- cypherpunks-legacy - lists.cpunks.org

Re: An attack on paypal --> secure UI for browsers
by lcs Mixmaster Remailer 14 Jun '03

14 Jun '03

Adam Shostack writes: > Actually, most of the features of Nogsuccob are features that I > want, like integrity protected, authenticated boot. The problem, > bundled with those features, is the ability of the system to attest to > its secure boot. This can be fixed by not letting the host know if > you've exported its host key or not, which makes it possible to run a > virtualized, trusted copy in your emulation environment. Nothing forces you to tell anyone else that you booted securely. At most someone may offer to give you something in exchange for such a proof, but you're not obligated to take them up on it. It's not clear what you're getting at about exporting the host key. These systems (TCs) are generally designed to make that difficult or impossible to accomplish. The security of the whole system is built on that assumption. If you actually did manage to pull out the host key then you could make it attest to any falsehood you wanted, although you might get caught eventually. Trusted Computing lets people convincingly tell the truth about what software they are running. This is seen as a horrific threat in certain circles. It's easy to see why liars wouldn't like it. What does an honest man have to lose?

4 3

Re: An attack on paypal --> secure UI for browsers
by Luthor Blisset 14 Jun '03

14 Jun '03

At 11:20 AM 6/14/2003 +0000, someone wrote: >Trusted Computing lets people convincingly tell the truth about what >software they are running. This is seen as a horrific threat in certain >circles. It's easy to see why liars wouldn't like it. What does an >honest man have to lose? The axiom "honest men have nothing to fear from the police" is currently under review at the Axiom Review Board. Thank you Terry Pratchett! If trolls like you weren't so easy to respond to, I'd just move on, but... Information about the software I'm running isn't anyone else's business. If someone wants to know about it, they can ask me, and under no circumstances am I obligated to tell them anything, much less what they want to hear. End of story. -- Luthor //Remembering is copying and copying is THEFT

2 1

Re: An attack on paypal --> secure UI for browsers
by Anonymous 13 Jun '03

13 Jun '03

The problem to be solved is this. Spoofed sites can acquire user credentials, especially passwords, and then use those to impersonate the user on the real sites. With paypal and e-gold, this allows stealing real money. Using client certificates to authenticate would solve this, because even if the user got fooled and authenticated to the spoofed site, the attacker wouldn't learn the client cert secret key and so would not be able to masquerade as the user. The problem (among others) is that this allows a virus to steal the client cert. If it is protected by a password, the malware must hang around long enough for the user to unlock the cert (perhaps because the malware sent a spoofed email calling for the user to visit the site, even the real site!). It can then read the user's keystrokes and acquire the password. Now it has the cert and password and can impersonate the user at will. The solution to this is Palladium (NGSCB). You'd want each ecommerce site to download a Nexus Computing Agent into the client. This should be no more difficult than downloading an Active-X control or some other DLL. The NCA has a manifest file associated with it that contains the ecommerce site's signing key. This allows the NCA to be effectively locked to that key. The user's site-specific client certificate would be sealed to this NCA. That means that no other NCA could get access to the client cert for that site, nor could any legacy software. All this is protected by the Palladium hardware and software. If a password is used for further security, to unlock the client cert (in addition to the NCA-specific encryption), it can use a secure channel to the NCA so that no keystroke loggers can steal the password. (However, as mentioned in a previous mail, this may not stop rogue NCA's from fooling the user by pretending to be the ecommerce site's NCA and picking up the password. It's not clear that adding a password really increases security. Fortunately the NCA security itself is already vastly stronger than anything available on a PC today.) In short, if Palladium comes with the ability to download site-specific DLLs that can act as NCAs, it should allow for solving the spoofed-site problem once and for all. When you login to paypal or e-gold, you would authenticate yourself using a cert that only those sites could see. This can be done in the framework of standard SSL, but would require a Palladium-aware browser.

5 4

Victory. Homeland Security Pulls the Plug On CAPPS II
by Bill Scannell 13 Jun '03

13 Jun '03

We Win! CAPPS II Testing Stops Pending Privacy Analysis See the victory statement at http://www.boycottdelta.org All the best, Bill Scannell Founder Boycott Delta

1 0

Spread Spectrum Image Steganography Patent
by John Young 13 Jun '03

13 Jun '03

The US Army today announced the availability of licensing of its patent for "Spread Spectrum Image Steganography:" http://cryptome.org/usa-patent.htm (with copy of the patent) Patent Abstract The Spread Spectrum Image Steganography (SSIS) of the present invention is a data hiding/secret communication steganographic system which uses digital imagery as a cover signal. SSIS provides the ability to hide a significant quantity of information bits within digital images while avoiding detection by an observer. The message is recovered with low error probability due the use of error control coding. SSIS payload is, at a minimum, an order of magnitude greater than of existing watermarking methods. Furthermore, the original image is not needed to extract the hidden information. The proposed recipient need only possess a key in order to reveal the secret message. The very existence of the hidden information is virtually undetectable by human or computer analysis. Finally, SSIS provides resiliency to transmission noise, like that found in a wireless environment and low levels of compression. Patent No.: 6,557,103 Granted: April 29, 2003 Inventors: Boncelet, Jr.; Charles G. (Newark, DE); Marvel; Lisa M. (Churchville, MD); Retter; Charles T. (Belcamp, MD) Assignee: The United States of America as represented by the Secretary of the Army (Washington, DC)

2 1

Israel's WMDs on MSNBC.COM
by Tyler Durden 13 Jun '03

13 Jun '03

Hey...just found out about msnbc.com's hidden page on WMDs, including bio, nuke, and chemical. Any way to push such a thing into a google cache? http://www.msnbc.com/news/wld/graphics/strategic_israel_dw.htm -TD _________________________________________________________________ Help STOP SPAM with the new MSN 8 and get 2 months FREE* http://join.msn.com/?page=features/junkmail

2 1

Re: Steganography and musical scores?
by Major Variola (ret) 13 Jun '03

13 Jun '03

(resent) At 11:44 AM 6/13/03 -0400, Peter Wayner wrote: >At 9:27 AM +0200 6/13/03, Thomas Shaddack wrote: >>See also something about computer-generated music: >>http://brainop.media.mit.edu/online/net-music/net-instrument/Thesis.html >> > > >I'm told someone is trying to encode information by ordering the >musical notes played in a chord with a Midi synthesizer. It's >possible to hide information in the order of a set using a technique >like this: > >http://www.wayner.org/books/discrypt2/sorted.php That's cute --there's no acoustic difference. There are also methods which produce nearly imperceptible differences --you can adjust the millisecond-scale timings, or the dynamics. Since these will vary with each performer's rendition anyway, they're fairly stealthy.

1 0

Steganography and musical scores?
by Thomas Shaddack 13 Jun '03

13 Jun '03

See also something about computer-generated music: http://brainop.media.mit.edu/online/net-music/net-instrument/Thesis.html ---------- Forwarded message ---------- Date: Fri, 13 Jun 2003 03:13:00 EDT Subject: Cryptography-Digest Digest #978 From: Digestifier <Cryptography-Digest-Request(a)senator-bedfellow.mit.edu> To: Cryptography-Digest(a)senator-bedfellow.mit.edu <irrelevant ones snipped>

2 1

Re: Steganography and musical scores?
by Tyler Durden 13 Jun '03

13 Jun '03

Well, of course there's the famous B-A-C-H that Bach encoded towards the end of Art of the Fugue, written right before he died. (H in Germany is the same as our B, I think, and B in Germany is our B-flat, but don't quote me, it may be the other way around.) There're tons of others in the history of Western music. I'd bet there's a book or two on the subject somewhere. -TD >From: Thomas Shaddack <shaddack(a)ns.arachne.cz> >To: cypherpunks <cypherpunks(a)lne.com> >Subject: Steganography and musical scores? >Date: Fri, 13 Jun 2003 09:27:20 +0200 (CEST) > >See also something about computer-generated music: >http://brainop.media.mit.edu/online/net-music/net-instrument/Thesis.html > > > >---------- Forwarded message ---------- >Date: Fri, 13 Jun 2003 03:13:00 EDT >Subject: Cryptography-Digest Digest #978 >From: Digestifier <Cryptography-Digest-Request(a)senator-bedfellow.mit.edu> >To: Cryptography-Digest(a)senator-bedfellow.mit.edu > ><irrelevant ones snipped> > >Subject: Historical Evidence or Possibility of Steganography in Music >From: Mark Lybrand <nunya(a)spamstopper.com> >Date: Fri, 13 Jun 2003 03:31:47 GMT > >I was wondering if anyone here might guide me to any reference material >regarding the possibility or actual occurrence of information having been >steganographically hidden in musical scores. > >If this is the wrong NG to post this to, please correct me. > >TIA > >Mark > >------------------------------ > >From: Richard Heathfield <dontmail(a)address.co.uk.invalid> >Subject: Re: Historical Evidence or Possibility of Steganography in Music >Date: Fri, 13 Jun 2003 06:26:02 +0000 (UTC) > >Mark Lybrand wrote: > > > I was wondering if anyone here might guide me to any reference material > > regarding the possibility or actual occurrence of information having >been > > steganographically hidden in musical scores. > >Sorry, I don't have any formal references for you about hiding information >in music. Nevertheless, I know it's happened, because I have done it >myself, in the mid-1980s. Not only that, but it survived a cryptanalytic >attack from somebody who was 99% sure that the music contained a message >but was unable to work out how that message was encoded. > >Some time in the 1990s, I read in good old Readers' Digest of a war-time >incident in which musical notation was used for encryption; this nearly got >a man killed when he was asked by the Germans to play the music. He was >able to shrug off the cacophony as "this modern music", and got away with >it. How true this account is, I don't know. > >I don't know why they didn't do what I did, which is to insert musical >padding into the score to maintain some semblance of melody. > >It's an expensive method of steganography, though, since you really do have >to compose your own tunes. The problem with saving time by using existing >scores is that their composition (if you will forgive the term) is public >knowledge, and so a comparison with the original will reveal the >significant differences. The only way around this is to prevent such a >comparison, and the only certain way to do that is to compose your own >tunes. > >You might be able to automate the padding, if your computer is soulful >enough. :-) > >-- >Richard Heathfield : binary(a)eton.powernet.co.uk >"Usenet is a strange place." - Dennis M Ritchie, 29 July 1999. >C FAQ: http://www.eskimo.com/~scs/C-faq/top.html >K&R answers, C books, etc: http://users.powernet.co.uk/eton _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

Re: SADISTIC WORLD Z.O.G. CONSPIRACY AT WORK IN VARKAUS, FINLAND!!
by Tyler Durden 13 Jun '03

13 Jun '03

"So as the conclusion I was punished by people of Finland after I had told them the truth,which was my job in the first place. I was hired to write my thesis on their business consolidation and I told the truth. As we know now today Ahlstrom Machinery does not exist any longer." Well, one things for sure. This guy ain't from the US. He actually seems suprised that some corporate bigwigs shut him down for putting roadblocks on their deal. Next he'll be writing in with the big revelation that, even though the company went down the crapper as a result of the deal, the deal-makers made out personally like bandits. Welcome to Capitalism, m'friend. -TD >From: Anonymous <nobody(a)remailer.privacy.at> >To: mail2news(a)anon.lcs.mit.edu, mail2news(a)dizum.com >CC: cypherpunks(a)minder.net >Subject: SADISTIC WORLD Z.O.G. CONSPIRACY AT WORK IN VARKAUS, FINLAND!! >Date: Fri, 13 Jun 2003 03:46:29 +0200 (CEST) > >------------------------------ BEGIN TRANSMISSION >------------------------------ > >From: Mark Saarelainen [cryptomjs(a)eudoramail.com] >Date: Thu, 12 Jun 2003 02:37:02 -0700 >To: cypherpunks(a)einstein.ssz.com >Subject: Please post this on the USENET : alt.politics.org.ciaforme .... >somebody tries t > >They stopped my USENET communication after I had told that my thesis on the >business consolidation of a foreign corporation in the North America was >100 % correct. I had told in 1991 that the consolidation of Ahlstrom >Machinery, Inc. (AMI) was a failure and unsuccessful. During the 1990s many >Ahsltrom Machinery's businesses were sold and the remaining parts were or >are to be sold to Andritz from Graz, Austria in 2003. I had told them the >truth in 1991 and I was punished by the executive management of AMI and >people spread bad stories about me and my thesis in 1991 although it was >graded as very good by one Professor. The Business Development Director of >Ahsltrom Machinery, Inc. even forced me to change my thesis tosome extent >by threatening to prevent me from graduating as the Masters of Science in >Industrial Engineering and Management in April/May, 1991. His name is >Markku Perkola. Itwas just my academic work.They had even told to my so >called birthmother that my thesis was! > no >t good, although it was graded as very good and as it is now concluded I >was 100 % correct and right. So my thesis was right and these people of >Ahsltrom Machinery and many people of Varkaus, Finland, just wanted to hurt >me and destroyed my careerat my age of 24 (12 years ago), when I had told >them the truth about the failing business operations of Ahsltrom Machinery >in the North America in 1991. > >So as the conclusion I was punished by people of Finland after I had told >them the truth,which was my job in the first place. I was hired to write my >thesis on their business consolidation and I told the truth. As we know now >today Ahlstrom Machinery does not exist any longer. > >Markku J. Saarelainen >Varkaus, Finland > >---- > >5/31/2003 > > Andritz acquires 50% of Ahlstrom Machinery Group - extension to >100% possible >Increase of sales by 50% to 1,000 million Euros > >Graz (Austria) based Andritz AG initially buys 50 per cent of the Finnish > >Ahlstrom Machinery Group. The acquisition became effective as of May >31, 2000, after obtaining the required permissions under anti-trust >laws. Ahlstrom Machinery Group's future company name will be Andritz- >Ahlstrom Corporation. Both Andritz and the Seller have options whose >exercise would make Andritz the sole owner of Ahlstrom Machinery >Group. > > > >Need a new email address that people can remember >Check out the new EudoraMail at >http://www.eudoramail.com > >------------------------------- END TRANSMISSION >------------------------------- _________________________________________________________________ MSN 8 with e-mail virus protection service: 2 months FREE* http://join.msn.com/?page=features/virus

1 0