July 2018 - cypherpunks-legacy

Re: Can Skype be wiretapped by the authorities?
by Enzo Michelangeli 06 Jul '18

06 Jul '18

----- Original Message ----- From: "Axel H Horns" <axel.h.horns(a)gmx.net> To: <cryptography(a)metzdowd.com> Sent: Wednesday, April 28, 2004 4:49 AM Subject: Can Skype be wiretapped by the authorities? > Is something known about the details of the crypto protocol within > Skype? How reliable is the encryption? > > See e.g. > > http://www.financialcryptography.com/mt/archives/000076.html > > Can Skype be wiretapped by the authorities? With collaboration of the > Skype operator? Without? What do you mean with "operator"? AFAIK, the system is fully peer-to-peer (http://www.skype.com/skype_p2pexplained.html ). Regarding the crypto, at http://www.skype.com/help_faq.html#Technical they say: What type of encryption is used? Skype uses AES (Advanced Encryption Standard) - also known as Rijndel - which is also used by U.S. Government organizations to protect sensitive, information. Skype uses 256-bit encryption, which has a total of 1.1 x 1077 possible keys, in order to actively encrypt the data in each Skype call or instant message. Skype uses 1536 to 2048 bit RSA to negotiate symmetric AES keys. User public keys are certified by Skype server at login. OK, so "Rijndael" is misspelled and the RSA-based key exchange does not provide forward secrecy, but apart from that it doesn't smell like snake oil. Not too bad, at least. BUT, unfortunately, the implementation is closed source, so there are no guarantees that the software is not GAKked. And yes, definitely an opensource (and multiplatform) alternative would be a cool thing to have. A message I posted a while ago to the list p2p-hackers was reposted by Eugene Leitl to cypherpunks (http://www.mail-archive.com/cypherpunks@minder.net/msg81814.html ) but the couple of followups it elicited didn't seem to center the issues I raised. I didn't reply then because I'm not a subscriber of cypherpunks any longer, so I'd like to take this occasion for doing it here now: Major Variola (ret) commented (indented lines, followed by my comment): [...] >Skype claims to use RSA-based key exchange, which is good for >multi-party conferencing but does not preserve forward secrecy. >Maybe some variant of ephemeral D-H authenticated by RSA >signatures, with transparent renegotiation every time someone >joins the conference, could do the job better. RSA (ie persistant keys) may be an option but MUST NOT be required, for secrecy reasons as mentioned. (At worst RSA keys can be used once, then discarded. Lots of primes out there :-) Well, I don't see why RSA signatures (only for authentication of the key exchange) could endanger forward secrecy. Also, this is *voice*, ie biometric auth, so public-key-web-o-trust verislime scam is unnecessary at best. It's not only voice, it's also IM-style text chat. And even with voice, biometric authentication becomes awkward to use with conference calls. [...] >One could always implement a brand new >network, using Distributed Hash Table algorithms such as Chord or >Kademlia, We don't give a flying fuck as to which shiny new algorithm you use, although were we a graph theory wonk, we might care. The issue here is that DHT algorithms allow to implement a fully distributed directory, which means one much more resistant to attacks (especially from institutional attackers) than implementations based on centralized servers (see, in a related fild, the different destinies of Napster and its distributed successors such as Overnet or the less efficient Gnutella). Still, a full search takes O(log(n)) steps, making them practical for implementing directory/presence services. [...] >but it would be much easier to rely from the very beginning upon >a large number of nodes (at least for directory and presence >functionality, if not for the reflectors which require specific >UDP code). What the NAT world (yawn) needs is free registry services exploitable by any protocol. Those NAT-users with RSA-clue can sign their registry entry. Not only that: NATted agents cannot be "called" unless they first register with some reflector on the open Internet. And centralized reflectors are, again, easy to attack, and also expensive to operate, as the bandwidth requirements are substantial (all the traffic flows through them): see e.g. John Walker's analysis of the reasons that led him to abandon SpeakFreely at http://www.fourmilab.ch/speakfree/ . Thomas Shaddack suggested to leverage on Jabber, but: 1. Jabber uses TCP as transport, and therefore can't be efficiently used as transport for telephony, i.e. using encapsulation of the voice packets in the Jabber protocol in order to traverse NAT devices. 2. Jabber is based on a client-server paradigm similar to e-mail. Running a Jabber server requires an always-on machine with its own domain name; and, although dynamic DNS can help, the model again tend to be hierarchical, easy to attack etc. That pretty much rules it out also for session initiation, directory/presence etc. The beauty of Skype, encryption aside, is that it's based on an overlay network solely based on P2P servents, relies (if their FAQ tells the truth) upon NO central registry for presence and directory services, and each client that runs non-NATted can transparently act as reflector supporting NATted users. Plus, all this (including, besides voice, text-based instant messaging) works with zero configuration with an idiotproof UI. Enzo --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[IP] More on Hayden on NSA program
by David Farber 06 Jul '18

06 Jul '18

-----Original Message----- From: Tim Finin [mailto:finin@cs.umbc.edu] Sent: Monday, January 23, 2006 9:13 PM To: dave(a)farber.net Subject: More on Hayden on NSA program I was puzzled when I heard this exchange on the radio. General Hayden was clearly denying that "probable cause" was the standard for what is allowed in the fourth amendment. But the Constitution seems to say otherwise. It turns out that there's a trick involved, so pay close attention. Here's the exchange: Q: Jonathan Landay with Knight Ridder. I'd like to stay on the same issue, and that had to do with the standard by which you use to target your wiretaps. I'm no lawyer, but my understanding is that the Fourth Amendment of the Constitution specifies that you must have probable cause to be able to do a search that does not violate an American's right against unlawful searches and seizures. Do you use -- HAYDEN: No, actually -- the Fourth Amendment actually protects all of us against unreasonable search and seizure. That's what it says. Q: But the measure is probable cause, I believe. HAYDEN: The amendment says unreasonable search and seizure. Q: But does it not say probable ... HAYDEN: No. The amendment says unreasonable search and seizure... Just to be very clear -- and believe me, if there's any amendment to the Constitution that employees of the National Security Agency are familiar with, it's the Fourth. And it is a reasonableness standard in the Fourth Amendment. And so what you've raised to me -- and I'm not a lawyer, and don't want to become one -- what you've raised to me is, in terms of quoting the Fourth Amendment, is an issue of the Constitution. The constitutional standard is "reasonable." And we believe -- I am convinced that we are lawful because what it is we're doing is reasonable." And here is the fourth amendment: The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. The trick is this -- "probable cause" is only needed to get a warrant for a search, so if you forgo asking for a warrant to be issued, you are home free. Slam dunk. This Law stuff is pretty neat. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Ridiculous Airline Security Story N+1 and N+2...
by Rohit Khare 06 Jul '18

06 Jul '18

Executive Summary: I am near my limit of anger with the "random", "neutral" FAA passenger profiling algorithm. I have every reason to believe some programmer has coded some strictures into it which would truly offend American civil society if translated from mathematics back into the ugly politics from whence it came. Soon after my last installment, I had to turn back around and fly out of Denver. They made me X-ray my *shoes*... This time, the problem was *too much* time on their hands. The second story is how I missed the last flight back home on Thanksgiving eve because the security supervisor wouldn't show up to process me at the gate in time. That snowballed into a series of Catch-22 situations trying to find a lost pair of glasses along the way. First, Denver. A tip on avoiding the Disneyland-like lines at the two main X-ray posts -- even though, strictly speaking, that's an insult to Disneyland, since even they've instituted a take-a-number pass system for the most popular rides. Rather than take the train to one of the outlying concourses, ignore the main signage and *walk* to Terminal A over a bridge on the ticketing level. That's the X-ray post to Continental, British, etc. Much less popular, even though many a savvy traveler knew that was the way around United's silly carryon sizer templates (Contintental's machines don't use them). Then take the train to wherever you really need to get to. A co-worker and I arrived at DIA together, and I was able to purchase a new ticket, and even with the foolishness of fellow business travelers in stocking-feet waiting for their shoes back, I caught up with him in the same train car... he spent the entire time in United lines. Now, for the real outrage. Today, I was warned about massive Thanksgiving delays at Sea-Tac, so I cut short a beer with a buddy in Bellevue to race back two and a half hours in advance. I returned the car, picked up a boarding pass from a pliant robot kiosk, and got through security in a wink. Two hours in advance... no problem, right? Well, I was a selectee, presumably since it was a one-way ticket. So I sat through yet another embarassing tearing-apart of my bags, and this time they found a pocket screwdriver. A promotional pen-style screwdriver that I've had for ten years (it's a NeXT repair shop :-) 1. They think you are not allowed to board with a three-inch, 1/8-inch wide screwdriver. 2. You are not allowed to ask the aircrew to hold it for you on the flight. 3. You are not allowed to leave the selectee table until a "GSC" supervisor comes to look it over. At this point, there's twenty minutes left.... tick-tock... now, the flight is almost completely boarded. You're still waiting. And now you suddenly realize you've lost your $400 prescription sunglasses. 4. You keep all your metal -- everything -- in your jacket at all times, so that you can x-ray a jacket rather than begin to empty out pockets. Your sunglasses have fallen out at some checkpoint. At this point, you start tracing back your steps. It's 7 minutes or so to push-back. 5. If you leave the selectee table, you will have to be searched all over again when you return to the gate 6. They do not have walkie-talkies to ask security if your glasses were stuck in the X-ray tunnel 7. See #3: You are not allowed to leave at all until the mythical GSC arrives. Finally, a GSC arrives. Two minutes or so to departure, you haven't been given any chance to run down and solve the mystery. 8. The screwdriver must be confiscated or bags must be checked. 9. Just because you have been flying with it all week means nothing. "We're supposed to randomly change what the FAA is looking for every day". Parse that, if you dare! 10. Any carry-on bag may be gate-checked *except* those containing "forbidden carry-on items". Catch-22 #1. So now you're finally free to run back to the X-ray post and miss your flight. 11. With about fifteen uniformed personnel of various stripes (National Guard, Argenbright, Alaska, and United), none of the first half-dozen people you ask claims to know about lost articles. 12. Before you can find a supervisor, the GSC has wandered back to warn them you are carrying a screwdriver. 13. So at this point, instead of any sympathy for a harried traveler asking for a supervisor, it's time for a lecture about "having committed two federal crimes, bringing a forbidden item into a screening area, lying about it to a ticket agent, two fines at $11,000 each" -- which they take the pompous time to warn you adds up to "a potential total fine of $22,000" since you're not paying enough attention to the supercillious bastard who won't admit to knowing who to ask about lost articles. Note that A) you are not allowed to leave your bags unaccompanied; and B) the only way for a solo traveler to speak to a security supervisor is to enter the screening area. Catch-22 #2. 14. Sufficiently alarmed, I am ordered to walk around, get back in line, and wait to be escorted back to the *front* of the metal detector to be handed my bags back. At this point, my interest is in going back to the Rental car desk and asking if I left the glasses there. At no point has anyone volunteered a back-up flight alternative for how I might every make it back to Northern California tonight. Ultimately, when rebooking my ticket for a later flight to SFO, I mention that I missed my flight because as a selectee, the personnel needed to inspect me were not available in time. I get snapped at for suggesting I was at all inconvenienced. And I'm marked as a selectee again. And when I finally wade through security for the fourth time, the same super is there to claim that the glasses must have been swept up to Port of Seattle Lost and Found. But that he doesn't know what their phone number is. 15. Seattle is the only airport in the world without white courtesy telephones :-) But while looking for those phones, the wandering GSC comes back around and huddles with the supervisor, staring at me. She's obviously asking him how I could have come back in without having checked my bag - and my dreaded screwdriver. Gingerly, they begin to follow me back out of the screening area. I decide to placate their fears that I got back through their infallible dragnet with contraband. "Oh, I mailed it to myself, first-class air-mail!" ... Clever solutions aside, the outcome of this story is that a very harried, very frequent traveling US citizen was at no point treated like an innocent person anxious to solve a problem. Instead, every contact is an opportunity to be treated like a suspect criminal. In three hours, I was patted down four times, had my bags X-rayed twice, hand-searched twice more, and went through metal detectors six times. The irony of it all is that the selectee program was created by the FAA for those passengers who choose NOT to provide photo identification as a matter of right. CAPPS, the Computer-Assisted Passenger Profiling System, deserves to be sued out of existence. I'm almost ready to join the ACLU. These so-called "confidential" criteria are not convincingly as neutral as the cheery pink "You have been randomly selected"! flyers in your ticket indicate. And the time-filling additional random searches by the gate security supervisor were even more visibly biased towards brown young men. Even one Army soldier on Thanksgiving leave. I am sick of being treated as guilty until proven innocent! Not least by such a patently fallible and placebo-driven security system... The Feds will be *such* an improvement. -- not! Yours, Rohit http://xent.com/mailman/listinfo/fork --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Can Skype be wiretapped by the authorities?
by Enzo Michelangeli 06 Jul '18

06 Jul '18

----- Original Message ----- From: "Axel H Horns" <axel.h.horns(a)gmx.net> To: <cryptography(a)metzdowd.com> Sent: Wednesday, April 28, 2004 4:49 AM Subject: Can Skype be wiretapped by the authorities? > Is something known about the details of the crypto protocol within > Skype? How reliable is the encryption? > > See e.g. > > http://www.financialcryptography.com/mt/archives/000076.html > > Can Skype be wiretapped by the authorities? With collaboration of the > Skype operator? Without? What do you mean with "operator"? AFAIK, the system is fully peer-to-peer (http://www.skype.com/skype_p2pexplained.html ). Regarding the crypto, at http://www.skype.com/help_faq.html#Technical they say: What type of encryption is used? Skype uses AES (Advanced Encryption Standard) - also known as Rijndel - which is also used by U.S. Government organizations to protect sensitive, information. Skype uses 256-bit encryption, which has a total of 1.1 x 1077 possible keys, in order to actively encrypt the data in each Skype call or instant message. Skype uses 1536 to 2048 bit RSA to negotiate symmetric AES keys. User public keys are certified by Skype server at login. OK, so "Rijndael" is misspelled and the RSA-based key exchange does not provide forward secrecy, but apart from that it doesn't smell like snake oil. Not too bad, at least. BUT, unfortunately, the implementation is closed source, so there are no guarantees that the software is not GAKked. And yes, definitely an opensource (and multiplatform) alternative would be a cool thing to have. A message I posted a while ago to the list p2p-hackers was reposted by Eugene Leitl to cypherpunks (http://www.mail-archive.com/cypherpunks@minder.net/msg81814.html ) but the couple of followups it elicited didn't seem to center the issues I raised. I didn't reply then because I'm not a subscriber of cypherpunks any longer, so I'd like to take this occasion for doing it here now: Major Variola (ret) commented (indented lines, followed by my comment): [...] >Skype claims to use RSA-based key exchange, which is good for >multi-party conferencing but does not preserve forward secrecy. >Maybe some variant of ephemeral D-H authenticated by RSA >signatures, with transparent renegotiation every time someone >joins the conference, could do the job better. RSA (ie persistant keys) may be an option but MUST NOT be required, for secrecy reasons as mentioned. (At worst RSA keys can be used once, then discarded. Lots of primes out there :-) Well, I don't see why RSA signatures (only for authentication of the key exchange) could endanger forward secrecy. Also, this is *voice*, ie biometric auth, so public-key-web-o-trust verislime scam is unnecessary at best. It's not only voice, it's also IM-style text chat. And even with voice, biometric authentication becomes awkward to use with conference calls. [...] >One could always implement a brand new >network, using Distributed Hash Table algorithms such as Chord or >Kademlia, We don't give a flying fuck as to which shiny new algorithm you use, although were we a graph theory wonk, we might care. The issue here is that DHT algorithms allow to implement a fully distributed directory, which means one much more resistant to attacks (especially from institutional attackers) than implementations based on centralized servers (see, in a related fild, the different destinies of Napster and its distributed successors such as Overnet or the less efficient Gnutella). Still, a full search takes O(log(n)) steps, making them practical for implementing directory/presence services. [...] >but it would be much easier to rely from the very beginning upon >a large number of nodes (at least for directory and presence >functionality, if not for the reflectors which require specific >UDP code). What the NAT world (yawn) needs is free registry services exploitable by any protocol. Those NAT-users with RSA-clue can sign their registry entry. Not only that: NATted agents cannot be "called" unless they first register with some reflector on the open Internet. And centralized reflectors are, again, easy to attack, and also expensive to operate, as the bandwidth requirements are substantial (all the traffic flows through them): see e.g. John Walker's analysis of the reasons that led him to abandon SpeakFreely at http://www.fourmilab.ch/speakfree/ . Thomas Shaddack suggested to leverage on Jabber, but: 1. Jabber uses TCP as transport, and therefore can't be efficiently used as transport for telephony, i.e. using encapsulation of the voice packets in the Jabber protocol in order to traverse NAT devices. 2. Jabber is based on a client-server paradigm similar to e-mail. Running a Jabber server requires an always-on machine with its own domain name; and, although dynamic DNS can help, the model again tend to be hierarchical, easy to attack etc. That pretty much rules it out also for session initiation, directory/presence etc. The beauty of Skype, encryption aside, is that it's based on an overlay network solely based on P2P servents, relies (if their FAQ tells the truth) upon NO central registry for presence and directory services, and each client that runs non-NATted can transparently act as reflector supporting NATted users. Plus, all this (including, besides voice, text-based instant messaging) works with zero configuration with an idiotproof UI. Enzo --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[IP] More on Hayden on NSA program
by David Farber 06 Jul '18

06 Jul '18

-----Original Message----- From: Tim Finin [mailto:finin@cs.umbc.edu] Sent: Monday, January 23, 2006 9:13 PM To: dave(a)farber.net Subject: More on Hayden on NSA program I was puzzled when I heard this exchange on the radio. General Hayden was clearly denying that "probable cause" was the standard for what is allowed in the fourth amendment. But the Constitution seems to say otherwise. It turns out that there's a trick involved, so pay close attention. Here's the exchange: Q: Jonathan Landay with Knight Ridder. I'd like to stay on the same issue, and that had to do with the standard by which you use to target your wiretaps. I'm no lawyer, but my understanding is that the Fourth Amendment of the Constitution specifies that you must have probable cause to be able to do a search that does not violate an American's right against unlawful searches and seizures. Do you use -- HAYDEN: No, actually -- the Fourth Amendment actually protects all of us against unreasonable search and seizure. That's what it says. Q: But the measure is probable cause, I believe. HAYDEN: The amendment says unreasonable search and seizure. Q: But does it not say probable ... HAYDEN: No. The amendment says unreasonable search and seizure... Just to be very clear -- and believe me, if there's any amendment to the Constitution that employees of the National Security Agency are familiar with, it's the Fourth. And it is a reasonableness standard in the Fourth Amendment. And so what you've raised to me -- and I'm not a lawyer, and don't want to become one -- what you've raised to me is, in terms of quoting the Fourth Amendment, is an issue of the Constitution. The constitutional standard is "reasonable." And we believe -- I am convinced that we are lawful because what it is we're doing is reasonable." And here is the fourth amendment: The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. The trick is this -- "probable cause" is only needed to get a warrant for a search, so if you forgo asking for a warrant to be issued, you are home free. Slam dunk. This Law stuff is pretty neat. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Journalist Arresting for Criticizing Cops
by Eric Cordian 06 Jul '18

06 Jul '18

In today's news of the truly odd. ----- KEY WEST, Fla. (AP) -- A newspaper editor and publisher was arrested for publishing an article alleging a cover-up in an internal police investigation he had filed an official complaint about, police records show. Dennis Cooper, 66, editor of the weekly Key West The Newspaper, was arrested Friday and released two hours later on his own recognizance. The affidavit for his arrest cites a Florida statute that makes it a misdemeanor for anyone involved in an internal police investigation to disclose information before it has been entered into public record. Cooper has alleged a police lieutenant lied in court about a 1996 stop of a bicyclist, and that the Key West Police Department covered it up. He filed a complaint last month with the Florida Department of Law Enforcement accusing an internal affairs investigator of falsifying information about his review of the incident. [...]"

1 0

A Pass on Privacy?
by Monty Solomon 06 Jul '18

06 Jul '18

A Pass on Privacy? By CHRISTOPHER CALDWELL July 17, 2005 Anyone making long drives this summer will notice a new dimension to contemporary inequality: a widening gap between the users of automatic toll-paying devices and those who pay cash. The E-ZPass system, as it is called on the East Coast, seemed like idle gadgetry when it was introduced a decade ago. Drivers who acquired the passes had to nose their way across traffic to reach specially equipped tollbooths -- and slow to a crawl while the machinery worked its magic. But now the sensors are sophisticated enough for you to whiz past them. As more lanes are dedicated to E-ZPass, lines lengthen for the saps paying cash. E-ZPass is one of many innovations that give you the option of trading a bit of privacy for a load of convenience. You can get deep discounts by ordering your books from Amazon.com or joining a supermarket ''club.'' In return, you surrender information about your purchasing habits. Some people see a bait-and-switch here. Over time, the data you are required to hand over become more and more personal, and such handovers cease to be optional. Neato data gathering is making society less free and less human. The people who issue such warnings -- whether you call them paranoids or libertarians -- are among those you see stuck in the rippling heat, 73 cars away from the ''Cash Only'' sign at the Tappan Zee Bridge. ... http://www.nytimes.com/2005/07/17/magazine/17WWLN.html?ex=1279339200&en=c1f… d3de06adea6&ei=5088 ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] A Pass on Privacy?
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Lawmaker Probes TSA Website Gaffe
by Randy Burge 06 Jul '18

06 Jul '18

Lawmaker Probes TSA Website Gaffe <http://www.wired.com/science/discoveries/news/2007/02/72790> Ryan Singel 02.23.07 | 12:00 PM A powerful congressional committee is investigating a Transportation Security Administration website that promised to help air travelers caught up in terrorist watch lists, after a Wired News blog revealed that the site was potentially exposing user's personal information to eavesdroppers. The House Committee on Oversight and Government Reform asked the TSA on Friday to turn over documents related to the Traveler Verification Identity Program website to determine how the site was designed, and whether government security and privacy regulations were violated. That site was intended to allow domestic airline travelers whose names are similar to entries on the government's No Fly List and other watchlists to submit a complaint online, instead of calling TSA and requesting a form be sent to them by mail. However, the site was full of misspellings and nonsensical directions, and asked travelers to provide sensitive personal information on an unencrypted page. Travelers in an airport using a wireless connection would be at risk of having their personal information stolen and used to commit identity fraud. Additionally, the site, which was entered from a link on the TSA's main website, was hosted on the website of Desyne.com, a web design company that has a P.O. Box as its contact information -- adding to the impression it was not a legitimate government site. Committee chairman Rep. Henry Waxman (D-California) told TSA in his letter (.pdf) that the "overall appearance of the site was so poor that web experts first assumed it was a so-called 'phishing' site, a site internet hackers had created to look like a TSA website page." Waxman also asked the agency to turn over by March 9 documents regarding Desyne, communications about security with that company, and the period of time that the site was running without encryption. Despite appearances, TSA spokesman Christopher White assured Wired News last week that the site was not part of a phishing attack. "We take IT responsibilities seriously. There was never a vulnerability; just a small glitch," White said. The Traveler Verification Identity Program site was taken down last Friday. It was replaced this week by a completely different webpage offering the same service, but now called the Travel Redress Inquiry Program, or TRIP. <snip> <http://www.wired.com/science/discoveries/news/2007/02/72790> ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Dewayne-Net] Lawmaker Probes TSA Website Gaffe
by dewayne＠warpspeed.com 06 Jul '18

06 Jul '18

[Note: This item comes from reader Randy Burge. DLH]

1 0