- cypherpunks-legacy - lists.cpunks.org

[i2p] weekly status notes [nov 16] (fwd from jrandom@i2p.net)
by Eugen Leitl 16 Nov '04

16 Nov '04

----- Forwarded message from jrandom <jrandom(a)i2p.net> -----

1 0

Gettin' Our Scots-Irish Up
by R.A. Hettinga 16 Nov '04

16 Nov '04

Fight. Sing. Drink. Pray. Cheers, RAH ------- <http://www.nationalreview.com/script/printpage.asp?ref=/owens/owens20041115…> The National Review November 15, 2004, 8:24 a.m. Gettin' Our Scots-Irish Up Country music reflects America's spirit. I am fortunate to have been given the opportunity to review Jim Webb's magnificent new book, Born Fighting: How the Scots-Irish Shaped America, for NRODT [National Review on dead trees --RAH]. It is a wonderful social history of an individualistic, stubborn, rebellious people responsible for creating America's strongest cultural force. A particularly powerful component of this culture is country music. Webb calls country music "a uniquely American phenomenon," a "hypnotic and emotionally powerful musical style" that evolved from its Celtic origins in the mists of Scotland and Ireland. Country music is at the heart of the Scots-Irish culture....In the hollows through those earlier years the dulcimer found its plaintive notes, the traditionally exquisite violin turned into such a hot fiddle that some warned it came from the devil (think Charlie Daniels: "The Devil came Down to Georgia"), and the banjar, a native African instrument made with a gourd, evolved into the hillbilly banjo. Indeed, anyone who wants to understand the Scots-Irish in America would do well to begin by listening to this genre. It is no accident that Webb describes the importance of country music for the Scots-Irish in his chapter entitled "Fight. Sing. Drink. Pray." Country music is about real life, about "hard living, cheating hearts, and good-looking women." It's also about sin and redemption. Country music teaches that actions have consequences, and no one has ever conveyed this reality more clearly than the hard-living, hard-drinking George Jones. The titles of his songs tell it all: "From Hillbilly Heaven to Honky-Tonk Hell," "Hell Stays Open All Night Long," "The Man that You Once Knew," "He Stopped Loving Her Today," and "I've Had Choices." I've had choices, since the day that I was born. There were voices, that told me right from wrong. If I had listened, no I wouldn't be here today, Living and dying, with the choices I've made. Country music teaches these lessons in a way that puts to shame most of what passes for poetry these days. Consider what I believe to be the greatest country song of all time: "Amarillo By Morning," by the incomparable George Strait. Amarillo by morning, Up from San Antone Everything that I've got, Is just what I've got on... They took my saddle in Houston, Broke my leg in Santa Fe Lost my wife and a girlfriend, Somewhere along the way.... Amarillo by morning, Up from San Antone Everything that I've got, Is just what I've got on I ain't got a dime, But what I've got is mine I ain't rich, But Lord I'm free Amarillo by morning, Amarillo's where I'll be. Or "Whiskey Lullaby," by Brad Paisley and Alison Krause: She put him out like the burnin' end of a midnight cigarette She broke his heart, he spent his whole life tryin' to forget We watched him drink his pain away a little at a time But he never could get drunk enough to get her off his mind Until the night. He put that bottle to his head and pulled the trigger And finally drank away her memory Life is short but this time it was bigger Than the strength he had to get up off his knees. Country music can be overtly religious, which, of course, scares the dickens out of secular elites in this country. Consider Jimmy Wayne's "I Love You This Much": He can't remember the times that he thought Does my daddy love me? Probably not But that didn't stop him from wishing that he did Didn't keep from wanting or worshipping him He guesses he saw him about once a year He could still feel the way he felt Standing in tears Stretching his arms out as far as they'd go Whispering daddy, I want you to know. Chorus I love you this much and I'm waiting on you To make up your mind, do you love me too? However long it takes I'm never giving up No matter what, I love you this much. He grew to hate him for what he had done 'Cause what kind of a father, could do that to his son He said 'damn you daddy', the day that he died The man didn't blink, but the little boy cried. Chorus Half way through the service While the choir sang a hymn He looked up above the preacher And he sat and stared at him He said "Forgive me father" When he realized That he hadn't been unloved or alone all his life His arms were stretched out as far as they'd go Nailed to the cross, for the whole world to know. Chorus But even a man of faith can lose it - at least for a while - if the burden is great enough. The next time you get a chance, listen to Alan Jackson sing "you left my heart as empty as a Monday-morning church" about a man who has just buried his wife. As Webb observes, when the Scots-Irish aren't praying, they are often fighting, singing, or sinning in other ways. Despite the admonition of countless fire-and-brimstone preachers from time immemorial, the Scots-Irish have lived the, ahem, secular life to the fullest. As an old Marine, the drinkin'-and-fightin' strain of country music has always appealed to me (not that I have ever engaged in such rowdy behavior, of course). To my way of thinking, there's nothing like the in-your-face music of Johnny Cash, Waylon Jennings, Hank Williams Jr., Aaron Tippin, and Toby Keith. And we shouldn't forget the rowdy girls. I love the ladies - Patsy Cline, Loretta Lynn, June Carter Cash, Reba, Faith Hill, and the rest - but I have always had a soft spot for the wild ones: Tanya Tucker and my latest favorite, Gretchen Philips, the redneck woman who's here for the party. I may not be a ten but the boys say I clean up good And if I gave 'em half a chance for some rowdy romance you know they would. The Scots-Irish have a 2000-year-old military tradition, so it's not surprising that country music is also overtly patriotic. Who can forget Alan Jackson's 9/11 musical memorial, "Where Were You?" or Toby Keith's moderate response to the terrorists, "Courtesy of the Red, White, and Blue" ("we'll put a boot in your ass, it's the American way")? Country music looks to tradition for continuity. There's nothing like a "ghost of Hank Williams" song. So Alan Jackson sings about "Midnight in Montgomery": Midnight in Montgomery, silver eagle, lonely road I was on my way to Mobile for a big New Years Eve show I stopped for just a minute to see a friend outside of town Put my collar up, found his name, and felt the wind die down Then a drunk man in a cowboy hat took me by surprise Wearing shiny boots, a Nudi suit and haunting haunted eyes. He said, "Friend it's good to see you, it's nice to know you care" Then the wind picked up and he was gone Was he ever really there? 'Cause it's midnight in Montgomery Just hear that whippoorwill See the stars light up the purple sky Feel that lonesome chill When the wind it's right, you'll hear his songs Smell whiskey in the air Midnight in Montgomery He's always singing there. Of course, the elites in this nation hate country music just as they hate what Webb describes as the Scots-Irish culture. So after the elections, novelist Jane Smiley wrote in Slate that The election results reflect the decision of the right wing to cultivate and exploit ignorance in the citizenry. . . . Ignorance and bloodlust have a long tradition in the United States, especially in the red states. . . . Listen to what the red state citizens say about themselves, the songs they write, and the sermons they flock to. They know who they are - they are full of original sin and they have a taste for violence. . . . Well, to Ms. Smiley and her fellow "elites," from us country-music fans: As Aaron Tippin sings in a different context, "Jane - kiss this!" - Mackubin Thomas Owens is an associate dean of academics and professor of national-security affairs at the Naval War College in Newport, R.I. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

3 2

The Beginning of the Crypto Era
by R.A. Hettinga 16 Nov '04

16 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 <http://www.eweek.com/print_article2/0,2533,a=139274,00.asp> EWeek The Beginning of the Crypto Era November 15, 2004 By Larry Seltzer In a move that was totally expected, if a little early, Yahoo has announced that it will put its money where its mouth is and start checking Yahoo Mail with its DomainKeys system. The company had told me that it would do so by the end of the year, but I suppose it had had this last week, during the FTC e-mail authentication summit, as an internal deadline. Earthlink also announced that it will test DomainKeys on its system. DomainKeys is important. It is the main implementation of the second of the two most credible approaches to SMTP authentication, specifically the use of cryptographic signatures to authenticate messages against the domains from which they were sent. The other approach-to check against the IP addresses of the servers in those domains-also moved forward recently with the second version of the Sender ID spec. Don't assume that the DomainKeys implementation is the final form. There is an IETF group called ietf-mailsig working in preliminary stages to standardize the crypto approach to SMTP authentication and they might want to make some changes to the approach used by Yahoo. And I expect Yahoo to be open to such suggestions. In fact, Yahoo's openness to reasonable suggestions and unobjectionable licenses is a big reason to be optimistic about widespread adoption of it. Indeed, while Yahoo has intellectual property claims on its developments in DomainKeys, the company isn't being a jerk about it, like some other coMpanieS in this business that shall remain naMeleSs. There are some interesting questions about DomainKeys and Yahoo's handling of it. The first has to do with performance. My own first impression of cryptography as a solution was that the added performance burden on MTAs (message transfer agents, better known as mail servers) would be great and that many companies would have to upgrade their hardware to run a DomainKeys-enabled server with decent performance. In a recent eSeminar in which I participated, Richi Jennings of Ferris Research echoed this view. But while it's still too early to tell, there's reason to believe the performance issue is not as serious as first impressions would indicate. I've spoken to Sendmail, the leading MTA company in the world, about it. Nobody, except Yahoo, has more hands-on experience actually testing and coding DomainKeys than Sendmail. Sendmail thinks the added performance burden, entirely CPU-based, is on the order of 15 percent to 20 percent. This isn't nothing, but MTAs aren't typically CPU-constrained-they are network- and perhaps disk-constrained-so there could easily be spare CPU capacity in the typical MTA (unless it's running Exchange Server or Notes, in which case it's CPU-starved). Next Page: Why no SPF implementation? The other question I have about Yahoo is why it has refused to implement SPF. Sender Policy Framework is the uncontroversial part of Sender ID, the part that checks the message envelope. Many people still argue that SPF is all we really need. But no serious people believe this, least of all SPF's author Meng Weng Wong, who is a principal author and sponsor of the Sender ID spec and also a fan of DomainKeys. All SPF really stops is bounce messages, also known as "Joe Jobs." It's an important part of the solution, but it's far from an adequate one. But it is an easy one, and there's no good technical reason why Yahoo should resist it. All the other major mail providers, to my knowledge, are implementing SPF as part of their experimentation. The answer for Yahoo is probably something as stupid as not wanting people to get the misimpression that they are hedging on DomainKeys. I asked the company about this several weeks ago, and it weaseled out of a direct answer. Most dissatisfying. The Yahoo announcement focuses on phishing, probably because it's topical. Spam has become a major annoyance, but phishing is scary. And SPF does nothing to address phishing. This is why Microsoft developed Caller ID, the header portion of Sender ID. I should also take a moment to wag my finger at those who continue to express concern at how spammers are adopting SPF and other authentication standards in order to get around them. I don't know if they're walking into a trap or if they're just experimenting, but it won't do them any good. The more spammers authenticate, the easier they will make themselves to block. For insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzer's Weblog. Remember, authentication systems are not complete anti-spam systems. They just identify who is sending the mail, not why they are sending it. This whole approach requires the coordinated use of reputation systems that will use the authenticated address to tell you whether a sender is trustworthy. In such a scenario, an authenticated spammer becomes easy to block. The collapse of MARID brought forth a call for experimentation with the various proposals in the hope that the experience would inform the standards process and help to produce a consensus. We're lucky. The experimentation so far has formed along the lines one would expect, meaning the proposals backed by the major players. The advancement of DomainKeys puts in an approach that the open-source community won't object to and that is forward-looking. It doesn't have to be the only success in this area, but it's good that we have it. Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. - -- - ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' -----BEGIN PGP SIGNATURE----- Version: 1308 iQA/AwUBQZpjVMPxH8jf3ohaEQJJKwCgi1SpEnUCBsoXyXRVKX0O1pyltdkAoKat BGbyLClwxL8k4hHIlcdZ7xB4 =jRYJ -----END PGP SIGNATURE-----

1 0

'Virtual Debit Card' Aims To Combat Online Fraud
by R.A. Hettinga 16 Nov '04

16 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 <http://online.wsj.com/article_print/0,,SB110056759053675009,00.html> The Wall Street Journal November 16, 2004 MONEY 'Virtual Debit Card' Aims To Combat Online Fraud By JENNIFER SARANOW Staff Reporter of THE WALL STREET JOURNAL November 16, 2004; Page D2 Consumers typically have been wary of using bank cards online. One bank's solution is to get rid of the cards. In an effort to ease customers' concerns about fraud and identity theft when shopping online, PNC Bank has launched a new checking account with a "virtual debit card." In addition to a regular debit card that can be used at automated teller machines and in stores, the "Digital Checking" account comes with an "eSpend" card. The card is basically a piece of paper with an account number, expiration date and verification code for making purchases online, over the phone and by mail order. Customers can set a daily limit for their eSpend card (say $1,000) and once that amount is spent, additional purchases won't be approved. PNC Bank, a unit of PNC Financial Services Group Inc., Pittsburgh, hopes the eSpend card will attract people who want to make purchases online with their debit card but are uncomfortable doing so for fear of making their bank account vulnerable to fraud. If an unauthorized person obtains a customer's eSpend number, only the specified daily limit could be taken out of a customer's bank account. If this occurs, PNC says customers aren't liable for the charges. Purchases made with the eSpend card show up separately on bank statements. The account, which is aimed at online-banking customers, also comes with identity-theft reimbursement insurance, a debit card rewards program and no fee for using non-PNC ATMs. The account has a monthly $11 service fee unless customers opt for direct deposit of paychecks or government checks such as Social Security, and pay at least three bills online. The eSpend card comes as debit cards are quickly overtaking cash and checks as preferred methods of payment. According to a report from the American Bankers Association and Boston-based Dove Consulting, 31% of in-store purchases were made with a debit card last year, up from 21% in 1999. Consumers typically have been wary of using debit cards online because, unlike credit cards, they are directly tied to bank accounts. But online use of debit cards is starting to grow. In the first quarter of this year, Visa debit cards were used for 46% of online purchases, up from 43% a year earlier, according to Visa International. Analysts are skeptical about how excited consumers will be about PNC's new card. "I think it's an interesting idea but if you look at consumer usage, consumers are using their debit cards online today in increasing numbers, so it's unclear how much of a demand there would be for a card with that unique application," says Tony Hayes, a Dove analyst. Other banks have long offered similar credit-card products as a way to encourage purchases on the Internet and reduce the amount of fraud they are liable for. In June of 2002, for example, Citigroup Inc.'s Citibank launched free, downloadable software that allows credit-card customers to obtain a new disposable account number each time they make a purchase online. A downside: Such "virtual account numbers" can't be used when a credit card must be shown at pickup. - -- - ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' -----BEGIN PGP SIGNATURE----- Version: 1308 iQA/AwUBQZpi4MPxH8jf3ohaEQKJ3QCfZ+wnHeKvUtcB5OPrDJpowuwZVlcAniqe Y95BEeRcqR2WVUz/2nG4zZvh =wU3/ -----END PGP SIGNATURE-----

1 0

[ISN] BlackBerry prickles Department of Defence spooks
by R.A. Hettinga 16 Nov '04

16 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --- begin forwarded text

1 0

[ISN] BlackBerry prickles Department of Defence spooks
by InfoSec News 16 Nov '04

16 Nov '04

http://www.theage.com.au/articles/2004/11/15/1100384480556.html By Rob O'Neill November 16, 2004 Next Department of Defence communications spooks are restricting the use of wireless BlackBerry devices in government over concerns about the security of confidential and restricted information. The Defence Signals Directorate (DSD), the nation's high-tech electronic eavesdropper, says the popular devices must not be used to transmit confidential or secret information or connect to systems that process it. Agencies may use BlackBerry devices with systems that handle "unclassified, x-in-confidence (excluding cabinet-in-confidence) and restricted information". Telstra, one of several providers of BlackBerry services, insists the systems are secure. "They are used by a lot of customers that require high levels of security in the financial services industry, and even the CIA and the Pentagon," a Telstra spokesman says. Paul Osmond, Asia-Pacific regional director of BlackBerry developer Research In Motion, is "thrilled" the Government has decided the Department of Defence can use the device, because 18 months ago they were prohibited. "Their restrictions are fairly common when you look at a first go-around," Osmond says. "They are similar to those the US defence forces put out when they first used it." The DSD will review the guidelines in February when it is expected RIM and ISPs will seek to have their say. The hand-held BlackBerry device, which allows access to corporate email, including attachments, from almost any location, has become the new must-have corporate accessory in the US and is receiving strong support here. But the swarm of new mobile computing devices poses security challenges to government and private organisations. They are keen to have the functionality but worry about privacy and access. Other consumer devices have also generated alarm. A British security firm's survey revealed Apple's iPod, which has large portable storage capacity and can be plugged into most PCs, is considered a threat. Sometimes such concerns can seem overblown, as in 1999 when the Furby, a computerised toy, was banned from US National Security Agency premises because it could be used as a recorder. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ - --- end forwarded text - -- - ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' -----BEGIN PGP SIGNATURE----- Version: 1308 iQA/AwUBQZpgrsPxH8jf3ohaEQIbrACgoFRvXVUJA1KwCT3bo1W/Kh43CKsAoKgs MVhEl7/6XTLGsGe1fcywBsMm =O3HP -----END PGP SIGNATURE-----

1 0

[ISN] BlackBerry prickles Department of Defence spooks
by InfoSec News 16 Nov '04

16 Nov '04

http://www.theage.com.au/articles/2004/11/15/1100384480556.html By Rob O'Neill November 16, 2004 Next Department of Defence communications spooks are restricting the use of wireless BlackBerry devices in government over concerns about the security of confidential and restricted information. The Defence Signals Directorate (DSD), the nation's high-tech electronic eavesdropper, says the popular devices must not be used to transmit confidential or secret information or connect to systems that process it. Agencies may use BlackBerry devices with systems that handle "unclassified, x-in-confidence (excluding cabinet-in-confidence) and restricted information". Telstra, one of several providers of BlackBerry services, insists the systems are secure. "They are used by a lot of customers that require high levels of security in the financial services industry, and even the CIA and the Pentagon," a Telstra spokesman says. Paul Osmond, Asia-Pacific regional director of BlackBerry developer Research In Motion, is "thrilled" the Government has decided the Department of Defence can use the device, because 18 months ago they were prohibited. "Their restrictions are fairly common when you look at a first go-around," Osmond says. "They are similar to those the US defence forces put out when they first used it." The DSD will review the guidelines in February when it is expected RIM and ISPs will seek to have their say. The hand-held BlackBerry device, which allows access to corporate email, including attachments, from almost any location, has become the new must-have corporate accessory in the US and is receiving strong support here. But the swarm of new mobile computing devices poses security challenges to government and private organisations. They are keen to have the functionality but worry about privacy and access. Other consumer devices have also generated alarm. A British security firm's survey revealed Apple's iPod, which has large portable storage capacity and can be plugged into most PCs, is considered a threat. Sometimes such concerns can seem overblown, as in 1999 when the Furby, a computerised toy, was banned from US National Security Agency premises because it could be used as a recorder. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ - --- end forwarded text - -- - ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' -----BEGIN PGP SIGNATURE----- Version: 1308 iQA/AwUBQZpgrsPxH8jf3ohaEQIbrACgoFRvXVUJA1KwCT3bo1W/Kh43CKsAoKgs MVhEl7/6XTLGsGe1fcywBsMm =O3HP -----END PGP SIGNATURE-----

1 0

Certicom First to Earn FIPS 186-2 Validation for Elliptic Curve Digital Signature Algorithm
by R.A. Hettinga 15 Nov '04

15 Nov '04

<http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=109&STORY=/www/story/11-1…> Certicom First to Earn FIPS 186-2 Validation for Elliptic Curve Digital Signature Algorithm Validation of ECC-based algorithm another step in ECC standardization and widespread adoption MISSISSAUGA, ON, Nov. 15 /PRNewswire-FirstCall/ - Certicom Corp. (TSX: CIC), the authority for strong, efficient cryptography, today announced that its implementation for the Elliptic Curve Digital Signature Algorithm (EassociateCDSA) has earned the Federal Information Processing Standards (FIPS) 186-2 validation certification No. 1 - making it the first company to receive the designation for an elliptic curve cryptography (ECC) -based algorithm. This validation is particularly valuable for original equipment manufacturers (OEMs) and software vendors who sell to government organizations. By using Certicom's ECDSA implementation in their products, they meet FIPS requirements without undergoing the time-consuming and costly testing process. ECDSA is used to build in digital signature functionality and is a faster alternative to legacy algorithms. For the cryptography community, and in particular proponents of ECC, the testing of ECC as part of the FIPS validation process is a significant step in the adoption of this public key cryptosystem. Considered a benchmark for security in government, a FIPS validation assures users that a given technology has passed rigorous testing by an accredited third party lab as set out by the National Institute of Standards for Technology (NIST) and can be used to secure sensitive information. Typically, it drives wide-scale adoption in government and in commercial sectors, particularly in the financial and healthcare sectors that recognize the significance of FIPS validation. This milestone in ECC's evolution follows last year's announcement from the National Security Agency (NSA) that ECC is a 'crucial technology'. Both events are part of the U.S. Government's crypto modernization program. "A major hurdle to widespread adoption of any security technology is standardization. We witnessed that 25 years ago with the Data Encryption Standard (DES) and now are seeing it play out with Advanced Encryption Standards (AES), the successor to DES," said Scott Vanstone, founder and executive vice-president, strategic technology at Certicom. "As a complementary cryptosystem to AES, we can expect the same for ECC. By testing ECC-based algorithms in the FIPS certification process, NIST added a level of assurance that says they've done the due diligence on it and now organizations can be very comfortable adopting it." ECC is a computationally efficient form of cryptography that offers equivalent security to other competing technologies but with much smaller key sizes. This results in faster computations, lower power consumption, as well as memory and bandwidth savings, thereby making it ideal for today's resource-constrained environments. Certicom is considered a pioneer in ECC research and implementations, backed by 20 years of experience. The company developed the industry's first toolkit to include ECC, which has since been adopted by over 300 organizations. Tomorrow it will host the Certicom ECC Conference 2004, the first-ever conference that brings together Elliptic Curve Cryptography researchers, industry experts and users. During the two-day conference, participants from North America, Europe and Asia will discuss the evolution of ECC and share best implementation practices and insights for future applications. About Certicom Certicom Corp. (TSX:CIC) is the authority for strong, efficient cryptography required by software vendors and device manufacturers to embed security in their products. Adopted by the US Government's National Security Agency (NSA), Certicom technologies for Elliptic Curve Cryptography (ECC) provide the most security per bit of any known public key scheme, making it ideal for constrained environments. Certicom products and services are currently licensed to more than 300 customers including Motorola, Oracle, Research In Motion, Terayon, Texas Instruments and Unisys. Founded in 1985, Certicom is headquartered in Mississauga, ON, Canada, with offices in Ottawa, ON; Reston, VA; San Mateo, CA; and London, England. Visit http://www.certicom.com . Certicom, Certicom Security Architecture, Certicom CodeSign, Security Builder, Security Builder Middleware, Security Builder API, Security Builder Crypto, Security Builder SSL, Security Builder PKI, and Security Builder GSE are trademarks or registered trademarks of Certicom Corp. Intel is registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. All other companies and products listed herein are trademarks or registered trademarks of their respective holders. Except for historical information contained herein, this news release contains forward-looking statements that involve risks and uncertainties. Actual results may differ materially. Factors that might cause a difference include, but are not limited to, those relating to the acceptance of mobile and wireless devices and the continued growth of e-commerce and m-commerce, the increase of the demand for mutual authentication in m-commerce transactions, the acceptance of Elliptic Curve Cryptography (ECC) technology as an industry standard, the market acceptance of our principal products and sales of our customer's products, the impact of competitive products and technologies, the possibility of our products infringing patents and other intellectual property of fourth parties, and costs of product development. Certicom will not update these forward-looking statements to reflect events or circumstances after the date hereof. More detailed information about potential factors that could affect Certicom's financial results is included in the documents Certicom files from time to time with the Canadian securities regulatory authorities. SOURCE Certicom Corp. More news from PR Newswire... Issuers of news releases and not PR Newswire are solely responsible for the accuracy of the content. Terms and conditions, including restrictions on redistribution, apply. Copyright ) 1996-2004 PR Newswire Association LLC. All Rights Reserved. A United Business Media company. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Banned Chechen Web Site Now Operating On Swedish Server
by R.A. Hettinga 15 Nov '04

15 Nov '04

<http://online.wsj.com/article_print/0,,BT_CO_20041115_000923,00.html> The Wall Street Journal November 15, 2004 4:57 a.m. EST Banned Chechen Web Site Now Operating On Swedish Server DOW JONES NEWSWIRES November 15, 2004 4:57 a.m. STOCKHOLM (AP)--A pro-independence Chechen Web site that was shut down by the Lithuanian government and then removed from a Finnish server because of a posting that claimed responsibility for the school massacre in southern Russia began operating on a Swedish-owned server. Jean Hamberg, managing director for Port80 AB, a Stockholm-based Internet service provider, said the Web site, www.kavkazcenter.com, was up and running on its servers since late last week. "Nobody has complained about it," he told The Associated Press on Monday. "No officials, I should say." The site is regarded as a clearing house for pro-Chechen information and a mouthpiece for Chechen rebel leaders battling Russian troops in the breakaway province. Lithuania's State Security Department shut the site down in September when it was hosted by Elneta, an Internet service provider in the Lithuanian capital, Vilnius. In early October, the site surfaced on a server owned by Finland's Sonera, but was shut down by the Finnish government. Russia's government has called the site an "information tool of international terrorists." On Sept. 17, the site posted a letter - purportedly by Chechen rebel leader Shamil Basayev - in which he claimed responsibility for the three-day siege of a Russian school in Beslan. More than 330 people died in the standoff, nearly half of them children. It was impossible to confirm whether the letter on the Web site was genuine, but Basayev's previous claims of responsibility have appeared there. Hamberg said the Web site would stay online, since it appeared to have not violated any law. "Our policy is if they're doing anything illegal, then they're out," he said. "If they're not doing anything illegal we don't wish to interfere." The Swedish government had no comment on the site. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Japanese Government Bans Security Researcher's Speech
by InfoSec News 15 Nov '04

15 Nov '04

http://www.ejovi.net/archives/2004/11/japanese_govern.html November 12, 2004 [JUKI net is Japan's national ID system. Ejovi performed a security audit of the system for Nagano Prefecture one year ago] Its been a long day. I am greatly disappointed that Soumushou, the Japanese government that maintains JUKI net, prevented me from speaking today at the PacSec security conference. Soumushou prevented my talk by threatening the Japanese event who currently are seeking contracts from the government The Japanese government gave me two options. 1) Do not talk 2) Drastically change your slides to say what they want me to. When I offered to not use slides at all and give my own opinion they told me that I would not be permitted to speak AT ALL. It is obvious to me that they did not have an issue with my slides or presentation. They were afraid that I would draw attention to problems in JUKI net. Soumushou thinks that they can hide from the issues. They think that if they keep people from speaking about the issues, it will go away. I thought I would be immune from such Japanese government pressures however I underestimated Soumushou's ability to manipulate those around me. Soumushou's reason for forbidding me to speak was this "Since we are endorsing the convention we have to right to tell you not to speak" if this is the case, the Japanese government needs only sponsor or endorse ANY event in which they don't agree with and force the organizers to change the content. If this is the case Japan will never make any progress towards a safer environment. What is most upsetting to me is the fact that I HAD NO PLANS TO CRITIZE the Japanese government. My talk was going to be extremely fair and balanced addressing the issues raised by both sides. In fact I invited Soumushou to meet with me directly so that I can address any issues they may have. I told them this on the telephone and by email. Instead they choose to pressure the Japanese representatives of the conference. They never attempted to talk with me directly. Why is this? If they had issues with something I may say why not ask me about it? Why pressure a company they relies on government contracts? Is this fair? The purpose of my talk was to present both sides of JUKI net security systems. I have no vested interest in seeing it fail or in seeing it succeed. I only wanted to recommend how best to make it safer, how best to improve the system. But Soumushou believed that my recommendations on how to improve its security alone would mean that JUKI net has problems and they refused to admit this. I'm sorry to tell them but it does have security problems. The good news is that the technical issues can be easily resolved. However the greatest problem with JUKI net is not technical but Soumushou's inability to even acknowledge that they exist! How can a system become secure if the Japanese government are not willing to listen to someone who points out issues. Today was a sad day for Japan and a frustrating day for me. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0