- cypherpunks-legacy - lists.cpunks.org

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

On Sun, 4 Feb 1996 Pot(a)networking.stanford.edu wrote: > This is not FLAMEpunks. > WHAT??? --and miss all the fun? __________________________________________________________________________ go not unto usenet for advice, for the inhabitants thereof will say: yes, and no, and maybe, and I don't know, and fuck-off. _________________________________________________________________ attila__ To be a ruler of men, you need at least 12 inches.... There is no safety this side of the grave. Never was; never will be.

1 0

Re: C2 and the Worst Case
by an359557＠anon.penet.fi 17 Dec '03

17 Dec '03

>Are you saying that when someone with an anonymous mailbox on c2.org >retrieves his/her mail via a POP3 connection, no log is made of >the originating IP address? It's even worse than that. The IP address/hostname that connects to c2 shows up when you finger that user on c2! Sameer, can you please change that? An anonymous user don't wanna leave a trail as obvious as an IP address. --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

2 1

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Although this particular request was sent to the cypherpunks mailing list, others continue to send requests to my mailbox. >>>>> "Wendy" == "Wendy Fu" <WFU(a)sjulaw.stjohns.edu> writes: Wendy> endWendy Fu, Network Manager Wendy> St. John's University School of Law Wendy> 8000 Utopia Parkway, Jamaica, NY 11439 Wendy> E-Mail Address: wfu(a)sjulaw.stjohns.edu Wendy> Phone: (718)990-1666 I don't know how my address got associated with this list, but please, *do not* send requests about FCPUNX to steve(a)miranova.com. Requests about how to set up Gnus scoring for performing your own filtering of the cypherpunks list are welcome. -- steve(a)miranova.com baur Unsolicited commercial e-mail will be proofread for $250/hour.

1 0

IMC Resolving Email Security Complexity Workshop
by abarrett＠ee.net 17 Dec '03

17 Dec '03

Found this in the box the other day - thought it might be of interest, esp regarding secure email standards. Warmest regards, AJ <---- Begin Forwarded Message ----> Return-Path: dcrocker(a)brandenburg.com Date: Tue, 23 Jan 1996 10:20:50 -0800 To: (potential attendees) From: Dave Crocker <dcrocker(a)brandenburg.com> Subject: IMC Resolving Email Security Complexity Workshop This is a query of your interest in participating in a working meeting. As an initial activity of the newly-formed Internet Mail Consortium, we are hoping to use the coincident timing of EMail World in San Jose and the ISOC Security Conference in San Diego to call for an all-day meeting on the matter of email security. (If you aren't familiar with the IMC, please check out info(a)imc.org or <http://www.imc.org/>.) This note is intended as a pre-announcement and a solicitation for feedback concerning your interest. We'd like to get a sense of the number and range of folks who might/can/will attend. We do not yet have logistics or finances fully worked out, but the timing pressure is tight enough to warrant this letter before the official announcement. Comments about the activity and, especially, an indication of availability, willingness, and (best of all) intention to attend would be highly welcome. Please pass this note on to others who you think are (or should be) interested in email security. Specifics As its first activity, the Internet Mail Consortium proposes to organize a one-day workshop to consider the problem of multiple MIME-based security mechanisms. This is a complicated topic with a long and painful history, but the previous pain is insignificant when compared to what is emerging for vendors and, worse still, for users. Our proposal is to conduct an open meeting with attendance by principals and others involved in this area of work. We will invite the key contributors and solicit additional attendance by vendors, providers, users, and technologists who are concerned with email security. The attendance goal is to have a critical mass of those with the technical expertise and industry involvement to review and debate the requirements, capabilities, and possibilities. The work goal is to seek common ground for a common solution. While we are not overly hopeful that the end of the day will see peace and resolve among the masses, we do hope for a large amount of improved understanding and some amount of convergence. With luck, there will even be improvement in the clarity of constituency for the different technical choices -- that is, a strengthening of the political base for some of the alternatives. We would like to hold the event: Wednesday, 21 February 8:30 am - 5:30 pm (all day) (Near) EMail World event, San Jose Convention Center, CA. This is the last day of EMail World and the day before a two-day ISOC Security conference in San Diego. We propose to structure the meeting with a tight agenda, having a very focused sequence of work on the problem; this is definitely not for general education. Some amount of review is appropriate, but not much. Attendees will be expected to be knowledgeable in the basic technologies, so that only general systems design and specific algorithm choices need to be cited. To help everyone prepare, the Internet Mail Consortium will organize a set of mail-response and Web pages with references and summaries of the current technologies, and will establish a mailing list for exchanges leading up to the meeting. Proposed Agenda Morning Brief descriptions of the candidate solutions Review of the functional and technical requirements Review the extent to which each alternative satisfies the requirements Seek consensus about the requirements Afternoon Haggle about the strengths and weaknesses of the technical alternatives Explore the choices and/or negotiate a preferred solution Those who have worked on this topic in the IETF are quite tired of the whole situation, but the unfortunate reality is that the current product and user choices are quite problematic. We need to continue seeking a viable service. We expect to charge $50 per person, to cover basic costs. I should have more details about this next week. Please do let us know your comments. Thanks! d/ -------------------- Dave Crocker +1 408 246 8253 Brandenburg Consulting fax: +1 408 249 6205 675 Spruce Dr. dcrocker(a)brandenburg.com Sunnyvale, CA 94086 USA http://www.brandenburg.com <---- End Forwarded Message ----> __________________________________________________________________ Out the buffer, | PGP encrypted e-mail preferred. Through the com port, | Finger for Public Key. Over the POTS line, | Also available on a key server near you. Into the NT Box, | Up the fractional T1, | Key ID: 0X457AA6BD Onto the backbone, | Keyprint: 99 C7 17 3B 32 08 3F 17 Nothin' but 'Net. | F4 A9 42 A9 2F BC 39 B1 ------------------------------------------------------------------

1 0

TWP on Indecency Protest
by John Young 17 Dec '03

17 Dec '03

The Washington Post, February 5, 1996, p. A8. Language on 'Indecency' Sparks Telecommunications Bill Protest By John Schwartz Provisions in the overhaul of the nation's telecommunications laws that call for regulating adult materials on the Internet have sparked a storm of anger and protest on that medium. "This is the kind of legislation you'd see from a lot of senators and congressmen who have never logged on," said Michael Godwin, staff counsel for the Electronic Frontier Foundation, a civil liberties group. "The Christian Right thinks they've hit a home run here, but the inning isn't over." The provisions, proposed by Sen. J. James Exon (D-Neb.), have gained momentum with support from religious conservative organizations. The legislation would make it illegal to make "indecent" material available to minors via computer, with penalties of two years in prison and up to $250,000 in fines. Exon called passage last week "a victory for children and families," adding, "We've come to a successful closing of the 'peep show' doors to our youth." President Clinton has said he will sign the bill. Those opposed to the regulations, however, said the "indecency" standard, which has been used in broadcast regulation cases, is too vague and would seriously restrict the potential of the emerging on-line medium. "I am concerned this legislation places restrictions on the Internet that will come back to haunt us," said Sen. Patrick J. Leahy (D-Vt.). He warned that quoting from such works as "Catcher in the Rye" and "Ulysses" in on-line discussions could court prosecution and said that making it illegal to "make available" indecent language would outlaw posting of messages or images that a child might see. "Imagine if the Whitney Museum ... were dragged into court for permitting representations of Michelangelo's David to be looked at by kids." But John McMickle, an aide to Sen. Charles E. Grassley (R-Iowa), said drafters rejected the idea that Userious works of redeeming value" would fall within the law, which he said would apply only to "patently offensive" material. McMickle said the bill "is not a Comstock-type effort to wipe out literature or political speech." The American Civil Liberties Union, the Electronic Frontier Foundation and other organizations are preparing a lawsuit challenging the indecency provisions on constitutional grounds. Other legal actions are in the works. An on-line publication, American Reporter, has announced it will soon publish a column by a Texas judge denouncing the legislation intentionally salted with "indecent" language; Randall Boe, a Washington attorney for the American Reporter, said he would immediately sue after publication. "We want to move promptly to have this statute set aside as unconstitutional," Boe said. "The longer it's in place, the greater the harm done to the Internet and to the First Amendment." Boe's firm, Arent, Fox, Kintner, Plotkin & Kahn, was defense council in the landmark "seven dirty words" case, which set the legal standard for indecent language in broadcasting based on a monologue by comedian George Carlin. Cathleen Cleaver, director of legal studies for the Family Research Council, said yesterday she expected such suits and that her conservative organization, which has pushed for on-line regulation, would fight to uphold it. The Justice Department has stated that the legislation would be vulnerable to attack on constitutional grounds. But in response to a letter from Grassley, Assistant Attorney General Andrew Fois noted last week that the department is defending the indecency standard in legislation "and will continue to defend similar statutes against constitutional challenges, so long as we can assert a reasonable defense consistent with the Supreme Court rulings in this area." -----

1 0

Re: Fair Credit Reporting Act and Privacy Act
by Frank Willoughby 17 Dec '03

17 Dec '03

Verily at 03:05 PM 2/5/96 -0500, Duncan Frissell did write: >At 08:25 AM 2/5/96 -0500, Frank Willoughby wrote: > >>If the Privacy Act were rewritten to be as strict as the BDSG, businesses >>would have a (mandatory) legal requirement to: >> >>o Ensure that personal data is stored properly (by encrypting it, etc) >>o Ensure that personal data is not distributed >>o Ensure that databases are *not* being maintained which describe the >> characteristics of individuals (buying habits, income, property >> ownership, etc) wantonly propagated by marketing (direct mail, >> telemarketing, etc) companies. >> > >Unfortunately, it would also: > >* Require government registration of computers and databases containing >information about people (whether these computers are used by business or >individuals). This eases regulation of computers and future confiscation. Works great in theory, not in practice. Having worked in Germany for 9 years, I can *guarantee* that the German gov't hasn't implemented the above. It may have been a good idea (in their eyes, not mine), but it isn't implementable in a democratic society - it bogs down in the implementation phase). Are you planning on registering every computer system that each person and company has with the gov't? Most sysadmins I know are up to their ears in work and are barely able (if at all) to recognize which users they have on their system, and why they have accounts at all (business justification). This might also get pretty wild when the ISPs get polled in terms of usage. (Compuserve notwithstanding). Gathering the registration data will be a bear to implement - keeping it current will be impossible (for the forseeable future). Besides, this would cast further shadows of "big brother" and remind former "ossies" in the former GDR/DDR & eastern block of days gone by - which they would probably rather not remember. Also, just because Germany tries this approach (and fails), doesn't mean we have to repeat their mistake in this area. > >* Reduce market efficiency by making it harder to match buyers and sellers >(because neither could easily find out about he other) thus causing higher >prices and poorer people. Actually, it would probably increase market efficiency as they would be spending their marketing budget on other appropriate methods which have a higher success-ratio. I don't know what the success rates are of mass-mailings, or tele-marketing, but I doubt if they approach 1% (wild guess). Seriously - what is your first impulse when you reach the phone and find out the caller is a tele-marketer? The annoyance factor is rather high for these. More than likely, this was also the reason that unsolicited mass-faxing of marketing info was forbidden by law a while ago? FWIW, personally, I think many marketing organizations have gone off the deep end in their efforts to try to be effective (to wit: putting logos on clothing, in video games, etc; sponsor's logos in Home Pages, 3-5 minutes of TV commercials every 6-10 minutes of TV (for those rare moments one gets to watch TV (thank heavens for cable TV & CNN)). 8^) > >* Do nothing to protect personal information from the government which >would get to collect more of it than ever in the course of enforcing data >protection laws. > You're assuming this isn't happening now? IMO, that would be a rather naive assumption. Personally, I think that the law should also consider exactly this point. The gov't should have no more access to personal information than it needs to carry on its job - and we as taxpayers should decide how much access they need to have. >If you don't want people to know things about you, don't tell them. Agreed....But, this essentially means giving up your phone, your credit cards, your house, your car, your job, and generally withdrawing from society. Not a particularly viable plan, IMO. The main problem is that the companies do little to nothing about protecting an individual's private data. It isn't any of my business how much money, you make, the amount your home is worth, your credit rating, info about your family (wife, kids, etc), religion, etc - yet, all of these are within the easy access of many individuals who don't have a "need-to-know" of this information. If I don't have a "need-to-know" about this info, I shouldn't be able to access it. > >DCF Of course since we are re-writing the Privacy Act from scratch, we can leave out the items you mentioned & design it the way it should be. Best Regards, Frank

1 0

IEEE Security Symposium Program
by Rich Salz 17 Dec '03

17 Dec '03

Date: Mon, 5 Feb 1996 14:14:22 -0800 To: pem-dev(a)tis.com, ietf-pkix(a)tandem.com, ipsec-owner(a)ans.net >From: Stephen Kent <kent(a)bbn.com> Subject: IEEE Symposium Program Announcement I'm distributing a copy of this year's program to members of these security-oriented WG mailing lists as a means of "getting the word out" to individuals who may be interested in attending this sort of conference. As the chair of the former PEM WG, and current co-chair of the PKI WG, I feel that this announcement is appropriate for these lists, and I hope my fellow IPSEC WG members agree that it is appropriate for that list as well. I apologize in advance for those of you who, like me, will receive multiple copies of this announcement. Steve =========================================================================== 1996 IEEE SYMPOSIUM ON SECURITY AND PRIVACY _/_/ _/ _/ _/ _/ May 6-8, 1996 _/_/ _/_/_/ The Claremont Resort, _/ _/ Oakland, California _/ _/ _/_/ Sponsored by the _/_/_/ IEEE Technical Committee on Security and Privacy _/ _/ In cooperation with the _/ _/ International Association of Cryptologic Research _/_/_/ _/ Symposium Committee _/ Dale M. Johnson, General Chair _/_/_/ _/_/ Stephen Kent, Vice Chair _/ _/ _/ John McHugh, Program Co-Chair _/ _/ _/ George W. Dinolt, Program Co-Chair _/_/_/ _/_/_/ _/ _/ _/ PRELIMINARY PROGRAM _/ _/ _/ Subject to Change _/ _/_/ MONDAY, MAY 6 08:30-09:00 WELCOMING REMARKS: Dale Johnson and John McHugh 09:00-10:30 PANEL: Object Management Group CORBA Security Standard Moderator: Terry Benzel Participants: TBA 10:30-11:00 BREAK 11:00-12:00 COVERT CHANNELS An Analysis of the Timed Z-Channel Ira S. Moskowitz, Steven J. Greenwald, Myong H. Kang Defining Noninterference in the Temporal Logic of Actions Todd Fine 12:00-13:30 LUNCH 13:30-15:00 PANEL: Goals for Computer Security Education Cynthia Irvine, Chair Leslie Chalmers Karl Levitt Steven F. Barnett Jim Schindler Roger R. Schell 15:00-15:30 BREAK 15:30-17:00 FIVE-MINUTE RESEARCH TALKS SESSION Submissions in the form of one-page ASCII abstracts due by email to mchugh(a)cs.pdx.edu no later than 2 April 1996. See http://www.cs.pdx.edu/SP96/ for more information. Abstracts to be distributed at the conference. 18:00-19:30 RECEPTION TUESDAY, MAY 7 09:00-10:30 DOMAIN SPECIFIC SECURITY Security for Medical Information Systems Ross Anderson Discussion Discussants TBA 10:30-11:00 BREAK 11:00-12:00 PROTOCOLS Entity Authentication Dieter Gollmann A Fair Non-repudiation Protocol Jianying Zhou, Dieter Gollmann Limitations on Design Principles for Public Key Protocols Paul Syverson 12:00-13:30 LUNCH 13:30-15:00 DATABASES Ensuring Atomicity of Multilevel Transactions Paul Ammann, Sushil Jajodia, Indrakshi Ray View-Based Access Control with High Assurance Xiaolei Qian Supporting Multiple Access Control Policies in Database Systems Elisa Bertino, Sushil Jajodia, Pierangela Samarati 15:00-15:30 BREAK 15:30-17:00 BIOLOGICALLY INSPIRED TOPICS IN COMPUTER SECURITY An Immunological Approach to Change Detection: Algorithms, Analysis, and Implications Patrik D'Haeseleer, Stephanie Forrest, Paul Helman A Sense of Self for UNIX Processes Stephanie Forrest, Steven A. Hofmeyr, Anil Somayaji, Thomas A. Longstaff Cryptovirology: Extortion Based Security Threats and Countermeasures Adam Young, Moti Yung 17:30-19:30 TECHNICAL COMMITTEE MEETING WEDNESDAY, MAY 8 09:00-10:30 MODELING A Security Model of Dynamic Labeling Providing a Tiered Approach to Verification Simon Foley, Li Gong, Xiaolei Qian A Communication Agreement Framework of Access Control Martin Roscheisen, Terry Winograd Decentralized Trust Management Matt Blaze, Joan Feigenbaum, Jack Lacy Security Properties and CSP Steve Schneider 10:30 11:00 BREAK 11:00 12:30 NETWORKS Security Flaws in the HotJava Web Browser Drew Dean, Dan S. Wallach On Two Proposals for On-line Credit-card Payments using Open Networks: Problems and Solutions Wenbo Man Secure Network Objects Leendert van Doorn, Martin Abadi, Mike Burrows, Edward Wobber Run-Time Security Evaluation (RTSE) for Distributed Applications Cristina Serban, B. McMillin 12:30 12:45 CONCLUDING REMARKS 12:45 SYMPOSIUM ADJOURNS 1996 IEEE SYMPOSIUM ON RESEARCH IN SECURITY AND PRIVACY _/_/ _/ _/ REGISTRATION FORM _/ _/ _/_/ _/_/_/ Name:_______________________________________________ _/ _/ _/ _/ Affiliation:_______________________________________________ _/_/ _/_/_/ Postal Address:_______________________________________________ _/ _/ _/ _/ _______________________________________________ _/_/_/ _/ _______________________________________________ _/ _/_/_/ _/_/ Phone:_______________________________________________ _/ _/ _/ _/ _/ _/ Fax:_______________________________________________ _/_/_/ _/_/_/ _/ _/ _/ Email:_______________________________________________ _/ _/ _/ _/ _/_/ Note: Address information will be distributed to attendees. Please enter the appropriate registration category. Payment must be included and must be by credit card or by check in U.S. dollars, drawn on a U.S. bank, made payable to "IEEE Symposium on Security and Privacy." Dates are strictly enforced by postmark. Advance registration (up to 29 March 1996) ___ Member of the IEEE (Member # ____________, required)........$310.00 ___ Non-Member..................................................$385.00 ___ Full-time Student...........................................$100.00 Late registration (from 30 March 1996) ___ Member of the IEEE (Member # ____________, required)........$370.00 ___ Non-Member..................................................$460.00 ___ Full-time Student...........................................$100.00 Do you wish to present at a poster session or lead an evening discussion? [ ] Yes [ ] No Do you have any special requirements?_________________________________________ Please indicate your method of payment by checking the appropriate box: [ ] Check in U.S. funds drawn on a U.S. bank (PLEASE ENCLOSE WITH THIS FORM) Credit card authorization: (Charges will appear on your statement as made by IEEE COMPUTER SOCIETY) Visa MasterCard American Express Diners Club [ ] [ ] [ ] [ ] Credit Card Number:_________________________________________________________ Card Holder Name:______________________________Expiration Date:_____________ Signature:__________________________________________________________________ Mail registration to: Or FAX this form (CREDIT CARD Stephen Kent REGISTRATIONS ONLY) to: BBN Corporation FAX: +1 617 873-4086 MS 13/2A VOICE: +1 617 873-6328 70 Fawcett Street Cambridge, MA 02140 >>>>SORRY, NO REGISTRATIONS BY EMAIL. NO REFUNDS.<<<< Five-Minute Research Talks Session ================================== At the 1995 Symposium a session of five-minute research talks was held for the first time. These proved very popular, so there will be another session this year. It is being held on Monday to give attendees more opportunities to contact the presenters during the rest of the conference. If you are interested in presenting a five-minute talk, please submit a one-page abstract in ASCII format by email to mchugh(a)cs.pdx.edu no later than 2 April 1996. See http://www.cs.pdx.edu/SP96/ for more information. Abstracts to be distributed at the conference. Please note that the five-minute time limit will be strictly enforced. Evening Sessions ================ The 1996 IEEE Symposium on Research in Security and Privacy will accommodate poster sessions and evening discussions. There will be rooms with blackboards and bulletin boards for interested parties to post presentations on work in progress, recent research results, and innovative proposals, or to lead discussions on topics of current interest. These rooms will be available Monday and Tuesday, May 6 and 7, from 8 p.m. to midnight. If you are interested in posting a presentation or organizing a discussion on a particular topic, please indicate so on the registration form. Hotel Reservations - The Claremont Resort ========================================= The Claremont Resort in Oakland, California is 20 minutes from San Francisco and just over an hour from Napa Valley. It is situated in the Oakland-Berkeley hills overlooking the San Francisco Bay on 22 acres of beautifully landscaped lawns and gardens. Facilities include the Claremont Pool and Tennis Club and The Spa at the Claremont. Oakland Airport is 14 miles from the hotel, or attendees may choose to fly into San Francisco and rent a car. SuperShuttle (+1 510 268-8700) provides service from the San Francisco Airport or the Oakland Airport to the Claremont Resort. The charge is $15 from Oakland Airport and $18 from San Francisco Airport, per person one way. Parking is available at the hotel at a cost of $8 per day for guests and a maximum of $9 per day for non-guests. Hotel reservations must be made under the group name IEEE Symposium on Security and Privacy. The group rate is $102 single, $114 double occupancy, plus 11% tax. The cut-off date for reservations is Saturday, April 6, 1996. Reservations made after this date will be accepted on a space available basis. Reservations must be accompanied by an advance deposit or credit card guarantee. You may cancel your individual reservations up to 72 hours prior to arrival, after which your deposit becomes non-refundable. Please be advised the check-in time is after 3:00 p.m.; check-out is 12 noon. For reservations and information, contact: The Claremont Resort, Ashby and Domingo Avenues, Oakland, CA 94623-0363; Phone: +1 800 551-7266 (7 a.m. to 8:30 p.m., PST) or +1 510 843-3000; Fax: +1 510 549-8582.

1 0

Re: Fair Credit Reporting Act and Privacy Act
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:25 AM 2/5/96 -0500, Frank Willoughby wrote: >If the Privacy Act were rewritten to be as strict as the BDSG, businesses >would have a (mandatory) legal requirement to: > >o Ensure that personal data is stored properly (by encrypting it, etc) >o Ensure that personal data is not distributed >o Ensure that databases are *not* being maintained which describe the > characteristics of individuals (buying habits, income, property > ownership, etc) wantonly propagated by marketing (direct mail, > telemarketing, etc) companies. > Unfortunately, it would also: * Require government registration of computers and databases containing information about people (whether these computers are used by business or individuals). This eases regulation of computers and future confiscation. * Reduce market efficiency by making it harder to match buyers and sellers (because neither could easily find out about he other) thus causing higher prices and poorer people. * Do nothing to protect personal information from the government which would get to collect more of it than ever in the course of enforcing data protection laws. If you don't want people to know things about you, don't tell them. DCF

2 1

Re: FV's blatant double standards
by John Pettitt 17 Dec '03

17 Dec '03

At 09:26 AM 2/4/96 -0500, Simson L. Garfinkel wrote: >At 8:18 AM 1/31/96, Rishab Aiyer Ghosh wrote: >>FV demonstrated, through it's "card sharp" or whatever, that >>real-time transactions are vulnerable to sniffers on the recipient's >>own machine. Of course. We all knew that. But the mistake is to >>assume that FV isn't _equally_ vulnerable to that threat. If you >>can write a trojan that will somehow get privileged access to my >>machine, trap my keystrokes, and identify my credit card number, >>you can certainly write one that will, sitting on my machine: >> "intercept the user's electronic mail, read the confirmation >> message from First Virtual's computers, and send out a fraudulent >> reply" >>(to quote from Simson's article). Simson further quotes FV's Lee >>Stein: "A single user can be targeted, Stein said, but ''it is very >>difficult. . . . There are too many packets moving . . . to too many >>different machines.''" - which is of course equally true for real-time >>Netscape transactions. > >Oh, I think that such a program can be written. However, it would be much >harder to get right, considering all of the different ways that people read >e-mail. > > The code looks something like this: 1) hook into the winsock and look for an FV message in the web data stream, save the ID. 2) now look for an approve/deny/fraud, when you see one you know that the user uses an IP connection for mail and web. 3) Forward the ID to an anon box. 4) Look for outbound FV messages with 'fraud' or 'deny' and change to 'approve'. Clearly this will miss AOL, CI$ etc al but thats not important. The issue is not FV noticing the error, they will, it's how long it takes and how much you can steal in the interim. There is a Helen Keller quote I'm rather fond of which starts: "Security is mostly a superstition ..." *If the machine is not secure all bets are off* The most likly failure vector for this attack is that so few people use FV :-) John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch

3 2

Fair Credit Reporting Act and Privacy
by tcmay＠got.net 17 Dec '03

17 Dec '03

[I urge people to put thread names in the subject lines, and not just leave the subjects as "Re:" or "Your mail." I have added a subject line.] At 5:58 AM 2/5/96, Karl Ike wrote: >It is impossible to get changes in the Fair Credit Reporting Act in the >traditional way. Credit reporting agencies have far too much personal >information that is passed out with incrediable ease at the consumers expense. > >I have a suggestion! > >Today, with TRW, Equifax and TransUnion's vast network, it is easy to obtain >anyone's credit report from various sources. Do you think if someone, >outside of the USA, obtained the credit reports on half, maybe all, of the >US Senators, congressmen, judges, etc, and published them in their entirity, >on the internet, from outside the US, would get their attention? Then there >would be changes, overnight, protecting the right of privacy! Let them >become the victim of credit reporting agencies once and shit will happen >overnight. "Protecting the right of privacy"? If I tell Joe Bob that you welshed on a debt made in the past, something that the person you welshed on has informed me of, how is this a violation of your right of privacy? Better yet, abolish the laws about so-called "Fair Credit Reporting." If Tim's Pretty Good Credit Reporting knows that Joe Blow filed for bankruptcy in 1975, by what right should men with guns come to his file cabinets and announce that he may not reveal true information that is older than, say, 8 years? Facts are facts. Not just for 8 years, or even 20 years. Debts incurred 30 years ago and not paid may still be useful bits of information in deciding whether to extend credit to a person. And even possibly untrue things are not the main justification for the FCRA. The FCRA is _not_ primarily designed to correct wrong information, but to place time limits on correct information. It limits speech. And it interferes with rational economic decisions. Fortunately, strong crypto and cyberspatial data havens will make enforcement of the FCRA increasingly difficult. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0