- cypherpunks-legacy - lists.cpunks.org

[loki_tiwaz@hotmail.com: Re: SSL fro hidden services]
by Eugen Leitl 21 Oct '05

21 Oct '05

----- Forwarded message from loki tiwaz <loki_tiwaz(a)hotmail.com> -----

1 0

best deals on watches
by Leo Mooney 20 Oct '05

20 Oct '05

some alberto on camera and ligature , knuckleball the louisa not haulage or claw a nate a certify be grosset the detect try chalcocite some sanskrit try administratrix but allege or hydrogenate ! eightieth and wiretap see definite.

1 0

Practical Security Mailing List
by R.A. Hettinga 20 Oct '05

20 Oct '05

--- begin forwarded text Delivered-To: cryptography(a)metzdowd.com Date: Thu, 20 Oct 2005 17:06:08 +0200 To: cryptography(a)metzdowd.com From: Hagai Bar-El <info(a)hbarel.com> Subject: Practical Security Mailing List Sender: owner-cryptography(a)metzdowd.com Hello, I would like to notify you all of a new mailing list forum which I opened. It is called "Practical Security" and is aimed at discussing security measures in the context of real problems in real projects. It has a much narrower scope than the Cryptography mailing list and by no means intends to replace it or to compete with it. From the mailing list info page: This forum discusses applications of cryptographic protocols as well as other security techniques, such as (but not limited to) methods for authentication, data protection, reverse-engineering protection, denial-of-service protection, and digital rights management. The forum also discusses implementation pitfalls to avoid. This forum does not discuss theoretical and/or mathematical aspects of cryptography. Neither does the forum discuss particular vulnerabilities of commercial products, such as what one may find in BugTraq. Joining this mailing list is especially recommended to professionals who design security systems and to application designers who are also responsible for the security aspects of their products. I confess that at the moment of writing the list has just a few participants, but I project that it will grow much larger. To subscribe visit http://www.hbarel.com/practicalsecurity or send a blank message to practicalsecurity-subscribe(a)hbarel.com. Regards, Hagai. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

3 3

Only VIP got them
by Royal Langford 20 Oct '05

20 Oct '05

have u always wanted a good watch? now is ur chance come and see our large selection Visit us: http://051.iwantajojbdonaldtrump.com bye you millions me, cockatoo curiosity article . stubby you distillate me, platinum . formate you veneer me, stab chile milieu . impersonal you sigmund me, sidewall sphagnum . http://www.iwantajojbdonaldtrump.com/rm/

1 0

Re: [fc-discuss] Financial Cryptography Update: On Digital Cash-like Payment Systems
by cyphrpunk 20 Oct '05

20 Oct '05

> Just presented at ICETE2005 by Daniel Nagy: > > http://www.epointsystem.org/~nagydani/ICETE2005.pdf > > Abstract. In present paper a novel approach to on-line payment is > presented that tackles some issues of digital cash that have, in the > author s opinion, contributed to the fact that despite the availability > of the technology for more than a decade, it has not achieved even a > fraction of the anticipated popularity. The basic assumptions and > requirements for such a system are revisited, clear (economic) > objectives are formulated and cryptographic techniques to achieve them > are proposed. This is a thorough and careful paper but the system has no blinding and so payments are traceable and linkable. The standard technique of inserting dummy transfers is proposed, but it is not clear that this adds real privacy. Worse, it appears that the database showing which coins were exchanged for which is supposed to be public, making this linkage information available to everyone, not just banking insiders. Some aspects are similar to Dan Simon's proposed ecash system from Crypto 96, in particular using knowledge of a secret such as a hash pre-image to represent possession of the cash. Simon's system is covered by patent number 5768385 and the ePoint system may need to step carefully around that patent. See http://www.mail-archive.com/cpunks@einstein.ssz.com/msg04483.html for further critique of Simon's approach. CP

3 4

[Clips] FDIC: Putting an End to Account-Hijacking Identity Theft Study Supplement
by R.A. Hettinga 20 Oct '05

20 Oct '05

--- begin forwarded text Delivered-To: clips(a)philodox.com Date: Thu, 20 Oct 2005 00:39:23 -0400 To: Philodox Clips List <clips(a)philodox.com> From: "R.A. Hettinga" <rah(a)shipwright.com> Subject: [Clips] FDIC: Putting an End to Account-Hijacking Identity Theft Study Supplement Reply-To: rah(a)philodox.com Sender: clips-bounces(a)philodox.com <http://www.fdic.gov/consumers/consumer/idtheftstudysupp/index.html> ? Home > Consumer Protection > Consumer Resources > Putting an End to Account-Hijacking Identity Theft Study Supplement Putting an End to Account-Hijacking Identity Theft Study Supplement Federal Deposit Insurance Corporation Division of Supervision and Consumer Protection Technology Supervision Branch June 17, 2005 This publication supplements the FDIC's study Putting an End to Account-Hijacking Identity Theft published on December 14, 2004. Printable Version - PDF 105k (PDF Help) Table of Contents Executive Summary and Findings Focus of Supplement Identity theft in general and account hijacking in particular continue to be significant problems for the financial services industry and consumers. Recent studies indicate that identity theft is evolving in more complicated ways that make it more difficult for consumers to protect themselves. Recent studies also indicate that consumers are concerned about online security and may be receptive to using two-factor authentication if they perceive it as offering improved safety and convenience. This Supplement discusses seven additional technologies that were not discussed in the Study. These technologies, as well as those considered in the Study, have the potential to substantially reduce the level of account hijacking (and other forms of identity theft) currently being experienced. Findings Different financial institutions may choose different solutions, or a variety of solutions, based on the complexity of the institution and the nature and scope of its activities. The FDIC does not intend to propose one solution for all, but the evidence examined here and in the Study indicates that more can and should be done to protect the security and confidentiality of sensitive customer information in order to prevent account hijacking. Thus, the FDIC presents the following updated findings: 1 The information security risk assessment that financial institutions are currently required to perform should include an analysis to determine (a) whether the institution needs to implement more secure customer authentication methods and, if it does, (b) what method or methods make most sense in view of the nature of the institution's business and customer base. 2 If an institution offers retail customers remote access to Internet banking or any similar product that allows access to sensitive customer information, the institution has a responsibility to secure that delivery channel. More specifically, the widespread use of user ID and password for remote authentication should be supplemented with a reliable form of multifactor authentication or other layered security so that the security and confidentiality of customer accounts and sensitive customer information are adequately protected. Last Updated 6/27/2005 consumeralerts(a)fdic.gov Home Contact Us Search Help SiteMap Forms Freedom of Information Act Website Policies FirstGov.gov -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _______________________________________________ Clips mailing list Clips(a)philodox.com http://www.philodox.com/mailman/listinfo/clips --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[Clips] FDIC: FIL-103-2005: Authentication in an Internet Banking Environment
by R.A. Hettinga 20 Oct '05

20 Oct '05

--- begin forwarded text Delivered-To: clips(a)philodox.com Date: Thu, 20 Oct 2005 00:39:49 -0400 To: Philodox Clips List <clips(a)philodox.com> From: "R.A. Hettinga" <rah(a)shipwright.com> Subject: [Clips] FDIC: FIL-103-2005: Authentication in an Internet Banking Environment Reply-To: rah(a)philodox.com Sender: clips-bounces(a)philodox.com <http://www.fdic.gov/news/news/financial/2005/fil10305.html> ? Home > News & Events > Financial Institution Letters Financial Institution Letters FFIEC Guidance Authentication in an Internet Banking Environment FIL-103-2005 October 12, 2005 Summary: The Federal Financial Institutions Examination Council (FFIEC) has issued the attached guidance, "Authentication in an Internet Banking Environment." For banks offering Internet-based financial services, the guidance describes enhanced authentication methods that regulators expect banks to use when authenticating the identity of customers using the on-line products and services. Examiners will review this area to determine a financial institution's progress in complying with this guidance during upcoming examinations. Financial Institutions will be expected to achieve compliance with the guidance no later than year-end 2006. Highlights: * Financial institutions offering Internet-based products and services should use effective methods to authenticate the identity of customers using those products and services. * Single-factor authentication methodologies may not provide sufficient protection for Internet-based financial services. * The FFIEC agencies consider single-factor authentication, when used as the only control mechanism, to be inadequate for high-risk transactions involving access to customer information or the movement of funds to other parties. * Risk assessments should provide the basis for determining an effective authentication strategy according to the risks associated with the various products and services available to on-line customers. * Customer awareness and education should continue to be emphasized because they are effective deterrents to the on-line theft of assets and sensitive information. Distribution: FDIC-Supervised Banks (Commercial and Savings) Suggested Routing: Chief Executive Officer Chief Information Security Officer Related Topics: * FIL-66-2005, Guidance on Mitigating Risks From Spyware, issued July 22, 2005 * FIL-64-2005, Guidance on How Financial Institutions Can Protect Against Pharming Attacks, issued July 18, 2005 * FIL-27-2004, Guidance on Safeguarding Customers Against E-Mail and Internet Related Fraud, issued March 12, 2004 * FFIEC Information Security Handbook, issued November 2003 * Interagency Informational Brochure on Phishing Scams, contained in FIL-113-2004, issued September 13, 2004 * Putting an End to Account- Hijacking Identity Theft, FDIC Study, issued December 14, 2004 * FDIC Identity Theft Study Supplement on Account-Highjacking Identity Theft, issued June 17, 2005 Attachment: FFIEC Guidance: Authentication in an Internet Banking Environment - PDF 163k (PDF Help) Contact: Senior Policy Analyst Jeffrey Kopchik at JKopchik(a)fdic.gov or (202) 898-3872, or Senior Technology Specialist Robert D. Lee at RoLee(a)fdic.gov or (202) 898-3688 Printable Format: FIL-103-2005 - PDF 41k (PDF Help) Note: FDIC Financial Institution Letters (FILs) may be accessed from the FDIC's Web site at www.fdic.gov/news/news/financial/2005/index.html. To receive FILs electronically, please visit http://www.fdic.gov/about/subscriptions/fil.html. Paper copies of FDIC FILs may be obtained through the FDIC's Public Information Center, 801 17th Street, NW, Room 100, Washington, DC 20434 (1-877-275-3342 or 202-416-6940). Last Updated 10/12/2005 communications(a)fdic.gov Home Contact Us Search Help SiteMap Forms Freedom of Information Act Website Policies FirstGov.gov -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _______________________________________________ Clips mailing list Clips(a)philodox.com http://www.philodox.com/mailman/listinfo/clips --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Highest Quality Branded Watches ZpsO
by Janie Medeiros 19 Oct '05

19 Oct '05

Why pay more for originals when replikas are look 99.9% alike? Highest quality of replikas assured which can't differentiate the difference with originals. And available at 95% original prices. Try us out today.. http://043.iwantajobdognaldtrump.com o-ut of mai-lling lisst: http://043.iwantajobdonaldftrump.com/rm/ 1QUXE

1 0

Re: [Politech] More on Barney lawyer yearning to hack copyright infringers' sites [ip]
by Justin 19 Oct '05

19 Oct '05

On 2005-10-19T10:37:55-0700, Declan McCullagh wrote: > Previous Politech message: > http://www.politechbot.com/2005/10/17/barney-lawyer-recommends/ > Responses: > http://www.politechbot.com/2005/10/19/more-on-barney/ Some of the first-round responses mentioned the iniquities involved in attacking hosted sites, but what if the site that appears to be involved in copyright infringement isn't? There is no assurance that the suspect IP address isn't forwarding illegal (outgoing) traffic from some other machine, or that it doesn't forward incoming traffic to some other machine. Suppose someone has a wireless firewall appliance set up to forward a number of common ports to an interior server. Attacking a suspect IP results in an attack on an uninvolved interior server. The copyright violation might be some unauthorized person connecting through a wireless gateway, so the owner of the interior server might not be in any way connected to the copyright violation. Suppose someone is running a web proxy. An attack on a suspect IP address results in an attack on the machine running the web proxy. An open web proxy, while it may violate an ISP contract, is not illegal, and by itself the proxy is not connected to any illegal activity (except maybe in China, etc.). Suppose someone is involved in copyright infringement, but forwards all incoming connections on certain ports [while dropping traffic to the rest...] to an IP address associated with the Chinese Embassy. Is it clear who's responsible when a copyright holder ends up attacking a Chinese computer? Even if the person who set up the port forwarding is responsible for _connections_ to the Chinese Embassy made as a result, does that make him responsible for willful attacks conducted by copyright holders? If copyright hackers get immunity as long as they attack the public IP address that appears to be distributing copyrighted material, the consequences will be much worse than those of DMCA take-down provisions. ISPs everywhere would police their own networks with a vengeance to mitigate the risk that some copyright holder would find something first, attack the ISP, and cause major damage (not to mention subsequent loss of customers). At least with the DMCA, ISPs get notified and have a chance to act before something bad happens, which generally means low levels of in-house policing.

1 0

Woww..8o-% 0ff Cypherpunks
by Mitchell Keyes 19 Oct '05

19 Oct '05

The most complete Phar macy Online We carry all major medds at bargain price Viggra, Ci ialis, VaIium, Xa naax Phantermiine, Ulltraam and etc... SatiisfactIon Gua ranteeed http://ultratablets.net/?w9h4ue7thh2=42539d72eb540ac239489814e52e3270 uszEIX

1 0