devices and applications. Security Builder GSE is the core cryptographic module for all Certicom security applications which means movianVPN(TM) GSE for Palm and movianCrypt(TM) GSE for Palm also meet government security requirements. These products are particularly important to government agencies that need to securely extend their networks to wireless handhelds but are required to use only FIPS 140-2 validated applications. FIPS is considered a benchmark for security within U.S. and Canadian government departments and agencies and is becoming a de facto standard internationally. Products must undergo rigorous testing by an accredited independent lab to satisfy the governments' standards. FIPS 140-2 is awarded through the National Institute of Standards and Testing (NIST) and the Canadian Communication Security Establishment (CSE). "We're extremely pleased Certicom has received FIPS 140-2 validation on the Palm platform. This will now make it easier for government workers to better integrate their Palm-powered handhelds into their secure networks," said John Inkley, director of federal sales for palmOne. "Mobile workers want more than just secure access to email. They want access to corporate information and applications too. This validation provides not one, but many alternative solutions for everything from secure push e-mail to backend database access and updates. Now users can do it with the confidence that their security meets the government's most stringent guidelines." Since 1997, Certicom and Palm have worked together to enable mobile workers to protect sensitive information with a high level of security, without compromising the speed and flexibility of wireless devices. "Certicom makes it easy for agencies to adhere to the strict security guidelines mandated by the government while still using the platform of their choice," said Tony Rosati, Certicom's vice-president, marketing and product management. "This certification extends our relationship with Palm and underscores our commitment to provide strong security solutions for multiple platforms without impacting performance." Along with standard cryptography algorithms such as DES, 3DES, AES, SHA-1 and the RSA public key algorithm, Security Builder GSE also includes Elliptic Curve Cryptography (ECC), a public-key cryptography technique approved by the U.S. government and many standards organizations including ANSI, IETF, IEEE and NIST. Last month, the National Security Agency purchased licensing rights to some of Certicom's ECC intellectual property to protect mission critical national security information. Security Builder GSE is available immediately and is priced with a license fee and royalties based on the number of devices. For more information, visit http://www.certicom/gov. About Certicom Certicom is a leading provider of wireless security solutions, enabling developers, governments and enterprises to add strong security to their devices, networks and applications. Designed for constrained devices, Certicom's patented technologies are unsurpassed in delivering the strongest cryptography with the smallest impact on performance and usability. Certicom products are currently licensed to more than 300 customers including Texas Instruments, Palm, Research In Motion, Cisco Systems, Oracle and Motorola. Founded in 1985, Certicom is headquartered in Mississauga, ON, Canada, with offices in Ottawa, ON; Herndon, VA; San Mateo, CA; and London, England. Visit http://www.certicom.com. Certicom, Security Builder, Security Builder Crypto, Security Builder SSL, Security Builder PKI, Security Builder GSE, movianVPN, movianCrypt and movianMail are trademarks or registered trademarks of Certicom Corp. All other companies and products listed herein are trademarks or registered trademarks of their respective holders. Except for historical information contained herein, this news release contains forward-looking statements that involve risks and uncertainties. Actual results may differ materially. Factors that might cause a difference include, but are not limited to, those relating to the acceptance of mobile and wireless devices and the continued growth of e-commerce and m-commerce, the increase of the demand for mutual authentication in m-commerce transactions, the acceptance of Elliptic Curve Cryptography (ECC) technology as an industry standard, the market acceptance of our principal products and sales of our customer's products, the impact of competitive products and technologies, the possibility of our products infringing patents and other intellectual property of fourth parties, and costs of product development. Certicom will not update these forward-looking statements to reflect events or circumstances after the date hereof. More detailed information about potential factors that could affect Certicom's financial results is included in the documents Certicom files from time to time with the Canadian securities regulatory authorities. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[Neuclear-general] ANNOUNCE: Released version 0.7 of NeuClear Commons
by Pelle Braendgaard 06 Jul '18

06 Jul '18

Panama City, 28 April, 2004. We are happy to announce the 0.7 release of NeuClear Commons. Main goal of this release is to support the 0.9 release of NeuClear ID. Download it today and join in the NeuClear revolution. Major new features are: * New Swing based Passphrase Agent * DefaultSigner is now completely interactive. * SQLSigner stores Public Private Key Pairs in SQL using Hibernate. * Removed all old SQL support code. * Added in memory caching to Public Key Resolver * Added new interactive signing model with the BrowsableSigner interface * New SetPublicKeyCallback method for returning the public key in interactive applications For more information see: http://dev.neuclear.org/commons/ Full Release notes below: Release Notes - NeuClear Commons - Version r_0_7 ** Bug * [COM-13] - Handle Invalid Passphrase in SwingAgent * [COM-14] - Use different screen layout for normal passphrase in SwingAgent * [COM-25] - Remembered passphrase is forgotten if identity is changed * [COM-27] - Loop when JCESigner is loaded with incorrect passphrase * [COM-31] - Remembered passphrase doesnt enable "sign" button * [COM-33] - Signed HTML generated by Identity and subclasses fail verification ** New Feature * [COM-4] - Create Completely Interactive Signing Method * [COM-5] - Support for more advanced passphrase agent * [COM-6] - Set PublicKey Callback Method * [COM-10] - Create Improved GUI Agent * [COM-11] - Add remember Passphrase to SwingAgent * [COM-12] - Add Identity Generator to SwingAgent * [COM-16] - add Password encrypted private key methods to CryptoTools * [COM-17] - Create SQLSigner * [COM-18] - Make DefaultSigner an intelligent wrapper for end user signing front ends * [COM-20] - Add Save Key Store Dialog to InteractiveAgent * [COM-21] - Add Open Key Store Dialog to InteractiveAgent * [COM-22] - Implement Save in SwingAgent ** Task * [COM-15] - Update project.xml with latest dependencies * [COM-32] - Drop all the sql packages as no longer needed ** Improvement * [COM-9] - Add in memory caching to PublicKey Resolver * [COM-19] - Create signing task queue on SwingAgent * [COM-26] - Change to DefaultSigner's method of saving -- http://talk.org + Live and direct from Panama http://neuclear.org + Clear it both ways with NeuClear ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click _______________________________________________ Neuclear-general mailing list Neuclear-general(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/neuclear-general --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Financial identity is *dangerous*? (was re: Fake companies, real money)
by John Kelsey 06 Jul '18

06 Jul '18

>From: Chris Kuethe <chris.kuethe(a)gmail.com> >Sent: Oct 13, 2004 1:15 PM >To: "James A. Donald" <jamesd(a)echeque.com> >Cc: cryptography(a)metzdowd.com, > "cypherpunks(a)al-qaeda.net" <cypherpunks(a)al-qaeda.net> >Subject: Re: Financial identity is *dangerous*? (was re: Fake companies, >real money) On Wed, 13 Oct 2004 09:27:20 -0700, James A. Donald <jamesd(a)echeque.com> wrote: > Two problems: ... >> It is clear that the world needs a fully cashlike form of >> internet money, that there is real demand for this, but the low >> security of personal computers makes it insecure from thieves, >> and the hostility of national governments make it insecure from >> governments. >Agreed. I would hope that users of "iCash" get fully educated on what >that entails: that that blob of bits is just as much $20 as that green >piece of paper or that big pile of quarters. And if someone gets it >and spends it, you may as well have been mugged. Okay, but there's a problem: If you want to mug me personally, you have to show up where I am, catch me unaware, take some personal risk that I'll fight back or shoot you or something, or that a cop will happen by at an inopportune moment, or that there's some surveilance camera you don't know about catching the whole thing on tape. At the end of that, you've done one mugging, and made maybe $100 or so. This is why mugging, armed robbery, etc., is basically a crime for people who don't think too far ahead. If you want to steal anonymous bearer assets from networked computers, you're going to contrive to do a whole lot of it at once, and you're going to have enormous incentives to develop new attacks to do so. I have to care about attackers everywhere on Earth, and about the most capable getting past my defenses. It's not like trying to keep random bored teenagers from breaking into your house by putting a proper lock on a properly installed door, it's like trying to keep a team of ex-SEALs, safecrackers, locksmiths, and demolition experts from breaking into your house. Today, most of what I'm trying to defend myself from online is done as either a kind of hobby (most viruses), or as fairly low-end scams that probably net the criminals reasonable amounts of money, but probably don't make them rich. Imagine a world where there are a few hundred million dollars in untraceable assets waiting to be stolen, but only on Windows XP boxes with the latest patches, firewalls and scanners installed, and reasonable security settings. IMO, that's a world where every day is day zero. All bugs are shallow, given enough qualified eyeballs, and with that kind of money on the table, there would be plenty of eyeballs looking. And once it's done, several thousand early adopters are out thousands of dollars each. This isn't much of an advertisement for the payment system. It's anonymous and based on bearer instruments, so there's no way to run the fraudulent transactions back. The money's gone, and the attackers are richer, and the next, more demanding round of attacks has been capitalized. >People do eventually learn when it costs them something out of pocket. >Now that they've learned that the white headphones mean "I'm a target >with an iPod, mug me!" I see a lot of iPod users with boring old sony >or koss headphones. Right now, insecurity doesn't cost the end-user >enough. As soon as some virus comes along and wipes out some new york >times columnist's savings, and he screams about it, then and only then >will the slightest nonzero percentage of the sheeple pay attention for >a bit. They also have to be able to do something about it. What would you tell a reasonably bright computer programmer with no particular expertise in security about how to keep a bearer asset as valuable as his car stored securely on a networked computer? If you can't give him an answer that will really work in a world where these bearer assets are common, you're just not going to get a widespread bearer payment system working, for the same reason that there's probably nobody jogging with an iPod through random the streets of Sadr City, no matter how careful they're being. ... --John Kelsey --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [cryptography] ICIJ's project - comment on cryptography & tools
by ianG 06 Jul '18

06 Jul '18

On 5/04/13 05:36 AM, James A. Donald wrote: > On 2013-04-05 10:47 AM, James A. Donald wrote: >> >> How does it work? Is it really secure, and if it is, how did they >> manage a "not one click for security" user interface? > > Already answered by others on this list. Not secure, apple can MIM it. Seems like. However, the barrier for that seems somewhat higher than an intercept or pen register. (Entering into full speculation mode here) I suspect that one would need a direct court order akin to a full search & seizure in order to give the feds access to the messages; it seems to involve handing over the entire device key to clone the full personality. The original CNN article doesn't pass muster, a far more skeptical and analytical one is here: http://securitywatch.pcmag.com/none/310015-the-real-reason-the-feds-can-t-r… iang _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by Tib 06 Jul '18

06 Jul '18

> Hope I'm not being totally naive about the capability of computer hardware, but > I sure don't recall my PC (or any that I have ever had or can think of > seeing) having short range broadcasting capabilities. How would this be > theorheticly possible (despite the utter nonsense that the rumor must be) to > accomplish, if at all? Read the whole paper. Look in the archives (or on Google) for TEMPEST. Duh... Mark

1 0

None
by Tib 06 Jul '18

06 Jul '18

> Hope I'm not being totally naive about the capability of computer hardware, but > I sure don't recall my PC (or any that I have ever had or can think of > seeing) having short range broadcasting capabilities. How would this be > theorheticly possible (despite the utter nonsense that the rumor must be) to > accomplish, if at all? Read the whole paper. Look in the archives (or on Google) for TEMPEST. Duh... Mark

1 0

None
by Tib 06 Jul '18

06 Jul '18

> Hope I'm not being totally naive about the capability of computer hardware, but > I sure don't recall my PC (or any that I have ever had or can think of > seeing) having short range broadcasting capabilities. How would this be > theorheticly possible (despite the utter nonsense that the rumor must be) to > accomplish, if at all? Read the whole paper. Look in the archives (or on Google) for TEMPEST. Duh... Mark

1 0

None
by Tib 06 Jul '18

06 Jul '18

> Hope I'm not being totally naive about the capability of computer hardware, but > I sure don't recall my PC (or any that I have ever had or can think of > seeing) having short range broadcasting capabilities. How would this be > theorheticly possible (despite the utter nonsense that the rumor must be) to > accomplish, if at all? Read the whole paper. Look in the archives (or on Google) for TEMPEST. Duh... Mark

1 0

None
by Tib 06 Jul '18

06 Jul '18

> Hope I'm not being totally naive about the capability of computer hardware, but > I sure don't recall my PC (or any that I have ever had or can think of > seeing) having short range broadcasting capabilities. How would this be > theorheticly possible (despite the utter nonsense that the rumor must be) to > accomplish, if at all? Read the whole paper. Look in the archives (or on Google) for TEMPEST. Duh... Mark

1 0