- cypherpunks-legacy - lists.cpunks.org

Re: Earthlink to Test Caller ID for E-Mail
by An Metet 09 Mar '04

09 Mar '04

Eugen* Leitl <a href="http://leitl.org">leitl</a> writes: > The passphrase locking idear won't fly, but a biometrics-lockable > wallet could. Isn't part of Pd envelope goal establishing a tamper-proof > compartment? We know Pd is evil, but once hardware support is everywhere, > one can as well use it for something positive, for a change. Well, you're preaching to the choir now, son. Of course, it's a choir of one, but c'est la vie. The idea of finding good uses for Trusted Computing has not exactly been gushingly popular around here. In fact, you yourself have been one of the harshest critics of its pseudonymous proponent ("intelligent idiot" sound familiar?). The problem with Palladium as a solution to spam is first, that it is many years away, being part of the Longhorn OS release. The latest official estimates are 2006, rumors are that 2007 is the internal date, and whispers of 2008 exist. Then, it will take years before such systems become widely enough used that spammers can no longer find pre-Palladium systems to serve as a basis for attacks. We're probably talking 2011 at the earliest. We'll need adequate solutions to spam long before then. Secondly, you could use Palladium to arrange that it was impossible to send mail from your computer except via human interaction with your authorized email program. You'd have to set your outgoing mail server to require a password (such auth systems are already in widespread use) and you'd use Pd to lock up the password so that only the mail client could get at it (using the application-specific sealed storage feature). The user wouldn't have to type the password, in fact he wouldn't even have to know there was a password, but he'd have to click the send button himself. (Secure user I/O paths are a Palladium feature.) However, in doing this you give up the ability for ANY other program to send email, at least without the user jumping through a lot of hoops to authorize it. Maybe that's an inherently necessary feature, but there are arguably some "good" programs which can usefully send email, and you'll be tossing out those babies with the spam bathwater. Bye bye MAPI. Further, there's always the risk that the email program itself will be buggy and be able to be tricked into sending something without user authorization. Fortunately, the number of such bugs is likely to be few and confined to just one program, so those can probably be fixed relatively quickly. In short, Trusted Computing could in theory make a computer much more resistant to being used to send spam. It could still be taken over, but the malware wouldn't be able to get to the password necessary for sending mail. You'd need some help from the ISP to require the password and possibly block attempts to use remote mail servers. Of course, if the ISP is this clueful and cooperative, you'd think maybe it could stop you from sending a zillion messages per hour in the first place. The big problem is that TC is many years away. But now that you know how good it will be, I hope you will join me in my never ending battle to bring some perspective to the one-sided "debate" over this technology. There are good uses of TC, and maybe if people weren't so determined to oppose it with their last breath, we might see the technology becoming available a little sooner.

1 0

[FoRK] Outlawing dissent: COINTELPRO resurgence (fwd from jbone@place.org)
by Eugen Leitl 08 Mar '04

08 Mar '04

----- Forwarded message from "jbone @ place. org" <jbone(a)place.org> -----

1 0

Earthlink to Test Caller ID for E-Mail
by R. A. Hettinga 08 Mar '04

08 Mar '04

The "whitelist for my friends" part of "a whitelist for my friends, all others pay cash" seems to be underway... If we really do get cryptographic signatures on email in a way that works, expect 80% of all spam to be blown away as a matter of course. Cheers, RAH ------- <http://www.pcworld.com/resource/printable/article/0,aid,115094,00.asp> PCWorld.com Earthlink to Test Caller ID for E-Mail New systems could fight spam and Internet scams, company says. Paul Roberts, IDG News Service Friday, March 05, 2004 ISP Earthlink will soon begin testing new e-mail security technology, including Microsoft's recently released Caller ID technology, a company executive says. AdvertisementEarthlink will be experimenting "very soon," with "sender authentication" technology including Caller ID and a similar plan called Sender Policy Framework (SPF). The Atlanta-based ISP will be evaluating other e-mail security proposals as well, but is not backing any specific technology, says Robert Sanders, chief architect at Earthlink. Plans to secure e-mail by verifying the source of e-mail messages have garnered much attention in recent months, as the volume of spam has swelled and the number of Internet scams has increased. Spammers and Internet-based criminals often fake, or "spoof," the origin of e-mail messages to trick recipients into opening them and trusting their content. Sender authentication technologies attempt to stop spoofing by matching the source of e-mail messages with a specific user or an approved e-mail server for the Internet domain that the message purports to come from. Different Strategies So far, Earthlink has stayed out of the sender authentication fray while Web-based e-mail services, including Yahoo and Hotmail, and major ISP America Online, have all backed slightly different sender authentication proposals. Yahoo is promoting an internally developed technology called DomainKeys, that uses public key cryptography to "sign" e-mail messages. AOL said in January that it is testing SPF for outgoing mail, publishing the IP (Internet protocol) addresses of its e-mail servers in an SPF record in the DNS (Domain Name System). Finally, Microsoft-owned Hotmail is publishing the addresses of its e-mail servers using that company's recently announced Caller ID standard. Earthlink believes that sender authentication is necessary, and is prepared to support multiple sender authentication standards if necessary. However, the company hopes that one clear winner emerges from the field of competing proposals, Sanders says. "I don't think it's unlikely that we'll see two or three coexisting proposals go into production. We had hopes that they would be able to merge, but I think at this point each standard adds a different function, and we're unlikely to see a merger," he says. Coming Soon? For now, Caller ID and SPF will probably make it into production first, because neither require companies to deploy new software to participate in the sender authentication system, he says. Earthlink is also interested in proposals like Yahoo's DomainKeys, which allows e-mail authors to cryptographically sign messages, enabling recipients to verify both the content of a message and its author. However, DomainKeys is more complicated to deploy than either Caller ID or SPF and requires software changes that will slow implementation, he says. Earthlink is not backing any proposal but is interested in looking at the results of its trial deployments, and those of other organizations. "We have to get real world data from people who have deployed SPF or Caller ID," he says. The company is also a member of the Anti-Spam Technical Alliance, an industry group that includes Microsoft, AOL, Yahoo, Comcast, and British Telecommunications, and continues to participate in meetings and initiatives through that organization, he says. Microsoft's backing of Caller ID and its plans to use that technology for Hotmail tips the scales in favor of that technology, he says. "One factor that determines what you, as an e-mail sender, deploy is the important question of 'Who am I sending mail to?' What the larger [e-mail] receivers deploy is what you're going to support," he says. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

5 9

Chameleon Card Changes Stripes
by R. A. Hettinga 07 Mar '04

07 Mar '04

<http://www.wired.com/news/print/0,1294,62545,00.html> Wired News Chameleon Card Changes Stripes By Mark Baard? Story location: http://www.wired.com/news/business/0,1367,62545,00.html 02:00 AM Mar. 05, 2004 PT Your next wallet may be 8 mm thick and contain the only card you'll ever need. Chameleon Network, in Concord, Massachusetts, plans to replace the stacks of credit, bank and customer-loyalty cards burdening modern consumers with a single, rewritable Chameleon Card, which works just like an ordinary card with a magnetic strip. The Chameleon Card's black strip covers a programmable transducer that mimics the information on the magnetic strips of the cards it is replacing. A new handheld device from Chameleon, the Pocket Vault, programs the Chameleon Card to take the place of any credit card the consumer chooses for a transaction. Shoppers will be able to swipe their Chameleon Cards through the same magnetic readers used in stores and banks today. And instead of reading bar codes off the back of customer-loyalty cards, retail bar-code readers will scan the bar code displayed on the Pocket Vault itself. The Pocket Vault has a slot for the Chameleon Card, but has no buttons or stylus. The device, which will be about half the size of an iPaq pocket PC, will be on sale in stores such as Best Buy and Circuit City as early as January 2005, according to Chameleon CEO Todd Burger. First-time users of the Pocket Vault will read their old credit cards with the device, which stores their information internally and backs it up to an online or local database in case the Pocket Vault is lost or stolen. Each credit card stored on the Pocket Vault is then represented by an icon on the device's touch-screen display. The Pocket Vault also prompts its owners to place their fingerprints on the device's reader pad to create a biometric profile. To use the Chameleon Card for a credit card transaction, a shopper taps the logo on the Pocket Vault's display representing the credit card account he wants to use. Seconds later, the Pocket Vault spits out the shopper's Chameleon Card, with the selected credit card account number, expiration date and logo imprinted on its flexible display, and its transducer reconfigured to work in the store's or bank's magnetic card reader. The Pocket Vault, which Burger expects to sell for less than $200, will also replace ExxonMobil's Speedpass and similar radio-frequency identification applications with its own, built-in RFID chips. But the Pocket Vault promises to do more than prevent slipped discs caused by overstuffed wallets. Its security features should also help safeguard shoppers from the devastation of credit card fraud and identity theft, said Burger. The Pocket Vault will only power up when it detects its owner's fingerprint. And unlike an ordinary credit card, the information stored on a Chameleon Card becomes unreadable (and the transducer inoperable) within 10 minutes. The Pocket Vault also switches off shortly after ejecting a Chameleon Card. That's plenty of time for a shopper to swipe his Chameleon Card through a magnetic reader at the grocery store, but hardly enough for a thief to do much damage to the shopper's credit. "Your worst possible exposure," said Burger, "is that a thief may be able to get in one illegal purchase in the 10 minutes after the card is ejected from the (Pocket Vault)." Major credit companies, banks and other financial institutions are just weeks away from signing an agreement with Chameleon, said Burger. Chameleon has built most of the components of the Pocket Vault system, and it has successfully tested its replacement for the Speedpass. But an analyst warned that, although the Pocket Vault and Chameleon Card may be easy to use, consumers are typically reluctant to change their buying behaviors. They may also balk at the Pocket Vault's strongest security feature, its use of fingerprint authentication. "Consumers still associate biometrics with an invasion of their privacy," said Forrester Research analyst Penny Gillespie. "For better or worse, they see it as intrusive." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Earthlink to Test Caller ID for E-Mail
by Major Variola (ret) 07 Mar '04

07 Mar '04

At 10:56 AM 3/6/04 -0500, Steve Furlong wrote: >No, pseudonymity lets others identify messages on, say c-punks, as >coming from a particular sender. Reputation can work here, even with no >meat-space identity attached. Anonymity means reputation can't work, so >each message has to be taken on its own, with no history to give clues >as to bias or reliability. Correct. Think of pseudonymity as a persistant endpoint of a communication, which thanks to (PK-verifiable) persistance can accrue reputation. An anonymous endpoint is necessarily ephemeral. >I realize that your, RAH's, "book" mostly deals with financial >transactions. In the very narrow domain of transactions which don't >require any trust, anonymity should be as useful as pseudonymity. In the >more general case, I'd think true anonymity would be a handicap. eg, I'm >certainly not going to send my hard-earned e-money to the account of >some untraceable joker in exchange for his promise to deliver me a >week's worth of groceries. Sure you will, if the groceries are in front of you, and the purchase or possession of some of them you don't want associated with anything. In this case the reputation of the grocer and/or your ability to assay the groceries (in meatspace) suffice.

2 1

Autobrinification: Microsoft Gadget Keeps Record of Your Life
by R. A. Hettinga 05 Mar '04

05 Mar '04

<http://biz.yahoo.com/ap/040304/microsoft_visual_diary_3.html> Yahoo! Associated Press Microsoft Gadget Keeps Record of Your Life Thursday March 4, 8:51 pm ET By Allison Linn, AP Business Writer Microsoft's SenseCam Can Be Worn Around Your Neck and Take 2,000 Images REDMOND, Wash. (AP) -- SenseCam, touted as a visual diary of sorts by Microsoft Corp., is designed to be worn around the neck and take up to 2,000 images a 12-hour day automatically. The prototype responds to changes such as bright lights and sudden movements and might one day even respond to other stimuli such as heart rate or skin temperature -- to track medical problems as easily as to record a Hawaiian vacation. And it could eventually link with other technology, such as face recognition to remind wearers when they've seen someone before. As Lyndsay Williams trudged along snow-covered paths and passed by shop windows one recent day in Cambridge, England, so too did her SenseCam -- automatically snapping hundreds of photos along the way. Later that day, Williams could have used those pictures to figure out where she'd left her car keys, or to show a friend the sweater she saw in a window. Perhaps weeks or months later, she might have zipped through them to figure out when she last saw a particular colleague or what bottle of wine she had been drinking that night. Williams and other Microsoft researchers are showcasing dozens of futuristic gadgets and projects to company employees and journalists. The annual TechFest is hosted by Microsoft Research, a unit that delves into everything from super-technical programming applications to tools for developing HIV vaccines. Though Microsoft Research works on security and other issues deemed important today, its head, Rick Rashid, said researchers also try to anticipate what Microsoft developers will want in several years. Some projects never make it into a for-profit product. But many do, including the TabletPC and a smart watch that gets news and other information from a service called MSN Direct. Other technologies could soon be available to the public. Microsoft is looking to license technology for identification cards touted as forge-proof because they combine a regular picture ID with a box that includes a compressed facial image. Another project converts a regular webcam image into low-resolution animation -- stripped of everything but the eyes, lips, nose and eyebrows. It's easier to transmit than full video and can be used with instant messaging to convey emotion and nuance. Rashid, a computer scientist at Carnegie Mellon University before joining Microsoft, is already thinking ahead. One item he has in mind: an alarm clock that figures out when to wake you based on current traffic conditions. http://research.microsoft.com -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Happy Reichstag Day...
by R. A. Hettinga 05 Mar '04

05 Mar '04

>From Writer's Almanac 5 March Literary and Historical Notes: It was on this day in 1933 that the Nazi Party won the majority of the seats in the German parliament, known as the Reichstag, effectively taking control of the country. It was the last free election in Germany the end of World War II. Adolf Hitler had secured the chancellorship after the November 1932 elections, but he still didn't have a majority in the Reichstag, so he set March 5, 1933 as the date for new elections. Six days before the election, the Reichstag building caught fire, and the Nazis used the fire as a symbol of the chaos that they would help correct, though some historians believe that the Nazis set the fire themselves. After the election, Hitler passed a law that gave him absolute power over the country. Just five days after the election, Victor Klemperer, a Jewish professor of romantic languages living in Germany, wrote in his diary: "What, up to election Sunday on March 5, I called terror, was a mild prelude. . . . It's astounding how easily everything collapses. . . . Since [the election,] day after day commissioners appointed, provincial governments trampled underfoot, flags raised, buildings taken over, people shot, newspapers banned, etc., etc. . . . A complete revolution and party dictatorship. And all opposing forces as if vanished from the earth. . . . No one dares say anything anymore, everyone is afraid." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: Vote changing gizmos (paid for by feds)
by Tyler Durden 04 Mar '04

04 Mar '04

"..slow exhale.. thanks for the hit, Bob, that's the good shit.. I miss it." Yeah...I admit it. I snuck down to the cellar and took a few tokes as well. I don't dig all the calls for "needs killing", but every now and then the dude delivers. -TD >From: "Major Variola (ret)" <mv(a)cdc.gov> >To: "cypherpunks(a)al-qaeda.net" <cypherpunks(a)al-qaeda.net> >Subject: Vote changing gizmos (paid for by feds) Date: Wed, 03 Mar 2004 >10:32:28 -0800 > >At 09:54 PM 3/2/04 -0500, R. A. Hettinga wrote: > > >From: Tim May <timcmay(a)removethis.got.net> > > >Or enter a voting place with a "gizmo" and aim it at the electronic > >polling stations. Turn to the little old biddies who run our polling > >places and smile. If they ask what you just did, tell them "I just > >changed the votes. Have a nice day!" Leave before they can call the > >cops. > >..slow exhale.. thanks for the hit, Bob, that's the good shit.. I miss >it. > >Of course, the e-election rubes contribute to the vote changing too: > >Glitches Hinder Casting of Votes >Problems with new electronic systems in Orange and San Diego counties >frustrate voters. Officials call the harm minimal. > >Problems with new electronic voting systems caused some Orange County >residents to vote in the wrong district elections Tuesday and prevented >some >San Diego County voters from casting any ballot at all. > >http://www.latimes.com/news/local/la-me-machines3mar03,1,3468893.story?coll… > > > _________________________________________________________________ Frustrated with dial-up? Lightning-fast Internet access for as low as $29.95/month. http://click.atdmt.com/AVE/go/onm00200360ave/direct/01/

1 0

FLA to use fingerprint scanners on schoolbusses
by Major Variola (ret.) 04 Mar '04

04 Mar '04

The Pinellas school system is ready to approve a new technology that uses student fingerprints to keep track of who is riding school buses. Beginning in the fall, the fingerprint system would identify students as they board and leave. The goal is to ensure they are getting on the right bus and getting off at the right stop. School officials say the $2-million project will save money and dramatically improve safety for students, whose fingerprints will serve as authorization to board and disembark. If the School Board approves the proposal March 9, Pinellas will become one of four Florida school districts in the process of implementing Global Positioning Systems with a student-tracking system. "This is Management 101 in transportation. Now we will have good, factual information that we can use in a very timely manner to make our services as good as humanly possible," said Terry Palmer, the district's transportation director. But some parents and national organizations are concerned about the implications of fingerprinting 45,000 bus riders, some as young as 5. "This is probably a really good idea, but in my mind it was just this terrible feeling, like they're watching my kids wherever they go," said Nancy McKibben, mother of three teenagers at Palm Harbor University High School and president of the school's PTSA. Critics say programs of this nature raise significant privacy concerns and teach students at a young age to accept what amounts to a "Big Brother" surveillance society. "We are conditioning these children to understand that they have no personal space, no personal privacy," said Barry Steinhardt, director of the American Civil Liberties Union's Program on Technology and Liberty. <snip> http://www.sptimes.com/2004/02/28/Tampabay/Have_your_thumb_ready.shtml

1 0

Re: How Tiny Swiss Cellphone Chips Helped Track Global Terror Web
by Major Variola (ret) 04 Mar '04

04 Mar '04

At 10:30 PM 3/3/04 -0500, R. A. Hettinga wrote: ><http://nytimes.com/2004/03/04/international/europe/04PHON.html?hp=&pagewant…> > >The New York Times > >March 4, 2004 > >How Tiny Swiss Cellphone Chips Helped Track Global Terror Web And that, boys and girls, is what traffic analysis is about. You don't need to know the surname of the endpoint of a communication to know that said endpoint is interesting. Also, of course, Al's mistake of thinking that the handset is the endpoint, instead of the SIM. Internet-broadcast stego is best if you don't have a courier and a donkey. ---- See you in Athens

1 0