- cypherpunks-legacy - lists.cpunks.org

E-protection necessary for nation's security: Kalam
by R.A. Hettinga 21 Dec '04

21 Dec '04

<http://www.newkerala.com/news-daily/news/features.php?action=fullnews&id=49… p> E-protection necessary for nation's security: Kalam [Business India]: Chennai, Dec 21 : India was moving into an "era of e-business, e-marketing, e-commerce and e-banking" and encryption technology to protect network communication was the only way to ensure the nation's security, said President A.P.J. Abdul Kalam. The president was addressing scientists here Monday evening at the 5th International Conference on Cryptology in India via videoconferencing. Reminding his audience that Indian mathematician Srinivasa Ramanujam's work was being applied in communication networks today, Kalam said: "Cryptography is a wealth generator and wealth protector." Noting that India was the only country in the world with a huge linguistic diversity and more than 3,000 languages, he asked: "Can we make use of this diversity to our advantage by using different languages as a cryptographic tool?" Addressing several hundred delegates from all over the world, who had gathered here for the three day conference that began Monday, Kalam said: "Nations that are capable of generating and managing information in a secure way will become world leaders and economic superpowers" He called for state-of-the-art technology at competitive costs in India, to secure Indian e-systems. Inaugurating the conference, hosted by the Institute of Mathematical Sciences and the Society for Electronic Transactions (SETS), principal scientific advisor to the central government R. Chidambaram said the science of encryption was the "only know-how" technologists had to protect e-systems. Information flows over open networks. And to secure this information is "of social, political, commercial and strategic" importance, Chidambaram said. He asked Indian scientists for research inputs into standardisation processes, called 'advanced encryption standard' it could develop quickly in India. Experts from various countries, including France, South Korea, Australia, Belgium and Germany are attending the meet. During the conference, 147 scientific papers on the art and science of encryption will be presented. Cryptology is the science of hiding information through codes. Mathematical systems provide some of the best encryptions the world has so far generated. It is also the art of breaking down codes and getting at secrets. --Indo-Asian News Service -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

'Video Miners' Use Hidden Cameras in Stores
by R.A. Hettinga 21 Dec '04

21 Dec '04

<http://online.wsj.com/article_print/0,,SB110357897849105150,00.html> The Wall Street Journal December 21, 2004 MARKETING 'Video Miners' Use Hidden Cameras in Stores 'Video Miners' Use Cameras Hidden in Stores to Analyze Who Shops, What They Like By JOSEPH PEREIRA Staff Reporter of THE WALL STREET JOURNAL December 21, 2004; Page B1 BRAINTREE, Mass. -- Stepping into a Gap store at the South Shore Shopping Plaza on a recent evening, Laura Munro became a research statistic. Twelve feet above her, a device resembling a smoke detector, mounted on the ceiling and equipped with a hidden camera, took a picture of her head and shoulders. The image was fed to a computer and shipped to a database in Chicago, where ShopperTrak RCT Corp., a consumer research firm, keeps count of shoppers nationwide using 40,000 cameras placed in stores and malls. ShopperTrak, whose profile has risen this holiday season as appetite grows for more real-time shopping data, is a leader in "video mining" -- an emerging field in marketing research enabled by technology that can analyze video images without relying on human eyes. ShopperTrak says it doesn't take pictures of faces. The company worries that shoppers would perceive that as an invasion of privacy. But nearly all of its videotaping is done without the knowledge of the people being taped. "I didn't even know there was a camera up there," says Ms. Munro, a public-transit manager who popped into the mall on her way home from work to find a gift for her 12-year-old daughter. Using proprietary software to gauge the size of the images of people, a ShopperTrak computer determined that Ms. Munro was an adult, not a child, and thus a bona fide shopper. Weeding out youngsters is critical in accurately calculating one of the valuable bits of data ShopperTrak sells -- the percentage of shoppers that buys and the percentage that only browses. It arrives at this data, including the so-called conversion rate, by comparing the number of people taped entering the store with the number of transactions. Ms. Munro's visit was tallied up twice: once as a visitor to the Gap and once in a national count of shoppers. Gap Inc., of San Francisco, pays ShopperTrak for the tally of Gap shoppers. ShopperTrak sells the broader data -- gleaned from 130 retail clients and 380 malls -- to economists, bankers and retailers. ShopperTrak takes into account how much shoppers spend, data that it gets from credit-card companies and banks, and extrapolates outward to the entire retail landscape. "We can get sales and traffic figures that are identical to the government's, two months before they can issue their report," says Bill Martin, ShopperTrak's founder and president. Of the millions of shoppers videotaped daily in the U.S., many are aware that security cameras are watching to detect shoplifting. In some cases, stores post signs to disclose such monitoring. But there is far less awareness by consumers that they are being filmed for market research. ShopperTrak discloses its clients -- a list that includes Gap and its Banana Republic unit; Limited Brands Inc., of Columbus, Ohio, and its Victoria's Secret chain; PaylessShoe Source Inc., of Topeka, Kan; American Eagle Outfitters Inc., of Warrendale, Pa.; and Children's Place Retail StoresInc., of Secaucus, N.J. Several other research companies that videotape shoppers say they sign agreements with clients in which they pledge not to disclose their names. They say their clients want the taping to be secret -- and worry shoppers would feel alienated or complain of privacy invasion if they knew. Katherine Albrecht, founder and director of Caspian, a Cambridge, Mass., consumer-advocacy group, says consumers have "no idea such things as video tracking are going on" and should be informed. When she tells them about such activities, she says the response she often hears is, "Isn't this illegal, like stalking? Shouldn't there be a law against it?" There aren't any state laws forbidding retailers from videotaping shoppers for research -- although in New Jersey last week, Caesars Atlantic City Hotel Casino was fined $80,000 for videotaping the breasts and legs of female employees and customers with cameras intended for security. Some research companies' cameras, with lenses as small as a quarter, can provide data on everything from the density of shopping traffic in an aisle to the reactions of a shopper gazing at the latest plasma TV set. The cash register is a popular spot for cameras, too. But cameras can be found in banks, fast-food outlets and hotel lobbies (but not guest rooms). Video miners say their research cameras are less invasive than security cameras, because their subjects aren't scrutinized as closely as security suspects. Images, they say, are destroyed when the research is done. Robert Bulmash, founder of the Private Citizen Inc., of Naperville, Ill., which advocates for privacy rights, says that being in a retailer's store doesn't give a retailer "the right to treat me like a guinea pig." He says he wonders about assurances that images are destroyed, since there isn't any way to verify such claims. The pictures "could be saved somewhere in that vast digital universe and some day come back to haunt us," he says. Already, video images can be subpoenaed from retailers for law-enforcement purposes. Technology capable of matching a photo with an individual's identity, say from credit-card transactions, "has certainly arrived," says Rajeev Sharma, a Penn State University computer science professor who has launched a company that is creating shopper-monitoring systems. It isn't certain whether retailers are availing themselves of the know-how. Credit card companies currently aren't sharing individuals' financial information with retailers, he adds, but retailers have their own customer databases as the result of loyalty cards, store credit cards and other in-house programs. Theoretically, they could link a transaction at a cash register with the face of a shopper appearing on the videotape. Dr. Sharma's start-up, Advanced Interfaces Inc., of State College, Pa., is expected this week to launch a Web site, videomining.com, highlighting the company's patented "computer vision" technologies. In a pilot project conducted last year in the Philadelphia area, Advanced Interfaces set up nine cameras in each of two McDonald's Corp. restaurants to find out which consumer types would find a new salad item most appealing. The research was done without consumers' knowledge, says Dr. Sharma, who is Advanced Interfaces' chief executive. Seven of the cameras were already in place for security purposes and needed only to be reconfigured using Advanced's sensors. Two additional cameras were positioned in the ceiling directly over cash registers. By measuring the shapes of people's faces, the sensors were able to provide a breakdown of the fast-food customers by race, gender and age group, he says. The videos also revealed the length of time customers spent waiting in line or looking at the menu before ordering. Mr. Sharma declined to discuss the findings. All of the video was subsequently destroyed, he says. "Only the computers and no humans saw the pictures of the customers," Mr. Sharma says. Advanced is conducting similar consumer-behavior analysis this holiday season for three other retailers that Mr. Sharma declined to identify. Video mining is being spurred by digital video cameras. Unlike their analog counterparts, digital video cameras can be programmed so that the images can be quickly read by computers -- taking only hours to complete tasks that might have taken weeks for humans to do. In a recent assignment that Kahn Research Group, of Huntersville, N.C., completed for American Express Co., computers took only a couple of days to sift through 64 hours of tape. Kahn researchers hid four cameras near the checkout counter at a couple of supermarkets in Southern California to study whether American Express gift cards should be displayed off in a spot by themselves, or lumped with competing brands near the cash registers. Researchers were interested in customers' facial expressions and eye movements as they spotted the gift cards, and whether they walked to a display to pick up a card. Kahn cameras, each the size of a golf ball, were hidden behind the displays. The devices were programmed to detect fast-eye movement, smiles and frowns, says Greg Kahn, the company's CEO. The research, which involved filming 2,000 shoppers, was "really not invasive," Mr. Kahn says. "Nobody knew they were being recorded and our work didn't interfere with the store environment. Had we tried to interview people, the process would have taken much longer." And had people known they were being taped, he says, "I know many of the shoppers would have stuck their hands in front of the camera lens and refused to be recorded." A spokeswoman for American Express described the project as a "pilot program ... that's not for public consumption" and declined to comment further. It isn't clear whether the American public will be as tolerant of secret market research using videotape as they are of security cameras. There are 29 million cameras videotaping people in airports, government buildings, offices, schools, stores and elsewhere, according to one widely cited estimate in the security industry. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

A Bronx Curbside Whisper: 'Hey, Need a Tuneup?'
by R.A. Hettinga 21 Dec '04

21 Dec '04

<http://nytimes.com/2004/12/19/nyregion/19bronx.html?pagewanted=print&positi…> The New York Times December 19, 2004 A Bronx Curbside Whisper: 'Hey, Need a Tuneup?' BY ANDREA ELLIOTT he men saunter up and down a littered block of Third Avenue in the Bronx, casting sidelong glances at passing cars. When the cars slow down, the men mouth silent promises of a cheap fix. When the drivers pull over, the men scan for cops before sliding up to the curb. It is a singular hustle. There are no drugs or sex. Instead, the hoods of the cars fly open and the men get to work, pulling out greasy tools to perform every mechanical remedy from oil changes to hair-raising tuneups and axle replacements, right on the street. In the vast underground of New York's economy, street mechanics hold a peculiar if utilitarian place. For people who balk at a $30 oil change, there is Country, a 41-year-old Virginia native who charges a third of that, jacking up his clients' cars as rush-hour traffic creeps by. In the expert hands of Chino and Heavy, a $200 brake job costs half as much, parts included. On busy days, cars line Third Avenue like sick patients, propped up by metal jacks, worn-out tires flung to the side. The mechanics disappear underneath, their boots peeking out, their tools splayed on asphalt outside the neon blink of auto parts shops. Sometimes ingenious, sometimes deceptive, they form a blue-collar rung in the city's freelance work ladder. They are mobile, carrying their tools in wheeled suitcases, on call around the clock by cellphone or pager. They draw clients from as far as Connecticut and Rhode Island. Some even wear uniforms, and the best ones travel on distant missions, reviving broken-down cars on roadsides from Boston to Atlantic City. "I'm like an ambulance," said Luis Mares, 40, who installs rebuilt alternators for as little as $85. "Where there's trouble, I go." The flourishing, although illegal, street business blends comical improvisation with corporate savvy. But as it does in any profession, the talent ranges. Some mechanics leave customers careering away brakeless. Many make a mess, with discarded oil and strewn parts. And hovering over them all is the constant threat of the police, who issue tickets to the men tirelessly, leading to hundreds of dollars in fines and repeated stays in jail. Yet week after week, the mechanics stubbornly return to the same street to eke out a living on their own terms. "This is New York," said Country, who would give only his street name and who has been issued, he said, 42 summonses in the last two years. "If you're not on your feet, you're on your butt." Street mechanics ply their trade all over the city. They can be found near Shea Stadium in Queens and around Pacific Street and Fourth Avenue in Brooklyn. But perhaps nowhere are they more brazenly visible than on Third Avenue from East 161st to 163rd Streets, in the Melrose Commons section of the South Bronx. On any given day, up to 15 mechanics work the street, competing for clients. Repairs begin after noon (the late hours are among the perks of the job) and pick up around 5 p.m., when customers leave their jobs and stop by for a new timing belt change or a brake adjustment. Paydays are the peak. Saturdays are prime: the best mechanics can pocket $400 in one day, saving clients the steeper prices charged by Pep Boys or Jiffy Lube. "I can't afford to go to the shop," said Howard Dawson, 66, a retired Amtrak repairman who regularly takes his '93 Cadillac Fleetwood to the street. "One hand's got to wash the other." The Third Avenue mechanics, like most workers, operate in a hierarchy. At the top are the owners of the auto parts stores, who moved to the street starting in the early 1970's. The mechanics came uninvited around the same time, like weeds in a garden. They formed a symbiotic relationship with the stores' employees. The stores sell parts to customers who often need a mechanic to install them and the mechanics will send their clients to the stores. "You help me and I'll help you," explained Humberto Ortiz, 56, a salesman at Ocampo Auto Electric on Third Avenue. At the bottom of the ladder are the "helpers" - mechanics in training who earn much of their pay by luring clients. They, too, have street names that in the mores of the South Bronx are assigned more than chosen. There is Little Mexico, Dominica and Mouse. Not by coincidence, they share several traits: they are small in build, move quickly and seem to have an outsized view of their own mechanical abilities. "Every time I see them doing something heavy, they look stuck in it," said Luis Martinez, who goes by Chino and is among the street's veterans. Tales abound of jobs the helpers started and botched, only to be saved by the street's experts. But unlike other would-be street mechanics, whose bad reputations result in swift excommunication, these helpers have clung to their place on the street. They tend to live off small jobs, not always involving cars. "I walk this dog for $2," said Little Mexico, stabbing two fingers in the air as a tiger-colored pit bull named Puppy yanked him away. Some mechanics admit they work to support a drug habit. Others say they are "clean" and look upon their entrepreneurship as a career choice. Two Third Avenue mechanics - Pernell Dingle and Elliot Rodriguez - claim they graduated "Mechanic of the Year" from Alfred E. Smith High School, two decades ago. (An official at the school, Jeff Block, confirmed that both men got mostly A's. "Dingle owes us $8," he added, for an automotive encyclopedia he never returned.) Chino, who has dozens of regular clients, takes his job especially seriously, arriving promptly at noon with a yellow plastic tool case. He wears one of his six navy blue uniforms, washed and pressed by his wife. "Who would you hire: a guy who looked like a bum or me?" he says. One recent weekday, Mr. Martinez is swiftly dismantling the innards of a shiny black Lincoln Town Car to change the alternator. His hands maneuver expertly around the radiator tank, the power steering wheel tank, several hoses and the engine belt. (He learned the trade as a boy, taking apart engines in his backyard in the Soundview section of the Bronx.) Mr. Martinez's client watches closely and then instructs his gum-chewing girlfriend, who is seated behind the faux-fur covered wheel, to rev the engine. The engine roars. A Betty Boop air freshener flutters from the rearview mirror. The job is almost done. "I promised him more power," said Mr. Martinez, 40, who has worked on the street for a decade. "Now we'll check." The two men jump into the car and head off. Not only do clients get test drives, some get credit. "I've got about $200 in the street right now," Mr. Martinez said. He keeps a stack of his clients' business cards. One is a plumber, another a lawyer. Then there is the candy wholesaler whose fuel pump went bad on a trip to Boston. He paid Mr. Martinez $400 to fix it. Recruiters from auto repair shops visit the street from time to time, looking for potential hires, but Mr. Martinez is quick to rebuff them. He makes enough on his own, he says - about $40,000 a year. "You walk into my house right now, you won't want to leave," said Mr. Martinez, who lives in a housing project a few blocks away. "Big-screen TV. Surround-sound system." He sends his stepdaughter to a Catholic school and vacations in Puerto Rico twice a year. The only nuisance, he concedes, are the tickets and occasional trips to jail. Mr. Martinez has been locked up twice, for two days each time. Some mechanics pay their tickets as dutifully as other people pay taxes. Mr. Dingle, on the other hand, has not paid one of his more than 50 tickets and has been jailed 17 times. "I tell them to put me in my regular cell," said Mr. Dingle, 44, as he stood on the street one early evening. "The cops know me by name." A few minutes later, a Chevy Impala with tinted windows slowly glided by. "See that little black car?" said Country. "That's the captain. He's out scouting." Street mechanics violate a number of city codes seemingly written with them in mind: on the street it is illegal to repair vehicles, remove vehicle parts or discard oil. Each violation can carry a fine of $100. But fines were rare, the mechanics said, until 2000, when the 42nd Precinct made "quality of life" issues a sudden priority and the police began cracking down on the trade. It was a sign of new times: the South Bronx was transforming, block by block, amid sweeping plans for urban renewal. These days, the police know the mechanics well. They know, for instance, that Frankie Rosado flashes his worn brown tool belt at passing cars the way a prostitute might lift her skirt. "If I'm looking at a car, I'm guilty," said Mr. Rosado, 44. One recent weekday, the security guards at the Bronx Criminal Courthouse on East 161st Street gave Mr. Rosado a familiar nod as he emptied his pockets: fuses, bulbs and screws. He navigated the building like he was walking through his own kitchen. He turned without looking, smiled at a guard who winked back, and approached a man sitting before a computer. "When's my next court date?" he asked. With so many tickets, he had lost track. His latest offense, written up on a pink summons dated Sept. 29, was for "dismantling." The man behind the desk lifted a plump arm, "Monique" tattooed across it in curly letters, and clicked on a mouse. "Somebody's always messing with you somewhere," said the man as he searched the Rosados on the screen. "Frankie C.?" "That's my son," Mr. Rosado said. Seconds later, the dates were found and Mr. Rosado took off in search of more work. The street mechanic world is organic to South Bronx life, but like other underground trades, it is increasingly at odds with the borough's evolving self-image. The Melrose Commons area is awash in new development: stately town houses, a gleaming BP gas station, and a $250 million criminal courthouse close to completion. Even the three-block stretch where the mechanics work is destined to become part of a new $30 million campus for Boricua College. The mechanics shrug it all off, doubtful that new buildings will extinguish the need for bargain car repairs. Some of their clients, they laugh, are off-duty police officers. One of them, Edward Sanchez, dropped by recently to have the alternator changed on his 1993 Nissan Maxima. "For me, it's better if I see somebody working on the street than making problems, stealing in stores," said Mr. Sanchez, 29, who flashed his badge to prove he works as an auxiliary police officer. "Maybe it's not legal, but I give them credit. They're trying to survive." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Israeli Airport Security Questioning Re: CRYPTO-GRAM, December 15, 2004
by John Kelsey 21 Dec '04

21 Dec '04

>The difference here is that Bad_Guy is visiting the >country for the first time. Now, there are fewer >questions to ask. But that's a common enough situation that the questioners are going to be ready for it. And I bet a lot of the point of their questioning is just to see if they detect signs of stress where they expect to. If you are a smart person who does something like this 20 times a day, you'll soon get a really good feel for when something odd is going on. Also, any kind of in-depth questioning is likely to uncover a lot of fraudulent claims. If I say I'm a chemical engineer, it's not going to take much depth of knowledge for the questioner to find out I don't know things any chemical engineer would know, for example. (It wouldn't be hard to come up with some computerized system for pulling up lists of questions like this. Like, someone says he's Catholic, and you ask him who was born without sin as a direct result of the immaculate conception, or ask him to say a Hail Mary.) So this might force you to tell more of the truth, which makes it easier to profile you. And this is all physical / procedural security. You're not building an unclimbable wall, you're building lots of challenging speedbumps. No doubt a real intelligence agent would be good at getting through this kind of screening, but that doesn't mean most of the people who want to blow up planes would be any good at it! >Sarad. --John

2 1

Rice University Computer Scientists Find a Flaw in Google's New Desktop Search Program
by R.A. Hettinga 20 Dec '04

20 Dec '04

<http://nytimes.com/2004/12/20/technology/20flaw.html?pagewanted=print&posit…> The New York Times December 20, 2004 Rice University Computer Scientists Find a Flaw in Google's New Desktop Search Program By JOHN MARKOFF AN FRANCISCO, Dec. 19 - A Rice University computer scientist and two of his students have discovered a potentially serious security flaw in the desktop search tool for personal computers that was recently distributed by Google. The glitch, which could permit an attacker to secretly search the contents of a personal computer via the Internet, is what computer scientists call a composition flaw - a security weakness that emerges when separate components interact. "When you put them together, out jumps a security flaw," said Dan Wallach, an assistant professor of computer science at Rice in Houston, who, with two graduate students, Seth Fogarty and Seth Nielson, discovered the flaw last month. "These are subtle problems, and it takes a lot of experience to ferret out this kind of flaw," Professor Wallach said. Google introduced a test version of the desktop search tool on Oct. 14, and it can be downloaded at no cost. The program indexes material on a user's local hard disk and then blends Web search results with local user information like electronic mail, text documents and other files. The flaw would permit a search to reveal only small portions of the files. The way the software tool is designed, a user's queries, but no locally stored information, is distributed via the Internet. But by reading user queries sent to its search service, Google is able to place its AdWords text advertisements next to the search results displayed in a user's browser window. In a statement over the weekend, the company said that it had been notified of the flaw by the computer researchers in late November and had begun distributing a new version of the desktop search engine that repairs the potential security hole. Google's introduction of a desktop search tool has touched off a competition with its closest Web search service competitors, Microsoft and Yahoo. Microsoft made a test version of its desktop search tool available last Monday as part of its MSN toolbar suite, and Yahoo has said that it will begin testing a similar search tool in January. The Rice University researchers said that they had not yet examined Microsoft's desktop search program, but noted that the service did not appear to integrate Web and local search results in the same manner as the Google tool. The researchers said that the Google security weakness lay in the way that Google Desktop was designed to intercept outgoing network connections from the user's computer. The program looks for traffic that appears to be going to Google.com and then inserts results from a user's hard disk for a particular search. They found that it was possible to trick the Google desktop search program into inserting those results into other Web pages where an attacker could read them. An attack would require a user to visit the attacker's Web site first, and any type of Web browser could make a user vulnerable. Google said there was no evidence that any such attacks had occurred. The Rice group was able to create a Java program that makes network connections back to the computer from where it was downloaded and then make it appear as if it were asking for a search at Google.com. That was enough to fool the Google desktop software into providing the user's search information. The program was able to do anything with the results, including transmitting them back to the attacking site. "This began as a student project to study how Google Desktop worked and to see if there were any security flaws," said Professor Wallach. "We started by wondering how Google did the local search integration. Once we figured out how it worked, it wasn't too much extra work to break it." The researchers said that Google had responded quickly to their alert last month and had begun releasing a corrected version of the program on Dec. 10. The Google desktop program includes an update feature that permits the company to automatically install new versions of the program on users' computers without user intervention or knowledge. The Rice researchers said that it was possible for users to tell if their version of the Google program had been patched by examining the "about" page from the Google Desktop icon in the browser task bar. Version numbers above 121,004 indicate a newer edition of the program. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Digipass Starts to Make a Mark
by R.A. Hettinga 20 Dec '04

20 Dec '04

<http://online.wsj.com/article_print/0,,SB110348908376704197,00.html> The Wall Street Journal December 20, 2004 Digipass Starts to Make a Mark Vasco Enhances Online Security As Web Banks Gain Popularity By STEVE DE BONVOISIN DOW JONES NEWSWIRES December 20, 2004 BRUSSELS -- Life-insurance salesman Renaud Bruneels, 34 years old, says he doesn't have time to take care of "life's little administrative issues" by visiting a bank during regular business hours. The Belgian has solved the problem by becoming one of 12 million users world-wide of Vasco Data Security International Inc.'s Digipass. The pocket-size gadget, which looks like a calculator, lets him use a single password to pay everything from garbage fees to phone bills over the Internet. INSIDE TECH 1 See complete coverage2 of Europe's technology sector, from cellphones to software. "It gives me the level of security I need to ... do all my banking transactions," Mr. Bruneels says. Vasco, which is based in Brussels and Chicago, is riding an uptick in online banking -- particularly in Europe, which has moved ahead of the U.S.; the company believes that the U.S. market will take off within the next two years, as banks roll out the service to retail customers. Digipass can be used to access anything online, from bank accounts to secure servers to a corporate intranet. Given a username and password, it issues a one-time code to be used for purchases or transactions on the Web. Because the code only works once, hackers who infiltrate a computer can't use it again. The added level of security sets the Digipass system apart from other online transactions via mobile handsets or laptop computers. Vasco was founded in 1997 by Digipass inventor Jan Valcke, a Belgian, and Ken Hunt, an American who ran an online-authentication software company. But after the Internet bubble burst in 2000, customers hesitated to invest in Internet banking security. Digipass "came out a little too early ... when the big focus was on viruses and not on identity theft," said Edward Ching, technology analyst at Rodman & Renshaw in New York. The stock fell from a high of $25 ($18.81) in February 2000 to under $1 in early 2003, forcing Vasco to delist from Nasdaq's National Market and move on to the SmallCap Market. In 2002, Mr. Hunt took over as chief executive. Vasco switched to "just in time" production, and spent hundreds of thousands of dollars training resellers to tackle the corporate-access market. In November, the company posted its third consecutive quarterly sales increase. Vasco forecasts 2004 sales will rise between 23% and 25% from $22.87 million in 2003, and on Thursday Vasco said it expects 2005 sales to grow 35% to 45% with gross margins in the range of 60% to 65%. On Friday, Vasco shares fell eight cents to $6.40 in 4 p.m. Nasdaq Stock Market trading. Vasco still faces stiff competition. It has only about $10 million in cash, putting it at a disadvantage against U.S. rival RSA Security Inc., when chasing big contracts. In September, RSA signed a landmark deal with Time Warner Inc.'s America Online service to provide authentication for users signing into their online e-mail accounts. "We don't have the brand recognition we deserve," says Mr. Hunt, who admits Vasco wasn't even invited to bid on the Time Warner contract. As a result, the company has increased its presence in trade shows together with partners such as Novell Inc. and Lucent Technologies Inc., and is bringing prospective and current clients together in workshops to help them solve operational problems. More than 100 million households world-wide now bank online, and that number is expected to triple to 300 million or more households by the end of the decade. Europe has taken the lead. About 37% of all Internet users on the Continent bank online, as opposed to 17% in the U.S., according to reports from research firms Gartner and Forrester Research. The number of Europeans carrying out financial transactions on the Net is expected to rise to 130 million by 2007, compared with 67 million Americans. Banks are Digipass's main customers. "Digipass is the most secure system available and the one which offers the greatest mobility," said Liliane Tackaert, spokeswoman for Belgo-Dutch banking giant Fortis NV. About 775,000 of the bank's clients in Belgium and Luxembourg use the service. Rabobank, of the Netherlands, Europe's biggest online bank in terms of online customers, has more than two million Digipasses in use. Vasco hopes it will become a lead supplier for the new European EMV payment card next year. Developed jointly by Europay International, MasterCard Inc. and Visa International, the card requires a PIN number in addition to a usual signature when buying goods in a shop, as well as a one-time code -- such as the one generated by Digipass -- to buy goods online or over the phone. In addition to Vasco, Xiring, of Suresnes, France, and U.S.-based ActivCard Corp., Fremont, California, are in the running. Outside Europe, Digipass is pushing into new markets, signing up banks in countries ranging from Singapore to Argentina. Sales in the U.S. -- a potentially huge market -- accounted for just 16% of group turnover in the third quarter. Phishing and other scams in the U.S. have made potential customers more suspicious about banking over the Internet, making some banks unwilling to invest in authentication products such as Digipass. Wachovia Corp., Charlotte, North Carolina, is Vasco's only large U.S. banking client and the use of Digipass is limited to corporate-banking users. Laurence Leinbach, head of Wachovia's online banking operations, said that until now, U.S. banks have invested in such security only for high-potential corporate customers. "There is a very different authentication philosophy between corporate banking and retail banking in the U.S.," added Mr. Leinbach. That could change. As identity fraud mounts, Mr. Leinbach predicts banks will take a closer look at authentication products. "Expect to see changes within the next 24 months in the majority of retail banks," he said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Coffee, Tea, or Should We Feel Your Pregnant Wife's Breasts Before Throwing You in a Cell at the Airport and Then Lying About Why We Put You There?
by John Kelsey 20 Dec '04

20 Dec '04

>From: Tyler Durden <camera_lumina(a)hotmail.com> >Sent: Dec 19, 2004 4:23 PM >Subject: Re: Coffee, Tea, or Should We Feel Your Pregnant Wife's Breasts Before Throwing You in a Cell at the >Airport and Then Lying About Why We Put You There? ... >Funny how most Americans only wake up after it happens to them. Why would this be a surprise? This is surely the way it is with most people, hence the famous old quote about "...and when they came for me, there was no one left to complain." I wonder how long it will take 'till TSA adops some kind of internal policing policies with some teeth, to deal with the claims about women being felt up, people being turned away from planes for reading the wrong book, or whatever. Probably sometime after a successful lawsuit costs them a few million dollars, alas. ... >-TD --John

1 0

Grateful Dead's former lyricist finds tough fight against searches
by R.A. Hettinga 20 Dec '04

20 Dec '04

<http://www.contracostatimes.com/mld/cctimes/news/10453495.htm?template=cont…> Posted on Sun, Dec. 19, 2004 Grateful Dead's former lyricist finds tough fight against searches By Mary Anne Ostrom John Perry Barlow, former Grateful Dead lyricist and current cyber-rights activist, had hoped to use his arrest on drug charges to shed light on how the Transportation Security Administration conducts its baggage searches. While most defendants caught by airport security with small amounts of contraband typically plead guilty to misdemeanor charges, Barlow decided to fight. He was arrested after a baggage screener at San Francisco International Airport in 2003 found small amounts of marijuana and hallucinogens in an Advil bottle in his checked luggage. He was immediately pulled off a Delta flight and handcuffed. He spent all day in San Mateo County Jail. But Judge Harry Papadakis, a retired Fresno judge, ruled Wednesday that the search of Barlow's checked luggage was reasonable under the U.S. Constitution, and now he must face trial next spring on the charges in San Mateo Superior Court. "I'm distressed," Barlow said after the ruling, calling it a blow to civil rights. "What the judge is saying is that when you are going to travel, you make yourself subject to any search no matter how thorough; the search can be as wide as possible." Barlow had claimed he was the subject of an unlawful search and seizure under the Fourth Amendment; the screener can look in checked baggage for explosives and incendiary devices that might be used to blow up an airplane, his attorney argued, but not drugs. It was a pair of laser gloves Barlow used at the Burning Man festival that initially caught the baggage screener's attention when an X-ray machine showed wires, electrodes and batteries in checked luggage. Barlow's attorney had tried to convince the judge that his client's case would expose the federal agency's baggage check policies as nothing but "a stalking horse" for much broader criminal investigations. The defense did elicit testimony from airport police that they work closely with the Transportation Security Administration, Drug Enforcement Agency and baggage screening contractors to act on drug tips, but that's not what led to Barlow's arrest. The screener, Sandra Ramos, testified Wednesday that when she opened up Barlow's hanging bag, she unzipped one of two compartments. Instead of finding the gloves, she found a large bottle of Advil. She told prosecutors she opened the bottle and dumped out the pills because it seemed much heavier than a normal bottle should be and possibly could have contained explosive material. And that's when she found the marijuana -- less than a quarter of an ounce -- and some fungus-like material that turned out to be hallucinogenic mushrooms. She then unzipped the other side and found the gloves. Law enforcement officials also identified the club drug ketamine and hypodermic needles in the luggage and later found Ecstasy in Barlow's wallet. Barlow is facing five misdemeanor counts. He has said the marijuana was for medicinal purposes and that the needles were used to inject hay fever medication. But from the start of Wednesday's hearing, the key issue was not drugs: It was how much testimony on Transportation Security Administration procedures would be allowed. San Mateo County Deputy District Attorney Aaron Fitzgerald argued that Barlow "was on a fishing expedition" in his attempt to open up the government's policies and procedures. Two government attorneys representing the federal agency sat directly behind Fitzgerald, arguing several times that witnesses could not answer defense questions because information such as how X-ray equipment is used and how workers are trained could "make it easier for terrorists." The judge sided with the prosecution at nearly every turn. As co-founder of the Electronic Frontier Foundation, Barlow has never been shy about condemning the government for what he sees as restricting freedoms. Wednesday's hearing drew more than half a dozen cyber activists. During a hearing recess, before the ruling, Barlow told reporters, "If you are going to have a free country, you certainly have to understand the circumstances under which you can be searched and detained." As for the laser gloves, Barlow showed up in court with them Wednesday. In fact, Barlow packed them in the same suitcase that had been the subject of the search. "The gloves made it through court security today," he said. "Nobody said a thing." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Flaw with lava lamp entropy source
by John Kelsey 20 Dec '04

20 Dec '04

>From: "James A. Donald" <jamesd(a)echeque.com> >Sent: Dec 18, 2004 2:51 PM >To: "cypherpunks(a)al-qaeda.net" <cypherpunks(a)al-qaeda.net> >Subject: Re: Flaw with lava lamp entropy source ... >These days the video entropy source is not a lava lamp, but a >lens cap - in the dark, the ccds generate significant thermal >noise, which (unlike chaotic noise) cannot fail, unless someone >immerses the camera in liquid helium. Do you (does anyone) know of any papers that have formally analyzed this entropy source? > --digsig > James A. Donald --John

1 0

Trouble On The Cards
by R.A. Hettinga 20 Dec '04

20 Dec '04

<http://www.mirror.co.uk/printable_version.cfm?method=printable_version_mirr…> TROUBLE ON THE CARDS By Bob Roberts Deputy Political Editor PLANS to bring in compulsory ID cards are to be hit by a double rebellion in the Commons today. Up to 30 Labour MPs are expected to oppose controversial Government moves to introduce the cards by 2008. And Tory leader Michael Howard - who has given his backing to the cards - is also facing a revolt by his own MPs as up to 40 "go missing" in the vote. Senior Tory Damian Green yesterday branded the cards "authoritarian" and said: "They will make us less free without making us safer." And Mr Howard's own head of policy David Cameron says the cards are a "waste of money". Earlier he said: "Is it time for national identity cards to deal with the problems of illegal immigration, crime and foreign visitors abusing our NHS? My answer is 'No'." Campaign group No2ID called the plan "pointless, expensive and an abuse of human rights". National group co-ordinator Mark Littlewood warned demonstrations would follow. He said: "With the level of opposition we're experiencing, a backlash on the scale of the anti-war demonstrations looks likely." Yesterday Liberal Democrat leader Charles Kennedy urged the government to delay the plan, to give time to "pause and reflect". He added: "That is the sensible way to go about it but I think this Government has got itself so much into tram lines now that it is not behaving sensibly at all." If a large number of Tories fail to vote on the Bill it could plunge Mr Howard into a new leadership crisis. But incoming Home Secretary Charles Clarke is expected to sweep aside calls for a delay when he faces the Commons for the first time in his new role. He insisted: "I certainly shall not pause. I will go ahead with the legislation. "Identity cards are a means of trying to create a secure society. I have always been a supporter." Despite the rebels, the Bill introducing the cards is expected to be voted through by a combination of loyal Tories and Labour MPs. Mr Clarke is expected to announce that the poor and pensioners will get cut-price ID cards to ease the cost, predicted to be around #85. The former Education Secretary will also promise tough punishments for anybody caught abusing the sensitive personal information which will be held on a massive computerised database. And he will insist cards will help the fight against terrorism, organised crime and illegal immigration. The credit card-sized documents will be issued from 2008 to anyone who applies for or renews a passport. The proposals were first introduced by David Blunkett. The ID cards will carry "biometric" details about each bearer, such as fingerprints or an electronic scan of the iris of the eye. These details - along with a photograph, signature, date of birth, address and nationality - will also be stored on the central register. Officials will be able to compare data on the card with the register, theoretically making them impossible to fake. Top -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0