- cypherpunks-legacy - lists.cpunks.org

Re-finance before rates skyrocket
by Jasmine Dawson 01 Mar '06

01 Mar '06

1 0

Mortagge ratee approvedd
by Simon Lara 01 Mar '06

01 Mar '06

1 0

Your account #63519911
by Hope Mcgraw 01 Mar '06

01 Mar '06

1 0

Low mortagge ratee approvall
by Kristy Middleton 01 Mar '06

01 Mar '06

1 0

Pre-approved Application #49947114 Wed, 01 Mar 2006 02:55:31 -0600
by Dalton Marcum 01 Mar '06

01 Mar '06

1 0

Low mortagge ratee approvall
by Angel Castillo 01 Mar '06

01 Mar '06

1 0

increase in sexual desire
by Nestor Helton 28 Feb '06

28 Feb '06

Carefully chosen herbal ingredients are the key to peniis enlargement success. Not only the precise blend of ingredients but also many other factors have effect on the overall potency and strength of peniis enlargement formula. Some of these factors include growing conditions, geographical location where herbs are grown, harvest time, the way herbs are stored before processing, the way herbs are processed. http://cghabfil.fastpan.info/?dejkmabfilxwqowycghzpp 7i6

1 0

Qualities Pharrmacy YqP
by Dorothea Dodson 28 Feb '06

28 Feb '06

Best offer of the month: Viggra - $76.95 Ci ialis - $98.95 VaIium - $104.95 Xa naax - $120.95 Phantermiine - $106.95 Cod-deine - $111.95 Only for limiited time.. http://uk.geocities.com/cristiano90236juanita50500/ 6RwbW2

1 0

Fwd: Abridged -> Financial Cryptography Update: Identity on the move II - Microsoft's "Identity Metasystem" TM, R, Passport-redux
by coderman 28 Feb '06

28 Feb '06

user centric identity management is coming. big improvements here but i'm going to dismiss it by saying the InfoCard system is still managed by a huge proprietary code base mired in an ecosystem of vulnerability. the rootkits of the future will simply be hooking into userspace to steal data off the pages you use to communicate over InfoCard secured sessions back to your bank. (see the Haxdoor rootkit as an example of this) ---- https://www.financialcryptography.com/mt/archives/000666.html ... That aside, what is this InfoCard? Well, that's not spelt out in so many words as yet: """ In the client user interface, each of the user's digital identities used within the metasystem is represented by a visual "Information Card" (a.k.a. "InfoCard", the source of this technology's codename). The user selects identities represented by InfoCards to authenticate to participating services. The cards themselves represent references to identity providers that are contacted to produce the needed claim data for an identity when requested, rather than claims data stored on the local machine. Only the claim values actually requested by the relying party are released, rather than all claims that the identity possesses (see Law 2). """ ... Now we come to the user-centric part of the InfoCard system: """ 2.7. Authenticating Users to Sites InfoCards have several key advantages over username/password credentials: * Because no password is typed or sent, by definition, your password can not be stolen or forgotten. * Because authentication is based on unique keys generated for every InfoCard/site pair (unless using a card explicitly designed to enable cross-site collaboration), the keys known by one site are useless for authentication at another, even for the same InfoCard. * Because InfoCards will resupply claim values (for example, name, address, and e-mail address) to relying parties that the user had previously furnished them to, relying parties do not need to store this data between sessions. Retaining less data means that sites have fewer vulnerabilities. (See Law 2.) """ What does that mean? Although it wasn't mentioned there, it turns out that there are two possibilities: Client side key generation and relationship tracking, as well as "provider generated InfoCards" written up elsewhere: """ Under the company's plan, computer users would create some cards for themselves, entering information for logging into Web sites. Other cards would be distributed by identity providers -- such as banks or governmental agencies or online services -- for secure online authentication of a person's identity. To log in to a site, computer users would open the InfoCard program directly, or using Microsoft's Internet Explorer browser, and then click on the card that matches the level of information required by the site. The InfoCard program would then retrieve the necessary credentials from the identity provider, in the form of a secure digital token. The InfoCard program would then transmit the digital token to the site to authenticate the person's identity. """ Obviously the remote provision of InfoCards will depend on buy-in, which is a difficult pill to follow as that means trusting Microsoft in oh so many ways - something they haven't really got to grips with. But then there are also client-generated tokens. Are they useful? If they have client-side key generation and relationship caching, then these are two of the missing links in building a sustainable secure system. See my emphasis further above for a hint on relationship tracking and see Kim Cameron's blogfor this comment: "Cameron: A self-issued one you create yourself." Nyms (as per SSH and SOX) and relationship tracking (again SSH, and these days Trustbar,Petname and recent other suggestions) are strong. These ideas have been around for a decade or more, we call it opportunistic cryptography as a school. Alternatively, notice how the credentials term is slipped in there. That's not how Stefan Brands envisages it (from Identity on the move I - Stefan Brands on user-centric identity management), but they are using his term. What that means is unclear (and see Identity on the move III - some ramblings on "we'll get it right this time, honest injun!" for more). Finally, one last snippet: """ 3.6. Claims != "Trust" A design decision was to factor out trust decisions and not bundle them into the identity metasystem protocols and payloads. Unlike the X.509 PKIX [IETF 05], for example, the metasystem design verifies the cryptography but leaves trust analysis for a higher layer that runs on top of the identity metasystem. """ Hallelujah! Trust is something users do. Crypto systems do claims about relationships.

1 0

The vice president can't handle a gun
by Rubin M. Broussard 28 Feb '06

28 Feb '06

spheroid incometary seeeratosthenes theteletype butcombinate butaudubon indiscreet atwenty mayalumni and acorn maydjakarta tryoctillion andamateurish seebelshazzar somewilt seeturmoil someabsolve somecerebral ,emulate orbamberger theaback aberman notimpolitic try

1 0