- cypherpunks-legacy - lists.cpunks.org

Overview: Payments Systems and Security 18/19th June 2004
by R. A. Hettinga 18 Apr '04

18 Apr '04

<http://www.enhyper.com/paysec/> Enhyper - Payment Systems and Security 04 - June 18/19 2004 Overview Agenda Presentations Venue Travel Accommodation Online Registration Contact Details Email: events(a)enhyper.com Tel: +44 (0) 870 1996774 Payments Systems and Security 18/19th June 2004 Enhyper are proud to announce a conference with a difference, to be held at The Innholders Hall on 18/19th Jun 2004. Overview At PaySec2004 we've brought together payment systems developers, security architects, operational risk practitioners and academics to address all aspects of technology, security and operation in the payment systems domain, both present and future state. The best of the Internet versus the best of the City. Short key technical demonstrations will be interspersed to bring context to the challenges and the solutions. Rump sessions will allow you to contribute your experiences for the benefit of others. Headline Topics The conference will cover many crucial topics in the Payment Systems field: * Payment Transformations and integration: a revolutionary code generation approach * Settlement to T+0 and RTGS * Programmatic electronic contract negotiation * Systems Performance Monitoring: Service Level Compliance * Extensible Electronic Currency Frameworks * SSL/SSH based infrastructure to enhance federated security * Payment Systems as Critical National Infrastructure * Automated System Risk Audits for Operational Risk Compliance * Strategies for Defending against Infrastructure Attacks * Reusable Security Architecture via pre-risk assessed patterns Conference Ethos Security of payments is more than the application of cryptography over the the Internet, and more than a secured private network between banks: it is the application of all of the disciplines - technology, a legal framework, risk analysis and mitigation, insurance, good management practice and strong accounting. Our desire is to bring the following four streams together in one conference in the context of applied security: Applications, Infrastructure, Risk and Research. Applications Blending today's payment systems providers with state-of-the-art payment technology developers combines experience with innovative technology. * An Escape From Hard-Coded Application Integration: Demonstration and discussion of a highly scalable message format definition, transformation and transport modelling toolset which solves data integration issues for legacy systems, message-orientated middleware and XML based messaging systems. * Electronic Payments and Contracts: Live demonstration and discussion of several payments frameworks and electronic contract mechanisms. Discussion of operational aspects and how new financial instruments can be supported. Infrastructure Computer infrastructure is changing from service-based to web service delivery. To deliver these services, Grid Infrastructures offer enhanced platform utilistation and massive scalability. * From Client/Server to Grid-based Web Services: Government see grid computing as the powerhouse behind a new economy. We meet the Director of the UK Government's initiative. * Application Security and Risk Assessment: Security is no longer that last final step before production. Threat analysis must be considered on all levels, not just any single one. Risk assessment is no longer a subjective, paper based exercise. Many organisations face the challenge of measuring their level of security, their level of risk and their progress in securing their IT resources. We present a framework for the reuse of security architecture patterns which streamlines the whole development process and greatly enhances application security and awareness. Automated risk assessment techniques will be demonstrated in a revolutionary approach to network vulnerability. Risk The 21st century has brought risks and attacks never previously thought realistic outside a Hollywood movie, but now have to be analysed, quantified, and prepared for. * Payment Systems as Critical National Infrastructure: Discussion of the threats posed by CNBR Research Regulatory and billing systems that assume one simple security model are already under strain, and will need to accomodate the new efficient security models of micropayments. The entry of the mobile phone into the payments platform will lead to increasing convergance pressures on Banks and Telcos. The Event The conference is held on a Friday and Saturday in a friendly, relaxed, cooperative environment, led by experienced payment industry professionals in a venue which combines the traditional with the modern - one of the City of London's oldest Livery halls with a WiFi network connected to the internet. There'll be opportunity to share your experience and hear that of others at one of our five minute rump sessions. Copyright ) 2004 Enhyper Ltd. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Payment system and security conference
by R. A. Hettinga 18 Apr '04

18 Apr '04

--- begin forwarded text

1 0

Re: [Community_studios] Apple's jackboots step on PlayFair in India
by proclus＠gnu-darwin.org 18 Apr '04

18 Apr '04

woohoo! here is another one. http://p2pnet.net/story/1193 http://www.p2pnet.net/playfair/playfair-0.4.tar.gz Regards, proclus http://www.gnu-darwin.org/ -- Visit proclus realm! http://proclus.tripod.com/ -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GMU/S d+@ s: a+ C++++ UBULI++++$ P+ L+++(++++) E--- W++ N- !o K- w--- !O M++@ V-- PS+++ PE Y+ PGP-- t+++(+) 5+++ X+ R tv-(--)@ b !DI D- G e++++ h--- r+++ y++++ ------END GEEK CODE BLOCK------

1 0

Payment system and security conference
by lynn.wheeler＠firstdata.com 18 Apr '04

18 Apr '04

reminder from this month's enhyper newsletter, 2004 payment system and security conference http//www.enhyper.com/paysec/ also mention financial cryptography blog ... by some of the same people http//www.financialcryptography.com/ they also have short blurb on: http://www.bitpass.com/ enhyper also discovered norm hardy and some of his papers: ... the digital silk road http//www.cap-lore.com/Economics/DSR/ http//www.agorics.com/Library/dsr.html norm's past include LLNL, 360s, vm/370, secure operating systems and secure transactions: http://cap-lore.com/ and secure operating systems at tymshare with gnosis and keykos: http//www.agorics.com/Library/keykosindex.html http//www.cis.upenn.edu/~KeyKOS/ .... and there is EROS -- extremely reliable operation system (outgrowth of keykos) http//www.cis.upenn.edu/~eros/ ... note above mentions looking at getting an EAL7+ evaluation for eros. when MD bought tymshare they were looking at spinning off a number of things. i was brought in to do a technical audit of gnosis as part of its spin-off as keykos. they were also spinning off Doug Engelbart who was working at Tymshare at the time ... tymshare was running doug's "augment" system on pdp10 ... http//www.superkids.com/aweb/pages/features/mouse/mouse.html http//sloan.stanford.edu/MouseSite/dce-bio.htm http//www.invisiblerevolution.net/engelbart/glossary/augment_nls.html http//www.sciencedaily.com/encyclopedia/nls and total topic drift, i've got lots of references to vm/370: http://www.garlic.com/~lynn/subtopic.html#545tech http://www.garlic.com/~lynn/subtopic.html#fairshare http://www.garlic.com/~lynn/subtopic.html#wsclock -- Internet trivia, 20th anv: http://www.garlic.com/~lynn/rfcietff.htm --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Payment system and security conference
by lynn.wheeler＠firstdata.com 18 Apr '04

18 Apr '04

reminder from this month's enhyper newsletter, 2004 payment system and security conference http//www.enhyper.com/paysec/ also mention financial cryptography blog ... by some of the same people http//www.financialcryptography.com/ they also have short blurb on: http://www.bitpass.com/ enhyper also discovered norm hardy and some of his papers: ... the digital silk road http//www.cap-lore.com/Economics/DSR/ http//www.agorics.com/Library/dsr.html norm's past include LLNL, 360s, vm/370, secure operating systems and secure transactions: http://cap-lore.com/ and secure operating systems at tymshare with gnosis and keykos: http//www.agorics.com/Library/keykosindex.html http//www.cis.upenn.edu/~KeyKOS/ .... and there is EROS -- extremely reliable operation system (outgrowth of keykos) http//www.cis.upenn.edu/~eros/ ... note above mentions looking at getting an EAL7+ evaluation for eros. when MD bought tymshare they were looking at spinning off a number of things. i was brought in to do a technical audit of gnosis as part of its spin-off as keykos. they were also spinning off Doug Engelbart who was working at Tymshare at the time ... tymshare was running doug's "augment" system on pdp10 ... http//www.superkids.com/aweb/pages/features/mouse/mouse.html http//sloan.stanford.edu/MouseSite/dce-bio.htm http//www.invisiblerevolution.net/engelbart/glossary/augment_nls.html http//www.sciencedaily.com/encyclopedia/nls and total topic drift, i've got lots of references to vm/370: http://www.garlic.com/~lynn/subtopic.html#545tech http://www.garlic.com/~lynn/subtopic.html#fairshare http://www.garlic.com/~lynn/subtopic.html#wsclock -- Internet trivia, 20th anv: http://www.garlic.com/~lynn/rfcietff.htm --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Behavior pattern recognition
by Thomas Shaddack 18 Apr '04

18 Apr '04

http://us.cnn.com/2004/TRAVEL/04/16/airline.behavior.ap/ http://www.usatoday.com/travel/news/2004-04-16-behaviorscan_x.htm http://news.bostonherald.com/national/view.bg?articleid=1780 Carnival Booth, anyone? Besides, it's matter of time until the checklists "leak" and the "adversaries" adjust their behavior accordingly. (What would be the next move then?). The "anyone observing security methods" is the funniest part. I am not certain how one can avoid it, given the amount of time to kill that's usually present on the airports (is killing time a terrorist act?) - sooner or later all the tiles on the floor and the panels on the ceiling are counted, and what's left to watch is the guards and the cameras. Wouldn't it be less prone to false positives if they would optimize the airport operations so people won't have to stay there long enough to get bored and start noticing the security holes?

1 0

E-mail lists choke on spam
by R. A. Hettinga 17 Apr '04

17 Apr '04

<http://news.com.com/2102-1038_3-5190826.html?tag=st.util.print> CNET News http://www.news.com/ E-mail lists choke on spam By John Borland Staff Writer, CNET News.com http://news.com.com/2100-1038-5190826.html Story last modified April 13, 2004, 1:36 PM PDT For close to half a decade, entertainment executives and copyright-averse college students have debated the future of technology side by side on the "Pho" e-mail list. Now that forum is under siege. Membership is falling, even though subscription requests are rising. In large part that's because so many e-mail addresses are choked with spam, or have fallen incommunicado behind bulk mail filters, and have had to be eliminated. Recently, whole companies--including Time Warner and CNET Networks, publisher of News.com--have periodically started bouncing the list's messages. That's not only frustrated subscribers who miss out on their daily dose of digital music dish; network administrators say they sometimes have to clear their servers of thousands of returned messages a day. ----- What's new: E-mail lists, long one of the most popular and useful online tools, are increasingly in danger of becoming collateral damage in the Net's war on unsolicited bulk mail. Bottom line: Many e-mail groups are responding by changing their format to Web-based bulletin boards or augmenting their discussions with RSS feeds, a popular content-distribution format used by bloggers and news sites. --------- Pho isn't alone. E-mail lists in general, long one of the most popular and useful online tools, are increasingly in danger of becoming collateral damage in the Net's war on unsolicited bulk mail. "Our cures for some of these diseases are boomeranging and killing us," said Jim Griffin, chief executive officer of Cherry Lane Digital and co-founder of the Pho list. "What we're discussing is the passing of a medium. It is alarming to me that one of the most basic features of the Net has been threatened so badly." It's far too early to write an obituary for e-mail lists. The 30-year-old medium has confronted crises before and has been reborn with the help of clever programmers and new technology. E-mail advocates say this process is already under way, as companies and list administrators figure out both how to keep spam under control without so much of an effect on mail lists and other desired e-mail messages. "In the early days of the Net, we built a nervous system, but nobody built an immune system," said Marc Smith, a sociologist who studies communities such as Usenet and e-mail groups for Microsoft's research division. "What we're seeing now is the emergence of an immune system." Nevertheless, it is undeniable that Pho and other groups are facing serious hurdles that could change the way the medium operates forever. It's almost impossible to estimate how broad the e-mail list community runs. Experts say there are certainly millions, perhaps tens of million of lists. They cover every conceivable topic, from the most arcane scientific topics to the most basely sexual. Some have only a few subscribers, while others have as many as tens of thousands. The growing problems are familiar to anyone with an e-mail box. The primary culprits are the avalanches of spam cluttering mailboxes with Viagra advertisements and XXX photos. The energy required to clear through that digital underbrush alone has taxed many people's patience for e-mail discussions, experts say. But the response to the spam assault also has helped undermine mail lists. Many people move e-mail addresses routinely, creating dead boxes that bounce messages back to list administrators. Many people use Web-based mailboxes for e-mail list subscriptions, and these can quickly fill up with spam or even legitimate messages, again bouncing messages back to their original servers, filling administrator mailboxes and requiring substantial time to review and clear. On the flip side are spam filters such as the popular SpamAssassin, used by many corporations. These routinely catch messages sent simultaneously to a large number of people, mistaking list messages for bulk advertisements. Subscribers have little or no way to tell that their mail is not getting through, or that, in some cases, they have been unsubscribed completely from a list. Faced with these growing issues, many e-mail groups are changing their format to Web-based bulletin boards or augmenting their discussions with RSS (Really Simple Syndication) feeds, a popular content-distribution format used by bloggers and news sites. Internet pundit Clay Shirky, who teaches a graduate course in networking at New York University, said he's close to pulling the plug on his mailing list altogether in favor of RSS. "The viability of mail lists is rapidly declining," Shirky said. "Fewer people are reading in e-mail directly. It's getting clear that the ordinary Web plus RSS feeds are better." Periodic crises This isn't the first time e-mail lists have flirted with collapse, however. The first e-mail was sent by Ray Tomlinson in 1971, a simple test message to himself. His message evolved almost immediately into broader discussions, although only a few remained active for long. By the close of the 1970s, there were 17 public e-mail discussion lists on the ARPAnet, the precursor to today's Internet. By 1982, there were 44, according to at least one account. Others were springing up by the dozens on private academic networks such as PLATO and BITNET. But as vibrant as these were, their own inefficiencies led to a crisis almost as dire as today's. At that time, lists were mostly run by hand, which meant that an actual human being had to respond to subscription requests and other problems. When these lists proliferated, it often took weeks for requests to be fulfilled. Adding to problems were traffic jams caused by the era's still-scarce bandwidth. Single messages were sent out to hundreds of addresses at a time, clogging transatlantic lines so badly that e-mails between Europe and the United States sometimes took a week to be delivered. Some people on the lists started discussing whether e-mail discussion groups should be banned altogether. The crisis soon passed, however. In 1986, a BITNET programmer in Paris named Eric Thomas wrote a tool called Listserv that automated the administrator's task of managing subscriptions. It also made message distribution more efficient, virtually eliminating the crippling traffic jams. The tool was quickly adopted elsewhere, and the number of e-mail lists on academic networks exploded. A half-decade later, an American programmer named Brent Thomas started looking around for tools to help automate Internet-based mailing lists. He found Listserv, but decided he could write a new one as quickly as he could learn the old tool, and in a week created a program called Majordomo and a scant 3,000 lines of code. Both tools are still widely used today. Over the ensuing decade, the shape of mailing lists has remained largely the same. Web-based services such as E-Groups, which Yahoo later bought and turned into Yahoo Groups, attracted hundreds of thousands of discussions, but the fundamental idea hasn't changed much. An Internet immune system That's why many in the e-mail list community think they'll survive, despite today's headaches. There is simply nothing that substitutes for the immediacy and simplicity of e-mail, advocates say. "I don't really see too many people dropping off lists," said Chapman, whose Great Circle Associates consulting firm still manages the Majordomo software. "Mailing lists serve a very valuable purpose. They come to you. Certain Web sites I do check, but you have to go check." Administrators are finding ways around the problems. Spam filters on list servers, and tools that ensure only list members can send to the list, help keep unwanted e-mail to a minimum. Automatic unsubscribe tools are helping reduce the amount of unwanted bounced messages. E-mail software itself is getting better at filtering messages into folders, so that all list messages can be segregated away from spam. Web mail services such as Yahoo and Hotmail also support this feature. Future-looking projects hold out hope of better improvements. Some programmers are working on pulling RSS and e-mail into the same interfaces, eliminating what appears to be competition between the mediums today. Others are looking at ways to help people wade through the morass of online discussions more easily. Microsoft's Smith has written about new interfaces that would help highlight important or heated conversations among thousands of messages, for example. These and other innovations, such as better tools to deal with the problems of spam and spam filters, will help keep e-mail lists and communities alive, he said. "Machines have gotten us into this problem, and they're going to have to get us out," Smith said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Usenet Dead. Film at 11
by R. A. Hettinga 17 Apr '04

17 Apr '04

<http://www.wcnc.com/sharedcontent/nationworld/nationprint/041704ccdrnatporn…> WCNC.com | News for Charlotte, N.C. | Nation/World Saturday April 17, 2004 8:09 p.m. Seized Web servers raise freedom concerns By DAVID B. CARUSO / Associated Press PHILADELPHIA - For $9.95 a month, a small company offered access to a search tool that would scour electronic bulletin boards for millions of "uncensored" movies and photographs and serve up "an all-you-can-eat taste of 'the Internet gone wild!"' Voicenet Communications executives said they didn't know users also were using their system to access child pornography until January, when authorities seized the computer servers that ran their "QuikVue" search program, a lawyer for the company said. Despite a burgeoning amount of online child pornography, prosecutors have been cautious in their handling of Internet companies that don't manufacture or distribute illegal content themselves, but do make it easier for customers to see material posted by others. The seizure of Voicenet's servers in suburban Ivyland was the first time a Pennsylvania law enforcement agency has stopped an Internet firm from facilitating access to child porn, lawyers said. No criminal charges have been filed but investigators said in court filings that they want to examine lists of QuikVue subscribers. It also was a rarity nationwide. Some free speech advocates have accused prosecutors of ignoring a federal law that generally protects Internet service providers from criminal liability when their systems are used to disseminate child pornography without their knowledge. Voicenet claimed in a federal lawsuit filed last month that QuikVue merely allowed customers to easily access files posted in discussion groups on Usenet, an enormous system of electronic bulletin boards. The company's attorney, Mark Sheppard, said the company had no control over what people posted to the groups, and was no more criminally liable for their actions than other hosts of Usenet material. "This case has very important implications, from a First Amendment standpoint and from a privacy standpoint," Sheppard said. "If Internet service providers are going to have to worry about getting their servers seized, then you have to wonder whether they can continue to offer access to Usenet." The firm asked a federal judge last week to order the government to return its equipment. Lawyers for Pennsylvania Attorney General Gerald Pappert and two county district attorneys involved in the investigation argued that the court should not intervene in an active criminal probe. The judge did not indicate when she would rule. The case has few precedents. Investigators in New York pressed criminal charges against a pair of Internet service providers in 1998 for allegedly failing to block access to Usenet groups that contained child pornography. One firm, Buffalo-based BuffNet, pleaded guilty to a misdemeanor charge of criminal facilitation in 2001 and paid a $5,000 fine. "The case helped establish that when an Internet service provider becomes aware of child pornography being on its system, it has an obligation to do something about it," said Paul Larrabee, a spokesman for New York Attorney General Eliot Spitzer. A federal judge imposed a tougher penalty on a Texas couple convicted in 2000 of operating a service that gave subscribers passwords to overseas Web sites containing child pornography. A judge sentenced Thomas Reedy to life in prison. His wife, who helped run the business, got 14 years. Prosecutors said that even though the couple didn't post child pornography themselves, they knowingly facilitated access to it and shared their profits with the Web sites responsible for the illegal material. John Morris, an attorney with the Center for Democracy and Technology, a civil liberties group, said companies like Voicenet can block access to improper Usenet content, but don't always know what people are posting on their system. "It's one thing to seize a server that is being used for a single Web site that is illegally serving up child pornography," Morris said. "But to go into an ISP and seize servers that have millions of postings on them that are perfectly lawful, with no real evidence that the ISP was intentionally doing anything criminal, is a much more questionable situation." --- On the Net: Voicenet Communications: http://www.voicenet.com Center for Democracy and Technology: http://www.cdt.org -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Re: Fortress America mans the ramparts
by Major Variola (ret) 17 Apr '04

17 Apr '04

At 08:54 AM 4/10/04 -0700, Steve Schear wrote: >> Wolfe is also scathing of steps taken post September 11 to protect >>airports. "It's not real security. This is eyewash security. This is for >>public consumption so that people think that they are doing something." > >Several years ago, on this list I belive, I coined a word to describe such >foolery - securisimilitude. "Security theatre" is perhaps as good, and fewer syllables besides. "Fortress America" might be "Maginot-Asylum America" more precisely. PS: what happens if your passport's chip doesn't work? Do you get sent back and the airline fined $10K? Do you wait extra time while the still-readable passport number indexes your record online? How much extra time? (Anyone have experience with domestic eg traffic pigs discovering that your magstrip is corrupted?) Are all chip biometrics encrypted with the same key? How much does that cost on BlackNet these days? How much extra should our Seals Flaps and Documents dept charge? ---- Do you need an air quality management district permit to burn hostages?

2 1

Idea: Offshore gambling as gateway between real and electronic money
by Thomas Shaddack 17 Apr '04

17 Apr '04

Adoption of anonymous e-money is to great degree hindered by the lack of infrastructure to convert this currency to/from "meatspace" money. However, there is possible a method, using offshore gambling companies. There may be a special kind of "gamble", that looks from the "outside" like regular betting, but where the participants to certain degree know the betting results, allowing use of their "e-money" to gain insight into the "game" - using "meatspace" money as a bet and "e-money" to buy the knowledge of cards/numbers/whatever in the value of the e-money that allows a sure win of that amount. In other words: Without use of the e-money, the game is a "normal" game, with appropriate probability of win. With the e-money, the player can buy the 100%-certain win of a given value. Conversely, a "rigged game" with 0%-probability of win could be used for depositing the "real" money and converting them to "e-money". Is this approach possible? Is this approach feasible? Where are the hidden problems there?

2 1