- cypherpunks-legacy - lists.cpunks.org

cel fraud
by an172607＠anon.penet.fi 17 Dec '03

17 Dec '03

Fighting Cellular Fraud, New York To Washington BEDMINSTER, NEW JERSEY, U.S.A., 1995 JAN 6 (NB) -- Bell Atlantic Mobile (BAM, parent NYSE:BEL) and NYNEX Mobile Communications (parent NYSE:NYN), two large US cellular phone carriers, are about to block automatic "roaming" service in New York City and surrounding areas. Starting January 9, BAM customers who place calls in the city will need to enter a personal identification number (PIN) issued by BAM in order to complete the call. The new policy is an antifraud measure to combat criminals who steal cellular service, BAM said. The PIN system was developed by NYNEX and is in use inside the City now, NYNEX sources said. Both firms emphasized that the new policy is no magic wand to do away with cellular fraud. However, as a BAM spokesperson told Newsbytes, the combination of restricted roaming and PIN numbers will "raise the bar again" where cellular fraud is concerned. Under the new system, the two cellular carriers will restrict calls in the greater NYC area by roaming customers from a "Fraud Protection Zone" that includes Washington, D.C.; Baltimore; Pittsburgh; and greater Philadelphia, including Delaware and southern New Jersey. BAM adopted the new measures because of increasing problems with cloning, in which a criminal picks off a cellular customer's automated phone IDs during a legitimate call and uses them to make a "clone phone." The cloned phone can be used to make calls for which the legitimate customers, not the cloners, are billed. AT&T's Steve Fleischer, speaking to Newsbytes, said such cloning operations have become such a successful criminal industry that some criminals sell the phones with 30-day guarantees. "If a number is cut off, you can bring it back to the cellular bandits and have it reprogrammed for no additional charge," he explained. "It costs the carriers around $1 million a day." He paused, then added: "It just shows how big a demand there is for wireless communications." Under the new policy, customers from inside the protected zone who want to use their phones at standard "roaming" rates in New York City must first contact BAM by dialing 211 from their cellular phone. After they provide proper identification and select a PIN code, the company deactivates the fraud zone lock-out. NYNEX spokesperson Kim Ancin told Newsbytes that customers with PIN numbers place calls as much usual by dialing the destination number and pressing the Send button. However, on protected phones, the customer then punches in the PIN number and presses Send again. Ancin explained that the PIN number goes out on a frequency different from the initial send. Cellular bandits use special equipment to pick up a legitimate phone's mobile identification number (MIN) and electronic serial number (ESN), which until now have been enough to clone a phone. However, she said, adding a PIN number on a second frequency makes cloning much more difficult. BAM said it would not activate the fraud protection lock-out in northern New Jersey, where calls to New York City are local calls. However, since customers who travel frequently into the city are at risk from cloning, the firm strongly recommended that northern New Jersey customers sign up for a PIN. Eventually, the firm said, all new customers will be required to select PINs. BAM said if a bandit does succeed in cloning a PIN-equipped phone, a customer can simply change the PIN number. Customers without PIN numbers must bring their phones back to a carrier or dealer to install a new phone number, notify business associates and friends of the number change, and modify business cards and stationery. There is no extra charge for PIN numbers, which are implemented by software at the carrier's switch, BAM's Fleischer told Newsbytes. The feature will not affect commonly used cellular services like voice mail or call waiting. Calls to 911, 611 and 411 will not require a PIN. (Craig Menefee/19950106/Press Contact: Steve Fleischer, 908-306-7539 or Brian Wood, 908-306-7508, both of BAM; Kim Ancin, 914-365-7573, or Jim Gerace, 914- 365-7712, both of NYNEX) ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

4 3

Re: Latency Costs of Anonymity
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Wei Dai <weidai(a)eskimo.com> > The points Tim makes here are quite good. However, I'm more concerned > with a slightly longer time scale, when people focus less on FILES, > but more on CONVERSATIONS and INTERACTIONS. It is then that latency > becomes more problematic. I think this is a good point. We have had some discussions about getting anonymity with web browsing. The "mix" or "remailer" concept doesn't work so well there as the connections are very short, so there is less chance of multiple communications going on at one time. OTOH I have heard discussions of asynchronous transfer mode, ATM, as a new packet-based network technology that could support high bandwidth communications. All messages, presumably even streams like video signals, get broken into fixed-size packets, which make their way through the network and are reassembled into a stream on the other end. The individual packets may not all take the same path through the network. (I am far from an expert on ATM so I welcome corrections to this description.) This technology does sound like mixing could work pretty well to provide anonymity. There is some price in bandwidth and latency but ATM is so fast that probably several steps of chaining and mixing would be possible. Naturally such mixes would have to be hardware based due to the rapid speeds of the packets. So this would be kind of a "souped up" version of our current email remailer network, with vastly greater bandwidths and switching speeds. Another possibility with connection-based communications would be Chaum's DC-Nets. These are networks where message source cannot be determined. They do face potentially severe costs in terms of bandwidth, though, depending on how much anonymity you get. As both mixes and dcnets have bandwidth costs, I wonder if it is provable that anonymity implies such costs. > Can anyone give me an estimate of when truly anonymous video conferencing > will become possible? This is not just to help me make the point, but > I'm really wondering. > > Wei Dai I think it may be more useful rather than speaking of "true" anonymity to think of factor-of-N anonymity. This reflects the bandwidth costs. I would guess that, if you have a packet-based video converencing system, that today you could probably get factor-of-2 anonymity with custom hardware, and perhaps even more than that. One other point I would make, based on Wei's original post, is that no doubt anonymity does exact some costs. However this does not mean that it is uncompetitive. It also may have, in some circumstances, advantages. People may be more frank and critical when they are shielded by anonymity. I've read articles about companies which introduce electornic "suggestion boxes" where people can post anonymously, and upper management is often shocked at the results. It is too early to judge how much of a net benefit or harm anonymity will be in general. Furthermore, it is likely that the net advantage will differ depending on the business or organization. At one extreme, a group working with illegal or restricted technology would probably benefit more from anonymity. I think it was Keith Henson who posted a story here a couple of years ago that he was working on, involving some kind of underground protest group which organized itself using crypto anonymity. So it is really not a question of whether anonymity is good or bad, but rather whether its costs outweigh its advantages in a particular situation. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLw8c9xnMLJtOy9MBAQFZBgH/R1c3FLHECJiEHDoUl/gUPaBIVzd3kvVz Uv2jqFwJxSFQjnrb1wtGT7vLjNOOXJ7uYpBNJU+ZfPSKOvPgGFD8yQ== =+6iw -----END PGP SIGNATURE-----

2 1

Anonymity and cost
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Wei Dai writes: > Anonymous e-mail that goes through a chain of N remailers will cost at > least N times as much bandwidth and have N times as much latency as normal > e-mail. But e-mail is hardly the state-of-the-art of network > communication, while anonymous e-mail IS the state of the art for > anonymous communication. How long will it take for the technology of > anonymous video conferencing to develope, for example? By then, of > course, those who are not concerned with anonymity will probably have > things such as full sensory virtual interaction. At a very basic level, anonymous (not pseudonymous, like the remailers are) messages are *cheaper*, because they carry less information; they do not need to send the bits which identify the sender. This conversation seems to elide distinctions between low-level anonymity (where source information is simply not transmitted) and high-level anonymity, where source information is transmitted but is not used for social or political reasons. Anonymous remailers are considered "anonymous" because (some of us) agree that we won't treat the "From:" line as indicating the real author of the text below. We agree this because we know how remailers work; we know that (probably) the person who wrote the message isn't the same person as the owner of the "From:" address. When we say a message is "anonymous" we mean that its real author should not/cannot be connected with the text of the message. We could just as easily agree on an "Identify-Author:" header field by which authors could indicate whether or not they wished to be speaking "on the record" when they wrote the message. A multi-hop message where the "From:" line changes with each hop costs almost precisely what a multi-hop message would cost without the "From:" line changes. Folks feeling detail-oriented can calculate the cost of the CPU time to strip header information vs. the cost of sending that header information to the next hop. I don't care about the answer, so I'm not going to. Anonymous video conferencing is available now; go to Kinko's, pay cash for the use of their video conference room. Or, ask/convince the recipient to consider the conversation "off the record". Current remailer operators experience a cost in that they receive some amount of hassle and exposure to liability by running remailers; but this is merely a "cost" shifted from one person (the author) to another, the surrogate author. This may look like a cost of anonymity but it's more accurately described as the cost of being provocative or rude or illegal. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLw8j133YhjZY3fMNAQGB5QP9HCgA2QiHLPVupVgOeU/Tez5SH8Ie3ch3 nSJreSYl3a97blPr/aI1Yx577EQuCwrHoyZKWWpVc/8u728i10gTbJPbavzpDBOw i3JawSt4+d/tMWBfLzYHzdrVALIcTZeGnmLLbfgzWzzC8NUDsDG/ppDB7sDq2ktf NiwvDeQzoYk= =oU42 -----END PGP SIGNATURE-----

2 2

Re: Vinge's True Email name ?
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>Lou Poppler says: >> I knew that old compuserve account was good for something. >> They list Vinge, Vernor San Diego CA 72267.2656(a)compuserve.com > Of course, he might have used his true name because he wanted to hear from people. Tom Clancy seems to enjoy the newsgroup created to discuss his books and he posts there regularily. Many people strive to become famous because they love the adolation of the fans. Others don't. Who knows about VV?

4 3

Re: Latency Costs of Anonymity
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Wei Dai <weidai(a)eskimo.com> > [My idea for ATM mixes] > The problem here is that you'll have to do a RSA operation on EACH > packet. Pretty hard on the CPU... Yes, good point. It might be possible to use a stream model where the separate packets which make up a stream use the same conventional key. This allows the various packets which make up a stream to be identified as such by outsiders, but still if there are a large number of virtual streams going through the network at one time it should be possible to confuse the streams pretty well. ("I've got a crazy idea. Let's cross the streams!" -- Ghostbusters). Then you only need to do the RSA work at setup time, and you need a fast streaming cypher during the conversation. This is how the streaming-packet encryption models like IPSP or Netscape's SSL seem to work. > > I think it may be more useful rather than speaking of "true" anonymity > > to think of factor-of-N anonymity. This reflects the bandwidth costs. I > > would guess that, if you have a packet-based video converencing system, > > that today you could probably get factor-of-2 anonymity with custom > > hardware, and perhaps even more than that. > > I'm not exactly sure what you mean by "factor-of-N". I only used "true" > to distiguish it from "trivial" anonymity (such as using a pay phone). > Of course, anonymity, like security, can only be relative. By "factor-of-N" I meant anonymity where you can only pin the source of a message down to one of N possibilities. It appears to me that many of the costs will be a function of N. It will be relatively easier to cloak your source as one of say 50 possibilities than to make it any of one in a million. This is why I suggested that factor-of-2 anonymity would be the easiest. The DC-Net concept would allow two users to share a cryptographically strong pseudo-random stream, and each of them to XOR their video output with the random stream; then these modified outputs from each of them are themselves XOR'd together to produce the joint output. As long as only one sends at a time, the resulting stream is their output, but it is impossible for an outsider to determine which one is sending. The hardware requirements seem quite modest and perhaps would be adequate today even for video. > [My points about limitations on suitability of anonymity] > > This is all very true. I guess I'm just lamenting the loss of my ealier, > more naive dream that one day everyone will be anonymous (read > pseudonymous), and that physical and digital identities will be totally > seperate. I don't think we would really expect everyone to be anonymous all of the time. In our personal lives, with friends and family, it doesn't seem appropriate to expect anonymity (although my earlier quotes from Greg Bear's sci fi story suggest differently). But still I think that for people who desire it and are willing to pay the prices, anonymity would indeed be available in many or most electronic communications. So if that is your desire you should be able to achieve it. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLw9Q1xnMLJtOy9MBAQEhPwH+KSYD4KhA1HOUxqOzdb2WdMuq0i1XTFzH fKMnejTqlKVbFfEnQqfHukwKpH5nFpuN7towJ1o98aGqT1ACxbSjpQ== =2mxw -----END PGP SIGNATURE-----

1 0

carrol(
by m00012＠KANGA.STCLOUD.MSUS.EDU 17 Dec '03

17 Dec '03

What is wrong with this person? ban her if you can, that's my opnion.

4 3

Re: Too Much!
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 01:16 AM 1/7/95 -0500, L. Todd Masco wrote: >You might want to try reading it from NNTP, via c2.org or hks.net. You >can then use Kill files. At that point, isn't the mailing list simply becoming a newsgroup? For that matter, is there some reason that escapes me why it ISN'T a newsgroup? I suppose the proportion of net.kooks is higher in a newsgroup than a mailing list, but arguably we're ALL net.kooks here. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

Re: carrol(
by m00012＠KANGA.STCLOUD.MSUS.EDU 17 Dec '03

17 Dec '03

I would put her in my killfile, but I don't know if vms has a kill file capibility. I use my unix accounts for important email, and do not want to have to sift through the volume I get from the cypherpunks. Otherwise, given that the percentage of interesting posts is going down as a result of carrolann (and perhaps me too now), I think having an elite group capable of banning certain people is perfectly ethical. mike

1 0

cipher magazine
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Someone just gave me this URL. It's probably in the cyphernomicon already, but I had fun rooting around in here and thought I'd pass it around to those who haven't seen it yet. http://www.itd.nrl.navy.mil:80/ITD/5540/ieee/cipher/ Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

how to subscribe
by Jonathan Nelson 17 Dec '03

17 Dec '03

can someone please mail me where to post to get subscribed Jonathan Nelson a015880t(a)bcfreenet.seflin.lib.fl.us

1 0