July 2018 - cypherpunks-legacy

Ross Anderson paper on fraud, risk and nonbank payment systems
by Steve Schear 06 Jul '18

06 Jul '18

[Read the paper here: http://www.cl.cam.ac.uk/%7Erja14/Papers/nonbanks.pdf Very interesting stuff, but not likely new to most here.] The Federal Reserve commissioned me to research and write a paper on fraud, risk and nonbank payment systems. I found that phishing is facilitated by payment systems like eGold and Western Union which make the recovery of stolen funds more difficult. Traditional payment systems like cheques and credit card payments are revocable; cheques can bounce and credit card charges can be charged back. However some modern systems provide irrevocability without charging an appropriate risk premium, and this attracts the bad guys. (After I submitted the paper, and before it was presented on Friday, eGold was indicted.) I also became convinced that the financial market controls used to fight fraud, money laundering and terrorist finance have become unbalanced as they have been beefed up post-9/11. The modern obsession with 'identity' - of asking even poor people living in huts in Africa for an ID document and two utility bills before they can open a bank account - is not only ridiculous and often discriminatory. It's led banks and regulators to take their eye off the ball, and to replace risk reduction with due diligence. In real life, following the money is just as important as following the man. It's time for the system to be rebalanced. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[FoRK] "Your papers, citizen"
by Russell Turpin 06 Jul '18

06 Jul '18

This was on Slashdot's political feed. Here's the jaw-dropper: McCain envisions erecting physical checkpoints, dubbed "screening points," near subways, airports, bus stations, train stations, federal buildings, telephone companies, Internet hubs and any other "critical infrastructure" facility deemed vulnerable to terrorist attacks. Secretary Tom Ridge would appear to be authorized to issue new federal IDs--with biometric identifiers--that Americans could be required to show at checkpoints. Here's the article: http://news.zdnet.com/2100-1009_22-5415111.html _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar ? get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/ _______________________________________________ FoRK mailing list http://xent.com/mailman/listinfo/fork ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Ross Anderson paper on fraud, risk and nonbank payment systems
by Steve Schear 06 Jul '18

06 Jul '18

[Read the paper here: http://www.cl.cam.ac.uk/%7Erja14/Papers/nonbanks.pdf Very interesting stuff, but not likely new to most here.] The Federal Reserve commissioned me to research and write a paper on fraud, risk and nonbank payment systems. I found that phishing is facilitated by payment systems like eGold and Western Union which make the recovery of stolen funds more difficult. Traditional payment systems like cheques and credit card payments are revocable; cheques can bounce and credit card charges can be charged back. However some modern systems provide irrevocability without charging an appropriate risk premium, and this attracts the bad guys. (After I submitted the paper, and before it was presented on Friday, eGold was indicted.) I also became convinced that the financial market controls used to fight fraud, money laundering and terrorist finance have become unbalanced as they have been beefed up post-9/11. The modern obsession with 'identity' - of asking even poor people living in huts in Africa for an ID document and two utility bills before they can open a bank account - is not only ridiculous and often discriminatory. It's led banks and regulators to take their eye off the ball, and to replace risk reduction with due diligence. In real life, following the money is just as important as following the man. It's time for the system to be rebalanced. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Freedombox-discuss] Anti- freedom-box
by Boruch Baum 06 Jul '18

06 Jul '18

Many of you may have seen this on slash-dot, it's a power strip with a concealed illicit motherboard, that includes: Onboard high-gain 802.11b/g/n wireless. Onboard high-gain Bluetooth (up to 1000'). Onboard dual-Ethernet. Fully functional 120/240v AC outlets!. Includes 16GB internal disk storage. Includes external 3G/GSM adapter. Includes all release 1.1 features. Fully-automated NAC/802.1x/RADIUS bypass. Out-of-band SSH access over 3G/GSM cell networks!. Text-to-Bash: text in bash commands via SMS! . Simple web-based administration with "Plug UI". One-click Evil AP, stealth mode, & passive recon. Maintains persistent, covert, encrypted SSH access to your target network [Details]. Tunnels through application-aware firewalls & IPS. Supports HTTP proxies, SSH-VPN, & OpenVPN. Sends email/SMS alerts when SSH tunnels are activated. Preloaded with Debian 6, Metasploit, SET, Fast-Track, w3af, Kismet, Aircrack, SSLstrip, nmap, Hydra, dsniff, Scapy, Ettercap, Bluetooth/VoIP/IPv6 tools, & more. Unpingable and no listening ports in stealth mode. Many of you may have also funded it; its development was paid for by US taxpayers via DARPA. http://www.zdnet.com/power-pwn-this-darpa-funded-power-strip-will-hack-your… http://hardware.slashdot.org/story/12/07/22/0335223/the-darpa-funded-power-… _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

The connection between NSA wiretapping and telephone
by Andy Oram 06 Jul '18

06 Jul '18

industry concentration http://www.oreillynet.com/pub/wlg/8924 Andy Oram Jan. 05, 2006 06:20 AM I have reported in detail, in a companion blog, about an [95] historic public forum on NSA wiretapping. Here I'll report on one technology-related aspect of particular interest to me: the collusion of the telephone companies, which has not been played up in the press. All the warrantless wiretapping we've recently heard about required help from the telephone companies and Internet service providers. These companies knew they were not only aiding the government in breaking the law, but were themselves violating terms of service for their customers--and in the case of telephone companies, also breaking the law. One law mentioned at the public form (and submitted years ago by the forum's moderator, Congressman Ed Markey) forbids cell phone companies from revealing the location of cell phone users--except with a court warrant. In fact, the NSA wiretapping scandal represents one of the largest conspiracies in recent years: a conspiracy between telephone companies and the government to defraud Americans out of our Fourth Amendment rights. Pertaining to this is the issue of industry concentration--the death of small phone companies and the mergers of larger ones into behemoths--which was also one of the goals of the Bush administration, pursued with determination by Michael Powell as FCC chair. Provisions for competition set up in the Telecom Act of 1996, and enforced by relatively even-handed regulations passed by earlier FCCs, were systematically weakened and discarded under Bush. (For some history, see an [96]earlier blog of mine. Admittedly, it's hard for any company to buck a demand from law enforcement. The PATRIOT Act's secrecy provisions (when the FBI approaches you, you can't even publicize the very fact that they have done so) leaves the impression that you'll be prosecuted for going public with government misbehavior, and thus contributes to the growing unaccountability of government. A few Internet service providers have done challenged illegal wiretaps, but not enough to establish the pattern we now see in the wiretap scandal. Overwhelmingly, the phone companies and ISPs just went along. One might argue that the pressure would have been even stronger if ISPs and phone companies were smaller, but size obviously hasn't helped them put up any resistance. Believe me, if we had an industry of scrappy Mom-and-Pop providers like in the 80s and 90s, word about this civil liberties horror would have come out sooner. Andy Oram is an editor for O'Reilly Media, specializing in Linux and free software books, and a member of Computer Professionals for Social Responsibility. His web site is www.praxagora.com/andyo. Weblog authors are solely responsible for the content and accuracy of their weblogs, including opinions they express, and O'Reilly Media, Inc., disclaims any and all liabililty for that content, its accuracy, and opinions it may contain. This work is licensed under a [103]Creative Commons License. References 95. http://www.oreillynet.com/pub/wlg/8923 96. http://www.oreillynet.com/pub/wlg/4616 103. http://creativecommons.org/licenses/by-nc-sa/2.5/ ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] The connection between NSA wiretapping and telephone industry
by David Farber 06 Jul '18

06 Jul '18

concentration X-Mailer: Apple Mail (2.746.2) Reply-To: dave(a)farber.net Begin forwarded message:

1 0

[liberationtech] Stanford MobiSocial Seminar: Commotion, Democracy, and Disruptive Technologies, October 24, 2011
by Terry Winograd 06 Jul '18

06 Jul '18

(People interested should RSVP toB Darlene(a)csl.stanford.edu, to make sureB there is enough lunch.) B B B B B B B B B B B B MobiSocial Seminar B B B B B B B B Monday, October 24, 2011 B B B B B B B B B B 12:15 PM, **Gates 415** B B B B B B B B Lunch will be served at Noon "Commotion, Democracy, and Disruptive Technologies" B B B B B B B B B B B B B B Josh King Commotion is an open source b device-as-infrastructureb communication platform that challenges conventional communication infrastructures both domestically and abroad. This new technology integrates usersb existing cell phones, Wi-Fi enabled computers, and other wireless-capable personal devices to create anonymous, peer-to-peer (mesh) communications networks. Deployment of Commotion is potentially as valuable for dissidents wishing to circumvent repressive regimes as for local activists wishing to support autonomous, low-cost communicative spaces. Josh King, lead technologist for the Open Technology Initiative at the New America Foundation, will discuss the architecture, opportunities, and challenges--both social and technical--of creating a distributed secure network. Bio: Josh King is technical lead for the Open Technology Initiative at the New America Foundation. Prior to joining New America, he was a Systems Engineer for OJC Technologies and also served as an Americorps VISTA Leader. Josh volunteered as a lead technology worker within the Indymedia movement in Central Illinois. _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Concept for takedown-resistant publishing
by Joss Wright 06 Jul '18

06 Jul '18

> Torrent files are slowly being replaced by magnet links. The next > problem is that most browsers don't understand magnet links, so unless > you have a BitTorrent client installed, the links won't take you anywhere. > > So it might be interesting to think about embedding a small BitTorrent > client in the browser to handle magnet links. It would need to be > embedded because once the torrent's finished downloading you want to > unpack it and view it in the same browser window where you clicked on > the link. >From a practical perspective, I think that the use of magnet links with an embedded browser is an interesting way to make certain documents harder to censor, as a supplement to the web but not in place of it. I'm not sure that anyone has proposed this, but remember that the majority of users' active web browsing experiences are not concerned with the retrieval of static pages, but instead making specific requests that are handled and packaged by the web server before being sent to the user. (Just accessing Google's main page isn't very interesting, it's access to the search results from their database, which we get by interacting with the main page that is important. Reading a news site typically gets you a set of articles drawn from their database on demand, that are formatted to create the page as you see it.) This means that the BitTorrent approach is useful for accessing static documents, but not (in general) for what we would consider web browsing. There are therefore three problems with this BitTorrent-style approach, The first is the standard bootstrap problem -- how you get that first link into the system. This wouldn't seem to be the main issue, as a 'seed' link could be bookmarked for long-term availability. (I imagine it would be harder in practise, but let's leave that problem there.) The second is that it's trivial to censor BitTorrent at the protocol level. Web browsing is easy to censor as well, but the average user's view is that the web is equivalent to the internet. If you block the web as a whole then you will upset all internet users. Blocking BitTorrent as a whole is much less of a concern. More subtly, BitTorrent is reasonably trackable and would leak the information of who is accessing what -- not something you really want for access to documents that your powerful adversary is trying to block. The third. and really the major, problem is that if using BitTorrent in this way actually results in using the traditional web for traditional web usage, and BitTorrent, either via .torrents or via magnet links, for censored or blocked documents, then you haven't actually moved a long way from simply having a BitTorrent client integrated with your web browser. That simply results in the method of bypassing censorship for static documents that is already widely in use today. Joss _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

The connection between NSA wiretapping and telephone
by Andy Oram 06 Jul '18

06 Jul '18

industry concentration http://www.oreillynet.com/pub/wlg/8924 Andy Oram Jan. 05, 2006 06:20 AM I have reported in detail, in a companion blog, about an [95] historic public forum on NSA wiretapping. Here I'll report on one technology-related aspect of particular interest to me: the collusion of the telephone companies, which has not been played up in the press. All the warrantless wiretapping we've recently heard about required help from the telephone companies and Internet service providers. These companies knew they were not only aiding the government in breaking the law, but were themselves violating terms of service for their customers--and in the case of telephone companies, also breaking the law. One law mentioned at the public form (and submitted years ago by the forum's moderator, Congressman Ed Markey) forbids cell phone companies from revealing the location of cell phone users--except with a court warrant. In fact, the NSA wiretapping scandal represents one of the largest conspiracies in recent years: a conspiracy between telephone companies and the government to defraud Americans out of our Fourth Amendment rights. Pertaining to this is the issue of industry concentration--the death of small phone companies and the mergers of larger ones into behemoths--which was also one of the goals of the Bush administration, pursued with determination by Michael Powell as FCC chair. Provisions for competition set up in the Telecom Act of 1996, and enforced by relatively even-handed regulations passed by earlier FCCs, were systematically weakened and discarded under Bush. (For some history, see an [96]earlier blog of mine. Admittedly, it's hard for any company to buck a demand from law enforcement. The PATRIOT Act's secrecy provisions (when the FBI approaches you, you can't even publicize the very fact that they have done so) leaves the impression that you'll be prosecuted for going public with government misbehavior, and thus contributes to the growing unaccountability of government. A few Internet service providers have done challenged illegal wiretaps, but not enough to establish the pattern we now see in the wiretap scandal. Overwhelmingly, the phone companies and ISPs just went along. One might argue that the pressure would have been even stronger if ISPs and phone companies were smaller, but size obviously hasn't helped them put up any resistance. Believe me, if we had an industry of scrappy Mom-and-Pop providers like in the 80s and 90s, word about this civil liberties horror would have come out sooner. Andy Oram is an editor for O'Reilly Media, specializing in Linux and free software books, and a member of Computer Professionals for Social Responsibility. His web site is www.praxagora.com/andyo. Weblog authors are solely responsible for the content and accuracy of their weblogs, including opinions they express, and O'Reilly Media, Inc., disclaims any and all liabililty for that content, its accuracy, and opinions it may contain. This work is licensed under a [103]Creative Commons License. References 95. http://www.oreillynet.com/pub/wlg/8923 96. http://www.oreillynet.com/pub/wlg/4616 103. http://creativecommons.org/licenses/by-nc-sa/2.5/ ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] The connection between NSA wiretapping and telephone industry
by David Farber 06 Jul '18

06 Jul '18

concentration X-Mailer: Apple Mail (2.746.2) Reply-To: dave(a)farber.net Begin forwarded message:

1 0