- cypherpunks-legacy - lists.cpunks.org

RE: Mystification of Identity: You Say Yusuf, I Say Youssouf...
by John Kelsey 28 Sep '04

28 Sep '04

>From: Tyler Durden <camera_lumina(a)hotmail.com> >Sent: Sep 27, 2004 10:00 AM >To: roy(a)rant-central.com >Cc: cypherpunks(a)al-qaeda.net >Subject: RE: Mystification of Identity: You Say Yusuf, I Say Youssouf... >Many Cypherpunks view the need to take up crypto arms to stem off an >Orwellian, hyper-evil and hyper-competent dictatorship. I'm thinking a more >likely (and no less threatening) scenario is one like "Brazil" (ie, the >movie). Yep. It turns out that broad and scary police powers don't make you any smarter or wiser or more careful, they just make it easier for you to insist on obedience and stifle complaints. Post 9/11, flight attendants and airline employees have more authority to order passengers around and deny people boarding, but they're still the same people they were on 9/10, they're presumably only marginally better at spotting terrorists (at least not obviously Arab-looking terrorists). They just have more power, and fewer consequences when they screw up. ... >-TD --John Kelsey

1 0

John Abizaid needs termination
by Major Variola (ret) 28 Sep '04

28 Sep '04

Saw "general" Abizaid on the news. He was so obviously either experiencing pharmaceutically-induced nystagmus or reading from a teleprompter it wasn't funny. Methinks he's a robot, or taking too many go-pills. Lets hear 2K dead by the elections. We'll settle for less if they're in DC.

2 1

Re: Mystification of Identity: You Say Yusuf, I Say Youssouf...
by Major Variola (ret) 27 Sep '04

27 Sep '04

At 05:53 PM 9/27/04 -0700, Bill Stewart wrote: >and preventing you from flying means you can't carry out your >Clever New Hijacking Plan, such as converting that small guitar >into a set of six piano-wire garrotes or mixing that Organophosphates will still make it onto a plane, have been used in Japan, and might be better used in stationary, more populated and still dense places in the US. Also, no one has really tested whether pilots will suffer 300 passengers to die. But there are groovier places to deploy the human pesticides, jets are so old-school. And then there's the ultimate soft targets, grammar schools. Those who lay with israelis die like israelis. Karma ain't just for breakfast anymore. Birds, roost, home. BTW, I don't think TATP would excite the nitrate-sniffing autodogs.. just light your shoe in the restroom next time for Allah's sake.. Who knew the fall of Rome II would be televised?

1 0

Individual Geopolitical Darwin Awards
by Major Variola (ret) 27 Sep '04

27 Sep '04

At 10:00 AM 9/27/04 -0400, Tyler Durden wrote: >Don't forget, the World Trade Center management was on the Intercom trying >to tell everyone to "Remain inside the Building...It's safest Inside the >Building". > >Fuck. Here on Wall Street I'm a dead man. If you stay in NYC or DC, you are an individual winner of a geopolitical Darwin Award. You can collect along with your half-dozen virgins.

1 0

Mystification of Identity: You Say Yusuf, I Say Youssouf...
by R. A. Hettinga 27 Sep '04

27 Sep '04

Gilmore, et al., are right, as always. If you've been all-but cavity-searched -- okay, virtually cavity-searched, given the state of modern X-Ray airport passenger scanning technology -- and you don't have a weapon, exactly *how* is knowing *who* you are going to affect your ability to hijack an airplane? I see nothing but the continuation of the privatization of air travel from all this nonsense. More NetJet owners, more Marquis Card-carrying business travellers, more investment capital for companies like Eclipse Aviation. Geodesic aviation, anyone? ;-) Cheers, RAH ------- <http://www.time.com/time/nation/printout/0,8816,702062,00.html> TIME.com Print Page: Nation -- Saturday, Sep. 25, 2004 You Say Yusuf, I Say Youssouf... The Cat Stevens incident has its origins in a spelling mistake By SALLY B. DONNELLY The Yusuf Islam incident earlier this week, in which the former Cat Stevens was denied entry into the U.S. when federal officials determined he was on the government's "no-fly" antiterror list, started with a simple spelling error. According to aviation sources with access to the list, there is no Yusuf Islam on the no-fly registry, though there is a "Youssouf Islam." The incorrect name was added to the register this summer, but because Islam's name is spelled "Yusuf" on his British passport, he was allowed to board a plane in London bound for the U.S. The Transportation Safety Administration alleges that Islam has links to terrorist groups, which he has denied, British foreign minister Jack Straw said the TSA action "should never have been taken." The incident points up some of the real problems facing security personnel as they try to enforce the "no-fly" list. One issue is spelling; many foreign names have several different transliterations into English. And the sheer size of the list is daunting; thousands of names have been added in the last couple months, says one government official, bringing the total up to more than 19,000 people to look out for. That makes it difficult for airlines and government agencies to check all passengers. Within the past six months, several people on the no fly list have been mistakenly allowed to fly. Still, the TSA is learning. It recently acknowledged that a Federal Air Marshall, unable to fly for weeks when his name was mistakenly put on the "no-fly" list, was in fact not a threat, and removed his name from the list. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

2 1

Saluting the data encryption legacy
by R. A. Hettinga 27 Sep '04

27 Sep '04

<http://news.com.com/2102-1029_3-5381232.html?tag=st.util.print> CNET News http://www.news.com/ Saluting the data encryption legacy By Bruce Schneier http://news.com.com/Saluting+the+data+encryption+legacy/2010-1029_3-5381232… Story last modified September 27, 2004, 9:00 AM PDT The Data Encryption Standard, or DES, was a mid-'70s brainchild of the National Bureau of Standards: the first modern, public, freely available encryption algorithm. For over two decades, DES was the workhorse of commercial cryptography. Over the decades, DES has been used to protect everything from databases in mainframe computers, to the communications links between ATMs and banks, to data transmissions between police cars and police stations. Whoever you are, I can guarantee that many times in your life, the security of your data was protected by DES. Just last month, the former National Bureau of Standards--the agency is now called the National Institute of Standards and Technology, or NIST--proposed withdrawing DES as an encryption standard, signifying the end of the federal government's most important technology standard, one more important than ASCII, I would argue. Today, cryptography is one of the most basic tools of computer security, but 30 years ago it barely existed as an academic discipline. In the days when the Internet was little more than a curiosity, cryptography wasn't even a recognized branch of mathematics. Secret codes were always fascinating, but they were pencil-and-paper codes based on alphabets. In the secret government labs during World War II, cryptography entered the computer era and became mathematics. But with no professors teaching it, and no conferences discussing it, all the cryptographic research in the United States was conducted at the National Security Agency. In the days when the Internet was little more than a curiosity, cryptography wasn't even a recognized branch of mathematics. And then came DES. Back in the early 1970s, it was a radical idea. The National Bureau of Standards decided that there should be a free encryption standard. Because the agency wanted it to be non-military, they solicited encryption algorithms from the public. They got only one serious response--the Data Encryption Standard--from the labs of IBM. In 1976, DES became the government's standard encryption algorithm for "sensitive but unclassified" traffic. This included things like personal, financial and logistical information. And simply because there was nothing else, companies began using DES whenever they needed an encryption algorithm. Of course, not everyone believed DES was secure. When IBM submitted DES as a standard, no one outside the National Security Agency had any expertise to analyze it. The NSA made two changes to DES: It tweaked the algorithm, and it cut the key size by more than half. The strength of an algorithm is based on two things: how good the mathematics is, and how long the key is. A sure way of breaking an algorithm is to try every possible key. Modern algorithms have a key so long that this is impossible; even if you built a computer out of all the silicon atoms on the planet and ran it for millions of years, you couldn't do it. So cryptographers look for shortcuts. If the mathematics are weak, maybe there's a way to find the key faster: "breaking" the algorithm. The NSA's changes caused outcry among the few who paid attention, both regarding the "invisible hand" of the NSA--the tweaks were not made public, and no rationale was given for the final design--and the short key length. But with the outcry came research. It's not an exaggeration to say that the publication of DES created the modern academic discipline of cryptography. The first academic cryptographers began their careers by trying to break DES, or at least trying to understand the NSA's tweak. And almost all of the encryption algorithms--public-key cryptography, in particular--can trace their roots back to DES. Papers analyzing different aspects of DES are still being published today. By the mid-1990s, it became widely believed that the NSA was able to break DES by trying every possible key. This ability was demonstrated in 1998, when a $220,000 machine was built that could brute-force a DES key in a few days. In 1985, the academic community proposed a DES variant with the same mathematics but a longer key, called triple-DES. This variant had been used in more secure applications in place of DES for years, but it was time for a new standard. In 1997, NIST solicited an algorithm to replace DES. The process illustrates the complete transformation of cryptography from a secretive NSA technology to a worldwide public technology. NIST once again solicited algorithms from the public, but this time the agency got 15 submissions from 10 countries. My own algorithm, Twofish, was one of them. And after two years of analysis and debate, NIST chose a Belgian algorithm, Rijndael, to become the Advanced Encryption Standard. It's a different world in cryptography now than it was 30 years ago. We know more about cryptography, and have more algorithms to choose among. AES won't become a ubiquitous standard in the same way that DES did. But it is finding its way into banking security products, Internet security protocols, even computerized voting machines. A NIST standard is an imprimatur of quality and security, and vendors recognize that. So, how good is the NSA at cryptography? They're certainly better than the academic world. They have more mathematicians working on the problems, they've been working on them longer, and they have access to everything published in the academic world, while they don't have to make their own results public. But are they a year ahead of the state of the art? Five years? A decade? No one knows. It took the academic community two decades to figure out that the NSA "tweaks" actually improved the security of DES. This means that back in the '70s, the National Security Agency was two decades ahead of the state of the art. Today, the NSA is still smarter, but the rest of us are catching up quickly. In 1999, the academic community discovered a weakness in another NSA algorithm, SHA, that the NSA claimed to have discovered only four years previously. And just last week there was a published analysis of the NSA's SHA-1 that demonstrated weaknesses that we believe the NSA didn't know about at all. Maybe now we're just a couple of years behind. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Under the hood of FIPS 140-2 Validations
by R. A. Hettinga 27 Sep '04

27 Sep '04

<http://www.cr80news.com/library/2004/09/26/under-the-hood-of-fips-1402-vali…> : CR80 News Under the hood of FIPS 140-2 Validations Sunday, September 26 2004 by John Morris, president and co-founder of Corsec Security, Inc. In our last article (SecureIDNews, August 2004) we covered what FIPS 140-2 and Common Criteria are at a high level. We introduced you to what these standards are, why we need them, who the players are, what the process is, as well as some of the common terms that you will need to know along the way. Now let's delve into what's actually involved in getting FIPS 140-2. In the next article, we'll do the same for Common Criteria. What is FIPS 140-2 again? As we learned last time, FIPS 140-2 dictates that the cryptographic parts of a product are designed, documented, and can be operated in a secure manner to the government's satisfaction. So FIPS 140-2 is a standard mandated for US federal government purchases, strictly enforced in Canada, and followed in various forms by many other governments worldwide. Widely adopted among financial institutions, the standard is becoming an international mark for cryptographic quality. But who sets the rules and who measures results? FIPS 140-2 is short for "Federal Information Processing Standards Publication." The documents are published by the National Institutes of Standards and Technologies (NIST) in the US. In particular FIPS 140-2 was published by NIST with the cooperation of the Communications Security Establishment (CSE) in Canada. NIST and CSE created a joint effort called the Cryptographic Module Validation Program (CMVP) to specifically manage the FIPS 140-2 process. What is the purpose of this program? CMVP, issues validation certificates that let purchasers know if products (cryptographic modules) actually meet the FIPS 140-2 requirements. It is important to understand that this program focuses only on the parts of the product that utilize cryptography. These are the "cryptographic engines" that power the security in all types of products. It's often difficult or impossible for an end consumer to lift the product's hood and examine the cryptographic engine and ensure it truly works the way it is supposed to. Therefore, the CMVP program ensures that detailed testing an analysis is performed, and only those products that meet the claims are listed on the validation lists. How does CMVP do this? CMVP accredits independent labs (commercial companies) to run a specific set of tests and report to the government on the output of those tests. The body that accredits the testing labs is called the National Voluntary Laboratory Accreditation Program, or NVLAP. Initially NVLAP accredited three laboratories to ensure commercial competition (one of which I managed). However, as industry demand and international interest has grown, so to has the number of labs. Currently, CMVP oversees nine testing labs across the US, Canada, and United Kingdom. How do the testing labs work? Testing labs are independent, for-profit organizations, so they compete for the vendors' business. They are all governed by the same sets of rules and regulations and hopefully produce the same end result in judging cryptographic engines. However, the process and procedures they use to achieve the results and how they evaluate documentation, design, and products vary. This is part of the reason that CMVP provides multiple laboratories to satisfy the needs of the competitive commercial marketplace, allowing vendors to compare laboratories on location, prices, responsiveness, resources, etc. But to ensure consistent quality testing the CMVP periodically monitors laboratory quality and prohibits testing labs from consulting on product design or creating documents for products they test. While laboratories can offer some guidance as to what the standard requires, they may not advise a vendor on how to relate that guidance to their specific product. There are separate consultants (such as my company, Corsec) that specialize in helping vendors in these areas. Vendors complain FIPS 140-2 is too hard - is it necessarily? A FIPS 140-2 validation entails significant effort for a vendor before, during and after the vendor chooses the lab. They must verify that their product design is compliant to the requirements in the standard. If not, then design changes will have to be made before the product goes through testing. Next, the vendor has to produce a large body of documentation that explains how the product meets cryptographic security requirements, how its design complies with them, and how it will behave in specific situations. The CMVP program requires very specific documents be submitted in particular formats. This means the vendors or their consultants must spend significant efforts producing documentation for FIPS 140-2 that they would not otherwise produce. Most vendors are not practiced in producing FIPS 140-2 Security Policies, Finite State Machines, or Vendor Evidence documents and may either spend more effort than laboratories require under FIPS 140-2, or include the wrong information. However, with the right focus in the documents, a vendor's product can be quickly evaluated by a laboratory, and efforts significantly reduced. The documents have been submitted, the testing has been done - so now what? Once the commercial testing has been performed, the CMVP reviews the test report and Security Policy as part of their quality control. Assuming the vendor responds promptly and correctly to government questions, CMVP will sign a validation certificate for the tested version of the product, and post it on their web site. In the past, lack of staffing and funding, and sharp growth in FIPS 140-2 testing has caused delays in the government's ability to process test reports - another source of vendor complaints. Although still woefully under-funded despite the recent focus on communications security, the CMVP has avoided the huge delays folks like INS have suffered, and continues to streamline the process. What does this mean to the purchaser? Government or Financial Services industry purchasers who are required to purchase only FIPS 140-2 validated products have begun using validated lists as shopping lists. They help narrow the playing field when comparing similar types of products. If one has been validated and another has not, the purchaser must choose the one with the FIPS 140-2 certificate. Thus, the validated products lists show which products have proven they meet FIPS 140-2 requirements for cryptographic security. It tells you that qualified, independent cryptographic "mechanics" have looked under the hood of the product and ensured the engine is soundly designed, well implemented, and running smoothly. More and more, this assurance is becoming a basic requirement of purchasers inside and outside the government. Vendors have noted this, and the list of validated vendors reads like a who's who of serious players in the market. These days, gaining a FIPS 140-2 validation also tells purchasers that a vendor is committed to security, as validations are typically far from cheap, fast, or easy. Next month, we will cover the testing process for Common Criteria and how it relates to FIPS 140-2 validation. In the meantime, you can read more about FIPS 140-2 requirements at www.corsec.com/fips_center.php, or contact me at jmorris at Corsec dot com. About the author John Morris is president and co-founder of Corsec Security, which offers consulting services for Common Criteria and FIPS 140-2 product validations. Mr. Morris is the former manager of a NVLAP-accredited testing laboratory, and has worked for the last decade in cryptography, public key infrastructure and security engineering with a focus on government security validations. You can read a Q/A by Mr. Morris in Corsec's monthly e-newsletter by visiting www.corsec.com/news.php. Questions can be submitted to info(a)corsec.com. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Now we are 8 (and this token proves it)
by R. A. Hettinga 27 Sep '04

27 Sep '04

<http://www.theregister.co.uk/2004/09/24/verisign_age_verification_token/pri…> The Register Biting the hand that feeds IT The Register » Security » Identity » Original URL: http://www.theregister.co.uk/2004/09/24/verisign_age_verification_token/ Now we are 8 (and this token proves it) By Thomas C Greene (thomas.greene at theregister.co.uk) Published Friday 24th September 2004 14:02 GMT VeriSign announced a new USB token that verifies the ages and sexes of children using a computer, and claimed that this will make it easier for innocent sprouts to avoid online predators, Reuters reports. "Chatroom lurkers who can't prove their age will stick out like sore thumbs as more kids adopt the tokens," the wire service explained. The so-called i-Stik USB token will provide verification of a child's age and sex. School administrators will provide lists of students, with their dates of birth and sexes, and VeriSign will encode that information onto the i-Stick tokens. The scheme will begin with a handful of schools for testing this Fall, and, if all goes according to plan, be extended to thousands of schools starting next Spring. That is, assuming its glaring flaws don't become painfully evident by that time. Most obviously, the token will not verify age or sex of the person using it, but only of the person to whom it was issued. Anyone might be using it, and no doubt paedos will be scrambling to get their hands on one of their own, either through loss, theft, or bribery. Once the tokens become popular and widely available, one can expect a brisk trade in them on paedo bulletin boards. (Naturally, the Feds will have to be supplied with plenty of these gizmos, so that they can spend their days hanging out in kids' chatrooms with better cover.) Meanwhile, parents will be lulled further into foolish notions that an Internet-connected PC makes for an adequate electronic babysitter. The Internet is adult space, and there is no substitute for parental supervision. If this scheme does anything to produce a false sense of security among parents, then it's worse than nothing; it's actually dangerous. One thing that the tokens will be good for is online marketing to children. Marketers will be able to get a more accurate sense of the ages and sexes of young visitors to various online venues, and target them more precisely. It will also make for decent PR and corporate image-making for VeriSign, suggesting that the company takes the safety of children seriously. Most importantly, it will produce a nice revenue stream from a basically worthless product that school districts will purchase with tax dollars. In all, it's a win/win gimmick and publicity stunt, so long as child safety is not a criterion for judging its success. ® Thomas C Greene is the author of Computer Security for the Home and Small Office (http://basicsec.org) a comprehensive guide to system hardening, malware protection, online anonymity, encryption, and data hygiene for Windows and Linux. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Passports: al-Qaeda's terror weapons
by R. A. Hettinga 27 Sep '04

27 Sep '04

<http://www.abs-cbnnews.com/NewsStory.aspx?section=Focus&oid=56434> ABS-CBNNEWS.COM Sunday, August 1, 2004 11:31 PM Passports: al-Qaeda's terror weapons Vienna, Austria - They're just little embossed rectangles in burgundy, forest green or navy blue, but they can lay a nation bare to a terrorist plot. Passports, not box cutters or even jetliners, may be al-Qaeda's most powerful weapons. Stolen and legitimate, doctored and untouched, they have enabled Osama bin Laden's network and other terror groups to plan and carry out attacks worldwide. In its final report, the US commission investigating the Sept.11 attacks touts high-tech biometric passports, still in the developmental stage, and better border guard training as key ways to tighten the United States' defenses. But antiterrorism experts, mindful of the ingenuity demonstrated by Islamic militants, told The Associated Press they feel humbled and helpless. "One of the hidden criticisms [in the report] is that not only were we not prepared on Sept. 11, but the measures we've taken from Sept. 11 to today have not improved the matter that much," said Michael Greenberger, who was a Justice Department official during the Clinton administration. "Our databases are a mess. Change a person's middle initial and he doesn't show up," said Greenberger, who now directs the University of Maryland's Center for Health and Homeland Security. "By and large, we've not been terribly successful." The commission offers no argument. "No one can hide his or her debt by acquiring a credit card with a slightly different name," said its report, released last week. "Yet today, a terrorist can defeat the link to electronic records by tossing away an old passport and slightly altering the name in the new one." Conceding it has only "fragmentary" evidence of the travels of the Sept. 11 organizers and hijackers, the commission's 567-page report nonetheless is packed with detailed accounts of how the terrorists obtained and modified the passports that got them into the United States. A key panel recommendation points up the seriousness of the threat: "Targeting travel is at least as powerful a weapon against terrorists as targeting their money. The United States should combine terrorist travel intelligence, operations, and law enforcement in a strategy to intercept terrorists, find terrorist travel facilitators, and constrain terrorist mobility." That, experts say, is far easier said than done. "If you have someone who is determined to evade immigration controls, they'll do it -- or at least they'll have a good chance," said Alex Standish, editor of Jane's Intelligence Digest. "I don't see any evidence to suggest that we've had any success in making [al-Qaeda] any less of a threat." Al-Qaeda once brazenly operated its own passport office at the airport in Kandahar, Afghanistan, where the group "altered papers, including passports, visas and identification cards" before the Sept. 11 attacks on the World Trade Center and the Pentagon, the commission notes. Although the US-led war in Afghanistan ended such Taliban-protected operations, there are plenty of terrorists worldwide who are skilled in doctoring documents, the panel warns. It says al-Qaeda and others have refined half a dozen simple yet highly effective techniques. Among the most popular is obtaining stolen passports, which authorities say are available on a lucrative black market that stretches from Eastern Europe to Southeast Asia and South Africa. There are up to 10 million lost or stolen passports in circulation worldwide, according to Interpol estimates. "You can find all sorts of fake passports in the Balkans, including stolen or fake American documents, a former high-ranking police official in Serbia told AP on condition of anonymity.Experts say they're being sold for as little as US$75, although US passports can fetch US$3,000 or more. Al-Qaeda militants and other terrorists intercepted in Europe had obtained South African passports they apparently got from crime syndicates operating within the government agency that issues the documents, officials disclosed to AP last week. Another commonly used technique involves adding or removing visa cachets and entry and exit stamps. By doing so, experts say, terrorists can delete any evidence of their travel to suspicious destinations such as Afghanistan or Pakistan. They also can create false trails to throw authorities off track. Two of the Sept. 11 hijackers, Nawaf al Hazmi and Khalid al Mihdhar, apparently flew to Bangkok because "they thought it would enhance their cover as tourists to have passport stamps from a popular tourist destination such as Thailand," the commission says. Some simply would turn in passports filled with suspicion-arousing visas and stamps from countries where al-Qaeda operated -- even if the documents were still valid for another year -- and get new, clean ones. Fourteen of the 19 suicide hijackers, exhorted by Sept. 11 mastermind Khalid Sheikh Mohammed, obtained new passports. Others work to acquire as many passports as possible, reasoning that a Canadian or Belgian passport is less likely to prompt scrutiny from US border guards than one from Saudi Arabia. In one case cited by the commission, convicted terrorist Ahmed Ressam obtained a blank baptismal certificate that a document vendor had stolen from a Roman Catholic Church in Montreal, and used it to get a genuine Canadian passport. Saudi hijackers had a problem: If they traveled to Afghanistan via Pakistan, and the Pakistanis stamped their passports, they risked having them confiscated back in Saudi Arabia. "So operatives either erased the Pakistani visas from their passports or traveled through Iran, which did not stamp visas directly into passports," the commission says. Tehran has angrily denied any complicity in the Sept. 11 attacks, even though the panel contends up to 10 of the hijackers passed through Iran en route to the United States. Al-Qaeda operative Tawfiq bin Attash indicated that Malaysia repeatedly was used as a place to plot attacks "because its government did not require citizens of Saudi Arabia or other Gulf states to have a visa." Bin Attash, better known as Khallad, helped bomb the USS Cole in Yemen in October 2000, killing 17 American sailors. Greenberger is among many pushing for the swift consolidation of travel databases "so these names start popping up." He and others also are pressing for the introduction of supposedly tamper-proof biometric passports that will contain digital photographs and fingerprints. The European Union agreed in March to fast track the inclusion of biometric data in passports by the end of 2006. Belgium has vowed to be among the first by introducing its new travel documents next year, and Austria, Denmark and Slovenia have developed working prototypes. "We've got to adopt the technology and get away from purely paper documents," Greenberger said. "Nothing is going to be foolproof, but by altering the technology, I think it's possible to raise our defenses," he said. "The harder we make it to forge documents, the greater our gains in protecting the borders. You're really upping the ante." But Standish, of Janes' Intelligence Digest, is skeptical. "The basic problem is that if a document of any kind can be produced, it can be falsified or forged," he said. "As an IRA terrorist once famously said to the authorities: `You have to be lucky all the time. I only have to be lucky once."' -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

AOL to Sell Secure ID Tags to Fight Hackers
by R. A. Hettinga 27 Sep '04

27 Sep '04

<http://www.reuters.com/newsArticle.jhtml?type=internetNews&storyID=6284760> Reuters AOL to Sell Secure ID Tags to Fight Hackers Mon Sep 20, 2004 06:18 PM ET NEW YORK (Reuters) - America Online will begin offering to sell members a security device and service that has been used to safeguard business computer networks, the world's largest Internet service provider said on Monday. AOL, a unit of Time Warner Inc. (TWX.N: Quote, Profile, Research) , signed a deal with Internet security company RSA Security Inc. (RSAS.O: Quote, Profile, Research) , to launch its new AOL PassCode, designed to add an additional layer of protection to member accounts. PassCode users will be provided with a small handheld six-digit numeric code key. To log onto an AOL account equipped with the service, users will have to type in the six-digits, which refresh on the device every 60 seconds, on top of using the regular password. The code-key device will cost $9.95. Monthly service costs range from $1.95 to $4.95. "AOL PassCode is like adding a deadbolt to your AOL account by automatically creating a new secondary password every 60 seconds," said Ned Brody, senior vice president of AOL Premium Services. Hackers coined the term "phishing" in 1996 to refer to the act of swindling unsuspecting AOL customers into giving up their passwords through phony e-mails or instant messages. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1