- cypherpunks-legacy - lists.cpunks.org

American Service PKM Ven.
by ham＠montana.com 10 Mar '05

10 Mar '05

1 0

Re: SHA1 broken?
by Major Variola (ret) 09 Mar '05

09 Mar '05

At 09:23 PM 2/19/05 +0000, Dave Howe wrote: > I am unaware of any massive improvement (certainly to the scale of >the comparable improvement in CPUs) in FPGAs, and the ones I looked at a >a few days ago while researching this question seemed to have pretty FPGAs scale with tech the same as CPUs, however CPUs contain a lot more design info (complexity). But FPGAs since '98 have gotten denser (Moore's observation), pioneering Cu wiring, smaller features, etc.

4 7

Credit card fraud hits new high despite chip and PIN
by R.A. Hettinga 08 Mar '05

08 Mar '05

<http://www.timesonline.co.uk/printFriendly/0,,1-2-1516072-2,00.html> The Times of London March 08, 2005 Credit card fraud hits new high despite chip and PIN By Helen Nugent CREDIT and debit card fraud has soared to a record #500 million despite the introduction of new chip-and-PIN technology, it emerged today. Banks, credit card companies and shop owners hoped that the new technology would reduce fraud because a four-digit personal identification number is harder to reproduce than a signature. But far from deterring fraudsters, the new measures have encouraged criminals to steal more cards. Figures from Apacs (the Association for Payment Clearing Services) show that losses to thieves rose by 20 per cent last year, equivalent to #10 for every adult in Britain. An average of 100,000 credit and debit cards were posted to consumers every day last year. Many were intercepted by criminals, resulting in a 62 per cent rise - to #73 million - in "mail non-receipt" fraud. The sheer volume of cards sent out every day provided rich pickings for fraudsters who operate by getting their hands on plastic before it is received by the genuine customers. The banking industry says that it is working with Royal Mail to monitor card losses, identify fraud hot spots and take preventive action such as asking cardholders to collect new cards from their branch. But customers seem reluctant to pick up new cards in person. Card analysts claim that fraudsters doubled their efforts last year in the belief that chip and PIN would eventually act as an effective deterrent. Malcolm Bushell, managing director of Ingenico, Northern Europe, the world's biggest developer and supplier of chip-and-PIN technology, said: "The banks knew that 2004 would be a difficult year because fraudsters would want to fill their boots while they still could." But retailers and banks seem powerless to clamp down on credit card fraud. The theft of card details, which are then used to buy products over the phone, via mail order or over the internet - known as "card-not-present fraud" - continues to top the table of losses, soaring by 24 per cent to #150 million last year. Consumers duped by counterfeiters who illegally clone or skim cards lost nearly #130 million last year, a rise of 17 per cent. Fraud at cash machines, a favourite resort of thieves, grew at an alarming rate, up by 81 per cent to nearly #75 million Chip and PIN claims to be a sophisticated anti-fraud measure, yet there is no deadline for its implementation. Cards without the new technology are still being issued and of 141 million credit and debit cards in circulation, one in three are still the old signature-only type. Furthermore, 15 per cent of retailers have yet to install tills that accept PINs, even though retailers without chip and PIN in-store have been liable for fraudulent transactions since January 1 this year. The British Retail Consortium said: "This time next year, we should be in more of a position to see the impact that chip and PIN has had on card fraud." Many shops that have up-to-date tills still do not insist that customers use PINs to authorise transactions. "Fraudsters can disable the chip, for instance by smacking it with a hammer, and pay for goods using a signature," Mr Bushell said. "There is a case for saying that a signature should not be accepted." Apacs estimates that, without chip and PIN, losses would reach #800 million by the end of this year. But it accepts that the battle against fraudsters is still to be won. Sandra Quinn, its director of corporate communications, said: "The more of us use a PIN, the harder a criminal's life becomes. But clearly they will keep targeting cards. Many people have made predictions on where the fraudsters will attack next, but we have long foreseen that we need to keep cards secure in all environments." Card identity fraud rose by 22 per cent during 2004, according to Apacs. Credit reference agencies say that this alternative type of fraud is likely to grow even more if chip and PIN does prove successful. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: I'll show you mine if you show me, er, mine
by James A. Donald 08 Mar '05

08 Mar '05

-- > > However, techniques that establish that the parties share a > > weak secret without leaking that secret have been around > > for years -- Bellovin and Merritt's DH-EKE, David Jablon's > > SPEKE. And they don't require either party to send the > > password itself at the end. > They are heavily patent laden, although untested last time I > looked. This has been discouraging to implementers. There seem to be a shitload of protocols, in addition to SPEKE and DH-EKE A password protocol should have the following properties: 1. It should identify both parties to each other, that is to say, be secure against replay and man in the middle attacks, in particular, strong against phishing.. It should be secure against replay and dictionary attacks by an evesdropper or man-in-the-middle. Such an attacker should be able to no better than someone who just tries repeatedly to log on to the server with a guessed password 2. It should be as strong as practical against offline attacks by the server itself. The server operators, or someone who has stolen information from them, should not know the users password, and dictionary attacks should be sufficiently expensive that a strong password (not your ordinary password) is secure. Can anyone suggest a well reviewed, unpatented, protocol that has the desired properties? --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG A8bCmCXDTAX2Syg907T7uRpajs77l9CqLEii+ezP 42zQDcP3xJXtcLPSgCVa55kew+ALkrQ/I50PFm9lC

2 1

[>Htech] Tracking a Specific Machine Anywhere On The Net (fwd from eugen@leitl.org)
by Eugen Leitl 08 Mar '05

08 Mar '05

----- Forwarded message from Eugen Leitl <eugen(a)leitl.org> -----

3 2

Re: [linux-elitists] Re: MCI boots send-safe (Register) -- adds a net of 11 more spam hosts (fwd from kmself@ix.netcom.com)
by Eugen Leitl 08 Mar '05

08 Mar '05

----- Forwarded message from "Karsten M. Self" <kmself(a)ix.netcom.com> -----

1 0

AVOJ Dep.
by norwood＠pittsburg.com 08 Mar '05

08 Mar '05

1 0

ZipLip ends secure email service
by Steve Schear 08 Mar '05

08 Mar '05

"Thank you for using ZipLip's free secure mail service. We appreciate your patronage and wish to inform you that we will be discontinuing our service on June 30th, 2005. For various reasons, including new U.S. legislation which significantly impacts the individual's privacy rights, ZipLip is no longer able to provide its free secure email services with any reasonable assurance of privacy and security, particularly in the context of a hosted service. We will revisit the service issue when our legislature reinstates our privacy rights. Please make the necessary arrangements to use another Webmail service before June 30th. We are unable to offer any data migration services. We sincerely apologize for any inconvenience caused. " https://www.ziplip.com/ps/PmApp/zlp_dummy?mgc=1&NextPage=/app/services/en/r…

1 0

NSA specifies elliptic-curve crypto for security applications
by sunder 07 Mar '05

07 Mar '05

http://www.eet.com/sys/news/showArticle.jhtml?articleId=60404977 NSA specifies elliptic-curve crypto for security applications By Loring Wirbel , EE Times <http://www.eetimes.com/;jsessionid=3J52X3FMWO51MQSNDBGCKHSCJUMEKJVN> March 03, 2005 (10:22 AM EST) URL: http://www.eet.com/article/showArticle.jhtml?articleId=60404977 <http://www.eet.com/article/showArticle.jhtml;jsessionid=3J52X3FMWO51MQSNDBG…> <SNIP> Last October, the agency referred to ECC as one of the few public-key systems that could meet equivalent security standards to the private-key AES. NSA (Fort Meade, Md.) is recommending a series of algorithms called "Suite B" for securing sensitive and unclassified data. Suite B includes Elliptic-Curve Menezes-Qu-Vanstone and Elliptic-Curve Diffie-Hellman for key agreement, along with the Elliptic Curve Digital Signature Algorithm for digital signatures. AES and Secure Hashing Algorithm also are included in Suite B.

1 0

Independent URUD
by waddell＠fairfax.com 07 Mar '05

07 Mar '05

1 0