- cypherpunks-legacy - lists.cpunks.org

[ISN] Safe and insecure
by InfoSec News 19 May '04

19 May '04

http://www.salon.com/tech/feature/2004/05/18/safe_and_insecure/index.html By Micah Joel May 18, 2004 Last week, I turned off all the security features of my wireless router. I removed WEP encryption, disabled MAC address filtering and made sure the SSID was being broadcast loud and clear. Now, anyone with a wireless card and a sniffer who happens by can use my connection to access the Internet. And with DHCP logging turned off, there's really no way to know who's using it. What's wrong with me? Haven't I heard about how malicious wardrivers can use my connection from across the street to stage their hacking operations? How my neighbors can steal my bandwidth so they don't have to pay for their own? How I'm exposing my home network to attacks from the inside? Yup. So why am I doing this? In a word, privacy. By making my Internet connection available to any and all who happen upon it, I have no way to be certain what kinds of songs, movies and pictures will be downloaded by other people using my IP address. And more important, my ISP has no way to be certain if it's me. In mid-April, Comcast sent letters to some of its subscribers claiming that their IP addresses had been used to download copyrighted movies. Since Comcast is not likely to improve customer satisfaction and retention with this strategy, it's probable the letter was a result of pressure from the Motion Picture Association of America or one of its members. And to Comcast's credit, it stopped short of direct accusation; instead it gives users an out. Says the letter, "If you believe in good faith that the allegedly infringing works have been removed or blocked by mistake or misidentification, then you may send a counter notification to Comcast." That's good enough for me. I've already composed my reply in case I receive one of these letters someday. "Dear Comcast, I am so sorry. I had no idea that copyrighted works were being downloaded via my IP address; I have a wireless router at home and it's possible that someone may have been using my connection at the time. I will do my best to secure this notoriously vulnerable technology, but I can make no guarantee that hackers will not exploit my network in the future." If it ever comes down to a lawsuit, who can be certain that I was the offender? And can the victim of hacking be held responsible for the hacker's crimes? If that were the case, we'd all be liable for the Blaster worm's denial of service attacks against Microsoft last year. Don't get me wrong. I'm not deliberately opening my network to hackers and miscreants bent on downloading copyrighted material. I'm simply choosing not to secure it. That's no different from the millions of people who haven't installed anti-virus software and the millions more who don't keep theirs up to date. Yes, their vulnerabilities allow viruses to spread more quickly, but that's their choice, right? What about the security of my home network? A determined hacker may be able to crack my passwords or exploit weaknesses in the operating system that I never even thought of, but how is that different from before? There's no system that's completely secure, so whether hackers are inside or outside my firewall will make little difference. I'm willing to trade a little security for privacy. It feels strange to be opening up my network after years of vigorously protecting it, and it's not without a tinge of anxiety that I do so. But there's also a sense of liberation, of sticking it to the Man, that's undeniable, as well as an odd sense of community. It seems there's safety in numbers after all, even among strangers. - - - - - - - - - - - - About the writer Micah Joel is a systems engineer for a software company, an award-winning tech presenter and an early adopter of home wireless. _________________________________________ ISN mailing list Sponsored by: OSVDB.org --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

ID Pass? But I Am Mayor..
by R. A. Hettinga 19 May '04

19 May '04

<http://www.mirror.co.uk/printable_version.cfm?method=printable_version_mirr…> ID PASS? BUT I AM MAYOR.. By Geoffrey Lakeman SELF-important mayor Anne Rey refused to open a police conference in her town - because she had to wear a security pass. Home Secretary David Blunkett will wear official ID at the meeting in Bournemouth, Dorset. But councillor Rey was "insulted" when asked for a passport photo for her pass, and said wearing her robes should be enough. Clive Chamberlain of the Dorset Police Federation, which is hosting the Police Federation Conference at Bournemouth International Centre, said: "She's being very silly. "The Home Secretary will be wearing a pass and when the Prime Minister comes to conferences he wears a pass too. "I don't know who she thinks she is. Her stance will embarrass the people of Bournemouth." Bournemouth-born Mrs Rey, 47, said: "I'd have thought going in my robes, wearing my chains and going with the mace-bearer would be enough." Deputy mayor David Baldwin, who will wear ID, will open the event. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "Several times a week, to enter a TV studio say, or to board a plane, I have to produce a tiny picture of my face." -- Christopher Hitchens

1 0

VIA Reveals Details of Next Generation C5J Esther Processor Core With Advanced Features For Securing E-Commerce Transactions
by R. A. Hettinga 19 May '04

19 May '04

<http://www.linuxelectrons.com/article.php/20040519090517729> LinuxElectrons - VIA Reveals Details of Next Generation C5J Esther Processor Core With Advanced Features For Securing E-Commerce Transactions Wednesday, May 19 2004 @ 09:05 AM Contributed by: ByteEnable San Jose, CA -- VIA Technologies, Inc, a leading innovator and developer of silicon chip technologies and PC platform solutions, has revealed details of the ultra power efficient VIA C5J "Esther" processor core manufactured with IBM's advanced 90nm SOI process and optimized for information security and e-commerce transactions. With its ultra low power consumption, the VIA C5J Esther core targets smart digital devices that extend the reach of x86 architecture further into the consumer electronics, embedded and mobile fields than current processor performance and thermal limitations allow. The new core is based on IBM's advanced 90nm SOI manufacturing process, providing a significant boost in processor speed within the same thermal bracket as current VIA processors, and reducing maximum power consumption to a mere 3.5W at 1GHz. Designed to be coupled with a range of feature rich chipsets from VIA, the C5J Esther core will enable unprecedented performance of demanding applications, such as high compression video streaming and data encryption/decryption, from miniature, fanless devices. The new C5J Esther core provides world-class security for e-commerce transactions by accelerating RSA encryption and Secure Hashing (SHA-1 and SHA-256), together with support for execution (NX) protection for countering email worms/viruses. Other performance enhancing features include a new faster Front Side Bus (FSB) of up to 800MHz, SSE2/SSE3 multimedia instructions, and a larger L2 cache. "Our approach to processor design allows small, fanless devices to carry out the most demanding security operations while simultaneously processing today's increasingly sophisticated digital entertainment applications," said Glenn Henry, President, Centaur Technology. "The new architecture of the C5J Esther core will allow us to ramp up processor speeds to 2GHz and above within the same thermal design points as previous cores, opening up new markets for our processors and extending the reach of the x86 architecture into new device categories." More of the World's Most Advanced On-Die x86 Processor Security Features The C5J Esther core extends the VIA PadLock Hardware Security Suite to include execution (NX) protection, Montgomery Multiplier support for RSA encryption and secure Hash (SHA-1 and SHA-256) algorithms in addition to the VIA PadLock RNG and VIA PadLock ACE that are featured in the current VIA C5P Nehemiah processor core. These hardware-based building blocks effortlessly carry out operations within security programs and help to improve overall system performance. "It's great to see a CPU vendor provide hardware support for the most important needs of crypto," said Phil Zimmermann, creator of PGP 1.0. "It's always been hard to find a good entropy source for random number generation on an unmanned server, a fast AES implementation for on-the-fly disk encryption, and hardware support for fast public key operations for a server to handle a high traffic workload from remote users. I wish all CPU vendors would do this." Execution (NX) protection prevents malicious code associated with worms or viruses from executing and propagating from memory. The VIA C5J Esther core's NX feature marks memory with an attribute that indicates that code should not be executed from that memory, helping to prevent damage or propagation of malicious code within x86 devices. Execution (NX) protection is an important new hardware-based feature that will be supported in the Microsoft. Windows. XP Service Pack 2. The RSA algorithm is the most widely used public-key cryptography system today and is increasingly important to e-commerce transactions that require exchanging confidential information with websites or checking access privileges. The major challenge facing public-key cryptography is that it requires large amounts of processing power, posing a critical problem for low power consumer electronics and embedded devices that cannot afford to halt in the middle of a video stream or transaction while it does the heavy lifting required by security programs. The VIA C5J Esther core features a dedicated x86 instruction that performs Montgomery Multiplication, an operation used to speed-up RSA cryptography, reducing the workload on the processor and helping to improve overall system performance during e-commerce transactions. Secure Hash Algorithms are used in cryptography to provide digital signatures that enable the recipient to verify the authenticity of the origin of the message. The VIA C5P Esther core provides two Secure Hash functions (SHA-1 and SHA-256) that assist in the creation and verification of digital signatures through algorithms that are embedded in the processor die. "The addition of hardware acceleration for SHA-1 hashing and large-integer operations for public-key cryptography make VIA processors an excellent choice for the implementation of security protocols such as IPsec, SSL/TLS, and SSH, since they eliminate the often heavy CPU overhead normally imposed by the crypto portions of these protocols," said Doctor Peter Gutmann of the University of Auckland and author of "CryptLib". "This removes the need to use the expensive external crypto-processors that are often required to achieve acceptable performance under load." "I am delighted to see that VIA's impressive on-chip AES capability is being further extended to provide execution (NX) protection, SHA hashing and support for public key cryptography using Montgomery Multiplication," said Dr. Brian Gladman, a leading information security specialist from Worcester, United Kingdom. "This will put VIA processors in a leading position for building secure applications offering high throughput and low CPU security overheads." More information, programmers guides and independent third party evaluations of the VIA PadLock Hardware Security Suite are available from the VIA PadLock Hardware Security Suite website. IBM's 90nm SOI Process The VIA C5J Esther core is being produced with IBM's groundbreaking silicon manufacturing technologies that include copper interconnects, silicon-on-insulator (SOI) and low-k dielectric insulation, together with its advanced 90-nanometer (nm) process. These advanced manufacturing technologies are designed to reduce power consumption and allow processor speeds of 2GHz and beyond within the same thermal envelope as current VIA processors. IBM's 90nm manufacturing process provides greater scope for power saving and performance enhancements by decreasing the internal distances traveled by electronic signals within the processor. The low-k dielectric technique, introduced by IBM, is a new method of building microchips that can deliver boosts in computing speed and performance of up to a 30 percent by facilitating the faster movement of electronic signals through the chip. Similarly, IBM's SOI CMOS technology limits transistor leakage, further increasing performance by an estimated 20-35% while reducing power consumption. The C5J Esther processor core is designed by Centaur Technology, a wholly owned subsidiary of VIA Technologies, Inc., and being manufactured by IBM at their state-of-the-art 300mm (12 inch) foundry in East Fishkill, N.Y. VIA at Embedded Processor Forum 2004 VIA is staging various live demonstrations of the VIA PadLock Hardware Security Suite at the Embedded Processor Forum in the Empire Room on Tuesday and Wednesday, 18th and 19th May, including a new AES encryption benchmark tool that compares software-based encryption to hardware-based encryption using the VIA Padlock ACE. Also on display will be the soon to be released VIA EPIA SP12000 Mini-ITX mainboard demonstrating high compression rate MPEG-4 and MPEG-2 digital video playback. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

IRS May Help DOD Find Reservists
by R. A. Hettinga 19 May '04

19 May '04

<http://www.military.com/Content/Printer_Friendly_Version/1,11491,,00.html?s…> Military Insider Newsletter IRS May Help DOD Find Reservists Fort Worth Star-Telegram May 18, 2004 FORT WORTH, Texas - The Defense Department, strapped for troops for missions in Iraq and Afghanistan, has proposed to Congress that it tap the Internal Revenue Service to locate out-of-touch reservists. The unusual measure, which the Pentagon said has been examined by lawyers, would allow the IRS to pass on addresses for tens of thousands of former military members who still face recall into the active duty. The proposal has largely escaped attention amid all the other crises of government, and it is likely to face opposition from privacy rights activists who see information held by the IRS as inviolate. For it to become practice, Congress and President Bush would have to approve the proposal, which would involve amending the tax code. Ari Schwartz, an associate director of the Center for Democracy and Technology in Washington, said granting access to any IRS data would open the door to more requests from other arms of the government. Just a few years ago, Congress strengthened the privacy provisions of the tax code, he said. "There are other ways to solve the problem they have, without putting the tax information at risk," Schwartz said. "We would hope that those members who worked only four or five years ago on strengthening tax-privacy laws would stand up and say this is a bad idea." Lt. Col. Bob Stone, a spokesman for the assistant defense secretary for reserve affairs, said the proposal was developed several years ago and is unconnected to the Army's current shortage of troops. Part or all of nine of the Army's 10 active-duty divisions are deployed to Iraq or Afghanistan, and 167,000 members of the reserves or National Guard are on active duty, with thousands more on alert for mobilization. Unknown to most Americans, though, is the existence of the Individual Ready Reserve, which has more than 280,000 members. The IRR is a distinctly different animal than the drilling reserves or National Guard. Those in the IRR are people who have completed their active-duty tours but are subject to involuntary recall for a certain number of years. For example, a soldier who serves four years on active duty remains in the IRR for another four years. During that time, however, they receive no pay, do not drill with a unit and are otherwise completely civilian. The problem for the Pentagon is that the whereabouts of 50,200 of those veterans are unknown to the Army, Navy, Marine Corps and Air Force. The largest number - 40,700 - are former Army GIs. Because Texas sends more people into the service than almost any other state, it's a good bet many are in the Lone Star State. "While the military today is comprised of an all-volunteer force, every individual who volunteers for service in the armed forces voluntarily accepts an eight-year military service obligation," Stone said. The troops are required to keep the services' updated on their residences, but many do not. Thirty-four percent of former Army soldiers cannot be tracked. The unknowns in the other services are in the single digit percentages. "One of the difficulties that the military services confront is keeping addresses current," Stone said. The Defense Department has called on members of the IRR before. About 7,000 people have been recalled since 9-11, Stone said. Approximately 30,000 were recalled for service during the buildup for the Persian Gulf War in 1990 and 1991, he said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

[Politech] Here's someone who actually likes political spam [sp]
by R. A. Hettinga 18 May '04

18 May '04

--- begin forwarded text

1 0

'Taxi! Fly Me To Cleveland'
by R. A. Hettinga 18 May '04

18 May '04

Geodesic Air Travel is here. I flew out of Albuquerque last week with one of the guys from Eclipse Aviation. Okay. We were on the same plane. I was in steerage. He wasn't. :-). Cheers, RAH ------- <http://online.wsj.com/article_print/0,,SB108491821399715012,00.html> The Wall Street Journal May 19, 2004 THE MIDDLE SEAT By SCOTT MCCARTNEY 'Taxi! Fly Me To Cleveland' New Four-Passenger Jets Spur Plans for Cab-Like Air Service; Memories of People Express May 19, 2004 Perhaps as soon as next year, travelers will have a new alternative to flying commercial airlines or buying their own jet. Using a new generation of small jets that are currently in flight testing, several entrepreneurs are trying to launch "air taxi" services. The goal is to let corporate travelers bypass crowded airports and fly into smaller, local airports, at half of the current cost of chartering a jet. The most advanced air-taxi effort is coming from the man who brought the bus to air travel. Donald C. Burr -- founder of People Express Airlines back in the 1980s -- plans to launch iFly Air Taxi Inc. service next year. He has teamed up with son, Cameron, as well as his onetime nemesis, Robert L. Crandall. The former chief executive of AMR Corp. and its American Airlines, Mr. Crandall once helped run Mr. Burr's People Express out of business. Venture capitalists and aircraft manufacturers say other groups are also developing plans for air-taxi service, but none has come forward publicly yet or has had to make a Securities and Exchange Commission filing as iFly did March 29. Air taxis are also envisioned as a growing part of the nation's air-transport system in a futuristic blueprint being developed by a government task force that will report to the White House later this year. One reason for optimism that now is the right time for air taxis: The arrival of a new generation of four-passenger "micro jets" that can operate more cheaply than conventional jets. These aircraft typically are much lighter than conventional private jets, and are powered by a new generation of small, fuel-efficient engines. None of the planes are in service yet. Manufacturers are accepting advance orders, which so far are being placed by a mixture of private individuals and hopeful air-taxi operators. The new planes have the potential to revolutionize transportation. Currently, chartering private jets is extremely expensive, costing $7,000 or more for a 500-mile hop, round-trip. Fractional ownership (where you buy a "share" of an aircraft that entitles you to use it periodically) is no bargain either. Corporate-owned jets, while sometimes economical for shuttling groups of executives, are often viewed as overly expensive perks. Air-taxi service would be different, in theory at least. Mr. Burr says he can provide rides for $3 to $4 a mile, on average -- which works out to be a bit more expensive than most first-class tickets. A trip to Cleveland from Teterboro, N.J., for example, might cost $1,000 to $1,400 on average. By comparison, an unrestricted first class ticket on Continental Airlines from Newark, N.J., to Cleveland costs $1,338. iFly is expected to announce an order for Adam Aircraft jets soon. The Adam A700, which at $2 million is half of the price of the cheapest Cessna Citation jet right now, began flight tests in July 2003. The Adam jet is one of a half-dozen new aircraft like this in development. Honda Motor Co. has been conducting test flights of its HondaJet in North Carolina; Toyota Motor Corp. is also working on a jet. Eclipse Aviation Corp., run by a former software executive with considerable financial backing, says it has orders for more than 2,000 jets. Other heavy hitters are working on the most important aspect, the engines. General Electric Co. is working on the Honda jet; Pratt & Whitney, a unit of United Technologies Corp., is testing a new engine that will power the Eclipse jet; and Williams International is shrinking an engine currently used on Citation jets for the micro-jet class. It powers the Adam Aircraft jet. Corporate aviation has a solid safety record, with an accident rate per flight-hour about on par with commuter airlines, according to National Transportation Safety Board figures. Air-taxi operations also claim to offer convenience, since travelers would arrive and depart at small airports, park just a short walk from the plane, and could choose their own departure times. And taking a taxi would avoid security lines and reduce the chances of lost luggage. "It's a highly simplified charter operation," Mr. Crandall says. "We hope to run it like a limousine service." Much like airline tickets, iFly will be priced so that peak periods are more expensive than off-peak times. In addition the third and fourth seats on a "taxi" flight will be a lot cheaper than the first or second seats sold. This time, he says he intends to grow slowly. The lack of technology and aggressive growth ultimately cratered People Express, which was bought out by Continental in 1987. iFly, which has raised $6.3 million, plans to start service with two to three planes based in the New York area. It eventually hopes divide the country into as many as 13 regions, and have about 75 to 100 planes serving each region. Success may well depend on how well the company's computer systems can manage the planes, maximizing taxi fares each day while minimizing costs. The Burrs have spent three years trying to pull together a plan. Raising money was tough until big companies like GE, Pratt & Whitney, Honda and Toyota started investing in micro-jets. The National Aeronautics and Space Administration has also helped advance the air-taxi concept through a project called Small Aircraft Transportation System that has pushed research on ways to relieve airport and highway congestion, and at the same time change travel patterns and boost small communities. "We have an abundance of airspace, we just don't know how to use it well," said Bruce Holmes, associate director in the airspace programs office at NASA Langley Research Center. Dr. Holmes is also part of a congressionally mandated task force drafting a blueprint for the "Next Generation Transportation System," which has been modeling different scenarios for what transportation will be like in 2025 and beyond. The task force's report is due at the White House in December, and it will endorse air-cab or air-limo services. There are a flock of unanswered questions about air-taxi service, including the issue of whether more planes in the sky will add to congestion, or will, in fact, relieve congestion. What seems clear is that transportation in the future will take many forms, and that our choices in the future may well be better than the ones we have today. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

al-qaeda.net node downtime
by Riad S. Wahby 18 May '04

18 May '04

I'm moving from Massachusetts to Texas, and unfortunately that means that my machine's connectivity will be in a state of flux for a while. Unless someone has a machine with a (fast, static) connection on which they want to let me host the node temporarily, al-qaeda.net will be down for some (unspecified, but hopefully not too long) time while I move. If you do have a place to put the node (I believe measl(a)mfn.org once offered such a machine, but perhaps things have changed), let me know within the next day or two and I'll move everything over before I leave. -- Riad Wahby rsw(a)jfet.org MIT VI-2 M.Eng

2 1

Diffie-Hellman question
by Thomas Shaddack 18 May '04

18 May '04

I have a standard implementation of OpenSSL, with Diffie-Hellman prime in the SSL certificate. The DH cipher suite is enabled. Is it safe to keep one prime there forever, or should I rather periodically regenerate it? Why? If yes, what's some sane period to do so: day, week, month? If the adversary has a log of a passively intercepted DHE-RSA-AES256-SHA secured SSL communication, presuming the ephemeral key was correctly generated and disposed of after the transaction, will the eventual physical retrieval of the DH prime (and the rest of the certificate) allow him to decode the captured log? I am rather inexperienced in this area, don't want to make a mistake, and generation of 2048-bit primes is CPU-hungry enough to not decide to just throw it in without a good reason.

3 2

Re: Reusable hashcash for spam prevention
by Fearghas McKay 18 May '04

18 May '04

and the data that Eric S. Johansson got: -=-=- forwarded text -=-=- this is frustrating. I have run through the exact same calculations and come up with a very different answer. The answers I came up with the show that at worst case, spammers with zombies would almost have enough horsepower to generate enough stamps. one of the difficult aspects of this is that I have not been able to get hard numbers on the number of zombies (it varies by an order of magnitude at least depending on the source) as I said at my MIT anti-spam conference talk, I do agree that proof of work stamps are not a panacea but they are an important component in the "drug cocktail" used to attack spam. that's why I tried very hard to build camram to be able to incorporate other anti-stamp techniques or work in conjunction with them. Another impression of a shortcoming is that they mix and match economic models. I need to go through in greater detail to find out if they have found something I missed. I do know that the cost of a PC and its operation are insignificant to the rate limiting effect of stamp generation. they also did not seem to account for different degrees of cost of doing business. Proof of work stamps will take out the low-end spammers first allowing us to concentrate efforts on higher end, better financed spammers. Fewer targets, easier to hit. They did not account for automatic inflation of postage rates when stamped Spam appears or the addition of a second tier of stamps (i.e. signatures for familiar entities/mailing lists. the problem with impact on low-end machines is important if you always generate stamps. However, for extreme low-end machines (PalmPilot and cellphones) you can always defer the computational load to a for fee service such as the ISP handling your e-mail for the device. With the rest of the low-end machines, stamped generation just takes longer, and background and once you have white listed the entity, you never need to send them a stamp again. on eco damage caused by stamp generation, again, the transition between stamps and white lists based on stamp activity illuminate that problem. It's only commercial entities who want to send you advertising unsolicited that would incur such damage. On the other hand, kill a couple of SUVs and you can generate many more stamps without worry. ;-) on zombies: I think it might be useful if the anti-spam folks spent some time developing zombie hunters and worked with various service providers to identify and shut off those machines. Additionally, ISPs should send Microsoft an invoice for every machine found and repaired. Get enough people together, you could have a substantial lawsuit. After all, the real culprit in the zombie problem is not the owner of the PC. Yes they were stupid, yes they ran something they shouldn't have, but the system should not have failed quite so easily! so am I discouraged? A little bit. I'm going to continue but it's one more naysayer I'm going to have to build arguments against. -=-=- end forwarded text -=-=- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Reusable hashcash for spam prevention
by Fearghas McKay 18 May '04

18 May '04

and the data that Eric S. Johansson got: -=-=- forwarded text -=-=- this is frustrating. I have run through the exact same calculations and come up with a very different answer. The answers I came up with the show that at worst case, spammers with zombies would almost have enough horsepower to generate enough stamps. one of the difficult aspects of this is that I have not been able to get hard numbers on the number of zombies (it varies by an order of magnitude at least depending on the source) as I said at my MIT anti-spam conference talk, I do agree that proof of work stamps are not a panacea but they are an important component in the "drug cocktail" used to attack spam. that's why I tried very hard to build camram to be able to incorporate other anti-stamp techniques or work in conjunction with them. Another impression of a shortcoming is that they mix and match economic models. I need to go through in greater detail to find out if they have found something I missed. I do know that the cost of a PC and its operation are insignificant to the rate limiting effect of stamp generation. they also did not seem to account for different degrees of cost of doing business. Proof of work stamps will take out the low-end spammers first allowing us to concentrate efforts on higher end, better financed spammers. Fewer targets, easier to hit. They did not account for automatic inflation of postage rates when stamped Spam appears or the addition of a second tier of stamps (i.e. signatures for familiar entities/mailing lists. the problem with impact on low-end machines is important if you always generate stamps. However, for extreme low-end machines (PalmPilot and cellphones) you can always defer the computational load to a for fee service such as the ISP handling your e-mail for the device. With the rest of the low-end machines, stamped generation just takes longer, and background and once you have white listed the entity, you never need to send them a stamp again. on eco damage caused by stamp generation, again, the transition between stamps and white lists based on stamp activity illuminate that problem. It's only commercial entities who want to send you advertising unsolicited that would incur such damage. On the other hand, kill a couple of SUVs and you can generate many more stamps without worry. ;-) on zombies: I think it might be useful if the anti-spam folks spent some time developing zombie hunters and worked with various service providers to identify and shut off those machines. Additionally, ISPs should send Microsoft an invoice for every machine found and repaired. Get enough people together, you could have a substantial lawsuit. After all, the real culprit in the zombie problem is not the owner of the PC. Yes they were stupid, yes they ran something they shouldn't have, but the system should not have failed quite so easily! so am I discouraged? A little bit. I'm going to continue but it's one more naysayer I'm going to have to build arguments against. -=-=- end forwarded text -=-=- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0