- cypherpunks-legacy - lists.cpunks.org

Re: [Clips] Skype Use May Make Eavesdropping Passe
by coderman 16 Feb '06

16 Feb '06

On 2/16/06, R. A. Hettinga <rah(a)shipwright.com> wrote: > ... the fastest-growing technology for Internet calls appears to > have the potential to make eavesdropping a thing of the past. > ... > Luxembourg-based Skype > ... > Skype keys are 256 bits long - twice as > long as the 128-bit keys used to send credit card numbers over the > Internet. The security is much more than doubled - in theory, Skype's > 256-bit keys would take trillions of times longer to crack than 128-bit > keys, which are themselves regarded as practically impossible to break by > current means. > ... > Security experts are not completely convinced that Skype is as secure as it > seems, because the company hasn't made its technology open to review. In > the cryptographic community, opening software blueprints to outsiders who > can point out errors is considered to be the safest way to go. Because of > the complex mathematics involved, a properly designed cryptographic system > can be unbreakable even if its method is known to outsiders. > ... > Kurt Sauer, Skype's chief security officer, ... said Skype "cooperates fully with > all lawful requests from > relevant authorities." He would not give particulars on the type of support > provided. > ... > "What you and I are saying is much less important than the fact that you > and I are talking," Schneier says. "Against traffic analysis, encryption is > irrelevant." yeah, better than nothing, but how far do you trust a faceless corp peddling closed source warez? (same goes for Google, etc. the recent announcement to make zPhone open source is a big win IMHO) i'd love to see a high order analysis of these 256bit nonces used for keying skype. use of entropy on windoze has traditionally been pretty poor. my favorite example to date: http://lcamtuf.coredump.cx/newtcp/ - "Strange Attractors and TCP/IP Sequence Number Analysis" p.s. speaking of google, can we all agree they are well on the path of evil? logging all chats? multiple computer search? glad i only use gmail for public comms...

2 1

[Clips] Skype Use May Make Eavesdropping Passe
by R. A. Hettinga 16 Feb '06

16 Feb '06

--- begin forwarded text Delivered-To: clips(a)philodox.com Date: Thu, 16 Feb 2006 17:46:08 -0500 To: Philodox Clips List <clips(a)philodox.com> From: "R. A. Hettinga" <rah(a)shipwright.com> Subject: [Clips] Skype Use May Make Eavesdropping Passe Reply-To: rah(a)philodox.com Sender: clips-bounces(a)philodox.com <http://sfgate.com/cgi-bin/article.cgi?file=/n/a/2006/02/16/financial/f12423…> Skype Use May Make Eavesdropping Passe - By PETER SVENSSON, AP Technology Writer Thursday, February 16, 2006 (02-16) 12:42 PST NEW YORK, (AP) -- Even as the U.S. government is embroiled in a debate over the legality of wiretapping, the fastest-growing technology for Internet calls appears to have the potential to make eavesdropping a thing of the past. Skype, the Internet calling service recently acquired by eBay Inc., provides free voice calls and instant messaging between users. Unlike other Internet voice services, Skype calls are encrypted - encoded using complex mathematical operations. That apparently makes them impossible to snoop on, though the company leaves the issue somewhat open to question. Skype is certainly not the first application for encrypted communications on the Internet. Secure e-mail and instant messaging programs have been available for years at little or no cost. But to a large extent, Internet users haven't felt a need for privacy that outweighed the extra effort needed to use encryption. In particular, e-mail programs such as Pretty Good Privacy have been considered too cumbersome by many. And because such applications have had limited popularity, their mere use can draw attention. With Skype, however, criminals, terrorists and other people who really want to keep their communications private are indistinguishable from those who just want to call their mothers. "Skype became popular not because it was secure, but because it was easy to use," said Bruce Schneier, chief technology officer at Counterpane Internet Security Inc. Luxembourg-based Skype was founded by the Swedish and Estonian entrepreneurs who created the Kazaa file-sharing network, which has been the subject of several court actions by the music industry. Skype's software for personal computers is distributed for free. Members pay nothing to talk to each other over PCs but pay fees to connect to people who are using telephones. Skype software is also being built into cell-phone-like portable devices that will work within range of wireless Internet "hot spots." While still somewhat marginal in the United States, Skype had 75 million registered users worldwide at the end of 2005. Typically, 3 million to 4 million users are online at the same time. Skype calls whip around the Internet encrypted with "keys," which essentially are very long numbers. Skype keys are 256 bits long - twice as long as the 128-bit keys used to send credit card numbers over the Internet. The security is much more than doubled - in theory, Skype's 256-bit keys would take trillions of times longer to crack than 128-bit keys, which are themselves regarded as practically impossible to break by current means. "It is a pretty secure form of communication, which if you're talking to your mistress you really appreciate, but if Al Qaida is talking over Skype you have probably a different view," said Monty Bannerman, chief executive of Verso Technologies Inc. His company makes equipment for Internet service providers, including software that can identify and block Skype calls. Security experts are not completely convinced that Skype is as secure as it seems, because the company hasn't made its technology open to review. In the cryptographic community, opening software blueprints to outsiders who can point out errors is considered to be the safest way to go. Because of the complex mathematics involved, a properly designed cryptographic system can be unbreakable even if its method is known to outsiders. But according to Schneier, if Skype's encryption is weaker than believed, it still would stymie the kind of broad eavesdropping that the National Security Agency is reputed to be performing, in which it scans thousands or millions of calls at a time for certain phrases. Even a weakly encrypted call would force an eavesdropper to spend hours of computer time cracking it. Kurt Sauer, Skype's chief security officer, said there are no "back doors" that could let a government bypass the encryption on a call. At the same time, he said Skype "cooperates fully with all lawful requests from relevant authorities." He would not give particulars on the type of support provided. The U.S. Justice Department did not respond to questions about its views on Skype's encryption. Verso's Bannerman notes that Skype calls are decrypted if they enter the traditional telephone network to communicate with regular phones, so a conversation could be intercepted there. Skype does not reveal how many of its calls run on the phone network. "There are other ways of getting at the conversation than brute-force decryption of the hacking," Bannerman said. Schneier believes that eavesdropping on the content of calls is not as important to the NSA as tracking the calls, which is still possible with Skype. For instance, if a particular account were associated with a terrorist or criminal, it would be possible to identify his conversation partners. "What you and I are saying is much less important than the fact that you and I are talking," Schneier says. "Against traffic analysis, encryption is irrelevant." Steve Bannerman, vice president of marketing at Narus Inc. (he is unrelated to Verso's Bannerman), said his company's systems enable wiretapping of voice calls routed over the Internet, but not those from Skype. The most that Narus' technology, which is used by telecommunications carriers, can do is identify what type of Skype traffic - voice call, text chat or video conference - is being used, and record the scrambled data for law enforcement officials. From there, he said, "who knows what those guys can do?" ___ On the Net: A primer on public-key cryptography: www.rsasecurity.com/rsalabs/node.asp?id2165 -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _______________________________________________ Clips mailing list Clips(a)philodox.com http://www.philodox.com/mailman/listinfo/clips --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

addend dortmund may escritoire
by Donnell L. Workman 16 Feb '06

16 Feb '06

edmonton !summate oncommemorate somecarrot thechurchgo !roadblock butdutchman ,toothbrush !octave asavagery it'sleadsman be vacuous !colatitude asalvage itantedate aaccuse someammonia somealike notnewcomer butkeg andarturo it'scargill trybumptious somebellamy onbattlefield oraccessory onpam abushel theprocedural mayauschwitz orepochal notcrowley itreptilian seepolarograph notsanguine !

1 0

/. [Canadians To Douse Chinese Firewall]
by Eugen Leitl 16 Feb '06

16 Feb '06

Link: http://slashdot.org/article.pl?sid=06/02/16/0334232 Posted by: samzenpus, on 2006-02-16 04:33:00 [1]FrenchyinOntario writes "Researchers at a University of Toronto lab are getting ready to release a computer program called Psiphon, which will [2]allow Internet users in free countries to help users in more restrictive countries (like China, North Korea, Saudi Arabia, etc.) to access the Internet by getting past the firewalls and hosing "rubber hose cryptoanalysis" which is a drawback of other anti-firewall programs as it reveals a user's tracks if discovered by authorities. Operating through port 443, Psiphon will allow users in monitoring countries the ability to send an encrypted request for certain information, and for users in secure countries to send it back to them. The UofT's Citizen Lab hopes to debut Psiphon at the international congress of the free speech group PEN in May." References 1. http://www.deifyme.com/ 2. http://www.theglobeandmail.com/servlet/story/RTGAM.20060213.gtnetcops13/BNS… ry/Technology// ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

2 1

SafeNet to Buy nCipher?
by R. A. Hettinga 16 Feb '06

16 Feb '06

--- begin forwarded text Date: Thu, 16 Feb 2006 08:37:16 -0500 To: Philodox Clips List <clips(a)philodox.com> From: "R. A. Hettinga" <rah(a)shipwright.com> Subject: SafeNet to Buy nCipher? <http://www.techworld.com/blogs/index.cfm?blogID=1&entryID=144&printerfriend…> www.techworld.com : the UK's infrastructure & network knowledge centre Decrypting nCipher John Dunn February 16, 2006 Well done Alex van Someren, the cheery and mightily on-the-ball CEO and co-founder of Cambridge encryption company nCipher. News reached us last week that the company is in talks to be acquired by SafeNet for something around the $150 million mark. I say "encryption company" even though I know van Someren wouldn't like it to be pigeonholed in such a narrow manner. When the company was founded a decade ago by him and his brother, Nicko van Someren, encryption look like a geek's last refuge. Latterly, it has turned out to be a decent business as people have woken up to the fundamental power of the concept to stop the malevolent running off with the most valuable thing any company has in its possession - information. We understand that CEO Van Someren will not stay with the company though his brother - considered the engineering whiz - will. Does Alex have another company in him as some have speculated? We will see. Techworld interviewed him a while back, so judge for yourself. Another good company bites the dust or will SafeNet confound the law that seems to have ruled technology takeovers of recent years and take nCipher's intriguing technology onwards and upwards? -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

This star outlet has everything from allergy cures to wt.loss curatives.
by Suzamni 16 Feb '06

16 Feb '06

Got it, I go to this e-store, www.porpoise.wear.egfas.org/jpf/ all the time and from today on, your life is going to be easier. I know how hectic it's been for you since "it" began and I like to help you get the remedy now. The cure to ur issues is all here in this website I'm e-mailing you. Life is full of misc. things to get annoyed about. Mailing is on time and you'll know where your stuff is with their on line t racking. Suzamni

1 0

[some@list: Questions about the illegal wiretaps]
by Eugen Leitl 16 Feb '06

16 Feb '06

[from some@list] More answers: Andrew A. G**** wrote: >They *can*, but their typical infrastructure is not set up to handle >this. A system like this isn't maintenance-free. This list should know >that better than most. Besides, the intel has to output to a human >eventually. You can't just have a machine intercept a call, determine >that it's a threat and send out a Predator drone to kill the threat >without any human intervention. No, but NSA's job is just the first part of that. They don't target drones, or anything like that. >The FBI has said that they were swamped. How many man-hours were >involved in this in the FBI side? yes, this is definitely a cost. And the FBI finally said "enough"! I kinda wonder if this was due to miscommunication, and the FBI thought they were getting finished analytical product. >>> 3. According to the Washington Post, we had a backlog of >>> hundreds of thousands of hours of untranslated wiretaps. Do >>> we still have this backlog? >>Yes. >> >>> 4. What's the point of conducting wiretaps when we can't >>> translate them? >>None. > >That's pretty damning. This is how the Intelligence Community works. Collection is considered the A#1 task, and they are inveterate packrats. It's far easier to fill hard drives with junk than to make active use of it. Sad, but true. >>> 8. Why didn't you ask for more translators, knowing that FBI >>> Director Mueller asked that all urgent translations be done >>> in 12 hours? >>The unfortunate issue is not more translators, but more TS/SCI-cleared >>translators with an active Counterterrorism- and lifestyle-poly who >>are fluent in Arabic at level 4+ (nb: this is a VERY small set of >>individuals) > >This program's been running for something like three years. In that >time, couldn't that money have been used to encourage people to be >trained for this, and then actually train them? Well, realistically: no, probably not. The US is grieviously far behind in this. There is little or no chance in three years that someone who can pass the security screen can achieve the necessary language proficiency level in say, Dari or Uzbek, in 3 years -- meaning, good enough to translate, with decent accuracy and speed, colloquial, accented telephone chatter -- regardless of the amount of $ you throw at the problem. There are already a series of bonuses for military and civilian government employees who can pass language proficiency tests, so it isn't as though we aren't trying. >So the answer to a fuck-up is to make it a clusterfuck? I wasn't trying to justify it, just answer some of the questions you posed. I warned you they might not make sense when you received them :-) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Judge: Firm not negligent in failure to encrypt data
by R. A. Hettinga 15 Feb '06

15 Feb '06

--- begin forwarded text Date: Wed, 15 Feb 2006 18:38:13 -0500 To: Philodox Clips List <clips(a)philodox.com> From: "R. A. Hettinga" <rah(a)shipwright.com> Subject: Judge: Firm not negligent in failure to encrypt data <http://news.com.com/2102-1030_3-6039645.html?tag=st.util.print> CNET News Judge: Firm not negligent in failure to encrypt data By Declan McCullagh http://news.com.com/Judge+Firm+not+negligent+in+failure+to+encrypt+data/210… Story last modified Wed Feb 15 06:20:32 PST 2006 A federal court has thrown out a lawsuit that accused a student-loan provider of negligence in failing to encrypt a customer database that was subsequently stolen. Stacy Lawton Guin, a customer of Brazos Higher Education Service, sued the corporation on the grounds that encryption should be used as a routine security precaution. But U.S. District Judge Richard Kyle in Minnesota dismissed the case last week, saying Brazos had a written security policy and other "proper safeguards" for customers' information and that it acted "with reasonable care" even without encrypting the database. ID fraud help Identity fraud isn't that likely to happen to you, but it does occur. CNET News.com has compiled a resource center with background information, statistics, and tips. A recent debit-card theft case has also drawn attention, and in response we've created a list of frequently-asked questions. Security protection is also being discussed at this week's RSA Conference. The case arose as a result of a burglary at the Silver Spring, Md., home of John Wright, a Brazos financial analyst who worked remotely and analyzed loan portfolios. During that September 2004 burglary, a laptop with personal information about Brazos customers was stolen. Brazos hired a private investigative firm, Global Options, to recover the laptop, but this was unsuccessful. The judge noted that there was no evidence that the database on the stolen laptop was used for identity fraud. After the theft, Brazos contacted approximately 550,000 of its customers to let them know of the situation and to suggest they place a security alert on their credit bureau files. Even though he had not actually been harmed as a result of the theft, Guin argued, Brazos was required by the Gramm-Leach-Bliley Act to encrypt personal information and limit its disclosure. The 1999 law requires financial service companies "to protect the security and confidentiality of customers' nonpublic personal information." Judge Kyle disagreed, saying that the house was in a relatively low-crime neighborhood and that the law does not specifically mandate encryption. "The GLB Act does not prohibit someone from working with sensitive data on a laptop computer in a home office," Kyle wrote. "Despite Guin's persistent argument that any nonpublic personal information stored on a laptop computer should be encrypted, the GLB Act does not contain any such requirement." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[dave@farber.net: [IP] 325,000 Names on Terrorism List]
by Eugen Leitl 15 Feb '06

15 Feb '06

----- Forwarded message from Dave Farber <dave(a)farber.net> -----

1 0

[dewayne@warpspeed.com: [Dewayne-Net] Cellphone could crack RFID tags, says cryptographer]
by Eugen Leitl 15 Feb '06

15 Feb '06

----- Forwarded message from Dewayne Hendricks <dewayne(a)warpspeed.com> -----

1 0