- cypherpunks-legacy - lists.cpunks.org

Anguilla on $1000 a Day
by R.A. Hettinga 26 Feb '05

26 Feb '05

<http://travel2.nytimes.com/2005/02/27/travel/27high.html?8td=&pagewanted=pr…> The New York Times February 27, 2005 HIGH LOW High: Anguilla on $1000 a Day By JULIET MACUR N hour after arriving on Anguilla in early January, I was soaking in the hot tub at an exclusive resort, sunglasses on, eyes closed, sun warming my pasty Northeastern face. Ah, Anguilla, a quiet island that has recently become "the next St. Barts," a hedonistic hideaway and magnet for members of the boldface set. At the northeast corner of this narrow isle, Jennifer Aniston and Brad Pitt spent New Year's in a villa on Captain's Bay. On its southwestern coast, Jay-Z and Beyonci had cuddled on the sands of Shoal Bay West. Down the beach from my resort, Uma Thurman had kicked back at a local bar. Just as I began to imagine that I, too, was a star on an escape-the-paparazzi trip, reality interrupted. A foreign object crashed into my hot tub and sent water slapping against my face. A small boy and his father were throwing a ball wildly. The father's next toss bounced off the boy's head and against a woman's forehead. The father laughed. The woman smiled. I growled and thought, "This doesn't happen to Jennifer Aniston." I left in a huff because I had no time for distractions. This was serious business: I had to figure out how to get by on $1,000 a day. Though Anguilla is a relatively undeveloped island where goats might outnumber residents, $1,000 a day at a chic resort amounts to roughing it. At the Cap Juluca resort, the cheapest room in high season cost $936 a night, including the 20 percent tax. Malliouhana Hotel offered a garden view room on the first floor for $744. If my best friend, Rose, and I were to eat, drink and even think of going to the spa on my $1,000-a-day budget, the only high-end resort I could afford was the CuisinArt Resort and Spa, which sits near the island's southwestern end on Rendezvous Bay's beach, one and a half miles of flour-soft sand, blindingly white. The turquoise ocean water was as clear as Evian, and you could see fish near the sea floor. The cheapest rate, $550 plus $110 tax - but including Continental breakfast - would allow us to pretend we belonged at this beautiful place. The resort's grounds were simple and elegant. Eggplant-colored bougainvillea climbed the whitewashed stucco buildings that looked as if they had been plucked from a Greek cliff. In a nearby garden were trees heavy with guavas, fig bananas and star apples. As we looked from the lobby onto a series of rectangular pools cascading to the beach, a receptionist said we had been upgraded from the main house to a suite in one of the 10 three-story villas clustered along the shore. "We hope you don't mind," she said, unaware that I was a journalist. No, we didn't, and certainly not after seeing the room. The upgrade, to a junior suite that would have cost $120 more a night, allowed us to hear waves from our patio. Our "suite" was a cheery, not fancy, single room, but at 920 square feet was nearly as big as my Manhattan apartment. A navy couch broke up the space into sleeping and lounging areas. Two double beds with wicker headboards faced the porch and a walkway to the beach. Paintings of Greek fishing villages and bright bedspreads splashed color against the white walls and tile floors. A brochure called the bathroom "your own private sanctum," large enough for an oval tub for a honeymooning couple's bubble bath. But nothing was that private, considering one wall was made of warped glass. While on the outside walkway one day, I gasped when I saw a fuzzy version of Rose heading for the shower. At the resort's free reception on our first night (with food and drink), the manager, Rabin Ortiz, told us, "Do not make plans for your weekend." We quickly learned why. There are no plans to make because, on Anguilla, there is basically nothing to do. And that's the point. At CuisinArt, stay away from the main pool (where ball-tossing children congregate). Instead, sit on the beach and take delivery of homemade lemon sorbet from waiters whose goal is to fill you with fruity rum drinks. After sundown, submit to spa treatments like the Anguillan coconut pineapple scrub, which smells good enough to eat, and the hydroponic cucumber and aloe wrap, using ingredients grown on the premises. Night life is minimal. (At 10:30 on Saturday night, only one couple was at our resort's bar, where a trio sang "Endless Love.") Sea kayaks, sailboats, catamarans and tennis courts were available and mostly unused. For casino or dance club action, it's a half-hour ferry ride to St. Martin. Still, after too many games of boccie and gin rummy - or perhaps not enough gin and rum - we searched for some fun. Down the beach was Dune Preserve, a delightfully mellow bar inside a wooden shack owned by the local reggae legend Bankie Banx. A CuisinArt bartender said that Uma had been there the night before. We followed the shoreline to get there. But then, as if the local gods ordered punishment for all $1,000-a-day cheapskates, two stray dogs charged us in the darkness. We couldn't see them, but they barked and snapped like rabid Rottweilers, sending us running back to CuisinArt. So much for Uma. Cowards that we were, we rented a car the next day for $55 (including $20 for an Anguillan license) and that night drove 60 seconds to Dune Preserve, only to realize we were too full for a drink. Because, on Anguilla, what you do is eat - often. Our gluttony had begun at Santorini, which, like CuisinArt's other heavenly restaurant, Cafe Mediterraneo, uses food grown in the resort's high-tech hydroponic garden or its old-school organic one. There, Rose and I went to a class led by CuisinArt's executive chef, Daniel Orr, formerly a chef at Guastavino's in New York City. Neither of us is a great cook. (My fridge at home contains two bottles of seltzer, nail polish and AA batteries.) But we are great eaters. We stuffed ourselves with a tangy serving of stingray, a dizzyingly delicious chocolate souffli and yellow lentil bisque so good we were tempted to lick our bowls. Afterward, I was shocked at the $75 charge, well over the advertised $55 I had budgeted (it had just gone up). I next heard my whiny voice telling the concierge: "You don't understand. I cannot afford this extra $20." The concierge rolled her eyes, but, hey, I needed $110 for the seaweed scrub later. That evening, we took a cab ($13 each way) to dinner at Blanchard's, a top-notch restaurant in a quaint cottage. Most of the 23 tables were arranged on the main floor, but we sat on a lower patio overlooking fountains and gardens and the sea beyond. The only disappointments were the rubbery lobster included in the $56 Caribbean Sampler and the waiters' rushing us through the meal. Total for my dinner: $110.40. Perhaps the management could sense that we were not the stars of our imaginations. I asked the man at the bar if any real stars came in. He reeled off names of those who had been there "just yesterday": Denzel Washington. Johnny Damon. Liam Neeson and his wife, Natasha Richardson. Courteney Cox Arquette. And, of course, Jennifer Aniston. The next day, though it was dry season, it poured. So on that rainy Sunday we rented a car and checked out Anguilla, which didn't take long. It is only about 16 miles long and 3 miles wide. We found it pleasingly devoid of cheesy T-shirt shops and fast-food joints but plentiful with road-roaming goats and the smiling people who own them. We lunched at Gorgeous Scilly Cay, a primitive restaurant on a tiny island off the northeastern coast. With no electricity, it's open only from 11 a.m. to 5 p.m. To get there, you stand on a dock and hail a boatman. Normally, patrons sun themselves there on lounge chairs between courses, and get foot rubs from the restaurant's masseur, said the owner, Sandra Wallace. But not on this rainy day. On the boat over with us, she wore a garbage bag to stay dry; the masseur stayed home. Still, a calypso band played upbeat music in the main house, which had about a dozen tables and was open on all sides. Outside, there were several palm-covered huts, each with a few plastic tables and chairs, where I ordered the crayfish and chicken plate for $45, as sweet as their rum punch was dangerous. My lunch, with tip, came to $74. We found no famous people there, either - we were managing to repel them - though we did hear that Sharon Stone had recently rented out the whole island. And Jennifer Aniston (her again) had been there the week before. That evening, I had my second treatment at the Venus Spa - a place without much character or Zen - at CuisinArt. (In the thumbnail-size locker room, I awkwardly rubbed elbows with someone's naked grandmother.) The Caribbean warm stone massage ($115, plus $22 tip) was a step up from the seaweed wrap of the day before - better called the seaweed chill. That one began with me shivering in the treatment room. The masseuse said, "If I told them once, I told them 20 times, this room is freezing." Then she spread cold seaweed gook over my goose bumps. I groaned while she mummified me with towels. Under those coverings, wrapped inside foil, I felt like a hypothermia patient. But relief came with the warm stone massage. As the smooth rocks rolled over my muscles it felt oddly soothing, as if I were being seared by a giant stick of roll-on deodorant. I felt so much at ease that later I splurged on a smoothie for Rose, at $8.05 the only thing I could afford to buy her all weekend. When the sun came out on our last day, I passed the hot tub and saw that same annoying family with their dreaded ball, this time being tossed between two strollers. So I headed for the beach. I bobbed around the water for a while, then moved my peaceful self to a lounge chair. There I sipped on my own smoothie until it was time to get back to the real world by way of the St. Martin airport. At a terminal newsstand, I finally saw Jennifer Aniston - on a magazine cover. How terrible - her Anguillan experience included suffering greater than my seaweed chill - she and Brad had broken up. "Hey lady!" the cashier yelled. "Did you see the sign? You can't read the magazines until you buy them!" What, she thought I looked rich? I had already spent my $2,000. So I dropped the $3.95 magazine onto the shelf and walked away. TWO-DAY TOTAL: $2,000.35 Visitor Information Getting There Several United States airlines run flights to Anguilla, but most operate in connection with other carriers. Most flights go through San Juan, and the cheapest fares (from about $646 round trip for late March) can require an additional connection in St. Martin. If you fly into St. Martin (from about $561 round trip), you can take a 20-minute ferry to Anguilla ($24 round trip plus $2.75 departure tax from St. Martin and $3 from Anguilla). Ferries run every half hour from 7:30 a.m. to 7:30 p.m. Where to Stay Cap Juluca, (888) 858-5822, www.capjuluca.com, is tucked away on the secluded beach at Maunday's Bay, making it a favorite hideaway for celebrities. Doubles start at $780 a night in the high season, from $445 in April, and $345 from May 1 through mid-November. (Add 20 percent in taxes to all rates.) Malliouhana Hotel and Spa, (264) 497-6111, www.malliouhana.com, is the perfect place to see an Anguillan sunset: it sits atop a cliff facing west over the crystal blue waters of Mead's Bay. Doubles start at $400 from April 1 to 30, and $290 from May 1 to Nov. 19; ocean-view one-bedroom suites are $825 and $660. CuisinArt Resort and Spa, (264) 498-2000, www.cuisinartresort.com, is perched on Rendezvous Bay. Rooms start at $550 a night from January through March, $395 in April, and $350 from May 1 to mid-December. Lloyd's Guest House, (264) 497-2351, www.lloyds.ai, has 14 rooms on Crocus Hill, in walking distance of Crocus Bay. The spacious rooms, some recently renovated, go for $65 to $85, with breakfast. Where to Eat Blanchard's, (264) 497-6100, www.blanchardsrestaurant.com, has a romantic setting overlooking Mead's Bay, and serves food with a Caribbean flair. >From mid-October through May, it opens for dinner at 6:30 p.m. and is closed Sunday. June through August, it is closed Sunday and Monday. Closed Sept. 1 to Oct. 20. Entrees from $34. Gorgeous Scilly Cay, (264) 497-5123, is an open-air restaurant on its own island, with free ferry service from Island Harbor. It is open on Wednesday, Friday and Sunday 11 a.m. to 5 p.m. Since there is no electricity, all food (chicken or seafood) is grilled. Live music on Wednesday and Sunday. Entrees start at $25. Roy's Place, (264) 497-2470, www.roysplaceanguilla.com, is a charming beachcomber's joint overlooking Crocus Bay, with a lively beach bar and an Internet connection for guests (including wireless). There is a Friday happy hour with dinner specials for $12. The Sunday specials are prime rib ($20) and lobster ($38). Lunch and dinner served daily, except dinner only on Saturday. English Rose, (264) 497-5353, a tavern in the central business district of The Valley, serves generous portions of comfort food at reasonable prices: burgers from $4, salads from $6. Closed Sunday. Tasty's Restaurant, (264) 497-2737, offers chic-casual Caribbean dining in South Hill: dishes like stewed creole-style lobster for $30, and coconut-crusted filet of parrot fish in banana rum sauce for $20. Open for breakfast, lunch and dinner daily, except Thursday. Trattoria Tramonto, (264) 497-8819, has open-air dining and a beach bar on one of the island's prettiest beaches, Shoal Bay West. The Italian menu emphasizes game and seafood, including wild boar filet mignon ($35) and spaghetti with crayfish, clams and shrimp ($30). Lunch and dinner except Monday. Uncle Ernie's, (264) 497-3907, is a quintessential beach shack on Shoal Bay East; open 9 a.m. to 7 p.m. What to Do Taino Wellness Center, off Spanish Town Road, South Hill, (264) 497-6066, www.magma.ca/~phwalker/, offers massages (from $40 for 30 minutes), manicures and pedicures (from $15), facials (from $50), and body treatments. Devonish Art Gallery, the Cove, West End, (264) 497-2949, shows works of local artists, including those by Courtney Devonish, a woodcarver and ceramicist. Open 9 a.m. to 5 p.m. Monday to Saturday or by appointment Sunday. Horseback riding with El Rancho del Blues in Blowing Point, (264) 497-6164 or 497-6334, starts at $25 an hour. JULIET MACUR is a sports reporter for The Times. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Bank of America: 1.2 million federal employee credit cards exposed
by R.A. Hettinga 26 Feb '05

26 Feb '05

<http://www.time.com/time/nation/printout/0,8816,1032140,00.html> Time Magazine Friday, Feb. 25, 2005 A New Cyber-Security Breach Bank of America says at least 1.2 million federal employee credit card accounts may be exposed to theft or hacking By TIMOTHY J. BURGER Try 4 Issues of TIME magazine FREE! In the financial world's latest cyber-identity crisis, Bank of America today is warning the holders of at least 1.2 million of its federal employee credit card accounts that a major security breach may have left their account information exposed to theft or hacking, according to a senior U.S. official and Bank spokeswoman. The U.S. official said that federal law enforcement is investigating the loss of several Bank of America data backup tapes that were being transferred across country by air when they disappeared in December. "We are proactively sending letters to impacted cardholders," said Alexandra Trower, spokesperson for Charlotte-based Bank of America. She said that after intensive account-monitoring, the tapes are at this point believed to be lost, not stolen. "We, with federal law authorities, have done a very robust, thorough investigation on this and neither we nor they would make the statement lightly that we believe those tapes to be lost," she said. "We have no evidence that the tapes have been accessed in any way. We have witnessed no unusual activity. And we've been monitoring the situation very closely." The U.S. official said a large percentage of the accounts are for the Pentagon but that some 40 federal agencies and other entities are affected. Some of the tapes related to non-federal card-holders, the official added. Trower would not comment on which agencies are affected, referring questions to the General Services Administration. A GSA spokesperson had no immediate response to an inquiry about the matter, including whether any of the Pentagon's billions of dollars in secret "black" programs could be affected. Pentagon spokesman Bryan Whitman said the data loss includes files on 900,000 of the Pentagon's three million or so military and civilian workers. "It is a significant number of the Department's employees," he said, declining to say whether it affected any who are working undercover. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

When paying with plastic, why swipe? Just wave
by R.A. Hettinga 25 Feb '05

25 Feb '05

<http://news.zdnet.com/2102-9588_22-5589512.html?tag=printthis> ZDNet News By Alorie Gilbert URL: http://news.zdnet.com/2100-9588_22-5589512.html Tired of having to swipe and sign every time you use a credit card? Visa is hoping to simplify the process of paying with plastic with a new payment technology it introduced Thursday. With the company's new "contactless" system, consumers need only wave credit and debit cards within a few inches of a reader to complete a purchase. And for purchases of less than $25, no signature is required. The technology will be more convenient for merchants and consumers alike by reducing checkout times and lines, Visa executives said. It's also designed to be an easy alternative to cash for small purchases such as a soda or pack of gum. "Our hope is that the contactless payment feature will drive added convenience and speed to consumers," said Niki Manby, vice president of market and technology innovation at Visa USA. "You no longer need to swipe or hand over your card." But don't go waving your credit and debit cards around just yet. Visa must first convince merchants and card issuers to use new equipment. For merchants, that means purchasing new card readers. For banks, it means introducing special cards capable of transmitting account data via radio signal rather than magnetic stripe. So far, no card issuers are offering them, Manby said. With 5.6 million merchants in the United States, Visa will need some time to phase out its old system. "It's not something retailers will do lightly overnight," said Pennie Gillespie, a Forrester Research analyst. Visa is not alone in the endeavor. MasterCard and American Express also are experimenting with contactless cards. MasterCard has been doing field tests in Florida, while American Express is doing trials in Arizona and New York. The companies are using compatible technology, so merchants can use the same card readers for all three systems. Merchants just need to install an extra bit of software to make it all work together, said Patrick Gauthier, senior vice president of new product development at Visa. Visa and its rivals have some obstacles to overcome before the technology becomes more mainstream, Gillespie said. Not only must they convince merchants to buy new readers, they must assure consumers that the new-fangled cards are every bit as secure as the old ones in an age of identity theft and high-tech hacking. "Security is a question," Gillespie said. "How easy is it for someone to interact with a wireless communication and pick up a number?" Visa designed its system to be highly secure, with multiple layers of encryption and fraud detection, Gauthier said. Each transmission between card and reader has a unique code that cannot be reused even if it is intercepted, a key security feature, he said. In addition, consumers have no liability for fraudulent charges with the new cards as with the old ones, Gauthier added. "Security is at the core of our business," Gauthier said. "We are fully confident that the platform we have developed is as secure as any form of Visa cards today." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

China walks out of wireless LAN security talks
by R.A. Hettinga 25 Feb '05

25 Feb '05

Time to put on the tinfoil hats and impute conspiracy to what is more probably, as Pournelle once observed, incompetence... Cheers, RAH ------- <http://www.commsdesign.com/printableArticle/;jsessionid=BDGFNBFMHFOX0QSNDBC…> China walks out of wireless LAN security talks Patrick Mannion Feb 24, 2005 (12:26 PM) MANHASSET, N.Y. - China walked out of a wireless standards meeting this week, accusing the International Organization for Standardization of favoring the IEEE's 802.11i ANSI-certified wireless LAN security scheme over its own controverisal proposal, EE Times has learned. The gambit came after China's Wireless Authentication and Privacy Infrastructure (WAPI) security scheme was withdrawn and placed on a slower track by the ISO. This week's meeting in Sulzbach, Germany, included the ISO/IEC JTC1 SC6 WG1 working group created to resolve the dispute. China initially agreed last year to refrain from making its WAPI security scheme mandatory for wireless LAN equipment in China. It then approached ISO with a fast-track submission in an effort to make WAPI an international security standard. The 802.11i proposal is also on the fast-track for ISO approval, possibly by April. Until this week, the ISO group was focused on whether or not both 802.11i and WAPI should be cemented as enhanced - but optional - security standards. However, sources said tempers flared when China's original fast-track submission, designated 1N7506 of China National Standard GB15629.11 (WAPI), was withdrawn from consideration. It was replaced by a revised submission, designated 6N12687, that removed the China proposal from the organization's fast-track approval process. The withdrawal was based on a procedural issue, according to a source, and the clock for approval was reset indefinitely to a later submission. The result is a delay in moving the WAPI proposal through ISO. Sources said China walked out specifially over disputes centering on which members have authority to seek a withdrawal and the timing of the request. Chinese delegates also accused ISO of favoring the IEEE 802.11i proposal. It remains unclear for now whether the dispute will affect the current suspension of China's original law requiring mandatory implementation of WAPI. The IEEE is currently drafting a formal response, but declined to comment. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Payroll site closes on security worries
by R.A. Hettinga 25 Feb '05

25 Feb '05

<http://news.com.com/2102-1029_3-5587859.html?tag=st.util.print> CNET News Payroll site closes on security worries By Robert Lemos Story last modified Wed Feb 23 15:54:00 PST 2005 Online payroll service provider PayMaxx shuttered its automated W-2 site on Wednesday after a researcher claimed that two security holes had exposed data on more than 25,000 people. A description of the problem posted on Think Computer's Web site by Aaron Greenspan, president of the software start-up, said the security issues could allow anyone to view the W-2 forms generated for employees of PayMaxx's clients for the last five years. PayMaxx did not acknowledge or deny the problems, saying that a third-party security company was investigating the allegations. "No system in the world is 100 percent secure from a sophisticated and determined hacker," the Tennessee-based payroll company said in a statement sent to CNET News.com. "PayMaxx has made and continues to make every effort to secure its system against any breach." The incident comes a week after background-check provider ChoicePoint acknowledged that data thieves had created dozens of fake companies to acquire more than 145,000 records touching on the personal lives of U.S. citizens. Federal legislators are considering strong protections on identity data following the ChoicePoint leak, and a class action lawsuit has been filed in California. Greenspan, a former PayMaxx customer, said he discovered the alleged problems in the company's system more than two weeks ago, after he received notification from the company that his W-2 tax form was available online for download and printing. The link to access the W-2 included an ID number, and he wondered whether the company had protected against an obvious security problem: adding one to the ID number to get the next form. Instead of being denied access, Greenspan found that another person's W-2 was downloaded and readable. Sequential, rather than randomized, ID numbers made it easy to call up numerous customers' data. The hole could have allowed employees at PayMaxx's clients to access more than 25,000 W-2 forms for last year and the W-2 forms for years back to 2000, he said. He said his investigation revealed that PayMaxx's database contained a record for testing purposes that contained a Social Security number of 000-00-0000 and a password of all zeros. That could allow anyone to log into the site and then use the lack of authentication to sequentially download all the W-2 forms, Greenspan said. "Anyone could have been exploiting these security issues for years, and no one would have known about it," he said. PayMaxx confirmed that the test account did exist as described in Greenspan's paper, but took issue with other allegations. The company stated that from a review of Greenspan's paper, it had found several of his claims to be inaccurate, but did not specify which claims. While PayMaxx did not confirm the problem, the company did qualify the extent of the damage. "Our initial analysis indicates that if Mr. Greenspan was able to improperly access any W-2 forms, a limited number of forms were accessed," the company said in the statement. That does not contradict Greenspan's claims, since the researcher said that he had only accessed enough of the site to confirm the issue and gauge the extent of the problem. PayMaxx charged that Greenspan had "attempted to hack" into its Web site. It said he had held back details of the alleged flaws and had requested that PayMaxx hire his company. "Due to the lack of specificity provided by Mr. Greenspan in his obvious sales pitch, PayMaxx did not view his communications as credible," the company said. "Consequently, we declined his offer to hire his services." Greenspan acknowledged that he had given PayMaxx few details, but took issue with their lack of response to his security concerns. "I did tell them that there was a problem, and gave them several options to deal with it, and instead they chose to do nothing," Greenspan said. "It is not my job to go around and fix problems for free." PayMaxx declined to comment on whether it had notified any of its customers about the report of a problem. Under California's Security Breach Information Act (S.B. 1386), companies that may have leaked personal or financial data must advise their customers as soon as possible. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Solutions to net security fears
by R.A. Hettinga 25 Feb '05

25 Feb '05

<http://news.bbc.co.uk/2/low/technology/4273135.stm> The BBC Friday, 25 February, 2005, 08:10 GMT Solutions to net security fears By Jo Twist BBC News science and technology reporter Fake bank e-mails, or phishing, and stories about ID theft are damaging the potential of using the net for online commerce, say e-business experts. Trust in online security is falling as a result. Almost 70% of those asked in a poll said that net firms are not doing enough to protect people. The survey of more than 1,000 people reported that 43% were not willing to hand over personal information online. It is worrying for shopaholics and firms who want to exploit the net. More people are becoming aware of online security issues but they have little confidence that companies are doing enough to counter the threats, said security firm RSA, which carried out the poll. An estimated 12 million Britons now use the net as a way of managing their financial affairs. Security experts say that scare stories and the vulnerabilities dogging e-commerce and e-banking are being taken seriously - by banks in particular. Who are you? "I don't think the threat is overplayed," Barry Beal, global security manager for Capgemini, told the BBC News website. He added: "The challenge for banks is to provide the customer with something that improves security but balances that with usability." Ensuring extra security measures are in place protects them too, as well as the individual, and it is up to both parties to make sure they do what is necessary to prevent fraud, he said. "Card issuers will keep us informed of types of attacks and what procedure to take to protect ourselves. If we do that, they will indemnify us," he said. Many believe using login details like usernames and passwords are simply not good enough anymore though. One of the biggest challenges to improving security online is how to authenticate an individual's identity. Several security companies have developed methods which complement or replace passwords, which are easily compromised and easy to forget. Last year, a street survey found that more than 70% of people would reveal their password for a bar of chocolate. On average, people have to remember four different passwords. Some resort to using the same one for all their online accounts. Those who use several passwords often write them down and hide them in a desk or in a document on their computer. In a separate survey by RSA, 80% said they were fed up with passwords and would like a better way to login to work computer systems. For many, the ideal is a single online identity that can be validated once with a series of passwords and questions, or some biometric measurement like a fingerprint or iris scan with a token like a smartcard. Token trust Activcard is just one of the many companies, like RSA Security, which has been trying to come up with just that. RSA has a deal with internet provider AOL that lets people pay monthly for a one-time passcode generation service. Users get a physical token which automatically generates a code which stays active for 60 seconds. Many companies use a token-based method already for employees to access networks securely already. Activcard's method is more complex. It is currently trailing its one-time passcode generation technology with UK banks. Steve Ash, from Activcard, told the BBC News website there are two parts to the process of identification. The most difficult is to ascertain whether an individual is who they say they are when they are online. "The end solution is to provide a method where you combine something the user knows with something they have and present those both." The method it has developed makes use of the chip embedded in bank cards and a special card reader which can generate unique codes that are active for a specified amount of time. This can be adjusted at any time and can be active for as little as 30 seconds before it changes. It combines that with usual usernames and passwords, as well as other security questions. "You take the card, put it in the reader, enter your pin number, and a code is given. "If you wanted then to transfer funds, for instance, you would have to have the code to authorise the transaction." The clever bit happens back at the bank's secure servers. The code is validated by the bank's systems, matching the information they expect with the customer's unique key. "Each individual gets a key which is unique to them. It is a 2048-bit long number that is virtually impossible to crack," said Mr Ash. It means that in a typical security attack, explains Mr Ash, even if password information is captured by a scammer using keystroke software or just through spoof websites, they need the passcode. "By the time they go back [to use the information], the code has expired, so they can't prove who they are," according to Mr Ash. In the next few years, Mr Ash predicts that this kind of method will be commonplace before we see biometric authentication that is acceptable for widespread use. "PCs will have readers built into them, the cost of readers will be very cheap, and more people will have the cards." The gadgets we carry around, like personal digital assistants (PDAs) and mobiles, could also have integrated card reader technology in them. "The PDA or phone method is a possible alternative as people are always carrying phones around," he said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Study: Security fears daunt online shoppers
by R.A. Hettinga 25 Feb '05

25 Feb '05

<http://news.zdnet.com/2102-1009_22-5575569.html?tag=printthis> ZDNet By Dawn Kawamoto URL: http://news.zdnet.com/2100-1009_22-5575569.html One-fourth of online shoppers have reduced their purchases in the past year as concerns over identity theft have risen, according to a survey released Monday. That increased reluctance to shop online comes as Americans become more aware of the possible risks, the consumer study by RSA Security indicated. Some 61 percent of respondents said they feel more informed about identity theft issues, and 23 percent noted they feel more vulnerable than they did a year ago. "Clearly, there's a lot of work to be done if businesses want to build more online trust with consumers," John Worrall, vice president of worldwide marketing at RSA Security, said in a statement. "While awareness of threats remains high, consumer confidence in dealing with those threats is low." The third annual study asked more than 1,000 U.S. consumers about how their attitudes to identity theft, computer attacks and other security issues had changed over the past two years. The results were released to coincide with the annual RSA security conference, which gets under way in San Francisco this week. Financial institutions, which hope to move more customers to online banking as a means to cut their operational costs, continue to face resistance. Twenty-one percent of consumers refuse to use online banking, the survey found. Banks have been particular targets of the rapid rise in phishing attacks, as attackers find that money can be made by luring victims into handing over sensitive information such as social security numbers and bank account details. The survey found that more than half of respondents felt traditional user IDs and passwords do not provide adequate security. Despite this, people also said they have not changed their approach to password use. Two out of three Web users said they use fewer than five passwords for all access to electronic information. Of the total, 15 percent said they use a single password. Those results have not changed from last year, RSA said. The majority of consumers, nearly 70 percent, felt the online merchants they do business with are falling short on protecting their personal information. Another report, released jointly by the Business Software Alliance and the Information Systems Security Association on Monday, found that companies are increasingly sending the responsibility of overseeing security to the executive suite. Forty-four percent of businesses surveyed last year said their senior management is responsible for security, up from 39 percent in 2003. But the number of security professionals who believe a major cyberattack will occur in the next 12 months has declined over the past year, the report said. The figure has dropped to 59 percent last year, from 65 percent in 2003. "This survey demonstrates that awareness and action are replacing fear," Robert Holleyman, BSA's chief executive, said in a statement. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

China walks out of wireless LAN security talks
by R.A. Hettinga 25 Feb '05

25 Feb '05

<http://www.commsdesign.com/printableArticle/;jsessionid=IUWFMVHO5S3NAQSNDBG…> China walks out of wireless LAN security talks Patrick Mannion Feb 24, 2005 (12:26 PM) MANHASSET, N.Y. - China walked out of a wireless standards meeting this week, accusing the International Organization for Standardization of favoring the IEEE's 802.11i ANSI-certified wireless LAN security scheme over its own controverisal proposal, EE Times has learned. The gambit came after China's Wireless Authentication and Privacy Infrastructure (WAPI) security scheme was withdrawn and placed on a slower track by the ISO. This week's meeting in Sulzbach, Germany, included the ISO/IEC JTC1 SC6 WG1 working group created to resolve the dispute. China initially agreed last year to refrain from making its WAPI security scheme mandatory for wireless LAN equipment in China. It then approached ISO with a fast-track submission in an effort to make WAPI an international security standard. The 802.11i proposal is also on the fast-track for ISO approval, possibly by April. Until this week, the ISO group was focused on whether or not both 802.11i and WAPI should be cemented as enhanced - but optional - security standards. However, sources said tempers flared when China's original fast-track submission, designated 1N7506 of China National Standard GB15629.11 (WAPI), was withdrawn from consideration. It was replaced by a revised submission, designated 6N12687, that removed the China proposal from the organization's fast-track approval process. The withdrawal was based on a procedural issue, according to a source, and the clock for approval was reset indefinitely to a later submission. The result is a delay in moving the WAPI proposal through ISO. Sources said China walked out specifially over disputes centering on which members have authority to seek a withdrawal and the timing of the request. Chinese delegates also accused ISO of favoring the IEEE 802.11i proposal. It remains unclear for now whether the dispute will affect the current suspension of China's original law requiring mandatory implementation of WAPI. The IEEE is currently drafting a formal response, but declined to comment. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Arab Bank Told by U.S. to Restrict Wire Transfers (Update5)
by R.A. Hettinga 25 Feb '05

25 Feb '05

<http://www.bloomberg.com/apps/news?pid=10000103&sid=atzqhwfJoPgc&refer=us> Bloomberg Arab Bank Told by U.S. to Restrict Wire Transfers (Update5) Feb. 25 (Bloomberg) -- Arab Bank Plc, the target of lawsuits by relatives of victims of terrorist attacks in the Middle East, was ordered by a U.S. regulator to restrict wire transfers and stop taking deposits at its New York branch. Amman, Jordan-based Arab Bank, the third-largest Arab lender, failed to monitor fund transfers at the branch for suspicious activity and to obtain enough information about them, the Office of the Comptroller of the Currency said in a consent order released in Washington today. The bank neither admitted nor denied wrongdoing. ``The inadequacy of the branch's controls over its funds transfer business is especially serious in light of the high-risk characteristics of many of the transactions,'' the OCC said. The order, which didn't mention the lawsuits, requires Arab Bank to pay off or transfer all deposit accounts and wind down money transfers at the New York branch, all but ending the branch's ability to do business as a traditional bank. The 75- year-old bank, which will now focus its New York business on trade and corporate finance, must also provide a daily report to the OCC of assets and keep all records in English. Bank spokeswoman Heather Geisler said transfers were a small part of the branch's operations. She said the branch dealt mostly with trade and corporate finance. U.S. regulators have intensified their surveillance of money transfers since the terrorist attacks of September 11, 2001. Families of victims of the attacks have used courts to target Arab individuals, banks and governments, including Saudi Arabia. The families that sued Arab Bank are seeking $2 billion in damages. Suits The suits, filed July 2 and Jan. 21 in a U.S. District Court in Brooklyn, say that the Saudi Committee in Support of the Intifada Al-Quds used Arab Bank to make at least six payments of 20,000 Saudi riyals ($5,332) each to relatives of bombers and gunmen. The charity has raised more than $100 million to aid Palestinians injured in the conflict with Israel. Chief Banking Officer Shukry Bishara said in an interview this month that Arab Bank didn't know the payments were going to families linked to the attacks. ``Nothing in the consent agreement asserts that transactions happened that were not supposed to,'' Geisler said in an e-mail. ``But rather it talks about weaknesses in Arab Bank's ability to report potentially suspicious activity.'' Nofal Barbar, regional manager for Arab Bank, wasn't available for comment, his office said. The bank's New York branch, its only one in the U.S, is on the second floor of an office building on Madison Avenue in midtown Manhattan. The bank has 22 branches in the West Bank and Gaza Strip and $2 billion in deposits. ``Arab Bank is committed to achieving and implementing best practices in the rapidly evolving area of transactional reporting,'' Bishara said in a statement today. ``This agreement builds on and will help strengthen our internal controls and will give our customers and regulators even more confidence in the safety and security of Arab Bank.'' Bishara said in a Feb. 7 interview that the bank might close the New York branch. Under the consent order, the bank can operate on a restricted basis in the U.S. provided it maintains ``quality'' assets to cover debits and protect the U.S. deposit insurance fund. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

U.S. claims deficiencies at N.Y. Arab Bank
by R.A. Hettinga 25 Feb '05

25 Feb '05

<http://seattlepi.nwsource.com/printer/ap.asp?category=1310&slug=Arab%20Bank> SEATTLE POST-INTELLIGENCER Friday, February 25, 2005 7 Last updated 2:49 p.m. PT U.S. claims deficiencies at N.Y. Arab Bank By MARCY GORDON AP BUSINESS WRITER WASHINGTON -- U.S. regulators said Friday that Arab Bank PLC, one of the largest financial institutions in the Middle East, has inadequate controls against money laundering at its New York branch and has been ordered to stop transferring funds or opening new accounts there. In an unusual move, the Office of the U.S. Comptroller of the Currency, a Treasury Department agency, said the branch was being converted into an entity that will not conduct traditional banking activities but will continue to engage in corporate and trade financing. Jordan-based Arab Bank, with operations in 30 countries, faces several lawsuits in the United States by relatives of terrorism victims in Israel who allege it supported terrorism by funneling donations to Palestinian suicide bombers and their families. The bank, which had said recently it would close the New York branch, agreed to the conditions in a consent order with the comptroller's office. "The inadequacy of the branch's controls over its funds transfer business is especially serious in light of the high-risk characteristics of many of the transfers," the comptroller's office said in the order, which was dated Thursday and announced Friday. Rep. Sue Kelly, R-N.Y., who heads a House subcommittee that has investigated terrorists' use of the U.S. financial system, called the action by the comptroller's office encouraging but added, "I remain deeply concerned about reports of Arab Bank's role in supporting terrorism and look forward to learning additional facts regarding this situation in the coming weeks and months." Families of about 40 U.S. citizens killed in terrorist attacks in Israel sued Arab Bank in federal court in New York City last summer, accusing it of channeling money to Palestinian terrorist groups and of making insurance payments to beneficiaries of suicide bombers. "This isn't the time to declare victory," Gary M. Osen, an attorney representing the families, said Friday. "The Treasury Department has taken an important step by setting up a process for closing Arab Bank's U.S. operations, but we're a long way from a full reckoning with Arab Bank for what they've done." The plaintiffs also allege that the Texas-based Holy Land Foundation for Relief and Development used Arab Bank's New York branch to transfer money to Hamas, a Palestinian terrorist organization blamed for dozens of attacks in Israel. The Justice Department in August indicted the Holy Land Foundation on charges of providing millions of dollars in support to Hamas. Officials of Arab Bank have called those allegations "completely false and totally irresponsible." In a statement Friday, Shukry Bishara, Arab Bank's chief banking officer, said the agreement with the U.S. regulators "will help strengthen our internal controls and will give our customers and regulators even more confidence in the safety and security of Arab Bank." The decision to close the New York branch was announced earlier this month by the Central Bank of Jordan, which oversees the operations of Arab Bank - the kingdom's largest financial institution with some $32 billion in assets. The bank is partly owned by the prominent Palestinian Shoman family, and its shareholders include the Saudi Oger Co., which was owned by former Lebanese Prime Minister Rafik Hariri, who was killed on Feb. 14 in a bombing in Beirut. -- On the Net: Office of the Comptroller of the Currency: http://www.occ.treas.gov Arab Bank PLC: http://www.arabbank.com -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0